9eb3c49000000400000000fd003e"], 0x44}}, 0x0) add_key(&(0x7f0000000080)='logon\x00', &(0x7f0000000100)={0x73, 0x79, 0x7a, 0x1}, &(0x7f0000001240), 0x0, 0xfffffffffffffff8) get_mempolicy(&(0x7f0000000000), &(0x7f00000001c0), 0x1ff, &(0x7f0000fff000/0x1000)=nil, 0x3) setsockopt$sock_int(r0, 0x1, 0x3c, &(0x7f0000d4effc)=0x1, 0x4) connect$inet(r0, &(0x7f0000000000)={0x2, 0x4e20, @dev={0xac, 0x14, 0x14, 0x18}}, 0x10) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f00000001c0)='tunl0\x00', 0x5) sendto$inet(r0, &(0x7f00006d1fd4)="db", 0x1, 0x4000010, &(0x7f00004daff0)={0x2, 0x0, @loopback, [0x4000000]}, 0x10) [ 1499.802578] binder: 13409:13411 BC_REQUEST_DEATH_NOTIFICATION invalid ref 4 13:16:38 executing program 5: r0 = syz_open_dev$binder(&(0x7f00000021c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000002340)={0x34, 0x0, &(0x7f0000002240)=[@request_death={0x400c630e, 0x4, 0x4}, @increfs={0x40046304, 0x4}, @increfs_done={0x40106308, 0x0, 0x3}, @increfs={0x40046304, 0xa0010000}], 0x77, 0x0, &(0x7f00000022c0)="b3cd0976d8e2af743c6f523efe14fd20c3c3dd2572734282a761e1b4304e2599c85f198cc82bd5d0c74c4edca2f9ea7b875ff7047ec0784fbb354e15fd3f7d837f533597d5082692a6f2fb748da3cc4157188f7f2a5477ded56f72f5b75c96872db429e44b8fcd781d96dead77a0b58b7af9085a208a22"}) [ 1499.905929] binder: 13409:13411 BC_REQUEST_DEATH_NOTIFICATION invalid ref 4 13:16:38 executing program 7: r0 = syz_open_dev$binder(&(0x7f00000021c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = openat$autofs(0xffffffffffffff9c, &(0x7f0000000000)='/dev/autofs\x00', 0x101000, 0x0) ioctl$DRM_IOCTL_WAIT_VBLANK(r1, 0xc018643a, &(0x7f0000000040)={0x78000001, 0x1, 0x12}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000002340)={0x18, 0x0, &(0x7f0000002240)=ANY=[@ANYBLOB="0e630c400400000000000463044004000000000000000000"], 0x0, 0x0, &(0x7f00000022c0)}) write$RDMA_USER_CM_CMD_CREATE_ID(r1, &(0x7f0000000100)={0x0, 0x18, 0xfa00, {0x4, &(0x7f00000000c0)={0xffffffffffffffff}, 0x111, 0x3}}, 0x20) write$RDMA_USER_CM_CMD_SET_OPTION(r1, &(0x7f0000000140)={0xe, 0x18, 0xfa00, @id_resuseaddr={&(0x7f0000000080)=0x1, r2, 0x0, 0x1, 0x4}}, 0x20) 13:16:38 executing program 4: perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e5}, 0x0, 0x0, 0xffffffffffffffff, 0x0) futex(&(0x7f000000cffc), 0x4, 0x0, &(0x7f0000fd7ff0), &(0x7f0000000040), 0x0) 13:16:38 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r0, &(0x7f0000942000)={0x2, 0x4e20, @multicast1}, 0x10) sendmsg$key(0xffffffffffffffff, &(0x7f0000f56000)={0x0, 0x0, &(0x7f00008feff0)={&(0x7f0000000500)=ANY=[@ANYBLOB="020300090a1500000000000000000000030006190000000002000000e0000001003f00000000000002000100e625aa66dcef85847e479eb3c49000000400000000fd003e"], 0x44}}, 0x0) add_key(&(0x7f0000000080)='logon\x00', &(0x7f0000000100)={0x73, 0x79, 0x7a, 0x1}, &(0x7f0000001240), 0x0, 0xfffffffffffffff8) get_mempolicy(&(0x7f0000000000), &(0x7f00000001c0), 0x1ff, &(0x7f0000fff000/0x1000)=nil, 0x3) setsockopt$sock_int(r0, 0x1, 0x3c, &(0x7f0000d4effc)=0x1, 0x4) connect$inet(r0, &(0x7f0000000000)={0x2, 0x4e20, @dev={0xac, 0x14, 0x14, 0x18}}, 0x10) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f00000001c0)='tunl0\x00', 0x5) sendto$inet(r0, &(0x7f00006d1fd4)="db", 0x1, 0x4000010, &(0x7f00004daff0)={0x2, 0x0, @loopback, [0x11]}, 0x10) [ 1500.132103] binder: 13424:13429 BC_REQUEST_DEATH_NOTIFICATION invalid ref 4 [ 1500.155119] binder: 13427:13432 BC_REQUEST_DEATH_NOTIFICATION invalid ref 4 [ 1500.181782] binder: 13427:13432 unknown command 0 [ 1500.198428] binder: 13424:13429 BC_INCREFS_DONE u0000000000000000 no match [ 1500.212478] binder: 13427:13432 ioctl c0306201 20002340 returned -22 [ 1500.245568] binder: 13427:13432 BC_REQUEST_DEATH_NOTIFICATION invalid ref 4 [ 1500.277366] binder: 13427:13432 unknown command 0 [ 1500.297755] binder: 13427:13432 ioctl c0306201 20002340 returned -22 13:16:38 executing program 1: r0 = socket$netlink(0x10, 0x3, 0x8000000004) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_TCP_CONGESTION(r1, 0x6, 0xd, &(0x7f0000000180)='vegas\x00', 0x6) bind$inet6(r1, &(0x7f00001fefe4)={0xa, 0x4e22}, 0x1c) sendto$inet6(r1, &(0x7f0000000100), 0x8d2d601e8976aa5, 0x20000004, &(0x7f000031e000)={0xa, 0x4e22}, 0x1c) writev(r0, &(0x7f0000000100)=[{&(0x7f0000000000)="580000001400192340834b80040d8c560a067f6033ff81004e220000000058000b4824ca944f64009400050028925aa8000000000000008000f0fffeffff09000000fff5dd00000010000100000c0900fcff0000040e05a5", 0x58}], 0x1) 13:16:38 executing program 3: r0 = perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = socket$alg(0x26, 0x5, 0x0) bind$alg(r1, &(0x7f0000000200)={0x26, 'hash\x00', 0x0, 0x0, 'sha1\x00'}, 0x58) r2 = accept$alg(r1, 0x0, 0x0) ioctl$PERF_EVENT_IOC_QUERY_BPF(r0, 0xc008240a, &(0x7f0000000180)={0x3, 0x0, [0x0, 0x0, 0x0]}) sendmmsg(r2, &(0x7f0000007f00)=[{{&(0x7f00000056c0)=@can, 0x3000, &(0x7f00000000c0)}}, {{&(0x7f0000005900)=@pppoe={0x18, 0x0, {0x0, @link_local, 'syzkaller0\x00'}}, 0x80, &(0x7f0000007ac0), 0x1a9, &(0x7f0000007b00)}}], 0x3fffffffffffe0d, 0x0) openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000140)='/dev/sequencer2\x00', 0x80840, 0x0) chown(&(0x7f0000000340)='./file0\x00', 0x0, 0x0) r3 = syz_open_dev$sndpcmc(&(0x7f00000000c0)='/dev/snd/pcmC#D#c\x00', 0x0, 0x0) ioctl$ASHMEM_SET_NAME(r3, 0x41007701, &(0x7f0000000100)='syzkaller0\x00') 13:16:38 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r0, &(0x7f0000942000)={0x2, 0x4e20, @multicast1}, 0x10) sendmsg$key(0xffffffffffffffff, &(0x7f0000f56000)={0x0, 0x0, &(0x7f00008feff0)={&(0x7f0000000500)=ANY=[@ANYBLOB="020300090a1500000000000000000000030006190000000002000000e0000001003f00000000000002000100e625aa66dcef85847e479eb3c49000000400000000fd003e"], 0x44}}, 0x0) add_key(&(0x7f0000000080)='logon\x00', &(0x7f0000000100)={0x73, 0x79, 0x7a, 0x1}, &(0x7f0000001240), 0x0, 0xfffffffffffffff8) get_mempolicy(&(0x7f0000000000), &(0x7f00000001c0), 0x1ff, &(0x7f0000fff000/0x1000)=nil, 0x3) setsockopt$sock_int(r0, 0x1, 0x3c, &(0x7f0000d4effc)=0x1, 0x4) connect$inet(r0, &(0x7f0000000000)={0x2, 0x4e20, @dev={0xac, 0x14, 0x14, 0x18}}, 0x10) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f00000001c0)='tunl0\x00', 0x5) sendto$inet(r0, &(0x7f00006d1fd4)="db", 0x1, 0x4000010, &(0x7f00004daff0)={0x2, 0x0, @loopback, [0x10000000000000]}, 0x10) 13:16:38 executing program 4: perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e5}, 0x0, 0x0, 0xffffffffffffffff, 0x0) futex(&(0x7f000000cffc), 0x0, 0x0, &(0x7f0000fd7ff0), &(0x7f0000000040), 0x0) 13:16:38 executing program 5: r0 = syz_open_dev$binder(&(0x7f00000021c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000002340)={0x34, 0x0, &(0x7f0000002240)=[@request_death={0x400c630e, 0x4, 0x4}, @increfs={0x40046304, 0x4}, @increfs_done={0x40106308, 0x0, 0x3}, @increfs={0x40046304, 0x8000a0}], 0x77, 0x0, &(0x7f00000022c0)="b3cd0976d8e2af743c6f523efe14fd20c3c3dd2572734282a761e1b4304e2599c85f198cc82bd5d0c74c4edca2f9ea7b875ff7047ec0784fbb354e15fd3f7d837f533597d5082692a6f2fb748da3cc4157188f7f2a5477ded56f72f5b75c96872db429e44b8fcd781d96dead77a0b58b7af9085a208a22"}) 13:16:38 executing program 6: clone(0x802102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000040), 0xffffffffffffffff) r0 = syz_open_dev$sndtimer(&(0x7f0000000000)='/dev/snd/timer\x00', 0x0, 0x0) r1 = getpid() sched_setscheduler(r1, 0x5, &(0x7f0000000200)) ioctl$SNDRV_TIMER_IOCTL_GPARAMS(r0, 0x40485404, &(0x7f0000000240)={{}, 0x0, 0x2000000000000000, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1000000]}) 13:16:38 executing program 7: r0 = syz_open_dev$binder(&(0x7f00000021c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000002340)={0x18, 0x0, &(0x7f0000002240)=ANY=[@ANYBLOB="0e630c400400000000000000000000000463044004d5a400"], 0x0, 0x0, &(0x7f00000022c0)}) 13:16:38 executing program 0: perf_event_open(&(0x7f0000000040)={0x2, 0x70, 0x3e5}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f00000021c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0x40086602, &(0x7f0000002340)={0xb5, 0x0, &(0x7f00000000c0)=ANY=[@ANYBLOB="0463044000000000b6a571ac965f26c50d500dae115e59afcd8a338d8b2727193c56d4ebef60c214b766ffde6cff6ceef2baa2594a53a0117e77afd5d58e8a35afdae81b258585ce769507333c0238790d5ed750bf1d6ca2a873050056528fce7becfd12f165ac43a826d3462822ff8f29ea992d4e208847cf4fc10ca00b87b5ce2523fa477bad0be1c97e4398aa2ac81d973b5a871d8e0b295e436cd8415f19088c6c82c85f4ed1fac41da062bc6dbfb8eac4276c"], 0x0, 0x0, &(0x7f00000022c0)}) [ 1500.524968] binder: 13451:13456 BC_REQUEST_DEATH_NOTIFICATION invalid ref 4 13:16:38 executing program 4: clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000440), 0xffffffffffffffff) sched_setscheduler(0x0, 0x5, &(0x7f0000000200)) r0 = socket$inet_tcp(0x2, 0x1, 0x0) getsockopt$inet_mreqn(r0, 0x0, 0x23, &(0x7f0000000d40)={@local, @multicast1}, &(0x7f0000000d80)=0xc) sendmsg$nl_route(r0, &(0x7f0000000e40)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x100}, 0xc, &(0x7f0000000e00)={&(0x7f0000000dc0)=@ipv4_delroute={0x1c, 0x19, 0x108, 0x0, 0x25dfdbfc, {0x2, 0x0, 0x0, 0x0, 0x0, 0x6, 0x0, 0x7}}, 0x1c}}, 0x54) [ 1500.565450] binder: 13454:13462 BC_REQUEST_DEATH_NOTIFICATION invalid ref 4 [ 1500.600183] binder: 13451:13456 BC_INCREFS_DONE u0000000000000000 no match 13:16:38 executing program 7: r0 = semget$private(0x0, 0x20000000104, 0x0) semop(r0, &(0x7f0000000040)=[{0x0, 0xfffffffffffffffb}, {0x0, 0x2, 0x1800}], 0x2) r1 = syz_open_dev$admmidi(&(0x7f0000000500)='/dev/admmidi#\x00', 0x1, 0x0) setsockopt$inet6_IPV6_ADDRFORM(r1, 0x29, 0x1, &(0x7f0000000540), 0x4) semtimedop(r0, &(0x7f0000000000)=[{0x0, 0x7fff, 0x1000}, {0x0, 0xf9a4}], 0x2, &(0x7f0000000100)={0x0, 0x989680}) r2 = syz_open_dev$binder(&(0x7f00000021c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) set_mempolicy(0xc002, &(0x7f0000000080)=0x9, 0x1ff) syz_open_dev$sndpcmc(&(0x7f00000004c0)='/dev/snd/pcmC#D#c\x00', 0x401, 0xc0040) r3 = openat$selinux_commit_pending_bools(0xffffffffffffff9c, &(0x7f0000000140)='/selinux/commit_pending_bools\x00', 0x1, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(0xffffffffffffffff, &(0x7f00000001c0)={0x0, 0x18, 0xfa00, {0x1, &(0x7f0000000180)={0xffffffffffffffff}, 0x13f, 0x2}}, 0x20) write$RDMA_USER_CM_CMD_GET_EVENT(r2, &(0x7f00000003c0)={0xc, 0x8, 0xfa00, {&(0x7f0000000240)}}, 0x10) write$RDMA_USER_CM_CMD_NOTIFY(r3, &(0x7f0000000200)={0xf, 0x8, 0xfa00, {r4, 0xc}}, 0x10) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000002340)={0x18, 0x0, &(0x7f0000002240)=[@request_death={0x400c630e, 0x4}, @increfs={0x40046304, 0x4}], 0x0, 0x0, &(0x7f00000022c0)}) syz_open_dev$usb(&(0x7f00000000c0)='/dev/bus/usb/00#/00#\x00', 0x0, 0x101000) write$UHID_INPUT2(r3, &(0x7f0000000400)={0xc, 0x84, "a425f212ff338a3979ebeb802457d56621cd5787fc16d5793e1fa52ab3bd192dcbb8d99ffcecc4501ca9c941805de19120cb9ec877aeb4e8268d6262a0f329c421208ad7aa52f8b485b1dbec4eec784500eccc83ff06cce879a5b4b61be029e21041ffb7717b10618f498d5f158997cecc5ce74ec444ceabd7c8be3ce1906b99b42b18cd"}, 0x8a) 13:16:38 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r0, &(0x7f0000942000)={0x2, 0x4e20, @multicast1}, 0x10) sendmsg$key(0xffffffffffffffff, &(0x7f0000f56000)={0x0, 0x0, &(0x7f00008feff0)={&(0x7f0000000500)=ANY=[@ANYBLOB="020300090a1500000000000000000000030006190000000002000000e0000001003f00000000000002000100e625aa66dcef85847e479eb3c49000000400000000fd003e"], 0x44}}, 0x0) add_key(&(0x7f0000000080)='logon\x00', &(0x7f0000000100)={0x73, 0x79, 0x7a, 0x1}, &(0x7f0000001240), 0x0, 0xfffffffffffffff8) get_mempolicy(&(0x7f0000000000), &(0x7f00000001c0), 0x1ff, &(0x7f0000fff000/0x1000)=nil, 0x3) setsockopt$sock_int(r0, 0x1, 0x3c, &(0x7f0000d4effc)=0x1, 0x4) connect$inet(r0, &(0x7f0000000000)={0x2, 0x4e20, @dev={0xac, 0x14, 0x14, 0x18}}, 0x10) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f00000001c0)='tunl0\x00', 0x5) sendto$inet(r0, &(0x7f00006d1fd4)="db", 0x1, 0x4000010, &(0x7f00004daff0)={0x2, 0x0, @loopback, [0x8000a0ffffffff]}, 0x10) 13:16:38 executing program 5: r0 = syz_open_dev$binder(&(0x7f00000021c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000002340)={0x34, 0x0, &(0x7f0000002240)=[@request_death={0x400c630e, 0x4, 0x4}, @increfs={0x40046304, 0x4}, @increfs_done={0x40106308, 0x0, 0x3}, @increfs], 0xa, 0x0, &(0x7f00000022c0)="b3cd0976d8e2af743c6f523efe14fd20c3c3dd2572734282a761e1b4304e2599c85f198cc82bd5d0c74c4edca2f9ea7b875ff7047ec0784fbb354e15fd3f7d837f533597d5082692a6f2fb748da3cc4157188f7f2a5477ded56f72f5b75c96872db429e44b8fcd781d96dead77a0b58b7af9085a208a22"}) 13:16:38 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r0, &(0x7f0000942000)={0x2, 0x4e20, @multicast1}, 0x10) sendmsg$key(0xffffffffffffffff, &(0x7f0000f56000)={0x0, 0x0, &(0x7f00008feff0)={&(0x7f0000000500)=ANY=[@ANYBLOB="020300090a1500000000000000000000030006190000000002000000e0000001003f00000000000002000100e625aa66dcef85847e479eb3c49000000400000000fd003e"], 0x44}}, 0x0) add_key(&(0x7f0000000080)='logon\x00', &(0x7f0000000100)={0x73, 0x79, 0x7a, 0x1}, &(0x7f0000001240), 0x0, 0xfffffffffffffff8) get_mempolicy(&(0x7f0000000000), &(0x7f00000001c0), 0x1ff, &(0x7f0000fff000/0x1000)=nil, 0x3) setsockopt$sock_int(r0, 0x1, 0x3c, &(0x7f0000d4effc)=0x1, 0x4) connect$inet(r0, &(0x7f0000000000)={0x2, 0x4e20, @dev={0xac, 0x14, 0x14, 0x18}}, 0x10) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f00000001c0)='tunl0\x00', 0x5) sendto$inet(r0, &(0x7f00006d1fd4)="db", 0x1, 0x4000010, &(0x7f00004daff0)={0x2, 0x0, @loopback, [0xf401000000000000]}, 0x10) 13:16:38 executing program 3: r0 = perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = socket$alg(0x26, 0x5, 0x0) bind$alg(r1, &(0x7f0000000200)={0x26, 'hash\x00', 0x0, 0x0, 'sha1\x00'}, 0x58) r2 = accept$alg(r1, 0x0, 0x0) sendmmsg(r2, &(0x7f0000007f00)=[{{&(0x7f00000056c0)=@can, 0x3000, &(0x7f00000000c0)}}, {{&(0x7f0000005900)=@pppoe={0x18, 0x0, {0x0, @link_local, 'syzkaller0\x00'}}, 0x80, &(0x7f0000007ac0), 0x1a9, &(0x7f0000007b00)}}], 0x3fffffffffffe0d, 0x0) openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000140)='/dev/sequencer2\x00', 0x80840, 0x0) chown(&(0x7f0000000340)='./file0\x00', 0x0, 0x0) r3 = msgget$private(0x0, 0x21) msgctl$MSG_STAT(r3, 0xb, &(0x7f0000000380)=""/235) r4 = syz_open_dev$sndpcmc(&(0x7f00000000c0)='/dev/snd/pcmC#D#c\x00', 0x0, 0x0) ioctl$ASHMEM_SET_NAME(r4, 0x41007701, &(0x7f0000000100)='syzkaller0\x00') fstat(r0, &(0x7f0000000180)) 13:16:38 executing program 7: syz_open_dev$binder(&(0x7f00000021c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) [ 1500.853883] binder: 13473:13477 BC_REQUEST_DEATH_NOTIFICATION invalid ref 4 [ 1500.865715] binder: 13473:13483 BC_REQUEST_DEATH_NOTIFICATION invalid ref 4 13:16:39 executing program 4: clone(0x2102001ffd, 0x0, 0xfffffffffffffffe, &(0x7f00000004c0), 0xffffffffffffffff) r0 = socket(0xa, 0x2, 0x0) setsockopt$inet_int(0xffffffffffffffff, 0x0, 0x0, &(0x7f0000000200), 0x4) clone(0x20002100, 0x0, 0xfffffffffffffffe, &(0x7f0000000100), 0xffffffffffffffff) r1 = getpid() sched_setscheduler(r1, 0x5, &(0x7f0000000000)) setsockopt$inet_group_source_req(r0, 0x0, 0x2f, &(0x7f0000000240)={0x6d7a, {{0x2, 0x4e24, @rand_addr=0x2}}, {{0x2, 0x4e21, @dev={0xac, 0x14, 0x14, 0x1e}}}}, 0x108) accept4(r0, &(0x7f0000000440)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @multicast2}}}, &(0x7f0000000180)=0x80, 0x0) [ 1501.060335] binder: 13497:13503 BC_INCREFS_DONE u0000000000000000 no match [ 1501.232501] binder: 13509:13511 ioctl 40086602 20002340 returned -22 [ 1501.242000] binder: 13509:13512 ioctl 40086602 20002340 returned -22 13:16:39 executing program 1: r0 = socket$netlink(0x10, 0x3, 0x8000000004) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_TCP_CONGESTION(r1, 0x6, 0xd, &(0x7f0000000180)='vegas\x00', 0x6) bind$inet6(r1, &(0x7f00001fefe4)={0xa, 0x4e22}, 0x1c) sendto$inet6(r1, &(0x7f0000000100), 0x8d2d601e8976aa5, 0x20000004, &(0x7f000031e000)={0xa, 0x4e22}, 0x1c) writev(r0, &(0x7f0000000100)=[{&(0x7f0000000000)="580000001400192340834b80040d8c560a067ff76dff81004e220000000058000b4824ca944f64009400050028925aa8000000000000008000f0fffeffff09000000fff5dd00000010000100000c0900fcff0000040e05a5", 0x58}], 0x1) 13:16:39 executing program 6: clone(0x802102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000040), 0xffffffffffffffff) r0 = syz_open_dev$sndtimer(&(0x7f0000000000)='/dev/snd/timer\x00', 0x0, 0x0) r1 = getpid() sched_setscheduler(r1, 0x5, &(0x7f0000000200)) ioctl$SNDRV_TIMER_IOCTL_GPARAMS(r0, 0x40485404, &(0x7f0000000240)={{}, 0x0, 0x2000000000000000, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3000000]}) 13:16:39 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r0, &(0x7f0000942000)={0x2, 0x4e20, @multicast1}, 0x10) sendmsg$key(0xffffffffffffffff, &(0x7f0000f56000)={0x0, 0x0, &(0x7f00008feff0)={&(0x7f0000000500)=ANY=[@ANYBLOB="020300090a1500000000000000000000030006190000000002000000e0000001003f00000000000002000100e625aa66dcef85847e479eb3c49000000400000000fd003e"], 0x44}}, 0x0) add_key(&(0x7f0000000080)='logon\x00', &(0x7f0000000100)={0x73, 0x79, 0x7a, 0x1}, &(0x7f0000001240), 0x0, 0xfffffffffffffff8) get_mempolicy(&(0x7f0000000000), &(0x7f00000001c0), 0x1ff, &(0x7f0000fff000/0x1000)=nil, 0x3) setsockopt$sock_int(r0, 0x1, 0x3c, &(0x7f0000d4effc)=0x1, 0x4) connect$inet(r0, &(0x7f0000000000)={0x2, 0x4e20, @dev={0xac, 0x14, 0x14, 0x18}}, 0x10) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f00000001c0)='tunl0\x00', 0x5) sendto$inet(r0, &(0x7f00006d1fd4)="db", 0x1, 0x4000010, &(0x7f00004daff0)={0x2, 0x0, @loopback, [0x700000000000000]}, 0x10) 13:16:39 executing program 7: r0 = syz_open_dev$binder(&(0x7f00000021c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000002340)={0x18, 0x0, &(0x7f0000002240)=ANY=[@ANYBLOB="400000000400000000000000000000001063044004e60000"], 0x0, 0x0, &(0x7f00000022c0)}) 13:16:39 executing program 5: r0 = syz_open_dev$binder(&(0x7f00000021c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000002340)={0x34, 0x0, &(0x7f0000002240)=[@request_death={0x400c630e, 0x4, 0x4}, @increfs={0x40046304, 0x4}, @increfs_done={0x40106308, 0x0, 0x3}, @increfs], 0x77, 0xffffffffa0008000, &(0x7f00000022c0)="b3cd0976d8e2af743c6f523efe14fd20c3c3dd2572734282a761e1b4304e2599c85f198cc82bd5d0c74c4edca2f9ea7b875ff7047ec0784fbb354e15fd3f7d837f533597d5082692a6f2fb748da3cc4157188f7f2a5477ded56f72f5b75c96872db429e44b8fcd781d96dead77a0b58b7af9085a208a22"}) 13:16:39 executing program 4: r0 = syz_open_procfs(0x0, &(0x7f0000000240)='net/ipx\x00') ioctl$BLKIOMIN(r0, 0x1278, &(0x7f0000000280)) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) openat$nullb(0xffffffffffffff9c, &(0x7f00000002c0)='/dev/nullb0\x00', 0x80a02, 0x0) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000640), 0xffffffffffffffff) r3 = bpf$MAP_CREATE(0x0, &(0x7f0000011fd4)={0x3, 0x4, 0x4, 0x1, 0x0, 0x1}, 0xe) clone(0x4842100, 0x0, 0xfffffffffffffffe, &(0x7f0000000480), 0xffffffffffffffff) r4 = getpid() sched_setscheduler(r4, 0x5, &(0x7f0000000200)) writev(r3, &(0x7f00000000c0)=[{&(0x7f0000000340)="d46960ba86a147050a18a2a8ca090826088e916628e00811189eb9432c4709b65a0d6d0e48887d48cf69922f22205503549aae714edfba17333f975067ab9e42e26b769301df7528a1f339eb23995a162b0667183f41a0565b0e740bf0520fedb600fc37a193326b55b551386e9a23077979e80b7da59117d8538f502384634cd8a7644f604ec61dcf2856a9a25c75f1e67ed49d2b53ae71b050528ac0f3dd348f7bb98a92abeb456151ac51d6ee29cf63dd4dc30e71c03578ed7d00a1f9ad64c0d19534871e1a2d14ca316e747a2295517ecd614f4121904d58", 0xda}], 0x1) r5 = creat(&(0x7f00000000c0)='./file0\x00', 0x8) getsockopt$inet_sctp_SCTP_NODELAY(r5, 0x84, 0x3, &(0x7f0000000180), &(0x7f00000001c0)=0x4) r6 = getpid() sched_setscheduler(r6, 0x5, &(0x7f0000000200)) ioctl$sock_SIOCETHTOOL(r1, 0x8946, &(0x7f0000000140)={"8b8700000000000000000000001800", &(0x7f0000000080)=ANY=[@ANYPTR=&(0x7f0000000040)=ANY=[@ANYRES16=r6, @ANYRESDEC=r1]]}) ioctl$sock_SIOCOUTQNSD(r1, 0x894b, &(0x7f0000000000)) 13:16:39 executing program 3: perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000200)={0x26, 'hash\x00', 0x0, 0x0, 'sha1\x00'}, 0x58) r1 = accept$alg(r0, 0x0, 0x0) sendmmsg(r1, &(0x7f0000007f00)=[{{&(0x7f00000056c0)=@can, 0x3000, &(0x7f00000000c0)}}, {{&(0x7f0000005900)=@pppoe={0x18, 0x0, {0x0, @link_local, 'syzkaller0\x00'}}, 0x80, &(0x7f0000007ac0), 0x1a9, &(0x7f0000007b00)}}], 0x3fffffffffffe0d, 0x0) r2 = openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000140)='/dev/sequencer2\x00', 0x80840, 0x0) chown(&(0x7f0000000340)='./file0\x00', 0x0, 0x0) r3 = syz_open_dev$sndpcmc(&(0x7f00000000c0)='/dev/snd/pcmC#D#c\x00', 0x0, 0x0) unlinkat(r2, &(0x7f0000000180)='./file0\x00', 0x200) ioctl$ASHMEM_SET_NAME(r3, 0x41007701, &(0x7f0000000100)='syzkaller0\x00') 13:16:39 executing program 0: perf_event_open(&(0x7f0000000040)={0x2, 0x70, 0x3e5}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f00000021c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0x40046207, &(0x7f0000002340)={0xb5, 0x0, &(0x7f00000000c0)=ANY=[@ANYBLOB="0463044000000000b6a571ac965f26c50d500dae115e59afcd8a338d8b2727193c56d4ebef60c214b766ffde6cff6ceef2baa2594a53a0117e77afd5d58e8a35afdae81b258585ce769507333c0238790d5ed750bf1d6ca2a873050056528fce7becfd12f165ac43a826d3462822ff8f29ea992d4e208847cf4fc10ca00b87b5ce2523fa477bad0be1c97e4398aa2ac81d973b5a871d8e0b295e436cd8415f19088c6c82c85f4ed1fac41da062bc6dbfb8eac4276c"], 0x0, 0x0, &(0x7f00000022c0)}) [ 1501.465217] binder: 13517:13529 unknown command 64 13:16:39 executing program 5: r0 = syz_open_dev$binder(&(0x7f00000021c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000002340)={0x34, 0x0, &(0x7f0000002240)=[@request_death={0x400c630e, 0x4, 0x4}, @increfs={0x40046304, 0x4}, @increfs_done={0x40106308, 0x0, 0x3}, @increfs], 0x77, 0x2000000000000000, &(0x7f00000022c0)="b3cd0976d8e2af743c6f523efe14fd20c3c3dd2572734282a761e1b4304e2599c85f198cc82bd5d0c74c4edca2f9ea7b875ff7047ec0784fbb354e15fd3f7d837f533597d5082692a6f2fb748da3cc4157188f7f2a5477ded56f72f5b75c96872db429e44b8fcd781d96dead77a0b58b7af9085a208a22"}) [ 1501.494377] binder: 13517:13529 ioctl c0306201 20002340 returned -22 13:16:39 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r0, &(0x7f0000942000)={0x2, 0x4e20, @multicast1}, 0x10) sendmsg$key(0xffffffffffffffff, &(0x7f0000f56000)={0x0, 0x0, &(0x7f00008feff0)={&(0x7f0000000500)=ANY=[@ANYBLOB="020300090a1500000000000000000000030006190000000002000000e0000001003f00000000000002000100e625aa66dcef85847e479eb3c49000000400000000fd003e"], 0x44}}, 0x0) add_key(&(0x7f0000000080)='logon\x00', &(0x7f0000000100)={0x73, 0x79, 0x7a, 0x1}, &(0x7f0000001240), 0x0, 0xfffffffffffffff8) get_mempolicy(&(0x7f0000000000), &(0x7f00000001c0), 0x1ff, &(0x7f0000fff000/0x1000)=nil, 0x3) setsockopt$sock_int(r0, 0x1, 0x3c, &(0x7f0000d4effc)=0x1, 0x4) connect$inet(r0, &(0x7f0000000000)={0x2, 0x4e20, @dev={0xac, 0x14, 0x14, 0x18}}, 0x10) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f00000001c0)='tunl0\x00', 0x5) sendto$inet(r0, &(0x7f00006d1fd4)="db", 0x1, 0x4000010, &(0x7f00004daff0)={0x2, 0x0, @loopback, [0x11000000]}, 0x10) 13:16:39 executing program 7: r0 = syz_open_dev$binder(&(0x7f00000021c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000002340)={0x18, 0x0, &(0x7f0000002240)=[@request_death={0x400c630e, 0x4}, @increfs={0x40046304, 0x4}], 0x0, 0x0, &(0x7f00000022c0)}) r1 = openat$autofs(0xffffffffffffff9c, &(0x7f0000000080)='/dev/autofs\x00', 0x82, 0x0) ioctl$sock_SIOCGIFCONF(r1, 0x8910, &(0x7f0000000100)=@buf={0x40, &(0x7f00000000c0)="27c6fbe74bb724dccad2a2165359f7da7b43f4865ed3a49107e94ccef656692b960a8b1d061b59eb0a69d4b6ab7429d0dad3df906bda6591adbd4b089783f09a"}) openat$selinux_avc_cache_stats(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/avc/cache_stats\x00', 0x0, 0x0) ioctl$KVM_ASSIGN_PCI_DEVICE(r0, 0x8040ae69, &(0x7f0000000040)={0xfff, 0x1ff, 0x8, 0x5, 0xe4fb}) 13:16:39 executing program 6: clone(0x802102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000040), 0xffffffffffffffff) r0 = syz_open_dev$sndtimer(&(0x7f0000000000)='/dev/snd/timer\x00', 0x0, 0x0) r1 = getpid() sched_setscheduler(r1, 0x5, &(0x7f0000000200)) ioctl$SNDRV_TIMER_IOCTL_GPARAMS(r0, 0x40485404, &(0x7f0000000240)={{}, 0x0, 0x2000000000000000, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x300]}) 13:16:39 executing program 3: r0 = openat$selinux_policy(0xffffffffffffff9c, &(0x7f0000000280)='/selinux/policy\x00', 0x0, 0x0) perf_event_open(&(0x7f00000002c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x401, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1}, 0x0, 0xffffffffffffffff, r0, 0x0) r1 = socket$alg(0x26, 0x5, 0x0) r2 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000180)='/dev/hwrng\x00', 0x208282, 0x0) ioctl$TIOCGWINSZ(r2, 0x5413, &(0x7f00000001c0)) bind$alg(r1, &(0x7f0000000200)={0x26, 'hash\x00', 0x0, 0x0, 'sha1\x00'}, 0x58) r3 = accept$alg(r1, 0x0, 0x0) sendmmsg(r3, &(0x7f0000007f00)=[{{&(0x7f00000056c0)=@can, 0x3000, &(0x7f00000000c0)}}, {{&(0x7f0000005900)=@pppoe={0x18, 0x0, {0x0, @link_local, 'syzkaller0\x00'}}, 0x80, &(0x7f0000007ac0), 0x1a9, &(0x7f0000007b00)}}], 0x3fffffffffffe0d, 0x0) openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000140)='/dev/sequencer2\x00', 0x80840, 0x0) chown(&(0x7f0000000340)='./file0\x00', 0x0, 0x0) r4 = syz_open_dev$sndpcmc(&(0x7f00000000c0)='/dev/snd/pcmC#D#c\x00', 0x0, 0x0) ioctl$ASHMEM_SET_NAME(r4, 0x41007701, &(0x7f0000000100)='syzkaller0\x00') [ 1501.736644] binder: 13540:13543 ioctl 8040ae69 20000040 returned -22 13:16:39 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r0, &(0x7f0000942000)={0x2, 0x4e20, @multicast1}, 0x10) sendmsg$key(0xffffffffffffffff, &(0x7f0000f56000)={0x0, 0x0, &(0x7f00008feff0)={&(0x7f0000000500)=ANY=[@ANYBLOB="020300090a1500000000000000000000030006190000000002000000e0000001003f00000000000002000100e625aa66dcef85847e479eb3c49000000400000000fd003e"], 0x44}}, 0x0) add_key(&(0x7f0000000080)='logon\x00', &(0x7f0000000100)={0x73, 0x79, 0x7a, 0x1}, &(0x7f0000001240), 0x0, 0xfffffffffffffff8) get_mempolicy(&(0x7f0000000000), &(0x7f00000001c0), 0x1ff, &(0x7f0000fff000/0x1000)=nil, 0x3) setsockopt$sock_int(r0, 0x1, 0x3c, &(0x7f0000d4effc)=0x1, 0x4) connect$inet(r0, &(0x7f0000000000)={0x2, 0x4e20, @dev={0xac, 0x14, 0x14, 0x18}}, 0x10) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f00000001c0)='tunl0\x00', 0x5) sendto$inet(r0, &(0x7f00006d1fd4)="db", 0x1, 0x4000010, &(0x7f00004daff0)={0x2, 0x0, @loopback, [0x14b80100]}, 0x10) 13:16:39 executing program 7: pipe(&(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x434, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) getsockopt$IP_VS_SO_GET_DAEMON(0xffffffffffffffff, 0x0, 0x487, &(0x7f0000000300), &(0x7f0000000340)=0x30) r2 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000080)='/dev/nullb0\x00', 0x4000000004002, 0x0) setsockopt$inet6_tcp_TCP_REPAIR_OPTIONS(0xffffffffffffffff, 0x6, 0x16, &(0x7f00000002c0), 0x0) mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x200000e, 0x13, r2, 0x0) ioctl$sock_FIOGETOWN(0xffffffffffffff9c, 0x8903, &(0x7f0000000100)) connect$can_bcm(0xffffffffffffffff, &(0x7f0000002ff0), 0x10) sendmsg$key(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000005ff0)={&(0x7f0000008000)={0x5, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, [@sadb_x_nat_t_port={0x1}, @sadb_x_nat_t_port={0x1}]}, 0x20}}, 0x0) write$binfmt_misc(r2, &(0x7f0000000440)={'syz1'}, 0x1200e) umount2(&(0x7f0000001a40)='./file0\x00', 0xe) ioctl$sock_inet_SIOCSIFDSTADDR(r1, 0x8918, &(0x7f0000000000)={'veth0_to_team\x00', {0x2, 0x4e22, @multicast2}}) sendmmsg$unix(r0, &(0x7f0000001a00)=[{&(0x7f00000004c0)=@file={0x0, './file0\x00'}, 0x6e, &(0x7f0000001980)=[{&(0x7f0000001840)="c6bbec873f10aa3c01ea79d4c2ff6d54338146e1f7574b02368b5c4c63e45a404ddac78a46d28026a5ad1960de407312c7730fe376a386cc01d065e45f1a03f5c009e2bac24fb2ab1bc31792ce04b97f75dd58aa7e8aed4c5960460e465014b4d4fc20c71091775c79bcee3924cc094f6359141c28861b5bd969643ddc64ce8ee6cf5b", 0x83}], 0x1, &(0x7f00000019c0), 0x0, 0x4800}], 0x1, 0x10) process_vm_writev(0x0, &(0x7f00000000c0), 0x215, &(0x7f0000121000)=[{&(0x7f0000217f28)=""/231, 0xe7}], 0x10000000000001ad, 0x0) ioctl$KDGETMODE(0xffffffffffffffff, 0x4b3b, &(0x7f0000000140)) 13:16:39 executing program 5: r0 = syz_open_dev$binder(&(0x7f00000021c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000002340)={0x34, 0x0, &(0x7f0000002240)=[@request_death={0x400c630e, 0x4, 0x4}, @increfs={0x40046304, 0x4}, @increfs_done={0x40106308, 0x0, 0x3}, @increfs], 0x77, 0x48000000, &(0x7f00000022c0)="b3cd0976d8e2af743c6f523efe14fd20c3c3dd2572734282a761e1b4304e2599c85f198cc82bd5d0c74c4edca2f9ea7b875ff7047ec0784fbb354e15fd3f7d837f533597d5082692a6f2fb748da3cc4157188f7f2a5477ded56f72f5b75c96872db429e44b8fcd781d96dead77a0b58b7af9085a208a22"}) 13:16:40 executing program 1: r0 = socket$netlink(0x10, 0x3, 0x8000000004) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_TCP_CONGESTION(r1, 0x6, 0xd, &(0x7f0000000180)='vegas\x00', 0x6) bind$inet6(r1, &(0x7f00001fefe4)={0xa, 0x4e22}, 0x1c) sendto$inet6(r1, &(0x7f0000000100), 0x8d2d601e8976aa5, 0x20000004, &(0x7f000031e000)={0xa, 0x4e22}, 0x1c) writev(r0, &(0x7f0000000100)=[{&(0x7f0000000000)="580000001400192340834b80040d8c560a067fd862ff81004e220000000058000b4824ca944f64009400050028925aa8000000000000008000f0fffeffff09000000fff5dd00000010000100000c0900fcff0000040e05a5", 0x58}], 0x1) 13:16:40 executing program 3: perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000200)={0x26, 'hash\x00', 0x0, 0x0, 'sha1\x00'}, 0x58) r1 = accept$alg(r0, 0x0, 0x0) sendmmsg(r1, &(0x7f0000007f00)=[{{&(0x7f00000056c0)=@can, 0x3000, &(0x7f00000000c0), 0x0, 0x0, 0xfffffffffffffeee}}, {{&(0x7f0000005900)=@pppoe={0x18, 0x0, {0x0, @link_local, 'syzkaller0\x00'}}, 0x80, &(0x7f0000007ac0), 0x1a9, &(0x7f0000007b00)}}], 0x3fffffffffffe0d, 0x0) r2 = openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000140)='/dev/sequencer2\x00', 0x80840, 0x0) chown(&(0x7f0000000340)='./file0\x00', 0x0, 0x0) r3 = syz_open_dev$sndpcmc(&(0x7f00000000c0)='/dev/snd/pcmC#D#c\x00', 0x0, 0x0) setsockopt$SO_VM_SOCKETS_BUFFER_MAX_SIZE(r2, 0x28, 0x2, &(0x7f0000000180)=0x3, 0x8) ioctl$ASHMEM_SET_NAME(r3, 0x41007701, &(0x7f0000000100)='syzkaller0\x00') 13:16:40 executing program 6: clone(0x802102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000040), 0xffffffffffffffff) r0 = syz_open_dev$sndtimer(&(0x7f0000000000)='/dev/snd/timer\x00', 0x0, 0x0) r1 = getpid() sched_setscheduler(r1, 0x5, &(0x7f0000000200)) ioctl$SNDRV_TIMER_IOCTL_GPARAMS(r0, 0x40485404, &(0x7f0000000240)={{}, 0x0, 0x2000000000000000, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3]}) 13:16:40 executing program 5: r0 = syz_open_dev$binder(&(0x7f00000021c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000002340)={0x34, 0x0, &(0x7f0000002240)=[@request_death={0x400c630e, 0x4, 0x4}, @increfs={0x40046304, 0x4}, @increfs_done={0x40106308, 0x0, 0x3}, @increfs], 0x77, 0x68000000, &(0x7f00000022c0)="b3cd0976d8e2af743c6f523efe14fd20c3c3dd2572734282a761e1b4304e2599c85f198cc82bd5d0c74c4edca2f9ea7b875ff7047ec0784fbb354e15fd3f7d837f533597d5082692a6f2fb748da3cc4157188f7f2a5477ded56f72f5b75c96872db429e44b8fcd781d96dead77a0b58b7af9085a208a22"}) 13:16:40 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r0, &(0x7f0000942000)={0x2, 0x4e20, @multicast1}, 0x10) sendmsg$key(0xffffffffffffffff, &(0x7f0000f56000)={0x0, 0x0, &(0x7f00008feff0)={&(0x7f0000000500)=ANY=[@ANYBLOB="020300090a1500000000000000000000030006190000000002000000e0000001003f00000000000002000100e625aa66dcef85847e479eb3c49000000400000000fd003e"], 0x44}}, 0x0) add_key(&(0x7f0000000080)='logon\x00', &(0x7f0000000100)={0x73, 0x79, 0x7a, 0x1}, &(0x7f0000001240), 0x0, 0xfffffffffffffff8) get_mempolicy(&(0x7f0000000000), &(0x7f00000001c0), 0x1ff, &(0x7f0000fff000/0x1000)=nil, 0x3) setsockopt$sock_int(r0, 0x1, 0x3c, &(0x7f0000d4effc)=0x1, 0x4) connect$inet(r0, &(0x7f0000000000)={0x2, 0x4e20, @dev={0xac, 0x14, 0x14, 0x18}}, 0x10) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f00000001c0)='tunl0\x00', 0x5) sendto$inet(r0, &(0x7f00006d1fd4)="db", 0x1, 0x4000010, &(0x7f00004daff0)={0x2, 0x0, @loopback, [0x100000]}, 0x10) 13:16:40 executing program 7: openat$urandom(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/urandom\x00', 0x0, 0x0) clone(0x4002102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000640), 0xffffffffffffffff) r0 = getpid() sched_setscheduler(r0, 0x5, &(0x7f0000000200)) r1 = memfd_create(&(0x7f0000000180)='\x00', 0x0) setsockopt$EBT_SO_SET_COUNTERS(r1, 0x0, 0x81, &(0x7f0000000300)={'broute\x00', 0x0, 0x0, 0x0, [], 0x5, &(0x7f0000000000)=[{}], 0x0, [{}, {}, {}, {}, {}]}, 0xc8) 13:16:40 executing program 0: perf_event_open(&(0x7f0000000040)={0x2, 0x70, 0x3e5}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f00000021c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0046209, &(0x7f0000002340)={0xb5, 0x0, &(0x7f00000000c0)=ANY=[@ANYBLOB="0463044000000000b6a571ac965f26c50d500dae115e59afcd8a338d8b2727193c56d4ebef60c214b766ffde6cff6ceef2baa2594a53a0117e77afd5d58e8a35afdae81b258585ce769507333c0238790d5ed750bf1d6ca2a873050056528fce7becfd12f165ac43a826d3462822ff8f29ea992d4e208847cf4fc10ca00b87b5ce2523fa477bad0be1c97e4398aa2ac81d973b5a871d8e0b295e436cd8415f19088c6c82c85f4ed1fac41da062bc6dbfb8eac4276c"], 0x0, 0x0, &(0x7f00000022c0)}) 13:16:40 executing program 4: clone(0x0, &(0x7f0000659ffe), &(0x7f0000000180), &(0x7f0000000080), &(0x7f0000000300)) wait4(0x0, &(0x7f0000000000), 0x80000008, 0x0) 13:16:40 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r0, &(0x7f0000942000)={0x2, 0x4e20, @multicast1}, 0x10) sendmsg$key(0xffffffffffffffff, &(0x7f0000f56000)={0x0, 0x0, &(0x7f00008feff0)={&(0x7f0000000500)=ANY=[@ANYBLOB="020300090a1500000000000000000000030006190000000002000000e0000001003f00000000000002000100e625aa66dcef85847e479eb3c49000000400000000fd003e"], 0x44}}, 0x0) add_key(&(0x7f0000000080)='logon\x00', &(0x7f0000000100)={0x73, 0x79, 0x7a, 0x1}, &(0x7f0000001240), 0x0, 0xfffffffffffffff8) get_mempolicy(&(0x7f0000000000), &(0x7f00000001c0), 0x1ff, &(0x7f0000fff000/0x1000)=nil, 0x3) setsockopt$sock_int(r0, 0x1, 0x3c, &(0x7f0000d4effc)=0x1, 0x4) connect$inet(r0, &(0x7f0000000000)={0x2, 0x4e20, @dev={0xac, 0x14, 0x14, 0x18}}, 0x10) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f00000001c0)='tunl0\x00', 0x5) sendto$inet(r0, &(0x7f00006d1fd4)="db", 0x1, 0x4000010, &(0x7f00004daff0)={0x2, 0x0, @loopback, [0xe803000000000000]}, 0x10) 13:16:40 executing program 3: perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$alg(0x26, 0x5, 0x0) getsockname(r0, &(0x7f0000000280)=@llc={0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, @local}, &(0x7f0000000300)=0x80) bind$alg(r0, &(0x7f0000000200)={0x26, 'hash\x00', 0x0, 0x0, 'sha1\x00'}, 0x58) r1 = accept$alg(r0, 0x0, 0x0) sendmmsg(r1, &(0x7f0000007f00)=[{{&(0x7f00000056c0)=@can, 0x3000, &(0x7f00000000c0)}}, {{&(0x7f0000005900)=@pppoe={0x18, 0x0, {0x0, @link_local, 'syzkaller0\x00'}}, 0x80, &(0x7f0000007ac0), 0x1a9, &(0x7f0000007b00)}}], 0x3fffffffffffe0d, 0x0) r2 = openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000140)='/dev/sequencer2\x00', 0x80840, 0x0) chown(&(0x7f0000000340)='./file0\x00', 0x0, 0x0) utimensat(r2, &(0x7f0000000180)='./file1\x00', &(0x7f00000001c0)={{0x0, 0x2710}, {0x0, 0x7530}}, 0x100) r3 = syz_open_dev$sndpcmc(&(0x7f00000000c0)='/dev/snd/pcmC#D#c\x00', 0x0, 0x0) ioctl$ASHMEM_SET_NAME(r3, 0x41007701, &(0x7f0000000100)='syzkaller0\x00') ustat(0x7, &(0x7f0000000380)) [ 1502.350584] binder_thread_write: 39 callbacks suppressed [ 1502.350613] binder: 13594:13601 IncRefs 0 refcount change on invalid ref 4 ret -22 [ 1502.390285] binder: 13594:13601 IncRefs 0 refcount change on invalid ref 0 ret -22 13:16:40 executing program 5: r0 = syz_open_dev$binder(&(0x7f00000021c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000002340)={0x34, 0x0, &(0x7f0000002240)=[@request_death={0x400c630e, 0x4, 0x4}, @increfs={0x40046304, 0x4}, @increfs_done={0x40106308, 0x0, 0x3}, @increfs], 0x77, 0x700, &(0x7f00000022c0)="b3cd0976d8e2af743c6f523efe14fd20c3c3dd2572734282a761e1b4304e2599c85f198cc82bd5d0c74c4edca2f9ea7b875ff7047ec0784fbb354e15fd3f7d837f533597d5082692a6f2fb748da3cc4157188f7f2a5477ded56f72f5b75c96872db429e44b8fcd781d96dead77a0b58b7af9085a208a22"}) 13:16:40 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r0, &(0x7f0000942000)={0x2, 0x4e20, @multicast1}, 0x10) sendmsg$key(0xffffffffffffffff, &(0x7f0000f56000)={0x0, 0x0, &(0x7f00008feff0)={&(0x7f0000000500)=ANY=[@ANYBLOB="020300090a1500000000000000000000030006190000000002000000e0000001003f00000000000002000100e625aa66dcef85847e479eb3c49000000400000000fd003e"], 0x44}}, 0x0) add_key(&(0x7f0000000080)='logon\x00', &(0x7f0000000100)={0x73, 0x79, 0x7a, 0x1}, &(0x7f0000001240), 0x0, 0xfffffffffffffff8) get_mempolicy(&(0x7f0000000000), &(0x7f00000001c0), 0x1ff, &(0x7f0000fff000/0x1000)=nil, 0x3) setsockopt$sock_int(r0, 0x1, 0x3c, &(0x7f0000d4effc)=0x1, 0x4) connect$inet(r0, &(0x7f0000000000)={0x2, 0x4e20, @dev={0xac, 0x14, 0x14, 0x18}}, 0x10) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f00000001c0)='tunl0\x00', 0x5) sendto$inet(r0, &(0x7f00006d1fd4)="db", 0x1, 0x4000010, &(0x7f00004daff0)={0x2, 0x0, @loopback, [0xfdffffff]}, 0x10) [ 1502.600034] binder: 13615:13617 IncRefs 0 refcount change on invalid ref 4 ret -22 [ 1502.635737] binder_thread_write: 5 callbacks suppressed [ 1502.635750] binder: 13615:13617 BC_INCREFS_DONE u0000000000000000 no match 13:16:40 executing program 7: 13:16:40 executing program 6: clone(0x802102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000040), 0xffffffffffffffff) r0 = syz_open_dev$sndtimer(&(0x7f0000000000)='/dev/snd/timer\x00', 0x0, 0x0) r1 = getpid() sched_setscheduler(r1, 0x5, &(0x7f0000000200)) ioctl$SNDRV_TIMER_IOCTL_GPARAMS(r0, 0x40485404, &(0x7f0000000240)={{}, 0x0, 0x2000000000000000, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x100000000000000]}) [ 1502.652307] binder: 13615:13617 IncRefs 0 refcount change on invalid ref 0 ret -22 13:16:40 executing program 5: r0 = syz_open_dev$binder(&(0x7f00000021c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000002340)={0x34, 0x0, &(0x7f0000002240)=[@request_death={0x400c630e, 0x4, 0x4}, @increfs={0x40046304, 0x4}, @increfs_done={0x40106308, 0x0, 0x3}, @increfs], 0x77, 0x2, &(0x7f00000022c0)="b3cd0976d8e2af743c6f523efe14fd20c3c3dd2572734282a761e1b4304e2599c85f198cc82bd5d0c74c4edca2f9ea7b875ff7047ec0784fbb354e15fd3f7d837f533597d5082692a6f2fb748da3cc4157188f7f2a5477ded56f72f5b75c96872db429e44b8fcd781d96dead77a0b58b7af9085a208a22"}) 13:16:40 executing program 3: r0 = openat$ipvs(0xffffffffffffff9c, &(0x7f0000000180)='/proc/sys/net/ipv4/vs/nat_icmp_send\x00', 0x2, 0x0) ioctl$RTC_UIE_ON(r0, 0x7003) r1 = socket$inet(0x10, 0x3, 0xc) sendmsg(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000009ff0)=[{&(0x7f0000000100)="240000000a0a07021dfffd946fa2830020200a0009000108000000680c1baba20400ff7e", 0x24}], 0x1}, 0x0) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r2 = socket$alg(0x26, 0x5, 0x0) bind$alg(r2, &(0x7f0000000200)={0x26, 'hash\x00', 0x0, 0x0, 'sha1\x00'}, 0x58) r3 = accept$alg(r2, 0x0, 0x0) sendmmsg(r3, &(0x7f0000007f00)=[{{&(0x7f00000056c0)=@can, 0x3000, &(0x7f00000000c0)}}, {{&(0x7f0000005900)=@pppoe={0x18, 0x0, {0x0, @link_local, 'syzkaller0\x00'}}, 0x80, &(0x7f0000007ac0), 0x1a9, &(0x7f0000007b00)}}], 0x3fffffffffffe0d, 0x0) r4 = openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000140)='/dev/sequencer2\x00', 0x80840, 0x0) chown(&(0x7f0000000340)='./file0\x00', 0x0, 0x0) openat$snapshot(0xffffffffffffff9c, &(0x7f0000000280)='/dev/snapshot\x00', 0x81, 0x0) r5 = syz_open_dev$sndpcmc(&(0x7f00000001c0)='/dev/snd/pcmC#D#c\x00', 0x4000000000002, 0xfffffffffffffffc) ioctl$ASHMEM_SET_NAME(r5, 0x41007701, &(0x7f0000000100)='syzkaller0\x00') setsockopt$IP_VS_SO_SET_TIMEOUT(r4, 0x0, 0x48a, &(0x7f00000000c0)={0x200000, 0x81, 0x1}, 0xc) [ 1502.864339] binder: 13638:13642 IncRefs 0 refcount change on invalid ref 4 ret -22 [ 1502.879943] binder: 13638:13642 BC_INCREFS_DONE u0000000000000000 no match [ 1502.888816] binder: 13638:13642 IncRefs 0 refcount change on invalid ref 0 ret -22 13:16:41 executing program 1: r0 = socket$netlink(0x10, 0x3, 0x8000000004) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_TCP_CONGESTION(r1, 0x6, 0xd, &(0x7f0000000180)='vegas\x00', 0x6) bind$inet6(r1, &(0x7f00001fefe4)={0xa, 0x4e22}, 0x1c) sendto$inet6(r1, &(0x7f0000000100), 0x8d2d601e8976aa5, 0x20000004, &(0x7f000031e000)={0xa, 0x4e22}, 0x1c) writev(r0, &(0x7f0000000100)=[{&(0x7f0000000000)="580000001400192340834b80040d8c560a067f08eaff81004e220000000058000b4824ca944f64009400050028925aa8000000000000008000f0fffeffff09000000fff5dd00000010000100000c0900fcff0000040e05a5", 0x58}], 0x1) 13:16:41 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r0, &(0x7f0000942000)={0x2, 0x4e20, @multicast1}, 0x10) sendmsg$key(0xffffffffffffffff, &(0x7f0000f56000)={0x0, 0x0, &(0x7f00008feff0)={&(0x7f0000000500)=ANY=[@ANYBLOB="020300090a1500000000000000000000030006190000000002000000e0000001003f00000000000002000100e625aa66dcef85847e479eb3c49000000400000000fd003e"], 0x44}}, 0x0) add_key(&(0x7f0000000080)='logon\x00', &(0x7f0000000100)={0x73, 0x79, 0x7a, 0x1}, &(0x7f0000001240), 0x0, 0xfffffffffffffff8) get_mempolicy(&(0x7f0000000000), &(0x7f00000001c0), 0x1ff, &(0x7f0000fff000/0x1000)=nil, 0x3) setsockopt$sock_int(r0, 0x1, 0x3c, &(0x7f0000d4effc)=0x1, 0x4) connect$inet(r0, &(0x7f0000000000)={0x2, 0x4e20, @dev={0xac, 0x14, 0x14, 0x18}}, 0x10) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f00000001c0)='tunl0\x00', 0x5) sendto$inet(r0, &(0x7f00006d1fd4)="db", 0x1, 0x4000010, &(0x7f00004daff0)={0x2, 0x0, @loopback, [0xa00]}, 0x10) 13:16:41 executing program 7: 13:16:41 executing program 5: r0 = syz_open_dev$binder(&(0x7f00000021c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000002340)={0x34, 0x0, &(0x7f0000002240)=[@request_death={0x400c630e, 0x4, 0x4}, @increfs={0x40046304, 0x4}, @increfs_done={0x40106308, 0x0, 0x3}, @increfs], 0x77, 0x400000000000000, &(0x7f00000022c0)="b3cd0976d8e2af743c6f523efe14fd20c3c3dd2572734282a761e1b4304e2599c85f198cc82bd5d0c74c4edca2f9ea7b875ff7047ec0784fbb354e15fd3f7d837f533597d5082692a6f2fb748da3cc4157188f7f2a5477ded56f72f5b75c96872db429e44b8fcd781d96dead77a0b58b7af9085a208a22"}) 13:16:41 executing program 6: clone(0x802102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000040), 0xffffffffffffffff) r0 = syz_open_dev$sndtimer(&(0x7f0000000000)='/dev/snd/timer\x00', 0x0, 0x0) r1 = getpid() sched_setscheduler(r1, 0x5, &(0x7f0000000200)) ioctl$SNDRV_TIMER_IOCTL_GPARAMS(r0, 0x40485404, &(0x7f0000000240)={{}, 0x0, 0x2000000000000000, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3000000]}) 13:16:41 executing program 4: clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000440), 0xffffffffffffffff) sched_setscheduler(0x0, 0x5, &(0x7f0000000200)) r0 = socket$inet_tcp(0x2, 0x1, 0x0) r1 = dup2(r0, r0) ioctl$TIOCGPGRP(r1, 0x540f, &(0x7f0000000000)) sendmsg$nl_route(r1, &(0x7f0000000380)={&(0x7f0000000240), 0xc, &(0x7f0000000340)={&(0x7f0000000280)=@ipv6_newrule={0x20}, 0x20}}, 0x0) 13:16:41 executing program 0: perf_event_open(&(0x7f0000000040)={0x2, 0x70, 0x3e5}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f00000021c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306225, &(0x7f0000002340)={0xb5, 0x0, &(0x7f00000000c0)=ANY=[@ANYBLOB="0463044000000000b6a571ac965f26c50d500dae115e59afcd8a338d8b2727193c56d4ebef60c214b766ffde6cff6ceef2baa2594a53a0117e77afd5d58e8a35afdae81b258585ce769507333c0238790d5ed750bf1d6ca2a873050056528fce7becfd12f165ac43a826d3462822ff8f29ea992d4e208847cf4fc10ca00b87b5ce2523fa477bad0be1c97e4398aa2ac81d973b5a871d8e0b295e436cd8415f19088c6c82c85f4ed1fac41da062bc6dbfb8eac4276c"], 0x0, 0x0, &(0x7f00000022c0)}) 13:16:41 executing program 3: r0 = perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = socket$alg(0x26, 0x5, 0x0) bind$alg(r1, &(0x7f0000000200)={0x26, 'hash\x00', 0x0, 0x0, 'sha1\x00'}, 0x58) r2 = accept$alg(r1, 0x0, 0x0) sendmmsg(r2, &(0x7f0000007f00)=[{{&(0x7f00000056c0)=@can, 0x3000, &(0x7f00000000c0)}}, {{&(0x7f0000005900)=@pppoe={0x18, 0x0, {0x0, @link_local, 'syzkaller0\x00'}}, 0x80, &(0x7f0000007ac0), 0x1a9, &(0x7f0000007b00)}}], 0x3fffffffffffe0d, 0x0) openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000140)='/dev/sequencer2\x00', 0x80840, 0x0) chown(&(0x7f0000000340)='./file0\x00', 0x0, 0x0) r3 = fcntl$dupfd(r2, 0x406, r0) epoll_ctl$EPOLL_CTL_MOD(r3, 0x3, r1, &(0x7f0000000180)={0x20000008}) r4 = syz_open_dev$sndpcmc(&(0x7f00000000c0)='/dev/snd/pcmC#D#c\x00', 0x0, 0x0) ioctl$ASHMEM_SET_NAME(r4, 0x41007701, &(0x7f0000000100)='syzkaller0\x00') 13:16:41 executing program 7: pipe(&(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) socket$inet6_tcp(0xa, 0x1, 0x0) bind$unix(r0, &(0x7f0000000140)=@file={0x0, './file0\x00'}, 0x6e) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) getsockopt$IP_VS_SO_GET_DAEMON(0xffffffffffffffff, 0x0, 0x487, &(0x7f0000000300), &(0x7f0000000340)=0x30) r1 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000080)='/dev/nullb0\x00', 0x4000000004002, 0x0) setsockopt$inet6_tcp_TCP_REPAIR_OPTIONS(0xffffffffffffffff, 0x6, 0x16, &(0x7f0000000000)=[{0x8, 0x200}, {0x8, 0x2}, {0xe, 0x8}, {0x4, 0x9}, {0x4, 0x3}, {0x3}, {0x2, 0x271}], 0x7) mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x200000e, 0x13, r1, 0x0) ioctl$sock_FIOGETOWN(0xffffffffffffff9c, 0x8903, &(0x7f0000000100)) connect$can_bcm(0xffffffffffffffff, &(0x7f0000002ff0), 0x10) write$binfmt_misc(r1, &(0x7f0000000440)={'syz1'}, 0x1200e) umount2(&(0x7f0000001a40)='./file0\x00', 0xe) sendmmsg$unix(r0, &(0x7f0000001a00)=[{&(0x7f00000004c0)=@file={0x0, './file0\x00'}, 0x6e, &(0x7f0000001980), 0x0, &(0x7f00000019c0), 0x0, 0x4800}], 0x1, 0x10) process_vm_writev(0x0, &(0x7f0000000000), 0x0, &(0x7f0000121000)=[{&(0x7f0000217f28)=""/231, 0xe7}], 0x1, 0x0) [ 1503.289337] binder: 13657:13669 IncRefs 0 refcount change on invalid ref 4 ret -22 [ 1503.382668] binder: 13657:13669 BC_INCREFS_DONE u0000000000000000 no match 13:16:41 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r0, &(0x7f0000942000)={0x2, 0x4e20, @multicast1}, 0x10) sendmsg$key(0xffffffffffffffff, &(0x7f0000f56000)={0x0, 0x0, &(0x7f00008feff0)={&(0x7f0000000500)=ANY=[@ANYBLOB="020300090a1500000000000000000000030006190000000002000000e0000001003f00000000000002000100e625aa66dcef85847e479eb3c49000000400000000fd003e"], 0x44}}, 0x0) add_key(&(0x7f0000000080)='logon\x00', &(0x7f0000000100)={0x73, 0x79, 0x7a, 0x1}, &(0x7f0000001240), 0x0, 0xfffffffffffffff8) get_mempolicy(&(0x7f0000000000), &(0x7f00000001c0), 0x1ff, &(0x7f0000fff000/0x1000)=nil, 0x3) setsockopt$sock_int(r0, 0x1, 0x3c, &(0x7f0000d4effc)=0x1, 0x4) connect$inet(r0, &(0x7f0000000000)={0x2, 0x4e20, @dev={0xac, 0x14, 0x14, 0x18}}, 0x10) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f00000001c0)='tunl0\x00', 0x5) sendto$inet(r0, &(0x7f00006d1fd4)="db", 0x1, 0x4000010, &(0x7f00004daff0)={0x2, 0x0, @loopback, [0x1100]}, 0x10) [ 1503.439820] binder: 13657:13669 IncRefs 0 refcount change on invalid ref 0 ret -22 13:16:41 executing program 6: clone(0x802102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000040), 0xffffffffffffffff) r0 = syz_open_dev$sndtimer(&(0x7f0000000000)='/dev/snd/timer\x00', 0x0, 0x0) r1 = getpid() sched_setscheduler(r1, 0x5, &(0x7f0000000200)) ioctl$SNDRV_TIMER_IOCTL_GPARAMS(r0, 0x40485404, &(0x7f0000000240)={{}, 0x0, 0x2000000000000000, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x300]}) 13:16:41 executing program 7: socketpair$inet_dccp(0x2, 0x6, 0x0, &(0x7f0000000040)) 13:16:41 executing program 5: r0 = syz_open_dev$binder(&(0x7f00000021c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000002340)={0x34, 0x0, &(0x7f0000002240)=[@request_death={0x400c630e, 0x4, 0x4}, @increfs={0x40046304, 0x4}, @increfs_done={0x40106308, 0x0, 0x3}, @increfs], 0x77, 0x8002a0, &(0x7f00000022c0)="b3cd0976d8e2af743c6f523efe14fd20c3c3dd2572734282a761e1b4304e2599c85f198cc82bd5d0c74c4edca2f9ea7b875ff7047ec0784fbb354e15fd3f7d837f533597d5082692a6f2fb748da3cc4157188f7f2a5477ded56f72f5b75c96872db429e44b8fcd781d96dead77a0b58b7af9085a208a22"}) 13:16:41 executing program 3: perf_event_open(&(0x7f0000000280)={0x1, 0x70, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x7fff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, @perf_bp, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000200)={0x26, 'hash\x00', 0x0, 0x0, 'sha1\x00'}, 0x58) r1 = accept$alg(r0, 0x0, 0x0) sendmmsg(r1, &(0x7f0000007f00)=[{{&(0x7f00000056c0)=@can, 0x3000, &(0x7f00000000c0)}}, {{&(0x7f0000005900)=@pppoe={0x18, 0x0, {0x0, @link_local, 'syzkaller0\x00'}}, 0x80, &(0x7f0000007ac0), 0xd2, &(0x7f0000007b00)}}], 0x3fffffffffffe0d, 0x0) r2 = openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000140)='/dev/sequencer2\x00', 0x80840, 0x0) setsockopt$inet6_tcp_TCP_FASTOPEN_KEY(r2, 0x6, 0x21, &(0x7f0000000180)="c0ddd82e0f9f4a874acabdaa54a16af5", 0x10) chown(&(0x7f0000000340)='./file0\x00', 0x0, 0x0) r3 = syz_open_dev$sndpcmc(&(0x7f00000000c0)='/dev/snd/pcmC#D#c\x00', 0x0, 0x0) ioctl$ASHMEM_SET_NAME(r3, 0x41007701, &(0x7f0000000100)='syzkaller0\x00') 13:16:41 executing program 7: setsockopt$IP_VS_SO_SET_EDIT(0xffffffffffffffff, 0x0, 0x483, &(0x7f0000000140)={0x0, @local, 0x0, 0x0, 'sed\x00'}, 0x2c) modify_ldt$write(0x1, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x0, 0x24, 0x0, 0x0, 0xd0d, 0x0, 0x7}, 0xfffffffffffffebb) r0 = openat$urandom(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/urandom\x00', 0x0, 0x0) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000640), 0xffffffffffffffff) r1 = getpid() sched_setscheduler(r1, 0x5, &(0x7f0000000200)) ioctl$EXT4_IOC_PRECACHE_EXTENTS(r0, 0x6612) fdatasync(r0) getpid() 13:16:41 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r0, &(0x7f0000942000)={0x2, 0x4e20, @multicast1}, 0x10) sendmsg$key(0xffffffffffffffff, &(0x7f0000f56000)={0x0, 0x0, &(0x7f00008feff0)={&(0x7f0000000500)=ANY=[@ANYBLOB="020300090a1500000000000000000000030006190000000002000000e0000001003f00000000000002000100e625aa66dcef85847e479eb3c49000000400000000fd003e"], 0x44}}, 0x0) add_key(&(0x7f0000000080)='logon\x00', &(0x7f0000000100)={0x73, 0x79, 0x7a, 0x1}, &(0x7f0000001240), 0x0, 0xfffffffffffffff8) get_mempolicy(&(0x7f0000000000), &(0x7f00000001c0), 0x1ff, &(0x7f0000fff000/0x1000)=nil, 0x3) setsockopt$sock_int(r0, 0x1, 0x3c, &(0x7f0000d4effc)=0x1, 0x4) connect$inet(r0, &(0x7f0000000000)={0x2, 0x4e20, @dev={0xac, 0x14, 0x14, 0x18}}, 0x10) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f00000001c0)='tunl0\x00', 0x5) sendto$inet(r0, &(0x7f00006d1fd4)="db", 0x1, 0x4000010, &(0x7f00004daff0)={0x2, 0x0, @loopback, [0xe000000]}, 0x10) [ 1503.755731] binder: 13697:13700 IncRefs 0 refcount change on invalid ref 4 ret -22 [ 1503.782255] binder: 13697:13700 BC_INCREFS_DONE u0000000000000000 no match [ 1503.813488] binder: 13697:13700 IncRefs 0 refcount change on invalid ref 0 ret -22 [ 1503.893168] binder: 13660:13710 ioctl c0306225 20002340 returned -22 [ 1503.962976] binder: 13660:13715 ioctl c0306225 20002340 returned -22 13:16:42 executing program 1: r0 = socket$netlink(0x10, 0x3, 0x8000000004) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_TCP_CONGESTION(r1, 0x6, 0xd, &(0x7f0000000180)='vegas\x00', 0x6) bind$inet6(r1, &(0x7f00001fefe4)={0xa, 0x4e22}, 0x1c) sendto$inet6(r1, &(0x7f0000000100), 0x8d2d601e8976aa5, 0x20000004, &(0x7f000031e000)={0xa, 0x4e22}, 0x1c) writev(r0, &(0x7f0000000100)=[{&(0x7f0000000000)="580000001400192340834b80040d8c560a067f0f80ff81004e220000000058000b4824ca944f64009400050028925aa8000000000000008000f0fffeffff09000000fff5dd00000010000100000c0900fcff0000040e05a5", 0x58}], 0x1) 13:16:42 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r0, &(0x7f0000942000)={0x2, 0x4e20, @multicast1}, 0x10) sendmsg$key(0xffffffffffffffff, &(0x7f0000f56000)={0x0, 0x0, &(0x7f00008feff0)={&(0x7f0000000500)=ANY=[@ANYBLOB="020300090a1500000000000000000000030006190000000002000000e0000001003f00000000000002000100e625aa66dcef85847e479eb3c49000000400000000fd003e"], 0x44}}, 0x0) add_key(&(0x7f0000000080)='logon\x00', &(0x7f0000000100)={0x73, 0x79, 0x7a, 0x1}, &(0x7f0000001240), 0x0, 0xfffffffffffffff8) get_mempolicy(&(0x7f0000000000), &(0x7f00000001c0), 0x1ff, &(0x7f0000fff000/0x1000)=nil, 0x3) setsockopt$sock_int(r0, 0x1, 0x3c, &(0x7f0000d4effc)=0x1, 0x4) connect$inet(r0, &(0x7f0000000000)={0x2, 0x4e20, @dev={0xac, 0x14, 0x14, 0x18}}, 0x10) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f00000001c0)='tunl0\x00', 0x5) sendto$inet(r0, &(0x7f00006d1fd4)="db", 0x1, 0x4000010, &(0x7f00004daff0)={0x2, 0x0, @loopback, [0xfffffff2]}, 0x10) 13:16:42 executing program 3: perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat$selinux_commit_pending_bools(0xffffffffffffff9c, &(0x7f00000001c0)='/selinux/commit_pending_bools\x00', 0x1, 0x0) r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000200)={0x26, 'hash\x00', 0x0, 0x0, 'sha1\x00'}, 0x58) r1 = accept$alg(r0, 0x0, 0x0) sendmmsg(r1, &(0x7f0000007f00)=[{{&(0x7f00000056c0)=@can, 0x3000, &(0x7f00000000c0)}}, {{&(0x7f0000005900)=@pppoe={0x18, 0x0, {0x0, @link_local, 'syzkaller0\x00'}}, 0x80, &(0x7f0000007ac0), 0x1a9, &(0x7f0000007b00)}}], 0x3fffffffffffe0d, 0x0) openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000140)='/dev/sequencer2\x00', 0x80840, 0x0) chown(&(0x7f0000000340)='./file0\x00', 0x0, 0x0) r2 = syz_open_dev$sndpcmc(&(0x7f00000000c0)='/dev/snd/pcmC#D#c\x00', 0x0, 0x0) statx(r2, &(0x7f0000000180)='./file0\x00', 0x6000, 0x20, &(0x7f0000000380)) ioctl$ASHMEM_SET_NAME(r2, 0x41007701, &(0x7f0000000100)='syzkaller0\x00') 13:16:42 executing program 5: r0 = syz_open_dev$binder(&(0x7f00000021c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000002340)={0x34, 0x0, &(0x7f0000002240)=[@request_death={0x400c630e, 0x4, 0x4}, @increfs={0x40046304, 0x4}, @increfs_done={0x40106308, 0x0, 0x3}, @increfs], 0x77, 0x7, &(0x7f00000022c0)="b3cd0976d8e2af743c6f523efe14fd20c3c3dd2572734282a761e1b4304e2599c85f198cc82bd5d0c74c4edca2f9ea7b875ff7047ec0784fbb354e15fd3f7d837f533597d5082692a6f2fb748da3cc4157188f7f2a5477ded56f72f5b75c96872db429e44b8fcd781d96dead77a0b58b7af9085a208a22"}) 13:16:42 executing program 7: r0 = openat$cuse(0xffffffffffffff9c, &(0x7f0000000080)='/dev/cuse\x00', 0x2, 0x0) clone(0x1002102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000640), 0xffffffffffffffff) r1 = getpid() sched_setscheduler(r1, 0x5, &(0x7f0000000000)) write$FUSE_NOTIFY_DELETE(r0, &(0x7f0000000040)={0x29}, 0x29) 13:16:42 executing program 6: clone(0x802102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000040), 0xffffffffffffffff) r0 = syz_open_dev$sndtimer(&(0x7f0000000000)='/dev/snd/timer\x00', 0x0, 0x0) r1 = getpid() sched_setscheduler(r1, 0x5, &(0x7f0000000200)) ioctl$SNDRV_TIMER_IOCTL_GPARAMS(r0, 0x40485404, &(0x7f0000000240)={{}, 0x0, 0x2000000000000000, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3]}) 13:16:42 executing program 4: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = gettid() perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x3e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff7fffffffffff}, 0x0, 0x0, 0xffffffffffffffff, 0x0) fcntl$setown(r0, 0x8, r1) bind$inet6(r0, &(0x7f0000807fe4)={0xa, 0x4e22}, 0x1c) sendto$inet6(r0, &(0x7f0000000380), 0x0, 0x200408d4, &(0x7f000072e000)={0xa, 0x4e22, 0x0, @loopback}, 0x1c) sendto$inet6(r0, &(0x7f0000ad6fad)='\x00', 0x1, 0x3fffffd, &(0x7f0000254000)={0xa, 0x0, 0x0, @loopback}, 0x1c) 13:16:42 executing program 0: perf_event_open(&(0x7f0000000040)={0x2, 0x70, 0x3e5}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f00000021c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0x4b49, &(0x7f0000002340)={0xb5, 0x0, &(0x7f00000000c0)=ANY=[@ANYBLOB="0463044000000000b6a571ac965f26c50d500dae115e59afcd8a338d8b2727193c56d4ebef60c214b766ffde6cff6ceef2baa2594a53a0117e77afd5d58e8a35afdae81b258585ce769507333c0238790d5ed750bf1d6ca2a873050056528fce7becfd12f165ac43a826d3462822ff8f29ea992d4e208847cf4fc10ca00b87b5ce2523fa477bad0be1c97e4398aa2ac81d973b5a871d8e0b295e436cd8415f19088c6c82c85f4ed1fac41da062bc6dbfb8eac4276c"], 0x0, 0x0, &(0x7f00000022c0)}) [ 1504.162558] binder: 13725:13731 BC_INCREFS_DONE u0000000000000000 no match 13:16:42 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r0, &(0x7f0000942000)={0x2, 0x4e20, @multicast1}, 0x10) sendmsg$key(0xffffffffffffffff, &(0x7f0000f56000)={0x0, 0x0, &(0x7f00008feff0)={&(0x7f0000000500)=ANY=[@ANYBLOB="020300090a1500000000000000000000030006190000000002000000e0000001003f00000000000002000100e625aa66dcef85847e479eb3c49000000400000000fd003e"], 0x44}}, 0x0) add_key(&(0x7f0000000080)='logon\x00', &(0x7f0000000100)={0x73, 0x79, 0x7a, 0x1}, &(0x7f0000001240), 0x0, 0xfffffffffffffff8) get_mempolicy(&(0x7f0000000000), &(0x7f00000001c0), 0x1ff, &(0x7f0000fff000/0x1000)=nil, 0x3) setsockopt$sock_int(r0, 0x1, 0x3c, &(0x7f0000d4effc)=0x1, 0x4) connect$inet(r0, &(0x7f0000000000)={0x2, 0x4e20, @dev={0xac, 0x14, 0x14, 0x18}}, 0x10) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f00000001c0)='tunl0\x00', 0x5) sendto$inet(r0, &(0x7f00006d1fd4)="db", 0x1, 0x4000010, &(0x7f00004daff0)={0x2, 0x0, @loopback, [0xe]}, 0x10) 13:16:42 executing program 5: r0 = syz_open_dev$binder(&(0x7f00000021c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000002340)={0x34, 0x0, &(0x7f0000002240)=[@request_death={0x400c630e, 0x4, 0x4}, @increfs={0x40046304, 0x4}, @increfs_done={0x40106308, 0x0, 0x3}, @increfs], 0x77, 0x7000000, &(0x7f00000022c0)="b3cd0976d8e2af743c6f523efe14fd20c3c3dd2572734282a761e1b4304e2599c85f198cc82bd5d0c74c4edca2f9ea7b875ff7047ec0784fbb354e15fd3f7d837f533597d5082692a6f2fb748da3cc4157188f7f2a5477ded56f72f5b75c96872db429e44b8fcd781d96dead77a0b58b7af9085a208a22"}) 13:16:42 executing program 3: r0 = perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = socket$alg(0x26, 0x5, 0x0) bind$alg(r1, &(0x7f0000000200)={0x26, 'hash\x00', 0x0, 0x0, 'sha1\x00'}, 0x58) r2 = accept$alg(r1, 0x0, 0x0) sendmmsg(r2, &(0x7f0000007f00)=[{{&(0x7f00000056c0)=@can, 0x3000, &(0x7f00000000c0)}}, {{&(0x7f0000005900)=@pppoe={0x18, 0x0, {0x0, @link_local, 'syzkaller0\x00'}}, 0x80, &(0x7f0000007ac0), 0x1a9, &(0x7f0000007b00)}}], 0x3fffffffffffe0d, 0x0) openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000140)='/dev/sequencer2\x00', 0x80840, 0x0) chown(&(0x7f0000000340)='./file0\x00', 0x0, 0x0) r3 = syz_open_dev$sndpcmc(&(0x7f00000000c0)='/dev/snd/pcmC#D#c\x00', 0x0, 0x0) ioctl$PERF_EVENT_IOC_DISABLE(r0, 0x2401, 0x0) ioctl$ASHMEM_SET_NAME(r3, 0x41007701, &(0x7f0000000100)='syzkaller0\x00') 13:16:42 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r0, &(0x7f0000942000)={0x2, 0x4e20, @multicast1}, 0x10) sendmsg$key(0xffffffffffffffff, &(0x7f0000f56000)={0x0, 0x0, &(0x7f00008feff0)={&(0x7f0000000500)=ANY=[@ANYBLOB="020300090a1500000000000000000000030006190000000002000000e0000001003f00000000000002000100e625aa66dcef85847e479eb3c49000000400000000fd003e"], 0x44}}, 0x0) add_key(&(0x7f0000000080)='logon\x00', &(0x7f0000000100)={0x73, 0x79, 0x7a, 0x1}, &(0x7f0000001240), 0x0, 0xfffffffffffffff8) get_mempolicy(&(0x7f0000000000), &(0x7f00000001c0), 0x1ff, &(0x7f0000fff000/0x1000)=nil, 0x3) setsockopt$sock_int(r0, 0x1, 0x3c, &(0x7f0000d4effc)=0x1, 0x4) connect$inet(r0, &(0x7f0000000000)={0x2, 0x4e20, @dev={0xac, 0x14, 0x14, 0x18}}, 0x10) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f00000001c0)='tunl0\x00', 0x5) sendto$inet(r0, &(0x7f00006d1fd4)="db", 0x1, 0x4000010, &(0x7f00004daff0)={0x2, 0x0, @loopback, [0x8055000000000000]}, 0x10) [ 1504.382241] binder: 13746:13750 BC_INCREFS_DONE u0000000000000000 no match 13:16:42 executing program 5: r0 = syz_open_dev$binder(&(0x7f00000021c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000002340)={0x34, 0x0, &(0x7f0000002240)=[@request_death={0x400c630e, 0x4, 0x4}, @increfs={0x40046304, 0x4}, @increfs_done={0x40106308, 0x0, 0x3}, @increfs], 0x77, 0x600, &(0x7f00000022c0)="b3cd0976d8e2af743c6f523efe14fd20c3c3dd2572734282a761e1b4304e2599c85f198cc82bd5d0c74c4edca2f9ea7b875ff7047ec0784fbb354e15fd3f7d837f533597d5082692a6f2fb748da3cc4157188f7f2a5477ded56f72f5b75c96872db429e44b8fcd781d96dead77a0b58b7af9085a208a22"}) 13:16:42 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r0, &(0x7f0000942000)={0x2, 0x4e20, @multicast1}, 0x10) sendmsg$key(0xffffffffffffffff, &(0x7f0000f56000)={0x0, 0x0, &(0x7f00008feff0)={&(0x7f0000000500)=ANY=[@ANYBLOB="020300090a1500000000000000000000030006190000000002000000e0000001003f00000000000002000100e625aa66dcef85847e479eb3c49000000400000000fd003e"], 0x44}}, 0x0) add_key(&(0x7f0000000080)='logon\x00', &(0x7f0000000100)={0x73, 0x79, 0x7a, 0x1}, &(0x7f0000001240), 0x0, 0xfffffffffffffff8) get_mempolicy(&(0x7f0000000000), &(0x7f00000001c0), 0x1ff, &(0x7f0000fff000/0x1000)=nil, 0x3) setsockopt$sock_int(r0, 0x1, 0x3c, &(0x7f0000d4effc)=0x1, 0x4) connect$inet(r0, &(0x7f0000000000)={0x2, 0x4e20, @dev={0xac, 0x14, 0x14, 0x18}}, 0x10) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f00000001c0)='tunl0\x00', 0x5) sendto$inet(r0, &(0x7f00006d1fd4)="db", 0x1, 0x4000010, &(0x7f00004daff0)={0x2, 0x0, @loopback, [0xa0008000]}, 0x10) 13:16:42 executing program 7: r0 = openat$cuse(0xffffffffffffff9c, &(0x7f0000000080)='/dev/cuse\x00', 0x2, 0x0) clone(0x1002102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000640), 0xffffffffffffffff) r1 = getpid() sched_setscheduler(r1, 0x5, &(0x7f0000000000)) write$FUSE_NOTIFY_DELETE(r0, &(0x7f0000000040)={0x29}, 0x29) [ 1504.574800] binder: 13762:13764 BC_INCREFS_DONE u0000000000000000 no match 13:16:42 executing program 3: perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000200)={0x26, 'hash\x00', 0x0, 0x0, 'sha1\x00'}, 0x58) r1 = accept$alg(r0, 0x0, 0x0) sendmmsg(r1, &(0x7f0000007f00)=[{{&(0x7f00000056c0)=@can, 0x3000, &(0x7f00000000c0)}}, {{&(0x7f0000005900)=@pppoe={0x18, 0x0, {0x0, @link_local, 'syzkaller0\x00'}}, 0x80, &(0x7f0000007ac0), 0x1a9, &(0x7f0000007b00)}}], 0x3fffffffffffe0d, 0x0) r2 = openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000140)='/dev/sequencer2\x00', 0x80840, 0x0) chown(&(0x7f0000000340)='./file0\x00', 0x0, 0x0) r3 = fcntl$getown(r0, 0x9) getsockopt$inet_IP_XFRM_POLICY(r2, 0x0, 0x11, &(0x7f00000006c0)={{{@in6, @in=@multicast1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in=@rand_addr}, 0x0, @in6=@mcast2}}, &(0x7f00000007c0)=0xe8) stat(&(0x7f0000000800)='./file1\x00', &(0x7f0000000840)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) sendmsg$unix(r2, &(0x7f0000000900)={&(0x7f0000000380)=@file={0x1, './file0\x00'}, 0x6e, &(0x7f0000000680)=[{&(0x7f0000000400)="99ce7289ff5338f2f535af9c68a4523d2e304c708c3da9d53d22706864e831ccda012fd953ef788398357bc5e90402604422cca5416a8f56cf1e4a4ff55cd9e9c55819d5269f253320ce6b00b890b417c21d6d2b841af860245f4b21460d3298fb5e20", 0x63}, {&(0x7f0000000480)="b513097b657c7c7d9dd042ce321d31169becc7dc25384f55373a661953e7e4c79d1300075fb41150bac9bc49b720a3eba35643c974a768d5757b0d191c43eb863a4caac8c07ac6a70711a31a394f387afc0e6e5534f87f39f1186a3993858114dda1058ecffe0bba07facf1bf1f9dbb7491f62b7b50701df057b5c5104ceafd560b02d095844eea96401fa513cfb346d02bbf7f7b3eda97334c52b925fbfae17887832ef0ae25211075220442213f3f4b4619a417b7073392ef7ce2b94f2f51125d86b2506739b315459f4df1196507088a870ff779d9b9d501f8851c39c624192319f360e28f7d0b39a4fc70c4b2ebec21cec6b778fc5", 0xf7}, {&(0x7f0000000580)="5e782bfd5ea667f1af62656e2ea0297641ea9cb27b01a209201b5db0133c045d3b0db3befd9af81904730cca57f950cbf3cb072287d239298943036b641f852c3f3edf4757cc11ff70061f54a573d60cf6882bfd9b0148f8df440c408b09a0faa8413f5a588c68e705e6f955f56e767feffc905512e362c81ad9a87177e01b7c7ffb380d4d75ae9cadbff032d63d3ea2132882f0d8f9e3523fe5fa182ade58d72e6e3260d4a15a8b7e3a4a4a0e414972e6999bd4c152d77c16f703dc4593ffcabd50", 0xc2}, {&(0x7f0000000300)="558c7c7fcbdd4469171a3903c65c463fd6b8da45c92ae26d145c76833d699a36ee855c0e9908fa663b2a7b867fe5fa64fc", 0x31}], 0x4, &(0x7f00000008c0)=[@cred={0x20, 0x1, 0x2, r3, r4, r5}], 0x20, 0x80}, 0x4000) r6 = syz_open_dev$sndpcmc(&(0x7f00000000c0)='/dev/snd/pcmC#D#c\x00', 0x0, 0x0) setsockopt$IP_VS_SO_SET_ADDDEST(r6, 0x0, 0x487, &(0x7f0000000180)={{0x7e, @broadcast, 0x4e21, 0x2, 'nq\x00', 0x24, 0xfffffffffffffffa, 0x33}, {@empty, 0x4e24, 0x10007, 0x3, 0x3, 0x9}}, 0x44) ioctl$sock_inet_SIOCGARP(r2, 0x8954, &(0x7f0000000280)={{0x2, 0x4e23, @broadcast}, {0x306, @local}, 0x10, {0x2, 0x4e20, @rand_addr=0x2}, 'veth0_to_bond\x00'}) ioctl$ASHMEM_SET_NAME(r6, 0x41007701, &(0x7f0000000100)='syzkaller0\x00') [ 1504.862040] binder: 13787:13788 ioctl 4b49 20002340 returned -22 [ 1504.870087] binder: 13787:13789 ioctl 4b49 20002340 returned -22 13:16:43 executing program 1: r0 = socket$netlink(0x10, 0x3, 0x8000000004) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_TCP_CONGESTION(r1, 0x6, 0xd, &(0x7f0000000180)='vegas\x00', 0x6) bind$inet6(r1, &(0x7f00001fefe4)={0xa, 0x4e22}, 0x1c) sendto$inet6(r1, &(0x7f0000000100), 0x8d2d601e8976aa5, 0x20000004, &(0x7f000031e000)={0xa, 0x4e22}, 0x1c) writev(r0, &(0x7f0000000100)=[{&(0x7f0000000000)="580000001400192340834b80040d8c560a067f552bff81004e220000000058000b4824ca944f64009400050028925aa8000000000000008000f0fffeffff09000000fff5dd00000010000100000c0900fcff0000040e05a5", 0x58}], 0x1) 13:16:43 executing program 6: clone(0x802102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000040), 0xffffffffffffffff) r0 = syz_open_dev$sndtimer(&(0x7f0000000000)='/dev/snd/timer\x00', 0x0, 0x0) r1 = getpid() sched_setscheduler(r1, 0x5, &(0x7f0000000200)) ioctl$SNDRV_TIMER_IOCTL_GPARAMS(r0, 0x40485404, &(0x7f0000000240)={{}, 0x0, 0x2000000000000000, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x300000000000000]}) 13:16:43 executing program 7: r0 = openat$cuse(0xffffffffffffff9c, &(0x7f0000000080)='/dev/cuse\x00', 0x2, 0x0) clone(0x1002102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000640), 0xffffffffffffffff) r1 = getpid() sched_setscheduler(r1, 0x5, &(0x7f0000000000)) write$FUSE_NOTIFY_DELETE(r0, &(0x7f0000000040)={0x29}, 0x29) 13:16:43 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r0, &(0x7f0000942000)={0x2, 0x4e20, @multicast1}, 0x10) sendmsg$key(0xffffffffffffffff, &(0x7f0000f56000)={0x0, 0x0, &(0x7f00008feff0)={&(0x7f0000000500)=ANY=[@ANYBLOB="020300090a1500000000000000000000030006190000000002000000e0000001003f00000000000002000100e625aa66dcef85847e479eb3c49000000400000000fd003e"], 0x44}}, 0x0) add_key(&(0x7f0000000080)='logon\x00', &(0x7f0000000100)={0x73, 0x79, 0x7a, 0x1}, &(0x7f0000001240), 0x0, 0xfffffffffffffff8) get_mempolicy(&(0x7f0000000000), &(0x7f00000001c0), 0x1ff, &(0x7f0000fff000/0x1000)=nil, 0x3) setsockopt$sock_int(r0, 0x1, 0x3c, &(0x7f0000d4effc)=0x1, 0x4) connect$inet(r0, &(0x7f0000000000)={0x2, 0x4e20, @dev={0xac, 0x14, 0x14, 0x18}}, 0x10) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f00000001c0)='tunl0\x00', 0x5) sendto$inet(r0, &(0x7f00006d1fd4)="db", 0x1, 0x4000010, &(0x7f00004daff0)={0x2, 0x0, @loopback, [0x7000000]}, 0x10) 13:16:43 executing program 5: r0 = syz_open_dev$binder(&(0x7f00000021c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000002340)={0x34, 0x0, &(0x7f0000002240)=[@request_death={0x400c630e, 0x4, 0x4}, @increfs={0x40046304, 0x4}, @increfs_done={0x40106308, 0x0, 0x3}, @increfs], 0x77, 0x6800, &(0x7f00000022c0)="b3cd0976d8e2af743c6f523efe14fd20c3c3dd2572734282a761e1b4304e2599c85f198cc82bd5d0c74c4edca2f9ea7b875ff7047ec0784fbb354e15fd3f7d837f533597d5082692a6f2fb748da3cc4157188f7f2a5477ded56f72f5b75c96872db429e44b8fcd781d96dead77a0b58b7af9085a208a22"}) 13:16:43 executing program 0: perf_event_open(&(0x7f0000000040)={0x2, 0x70, 0x3e5}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f00000021c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0x40087602, &(0x7f0000002340)={0xb5, 0x0, &(0x7f00000000c0)=ANY=[@ANYBLOB="0463044000000000b6a571ac965f26c50d500dae115e59afcd8a338d8b2727193c56d4ebef60c214b766ffde6cff6ceef2baa2594a53a0117e77afd5d58e8a35afdae81b258585ce769507333c0238790d5ed750bf1d6ca2a873050056528fce7becfd12f165ac43a826d3462822ff8f29ea992d4e208847cf4fc10ca00b87b5ce2523fa477bad0be1c97e4398aa2ac81d973b5a871d8e0b295e436cd8415f19088c6c82c85f4ed1fac41da062bc6dbfb8eac4276c"], 0x0, 0x0, &(0x7f00000022c0)}) 13:16:43 executing program 4: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = gettid() perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x3e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff7fffffffffff}, 0x0, 0x0, 0xffffffffffffffff, 0x0) fcntl$setown(r0, 0x8, r1) bind$inet6(r0, &(0x7f0000807fe4)={0xa, 0x4e22}, 0x1c) sendto$inet6(r0, &(0x7f0000000380), 0x0, 0x200408d4, &(0x7f000072e000)={0xa, 0x4e22, 0x0, @loopback}, 0x1c) sendto$inet6(r0, &(0x7f0000ad6fad)='\x00', 0x1, 0x3fffffd, &(0x7f0000254000)={0xa, 0x0, 0x0, @loopback}, 0x1c) 13:16:43 executing program 3: perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$alg(0x26, 0x5, 0x0) openat$dsp(0xffffffffffffff9c, &(0x7f0000000180)='/dev/dsp\x00', 0x801, 0x0) bind$alg(r0, &(0x7f0000000200)={0x26, 'hash\x00', 0x0, 0x0, 'sha1\x00'}, 0x58) r1 = accept$alg(r0, 0x0, 0x0) sendmmsg(r1, &(0x7f0000007f00)=[{{&(0x7f00000056c0)=@can, 0x3000, &(0x7f00000000c0)}}, {{&(0x7f0000005900)=@pppoe={0x18, 0x0, {0x0, @link_local, 'syzkaller0\x00'}}, 0x80, &(0x7f0000007ac0), 0x1a9, &(0x7f0000007b00)}}], 0x3fffffffffffe0d, 0x0) openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000140)='/dev/sequencer2\x00', 0x80840, 0x0) chown(&(0x7f0000000340)='./file0\x00', 0x0, 0x0) r2 = syz_open_dev$sndpcmc(&(0x7f00000000c0)='/dev/snd/pcmC#D#c\x00', 0x0, 0x0) ioctl$ASHMEM_SET_NAME(r2, 0x41007701, &(0x7f0000000100)='syzkaller0\x00') 13:16:43 executing program 6: clone(0x802102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000040), 0xffffffffffffffff) r0 = syz_open_dev$sndtimer(&(0x7f0000000000)='/dev/snd/timer\x00', 0x0, 0x0) r1 = getpid() sched_setscheduler(r1, 0x5, &(0x7f0000000200)) ioctl$SNDRV_TIMER_IOCTL_GPARAMS(r0, 0x40485404, &(0x7f0000000240)={{}, 0x0, 0x2000000000000000, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x100000000000000]}) 13:16:43 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r0, &(0x7f0000942000)={0x2, 0x4e20, @multicast1}, 0x10) sendmsg$key(0xffffffffffffffff, &(0x7f0000f56000)={0x0, 0x0, &(0x7f00008feff0)={&(0x7f0000000500)=ANY=[@ANYBLOB="020300090a1500000000000000000000030006190000000002000000e0000001003f00000000000002000100e625aa66dcef85847e479eb3c49000000400000000fd003e"], 0x44}}, 0x0) add_key(&(0x7f0000000080)='logon\x00', &(0x7f0000000100)={0x73, 0x79, 0x7a, 0x1}, &(0x7f0000001240), 0x0, 0xfffffffffffffff8) get_mempolicy(&(0x7f0000000000), &(0x7f00000001c0), 0x1ff, &(0x7f0000fff000/0x1000)=nil, 0x3) setsockopt$sock_int(r0, 0x1, 0x3c, &(0x7f0000d4effc)=0x1, 0x4) connect$inet(r0, &(0x7f0000000000)={0x2, 0x4e20, @dev={0xac, 0x14, 0x14, 0x18}}, 0x10) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f00000001c0)='tunl0\x00', 0x5) sendto$inet(r0, &(0x7f00006d1fd4)="db", 0x1, 0x4000010, &(0x7f00004daff0)={0x2, 0x0, @loopback, [0x8002a0]}, 0x10) [ 1505.108683] binder_thread_write: 15 callbacks suppressed [ 1505.108697] binder: 13798:13808 BC_REQUEST_DEATH_NOTIFICATION invalid ref 4 13:16:43 executing program 6: clone(0x802102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000040), 0xffffffffffffffff) r0 = syz_open_dev$sndtimer(&(0x7f0000000000)='/dev/snd/timer\x00', 0x0, 0x0) r1 = getpid() sched_setscheduler(r1, 0x5, &(0x7f0000000200)) ioctl$SNDRV_TIMER_IOCTL_GPARAMS(r0, 0x40485404, &(0x7f0000000240)={{}, 0x0, 0x2000000000000000, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1000000]}) [ 1505.198338] binder: 13798:13808 BC_INCREFS_DONE u0000000000000000 no match 13:16:43 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r0, &(0x7f0000942000)={0x2, 0x4e20, @multicast1}, 0x10) sendmsg$key(0xffffffffffffffff, &(0x7f0000f56000)={0x0, 0x0, &(0x7f00008feff0)={&(0x7f0000000500)=ANY=[@ANYBLOB="020300090a1500000000000000000000030006190000000002000000e0000001003f00000000000002000100e625aa66dcef85847e479eb3c49000000400000000fd003e"], 0x44}}, 0x0) add_key(&(0x7f0000000080)='logon\x00', &(0x7f0000000100)={0x73, 0x79, 0x7a, 0x1}, &(0x7f0000001240), 0x0, 0xfffffffffffffff8) get_mempolicy(&(0x7f0000000000), &(0x7f00000001c0), 0x1ff, &(0x7f0000fff000/0x1000)=nil, 0x3) setsockopt$sock_int(r0, 0x1, 0x3c, &(0x7f0000d4effc)=0x1, 0x4) connect$inet(r0, &(0x7f0000000000)={0x2, 0x4e20, @dev={0xac, 0x14, 0x14, 0x18}}, 0x10) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f00000001c0)='tunl0\x00', 0x5) sendto$inet(r0, &(0x7f00006d1fd4)="db", 0x1, 0x4000010, &(0x7f00004daff0)={0x2, 0x0, @loopback, [0xa000000]}, 0x10) 13:16:43 executing program 5: r0 = syz_open_dev$binder(&(0x7f00000021c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000002340)={0x34, 0x0, &(0x7f0000002240)=[@request_death={0x400c630e, 0x4, 0x4}, @increfs={0x40046304, 0x4}, @increfs_done={0x40106308, 0x0, 0x3}, @increfs], 0x77, 0x10000000, &(0x7f00000022c0)="b3cd0976d8e2af743c6f523efe14fd20c3c3dd2572734282a761e1b4304e2599c85f198cc82bd5d0c74c4edca2f9ea7b875ff7047ec0784fbb354e15fd3f7d837f533597d5082692a6f2fb748da3cc4157188f7f2a5477ded56f72f5b75c96872db429e44b8fcd781d96dead77a0b58b7af9085a208a22"}) 13:16:43 executing program 6: clone(0x802102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000040), 0xffffffffffffffff) r0 = syz_open_dev$sndtimer(&(0x7f0000000000)='/dev/snd/timer\x00', 0x0, 0x0) r1 = getpid() sched_setscheduler(r1, 0x5, &(0x7f0000000200)) ioctl$SNDRV_TIMER_IOCTL_GPARAMS(r0, 0x40485404, &(0x7f0000000240)={{}, 0x0, 0x2000000000000000, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3]}) 13:16:43 executing program 7: r0 = openat$cuse(0xffffffffffffff9c, &(0x7f0000000080)='/dev/cuse\x00', 0x2, 0x0) clone(0x1002102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000640), 0xffffffffffffffff) r1 = getpid() sched_setscheduler(r1, 0x5, &(0x7f0000000000)) write$FUSE_NOTIFY_DELETE(r0, &(0x7f0000000040)={0x29}, 0x29) 13:16:43 executing program 3: perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$alg(0x26, 0x5, 0x0) accept$alg(r0, 0x0, 0x0) bind$alg(r0, &(0x7f0000000200)={0x26, 'hash\x00', 0x0, 0x0, 'sha1\x00'}, 0x58) r1 = accept$alg(r0, 0x0, 0x0) sendmmsg(r1, &(0x7f0000007f00)=[{{&(0x7f00000056c0)=@can, 0x3000, &(0x7f00000000c0)}}, {{&(0x7f0000005900)=@pppoe={0x18, 0x0, {0x0, @link_local, 'syzkaller0\x00'}}, 0x80, &(0x7f0000007ac0), 0x1a9, &(0x7f0000007b00)}}], 0x3fffffffffffe0d, 0x0) openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000140)='/dev/sequencer2\x00', 0x80840, 0x0) chown(&(0x7f0000000340)='./file0\x00', 0x0, 0x0) r2 = syz_open_dev$sndpcmc(&(0x7f00000000c0)='/dev/snd/pcmC#D#c\x00', 0x0, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r2, &(0x7f0000000280)={0x0, 0x18, 0xfa00, {0x3, &(0x7f00000001c0)={0xffffffffffffffff}, 0x13f}}, 0x20) write$RDMA_USER_CM_CMD_DESTROY_ID(r0, &(0x7f00000002c0)={0x1, 0x10, 0xfa00, {&(0x7f0000000180), r3}}, 0x18) ioctl$ASHMEM_SET_NAME(r2, 0x41007701, &(0x7f0000000100)='syzkaller0\x00') [ 1505.457113] binder: 13799:13841 ioctl 40087602 20002340 returned -22 [ 1505.486518] binder: 13838:13848 BC_REQUEST_DEATH_NOTIFICATION invalid ref 4 [ 1505.494142] binder: 13838:13848 BC_INCREFS_DONE u0000000000000000 no match [ 1505.656881] binder: 13799:13863 ioctl 40087602 20002340 returned -22 13:16:44 executing program 1: r0 = socket$netlink(0x10, 0x3, 0x8000000004) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_TCP_CONGESTION(r1, 0x6, 0xd, &(0x7f0000000180)='vegas\x00', 0x6) bind$inet6(r1, &(0x7f00001fefe4)={0xa, 0x4e22}, 0x1c) sendto$inet6(r1, &(0x7f0000000100), 0x8d2d601e8976aa5, 0x20000004, &(0x7f000031e000)={0xa, 0x4e22}, 0x1c) writev(r0, &(0x7f0000000100)=[{&(0x7f0000000000)="580000001400192340834b80040d8c560a067f1261ff81004e220000000058000b4824ca944f64009400050028925aa8000000000000008000f0fffeffff09000000fff5dd00000010000100000c0900fcff0000040e05a5", 0x58}], 0x1) 13:16:44 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r0, &(0x7f0000942000)={0x2, 0x4e20, @multicast1}, 0x10) sendmsg$key(0xffffffffffffffff, &(0x7f0000f56000)={0x0, 0x0, &(0x7f00008feff0)={&(0x7f0000000500)=ANY=[@ANYBLOB="020300090a1500000000000000000000030006190000000002000000e0000001003f00000000000002000100e625aa66dcef85847e479eb3c49000000400000000fd003e"], 0x44}}, 0x0) add_key(&(0x7f0000000080)='logon\x00', &(0x7f0000000100)={0x73, 0x79, 0x7a, 0x1}, &(0x7f0000001240), 0x0, 0xfffffffffffffff8) get_mempolicy(&(0x7f0000000000), &(0x7f00000001c0), 0x1ff, &(0x7f0000fff000/0x1000)=nil, 0x3) setsockopt$sock_int(r0, 0x1, 0x3c, &(0x7f0000d4effc)=0x1, 0x4) connect$inet(r0, &(0x7f0000000000)={0x2, 0x4e20, @dev={0xac, 0x14, 0x14, 0x18}}, 0x10) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f00000001c0)='tunl0\x00', 0x5) sendto$inet(r0, &(0x7f00006d1fd4)="db", 0x1, 0x4000010, &(0x7f00004daff0)={0x2, 0x0, @loopback, [0x1100000000000000]}, 0x10) 13:16:44 executing program 5: r0 = syz_open_dev$binder(&(0x7f00000021c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000002340)={0x34, 0x0, &(0x7f0000002240)=[@request_death={0x400c630e, 0x4, 0x4}, @increfs={0x40046304, 0x4}, @increfs_done={0x40106308, 0x0, 0x3}, @increfs], 0x77, 0xffffffffa0010000, &(0x7f00000022c0)="b3cd0976d8e2af743c6f523efe14fd20c3c3dd2572734282a761e1b4304e2599c85f198cc82bd5d0c74c4edca2f9ea7b875ff7047ec0784fbb354e15fd3f7d837f533597d5082692a6f2fb748da3cc4157188f7f2a5477ded56f72f5b75c96872db429e44b8fcd781d96dead77a0b58b7af9085a208a22"}) 13:16:44 executing program 7: r0 = openat$cuse(0xffffffffffffff9c, &(0x7f0000000080)='/dev/cuse\x00', 0x2, 0x0) clone(0x1002102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000640), 0xffffffffffffffff) getpid() write$FUSE_NOTIFY_DELETE(r0, &(0x7f0000000040)={0x29}, 0x29) 13:16:44 executing program 4: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = gettid() perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x3e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff7fffffffffff}, 0x0, 0x0, 0xffffffffffffffff, 0x0) fcntl$setown(r0, 0x8, r1) bind$inet6(r0, &(0x7f0000807fe4)={0xa, 0x4e22}, 0x1c) sendto$inet6(r0, &(0x7f0000000380), 0x0, 0x200408d4, &(0x7f000072e000)={0xa, 0x4e22, 0x0, @loopback}, 0x1c) sendto$inet6(r0, &(0x7f0000ad6fad)='\x00', 0x1, 0x3fffffd, &(0x7f0000254000)={0xa, 0x0, 0x0, @loopback}, 0x1c) 13:16:44 executing program 0: perf_event_open(&(0x7f0000000040)={0x2, 0x70, 0x3e5}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f00000021c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306263, &(0x7f0000002340)={0xb5, 0x0, &(0x7f00000000c0)=ANY=[@ANYBLOB="0463044000000000b6a571ac965f26c50d500dae115e59afcd8a338d8b2727193c56d4ebef60c214b766ffde6cff6ceef2baa2594a53a0117e77afd5d58e8a35afdae81b258585ce769507333c0238790d5ed750bf1d6ca2a873050056528fce7becfd12f165ac43a826d3462822ff8f29ea992d4e208847cf4fc10ca00b87b5ce2523fa477bad0be1c97e4398aa2ac81d973b5a871d8e0b295e436cd8415f19088c6c82c85f4ed1fac41da062bc6dbfb8eac4276c"], 0x0, 0x0, &(0x7f00000022c0)}) 13:16:44 executing program 6: clone(0x802102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000040), 0xffffffffffffffff) r0 = syz_open_dev$sndtimer(&(0x7f0000000000)='/dev/snd/timer\x00', 0x0, 0x0) r1 = getpid() sched_setscheduler(r1, 0x5, &(0x7f0000000200)) ioctl$SNDRV_TIMER_IOCTL_GPARAMS(r0, 0x40485404, &(0x7f0000000240)={{}, 0x0, 0x2000000000000000, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x100000000000000]}) 13:16:44 executing program 3: perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000200)={0x26, 'hash\x00', 0x0, 0x0, 'sha1\x00'}, 0x58) r1 = accept$alg(r0, 0x0, 0x0) sendmmsg(r1, &(0x7f0000007f00)=[{{&(0x7f00000056c0)=@can, 0x3000, &(0x7f00000000c0)}}, {{&(0x7f0000005900)=@pppoe={0x18, 0x0, {0x0, @link_local, 'syzkaller0\x00'}}, 0x80, &(0x7f0000007ac0), 0x1a9, &(0x7f0000007b00)}}], 0x3fffffffffffe0d, 0x0) openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000140)='/dev/sequencer2\x00', 0x80840, 0x0) chown(&(0x7f00000002c0)='./file0\x00', 0x0, 0x0) r2 = syz_open_dev$sndpcmc(&(0x7f00000000c0)='/dev/snd/pcmC#D#c\x00', 0x0, 0x0) ioctl$ASHMEM_SET_NAME(r2, 0x41007701, &(0x7f0000000100)='syzkaller0\x00') 13:16:44 executing program 7: r0 = openat$cuse(0xffffffffffffff9c, &(0x7f0000000080)='/dev/cuse\x00', 0x2, 0x0) clone(0x1002102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000640), 0xffffffffffffffff) sched_setscheduler(0x0, 0x5, &(0x7f0000000000)) write$FUSE_NOTIFY_DELETE(r0, &(0x7f0000000040)={0x29}, 0x29) 13:16:44 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r0, &(0x7f0000942000)={0x2, 0x4e20, @multicast1}, 0x10) sendmsg$key(0xffffffffffffffff, &(0x7f0000f56000)={0x0, 0x0, &(0x7f00008feff0)={&(0x7f0000000500)=ANY=[@ANYBLOB="020300090a1500000000000000000000030006190000000002000000e0000001003f00000000000002000100e625aa66dcef85847e479eb3c49000000400000000fd003e"], 0x44}}, 0x0) add_key(&(0x7f0000000080)='logon\x00', &(0x7f0000000100)={0x73, 0x79, 0x7a, 0x1}, &(0x7f0000001240), 0x0, 0xfffffffffffffff8) get_mempolicy(&(0x7f0000000000), &(0x7f00000001c0), 0x1ff, &(0x7f0000fff000/0x1000)=nil, 0x3) setsockopt$sock_int(r0, 0x1, 0x3c, &(0x7f0000d4effc)=0x1, 0x4) connect$inet(r0, &(0x7f0000000000)={0x2, 0x4e20, @dev={0xac, 0x14, 0x14, 0x18}}, 0x10) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f00000001c0)='tunl0\x00', 0x5) sendto$inet(r0, &(0x7f00006d1fd4)="db", 0x1, 0x4000010, &(0x7f00004daff0)={0x2, 0x0, @loopback, [0x1a0ffffffff]}, 0x10) [ 1506.093713] binder: 13870:13885 BC_REQUEST_DEATH_NOTIFICATION invalid ref 4 13:16:44 executing program 7: r0 = openat$cuse(0xffffffffffffff9c, &(0x7f0000000080)='/dev/cuse\x00', 0x2, 0x0) clone(0x1002102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000640), 0xffffffffffffffff) sched_setscheduler(0x0, 0x5, &(0x7f0000000000)) write$FUSE_NOTIFY_DELETE(r0, &(0x7f0000000040)={0x29}, 0x29) [ 1506.182744] binder: 13870:13885 BC_INCREFS_DONE u0000000000000000 no match 13:16:44 executing program 5: r0 = syz_open_dev$binder(&(0x7f00000021c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000002340)={0x34, 0x0, &(0x7f0000002240)=[@request_death={0x400c630e, 0x4, 0x4}, @increfs={0x40046304, 0x4}, @increfs_done={0x40106308, 0x0, 0x3}, @increfs], 0x77, 0x74, &(0x7f00000022c0)="b3cd0976d8e2af743c6f523efe14fd20c3c3dd2572734282a761e1b4304e2599c85f198cc82bd5d0c74c4edca2f9ea7b875ff7047ec0784fbb354e15fd3f7d837f533597d5082692a6f2fb748da3cc4157188f7f2a5477ded56f72f5b75c96872db429e44b8fcd781d96dead77a0b58b7af9085a208a22"}) 13:16:44 executing program 7: r0 = openat$cuse(0xffffffffffffff9c, &(0x7f0000000080)='/dev/cuse\x00', 0x2, 0x0) clone(0x1002102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000640), 0xffffffffffffffff) sched_setscheduler(0x0, 0x5, &(0x7f0000000000)) write$FUSE_NOTIFY_DELETE(r0, &(0x7f0000000040)={0x29}, 0x29) 13:16:44 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r0, &(0x7f0000942000)={0x2, 0x4e20, @multicast1}, 0x10) sendmsg$key(0xffffffffffffffff, &(0x7f0000f56000)={0x0, 0x0, &(0x7f00008feff0)={&(0x7f0000000500)=ANY=[@ANYBLOB="020300090a1500000000000000000000030006190000000002000000e0000001003f00000000000002000100e625aa66dcef85847e479eb3c49000000400000000fd003e"], 0x44}}, 0x0) add_key(&(0x7f0000000080)='logon\x00', &(0x7f0000000100)={0x73, 0x79, 0x7a, 0x1}, &(0x7f0000001240), 0x0, 0xfffffffffffffff8) get_mempolicy(&(0x7f0000000000), &(0x7f00000001c0), 0x1ff, &(0x7f0000fff000/0x1000)=nil, 0x3) setsockopt$sock_int(r0, 0x1, 0x3c, &(0x7f0000d4effc)=0x1, 0x4) connect$inet(r0, &(0x7f0000000000)={0x2, 0x4e20, @dev={0xac, 0x14, 0x14, 0x18}}, 0x10) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f00000001c0)='tunl0\x00', 0x5) sendto$inet(r0, &(0x7f00006d1fd4)="db", 0x1, 0x4000010, &(0x7f00004daff0)={0x2, 0x0, @loopback, [0xf4010000]}, 0x10) 13:16:44 executing program 3: perf_event_open(&(0x7f0000000040)={0x2, 0x70, 0x0, 0x3, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0xfffffffffffff693, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp, 0x0, 0x0, 0x0, 0x1000}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000200)={0x26, 'hash\x00', 0x0, 0x0, 'sha1\x00'}, 0x58) r1 = accept$alg(r0, 0x0, 0x0) sendmmsg(r1, &(0x7f0000007f00)=[{{&(0x7f00000056c0)=@can, 0x3000, &(0x7f00000000c0)}}, {{&(0x7f0000005900)=@pppoe={0x18, 0x0, {0x0, @link_local, 'syzkaller0\x00'}}, 0x80, &(0x7f0000007ac0), 0x1a9, &(0x7f0000007b00)}}], 0x3fffffffffffe0d, 0x0) openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000140)='/dev/sequencer2\x00', 0x80840, 0x0) chown(&(0x7f0000000340)='./file0\x00', 0x0, 0x0) r2 = syz_open_dev$sndpcmc(&(0x7f00000000c0)='/dev/snd/pcmC#D#c\x00', 0xfffdfffffffffffd, 0x0) ioctl$ASHMEM_SET_NAME(r2, 0x41007701, &(0x7f0000000100)='syzkaller0\x00') 13:16:44 executing program 7: r0 = openat$cuse(0xffffffffffffff9c, &(0x7f0000000080)='/dev/cuse\x00', 0x2, 0x0) r1 = getpid() sched_setscheduler(r1, 0x5, &(0x7f0000000000)) write$FUSE_NOTIFY_DELETE(r0, &(0x7f0000000040)={0x29}, 0x29) [ 1506.389130] binder: 13907:13910 BC_REQUEST_DEATH_NOTIFICATION invalid ref 4 [ 1506.620193] binder: 13922:13926 ioctl c0306263 20002340 returned -22 [ 1506.629152] binder: 13922:13927 ioctl c0306263 20002340 returned -22 13:16:44 executing program 1: r0 = socket$netlink(0x10, 0x3, 0x8000000004) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_TCP_CONGESTION(r1, 0x6, 0xd, &(0x7f0000000180)='vegas\x00', 0x6) bind$inet6(r1, &(0x7f00001fefe4)={0xa, 0x4e22}, 0x1c) sendto$inet6(r1, &(0x7f0000000100), 0x8d2d601e8976aa5, 0x20000004, &(0x7f000031e000)={0xa, 0x4e22}, 0x1c) writev(r0, &(0x7f0000000100)=[{&(0x7f0000000000)="580000001400192340834b80040d8c560a067f27beff81004e220000000058000b4824ca944f64009400050028925aa8000000000000008000f0fffeffff09000000fff5dd00000010000100000c0900fcff0000040e05a5", 0x58}], 0x1) 13:16:44 executing program 5: r0 = syz_open_dev$binder(&(0x7f00000021c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000002340)={0x34, 0x0, &(0x7f0000002240)=[@request_death={0x400c630e, 0x4, 0x4}, @increfs={0x40046304, 0x4}, @increfs_done={0x40106308, 0x0, 0x3}, @increfs], 0x77, 0x600000000000000, &(0x7f00000022c0)="b3cd0976d8e2af743c6f523efe14fd20c3c3dd2572734282a761e1b4304e2599c85f198cc82bd5d0c74c4edca2f9ea7b875ff7047ec0784fbb354e15fd3f7d837f533597d5082692a6f2fb748da3cc4157188f7f2a5477ded56f72f5b75c96872db429e44b8fcd781d96dead77a0b58b7af9085a208a22"}) 13:16:44 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r0, &(0x7f0000942000)={0x2, 0x4e20, @multicast1}, 0x10) sendmsg$key(0xffffffffffffffff, &(0x7f0000f56000)={0x0, 0x0, &(0x7f00008feff0)={&(0x7f0000000500)=ANY=[@ANYBLOB="020300090a1500000000000000000000030006190000000002000000e0000001003f00000000000002000100e625aa66dcef85847e479eb3c49000000400000000fd003e"], 0x44}}, 0x0) add_key(&(0x7f0000000080)='logon\x00', &(0x7f0000000100)={0x73, 0x79, 0x7a, 0x1}, &(0x7f0000001240), 0x0, 0xfffffffffffffff8) get_mempolicy(&(0x7f0000000000), &(0x7f00000001c0), 0x1ff, &(0x7f0000fff000/0x1000)=nil, 0x3) setsockopt$sock_int(r0, 0x1, 0x3c, &(0x7f0000d4effc)=0x1, 0x4) connect$inet(r0, &(0x7f0000000000)={0x2, 0x4e20, @dev={0xac, 0x14, 0x14, 0x18}}, 0x10) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f00000001c0)='tunl0\x00', 0x5) sendto$inet(r0, &(0x7f00006d1fd4)="db", 0x1, 0x4000010, &(0x7f00004daff0)={0x2, 0x0, @loopback, [0x5000000]}, 0x10) 13:16:44 executing program 6: clone(0x802102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000040), 0xffffffffffffffff) r0 = syz_open_dev$sndtimer(&(0x7f0000000000)='/dev/snd/timer\x00', 0x0, 0x0) r1 = getpid() sched_setscheduler(r1, 0x5, &(0x7f0000000200)) ioctl$SNDRV_TIMER_IOCTL_GPARAMS(r0, 0x40485404, &(0x7f0000000240)={{}, 0x0, 0x2000000000000000, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x300000000000000]}) 13:16:44 executing program 3: perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000200)={0x26, 'hash\x00', 0x0, 0x0, 'sha1\x00'}, 0x58) r1 = accept$alg(r0, 0x0, 0x0) sendmmsg(r1, &(0x7f0000007f00)=[{{&(0x7f00000056c0)=@can, 0x3000, &(0x7f00000000c0)}}, {{&(0x7f0000005900)=@pppoe={0x18, 0x0, {0x0, @link_local, 'syzkaller0\x00'}}, 0x80, &(0x7f0000007ac0), 0x1a9, &(0x7f0000007b00)}}], 0x3fffffffffffe0d, 0x0) openat$tun(0xffffffffffffff9c, &(0x7f0000000180)='/dev/net/tun\x00', 0x141000, 0x0) r2 = openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000140)='/dev/sequencer2\x00', 0x80840, 0x0) chown(&(0x7f0000000340)='./file0\x00', 0x0, 0x0) getpeername$unix(r2, &(0x7f0000000280)=@abs, &(0x7f0000000300)=0x6e) r3 = syz_open_dev$sndpcmc(&(0x7f00000000c0)='/dev/snd/pcmC#D#c\x00', 0x0, 0x0) ioctl$ASHMEM_SET_NAME(r3, 0x41007701, &(0x7f0000000100)='syzkaller0\x00') prctl$setname(0xf, &(0x7f00000001c0)='sha1\x00') getsockopt$inet_sctp_SCTP_FRAGMENT_INTERLEAVE(r3, 0x84, 0x12, &(0x7f0000000380), &(0x7f00000003c0)=0x4) 13:16:44 executing program 4: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = gettid() perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x3e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff7fffffffffff}, 0x0, 0x0, 0xffffffffffffffff, 0x0) fcntl$setown(r0, 0x8, r1) bind$inet6(r0, &(0x7f0000807fe4)={0xa, 0x4e22}, 0x1c) sendto$inet6(r0, &(0x7f0000000380), 0x0, 0x200408d4, &(0x7f000072e000)={0xa, 0x4e22, 0x0, @loopback}, 0x1c) sendto$inet6(r0, &(0x7f0000ad6fad)='\x00', 0x1, 0x3fffffd, &(0x7f0000254000)={0xa, 0x0, 0x0, @loopback}, 0x1c) 13:16:44 executing program 7: clone(0x1002102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000640), 0xffffffffffffffff) r0 = getpid() sched_setscheduler(r0, 0x5, &(0x7f0000000000)) write$FUSE_NOTIFY_DELETE(0xffffffffffffffff, &(0x7f0000000040)={0x29}, 0x29) 13:16:44 executing program 0: perf_event_open(&(0x7f0000000040)={0x2, 0x70, 0x3e5}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f00000021c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0x5451, &(0x7f0000002340)={0xb5, 0x0, &(0x7f00000000c0)=ANY=[@ANYBLOB="0463044000000000b6a571ac965f26c50d500dae115e59afcd8a338d8b2727193c56d4ebef60c214b766ffde6cff6ceef2baa2594a53a0117e77afd5d58e8a35afdae81b258585ce769507333c0238790d5ed750bf1d6ca2a873050056528fce7becfd12f165ac43a826d3462822ff8f29ea992d4e208847cf4fc10ca00b87b5ce2523fa477bad0be1c97e4398aa2ac81d973b5a871d8e0b295e436cd8415f19088c6c82c85f4ed1fac41da062bc6dbfb8eac4276c"], 0x0, 0x0, &(0x7f00000022c0)}) 13:16:45 executing program 7: clone(0x1002102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000640), 0xffffffffffffffff) r0 = getpid() sched_setscheduler(r0, 0x5, &(0x7f0000000000)) write$FUSE_NOTIFY_DELETE(0xffffffffffffffff, &(0x7f0000000040)={0x29}, 0x29) [ 1506.932501] binder: 13930:13940 BC_REQUEST_DEATH_NOTIFICATION invalid ref 4 13:16:45 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r0, &(0x7f0000942000)={0x2, 0x4e20, @multicast1}, 0x10) sendmsg$key(0xffffffffffffffff, &(0x7f0000f56000)={0x0, 0x0, &(0x7f00008feff0)={&(0x7f0000000500)=ANY=[@ANYBLOB="020300090a1500000000000000000000030006190000000002000000e0000001003f00000000000002000100e625aa66dcef85847e479eb3c49000000400000000fd003e"], 0x44}}, 0x0) add_key(&(0x7f0000000080)='logon\x00', &(0x7f0000000100)={0x73, 0x79, 0x7a, 0x1}, &(0x7f0000001240), 0x0, 0xfffffffffffffff8) get_mempolicy(&(0x7f0000000000), &(0x7f00000001c0), 0x1ff, &(0x7f0000fff000/0x1000)=nil, 0x3) setsockopt$sock_int(r0, 0x1, 0x3c, &(0x7f0000d4effc)=0x1, 0x4) connect$inet(r0, &(0x7f0000000000)={0x2, 0x4e20, @dev={0xac, 0x14, 0x14, 0x18}}, 0x10) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f00000001c0)='tunl0\x00', 0x5) sendto$inet(r0, &(0x7f00006d1fd4)="db", 0x1, 0x4000010, &(0x7f00004daff0)={0x2, 0x0, @loopback, [0x3f000000]}, 0x10) 13:16:45 executing program 7: r0 = openat$cuse(0xffffffffffffff9c, &(0x7f0000000080)='/dev/cuse\x00', 0x2, 0x0) clone(0x0, 0x0, 0xfffffffffffffffe, &(0x7f0000000640), 0xffffffffffffffff) r1 = getpid() sched_setscheduler(r1, 0x5, &(0x7f0000000000)) write$FUSE_NOTIFY_DELETE(r0, &(0x7f0000000040)={0x29}, 0x29) 13:16:45 executing program 6: clone(0x802102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000040), 0xffffffffffffffff) r0 = syz_open_dev$sndtimer(&(0x7f0000000000)='/dev/snd/timer\x00', 0x0, 0x0) r1 = getpid() sched_setscheduler(r1, 0x5, &(0x7f0000000200)) ioctl$SNDRV_TIMER_IOCTL_GPARAMS(r0, 0x40485404, &(0x7f0000000240)={{}, 0x0, 0x2000000000000000, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3000000]}) 13:16:45 executing program 5: r0 = syz_open_dev$binder(&(0x7f00000021c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000002340)={0x34, 0x0, &(0x7f0000002240)=[@request_death={0x400c630e, 0x4, 0x4}, @increfs={0x40046304, 0x4}, @increfs_done={0x40106308, 0x0, 0x3}, @increfs], 0x77, 0x4800000000000000, &(0x7f00000022c0)="b3cd0976d8e2af743c6f523efe14fd20c3c3dd2572734282a761e1b4304e2599c85f198cc82bd5d0c74c4edca2f9ea7b875ff7047ec0784fbb354e15fd3f7d837f533597d5082692a6f2fb748da3cc4157188f7f2a5477ded56f72f5b75c96872db429e44b8fcd781d96dead77a0b58b7af9085a208a22"}) 13:16:45 executing program 6: clone(0x802102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000040), 0xffffffffffffffff) r0 = syz_open_dev$sndtimer(&(0x7f0000000000)='/dev/snd/timer\x00', 0x0, 0x0) r1 = getpid() sched_setscheduler(r1, 0x5, &(0x7f0000000200)) ioctl$SNDRV_TIMER_IOCTL_GPARAMS(r0, 0x40485404, &(0x7f0000000240)={{}, 0x0, 0x2000000000000000, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1000000]}) 13:16:45 executing program 7: r0 = openat$cuse(0xffffffffffffff9c, &(0x7f0000000080)='/dev/cuse\x00', 0x2, 0x0) clone(0x1002102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000640), 0xffffffffffffffff) getpid() sched_setscheduler(0x0, 0x5, &(0x7f0000000000)) write$FUSE_NOTIFY_DELETE(r0, &(0x7f0000000040)={0x29}, 0x29) 13:16:45 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r0, &(0x7f0000942000)={0x2, 0x4e20, @multicast1}, 0x10) sendmsg$key(0xffffffffffffffff, &(0x7f0000f56000)={0x0, 0x0, &(0x7f00008feff0)={&(0x7f0000000500)=ANY=[@ANYBLOB="020300090a1500000000000000000000030006190000000002000000e0000001003f00000000000002000100e625aa66dcef85847e479eb3c49000000400000000fd003e"], 0x44}}, 0x0) add_key(&(0x7f0000000080)='logon\x00', &(0x7f0000000100)={0x73, 0x79, 0x7a, 0x1}, &(0x7f0000001240), 0x0, 0xfffffffffffffff8) get_mempolicy(&(0x7f0000000000), &(0x7f00000001c0), 0x1ff, &(0x7f0000fff000/0x1000)=nil, 0x3) setsockopt$sock_int(r0, 0x1, 0x3c, &(0x7f0000d4effc)=0x1, 0x4) connect$inet(r0, &(0x7f0000000000)={0x2, 0x4e20, @dev={0xac, 0x14, 0x14, 0x18}}, 0x10) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f00000001c0)='tunl0\x00', 0x5) sendto$inet(r0, &(0x7f00006d1fd4)="db", 0x1, 0x4000010, &(0x7f00004daff0)={0x2, 0x0, @loopback, [0x8000a0]}, 0x10) [ 1507.322317] binder: 13980:13984 BC_REQUEST_DEATH_NOTIFICATION invalid ref 4 13:16:45 executing program 1: r0 = socket$netlink(0x10, 0x3, 0x8000000004) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_TCP_CONGESTION(r1, 0x6, 0xd, &(0x7f0000000180)='vegas\x00', 0x6) bind$inet6(r1, &(0x7f00001fefe4)={0xa, 0x4e22}, 0x1c) sendto$inet6(r1, &(0x7f0000000100), 0x8d2d601e8976aa5, 0x20000004, &(0x7f000031e000)={0xa, 0x4e22}, 0x1c) writev(r0, &(0x7f0000000100)=[{&(0x7f0000000000)="580000001400192340834b80040d8c560a067f6acfff81004e220000000058000b4824ca944f64009400050028925aa8000000000000008000f0fffeffff09000000fff5dd00000010000100000c0900fcff0000040e05a5", 0x58}], 0x1) 13:16:45 executing program 7: r0 = openat$cuse(0xffffffffffffff9c, &(0x7f0000000080)='/dev/cuse\x00', 0x2, 0x0) clone(0x1002102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000640), 0xffffffffffffffff) getpid() sched_setscheduler(0x0, 0x5, &(0x7f0000000000)) write$FUSE_NOTIFY_DELETE(r0, &(0x7f0000000040)={0x29}, 0x29) 13:16:45 executing program 3: perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000200)={0x26, 'hash\x00', 0x0, 0x0, 'sha1\x00'}, 0x58) r1 = accept$alg(r0, 0x0, 0x0) sendmmsg(r1, &(0x7f0000007f00)=[{{&(0x7f00000056c0)=@can, 0x3000, &(0x7f00000000c0)}}, {{&(0x7f0000005900)=@pppoe={0x18, 0x0, {0x0, @link_local, 'syzkaller0\x00'}}, 0x80, &(0x7f0000007ac0), 0x1a9, &(0x7f0000007b00)}}], 0x3fffffffffffe0d, 0x0) r2 = openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000140)='/dev/sequencer2\x00', 0x80840, 0x0) chown(&(0x7f0000000340)='./file0\x00', 0x0, 0x0) r3 = socket$inet(0x2, 0x3, 0x4000000004006b61) setsockopt$inet_int(r3, 0x0, 0xca, &(0x7f0000000000), 0x10) ioctl$BLKROGET(r2, 0x125e, &(0x7f0000000180)) r4 = syz_open_dev$sndpcmc(&(0x7f00000000c0)='/dev/snd/pcmC#D#c\x00', 0x0, 0x0) ioctl$ASHMEM_SET_NAME(r4, 0x41007701, &(0x7f0000000100)='syzkaller0\x00') socket$inet6_udp(0xa, 0x2, 0x0) 13:16:45 executing program 5: r0 = syz_open_dev$binder(&(0x7f00000021c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000002340)={0x34, 0x0, &(0x7f0000002240)=[@request_death={0x400c630e, 0x4, 0x4}, @increfs={0x40046304, 0x4}, @increfs_done={0x40106308, 0x0, 0x3}, @increfs], 0x77, 0x4c00000000000000, &(0x7f00000022c0)="b3cd0976d8e2af743c6f523efe14fd20c3c3dd2572734282a761e1b4304e2599c85f198cc82bd5d0c74c4edca2f9ea7b875ff7047ec0784fbb354e15fd3f7d837f533597d5082692a6f2fb748da3cc4157188f7f2a5477ded56f72f5b75c96872db429e44b8fcd781d96dead77a0b58b7af9085a208a22"}) 13:16:45 executing program 6: clone(0x802102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000040), 0xffffffffffffffff) r0 = syz_open_dev$sndtimer(&(0x7f0000000000)='/dev/snd/timer\x00', 0x0, 0x0) r1 = getpid() sched_setscheduler(r1, 0x5, &(0x7f0000000200)) ioctl$SNDRV_TIMER_IOCTL_GPARAMS(r0, 0x40485404, &(0x7f0000000240)={{}, 0x0, 0x2000000000000000, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x300]}) 13:16:45 executing program 0: perf_event_open(&(0x7f0000000040)={0x2, 0x70, 0x3e5}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f00000021c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0x5450, &(0x7f0000002340)={0xb5, 0x0, &(0x7f00000000c0)=ANY=[@ANYBLOB="0463044000000000b6a571ac965f26c50d500dae115e59afcd8a338d8b2727193c56d4ebef60c214b766ffde6cff6ceef2baa2594a53a0117e77afd5d58e8a35afdae81b258585ce769507333c0238790d5ed750bf1d6ca2a873050056528fce7becfd12f165ac43a826d3462822ff8f29ea992d4e208847cf4fc10ca00b87b5ce2523fa477bad0be1c97e4398aa2ac81d973b5a871d8e0b295e436cd8415f19088c6c82c85f4ed1fac41da062bc6dbfb8eac4276c"], 0x0, 0x0, &(0x7f00000022c0)}) 13:16:45 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r0, &(0x7f0000942000)={0x2, 0x4e20, @multicast1}, 0x10) sendmsg$key(0xffffffffffffffff, &(0x7f0000f56000)={0x0, 0x0, &(0x7f00008feff0)={&(0x7f0000000500)=ANY=[@ANYBLOB="020300090a1500000000000000000000030006190000000002000000e0000001003f00000000000002000100e625aa66dcef85847e479eb3c49000000400000000fd003e"], 0x44}}, 0x0) add_key(&(0x7f0000000080)='logon\x00', &(0x7f0000000100)={0x73, 0x79, 0x7a, 0x1}, &(0x7f0000001240), 0x0, 0xfffffffffffffff8) get_mempolicy(&(0x7f0000000000), &(0x7f00000001c0), 0x1ff, &(0x7f0000fff000/0x1000)=nil, 0x3) setsockopt$sock_int(r0, 0x1, 0x3c, &(0x7f0000d4effc)=0x1, 0x4) connect$inet(r0, &(0x7f0000000000)={0x2, 0x4e20, @dev={0xac, 0x14, 0x14, 0x18}}, 0x10) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f00000001c0)='tunl0\x00', 0x5) sendto$inet(r0, &(0x7f00006d1fd4)="db", 0x1, 0x4000010, &(0x7f00004daff0)={0x2, 0x0, @loopback, [0xfffffffd]}, 0x10) 13:16:45 executing program 4: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = gettid() perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x3e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff7fffffffffff}, 0x0, 0x0, 0xffffffffffffffff, 0x0) fcntl$setown(r0, 0x8, r1) bind$inet6(r0, &(0x7f0000807fe4)={0xa, 0x4e22}, 0x1c) sendto$inet6(r0, &(0x7f0000ad6fad)='\x00', 0x1, 0x3fffffd, &(0x7f0000254000)={0xa, 0x0, 0x0, @loopback}, 0x1c) 13:16:45 executing program 7: r0 = openat$cuse(0xffffffffffffff9c, &(0x7f0000000080)='/dev/cuse\x00', 0x2, 0x0) clone(0x1002102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000640), 0xffffffffffffffff) getpid() sched_setscheduler(0x0, 0x5, &(0x7f0000000000)) write$FUSE_NOTIFY_DELETE(r0, &(0x7f0000000040)={0x29}, 0x29) [ 1507.852304] binder: 14005:14017 BC_REQUEST_DEATH_NOTIFICATION invalid ref 4 13:16:46 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r0, &(0x7f0000942000)={0x2, 0x4e20, @multicast1}, 0x10) sendmsg$key(0xffffffffffffffff, &(0x7f0000f56000)={0x0, 0x0, &(0x7f00008feff0)={&(0x7f0000000500)=ANY=[@ANYBLOB="020300090a1500000000000000000000030006190000000002000000e0000001003f00000000000002000100e625aa66dcef85847e479eb3c49000000400000000fd003e"], 0x44}}, 0x0) add_key(&(0x7f0000000080)='logon\x00', &(0x7f0000000100)={0x73, 0x79, 0x7a, 0x1}, &(0x7f0000001240), 0x0, 0xfffffffffffffff8) get_mempolicy(&(0x7f0000000000), &(0x7f00000001c0), 0x1ff, &(0x7f0000fff000/0x1000)=nil, 0x3) setsockopt$sock_int(r0, 0x1, 0x3c, &(0x7f0000d4effc)=0x1, 0x4) connect$inet(r0, &(0x7f0000000000)={0x2, 0x4e20, @dev={0xac, 0x14, 0x14, 0x18}}, 0x10) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f00000001c0)='tunl0\x00', 0x5) sendto$inet(r0, &(0x7f00006d1fd4)="db", 0x1, 0x4000010, &(0x7f00004daff0)={0x2, 0x0, @loopback, [0x2]}, 0x10) 13:16:46 executing program 7: r0 = openat$cuse(0xffffffffffffff9c, &(0x7f0000000080)='/dev/cuse\x00', 0x2, 0x0) clone(0x1002102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000640), 0xffffffffffffffff) r1 = getpid() sched_setscheduler(r1, 0x0, &(0x7f0000000000)) write$FUSE_NOTIFY_DELETE(r0, &(0x7f0000000040)={0x29}, 0x29) [ 1507.919618] binder_thread_write: 18 callbacks suppressed [ 1507.919648] binder: 14005:14017 IncRefs 0 refcount change on invalid ref 4 ret -22 [ 1507.952114] binder_thread_write: 3 callbacks suppressed [ 1507.952130] binder: 14005:14017 BC_INCREFS_DONE u0000000000000000 no match 13:16:46 executing program 3: perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000200)={0x26, 'hash\x00', 0x0, 0x0, 'sha1\x00'}, 0x58) r1 = accept$alg(r0, 0x0, 0x0) sendmmsg(r1, &(0x7f0000007f00)=[{{&(0x7f00000056c0)=@can, 0x3000, &(0x7f00000000c0)}}, {{&(0x7f0000005900)=@pppoe={0x18, 0x0, {0x0, @link_local, 'syzkaller0\x00'}}, 0x80, &(0x7f0000007ac0), 0x1a9, &(0x7f0000007b00)}}], 0x3fffffffffffe0d, 0x0) openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000140)='/dev/sequencer2\x00', 0x80840, 0x0) chown(&(0x7f0000000180)='./file0\x00', 0x0, 0x0) r2 = syz_open_dev$sndpcmc(&(0x7f00000000c0)='/dev/snd/pcmC#D#c\x00', 0x0, 0x0) ioctl$ASHMEM_SET_NAME(r2, 0x41007701, &(0x7f0000000100)='syzkaller0\x00') 13:16:46 executing program 7: openat$cuse(0xffffffffffffff9c, &(0x7f0000000080)='/dev/cuse\x00', 0x2, 0x0) clone(0x1002102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000640), 0xffffffffffffffff) r0 = getpid() sched_setscheduler(r0, 0x5, &(0x7f0000000000)) write$FUSE_NOTIFY_DELETE(0xffffffffffffffff, &(0x7f0000000040)={0x29}, 0x29) [ 1508.059129] binder: 14005:14017 IncRefs 0 refcount change on invalid ref 0 ret -22 [ 1508.088857] binder: 14005:14017 BC_REQUEST_DEATH_NOTIFICATION invalid ref 4 13:16:46 executing program 5: r0 = syz_open_dev$binder(&(0x7f00000021c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000002340)={0x34, 0x0, &(0x7f0000002240)=[@request_death={0x400c630e, 0x4, 0x4}, @increfs={0x40046304, 0x4}, @increfs_done={0x40106308, 0x0, 0x3}, @increfs], 0x77, 0x3f00000000000000, &(0x7f00000022c0)="b3cd0976d8e2af743c6f523efe14fd20c3c3dd2572734282a761e1b4304e2599c85f198cc82bd5d0c74c4edca2f9ea7b875ff7047ec0784fbb354e15fd3f7d837f533597d5082692a6f2fb748da3cc4157188f7f2a5477ded56f72f5b75c96872db429e44b8fcd781d96dead77a0b58b7af9085a208a22"}) [ 1508.123814] binder: 14005:14017 IncRefs 0 refcount change on invalid ref 4 ret -22 [ 1508.133698] binder: 14005:14017 BC_INCREFS_DONE u0000000000000000 no match [ 1508.142012] binder: 14005:14017 IncRefs 0 refcount change on invalid ref 0 ret -22 13:16:46 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r0, &(0x7f0000942000)={0x2, 0x4e20, @multicast1}, 0x10) sendmsg$key(0xffffffffffffffff, &(0x7f0000f56000)={0x0, 0x0, &(0x7f00008feff0)={&(0x7f0000000500)=ANY=[@ANYBLOB="020300090a1500000000000000000000030006190000000002000000e0000001003f00000000000002000100e625aa66dcef85847e479eb3c49000000400000000fd003e"], 0x44}}, 0x0) add_key(&(0x7f0000000080)='logon\x00', &(0x7f0000000100)={0x73, 0x79, 0x7a, 0x1}, &(0x7f0000001240), 0x0, 0xfffffffffffffff8) get_mempolicy(&(0x7f0000000000), &(0x7f00000001c0), 0x1ff, &(0x7f0000fff000/0x1000)=nil, 0x3) setsockopt$sock_int(r0, 0x1, 0x3c, &(0x7f0000d4effc)=0x1, 0x4) connect$inet(r0, &(0x7f0000000000)={0x2, 0x4e20, @dev={0xac, 0x14, 0x14, 0x18}}, 0x10) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f00000001c0)='tunl0\x00', 0x5) sendto$inet(r0, &(0x7f00006d1fd4)="db", 0x1, 0x4000010, &(0x7f00004daff0)={0x2, 0x0, @loopback, [0x500000000000000]}, 0x10) 13:16:46 executing program 6: clone(0x802102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000040), 0xffffffffffffffff) r0 = syz_open_dev$sndtimer(&(0x7f0000000000)='/dev/snd/timer\x00', 0x0, 0x0) r1 = getpid() sched_setscheduler(r1, 0x5, &(0x7f0000000200)) ioctl$SNDRV_TIMER_IOCTL_GPARAMS(r0, 0x40485404, &(0x7f0000000240)={{}, 0x0, 0x2000000000000000, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3]}) [ 1508.371418] binder: 14047:14055 BC_REQUEST_DEATH_NOTIFICATION invalid ref 4 [ 1508.436105] binder: 14047:14055 IncRefs 0 refcount change on invalid ref 4 ret -22 [ 1508.454265] binder: 14047:14055 BC_INCREFS_DONE u0000000000000000 no match [ 1508.480954] binder: 14047:14055 IncRefs 0 refcount change on invalid ref 0 ret -22 [ 1508.492055] binder: 14047:14055 BC_REQUEST_DEATH_NOTIFICATION invalid ref 4 [ 1508.501188] binder: 14047:14055 IncRefs 0 refcount change on invalid ref 4 ret -22 [ 1508.513874] binder: 14047:14055 BC_INCREFS_DONE u0000000000000000 no match [ 1508.521179] binder: 14047:14055 IncRefs 0 refcount change on invalid ref 0 ret -22 13:16:46 executing program 1: r0 = socket$netlink(0x10, 0x3, 0x8000000004) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_TCP_CONGESTION(r1, 0x6, 0xd, &(0x7f0000000180)='vegas\x00', 0x6) bind$inet6(r1, &(0x7f00001fefe4)={0xa, 0x4e22}, 0x1c) sendto$inet6(r1, &(0x7f0000000100), 0x8d2d601e8976aa5, 0x20000004, &(0x7f000031e000)={0xa, 0x4e22}, 0x1c) writev(r0, &(0x7f0000000100)=[{&(0x7f0000000000)="580000001400192340834b80040d8c560a067f5f2dff81004e220000000058000b4824ca944f64009400050028925aa8000000000000008000f0fffeffff09000000fff5dd00000010000100000c0900fcff0000040e05a5", 0x58}], 0x1) 13:16:46 executing program 7: openat$cuse(0xffffffffffffff9c, &(0x7f0000000080)='/dev/cuse\x00', 0x2, 0x0) clone(0x1002102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000640), 0xffffffffffffffff) r0 = getpid() sched_setscheduler(r0, 0x5, &(0x7f0000000000)) write$FUSE_NOTIFY_DELETE(0xffffffffffffffff, &(0x7f0000000040)={0x29}, 0x29) 13:16:46 executing program 3: perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x20000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000200)={0x26, 'hash\x00', 0x0, 0x0, 'sha1\x00'}, 0x58) r1 = accept$alg(r0, 0x0, 0x0) sendmmsg(r1, &(0x7f0000007f00)=[{{&(0x7f00000056c0)=@can, 0x3000, &(0x7f00000000c0)}}, {{&(0x7f0000005900)=@pppoe={0x18, 0x0, {0x0, @link_local, 'syzkaller0\x00'}}, 0x80, &(0x7f0000007ac0), 0x1a9, &(0x7f0000007b00)}}], 0x3fffffffffffe0d, 0x0) ioctl$sock_SIOCOUTQNSD(r1, 0x894b, &(0x7f00000001c0)) r2 = openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000140)='/dev/sequencer2\x00', 0x80840, 0x0) setsockopt$inet_sctp_SCTP_FRAGMENT_INTERLEAVE(r2, 0x84, 0x12, &(0x7f0000000100)=0x10001, 0x4) chown(&(0x7f0000000340)='./file0\x00', 0x0, 0x0) r3 = syz_open_dev$sndpcmc(&(0x7f00000000c0)='/dev/snd/pcmC#D#c\x00', 0x0, 0x0) write$P9_RMKDIR(r2, &(0x7f0000000180)={0x14, 0x49, 0x2, {0x4, 0x6, 0x5}}, 0x14) ioctl$ASHMEM_SET_NAME(r3, 0x41007701, &(0x7f0000000280)='syzkaller0\x00') 13:16:46 executing program 6: clone(0x802102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000040), 0xffffffffffffffff) r0 = syz_open_dev$sndtimer(&(0x7f0000000000)='/dev/snd/timer\x00', 0x0, 0x0) r1 = getpid() sched_setscheduler(r1, 0x5, &(0x7f0000000200)) ioctl$SNDRV_TIMER_IOCTL_GPARAMS(r0, 0x40485404, &(0x7f0000000240)={{}, 0x0, 0x2000000000000000, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x100000000000000]}) 13:16:46 executing program 0: perf_event_open(&(0x7f0000000040)={0x2, 0x70, 0x3e5}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f00000021c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0x40046208, &(0x7f0000002340)={0xb5, 0x0, &(0x7f00000000c0)=ANY=[@ANYBLOB="0463044000000000b6a571ac965f26c50d500dae115e59afcd8a338d8b2727193c56d4ebef60c214b766ffde6cff6ceef2baa2594a53a0117e77afd5d58e8a35afdae81b258585ce769507333c0238790d5ed750bf1d6ca2a873050056528fce7becfd12f165ac43a826d3462822ff8f29ea992d4e208847cf4fc10ca00b87b5ce2523fa477bad0be1c97e4398aa2ac81d973b5a871d8e0b295e436cd8415f19088c6c82c85f4ed1fac41da062bc6dbfb8eac4276c"], 0x0, 0x0, &(0x7f00000022c0)}) 13:16:46 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r0, &(0x7f0000942000)={0x2, 0x4e20, @multicast1}, 0x10) sendmsg$key(0xffffffffffffffff, &(0x7f0000f56000)={0x0, 0x0, &(0x7f00008feff0)={&(0x7f0000000500)=ANY=[@ANYBLOB="020300090a1500000000000000000000030006190000000002000000e0000001003f00000000000002000100e625aa66dcef85847e479eb3c49000000400000000fd003e"], 0x44}}, 0x0) add_key(&(0x7f0000000080)='logon\x00', &(0x7f0000000100)={0x73, 0x79, 0x7a, 0x1}, &(0x7f0000001240), 0x0, 0xfffffffffffffff8) get_mempolicy(&(0x7f0000000000), &(0x7f00000001c0), 0x1ff, &(0x7f0000fff000/0x1000)=nil, 0x3) setsockopt$sock_int(r0, 0x1, 0x3c, &(0x7f0000d4effc)=0x1, 0x4) connect$inet(r0, &(0x7f0000000000)={0x2, 0x4e20, @dev={0xac, 0x14, 0x14, 0x18}}, 0x10) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f00000001c0)='tunl0\x00', 0x5) sendto$inet(r0, &(0x7f00006d1fd4)="db", 0x1, 0x4000010, &(0x7f00004daff0)={0x2, 0x0, @loopback, [0x300000000000000]}, 0x10) 13:16:46 executing program 5: r0 = syz_open_dev$binder(&(0x7f00000021c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000002340)={0x34, 0x0, &(0x7f0000002240)=[@request_death={0x400c630e, 0x4, 0x4}, @increfs={0x40046304, 0x4}, @increfs_done={0x40106308, 0x0, 0x3}, @increfs], 0x77, 0x4000000, &(0x7f00000022c0)="b3cd0976d8e2af743c6f523efe14fd20c3c3dd2572734282a761e1b4304e2599c85f198cc82bd5d0c74c4edca2f9ea7b875ff7047ec0784fbb354e15fd3f7d837f533597d5082692a6f2fb748da3cc4157188f7f2a5477ded56f72f5b75c96872db429e44b8fcd781d96dead77a0b58b7af9085a208a22"}) 13:16:46 executing program 4: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = gettid() perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x3e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff7fffffffffff}, 0x0, 0x0, 0xffffffffffffffff, 0x0) fcntl$setown(r0, 0x8, r1) sendto$inet6(r0, &(0x7f0000000380), 0x0, 0x200408d4, &(0x7f000072e000)={0xa, 0x4e22, 0x0, @loopback}, 0x1c) sendto$inet6(r0, &(0x7f0000ad6fad)='\x00', 0x1, 0x3fffffd, &(0x7f0000254000)={0xa, 0x0, 0x0, @loopback}, 0x1c) [ 1508.736020] binder: 14071:14077 IncRefs 0 refcount change on invalid ref 4 ret -22 13:16:46 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r0, &(0x7f0000942000)={0x2, 0x4e20, @multicast1}, 0x10) sendmsg$key(0xffffffffffffffff, &(0x7f0000f56000)={0x0, 0x0, &(0x7f00008feff0)={&(0x7f0000000500)=ANY=[@ANYBLOB="020300090a1500000000000000000000030006190000000002000000e0000001003f00000000000002000100e625aa66dcef85847e479eb3c49000000400000000fd003e"], 0x44}}, 0x0) add_key(&(0x7f0000000080)='logon\x00', &(0x7f0000000100)={0x73, 0x79, 0x7a, 0x1}, &(0x7f0000001240), 0x0, 0xfffffffffffffff8) get_mempolicy(&(0x7f0000000000), &(0x7f00000001c0), 0x1ff, &(0x7f0000fff000/0x1000)=nil, 0x3) setsockopt$sock_int(r0, 0x1, 0x3c, &(0x7f0000d4effc)=0x1, 0x4) connect$inet(r0, &(0x7f0000000000)={0x2, 0x4e20, @dev={0xac, 0x14, 0x14, 0x18}}, 0x10) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f00000001c0)='tunl0\x00', 0x5) sendto$inet(r0, &(0x7f00006d1fd4)="db", 0x1, 0x4000010, &(0x7f00004daff0)={0x2, 0x0, @loopback, [0x14b8010000000000]}, 0x10) [ 1508.813180] binder: 14071:14077 BC_INCREFS_DONE u0000000000000000 no match 13:16:46 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r0, &(0x7f0000942000)={0x2, 0x4e20, @multicast1}, 0x10) sendmsg$key(0xffffffffffffffff, &(0x7f0000f56000)={0x0, 0x0, &(0x7f00008feff0)={&(0x7f0000000500)=ANY=[@ANYBLOB="020300090a1500000000000000000000030006190000000002000000e0000001003f00000000000002000100e625aa66dcef85847e479eb3c49000000400000000fd003e"], 0x44}}, 0x0) add_key(&(0x7f0000000080)='logon\x00', &(0x7f0000000100)={0x73, 0x79, 0x7a, 0x1}, &(0x7f0000001240), 0x0, 0xfffffffffffffff8) get_mempolicy(&(0x7f0000000000), &(0x7f00000001c0), 0x1ff, &(0x7f0000fff000/0x1000)=nil, 0x3) setsockopt$sock_int(r0, 0x1, 0x3c, &(0x7f0000d4effc)=0x1, 0x4) connect$inet(r0, &(0x7f0000000000)={0x2, 0x4e20, @dev={0xac, 0x14, 0x14, 0x18}}, 0x10) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f00000001c0)='tunl0\x00', 0x5) sendto$inet(r0, &(0x7f00006d1fd4)="db", 0x1, 0x4000010, &(0x7f00004daff0)={0x2, 0x0, @loopback, [0x1a0]}, 0x10) [ 1508.886264] binder: 14071:14077 IncRefs 0 refcount change on invalid ref 0 ret -22 13:16:47 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r0, &(0x7f0000942000)={0x2, 0x4e20, @multicast1}, 0x10) sendmsg$key(0xffffffffffffffff, &(0x7f0000f56000)={0x0, 0x0, &(0x7f00008feff0)={&(0x7f0000000500)=ANY=[@ANYBLOB="020300090a1500000000000000000000030006190000000002000000e0000001003f00000000000002000100e625aa66dcef85847e479eb3c49000000400000000fd003e"], 0x44}}, 0x0) add_key(&(0x7f0000000080)='logon\x00', &(0x7f0000000100)={0x73, 0x79, 0x7a, 0x1}, &(0x7f0000001240), 0x0, 0xfffffffffffffff8) get_mempolicy(&(0x7f0000000000), &(0x7f00000001c0), 0x1ff, &(0x7f0000fff000/0x1000)=nil, 0x3) setsockopt$sock_int(r0, 0x1, 0x3c, &(0x7f0000d4effc)=0x1, 0x4) connect$inet(r0, &(0x7f0000000000)={0x2, 0x4e20, @dev={0xac, 0x14, 0x14, 0x18}}, 0x10) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f00000001c0)='tunl0\x00', 0x5) sendto$inet(r0, &(0x7f00006d1fd4)="db", 0x1, 0x4000010, &(0x7f00004daff0)={0x2, 0x0, @loopback, [0x40020000]}, 0x10) 13:16:47 executing program 7: openat$cuse(0xffffffffffffff9c, &(0x7f0000000080)='/dev/cuse\x00', 0x2, 0x0) clone(0x1002102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000640), 0xffffffffffffffff) r0 = getpid() sched_setscheduler(r0, 0x5, &(0x7f0000000000)) write$FUSE_NOTIFY_DELETE(0xffffffffffffffff, &(0x7f0000000040)={0x29}, 0x29) 13:16:47 executing program 5: r0 = syz_open_dev$binder(&(0x7f00000021c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000002340)={0x34, 0x0, &(0x7f0000002240)=[@request_death={0x400c630e, 0x4, 0x4}, @increfs={0x40046304, 0x4}, @increfs_done={0x40106308, 0x0, 0x3}, @increfs], 0x77, 0x10, &(0x7f00000022c0)="b3cd0976d8e2af743c6f523efe14fd20c3c3dd2572734282a761e1b4304e2599c85f198cc82bd5d0c74c4edca2f9ea7b875ff7047ec0784fbb354e15fd3f7d837f533597d5082692a6f2fb748da3cc4157188f7f2a5477ded56f72f5b75c96872db429e44b8fcd781d96dead77a0b58b7af9085a208a22"}) 13:16:47 executing program 3: r0 = syz_open_dev$sndctrl(&(0x7f00000003c0)='/dev/snd/controlC#\x00', 0x5, 0x10000) fsetxattr$trusted_overlay_origin(r0, &(0x7f0000000400)='trusted.overlay.origin\x00', &(0x7f0000000440)='y\x00', 0x2, 0x3) r1 = fcntl$dupfd(0xffffffffffffff9c, 0x406, 0xffffffffffffff9c) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000380)={0x4, 0x0, &(0x7f00000001c0)=[@register_looper], 0x94, 0x0, &(0x7f0000000280)="f2b70de6efa9ba00e5e9698bc545130b23a9b790a5c645079a8cd04717d5127593339b11a8faceddb4823a25b2f4fb007a57223c9e4c233d02e586ab8d42b1a0b70e81bca57f3e0911d20eea733cde5c3a062634f42f3bf8359c3b1c8dce4eb821a5b1ce40a92de4d1876e54fb638e81b6738ec5bd80f76c6bbdd398d14d16aaea610b061ea372c1e8fc3146cd66d21ba725111c"}) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat$selinux_avc_cache_stats(0xffffffffffffff9c, &(0x7f0000000180)='/selinux/avc/cache_stats\x00', 0x0, 0x0) r2 = socket$alg(0x26, 0x5, 0x0) bind$alg(r2, &(0x7f0000000200)={0x26, 'hash\x00', 0x0, 0x0, 'sha1\x00'}, 0x58) r3 = accept$alg(r2, 0x0, 0x0) sendmmsg(r3, &(0x7f0000007f00)=[{{&(0x7f00000056c0)=@can, 0x3000, &(0x7f00000000c0)}}, {{&(0x7f0000005900)=@pppoe={0x18, 0x0, {0x0, @link_local, 'syzkaller0\x00'}}, 0x80, &(0x7f0000007ac0), 0x1a9, &(0x7f0000007b00)}}], 0x3fffffffffffe0d, 0x0) openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000140)='/dev/sequencer2\x00', 0x80840, 0x0) chown(&(0x7f0000000340)='./file0\x00', 0x0, 0x0) r4 = syz_open_dev$sndpcmc(&(0x7f00000000c0)='/dev/snd/pcmC#D#c\x00', 0x0, 0x0) ioctl$ASHMEM_SET_NAME(r4, 0x41007701, &(0x7f0000000100)='syzkaller0\x00') 13:16:47 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r0, &(0x7f0000942000)={0x2, 0x4e20, @multicast1}, 0x10) sendmsg$key(0xffffffffffffffff, &(0x7f0000f56000)={0x0, 0x0, &(0x7f00008feff0)={&(0x7f0000000500)=ANY=[@ANYBLOB="020300090a1500000000000000000000030006190000000002000000e0000001003f00000000000002000100e625aa66dcef85847e479eb3c49000000400000000fd003e"], 0x44}}, 0x0) add_key(&(0x7f0000000080)='logon\x00', &(0x7f0000000100)={0x73, 0x79, 0x7a, 0x1}, &(0x7f0000001240), 0x0, 0xfffffffffffffff8) get_mempolicy(&(0x7f0000000000), &(0x7f00000001c0), 0x1ff, &(0x7f0000fff000/0x1000)=nil, 0x3) setsockopt$sock_int(r0, 0x1, 0x3c, &(0x7f0000d4effc)=0x1, 0x4) connect$inet(r0, &(0x7f0000000000)={0x2, 0x4e20, @dev={0xac, 0x14, 0x14, 0x18}}, 0x10) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f00000001c0)='tunl0\x00', 0x5) sendto$inet(r0, &(0x7f00006d1fd4)="db", 0x1, 0x4000010, &(0x7f00004daff0)={0x2, 0x0, @loopback, [0x700]}, 0x10) 13:16:47 executing program 7: r0 = syz_open_dev$loop(&(0x7f0000000040)='/dev/loop#\x00', 0x4, 0x0) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000640), 0xffffffffffffffff) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = getpid() sched_setscheduler(r2, 0x5, &(0x7f00000000c0)) ioctl$IOC_PR_RESERVE(r0, 0x1274, &(0x7f0000000080)) [ 1509.186700] binder: 14114:14118 BC_INCREFS_DONE u0000000000000000 no match 13:16:47 executing program 1: r0 = socket$netlink(0x10, 0x3, 0x8000000004) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_TCP_CONGESTION(r1, 0x6, 0xd, &(0x7f0000000180)='vegas\x00', 0x6) bind$inet6(r1, &(0x7f00001fefe4)={0xa, 0x4e22}, 0x1c) sendto$inet6(r1, &(0x7f0000000100), 0x8d2d601e8976aa5, 0x20000004, &(0x7f000031e000)={0xa, 0x4e22}, 0x1c) writev(r0, &(0x7f0000000100)=[{&(0x7f0000000000)="580000001400192340834b80040d8c560a067f3d90ff81004e220000000058000b4824ca944f64009400050028925aa8000000000000008000f0fffeffff09000000fff5dd00000010000100000c0900fcff0000040e05a5", 0x58}], 0x1) 13:16:47 executing program 7: clone(0x802102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000040), 0xffffffffffffffff) r0 = syz_open_dev$sndtimer(&(0x7f0000000000)='/dev/snd/timer\x00', 0x0, 0x0) r1 = getpid() sched_setscheduler(r1, 0x5, &(0x7f0000000200)) ioctl$SNDRV_TIMER_IOCTL_GPARAMS(r0, 0x40485404, &(0x7f0000000240)={{}, 0x0, 0x2000000000000000, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x300]}) 13:16:47 executing program 5: r0 = syz_open_dev$binder(&(0x7f00000021c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000002340)={0x34, 0x0, &(0x7f0000002240)=[@request_death={0x400c630e, 0x4, 0x4}, @increfs={0x40046304, 0x4}, @increfs_done={0x40106308, 0x0, 0x3}, @increfs], 0x77, 0xa00000000000000, &(0x7f00000022c0)="b3cd0976d8e2af743c6f523efe14fd20c3c3dd2572734282a761e1b4304e2599c85f198cc82bd5d0c74c4edca2f9ea7b875ff7047ec0784fbb354e15fd3f7d837f533597d5082692a6f2fb748da3cc4157188f7f2a5477ded56f72f5b75c96872db429e44b8fcd781d96dead77a0b58b7af9085a208a22"}) 13:16:47 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r0, &(0x7f0000942000)={0x2, 0x4e20, @multicast1}, 0x10) sendmsg$key(0xffffffffffffffff, &(0x7f0000f56000)={0x0, 0x0, &(0x7f00008feff0)={&(0x7f0000000500)=ANY=[@ANYBLOB="020300090a1500000000000000000000030006190000000002000000e0000001003f00000000000002000100e625aa66dcef85847e479eb3c49000000400000000fd003e"], 0x44}}, 0x0) add_key(&(0x7f0000000080)='logon\x00', &(0x7f0000000100)={0x73, 0x79, 0x7a, 0x1}, &(0x7f0000001240), 0x0, 0xfffffffffffffff8) get_mempolicy(&(0x7f0000000000), &(0x7f00000001c0), 0x1ff, &(0x7f0000fff000/0x1000)=nil, 0x3) setsockopt$sock_int(r0, 0x1, 0x3c, &(0x7f0000d4effc)=0x1, 0x4) connect$inet(r0, &(0x7f0000000000)={0x2, 0x4e20, @dev={0xac, 0x14, 0x14, 0x18}}, 0x10) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f00000001c0)='tunl0\x00', 0x5) sendto$inet(r0, &(0x7f00006d1fd4)="db", 0x1, 0x4000010, &(0x7f00004daff0)={0x2, 0x0, @loopback, [0x800000000000000]}, 0x10) 13:16:47 executing program 6: clone(0x802102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000040), 0xffffffffffffffff) r0 = syz_open_dev$sndtimer(&(0x7f0000000000)='/dev/snd/timer\x00', 0x0, 0x0) r1 = getpid() sched_setscheduler(r1, 0x5, &(0x7f0000000200)) ioctl$SNDRV_TIMER_IOCTL_GPARAMS(r0, 0x40485404, &(0x7f0000000240)={{}, 0x0, 0x2000000000000000, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x300000000000000]}) 13:16:47 executing program 4: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) gettid() perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x3e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff7fffffffffff}, 0x0, 0x0, 0xffffffffffffffff, 0x0) bind$inet6(r0, &(0x7f0000807fe4)={0xa, 0x4e22}, 0x1c) sendto$inet6(r0, &(0x7f0000000380), 0x0, 0x200408d4, &(0x7f000072e000)={0xa, 0x4e22, 0x0, @loopback}, 0x1c) sendto$inet6(r0, &(0x7f0000ad6fad)='\x00', 0x1, 0x3fffffd, &(0x7f0000254000)={0xa, 0x0, 0x0, @loopback}, 0x1c) 13:16:47 executing program 3: perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000200)={0x26, 'hash\x00', 0x0, 0x0, 'sha1\x00'}, 0x58) r1 = accept$alg(r0, 0x0, 0x0) sendmmsg(r1, &(0x7f0000007f00)=[{{&(0x7f00000056c0)=@can, 0x3000, &(0x7f00000000c0)}}, {{&(0x7f0000005900)=@pppoe={0x18, 0x0, {0x0, @link_local, 'syzkaller0\x00'}}, 0x80, &(0x7f0000007ac0), 0x1a9, &(0x7f0000007b00)}}], 0x3fffffffffffe0d, 0x0) openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000180)='/dev/sequencer2\x00', 0x80840, 0x0) chown(&(0x7f0000000340)='./file0\x00', 0x0, 0x0) r2 = syz_open_dev$sndpcmc(&(0x7f00000000c0)='/dev/snd/pcmC#D#c\x00', 0x0, 0x0) ioctl$ASHMEM_SET_NAME(r2, 0x41007701, &(0x7f0000000100)='syzkaller0\x00') 13:16:47 executing program 0: perf_event_open(&(0x7f0000000040)={0x2, 0x70, 0x3e5}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f00000021c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0x5452, &(0x7f0000002340)={0xb5, 0x0, &(0x7f00000000c0)=ANY=[@ANYBLOB="0463044000000000b6a571ac965f26c50d500dae115e59afcd8a338d8b2727193c56d4ebef60c214b766ffde6cff6ceef2baa2594a53a0117e77afd5d58e8a35afdae81b258585ce769507333c0238790d5ed750bf1d6ca2a873050056528fce7becfd12f165ac43a826d3462822ff8f29ea992d4e208847cf4fc10ca00b87b5ce2523fa477bad0be1c97e4398aa2ac81d973b5a871d8e0b295e436cd8415f19088c6c82c85f4ed1fac41da062bc6dbfb8eac4276c"], 0x0, 0x0, &(0x7f00000022c0)}) [ 1509.665167] binder: 14145:14156 BC_INCREFS_DONE u0000000000000000 no match 13:16:47 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r0, &(0x7f0000942000)={0x2, 0x4e20, @multicast1}, 0x10) sendmsg$key(0xffffffffffffffff, &(0x7f0000f56000)={0x0, 0x0, &(0x7f00008feff0)={&(0x7f0000000500)=ANY=[@ANYBLOB="020300090a1500000000000000000000030006190000000002000000e0000001003f00000000000002000100e625aa66dcef85847e479eb3c49000000400000000fd003e"], 0x44}}, 0x0) add_key(&(0x7f0000000080)='logon\x00', &(0x7f0000000100)={0x73, 0x79, 0x7a, 0x1}, &(0x7f0000001240), 0x0, 0xfffffffffffffff8) get_mempolicy(&(0x7f0000000000), &(0x7f00000001c0), 0x1ff, &(0x7f0000fff000/0x1000)=nil, 0x3) setsockopt$sock_int(r0, 0x1, 0x3c, &(0x7f0000d4effc)=0x1, 0x4) connect$inet(r0, &(0x7f0000000000)={0x2, 0x4e20, @dev={0xac, 0x14, 0x14, 0x18}}, 0x10) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f00000001c0)='tunl0\x00', 0x5) sendto$inet(r0, &(0x7f00006d1fd4)="db", 0x1, 0x4000010, &(0x7f00004daff0)={0x2, 0x0, @loopback, [0xe8030000]}, 0x10) 13:16:47 executing program 3: perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000200)={0x26, 'hash\x00', 0x0, 0x0, 'sha1\x00'}, 0x58) r1 = accept$alg(r0, 0x0, 0x0) sendmmsg(r1, &(0x7f0000007f00)=[{{&(0x7f00000056c0)=@can, 0x3000, &(0x7f00000000c0)}}, {{&(0x7f0000005900)=@pppoe={0x18, 0x0, {0x0, @link_local, 'syzkaller0\x00'}}, 0x80, &(0x7f0000007ac0), 0x1a9, &(0x7f0000007b00)}}], 0x3fffffffffffe0d, 0x0) openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000140)='/dev/sequencer2\x00', 0x80840, 0x0) chown(&(0x7f0000000340)='./file0\x00', 0x0, 0x0) r2 = syz_open_dev$sndpcmc(&(0x7f00000000c0)='/dev/snd/pcmC#D#c\x00', 0x0, 0x301000) ioctl$ASHMEM_SET_NAME(r2, 0x41007701, &(0x7f0000000100)='syzkaller0\x00') 13:16:47 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r0, &(0x7f0000942000)={0x2, 0x4e20, @multicast1}, 0x10) sendmsg$key(0xffffffffffffffff, &(0x7f0000f56000)={0x0, 0x0, &(0x7f00008feff0)={&(0x7f0000000500)=ANY=[@ANYBLOB="020300090a1500000000000000000000030006190000000002000000e0000001003f00000000000002000100e625aa66dcef85847e479eb3c49000000400000000fd003e"], 0x44}}, 0x0) add_key(&(0x7f0000000080)='logon\x00', &(0x7f0000000100)={0x73, 0x79, 0x7a, 0x1}, &(0x7f0000001240), 0x0, 0xfffffffffffffff8) get_mempolicy(&(0x7f0000000000), &(0x7f00000001c0), 0x1ff, &(0x7f0000fff000/0x1000)=nil, 0x3) setsockopt$sock_int(r0, 0x1, 0x3c, &(0x7f0000d4effc)=0x1, 0x4) connect$inet(r0, &(0x7f0000000000)={0x2, 0x4e20, @dev={0xac, 0x14, 0x14, 0x18}}, 0x10) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f00000001c0)='tunl0\x00', 0x5) sendto$inet(r0, &(0x7f00006d1fd4)="db", 0x1, 0x4000010, &(0x7f00004daff0)={0x2, 0x0, @loopback, [0xfeffffff]}, 0x10) 13:16:47 executing program 7: perf_event_open(&(0x7f0000000040)={0x2, 0x70, 0x3e5}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f00000021c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0x40046208, &(0x7f0000002340)={0xb5, 0x0, &(0x7f00000000c0)=ANY=[@ANYBLOB="0463044000000000b6a571ac965f26c50d500dae115e59afcd8a338d8b2727193c56d4ebef60c214b766ffde6cff6ceef2baa2594a53a0117e77afd5d58e8a35afdae81b258585ce769507333c0238790d5ed750bf1d6ca2a873050056528fce7becfd12f165ac43a826d3462822ff8f29ea992d4e208847cf4fc10ca00b87b5ce2523fa477bad0be1c97e4398aa2ac81d973b5a871d8e0b295e436cd8415f19088c6c82c85f4ed1fac41da062bc6dbfb8eac4276c"], 0x0, 0x0, &(0x7f00000022c0)}) 13:16:47 executing program 6: clone(0x802102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000040), 0xffffffffffffffff) r0 = syz_open_dev$sndtimer(&(0x7f0000000000)='/dev/snd/timer\x00', 0x0, 0x0) r1 = getpid() sched_setscheduler(r1, 0x5, &(0x7f0000000200)) ioctl$SNDRV_TIMER_IOCTL_GPARAMS(r0, 0x40485404, &(0x7f0000000240)={{}, 0x0, 0x2000000000000000, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3000000]}) 13:16:47 executing program 5: r0 = syz_open_dev$binder(&(0x7f00000021c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000002340)={0x34, 0x0, &(0x7f0000002240)=[@request_death={0x400c630e, 0x4, 0x4}, @increfs={0x40046304, 0x4}, @increfs_done={0x40106308, 0x0, 0x3}, @increfs], 0x77, 0xffffff7f, &(0x7f00000022c0)="b3cd0976d8e2af743c6f523efe14fd20c3c3dd2572734282a761e1b4304e2599c85f198cc82bd5d0c74c4edca2f9ea7b875ff7047ec0784fbb354e15fd3f7d837f533597d5082692a6f2fb748da3cc4157188f7f2a5477ded56f72f5b75c96872db429e44b8fcd781d96dead77a0b58b7af9085a208a22"}) 13:16:48 executing program 7: r0 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r0, &(0x7f0000942000)={0x2, 0x4e20, @multicast1}, 0x10) sendmsg$key(0xffffffffffffffff, &(0x7f0000f56000)={0x0, 0x0, &(0x7f00008feff0)={&(0x7f0000000500)=ANY=[@ANYBLOB="020300090a1500000000000000000000030006190000000002000000e0000001003f00000000000002000100e625aa66dcef85847e479eb3c49000000400000000fd003e"], 0x44}}, 0x0) add_key(&(0x7f0000000080)='logon\x00', &(0x7f0000000100)={0x73, 0x79, 0x7a, 0x1}, &(0x7f0000001240), 0x0, 0xfffffffffffffff8) get_mempolicy(&(0x7f0000000000), &(0x7f00000001c0), 0x1ff, &(0x7f0000fff000/0x1000)=nil, 0x3) setsockopt$sock_int(r0, 0x1, 0x3c, &(0x7f0000d4effc)=0x1, 0x4) connect$inet(r0, &(0x7f0000000000)={0x2, 0x4e20, @dev={0xac, 0x14, 0x14, 0x18}}, 0x10) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f00000001c0)='tunl0\x00', 0x5) sendto$inet(r0, &(0x7f00006d1fd4)="db", 0x1, 0x4000010, &(0x7f00004daff0)={0x2, 0x0, @loopback, [0x4002]}, 0x10) 13:16:48 executing program 6: clone(0x802102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000040), 0xffffffffffffffff) r0 = syz_open_dev$sndtimer(&(0x7f0000000000)='/dev/snd/timer\x00', 0x0, 0x0) r1 = getpid() sched_setscheduler(r1, 0x5, &(0x7f0000000200)) ioctl$SNDRV_TIMER_IOCTL_GPARAMS(r0, 0x40485404, &(0x7f0000000240)={{}, 0x0, 0x2000000000000000, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1000000]}) [ 1510.077092] binder: 14191:14194 BC_INCREFS_DONE u0000000000000000 no match 13:16:48 executing program 1: r0 = socket$netlink(0x10, 0x3, 0x8000000004) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_TCP_CONGESTION(r1, 0x6, 0xd, &(0x7f0000000180)='vegas\x00', 0x6) bind$inet6(r1, &(0x7f00001fefe4)={0xa, 0x4e22}, 0x1c) sendto$inet6(r1, &(0x7f0000000100), 0x8d2d601e8976aa5, 0x20000004, &(0x7f000031e000)={0xa, 0x4e22}, 0x1c) writev(r0, &(0x7f0000000100)=[{&(0x7f0000000000)="580000001400192340834b80040d8c560a067fe912ff81004e220000000058000b4824ca944f64009400050028925aa8000000000000008000f0fffeffff09000000fff5dd00000010000100000c0900fcff0000040e05a5", 0x58}], 0x1) 13:16:48 executing program 3: perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000200)={0x26, 'hash\x00', 0x0, 0x0, 'sha1\x00'}, 0x58) r1 = accept$alg(r0, 0x0, 0x0) sendmmsg(r1, &(0x7f0000007f00)=[{{&(0x7f00000056c0)=@can, 0x3000, &(0x7f00000000c0)}}, {{&(0x7f0000005900)=@pppoe={0x18, 0x0, {0x0, @link_local, 'syzkaller0\x00'}}, 0x80, &(0x7f0000007ac0), 0x1a9, &(0x7f0000007b00)}}], 0x3fffffffffffe0d, 0x0) ioctl$sock_inet_SIOCGIFNETMASK(r1, 0x891b, &(0x7f0000000180)={'veth1_to_team\x00', {0x2, 0x4e24}}) openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000140)='/dev/sequencer2\x00', 0x80840, 0x0) chown(&(0x7f0000000340)='./file0\x00', 0x0, 0x0) r2 = syz_open_dev$sndpcmc(&(0x7f00000000c0)='/dev/snd/pcmC#D#c\x00', 0x0, 0x0) ioctl$ASHMEM_SET_NAME(r2, 0x41007701, &(0x7f0000000100)='syzkaller0\x00') flistxattr(r0, &(0x7f0000000380)=""/248, 0xf8) 13:16:48 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r0, &(0x7f0000942000)={0x2, 0x4e20, @multicast1}, 0x10) sendmsg$key(0xffffffffffffffff, &(0x7f0000f56000)={0x0, 0x0, &(0x7f00008feff0)={&(0x7f0000000500)=ANY=[@ANYBLOB="020300090a1500000000000000000000030006190000000002000000e0000001003f00000000000002000100e625aa66dcef85847e479eb3c49000000400000000fd003e"], 0x44}}, 0x0) add_key(&(0x7f0000000080)='logon\x00', &(0x7f0000000100)={0x73, 0x79, 0x7a, 0x1}, &(0x7f0000001240), 0x0, 0xfffffffffffffff8) get_mempolicy(&(0x7f0000000000), &(0x7f00000001c0), 0x1ff, &(0x7f0000fff000/0x1000)=nil, 0x3) setsockopt$sock_int(r0, 0x1, 0x3c, &(0x7f0000d4effc)=0x1, 0x4) connect$inet(r0, &(0x7f0000000000)={0x2, 0x4e20, @dev={0xac, 0x14, 0x14, 0x18}}, 0x10) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f00000001c0)='tunl0\x00', 0x5) sendto$inet(r0, &(0x7f00006d1fd4)="db", 0x1, 0x4000010, &(0x7f00004daff0)={0x2, 0x0, @loopback, [0x3f00]}, 0x10) 13:16:48 executing program 7 (fault-call:4 fault-nth:0): r0 = openat$cuse(0xffffffffffffff9c, &(0x7f0000000080)='/dev/cuse\x00', 0x2, 0x0) clone(0x1002102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000640), 0xffffffffffffffff) r1 = getpid() sched_setscheduler(r1, 0x5, &(0x7f0000000000)) write$FUSE_NOTIFY_DELETE(r0, &(0x7f0000000040)={0x29}, 0x29) 13:16:48 executing program 5: r0 = syz_open_dev$binder(&(0x7f00000021c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000002340)={0x34, 0x0, &(0x7f0000002240)=[@request_death={0x400c630e, 0x4, 0x4}, @increfs={0x40046304, 0x4}, @increfs_done={0x40106308, 0x0, 0x3}, @increfs], 0x77, 0x60000000, &(0x7f00000022c0)="b3cd0976d8e2af743c6f523efe14fd20c3c3dd2572734282a761e1b4304e2599c85f198cc82bd5d0c74c4edca2f9ea7b875ff7047ec0784fbb354e15fd3f7d837f533597d5082692a6f2fb748da3cc4157188f7f2a5477ded56f72f5b75c96872db429e44b8fcd781d96dead77a0b58b7af9085a208a22"}) 13:16:48 executing program 6: clone(0x802102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000040), 0xffffffffffffffff) r0 = syz_open_dev$sndtimer(&(0x7f0000000000)='/dev/snd/timer\x00', 0x0, 0x0) r1 = getpid() sched_setscheduler(r1, 0x5, &(0x7f0000000200)) ioctl$SNDRV_TIMER_IOCTL_GPARAMS(r0, 0x40485404, &(0x7f0000000240)={{}, 0x0, 0x2000000000000000, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x300]}) 13:16:48 executing program 0: perf_event_open(&(0x7f0000000040)={0x2, 0x70, 0x3e5}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f00000021c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0x2, &(0x7f0000002340)={0xb5, 0x0, &(0x7f00000000c0)=ANY=[@ANYBLOB="0463044000000000b6a571ac965f26c50d500dae115e59afcd8a338d8b2727193c56d4ebef60c214b766ffde6cff6ceef2baa2594a53a0117e77afd5d58e8a35afdae81b258585ce769507333c0238790d5ed750bf1d6ca2a873050056528fce7becfd12f165ac43a826d3462822ff8f29ea992d4e208847cf4fc10ca00b87b5ce2523fa477bad0be1c97e4398aa2ac81d973b5a871d8e0b295e436cd8415f19088c6c82c85f4ed1fac41da062bc6dbfb8eac4276c"], 0x0, 0x0, &(0x7f00000022c0)}) 13:16:48 executing program 4: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) gettid() perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x3e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff7fffffffffff}, 0x0, 0x0, 0xffffffffffffffff, 0x0) bind$inet6(r0, &(0x7f0000807fe4)={0xa, 0x4e22}, 0x1c) sendto$inet6(r0, &(0x7f0000000380), 0x0, 0x200408d4, &(0x7f000072e000)={0xa, 0x4e22, 0x0, @loopback}, 0x1c) sendto$inet6(r0, &(0x7f0000ad6fad)='\x00', 0x1, 0x3fffffd, &(0x7f0000254000)={0xa, 0x0, 0x0, @loopback}, 0x1c) [ 1510.573943] FAULT_INJECTION: forcing a failure. [ 1510.573943] name failslab, interval 1, probability 0, space 0, times 0 [ 1510.583903] binder_thread_write: 4 callbacks suppressed [ 1510.583917] binder: 14217:14226 BC_REQUEST_DEATH_NOTIFICATION invalid ref 4 [ 1510.624648] CPU: 1 PID: 14224 Comm: syz-executor7 Not tainted 4.19.0-rc2+ #8 [ 1510.631891] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 1510.641257] Call Trace: [ 1510.643866] dump_stack+0x1c4/0x2b4 [ 1510.647517] ? dump_stack_print_info.cold.2+0x52/0x52 [ 1510.652747] should_fail.cold.4+0xa/0x17 [ 1510.656833] ? fault_create_debugfs_attr+0x1f0/0x1f0 [ 1510.661949] ? print_usage_bug+0xc0/0xc0 [ 1510.666029] ? graph_lock+0x170/0x170 [ 1510.669856] ? flush_bg_queue+0x650/0x650 [ 1510.674028] ? find_held_lock+0x36/0x1c0 [ 1510.678131] ? ___might_sleep+0x1ed/0x300 [ 1510.682296] ? memcpy+0x45/0x50 [ 1510.685598] ? arch_local_save_flags+0x40/0x40 [ 1510.690207] ? fuse_copy_do+0x286/0x440 [ 1510.694206] __should_failslab+0x124/0x180 [ 1510.698464] should_failslab+0x9/0x14 [ 1510.702281] kmem_cache_alloc_trace+0x2d7/0x750 [ 1510.707000] ? graph_lock+0x170/0x170 [ 1510.710833] fuse_dev_do_write+0x60e/0x36e0 [ 1510.715189] ? __lock_acquire+0x7ec/0x4ec0 [ 1510.719444] ? fuse_dev_read+0x250/0x250 [ 1510.723536] ? mark_held_locks+0x130/0x130 [ 1510.727782] ? __lock_acquire+0x7ec/0x4ec0 [ 1510.732028] ? check_preemption_disabled+0x48/0x200 [ 1510.737068] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 1510.742628] ? check_preemption_disabled+0x48/0x200 [ 1510.747675] ? check_preemption_disabled+0x48/0x200 [ 1510.752714] ? debug_smp_processor_id+0x1c/0x20 [ 1510.757398] ? perf_trace_lock+0x14d/0x7a0 [ 1510.761649] ? zap_class+0x640/0x640 [ 1510.765379] ? __lock_acquire+0x7ec/0x4ec0 [ 1510.769639] ? zap_class+0x640/0x640 13:16:48 executing program 0: perf_event_open(&(0x7f0000000040)={0x2, 0x70, 0x3e5}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f00000021c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0x541b, &(0x7f0000002340)={0xb5, 0x0, &(0x7f00000000c0)=ANY=[@ANYBLOB="0463044000000000b6a571ac965f26c50d500dae115e59afcd8a338d8b2727193c56d4ebef60c214b766ffde6cff6ceef2baa2594a53a0117e77afd5d58e8a35afdae81b258585ce769507333c0238790d5ed750bf1d6ca2a873050056528fce7becfd12f165ac43a826d3462822ff8f29ea992d4e208847cf4fc10ca00b87b5ce2523fa477bad0be1c97e4398aa2ac81d973b5a871d8e0b295e436cd8415f19088c6c82c85f4ed1fac41da062bc6dbfb8eac4276c"], 0x0, 0x0, &(0x7f00000022c0)}) [ 1510.773368] ? dput.part.26+0x26d/0x790 [ 1510.777361] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 1510.782912] ? check_preemption_disabled+0x48/0x200 [ 1510.787953] ? graph_lock+0x170/0x170 [ 1510.791792] ? find_held_lock+0x36/0x1c0 [ 1510.795874] ? __fget+0x4aa/0x740 [ 1510.799361] ? lock_downgrade+0x900/0x900 [ 1510.803530] ? check_preemption_disabled+0x48/0x200 [ 1510.808571] ? rcu_read_unlock_special.part.39+0x11f0/0x11f0 [ 1510.814396] ? kasan_check_read+0x11/0x20 [ 1510.818567] ? rcu_dynticks_curr_cpu_in_eqs+0x9f/0x160 13:16:48 executing program 6: clone(0x802102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000040), 0xffffffffffffffff) r0 = syz_open_dev$sndtimer(&(0x7f0000000000)='/dev/snd/timer\x00', 0x0, 0x0) r1 = getpid() sched_setscheduler(r1, 0x5, &(0x7f0000000200)) ioctl$SNDRV_TIMER_IOCTL_GPARAMS(r0, 0x40485404, &(0x7f0000000240)={{}, 0x0, 0x2000000000000000, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x300]}) [ 1510.823872] ? rcu_bh_qs+0xc0/0xc0 [ 1510.827444] ? __fget+0x4d1/0x740 [ 1510.830915] ? memset+0x31/0x40 [ 1510.834213] fuse_dev_write+0x19a/0x240 [ 1510.838200] ? fuse_dev_splice_write+0xe70/0xe70 [ 1510.842997] ? __sanitizer_cov_trace_const_cmp8+0x18/0x20 [ 1510.848616] ? iov_iter_init+0xc2/0x1e0 [ 1510.852623] __vfs_write+0x6b8/0x9f0 [ 1510.856361] ? kernel_read+0x120/0x120 [ 1510.860268] ? __might_sleep+0x95/0x190 [ 1510.864260] ? __sanitizer_cov_trace_const_cmp1+0x1a/0x20 [ 1510.869815] ? __inode_security_revalidate+0xd9/0x120 13:16:48 executing program 6: clone(0x802102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000040), 0xffffffffffffffff) r0 = syz_open_dev$sndtimer(&(0x7f0000000000)='/dev/snd/timer\x00', 0x0, 0x0) r1 = getpid() sched_setscheduler(r1, 0x5, &(0x7f0000000200)) ioctl$SNDRV_TIMER_IOCTL_GPARAMS(r0, 0x40485404, &(0x7f0000000240)={{}, 0x0, 0x2000000000000000, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3]}) [ 1510.875021] ? selinux_file_permission+0x90/0x540 [ 1510.875055] ? rw_verify_area+0x118/0x360 [ 1510.875078] vfs_write+0x1fc/0x560 [ 1510.875100] ksys_write+0x101/0x260 [ 1510.875121] ? __ia32_sys_read+0xb0/0xb0 [ 1510.875151] ? __bpf_trace_preemptirq_template+0x30/0x30 [ 1510.875176] __x64_sys_write+0x73/0xb0 [ 1510.884200] do_syscall_64+0x1b9/0x820 [ 1510.908599] ? entry_SYSCALL_64_after_hwframe+0x3e/0xbe [ 1510.914005] ? syscall_return_slowpath+0x5e0/0x5e0 [ 1510.918957] ? trace_hardirqs_on_caller+0x310/0x310 [ 1510.921391] binder: 14217:14226 BC_INCREFS_DONE u0000000000000000 no match [ 1510.923989] ? prepare_exit_to_usermode+0x3b0/0x3b0 [ 1510.924007] ? recalc_sigpending_tsk+0x180/0x180 [ 1510.924027] ? kasan_check_write+0x14/0x20 [ 1510.924051] ? trace_hardirqs_off_thunk+0x1a/0x1c [ 1510.935422] binder: 14217:14226 BC_REQUEST_DEATH_NOTIFICATION invalid ref 4 [ 1510.936082] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 1510.936097] RIP: 0033:0x457099 [ 1510.936117] Code: fd b4 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 cb b4 fb ff c3 66 2e 0f 1f 84 00 00 00 00 [ 1510.942591] binder: 14217:14226 BC_INCREFS_DONE u0000000000000000 no match [ 1510.945082] RSP: 002b:00007f0e823d5c78 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 1510.945101] RAX: ffffffffffffffda RBX: 00007f0e823d66d4 RCX: 0000000000457099 [ 1510.945111] RDX: 0000000000000029 RSI: 0000000020000040 RDI: 0000000000000003 [ 1510.945121] RBP: 00000000009300a0 R08: 0000000000000000 R09: 0000000000000000 13:16:49 executing program 6: clone(0x802102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000040), 0xffffffffffffffff) r0 = syz_open_dev$sndtimer(&(0x7f0000000000)='/dev/snd/timer\x00', 0x0, 0x0) r1 = getpid() sched_setscheduler(r1, 0x5, &(0x7f0000000200)) ioctl$SNDRV_TIMER_IOCTL_GPARAMS(r0, 0x40485404, &(0x7f0000000240)={{}, 0x0, 0x2000000000000000, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x100000000000000]}) 13:16:49 executing program 3: perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$alg(0x26, 0x5, 0x0) r1 = openat$selinux_avc_cache_stats(0xffffffffffffff9c, &(0x7f00000001c0)='/selinux/avc/cache_stats\x00', 0x0, 0x0) ioctl$RTC_WKALM_SET(r1, 0x4028700f, &(0x7f0000000280)={0x0, 0x0, {0x3, 0x2, 0x16, 0x6, 0x7, 0x3, 0x4, 0x56, 0x1}}) bind$alg(r0, &(0x7f0000000200)={0x26, 'hash\x00', 0x0, 0x0, 'sha1\x00'}, 0x58) sendmmsg(0xffffffffffffffff, &(0x7f0000007f00)=[{{&(0x7f00000056c0)=@can, 0x3000, &(0x7f00000000c0)}}, {{&(0x7f0000005900)=@pppoe={0x18, 0x0, {0x0, @link_local, 'syzkaller0\x00'}}, 0x80, &(0x7f0000007ac0), 0x1a9, &(0x7f0000007b00)}}], 0x3fffffffffffe0d, 0x0) openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000140)='/dev/sequencer2\x00', 0x80840, 0x0) chown(&(0x7f0000000340)='./file0\x00', 0x0, 0x0) r2 = syz_open_dev$sndpcmc(&(0x7f00000000c0)='/dev/snd/pcmC#D#c\x00', 0x0, 0x0) ioctl$ASHMEM_SET_NAME(r2, 0x41007701, &(0x7f0000000180)='#mime_type\x00') ioctl$KVM_S390_UCAS_MAP(r2, 0x4018ae50, &(0x7f0000000100)={0x3, 0x3, 0x8}) 13:16:49 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r0, &(0x7f0000942000)={0x2, 0x4e20, @multicast1}, 0x10) sendmsg$key(0xffffffffffffffff, &(0x7f0000f56000)={0x0, 0x0, &(0x7f00008feff0)={&(0x7f0000000500)=ANY=[@ANYBLOB="020300090a1500000000000000000000030006190000000002000000e0000001003f00000000000002000100e625aa66dcef85847e479eb3c49000000400000000fd003e"], 0x44}}, 0x0) add_key(&(0x7f0000000080)='logon\x00', &(0x7f0000000100)={0x73, 0x79, 0x7a, 0x1}, &(0x7f0000001240), 0x0, 0xfffffffffffffff8) get_mempolicy(&(0x7f0000000000), &(0x7f00000001c0), 0x1ff, &(0x7f0000fff000/0x1000)=nil, 0x3) setsockopt$sock_int(r0, 0x1, 0x3c, &(0x7f0000d4effc)=0x1, 0x4) connect$inet(r0, &(0x7f0000000000)={0x2, 0x4e20, @dev={0xac, 0x14, 0x14, 0x18}}, 0x10) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f00000001c0)='tunl0\x00', 0x5) sendto$inet(r0, &(0x7f00006d1fd4)="db", 0x1, 0x4000010, &(0x7f00004daff0)={0x2, 0x0, @loopback, [0x4900]}, 0x10) 13:16:49 executing program 5: r0 = syz_open_dev$binder(&(0x7f00000021c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000002340)={0x34, 0x0, &(0x7f0000002240)=[@request_death={0x400c630e, 0x4, 0x4}, @increfs={0x40046304, 0x4}, @increfs_done={0x40106308, 0x0, 0x3}, @increfs], 0x77, 0x6800000000000000, &(0x7f00000022c0)="b3cd0976d8e2af743c6f523efe14fd20c3c3dd2572734282a761e1b4304e2599c85f198cc82bd5d0c74c4edca2f9ea7b875ff7047ec0784fbb354e15fd3f7d837f533597d5082692a6f2fb748da3cc4157188f7f2a5477ded56f72f5b75c96872db429e44b8fcd781d96dead77a0b58b7af9085a208a22"}) 13:16:49 executing program 7: r0 = openat$cuse(0xffffffffffffff9c, &(0x7f0000000080)='/dev/cuse\x00', 0x2, 0x0) clone(0x1002102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000640), 0xffffffffffffffff) r1 = getpid() sched_setscheduler(r1, 0x5, &(0x7f0000000000)) write$FUSE_NOTIFY_DELETE(r0, &(0x7f0000000040)={0x29}, 0x29) [ 1510.945130] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000004 [ 1510.945148] R13: 00000000004d7b00 R14: 00000000004ca89f R15: 0000000000000000 [ 1511.186224] binder: 14268:14272 BC_REQUEST_DEATH_NOTIFICATION invalid ref 4 [ 1511.310813] binder: 14277:14278 ioctl 541b 20002340 returned -22 [ 1511.320104] binder: 14277:14279 ioctl 541b 20002340 returned -22 13:16:49 executing program 1: r0 = socket$netlink(0x10, 0x3, 0x8000000004) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_TCP_CONGESTION(r1, 0x6, 0xd, &(0x7f0000000180)='vegas\x00', 0x6) bind$inet6(r1, &(0x7f00001fefe4)={0xa, 0x4e22}, 0x1c) sendto$inet6(r1, &(0x7f0000000100), 0x8d2d601e8976aa5, 0x20000004, &(0x7f000031e000)={0xa, 0x4e22}, 0x1c) writev(r0, &(0x7f0000000100)=[{&(0x7f0000000000)="580000001400192340834b80040d8c560a067f0b71ff81004e220000000058000b4824ca944f64009400050028925aa8000000000000008000f0fffeffff09000000fff5dd00000010000100000c0900fcff0000040e05a5", 0x58}], 0x1) 13:16:49 executing program 3: perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000200)={0x26, 'hash\x00', 0x0, 0x0, 'sha1\x00'}, 0x58) r1 = accept$alg(r0, 0x0, 0x0) sendmmsg(r1, &(0x7f0000007f00)=[{{&(0x7f00000056c0)=@can, 0x3000, &(0x7f00000000c0)}}, {{&(0x7f0000005900)=@pppoe={0x18, 0x0, {0x0, @link_local, 'syzkaller0\x00'}}, 0x80, &(0x7f0000007ac0), 0x1a9, &(0x7f0000007b00)}}], 0x3fffffffffffe0d, 0x0) r2 = openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000140)='/dev/sequencer2\x00', 0x80840, 0x0) chown(&(0x7f0000000340)='./file0\x00', 0x0, 0x0) r3 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r3, &(0x7f0000000040)={0x2, 0x4e20, @multicast1}, 0x10) setsockopt$sock_int(r3, 0x1, 0x3c, &(0x7f0000d4effc)=0x1, 0x4) connect$inet(r3, &(0x7f0000000000)={0x2, 0x4e20, @dev={0xac, 0x14, 0x14, 0x18}}, 0x10) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) setsockopt$SO_BINDTODEVICE(r3, 0x1, 0x19, &(0x7f00000001c0)='vcan0\x00', 0x10) sendto$inet(r3, &(0x7f0000000b40)="94", 0x1, 0x0, 0x0, 0x0) sendto$inet(r3, &(0x7f00006d1fd4)="db", 0x1, 0x4000010, &(0x7f00004daff0)={0x2, 0x0, @loopback}, 0x10) write(r3, &(0x7f0000000980)="1acbcb75ce3c3dc9edabb5a2e6b48b07bcbefcc1a1f84f9488393825b2026eb6fbccd36bf4d163948b6d551f19be4b8e54455dab3f89ab8b06a9c2a76fea14feb16945b43c8c69", 0x47) r5 = syz_open_dev$sndpcmc(&(0x7f00000000c0)='/dev/snd/pcmC#D#c\x00', 0x0, 0x0) setsockopt$ARPT_SO_SET_ADD_COUNTERS(r2, 0x0, 0x61, &(0x7f0000000180)={'filter\x00', 0x4}, 0x68) ioctl$ASHMEM_SET_NAME(r5, 0x41007701, &(0x7f0000000100)='syzkaller0\x00') 13:16:49 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r0, &(0x7f0000942000)={0x2, 0x4e20, @multicast1}, 0x10) sendmsg$key(0xffffffffffffffff, &(0x7f0000f56000)={0x0, 0x0, &(0x7f00008feff0)={&(0x7f0000000500)=ANY=[@ANYBLOB="020300090a1500000000000000000000030006190000000002000000e0000001003f00000000000002000100e625aa66dcef85847e479eb3c49000000400000000fd003e"], 0x44}}, 0x0) add_key(&(0x7f0000000080)='logon\x00', &(0x7f0000000100)={0x73, 0x79, 0x7a, 0x1}, &(0x7f0000001240), 0x0, 0xfffffffffffffff8) get_mempolicy(&(0x7f0000000000), &(0x7f00000001c0), 0x1ff, &(0x7f0000fff000/0x1000)=nil, 0x3) setsockopt$sock_int(r0, 0x1, 0x3c, &(0x7f0000d4effc)=0x1, 0x4) connect$inet(r0, &(0x7f0000000000)={0x2, 0x4e20, @dev={0xac, 0x14, 0x14, 0x18}}, 0x10) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f00000001c0)='tunl0\x00', 0x5) sendto$inet(r0, &(0x7f00006d1fd4)="db", 0x1, 0x4000010, &(0x7f00004daff0)={0x2, 0x0, @loopback, [0x281400]}, 0x10) 13:16:49 executing program 5: r0 = syz_open_dev$binder(&(0x7f00000021c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000002340)={0x34, 0x0, &(0x7f0000002240)=[@request_death={0x400c630e, 0x4, 0x4}, @increfs={0x40046304, 0x4}, @increfs_done={0x40106308, 0x0, 0x3}, @increfs], 0x77, 0x6000000000000000, &(0x7f00000022c0)="b3cd0976d8e2af743c6f523efe14fd20c3c3dd2572734282a761e1b4304e2599c85f198cc82bd5d0c74c4edca2f9ea7b875ff7047ec0784fbb354e15fd3f7d837f533597d5082692a6f2fb748da3cc4157188f7f2a5477ded56f72f5b75c96872db429e44b8fcd781d96dead77a0b58b7af9085a208a22"}) 13:16:49 executing program 7: r0 = openat$cuse(0xffffffffffffff9c, &(0x7f0000000080)='/dev/cuse\x00', 0x2, 0x0) clone(0x1002102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000640), 0xffffffffffffffff) r1 = getpid() sched_setscheduler(r1, 0x5, &(0x7f0000000000)) write$FUSE_NOTIFY_DELETE(r0, &(0x7f0000000040)={0x20000069}, 0x29) 13:16:49 executing program 6: clone(0x802102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000040), 0xffffffffffffffff) r0 = syz_open_dev$sndtimer(&(0x7f0000000000)='/dev/snd/timer\x00', 0x0, 0x0) r1 = getpid() sched_setscheduler(r1, 0x5, &(0x7f0000000200)) ioctl$SNDRV_TIMER_IOCTL_GPARAMS(r0, 0x40485404, &(0x7f0000000240)={{}, 0x0, 0x2000000000000000, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x300000000000000]}) 13:16:49 executing program 4: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) gettid() perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x3e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff7fffffffffff}, 0x0, 0x0, 0xffffffffffffffff, 0x0) bind$inet6(r0, &(0x7f0000807fe4)={0xa, 0x4e22}, 0x1c) sendto$inet6(r0, &(0x7f0000000380), 0x0, 0x200408d4, &(0x7f000072e000)={0xa, 0x4e22, 0x0, @loopback}, 0x1c) sendto$inet6(r0, &(0x7f0000ad6fad)='\x00', 0x1, 0x3fffffd, &(0x7f0000254000)={0xa, 0x0, 0x0, @loopback}, 0x1c) 13:16:49 executing program 0: perf_event_open(&(0x7f0000000040)={0x2, 0x70, 0x3e5}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f00000021c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0x80087601, &(0x7f0000002340)={0xb5, 0x0, &(0x7f00000000c0)=ANY=[@ANYBLOB="0463044000000000b6a571ac965f26c50d500dae115e59afcd8a338d8b2727193c56d4ebef60c214b766ffde6cff6ceef2baa2594a53a0117e77afd5d58e8a35afdae81b258585ce769507333c0238790d5ed750bf1d6ca2a873050056528fce7becfd12f165ac43a826d3462822ff8f29ea992d4e208847cf4fc10ca00b87b5ce2523fa477bad0be1c97e4398aa2ac81d973b5a871d8e0b295e436cd8415f19088c6c82c85f4ed1fac41da062bc6dbfb8eac4276c"], 0x0, 0x0, &(0x7f00000022c0)}) 13:16:49 executing program 6: clone(0x802102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000040), 0xffffffffffffffff) r0 = syz_open_dev$sndtimer(&(0x7f0000000000)='/dev/snd/timer\x00', 0x0, 0x0) r1 = getpid() sched_setscheduler(r1, 0x5, &(0x7f0000000200)) ioctl$SNDRV_TIMER_IOCTL_GPARAMS(r0, 0x40485404, &(0x7f0000000240)={{}, 0x0, 0x2000000000000000, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1000000]}) 13:16:49 executing program 7: r0 = openat$cuse(0xffffffffffffff9c, &(0x7f0000000080)='/dev/cuse\x00', 0x2, 0x0) clone(0x1002102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000640), 0xffffffffffffffff) r1 = getpid() sched_setscheduler(r1, 0x5, &(0x7f0000000000)) write$FUSE_NOTIFY_DELETE(r0, &(0x7f0000000040)={0xf}, 0x29) [ 1511.502913] binder: 14284:14296 BC_REQUEST_DEATH_NOTIFICATION invalid ref 4 13:16:49 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r0, &(0x7f0000942000)={0x2, 0x4e20, @multicast1}, 0x10) sendmsg$key(0xffffffffffffffff, &(0x7f0000f56000)={0x0, 0x0, &(0x7f00008feff0)={&(0x7f0000000500)=ANY=[@ANYBLOB="020300090a1500000000000000000000030006190000000002000000e0000001003f00000000000002000100e625aa66dcef85847e479eb3c49000000400000000fd003e"], 0x44}}, 0x0) add_key(&(0x7f0000000080)='logon\x00', &(0x7f0000000100)={0x73, 0x79, 0x7a, 0x1}, &(0x7f0000001240), 0x0, 0xfffffffffffffff8) get_mempolicy(&(0x7f0000000000), &(0x7f00000001c0), 0x1ff, &(0x7f0000fff000/0x1000)=nil, 0x3) setsockopt$sock_int(r0, 0x1, 0x3c, &(0x7f0000d4effc)=0x1, 0x4) connect$inet(r0, &(0x7f0000000000)={0x2, 0x4e20, @dev={0xac, 0x14, 0x14, 0x18}}, 0x10) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f00000001c0)='tunl0\x00', 0x5) sendto$inet(r0, &(0x7f00006d1fd4)="db", 0x1, 0x4000010, &(0x7f00004daff0)={0x2, 0x0, @loopback, [0x3f00000000000000]}, 0x10) 13:16:49 executing program 5: r0 = syz_open_dev$binder(&(0x7f00000021c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000002340)={0x34, 0x0, &(0x7f0000002240)=[@request_death={0x400c630e, 0x4, 0x4}, @increfs={0x40046304, 0x4}, @increfs_done={0x40106308, 0x0, 0x3}, @increfs], 0x77, 0xffffff7f00000000, &(0x7f00000022c0)="b3cd0976d8e2af743c6f523efe14fd20c3c3dd2572734282a761e1b4304e2599c85f198cc82bd5d0c74c4edca2f9ea7b875ff7047ec0784fbb354e15fd3f7d837f533597d5082692a6f2fb748da3cc4157188f7f2a5477ded56f72f5b75c96872db429e44b8fcd781d96dead77a0b58b7af9085a208a22"}) 13:16:49 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r0, &(0x7f0000942000)={0x2, 0x4e20, @multicast1}, 0x10) sendmsg$key(0xffffffffffffffff, &(0x7f0000f56000)={0x0, 0x0, &(0x7f00008feff0)={&(0x7f0000000500)=ANY=[@ANYBLOB="020300090a1500000000000000000000030006190000000002000000e0000001003f00000000000002000100e625aa66dcef85847e479eb3c49000000400000000fd003e"], 0x44}}, 0x0) add_key(&(0x7f0000000080)='logon\x00', &(0x7f0000000100)={0x73, 0x79, 0x7a, 0x1}, &(0x7f0000001240), 0x0, 0xfffffffffffffff8) get_mempolicy(&(0x7f0000000000), &(0x7f00000001c0), 0x1ff, &(0x7f0000fff000/0x1000)=nil, 0x3) setsockopt$sock_int(r0, 0x1, 0x3c, &(0x7f0000d4effc)=0x1, 0x4) connect$inet(r0, &(0x7f0000000000)={0x2, 0x4e20, @dev={0xac, 0x14, 0x14, 0x18}}, 0x10) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f00000001c0)='tunl0\x00', 0x5) sendto$inet(r0, &(0x7f00006d1fd4)="db", 0x1, 0x4000010, &(0x7f00004daff0)={0x2, 0x0, @loopback, [0xfeffffff00000000]}, 0x10) [ 1511.778860] binder: 14316:14319 BC_REQUEST_DEATH_NOTIFICATION invalid ref 4 13:16:49 executing program 5: r0 = syz_open_dev$binder(&(0x7f00000021c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000002340)={0x34, 0x0, &(0x7f0000002240)=[@request_death={0x400c630e, 0x4, 0x4}, @increfs={0x40046304, 0x4}, @increfs_done={0x40106308, 0x0, 0x3}, @increfs], 0x77, 0xa0010000, &(0x7f00000022c0)="b3cd0976d8e2af743c6f523efe14fd20c3c3dd2572734282a761e1b4304e2599c85f198cc82bd5d0c74c4edca2f9ea7b875ff7047ec0784fbb354e15fd3f7d837f533597d5082692a6f2fb748da3cc4157188f7f2a5477ded56f72f5b75c96872db429e44b8fcd781d96dead77a0b58b7af9085a208a22"}) 13:16:50 executing program 6: clone(0x802102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000040), 0xffffffffffffffff) r0 = syz_open_dev$sndtimer(&(0x7f0000000000)='/dev/snd/timer\x00', 0x0, 0x0) r1 = getpid() sched_setscheduler(r1, 0x5, &(0x7f0000000200)) ioctl$SNDRV_TIMER_IOCTL_GPARAMS(r0, 0x40485404, &(0x7f0000000240)={{}, 0x0, 0x2000000000000000, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3000000]}) 13:16:50 executing program 3: perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x1}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000200)={0x26, 'hash\x00', 0x0, 0x0, 'sha1\x00'}, 0x58) r1 = accept$alg(r0, 0x0, 0x0) sendmmsg(r1, &(0x7f0000007f00)=[{{&(0x7f00000056c0)=@can, 0x3000, &(0x7f00000000c0)}}, {{&(0x7f0000005900)=@pppoe={0x18, 0x0, {0x0, @link_local, 'syzkaller0\x00'}}, 0x80, &(0x7f0000007ac0), 0x1a9, &(0x7f0000007b00)}}], 0x3fffffffffffe0d, 0x0) openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000140)='/dev/sequencer2\x00', 0x80840, 0x0) chown(&(0x7f0000000340)='./file0\x00', 0x0, 0x0) shutdown(r1, 0x0) r2 = syz_open_dev$sndpcmc(&(0x7f00000000c0)='/dev/snd/pcmC#D#c\x00', 0x0, 0x0) ioctl$ASHMEM_SET_NAME(r2, 0x41007701, &(0x7f0000000100)='syzkaller0\x00') [ 1512.020549] binder: 14332:14333 ioctl 80087601 20002340 returned -22 [ 1512.029034] binder: 14332:14334 ioctl 80087601 20002340 returned -22 [ 1512.060736] binder: 14325:14326 BC_REQUEST_DEATH_NOTIFICATION invalid ref 4 13:16:50 executing program 1: r0 = socket$netlink(0x10, 0x3, 0x8000000004) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_TCP_CONGESTION(r1, 0x6, 0xd, &(0x7f0000000180)='vegas\x00', 0x6) bind$inet6(r1, &(0x7f00001fefe4)={0xa, 0x4e22}, 0x1c) sendto$inet6(r1, &(0x7f0000000100), 0x8d2d601e8976aa5, 0x20000004, &(0x7f000031e000)={0xa, 0x4e22}, 0x1c) writev(r0, &(0x7f0000000100)=[{&(0x7f0000000000)="580000001400192340834b80040d8c560a067fce71ff81004e220000000058000b4824ca944f64009400050028925aa8000000000000008000f0fffeffff09000000fff5dd00000010000100000c0900fcff0000040e05a5", 0x58}], 0x1) 13:16:50 executing program 0: perf_event_open(&(0x7f0000000040)={0x2, 0x70, 0x3e5}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f00000021c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306202, &(0x7f0000002340)={0xb5, 0x0, &(0x7f00000000c0)=ANY=[@ANYBLOB="0463044000000000b6a571ac965f26c50d500dae115e59afcd8a338d8b2727193c56d4ebef60c214b766ffde6cff6ceef2baa2594a53a0117e77afd5d58e8a35afdae81b258585ce769507333c0238790d5ed750bf1d6ca2a873050056528fce7becfd12f165ac43a826d3462822ff8f29ea992d4e208847cf4fc10ca00b87b5ce2523fa477bad0be1c97e4398aa2ac81d973b5a871d8e0b295e436cd8415f19088c6c82c85f4ed1fac41da062bc6dbfb8eac4276c"], 0x0, 0x0, &(0x7f00000022c0)}) 13:16:50 executing program 6: clone(0x802102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000040), 0xffffffffffffffff) r0 = syz_open_dev$sndtimer(&(0x7f0000000000)='/dev/snd/timer\x00', 0x0, 0x0) r1 = getpid() sched_setscheduler(r1, 0x5, &(0x7f0000000200)) ioctl$SNDRV_TIMER_IOCTL_GPARAMS(r0, 0x40485404, &(0x7f0000000240)={{}, 0x0, 0x2000000000000000, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x100000000000000]}) 13:16:50 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r0, &(0x7f0000942000)={0x2, 0x4e20, @multicast1}, 0x10) sendmsg$key(0xffffffffffffffff, &(0x7f0000f56000)={0x0, 0x0, &(0x7f00008feff0)={&(0x7f0000000500)=ANY=[@ANYBLOB="020300090a1500000000000000000000030006190000000002000000e0000001003f00000000000002000100e625aa66dcef85847e479eb3c49000000400000000fd003e"], 0x44}}, 0x0) add_key(&(0x7f0000000080)='logon\x00', &(0x7f0000000100)={0x73, 0x79, 0x7a, 0x1}, &(0x7f0000001240), 0x0, 0xfffffffffffffff8) get_mempolicy(&(0x7f0000000000), &(0x7f00000001c0), 0x1ff, &(0x7f0000fff000/0x1000)=nil, 0x3) setsockopt$sock_int(r0, 0x1, 0x3c, &(0x7f0000d4effc)=0x1, 0x4) connect$inet(r0, &(0x7f0000000000)={0x2, 0x4e20, @dev={0xac, 0x14, 0x14, 0x18}}, 0x10) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f00000001c0)='tunl0\x00', 0x5) sendto$inet(r0, &(0x7f00006d1fd4)="db", 0x1, 0x4000010, &(0x7f00004daff0)={0x2, 0x0, @loopback, [0xe00000000000000]}, 0x10) 13:16:50 executing program 7: r0 = openat$cuse(0xffffffffffffff9c, &(0x7f0000000080)='/dev/cuse\x00', 0x2, 0x0) clone(0x1002102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000640), 0xffffffffffffffff) r1 = getpid() sched_setscheduler(r1, 0x5, &(0x7f0000000000)) write$FUSE_NOTIFY_DELETE(r0, &(0x7f0000000040)={0x29, 0x4}, 0x29) 13:16:50 executing program 5: r0 = syz_open_dev$binder(&(0x7f00000021c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000002340)={0x34, 0x0, &(0x7f0000002240)=[@request_death={0x400c630e, 0x4, 0x4}, @increfs={0x40046304, 0x4}, @increfs_done={0x40106308, 0x0, 0x3}, @increfs], 0x77, 0x3000000, &(0x7f00000022c0)="b3cd0976d8e2af743c6f523efe14fd20c3c3dd2572734282a761e1b4304e2599c85f198cc82bd5d0c74c4edca2f9ea7b875ff7047ec0784fbb354e15fd3f7d837f533597d5082692a6f2fb748da3cc4157188f7f2a5477ded56f72f5b75c96872db429e44b8fcd781d96dead77a0b58b7af9085a208a22"}) 13:16:50 executing program 4: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = gettid() fcntl$setown(r0, 0x8, r1) bind$inet6(r0, &(0x7f0000807fe4)={0xa, 0x4e22}, 0x1c) sendto$inet6(r0, &(0x7f0000000380), 0x0, 0x200408d4, &(0x7f000072e000)={0xa, 0x4e22, 0x0, @loopback}, 0x1c) sendto$inet6(r0, &(0x7f0000ad6fad)='\x00', 0x1, 0x3fffffd, &(0x7f0000254000)={0xa, 0x0, 0x0, @loopback}, 0x1c) 13:16:50 executing program 3: perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000200)={0x26, 'hash\x00', 0x0, 0x0, 'sha1\x00'}, 0x58) r1 = open(&(0x7f0000000300)='./file0\x00', 0x2400, 0x40) getsockopt$bt_BT_SECURITY(r1, 0x112, 0x4, &(0x7f0000000380), 0x2) r2 = accept$alg(r0, 0x0, 0x0) sendmmsg(r2, &(0x7f0000007f00)=[{{&(0x7f00000056c0)=@can, 0x3000, &(0x7f00000000c0)}}, {{&(0x7f0000005900)=@pppoe={0x18, 0x0, {0x0, @link_local, 'syzkaller0\x00'}}, 0x80, &(0x7f0000007ac0), 0x1a9, &(0x7f0000007b00)}}], 0x3fffffffffffe0d, 0x0) openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000140)='/dev/sequencer2\x00', 0x80840, 0x0) lstat(&(0x7f00000001c0)='./file0\x00', &(0x7f0000000280)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) r4 = geteuid() chown(&(0x7f0000000340)='./file0\x00', r4, r3) r5 = syz_open_dev$sndpcmc(&(0x7f00000000c0)='/dev/snd/pcmC#D#c\x00', 0x0, 0x0) ioctl$SG_SET_KEEP_ORPHAN(r5, 0x2287, &(0x7f0000000180)=0xa6c2) ioctl$SNDRV_TIMER_IOCTL_STOP(r5, 0x54a1) ioctl$ASHMEM_SET_NAME(r5, 0x41007701, &(0x7f0000000100)='syzkaller0\x00') 13:16:50 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r0, &(0x7f0000942000)={0x2, 0x4e20, @multicast1}, 0x10) sendmsg$key(0xffffffffffffffff, &(0x7f0000f56000)={0x0, 0x0, &(0x7f00008feff0)={&(0x7f0000000500)=ANY=[@ANYBLOB="020300090a1500000000000000000000030006190000000002000000e0000001003f00000000000002000100e625aa66dcef85847e479eb3c49000000400000000fd003e"], 0x44}}, 0x0) add_key(&(0x7f0000000080)='logon\x00', &(0x7f0000000100)={0x73, 0x79, 0x7a, 0x1}, &(0x7f0000001240), 0x0, 0xfffffffffffffff8) get_mempolicy(&(0x7f0000000000), &(0x7f00000001c0), 0x1ff, &(0x7f0000fff000/0x1000)=nil, 0x3) setsockopt$sock_int(r0, 0x1, 0x3c, &(0x7f0000d4effc)=0x1, 0x4) connect$inet(r0, &(0x7f0000000000)={0x2, 0x4e20, @dev={0xac, 0x14, 0x14, 0x18}}, 0x10) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f00000001c0)='tunl0\x00', 0x5) sendto$inet(r0, &(0x7f00006d1fd4)="db", 0x1, 0x4000010, &(0x7f00004daff0)={0x2, 0x0, @loopback, [0xf401]}, 0x10) [ 1512.389082] binder: 14354:14356 BC_REQUEST_DEATH_NOTIFICATION invalid ref 4 [ 1512.409902] binder: 14365:14366 ioctl c0306202 20002340 returned -22 [ 1512.418025] binder: 14365:14367 ioctl c0306202 20002340 returned -22 13:16:50 executing program 5: r0 = syz_open_dev$binder(&(0x7f00000021c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000002340)={0x34, 0x0, &(0x7f0000002240)=[@request_death={0x400c630e, 0x4, 0x4}, @increfs={0x40046304, 0x4}, @increfs_done={0x40106308, 0x0, 0x3}, @increfs], 0x77, 0x3f000000, &(0x7f00000022c0)="b3cd0976d8e2af743c6f523efe14fd20c3c3dd2572734282a761e1b4304e2599c85f198cc82bd5d0c74c4edca2f9ea7b875ff7047ec0784fbb354e15fd3f7d837f533597d5082692a6f2fb748da3cc4157188f7f2a5477ded56f72f5b75c96872db429e44b8fcd781d96dead77a0b58b7af9085a208a22"}) 13:16:50 executing program 6: clone(0x802102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000040), 0xffffffffffffffff) r0 = syz_open_dev$sndtimer(&(0x7f0000000000)='/dev/snd/timer\x00', 0x0, 0x0) r1 = getpid() sched_setscheduler(r1, 0x5, &(0x7f0000000200)) ioctl$SNDRV_TIMER_IOCTL_GPARAMS(r0, 0x40485404, &(0x7f0000000240)={{}, 0x0, 0x2000000000000000, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x300000000000000]}) 13:16:50 executing program 7: r0 = openat$cuse(0xffffffffffffff9c, &(0x7f0000000080)='/dev/cuse\x00', 0x2, 0x0) clone(0x1002102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000640), 0xffffffffffffffff) r1 = getpid() sched_setscheduler(r1, 0x5, &(0x7f0000000000)) write$FUSE_NOTIFY_DELETE(r0, &(0x7f0000000040)={0x29, 0x5}, 0x29) 13:16:50 executing program 0: perf_event_open(&(0x7f0000000040)={0x2, 0x70, 0x3e5}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f00000021c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0x5421, &(0x7f0000002340)={0xb5, 0x0, &(0x7f00000000c0)=ANY=[@ANYBLOB="0463044000000000b6a571ac965f26c50d500dae115e59afcd8a338d8b2727193c56d4ebef60c214b766ffde6cff6ceef2baa2594a53a0117e77afd5d58e8a35afdae81b258585ce769507333c0238790d5ed750bf1d6ca2a873050056528fce7becfd12f165ac43a826d3462822ff8f29ea992d4e208847cf4fc10ca00b87b5ce2523fa477bad0be1c97e4398aa2ac81d973b5a871d8e0b295e436cd8415f19088c6c82c85f4ed1fac41da062bc6dbfb8eac4276c"], 0x0, 0x0, &(0x7f00000022c0)}) 13:16:50 executing program 4: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = gettid() fcntl$setown(r0, 0x8, r1) bind$inet6(r0, &(0x7f0000807fe4)={0xa, 0x4e22}, 0x1c) sendto$inet6(r0, &(0x7f0000000380), 0x0, 0x200408d4, &(0x7f000072e000)={0xa, 0x4e22, 0x0, @loopback}, 0x1c) sendto$inet6(r0, &(0x7f0000ad6fad)='\x00', 0x1, 0x3fffffd, &(0x7f0000254000)={0xa, 0x0, 0x0, @loopback}, 0x1c) 13:16:50 executing program 7: r0 = openat$cuse(0xffffffffffffff9c, &(0x7f0000000080)='/dev/cuse\x00', 0x2, 0x0) clone(0x1002102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000640), 0xffffffffffffffff) r1 = getpid() sched_setscheduler(r1, 0x5, &(0x7f0000000000)) write$FUSE_NOTIFY_DELETE(r0, &(0x7f0000000040)={0x29, 0x2}, 0x29) 13:16:50 executing program 7: r0 = openat$cuse(0xffffffffffffff9c, &(0x7f0000000080)='/dev/cuse\x00', 0x2, 0x0) clone(0x1002102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000640), 0xffffffffffffffff) r1 = getpid() sched_setscheduler(r1, 0x5, &(0x7f0000000000)) write$FUSE_NOTIFY_DELETE(r0, &(0x7f0000000040)={0x29, 0x3}, 0x29) [ 1512.790288] binder: 14391:14394 BC_REQUEST_DEATH_NOTIFICATION invalid ref 4 13:16:51 executing program 1: r0 = socket$netlink(0x10, 0x3, 0x8000000004) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_TCP_CONGESTION(r1, 0x6, 0xd, &(0x7f0000000180)='vegas\x00', 0x6) bind$inet6(r1, &(0x7f00001fefe4)={0xa, 0x4e22}, 0x1c) sendto$inet6(r1, &(0x7f0000000100), 0x8d2d601e8976aa5, 0x20000004, &(0x7f000031e000)={0xa, 0x4e22}, 0x1c) writev(r0, &(0x7f0000000100)=[{&(0x7f0000000000)="580000001400192340834b80040d8c560a067f1614ff81004e220000000058000b4824ca944f64009400050028925aa8000000000000008000f0fffeffff09000000fff5dd00000010000100000c0900fcff0000040e05a5", 0x58}], 0x1) 13:16:51 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r0, &(0x7f0000942000)={0x2, 0x4e20, @multicast1}, 0x10) sendmsg$key(0xffffffffffffffff, &(0x7f0000f56000)={0x0, 0x0, &(0x7f00008feff0)={&(0x7f0000000500)=ANY=[@ANYBLOB="020300090a1500000000000000000000030006190000000002000000e0000001003f00000000000002000100e625aa66dcef85847e479eb3c49000000400000000fd003e"], 0x44}}, 0x0) add_key(&(0x7f0000000080)='logon\x00', &(0x7f0000000100)={0x73, 0x79, 0x7a, 0x1}, &(0x7f0000001240), 0x0, 0xfffffffffffffff8) get_mempolicy(&(0x7f0000000000), &(0x7f00000001c0), 0x1ff, &(0x7f0000fff000/0x1000)=nil, 0x3) setsockopt$sock_int(r0, 0x1, 0x3c, &(0x7f0000d4effc)=0x1, 0x4) connect$inet(r0, &(0x7f0000000000)={0x2, 0x4e20, @dev={0xac, 0x14, 0x14, 0x18}}, 0x10) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f00000001c0)='tunl0\x00', 0x5) sendto$inet(r0, &(0x7f00006d1fd4)="db", 0x1, 0x4000010, &(0x7f00004daff0)={0x2, 0x0, @loopback, [0x1b814]}, 0x10) 13:16:51 executing program 3: perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x800}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000180)={0x26, 'aead\x00', 0x0, 0x0, 'morus1280\x00'}, 0xfffffffffffffed4) r1 = accept$alg(r0, 0x0, 0x0) sendmmsg(r1, &(0x7f0000007f00)=[{{&(0x7f00000056c0)=@can, 0x3000, &(0x7f00000000c0), 0x100000000000022d}}, {{&(0x7f0000005900)=@pppoe={0x18, 0x0, {0x0, @link_local, 'syzkaller0\x00'}}, 0x80, &(0x7f0000007ac0), 0x1a9, &(0x7f0000007b00)}}], 0x3fffffffffffe0d, 0x0) openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000140)='/dev/sequencer2\x00', 0x80840, 0x0) r2 = openat$dsp(0xffffffffffffff9c, &(0x7f0000000280)='/dev/dsp\x00', 0x20000000000000a0, 0x0) r3 = syz_open_dev$sndpcmc(&(0x7f00000000c0)='/dev/snd/pcmC#D#c\x00', 0x0, 0x0) mq_timedreceive(r3, &(0x7f00000002c0)=""/219, 0xdb, 0x7, &(0x7f0000000200)={0x0, 0x989680}) setsockopt(r2, 0x6, 0x7fff, &(0x7f0000000200), 0xfffffe08) ioctl$ASHMEM_SET_NAME(r3, 0x41007701, &(0x7f0000000100)='syzkaller0\x00') 13:16:51 executing program 7: r0 = openat$cuse(0xffffffffffffff9c, &(0x7f0000000080)='/dev/cuse\x00', 0x2, 0x0) clone(0x1002102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000640), 0xffffffffffffffff) r1 = getpid() sched_setscheduler(r1, 0x5, &(0x7f0000000000)) write$FUSE_NOTIFY_DELETE(r0, &(0x7f0000000040)={0x29, 0x6, 0xc00}, 0x29) 13:16:51 executing program 6: clone(0x802102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000040), 0xffffffffffffffff) r0 = syz_open_dev$sndtimer(&(0x7f0000000000)='/dev/snd/timer\x00', 0x0, 0x0) r1 = getpid() sched_setscheduler(r1, 0x5, &(0x7f0000000200)) ioctl$SNDRV_TIMER_IOCTL_GPARAMS(r0, 0x40485404, &(0x7f0000000240)={{}, 0x0, 0x2000000000000000, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1000000]}) 13:16:51 executing program 5: r0 = syz_open_dev$binder(&(0x7f00000021c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000002340)={0x34, 0x0, &(0x7f0000002240)=[@request_death={0x400c630e, 0x4, 0x4}, @increfs={0x40046304, 0x4}, @increfs_done={0x40106308, 0x0, 0x3}, @increfs], 0x77, 0x7a000000, &(0x7f00000022c0)="b3cd0976d8e2af743c6f523efe14fd20c3c3dd2572734282a761e1b4304e2599c85f198cc82bd5d0c74c4edca2f9ea7b875ff7047ec0784fbb354e15fd3f7d837f533597d5082692a6f2fb748da3cc4157188f7f2a5477ded56f72f5b75c96872db429e44b8fcd781d96dead77a0b58b7af9085a208a22"}) 13:16:51 executing program 0: perf_event_open(&(0x7f0000000040)={0x2, 0x70, 0x3e5}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f00000021c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0x40046205, &(0x7f0000002340)={0xb5, 0x0, &(0x7f00000000c0)=ANY=[@ANYBLOB="0463044000000000b6a571ac965f26c50d500dae115e59afcd8a338d8b2727193c56d4ebef60c214b766ffde6cff6ceef2baa2594a53a0117e77afd5d58e8a35afdae81b258585ce769507333c0238790d5ed750bf1d6ca2a873050056528fce7becfd12f165ac43a826d3462822ff8f29ea992d4e208847cf4fc10ca00b87b5ce2523fa477bad0be1c97e4398aa2ac81d973b5a871d8e0b295e436cd8415f19088c6c82c85f4ed1fac41da062bc6dbfb8eac4276c"], 0x0, 0x0, &(0x7f00000022c0)}) 13:16:51 executing program 4: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = gettid() fcntl$setown(r0, 0x8, r1) bind$inet6(r0, &(0x7f0000807fe4)={0xa, 0x4e22}, 0x1c) sendto$inet6(r0, &(0x7f0000000380), 0x0, 0x200408d4, &(0x7f000072e000)={0xa, 0x4e22, 0x0, @loopback}, 0x1c) sendto$inet6(r0, &(0x7f0000ad6fad)='\x00', 0x1, 0x3fffffd, &(0x7f0000254000)={0xa, 0x0, 0x0, @loopback}, 0x1c) 13:16:51 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r0, &(0x7f0000942000)={0x2, 0x4e20, @multicast1}, 0x10) sendmsg$key(0xffffffffffffffff, &(0x7f0000f56000)={0x0, 0x0, &(0x7f00008feff0)={&(0x7f0000000500)=ANY=[@ANYBLOB="020300090a1500000000000000000000030006190000000002000000e0000001003f00000000000002000100e625aa66dcef85847e479eb3c49000000400000000fd003e"], 0x44}}, 0x0) add_key(&(0x7f0000000080)='logon\x00', &(0x7f0000000100)={0x73, 0x79, 0x7a, 0x1}, &(0x7f0000001240), 0x0, 0xfffffffffffffff8) get_mempolicy(&(0x7f0000000000), &(0x7f00000001c0), 0x1ff, &(0x7f0000fff000/0x1000)=nil, 0x3) setsockopt$sock_int(r0, 0x1, 0x3c, &(0x7f0000d4effc)=0x1, 0x4) connect$inet(r0, &(0x7f0000000000)={0x2, 0x4e20, @dev={0xac, 0x14, 0x14, 0x18}}, 0x10) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f00000001c0)='tunl0\x00', 0x5) sendto$inet(r0, &(0x7f00006d1fd4)="db", 0x1, 0x4000010, &(0x7f00004daff0)={0x2, 0x0, @loopback, [0xffffffffa0008000]}, 0x10) [ 1513.275824] binder: 14435:14443 BC_REQUEST_DEATH_NOTIFICATION invalid ref 4 [ 1513.290462] binder_thread_write: 22 callbacks suppressed [ 1513.290486] binder: 14435:14443 IncRefs 0 refcount change on invalid ref 4 ret -22 13:16:51 executing program 3: r0 = perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = socket$alg(0x26, 0x5, 0x0) bind$alg(r1, &(0x7f0000000200)={0x26, 'hash\x00', 0x0, 0x0, 'sha1\x00'}, 0x58) r2 = accept$alg(r1, 0x0, 0x0) ioctl$FICLONE(r0, 0x40049409, r2) sendmmsg(r2, &(0x7f0000007f00)=[{{&(0x7f00000056c0)=@can, 0x3000, &(0x7f00000000c0)}}, {{&(0x7f0000005900)=@pppoe={0x18, 0x0, {0x0, @link_local, 'syzkaller0\x00'}}, 0x80, &(0x7f0000007ac0), 0x1a9, &(0x7f0000007b00)}}], 0x3fffffffffffe0d, 0x0) openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000140)='/dev/sequencer2\x00', 0x80840, 0x0) chown(&(0x7f0000000340)='./file0\x00', 0x0, 0x0) r3 = syz_open_dev$sndpcmc(&(0x7f00000000c0)='/dev/snd/pcmC#D#c\x00', 0x0, 0x0) ioctl$ASHMEM_SET_NAME(r3, 0x41007701, &(0x7f0000000100)='syzkaller0\x00') 13:16:51 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r0, &(0x7f0000942000)={0x2, 0x4e20, @multicast1}, 0x10) sendmsg$key(0xffffffffffffffff, &(0x7f0000f56000)={0x0, 0x0, &(0x7f00008feff0)={&(0x7f0000000500)=ANY=[@ANYBLOB="020300090a1500000000000000000000030006190000000002000000e0000001003f00000000000002000100e625aa66dcef85847e479eb3c49000000400000000fd003e"], 0x44}}, 0x0) add_key(&(0x7f0000000080)='logon\x00', &(0x7f0000000100)={0x73, 0x79, 0x7a, 0x1}, &(0x7f0000001240), 0x0, 0xfffffffffffffff8) get_mempolicy(&(0x7f0000000000), &(0x7f00000001c0), 0x1ff, &(0x7f0000fff000/0x1000)=nil, 0x3) setsockopt$sock_int(r0, 0x1, 0x3c, &(0x7f0000d4effc)=0x1, 0x4) connect$inet(r0, &(0x7f0000000000)={0x2, 0x4e20, @dev={0xac, 0x14, 0x14, 0x18}}, 0x10) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f00000001c0)='tunl0\x00', 0x5) sendto$inet(r0, &(0x7f00006d1fd4)="db", 0x1, 0x4000010, &(0x7f00004daff0)={0x2, 0x0, @loopback, [0xa0028000]}, 0x10) [ 1513.347140] binder_thread_write: 6 callbacks suppressed [ 1513.347156] binder: 14435:14443 BC_INCREFS_DONE u0000000000000000 no match 13:16:51 executing program 6: clone(0x802102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000040), 0xffffffffffffffff) r0 = syz_open_dev$sndtimer(&(0x7f0000000000)='/dev/snd/timer\x00', 0x0, 0x0) r1 = getpid() sched_setscheduler(r1, 0x5, &(0x7f0000000200)) ioctl$SNDRV_TIMER_IOCTL_GPARAMS(r0, 0x40485404, &(0x7f0000000240)={{}, 0x0, 0x2000000000000000, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3000000]}) [ 1513.444529] binder: 14435:14443 IncRefs 0 refcount change on invalid ref 0 ret -22 [ 1513.462601] binder: 14435:14443 BC_REQUEST_DEATH_NOTIFICATION invalid ref 4 [ 1513.489526] binder: 14435:14443 IncRefs 0 refcount change on invalid ref 4 ret -22 13:16:51 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r0, &(0x7f0000942000)={0x2, 0x4e20, @multicast1}, 0x10) sendmsg$key(0xffffffffffffffff, &(0x7f0000f56000)={0x0, 0x0, &(0x7f00008feff0)={&(0x7f0000000500)=ANY=[@ANYBLOB="020300090a1500000000000000000000030006190000000002000000e0000001003f00000000000002000100e625aa66dcef85847e479eb3c49000000400000000fd003e"], 0x44}}, 0x0) add_key(&(0x7f0000000080)='logon\x00', &(0x7f0000000100)={0x73, 0x79, 0x7a, 0x1}, &(0x7f0000001240), 0x0, 0xfffffffffffffff8) get_mempolicy(&(0x7f0000000000), &(0x7f00000001c0), 0x1ff, &(0x7f0000fff000/0x1000)=nil, 0x3) setsockopt$sock_int(r0, 0x1, 0x3c, &(0x7f0000d4effc)=0x1, 0x4) connect$inet(r0, &(0x7f0000000000)={0x2, 0x4e20, @dev={0xac, 0x14, 0x14, 0x18}}, 0x10) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f00000001c0)='tunl0\x00', 0x5) sendto$inet(r0, &(0x7f00006d1fd4)="db", 0x1, 0x4000010, &(0x7f00004daff0)={0x2, 0x0, @loopback, [0xa6ffffff]}, 0x10) [ 1513.543980] binder: 14435:14443 BC_INCREFS_DONE u0000000000000000 no match [ 1513.571735] binder: 14435:14443 IncRefs 0 refcount change on invalid ref 0 ret -22 13:16:51 executing program 5: r0 = syz_open_dev$binder(&(0x7f00000021c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000002340)={0x34, 0x0, &(0x7f0000002240)=[@request_death={0x400c630e, 0x4, 0x4}, @increfs={0x40046304, 0x4}, @increfs_done={0x40106308, 0x0, 0x3}, @increfs], 0x77, 0x7a00, &(0x7f00000022c0)="b3cd0976d8e2af743c6f523efe14fd20c3c3dd2572734282a761e1b4304e2599c85f198cc82bd5d0c74c4edca2f9ea7b875ff7047ec0784fbb354e15fd3f7d837f533597d5082692a6f2fb748da3cc4157188f7f2a5477ded56f72f5b75c96872db429e44b8fcd781d96dead77a0b58b7af9085a208a22"}) 13:16:51 executing program 3: perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000200)={0x26, 'hash\x00', 0x0, 0x0, 'sha1\x00'}, 0x58) r1 = accept$alg(r0, 0x0, 0x0) sendmmsg(r1, &(0x7f0000007f00)=[{{&(0x7f00000056c0)=@can, 0x3000, &(0x7f00000000c0)}}, {{&(0x7f0000005900)=@pppoe={0x18, 0x0, {0x0, @link_local, 'syzkaller0\x00'}}, 0x80, &(0x7f0000007ac0), 0x1a9, &(0x7f0000007b00)}}], 0x3fffffffffffe0d, 0x0) openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000140)='/dev/sequencer2\x00', 0x80840, 0x0) chown(&(0x7f0000000340)='./file0\x00', 0x0, 0x0) r2 = syz_open_dev$sndpcmc(&(0x7f00000000c0)='/dev/snd/pcmC#D#c\x00', 0x0, 0x0) setsockopt$netlink_NETLINK_TX_RING(r2, 0x10e, 0x7, &(0x7f0000000180)={0x6, 0x0, 0x2}, 0x10) ioctl$ASHMEM_SET_NAME(r2, 0x41007701, &(0x7f0000000100)='syzkaller0\x00') 13:16:51 executing program 6: clone(0x802102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000040), 0xffffffffffffffff) r0 = syz_open_dev$sndtimer(&(0x7f0000000000)='/dev/snd/timer\x00', 0x0, 0x0) r1 = getpid() sched_setscheduler(r1, 0x5, &(0x7f0000000200)) ioctl$SNDRV_TIMER_IOCTL_GPARAMS(r0, 0x40485404, &(0x7f0000000240)={{}, 0x0, 0x2000000000000000, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x300]}) [ 1513.879783] binder: 14488:14493 IncRefs 0 refcount change on invalid ref 4 ret -22 [ 1513.930986] binder: 14488:14493 BC_INCREFS_DONE u0000000000000000 no match [ 1513.944825] binder: 14488:14493 IncRefs 0 refcount change on invalid ref 0 ret -22 13:16:52 executing program 1: r0 = socket$netlink(0x10, 0x3, 0x8000000004) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_TCP_CONGESTION(r1, 0x6, 0xd, &(0x7f0000000180)='vegas\x00', 0x6) bind$inet6(r1, &(0x7f00001fefe4)={0xa, 0x4e22}, 0x1c) sendto$inet6(r1, &(0x7f0000000100), 0x8d2d601e8976aa5, 0x20000004, &(0x7f000031e000)={0xa, 0x4e22}, 0x1c) writev(r0, &(0x7f0000000100)=[{&(0x7f0000000000)="580000001400192340834b80040d8c560a067f01f4ff81004e220000000058000b4824ca944f64009400050028925aa8000000000000008000f0fffeffff09000000fff5dd00000010000100000c0900fcff0000040e05a5", 0x58}], 0x1) 13:16:52 executing program 4: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x3e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff7fffffffffff}, 0x0, 0x0, 0xffffffffffffffff, 0x0) fcntl$setown(r0, 0x8, 0x0) bind$inet6(r0, &(0x7f0000807fe4)={0xa, 0x4e22}, 0x1c) sendto$inet6(r0, &(0x7f0000000380), 0x0, 0x200408d4, &(0x7f000072e000)={0xa, 0x4e22, 0x0, @loopback}, 0x1c) sendto$inet6(r0, &(0x7f0000ad6fad)='\x00', 0x1, 0x3fffffd, &(0x7f0000254000)={0xa, 0x0, 0x0, @loopback}, 0x1c) 13:16:52 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r0, &(0x7f0000942000)={0x2, 0x4e20, @multicast1}, 0x10) sendmsg$key(0xffffffffffffffff, &(0x7f0000f56000)={0x0, 0x0, &(0x7f00008feff0)={&(0x7f0000000500)=ANY=[@ANYBLOB="020300090a1500000000000000000000030006190000000002000000e0000001003f00000000000002000100e625aa66dcef85847e479eb3c49000000400000000fd003e"], 0x44}}, 0x0) add_key(&(0x7f0000000080)='logon\x00', &(0x7f0000000100)={0x73, 0x79, 0x7a, 0x1}, &(0x7f0000001240), 0x0, 0xfffffffffffffff8) get_mempolicy(&(0x7f0000000000), &(0x7f00000001c0), 0x1ff, &(0x7f0000fff000/0x1000)=nil, 0x3) setsockopt$sock_int(r0, 0x1, 0x3c, &(0x7f0000d4effc)=0x1, 0x4) connect$inet(r0, &(0x7f0000000000)={0x2, 0x4e20, @dev={0xac, 0x14, 0x14, 0x18}}, 0x10) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f00000001c0)='tunl0\x00', 0x5) sendto$inet(r0, &(0x7f00006d1fd4)="db", 0x1, 0x4000010, &(0x7f00004daff0)={0x2, 0x0, @loopback, [0x3e8]}, 0x10) 13:16:52 executing program 7: r0 = openat$cuse(0xffffffffffffff9c, &(0x7f0000000080)='/dev/cuse\x00', 0x2, 0x0) clone(0x1002102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000640), 0xffffffffffffffff) r1 = getpid() sched_setscheduler(r1, 0x5, &(0x7f0000000000)) write$FUSE_NOTIFY_DELETE(r0, &(0x7f0000000040)={0x29, 0x6, 0x7}, 0x29) 13:16:52 executing program 6: clone(0x802102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000040), 0xffffffffffffffff) r0 = syz_open_dev$sndtimer(&(0x7f0000000000)='/dev/snd/timer\x00', 0x0, 0x0) r1 = getpid() sched_setscheduler(r1, 0x5, &(0x7f0000000200)) ioctl$SNDRV_TIMER_IOCTL_GPARAMS(r0, 0x40485404, &(0x7f0000000240)={{}, 0x0, 0x2000000000000000, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3]}) 13:16:52 executing program 0: perf_event_open(&(0x7f0000000040)={0x2, 0x70, 0x3e5}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f00000021c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306209, &(0x7f0000002340)={0xb5, 0x0, &(0x7f00000000c0)=ANY=[@ANYBLOB="0463044000000000b6a571ac965f26c50d500dae115e59afcd8a338d8b2727193c56d4ebef60c214b766ffde6cff6ceef2baa2594a53a0117e77afd5d58e8a35afdae81b258585ce769507333c0238790d5ed750bf1d6ca2a873050056528fce7becfd12f165ac43a826d3462822ff8f29ea992d4e208847cf4fc10ca00b87b5ce2523fa477bad0be1c97e4398aa2ac81d973b5a871d8e0b295e436cd8415f19088c6c82c85f4ed1fac41da062bc6dbfb8eac4276c"], 0x0, 0x0, &(0x7f00000022c0)}) 13:16:52 executing program 5: r0 = syz_open_dev$binder(&(0x7f00000021c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000002340)={0x34, 0x0, &(0x7f0000002240)=[@request_death={0x400c630e, 0x4, 0x4}, @increfs={0x40046304, 0x4}, @increfs_done={0x40106308, 0x0, 0x3}, @increfs], 0x77, 0x6, &(0x7f00000022c0)="b3cd0976d8e2af743c6f523efe14fd20c3c3dd2572734282a761e1b4304e2599c85f198cc82bd5d0c74c4edca2f9ea7b875ff7047ec0784fbb354e15fd3f7d837f533597d5082692a6f2fb748da3cc4157188f7f2a5477ded56f72f5b75c96872db429e44b8fcd781d96dead77a0b58b7af9085a208a22"}) 13:16:52 executing program 3: perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000200)={0x26, 'hash\x00', 0x0, 0x0, 'sha1\x00'}, 0x58) r1 = accept$alg(r0, 0x0, 0x0) sendmmsg(r1, &(0x7f0000007f00)=[{{&(0x7f00000056c0)=@can, 0x3000, &(0x7f00000000c0)}}, {{&(0x7f0000005900)=@pppoe={0x18, 0x0, {0x0, @link_local, 'syzkaller0\x00'}}, 0x80, &(0x7f0000007ac0), 0x1a9, &(0x7f0000007b00)}}], 0x3fffffffffffe0d, 0x0) r2 = openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000140)='/dev/sequencer2\x00', 0x80840, 0x0) getsockopt$inet_IP_XFRM_POLICY(r2, 0x0, 0x11, &(0x7f0000000380)={{{@in6=@mcast2, @in=@rand_addr, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in=@multicast1}, 0x0, @in6=@loopback}}, &(0x7f0000000180)=0xe8) chown(&(0x7f0000000340)='./file0\x00', r3, 0x0) r4 = syz_open_dev$sndpcmc(&(0x7f00000000c0)='/dev/snd/pcmC#D#c\x00', 0x0, 0x0) ioctl$ASHMEM_SET_NAME(r4, 0x41007701, &(0x7f0000000100)='syzkaller0\x00') [ 1514.181636] binder: 14512:14523 IncRefs 0 refcount change on invalid ref 4 ret -22 [ 1514.219803] binder: 14512:14523 BC_INCREFS_DONE u0000000000000000 no match 13:16:52 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r0, &(0x7f0000942000)={0x2, 0x4e20, @multicast1}, 0x10) sendmsg$key(0xffffffffffffffff, &(0x7f0000f56000)={0x0, 0x0, &(0x7f00008feff0)={&(0x7f0000000500)=ANY=[@ANYBLOB="020300090a1500000000000000000000030006190000000002000000e0000001003f00000000000002000100e625aa66dcef85847e479eb3c49000000400000000fd003e"], 0x44}}, 0x0) add_key(&(0x7f0000000080)='logon\x00', &(0x7f0000000100)={0x73, 0x79, 0x7a, 0x1}, &(0x7f0000001240), 0x0, 0xfffffffffffffff8) get_mempolicy(&(0x7f0000000000), &(0x7f00000001c0), 0x1ff, &(0x7f0000fff000/0x1000)=nil, 0x3) setsockopt$sock_int(r0, 0x1, 0x3c, &(0x7f0000d4effc)=0x1, 0x4) connect$inet(r0, &(0x7f0000000000)={0x2, 0x4e20, @dev={0xac, 0x14, 0x14, 0x18}}, 0x10) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f00000001c0)='tunl0\x00', 0x5) sendto$inet(r0, &(0x7f00006d1fd4)="db", 0x1, 0x4000010, &(0x7f00004daff0)={0x2, 0x0, @loopback, [0x3]}, 0x10) [ 1514.242566] binder: 14512:14523 IncRefs 0 refcount change on invalid ref 0 ret -22 13:16:52 executing program 5: r0 = syz_open_dev$binder(&(0x7f00000021c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000002340)={0x34, 0x0, &(0x7f0000002240)=[@request_death={0x400c630e, 0x4, 0x4}, @increfs={0x40046304, 0x4}, @increfs_done={0x40106308, 0x0, 0x3}, @increfs], 0x77, 0x700000000000000, &(0x7f00000022c0)="b3cd0976d8e2af743c6f523efe14fd20c3c3dd2572734282a761e1b4304e2599c85f198cc82bd5d0c74c4edca2f9ea7b875ff7047ec0784fbb354e15fd3f7d837f533597d5082692a6f2fb748da3cc4157188f7f2a5477ded56f72f5b75c96872db429e44b8fcd781d96dead77a0b58b7af9085a208a22"}) 13:16:52 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r0, &(0x7f0000942000)={0x2, 0x4e20, @multicast1}, 0x10) sendmsg$key(0xffffffffffffffff, &(0x7f0000f56000)={0x0, 0x0, &(0x7f00008feff0)={&(0x7f0000000500)=ANY=[@ANYBLOB="020300090a1500000000000000000000030006190000000002000000e0000001003f00000000000002000100e625aa66dcef85847e479eb3c49000000400000000fd003e"], 0x44}}, 0x0) add_key(&(0x7f0000000080)='logon\x00', &(0x7f0000000100)={0x73, 0x79, 0x7a, 0x1}, &(0x7f0000001240), 0x0, 0xfffffffffffffff8) get_mempolicy(&(0x7f0000000000), &(0x7f00000001c0), 0x1ff, &(0x7f0000fff000/0x1000)=nil, 0x3) setsockopt$sock_int(r0, 0x1, 0x3c, &(0x7f0000d4effc)=0x1, 0x4) connect$inet(r0, &(0x7f0000000000)={0x2, 0x4e20, @dev={0xac, 0x14, 0x14, 0x18}}, 0x10) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f00000001c0)='tunl0\x00', 0x5) sendto$inet(r0, &(0x7f00006d1fd4)="db", 0x1, 0x4000010, &(0x7f00004daff0)={0x2, 0x0, @loopback, [0xa00000000000000]}, 0x10) 13:16:52 executing program 6: clone(0x802102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000040), 0xffffffffffffffff) r0 = syz_open_dev$sndtimer(&(0x7f0000000000)='/dev/snd/timer\x00', 0x0, 0x0) r1 = getpid() sched_setscheduler(r1, 0x5, &(0x7f0000000200)) ioctl$SNDRV_TIMER_IOCTL_GPARAMS(r0, 0x40485404, &(0x7f0000000240)={{}, 0x0, 0x2000000000000000, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3]}) 13:16:52 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r0, &(0x7f0000942000)={0x2, 0x4e20, @multicast1}, 0x10) sendmsg$key(0xffffffffffffffff, &(0x7f0000f56000)={0x0, 0x0, &(0x7f00008feff0)={&(0x7f0000000500)=ANY=[@ANYBLOB="020300090a1500000000000000000000030006190000000002000000e0000001003f00000000000002000100e625aa66dcef85847e479eb3c49000000400000000fd003e"], 0x44}}, 0x0) add_key(&(0x7f0000000080)='logon\x00', &(0x7f0000000100)={0x73, 0x79, 0x7a, 0x1}, &(0x7f0000001240), 0x0, 0xfffffffffffffff8) get_mempolicy(&(0x7f0000000000), &(0x7f00000001c0), 0x1ff, &(0x7f0000fff000/0x1000)=nil, 0x3) setsockopt$sock_int(r0, 0x1, 0x3c, &(0x7f0000d4effc)=0x1, 0x4) connect$inet(r0, &(0x7f0000000000)={0x2, 0x4e20, @dev={0xac, 0x14, 0x14, 0x18}}, 0x10) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f00000001c0)='tunl0\x00', 0x5) sendto$inet(r0, &(0x7f00006d1fd4)="db", 0x1, 0x4000010, &(0x7f00004daff0)={0x2, 0x0, @loopback, [0x3000000]}, 0x10) [ 1514.430449] binder: 14536:14541 IncRefs 0 refcount change on invalid ref 4 ret -22 [ 1514.442702] binder: 14536:14541 BC_INCREFS_DONE u0000000000000000 no match [ 1514.455648] binder: 14536:14541 IncRefs 0 refcount change on invalid ref 0 ret -22 13:16:52 executing program 7: r0 = openat$cuse(0xffffffffffffff9c, &(0x7f0000000080)='/dev/cuse\x00', 0x2, 0x0) clone(0x1002102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000640), 0xffffffffffffffff) r1 = getpid() sched_setscheduler(r1, 0x5, &(0x7f0000000000)) write$FUSE_NOTIFY_DELETE(r0, &(0x7f0000000040)={0x29, 0x6, 0xffffffffa0028000}, 0x29) 13:16:52 executing program 3: r0 = syz_open_dev$usb(&(0x7f0000000180)='/dev/bus/usb/00#/00#\x00', 0xc3, 0x2) ioctl$TIOCMBIC(r0, 0x5417, &(0x7f00000001c0)=0x4) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = socket$alg(0x26, 0x5, 0x0) bind$alg(r1, &(0x7f0000000200)={0x26, 'hash\x00', 0x0, 0x0, 'sha1\x00'}, 0x58) r2 = accept$alg(r1, 0x0, 0x0) sendmmsg(r2, &(0x7f0000007f00)=[{{&(0x7f00000056c0)=@can, 0x3000, &(0x7f00000000c0)}}, {{&(0x7f0000005900)=@pppoe={0x18, 0x0, {0x0, @link_local, 'syzkaller0\x00'}}, 0x80, &(0x7f0000007ac0), 0x1a9, &(0x7f0000007b00)}}], 0x3fffffffffffe0d, 0x0) openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000140)='/dev/sequencer2\x00', 0x80840, 0x0) chown(&(0x7f0000000340)='./file0\x00', 0x0, 0x0) r3 = syz_open_dev$sndpcmc(&(0x7f0000000280)='/dev/snd/pcmC#D#c\x00', 0x8, 0x0) ioctl$ASHMEM_SET_NAME(r3, 0x41007701, &(0x7f0000000100)='syzkaller0\x00') 13:16:52 executing program 5: r0 = syz_open_dev$binder(&(0x7f00000021c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000002340)={0x34, 0x0, &(0x7f0000002240)=[@request_death={0x400c630e, 0x4, 0x4}, @increfs={0x40046304, 0x4}, @increfs_done={0x40106308, 0x0, 0x3}, @increfs], 0x77, 0x8000a0, &(0x7f00000022c0)="b3cd0976d8e2af743c6f523efe14fd20c3c3dd2572734282a761e1b4304e2599c85f198cc82bd5d0c74c4edca2f9ea7b875ff7047ec0784fbb354e15fd3f7d837f533597d5082692a6f2fb748da3cc4157188f7f2a5477ded56f72f5b75c96872db429e44b8fcd781d96dead77a0b58b7af9085a208a22"}) [ 1514.525859] binder: 14546:14547 ioctl c0306209 20002340 returned -22 [ 1514.536923] binder: 14546:14548 ioctl c0306209 20002340 returned -22 [ 1514.674203] binder: 14561:14562 BC_INCREFS_DONE u0000000000000000 no match 13:16:53 executing program 1: r0 = socket$netlink(0x10, 0x3, 0x8000000004) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_TCP_CONGESTION(r1, 0x6, 0xd, &(0x7f0000000180)='vegas\x00', 0x6) bind$inet6(r1, &(0x7f00001fefe4)={0xa, 0x4e22}, 0x1c) sendto$inet6(r1, &(0x7f0000000100), 0x8d2d601e8976aa5, 0x20000004, &(0x7f000031e000)={0xa, 0x4e22}, 0x1c) writev(r0, &(0x7f0000000100)=[{&(0x7f0000000000)="580000001400192340834b80040d8c560a067f35a5ff81004e220000000058000b4824ca944f64009400050028925aa8000000000000008000f0fffeffff09000000fff5dd00000010000100000c0900fcff0000040e05a5", 0x58}], 0x1) 13:16:53 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r0, &(0x7f0000942000)={0x2, 0x4e20, @multicast1}, 0x10) sendmsg$key(0xffffffffffffffff, &(0x7f0000f56000)={0x0, 0x0, &(0x7f00008feff0)={&(0x7f0000000500)=ANY=[@ANYBLOB="020300090a1500000000000000000000030006190000000002000000e0000001003f00000000000002000100e625aa66dcef85847e479eb3c49000000400000000fd003e"], 0x44}}, 0x0) add_key(&(0x7f0000000080)='logon\x00', &(0x7f0000000100)={0x73, 0x79, 0x7a, 0x1}, &(0x7f0000001240), 0x0, 0xfffffffffffffff8) get_mempolicy(&(0x7f0000000000), &(0x7f00000001c0), 0x1ff, &(0x7f0000fff000/0x1000)=nil, 0x3) setsockopt$sock_int(r0, 0x1, 0x3c, &(0x7f0000d4effc)=0x1, 0x4) connect$inet(r0, &(0x7f0000000000)={0x2, 0x4e20, @dev={0xac, 0x14, 0x14, 0x18}}, 0x10) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f00000001c0)='tunl0\x00', 0x5) sendto$inet(r0, &(0x7f00006d1fd4)="db", 0x1, 0x4000010, &(0x7f00004daff0)={0x2, 0x0, @loopback, [0x49000000]}, 0x10) 13:16:53 executing program 5: r0 = syz_open_dev$binder(&(0x7f00000021c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000002340)={0x34, 0x0, &(0x7f0000002240)=[@request_death={0x400c630e, 0x4, 0x4}, @increfs={0x40046304, 0x4}, @increfs_done={0x40106308, 0x0, 0x3}, @increfs], 0x77, 0x7400, &(0x7f00000022c0)="b3cd0976d8e2af743c6f523efe14fd20c3c3dd2572734282a761e1b4304e2599c85f198cc82bd5d0c74c4edca2f9ea7b875ff7047ec0784fbb354e15fd3f7d837f533597d5082692a6f2fb748da3cc4157188f7f2a5477ded56f72f5b75c96872db429e44b8fcd781d96dead77a0b58b7af9085a208a22"}) 13:16:53 executing program 4: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x3e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff7fffffffffff}, 0x0, 0x0, 0xffffffffffffffff, 0x0) fcntl$setown(r0, 0x8, 0x0) bind$inet6(r0, &(0x7f0000807fe4)={0xa, 0x4e22}, 0x1c) sendto$inet6(r0, &(0x7f0000000380), 0x0, 0x200408d4, &(0x7f000072e000)={0xa, 0x4e22, 0x0, @loopback}, 0x1c) sendto$inet6(r0, &(0x7f0000ad6fad)='\x00', 0x1, 0x3fffffd, &(0x7f0000254000)={0xa, 0x0, 0x0, @loopback}, 0x1c) 13:16:53 executing program 6: clone(0x802102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000040), 0xffffffffffffffff) r0 = syz_open_dev$sndtimer(&(0x7f0000000000)='/dev/snd/timer\x00', 0x0, 0x0) r1 = getpid() sched_setscheduler(r1, 0x5, &(0x7f0000000200)) ioctl$SNDRV_TIMER_IOCTL_GPARAMS(r0, 0x40485404, &(0x7f0000000240)={{}, 0x0, 0x2000000000000000, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x100000000000000]}) 13:16:53 executing program 7: r0 = openat$cuse(0xffffffffffffff9c, &(0x7f0000000080)='/dev/cuse\x00', 0x2, 0x0) clone(0x1002102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000640), 0xffffffffffffffff) r1 = getpid() sched_setscheduler(r1, 0x5, &(0x7f0000000000)) write$FUSE_NOTIFY_DELETE(r0, &(0x7f0000000040)={0x29, 0x6, 0x3}, 0x29) 13:16:53 executing program 3: perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000180)='cpu.stat\x00', 0x0, 0x0) ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r1 = socket$alg(0x26, 0x5, 0x0) bind$alg(r1, &(0x7f0000000200)={0x26, 'hash\x00', 0x0, 0x0, 'sha1\x00'}, 0x58) r2 = accept$alg(r1, 0x0, 0x0) sendmmsg(r2, &(0x7f0000007f00)=[{{&(0x7f00000056c0)=@can, 0x3000, &(0x7f00000000c0)}}, {{&(0x7f0000005900)=@pppoe={0x18, 0x0, {0x0, @link_local, 'syzkaller0\x00'}}, 0x80, &(0x7f0000007ac0), 0x1a9, &(0x7f0000007b00)}}], 0x3fffffffffffe0d, 0x0) openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000140)='/dev/sequencer2\x00', 0x80840, 0x0) chown(&(0x7f0000000340)='./file0\x00', 0x0, 0x0) r3 = syz_open_dev$sndpcmc(&(0x7f00000000c0)='/dev/snd/pcmC#D#c\x00', 0x0, 0x0) ioctl$ASHMEM_SET_NAME(r3, 0x41007701, &(0x7f0000000100)='syzkaller0\x00') 13:16:53 executing program 0: perf_event_open(&(0x7f0000000040)={0x2, 0x70, 0x3e5}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f00000021c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc018620b, &(0x7f0000002340)={0xb5, 0x0, &(0x7f00000000c0)=ANY=[@ANYBLOB="0463044000000000b6a571ac965f26c50d500dae115e59afcd8a338d8b2727193c56d4ebef60c214b766ffde6cff6ceef2baa2594a53a0117e77afd5d58e8a35afdae81b258585ce769507333c0238790d5ed750bf1d6ca2a873050056528fce7becfd12f165ac43a826d3462822ff8f29ea992d4e208847cf4fc10ca00b87b5ce2523fa477bad0be1c97e4398aa2ac81d973b5a871d8e0b295e436cd8415f19088c6c82c85f4ed1fac41da062bc6dbfb8eac4276c"], 0x0, 0x0, &(0x7f00000022c0)}) [ 1515.025337] binder: 14579:14584 BC_INCREFS_DONE u0000000000000000 no match 13:16:53 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r0, &(0x7f0000942000)={0x2, 0x4e20, @multicast1}, 0x10) sendmsg$key(0xffffffffffffffff, &(0x7f0000f56000)={0x0, 0x0, &(0x7f00008feff0)={&(0x7f0000000500)=ANY=[@ANYBLOB="020300090a1500000000000000000000030006190000000002000000e0000001003f00000000000002000100e625aa66dcef85847e479eb3c49000000400000000fd003e"], 0x44}}, 0x0) add_key(&(0x7f0000000080)='logon\x00', &(0x7f0000000100)={0x73, 0x79, 0x7a, 0x1}, &(0x7f0000001240), 0x0, 0xfffffffffffffff8) get_mempolicy(&(0x7f0000000000), &(0x7f00000001c0), 0x1ff, &(0x7f0000fff000/0x1000)=nil, 0x3) setsockopt$sock_int(r0, 0x1, 0x3c, &(0x7f0000d4effc)=0x1, 0x4) connect$inet(r0, &(0x7f0000000000)={0x2, 0x4e20, @dev={0xac, 0x14, 0x14, 0x18}}, 0x10) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f00000001c0)='tunl0\x00', 0x5) sendto$inet(r0, &(0x7f00006d1fd4)="db", 0x1, 0x4000010, &(0x7f00004daff0)={0x2, 0x0, @loopback, [0xe803]}, 0x10) 13:16:53 executing program 5: r0 = syz_open_dev$binder(&(0x7f00000021c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000002340)={0x34, 0x0, &(0x7f0000002240)=[@request_death={0x400c630e, 0x4, 0x4}, @increfs={0x40046304, 0x4}, @increfs_done={0x40106308, 0x0, 0x3}, @increfs], 0x77, 0x6c00, &(0x7f00000022c0)="b3cd0976d8e2af743c6f523efe14fd20c3c3dd2572734282a761e1b4304e2599c85f198cc82bd5d0c74c4edca2f9ea7b875ff7047ec0784fbb354e15fd3f7d837f533597d5082692a6f2fb748da3cc4157188f7f2a5477ded56f72f5b75c96872db429e44b8fcd781d96dead77a0b58b7af9085a208a22"}) 13:16:53 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r0, &(0x7f0000942000)={0x2, 0x4e20, @multicast1}, 0x10) sendmsg$key(0xffffffffffffffff, &(0x7f0000f56000)={0x0, 0x0, &(0x7f00008feff0)={&(0x7f0000000500)=ANY=[@ANYBLOB="020300090a1500000000000000000000030006190000000002000000e0000001003f00000000000002000100e625aa66dcef85847e479eb3c49000000400000000fd003e"], 0x44}}, 0x0) add_key(&(0x7f0000000080)='logon\x00', &(0x7f0000000100)={0x73, 0x79, 0x7a, 0x1}, &(0x7f0000001240), 0x0, 0xfffffffffffffff8) get_mempolicy(&(0x7f0000000000), &(0x7f00000001c0), 0x1ff, &(0x7f0000fff000/0x1000)=nil, 0x3) setsockopt$sock_int(r0, 0x1, 0x3c, &(0x7f0000d4effc)=0x1, 0x4) connect$inet(r0, &(0x7f0000000000)={0x2, 0x4e20, @dev={0xac, 0x14, 0x14, 0x18}}, 0x10) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f00000001c0)='tunl0\x00', 0x5) sendto$inet(r0, &(0x7f00006d1fd4)="db", 0x1, 0x4000010, &(0x7f00004daff0)={0x2, 0x0, @loopback, [0x200000000000000]}, 0x10) 13:16:53 executing program 5: r0 = syz_open_dev$binder(&(0x7f00000021c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000002340)={0x34, 0x0, &(0x7f0000002240)=[@request_death={0x400c630e, 0x4, 0x4}, @increfs={0x40046304, 0x4}, @increfs_done={0x40106308, 0x0, 0x3}, @increfs], 0x77, 0xa00, &(0x7f00000022c0)="b3cd0976d8e2af743c6f523efe14fd20c3c3dd2572734282a761e1b4304e2599c85f198cc82bd5d0c74c4edca2f9ea7b875ff7047ec0784fbb354e15fd3f7d837f533597d5082692a6f2fb748da3cc4157188f7f2a5477ded56f72f5b75c96872db429e44b8fcd781d96dead77a0b58b7af9085a208a22"}) [ 1515.263923] binder: 14600:14601 BC_INCREFS_DONE u0000000000000000 no match 13:16:53 executing program 3: perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000200)={0x26, 'hash\x00', 0x0, 0x0, 'sha1\x00'}, 0x58) r1 = accept$alg(r0, 0x0, 0x0) sendmmsg(r1, &(0x7f0000007f00)=[{{&(0x7f00000056c0)=@can, 0x80, &(0x7f00000000c0)}}, {{&(0x7f0000005900)=@pppoe={0x18, 0x0, {0x0, @link_local, 'syzkaller0\x00'}}, 0x80, &(0x7f0000007ac0), 0x0, &(0x7f0000007b00)}}], 0x2, 0x4) openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000140)='/dev/sequencer2\x00', 0x80840, 0x0) chown(&(0x7f0000000340)='./file0\x00', 0x0, 0x0) r2 = syz_open_dev$sndpcmc(&(0x7f00000000c0)='/dev/snd/pcmC#D#c\x00', 0x0, 0x0) ioctl$ASHMEM_SET_NAME(r2, 0x41007701, &(0x7f0000000100)='syzkaller0\x00') 13:16:53 executing program 7: r0 = openat$cuse(0xffffffffffffff9c, &(0x7f0000000080)='/dev/cuse\x00', 0x2, 0x0) clone(0x1002102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000640), 0xffffffffffffffff) r1 = getpid() sched_setscheduler(r1, 0x5, &(0x7f0000000000)) write$FUSE_NOTIFY_DELETE(r0, &(0x7f0000000040)={0x29, 0x6, 0x600000000000000}, 0x29) [ 1515.375394] binder: 14608:14611 BC_INCREFS_DONE u0000000000000000 no match 13:16:53 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r0, &(0x7f0000942000)={0x2, 0x4e20, @multicast1}, 0x10) sendmsg$key(0xffffffffffffffff, &(0x7f0000f56000)={0x0, 0x0, &(0x7f00008feff0)={&(0x7f0000000500)=ANY=[@ANYBLOB="020300090a1500000000000000000000030006190000000002000000e0000001003f00000000000002000100e625aa66dcef85847e479eb3c49000000400000000fd003e"], 0x44}}, 0x0) add_key(&(0x7f0000000080)='logon\x00', &(0x7f0000000100)={0x73, 0x79, 0x7a, 0x1}, &(0x7f0000001240), 0x0, 0xfffffffffffffff8) get_mempolicy(&(0x7f0000000000), &(0x7f00000001c0), 0x1ff, &(0x7f0000fff000/0x1000)=nil, 0x3) setsockopt$sock_int(r0, 0x1, 0x3c, &(0x7f0000d4effc)=0x1, 0x4) connect$inet(r0, &(0x7f0000000000)={0x2, 0x4e20, @dev={0xac, 0x14, 0x14, 0x18}}, 0x10) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f00000001c0)='tunl0\x00', 0x5) sendto$inet(r0, &(0x7f00006d1fd4)="db", 0x1, 0x4000010, &(0x7f00004daff0)={0x2, 0x0, @loopback, [0x1000000]}, 0x10) 13:16:53 executing program 6: clone(0x802102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000040), 0xffffffffffffffff) r0 = syz_open_dev$sndtimer(&(0x7f0000000000)='/dev/snd/timer\x00', 0x0, 0x0) r1 = getpid() sched_setscheduler(r1, 0x5, &(0x7f0000000200)) ioctl$SNDRV_TIMER_IOCTL_GPARAMS(r0, 0x40485404, &(0x7f0000000240)={{}, 0x0, 0x2000000000000000, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x300000000000000]}) 13:16:53 executing program 1: r0 = socket$netlink(0x10, 0x3, 0x8000000004) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_TCP_CONGESTION(r1, 0x6, 0xd, &(0x7f0000000180)='vegas\x00', 0x6) bind$inet6(r1, &(0x7f00001fefe4)={0xa, 0x4e22}, 0x1c) sendto$inet6(r1, &(0x7f0000000100), 0x8d2d601e8976aa5, 0x20000004, &(0x7f000031e000)={0xa, 0x4e22}, 0x1c) writev(r0, &(0x7f0000000100)=[{&(0x7f0000000000)="580000001400192340834b80040d8c560a067f7597ff81004e220000000058000b4824ca944f64009400050028925aa8000000000000008000f0fffeffff09000000fff5dd00000010000100000c0900fcff0000040e05a5", 0x58}], 0x1) 13:16:53 executing program 5: r0 = syz_open_dev$binder(&(0x7f00000021c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000002340)={0x34, 0x0, &(0x7f0000002240)=[@request_death={0x400c630e, 0x4, 0x4}, @increfs={0x40046304, 0x4}, @increfs_done={0x40106308, 0x0, 0x3}, @increfs], 0x77, 0x500, &(0x7f00000022c0)="b3cd0976d8e2af743c6f523efe14fd20c3c3dd2572734282a761e1b4304e2599c85f198cc82bd5d0c74c4edca2f9ea7b875ff7047ec0784fbb354e15fd3f7d837f533597d5082692a6f2fb748da3cc4157188f7f2a5477ded56f72f5b75c96872db429e44b8fcd781d96dead77a0b58b7af9085a208a22"}) 13:16:53 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r0, &(0x7f0000942000)={0x2, 0x4e20, @multicast1}, 0x10) sendmsg$key(0xffffffffffffffff, &(0x7f0000f56000)={0x0, 0x0, &(0x7f00008feff0)={&(0x7f0000000500)=ANY=[@ANYBLOB="020300090a1500000000000000000000030006190000000002000000e0000001003f00000000000002000100e625aa66dcef85847e479eb3c49000000400000000fd003e"], 0x44}}, 0x0) add_key(&(0x7f0000000080)='logon\x00', &(0x7f0000000100)={0x73, 0x79, 0x7a, 0x1}, &(0x7f0000001240), 0x0, 0xfffffffffffffff8) get_mempolicy(&(0x7f0000000000), &(0x7f00000001c0), 0x1ff, &(0x7f0000fff000/0x1000)=nil, 0x3) setsockopt$sock_int(r0, 0x1, 0x3c, &(0x7f0000d4effc)=0x1, 0x4) connect$inet(r0, &(0x7f0000000000)={0x2, 0x4e20, @dev={0xac, 0x14, 0x14, 0x18}}, 0x10) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f00000001c0)='tunl0\x00', 0x5) sendto$inet(r0, &(0x7f00006d1fd4)="db", 0x1, 0x4000010, &(0x7f00004daff0)={0x2, 0x0, @loopback, [0xe00]}, 0x10) 13:16:53 executing program 6: clone(0x802102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000040), 0xffffffffffffffff) r0 = syz_open_dev$sndtimer(&(0x7f0000000000)='/dev/snd/timer\x00', 0x0, 0x0) r1 = getpid() sched_setscheduler(r1, 0x5, &(0x7f0000000200)) ioctl$SNDRV_TIMER_IOCTL_GPARAMS(r0, 0x40485404, &(0x7f0000000240)={{}, 0x0, 0x2000000000000000, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1000000]}) 13:16:53 executing program 3: perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x100000001, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffc, 0x0, 0x0, 0x2}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000200)={0x26, 'hash\x00', 0x0, 0x0, 'sha1\x00'}, 0x58) r1 = accept$alg(r0, 0x0, 0x0) sendmmsg(r1, &(0x7f0000007f00)=[{{&(0x7f00000056c0)=@can, 0x3000, &(0x7f00000000c0)}}, {{&(0x7f0000005900)=@pppoe={0x18, 0x0, {0x0, @link_local, 'syzkaller0\x00'}}, 0x80, &(0x7f0000007ac0), 0x1a9, &(0x7f0000007b00)}}], 0x3fffffffffffe0d, 0x0) openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000140)='/dev/sequencer2\x00', 0x80840, 0x0) chown(&(0x7f0000000340)='./file0\x00', 0x0, 0x0) r2 = syz_open_dev$sndpcmc(&(0x7f00000000c0)='/dev/snd/pcmC#D#c\x00', 0x0, 0x0) ioctl$ASHMEM_SET_NAME(r2, 0x41007701, &(0x7f0000000100)='syzkaller0\x00') 13:16:53 executing program 0: perf_event_open(&(0x7f0000000040)={0x2, 0x70, 0x3e5}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f00000021c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000002340)={0xb5, 0x60, &(0x7f00000000c0)=ANY=[@ANYBLOB="0463044000000000b6a571ac965f26c50d500dae115e59afcd8a338d8b2727193c56d4ebef60c214b766ffde6cff6ceef2baa2594a53a0117e77afd5d58e8a35afdae81b258585ce769507333c0238790d5ed750bf1d6ca2a873050056528fce7becfd12f165ac43a826d3462822ff8f29ea992d4e208847cf4fc10ca00b87b5ce2523fa477bad0be1c97e4398aa2ac81d973b5a871d8e0b295e436cd8415f19088c6c82c85f4ed1fac41da062bc6dbfb8eac4276c"], 0x0, 0x0, &(0x7f00000022c0)}) 13:16:53 executing program 7: r0 = openat$cuse(0xffffffffffffff9c, &(0x7f0000000080)='/dev/cuse\x00', 0x2, 0x0) clone(0x1002102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000640), 0xffffffffffffffff) r1 = getpid() sched_setscheduler(r1, 0x5, &(0x7f0000000000)) write$FUSE_NOTIFY_DELETE(r0, &(0x7f0000000040)={0x29, 0x6, 0x4000000000000}, 0x29) 13:16:53 executing program 4: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x3e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff7fffffffffff}, 0x0, 0x0, 0xffffffffffffffff, 0x0) fcntl$setown(r0, 0x8, 0x0) bind$inet6(r0, &(0x7f0000807fe4)={0xa, 0x4e22}, 0x1c) sendto$inet6(r0, &(0x7f0000000380), 0x0, 0x200408d4, &(0x7f000072e000)={0xa, 0x4e22, 0x0, @loopback}, 0x1c) sendto$inet6(r0, &(0x7f0000ad6fad)='\x00', 0x1, 0x3fffffd, &(0x7f0000254000)={0xa, 0x0, 0x0, @loopback}, 0x1c) [ 1515.912064] binder_thread_write: 7 callbacks suppressed [ 1515.912077] binder: 14646:14656 BC_REQUEST_DEATH_NOTIFICATION invalid ref 4 13:16:54 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r0, &(0x7f0000942000)={0x2, 0x4e20, @multicast1}, 0x10) sendmsg$key(0xffffffffffffffff, &(0x7f0000f56000)={0x0, 0x0, &(0x7f00008feff0)={&(0x7f0000000500)=ANY=[@ANYBLOB="020300090a1500000000000000000000030006190000000002000000e0000001003f00000000000002000100e625aa66dcef85847e479eb3c49000000400000000fd003e"], 0x44}}, 0x0) add_key(&(0x7f0000000080)='logon\x00', &(0x7f0000000100)={0x73, 0x79, 0x7a, 0x1}, &(0x7f0000001240), 0x0, 0xfffffffffffffff8) get_mempolicy(&(0x7f0000000000), &(0x7f00000001c0), 0x1ff, &(0x7f0000fff000/0x1000)=nil, 0x3) setsockopt$sock_int(r0, 0x1, 0x3c, &(0x7f0000d4effc)=0x1, 0x4) connect$inet(r0, &(0x7f0000000000)={0x2, 0x4e20, @dev={0xac, 0x14, 0x14, 0x18}}, 0x10) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f00000001c0)='tunl0\x00', 0x5) sendto$inet(r0, &(0x7f00006d1fd4)="db", 0x1, 0x4000010, &(0x7f00004daff0)={0x2, 0x0, @loopback, [0x0, 0x11000000]}, 0x10) [ 1515.973179] binder: 14646:14656 BC_INCREFS_DONE u0000000000000000 no match 13:16:54 executing program 5: r0 = syz_open_dev$binder(&(0x7f00000021c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000002340)={0x34, 0x0, &(0x7f0000002240)=[@request_death={0x400c630e, 0x4, 0x4}, @increfs={0x40046304, 0x4}, @increfs_done={0x40106308, 0x0, 0x3}, @increfs], 0x77, 0x6c, &(0x7f00000022c0)="b3cd0976d8e2af743c6f523efe14fd20c3c3dd2572734282a761e1b4304e2599c85f198cc82bd5d0c74c4edca2f9ea7b875ff7047ec0784fbb354e15fd3f7d837f533597d5082692a6f2fb748da3cc4157188f7f2a5477ded56f72f5b75c96872db429e44b8fcd781d96dead77a0b58b7af9085a208a22"}) 13:16:54 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r0, &(0x7f0000942000)={0x2, 0x4e20, @multicast1}, 0x10) sendmsg$key(0xffffffffffffffff, &(0x7f0000f56000)={0x0, 0x0, &(0x7f00008feff0)={&(0x7f0000000500)=ANY=[@ANYBLOB="020300090a1500000000000000000000030006190000000002000000e0000001003f00000000000002000100e625aa66dcef85847e479eb3c49000000400000000fd003e"], 0x44}}, 0x0) add_key(&(0x7f0000000080)='logon\x00', &(0x7f0000000100)={0x73, 0x79, 0x7a, 0x1}, &(0x7f0000001240), 0x0, 0xfffffffffffffff8) get_mempolicy(&(0x7f0000000000), &(0x7f00000001c0), 0x1ff, &(0x7f0000fff000/0x1000)=nil, 0x3) setsockopt$sock_int(r0, 0x1, 0x3c, &(0x7f0000d4effc)=0x1, 0x4) connect$inet(r0, &(0x7f0000000000)={0x2, 0x4e20, @dev={0xac, 0x14, 0x14, 0x18}}, 0x10) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f00000001c0)='tunl0\x00', 0x5) sendto$inet(r0, &(0x7f00006d1fd4)="db", 0x1, 0x4000010, &(0x7f00004daff0)={0x2, 0x0, @loopback, [0x0, 0xa]}, 0x10) 13:16:54 executing program 3: perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000200)={0x26, 'hash\x00', 0x0, 0x0, 'sha1\x00'}, 0x58) r1 = accept$alg(r0, 0x0, 0x0) sendmmsg(r1, &(0x7f0000007f00)=[{{&(0x7f00000056c0)=@can, 0x3000, &(0x7f00000000c0)}}, {{&(0x7f0000005900)=@pppoe={0x18, 0x0, {0x0, @link_local, 'syzkaller0\x00'}}, 0x80, &(0x7f0000007ac0), 0x1a9, &(0x7f0000007b00)}}], 0x3fffffffffffe0d, 0x0) r2 = openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000140)='/dev/sequencer2\x00', 0x80840, 0x0) getsockopt$bt_hci(r2, 0x0, 0x1, &(0x7f0000000180)=""/66, &(0x7f0000000280)=0x42) chown(&(0x7f0000000340)='./file0\x00', 0x0, 0x0) r3 = syz_open_dev$sndpcmc(&(0x7f00000000c0)='/dev/snd/pcmC#D#c\x00', 0x0, 0x0) ioctl$ASHMEM_SET_NAME(r3, 0x41007701, &(0x7f0000000100)='syzkaller0\x00') [ 1516.143133] binder: 14672:14674 BC_REQUEST_DEATH_NOTIFICATION invalid ref 4 13:16:54 executing program 7: r0 = openat$cuse(0xffffffffffffff9c, &(0x7f0000000080)='/dev/cuse\x00', 0x2, 0x0) clone(0x1002102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000640), 0xffffffffffffffff) r1 = getpid() sched_setscheduler(r1, 0x5, &(0x7f0000000000)) write$FUSE_NOTIFY_DELETE(r0, &(0x7f0000000040)={0x29, 0x6, 0xb00000000000000}, 0x29) 13:16:54 executing program 5: r0 = syz_open_dev$binder(&(0x7f00000021c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000002340)={0x34, 0x0, &(0x7f0000002240)=[@request_death={0x400c630e, 0x4, 0x4}, @increfs={0x40046304, 0x4}, @increfs_done={0x40106308, 0x0, 0x3}, @increfs], 0x77, 0x6000, &(0x7f00000022c0)="b3cd0976d8e2af743c6f523efe14fd20c3c3dd2572734282a761e1b4304e2599c85f198cc82bd5d0c74c4edca2f9ea7b875ff7047ec0784fbb354e15fd3f7d837f533597d5082692a6f2fb748da3cc4157188f7f2a5477ded56f72f5b75c96872db429e44b8fcd781d96dead77a0b58b7af9085a208a22"}) 13:16:54 executing program 6: clone(0x802102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000040), 0xffffffffffffffff) r0 = syz_open_dev$sndtimer(&(0x7f0000000000)='/dev/snd/timer\x00', 0x0, 0x0) r1 = getpid() sched_setscheduler(r1, 0x5, &(0x7f0000000200)) ioctl$SNDRV_TIMER_IOCTL_GPARAMS(r0, 0x40485404, &(0x7f0000000240)={{}, 0x0, 0x2000000000000000, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3000000]}) 13:16:54 executing program 5: r0 = syz_open_dev$binder(&(0x7f00000021c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000002340)={0x34, 0x0, &(0x7f0000002240)=[@request_death={0x400c630e, 0x4, 0x4}, @increfs={0x40046304, 0x4}, @increfs_done={0x40106308, 0x0, 0x3}, @increfs], 0x77, 0x48, &(0x7f00000022c0)="b3cd0976d8e2af743c6f523efe14fd20c3c3dd2572734282a761e1b4304e2599c85f198cc82bd5d0c74c4edca2f9ea7b875ff7047ec0784fbb354e15fd3f7d837f533597d5082692a6f2fb748da3cc4157188f7f2a5477ded56f72f5b75c96872db429e44b8fcd781d96dead77a0b58b7af9085a208a22"}) [ 1516.323878] binder: 14691:14692 BC_REQUEST_DEATH_NOTIFICATION invalid ref 4 [ 1516.427785] binder: 14703:14704 BC_REQUEST_DEATH_NOTIFICATION invalid ref 4 [ 1516.508348] binder: 14705:14708 unknown command 318631035 [ 1516.521359] binder: 14705:14708 ioctl c0306201 20002340 returned -22 [ 1516.538720] binder: 14705:14711 unknown command 318631035 [ 1516.559727] binder: 14705:14711 ioctl c0306201 20002340 returned -22 13:16:54 executing program 1: r0 = socket$netlink(0x10, 0x3, 0x8000000004) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_TCP_CONGESTION(r1, 0x6, 0xd, &(0x7f0000000180)='vegas\x00', 0x6) bind$inet6(r1, &(0x7f00001fefe4)={0xa, 0x4e22}, 0x1c) sendto$inet6(r1, &(0x7f0000000100), 0x8d2d601e8976aa5, 0x20000004, &(0x7f000031e000)={0xa, 0x4e22}, 0x1c) writev(r0, &(0x7f0000000100)=[{&(0x7f0000000000)="580000001400192340834b80040d8c560a067fb578ff81004e220000000058000b4824ca944f64009400050028925aa8000000000000008000f0fffeffff09000000fff5dd00000010000100000c0900fcff0000040e05a5", 0x58}], 0x1) 13:16:54 executing program 7: r0 = openat$cuse(0xffffffffffffff9c, &(0x7f0000000080)='/dev/cuse\x00', 0x2, 0x0) clone(0x1002102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000640), 0xffffffffffffffff) r1 = getpid() sched_setscheduler(r1, 0x5, &(0x7f0000000000)) write$FUSE_NOTIFY_DELETE(r0, &(0x7f0000000040)={0x29, 0x6, 0x700000000000000}, 0x29) 13:16:54 executing program 6: clone(0x802102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000040), 0xffffffffffffffff) r0 = syz_open_dev$sndtimer(&(0x7f0000000000)='/dev/snd/timer\x00', 0x0, 0x0) r1 = getpid() sched_setscheduler(r1, 0x5, &(0x7f0000000200)) ioctl$SNDRV_TIMER_IOCTL_GPARAMS(r0, 0x40485404, &(0x7f0000000240)={{}, 0x0, 0x2000000000000000, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x300]}) 13:16:54 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r0, &(0x7f0000942000)={0x2, 0x4e20, @multicast1}, 0x10) sendmsg$key(0xffffffffffffffff, &(0x7f0000f56000)={0x0, 0x0, &(0x7f00008feff0)={&(0x7f0000000500)=ANY=[@ANYBLOB="020300090a1500000000000000000000030006190000000002000000e0000001003f00000000000002000100e625aa66dcef85847e479eb3c49000000400000000fd003e"], 0x44}}, 0x0) add_key(&(0x7f0000000080)='logon\x00', &(0x7f0000000100)={0x73, 0x79, 0x7a, 0x1}, &(0x7f0000001240), 0x0, 0xfffffffffffffff8) get_mempolicy(&(0x7f0000000000), &(0x7f00000001c0), 0x1ff, &(0x7f0000fff000/0x1000)=nil, 0x3) setsockopt$sock_int(r0, 0x1, 0x3c, &(0x7f0000d4effc)=0x1, 0x4) connect$inet(r0, &(0x7f0000000000)={0x2, 0x4e20, @dev={0xac, 0x14, 0x14, 0x18}}, 0x10) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f00000001c0)='tunl0\x00', 0x5) sendto$inet(r0, &(0x7f00006d1fd4)="db", 0x1, 0x4000010, &(0x7f00004daff0)={0x2, 0x0, @loopback, [0x0, 0x240]}, 0x10) 13:16:54 executing program 4: r0 = gettid() perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x3e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff7fffffffffff}, 0x0, 0x0, 0xffffffffffffffff, 0x0) fcntl$setown(0xffffffffffffffff, 0x8, r0) bind$inet6(0xffffffffffffffff, &(0x7f0000807fe4)={0xa, 0x4e22}, 0x1c) sendto$inet6(0xffffffffffffffff, &(0x7f0000000380), 0x0, 0x200408d4, &(0x7f000072e000)={0xa, 0x4e22, 0x0, @loopback}, 0x1c) sendto$inet6(0xffffffffffffffff, &(0x7f0000ad6fad)='\x00', 0x1, 0x3fffffd, &(0x7f0000254000)={0xa, 0x0, 0x0, @loopback}, 0x1c) 13:16:54 executing program 5: r0 = syz_open_dev$binder(&(0x7f00000021c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000002340)={0x34, 0x0, &(0x7f0000002240)=[@request_death={0x400c630e, 0x4, 0x4}, @increfs={0x40046304, 0x4}, @increfs_done={0x40106308, 0x0, 0x3}, @increfs], 0x77, 0x1a0ffffffff, &(0x7f00000022c0)="b3cd0976d8e2af743c6f523efe14fd20c3c3dd2572734282a761e1b4304e2599c85f198cc82bd5d0c74c4edca2f9ea7b875ff7047ec0784fbb354e15fd3f7d837f533597d5082692a6f2fb748da3cc4157188f7f2a5477ded56f72f5b75c96872db429e44b8fcd781d96dead77a0b58b7af9085a208a22"}) 13:16:54 executing program 3: perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000200)={0x26, 'hash\x00', 0x0, 0x0, 'sha1\x00'}, 0x58) r1 = accept$alg(r0, 0x0, 0x0) sendmmsg(r1, &(0x7f0000007f00)=[{{&(0x7f0000000740)=@can, 0x80, &(0x7f00000000c0)}}, {{&(0x7f0000005900)=@pppoe={0x18, 0x0, {0x0, @link_local, 'syzkaller0\x00'}}, 0x80, &(0x7f0000007ac0), 0x0, &(0x7f0000007b00)}}], 0x2, 0x0) r2 = openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000140)='/dev/sequencer2\x00', 0x400800, 0x0) getgroups(0x3, &(0x7f0000000180)=[0xee01, 0xffffffffffffffff, 0xffffffffffffffff]) setsockopt$inet_MCAST_JOIN_GROUP(r1, 0x0, 0x2a, &(0x7f0000000680)={0x7, {{0x2, 0x4e21}}}, 0x88) getresgid(&(0x7f00000001c0)=0x0, &(0x7f0000000280), &(0x7f00000002c0)) getsockopt$inet6_IPV6_XFRM_POLICY(r2, 0x29, 0x23, &(0x7f00000007c0)={{{@in=@remote, @in6=@remote}}, {{@in6=@loopback}, 0x0, @in=@loopback}}, &(0x7f0000000900)=0x1b) stat(0xffffffffffffffff, &(0x7f0000000a40)) write$P9_RREMOVE(r2, &(0x7f0000000340)={0x7, 0x7b, 0x2}, 0x7) io_setup(0x0, &(0x7f0000000380)=0x0) io_cancel(r4, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x6, 0x3ff, r1, &(0x7f00000003c0)="c72fcf2cb617bb709cfc2cf630d6c1f9dcf8311224637f73e97e2724ec0808", 0x1f, 0xb00c, 0x0, 0x0, r2}, &(0x7f0000000440)) getsockopt$inet_IP_IPSEC_POLICY(r2, 0x0, 0x10, &(0x7f0000000540)={{{@in=@broadcast, @in=@dev, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in=@local}, 0x0, @in=@rand_addr}}, &(0x7f0000000640)=0xe8) chown(&(0x7f0000000300)='./file0\x00', r5, r3) r6 = syz_open_dev$sndpcmc(&(0x7f00000000c0)='/dev/snd/pcmC#D#c\x00', 0x0, 0x0) ioctl$ASHMEM_SET_NAME(r6, 0x41007701, &(0x7f0000000100)='syzkaller0\x00') 13:16:54 executing program 0: perf_event_open(&(0x7f0000000040)={0x2, 0x70, 0x3e5}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f00000021c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000002340)={0xb5, 0x4c, &(0x7f00000000c0)=ANY=[@ANYBLOB="0463044000000000b6a571ac965f26c50d500dae115e59afcd8a338d8b2727193c56d4ebef60c214b766ffde6cff6ceef2baa2594a53a0117e77afd5d58e8a35afdae81b258585ce769507333c0238790d5ed750bf1d6ca2a873050056528fce7becfd12f165ac43a826d3462822ff8f29ea992d4e208847cf4fc10ca00b87b5ce2523fa477bad0be1c97e4398aa2ac81d973b5a871d8e0b295e436cd8415f19088c6c82c85f4ed1fac41da062bc6dbfb8eac4276c"], 0x0, 0x0, &(0x7f00000022c0)}) 13:16:54 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r0, &(0x7f0000942000)={0x2, 0x4e20, @multicast1}, 0x10) sendmsg$key(0xffffffffffffffff, &(0x7f0000f56000)={0x0, 0x0, &(0x7f00008feff0)={&(0x7f0000000500)=ANY=[@ANYBLOB="020300090a1500000000000000000000030006190000000002000000e0000001003f00000000000002000100e625aa66dcef85847e479eb3c49000000400000000fd003e"], 0x44}}, 0x0) add_key(&(0x7f0000000080)='logon\x00', &(0x7f0000000100)={0x73, 0x79, 0x7a, 0x1}, &(0x7f0000001240), 0x0, 0xfffffffffffffff8) get_mempolicy(&(0x7f0000000000), &(0x7f00000001c0), 0x1ff, &(0x7f0000fff000/0x1000)=nil, 0x3) setsockopt$sock_int(r0, 0x1, 0x3c, &(0x7f0000d4effc)=0x1, 0x4) connect$inet(r0, &(0x7f0000000000)={0x2, 0x4e20, @dev={0xac, 0x14, 0x14, 0x18}}, 0x10) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f00000001c0)='tunl0\x00', 0x5) sendto$inet(r0, &(0x7f00006d1fd4)="db", 0x1, 0x4000010, &(0x7f00004daff0)={0x2, 0x0, @loopback, [0x0, 0xa00000000000000]}, 0x10) 13:16:54 executing program 3: perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000200)={0x26, 'hash\x00', 0x0, 0x0, 'sha1\x00'}, 0x58) r1 = accept$alg(r0, 0x0, 0x0) sendmmsg(r1, &(0x7f0000007f00)=[{{&(0x7f00000056c0)=@can, 0x3000, &(0x7f00000000c0)}}, {{&(0x7f0000005900)=@pppoe={0x18, 0x0, {0x0, @link_local, 'syzkaller0\x00'}}, 0x80, &(0x7f0000007ac0), 0x1a9, &(0x7f0000007b00)}}], 0x3fffffffffffe0d, 0x0) openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000140)='/dev/sequencer2\x00', 0x80840, 0x0) chown(&(0x7f0000000340)='./file0\x00', 0x0, 0x0) r2 = syz_open_dev$sndpcmc(&(0x7f00000000c0)='/dev/snd/pcmC#D#c\x00', 0x0, 0x0) ioctl$ASHMEM_SET_NAME(r2, 0x41007701, &(0x7f0000000100)='syzkaller0\x00') ioctl$sock_proto_private(r1, 0x89e0, &(0x7f0000000180)="366d57a2f97103052fcd3f203099affb4eb25e974a8b4a") [ 1516.821908] binder: 14716:14734 BC_REQUEST_DEATH_NOTIFICATION invalid ref 4 13:16:54 executing program 5: r0 = syz_open_dev$binder(&(0x7f00000021c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000002340)={0x34, 0x0, &(0x7f0000002240)=[@request_death={0x400c630e, 0x4, 0x4}, @increfs={0x40046304, 0x4}, @increfs_done={0x40106308, 0x0, 0x3}, @increfs], 0x77, 0x2000, &(0x7f00000022c0)="b3cd0976d8e2af743c6f523efe14fd20c3c3dd2572734282a761e1b4304e2599c85f198cc82bd5d0c74c4edca2f9ea7b875ff7047ec0784fbb354e15fd3f7d837f533597d5082692a6f2fb748da3cc4157188f7f2a5477ded56f72f5b75c96872db429e44b8fcd781d96dead77a0b58b7af9085a208a22"}) 13:16:55 executing program 7: r0 = openat$cuse(0xffffffffffffff9c, &(0x7f0000000080)='/dev/cuse\x00', 0x2, 0x0) clone(0x1002102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000640), 0xffffffffffffffff) r1 = getpid() sched_setscheduler(r1, 0x5, &(0x7f0000000000)) write$FUSE_NOTIFY_DELETE(r0, &(0x7f0000000040)={0x29, 0x6, 0x3000000}, 0x29) 13:16:55 executing program 6: clone(0x802102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000040), 0xffffffffffffffff) r0 = syz_open_dev$sndtimer(&(0x7f0000000000)='/dev/snd/timer\x00', 0x0, 0x0) r1 = getpid() sched_setscheduler(r1, 0x5, &(0x7f0000000200)) ioctl$SNDRV_TIMER_IOCTL_GPARAMS(r0, 0x40485404, &(0x7f0000000240)={{}, 0x0, 0x2000000000000000, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3]}) 13:16:55 executing program 7: r0 = openat$cuse(0xffffffffffffff9c, &(0x7f0000000080)='/dev/cuse\x00', 0x2, 0x0) clone(0x1002102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000640), 0xffffffffffffffff) r1 = getpid() sched_setscheduler(r1, 0x5, &(0x7f0000000000)) write$FUSE_NOTIFY_DELETE(r0, &(0x7f0000000040)={0x29, 0x6, 0x8}, 0x29) 13:16:55 executing program 6: clone(0x802102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000040), 0xffffffffffffffff) r0 = syz_open_dev$sndtimer(&(0x7f0000000000)='/dev/snd/timer\x00', 0x0, 0x0) r1 = getpid() sched_setscheduler(r1, 0x5, &(0x7f0000000200)) ioctl$SNDRV_TIMER_IOCTL_GPARAMS(r0, 0x40485404, &(0x7f0000000240)={{}, 0x0, 0x2000000000000000, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x100000000000000]}) 13:16:55 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r0, &(0x7f0000942000)={0x2, 0x4e20, @multicast1}, 0x10) sendmsg$key(0xffffffffffffffff, &(0x7f0000f56000)={0x0, 0x0, &(0x7f00008feff0)={&(0x7f0000000500)=ANY=[@ANYBLOB="020300090a1500000000000000000000030006190000000002000000e0000001003f00000000000002000100e625aa66dcef85847e479eb3c49000000400000000fd003e"], 0x44}}, 0x0) add_key(&(0x7f0000000080)='logon\x00', &(0x7f0000000100)={0x73, 0x79, 0x7a, 0x1}, &(0x7f0000001240), 0x0, 0xfffffffffffffff8) get_mempolicy(&(0x7f0000000000), &(0x7f00000001c0), 0x1ff, &(0x7f0000fff000/0x1000)=nil, 0x3) setsockopt$sock_int(r0, 0x1, 0x3c, &(0x7f0000d4effc)=0x1, 0x4) connect$inet(r0, &(0x7f0000000000)={0x2, 0x4e20, @dev={0xac, 0x14, 0x14, 0x18}}, 0x10) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f00000001c0)='tunl0\x00', 0x5) sendto$inet(r0, &(0x7f00006d1fd4)="db", 0x1, 0x4000010, &(0x7f00004daff0)={0x2, 0x0, @loopback, [0x0, 0x700000000000000]}, 0x10) [ 1517.074497] binder: 14751:14755 BC_REQUEST_DEATH_NOTIFICATION invalid ref 4 [ 1517.338024] binder: 14717:14788 unknown command 2033713724 [ 1517.353981] binder: 14717:14788 ioctl c0306201 20002340 returned -22 [ 1517.363270] binder: 14717:14792 unknown command 2033713724 [ 1517.370635] binder: 14717:14792 ioctl c0306201 20002340 returned -22 13:16:55 executing program 1: r0 = socket$netlink(0x10, 0x3, 0x8000000004) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_TCP_CONGESTION(r1, 0x6, 0xd, &(0x7f0000000180)='vegas\x00', 0x6) bind$inet6(r1, &(0x7f00001fefe4)={0xa, 0x4e22}, 0x1c) sendto$inet6(r1, &(0x7f0000000100), 0x8d2d601e8976aa5, 0x20000004, &(0x7f000031e000)={0xa, 0x4e22}, 0x1c) writev(r0, &(0x7f0000000100)=[{&(0x7f0000000000)="580000001400192340834b80040d8c560a067f1b66ff81004e220000000058000b4824ca944f64009400050028925aa8000000000000008000f0fffeffff09000000fff5dd00000010000100000c0900fcff0000040e05a5", 0x58}], 0x1) 13:16:55 executing program 5: r0 = syz_open_dev$binder(&(0x7f00000021c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000002340)={0x34, 0x0, &(0x7f0000002240)=[@request_death={0x400c630e, 0x4, 0x4}, @increfs={0x40046304, 0x4}, @increfs_done={0x40106308, 0x0, 0x3}, @increfs], 0x77, 0xffffffffa0028000, &(0x7f00000022c0)="b3cd0976d8e2af743c6f523efe14fd20c3c3dd2572734282a761e1b4304e2599c85f198cc82bd5d0c74c4edca2f9ea7b875ff7047ec0784fbb354e15fd3f7d837f533597d5082692a6f2fb748da3cc4157188f7f2a5477ded56f72f5b75c96872db429e44b8fcd781d96dead77a0b58b7af9085a208a22"}) 13:16:55 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r0, &(0x7f0000942000)={0x2, 0x4e20, @multicast1}, 0x10) sendmsg$key(0xffffffffffffffff, &(0x7f0000f56000)={0x0, 0x0, &(0x7f00008feff0)={&(0x7f0000000500)=ANY=[@ANYBLOB="020300090a1500000000000000000000030006190000000002000000e0000001003f00000000000002000100e625aa66dcef85847e479eb3c49000000400000000fd003e"], 0x44}}, 0x0) add_key(&(0x7f0000000080)='logon\x00', &(0x7f0000000100)={0x73, 0x79, 0x7a, 0x1}, &(0x7f0000001240), 0x0, 0xfffffffffffffff8) get_mempolicy(&(0x7f0000000000), &(0x7f00000001c0), 0x1ff, &(0x7f0000fff000/0x1000)=nil, 0x3) setsockopt$sock_int(r0, 0x1, 0x3c, &(0x7f0000d4effc)=0x1, 0x4) connect$inet(r0, &(0x7f0000000000)={0x2, 0x4e20, @dev={0xac, 0x14, 0x14, 0x18}}, 0x10) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f00000001c0)='tunl0\x00', 0x5) sendto$inet(r0, &(0x7f00006d1fd4)="db", 0x1, 0x4000010, &(0x7f00004daff0)={0x2, 0x0, @loopback, [0x0, 0x400000000000000]}, 0x10) 13:16:55 executing program 7: r0 = openat$cuse(0xffffffffffffff9c, &(0x7f0000000080)='/dev/cuse\x00', 0x2, 0x0) clone(0x1002102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000640), 0xffffffffffffffff) r1 = getpid() sched_setscheduler(r1, 0x5, &(0x7f0000000000)) write$FUSE_NOTIFY_DELETE(r0, &(0x7f0000000040)={0x29, 0x6, 0xa}, 0x29) 13:16:55 executing program 6: clone(0x802102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000040), 0xffffffffffffffff) r0 = syz_open_dev$sndtimer(&(0x7f0000000000)='/dev/snd/timer\x00', 0x0, 0x0) r1 = getpid() sched_setscheduler(r1, 0x5, &(0x7f0000000200)) ioctl$SNDRV_TIMER_IOCTL_GPARAMS(r0, 0x40485404, &(0x7f0000000240)={{}, 0x0, 0x2000000000000000, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x300000000000000]}) 13:16:55 executing program 4: r0 = gettid() perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x3e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff7fffffffffff}, 0x0, 0x0, 0xffffffffffffffff, 0x0) fcntl$setown(0xffffffffffffffff, 0x8, r0) bind$inet6(0xffffffffffffffff, &(0x7f0000807fe4)={0xa, 0x4e22}, 0x1c) sendto$inet6(0xffffffffffffffff, &(0x7f0000000380), 0x0, 0x200408d4, &(0x7f000072e000)={0xa, 0x4e22, 0x0, @loopback}, 0x1c) sendto$inet6(0xffffffffffffffff, &(0x7f0000ad6fad)='\x00', 0x1, 0x3fffffd, &(0x7f0000254000)={0xa, 0x0, 0x0, @loopback}, 0x1c) 13:16:55 executing program 3: perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000200)={0x26, 'hash\x00', 0x0, 0x0, 'sha1\x00'}, 0x58) r1 = accept$alg(r0, 0x0, 0x0) sendmmsg(r1, &(0x7f0000007f00)=[{{&(0x7f00000056c0)=@can, 0x3000, &(0x7f00000000c0)}}, {{&(0x7f0000005900)=@pppoe={0x18, 0x0, {0x0, @link_local, 'syzkaller0\x00'}}, 0x80, &(0x7f0000007ac0), 0x1a9, &(0x7f0000007b00)}}], 0x3fffffffffffe0d, 0x0) openat$sequencer2(0xffffffffffffff9c, &(0x7f00000002c0)='/dev/sequencer2\x00', 0x80840, 0x0) chown(&(0x7f0000000340)='./file0\x00', 0x0, 0x0) r2 = syz_open_dev$sndpcmc(&(0x7f00000000c0)='/dev/snd/pcmC#D#c\x00', 0x0, 0x0) ioctl$ASHMEM_SET_NAME(r2, 0x41007701, &(0x7f0000000100)='syzkaller0\x00') 13:16:55 executing program 0: perf_event_open(&(0x7f0000000040)={0x2, 0x70, 0x3e5}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f00000021c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000002340)={0xb5, 0xa0010000, &(0x7f00000000c0)=ANY=[@ANYBLOB="0463044000000000b6a571ac965f26c50d500dae115e59afcd8a338d8b2727193c56d4ebef60c214b766ffde6cff6ceef2baa2594a53a0117e77afd5d58e8a35afdae81b258585ce769507333c0238790d5ed750bf1d6ca2a873050056528fce7becfd12f165ac43a826d3462822ff8f29ea992d4e208847cf4fc10ca00b87b5ce2523fa477bad0be1c97e4398aa2ac81d973b5a871d8e0b295e436cd8415f19088c6c82c85f4ed1fac41da062bc6dbfb8eac4276c"], 0x0, 0x0, &(0x7f00000022c0)}) 13:16:55 executing program 5: r0 = syz_open_dev$binder(&(0x7f00000021c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000002340)={0x34, 0x0, &(0x7f0000002240)=[@request_death={0x400c630e, 0x4, 0x4}, @increfs={0x40046304, 0x4}, @increfs_done={0x40106308, 0x0, 0x3}, @increfs], 0x77, 0x4c, &(0x7f00000022c0)="b3cd0976d8e2af743c6f523efe14fd20c3c3dd2572734282a761e1b4304e2599c85f198cc82bd5d0c74c4edca2f9ea7b875ff7047ec0784fbb354e15fd3f7d837f533597d5082692a6f2fb748da3cc4157188f7f2a5477ded56f72f5b75c96872db429e44b8fcd781d96dead77a0b58b7af9085a208a22"}) 13:16:55 executing program 7: r0 = openat$cuse(0xffffffffffffff9c, &(0x7f0000000080)='/dev/cuse\x00', 0x2, 0x0) clone(0x1002102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000640), 0xffffffffffffffff) r1 = getpid() sched_setscheduler(r1, 0x5, &(0x7f0000000000)) write$FUSE_NOTIFY_DELETE(r0, &(0x7f0000000040)={0x29, 0x6, 0x300000000000000}, 0x29) [ 1517.683852] binder: 14804:14810 BC_REQUEST_DEATH_NOTIFICATION invalid ref 4 13:16:55 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r0, &(0x7f0000942000)={0x2, 0x4e20, @multicast1}, 0x10) sendmsg$key(0xffffffffffffffff, &(0x7f0000f56000)={0x0, 0x0, &(0x7f00008feff0)={&(0x7f0000000500)=ANY=[@ANYBLOB="020300090a1500000000000000000000030006190000000002000000e0000001003f00000000000002000100e625aa66dcef85847e479eb3c49000000400000000fd003e"], 0x44}}, 0x0) add_key(&(0x7f0000000080)='logon\x00', &(0x7f0000000100)={0x73, 0x79, 0x7a, 0x1}, &(0x7f0000001240), 0x0, 0xfffffffffffffff8) get_mempolicy(&(0x7f0000000000), &(0x7f00000001c0), 0x1ff, &(0x7f0000fff000/0x1000)=nil, 0x3) setsockopt$sock_int(r0, 0x1, 0x3c, &(0x7f0000d4effc)=0x1, 0x4) connect$inet(r0, &(0x7f0000000000)={0x2, 0x4e20, @dev={0xac, 0x14, 0x14, 0x18}}, 0x10) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f00000001c0)='tunl0\x00', 0x5) sendto$inet(r0, &(0x7f00006d1fd4)="db", 0x1, 0x4000010, &(0x7f00004daff0)={0x2, 0x0, @loopback, [0x0, 0x142800]}, 0x10) 13:16:55 executing program 6: clone(0x802102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000040), 0xffffffffffffffff) r0 = syz_open_dev$sndtimer(&(0x7f0000000000)='/dev/snd/timer\x00', 0x0, 0x0) r1 = getpid() sched_setscheduler(r1, 0x5, &(0x7f0000000200)) ioctl$SNDRV_TIMER_IOCTL_GPARAMS(r0, 0x40485404, &(0x7f0000000240)={{}, 0x0, 0x2000000000000000, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1000000]}) 13:16:56 executing program 5: r0 = syz_open_dev$binder(&(0x7f00000021c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000002340)={0x34, 0x0, &(0x7f0000002240)=[@request_death={0x400c630e, 0x4, 0x4}, @increfs={0x40046304, 0x4}, @increfs_done={0x40106308, 0x0, 0x3}, @increfs], 0x77, 0x100000000000000, &(0x7f00000022c0)="b3cd0976d8e2af743c6f523efe14fd20c3c3dd2572734282a761e1b4304e2599c85f198cc82bd5d0c74c4edca2f9ea7b875ff7047ec0784fbb354e15fd3f7d837f533597d5082692a6f2fb748da3cc4157188f7f2a5477ded56f72f5b75c96872db429e44b8fcd781d96dead77a0b58b7af9085a208a22"}) 13:16:56 executing program 7: r0 = openat$cuse(0xffffffffffffff9c, &(0x7f0000000080)='/dev/cuse\x00', 0x2, 0x0) clone(0x1002102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000640), 0xffffffffffffffff) r1 = getpid() sched_setscheduler(r1, 0x5, &(0x7f0000000000)) write$FUSE_NOTIFY_DELETE(r0, &(0x7f0000000040)={0x29, 0x6, 0x8000a0}, 0x29) 13:16:56 executing program 6: clone(0x802102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000040), 0xffffffffffffffff) r0 = syz_open_dev$sndtimer(&(0x7f0000000000)='/dev/snd/timer\x00', 0x0, 0x0) r1 = getpid() sched_setscheduler(r1, 0x5, &(0x7f0000000200)) ioctl$SNDRV_TIMER_IOCTL_GPARAMS(r0, 0x40485404, &(0x7f0000000240)={{}, 0x0, 0x2000000000000000, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3000000]}) [ 1517.900815] binder: 14827:14833 BC_REQUEST_DEATH_NOTIFICATION invalid ref 4 13:16:56 executing program 7: r0 = openat$cuse(0xffffffffffffff9c, &(0x7f0000000080)='/dev/cuse\x00', 0x2, 0x0) clone(0x1002102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000640), 0xffffffffffffffff) r1 = getpid() sched_setscheduler(r1, 0x5, &(0x7f0000000000)) write$FUSE_NOTIFY_DELETE(r0, &(0x7f0000000040)={0x29, 0x6, 0x9000000}, 0x29) [ 1518.068453] binder: 14848:14857 BC_REQUEST_DEATH_NOTIFICATION invalid ref 4 13:16:56 executing program 1: r0 = socket$netlink(0x10, 0x3, 0x8000000004) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_TCP_CONGESTION(r1, 0x6, 0xd, &(0x7f0000000180)='vegas\x00', 0x6) bind$inet6(r1, &(0x7f00001fefe4)={0xa, 0x4e22}, 0x1c) sendto$inet6(r1, &(0x7f0000000100), 0x8d2d601e8976aa5, 0x20000004, &(0x7f000031e000)={0xa, 0x4e22}, 0x1c) writev(r0, &(0x7f0000000100)=[{&(0x7f0000000000)="580000001400192340834b80040d8c560a067f02a4ff81004e220000000058000b4824ca944f64009400050028925aa8000000000000008000f0fffeffff09000000fff5dd00000010000100000c0900fcff0000040e05a5", 0x58}], 0x1) 13:16:56 executing program 6: clone(0x802102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000040), 0xffffffffffffffff) r0 = syz_open_dev$sndtimer(&(0x7f0000000000)='/dev/snd/timer\x00', 0x0, 0x0) r1 = getpid() sched_setscheduler(r1, 0x5, &(0x7f0000000200)) ioctl$SNDRV_TIMER_IOCTL_GPARAMS(r0, 0x40485404, &(0x7f0000000240)={{}, 0x0, 0x2000000000000000, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x300]}) 13:16:56 executing program 3: perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000200)={0x26, 'hash\x00', 0x0, 0x0, 'sha1\x00'}, 0x58) r1 = openat(0xffffffffffffffff, &(0x7f0000000180)='./file0\x00', 0x40400, 0x40) setsockopt$SO_VM_SOCKETS_BUFFER_SIZE(r1, 0x28, 0x0, &(0x7f00000001c0)=0x3fc000000000, 0x8) r2 = accept$alg(r0, 0x0, 0x0) sendmmsg(r2, &(0x7f0000007f00)=[{{&(0x7f00000056c0)=@can, 0x3000, &(0x7f00000000c0)}}, {{&(0x7f0000005900)=@pppoe={0x18, 0x0, {0x0, @link_local, 'syzkaller0\x00'}}, 0x80, &(0x7f0000007ac0), 0x1a9, &(0x7f0000007b00)}}], 0x3fffffffffffe0d, 0x0) openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000140)='/dev/sequencer2\x00', 0x80840, 0x0) chown(&(0x7f0000000340)='./file0\x00', 0x0, 0x0) r3 = syz_open_dev$sndpcmc(&(0x7f00000000c0)='/dev/snd/pcmC#D#c\x00', 0x0, 0x0) ioctl$ASHMEM_SET_NAME(r3, 0x41007701, &(0x7f0000000100)='syzkaller0\x00') 13:16:56 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r0, &(0x7f0000942000)={0x2, 0x4e20, @multicast1}, 0x10) sendmsg$key(0xffffffffffffffff, &(0x7f0000f56000)={0x0, 0x0, &(0x7f00008feff0)={&(0x7f0000000500)=ANY=[@ANYBLOB="020300090a1500000000000000000000030006190000000002000000e0000001003f00000000000002000100e625aa66dcef85847e479eb3c49000000400000000fd003e"], 0x44}}, 0x0) add_key(&(0x7f0000000080)='logon\x00', &(0x7f0000000100)={0x73, 0x79, 0x7a, 0x1}, &(0x7f0000001240), 0x0, 0xfffffffffffffff8) get_mempolicy(&(0x7f0000000000), &(0x7f00000001c0), 0x1ff, &(0x7f0000fff000/0x1000)=nil, 0x3) setsockopt$sock_int(r0, 0x1, 0x3c, &(0x7f0000d4effc)=0x1, 0x4) connect$inet(r0, &(0x7f0000000000)={0x2, 0x4e20, @dev={0xac, 0x14, 0x14, 0x18}}, 0x10) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f00000001c0)='tunl0\x00', 0x5) sendto$inet(r0, &(0x7f00006d1fd4)="db", 0x1, 0x4000010, &(0x7f00004daff0)={0x2, 0x0, @loopback, [0x0, 0x5000000]}, 0x10) 13:16:56 executing program 5: r0 = syz_open_dev$binder(&(0x7f00000021c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000002340)={0x34, 0x0, &(0x7f0000002240)=[@request_death={0x400c630e, 0x4, 0x4}, @increfs={0x40046304, 0x4}, @increfs_done={0x40106308, 0x0, 0x3}, @increfs], 0x77, 0xa0028000, &(0x7f00000022c0)="b3cd0976d8e2af743c6f523efe14fd20c3c3dd2572734282a761e1b4304e2599c85f198cc82bd5d0c74c4edca2f9ea7b875ff7047ec0784fbb354e15fd3f7d837f533597d5082692a6f2fb748da3cc4157188f7f2a5477ded56f72f5b75c96872db429e44b8fcd781d96dead77a0b58b7af9085a208a22"}) 13:16:56 executing program 7: r0 = openat$cuse(0xffffffffffffff9c, &(0x7f0000000080)='/dev/cuse\x00', 0x2, 0x0) clone(0x1002102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000640), 0xffffffffffffffff) r1 = getpid() sched_setscheduler(r1, 0x5, &(0x7f0000000000)) write$FUSE_NOTIFY_DELETE(r0, &(0x7f0000000040)={0x29, 0x6, 0x5000000}, 0x29) 13:16:56 executing program 0: perf_event_open(&(0x7f0000000040)={0x2, 0x70, 0x3e5}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f00000021c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000002340)={0xb5, 0x1000000, &(0x7f00000000c0)=ANY=[@ANYBLOB="0463044000000000b6a571ac965f26c50d500dae115e59afcd8a338d8b2727193c56d4ebef60c214b766ffde6cff6ceef2baa2594a53a0117e77afd5d58e8a35afdae81b258585ce769507333c0238790d5ed750bf1d6ca2a873050056528fce7becfd12f165ac43a826d3462822ff8f29ea992d4e208847cf4fc10ca00b87b5ce2523fa477bad0be1c97e4398aa2ac81d973b5a871d8e0b295e436cd8415f19088c6c82c85f4ed1fac41da062bc6dbfb8eac4276c"], 0x0, 0x0, &(0x7f00000022c0)}) 13:16:56 executing program 4: r0 = gettid() perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x3e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff7fffffffffff}, 0x0, 0x0, 0xffffffffffffffff, 0x0) fcntl$setown(0xffffffffffffffff, 0x8, r0) bind$inet6(0xffffffffffffffff, &(0x7f0000807fe4)={0xa, 0x4e22}, 0x1c) sendto$inet6(0xffffffffffffffff, &(0x7f0000000380), 0x0, 0x200408d4, &(0x7f000072e000)={0xa, 0x4e22, 0x0, @loopback}, 0x1c) sendto$inet6(0xffffffffffffffff, &(0x7f0000ad6fad)='\x00', 0x1, 0x3fffffd, &(0x7f0000254000)={0xa, 0x0, 0x0, @loopback}, 0x1c) [ 1518.556582] binder: 14875:14879 BC_REQUEST_DEATH_NOTIFICATION invalid ref 4 [ 1518.600186] binder_thread_write: 26 callbacks suppressed [ 1518.600204] binder: 14875:14879 IncRefs 0 refcount change on invalid ref 4 ret -22 13:16:56 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r0, &(0x7f0000942000)={0x2, 0x4e20, @multicast1}, 0x10) sendmsg$key(0xffffffffffffffff, &(0x7f0000f56000)={0x0, 0x0, &(0x7f00008feff0)={&(0x7f0000000500)=ANY=[@ANYBLOB="020300090a1500000000000000000000030006190000000002000000e0000001003f00000000000002000100e625aa66dcef85847e479eb3c49000000400000000fd003e"], 0x44}}, 0x0) add_key(&(0x7f0000000080)='logon\x00', &(0x7f0000000100)={0x73, 0x79, 0x7a, 0x1}, &(0x7f0000001240), 0x0, 0xfffffffffffffff8) get_mempolicy(&(0x7f0000000000), &(0x7f00000001c0), 0x1ff, &(0x7f0000fff000/0x1000)=nil, 0x3) setsockopt$sock_int(r0, 0x1, 0x3c, &(0x7f0000d4effc)=0x1, 0x4) connect$inet(r0, &(0x7f0000000000)={0x2, 0x4e20, @dev={0xac, 0x14, 0x14, 0x18}}, 0x10) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f00000001c0)='tunl0\x00', 0x5) sendto$inet(r0, &(0x7f00006d1fd4)="db", 0x1, 0x4000010, &(0x7f00004daff0)={0x2, 0x0, @loopback, [0x0, 0x1a0]}, 0x10) [ 1518.651750] binder_thread_write: 8 callbacks suppressed [ 1518.651764] binder: 14875:14879 BC_INCREFS_DONE u0000000000000000 no match [ 1518.691318] binder: 14875:14879 IncRefs 0 refcount change on invalid ref 0 ret -22 13:16:56 executing program 3: perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000200)={0x26, 'hash\x00', 0x0, 0x0, 'sha1\x00'}, 0x58) r1 = accept$alg(r0, 0x0, 0x0) r2 = add_key$keyring(&(0x7f0000000400)='keyring\x00', &(0x7f0000000440)={0x73, 0x79, 0x7a, 0x2}, 0x0, 0x0, 0xfffffffffffffffc) r3 = openat$ipvs(0xffffffffffffff9c, &(0x7f0000000480)='/proc/sys/net/ipv4/vs/amemthresh\x00', 0x2, 0x0) openat$cgroup_procs(r3, &(0x7f00000016c0)='cgroup.threads\x00', 0x2, 0x0) getsockopt$inet_sctp6_SCTP_GET_LOCAL_ADDRS(0xffffffffffffff9c, 0x84, 0x6d, &(0x7f00000004c0)={0x0, 0xff, "238b0d573eb9781d14fe14097ce649303879b3d44890b2f7c767c0370c65aeaa602e7d39cf177db9c8f753396ec3eabc955102cb50bd7aaaec39b41bd62ced9e6ee0309367d270d9f336d8d19a2d156f3001e263fec241aa9fc27c1b0e316d76e571aa552b9a680619a4701ffb03e292e356e32720495aa1fb734fdb0cf23fc8429d11d91788123b4da47bff5ad6d5418929992e02c4c2cc0dbe8df533ee9004d928b9e5c4735eb72b0e37d5f4a66ee6514a666c4e05153e65abb81f54ecf77e0bc0a178bc259582d971b21a2d585cb05c2498a6a995035e5212a326b3eecc6f786c812bd62f008ecd0d14f0c928b2e9e3165dd91b247d0fc6fb2c3374da65"}, &(0x7f0000000600)=0x107) accept4$bt_l2cap(r3, &(0x7f0000001700), &(0x7f0000001740)=0xe, 0x80800) getsockopt$inet_sctp6_SCTP_LOCAL_AUTH_CHUNKS(r3, 0x84, 0x1b, &(0x7f0000000640)={r4, 0x1000, "672876eb11227d0ff098963888eb7215a7cca71681f42b3581601ee0ba343da8801369c04ba7c2b67395a3b03af43e10bc4a48a06f1f45cb6bbebb9330a2c077566d2c0ebb1652f341da1bdd1b36d983587d386138ed10b12154e507ac734e2390d32e8d25fe08e8ae074369a0af59ea557c963e377e726a9129c163ef2cd0c90475ed1a6795bd101e71e29856a9d201332dadbd8a49bde5bb098553d93f0613aad04c874b58dbebc9876308a027488dcef555ffc43230d6dec8e8b09dfdffc4482b3d49c4b48ee93158572f252601e799e39e187d697338726dd691bdea90f8bba0861407704bf945857c09953d03547ad5fb6cbe5b555f3bd2e39028c13ff84a945ddeb2af4a3c3cea95077f6397ab212d7e994609cb0f6a2051c2865f9840b27919d5c5a5a8f6a526abab44340ca9eee016d13d2272a66ab6eb0640176128b47c9d28f66ed689dc8872d900afeb31452b289d1cc31c514564f91a01a74330c212f555763702192e079d163f2627236c208525558dbf40f513b6edc9cf2d93ba6cf94f072ed1abd955137df9412f9c1ac2f09707a04ad8e74a5e800637da6668069d87b1c0218e80e81ff484da216a116c11f6260ed5f7f9fbf4d9ed12d29eb8695d5b1868a24fd1e1ab7b94f3e126e59186de4537046af624982072c338dbfe22f5d96622e572924942181ae683befb7f635321c5fe402c341681e3bef6e918ed34b298cc932a53e140cae17327ab4650a99c435d676a9129e214134004106746c20172b7bbe63cc27d011eabf83fe9477d7827d749cfaa94f31a24b0b5387f1ee0a49e4b3663709369d4e957743b44d8faadeef29b09fdb7ed3717b7da525abb173abf99d20ce9dc9c820674bcebfd6a28774aa26c837a4de8584a7dcea737d6e1d0cd174432d699c4f0e208dfeadd020d696f4cfa3c6a95e94320bab9860946d1abad59948bb303277ab7dfbb32e3a167d675c27242e365efcb68d3feb13d40fa37f52ff683ff3c64958947fd271b4ea894d98ad3347893459aa865bde69cd2aced73024822dbd9bdeec944c46c08ace07f222308a07b179d1c5721f92d8e4807afabfdb0c8c7903cb6a82b4bc5de6decf8e5c8a371f33c92dec8e0376fd7839a6d50d24799c2e858083a14279ef3055e406ae5f02e5313533aecaea3b3e0705c84e972d18f55269e895728042f0e7a8b9e00f3aa713654239296294fbecfa1b6ac5c392fd7f492be6d9aaf62fc7fd9545d438ba83d2d3a9e23e29eb46f65163fed1df39812aa25f92c8c5726bd874da71ef33fbeafe8c29f0507443194667a2b04d845d5d6c5dd6ee9f30becfeb131e4ed6ec9aadaefad1d2921fb107d44d9f7dd0d77dca14a817b2ff18ff66bd1c2654fc5b470eb97b52a2e65b7dab794159eafc2aa36ac8a8c103edcd802d7a98c69b38ebddb306d3a59c326a4aa2d72a534914044b289889b0c21f7798b0b9aa03f2ebd80f4aac3bc692ac87ac9042e3bc80561881874539eb726d2a9071c015d62dfa5543d3ebe5a08cacb73ef26c0e9dfc4634f578378962b6e206f6d9e3343c37e4ae8b3fdc36ba781484e111d1d432d236b941efd53761e0405bdd4960f783efa0ac4a4c000d7a7d1ad9fc0ca4242dac715fe71e5ffab3cbccedbde9eb7e28f66c566c242a79e3f1ddd4290a5db68f2466929a32f425297885c7b7f756d612819f6734ed38db21486a0ce5e46bac96ca38741d694b78c30239ddee60de76d50417f7afb56ee33d9c6acc0372d41b393326709e647845ba50c3745a1b8baa17e0dfcbce7a04273cf31f9965e0b1e7a38170d22498e3395b411a3e1d68ecfd97ba954b38795ef786774f4f52ac84b94d8345db403f4e72852f372c5a2e552d6d0a29035bc90089839608c8f8fa3eead4ad6e1ee7718177b49d20f90dff7d2a06902e76befd39b15b2838f1a9cfce63af36f7bfbb07a8e002150ac9313ef8a0a3c12eb0f05113ae555e6e53d2dac19a9e68ecc515d66a859dfe2e6d53db4d0a08345ac052dc5f953e5286b728ebe0f136678d996f6176945279746e1719e206707f33a139bd98365e42db1ac3a4e17230e8553254b43654b1fae3603cade1f0f26af2e307e04ce55b013c2514d4b24265b6e35188ca57be760661ed37ebf7be8d1867226b9cf092360ad5168da0833e5a55752d292ac7eb05cc33de594103d0268a6e1b7fd393c51bed60cb35f1b67c6b789213054d1176ba75804ea60fc8ab1e39de8ce9f9aa91156b8aa4c7d36faf086934cc7e2461d19d715388e6739305861d993bd1fe453713f7076babe519d0732aa469af5786ea736a9fc1a25379c2568b1ef70a57337f72beacb7697412b53109e9a038458aff20c278fec592f097c888be309901cc1b124aa55d6fbfe9daf65e6940489a55c25c10698d811c202d292b1608c94ba8210c66fe557fe8fe24d8a73875811ef50a16ae9eb86424ac7551e1849f7e64c1a0d1dcd4ef6cd0c21fad63caea0167daf0b127feea0f0052eb48d21d5f75b3443bb053da8ae7859276e2f3baf1655fb21a1acbd29d1dd47695bfe9ccaa1a5205f9237fc919c2c4fd9a9a6efe8b74bb4c66c755bb4f3c14688b80837031c864205f13154193b18a2af1de44ba7cf1524f64f1e8efd4b0437d779fe824f346824b9ed4ad0ab969986b368706efbdd4c52790782e3514d488d2a19b0865dcd30e4f0d51c2b9f27e271cb745ac665f3648c9b89eb9db06d5bea18fcf5a1d357948cf1e95298b61f8f48dd53526a7a5a22a7980b84343b34cdce9f07b14d5284d824ba0ea8512035d4f7fdf5420dac100722baa4617303f84789991e6075828d694cd4a5884f2618325cf3ade4ea6aa75e8fa5f9ef04a28bab9dada43f8342db660fd194347df17d5fff19952c66b7cb0ec4796a524b1f1a4d99c12f61694f4befd96105ce5e69631ff56b78e051c115e40b6b7e416dff5b7a4b5e0058d52066bb1a09767f38ad023fe66de3263d4f90c1022a65574f2897fb948b81a35671609e1f4857fc70f6d753371c7dd05054e2e1e6d515b087b640a7d7881c0f5126f91688a437de8f97b068b054e1a3d1b6b19f474f982e201500236d22af114295058e0e9ef24295e92da455db9e8f4268b69eb1a5c9ff8b261e58c0a13e2de628993e7518d77bfbeef9856bd5d1b1f8e748fd47cbf1b8a56c466c711d66a6317e52843f1ae58f2cea9b3a73dca9bdfb7906e5193ee1cc183c80473bd87c39c8f4fac31f40caa444da9e8a494d138bd487cb81c234939bcc55023f61d2ab468df34c8591d440da38a21ea92fe74ba2e8c2613a3f7bcbefb9e4abade74a89912949a861fe18894c8f64cd689c45343c077536e46a261cf56dd99e076d9afb05fb35aac405bd2fa300fea0f12202babc536dc75cbfc0f5142641d41fbd921b199af2fa0240780d124224e29080812f0cf70872addcf51993928258f7f1685d19a6ee3df3a43881ed485c2ea2d38b06fab911aa29845dbd813fe1ee647ccfd921de76d0da579ef099ab21c0a40c2811ac29c374ebb87d9bbacd483687b08586580ec5172cee1de71c58cc4eb737e5772d0c25e2df20c806823f9a4686536fd24a90530d93d70391798338ccc9248f2ae7b32217a25c2bc5fee078a86d2950ff60de5860ef3bd0dde4bc022afa3c5614b9f29dfa6f403636b4dd31eaa7434e48c125752cad0ee5031b15d21708a1942f74fbd1a73707f8078eef1a0f6b164184b77ee2db45b5ff5a99e7eb389d2002c762bcc7446e3e70107ac21a4b3ab25163240c9e5ca0bdc58f537e8a61c98a36736ddbb0d6056ebfba7a129e9f2eee81da042c5dc48db75375514094c13f65d58f9b6837af3f1d0a90d115df57c22d542f5d6c19b0c972dc5a2d7717352681f99f2a76c157b6b06d4f7850ebc9982d283762d322dafd8fef5b2a517eb1e6db9228570ec0655f7c874c083258f0bcdae7f7bac211b3f07d130b9b6c6c3e9c61f2fe14b347f1bf38a0021ca0a1918c6a62bc100f4c618cbb33a6c1ecd9fe1442fa02f7472656a7ba2d898250026e9b17a3fd46374522398a25c5639e796c5d84ed0b433b2b5b46ecf0b11c57961953e01ecdf769f695c778d29d4b688ea559b829cd583f49649e7a489b27efea2a9970cb485455094cd6437e4a491de0c47a21fdf44ce66dd99c1c89b449372938481413c79db68312d51df80b49dfdf073b7323bde17a62422fb3d349e32ade9c2fda60da8bd013fbb5fd4cad90cfb6d17ac4e81182ca33756f8a67f0806e4b36f3b99d123a1c70c4972fbd80919c327b4a195c352f6b45d0b7f3a982eeadaa76a24f39abcf464cb30997fd74946461fbc347e0e2b0cb6c3b384e3b944a7d5bd1ba6b3b14dd8b8321495e283aad3e60469eb47c0fe6d484381a0a56ee74092361ae99c85311bd5f5244c4a249e14f9fbaa6818fd00a6c1924430290a805fde5ffbfcc57389c9748bf33497d693554235f3ee30b05811a8098f1f23dd17ec411fbcea9b88aabb19f38a06f582d572919e467f085843bf250798d0c7932287a078808c969bf19c2131ae78120a5c91b4f32d9dc4387c36e5dba1ace2587fa64ef4a1d7df8db3cc456a8f72f0e6d30ce637cbd31a2c3975214813a250ec76fab1af083cc280c1d2126d4333519ba6e0acf15c0292c0aedebf3753356e938922f3b606acbf360618c30d2870b68fbc3836feadb78ded41306f68cd11327cf8a74bc232818763d4eca7c36ae14a8680c62b38153b40a668a9fe23ad1b6ada08a9908f873c7ecdee308ae81c80a658040f2bb093d40c22062d122becfcb10aa7c3a3f5b948d7849921c1f0aa2560d2c15723c8160b2cb6bebe38808f7d34b9a0ad7e5b0c9a1a01b14cd7c0d532599febe58c2253dc9acafd1d10747f3cdf8da7e5a98b5fc0aeeccbc80158a03b3d2dcd1a1e6640df5d5adfa451d5907d8333cfc6035a212f7aa3af1b9032532ec6c70ef89094803474a511a8628f42240ca365d1af8fced897af618a09feac5b86f57e45070951181c074f38bfac2f1bce962f298421729d4f0c9c170fdc8932b623317723676d48d89d4dac3cf5f865b544c25a21f9ec53c5269a42602ab8a1ec0b89e404536e81029f8088240ecc0150529d75898a63af0c64583fb637a6a8e373f3dbd155212d0fc1b4a28d86674718d532deb685e5976eb9266ae852c56cd40a40fdd3503a2756f2915ff585858ddeb58aa7043f7ec9cc6a8f66f05d167200ef8d96b1d836445b086ef98059617aa130d08e1b970bf061cbd6d31244c0b9617da2a1d153e368bdaf838d6a5588d945cd7dab6a0a631642e7144430451a28542689020bf73851efd2b557152f41770bdea350184d7f2bbd1f503babec8637a6d215f77ff60ec720db6e969192cf73eeb98d1ebd9785f7b41da3706a5e2431161b37e41ca1cf46c5cb4371f2b1797b8b25d9707bd54f3cd69c599316cc68e95c9841a881fdcd067ffe9bcb8a83cd098e53064b931c803101d471a2e577321dad07334a66d59cf66fbb430767096d154c7ca6f781e7f1d05315da87afb6071dd6c50d79cd644d6374afe995c3a573f7e9cca19cb005d1c18b2bef39136066d0146f7bb5df197abf7035047d9aad78815c19991e164914a5124938e9e1acda07d2a5400c4ebf6b082277e8f8feff4171c4093146a78a9cbafd56d1558e047ae9bc0714917370158fcd01955cd4cfc25ee1f4c4076d18914253911f8d17ea619b16f7b42f726c2a09e6ba3c70b02b2955c55eb7cf82cfb6adb3fca37fef31ddfc91bbc39b850e76e34"}, &(0x7f0000001680)=0x1008) add_key(&(0x7f0000000180)='id_legacy\x00', &(0x7f0000000380)={0x73, 0x79, 0x7a, 0x2}, &(0x7f00000003c0)="e2196775d85ce1edbb42ba349f844010b7212c1a9f59f4f5c556225af7a9915b2fb92b4ed7accd", 0x27, r2) sendmmsg(r0, &(0x7f0000007f00)=[{{&(0x7f0000000280)=@can, 0x25d3, &(0x7f0000000300)}}, {{&(0x7f0000005900)=@pppoe={0x18, 0x0, {0x0, @link_local, 'syzkaller0\x00'}}, 0xfffffffffffffd1e, &(0x7f0000007ac0), 0xffffffffffffffe, &(0x7f0000007b00)}}], 0x3fffffffffffe0d, 0x0) r5 = openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000140)='/dev/sequencer2\x00', 0x80840, 0x0) ioctl$ifreq_SIOCGIFINDEX_team(r1, 0x8933, &(0x7f00000000c0)={'team0\x00', 0x0}) bind$bt_hci(r5, &(0x7f0000000300)={0x1f, r6, 0x2}, 0xc) chown(&(0x7f0000000340)='./file0\x00', 0x0, 0x0) r7 = syz_open_dev$sndpcmc(&(0x7f00000001c0)='/dev/snd/pcmC#D#c\x00', 0x5232ea, 0xfffffffffffffffc) ioctl$ASHMEM_SET_NAME(r7, 0x41007701, &(0x7f0000000100)='syzkaller0\x00') 13:16:56 executing program 7: r0 = openat$cuse(0xffffffffffffff9c, &(0x7f0000000080)='/dev/cuse\x00', 0x2, 0x0) clone(0x1002102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000640), 0xffffffffffffffff) r1 = getpid() sched_setscheduler(r1, 0x5, &(0x7f0000000000)) write$FUSE_NOTIFY_DELETE(r0, &(0x7f0000000040)={0x29, 0x6, 0xa000000}, 0x29) 13:16:56 executing program 5: r0 = syz_open_dev$binder(&(0x7f00000021c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000002340)={0x34, 0x0, &(0x7f0000002240)=[@request_death={0x400c630e, 0x4, 0x4}, @increfs={0x40046304, 0x4}, @increfs_done={0x40106308, 0x0, 0x3}, @increfs], 0x77, 0x74000000, &(0x7f00000022c0)="b3cd0976d8e2af743c6f523efe14fd20c3c3dd2572734282a761e1b4304e2599c85f198cc82bd5d0c74c4edca2f9ea7b875ff7047ec0784fbb354e15fd3f7d837f533597d5082692a6f2fb748da3cc4157188f7f2a5477ded56f72f5b75c96872db429e44b8fcd781d96dead77a0b58b7af9085a208a22"}) 13:16:56 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r0, &(0x7f0000942000)={0x2, 0x4e20, @multicast1}, 0x10) sendmsg$key(0xffffffffffffffff, &(0x7f0000f56000)={0x0, 0x0, &(0x7f00008feff0)={&(0x7f0000000500)=ANY=[@ANYBLOB="020300090a1500000000000000000000030006190000000002000000e0000001003f00000000000002000100e625aa66dcef85847e479eb3c49000000400000000fd003e"], 0x44}}, 0x0) add_key(&(0x7f0000000080)='logon\x00', &(0x7f0000000100)={0x73, 0x79, 0x7a, 0x1}, &(0x7f0000001240), 0x0, 0xfffffffffffffff8) get_mempolicy(&(0x7f0000000000), &(0x7f00000001c0), 0x1ff, &(0x7f0000fff000/0x1000)=nil, 0x3) setsockopt$sock_int(r0, 0x1, 0x3c, &(0x7f0000d4effc)=0x1, 0x4) connect$inet(r0, &(0x7f0000000000)={0x2, 0x4e20, @dev={0xac, 0x14, 0x14, 0x18}}, 0x10) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f00000001c0)='tunl0\x00', 0x5) sendto$inet(r0, &(0x7f00006d1fd4)="db", 0x1, 0x4000010, &(0x7f00004daff0)={0x2, 0x0, @loopback, [0x0, 0x3e8]}, 0x10) [ 1518.877363] binder: 14904:14908 IncRefs 0 refcount change on invalid ref 4 ret -22 13:16:57 executing program 6: clone(0x802102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000040), 0xffffffffffffffff) r0 = syz_open_dev$sndtimer(&(0x7f0000000000)='/dev/snd/timer\x00', 0x0, 0x0) r1 = getpid() sched_setscheduler(r1, 0x5, &(0x7f0000000200)) ioctl$SNDRV_TIMER_IOCTL_GPARAMS(r0, 0x40485404, &(0x7f0000000240)={{}, 0x0, 0x2000000000000000, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1000000]}) 13:16:57 executing program 7: r0 = openat$cuse(0xffffffffffffff9c, &(0x7f0000000080)='/dev/cuse\x00', 0x2, 0x0) clone(0x1002102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000640), 0xffffffffffffffff) r1 = getpid() sched_setscheduler(r1, 0x5, &(0x7f0000000000)) write$FUSE_NOTIFY_DELETE(r0, &(0x7f0000000040)={0x29, 0x6, 0x1a0ffffffff}, 0x29) [ 1518.920415] binder: 14904:14908 BC_INCREFS_DONE u0000000000000000 no match [ 1518.930585] binder: 14904:14908 IncRefs 0 refcount change on invalid ref 0 ret -22 [ 1518.962191] binder: 14904:14908 IncRefs 0 refcount change on invalid ref 4 ret -22 13:16:57 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r0, &(0x7f0000942000)={0x2, 0x4e20, @multicast1}, 0x10) sendmsg$key(0xffffffffffffffff, &(0x7f0000f56000)={0x0, 0x0, &(0x7f00008feff0)={&(0x7f0000000500)=ANY=[@ANYBLOB="020300090a1500000000000000000000030006190000000002000000e0000001003f00000000000002000100e625aa66dcef85847e479eb3c49000000400000000fd003e"], 0x44}}, 0x0) add_key(&(0x7f0000000080)='logon\x00', &(0x7f0000000100)={0x73, 0x79, 0x7a, 0x1}, &(0x7f0000001240), 0x0, 0xfffffffffffffff8) get_mempolicy(&(0x7f0000000000), &(0x7f00000001c0), 0x1ff, &(0x7f0000fff000/0x1000)=nil, 0x3) setsockopt$sock_int(r0, 0x1, 0x3c, &(0x7f0000d4effc)=0x1, 0x4) connect$inet(r0, &(0x7f0000000000)={0x2, 0x4e20, @dev={0xac, 0x14, 0x14, 0x18}}, 0x10) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f00000001c0)='tunl0\x00', 0x5) sendto$inet(r0, &(0x7f00006d1fd4)="db", 0x1, 0x4000010, &(0x7f00004daff0)={0x2, 0x0, @loopback, [0x0, 0xfffffff2]}, 0x10) [ 1519.012375] binder: 14904:14908 BC_INCREFS_DONE u0000000000000000 no match [ 1519.103904] binder: 14904:14908 IncRefs 0 refcount change on invalid ref 0 ret -22 13:16:57 executing program 1: r0 = socket$netlink(0x10, 0x3, 0x8000000004) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_TCP_CONGESTION(r1, 0x6, 0xd, &(0x7f0000000180)='vegas\x00', 0x6) bind$inet6(r1, &(0x7f00001fefe4)={0xa, 0x4e22}, 0x1c) sendto$inet6(r1, &(0x7f0000000100), 0x8d2d601e8976aa5, 0x20000004, &(0x7f000031e000)={0xa, 0x4e22}, 0x1c) writev(r0, &(0x7f0000000100)=[{&(0x7f0000000000)="580000001400192340834b80040d8c560a067fcb79ff81004e220000000058000b4824ca944f64009400050028925aa8000000000000008000f0fffeffff09000000fff5dd00000010000100000c0900fcff0000040e05a5", 0x58}], 0x1) 13:16:57 executing program 3: perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000200)={0x26, 'hash\x00', 0x0, 0x0, 'sha1\x00'}, 0x58) r1 = accept$alg(r0, 0x0, 0x0) sendmmsg(r1, &(0x7f0000007f00)=[{{&(0x7f00000056c0)=@can, 0x3000, &(0x7f00000000c0)}}, {{&(0x7f0000005900)=@pppoe={0x18, 0x0, {0x0, @link_local, 'syzkaller0\x00'}}, 0x80, &(0x7f0000007ac0), 0x1a9, &(0x7f0000007b00)}}], 0x3fffffffffffe0d, 0x0) r2 = openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000140)='/dev/sequencer2\x00', 0x80840, 0x0) chown(&(0x7f0000000340)='./file0\x00', 0x0, 0x0) r3 = syz_open_dev$sndpcmc(&(0x7f00000000c0)='/dev/snd/pcmC#D#c\x00', 0x0, 0x0) connect$l2tp(r2, &(0x7f0000000180)=@pppol2tpv3in6={0x18, 0x1, {0x0, r2, 0x3, 0x2, 0x1, 0x1, {0xa, 0x4e20, 0x9, @mcast2, 0x100000000}}}, 0x3a) ioctl$ASHMEM_SET_NAME(r3, 0x41007701, &(0x7f0000000100)='syzkaller0\x00') 13:16:57 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r0, &(0x7f0000942000)={0x2, 0x4e20, @multicast1}, 0x10) sendmsg$key(0xffffffffffffffff, &(0x7f0000f56000)={0x0, 0x0, &(0x7f00008feff0)={&(0x7f0000000500)=ANY=[@ANYBLOB="020300090a1500000000000000000000030006190000000002000000e0000001003f00000000000002000100e625aa66dcef85847e479eb3c49000000400000000fd003e"], 0x44}}, 0x0) add_key(&(0x7f0000000080)='logon\x00', &(0x7f0000000100)={0x73, 0x79, 0x7a, 0x1}, &(0x7f0000001240), 0x0, 0xfffffffffffffff8) get_mempolicy(&(0x7f0000000000), &(0x7f00000001c0), 0x1ff, &(0x7f0000fff000/0x1000)=nil, 0x3) setsockopt$sock_int(r0, 0x1, 0x3c, &(0x7f0000d4effc)=0x1, 0x4) connect$inet(r0, &(0x7f0000000000)={0x2, 0x4e20, @dev={0xac, 0x14, 0x14, 0x18}}, 0x10) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f00000001c0)='tunl0\x00', 0x5) sendto$inet(r0, &(0x7f00006d1fd4)="db", 0x1, 0x4000010, &(0x7f00004daff0)={0x2, 0x0, @loopback, [0x0, 0x8]}, 0x10) 13:16:57 executing program 6: clone(0x802102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000040), 0xffffffffffffffff) r0 = syz_open_dev$sndtimer(&(0x7f0000000000)='/dev/snd/timer\x00', 0x0, 0x0) r1 = getpid() sched_setscheduler(r1, 0x5, &(0x7f0000000200)) ioctl$SNDRV_TIMER_IOCTL_GPARAMS(r0, 0x40485404, &(0x7f0000000240)={{}, 0x0, 0x2000000000000000, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3000000]}) 13:16:57 executing program 5: r0 = syz_open_dev$binder(&(0x7f00000021c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000002340)={0x34, 0x0, &(0x7f0000002240)=[@request_death={0x400c630e, 0x4, 0x4}, @increfs={0x40046304, 0x4}, @increfs_done={0x40106308, 0x0, 0x3}, @increfs], 0x77, 0x3, &(0x7f00000022c0)="b3cd0976d8e2af743c6f523efe14fd20c3c3dd2572734282a761e1b4304e2599c85f198cc82bd5d0c74c4edca2f9ea7b875ff7047ec0784fbb354e15fd3f7d837f533597d5082692a6f2fb748da3cc4157188f7f2a5477ded56f72f5b75c96872db429e44b8fcd781d96dead77a0b58b7af9085a208a22"}) 13:16:57 executing program 7: r0 = openat$cuse(0xffffffffffffff9c, &(0x7f0000000080)='/dev/cuse\x00', 0x2, 0x0) clone(0x1002102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000640), 0xffffffffffffffff) r1 = getpid() sched_setscheduler(r1, 0x5, &(0x7f0000000000)) write$FUSE_NOTIFY_DELETE(r0, &(0x7f0000000040)={0x29, 0x6, 0x8002a0}, 0x29) 13:16:57 executing program 0: perf_event_open(&(0x7f0000000040)={0x2, 0x70, 0x3e5}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f00000021c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000002340)={0xb5, 0x74000000, &(0x7f00000000c0)=ANY=[@ANYBLOB="0463044000000000b6a571ac965f26c50d500dae115e59afcd8a338d8b2727193c56d4ebef60c214b766ffde6cff6ceef2baa2594a53a0117e77afd5d58e8a35afdae81b258585ce769507333c0238790d5ed750bf1d6ca2a873050056528fce7becfd12f165ac43a826d3462822ff8f29ea992d4e208847cf4fc10ca00b87b5ce2523fa477bad0be1c97e4398aa2ac81d973b5a871d8e0b295e436cd8415f19088c6c82c85f4ed1fac41da062bc6dbfb8eac4276c"], 0x0, 0x0, &(0x7f00000022c0)}) 13:16:57 executing program 4: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = gettid() perf_event_open(&(0x7f000025c000)={0x0, 0x70, 0x3e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff7fffffffffff}, 0x0, 0x0, 0xffffffffffffffff, 0x0) fcntl$setown(r0, 0x8, r1) bind$inet6(r0, &(0x7f0000807fe4)={0xa, 0x4e22}, 0x1c) sendto$inet6(r0, &(0x7f0000000380), 0x0, 0x200408d4, &(0x7f000072e000)={0xa, 0x4e22, 0x0, @loopback}, 0x1c) sendto$inet6(r0, &(0x7f0000ad6fad)='\x00', 0x1, 0x3fffffd, &(0x7f0000254000)={0xa, 0x0, 0x0, @loopback}, 0x1c) 13:16:57 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r0, &(0x7f0000942000)={0x2, 0x4e20, @multicast1}, 0x10) sendmsg$key(0xffffffffffffffff, &(0x7f0000f56000)={0x0, 0x0, &(0x7f00008feff0)={&(0x7f0000000500)=ANY=[@ANYBLOB="020300090a1500000000000000000000030006190000000002000000e0000001003f00000000000002000100e625aa66dcef85847e479eb3c49000000400000000fd003e"], 0x44}}, 0x0) add_key(&(0x7f0000000080)='logon\x00', &(0x7f0000000100)={0x73, 0x79, 0x7a, 0x1}, &(0x7f0000001240), 0x0, 0xfffffffffffffff8) get_mempolicy(&(0x7f0000000000), &(0x7f00000001c0), 0x1ff, &(0x7f0000fff000/0x1000)=nil, 0x3) setsockopt$sock_int(r0, 0x1, 0x3c, &(0x7f0000d4effc)=0x1, 0x4) connect$inet(r0, &(0x7f0000000000)={0x2, 0x4e20, @dev={0xac, 0x14, 0x14, 0x18}}, 0x10) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f00000001c0)='tunl0\x00', 0x5) sendto$inet(r0, &(0x7f00006d1fd4)="db", 0x1, 0x4000010, &(0x7f00004daff0)={0x2, 0x0, @loopback, [0x0, 0x200000000000000]}, 0x10) 13:16:57 executing program 6: clone(0x802102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000040), 0xffffffffffffffff) r0 = syz_open_dev$sndtimer(&(0x7f0000000000)='/dev/snd/timer\x00', 0x0, 0x0) r1 = getpid() sched_setscheduler(r1, 0x5, &(0x7f0000000200)) ioctl$SNDRV_TIMER_IOCTL_GPARAMS(r0, 0x40485404, &(0x7f0000000240)={{}, 0x0, 0x2000000000000000, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x300]}) [ 1519.439953] binder: 14948:14958 IncRefs 0 refcount change on invalid ref 4 ret -22 [ 1519.525559] binder: 14948:14958 BC_INCREFS_DONE u0000000000000000 no match [ 1519.573992] binder: 14948:14958 IncRefs 0 refcount change on invalid ref 0 ret -22 13:16:57 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r0, &(0x7f0000942000)={0x2, 0x4e20, @multicast1}, 0x10) sendmsg$key(0xffffffffffffffff, &(0x7f0000f56000)={0x0, 0x0, &(0x7f00008feff0)={&(0x7f0000000500)=ANY=[@ANYBLOB="020300090a1500000000000000000000030006190000000002000000e0000001003f00000000000002000100e625aa66dcef85847e479eb3c49000000400000000fd003e"], 0x44}}, 0x0) add_key(&(0x7f0000000080)='logon\x00', &(0x7f0000000100)={0x73, 0x79, 0x7a, 0x1}, &(0x7f0000001240), 0x0, 0xfffffffffffffff8) get_mempolicy(&(0x7f0000000000), &(0x7f00000001c0), 0x1ff, &(0x7f0000fff000/0x1000)=nil, 0x3) setsockopt$sock_int(r0, 0x1, 0x3c, &(0x7f0000d4effc)=0x1, 0x4) connect$inet(r0, &(0x7f0000000000)={0x2, 0x4e20, @dev={0xac, 0x14, 0x14, 0x18}}, 0x10) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f00000001c0)='tunl0\x00', 0x5) sendto$inet(r0, &(0x7f00006d1fd4)="db", 0x1, 0x4000010, &(0x7f00004daff0)={0x2, 0x0, @loopback, [0x0, 0x1a0ffffffff]}, 0x10) 13:16:57 executing program 5: r0 = syz_open_dev$binder(&(0x7f00000021c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000002340)={0x34, 0x0, &(0x7f0000002240)=[@request_death={0x400c630e, 0x4, 0x4}, @increfs={0x40046304, 0x4}, @increfs_done={0x40106308, 0x0, 0x3}, @increfs], 0x77, 0x60, &(0x7f00000022c0)="b3cd0976d8e2af743c6f523efe14fd20c3c3dd2572734282a761e1b4304e2599c85f198cc82bd5d0c74c4edca2f9ea7b875ff7047ec0784fbb354e15fd3f7d837f533597d5082692a6f2fb748da3cc4157188f7f2a5477ded56f72f5b75c96872db429e44b8fcd781d96dead77a0b58b7af9085a208a22"}) 13:16:57 executing program 3: perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000200)={0x26, 'hash\x00', 0x0, 0x0, 'sha1\x00'}, 0x58) r1 = accept$alg(r0, 0x0, 0x0) sendmmsg(r1, &(0x7f0000007f00)=[{{&(0x7f00000056c0)=@can, 0x3000, &(0x7f00000000c0)}}, {{&(0x7f0000005900)=@pppoe={0x18, 0x0, {0x0, @link_local, 'syzkaller0\x00'}}, 0x80, &(0x7f0000007ac0), 0x1a9, &(0x7f0000007b00)}}], 0x3fffffffffffe0d, 0x0) openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000140)='/dev/sequencer2\x00', 0x80840, 0x0) chown(&(0x7f0000000340)='./file0\x00', 0x0, 0x0) r2 = syz_open_dev$sndpcmc(&(0x7f0000000180)='/dev/snd/pcmC#D#c\x00', 0xafdd, 0x1) ioctl$ASHMEM_SET_NAME(r2, 0x41007701, &(0x7f0000000100)='syzkaller0\x00') 13:16:57 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r0, &(0x7f0000942000)={0x2, 0x4e20, @multicast1}, 0x10) sendmsg$key(0xffffffffffffffff, &(0x7f0000f56000)={0x0, 0x0, &(0x7f00008feff0)={&(0x7f0000000500)=ANY=[@ANYBLOB="020300090a1500000000000000000000030006190000000002000000e0000001003f00000000000002000100e625aa66dcef85847e479eb3c49000000400000000fd003e"], 0x44}}, 0x0) add_key(&(0x7f0000000080)='logon\x00', &(0x7f0000000100)={0x73, 0x79, 0x7a, 0x1}, &(0x7f0000001240), 0x0, 0xfffffffffffffff8) get_mempolicy(&(0x7f0000000000), &(0x7f00000001c0), 0x1ff, &(0x7f0000fff000/0x1000)=nil, 0x3) setsockopt$sock_int(r0, 0x1, 0x3c, &(0x7f0000d4effc)=0x1, 0x4) connect$inet(r0, &(0x7f0000000000)={0x2, 0x4e20, @dev={0xac, 0x14, 0x14, 0x18}}, 0x10) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f00000001c0)='tunl0\x00', 0x5) sendto$inet(r0, &(0x7f00006d1fd4)="db", 0x1, 0x4000010, &(0x7f00004daff0)={0x2, 0x0, @loopback, [0x0, 0x14280000000000]}, 0x10) [ 1519.813912] binder: 14978:14983 IncRefs 0 refcount change on invalid ref 4 ret -22 13:16:57 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r0, &(0x7f0000942000)={0x2, 0x4e20, @multicast1}, 0x10) sendmsg$key(0xffffffffffffffff, &(0x7f0000f56000)={0x0, 0x0, &(0x7f00008feff0)={&(0x7f0000000500)=ANY=[@ANYBLOB="020300090a1500000000000000000000030006190000000002000000e0000001003f00000000000002000100e625aa66dcef85847e479eb3c49000000400000000fd003e"], 0x44}}, 0x0) add_key(&(0x7f0000000080)='logon\x00', &(0x7f0000000100)={0x73, 0x79, 0x7a, 0x1}, &(0x7f0000001240), 0x0, 0xfffffffffffffff8) get_mempolicy(&(0x7f0000000000), &(0x7f00000001c0), 0x1ff, &(0x7f0000fff000/0x1000)=nil, 0x3) setsockopt$sock_int(r0, 0x1, 0x3c, &(0x7f0000d4effc)=0x1, 0x4) connect$inet(r0, &(0x7f0000000000)={0x2, 0x4e20, @dev={0xac, 0x14, 0x14, 0x18}}, 0x10) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f00000001c0)='tunl0\x00', 0x5) sendto$inet(r0, &(0x7f00006d1fd4)="db", 0x1, 0x4000010, &(0x7f00004daff0)={0x2, 0x0, @loopback, [0x0, 0x4000000]}, 0x10) [ 1519.859127] binder: 14978:14983 BC_INCREFS_DONE u0000000000000000 no match [ 1519.891602] binder: 14978:14983 IncRefs 0 refcount change on invalid ref 0 ret -22 13:16:58 executing program 5: r0 = syz_open_dev$binder(&(0x7f00000021c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000002340)={0x34, 0x0, &(0x7f0000002240)=[@request_death={0x400c630e, 0x4, 0x4}, @increfs={0x40046304, 0x4}, @increfs_done={0x40106308, 0x0, 0x3}, @increfs], 0x77, 0x6c00000000000000, &(0x7f00000022c0)="b3cd0976d8e2af743c6f523efe14fd20c3c3dd2572734282a761e1b4304e2599c85f198cc82bd5d0c74c4edca2f9ea7b875ff7047ec0784fbb354e15fd3f7d837f533597d5082692a6f2fb748da3cc4157188f7f2a5477ded56f72f5b75c96872db429e44b8fcd781d96dead77a0b58b7af9085a208a22"}) [ 1520.079018] binder: 15001:15002 BC_INCREFS_DONE u0000000000000000 no match 13:16:58 executing program 1: r0 = socket$netlink(0x10, 0x3, 0x8000000004) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_TCP_CONGESTION(r1, 0x6, 0xd, &(0x7f0000000180)='vegas\x00', 0x6) bind$inet6(r1, &(0x7f00001fefe4)={0xa, 0x4e22}, 0x1c) sendto$inet6(r1, &(0x7f0000000100), 0x8d2d601e8976aa5, 0x20000004, &(0x7f000031e000)={0xa, 0x4e22}, 0x1c) writev(r0, &(0x7f0000000100)=[{&(0x7f0000000000)="580000001400192340834b80040d8c560a067f2cf9ff81004e220000000058000b4824ca944f64009400050028925aa8000000000000008000f0fffeffff09000000fff5dd00000010000100000c0900fcff0000040e05a5", 0x58}], 0x1) 13:16:58 executing program 7: r0 = openat$cuse(0xffffffffffffff9c, &(0x7f0000000080)='/dev/cuse\x00', 0x2, 0x0) clone(0x1002102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000640), 0xffffffffffffffff) r1 = getpid() sched_setscheduler(r1, 0x5, &(0x7f0000000000)) write$FUSE_NOTIFY_DELETE(r0, &(0x7f0000000040)={0x29, 0x6, 0x5}, 0x29) 13:16:58 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r0, &(0x7f0000942000)={0x2, 0x4e20, @multicast1}, 0x10) sendmsg$key(0xffffffffffffffff, &(0x7f0000f56000)={0x0, 0x0, &(0x7f00008feff0)={&(0x7f0000000500)=ANY=[@ANYBLOB="020300090a1500000000000000000000030006190000000002000000e0000001003f00000000000002000100e625aa66dcef85847e479eb3c49000000400000000fd003e"], 0x44}}, 0x0) add_key(&(0x7f0000000080)='logon\x00', &(0x7f0000000100)={0x73, 0x79, 0x7a, 0x1}, &(0x7f0000001240), 0x0, 0xfffffffffffffff8) get_mempolicy(&(0x7f0000000000), &(0x7f00000001c0), 0x1ff, &(0x7f0000fff000/0x1000)=nil, 0x3) setsockopt$sock_int(r0, 0x1, 0x3c, &(0x7f0000d4effc)=0x1, 0x4) connect$inet(r0, &(0x7f0000000000)={0x2, 0x4e20, @dev={0xac, 0x14, 0x14, 0x18}}, 0x10) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f00000001c0)='tunl0\x00', 0x5) sendto$inet(r0, &(0x7f00006d1fd4)="db", 0x1, 0x4000010, &(0x7f00004daff0)={0x2, 0x0, @loopback, [0x0, 0x4002000000000000]}, 0x10) 13:16:58 executing program 3: perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000200)={0x26, 'hash\x00', 0x0, 0x0, 'sha1\x00'}, 0x58) r1 = accept$alg(r0, 0x0, 0x0) sendmmsg(r1, &(0x7f0000007f00)=[{{&(0x7f00000056c0)=@can, 0x3000, &(0x7f00000000c0)}}, {{&(0x7f0000005900)=@pppoe={0x18, 0x0, {0x0, @link_local, 'syzkaller0\x00'}}, 0x80, &(0x7f0000007ac0), 0x1a9, &(0x7f0000007b00)}}], 0x3fffffffffffe0d, 0x0) r2 = openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000140)='/dev/sequencer2\x00', 0x80840, 0x0) chown(&(0x7f0000000340)='./file0\x00', 0x0, 0x0) ioctl$TIOCSETD(r2, 0x5423, &(0x7f0000000180)=0x7) r3 = syz_open_dev$sndpcmc(&(0x7f00000000c0)='/dev/snd/pcmC#D#c\x00', 0x0, 0x0) bpf$OBJ_PIN_PROG(0x6, &(0x7f0000000280)={&(0x7f00000001c0)='./file0\x00', r2}, 0x10) ioctl$ASHMEM_SET_NAME(r3, 0x41007701, &(0x7f0000000100)='\x00') 13:16:58 executing program 4: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = gettid() perf_event_open(&(0x7f000025c000)={0x0, 0x70, 0x3e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff7fffffffffff}, 0x0, 0x0, 0xffffffffffffffff, 0x0) fcntl$setown(r0, 0x8, r1) bind$inet6(r0, &(0x7f0000807fe4)={0xa, 0x4e22}, 0x1c) sendto$inet6(r0, &(0x7f0000000380), 0x0, 0x200408d4, &(0x7f000072e000)={0xa, 0x4e22, 0x0, @loopback}, 0x1c) sendto$inet6(r0, &(0x7f0000ad6fad)='\x00', 0x1, 0x3fffffd, &(0x7f0000254000)={0xa, 0x0, 0x0, @loopback}, 0x1c) 13:16:58 executing program 5: r0 = syz_open_dev$binder(&(0x7f00000021c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000002340)={0x34, 0x0, &(0x7f0000002240)=[@request_death={0x400c630e, 0x4, 0x4}, @increfs={0x40046304, 0x4}, @increfs_done={0x40106308, 0x0, 0x3}, @increfs], 0x77, 0x4, &(0x7f00000022c0)="b3cd0976d8e2af743c6f523efe14fd20c3c3dd2572734282a761e1b4304e2599c85f198cc82bd5d0c74c4edca2f9ea7b875ff7047ec0784fbb354e15fd3f7d837f533597d5082692a6f2fb748da3cc4157188f7f2a5477ded56f72f5b75c96872db429e44b8fcd781d96dead77a0b58b7af9085a208a22"}) 13:16:58 executing program 0: perf_event_open(&(0x7f0000000040)={0x2, 0x70, 0x3e5}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f00000021c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000002340)={0xb5, 0x2000, &(0x7f00000000c0)=ANY=[@ANYBLOB="0463044000000000b6a571ac965f26c50d500dae115e59afcd8a338d8b2727193c56d4ebef60c214b766ffde6cff6ceef2baa2594a53a0117e77afd5d58e8a35afdae81b258585ce769507333c0238790d5ed750bf1d6ca2a873050056528fce7becfd12f165ac43a826d3462822ff8f29ea992d4e208847cf4fc10ca00b87b5ce2523fa477bad0be1c97e4398aa2ac81d973b5a871d8e0b295e436cd8415f19088c6c82c85f4ed1fac41da062bc6dbfb8eac4276c"], 0x0, 0x0, &(0x7f00000022c0)}) 13:16:58 executing program 6: clone(0x802102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000040), 0xffffffffffffffff) r0 = syz_open_dev$sndtimer(&(0x7f0000000000)='/dev/snd/timer\x00', 0x0, 0x0) r1 = getpid() sched_setscheduler(r1, 0x5, &(0x7f0000000200)) ioctl$SNDRV_TIMER_IOCTL_GPARAMS(r0, 0x40485404, &(0x7f0000000240)={{}, 0x0, 0x2000000000000000, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3]}) [ 1520.346881] binder: 15014:15020 BC_INCREFS_DONE u0000000000000000 no match 13:16:58 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r0, &(0x7f0000942000)={0x2, 0x4e20, @multicast1}, 0x10) sendmsg$key(0xffffffffffffffff, &(0x7f0000f56000)={0x0, 0x0, &(0x7f00008feff0)={&(0x7f0000000500)=ANY=[@ANYBLOB="020300090a1500000000000000000000030006190000000002000000e0000001003f00000000000002000100e625aa66dcef85847e479eb3c49000000400000000fd003e"], 0x44}}, 0x0) add_key(&(0x7f0000000080)='logon\x00', &(0x7f0000000100)={0x73, 0x79, 0x7a, 0x1}, &(0x7f0000001240), 0x0, 0xfffffffffffffff8) get_mempolicy(&(0x7f0000000000), &(0x7f00000001c0), 0x1ff, &(0x7f0000fff000/0x1000)=nil, 0x3) setsockopt$sock_int(r0, 0x1, 0x3c, &(0x7f0000d4effc)=0x1, 0x4) connect$inet(r0, &(0x7f0000000000)={0x2, 0x4e20, @dev={0xac, 0x14, 0x14, 0x18}}, 0x10) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f00000001c0)='tunl0\x00', 0x5) sendto$inet(r0, &(0x7f00006d1fd4)="db", 0x1, 0x4000010, &(0x7f00004daff0)={0x2, 0x0, @loopback, [0x0, 0x49000000]}, 0x10) 13:16:58 executing program 6: clone(0x802102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000040), 0xffffffffffffffff) r0 = syz_open_dev$sndtimer(&(0x7f0000000000)='/dev/snd/timer\x00', 0x0, 0x0) r1 = getpid() sched_setscheduler(r1, 0x5, &(0x7f0000000200)) ioctl$SNDRV_TIMER_IOCTL_GPARAMS(r0, 0x40485404, &(0x7f0000000240)={{}, 0x0, 0x2000000000000000, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x300000000000000]}) 13:16:58 executing program 7: r0 = openat$cuse(0xffffffffffffff9c, &(0x7f0000000080)='/dev/cuse\x00', 0x2, 0x0) clone(0x1002102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000640), 0xffffffffffffffff) r1 = getpid() sched_setscheduler(r1, 0x5, &(0x7f0000000000)) write$FUSE_NOTIFY_DELETE(r0, &(0x7f0000000040)={0x29, 0x6, 0xc}, 0x29) 13:16:58 executing program 5: r0 = syz_open_dev$binder(&(0x7f00000021c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000002340)={0x34, 0x0, &(0x7f0000002240)=[@request_death={0x400c630e, 0x4, 0x4}, @increfs={0x40046304, 0x4}, @increfs_done={0x40106308, 0x0, 0x3}, @increfs], 0x77, 0x5, &(0x7f00000022c0)="b3cd0976d8e2af743c6f523efe14fd20c3c3dd2572734282a761e1b4304e2599c85f198cc82bd5d0c74c4edca2f9ea7b875ff7047ec0784fbb354e15fd3f7d837f533597d5082692a6f2fb748da3cc4157188f7f2a5477ded56f72f5b75c96872db429e44b8fcd781d96dead77a0b58b7af9085a208a22"}) 13:16:58 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r0, &(0x7f0000942000)={0x2, 0x4e20, @multicast1}, 0x10) sendmsg$key(0xffffffffffffffff, &(0x7f0000f56000)={0x0, 0x0, &(0x7f00008feff0)={&(0x7f0000000500)=ANY=[@ANYBLOB="020300090a1500000000000000000000030006190000000002000000e0000001003f00000000000002000100e625aa66dcef85847e479eb3c49000000400000000fd003e"], 0x44}}, 0x0) add_key(&(0x7f0000000080)='logon\x00', &(0x7f0000000100)={0x73, 0x79, 0x7a, 0x1}, &(0x7f0000001240), 0x0, 0xfffffffffffffff8) get_mempolicy(&(0x7f0000000000), &(0x7f00000001c0), 0x1ff, &(0x7f0000fff000/0x1000)=nil, 0x3) setsockopt$sock_int(r0, 0x1, 0x3c, &(0x7f0000d4effc)=0x1, 0x4) connect$inet(r0, &(0x7f0000000000)={0x2, 0x4e20, @dev={0xac, 0x14, 0x14, 0x18}}, 0x10) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f00000001c0)='tunl0\x00', 0x5) sendto$inet(r0, &(0x7f00006d1fd4)="db", 0x1, 0x4000010, &(0x7f00004daff0)={0x2, 0x0, @loopback, [0x0, 0x5580]}, 0x10) 13:16:58 executing program 5: r0 = syz_open_dev$binder(&(0x7f00000021c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000002340)={0x34, 0x0, &(0x7f0000002240)=[@request_death={0x400c630e, 0x4, 0x4}, @increfs={0x40046304, 0x4}, @increfs_done={0x40106308, 0x0, 0x3}, @increfs], 0x77, 0x7400000000000000, &(0x7f00000022c0)="b3cd0976d8e2af743c6f523efe14fd20c3c3dd2572734282a761e1b4304e2599c85f198cc82bd5d0c74c4edca2f9ea7b875ff7047ec0784fbb354e15fd3f7d837f533597d5082692a6f2fb748da3cc4157188f7f2a5477ded56f72f5b75c96872db429e44b8fcd781d96dead77a0b58b7af9085a208a22"}) [ 1520.636591] binder: 15050:15053 BC_INCREFS_DONE u0000000000000000 no match 13:16:58 executing program 3: r0 = perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = getpid() ioctl$sock_FIOGETOWN(0xffffffffffffffff, 0x8903, &(0x7f0000000180)=0x0) r3 = syz_open_dev$vcsn(&(0x7f00000001c0)='/dev/vcs#\x00', 0x3, 0x2000) kcmp$KCMP_EPOLL_TFD(r1, r2, 0x7, r0, &(0x7f0000000280)={r3, r0, 0xfffffffffffffffc}) r4 = socket$alg(0x26, 0x5, 0x0) bind$alg(r4, &(0x7f0000000200)={0x26, 'hash\x00', 0x0, 0x0, 'sha1\x00'}, 0x58) r5 = accept$alg(r4, 0x0, 0x0) sendmmsg(r5, &(0x7f0000007f00)=[{{&(0x7f00000056c0)=@can, 0x3000, &(0x7f00000000c0)}}, {{&(0x7f0000005900)=@pppoe={0x18, 0x0, {0x0, @link_local, 'syzkaller0\x00'}}, 0x80, &(0x7f0000007ac0), 0x1a9, &(0x7f0000007b00)}}], 0x3fffffffffffe0d, 0x0) openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000140)='/dev/sequencer2\x00', 0x80840, 0x0) chown(&(0x7f0000000340)='./file0\x00', 0x0, 0x0) r6 = syz_open_dev$sndpcmc(&(0x7f00000000c0)='/dev/snd/pcmC#D#c\x00', 0x0, 0x0) ioctl$ASHMEM_SET_NAME(r6, 0x41007701, &(0x7f0000000100)='syzkaller0\x00') 13:16:58 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r0, &(0x7f0000942000)={0x2, 0x4e20, @multicast1}, 0x10) sendmsg$key(0xffffffffffffffff, &(0x7f0000f56000)={0x0, 0x0, &(0x7f00008feff0)={&(0x7f0000000500)=ANY=[@ANYBLOB="020300090a1500000000000000000000030006190000000002000000e0000001003f00000000000002000100e625aa66dcef85847e479eb3c49000000400000000fd003e"], 0x44}}, 0x0) add_key(&(0x7f0000000080)='logon\x00', &(0x7f0000000100)={0x73, 0x79, 0x7a, 0x1}, &(0x7f0000001240), 0x0, 0xfffffffffffffff8) get_mempolicy(&(0x7f0000000000), &(0x7f00000001c0), 0x1ff, &(0x7f0000fff000/0x1000)=nil, 0x3) setsockopt$sock_int(r0, 0x1, 0x3c, &(0x7f0000d4effc)=0x1, 0x4) connect$inet(r0, &(0x7f0000000000)={0x2, 0x4e20, @dev={0xac, 0x14, 0x14, 0x18}}, 0x10) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f00000001c0)='tunl0\x00', 0x5) sendto$inet(r0, &(0x7f00006d1fd4)="db", 0x1, 0x4000010, &(0x7f00004daff0)={0x2, 0x0, @loopback, [0x0, 0xa6ffffff00000000]}, 0x10) [ 1520.920432] binder_thread_write: 7 callbacks suppressed [ 1520.920446] binder: 15063:15074 BC_REQUEST_DEATH_NOTIFICATION invalid ref 4 [ 1520.940930] binder: 15063:15074 BC_INCREFS_DONE u0000000000000000 no match 13:16:59 executing program 6: clone(0x802102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000040), 0xffffffffffffffff) r0 = syz_open_dev$sndtimer(&(0x7f0000000000)='/dev/snd/timer\x00', 0x0, 0x0) r1 = getpid() sched_setscheduler(r1, 0x5, &(0x7f0000000200)) ioctl$SNDRV_TIMER_IOCTL_GPARAMS(r0, 0x40485404, &(0x7f0000000240)={{}, 0x0, 0x2000000000000000, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x100000000000000]}) 13:16:59 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r0, &(0x7f0000942000)={0x2, 0x4e20, @multicast1}, 0x10) sendmsg$key(0xffffffffffffffff, &(0x7f0000f56000)={0x0, 0x0, &(0x7f00008feff0)={&(0x7f0000000500)=ANY=[@ANYBLOB="020300090a1500000000000000000000030006190000000002000000e0000001003f00000000000002000100e625aa66dcef85847e479eb3c49000000400000000fd003e"], 0x44}}, 0x0) add_key(&(0x7f0000000080)='logon\x00', &(0x7f0000000100)={0x73, 0x79, 0x7a, 0x1}, &(0x7f0000001240), 0x0, 0xfffffffffffffff8) get_mempolicy(&(0x7f0000000000), &(0x7f00000001c0), 0x1ff, &(0x7f0000fff000/0x1000)=nil, 0x3) setsockopt$sock_int(r0, 0x1, 0x3c, &(0x7f0000d4effc)=0x1, 0x4) connect$inet(r0, &(0x7f0000000000)={0x2, 0x4e20, @dev={0xac, 0x14, 0x14, 0x18}}, 0x10) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f00000001c0)='tunl0\x00', 0x5) sendto$inet(r0, &(0x7f00006d1fd4)="db", 0x1, 0x4000010, &(0x7f00004daff0)={0x2, 0x0, @loopback, [0x0, 0x14b80100]}, 0x10) 13:16:59 executing program 3: perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000200)={0x26, 'hash\x00', 0x0, 0x0, 'sha1\x00'}, 0x58) r1 = accept$alg(r0, 0x0, 0x0) sendmmsg(r1, &(0x7f0000007f00)=[{{&(0x7f00000056c0)=@can, 0x3000, &(0x7f00000000c0)}}, {{&(0x7f0000005900)=@pppoe={0x18, 0x0, {0x0, @link_local, 'syzkaller0\x00'}}, 0x80, &(0x7f0000007ac0), 0x1a9, &(0x7f0000007b00)}}], 0x3fffffffffffe0d, 0x0) openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000140)='/dev/sequencer2\x00', 0x101000, 0x0) chown(&(0x7f0000000340)='./file0\x00', 0x0, 0x0) r2 = syz_open_dev$sndpcmc(&(0x7f00000000c0)='/dev/snd/pcmC#D#c\x00', 0x0, 0x8000) ioctl$ASHMEM_SET_NAME(r2, 0x41007701, &(0x7f0000000100)='syzkaller0\x00') 13:16:59 executing program 7: r0 = openat$cuse(0xffffffffffffff9c, &(0x7f0000000080)='/dev/cuse\x00', 0x2, 0x0) clone(0x1002102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000640), 0xffffffffffffffff) r1 = getpid() sched_setscheduler(r1, 0x5, &(0x7f0000000000)) write$FUSE_NOTIFY_DELETE(r0, &(0x7f0000000040)={0x29, 0x6, 0x900000000000000}, 0x29) 13:16:59 executing program 0: perf_event_open(&(0x7f0000000040)={0x2, 0x70, 0x3e5}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f00000021c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000002340)={0xb5, 0x6000, &(0x7f00000000c0)=ANY=[@ANYBLOB="0463044000000000b6a571ac965f26c50d500dae115e59afcd8a338d8b2727193c56d4ebef60c214b766ffde6cff6ceef2baa2594a53a0117e77afd5d58e8a35afdae81b258585ce769507333c0238790d5ed750bf1d6ca2a873050056528fce7becfd12f165ac43a826d3462822ff8f29ea992d4e208847cf4fc10ca00b87b5ce2523fa477bad0be1c97e4398aa2ac81d973b5a871d8e0b295e436cd8415f19088c6c82c85f4ed1fac41da062bc6dbfb8eac4276c"], 0x0, 0x0, &(0x7f00000022c0)}) 13:16:59 executing program 5: r0 = syz_open_dev$binder(&(0x7f00000021c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000002340)={0x34, 0x0, &(0x7f0000002240)=[@request_death={0x400c630e, 0x4, 0x4}, @increfs={0x40046304, 0x4}, @increfs_done={0x40106308, 0x0, 0x3}, @increfs], 0x77, 0x7a00000000000000, &(0x7f00000022c0)="b3cd0976d8e2af743c6f523efe14fd20c3c3dd2572734282a761e1b4304e2599c85f198cc82bd5d0c74c4edca2f9ea7b875ff7047ec0784fbb354e15fd3f7d837f533597d5082692a6f2fb748da3cc4157188f7f2a5477ded56f72f5b75c96872db429e44b8fcd781d96dead77a0b58b7af9085a208a22"}) 13:16:59 executing program 1: r0 = socket$netlink(0x10, 0x3, 0x8000000004) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_TCP_CONGESTION(r1, 0x6, 0xd, &(0x7f0000000180)='vegas\x00', 0x6) bind$inet6(r1, &(0x7f00001fefe4)={0xa, 0x4e22}, 0x1c) sendto$inet6(r1, &(0x7f0000000100), 0x8d2d601e8976aa5, 0x20000004, &(0x7f000031e000)={0xa, 0x4e22}, 0x1c) writev(r0, &(0x7f0000000100)=[{&(0x7f0000000000)="580000001400192340834b80040d8c560a067f62baff81004e220000000058000b4824ca944f64009400050028925aa8000000000000008000f0fffeffff09000000fff5dd00000010000100000c0900fcff0000040e05a5", 0x58}], 0x1) 13:16:59 executing program 4: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = gettid() perf_event_open(&(0x7f000025c000)={0x0, 0x70, 0x3e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff7fffffffffff}, 0x0, 0x0, 0xffffffffffffffff, 0x0) fcntl$setown(r0, 0x8, r1) bind$inet6(r0, &(0x7f0000807fe4)={0xa, 0x4e22}, 0x1c) sendto$inet6(r0, &(0x7f0000000380), 0x0, 0x200408d4, &(0x7f000072e000)={0xa, 0x4e22, 0x0, @loopback}, 0x1c) sendto$inet6(r0, &(0x7f0000ad6fad)='\x00', 0x1, 0x3fffffd, &(0x7f0000254000)={0xa, 0x0, 0x0, @loopback}, 0x1c) [ 1521.192209] binder: 15089:15093 BC_REQUEST_DEATH_NOTIFICATION invalid ref 4 13:16:59 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r0, &(0x7f0000942000)={0x2, 0x4e20, @multicast1}, 0x10) sendmsg$key(0xffffffffffffffff, &(0x7f0000f56000)={0x0, 0x0, &(0x7f00008feff0)={&(0x7f0000000500)=ANY=[@ANYBLOB="020300090a1500000000000000000000030006190000000002000000e0000001003f00000000000002000100e625aa66dcef85847e479eb3c49000000400000000fd003e"], 0x44}}, 0x0) add_key(&(0x7f0000000080)='logon\x00', &(0x7f0000000100)={0x73, 0x79, 0x7a, 0x1}, &(0x7f0000001240), 0x0, 0xfffffffffffffff8) get_mempolicy(&(0x7f0000000000), &(0x7f00000001c0), 0x1ff, &(0x7f0000fff000/0x1000)=nil, 0x3) setsockopt$sock_int(r0, 0x1, 0x3c, &(0x7f0000d4effc)=0x1, 0x4) connect$inet(r0, &(0x7f0000000000)={0x2, 0x4e20, @dev={0xac, 0x14, 0x14, 0x18}}, 0x10) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f00000001c0)='tunl0\x00', 0x5) sendto$inet(r0, &(0x7f00006d1fd4)="db", 0x1, 0x4000010, &(0x7f00004daff0)={0x2, 0x0, @loopback, [0x0, 0x3f00]}, 0x10) [ 1521.242702] binder: 15089:15093 BC_INCREFS_DONE u0000000000000000 no match 13:16:59 executing program 7: r0 = openat$cuse(0xffffffffffffff9c, &(0x7f0000000080)='/dev/cuse\x00', 0x2, 0x0) clone(0x1002102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000640), 0xffffffffffffffff) r1 = getpid() sched_setscheduler(r1, 0x5, &(0x7f0000000000)) write$FUSE_NOTIFY_DELETE(r0, &(0x7f0000000040)={0x29, 0x6, 0xb}, 0x29) 13:16:59 executing program 6: clone(0x802102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000040), 0xffffffffffffffff) r0 = syz_open_dev$sndtimer(&(0x7f0000000000)='/dev/snd/timer\x00', 0x0, 0x0) r1 = getpid() sched_setscheduler(r1, 0x5, &(0x7f0000000200)) ioctl$SNDRV_TIMER_IOCTL_GPARAMS(r0, 0x40485404, &(0x7f0000000240)={{}, 0x0, 0x2000000000000000, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3]}) 13:16:59 executing program 5: r0 = syz_open_dev$binder(&(0x7f00000021c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000002340)={0x34, 0x0, &(0x7f0000002240)=[@request_death={0x400c630e, 0x4, 0x4}, @increfs={0x40046304, 0x4}, @increfs_done={0x40106308, 0x0, 0x3}, @increfs], 0x77, 0x6c000000, &(0x7f00000022c0)="b3cd0976d8e2af743c6f523efe14fd20c3c3dd2572734282a761e1b4304e2599c85f198cc82bd5d0c74c4edca2f9ea7b875ff7047ec0784fbb354e15fd3f7d837f533597d5082692a6f2fb748da3cc4157188f7f2a5477ded56f72f5b75c96872db429e44b8fcd781d96dead77a0b58b7af9085a208a22"}) 13:16:59 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r0, &(0x7f0000942000)={0x2, 0x4e20, @multicast1}, 0x10) sendmsg$key(0xffffffffffffffff, &(0x7f0000f56000)={0x0, 0x0, &(0x7f00008feff0)={&(0x7f0000000500)=ANY=[@ANYBLOB="020300090a1500000000000000000000030006190000000002000000e0000001003f00000000000002000100e625aa66dcef85847e479eb3c49000000400000000fd003e"], 0x44}}, 0x0) add_key(&(0x7f0000000080)='logon\x00', &(0x7f0000000100)={0x73, 0x79, 0x7a, 0x1}, &(0x7f0000001240), 0x0, 0xfffffffffffffff8) get_mempolicy(&(0x7f0000000000), &(0x7f00000001c0), 0x1ff, &(0x7f0000fff000/0x1000)=nil, 0x3) setsockopt$sock_int(r0, 0x1, 0x3c, &(0x7f0000d4effc)=0x1, 0x4) connect$inet(r0, &(0x7f0000000000)={0x2, 0x4e20, @dev={0xac, 0x14, 0x14, 0x18}}, 0x10) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f00000001c0)='tunl0\x00', 0x5) sendto$inet(r0, &(0x7f00006d1fd4)="db", 0x1, 0x4000010, &(0x7f00004daff0)={0x2, 0x0, @loopback, [0x0, 0xe]}, 0x10) 13:16:59 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r0, &(0x7f0000942000)={0x2, 0x4e20, @multicast1}, 0x10) sendmsg$key(0xffffffffffffffff, &(0x7f0000f56000)={0x0, 0x0, &(0x7f00008feff0)={&(0x7f0000000500)=ANY=[@ANYBLOB="020300090a1500000000000000000000030006190000000002000000e0000001003f00000000000002000100e625aa66dcef85847e479eb3c49000000400000000fd003e"], 0x44}}, 0x0) add_key(&(0x7f0000000080)='logon\x00', &(0x7f0000000100)={0x73, 0x79, 0x7a, 0x1}, &(0x7f0000001240), 0x0, 0xfffffffffffffff8) get_mempolicy(&(0x7f0000000000), &(0x7f00000001c0), 0x1ff, &(0x7f0000fff000/0x1000)=nil, 0x3) setsockopt$sock_int(r0, 0x1, 0x3c, &(0x7f0000d4effc)=0x1, 0x4) connect$inet(r0, &(0x7f0000000000)={0x2, 0x4e20, @dev={0xac, 0x14, 0x14, 0x18}}, 0x10) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f00000001c0)='tunl0\x00', 0x5) sendto$inet(r0, &(0x7f00006d1fd4)="db", 0x1, 0x4000010, &(0x7f00004daff0)={0x2, 0x0, @loopback, [0x0, 0x7]}, 0x10) 13:16:59 executing program 7: r0 = openat$cuse(0xffffffffffffff9c, &(0x7f0000000080)='/dev/cuse\x00', 0x2, 0x0) clone(0x1002102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000640), 0xffffffffffffffff) r1 = getpid() sched_setscheduler(r1, 0x5, &(0x7f0000000000)) write$FUSE_NOTIFY_DELETE(r0, &(0x7f0000000040)={0x29, 0x6, 0x2}, 0x29) 13:16:59 executing program 6: clone(0x802102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000040), 0xffffffffffffffff) r0 = syz_open_dev$sndtimer(&(0x7f0000000000)='/dev/snd/timer\x00', 0x0, 0x0) r1 = getpid() sched_setscheduler(r1, 0x5, &(0x7f0000000200)) ioctl$SNDRV_TIMER_IOCTL_GPARAMS(r0, 0x40485404, &(0x7f0000000240)={{}, 0x0, 0x2000000000000000, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x100000000000000]}) [ 1521.596855] binder: 15129:15131 BC_REQUEST_DEATH_NOTIFICATION invalid ref 4 13:16:59 executing program 5: r0 = syz_open_dev$binder(&(0x7f00000021c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000002340)={0x34, 0x0, &(0x7f0000002240)=[@request_death={0x400c630e, 0x4, 0x4}, @increfs={0x40046304, 0x4}, @increfs_done={0x40106308, 0x0, 0x3}, @increfs], 0x77, 0x2000000, &(0x7f00000022c0)="b3cd0976d8e2af743c6f523efe14fd20c3c3dd2572734282a761e1b4304e2599c85f198cc82bd5d0c74c4edca2f9ea7b875ff7047ec0784fbb354e15fd3f7d837f533597d5082692a6f2fb748da3cc4157188f7f2a5477ded56f72f5b75c96872db429e44b8fcd781d96dead77a0b58b7af9085a208a22"}) 13:16:59 executing program 3: r0 = perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = socket$alg(0x26, 0x5, 0x0) bind$alg(r1, &(0x7f0000000200)={0x26, 'hash\x00', 0x0, 0x0, 'sha1\x00'}, 0x58) r2 = accept$alg(r1, 0x0, 0x0) sendmmsg(r2, &(0x7f0000007f00)=[{{&(0x7f00000056c0)=@can, 0x3000, &(0x7f00000000c0)}}, {{&(0x7f0000005900)=@pppoe={0x18, 0x0, {0x0, @link_local, 'syzkaller0\x00'}}, 0x80, &(0x7f0000007ac0), 0x1a9, &(0x7f0000007b00)}}], 0x3fffffffffffe0d, 0x0) r3 = openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000140)='/dev/sequencer2\x00', 0x80840, 0x0) ioctl$EVIOCGBITSND(r3, 0x80404532, &(0x7f0000000280)=""/145) chown(&(0x7f0000000340)='./file0\x00', 0x0, 0x0) r4 = syz_open_dev$sndpcmc(&(0x7f00000000c0)='/dev/snd/pcmC#D#c\x00', 0x0, 0x0) ioctl$ASHMEM_SET_NAME(r4, 0x41007701, &(0x7f0000000100)='syzkaller0\x00') ioctl$sock_inet6_tcp_SIOCINQ(r0, 0x541b, &(0x7f0000000180)) ioctl$KVM_GET_MP_STATE(r3, 0x8004ae98, &(0x7f00000001c0)) 13:16:59 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r0, &(0x7f0000942000)={0x2, 0x4e20, @multicast1}, 0x10) sendmsg$key(0xffffffffffffffff, &(0x7f0000f56000)={0x0, 0x0, &(0x7f00008feff0)={&(0x7f0000000500)=ANY=[@ANYBLOB="020300090a1500000000000000000000030006190000000002000000e0000001003f00000000000002000100e625aa66dcef85847e479eb3c49000000400000000fd003e"], 0x44}}, 0x0) add_key(&(0x7f0000000080)='logon\x00', &(0x7f0000000100)={0x73, 0x79, 0x7a, 0x1}, &(0x7f0000001240), 0x0, 0xfffffffffffffff8) get_mempolicy(&(0x7f0000000000), &(0x7f00000001c0), 0x1ff, &(0x7f0000fff000/0x1000)=nil, 0x3) setsockopt$sock_int(r0, 0x1, 0x3c, &(0x7f0000d4effc)=0x1, 0x4) connect$inet(r0, &(0x7f0000000000)={0x2, 0x4e20, @dev={0xac, 0x14, 0x14, 0x18}}, 0x10) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f00000001c0)='tunl0\x00', 0x5) sendto$inet(r0, &(0x7f00006d1fd4)="db", 0x1, 0x4000010, &(0x7f00004daff0)={0x2, 0x0, @loopback, [0x0, 0xa0028000]}, 0x10) [ 1521.752658] binder: 15150:15151 BC_REQUEST_DEATH_NOTIFICATION invalid ref 4 13:16:59 executing program 5: r0 = syz_open_dev$binder(&(0x7f00000021c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000002340)={0x34, 0x0, &(0x7f0000002240)=[@request_death={0x400c630e, 0x4, 0x4}, @increfs={0x40046304, 0x4}, @increfs_done={0x40106308, 0x0, 0x3}, @increfs], 0x77, 0xa000000, &(0x7f00000022c0)="b3cd0976d8e2af743c6f523efe14fd20c3c3dd2572734282a761e1b4304e2599c85f198cc82bd5d0c74c4edca2f9ea7b875ff7047ec0784fbb354e15fd3f7d837f533597d5082692a6f2fb748da3cc4157188f7f2a5477ded56f72f5b75c96872db429e44b8fcd781d96dead77a0b58b7af9085a208a22"}) [ 1521.966662] binder: 15163:15164 BC_REQUEST_DEATH_NOTIFICATION invalid ref 4 13:17:00 executing program 3: perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000200)={0x26, 'hash\x00', 0x0, 0x0, 'sha1\x00'}, 0x58) r1 = accept$alg(r0, 0x0, 0x0) sendmmsg(r1, &(0x7f0000007f00)=[{{&(0x7f0000000180)=@can, 0x80, &(0x7f00000000c0)}}, {{&(0x7f0000005900)=@pppoe={0x18, 0x0, {0x0, @link_local, 'syzkaller0\x00'}}, 0x80, &(0x7f0000007ac0), 0x0, &(0x7f0000007b00)}}], 0x2, 0x0) r2 = openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000140)='/dev/sequencer2\x00', 0x80840, 0x0) getsockopt$inet6_IPV6_XFRM_POLICY(r2, 0x29, 0x23, &(0x7f00000002c0)={{{@in6=@mcast2, @in6=@mcast1}}, {{@in=@loopback}, 0x0, @in6=@dev}}, &(0x7f00000003c0)=0xe8) lstat(&(0x7f0000000280)='./file0\x00', &(0x7f0000000480)={0x0, 0x0, 0x0, 0x0, 0x0}) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000000500)={0x0, 0x0, 0x0}, &(0x7f0000000540)=0xc) chown(&(0x7f0000000400)='./file0\x00', r3, r4) r5 = syz_open_dev$sndpcmc(&(0x7f00000000c0)='/dev/snd/pcmC#D#c\x00', 0x0, 0x0) ioctl$ASHMEM_SET_NAME(r5, 0x41007701, &(0x7f0000000100)='syzkaller0\x00') socket$inet_icmp_raw(0x2, 0x3, 0x1) 13:17:00 executing program 5: r0 = syz_open_dev$binder(&(0x7f00000021c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000002340)={0x34, 0x0, &(0x7f0000002240)=[@request_death={0x400c630e, 0x4, 0x4}, @increfs={0x40046304, 0x4}, @increfs_done={0x40106308, 0x0, 0x3}, @increfs], 0x77, 0x4c00, &(0x7f00000022c0)="b3cd0976d8e2af743c6f523efe14fd20c3c3dd2572734282a761e1b4304e2599c85f198cc82bd5d0c74c4edca2f9ea7b875ff7047ec0784fbb354e15fd3f7d837f533597d5082692a6f2fb748da3cc4157188f7f2a5477ded56f72f5b75c96872db429e44b8fcd781d96dead77a0b58b7af9085a208a22"}) 13:17:00 executing program 1: r0 = socket$netlink(0x10, 0x3, 0x8000000004) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_TCP_CONGESTION(r1, 0x6, 0xd, &(0x7f0000000180)='vegas\x00', 0x6) bind$inet6(r1, &(0x7f00001fefe4)={0xa, 0x4e22}, 0x1c) sendto$inet6(r1, &(0x7f0000000100), 0x8d2d601e8976aa5, 0x20000004, &(0x7f000031e000)={0xa, 0x4e22}, 0x1c) writev(r0, &(0x7f0000000100)=[{&(0x7f0000000000)="580000001400192340834b80040d8c560a067f71ceff81004e220000000058000b4824ca944f64009400050028925aa8000000000000008000f0fffeffff09000000fff5dd00000010000100000c0900fcff0000040e05a5", 0x58}], 0x1) [ 1522.157370] binder: 15174:15183 BC_REQUEST_DEATH_NOTIFICATION invalid ref 4 13:17:00 executing program 4: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = gettid() perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff7fffffffffff}, 0x0, 0x0, 0xffffffffffffffff, 0x0) fcntl$setown(r0, 0x8, r1) bind$inet6(r0, &(0x7f0000807fe4)={0xa, 0x4e22}, 0x1c) sendto$inet6(r0, &(0x7f0000000380), 0x0, 0x200408d4, &(0x7f000072e000)={0xa, 0x4e22, 0x0, @loopback}, 0x1c) sendto$inet6(r0, &(0x7f0000ad6fad)='\x00', 0x1, 0x3fffffd, &(0x7f0000254000)={0xa, 0x0, 0x0, @loopback}, 0x1c) 13:17:00 executing program 6: clone(0x802102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000040), 0xffffffffffffffff) r0 = syz_open_dev$sndtimer(&(0x7f0000000000)='/dev/snd/timer\x00', 0x0, 0x0) r1 = getpid() sched_setscheduler(r1, 0x5, &(0x7f0000000200)) ioctl$SNDRV_TIMER_IOCTL_GPARAMS(r0, 0x40485404, &(0x7f0000000240)={{}, 0x0, 0x2000000000000000, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x300000000000000]}) 13:17:00 executing program 7: r0 = openat$cuse(0xffffffffffffff9c, &(0x7f0000000080)='/dev/cuse\x00', 0x2, 0x0) clone(0x1002102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000640), 0xffffffffffffffff) r1 = getpid() sched_setscheduler(r1, 0x5, &(0x7f0000000000)) write$FUSE_NOTIFY_DELETE(r0, &(0x7f0000000040)={0x29, 0x6, 0xffffffffa0008000}, 0x29) 13:17:00 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r0, &(0x7f0000942000)={0x2, 0x4e20, @multicast1}, 0x10) sendmsg$key(0xffffffffffffffff, &(0x7f0000f56000)={0x0, 0x0, &(0x7f00008feff0)={&(0x7f0000000500)=ANY=[@ANYBLOB="020300090a1500000000000000000000030006190000000002000000e0000001003f00000000000002000100e625aa66dcef85847e479eb3c49000000400000000fd003e"], 0x44}}, 0x0) add_key(&(0x7f0000000080)='logon\x00', &(0x7f0000000100)={0x73, 0x79, 0x7a, 0x1}, &(0x7f0000001240), 0x0, 0xfffffffffffffff8) get_mempolicy(&(0x7f0000000000), &(0x7f00000001c0), 0x1ff, &(0x7f0000fff000/0x1000)=nil, 0x3) setsockopt$sock_int(r0, 0x1, 0x3c, &(0x7f0000d4effc)=0x1, 0x4) connect$inet(r0, &(0x7f0000000000)={0x2, 0x4e20, @dev={0xac, 0x14, 0x14, 0x18}}, 0x10) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f00000001c0)='tunl0\x00', 0x5) sendto$inet(r0, &(0x7f00006d1fd4)="db", 0x1, 0x4000010, &(0x7f00004daff0)={0x2, 0x0, @loopback, [0x0, 0x8000000]}, 0x10) 13:17:00 executing program 0: perf_event_open(&(0x7f0000000040)={0x2, 0x70, 0x3e5}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f00000021c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000002340)={0xb5, 0x6c, &(0x7f00000000c0)=ANY=[@ANYBLOB="0463044000000000b6a571ac965f26c50d500dae115e59afcd8a338d8b2727193c56d4ebef60c214b766ffde6cff6ceef2baa2594a53a0117e77afd5d58e8a35afdae81b258585ce769507333c0238790d5ed750bf1d6ca2a873050056528fce7becfd12f165ac43a826d3462822ff8f29ea992d4e208847cf4fc10ca00b87b5ce2523fa477bad0be1c97e4398aa2ac81d973b5a871d8e0b295e436cd8415f19088c6c82c85f4ed1fac41da062bc6dbfb8eac4276c"], 0x0, 0x0, &(0x7f00000022c0)}) 13:17:00 executing program 3: perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = openat$selinux_mls(0xffffffffffffff9c, &(0x7f0000000180)='/selinux/mls\x00', 0x0, 0x0) write$FUSE_BMAP(r0, &(0x7f00000001c0)={0x18, 0x0, 0x3, {0x5}}, 0x18) r1 = socket$alg(0x26, 0x5, 0x0) bind$alg(r1, &(0x7f0000000200)={0x26, 'hash\x00', 0x0, 0x0, 'sha1\x00'}, 0x58) r2 = accept$alg(r1, 0x0, 0x0) sendmmsg(r2, &(0x7f0000007f00)=[{{&(0x7f00000056c0)=@can, 0x3000, &(0x7f00000000c0)}}, {{&(0x7f0000005900)=@pppoe={0x18, 0x0, {0x0, @link_local, 'syzkaller0\x00'}}, 0x80, &(0x7f0000007ac0), 0x1a9, &(0x7f0000007b00)}}], 0x3fffffffffffe0d, 0x0) r3 = openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000140)='/dev/sequencer2\x00', 0x80840, 0x0) setsockopt$nfc_llcp_NFC_LLCP_MIUX(r3, 0x118, 0x1, &(0x7f00000000c0)=0x5, 0x4) getresuid(&(0x7f0000000300), &(0x7f0000000380), &(0x7f00000003c0)=0x0) chown(&(0x7f0000000340)='./file0\x00', r4, 0x0) r5 = syz_open_dev$sndpcmc(&(0x7f0000000280)='/dev/snd/pcmC#D#c\x00', 0x0, 0x4) ioctl$ASHMEM_SET_PROT_MASK(r5, 0x40087705, &(0x7f00000002c0)={0x5, 0x6}) ioctl$ASHMEM_SET_NAME(r5, 0x41007701, &(0x7f0000000100)='syzkaller0\x00') 13:17:00 executing program 5: r0 = syz_open_dev$binder(&(0x7f00000021c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000002340)={0x34, 0x0, &(0x7f0000002240)=[@request_death={0x400c630e, 0x4, 0x4}, @increfs={0x40046304, 0x4}, @increfs_done={0x40106308, 0x0, 0x3}, @increfs], 0x77, 0x7a, &(0x7f00000022c0)="b3cd0976d8e2af743c6f523efe14fd20c3c3dd2572734282a761e1b4304e2599c85f198cc82bd5d0c74c4edca2f9ea7b875ff7047ec0784fbb354e15fd3f7d837f533597d5082692a6f2fb748da3cc4157188f7f2a5477ded56f72f5b75c96872db429e44b8fcd781d96dead77a0b58b7af9085a208a22"}) 13:17:00 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r0, &(0x7f0000942000)={0x2, 0x4e20, @multicast1}, 0x10) sendmsg$key(0xffffffffffffffff, &(0x7f0000f56000)={0x0, 0x0, &(0x7f00008feff0)={&(0x7f0000000500)=ANY=[@ANYBLOB="020300090a1500000000000000000000030006190000000002000000e0000001003f00000000000002000100e625aa66dcef85847e479eb3c49000000400000000fd003e"], 0x44}}, 0x0) add_key(&(0x7f0000000080)='logon\x00', &(0x7f0000000100)={0x73, 0x79, 0x7a, 0x1}, &(0x7f0000001240), 0x0, 0xfffffffffffffff8) get_mempolicy(&(0x7f0000000000), &(0x7f00000001c0), 0x1ff, &(0x7f0000fff000/0x1000)=nil, 0x3) setsockopt$sock_int(r0, 0x1, 0x3c, &(0x7f0000d4effc)=0x1, 0x4) connect$inet(r0, &(0x7f0000000000)={0x2, 0x4e20, @dev={0xac, 0x14, 0x14, 0x18}}, 0x10) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f00000001c0)='tunl0\x00', 0x5) sendto$inet(r0, &(0x7f00006d1fd4)="db", 0x1, 0x4000010, &(0x7f00004daff0)={0x2, 0x0, @loopback, [0x0, 0xf2ffffff]}, 0x10) [ 1522.367563] binder: 15196:15201 BC_REQUEST_DEATH_NOTIFICATION invalid ref 4 13:17:00 executing program 5: r0 = syz_open_dev$binder(&(0x7f00000021c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000002340)={0x34, 0x0, &(0x7f0000002240)=[@request_death={0x400c630e, 0x4, 0x4}, @increfs={0x40046304, 0x4}, @increfs_done={0x40106308, 0x0, 0x3}, @increfs], 0x77, 0x1000000000000000, &(0x7f00000022c0)="b3cd0976d8e2af743c6f523efe14fd20c3c3dd2572734282a761e1b4304e2599c85f198cc82bd5d0c74c4edca2f9ea7b875ff7047ec0784fbb354e15fd3f7d837f533597d5082692a6f2fb748da3cc4157188f7f2a5477ded56f72f5b75c96872db429e44b8fcd781d96dead77a0b58b7af9085a208a22"}) 13:17:00 executing program 6: clone(0x802102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000040), 0xffffffffffffffff) r0 = syz_open_dev$sndtimer(&(0x7f0000000000)='/dev/snd/timer\x00', 0x0, 0x0) r1 = getpid() sched_setscheduler(r1, 0x5, &(0x7f0000000200)) ioctl$SNDRV_TIMER_IOCTL_GPARAMS(r0, 0x40485404, &(0x7f0000000240)={{}, 0x0, 0x2000000000000000, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1000000]}) 13:17:00 executing program 5: r0 = syz_open_dev$binder(&(0x7f00000021c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000002340)={0x34, 0x0, &(0x7f0000002240)=[@request_death={0x400c630e, 0x4, 0x4}, @increfs={0x40046304, 0x4}, @increfs_done={0x40106308, 0x0, 0x3}, @increfs], 0x77, 0x300, &(0x7f00000022c0)="b3cd0976d8e2af743c6f523efe14fd20c3c3dd2572734282a761e1b4304e2599c85f198cc82bd5d0c74c4edca2f9ea7b875ff7047ec0784fbb354e15fd3f7d837f533597d5082692a6f2fb748da3cc4157188f7f2a5477ded56f72f5b75c96872db429e44b8fcd781d96dead77a0b58b7af9085a208a22"}) [ 1522.560994] binder: 15225:15226 BC_REQUEST_DEATH_NOTIFICATION invalid ref 4 13:17:00 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r0, &(0x7f0000942000)={0x2, 0x4e20, @multicast1}, 0x10) sendmsg$key(0xffffffffffffffff, &(0x7f0000f56000)={0x0, 0x0, &(0x7f00008feff0)={&(0x7f0000000500)=ANY=[@ANYBLOB="020300090a1500000000000000000000030006190000000002000000e0000001003f00000000000002000100e625aa66dcef85847e479eb3c49000000400000000fd003e"], 0x44}}, 0x0) add_key(&(0x7f0000000080)='logon\x00', &(0x7f0000000100)={0x73, 0x79, 0x7a, 0x1}, &(0x7f0000001240), 0x0, 0xfffffffffffffff8) get_mempolicy(&(0x7f0000000000), &(0x7f00000001c0), 0x1ff, &(0x7f0000fff000/0x1000)=nil, 0x3) setsockopt$sock_int(r0, 0x1, 0x3c, &(0x7f0000d4effc)=0x1, 0x4) connect$inet(r0, &(0x7f0000000000)={0x2, 0x4e20, @dev={0xac, 0x14, 0x14, 0x18}}, 0x10) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f00000001c0)='tunl0\x00', 0x5) sendto$inet(r0, &(0x7f00006d1fd4)="db", 0x1, 0x4000010, &(0x7f00004daff0)={0x2, 0x0, @loopback, [0x0, 0x7000000]}, 0x10) 13:17:00 executing program 3: perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000200)={0x26, 'hash\x00', 0x0, 0x0, 'sha1\x00'}, 0x58) r1 = accept$alg(r0, 0x0, 0x0) mkdir(&(0x7f0000000180)='./file0\x00', 0x8) sendmmsg(r1, &(0x7f0000007f00)=[{{&(0x7f00000056c0)=@can, 0x3000, &(0x7f00000000c0)}}, {{&(0x7f0000005900)=@pppoe={0x18, 0x0, {0x0, @link_local, 'syzkaller0\x00'}}, 0x80, &(0x7f0000007ac0), 0x1a9, &(0x7f0000007b00)}}], 0x3fffffffffffe0d, 0x0) openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000140)='/dev/sequencer2\x00', 0x80840, 0x0) chown(&(0x7f0000000340)='./file0\x00', 0x0, 0x0) r2 = syz_open_dev$sndpcmc(&(0x7f00000000c0)='/dev/snd/pcmC#D#c\x00', 0x0, 0x0) ioctl$ASHMEM_SET_NAME(r2, 0x41007701, &(0x7f0000000100)='syzkaller0\x00') 13:17:00 executing program 7: r0 = openat$cuse(0xffffffffffffff9c, &(0x7f0000000080)='/dev/cuse\x00', 0x2, 0x0) clone(0x1002102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000640), 0xffffffffffffffff) r1 = getpid() sched_setscheduler(r1, 0x5, &(0x7f0000000000)) write$FUSE_NOTIFY_DELETE(r0, &(0x7f0000000040)={0x29, 0x6, 0x600}, 0x29) 13:17:00 executing program 6: clone(0x802102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000040), 0xffffffffffffffff) r0 = syz_open_dev$sndtimer(&(0x7f0000000000)='/dev/snd/timer\x00', 0x0, 0x0) r1 = getpid() sched_setscheduler(r1, 0x5, &(0x7f0000000200)) ioctl$SNDRV_TIMER_IOCTL_GPARAMS(r0, 0x40485404, &(0x7f0000000240)={{}, 0x0, 0x2000000000000000, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3000000]}) [ 1522.633171] binder: 15234:15236 unknown command -1879104984 [ 1522.639501] binder: 15234:15236 ioctl c0306201 20002340 returned -22 [ 1522.649161] binder: 15234:15237 unknown command -1879104984 [ 1522.655927] binder: 15234:15237 ioctl c0306201 20002340 returned -22 [ 1522.788245] binder: 15244:15252 BC_REQUEST_DEATH_NOTIFICATION invalid ref 4 13:17:01 executing program 1: r0 = socket$netlink(0x10, 0x3, 0x8000000004) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_TCP_CONGESTION(r1, 0x6, 0xd, &(0x7f0000000180)='vegas\x00', 0x6) bind$inet6(r1, &(0x7f00001fefe4)={0xa, 0x4e22}, 0x1c) sendto$inet6(r1, &(0x7f0000000100), 0x8d2d601e8976aa5, 0x20000004, &(0x7f000031e000)={0xa, 0x4e22}, 0x1c) writev(r0, &(0x7f0000000100)=[{&(0x7f0000000000)="580000001400192340834b80040d8c560a067f209dff81004e220000000058000b4824ca944f64009400050028925aa8000000000000008000f0fffeffff09000000fff5dd00000010000100000c0900fcff0000040e05a5", 0x58}], 0x1) 13:17:01 executing program 4: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = gettid() perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff7fffffffffff}, 0x0, 0x0, 0xffffffffffffffff, 0x0) fcntl$setown(r0, 0x8, r1) bind$inet6(r0, &(0x7f0000807fe4)={0xa, 0x4e22}, 0x1c) sendto$inet6(r0, &(0x7f0000000380), 0x0, 0x200408d4, &(0x7f000072e000)={0xa, 0x4e22, 0x0, @loopback}, 0x1c) sendto$inet6(r0, &(0x7f0000ad6fad)='\x00', 0x1, 0x3fffffd, &(0x7f0000254000)={0xa, 0x0, 0x0, @loopback}, 0x1c) 13:17:01 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r0, &(0x7f0000942000)={0x2, 0x4e20, @multicast1}, 0x10) sendmsg$key(0xffffffffffffffff, &(0x7f0000f56000)={0x0, 0x0, &(0x7f00008feff0)={&(0x7f0000000500)=ANY=[@ANYBLOB="020300090a1500000000000000000000030006190000000002000000e0000001003f00000000000002000100e625aa66dcef85847e479eb3c49000000400000000fd003e"], 0x44}}, 0x0) add_key(&(0x7f0000000080)='logon\x00', &(0x7f0000000100)={0x73, 0x79, 0x7a, 0x1}, &(0x7f0000001240), 0x0, 0xfffffffffffffff8) get_mempolicy(&(0x7f0000000000), &(0x7f00000001c0), 0x1ff, &(0x7f0000fff000/0x1000)=nil, 0x3) setsockopt$sock_int(r0, 0x1, 0x3c, &(0x7f0000d4effc)=0x1, 0x4) connect$inet(r0, &(0x7f0000000000)={0x2, 0x4e20, @dev={0xac, 0x14, 0x14, 0x18}}, 0x10) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f00000001c0)='tunl0\x00', 0x5) sendto$inet(r0, &(0x7f00006d1fd4)="db", 0x1, 0x4000010, &(0x7f00004daff0)={0x2, 0x0, @loopback, [0x0, 0x4900]}, 0x10) 13:17:01 executing program 5: r0 = syz_open_dev$binder(&(0x7f00000021c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000002340)={0x34, 0x0, &(0x7f0000002240)=[@request_death={0x400c630e, 0x4, 0x4}, @increfs={0x40046304, 0x4}, @increfs_done={0x40106308, 0x0, 0x3}, @increfs], 0x77, 0x300000000000000, &(0x7f00000022c0)="b3cd0976d8e2af743c6f523efe14fd20c3c3dd2572734282a761e1b4304e2599c85f198cc82bd5d0c74c4edca2f9ea7b875ff7047ec0784fbb354e15fd3f7d837f533597d5082692a6f2fb748da3cc4157188f7f2a5477ded56f72f5b75c96872db429e44b8fcd781d96dead77a0b58b7af9085a208a22"}) 13:17:01 executing program 7: r0 = openat$cuse(0xffffffffffffff9c, &(0x7f0000000080)='/dev/cuse\x00', 0x2, 0x0) clone(0x1002102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000640), 0xffffffffffffffff) r1 = getpid() sched_setscheduler(r1, 0x5, &(0x7f0000000000)) write$FUSE_NOTIFY_DELETE(r0, &(0x7f0000000040)={0x29, 0x6, 0xa0010000}, 0x29) 13:17:01 executing program 6: clone(0x802102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000040), 0xffffffffffffffff) r0 = syz_open_dev$sndtimer(&(0x7f0000000000)='/dev/snd/timer\x00', 0x0, 0x0) r1 = getpid() sched_setscheduler(r1, 0x5, &(0x7f0000000200)) ioctl$SNDRV_TIMER_IOCTL_GPARAMS(r0, 0x40485404, &(0x7f0000000240)={{}, 0x0, 0x2000000000000000, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x300]}) 13:17:01 executing program 0: perf_event_open(&(0x7f0000000040)={0x2, 0x70, 0x3e5}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f00000021c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000002340)={0xb5, 0x700000000000000, &(0x7f00000000c0)=ANY=[@ANYBLOB="0463044000000000b6a571ac965f26c50d500dae115e59afcd8a338d8b2727193c56d4ebef60c214b766ffde6cff6ceef2baa2594a53a0117e77afd5d58e8a35afdae81b258585ce769507333c0238790d5ed750bf1d6ca2a873050056528fce7becfd12f165ac43a826d3462822ff8f29ea992d4e208847cf4fc10ca00b87b5ce2523fa477bad0be1c97e4398aa2ac81d973b5a871d8e0b295e436cd8415f19088c6c82c85f4ed1fac41da062bc6dbfb8eac4276c"], 0x0, 0x0, &(0x7f00000022c0)}) 13:17:01 executing program 3: perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000200)={0x26, 'hash\x00', 0x0, 0x0, 'sha1\x00'}, 0x58) r1 = accept$alg(r0, 0x0, 0x0) sendmmsg(r1, &(0x7f0000007f00)=[{{&(0x7f00000056c0)=@can, 0x3000, &(0x7f00000000c0)}}, {{&(0x7f0000005900)=@pppoe={0x18, 0x0, {0x0, @link_local, 'syzkaller0\x00'}}, 0x80, &(0x7f0000007ac0), 0x1a9, &(0x7f0000007b00)}}], 0x3fffffffffffe0d, 0x0) openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000140)='/dev/sequencer2\x00', 0x80840, 0x0) chown(&(0x7f0000000340)='./file0\x00', 0x0, 0x0) r2 = syz_open_dev$sndpcmc(&(0x7f00000000c0)='/dev/snd/pcmC#D#c\x00', 0xfffffffffffffffc, 0x20000) ioctl$ASHMEM_SET_NAME(r2, 0x41007701, &(0x7f0000000100)='syzkaller0\x00') openat$vhci(0xffffffffffffff9c, &(0x7f0000000180)='/dev/vhci\x00', 0x20000, 0x0) [ 1523.173849] binder: 15281:15286 BC_REQUEST_DEATH_NOTIFICATION invalid ref 4 13:17:01 executing program 5: r0 = syz_open_dev$binder(&(0x7f00000021c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000002340)={0x34, 0x0, &(0x7f0000002240)=[@request_death={0x400c630e, 0x4, 0x4}, @increfs={0x40046304, 0x4}, @increfs_done={0x40106308, 0x0, 0x3}, @increfs], 0x77, 0x20000000, &(0x7f00000022c0)="b3cd0976d8e2af743c6f523efe14fd20c3c3dd2572734282a761e1b4304e2599c85f198cc82bd5d0c74c4edca2f9ea7b875ff7047ec0784fbb354e15fd3f7d837f533597d5082692a6f2fb748da3cc4157188f7f2a5477ded56f72f5b75c96872db429e44b8fcd781d96dead77a0b58b7af9085a208a22"}) 13:17:01 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r0, &(0x7f0000942000)={0x2, 0x4e20, @multicast1}, 0x10) sendmsg$key(0xffffffffffffffff, &(0x7f0000f56000)={0x0, 0x0, &(0x7f00008feff0)={&(0x7f0000000500)=ANY=[@ANYBLOB="020300090a1500000000000000000000030006190000000002000000e0000001003f00000000000002000100e625aa66dcef85847e479eb3c49000000400000000fd003e"], 0x44}}, 0x0) add_key(&(0x7f0000000080)='logon\x00', &(0x7f0000000100)={0x73, 0x79, 0x7a, 0x1}, &(0x7f0000001240), 0x0, 0xfffffffffffffff8) get_mempolicy(&(0x7f0000000000), &(0x7f00000001c0), 0x1ff, &(0x7f0000fff000/0x1000)=nil, 0x3) setsockopt$sock_int(r0, 0x1, 0x3c, &(0x7f0000d4effc)=0x1, 0x4) connect$inet(r0, &(0x7f0000000000)={0x2, 0x4e20, @dev={0xac, 0x14, 0x14, 0x18}}, 0x10) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f00000001c0)='tunl0\x00', 0x5) sendto$inet(r0, &(0x7f00006d1fd4)="db", 0x1, 0x4000010, &(0x7f00004daff0)={0x2, 0x0, @loopback, [0x0, 0xfffffffe]}, 0x10) 13:17:01 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r0, &(0x7f0000942000)={0x2, 0x4e20, @multicast1}, 0x10) sendmsg$key(0xffffffffffffffff, &(0x7f0000f56000)={0x0, 0x0, &(0x7f00008feff0)={&(0x7f0000000500)=ANY=[@ANYBLOB="020300090a1500000000000000000000030006190000000002000000e0000001003f00000000000002000100e625aa66dcef85847e479eb3c49000000400000000fd003e"], 0x44}}, 0x0) add_key(&(0x7f0000000080)='logon\x00', &(0x7f0000000100)={0x73, 0x79, 0x7a, 0x1}, &(0x7f0000001240), 0x0, 0xfffffffffffffff8) get_mempolicy(&(0x7f0000000000), &(0x7f00000001c0), 0x1ff, &(0x7f0000fff000/0x1000)=nil, 0x3) setsockopt$sock_int(r0, 0x1, 0x3c, &(0x7f0000d4effc)=0x1, 0x4) connect$inet(r0, &(0x7f0000000000)={0x2, 0x4e20, @dev={0xac, 0x14, 0x14, 0x18}}, 0x10) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f00000001c0)='tunl0\x00', 0x5) sendto$inet(r0, &(0x7f00006d1fd4)="db", 0x1, 0x4000010, &(0x7f00004daff0)={0x2, 0x0, @loopback, [0x0, 0xf2ffffff00000000]}, 0x10) 13:17:01 executing program 5: r0 = syz_open_dev$binder(&(0x7f00000021c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000002340)={0x34, 0x0, &(0x7f0000002240)=[@request_death={0x400c630e, 0x4, 0x4}, @increfs={0x40046304, 0x4}, @increfs_done={0x40106308, 0x0, 0x3}, @increfs], 0x77, 0x1a0, &(0x7f00000022c0)="b3cd0976d8e2af743c6f523efe14fd20c3c3dd2572734282a761e1b4304e2599c85f198cc82bd5d0c74c4edca2f9ea7b875ff7047ec0784fbb354e15fd3f7d837f533597d5082692a6f2fb748da3cc4157188f7f2a5477ded56f72f5b75c96872db429e44b8fcd781d96dead77a0b58b7af9085a208a22"}) 13:17:01 executing program 3: perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$alg(0x26, 0x5, 0x0) r1 = syz_open_dev$mice(&(0x7f00000001c0)='/dev/input/mice\x00', 0x0, 0x0) ioctl$DRM_IOCTL_GEM_OPEN(0xffffffffffffffff, 0xc010640b, &(0x7f0000000280)={0x0, 0x0, 0x401}) r3 = syz_open_dev$admmidi(&(0x7f00000002c0)='/dev/admmidi#\x00', 0x8, 0x800) ioctl$DRM_IOCTL_PRIME_FD_TO_HANDLE(r1, 0xc00c642e, &(0x7f0000000300)={r2, 0x80000, r3}) bind$alg(r0, &(0x7f0000000200)={0x26, 'hash\x00', 0x0, 0x0, 'sha1\x00'}, 0x58) ioctl$TIOCSLCKTRMIOS(r0, 0x5457, &(0x7f0000000180)) r4 = accept$alg(r0, 0x0, 0x0) sendmmsg(r4, &(0x7f0000007f00)=[{{&(0x7f00000056c0)=@can, 0x3000, &(0x7f00000000c0)}}, {{&(0x7f0000005900)=@pppoe={0x18, 0x0, {0x0, @link_local, 'syzkaller0\x00'}}, 0x80, &(0x7f0000007ac0), 0x1a9, &(0x7f0000007b00)}}], 0x3fffffffffffe0d, 0x0) r5 = openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000140)='/dev/sequencer2\x00', 0x80840, 0x0) chown(&(0x7f0000000340)='./file0\x00', 0x0, 0x0) setsockopt$inet6_group_source_req(r5, 0x29, 0x2c, &(0x7f0000000380)={0x31, {{0xa, 0x4e21, 0x400, @remote, 0xfffffffffffffff7}}, {{0xa, 0x4e21, 0x100000001, @mcast2, 0x3}}}, 0x108) r6 = syz_open_dev$sndpcmc(&(0x7f00000000c0)='/dev/snd/pcmC#D#c\x00', 0x0, 0x0) ioctl$ASHMEM_SET_NAME(r6, 0x41007701, &(0x7f0000000100)='syzkaller0\x00') [ 1523.590262] audit: type=1400 audit(1536499021.657:59): avc: denied { map } for pid=15307 comm="sh" path="/bin/dash" dev="sda1" ino=1473 scontext=system_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=system_u:object_r:file_t:s0 tclass=file permissive=1 13:17:01 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r0, &(0x7f0000942000)={0x2, 0x4e20, @multicast1}, 0x10) sendmsg$key(0xffffffffffffffff, &(0x7f0000f56000)={0x0, 0x0, &(0x7f00008feff0)={&(0x7f0000000500)=ANY=[@ANYBLOB="020300090a1500000000000000000000030006190000000002000000e0000001003f00000000000002000100e625aa66dcef85847e479eb3c49000000400000000fd003e"], 0x44}}, 0x0) add_key(&(0x7f0000000080)='logon\x00', &(0x7f0000000100)={0x73, 0x79, 0x7a, 0x1}, &(0x7f0000001240), 0x0, 0xfffffffffffffff8) get_mempolicy(&(0x7f0000000000), &(0x7f00000001c0), 0x1ff, &(0x7f0000fff000/0x1000)=nil, 0x3) setsockopt$sock_int(r0, 0x1, 0x3c, &(0x7f0000d4effc)=0x1, 0x4) connect$inet(r0, &(0x7f0000000000)={0x2, 0x4e20, @dev={0xac, 0x14, 0x14, 0x18}}, 0x10) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f00000001c0)='tunl0\x00', 0x5) sendto$inet(r0, &(0x7f00006d1fd4)="db", 0x1, 0x4000010, &(0x7f00004daff0)={0x2, 0x0, @loopback, [0x0, 0x40020000]}, 0x10) [ 1523.739713] binder_thread_write: 28 callbacks suppressed [ 1523.739728] binder: 15317:15320 IncRefs 0 refcount change on invalid ref 4 ret -22 [ 1523.753405] binder_thread_write: 9 callbacks suppressed [ 1523.753418] binder: 15317:15320 BC_INCREFS_DONE u0000000000000000 no match 13:17:01 executing program 7: r0 = openat$cuse(0xffffffffffffff9c, &(0x7f0000000080)='/dev/cuse\x00', 0x2, 0x0) clone(0x1002102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000640), 0xffffffffffffffff) r1 = getpid() sched_setscheduler(r1, 0x5, &(0x7f0000000000)) write$FUSE_NOTIFY_DELETE(r0, &(0x7f0000000040)={0x29, 0x6, 0xa00000000000000}, 0x29) [ 1523.851996] binder: 15317:15320 IncRefs 0 refcount change on invalid ref 0 ret -22 13:17:02 executing program 3: perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000200)={0x26, 'hash\x00', 0x0, 0x0, 'sha1\x00'}, 0x58) r1 = accept$alg(r0, 0x0, 0x0) sendmmsg(r1, &(0x7f0000007f00)=[{{&(0x7f00000056c0)=@can, 0x3000, &(0x7f00000000c0)}}, {{&(0x7f0000005900)=@pppoe={0x18, 0x0, {0x0, @link_local, 'syzkaller0\x00'}}, 0x80, &(0x7f0000007ac0), 0x1a9, &(0x7f0000007b00)}}], 0x3fffffffffffe0d, 0x0) r2 = openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000140)='/dev/sequencer2\x00', 0x80840, 0x0) statx(r2, &(0x7f0000000180)='./file0\x00', 0x1d00, 0x10, &(0x7f0000000380)) chown(&(0x7f0000000340)='./file0\x00', 0x0, 0x0) r3 = syz_open_dev$sndpcmc(&(0x7f00000000c0)='/dev/snd/pcmC#D#c\x00', 0x0, 0x0) ioctl$ASHMEM_SET_NAME(r3, 0x41007701, &(0x7f0000000100)='syzkaller0\x00') 13:17:02 executing program 1: r0 = socket$netlink(0x10, 0x3, 0x8000000004) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_TCP_CONGESTION(r1, 0x6, 0xd, &(0x7f0000000180)='vegas\x00', 0x6) bind$inet6(r1, &(0x7f00001fefe4)={0xa, 0x4e22}, 0x1c) sendto$inet6(r1, &(0x7f0000000100), 0x8d2d601e8976aa5, 0x20000004, &(0x7f000031e000)={0xa, 0x4e22}, 0x1c) writev(r0, &(0x7f0000000100)=[{&(0x7f0000000000)="580000001400192340834b80040d8c560a067f0768ff81004e220000000058000b4824ca944f64009400050028925aa8000000000000008000f0fffeffff09000000fff5dd00000010000100000c0900fcff0000040e05a5", 0x58}], 0x1) 13:17:02 executing program 4: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = gettid() perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff7fffffffffff}, 0x0, 0x0, 0xffffffffffffffff, 0x0) fcntl$setown(r0, 0x8, r1) bind$inet6(r0, &(0x7f0000807fe4)={0xa, 0x4e22}, 0x1c) sendto$inet6(r0, &(0x7f0000000380), 0x0, 0x200408d4, &(0x7f000072e000)={0xa, 0x4e22, 0x0, @loopback}, 0x1c) sendto$inet6(r0, &(0x7f0000ad6fad)='\x00', 0x1, 0x3fffffd, &(0x7f0000254000)={0xa, 0x0, 0x0, @loopback}, 0x1c) 13:17:02 executing program 5: r0 = syz_open_dev$binder(&(0x7f00000021c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000002340)={0x34, 0x0, &(0x7f0000002240)=[@request_death={0x400c630e, 0x4, 0x4}, @increfs={0x40046304, 0x4}, @increfs_done={0x40106308, 0x0, 0x3}, @increfs], 0x77, 0x1000000, &(0x7f00000022c0)="b3cd0976d8e2af743c6f523efe14fd20c3c3dd2572734282a761e1b4304e2599c85f198cc82bd5d0c74c4edca2f9ea7b875ff7047ec0784fbb354e15fd3f7d837f533597d5082692a6f2fb748da3cc4157188f7f2a5477ded56f72f5b75c96872db429e44b8fcd781d96dead77a0b58b7af9085a208a22"}) 13:17:02 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r0, &(0x7f0000942000)={0x2, 0x4e20, @multicast1}, 0x10) sendmsg$key(0xffffffffffffffff, &(0x7f0000f56000)={0x0, 0x0, &(0x7f00008feff0)={&(0x7f0000000500)=ANY=[@ANYBLOB="020300090a1500000000000000000000030006190000000002000000e0000001003f00000000000002000100e625aa66dcef85847e479eb3c49000000400000000fd003e"], 0x44}}, 0x0) add_key(&(0x7f0000000080)='logon\x00', &(0x7f0000000100)={0x73, 0x79, 0x7a, 0x1}, &(0x7f0000001240), 0x0, 0xfffffffffffffff8) get_mempolicy(&(0x7f0000000000), &(0x7f00000001c0), 0x1ff, &(0x7f0000fff000/0x1000)=nil, 0x3) setsockopt$sock_int(r0, 0x1, 0x3c, &(0x7f0000d4effc)=0x1, 0x4) connect$inet(r0, &(0x7f0000000000)={0x2, 0x4e20, @dev={0xac, 0x14, 0x14, 0x18}}, 0x10) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f00000001c0)='tunl0\x00', 0x5) sendto$inet(r0, &(0x7f00006d1fd4)="db", 0x1, 0x4000010, &(0x7f00004daff0)={0x2, 0x0, @loopback, [0x0, 0x4002]}, 0x10) 13:17:02 executing program 6: clone(0x802102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000040), 0xffffffffffffffff) r0 = syz_open_dev$sndtimer(&(0x7f0000000000)='/dev/snd/timer\x00', 0x0, 0x0) r1 = getpid() sched_setscheduler(r1, 0x5, &(0x7f0000000200)) ioctl$SNDRV_TIMER_IOCTL_GPARAMS(r0, 0x40485404, &(0x7f0000000240)={{}, 0x0, 0x2000000000000000, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x300]}) 13:17:02 executing program 0: perf_event_open(&(0x7f0000000040)={0x2, 0x70, 0x3e5}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f00000021c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000002340)={0xb5, 0x4800000000000000, &(0x7f00000000c0)=ANY=[@ANYBLOB="0463044000000000b6a571ac965f26c50d500dae115e59afcd8a338d8b2727193c56d4ebef60c214b766ffde6cff6ceef2baa2594a53a0117e77afd5d58e8a35afdae81b258585ce769507333c0238790d5ed750bf1d6ca2a873050056528fce7becfd12f165ac43a826d3462822ff8f29ea992d4e208847cf4fc10ca00b87b5ce2523fa477bad0be1c97e4398aa2ac81d973b5a871d8e0b295e436cd8415f19088c6c82c85f4ed1fac41da062bc6dbfb8eac4276c"], 0x0, 0x0, &(0x7f00000022c0)}) 13:17:02 executing program 7: r0 = openat$cuse(0xffffffffffffff9c, &(0x7f0000000080)='/dev/cuse\x00', 0x2, 0x0) clone(0x1002102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000640), 0xffffffffffffffff) r1 = getpid() sched_setscheduler(r1, 0x5, &(0x7f0000000000)) write$FUSE_NOTIFY_DELETE(r0, &(0x7f0000000040)={0x29, 0x6, 0x400000000000000}, 0x29) 13:17:02 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r0, &(0x7f0000942000)={0x2, 0x4e20, @multicast1}, 0x10) sendmsg$key(0xffffffffffffffff, &(0x7f0000f56000)={0x0, 0x0, &(0x7f00008feff0)={&(0x7f0000000500)=ANY=[@ANYBLOB="020300090a1500000000000000000000030006190000000002000000e0000001003f00000000000002000100e625aa66dcef85847e479eb3c49000000400000000fd003e"], 0x44}}, 0x0) add_key(&(0x7f0000000080)='logon\x00', &(0x7f0000000100)={0x73, 0x79, 0x7a, 0x1}, &(0x7f0000001240), 0x0, 0xfffffffffffffff8) get_mempolicy(&(0x7f0000000000), &(0x7f00000001c0), 0x1ff, &(0x7f0000fff000/0x1000)=nil, 0x3) setsockopt$sock_int(r0, 0x1, 0x3c, &(0x7f0000d4effc)=0x1, 0x4) connect$inet(r0, &(0x7f0000000000)={0x2, 0x4e20, @dev={0xac, 0x14, 0x14, 0x18}}, 0x10) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f00000001c0)='tunl0\x00', 0x5) sendto$inet(r0, &(0x7f00006d1fd4)="db", 0x1, 0x4000010, &(0x7f00004daff0)={0x2, 0x0, @loopback, [0x0, 0x1f4]}, 0x10) 13:17:02 executing program 6: clone(0x802102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000040), 0xffffffffffffffff) r0 = syz_open_dev$sndtimer(&(0x7f0000000000)='/dev/snd/timer\x00', 0x0, 0x0) r1 = getpid() sched_setscheduler(r1, 0x5, &(0x7f0000000200)) ioctl$SNDRV_TIMER_IOCTL_GPARAMS(r0, 0x40485404, &(0x7f0000000240)={{}, 0x0, 0x2000000000000000, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3]}) 13:17:02 executing program 7: r0 = openat$cuse(0xffffffffffffff9c, &(0x7f0000000080)='/dev/cuse\x00', 0x2, 0x0) clone(0x1002102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000640), 0xffffffffffffffff) r1 = getpid() sched_setscheduler(r1, 0x5, &(0x7f0000000000)) write$FUSE_NOTIFY_DELETE(r0, &(0x7f0000000040)={0x29, 0x6, 0x40000}, 0x29) [ 1524.303317] binder: 15353:15367 IncRefs 0 refcount change on invalid ref 4 ret -22 13:17:02 executing program 3: perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000180)={0x26, 'hash\x00', 0x0, 0x0, 'sha3-256\x00'}, 0x58) r1 = accept$alg(r0, 0x0, 0x0) socketpair(0xa, 0x80001, 0x8f6, &(0x7f0000000200)={0xffffffffffffffff}) setsockopt$inet6_MCAST_MSFILTER(r2, 0x29, 0x30, &(0x7f0000000240)={0x100000001, {{0xa, 0x4e21, 0x40, @local, 0x6}}, 0x1, 0x8, [{{0xa, 0x4e24, 0x0, @mcast2, 0x8}}, {{0xa, 0x4e20, 0x952, @remote, 0x20}}, {{0xa, 0x4e20, 0x8, @local}}, {{0xa, 0x4e23, 0x9, @dev={0xfe, 0x80, [], 0x10}, 0x80}}, {{0xa, 0x4e20, 0x1, @empty, 0xb4}}, {{0xa, 0x4e24, 0x7, @empty, 0xf7}}, {{0xa, 0x4e20, 0x7fff, @loopback, 0xb6}}, {{0xa, 0x4e22, 0x5, @loopback, 0x2}}]}, 0x490) sendmmsg(r1, &(0x7f0000007f00)=[{{&(0x7f00000056c0)=@can, 0x3000, &(0x7f00000000c0)}}, {{&(0x7f0000005900)=@pppoe={0x18, 0x0, {0x0, @link_local, 'syzkaller0\x00'}}, 0x80, &(0x7f0000007ac0), 0x1a9, &(0x7f0000007b00)}}], 0x3fffffffffffe0d, 0x0) openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000140)='/dev/sequencer2\x00', 0x80840, 0x0) r3 = syz_open_dev$sndpcmc(&(0x7f00000000c0)='/dev/snd/pcmC#D#c\x00', 0x0, 0x0) ioctl$ASHMEM_SET_NAME(r3, 0x41007701, &(0x7f0000000100)='syzkaller0\x00') 13:17:02 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r0, &(0x7f0000942000)={0x2, 0x4e20, @multicast1}, 0x10) sendmsg$key(0xffffffffffffffff, &(0x7f0000f56000)={0x0, 0x0, &(0x7f00008feff0)={&(0x7f0000000500)=ANY=[@ANYBLOB="020300090a1500000000000000000000030006190000000002000000e0000001003f00000000000002000100e625aa66dcef85847e479eb3c49000000400000000fd003e"], 0x44}}, 0x0) add_key(&(0x7f0000000080)='logon\x00', &(0x7f0000000100)={0x73, 0x79, 0x7a, 0x1}, &(0x7f0000001240), 0x0, 0xfffffffffffffff8) get_mempolicy(&(0x7f0000000000), &(0x7f00000001c0), 0x1ff, &(0x7f0000fff000/0x1000)=nil, 0x3) setsockopt$sock_int(r0, 0x1, 0x3c, &(0x7f0000d4effc)=0x1, 0x4) connect$inet(r0, &(0x7f0000000000)={0x2, 0x4e20, @dev={0xac, 0x14, 0x14, 0x18}}, 0x10) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f00000001c0)='tunl0\x00', 0x5) sendto$inet(r0, &(0x7f00006d1fd4)="db", 0x1, 0x4000010, &(0x7f00004daff0)={0x2, 0x0, @loopback, [0x0, 0xffffffa6]}, 0x10) [ 1524.424351] binder: 15353:15367 BC_INCREFS_DONE u0000000000000000 no match 13:17:02 executing program 5: r0 = syz_open_dev$binder(&(0x7f00000021c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000002340)={0x34, 0x0, &(0x7f0000002240)=[@request_death={0x400c630e, 0x4, 0x4}, @increfs={0x40046304, 0x4}, @increfs_done={0x40106308, 0x0, 0x3}, @increfs], 0x77, 0xa0008000, &(0x7f00000022c0)="b3cd0976d8e2af743c6f523efe14fd20c3c3dd2572734282a761e1b4304e2599c85f198cc82bd5d0c74c4edca2f9ea7b875ff7047ec0784fbb354e15fd3f7d837f533597d5082692a6f2fb748da3cc4157188f7f2a5477ded56f72f5b75c96872db429e44b8fcd781d96dead77a0b58b7af9085a208a22"}) [ 1524.480083] binder: 15353:15367 IncRefs 0 refcount change on invalid ref 0 ret -22 13:17:02 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r0, &(0x7f0000942000)={0x2, 0x4e20, @multicast1}, 0x10) sendmsg$key(0xffffffffffffffff, &(0x7f0000f56000)={0x0, 0x0, &(0x7f00008feff0)={&(0x7f0000000500)=ANY=[@ANYBLOB="020300090a1500000000000000000000030006190000000002000000e0000001003f00000000000002000100e625aa66dcef85847e479eb3c49000000400000000fd003e"], 0x44}}, 0x0) add_key(&(0x7f0000000080)='logon\x00', &(0x7f0000000100)={0x73, 0x79, 0x7a, 0x1}, &(0x7f0000001240), 0x0, 0xfffffffffffffff8) get_mempolicy(&(0x7f0000000000), &(0x7f00000001c0), 0x1ff, &(0x7f0000fff000/0x1000)=nil, 0x3) setsockopt$sock_int(r0, 0x1, 0x3c, &(0x7f0000d4effc)=0x1, 0x4) connect$inet(r0, &(0x7f0000000000)={0x2, 0x4e20, @dev={0xac, 0x14, 0x14, 0x18}}, 0x10) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f00000001c0)='tunl0\x00', 0x5) sendto$inet(r0, &(0x7f00006d1fd4)="db", 0x1, 0x4000010, &(0x7f00004daff0)={0x2, 0x0, @loopback, [0x0, 0x8055000000000000]}, 0x10) [ 1524.609578] binder: 15396:15397 IncRefs 0 refcount change on invalid ref 4 ret -22 13:17:02 executing program 6: clone(0x802102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000040), 0xffffffffffffffff) r0 = syz_open_dev$sndtimer(&(0x7f0000000000)='/dev/snd/timer\x00', 0x0, 0x0) r1 = getpid() sched_setscheduler(r1, 0x5, &(0x7f0000000200)) ioctl$SNDRV_TIMER_IOCTL_GPARAMS(r0, 0x40485404, &(0x7f0000000240)={{}, 0x0, 0x2000000000000000, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x100000000000000]}) 13:17:02 executing program 7: r0 = openat$cuse(0xffffffffffffff9c, &(0x7f0000000080)='/dev/cuse\x00', 0x2, 0x0) clone(0x1002102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000640), 0xffffffffffffffff) r1 = getpid() sched_setscheduler(r1, 0x5, &(0x7f0000000000)) write$FUSE_NOTIFY_DELETE(r0, &(0x7f0000000040)={0x29, 0x6, 0x2000000}, 0x29) [ 1524.649448] binder: 15396:15397 BC_INCREFS_DONE u0000000000000000 no match [ 1524.673586] binder: 15396:15397 IncRefs 0 refcount change on invalid ref 0 ret -22 13:17:03 executing program 1: r0 = socket$netlink(0x10, 0x3, 0x8000000004) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_TCP_CONGESTION(r1, 0x6, 0xd, &(0x7f0000000180)='vegas\x00', 0x6) bind$inet6(r1, &(0x7f00001fefe4)={0xa, 0x4e22}, 0x1c) sendto$inet6(r1, &(0x7f0000000100), 0x8d2d601e8976aa5, 0x20000004, &(0x7f000031e000)={0xa, 0x4e22}, 0x1c) writev(r0, &(0x7f0000000100)=[{&(0x7f0000000000)="580000001400192340834b80040d8c560a067f7c2aff81004e220000000058000b4824ca944f64009400050028925aa8000000000000008000f0fffeffff09000000fff5dd00000010000100000c0900fcff0000040e05a5", 0x58}], 0x1) 13:17:03 executing program 5: r0 = syz_open_dev$binder(&(0x7f00000021c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000002340)={0x34, 0x0, &(0x7f0000002240)=[@request_death={0x400c630e, 0x4, 0x4}, @increfs={0x40046304, 0x4}, @increfs_done={0x40106308, 0x0, 0x3}, @increfs], 0x77, 0x6000000, &(0x7f00000022c0)="b3cd0976d8e2af743c6f523efe14fd20c3c3dd2572734282a761e1b4304e2599c85f198cc82bd5d0c74c4edca2f9ea7b875ff7047ec0784fbb354e15fd3f7d837f533597d5082692a6f2fb748da3cc4157188f7f2a5477ded56f72f5b75c96872db429e44b8fcd781d96dead77a0b58b7af9085a208a22"}) 13:17:03 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r0, &(0x7f0000942000)={0x2, 0x4e20, @multicast1}, 0x10) sendmsg$key(0xffffffffffffffff, &(0x7f0000f56000)={0x0, 0x0, &(0x7f00008feff0)={&(0x7f0000000500)=ANY=[@ANYBLOB="020300090a1500000000000000000000030006190000000002000000e0000001003f00000000000002000100e625aa66dcef85847e479eb3c49000000400000000fd003e"], 0x44}}, 0x0) add_key(&(0x7f0000000080)='logon\x00', &(0x7f0000000100)={0x73, 0x79, 0x7a, 0x1}, &(0x7f0000001240), 0x0, 0xfffffffffffffff8) get_mempolicy(&(0x7f0000000000), &(0x7f00000001c0), 0x1ff, &(0x7f0000fff000/0x1000)=nil, 0x3) setsockopt$sock_int(r0, 0x1, 0x3c, &(0x7f0000d4effc)=0x1, 0x4) connect$inet(r0, &(0x7f0000000000)={0x2, 0x4e20, @dev={0xac, 0x14, 0x14, 0x18}}, 0x10) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f00000001c0)='tunl0\x00', 0x5) sendto$inet(r0, &(0x7f00006d1fd4)="db", 0x1, 0x4000010, &(0x7f00004daff0)={0x2, 0x0, @loopback, [0x0, 0x3f00000000000000]}, 0x10) 13:17:03 executing program 3: perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000200)={0x26, 'hash\x00', 0x0, 0x0, 'sha1\x00'}, 0x58) r1 = accept$alg(r0, 0x0, 0x0) sendmmsg(r1, &(0x7f0000007f00)=[{{&(0x7f00000056c0)=@can, 0x3000, &(0x7f00000000c0)}}, {{&(0x7f0000005900)=@pppoe={0x18, 0x0, {0x0, @link_local, 'syzkaller0\x00'}}, 0x80, &(0x7f0000007ac0), 0x1a9, &(0x7f0000007b00)}}], 0x3fffffffffffe0d, 0x0) r2 = openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000140)='/dev/sequencer2\x00', 0x80840, 0x0) chown(&(0x7f0000000340)='./file0\x00', 0x0, 0x0) r3 = syz_open_dev$sndpcmc(&(0x7f00000000c0)='/dev/snd/pcmC#D#c\x00', 0x0, 0x0) ioctl$sock_SIOCINQ(r2, 0x541b, &(0x7f0000000180)) ioctl$ASHMEM_SET_NAME(r3, 0x41007701, &(0x7f0000000100)='syzkaller0\x00') 13:17:03 executing program 7: r0 = openat$cuse(0xffffffffffffff9c, &(0x7f0000000080)='/dev/cuse\x00', 0x2, 0x0) clone(0x1002102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000640), 0xffffffffffffffff) r1 = getpid() sched_setscheduler(r1, 0x5, &(0x7f0000000000)) write$FUSE_NOTIFY_DELETE(r0, &(0x7f0000000040)={0x29, 0x6, 0x1000000}, 0x29) 13:17:03 executing program 0: perf_event_open(&(0x7f0000000040)={0x2, 0x70, 0x3e5}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f00000021c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000002340)={0xb5, 0xa0008000, &(0x7f00000000c0)=ANY=[@ANYBLOB="0463044000000000b6a571ac965f26c50d500dae115e59afcd8a338d8b2727193c56d4ebef60c214b766ffde6cff6ceef2baa2594a53a0117e77afd5d58e8a35afdae81b258585ce769507333c0238790d5ed750bf1d6ca2a873050056528fce7becfd12f165ac43a826d3462822ff8f29ea992d4e208847cf4fc10ca00b87b5ce2523fa477bad0be1c97e4398aa2ac81d973b5a871d8e0b295e436cd8415f19088c6c82c85f4ed1fac41da062bc6dbfb8eac4276c"], 0x0, 0x0, &(0x7f00000022c0)}) 13:17:03 executing program 6: clone(0x802102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000040), 0xffffffffffffffff) r0 = syz_open_dev$sndtimer(&(0x7f0000000000)='/dev/snd/timer\x00', 0x0, 0x0) r1 = getpid() sched_setscheduler(r1, 0x5, &(0x7f0000000200)) ioctl$SNDRV_TIMER_IOCTL_GPARAMS(r0, 0x40485404, &(0x7f0000000240)={{}, 0x0, 0x2000000000000000, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x300000000000000]}) 13:17:03 executing program 4: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = gettid() perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x3e5}, 0x0, 0x0, 0xffffffffffffffff, 0x0) fcntl$setown(r0, 0x8, r1) bind$inet6(r0, &(0x7f0000807fe4)={0xa, 0x4e22}, 0x1c) sendto$inet6(r0, &(0x7f0000000380), 0x0, 0x200408d4, &(0x7f000072e000)={0xa, 0x4e22, 0x0, @loopback}, 0x1c) sendto$inet6(r0, &(0x7f0000ad6fad)='\x00', 0x1, 0x3fffffd, &(0x7f0000254000)={0xa, 0x0, 0x0, @loopback}, 0x1c) 13:17:03 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r0, &(0x7f0000942000)={0x2, 0x4e20, @multicast1}, 0x10) sendmsg$key(0xffffffffffffffff, &(0x7f0000f56000)={0x0, 0x0, &(0x7f00008feff0)={&(0x7f0000000500)=ANY=[@ANYBLOB="020300090a1500000000000000000000030006190000000002000000e0000001003f00000000000002000100e625aa66dcef85847e479eb3c49000000400000000fd003e"], 0x44}}, 0x0) add_key(&(0x7f0000000080)='logon\x00', &(0x7f0000000100)={0x73, 0x79, 0x7a, 0x1}, &(0x7f0000001240), 0x0, 0xfffffffffffffff8) get_mempolicy(&(0x7f0000000000), &(0x7f00000001c0), 0x1ff, &(0x7f0000fff000/0x1000)=nil, 0x3) setsockopt$sock_int(r0, 0x1, 0x3c, &(0x7f0000d4effc)=0x1, 0x4) connect$inet(r0, &(0x7f0000000000)={0x2, 0x4e20, @dev={0xac, 0x14, 0x14, 0x18}}, 0x10) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f00000001c0)='tunl0\x00', 0x5) sendto$inet(r0, &(0x7f00006d1fd4)="db", 0x1, 0x4000010, &(0x7f00004daff0)={0x2, 0x0, @loopback, [0x0, 0xe8030000]}, 0x10) [ 1525.023941] binder: 15428:15438 IncRefs 0 refcount change on invalid ref 4 ret -22 [ 1525.116050] binder: 15428:15438 BC_INCREFS_DONE u0000000000000000 no match [ 1525.148949] binder: 15428:15438 IncRefs 0 refcount change on invalid ref 0 ret -22 13:17:03 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r0, &(0x7f0000942000)={0x2, 0x4e20, @multicast1}, 0x10) sendmsg$key(0xffffffffffffffff, &(0x7f0000f56000)={0x0, 0x0, &(0x7f00008feff0)={&(0x7f0000000500)=ANY=[@ANYBLOB="020300090a1500000000000000000000030006190000000002000000e0000001003f00000000000002000100e625aa66dcef85847e479eb3c49000000400000000fd003e"], 0x44}}, 0x0) add_key(&(0x7f0000000080)='logon\x00', &(0x7f0000000100)={0x73, 0x79, 0x7a, 0x1}, &(0x7f0000001240), 0x0, 0xfffffffffffffff8) get_mempolicy(&(0x7f0000000000), &(0x7f00000001c0), 0x1ff, &(0x7f0000fff000/0x1000)=nil, 0x3) setsockopt$sock_int(r0, 0x1, 0x3c, &(0x7f0000d4effc)=0x1, 0x4) connect$inet(r0, &(0x7f0000000000)={0x2, 0x4e20, @dev={0xac, 0x14, 0x14, 0x18}}, 0x10) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f00000001c0)='tunl0\x00', 0x5) sendto$inet(r0, &(0x7f00006d1fd4)="db", 0x1, 0x4000010, &(0x7f00004daff0)={0x2, 0x0, @loopback, [0x0, 0xa000000]}, 0x10) 13:17:03 executing program 5: r0 = syz_open_dev$binder(&(0x7f00000021c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000002340)={0x34, 0x0, &(0x7f0000002240)=[@request_death={0x400c630e, 0x4, 0x4}, @increfs={0x40046304, 0x4}, @increfs_done={0x40106308, 0x0, 0x3}, @increfs], 0x77, 0x4c000000, &(0x7f00000022c0)="b3cd0976d8e2af743c6f523efe14fd20c3c3dd2572734282a761e1b4304e2599c85f198cc82bd5d0c74c4edca2f9ea7b875ff7047ec0784fbb354e15fd3f7d837f533597d5082692a6f2fb748da3cc4157188f7f2a5477ded56f72f5b75c96872db429e44b8fcd781d96dead77a0b58b7af9085a208a22"}) 13:17:03 executing program 6: clone(0x802102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000040), 0xffffffffffffffff) r0 = syz_open_dev$sndtimer(&(0x7f0000000000)='/dev/snd/timer\x00', 0x0, 0x0) r1 = getpid() sched_setscheduler(r1, 0x5, &(0x7f0000000200)) ioctl$SNDRV_TIMER_IOCTL_GPARAMS(r0, 0x40485404, &(0x7f0000000240)={{}, 0x0, 0x2000000000000000, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1000000]}) 13:17:03 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r0, &(0x7f0000942000)={0x2, 0x4e20, @multicast1}, 0x10) sendmsg$key(0xffffffffffffffff, &(0x7f0000f56000)={0x0, 0x0, &(0x7f00008feff0)={&(0x7f0000000500)=ANY=[@ANYBLOB="020300090a1500000000000000000000030006190000000002000000e0000001003f00000000000002000100e625aa66dcef85847e479eb3c49000000400000000fd003e"], 0x44}}, 0x0) add_key(&(0x7f0000000080)='logon\x00', &(0x7f0000000100)={0x73, 0x79, 0x7a, 0x1}, &(0x7f0000001240), 0x0, 0xfffffffffffffff8) get_mempolicy(&(0x7f0000000000), &(0x7f00000001c0), 0x1ff, &(0x7f0000fff000/0x1000)=nil, 0x3) setsockopt$sock_int(r0, 0x1, 0x3c, &(0x7f0000d4effc)=0x1, 0x4) connect$inet(r0, &(0x7f0000000000)={0x2, 0x4e20, @dev={0xac, 0x14, 0x14, 0x18}}, 0x10) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f00000001c0)='tunl0\x00', 0x5) sendto$inet(r0, &(0x7f00006d1fd4)="db", 0x1, 0x4000010, &(0x7f00004daff0)={0x2, 0x0, @loopback, [0x0, 0xe803]}, 0x10) 13:17:03 executing program 3: perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000200)={0x26, 'hash\x00', 0x0, 0x0, 'sha1\x00'}, 0x58) r1 = accept$alg(r0, 0x0, 0x0) r2 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000180)='/dev/vcs\x00', 0x4000, 0x0) write$FUSE_IOCTL(r2, &(0x7f00000001c0)={0x20, 0x0, 0x3, {0x9, 0x4, 0x53, 0x9988}}, 0x20) syz_mount_image$nfs4(&(0x7f0000000280)='nfs4\x00', &(0x7f0000000300)='./file0\x00', 0x1, 0x7, &(0x7f0000002700)=[{&(0x7f0000000480)="c3905774e5255637062798e3fb37b5c985aaeb6684ba8c4245cd8294c9a58d86754e4e6e5bf16569e0cf5d770b0606a656984a68c8ddcef030cca7abd28fa0b8c837b6a74c4707a1b500be07dedfbc2894ca2844fff9fc0d4359e9c06012777db19fd7ea3ff0c1c425cf5610f496e964ede8aa43e333060748f13e80893a4273b75761b2c3fcb0022723bd2c5c4762395bf502324cab9e373db4b1a2089e9529888b4d5f28806039d1f3118731436155c5d8a3208bad7212f57a580b667c81956ee55e444b88b694bba0510bcb3d8034a84e2c58d3908eaf7b92dac0ce4b9572856ba72c5ee034075949d0e387b62a230e3771e3694308c2755dae3714c0636ad6584d931b1496bf53492a936b3d32ee8df788e469ca442c50ec39c10ea6ffab4314b750316f7de883c3a38c9a27de2f9a5ba03f3b15baf76e8cdee2051c0789110090f64388dd9fd217a98922a59abb428581af40d25758fbd7150e36595e9af91ae55b76131ca66ea14379b0f01522c660ebdc762141399849947b5e2094d223cf42e47c81b319914a2d2a4ec5846d611ae8c582ec7aac6d2dc8da2a9ab6722691aa726347504ac954fb83d7a068860f62ee2f64fb693227a632cf3884f6e0983f060cbd5c9efe464be8f66cc6b6600a11b69990058830ed1f2146a2da476db100415384ce19942ba24dea332b48e3914f05bf2c735d85bb7003419c44108551697581a5dba652c7ba9fb2df8e7c84543a503d034fc354e055ca9aaa5e24ca655800419bbe3cc1b7e750b4eb5f5d6a68a97d754a55f89a81ae8898ed21406170be1f81a8269ffc5f961c2bbd6dac450b54f588206ece0971f05c542ed14b5e4c99f967d597095d7f94ba1146ec23e445e480691502566273f1360c1e3d778a7114cf46cedc8b2209f6c09f8264c6ea6b6d380ac14b72e3e638f600baef7d4da417c2350c898d30ad2c35a7bae7c34a3d4fd6a96b605493a3b2145c954f1d1926e64c2d2025bf8f027db7276621e9e3c94382e940c363e6ef85cc7231ae3a6db76cc47a964008b053ab4c7e8e0413a263b3328eff23055649dd445588c954d16edeaf2e408cad2f78cdf73485fd9ad65df58a002f18ee9ccd1fc5052e6024ea6ab37f9cc5bae47ff4326195d82b92cd1891b1d3d1296db75391a71fff81d1e2d510d5db557e5d52e45291104e17454f99e1a188c5b1e8145a0ece31ec21d7839e59e8109db72e21529b83c79161bfd955d47e633119c45a49b955c9b8469766f8fc35b2d993ead926167ed134fd6c11e611530b5b88d3f9aee7d8c6bc89eed7eafb647b939feb44fa90c218a555aabfd225c7020763e18907c23b6c001881bc6523aa4cbd8806c335e72bc44cab71e37a11c3c34f625e58d897f91547faf40cb30c27ff6af3ddf4311daf1b37b61b9b88a031466610ed75dd1c85771844773a340d2596d54f6eceaa44601cf5f15063335d0e1429a9bfd4d5ab9c2fb97bde32156401475cce1635e8b51631cce4c12ffc204c0fa14eead19e167803701f9943cd5ae535a1eabd9959a07bdb4a48646232dbd0024fb30319c2e8942d545f9d96b80f6347646c03b0cef9c0adc069a52cbeee96ec60600b0f771c362e26b62c2531551519226ddb7b419a6d402815b0000f75727f07d22e6c88aeaf6bf2755fdccf0592fc31fb853390cb12953369cff92ce08485ea61a85c3557e4f1e9f1b3f659cc8c9c9a11c0611dc1d4815823fcc7a0e58dc04f14ea7ab56bf44902c335e2f7495791a0da84684e99367b7a0de56079eb16e94bdcd7c42d271d6a0ab403c0b24bd53ed0f3409aa112c33f5edc8fb58a0ab790f62ae21280bfa0f66b120a764a808b2e3ae938c1528cd20251a25fa876984d420bc0b506bab42848e00652789bc09ae250a9fe3e7cea94070784c1fcf6ffe9e459a74107769ef604a59f19d341e209108efce27ce6ba1c192aee35fb8b4310935f5308d0d094ffee0ee4530fdf3d8a5ca645df0041d8b20e5ab88345b7e229e74290242f0de9b96cc2faf88611e551c8fe652413be1abefd8337c4f8be708e57ad1a0fdf415efcffb60bec6e5314f1223d1983fbf8b91f7552a9ca08cbd72fbeb65f6c0a1a738b8cc7f08af5c4d69766543aee1190333d29466ed41cf34a55b31a74d4324f2660f30569e5d05cde67aa883721d254f040c2bfb474d6e5794edda2b27d485ddc7fc458e098f4d834577418fdee18faac83eca1dcf584870e44da90994111594ca219fd46ae12b49d98b835e9b5e62369cf5ffefca1db19cd0701f23e1fdc5a0261ad4b7fbef6091c96bf33c775ec4bd6baebf5f5034d304ff633b94ed1b82783ead59409214b5f8d8b6c617688f086e7c5cbd3cf1350302b4d2caa90177e16badb222df3fc509f9c18cbd200297ecf88c504b4265d2a61e1e7a07b017ee7fb5247135d20ce7d0822b8f3c4b1caded8010bbc685b37ab5ce90051834929fa182ee7452b7ecffb5ee1f1522c92daada488b4b4a178f1996a36559f3982a676c0409f309fa64ba322864786ae9fa764fd61bc935cd46211b0e063520b3193572938e12ab372abcea27216e8ee63149b09315ed7e755a739da65f5a6890377a384eef686b0d7bfeccede9fe4b514018fab90c71d27e2a628fdcb86e3950dade20d40d3da1402bc5426ee0cd7f433d8c1ef1e42c089db344801c0ad8ce916daf6abebcc26fd006b4ecebc7e301cf2102345fa853b78f3b197e3add0972d177c42a5ae2fa6d12548af10cb0e9ed6a9cf9469abc2e3a6efeff350898071721307a01dc58d6aa3cefa9f0c6bf1769c5e7d64a1186b7201931b5ac118b51746cc829a72d7f01aa1bc6b16e9e746a69763496bd3cb3d42feaec386de88c933e250c1e8975ef476af99fe027fbbff53055d9665907f3e2267649e0a14b0def4a0be7ee8c3fa61729f4942b525a103a06c8f2d8c1048ae34d37e7b77a5d230cd475a6d2e0e95be25c7714a6b0f72cc49e1771408d7c1183df484f3b3372492ba58894750b60b83cc870cb3020665750f1bb6df01d34e03938e89d8a2ce74cbae89727b359d6ee39ba021cf0d7d5835c68ad82ed4a22fd86e03f285f35c12960ec95d04696fe8138381260665357b650680e2fda0ac750e2da37300617c17cc01dcf5852996ca580e6365e5f90fe648b439e7005376d7b18360a61c2bee039fabc46d17a5e78cee007b22de7be84c85178ecebd088138a3c3e9b40c9b423614f137aee16026afee6a35faff6323f7539b340bcf91715c62a99c0cc460e4675c7a55834591b7d8929b4336e1a72ccda4a2a56b9d57eacfb7c9ced6f49f9f25f387e9958a46bbf88dd9b2a37ada5996245c5f220812b6c2495f9eb80bb5a2641105cc87edd44876f1b7e3402815397eaa415900ee45b2729fdfa1e91e63e36ab78141ae0e083ab478b7053a577b14e45dba119d0d8567fb45cbf0485ba97273ffbec9027cb3c398b58845c2df54d2fcf74c23caedaff937063b65284f0430bb5ffb132dc50be1804f233060c7275088eec134b4b67548d88be2e997aee6babc7332ca14ddac3f43feae83cbf4eae76d33bb9ed5915d9f6dc766f42dbac128b8e3b22e0a1063b7b0df75e831631c6650d4ea9a06424b0be892955925ed4feca369c5af3cacec56fec6057897acd1cbd6def9d9d3e8e7aa234b932e5f90a3bfe2e4ea6f2705102edae9588539eddd87e5cb8bea33015d11f83a8b887629586222ca07ad200a9f70ab38f8f99cbb8b71a1b8166362ec7e538698591b824b3dc617734bffd7e8b14013e53e29e49f4305e70b23106e3b1e51e8e94c3581b2fd4e45b1a5147ecc1c1a25210d3c3bb36a1b3fbde035de0a5374dbd5aa0d3875177864b64fd56b1aa4bb7c048d47182a5669a6cb7ab2f32f9859e413deac0802959b1c367833b0ea54e32b732b03b8a42b3ff082fd0af9e880db17b201a108bf51fc7e7bfd19a33e0146b3f0498dfa92ef3d8ebe63952cabbdd8c6de83e8e993e0343251b0e02030d91664f6f6fb3f1ffd363458a2acaf8f23c4088126ac94c29bd46a81a366f178d0739824c7b60cda79ef44f972b82c308749d29dd20c92d530149bd70339cc93270c0062708688d94c50b5bdff137db17bfcd255d505befd9ff2cd1c0d9aa9f4a456e622dc90fd29770a6aba18b79d2ed380f7dcb3151d843f69f86ef5b99ab5f616dfc19befb05c0b9473a211c71d9083de6485c0c648f055cf2d45896823b353ca6693b9eb364eaf9623a50f50c3b1cc165a5ca577657c0ec021270c29c0fb694dd19b19180383177af9d648164136515029f664735f62179f3fae4cff87acac1991a0f7c4815c914df3ca9fc7075337384cee5672dcffc3aa9c8ad1915a388c3d27e90ee3b010e36922f38665979579b2a146df8da926dab9aa6622b78a5bce67c2b705f2a17eaa0807262078f84e173e3bff18f470ce0331d3f7287dc990e8382847860470af3b80e88671097c179f109f96bc9573d7c5f0b97b6c3bbf6a087ac3d8cd6db18fc875d0c7f5e183909ec8a179503b21a0e859ef542940bcad5dad6a4f62ed03fb0c2535845828baf8c7ee506a4a111909be2d5e7a5031d2bc012f175d7f5c82d362f78744a8ec55a107da63c0af3b367414c7096fa5e73875f1dffb99858a17a981f5cc44377b64de4d51361dd19acb00d25d2c9eebc6e35d51777237339f27c97d575c20e42a0ada2188ef3cae303a99d5f60443a00be2ab0eb33dda366f9c32686976173cc4c1f2917050059517e646ac009f9b27364feb79a526cc4a9832d565ca3ca7711c9f0b37e519c4580eb2f27b2884043fc3b6fa94cb2e848c13865f0b92ef378c54298768ae17ab2f6f9750e36ed299669239552d03069591fbb5710ef9485c271ccae22e10fcea84622f4c6333f7742ee659530436ed69305d169a902d53620d567144f62f4b3d5cf4c3330fa7fc38bd25bce204c751c0f1d2eb655974eb5e8dcee24eb9d384ed623d5922c6301395df52e0faf8edfc3f50ad64ae7e7f81222643160bf6e8bcafaea30e56127a63c1fed2305bf42c13d20d81f6d69445003d660857663cb5fc32fd7c907d98ab9ce68808de5ea5871ba827e47eea2ff89c149363bcaec1680fe2519becabf389908340fcc02a3f630c691e999bfec1a5d7e8b2686da13ca29c8a40a9fa4a74a57989a7f8c94c24c9861089da6a43406ef323cc4717ed33e1b985f669124a0aa81cc1c9e68cb5c49098258fe0807bb9066258fefd28b207cf49e6233a218f2ab8606b13b2789849f1c701dd26e0da546b5918ec263571913f35055da02c1acb64247be0d7e6597c1f77d141cca3ffb4f72e6e41393d5cf2a45d0d5665aab05612ef58994c38ebc97cac525a13cc229897f7097662e27fc39a674d7b714d4c076ed4aa63e3f074b960381f9db19e1a7b47febceab8caf74945975de4268ab504f3bf516f38c5589554127c8f8050f37420ef45d2dea9e5380847cbe35e5893b1396741fcccd9ae8ebd01956d69456da0c0cec8fea4da0d7c7681dd04e9996d5ced43c2af95c6be18afd9cf2a677278a1d0c55db4b2d3ead414053440c473403a45b2932eaef225a170bbeff5939c7bb380bf58868ad91e2614952d3d76262c7c59a1898f4ee9a1572d9b947e551087596760d188b3bdb07e62b6200f8f185b02d87099dca220ca3cc0c4c219e40037acbb9bb1d0095e4f0893cba641d91d876d869195007b8e6a5ff93aef090bd6b8aa9f6e1774632f67fbc56630b4896030558f0b25f0d0b5e7b6b00397ab910bde7a", 0x1000, 0x20}, {&(0x7f0000000340)="9d941460", 0x4, 0x6}, {&(0x7f0000001480)="a79acfbf9b058830cf8be32aef514d1f51877e2c1a4175b9e9a2162387b5ce97b3d8a2d335479778470cd713335b8d8412d8cf964b6db0387bbf58e80381cc9b2f00cf3a8f488e5ffbc02eb25d2aa9cb06fb037415e1d74cbbe50b233eb74d6592107872efbc2d19bfaea338d65945f7eb5db48eb1530d8be13e90054304ff5547b51982327eb4c6d874e7d1534153f2fdef2643f3b7dc3d79a0842cd2f008ca51ffe27904733ffb7ad359caf6fc3ce0f39054abf646bb2b2b2e0adfc97d64985dbe23dfa0b95a87c154d68dd0df8f92282d9639a9df5d292a9a00710a0b81caed", 0xe1, 0x3}, {&(0x7f0000001580)="9464b59bafa8f84c25414726ebb56038d7abd7429fd6b0b9e72ea4071bd6df60b85f99a5f1e6c1f61e038d741da85cedda7fe2f51a47ea99583d50fad86c9b89860b3aae1a902c307a339b3c3a82c209c6941445e7ddbe", 0x57, 0x5c99}, {&(0x7f0000001600)="3ba0e7c06c8566274914d1ed2cb4eab0c42271ae99e2905f9157879171579cae592b13838a2c0f784880b9baa08b71535fdc9f175512d099ec718f46c076d04fdf50d30c02a42f55318f0310829e6045d1d51515f1e9b8bb08d51dc3e244aff14155f230a4ba9d3bd3f67e39b4036fba0d9e7c892bebd31831c467e53b4fc8a7e18b9f2203ef717be43875cef6d1adeed0302f596fde", 0x96, 0x101}, {&(0x7f00000016c0)}, {&(0x7f0000001700)="889d7adb0ee4d6d270f0678e0c49859b6def7e08ebaecf45380f5893de50a7b918373637d2c217b87d3fcd203686e73d84896386ae0cb167c39329816432bc4ec9bf391661092025e9b661caba4080fce661e94c3fd22e5415a40f6f15c9df93995d2b96ce637f6b478459b320a3a1132036e6e41a591dfb40cddbb474bfceeb6a0e8cab99fc4b5afab3d2e1e0e11b3e05b14b7ec85133e797496692382d9c68eaa03038df407f3c362837e3d2a0a732a4ff8fc1d792707e5f8ff72e00bfe1f8e4bc301eb6f50f9d29ba15800c409637ca16adc3b3ac5273b112f2e3f8c280164987a7e21774701d8e58ac258f9e774ba48afd17b62995ce4595c02472834b6ccea20d787bb27bd853bedfc759daa6e4346b167e4e4edf50a6c9bb5d8a492a782bc19b744fa6dafb7343ee221042e804773b16d7f12d49d90d54cd9d00c6190f6a1bc30d660c35dc02c404348ce5fcaa4a4118fddda460b5899f521172b28ca63e2e87d502a00a05ffede7ae45c682c7c13d64466cadc337cae02a4a9ae299c017adaa048d7646f77b23c3f5fc5e592729bb0965173485d1663461ed720d129571a0ed86008b5bf97cac8e4e70f69f12ef7cd0ffa3e9a256d271c81fa33e250d5aee1460ae04475a2f24b169dc9aa171577613b7b0284cac4c83e52804976ca6af1397677e5337c4c711ef92fb4ed451b035f93629d7eb416c6da87f319243a7a0d61a012739c8f514166bd53a636c0428d7772b3c5df72aca9513d1f7fe944420076295b702524f0bb36837e6b635fd915c85025a8bf5a2a255ce8e4414325a7f5c738ca5e7fef6c7de84fcf76fa595d9f0de994bc5c06f8ff62dd610201a8547c41c26e1b377d1a6f02d5f5af74df996bd377283d1e543145880c5ffed7f9bfef875370884664177980061d1811f1e497b3459103fde0a8ba5a52727b8ad22e662d16a6f385a6f88c8fe1c2df309f9f65aed2d582fdf709e8c1ba4174f8a38701a129f622254e9db2c25e9c34552464341d32eb9cb0088270ad82528ab860c80e421acb3fc82465f1e64c60a1fd57158fb915fb9b13bcf0d2ea427c098b6bff1e06dd877a813226aa4517b20d9c4e8a62f97f29497b727840b456b951b5b51c058f52e204cfb20e5df1620118e355f5aceca15410a760461fe9661fa67cc7e85383f9d77cba884fb4e7a5e2cbb5fd6e47d732ab63ab6448c8802f67f42dc7338e769594bc69d132e6ebe86b0b7054ff05e426b75c1041d9b614eb7a8857079ba313286195ecc5886037a9008e7f1f7d615d06664525e749544360028ea918a390d889b65461be0ce90d9310d2362f763fe5fae0fd0ede30edbd971ceb99948287e2fefcd6334df5d853a616a9a174c75d4617f4c265a1fc90677bfcb5d056af4ee4560a500c37babebffd48481d2afc78a4939e139cee97bc10bd7d41cb44612458192ea14aab87b9c7c141e60aaa53cc2df11c219ffe69433c3f4b945e61ed6ba9045f6dbf1e74b36752205368db3c7d40fa6566df847a4cb071ab77e34e573f136486979ce3d15509191afcfb87cb47f6f6875630d14f1a4ceacf0706200acfe7f9a637e30ca5af75e3d5aeb47044ab013a5b742f167a94140b68445fb255652f4fa6dc7100fd10398356ddd8202d640338c110f006fae5591bea43a4271534aa1754e624926521a402d70cd806b7a18a6d46025b6aad7fb67ea5128a9aabb8025416287a193d43c3a34691cb32f055ff1b2c0b2a64937dd4b394eea351545ea0c6a04b367d1b7ca674840ea7b4fe52847559f830a4f205012278d31a3b91199f4b8713ba956b17ade38cade16aba0ff73d9c1c985484496409464a8981ac04f6142331702da13b91c86390c8c2a5fa9e94a11f66319f1245b9dcd8b430d97e981c3a2d9b35865099212398cef8ce00450effaa548dc6cb9775129658eaa5d2158e611898578b9421fee85b558093043f013321ba5b4d6a063f358b53c075d40df33f2b263d747bf625244b9a455f421683604e3cb720d6765929c3a5b083a15ddab58ba93fcbe28b3be7a041126eec67457b004a7d5ae5511c06f4c40b852e372f29afe39e419958217a157779908feeb9a0266a43cf422f3e2b9da956d6137e60b118d0b2d4cb26e53213fe10c2b155170bc6227fd15edcb8f32d274b55c6ec3ad9bbb63d9dffa82204bf02807b7714804885f1fb7318bebadf263263e2ad0ee403df6a8e2ce7ff7ab2e7bf40eef22ceae688d36cbe08a79e8e33e778018a50a8e4ad5710f04f1f8e01fa03b0b98e12262fd70c22f1a70e0662feed302d261973b04a45dc478e8ce95b2d40bca6d3d321aff107019ab7c37d9346cd42ec4c089e7ee2403f1eb4cc26829e56904db6de635a0eaf907a24ed91ad0799e17472b6ad1afd321e1c29ff9146255b70f87aa7e530e65ce84a08cd5a42edd04bd256e61d8d5e0cf01cd0c926bacb7518a69658929358c65e3265a4b065d9d7dceebfdf85962137675408d5761c03cdc6bae94c4f81a11fcb982dd70138d63b03557cc8b9fd306897917561b3b5db23deece024224d352663bd546e4d448f49ae488ddb2aa8b29f2f4f36cc055c9a5932c9e1c83aff3e33fe0c019b8469564913af8fb8dd361d05eee9648d2bad25f8d5da960faaa115524926017188611c3594da48d99949ea6c774a9f8a9aa44459a7301453b590489eda25bb97c323e4aefcb19cf7f663202ea83d3c80370e6c19734d8ad0a9add523df41546ea90f46df300ed5d30890f54435e10356113a6c0057f1c971a6477f8af8d9b3af12379f1001531e0918fdc94dd87c7bf7b5b5986e63501168194f47b95a6a230ffeb21e8beaecb48997bdb9863ada388ac90c002f371ef5433fd3d2e8584dda520f49c1b4517818b401cb2ad0ebae2369ceb189e8a9ffccc233ba47adb37cf28168a889d6b8fd240f5dd220d367fd0575e862bbf8da3e27378b5103065e717e74e792f5f13f4648428943cfe118b922f6cda857771bc4f4a6c4a3589ce74dc61d8058c4715eacb6c0e9666752f038ce23763763aca11beec9122f3bd5df9ff94a59b0e6b84c543f086784fad6bbc215364abae3358dfeee87ee8f468cecb0d4cb1e7af5d41afd9e33b556f4f6242e50e26093030788be110bf2dfad1835dcff19c900179c3d8e0b4d31e09d4bc287669d0a3f785bc6d5264fb909f4cad8904fe98b0c82db5abf58bfd70b8f76d80f2649929d08aed9a1bb17e3966d4a005fc7ca27d095e1a3a9d5a26e2d15e0f4823d7b9824a542bcdc1ffde4e828132ae47b7dacac81c5cb00d5da5f91c747ca9446294c242d928d4f55c692a6988f05cda1c5dbb23a88d79a0dacddac886a6a5746f490fb60bcbc189297c42a539b894690342fa3d36adc888dae94050bf03e5caf79d35b8c936e3ec0e90e1e8ccb0044a70b78058101e53ee71961d4be6b15165bfe96f41a19822e1c69f795c8f8d2cd5d999fa0f406d51da7bbbdfb953576413e00783463cbaea10d48e4dab94e1c25afe9538cc8a7d1c187ba55dd4c1452c56799be1d59bedc51e1c0dd8a8f77717e1f39c0fede651d63dd2cb2d938acf8151076f7e715f628e580025dbc3f6ec83c7dcf48e96c48bdbf74c3a8d8da933b13b5d90493e0edd37d2b7be9ddb81ecaa8314fa33734a695dad528ebbe25f09fa6dc3133451af525ec68ef19975b11a1eda434db6ab0088f31c8ed745c2cd3593e586ac1dbe161a7dcdd4d80a094d0b844b9463e62bfb224c4cc9452ef0b4f49aca06ee5a99c8d5a994ac158eba2bf6d20ee08225d324590824e1ecb3ee1f4c805ba9f6e23fe5b401c76626a74db1cdc939b43919ce5496fca6095adc786d1a1f5b42b41f7281fcbc9c47c5f16887c733c6ebe693ca5c2786571e6bf4c2da976da492620b73979b3c09aa9d981b31ba45c0fb14a94c5a6031b5a4955d8514b3986a469e4a4246c53fbebbbbbf966155ddce03ef1edcb30e3b729456952a2538d291eee625be0f4f6debb77a355f100603a2d7ed91c301e7beeba5d6c87297a9621453b7f1b82fb8bcc1a8e32e0790e80df90674db62075b47e9c4ffaa91e3320d83736d1d40989ba4a59ac83e1a63d331108704b57cd850b7d7f4b6a96819962e5b0417ad3a56c8e44b2b18c7b023623b52a5d0b777f678e20739a6320237d53a34a3a2c4fffcf84f658d0b563bdf7b269db9651a8bcd5f55dc9441ee2ef357423883c3ef2499152025234c0015310284229e3df2551f498597858715b06c6d912b63219e5d01401394e8ff54c172dfe2dd5c12ba1c92eb8aad9fc7e97fcd832004aa6a564be47c42f8551ef2ec134089720440ae8aaf98a0ba7a9b7412edc568bed586355b969d1f1001e201290ce792d02626b3af3b2c68e890154ef6a53c5d7c3eb8c32db0c605dbf97d7fbfe9af8a55b063a5d80905f58e8cd676b8d7123a156885e63ac496b3480fa0c2a07e66f9e9770104e2cc7393f1e02855e74d140e8ea1d142c45a0f236f9691922b54c3194255378af8a4b37637dae7fb27b91dd0ff66d92267c9543f71f9d31ce31d56af7e82594ec587f015dd3cd2ce23707360ad49d72331a54a2d29b49e4a3c3978a2d79b69eeeb47e562e96b513db40acccc8a11f9d7ba2bc9dd32ad134241a73e7b72ad88f4c2b60a64f5819bee730ef33b8bd43e52a0d093b2f1d347149b4d96bdd43ec339aae2e1234c5332966007329ccb2623b22f876c34e8806c04fcd9218b54a4695192821cf43d7bf5a4dcc1798c2433329a4b4b77351386293180b1eafd5891e8041d8ee27ca97057029373811ad0f3faa5ec9e48c4b1494c6cd70db5e13d0487619949ff08489fa4cbe7d950f8e8d09dc01332395f4b6b158766ee51b7e57c329443ab18fac8465e032ad4b7d76dfa47efbab160751e1a08ef8c0fc717d674413b29c2113e0370a365ff152ad922ec9f9ae6612c95b0a57bec31f6a284e8b1fe53fb825d2221e05e0763d367d3a7ee49a445b32b318e0233016017451f715bc971cd330ed017d8df167916e2731f157288f1bb066ff201d7d6ceef3490f4f0efca1fff266f4633c27508f38fce40972de8d2bf020746995348c8628c553b091878d2780c03ba6f951d70696b4cef7643c752d296b1dc3dcfb717bca357e837ee4e2c36d525d5da6fa8fe04d1efa8c3e733e999d1dad2c7634315d4fcf41f11a28555853f033e4cbe5e599d7674b6c43ae2f736680f092aa1ced7cf6b211f0e834cfb409a22ef60ba0c2ca24bcef59d3f60450ab0f4f446c51eecd95f0c88d0a020f8bfa6ef02f491c0c79e4adc7f5c5a7cffbf765a4da43344e3650f145124f081675af41d76d8fb623a46043025baf3c3ae0aa5ccb8b272895c27ecaa28de794249f82a630b75fd5abb7ee745854a7d303b22727fcaebf5c233d0c661f57863370fe1d0e3acc5d0fa47424fe2dacc14206f6a2d4f23e57effae8096666aa986182fb821ec7298d60852942e176734e0d3a49b563eb0ceb2d7c5afe5ddfa786a067e5d368c32782b42c50bf72f2c27898e1fbfe8c7f91cef0af595c1a52d6bfd9216cbbc1d2d045ec34b4870c71a42c4d10cc1ba2783ab50ba377a29cb192016cc64142ba58bffcf7d8f505c905451a8ce977375ada819913bbd16a0a460dda25cee27875a654b4858916ef4300082768cbf418458384e6069ce7c7f87e106bdf3c5ffc8bef9f26f1a1d345df7e4eee404b3a0b93f898c5f61508cfde9ad584e376ec7056e1217b69c5e13ff5aa470ce33f3a96e487d14648a6a8295beb9c786a7f34d6176", 0x1000, 0x8000}], 0x28a0048, &(0x7f00000027c0)=')\x00') sendmmsg(r1, &(0x7f0000007f00)=[{{&(0x7f00000056c0)=@can, 0x3000, &(0x7f00000000c0)}}, {{&(0x7f0000005900)=@pppoe={0x18, 0x0, {0x0, @link_local, 'syzkaller0\x00'}}, 0x80, &(0x7f0000007ac0), 0x1a9, &(0x7f0000007b00)}}], 0x3fffffffffffe0d, 0x0) r3 = openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000140)='/dev/sequencer2\x00', 0x80840, 0x0) r4 = getegid() chown(&(0x7f00000002c0)='./file0\x00', 0x0, r4) r5 = syz_open_dev$sndpcmc(&(0x7f00000000c0)='/dev/snd/pcmC#D#c\x00', 0x0, 0x0) setsockopt$inet6_dccp_buf(r3, 0x21, 0x8d, &(0x7f0000000380)="dce277d30a1b8abc4af9998610505a21154f2f7a7fded0851a32321423a9615eea8ff08f02aa48af4b048ce25177d423c4254e2cfee9bee25939399e7f1289023cecce3b4a2aed639064cf287dfc6a06a41cfd3d6e10ec35b46f31faa4ab921646d13597c9f0e5d963e204d2e8d2eed43fbdb153b27f42792d699cd0f08b34556e9e61603ade75a3d13b4bb90079586381f5960e09ec7c57f3272cfb88067c27ba10735dfd4d1eca9a17ff147d50b316b971b8bc5a5a2d5b3d10c272624a05444203a779bb20ea63f7ef7034aebd2001806f17f2e79876cb08b8b655717d8a96647a2950b66a", 0xe6) ioctl$ASHMEM_SET_NAME(r5, 0x41007701, &(0x7f0000000100)='syzkaller0\x00') [ 1525.368405] binder: 15462:15464 IncRefs 0 refcount change on invalid ref 4 ret -22 [ 1525.392515] binder: 15462:15464 BC_INCREFS_DONE u0000000000000000 no match [ 1525.407373] binder: 15462:15464 IncRefs 0 refcount change on invalid ref 0 ret -22 13:17:03 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r0, &(0x7f0000942000)={0x2, 0x4e20, @multicast1}, 0x10) sendmsg$key(0xffffffffffffffff, &(0x7f0000f56000)={0x0, 0x0, &(0x7f00008feff0)={&(0x7f0000000500)=ANY=[@ANYBLOB="020300090a1500000000000000000000030006190000000002000000e0000001003f00000000000002000100e625aa66dcef85847e479eb3c49000000400000000fd003e"], 0x44}}, 0x0) add_key(&(0x7f0000000080)='logon\x00', &(0x7f0000000100)={0x73, 0x79, 0x7a, 0x1}, &(0x7f0000001240), 0x0, 0xfffffffffffffff8) get_mempolicy(&(0x7f0000000000), &(0x7f00000001c0), 0x1ff, &(0x7f0000fff000/0x1000)=nil, 0x3) setsockopt$sock_int(r0, 0x1, 0x3c, &(0x7f0000d4effc)=0x1, 0x4) connect$inet(r0, &(0x7f0000000000)={0x2, 0x4e20, @dev={0xac, 0x14, 0x14, 0x18}}, 0x10) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f00000001c0)='tunl0\x00', 0x5) sendto$inet(r0, &(0x7f00006d1fd4)="db", 0x1, 0x4000010, &(0x7f00004daff0)={0x2, 0x0, @loopback, [0x0, 0x281400]}, 0x10) 13:17:03 executing program 5: r0 = syz_open_dev$binder(&(0x7f00000021c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000002340)={0x34, 0x0, &(0x7f0000002240)=[@request_death={0x400c630e, 0x4, 0x4}, @increfs={0x40046304, 0x4}, @increfs_done={0x40106308, 0x0, 0x3}, @increfs], 0x77, 0x3f00, &(0x7f00000022c0)="b3cd0976d8e2af743c6f523efe14fd20c3c3dd2572734282a761e1b4304e2599c85f198cc82bd5d0c74c4edca2f9ea7b875ff7047ec0784fbb354e15fd3f7d837f533597d5082692a6f2fb748da3cc4157188f7f2a5477ded56f72f5b75c96872db429e44b8fcd781d96dead77a0b58b7af9085a208a22"}) [ 1525.698032] binder: 15499:15503 BC_INCREFS_DONE u0000000000000000 no match 13:17:03 executing program 1: r0 = socket$netlink(0x10, 0x3, 0x8000000004) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_TCP_CONGESTION(r1, 0x6, 0xd, &(0x7f0000000180)='vegas\x00', 0x6) bind$inet6(r1, &(0x7f00001fefe4)={0xa, 0x4e22}, 0x1c) sendto$inet6(r1, &(0x7f0000000100), 0x8d2d601e8976aa5, 0x20000004, &(0x7f000031e000)={0xa, 0x4e22}, 0x1c) writev(r0, &(0x7f0000000100)=[{&(0x7f0000000000)="580000001400192340834b80040d8c560a067f5881ff81004e220000000058000b4824ca944f64009400050028925aa8000000000000008000f0fffeffff09000000fff5dd00000010000100000c0900fcff0000040e05a5", 0x58}], 0x1) 13:17:03 executing program 7: r0 = openat$cuse(0xffffffffffffff9c, &(0x7f0000000080)='/dev/cuse\x00', 0x2, 0x0) clone(0x1002102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000640), 0xffffffffffffffff) r1 = getpid() sched_setscheduler(r1, 0x5, &(0x7f0000000000)) write$FUSE_NOTIFY_DELETE(r0, &(0x7f0000000040)={0x29, 0x6, 0x4}, 0x29) 13:17:03 executing program 6: clone(0x802102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000040), 0xffffffffffffffff) r0 = syz_open_dev$sndtimer(&(0x7f0000000000)='/dev/snd/timer\x00', 0x0, 0x0) r1 = getpid() sched_setscheduler(r1, 0x5, &(0x7f0000000200)) ioctl$SNDRV_TIMER_IOCTL_GPARAMS(r0, 0x40485404, &(0x7f0000000240)={{}, 0x0, 0x2000000000000000, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3000000]}) 13:17:03 executing program 3: r0 = perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = socket$alg(0x26, 0x5, 0x0) bind$alg(r1, &(0x7f0000000200)={0x26, 'hash\x00', 0x0, 0x0, 'sha1\x00'}, 0x58) r2 = accept$alg(r1, 0x0, 0x0) sendmmsg(r2, &(0x7f0000007f00)=[{{&(0x7f00000056c0)=@can, 0x3000, &(0x7f00000000c0)}}, {{&(0x7f0000005900)=@pppoe={0x18, 0x0, {0x0, @link_local, 'syzkaller0\x00'}}, 0x80, &(0x7f0000007ac0), 0x1a9, &(0x7f0000007b00)}}], 0x3fffffffffffe0d, 0x0) ioctl$FS_IOC_GETVERSION(r0, 0x80087601, &(0x7f0000000180)) openat$sequencer2(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/sequencer2\x00', 0x20000, 0x0) chown(&(0x7f0000000340)='./file0\x00', 0x0, 0x0) r3 = syz_open_dev$sndpcmc(&(0x7f00000000c0)='/dev/snd/pcmC#D#c\x00', 0x0, 0x0) ioctl$ASHMEM_SET_NAME(r3, 0x41007701, &(0x7f0000000100)='syzkaller0\x00') 13:17:03 executing program 5: r0 = syz_open_dev$binder(&(0x7f00000021c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000002340)={0x34, 0x0, &(0x7f0000002240)=[@request_death={0x400c630e, 0x4, 0x4}, @increfs={0x40046304, 0x4}, @increfs_done={0x40106308, 0x0, 0x3}, @increfs], 0x77, 0x5000000, &(0x7f00000022c0)="b3cd0976d8e2af743c6f523efe14fd20c3c3dd2572734282a761e1b4304e2599c85f198cc82bd5d0c74c4edca2f9ea7b875ff7047ec0784fbb354e15fd3f7d837f533597d5082692a6f2fb748da3cc4157188f7f2a5477ded56f72f5b75c96872db429e44b8fcd781d96dead77a0b58b7af9085a208a22"}) 13:17:03 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r0, &(0x7f0000942000)={0x2, 0x4e20, @multicast1}, 0x10) sendmsg$key(0xffffffffffffffff, &(0x7f0000f56000)={0x0, 0x0, &(0x7f00008feff0)={&(0x7f0000000500)=ANY=[@ANYBLOB="020300090a1500000000000000000000030006190000000002000000e0000001003f00000000000002000100e625aa66dcef85847e479eb3c49000000400000000fd003e"], 0x44}}, 0x0) add_key(&(0x7f0000000080)='logon\x00', &(0x7f0000000100)={0x73, 0x79, 0x7a, 0x1}, &(0x7f0000001240), 0x0, 0xfffffffffffffff8) get_mempolicy(&(0x7f0000000000), &(0x7f00000001c0), 0x1ff, &(0x7f0000fff000/0x1000)=nil, 0x3) setsockopt$sock_int(r0, 0x1, 0x3c, &(0x7f0000d4effc)=0x1, 0x4) connect$inet(r0, &(0x7f0000000000)={0x2, 0x4e20, @dev={0xac, 0x14, 0x14, 0x18}}, 0x10) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f00000001c0)='tunl0\x00', 0x5) sendto$inet(r0, &(0x7f00006d1fd4)="db", 0x1, 0x4000010, &(0x7f00004daff0)={0x2, 0x0, @loopback, [0x0, 0xffffffffffffffff]}, 0x10) 13:17:03 executing program 0: perf_event_open(&(0x7f0000000040)={0x2, 0x70, 0x3e5}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f00000021c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000002340)={0xb5, 0xffffffffa0010000, &(0x7f00000000c0)=ANY=[@ANYBLOB="0463044000000000b6a571ac965f26c50d500dae115e59afcd8a338d8b2727193c56d4ebef60c214b766ffde6cff6ceef2baa2594a53a0117e77afd5d58e8a35afdae81b258585ce769507333c0238790d5ed750bf1d6ca2a873050056528fce7becfd12f165ac43a826d3462822ff8f29ea992d4e208847cf4fc10ca00b87b5ce2523fa477bad0be1c97e4398aa2ac81d973b5a871d8e0b295e436cd8415f19088c6c82c85f4ed1fac41da062bc6dbfb8eac4276c"], 0x0, 0x0, &(0x7f00000022c0)}) 13:17:03 executing program 4: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = gettid() perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x3e5}, 0x0, 0x0, 0xffffffffffffffff, 0x0) fcntl$setown(r0, 0x8, r1) bind$inet6(r0, &(0x7f0000807fe4)={0xa, 0x4e22}, 0x1c) sendto$inet6(r0, &(0x7f0000000380), 0x0, 0x200408d4, &(0x7f000072e000)={0xa, 0x4e22, 0x0, @loopback}, 0x1c) sendto$inet6(r0, &(0x7f0000ad6fad)='\x00', 0x1, 0x3fffffd, &(0x7f0000254000)={0xa, 0x0, 0x0, @loopback}, 0x1c) [ 1525.925186] binder_thread_write: 7 callbacks suppressed [ 1525.925200] binder: 15511:15522 BC_REQUEST_DEATH_NOTIFICATION invalid ref 4 13:17:04 executing program 6: clone(0x802102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000040), 0xffffffffffffffff) r0 = syz_open_dev$sndtimer(&(0x7f0000000000)='/dev/snd/timer\x00', 0x0, 0x0) r1 = getpid() sched_setscheduler(r1, 0x5, &(0x7f0000000200)) ioctl$SNDRV_TIMER_IOCTL_GPARAMS(r0, 0x40485404, &(0x7f0000000240)={{}, 0x0, 0x2000000000000000, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3000000]}) 13:17:04 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r0, &(0x7f0000942000)={0x2, 0x4e20, @multicast1}, 0x10) sendmsg$key(0xffffffffffffffff, &(0x7f0000f56000)={0x0, 0x0, &(0x7f00008feff0)={&(0x7f0000000500)=ANY=[@ANYBLOB="020300090a1500000000000000000000030006190000000002000000e0000001003f00000000000002000100e625aa66dcef85847e479eb3c49000000400000000fd003e"], 0x44}}, 0x0) add_key(&(0x7f0000000080)='logon\x00', &(0x7f0000000100)={0x73, 0x79, 0x7a, 0x1}, &(0x7f0000001240), 0x0, 0xfffffffffffffff8) get_mempolicy(&(0x7f0000000000), &(0x7f00000001c0), 0x1ff, &(0x7f0000fff000/0x1000)=nil, 0x3) setsockopt$sock_int(r0, 0x1, 0x3c, &(0x7f0000d4effc)=0x1, 0x4) connect$inet(r0, &(0x7f0000000000)={0x2, 0x4e20, @dev={0xac, 0x14, 0x14, 0x18}}, 0x10) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f00000001c0)='tunl0\x00', 0x5) sendto$inet(r0, &(0x7f00006d1fd4)="db", 0x1, 0x4000010, &(0x7f00004daff0)={0x2, 0x0, @loopback, [0x0, 0xfdffffff00000000]}, 0x10) [ 1526.066566] binder: 15511:15522 BC_INCREFS_DONE u0000000000000000 no match 13:17:04 executing program 5: r0 = syz_open_dev$binder(&(0x7f00000021c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000002340)={0x34, 0x0, &(0x7f0000002240)=[@request_death={0x400c630e, 0x4, 0x4}, @increfs={0x40046304, 0x4}, @increfs_done={0x40106308, 0x0, 0x3}, @increfs], 0x77, 0x68, &(0x7f00000022c0)="b3cd0976d8e2af743c6f523efe14fd20c3c3dd2572734282a761e1b4304e2599c85f198cc82bd5d0c74c4edca2f9ea7b875ff7047ec0784fbb354e15fd3f7d837f533597d5082692a6f2fb748da3cc4157188f7f2a5477ded56f72f5b75c96872db429e44b8fcd781d96dead77a0b58b7af9085a208a22"}) 13:17:04 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r0, &(0x7f0000942000)={0x2, 0x4e20, @multicast1}, 0x10) sendmsg$key(0xffffffffffffffff, &(0x7f0000f56000)={0x0, 0x0, &(0x7f00008feff0)={&(0x7f0000000500)=ANY=[@ANYBLOB="020300090a1500000000000000000000030006190000000002000000e0000001003f00000000000002000100e625aa66dcef85847e479eb3c49000000400000000fd003e"], 0x44}}, 0x0) add_key(&(0x7f0000000080)='logon\x00', &(0x7f0000000100)={0x73, 0x79, 0x7a, 0x1}, &(0x7f0000001240), 0x0, 0xfffffffffffffff8) get_mempolicy(&(0x7f0000000000), &(0x7f00000001c0), 0x1ff, &(0x7f0000fff000/0x1000)=nil, 0x3) setsockopt$sock_int(r0, 0x1, 0x3c, &(0x7f0000d4effc)=0x1, 0x4) connect$inet(r0, &(0x7f0000000000)={0x2, 0x4e20, @dev={0xac, 0x14, 0x14, 0x18}}, 0x10) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f00000001c0)='tunl0\x00', 0x5) sendto$inet(r0, &(0x7f00006d1fd4)="db", 0x1, 0x4000010, &(0x7f00004daff0)={0x2, 0x0, @loopback, [0x0, 0x80550000]}, 0x10) 13:17:04 executing program 3: perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000200)={0x26, 'hash\x00', 0x0, 0x0, 'sha1\x00'}, 0x58) r1 = accept$alg(r0, 0x0, 0x0) syz_open_dev$vcsn(&(0x7f0000000180)='/dev/vcs#\x00', 0x8, 0x50000) sendmmsg(r1, &(0x7f0000007f00)=[{{&(0x7f00000056c0)=@can, 0x3000, &(0x7f00000000c0)}}, {{&(0x7f0000005900)=@pppoe={0x18, 0x0, {0x0, @link_local, 'syzkaller0\x00'}}, 0x80, &(0x7f0000007ac0), 0x1a9, &(0x7f0000007b00)}}], 0x3fffffffffffe0d, 0x0) openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000140)='/dev/sequencer2\x00', 0x80840, 0x0) chown(&(0x7f0000000340)='./file0\x00', 0x0, 0x0) r2 = syz_open_dev$sndpcmc(&(0x7f00000000c0)='/dev/snd/pcmC#D#c\x00', 0x0, 0x0) ioctl$ASHMEM_SET_NAME(r2, 0x41007701, &(0x7f0000000100)='syzkaller0\x00') [ 1526.213440] binder: 15546:15548 BC_REQUEST_DEATH_NOTIFICATION invalid ref 4 13:17:04 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r0, &(0x7f0000942000)={0x2, 0x4e20, @multicast1}, 0x10) sendmsg$key(0xffffffffffffffff, &(0x7f0000f56000)={0x0, 0x0, &(0x7f00008feff0)={&(0x7f0000000500)=ANY=[@ANYBLOB="020300090a1500000000000000000000030006190000000002000000e0000001003f00000000000002000100e625aa66dcef85847e479eb3c49000000400000000fd003e"], 0x44}}, 0x0) add_key(&(0x7f0000000080)='logon\x00', &(0x7f0000000100)={0x73, 0x79, 0x7a, 0x1}, &(0x7f0000001240), 0x0, 0xfffffffffffffff8) get_mempolicy(&(0x7f0000000000), &(0x7f00000001c0), 0x1ff, &(0x7f0000fff000/0x1000)=nil, 0x3) setsockopt$sock_int(r0, 0x1, 0x3c, &(0x7f0000d4effc)=0x1, 0x4) connect$inet(r0, &(0x7f0000000000)={0x2, 0x4e20, @dev={0xac, 0x14, 0x14, 0x18}}, 0x10) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f00000001c0)='tunl0\x00', 0x5) sendto$inet(r0, &(0x7f00006d1fd4)="db", 0x1, 0x4000010, &(0x7f00004daff0)={0x2, 0x0, @loopback, [0x0, 0x2000000]}, 0x10) [ 1526.263289] binder: 15546:15548 BC_INCREFS_DONE u0000000000000000 no match 13:17:04 executing program 5: r0 = syz_open_dev$binder(&(0x7f00000021c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000002340)={0x34, 0x0, &(0x7f0000002240)=[@request_death={0x400c630e, 0x4, 0x4}, @increfs={0x40046304, 0x4}, @increfs_done={0x40106308, 0x0, 0x3}, @increfs], 0x77, 0x200000000000000, &(0x7f00000022c0)="b3cd0976d8e2af743c6f523efe14fd20c3c3dd2572734282a761e1b4304e2599c85f198cc82bd5d0c74c4edca2f9ea7b875ff7047ec0784fbb354e15fd3f7d837f533597d5082692a6f2fb748da3cc4157188f7f2a5477ded56f72f5b75c96872db429e44b8fcd781d96dead77a0b58b7af9085a208a22"}) 13:17:04 executing program 6: clone(0x802102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000040), 0xffffffffffffffff) r0 = syz_open_dev$sndtimer(&(0x7f0000000000)='/dev/snd/timer\x00', 0x0, 0x0) r1 = getpid() sched_setscheduler(r1, 0x5, &(0x7f0000000200)) ioctl$SNDRV_TIMER_IOCTL_GPARAMS(r0, 0x40485404, &(0x7f0000000240)={{}, 0x0, 0x2000000000000000, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x300]}) [ 1526.402363] binder: 15560:15561 BC_REQUEST_DEATH_NOTIFICATION invalid ref 4 [ 1526.410699] binder: 15560:15561 BC_INCREFS_DONE u0000000000000000 no match 13:17:04 executing program 1: r0 = socket$netlink(0x10, 0x3, 0x8000000004) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_TCP_CONGESTION(r1, 0x6, 0xd, &(0x7f0000000180)='vegas\x00', 0x6) bind$inet6(r1, &(0x7f00001fefe4)={0xa, 0x4e22}, 0x1c) sendto$inet6(r1, &(0x7f0000000100), 0x8d2d601e8976aa5, 0x20000004, &(0x7f000031e000)={0xa, 0x4e22}, 0x1c) writev(r0, &(0x7f0000000100)=[{&(0x7f0000000000)="580000001400192340834b80040d8c560a067fa175ff81004e220000000058000b4824ca944f64009400050028925aa8000000000000008000f0fffeffff09000000fff5dd00000010000100000c0900fcff0000040e05a5", 0x58}], 0x1) 13:17:04 executing program 7: r0 = openat$cuse(0xffffffffffffff9c, &(0x7f0000000080)='/dev/cuse\x00', 0x2, 0x0) clone(0x1002102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000640), 0xffffffffffffffff) r1 = getpid() sched_setscheduler(r1, 0x5, &(0x7f0000000000)) write$FUSE_NOTIFY_DELETE(r0, &(0x7f0000000040)={0x29, 0x6, 0xffffffffa0010000}, 0x29) 13:17:04 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r0, &(0x7f0000942000)={0x2, 0x4e20, @multicast1}, 0x10) sendmsg$key(0xffffffffffffffff, &(0x7f0000f56000)={0x0, 0x0, &(0x7f00008feff0)={&(0x7f0000000500)=ANY=[@ANYBLOB="020300090a1500000000000000000000030006190000000002000000e0000001003f00000000000002000100e625aa66dcef85847e479eb3c49000000400000000fd003e"], 0x44}}, 0x0) add_key(&(0x7f0000000080)='logon\x00', &(0x7f0000000100)={0x73, 0x79, 0x7a, 0x1}, &(0x7f0000001240), 0x0, 0xfffffffffffffff8) get_mempolicy(&(0x7f0000000000), &(0x7f00000001c0), 0x1ff, &(0x7f0000fff000/0x1000)=nil, 0x3) setsockopt$sock_int(r0, 0x1, 0x3c, &(0x7f0000d4effc)=0x1, 0x4) connect$inet(r0, &(0x7f0000000000)={0x2, 0x4e20, @dev={0xac, 0x14, 0x14, 0x18}}, 0x10) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f00000001c0)='tunl0\x00', 0x5) sendto$inet(r0, &(0x7f00006d1fd4)="db", 0x1, 0x4000010, &(0x7f00004daff0)={0x2, 0x0, @loopback, [0x0, 0x5]}, 0x10) 13:17:04 executing program 6: clone(0x802102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000040), 0xffffffffffffffff) r0 = syz_open_dev$sndtimer(&(0x7f0000000000)='/dev/snd/timer\x00', 0x0, 0x0) r1 = getpid() sched_setscheduler(r1, 0x5, &(0x7f0000000200)) ioctl$SNDRV_TIMER_IOCTL_GPARAMS(r0, 0x40485404, &(0x7f0000000240)={{}, 0x0, 0x2000000000000000, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3]}) 13:17:04 executing program 3: perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000200)={0x26, 'hash\x00', 0x0, 0x0, 'sha1\x00'}, 0x58) r1 = accept$alg(r0, 0x0, 0x0) sendmmsg(r1, &(0x7f0000007f00)=[{{&(0x7f00000056c0)=@can, 0x3000, &(0x7f00000000c0)}}, {{&(0x7f0000005900)=@pppoe={0x18, 0x0, {0x0, @link_local, 'syzkaller0\x00'}}, 0x80, &(0x7f0000007ac0), 0x1a9, &(0x7f0000007b00)}}], 0x3fffffffffffe0d, 0x0) r2 = syz_open_dev$sndpcmc(&(0x7f0000000180)='/dev/snd/pcmC#D#c\x00', 0x2, 0x86000) write$uinput_user_dev(r2, &(0x7f0000000380)={'syz0\x00', {0x4, 0x80000001, 0x2, 0x7}, 0x1, [0x4, 0x1, 0x9, 0x3, 0x7f, 0x0, 0x5, 0x3, 0x2, 0x795f5f9a, 0x1, 0x3, 0x10000, 0x3800, 0x2, 0x1ff, 0xffffffff, 0x9376, 0x40, 0x800, 0x8, 0xc0, 0x800, 0xfe00000000000, 0x3, 0xffffffff, 0xffffffffffffff3e, 0x10001, 0x5, 0x480000000000000, 0x1, 0xbe6c, 0x0, 0xffffffffffffff81, 0x4, 0x0, 0x20, 0x4, 0x1, 0x9, 0x20, 0x2, 0x0, 0xff, 0x4, 0x22f4, 0x3ff, 0x800, 0x1ff, 0x9, 0x7, 0x8, 0xf8, 0x0, 0x8, 0x2d, 0x5f1e, 0x200, 0x81, 0x80, 0x1, 0x3, 0x3f, 0x800], [0x401, 0x0, 0x2, 0x80000001, 0x3, 0x101, 0x9, 0x8, 0x3ff, 0x0, 0x1, 0xfffffffffffffffd, 0x4, 0x1000, 0x2, 0x4, 0x4, 0x2, 0x3, 0x2, 0xffff, 0x1, 0x1, 0x2, 0x9, 0x0, 0x6, 0x1, 0x0, 0x29a, 0x7, 0x5d2, 0xa66, 0x9, 0x0, 0x8, 0x80000000, 0x4, 0x2, 0x400, 0x1000, 0x7fffffff, 0xa00, 0x3, 0x3, 0x4, 0x6, 0x6, 0x573, 0xa37, 0xa33, 0x9d, 0x6, 0x401, 0x2, 0x4, 0xff, 0xab, 0x5, 0x9, 0x6, 0x0, 0xffffffffffffff01, 0x3], [0x10001, 0xf89, 0x5, 0x65, 0x3, 0x80, 0x7d, 0x5, 0x7fff, 0xffffffff, 0x8, 0xffff, 0x3, 0x0, 0x9, 0x3c66, 0x5, 0x687d, 0x0, 0x7fff, 0x6, 0x8, 0xfffffffeffffffff, 0x1, 0x7, 0xfffffffffffffffb, 0xd6, 0x6, 0x8, 0x6, 0x7, 0x6, 0x7ff, 0x4800000000000, 0x8, 0x7, 0x2, 0x0, 0x4, 0x5, 0x8, 0x1, 0x9, 0x8, 0xd3, 0xf9, 0x10001, 0x3, 0x101, 0x9, 0x9, 0xc0, 0x0, 0x20, 0x1000, 0x14d, 0x3, 0x1, 0x0, 0x662e, 0x80000001, 0x0, 0x6, 0x81], [0x0, 0x1ff, 0x1, 0x10000, 0x80000000, 0x2, 0xfffffffffffffffd, 0x0, 0x46, 0x20, 0xad, 0x8000, 0x5, 0x40, 0x80, 0x101, 0x5, 0x5, 0xd0d, 0x7fff, 0x773e, 0x1, 0x5, 0x4, 0xffffffff, 0x5, 0x4, 0x1, 0x100000000, 0x0, 0x8, 0x1f, 0x0, 0x100000001, 0x101, 0x9, 0xffffffffffffffff, 0x4, 0x3, 0x20, 0xdc7, 0x1b17, 0x4, 0xff, 0x7, 0x7ff, 0x6, 0x6, 0x4, 0x2, 0x5, 0x3, 0x0, 0xff, 0x7, 0x100000000, 0x5, 0xfff, 0x80000000, 0x3, 0x7c, 0x1, 0x9, 0x401]}, 0x45c) openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000140)='/dev/sequencer2\x00', 0x80840, 0x0) chown(&(0x7f0000000340)='./file0\x00', 0x0, 0x0) r3 = syz_open_dev$sndpcmc(&(0x7f00000000c0)='/dev/snd/pcmC#D#c\x00', 0x0, 0x0) ioctl$ASHMEM_SET_NAME(r3, 0x41007701, &(0x7f0000000100)='syzkaller0\x00') 13:17:04 executing program 5: r0 = syz_open_dev$binder(&(0x7f00000021c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000002340)={0x34, 0x0, &(0x7f0000002240)=[@request_death={0x400c630e, 0x4, 0x4}, @increfs={0x40046304, 0x4}, @increfs_done={0x40106308, 0x0, 0x3}, @increfs], 0x77, 0x8002a0ffffffff, &(0x7f00000022c0)="b3cd0976d8e2af743c6f523efe14fd20c3c3dd2572734282a761e1b4304e2599c85f198cc82bd5d0c74c4edca2f9ea7b875ff7047ec0784fbb354e15fd3f7d837f533597d5082692a6f2fb748da3cc4157188f7f2a5477ded56f72f5b75c96872db429e44b8fcd781d96dead77a0b58b7af9085a208a22"}) 13:17:04 executing program 4: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = gettid() perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x3e5}, 0x0, 0x0, 0xffffffffffffffff, 0x0) fcntl$setown(0xffffffffffffffff, 0x8, r1) bind$inet6(r0, &(0x7f0000807fe4)={0xa, 0x4e22}, 0x1c) sendto$inet6(r0, &(0x7f0000000380), 0x0, 0x200408d4, &(0x7f000072e000)={0xa, 0x4e22, 0x0, @loopback}, 0x1c) sendto$inet6(r0, &(0x7f0000ad6fad)='\x00', 0x1, 0x3fffffd, &(0x7f0000254000)={0xa, 0x0, 0x0, @loopback}, 0x1c) 13:17:04 executing program 0: perf_event_open(&(0x7f0000000040)={0x2, 0x70, 0x3e5}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f00000021c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000002340)={0xb5, 0x7400000000000000, &(0x7f00000000c0)=ANY=[@ANYBLOB="0463044000000000b6a571ac965f26c50d500dae115e59afcd8a338d8b2727193c56d4ebef60c214b766ffde6cff6ceef2baa2594a53a0117e77afd5d58e8a35afdae81b258585ce769507333c0238790d5ed750bf1d6ca2a873050056528fce7becfd12f165ac43a826d3462822ff8f29ea992d4e208847cf4fc10ca00b87b5ce2523fa477bad0be1c97e4398aa2ac81d973b5a871d8e0b295e436cd8415f19088c6c82c85f4ed1fac41da062bc6dbfb8eac4276c"], 0x0, 0x0, &(0x7f00000022c0)}) 13:17:04 executing program 6: clone(0x802102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000040), 0xffffffffffffffff) r0 = syz_open_dev$sndtimer(&(0x7f0000000000)='/dev/snd/timer\x00', 0x0, 0x0) r1 = getpid() sched_setscheduler(r1, 0x5, &(0x7f0000000200)) ioctl$SNDRV_TIMER_IOCTL_GPARAMS(r0, 0x40485404, &(0x7f0000000240)={{}, 0x0, 0x2000000000000000, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x300000000000000]}) [ 1526.784017] binder: 15586:15594 BC_REQUEST_DEATH_NOTIFICATION invalid ref 4 [ 1526.796599] binder: 15586:15594 BC_INCREFS_DONE u0000000000000000 no match 13:17:04 executing program 5: r0 = syz_open_dev$binder(&(0x7f00000021c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000002340)={0x34, 0x0, &(0x7f0000002240)=[@request_death={0x400c630e, 0x4, 0x4}, @increfs={0x40046304, 0x4}, @increfs_done={0x40106308, 0x0, 0x3}, @increfs], 0x77, 0x8000a0ffffffff, &(0x7f00000022c0)="b3cd0976d8e2af743c6f523efe14fd20c3c3dd2572734282a761e1b4304e2599c85f198cc82bd5d0c74c4edca2f9ea7b875ff7047ec0784fbb354e15fd3f7d837f533597d5082692a6f2fb748da3cc4157188f7f2a5477ded56f72f5b75c96872db429e44b8fcd781d96dead77a0b58b7af9085a208a22"}) 13:17:05 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r0, &(0x7f0000942000)={0x2, 0x4e20, @multicast1}, 0x10) sendmsg$key(0xffffffffffffffff, &(0x7f0000f56000)={0x0, 0x0, &(0x7f00008feff0)={&(0x7f0000000500)=ANY=[@ANYBLOB="020300090a1500000000000000000000030006190000000002000000e0000001003f00000000000002000100e625aa66dcef85847e479eb3c49000000400000000fd003e"], 0x44}}, 0x0) add_key(&(0x7f0000000080)='logon\x00', &(0x7f0000000100)={0x73, 0x79, 0x7a, 0x1}, &(0x7f0000001240), 0x0, 0xfffffffffffffff8) get_mempolicy(&(0x7f0000000000), &(0x7f00000001c0), 0x1ff, &(0x7f0000fff000/0x1000)=nil, 0x3) setsockopt$sock_int(r0, 0x1, 0x3c, &(0x7f0000d4effc)=0x1, 0x4) connect$inet(r0, &(0x7f0000000000)={0x2, 0x4e20, @dev={0xac, 0x14, 0x14, 0x18}}, 0x10) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f00000001c0)='tunl0\x00', 0x5) sendto$inet(r0, &(0x7f00006d1fd4)="db", 0x1, 0x4000010, &(0x7f00004daff0)={0x2, 0x0, @loopback, [0x0, 0xffffffffa0008000]}, 0x10) 13:17:05 executing program 5: r0 = syz_open_dev$binder(&(0x7f00000021c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000002340)={0x34, 0x0, &(0x7f0000002240)=[@request_death={0x400c630e, 0x4, 0x4}, @increfs={0x40046304, 0x4}, @increfs_done={0x40106308, 0x0, 0x3}, @increfs], 0x77, 0x500000000000000, &(0x7f00000022c0)="b3cd0976d8e2af743c6f523efe14fd20c3c3dd2572734282a761e1b4304e2599c85f198cc82bd5d0c74c4edca2f9ea7b875ff7047ec0784fbb354e15fd3f7d837f533597d5082692a6f2fb748da3cc4157188f7f2a5477ded56f72f5b75c96872db429e44b8fcd781d96dead77a0b58b7af9085a208a22"}) 13:17:05 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r0, &(0x7f0000942000)={0x2, 0x4e20, @multicast1}, 0x10) sendmsg$key(0xffffffffffffffff, &(0x7f0000f56000)={0x0, 0x0, &(0x7f00008feff0)={&(0x7f0000000500)=ANY=[@ANYBLOB="020300090a1500000000000000000000030006190000000002000000e0000001003f00000000000002000100e625aa66dcef85847e479eb3c49000000400000000fd003e"], 0x44}}, 0x0) add_key(&(0x7f0000000080)='logon\x00', &(0x7f0000000100)={0x73, 0x79, 0x7a, 0x1}, &(0x7f0000001240), 0x0, 0xfffffffffffffff8) get_mempolicy(&(0x7f0000000000), &(0x7f00000001c0), 0x1ff, &(0x7f0000fff000/0x1000)=nil, 0x3) setsockopt$sock_int(r0, 0x1, 0x3c, &(0x7f0000d4effc)=0x1, 0x4) connect$inet(r0, &(0x7f0000000000)={0x2, 0x4e20, @dev={0xac, 0x14, 0x14, 0x18}}, 0x10) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f00000001c0)='tunl0\x00', 0x5) sendto$inet(r0, &(0x7f00006d1fd4)="db", 0x1, 0x4000010, &(0x7f00004daff0)={0x2, 0x0, @loopback, [0x0, 0xffffffffa0010000]}, 0x10) 13:17:05 executing program 6: clone(0x802102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000040), 0xffffffffffffffff) r0 = syz_open_dev$sndtimer(&(0x7f0000000000)='/dev/snd/timer\x00', 0x0, 0x0) r1 = getpid() sched_setscheduler(r1, 0x5, &(0x7f0000000200)) ioctl$SNDRV_TIMER_IOCTL_GPARAMS(r0, 0x40485404, &(0x7f0000000240)={{}, 0x0, 0x2000000000000000, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x100000000000000]}) 13:17:05 executing program 7: r0 = openat$cuse(0xffffffffffffff9c, &(0x7f0000000080)='/dev/cuse\x00', 0x2, 0x0) clone(0x1002102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000640), 0xffffffffffffffff) r1 = getpid() sched_setscheduler(r1, 0x5, &(0x7f0000000000)) write$FUSE_NOTIFY_DELETE(r0, &(0x7f0000000040)={0x29, 0x6, 0x200000000000000}, 0x29) 13:17:05 executing program 3: perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x27}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000200)={0x26, 'hash\x00', 0x0, 0x0, 'sha1\x00'}, 0x58) r1 = accept$alg(r0, 0x0, 0x0) sendmmsg(r1, &(0x7f0000007f00)=[{{&(0x7f00000056c0)=@can, 0x80, &(0x7f0000000180)}}, {{&(0x7f0000005900)=@pppoe={0x18, 0x0, {0x0, @link_local, 'syzkaller0\x00'}}, 0x80, &(0x7f0000007ac0), 0x0, &(0x7f0000007b00)}}], 0x2, 0x0) r2 = openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000140)='/dev/sequencer2\x00', 0x80840, 0x0) r3 = syz_genetlink_get_family_id$ipvs(&(0x7f00000001c0)='IPVS\x00') sendmsg$IPVS_CMD_GET_CONFIG(r2, &(0x7f0000000380)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x40000}, 0xc, &(0x7f0000000300)={&(0x7f0000000280)={0x64, r3, 0x100, 0x70bd2a, 0x25dfdbfb, {}, [@IPVS_CMD_ATTR_TIMEOUT_TCP={0x8, 0x4, 0x9}, @IPVS_CMD_ATTR_TIMEOUT_TCP={0x8}, @IPVS_CMD_ATTR_DAEMON={0x40, 0x3, [@IPVS_DAEMON_ATTR_MCAST_IFN={0x14, 0x2, 'veth1_to_bond\x00'}, @IPVS_DAEMON_ATTR_MCAST_GROUP6={0x14, 0x6, @dev={0xfe, 0x80, [], 0xa}}, @IPVS_DAEMON_ATTR_MCAST_GROUP6={0x14, 0x6, @local}]}]}, 0x64}, 0x1, 0x0, 0x0, 0x40000}, 0x80) chown(&(0x7f0000000340)='./file0\x00', 0x0, 0x0) r4 = syz_open_dev$sndpcmc(&(0x7f00000000c0)='/dev/snd/pcmC#D#c\x00', 0x0, 0x0) ioctl$ASHMEM_SET_NAME(r4, 0x41007701, &(0x7f0000000100)='syzkaller0\x00') [ 1527.270104] binder: 15642:15651 BC_REQUEST_DEATH_NOTIFICATION invalid ref 4 13:17:05 executing program 1: r0 = socket$netlink(0x10, 0x3, 0x8000000004) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_TCP_CONGESTION(r1, 0x6, 0xd, &(0x7f0000000180)='vegas\x00', 0x6) bind$inet6(r1, &(0x7f00001fefe4)={0xa, 0x4e22}, 0x1c) sendto$inet6(r1, &(0x7f0000000100), 0x8d2d601e8976aa5, 0x20000004, &(0x7f000031e000)={0xa, 0x4e22}, 0x1c) writev(r0, &(0x7f0000000100)=[{&(0x7f0000000000)="580000001400192340834b80040d8c560a067f1b05ff81004e220000000058000b4824ca944f64009400050028925aa8000000000000008000f0fffeffff09000000fff5dd00000010000100000c0900fcff0000040e05a5", 0x58}], 0x1) 13:17:05 executing program 7: r0 = openat$cuse(0xffffffffffffff9c, &(0x7f0000000080)='/dev/cuse\x00', 0x2, 0x0) clone(0x1002102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000640), 0xffffffffffffffff) r1 = getpid() sched_setscheduler(r1, 0x5, &(0x7f0000000000)) write$FUSE_NOTIFY_DELETE(r0, &(0x7f0000000040)={0x29, 0x6, 0x6000000}, 0x29) 13:17:05 executing program 3: r0 = perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = socket$alg(0x26, 0x5, 0x0) bind$alg(r1, &(0x7f0000000200)={0x26, 'hash\x00', 0x0, 0x0, 'sha1\x00'}, 0x58) r2 = accept$alg(r1, 0x0, 0x0) sendmmsg(r2, &(0x7f0000007f00)=[{{&(0x7f00000056c0)=@can, 0x3000, &(0x7f00000000c0)}}, {{&(0x7f0000005900)=@pppoe={0x18, 0x0, {0x0, @link_local, 'syzkaller0\x00'}}, 0x80, &(0x7f0000007ac0), 0x1a9, &(0x7f0000007b00)}}], 0x3fffffffffffe0d, 0x0) fstat(r0, &(0x7f0000000280)={0x0, 0x0, 0x0, 0x0, 0x0}) getsockopt$sock_cred(r1, 0x1, 0x11, &(0x7f00000001c0)={0x0, 0x0, 0x0}, &(0x7f0000000300)=0xc) chown(&(0x7f0000000180)='./file0\x00', r3, r4) openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000140)='/dev/sequencer2\x00', 0x80840, 0x0) chown(&(0x7f0000000340)='./file0\x00', 0x0, 0x0) r5 = syz_open_dev$sndpcmc(&(0x7f00000000c0)='/dev/snd/pcmC#D#c\x00', 0x0, 0x0) ioctl$ASHMEM_SET_NAME(r5, 0x41007701, &(0x7f0000000100)='syzkaller0\x00') syz_init_net_socket$bt_l2cap(0x1f, 0x7, 0x0) 13:17:05 executing program 6: clone(0x802102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000040), 0xffffffffffffffff) r0 = syz_open_dev$sndtimer(&(0x7f0000000000)='/dev/snd/timer\x00', 0x0, 0x0) r1 = getpid() sched_setscheduler(r1, 0x5, &(0x7f0000000200)) ioctl$SNDRV_TIMER_IOCTL_GPARAMS(r0, 0x40485404, &(0x7f0000000240)={{}, 0x0, 0x2000000000000000, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1000000]}) 13:17:05 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r0, &(0x7f0000942000)={0x2, 0x4e20, @multicast1}, 0x10) sendmsg$key(0xffffffffffffffff, &(0x7f0000f56000)={0x0, 0x0, &(0x7f00008feff0)={&(0x7f0000000500)=ANY=[@ANYBLOB="020300090a1500000000000000000000030006190000000002000000e0000001003f00000000000002000100e625aa66dcef85847e479eb3c49000000400000000fd003e"], 0x44}}, 0x0) add_key(&(0x7f0000000080)='logon\x00', &(0x7f0000000100)={0x73, 0x79, 0x7a, 0x1}, &(0x7f0000001240), 0x0, 0xfffffffffffffff8) get_mempolicy(&(0x7f0000000000), &(0x7f00000001c0), 0x1ff, &(0x7f0000fff000/0x1000)=nil, 0x3) setsockopt$sock_int(r0, 0x1, 0x3c, &(0x7f0000d4effc)=0x1, 0x4) connect$inet(r0, &(0x7f0000000000)={0x2, 0x4e20, @dev={0xac, 0x14, 0x14, 0x18}}, 0x10) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f00000001c0)='tunl0\x00', 0x5) sendto$inet(r0, &(0x7f00006d1fd4)="db", 0x1, 0x4000010, &(0x7f00004daff0)={0x2, 0x0, @loopback, [0x0, 0x100000000000000]}, 0x10) 13:17:05 executing program 5: r0 = syz_open_dev$binder(&(0x7f00000021c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000002340)={0x34, 0x0, &(0x7f0000002240)=[@request_death={0x400c630e, 0x4, 0x4}, @increfs={0x40046304, 0x4}, @increfs_done={0x40106308, 0x0, 0x3}, @increfs], 0x77, 0x4800, &(0x7f00000022c0)="b3cd0976d8e2af743c6f523efe14fd20c3c3dd2572734282a761e1b4304e2599c85f198cc82bd5d0c74c4edca2f9ea7b875ff7047ec0784fbb354e15fd3f7d837f533597d5082692a6f2fb748da3cc4157188f7f2a5477ded56f72f5b75c96872db429e44b8fcd781d96dead77a0b58b7af9085a208a22"}) 13:17:05 executing program 4: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = gettid() perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x3e5}, 0x0, 0x0, 0xffffffffffffffff, 0x0) fcntl$setown(0xffffffffffffffff, 0x8, r1) bind$inet6(r0, &(0x7f0000807fe4)={0xa, 0x4e22}, 0x1c) sendto$inet6(r0, &(0x7f0000000380), 0x0, 0x200408d4, &(0x7f000072e000)={0xa, 0x4e22, 0x0, @loopback}, 0x1c) sendto$inet6(r0, &(0x7f0000ad6fad)='\x00', 0x1, 0x3fffffd, &(0x7f0000254000)={0xa, 0x0, 0x0, @loopback}, 0x1c) 13:17:05 executing program 0: perf_event_open(&(0x7f0000000040)={0x2, 0x70, 0x3e5}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f00000021c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000002340)={0xb5, 0x200000000000000, &(0x7f00000000c0)=ANY=[@ANYBLOB="0463044000000000b6a571ac965f26c50d500dae115e59afcd8a338d8b2727193c56d4ebef60c214b766ffde6cff6ceef2baa2594a53a0117e77afd5d58e8a35afdae81b258585ce769507333c0238790d5ed750bf1d6ca2a873050056528fce7becfd12f165ac43a826d3462822ff8f29ea992d4e208847cf4fc10ca00b87b5ce2523fa477bad0be1c97e4398aa2ac81d973b5a871d8e0b295e436cd8415f19088c6c82c85f4ed1fac41da062bc6dbfb8eac4276c"], 0x0, 0x0, &(0x7f00000022c0)}) 13:17:05 executing program 5: r0 = syz_open_dev$binder(&(0x7f00000021c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000002340)={0x34, 0x0, &(0x7f0000002240)=[@request_death={0x400c630e, 0x4, 0x4}, @increfs={0x40046304, 0x4}, @increfs_done={0x40106308, 0x0, 0x3}, @increfs], 0x77, 0xa, &(0x7f00000022c0)="b3cd0976d8e2af743c6f523efe14fd20c3c3dd2572734282a761e1b4304e2599c85f198cc82bd5d0c74c4edca2f9ea7b875ff7047ec0784fbb354e15fd3f7d837f533597d5082692a6f2fb748da3cc4157188f7f2a5477ded56f72f5b75c96872db429e44b8fcd781d96dead77a0b58b7af9085a208a22"}) 13:17:05 executing program 7: r0 = openat$cuse(0xffffffffffffff9c, &(0x7f0000000080)='/dev/cuse\x00', 0x2, 0x0) clone(0x1002102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000640), 0xffffffffffffffff) r1 = getpid() sched_setscheduler(r1, 0x5, &(0x7f0000000000)) write$FUSE_NOTIFY_DELETE(r0, &(0x7f0000000040)={0x29, 0x6, 0x6}, 0x29) 13:17:05 executing program 6: clone(0x802102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000040), 0xffffffffffffffff) r0 = syz_open_dev$sndtimer(&(0x7f0000000000)='/dev/snd/timer\x00', 0x0, 0x0) r1 = getpid() sched_setscheduler(r1, 0x5, &(0x7f0000000200)) ioctl$SNDRV_TIMER_IOCTL_GPARAMS(r0, 0x40485404, &(0x7f0000000240)={{}, 0x0, 0x2000000000000000, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x100000000000000]}) [ 1527.693220] binder: 15668:15677 BC_REQUEST_DEATH_NOTIFICATION invalid ref 4 13:17:05 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r0, &(0x7f0000942000)={0x2, 0x4e20, @multicast1}, 0x10) sendmsg$key(0xffffffffffffffff, &(0x7f0000f56000)={0x0, 0x0, &(0x7f00008feff0)={&(0x7f0000000500)=ANY=[@ANYBLOB="020300090a1500000000000000000000030006190000000002000000e0000001003f00000000000002000100e625aa66dcef85847e479eb3c49000000400000000fd003e"], 0x44}}, 0x0) add_key(&(0x7f0000000080)='logon\x00', &(0x7f0000000100)={0x73, 0x79, 0x7a, 0x1}, &(0x7f0000001240), 0x0, 0xfffffffffffffff8) get_mempolicy(&(0x7f0000000000), &(0x7f00000001c0), 0x1ff, &(0x7f0000fff000/0x1000)=nil, 0x3) setsockopt$sock_int(r0, 0x1, 0x3c, &(0x7f0000d4effc)=0x1, 0x4) connect$inet(r0, &(0x7f0000000000)={0x2, 0x4e20, @dev={0xac, 0x14, 0x14, 0x18}}, 0x10) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f00000001c0)='tunl0\x00', 0x5) sendto$inet(r0, &(0x7f00006d1fd4)="db", 0x1, 0x4000010, &(0x7f00004daff0)={0x2, 0x0, @loopback, [0x0, 0x8002a0]}, 0x10) 13:17:06 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r0, &(0x7f0000942000)={0x2, 0x4e20, @multicast1}, 0x10) sendmsg$key(0xffffffffffffffff, &(0x7f0000f56000)={0x0, 0x0, &(0x7f00008feff0)={&(0x7f0000000500)=ANY=[@ANYBLOB="020300090a1500000000000000000000030006190000000002000000e0000001003f00000000000002000100e625aa66dcef85847e479eb3c49000000400000000fd003e"], 0x44}}, 0x0) add_key(&(0x7f0000000080)='logon\x00', &(0x7f0000000100)={0x73, 0x79, 0x7a, 0x1}, &(0x7f0000001240), 0x0, 0xfffffffffffffff8) get_mempolicy(&(0x7f0000000000), &(0x7f00000001c0), 0x1ff, &(0x7f0000fff000/0x1000)=nil, 0x3) setsockopt$sock_int(r0, 0x1, 0x3c, &(0x7f0000d4effc)=0x1, 0x4) connect$inet(r0, &(0x7f0000000000)={0x2, 0x4e20, @dev={0xac, 0x14, 0x14, 0x18}}, 0x10) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f00000001c0)='tunl0\x00', 0x5) sendto$inet(r0, &(0x7f00006d1fd4)="db", 0x1, 0x4000010, &(0x7f00004daff0)={0x2, 0x0, @loopback, [0x0, 0x300]}, 0x10) 13:17:06 executing program 6: clone(0x802102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000040), 0xffffffffffffffff) r0 = syz_open_dev$sndtimer(&(0x7f0000000000)='/dev/snd/timer\x00', 0x0, 0x0) r1 = getpid() sched_setscheduler(r1, 0x5, &(0x7f0000000200)) ioctl$SNDRV_TIMER_IOCTL_GPARAMS(r0, 0x40485404, &(0x7f0000000240)={{}, 0x0, 0x2000000000000000, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x300000000000000]}) [ 1527.922979] binder: 15696:15701 BC_REQUEST_DEATH_NOTIFICATION invalid ref 4 13:17:06 executing program 7: r0 = openat$cuse(0xffffffffffffff9c, &(0x7f0000000080)='/dev/cuse\x00', 0x2, 0x0) clone(0x1002102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000640), 0xffffffffffffffff) r1 = getpid() sched_setscheduler(r1, 0x5, &(0x7f0000000000)) write$FUSE_NOTIFY_DELETE(r0, &(0x7f0000000040)={0x29, 0x6, 0xa0008000}, 0x29) 13:17:06 executing program 3: r0 = perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = syz_open_dev$vcsn(&(0x7f0000000380)='/dev/vcs#\x00', 0xfffffffffffffff9, 0x202000) r2 = getpid() ioctl$sock_SIOCSPGRP(r1, 0x8902, &(0x7f0000000280)=r2) r3 = socket$alg(0x26, 0x5, 0x0) write$selinux_access(r1, &(0x7f0000000440)={'system_u:object_r:systemd_systemctl_exec_t:s0', 0x20, 'unconfined'}, 0x4e) bind$alg(r3, &(0x7f0000000200)={0x26, 'hash\x00', 0x0, 0x0, 'sha1\x00'}, 0x58) r4 = accept$alg(r3, 0x0, 0x0) sendmmsg(r4, &(0x7f0000007f00)=[{{&(0x7f00000056c0)=@can, 0x3000, &(0x7f00000000c0)}}, {{&(0x7f0000005900)=@pppoe={0x18, 0x0, {0x0, @link_local, 'syzkaller0\x00'}}, 0x80, &(0x7f0000007ac0), 0x1a9, &(0x7f0000007b00)}}], 0x3fffffffffffe0d, 0x0) getpid() r5 = openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000140)='/dev/sequencer2\x00', 0x80840, 0x0) ioctl$FIBMAP(r0, 0x1, &(0x7f0000000180)=0x2) chown(&(0x7f0000000340)='./file0\x00', 0x0, 0x0) r6 = syz_open_dev$sndpcmc(&(0x7f00000000c0)='/dev/snd/pcmC#D#c\x00', 0x0, 0x0) setsockopt$bt_BT_SECURITY(r6, 0x112, 0x4, &(0x7f00000002c0)={0x8, 0x40}, 0x2) write$selinux_access(r5, &(0x7f00000003c0)={'system_u:object_r:zero_device_t:s0', 0x20, '/sbin/dhclient', 0x20, 0x8}, 0x47) ioctl$ASHMEM_SET_NAME(r6, 0x41007701, &(0x7f0000000100)='syzkaller0\x00') 13:17:06 executing program 1: r0 = socket$netlink(0x10, 0x3, 0x8000000004) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_TCP_CONGESTION(r1, 0x6, 0xd, &(0x7f0000000180)='vegas\x00', 0x6) bind$inet6(r1, &(0x7f00001fefe4)={0xa, 0x4e22}, 0x1c) sendto$inet6(r1, &(0x7f0000000100), 0x8d2d601e8976aa5, 0x20000004, &(0x7f000031e000)={0xa, 0x4e22}, 0x1c) writev(r0, &(0x7f0000000100)=[{&(0x7f0000000000)="580000001400192340834b80040d8c560a067fc01eff81004e220000000058000b4824ca944f64009400050028925aa8000000000000008000f0fffeffff09000000fff5dd00000010000100000c0900fcff0000040e05a5", 0x58}], 0x1) 13:17:06 executing program 5: r0 = syz_open_dev$binder(&(0x7f00000021c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000002340)={0x34, 0x0, &(0x7f0000002240)=[@request_death={0x400c630e, 0x4, 0x4}, @increfs={0x40046304, 0x4}, @increfs_done={0x40106308, 0x0, 0x3}, @increfs], 0x77, 0x0, &(0x7f00000022c0)="b3cd4d76d8e2af743c6f523efe14fd20c3c3dd2572734282a761e1b4304e2599c85f198cc82bd5d0c74c4edca2f9ea7b875ff7047ec0784fbb354e15fd3f7d837f533597d5082692a6f2fb748da3cc4157188f7f2a5477ded56f72f5b75c96872db429e44b8fcd781d96dead77a0b58b7af9085a208a22"}) 13:17:06 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r0, &(0x7f0000942000)={0x2, 0x4e20, @multicast1}, 0x10) sendmsg$key(0xffffffffffffffff, &(0x7f0000f56000)={0x0, 0x0, &(0x7f00008feff0)={&(0x7f0000000500)=ANY=[@ANYBLOB="020300090a1500000000000000000000030006190000000002000000e0000001003f00000000000002000100e625aa66dcef85847e479eb3c49000000400000000fd003e"], 0x44}}, 0x0) add_key(&(0x7f0000000080)='logon\x00', &(0x7f0000000100)={0x73, 0x79, 0x7a, 0x1}, &(0x7f0000001240), 0x0, 0xfffffffffffffff8) get_mempolicy(&(0x7f0000000000), &(0x7f00000001c0), 0x1ff, &(0x7f0000fff000/0x1000)=nil, 0x3) setsockopt$sock_int(r0, 0x1, 0x3c, &(0x7f0000d4effc)=0x1, 0x4) connect$inet(r0, &(0x7f0000000000)={0x2, 0x4e20, @dev={0xac, 0x14, 0x14, 0x18}}, 0x10) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f00000001c0)='tunl0\x00', 0x5) sendto$inet(r0, &(0x7f00006d1fd4)="db", 0x1, 0x4000010, &(0x7f00004daff0)={0x2, 0x0, @loopback, [0x0, 0x49]}, 0x10) 13:17:06 executing program 6: clone(0x802102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000040), 0xffffffffffffffff) r0 = syz_open_dev$sndtimer(&(0x7f0000000000)='/dev/snd/timer\x00', 0x0, 0x0) r1 = getpid() sched_setscheduler(r1, 0x5, &(0x7f0000000200)) ioctl$SNDRV_TIMER_IOCTL_GPARAMS(r0, 0x40485404, &(0x7f0000000240)={{}, 0x0, 0x2000000000000000, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1000000]}) 13:17:06 executing program 7: r0 = openat$cuse(0xffffffffffffff9c, &(0x7f0000000080)='/dev/cuse\x00', 0x2, 0x0) clone(0x1002102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000640), 0xffffffffffffffff) r1 = getpid() sched_setscheduler(r1, 0x5, &(0x7f0000000000)) write$FUSE_NOTIFY_DELETE(r0, &(0x7f0000000040)={0x29, 0x6, 0xa0028000}, 0x29) 13:17:06 executing program 4: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = gettid() perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x3e5}, 0x0, 0x0, 0xffffffffffffffff, 0x0) fcntl$setown(0xffffffffffffffff, 0x8, r1) bind$inet6(r0, &(0x7f0000807fe4)={0xa, 0x4e22}, 0x1c) sendto$inet6(r0, &(0x7f0000000380), 0x0, 0x200408d4, &(0x7f000072e000)={0xa, 0x4e22, 0x0, @loopback}, 0x1c) sendto$inet6(r0, &(0x7f0000ad6fad)='\x00', 0x1, 0x3fffffd, &(0x7f0000254000)={0xa, 0x0, 0x0, @loopback}, 0x1c) 13:17:06 executing program 3: r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000200)={0x26, 'hash\x00', 0x0, 0x0, 'sha1\x00'}, 0x58) r1 = accept$alg(r0, 0x0, 0x0) sendmmsg(r1, &(0x7f0000007f00)=[{{&(0x7f00000056c0)=@can, 0x3000, &(0x7f00000000c0)}}, {{&(0x7f0000005900)=@pppoe={0x18, 0x0, {0x0, @link_local, 'syzkaller0\x00'}}, 0x80, &(0x7f0000007ac0), 0x1a9, &(0x7f0000007b00)}}], 0x3fffffffffffe0d, 0x0) stat(&(0x7f00000001c0)='./file0\x00', &(0x7f0000000280)={0x0, 0x0, 0x0, 0x0, 0x0}) r3 = getegid() chown(&(0x7f0000000180)='./file0\x00', r2, r3) openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000140)='/dev/sequencer2\x00', 0x80840, 0x0) chown(&(0x7f0000000340)='./file0\x00', 0x0, 0x0) setrlimit(0x0, &(0x7f0000000000)={0x9, 0xa88}) r4 = syz_open_dev$sndpcmc(&(0x7f00000000c0)='/dev/snd/pcmC#D#c\x00', 0x0, 0x0) ioctl$ASHMEM_SET_NAME(r4, 0x41007701, &(0x7f0000000100)='syzkaller0\x00') 13:17:06 executing program 0: perf_event_open(&(0x7f0000000040)={0x2, 0x70, 0x3e5}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f00000021c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000002340)={0xb5, 0x4c000000, &(0x7f00000000c0)=ANY=[@ANYBLOB="0463044000000000b6a571ac965f26c50d500dae115e59afcd8a338d8b2727193c56d4ebef60c214b766ffde6cff6ceef2baa2594a53a0117e77afd5d58e8a35afdae81b258585ce769507333c0238790d5ed750bf1d6ca2a873050056528fce7becfd12f165ac43a826d3462822ff8f29ea992d4e208847cf4fc10ca00b87b5ce2523fa477bad0be1c97e4398aa2ac81d973b5a871d8e0b295e436cd8415f19088c6c82c85f4ed1fac41da062bc6dbfb8eac4276c"], 0x0, 0x0, &(0x7f00000022c0)}) 13:17:06 executing program 6: clone(0x802102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000040), 0xffffffffffffffff) r0 = syz_open_dev$sndtimer(&(0x7f0000000000)='/dev/snd/timer\x00', 0x0, 0x0) r1 = getpid() sched_setscheduler(r1, 0x5, &(0x7f0000000200)) ioctl$SNDRV_TIMER_IOCTL_GPARAMS(r0, 0x40485404, &(0x7f0000000240)={{}, 0x0, 0x2000000000000000, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3000000]}) 13:17:06 executing program 7: r0 = openat$cuse(0xffffffffffffff9c, &(0x7f0000000080)='/dev/cuse\x00', 0x2, 0x0) clone(0x1002102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000640), 0xffffffffffffffff) r1 = getpid() sched_setscheduler(r1, 0x5, &(0x7f0000000000)) write$FUSE_NOTIFY_DELETE(r0, &(0x7f0000000040)={0x29, 0x6, 0x8000a0ffffffff}, 0x29) [ 1528.686009] binder: 15746:15759 BC_REQUEST_DEATH_NOTIFICATION invalid ref 4 13:17:06 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r0, &(0x7f0000942000)={0x2, 0x4e20, @multicast1}, 0x10) sendmsg$key(0xffffffffffffffff, &(0x7f0000f56000)={0x0, 0x0, &(0x7f00008feff0)={&(0x7f0000000500)=ANY=[@ANYBLOB="020300090a1500000000000000000000030006190000000002000000e0000001003f00000000000002000100e625aa66dcef85847e479eb3c49000000400000000fd003e"], 0x44}}, 0x0) add_key(&(0x7f0000000080)='logon\x00', &(0x7f0000000100)={0x73, 0x79, 0x7a, 0x1}, &(0x7f0000001240), 0x0, 0xfffffffffffffff8) get_mempolicy(&(0x7f0000000000), &(0x7f00000001c0), 0x1ff, &(0x7f0000fff000/0x1000)=nil, 0x3) setsockopt$sock_int(r0, 0x1, 0x3c, &(0x7f0000d4effc)=0x1, 0x4) connect$inet(r0, &(0x7f0000000000)={0x2, 0x4e20, @dev={0xac, 0x14, 0x14, 0x18}}, 0x10) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f00000001c0)='tunl0\x00', 0x5) sendto$inet(r0, &(0x7f00006d1fd4)="db", 0x1, 0x4000010, &(0x7f00004daff0)={0x2, 0x0, @loopback, [0x0, 0xe00000000000000]}, 0x10) [ 1528.770314] binder_thread_write: 16 callbacks suppressed [ 1528.770333] binder: 15746:15759 IncRefs 0 refcount change on invalid ref 4 ret -22 [ 1528.801874] binder_thread_write: 3 callbacks suppressed [ 1528.801888] binder: 15746:15759 BC_INCREFS_DONE u0000000000000000 no match 13:17:06 executing program 3: perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000200)={0x26, 'hash\x00', 0x0, 0x0, 'sha1\x00'}, 0x58) r1 = accept$alg(r0, 0x0, 0x0) sendmmsg(r1, &(0x7f0000007f00)=[{{&(0x7f00000056c0)=@can, 0x3000, &(0x7f00000000c0)}}, {{&(0x7f0000005900)=@pppoe={0x18, 0x0, {0x0, @link_local, 'syzkaller0\x00'}}, 0x80, &(0x7f0000007ac0), 0x1a9, &(0x7f0000007b00)}}], 0x3fffffffffffe0d, 0x0) r2 = openat$selinux_avc_cache_threshold(0xffffffffffffff9c, &(0x7f0000000180)='/selinux/avc/cache_threshold\x00', 0x2, 0x0) ioctl$EVIOCRMFF(r2, 0x40044581, &(0x7f00000001c0)=0x3) openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000140)='/dev/sequencer2\x00', 0x80840, 0x0) chown(&(0x7f0000000340)='./file0\x00', 0x0, 0x0) modify_ldt$read_default(0x2, &(0x7f0000000380)=""/4096, 0x1000) r3 = syz_open_dev$sndpcmc(&(0x7f00000000c0)='/dev/snd/pcmC#D#c\x00', 0x0, 0x0) ioctl$ASHMEM_SET_NAME(r3, 0x41007701, &(0x7f0000000100)='syzkaller0\x00') openat$selinux_checkreqprot(0xffffffffffffff9c, &(0x7f0000000280)='/selinux/checkreqprot\x00', 0x60040, 0x0) 13:17:06 executing program 5: r0 = syz_open_dev$binder(&(0x7f00000021c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000002340)={0x34, 0x0, &(0x7f0000002240)=[@request_death={0x400c630e, 0x4, 0x4}, @increfs={0x40046304, 0x4}, @increfs_done={0x40106308, 0x0, 0x3}, @increfs], 0x77, 0x0, &(0x7f00000022c0)="b3cd0c76d8e2af743c6f523efe14fd20c3c3dd2572734282a761e1b4304e2599c85f198cc82bd5d0c74c4edca2f9ea7b875ff7047ec0784fbb354e15fd3f7d837f533597d5082692a6f2fb748da3cc4157188f7f2a5477ded56f72f5b75c96872db429e44b8fcd781d96dead77a0b58b7af9085a208a22"}) [ 1528.821150] binder: 15746:15759 IncRefs 0 refcount change on invalid ref 0 ret -22 13:17:07 executing program 6: clone(0x802102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000040), 0xffffffffffffffff) r0 = syz_open_dev$sndtimer(&(0x7f0000000000)='/dev/snd/timer\x00', 0x0, 0x0) r1 = getpid() sched_setscheduler(r1, 0x5, &(0x7f0000000200)) ioctl$SNDRV_TIMER_IOCTL_GPARAMS(r0, 0x40485404, &(0x7f0000000240)={{}, 0x0, 0x2000000000000000, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x300]}) 13:17:07 executing program 6: clone(0x802102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000040), 0xffffffffffffffff) r0 = syz_open_dev$sndtimer(&(0x7f0000000000)='/dev/snd/timer\x00', 0x0, 0x0) r1 = getpid() sched_setscheduler(r1, 0x5, &(0x7f0000000200)) ioctl$SNDRV_TIMER_IOCTL_GPARAMS(r0, 0x40485404, &(0x7f0000000240)={{}, 0x0, 0x2000000000000000, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3]}) 13:17:07 executing program 0: perf_event_open(&(0x7f0000000040)={0x2, 0x70, 0x3e5}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f00000021c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000002340)={0xb5, 0x6c000000, &(0x7f00000000c0)=ANY=[@ANYBLOB="0463044000000000b6a571ac965f26c50d500dae115e59afcd8a338d8b2727193c56d4ebef60c214b766ffde6cff6ceef2baa2594a53a0117e77afd5d58e8a35afdae81b258585ce769507333c0238790d5ed750bf1d6ca2a873050056528fce7becfd12f165ac43a826d3462822ff8f29ea992d4e208847cf4fc10ca00b87b5ce2523fa477bad0be1c97e4398aa2ac81d973b5a871d8e0b295e436cd8415f19088c6c82c85f4ed1fac41da062bc6dbfb8eac4276c"], 0x0, 0x0, &(0x7f00000022c0)}) [ 1529.016540] binder: 15784:15798 BC_REQUEST_DEATH_NOTIFICATION invalid ref 4 [ 1529.023989] binder: 15784:15798 IncRefs 0 refcount change on invalid ref 4 ret -22 [ 1529.033839] binder: 15784:15798 BC_INCREFS_DONE u0000000000000000 no match [ 1529.090270] binder: 15784:15798 IncRefs 0 refcount change on invalid ref 0 ret -22 13:17:07 executing program 1: r0 = socket$netlink(0x10, 0x3, 0x8000000004) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_TCP_CONGESTION(r1, 0x6, 0xd, &(0x7f0000000180)='vegas\x00', 0x6) bind$inet6(r1, &(0x7f00001fefe4)={0xa, 0x4e22}, 0x1c) sendto$inet6(r1, &(0x7f0000000100), 0x8d2d601e8976aa5, 0x20000004, &(0x7f000031e000)={0xa, 0x4e22}, 0x1c) writev(r0, &(0x7f0000000100)=[{&(0x7f0000000000)="580000001400192340834b80040d8c560a067f729dff81004e220000000058000b4824ca944f64009400050028925aa8000000000000008000f0fffeffff09000000fff5dd00000010000100000c0900fcff0000040e05a5", 0x58}], 0x1) 13:17:07 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r0, &(0x7f0000942000)={0x2, 0x4e20, @multicast1}, 0x10) sendmsg$key(0xffffffffffffffff, &(0x7f0000f56000)={0x0, 0x0, &(0x7f00008feff0)={&(0x7f0000000500)=ANY=[@ANYBLOB="020300090a1500000000000000000000030006190000000002000000e0000001003f00000000000002000100e625aa66dcef85847e479eb3c49000000400000000fd003e"], 0x44}}, 0x0) add_key(&(0x7f0000000080)='logon\x00', &(0x7f0000000100)={0x73, 0x79, 0x7a, 0x1}, &(0x7f0000001240), 0x0, 0xfffffffffffffff8) get_mempolicy(&(0x7f0000000000), &(0x7f00000001c0), 0x1ff, &(0x7f0000fff000/0x1000)=nil, 0x3) setsockopt$sock_int(r0, 0x1, 0x3c, &(0x7f0000d4effc)=0x1, 0x4) connect$inet(r0, &(0x7f0000000000)={0x2, 0x4e20, @dev={0xac, 0x14, 0x14, 0x18}}, 0x10) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f00000001c0)='tunl0\x00', 0x5) sendto$inet(r0, &(0x7f00006d1fd4)="db", 0x1, 0x4000010, &(0x7f00004daff0)={0x2, 0x0, @loopback, [0x0, 0x800000000000000]}, 0x10) 13:17:07 executing program 6: clone(0x802102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000040), 0xffffffffffffffff) r0 = syz_open_dev$sndtimer(&(0x7f0000000000)='/dev/snd/timer\x00', 0x0, 0x0) r1 = getpid() sched_setscheduler(r1, 0x5, &(0x7f0000000200)) ioctl$SNDRV_TIMER_IOCTL_GPARAMS(r0, 0x40485404, &(0x7f0000000240)={{}, 0x0, 0x2000000000000000, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3000000]}) 13:17:07 executing program 4: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) gettid() perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x3e5}, 0x0, 0x0, 0xffffffffffffffff, 0x0) fcntl$setown(r0, 0x8, 0x0) bind$inet6(r0, &(0x7f0000807fe4)={0xa, 0x4e22}, 0x1c) sendto$inet6(r0, &(0x7f0000000380), 0x0, 0x200408d4, &(0x7f000072e000)={0xa, 0x4e22, 0x0, @loopback}, 0x1c) sendto$inet6(r0, &(0x7f0000ad6fad)='\x00', 0x1, 0x3fffffd, &(0x7f0000254000)={0xa, 0x0, 0x0, @loopback}, 0x1c) 13:17:07 executing program 7: r0 = openat$cuse(0xffffffffffffff9c, &(0x7f0000000080)='/dev/cuse\x00', 0x2, 0x0) clone(0x1002102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000640), 0xffffffffffffffff) r1 = getpid() sched_setscheduler(r1, 0x5, &(0x7f0000000000)) write$FUSE_NOTIFY_DELETE(r0, &(0x7f0000000040)={0x29, 0x6, 0xa00}, 0x29) 13:17:07 executing program 5: r0 = syz_open_dev$binder(&(0x7f00000021c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000002340)={0x34, 0x0, &(0x7f0000002240)=[@request_death={0x400c630e, 0x4, 0x4}, @increfs={0x40046304, 0x4}, @increfs_done={0x40106308, 0x0, 0x3}, @increfs], 0x77, 0x0, &(0x7f00000022c0)="b3cd0776d8e2af743c6f523efe14fd20c3c3dd2572734282a761e1b4304e2599c85f198cc82bd5d0c74c4edca2f9ea7b875ff7047ec0784fbb354e15fd3f7d837f533597d5082692a6f2fb748da3cc4157188f7f2a5477ded56f72f5b75c96872db429e44b8fcd781d96dead77a0b58b7af9085a208a22"}) 13:17:07 executing program 3: r0 = perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = socket$alg(0x26, 0x5, 0x0) bind$alg(r1, &(0x7f0000000200)={0x26, 'hash\x00', 0x0, 0x0, 'sha1\x00'}, 0x58) r2 = accept$alg(r1, 0x0, 0x0) sendmmsg(r2, &(0x7f0000007f00)=[{{&(0x7f00000056c0)=@can, 0x3000, &(0x7f00000000c0)}}, {{&(0x7f0000005900)=@pppoe={0x18, 0x0, {0x0, @link_local, 'syzkaller0\x00'}}, 0x80, &(0x7f0000007ac0), 0x1a9, &(0x7f0000007b00)}}], 0x3fffffffffffe0d, 0x0) getresuid(&(0x7f0000000500)=0x0, &(0x7f0000000540), &(0x7f0000000580)) stat(&(0x7f00000005c0)='./file0\x00', &(0x7f0000000600)={0x0, 0x0, 0x0, 0x0, 0x0}) r5 = geteuid() getresuid(&(0x7f0000000680), &(0x7f00000006c0), &(0x7f0000000700)=0x0) r7 = getuid() getsockopt$sock_cred(r0, 0x1, 0x11, &(0x7f0000000740)={0x0, 0x0}, &(0x7f0000000780)=0xc) getsockopt$sock_cred(r1, 0x1, 0x11, &(0x7f00000007c0)={0x0, 0x0}, &(0x7f0000000800)=0xc) getsockopt$inet6_IPV6_XFRM_POLICY(r1, 0x29, 0x23, &(0x7f0000000840)={{{@in6, @in6=@dev, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in=@broadcast}, 0x0, @in=@multicast1}}, &(0x7f0000000940)=0xe8) r11 = getuid() r12 = geteuid() stat(&(0x7f0000000980)='./file0\x00', &(0x7f00000009c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) getgroups(0x5, &(0x7f0000000a40)=[0xee01, 0xee01, 0xffffffffffffffff, 0x0, 0x0]) getresgid(&(0x7f0000000a80), &(0x7f0000000ac0)=0x0, &(0x7f0000000b00)) lstat(&(0x7f0000000b40)='./file0\x00', &(0x7f0000000b80)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) setxattr$system_posix_acl(&(0x7f0000000480)='./file0\x00', &(0x7f00000004c0)='system.posix_acl_access\x00', &(0x7f0000000c00)={{}, {0x1, 0x6}, [{0x2, 0x5, r3}, {0x2, 0x7, r4}, {0x2, 0x1, r5}, {0x2, 0x2, r6}, {0x2, 0x1, r7}, {0x2, 0x7, r8}, {0x2, 0x2, r9}, {0x2, 0x1, r10}, {0x2, 0x7, r11}, {0x2, 0x4, r12}], {0x4, 0x2}, [{0x8, 0x3, r13}, {0x8, 0x2, r14}, {0x8, 0x1, r15}, {0x8, 0x1, r16}], {0x10, 0x1}, {0x20, 0x4}}, 0x94, 0x1) r17 = openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000140)='/dev/sequencer2\x00', 0x80840, 0x0) chown(&(0x7f0000000340)='./file0\x00', 0x0, 0x0) ioctl$sock_SIOCGPGRP(r2, 0x8904, &(0x7f0000000180)=0x0) ioctl$RTC_WIE_ON(r17, 0x700f) ioctl$KVM_XEN_HVM_CONFIG(r17, 0x4038ae7a, &(0x7f0000000440)={0x1648, 0x392, &(0x7f0000000300)="66d8f6e9655753fc7dcde8cf6352f993dd01a76929561e6f5622aa0fc38b50d1fa53e9d58ea1b4cee604606c66190b43689e0c772bb4210d", &(0x7f0000000380)="dfcf423dc450fed9b865b18fe5afdeaef4ab71809c734abf7c7c70ba7a8ff8a62eb151e10b7787024ba12aa3c97be34f933d5b94740463343e496ba0569f4a0a0fabc6de888bacf84a9e6d899bd9ae8a8a70c6ab4b44aff461ee6daa00189f33c25cb5ab8c53ae48feb121d039d927ba1746214ca7c5dcd1adece40cac77fce6d44868e2d8beff7df0cd1be0ef18dd18c033ddf12f0ecd", 0x38, 0x97}) ptrace$setregset(0x4205, r18, 0x6, &(0x7f00000001c0)={&(0x7f0000000280)="10543176564b8d2e9800c1182edd3cfe8eebb4a7d585ec72815253625e33b2d1731a46c4c08c23e4adec5d1ac208bae1ea5a92f81c0856e9a472fe562871c2e46a13ce2449e5", 0x46}) r19 = syz_open_dev$sndpcmc(&(0x7f00000000c0)='/dev/snd/pcmC#D#c\x00', 0x0, 0x0) ioctl$ASHMEM_SET_NAME(r19, 0x41007701, &(0x7f0000000100)='syzkaller0\x00') 13:17:07 executing program 0: perf_event_open(&(0x7f0000000040)={0x2, 0x70, 0x3e5}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f00000021c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000002340)={0xb5, 0x100000000000000, &(0x7f00000000c0)=ANY=[@ANYBLOB="0463044000000000b6a571ac965f26c50d500dae115e59afcd8a338d8b2727193c56d4ebef60c214b766ffde6cff6ceef2baa2594a53a0117e77afd5d58e8a35afdae81b258585ce769507333c0238790d5ed750bf1d6ca2a873050056528fce7becfd12f165ac43a826d3462822ff8f29ea992d4e208847cf4fc10ca00b87b5ce2523fa477bad0be1c97e4398aa2ac81d973b5a871d8e0b295e436cd8415f19088c6c82c85f4ed1fac41da062bc6dbfb8eac4276c"], 0x0, 0x0, &(0x7f00000022c0)}) [ 1529.530715] binder: 15817:15824 BC_REQUEST_DEATH_NOTIFICATION invalid ref 4 [ 1529.542829] binder: 15817:15824 IncRefs 0 refcount change on invalid ref 4 ret -22 [ 1529.571547] binder: 15817:15824 BC_INCREFS_DONE u0000000000000000 no match [ 1529.579898] binder: 15817:15824 IncRefs 0 refcount change on invalid ref 0 ret -22 [ 1529.606086] binder: 15817:15824 IncRefs 0 refcount change on invalid ref 4 ret -22 13:17:07 executing program 6: clone(0x802102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000040), 0xffffffffffffffff) r0 = syz_open_dev$sndtimer(&(0x7f0000000000)='/dev/snd/timer\x00', 0x0, 0x0) r1 = getpid() sched_setscheduler(r1, 0x5, &(0x7f0000000200)) ioctl$SNDRV_TIMER_IOCTL_GPARAMS(r0, 0x40485404, &(0x7f0000000240)={{}, 0x0, 0x2000000000000000, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1000000]}) [ 1529.622952] binder: 15817:15824 BC_INCREFS_DONE u0000000000000000 no match [ 1529.636410] binder: 15817:15824 IncRefs 0 refcount change on invalid ref 0 ret -22 13:17:07 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r0, &(0x7f0000942000)={0x2, 0x4e20, @multicast1}, 0x10) sendmsg$key(0xffffffffffffffff, &(0x7f0000f56000)={0x0, 0x0, &(0x7f00008feff0)={&(0x7f0000000500)=ANY=[@ANYBLOB="020300090a1500000000000000000000030006190000000002000000e0000001003f00000000000002000100e625aa66dcef85847e479eb3c49000000400000000fd003e"], 0x44}}, 0x0) add_key(&(0x7f0000000080)='logon\x00', &(0x7f0000000100)={0x73, 0x79, 0x7a, 0x1}, &(0x7f0000001240), 0x0, 0xfffffffffffffff8) get_mempolicy(&(0x7f0000000000), &(0x7f00000001c0), 0x1ff, &(0x7f0000fff000/0x1000)=nil, 0x3) setsockopt$sock_int(r0, 0x1, 0x3c, &(0x7f0000d4effc)=0x1, 0x4) connect$inet(r0, &(0x7f0000000000)={0x2, 0x4e20, @dev={0xac, 0x14, 0x14, 0x18}}, 0x10) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f00000001c0)='tunl0\x00', 0x5) sendto$inet(r0, &(0x7f00006d1fd4)="db", 0x1, 0x4000010, &(0x7f00004daff0)={0x2, 0x0, @loopback, [0x0, 0x8000a0]}, 0x10) 13:17:07 executing program 5: r0 = syz_open_dev$binder(&(0x7f00000021c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000002340)={0x34, 0x0, &(0x7f0000002240)=[@request_death={0x400c630e, 0x4, 0x4}, @increfs={0x40046304, 0x4}, @increfs_done={0x40106308, 0x0, 0x3}, @increfs], 0x77, 0x0, &(0x7f00000022c0)="b3cd3b76d8e2af743c6f523efe14fd20c3c3dd2572734282a761e1b4304e2599c85f198cc82bd5d0c74c4edca2f9ea7b875ff7047ec0784fbb354e15fd3f7d837f533597d5082692a6f2fb748da3cc4157188f7f2a5477ded56f72f5b75c96872db429e44b8fcd781d96dead77a0b58b7af9085a208a22"}) 13:17:07 executing program 3: r0 = openat$ipvs(0xffffffffffffff9c, &(0x7f0000000180)='/proc/sys/net/ipv4/vs/sync_persist_mode\x00', 0x2, 0x0) ioctl$GIO_FONT(r0, 0x4b60, &(0x7f0000000380)=""/246) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = socket$alg(0x26, 0x5, 0x0) bind$alg(r1, &(0x7f0000000200)={0x26, 'hash\x00', 0x0, 0x0, 'sha1\x00'}, 0x58) r2 = accept$alg(r1, 0x0, 0x0) write$selinux_validatetrans(r0, &(0x7f0000000280)={'system_u:object_r:mouse_device_t:s0', 0x20, 'system_u:object_r:autofs_device_t:s0', 0x20, 0x81, 0x20, '/usr/lib/telepathy/mission-control-5\x00'}, 0x83) sendmmsg(r2, &(0x7f0000007f00)=[{{&(0x7f00000056c0)=@can, 0x3000, &(0x7f00000000c0)}}, {{&(0x7f0000005900)=@pppoe={0x18, 0x0, {0x0, @link_local, 'syzkaller0\x00'}}, 0x80, &(0x7f0000007ac0), 0x1a9, &(0x7f0000007b00)}}], 0x3fffffffffffe0d, 0x0) openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000140)='/dev/sequencer2\x00', 0x80840, 0x0) ioctl$ASHMEM_GET_PIN_STATUS(r0, 0x7709, 0x0) r3 = syz_open_dev$sndpcmc(&(0x7f00000000c0)='/dev/snd/pcmC#D#c\x00', 0x0, 0x0) ioctl$ASHMEM_SET_NAME(r3, 0x41007701, &(0x7f0000000100)='syzkaller0\x00') 13:17:07 executing program 6: clone(0x802102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000040), 0xffffffffffffffff) r0 = syz_open_dev$sndtimer(&(0x7f0000000000)='/dev/snd/timer\x00', 0x0, 0x0) r1 = getpid() sched_setscheduler(r1, 0x5, &(0x7f0000000200)) ioctl$SNDRV_TIMER_IOCTL_GPARAMS(r0, 0x40485404, &(0x7f0000000240)={{}, 0x0, 0x2000000000000000, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x300]}) 13:17:07 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r0, &(0x7f0000942000)={0x2, 0x4e20, @multicast1}, 0x10) sendmsg$key(0xffffffffffffffff, &(0x7f0000f56000)={0x0, 0x0, &(0x7f00008feff0)={&(0x7f0000000500)=ANY=[@ANYBLOB="020300090a1500000000000000000000030006190000000002000000e0000001003f00000000000002000100e625aa66dcef85847e479eb3c49000000400000000fd003e"], 0x44}}, 0x0) add_key(&(0x7f0000000080)='logon\x00', &(0x7f0000000100)={0x73, 0x79, 0x7a, 0x1}, &(0x7f0000001240), 0x0, 0xfffffffffffffff8) get_mempolicy(&(0x7f0000000000), &(0x7f00000001c0), 0x1ff, &(0x7f0000fff000/0x1000)=nil, 0x3) setsockopt$sock_int(r0, 0x1, 0x3c, &(0x7f0000d4effc)=0x1, 0x4) connect$inet(r0, &(0x7f0000000000)={0x2, 0x4e20, @dev={0xac, 0x14, 0x14, 0x18}}, 0x10) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f00000001c0)='tunl0\x00', 0x5) sendto$inet(r0, &(0x7f00006d1fd4)="db", 0x1, 0x4000010, &(0x7f00004daff0)={0x2, 0x0, @loopback, [0x0, 0xfdffffff]}, 0x10) 13:17:08 executing program 6: clone(0x802102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000040), 0xffffffffffffffff) r0 = syz_open_dev$sndtimer(&(0x7f0000000000)='/dev/snd/timer\x00', 0x0, 0x0) r1 = getpid() sched_setscheduler(r1, 0x5, &(0x7f0000000200)) ioctl$SNDRV_TIMER_IOCTL_GPARAMS(r0, 0x40485404, &(0x7f0000000240)={{}, 0x0, 0x2000000000000000, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3]}) 13:17:08 executing program 7: r0 = openat$cuse(0xffffffffffffff9c, &(0x7f0000000080)='/dev/cuse\x00', 0x2, 0x0) clone(0x1002102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000640), 0xffffffffffffffff) r1 = getpid() sched_setscheduler(r1, 0x5, &(0x7f0000000000)) write$FUSE_NOTIFY_DELETE(r0, &(0x7f0000000040)={0x29, 0x6, 0xb00}, 0x29) [ 1529.941165] binder: 15858:15862 IncRefs 0 refcount change on invalid ref 4 ret -22 [ 1530.029864] binder: 15858:15862 BC_INCREFS_DONE u0000000000000000 no match [ 1530.101717] binder: 15858:15862 IncRefs 0 refcount change on invalid ref 0 ret -22 13:17:08 executing program 1: r0 = socket$netlink(0x10, 0x3, 0x8000000004) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_TCP_CONGESTION(r1, 0x6, 0xd, &(0x7f0000000180)='vegas\x00', 0x6) bind$inet6(r1, &(0x7f00001fefe4)={0xa, 0x4e22}, 0x1c) sendto$inet6(r1, &(0x7f0000000100), 0x8d2d601e8976aa5, 0x20000004, &(0x7f000031e000)={0xa, 0x4e22}, 0x1c) writev(r0, &(0x7f0000000100)=[{&(0x7f0000000000)="580000001400192340834b80040d8c560a067f10d8ff81004e220000000058000b4824ca944f64009400050028925aa8000000000000008000f0fffeffff09000000fff5dd00000010000100000c0900fcff0000040e05a5", 0x58}], 0x1) 13:17:08 executing program 7: r0 = openat$cuse(0xffffffffffffff9c, &(0x7f0000000080)='/dev/cuse\x00', 0x2, 0x0) clone(0x1002102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000640), 0xffffffffffffffff) r1 = getpid() sched_setscheduler(r1, 0x5, &(0x7f0000000000)) write$FUSE_NOTIFY_DELETE(r0, &(0x7f0000000040)={0x29, 0x6, 0x700}, 0x29) 13:17:08 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r0, &(0x7f0000942000)={0x2, 0x4e20, @multicast1}, 0x10) sendmsg$key(0xffffffffffffffff, &(0x7f0000f56000)={0x0, 0x0, &(0x7f00008feff0)={&(0x7f0000000500)=ANY=[@ANYBLOB="020300090a1500000000000000000000030006190000000002000000e0000001003f00000000000002000100e625aa66dcef85847e479eb3c49000000400000000fd003e"], 0x44}}, 0x0) add_key(&(0x7f0000000080)='logon\x00', &(0x7f0000000100)={0x73, 0x79, 0x7a, 0x1}, &(0x7f0000001240), 0x0, 0xfffffffffffffff8) get_mempolicy(&(0x7f0000000000), &(0x7f00000001c0), 0x1ff, &(0x7f0000fff000/0x1000)=nil, 0x3) setsockopt$sock_int(r0, 0x1, 0x3c, &(0x7f0000d4effc)=0x1, 0x4) connect$inet(r0, &(0x7f0000000000)={0x2, 0x4e20, @dev={0xac, 0x14, 0x14, 0x18}}, 0x10) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f00000001c0)='tunl0\x00', 0x5) sendto$inet(r0, &(0x7f00006d1fd4)="db", 0x1, 0x4000010, &(0x7f00004daff0)={0x2, 0x0, @loopback, [0x0, 0xf401]}, 0x10) 13:17:08 executing program 5: r0 = syz_open_dev$binder(&(0x7f00000021c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000002340)={0x34, 0x0, &(0x7f0000002240)=[@request_death={0x400c630e, 0x4, 0x4}, @increfs={0x40046304, 0x4}, @increfs_done={0x40106308, 0x0, 0x3}, @increfs], 0x77, 0x0, &(0x7f00000022c0)="b3cd0876d8e2af743c6f523efe14fd20c3c3dd2572734282a761e1b4304e2599c85f198cc82bd5d0c74c4edca2f9ea7b875ff7047ec0784fbb354e15fd3f7d837f533597d5082692a6f2fb748da3cc4157188f7f2a5477ded56f72f5b75c96872db429e44b8fcd781d96dead77a0b58b7af9085a208a22"}) 13:17:08 executing program 6: clone(0x802102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000040), 0xffffffffffffffff) r0 = syz_open_dev$sndtimer(&(0x7f0000000000)='/dev/snd/timer\x00', 0x0, 0x0) r1 = getpid() sched_setscheduler(r1, 0x5, &(0x7f0000000200)) ioctl$SNDRV_TIMER_IOCTL_GPARAMS(r0, 0x40485404, &(0x7f0000000240)={{}, 0x0, 0x2000000000000000, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x100000000000000]}) 13:17:08 executing program 3: perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) syz_open_dev$amidi(&(0x7f00000001c0)='/dev/amidi#\x00', 0xfc60000000000000, 0x40) r0 = socket$alg(0x26, 0x5, 0x0) openat$selinux_relabel(0xffffffffffffff9c, &(0x7f0000000180)='/selinux/relabel\x00', 0x2, 0x0) bind$alg(r0, &(0x7f0000000200)={0x26, 'hash\x00', 0x0, 0x0, 'sha1\x00'}, 0x58) r1 = accept$alg(r0, 0x0, 0x0) sendmmsg(r1, &(0x7f0000007f00)=[{{&(0x7f00000056c0)=@can, 0x3000, &(0x7f00000000c0)}}, {{&(0x7f0000005900)=@pppoe={0x18, 0x0, {0x0, @link_local, 'syzkaller0\x00'}}, 0x80, &(0x7f0000007ac0), 0x1a9, &(0x7f0000007b00)}}], 0x3fffffffffffe0d, 0x0) openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000140)='/dev/sequencer2\x00', 0x80840, 0x0) chown(&(0x7f0000000340)='./file0\x00', 0x0, 0x0) r2 = syz_open_dev$sndpcmc(&(0x7f00000000c0)='/dev/snd/pcmC#D#c\x00', 0x0, 0x0) ioctl$ASHMEM_SET_NAME(r2, 0x41007701, &(0x7f0000000100)='syzkaller0\x00') 13:17:08 executing program 0: perf_event_open(&(0x7f0000000040)={0x2, 0x70, 0x3e5}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f00000021c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000002340)={0xb5, 0x600000000000000, &(0x7f00000000c0)=ANY=[@ANYBLOB="0463044000000000b6a571ac965f26c50d500dae115e59afcd8a338d8b2727193c56d4ebef60c214b766ffde6cff6ceef2baa2594a53a0117e77afd5d58e8a35afdae81b258585ce769507333c0238790d5ed750bf1d6ca2a873050056528fce7becfd12f165ac43a826d3462822ff8f29ea992d4e208847cf4fc10ca00b87b5ce2523fa477bad0be1c97e4398aa2ac81d973b5a871d8e0b295e436cd8415f19088c6c82c85f4ed1fac41da062bc6dbfb8eac4276c"], 0x0, 0x0, &(0x7f00000022c0)}) 13:17:08 executing program 4: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) gettid() perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x3e5}, 0x0, 0x0, 0xffffffffffffffff, 0x0) fcntl$setown(r0, 0x8, 0x0) bind$inet6(r0, &(0x7f0000807fe4)={0xa, 0x4e22}, 0x1c) sendto$inet6(r0, &(0x7f0000000380), 0x0, 0x200408d4, &(0x7f000072e000)={0xa, 0x4e22, 0x0, @loopback}, 0x1c) sendto$inet6(r0, &(0x7f0000ad6fad)='\x00', 0x1, 0x3fffffd, &(0x7f0000254000)={0xa, 0x0, 0x0, @loopback}, 0x1c) 13:17:08 executing program 6: clone(0x802102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000040), 0xffffffffffffffff) r0 = syz_open_dev$sndtimer(&(0x7f0000000000)='/dev/snd/timer\x00', 0x0, 0x0) r1 = getpid() sched_setscheduler(r1, 0x5, &(0x7f0000000200)) ioctl$SNDRV_TIMER_IOCTL_GPARAMS(r0, 0x40485404, &(0x7f0000000240)={{}, 0x0, 0x2000000000000000, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x300000000000000]}) [ 1530.406791] binder: 15891:15897 BC_INCREFS_DONE u0000000000000000 no match 13:17:08 executing program 6: clone(0x802102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000040), 0xffffffffffffffff) r0 = syz_open_dev$sndtimer(&(0x7f0000000000)='/dev/snd/timer\x00', 0x0, 0x0) r1 = getpid() sched_setscheduler(r1, 0x5, &(0x7f0000000200)) ioctl$SNDRV_TIMER_IOCTL_GPARAMS(r0, 0x40485404, &(0x7f0000000240)={{}, 0x0, 0x2000000000000000, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3000000]}) 13:17:08 executing program 7: r0 = openat$cuse(0xffffffffffffff9c, &(0x7f0000000080)='/dev/cuse\x00', 0x2, 0x0) clone(0x1002102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000640), 0xffffffffffffffff) r1 = getpid() sched_setscheduler(r1, 0x5, &(0x7f0000000000)) write$FUSE_NOTIFY_DELETE(r0, &(0x7f0000000040)={0x29, 0x6, 0x900}, 0x29) 13:17:08 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r0, &(0x7f0000942000)={0x2, 0x4e20, @multicast1}, 0x10) sendmsg$key(0xffffffffffffffff, &(0x7f0000f56000)={0x0, 0x0, &(0x7f00008feff0)={&(0x7f0000000500)=ANY=[@ANYBLOB="020300090a1500000000000000000000030006190000000002000000e0000001003f00000000000002000100e625aa66dcef85847e479eb3c49000000400000000fd003e"], 0x44}}, 0x0) add_key(&(0x7f0000000080)='logon\x00', &(0x7f0000000100)={0x73, 0x79, 0x7a, 0x1}, &(0x7f0000001240), 0x0, 0xfffffffffffffff8) get_mempolicy(&(0x7f0000000000), &(0x7f00000001c0), 0x1ff, &(0x7f0000fff000/0x1000)=nil, 0x3) setsockopt$sock_int(r0, 0x1, 0x3c, &(0x7f0000d4effc)=0x1, 0x4) connect$inet(r0, &(0x7f0000000000)={0x2, 0x4e20, @dev={0xac, 0x14, 0x14, 0x18}}, 0x10) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f00000001c0)='tunl0\x00', 0x5) sendto$inet(r0, &(0x7f00006d1fd4)="db", 0x1, 0x4000010, &(0x7f00004daff0)={0x2, 0x0, @loopback, [0x0, 0x4900000000000000]}, 0x10) 13:17:08 executing program 5: r0 = syz_open_dev$binder(&(0x7f00000021c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000002340)={0x34, 0x0, &(0x7f0000002240)=[@request_death={0x400c630e, 0x4, 0x4}, @increfs={0x40046304, 0x4}, @increfs_done={0x40106308, 0x0, 0x3}, @increfs], 0x77, 0x0, &(0x7f00000022c0)="b3cd0e76d8e2af743c6f523efe14fd20c3c3dd2572734282a761e1b4304e2599c85f198cc82bd5d0c74c4edca2f9ea7b875ff7047ec0784fbb354e15fd3f7d837f533597d5082692a6f2fb748da3cc4157188f7f2a5477ded56f72f5b75c96872db429e44b8fcd781d96dead77a0b58b7af9085a208a22"}) 13:17:08 executing program 3: perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000200)={0x26, 'hash\x00', 0x0, 0x0, 'sha1\x00'}, 0x58) r1 = accept$alg(r0, 0x0, 0x0) sendmmsg(r1, &(0x7f0000007f00)=[{{&(0x7f00000056c0)=@can, 0x3000, &(0x7f00000000c0)}}, {{&(0x7f0000005900)=@pppoe={0x18, 0x0, {0x0, @link_local, 'syzkaller0\x00'}}, 0x80, &(0x7f0000007ac0), 0x1a9, &(0x7f0000007b00)}}], 0x3fffffffffffe0d, 0x0) r2 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vhost-vsock\x00', 0x2, 0x0) getresuid(&(0x7f0000000280)=0x0, &(0x7f00000002c0), &(0x7f0000000300)) r4 = getgid() lchown(&(0x7f00000001c0)='./file0\x00', r3, r4) ioctl$VHOST_VSOCK_SET_GUEST_CID(r2, 0x4008af60, &(0x7f0000000040)={@my=0x0}) r5 = socket$vsock_stream(0x28, 0x1, 0x0) connect$vsock_dgram(r5, &(0x7f0000000080)={0x28, 0x0, 0x0, @hyper}, 0x10) openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000140)='/dev/sequencer2\x00', 0x80840, 0x0) chown(&(0x7f0000000180)='./file0\x00', 0x0, 0x0) r6 = syz_open_dev$sndpcmc(&(0x7f00000000c0)='/dev/snd/pcmC#D#c\x00', 0x0, 0x0) ioctl$ASHMEM_SET_NAME(r6, 0x41007701, &(0x7f0000000100)='syzkaller0\x00') [ 1530.729838] binder: 15932:15937 BC_INCREFS_DONE u0000000000000000 no match 13:17:08 executing program 5: r0 = syz_open_dev$binder(&(0x7f00000021c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000002340)={0x34, 0x0, &(0x7f0000002240)=[@request_death={0x400c630e, 0x4, 0x4}, @increfs={0x40046304, 0x4}, @increfs_done={0x40106308, 0x0, 0x3}, @increfs], 0x77, 0x0, &(0x7f00000022c0)="b3cd0276d8e2af743c6f523efe14fd20c3c3dd2572734282a761e1b4304e2599c85f198cc82bd5d0c74c4edca2f9ea7b875ff7047ec0784fbb354e15fd3f7d837f533597d5082692a6f2fb748da3cc4157188f7f2a5477ded56f72f5b75c96872db429e44b8fcd781d96dead77a0b58b7af9085a208a22"}) 13:17:08 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r0, &(0x7f0000942000)={0x2, 0x4e20, @multicast1}, 0x10) sendmsg$key(0xffffffffffffffff, &(0x7f0000f56000)={0x0, 0x0, &(0x7f00008feff0)={&(0x7f0000000500)=ANY=[@ANYBLOB="020300090a1500000000000000000000030006190000000002000000e0000001003f00000000000002000100e625aa66dcef85847e479eb3c49000000400000000fd003e"], 0x44}}, 0x0) add_key(&(0x7f0000000080)='logon\x00', &(0x7f0000000100)={0x73, 0x79, 0x7a, 0x1}, &(0x7f0000001240), 0x0, 0xfffffffffffffff8) get_mempolicy(&(0x7f0000000000), &(0x7f00000001c0), 0x1ff, &(0x7f0000fff000/0x1000)=nil, 0x3) setsockopt$sock_int(r0, 0x1, 0x3c, &(0x7f0000d4effc)=0x1, 0x4) connect$inet(r0, &(0x7f0000000000)={0x2, 0x4e20, @dev={0xac, 0x14, 0x14, 0x18}}, 0x10) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f00000001c0)='tunl0\x00', 0x5) sendto$inet(r0, &(0x7f00006d1fd4)="db", 0x1, 0x4000010, &(0x7f00004daff0)={0x2, 0x0, @loopback, [0x0, 0x1100000000000000]}, 0x10) [ 1530.862704] binder: 15946:15948 BC_INCREFS_DONE u0000000000000000 no match 13:17:09 executing program 1: r0 = socket$netlink(0x10, 0x3, 0x8000000004) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_TCP_CONGESTION(r1, 0x6, 0xd, &(0x7f0000000180)='vegas\x00', 0x6) bind$inet6(r1, &(0x7f00001fefe4)={0xa, 0x4e22}, 0x1c) sendto$inet6(r1, &(0x7f0000000100), 0x8d2d601e8976aa5, 0x20000004, &(0x7f000031e000)={0xa, 0x4e22}, 0x1c) writev(r0, &(0x7f0000000100)=[{&(0x7f0000000000)="580000001400192340834b80040d8c560a067f3efbff81004e220000000058000b4824ca944f64009400050028925aa8000000000000008000f0fffeffff09000000fff5dd00000010000100000c0900fcff0000040e05a5", 0x58}], 0x1) 13:17:09 executing program 6: clone(0x802102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000040), 0xffffffffffffffff) r0 = syz_open_dev$sndtimer(&(0x7f0000000000)='/dev/snd/timer\x00', 0x0, 0x0) r1 = getpid() sched_setscheduler(r1, 0x5, &(0x7f0000000200)) ioctl$SNDRV_TIMER_IOCTL_GPARAMS(r0, 0x40485404, &(0x7f0000000240)={{}, 0x0, 0x2000000000000000, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x300]}) 13:17:09 executing program 7: r0 = openat$cuse(0xffffffffffffff9c, &(0x7f0000000080)='/dev/cuse\x00', 0x2, 0x0) clone(0x1002102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000640), 0xffffffffffffffff) r1 = getpid() sched_setscheduler(r1, 0x5, &(0x7f0000000000)) write$FUSE_NOTIFY_DELETE(r0, &(0x7f0000000040)={0x29, 0x6, 0x500000000000000}, 0x29) 13:17:09 executing program 5: r0 = syz_open_dev$binder(&(0x7f00000021c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000002340)={0x34, 0x0, &(0x7f0000002240)=[@request_death={0x400c630e, 0x4, 0x4}, @increfs={0x40046304, 0x4}, @increfs_done={0x40106308, 0x0, 0x3}, @increfs], 0x77, 0x0, &(0x7f00000022c0)="b3cd0576d8e2af743c6f523efe14fd20c3c3dd2572734282a761e1b4304e2599c85f198cc82bd5d0c74c4edca2f9ea7b875ff7047ec0784fbb354e15fd3f7d837f533597d5082692a6f2fb748da3cc4157188f7f2a5477ded56f72f5b75c96872db429e44b8fcd781d96dead77a0b58b7af9085a208a22"}) 13:17:09 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r0, &(0x7f0000942000)={0x2, 0x4e20, @multicast1}, 0x10) sendmsg$key(0xffffffffffffffff, &(0x7f0000f56000)={0x0, 0x0, &(0x7f00008feff0)={&(0x7f0000000500)=ANY=[@ANYBLOB="020300090a1500000000000000000000030006190000000002000000e0000001003f00000000000002000100e625aa66dcef85847e479eb3c49000000400000000fd003e"], 0x44}}, 0x0) add_key(&(0x7f0000000080)='logon\x00', &(0x7f0000000100)={0x73, 0x79, 0x7a, 0x1}, &(0x7f0000001240), 0x0, 0xfffffffffffffff8) get_mempolicy(&(0x7f0000000000), &(0x7f00000001c0), 0x1ff, &(0x7f0000fff000/0x1000)=nil, 0x3) setsockopt$sock_int(r0, 0x1, 0x3c, &(0x7f0000d4effc)=0x1, 0x4) connect$inet(r0, &(0x7f0000000000)={0x2, 0x4e20, @dev={0xac, 0x14, 0x14, 0x18}}, 0x10) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f00000001c0)='tunl0\x00', 0x5) sendto$inet(r0, &(0x7f00006d1fd4)="db", 0x1, 0x4000010, &(0x7f00004daff0)={0x2, 0x0, @loopback, [0x0, 0x3f000000]}, 0x10) 13:17:09 executing program 0: perf_event_open(&(0x7f0000000040)={0x2, 0x70, 0x3e5}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f00000021c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000002340)={0xb5, 0x6c00000000000000, &(0x7f00000000c0)=ANY=[@ANYBLOB="0463044000000000b6a571ac965f26c50d500dae115e59afcd8a338d8b2727193c56d4ebef60c214b766ffde6cff6ceef2baa2594a53a0117e77afd5d58e8a35afdae81b258585ce769507333c0238790d5ed750bf1d6ca2a873050056528fce7becfd12f165ac43a826d3462822ff8f29ea992d4e208847cf4fc10ca00b87b5ce2523fa477bad0be1c97e4398aa2ac81d973b5a871d8e0b295e436cd8415f19088c6c82c85f4ed1fac41da062bc6dbfb8eac4276c"], 0x0, 0x0, &(0x7f00000022c0)}) 13:17:09 executing program 3: syz_open_dev$sndpcmc(&(0x7f0000000180)='/dev/snd/pcmC#D#c\x00', 0x8, 0x80000) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) bind$alg(0xffffffffffffffff, &(0x7f0000000200)={0x26, 'hash\x00', 0x0, 0x0, 'sha1\x00'}, 0x58) accept$alg(0xffffffffffffffff, 0x0, 0x0) openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000140)='/dev/sequencer2\x00', 0x80840, 0x0) chown(&(0x7f0000000340)='./file0\x00', 0x0, 0x0) r0 = syz_open_dev$sndpcmc(&(0x7f00000000c0)='/dev/snd/pcmC#D#c\x00', 0x0, 0x0) ioctl$ASHMEM_SET_NAME(r0, 0x41007701, &(0x7f0000000100)='syzkaller0\x00') 13:17:09 executing program 4: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) gettid() perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x3e5}, 0x0, 0x0, 0xffffffffffffffff, 0x0) fcntl$setown(r0, 0x8, 0x0) bind$inet6(r0, &(0x7f0000807fe4)={0xa, 0x4e22}, 0x1c) sendto$inet6(r0, &(0x7f0000000380), 0x0, 0x200408d4, &(0x7f000072e000)={0xa, 0x4e22, 0x0, @loopback}, 0x1c) sendto$inet6(r0, &(0x7f0000ad6fad)='\x00', 0x1, 0x3fffffd, &(0x7f0000254000)={0xa, 0x0, 0x0, @loopback}, 0x1c) 13:17:09 executing program 3: perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$alg(0x26, 0x5, 0x0) r1 = open(&(0x7f0000000180)='./file0\x00', 0x420480, 0x101) ioctl$EVIOCGKEYCODE_V2(r1, 0x80284504, &(0x7f0000000280)=""/179) bind$alg(r0, &(0x7f0000000200)={0x26, 'hash\x00', 0x0, 0x0, 'sha1\x00'}, 0x58) r2 = accept$alg(r0, 0x0, 0x0) sendmmsg(r2, &(0x7f0000007f00)=[{{&(0x7f00000056c0)=@can, 0x3000, &(0x7f00000000c0)}}, {{&(0x7f0000005900)=@pppoe={0x18, 0x0, {0x0, @link_local, 'syzkaller0\x00'}}, 0x80, &(0x7f0000007ac0), 0x1a9, &(0x7f0000007b00)}}], 0x3fffffffffffe0d, 0x0) openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000140)='/dev/sequencer2\x00', 0x80840, 0x0) chown(&(0x7f0000000340)='./file0\x00', 0x0, 0x0) r3 = syz_open_dev$sndpcmc(&(0x7f00000000c0)='/dev/snd/pcmC#D#c\x00', 0x0, 0x0) ioctl$ASHMEM_SET_NAME(r3, 0x41007701, &(0x7f0000000100)='syzkaller0\x00') 13:17:09 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r0, &(0x7f0000942000)={0x2, 0x4e20, @multicast1}, 0x10) sendmsg$key(0xffffffffffffffff, &(0x7f0000f56000)={0x0, 0x0, &(0x7f00008feff0)={&(0x7f0000000500)=ANY=[@ANYBLOB="020300090a1500000000000000000000030006190000000002000000e0000001003f00000000000002000100e625aa66dcef85847e479eb3c49000000400000000fd003e"], 0x44}}, 0x0) add_key(&(0x7f0000000080)='logon\x00', &(0x7f0000000100)={0x73, 0x79, 0x7a, 0x1}, &(0x7f0000001240), 0x0, 0xfffffffffffffff8) get_mempolicy(&(0x7f0000000000), &(0x7f00000001c0), 0x1ff, &(0x7f0000fff000/0x1000)=nil, 0x3) setsockopt$sock_int(r0, 0x1, 0x3c, &(0x7f0000d4effc)=0x1, 0x4) connect$inet(r0, &(0x7f0000000000)={0x2, 0x4e20, @dev={0xac, 0x14, 0x14, 0x18}}, 0x10) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f00000001c0)='tunl0\x00', 0x5) sendto$inet(r0, &(0x7f00006d1fd4)="db", 0x1, 0x4000010, &(0x7f00004daff0)={0x2, 0x0, @loopback, [0x0, 0x100000]}, 0x10) [ 1531.362349] binder_thread_write: 5 callbacks suppressed [ 1531.362362] binder: 15970:15981 BC_REQUEST_DEATH_NOTIFICATION invalid ref 4 [ 1531.384038] binder: 15970:15981 BC_INCREFS_DONE u0000000000000000 no match 13:17:09 executing program 5: r0 = syz_open_dev$binder(&(0x7f00000021c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000002340)={0x34, 0x0, &(0x7f0000002240)=[@request_death={0x400c630e, 0x4, 0x4}, @increfs={0x40046304, 0x4}, @increfs_done={0x40106308, 0x0, 0x3}, @increfs], 0x77, 0x0, &(0x7f00000022c0)="b3cd5476d8e2af743c6f523efe14fd20c3c3dd2572734282a761e1b4304e2599c85f198cc82bd5d0c74c4edca2f9ea7b875ff7047ec0784fbb354e15fd3f7d837f533597d5082692a6f2fb748da3cc4157188f7f2a5477ded56f72f5b75c96872db429e44b8fcd781d96dead77a0b58b7af9085a208a22"}) 13:17:09 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r0, &(0x7f0000942000)={0x2, 0x4e20, @multicast1}, 0x10) sendmsg$key(0xffffffffffffffff, &(0x7f0000f56000)={0x0, 0x0, &(0x7f00008feff0)={&(0x7f0000000500)=ANY=[@ANYBLOB="020300090a1500000000000000000000030006190000000002000000e0000001003f00000000000002000100e625aa66dcef85847e479eb3c49000000400000000fd003e"], 0x44}}, 0x0) add_key(&(0x7f0000000080)='logon\x00', &(0x7f0000000100)={0x73, 0x79, 0x7a, 0x1}, &(0x7f0000001240), 0x0, 0xfffffffffffffff8) get_mempolicy(&(0x7f0000000000), &(0x7f00000001c0), 0x1ff, &(0x7f0000fff000/0x1000)=nil, 0x3) setsockopt$sock_int(r0, 0x1, 0x3c, &(0x7f0000d4effc)=0x1, 0x4) connect$inet(r0, &(0x7f0000000000)={0x2, 0x4e20, @dev={0xac, 0x14, 0x14, 0x18}}, 0x10) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f00000001c0)='tunl0\x00', 0x5) sendto$inet(r0, &(0x7f00006d1fd4)="db", 0x1, 0x4000010, &(0x7f00004daff0)={0x2, 0x0, @loopback, [0x0, 0xa00]}, 0x10) 13:17:09 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r0, &(0x7f0000942000)={0x2, 0x4e20, @multicast1}, 0x10) sendmsg$key(0xffffffffffffffff, &(0x7f0000f56000)={0x0, 0x0, &(0x7f00008feff0)={&(0x7f0000000500)=ANY=[@ANYBLOB="020300090a1500000000000000000000030006190000000002000000e0000001003f00000000000002000100e625aa66dcef85847e479eb3c49000000400000000fd003e"], 0x44}}, 0x0) add_key(&(0x7f0000000080)='logon\x00', &(0x7f0000000100)={0x73, 0x79, 0x7a, 0x1}, &(0x7f0000001240), 0x0, 0xfffffffffffffff8) get_mempolicy(&(0x7f0000000000), &(0x7f00000001c0), 0x1ff, &(0x7f0000fff000/0x1000)=nil, 0x3) setsockopt$sock_int(r0, 0x1, 0x3c, &(0x7f0000d4effc)=0x1, 0x4) connect$inet(r0, &(0x7f0000000000)={0x2, 0x4e20, @dev={0xac, 0x14, 0x14, 0x18}}, 0x10) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f00000001c0)='tunl0\x00', 0x5) sendto$inet(r0, &(0x7f00006d1fd4)="db", 0x1, 0x4000010, &(0x7f00004daff0)={0x2, 0x0, @loopback, [0x0, 0x500]}, 0x10) [ 1531.618990] binder: 15998:16006 BC_REQUEST_DEATH_NOTIFICATION invalid ref 4 [ 1531.646536] binder: 15998:16006 BC_INCREFS_DONE u0000000000000000 no match 13:17:09 executing program 5: r0 = syz_open_dev$binder(&(0x7f00000021c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000002340)={0x34, 0x0, &(0x7f0000002240)=[@request_death={0x400c630e, 0x4, 0x4}, @increfs={0x40046304, 0x4}, @increfs_done={0x40106308, 0x0, 0x3}, @increfs], 0x77, 0x0, &(0x7f00000022c0)="b3cd0476d8e2af743c6f523efe14fd20c3c3dd2572734282a761e1b4304e2599c85f198cc82bd5d0c74c4edca2f9ea7b875ff7047ec0784fbb354e15fd3f7d837f533597d5082692a6f2fb748da3cc4157188f7f2a5477ded56f72f5b75c96872db429e44b8fcd781d96dead77a0b58b7af9085a208a22"}) 13:17:09 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r0, &(0x7f0000942000)={0x2, 0x4e20, @multicast1}, 0x10) sendmsg$key(0xffffffffffffffff, &(0x7f0000f56000)={0x0, 0x0, &(0x7f00008feff0)={&(0x7f0000000500)=ANY=[@ANYBLOB="020300090a1500000000000000000000030006190000000002000000e0000001003f00000000000002000100e625aa66dcef85847e479eb3c49000000400000000fd003e"], 0x44}}, 0x0) add_key(&(0x7f0000000080)='logon\x00', &(0x7f0000000100)={0x73, 0x79, 0x7a, 0x1}, &(0x7f0000001240), 0x0, 0xfffffffffffffff8) get_mempolicy(&(0x7f0000000000), &(0x7f00000001c0), 0x1ff, &(0x7f0000fff000/0x1000)=nil, 0x3) setsockopt$sock_int(r0, 0x1, 0x3c, &(0x7f0000d4effc)=0x1, 0x4) connect$inet(r0, &(0x7f0000000000)={0x2, 0x4e20, @dev={0xac, 0x14, 0x14, 0x18}}, 0x10) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f00000001c0)='tunl0\x00', 0x5) sendto$inet(r0, &(0x7f00006d1fd4)="db", 0x1, 0x4000010, &(0x7f00004daff0)={0x2, 0x0, @loopback, [0x0, 0xe000000]}, 0x10) 13:17:09 executing program 3: r0 = perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = socket$alg(0x26, 0x5, 0x0) bind$alg(r1, &(0x7f0000000280)={0x26, 'hash\x00', 0x0, 0x0, 'sha1\x00'}, 0x58) r2 = accept$alg(r1, 0x0, 0x0) r3 = openat$mixer(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/mixer\x00', 0x40000, 0x0) getsockopt$sock_cred(r3, 0x1, 0x11, &(0x7f0000000200)={0x0}, &(0x7f0000000240)=0xc) r5 = getpgrp(0x0) kcmp(r4, r5, 0x3, r3, r0) sendmmsg(r2, &(0x7f0000007f00)=[{{&(0x7f00000056c0)=@can, 0x3000, &(0x7f00000000c0)}}, {{&(0x7f0000005900)=@pppoe={0x18, 0x0, {0x0, @link_local, 'syzkaller0\x00'}}, 0x80, &(0x7f0000007ac0), 0x1a9, &(0x7f0000007b00)}}], 0x3fffffffffffe0d, 0x0) openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000140)='/dev/sequencer2\x00', 0x80840, 0x0) chown(&(0x7f0000000340)='./file0\x00', 0x0, 0x0) r6 = syz_open_dev$sndpcmc(&(0x7f00000000c0)='/dev/snd/pcmC#D#c\x00', 0x0, 0x0) ioctl$ASHMEM_SET_NAME(r6, 0x41007701, &(0x7f0000000100)='syzkaller0\x00') ioctl$BLKBSZSET(r6, 0x40081271, &(0x7f0000000180)=0x230) [ 1531.801843] binder: 16016:16018 BC_REQUEST_DEATH_NOTIFICATION invalid ref 4 13:17:10 executing program 1: r0 = socket$netlink(0x10, 0x3, 0x8000000004) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_TCP_CONGESTION(r1, 0x6, 0xd, &(0x7f0000000180)='vegas\x00', 0x6) bind$inet6(r1, &(0x7f00001fefe4)={0xa, 0x4e22}, 0x1c) sendto$inet6(r1, &(0x7f0000000100), 0x8d2d601e8976aa5, 0x20000004, &(0x7f000031e000)={0xa, 0x4e22}, 0x1c) writev(r0, &(0x7f0000000100)=[{&(0x7f0000000000)="580000001400192340834b80040d8c560a067fab28ff81004e220000000058000b4824ca944f64009400050028925aa8000000000000008000f0fffeffff09000000fff5dd00000010000100000c0900fcff0000040e05a5", 0x58}], 0x1) 13:17:10 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r0, &(0x7f0000942000)={0x2, 0x4e20, @multicast1}, 0x10) sendmsg$key(0xffffffffffffffff, &(0x7f0000f56000)={0x0, 0x0, &(0x7f00008feff0)={&(0x7f0000000500)=ANY=[@ANYBLOB="020300090a1500000000000000000000030006190000000002000000e0000001003f00000000000002000100e625aa66dcef85847e479eb3c49000000400000000fd003e"], 0x44}}, 0x0) add_key(&(0x7f0000000080)='logon\x00', &(0x7f0000000100)={0x73, 0x79, 0x7a, 0x1}, &(0x7f0000001240), 0x0, 0xfffffffffffffff8) get_mempolicy(&(0x7f0000000000), &(0x7f00000001c0), 0x1ff, &(0x7f0000fff000/0x1000)=nil, 0x3) setsockopt$sock_int(r0, 0x1, 0x3c, &(0x7f0000d4effc)=0x1, 0x4) connect$inet(r0, &(0x7f0000000000)={0x2, 0x4e20, @dev={0xac, 0x14, 0x14, 0x18}}, 0x10) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f00000001c0)='tunl0\x00', 0x5) sendto$inet(r0, &(0x7f00006d1fd4)="db", 0x1, 0x4000010, &(0x7f00004daff0)={0x2, 0x0, @loopback, [0x0, 0xffffffffa0028000]}, 0x10) 13:17:10 executing program 6: clone(0x802102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000040), 0xffffffffffffffff) r0 = syz_open_dev$sndtimer(&(0x7f0000000000)='/dev/snd/timer\x00', 0x0, 0x0) r1 = getpid() sched_setscheduler(r1, 0x5, &(0x7f0000000200)) ioctl$SNDRV_TIMER_IOCTL_GPARAMS(r0, 0x40485404, &(0x7f0000000240)={{}, 0x0, 0x2000000000000000, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3]}) 13:17:10 executing program 7: r0 = openat$cuse(0xffffffffffffff9c, &(0x7f0000000080)='/dev/cuse\x00', 0x2, 0x0) clone(0x1002102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000640), 0xffffffffffffffff) r1 = getpid() sched_setscheduler(r1, 0x5, &(0x7f0000000000)) write$FUSE_NOTIFY_DELETE(r0, &(0x7f0000000040)={0x29, 0x6, 0x8000000}, 0x29) 13:17:10 executing program 5: r0 = syz_open_dev$binder(&(0x7f00000021c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000002340)={0x34, 0x0, &(0x7f0000002240)=[@request_death={0x400c630e, 0x4, 0x4}, @increfs={0x40046304, 0x4}, @increfs_done={0x40106308, 0x0, 0x3}, @increfs], 0x77, 0x0, &(0x7f00000022c0)="b3cd1176d8e2af743c6f523efe14fd20c3c3dd2572734282a761e1b4304e2599c85f198cc82bd5d0c74c4edca2f9ea7b875ff7047ec0784fbb354e15fd3f7d837f533597d5082692a6f2fb748da3cc4157188f7f2a5477ded56f72f5b75c96872db429e44b8fcd781d96dead77a0b58b7af9085a208a22"}) 13:17:10 executing program 4: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = gettid() perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x3e5}, 0x0, 0x0, 0xffffffffffffffff, 0x0) fcntl$setown(r0, 0x8, r1) bind$inet6(0xffffffffffffffff, &(0x7f0000807fe4)={0xa, 0x4e22}, 0x1c) sendto$inet6(r0, &(0x7f0000000380), 0x0, 0x200408d4, &(0x7f000072e000)={0xa, 0x4e22, 0x0, @loopback}, 0x1c) sendto$inet6(r0, &(0x7f0000ad6fad)='\x00', 0x1, 0x3fffffd, &(0x7f0000254000)={0xa, 0x0, 0x0, @loopback}, 0x1c) 13:17:10 executing program 0: perf_event_open(&(0x7f0000000040)={0x2, 0x70, 0x3e5}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f00000021c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000002340)={0xb5, 0xa0028000, &(0x7f00000000c0)=ANY=[@ANYBLOB="0463044000000000b6a571ac965f26c50d500dae115e59afcd8a338d8b2727193c56d4ebef60c214b766ffde6cff6ceef2baa2594a53a0117e77afd5d58e8a35afdae81b258585ce769507333c0238790d5ed750bf1d6ca2a873050056528fce7becfd12f165ac43a826d3462822ff8f29ea992d4e208847cf4fc10ca00b87b5ce2523fa477bad0be1c97e4398aa2ac81d973b5a871d8e0b295e436cd8415f19088c6c82c85f4ed1fac41da062bc6dbfb8eac4276c"], 0x0, 0x0, &(0x7f00000022c0)}) 13:17:10 executing program 3: perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000200)={0x26, 'hash\x00', 0x0, 0x0, 'sha1\x00'}, 0x58) r1 = accept$alg(r0, 0x0, 0x0) sendmmsg(r1, &(0x7f0000007f00)=[{{&(0x7f00000056c0)=@can, 0x3000, &(0x7f00000000c0)}}, {{&(0x7f0000005900)=@pppoe={0x18, 0x0, {0x0, @link_local, 'syzkaller0\x00'}}, 0x80, &(0x7f0000007ac0), 0x1a9, &(0x7f0000007b00)}}], 0x3fffffffffffe0d, 0x0) getresgid(&(0x7f0000000280), &(0x7f00000002c0), &(0x7f0000000300)=0x0) getresgid(&(0x7f0000000380)=0x0, &(0x7f00000003c0), &(0x7f0000000400)) getsockopt$sock_cred(r0, 0x1, 0x11, &(0x7f0000000440)={0x0, 0x0, 0x0}, &(0x7f0000000480)=0xc) r5 = getgid() lstat(&(0x7f00000004c0)='./file0\x00', &(0x7f0000000500)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) fstat(r0, &(0x7f0000000580)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) getsockopt$sock_cred(r0, 0x1, 0x11, &(0x7f0000000600)={0x0, 0x0, 0x0}, &(0x7f0000000640)=0xc) lsetxattr$system_posix_acl(&(0x7f0000000180)='./file0\x00', &(0x7f00000001c0)='system.posix_acl_default\x00', &(0x7f0000000680)={{}, {}, [], {0x4, 0x7}, [{0x8, 0x2, r2}, {0x8, 0x1, r3}, {0x8, 0x7, r4}, {0x8, 0x4, r5}, {0x8, 0x3, r6}, {0x8, 0x1, r7}, {0x8, 0x5, r8}], {0x10, 0x7}}, 0x5c, 0x2) openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000140)='/dev/sequencer2\x00', 0x80840, 0x0) chown(&(0x7f0000000340)='./file0\x00', 0x0, 0x0) r9 = syz_open_dev$sndpcmc(&(0x7f00000000c0)='/dev/snd/pcmC#D#c\x00', 0x0, 0x0) ioctl$ASHMEM_SET_NAME(r9, 0x41007701, &(0x7f0000000100)='syzkaller0\x00') [ 1532.202216] binder: 16040:16047 BC_REQUEST_DEATH_NOTIFICATION invalid ref 4 13:17:10 executing program 6: clone(0x802102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000040), 0xffffffffffffffff) r0 = syz_open_dev$sndtimer(&(0x7f0000000000)='/dev/snd/timer\x00', 0x0, 0x0) r1 = getpid() sched_setscheduler(r1, 0x5, &(0x7f0000000200)) ioctl$SNDRV_TIMER_IOCTL_GPARAMS(r0, 0x40485404, &(0x7f0000000240)={{}, 0x0, 0x2000000000000000, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x100000000000000]}) 13:17:10 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r0, &(0x7f0000942000)={0x2, 0x4e20, @multicast1}, 0x10) sendmsg$key(0xffffffffffffffff, &(0x7f0000f56000)={0x0, 0x0, &(0x7f00008feff0)={&(0x7f0000000500)=ANY=[@ANYBLOB="020300090a1500000000000000000000030006190000000002000000e0000001003f00000000000002000100e625aa66dcef85847e479eb3c49000000400000000fd003e"], 0x44}}, 0x0) add_key(&(0x7f0000000080)='logon\x00', &(0x7f0000000100)={0x73, 0x79, 0x7a, 0x1}, &(0x7f0000001240), 0x0, 0xfffffffffffffff8) get_mempolicy(&(0x7f0000000000), &(0x7f00000001c0), 0x1ff, &(0x7f0000fff000/0x1000)=nil, 0x3) setsockopt$sock_int(r0, 0x1, 0x3c, &(0x7f0000d4effc)=0x1, 0x4) connect$inet(r0, &(0x7f0000000000)={0x2, 0x4e20, @dev={0xac, 0x14, 0x14, 0x18}}, 0x10) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f00000001c0)='tunl0\x00', 0x5) sendto$inet(r0, &(0x7f00006d1fd4)="db", 0x1, 0x4000010, &(0x7f00004daff0)={0x2, 0x0, @loopback, [0x0, 0x11]}, 0x10) 13:17:10 executing program 5: r0 = syz_open_dev$binder(&(0x7f00000021c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000002340)={0x34, 0x0, &(0x7f0000002240)=[@request_death={0x400c630e, 0x4, 0x4}, @increfs={0x40046304, 0x4}, @increfs_done={0x40106308, 0x0, 0x3}, @increfs], 0x77, 0x0, &(0x7f00000022c0)="b3cd0b76d8e2af743c6f523efe14fd20c3c3dd2572734282a761e1b4304e2599c85f198cc82bd5d0c74c4edca2f9ea7b875ff7047ec0784fbb354e15fd3f7d837f533597d5082692a6f2fb748da3cc4157188f7f2a5477ded56f72f5b75c96872db429e44b8fcd781d96dead77a0b58b7af9085a208a22"}) 13:17:10 executing program 7: r0 = openat$cuse(0xffffffffffffff9c, &(0x7f0000000080)='/dev/cuse\x00', 0x2, 0x0) clone(0x1002102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000640), 0xffffffffffffffff) r1 = getpid() sched_setscheduler(r1, 0x5, &(0x7f0000000000)) write$FUSE_NOTIFY_DELETE(r0, &(0x7f0000000040)={0x29, 0x6, 0xb000000}, 0x29) 13:17:10 executing program 3: perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000200)={0x26, 'hash\x00', 0x0, 0x0, 'sha1\x00'}, 0x58) r1 = accept$alg(r0, 0x0, 0x0) sendmmsg(r1, &(0x7f0000007f00)=[{{&(0x7f00000056c0)=@can, 0x3000, &(0x7f00000000c0)}}, {{&(0x7f0000005900)=@pppoe={0x18, 0x0, {0x0, @link_local, 'syzkaller0\x00'}}, 0x80, &(0x7f0000007ac0), 0x1a9, &(0x7f0000007b00)}}], 0x3fffffffffffe0d, 0x0) r2 = openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000140)='/dev/sequencer2\x00', 0x80840, 0x0) chown(&(0x7f0000000340)='./file0\x00', 0x0, 0x0) r3 = syz_open_dev$sndpcmc(&(0x7f00000000c0)='/dev/snd/pcmC#D#c\x00', 0x0, 0x0) ioctl$ASHMEM_SET_NAME(r3, 0x41007701, &(0x7f0000000100)='syzkaller0\x00') ioctl$PIO_FONTRESET(r2, 0x4b6d, 0x0) 13:17:10 executing program 6: clone(0x802102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000040), 0xffffffffffffffff) r0 = syz_open_dev$sndtimer(&(0x7f0000000000)='/dev/snd/timer\x00', 0x0, 0x0) r1 = getpid() sched_setscheduler(r1, 0x5, &(0x7f0000000200)) ioctl$SNDRV_TIMER_IOCTL_GPARAMS(r0, 0x40485404, &(0x7f0000000240)={{}, 0x0, 0x2000000000000000, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x300000000000000]}) [ 1532.539208] binder: 16076:16077 BC_REQUEST_DEATH_NOTIFICATION invalid ref 4 13:17:10 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r0, &(0x7f0000942000)={0x2, 0x4e20, @multicast1}, 0x10) sendmsg$key(0xffffffffffffffff, &(0x7f0000f56000)={0x0, 0x0, &(0x7f00008feff0)={&(0x7f0000000500)=ANY=[@ANYBLOB="020300090a1500000000000000000000030006190000000002000000e0000001003f00000000000002000100e625aa66dcef85847e479eb3c49000000400000000fd003e"], 0x44}}, 0x0) add_key(&(0x7f0000000080)='logon\x00', &(0x7f0000000100)={0x73, 0x79, 0x7a, 0x1}, &(0x7f0000001240), 0x0, 0xfffffffffffffff8) get_mempolicy(&(0x7f0000000000), &(0x7f00000001c0), 0x1ff, &(0x7f0000fff000/0x1000)=nil, 0x3) setsockopt$sock_int(r0, 0x1, 0x3c, &(0x7f0000d4effc)=0x1, 0x4) connect$inet(r0, &(0x7f0000000000)={0x2, 0x4e20, @dev={0xac, 0x14, 0x14, 0x18}}, 0x10) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f00000001c0)='tunl0\x00', 0x5) sendto$inet(r0, &(0x7f00006d1fd4)="db", 0x1, 0x4000010, &(0x7f00004daff0)={0x2, 0x0, @loopback, [0x0, 0xf401000000000000]}, 0x10) 13:17:10 executing program 5: r0 = syz_open_dev$binder(&(0x7f00000021c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000002340)={0x34, 0x0, &(0x7f0000002240)=[@request_death={0x400c630e, 0x4, 0x4}, @increfs={0x40046304, 0x4}, @increfs_done={0x40106308, 0x0, 0x3}, @increfs], 0x77, 0x0, &(0x7f00000022c0)="b3cd1276d8e2af743c6f523efe14fd20c3c3dd2572734282a761e1b4304e2599c85f198cc82bd5d0c74c4edca2f9ea7b875ff7047ec0784fbb354e15fd3f7d837f533597d5082692a6f2fb748da3cc4157188f7f2a5477ded56f72f5b75c96872db429e44b8fcd781d96dead77a0b58b7af9085a208a22"}) [ 1532.770853] binder: 16104:16107 BC_REQUEST_DEATH_NOTIFICATION invalid ref 4 13:17:11 executing program 1: r0 = socket$netlink(0x10, 0x3, 0x8000000004) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_TCP_CONGESTION(r1, 0x6, 0xd, &(0x7f0000000180)='vegas\x00', 0x6) bind$inet6(r1, &(0x7f00001fefe4)={0xa, 0x4e22}, 0x1c) sendto$inet6(r1, &(0x7f0000000100), 0x8d2d601e8976aa5, 0x20000004, &(0x7f000031e000)={0xa, 0x4e22}, 0x1c) writev(r0, &(0x7f0000000100)=[{&(0x7f0000000000)="580000001400192340834b80040d8c560a067f903eff81004e220000000058000b4824ca944f64009400050028925aa8000000000000008000f0fffeffff09000000fff5dd00000010000100000c0900fcff0000040e05a5", 0x58}], 0x1) 13:17:11 executing program 7: r0 = openat$cuse(0xffffffffffffff9c, &(0x7f0000000080)='/dev/cuse\x00', 0x2, 0x0) clone(0x1002102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000640), 0xffffffffffffffff) r1 = getpid() sched_setscheduler(r1, 0x5, &(0x7f0000000000)) write$FUSE_NOTIFY_DELETE(r0, &(0x7f0000000040)={0x29, 0x6, 0x7000000}, 0x29) 13:17:11 executing program 6: clone(0x802102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000040), 0xffffffffffffffff) r0 = syz_open_dev$sndtimer(&(0x7f0000000000)='/dev/snd/timer\x00', 0x0, 0x0) r1 = getpid() sched_setscheduler(r1, 0x5, &(0x7f0000000200)) ioctl$SNDRV_TIMER_IOCTL_GPARAMS(r0, 0x40485404, &(0x7f0000000240)={{}, 0x0, 0x2000000000000000, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1000000]}) 13:17:11 executing program 5: r0 = syz_open_dev$binder(&(0x7f00000021c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000002340)={0x34, 0x0, &(0x7f0000002240)=[@request_death={0x400c630e, 0x4, 0x4}, @increfs={0x40046304, 0x4}, @increfs_done={0x40106308, 0x0, 0x3}, @increfs], 0x77, 0x0, &(0x7f00000022c0)="b3cd4c76d8e2af743c6f523efe14fd20c3c3dd2572734282a761e1b4304e2599c85f198cc82bd5d0c74c4edca2f9ea7b875ff7047ec0784fbb354e15fd3f7d837f533597d5082692a6f2fb748da3cc4157188f7f2a5477ded56f72f5b75c96872db429e44b8fcd781d96dead77a0b58b7af9085a208a22"}) 13:17:11 executing program 3: clone(0x802102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000040), 0xffffffffffffffff) r0 = syz_open_dev$sndtimer(&(0x7f0000000000)='/dev/snd/timer\x00', 0x0, 0x0) r1 = getpid() sched_setscheduler(r1, 0x5, &(0x7f0000000200)) ioctl$SNDRV_TIMER_IOCTL_GPARAMS(r0, 0x40485404, &(0x7f0000000240)={{}, 0x0, 0x2000000000000000, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3]}) 13:17:11 executing program 0: perf_event_open(&(0x7f0000000040)={0x2, 0x70, 0x3e5}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f00000021c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000002340)={0xb5, 0x68000000, &(0x7f00000000c0)=ANY=[@ANYBLOB="0463044000000000b6a571ac965f26c50d500dae115e59afcd8a338d8b2727193c56d4ebef60c214b766ffde6cff6ceef2baa2594a53a0117e77afd5d58e8a35afdae81b258585ce769507333c0238790d5ed750bf1d6ca2a873050056528fce7becfd12f165ac43a826d3462822ff8f29ea992d4e208847cf4fc10ca00b87b5ce2523fa477bad0be1c97e4398aa2ac81d973b5a871d8e0b295e436cd8415f19088c6c82c85f4ed1fac41da062bc6dbfb8eac4276c"], 0x0, 0x0, &(0x7f00000022c0)}) 13:17:11 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r0, &(0x7f0000942000)={0x2, 0x4e20, @multicast1}, 0x10) sendmsg$key(0xffffffffffffffff, &(0x7f0000f56000)={0x0, 0x0, &(0x7f00008feff0)={&(0x7f0000000500)=ANY=[@ANYBLOB="020300090a1500000000000000000000030006190000000002000000e0000001003f00000000000002000100e625aa66dcef85847e479eb3c49000000400000000fd003e"], 0x44}}, 0x0) add_key(&(0x7f0000000080)='logon\x00', &(0x7f0000000100)={0x73, 0x79, 0x7a, 0x1}, &(0x7f0000001240), 0x0, 0xfffffffffffffff8) get_mempolicy(&(0x7f0000000000), &(0x7f00000001c0), 0x1ff, &(0x7f0000fff000/0x1000)=nil, 0x3) setsockopt$sock_int(r0, 0x1, 0x3c, &(0x7f0000d4effc)=0x1, 0x4) connect$inet(r0, &(0x7f0000000000)={0x2, 0x4e20, @dev={0xac, 0x14, 0x14, 0x18}}, 0x10) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f00000001c0)='tunl0\x00', 0x5) sendto$inet(r0, &(0x7f00006d1fd4)="db", 0x1, 0x4000010, &(0x7f00004daff0)={0x2, 0x0, @loopback, [0x0, 0x14b8010000000000]}, 0x10) 13:17:11 executing program 4: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = gettid() perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x3e5}, 0x0, 0x0, 0xffffffffffffffff, 0x0) fcntl$setown(r0, 0x8, r1) bind$inet6(r0, &(0x7f0000807fe4), 0x1c) sendto$inet6(r0, &(0x7f0000000380), 0x0, 0x200408d4, &(0x7f000072e000)={0xa, 0x4e22, 0x0, @loopback}, 0x1c) sendto$inet6(r0, &(0x7f0000ad6fad)='\x00', 0x1, 0x3fffffd, &(0x7f0000254000)={0xa, 0x0, 0x0, @loopback}, 0x1c) 13:17:11 executing program 7: r0 = openat$cuse(0xffffffffffffff9c, &(0x7f0000000080)='/dev/cuse\x00', 0x2, 0x0) clone(0x1002102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000640), 0xffffffffffffffff) r1 = getpid() sched_setscheduler(r1, 0x5, &(0x7f0000000000)) write$FUSE_NOTIFY_DELETE(r0, &(0x7f0000000040)={0x29, 0x6, 0x9}, 0x29) 13:17:11 executing program 3: clone(0x802102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000040), 0xffffffffffffffff) r0 = syz_open_dev$sndtimer(&(0x7f0000000000)='/dev/snd/timer\x00', 0x0, 0x0) r1 = getpid() sched_setscheduler(r1, 0x5, &(0x7f0000000200)) ioctl$SNDRV_TIMER_IOCTL_GPARAMS(r0, 0x40485404, &(0x7f0000000240)={{}, 0x0, 0x2000000000000000, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3]}) [ 1533.110018] binder: 16116:16128 BC_REQUEST_DEATH_NOTIFICATION invalid ref 4 13:17:11 executing program 3: syz_open_dev$sndpcmc(&(0x7f0000000180)='/dev/snd/pcmC#D#c\x00', 0x8, 0x80000) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) bind$alg(0xffffffffffffffff, &(0x7f0000000200)={0x26, 'hash\x00', 0x0, 0x0, 'sha1\x00'}, 0x58) accept$alg(0xffffffffffffffff, 0x0, 0x0) openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000140)='/dev/sequencer2\x00', 0x80840, 0x0) chown(&(0x7f0000000340)='./file0\x00', 0x0, 0x0) r0 = syz_open_dev$sndpcmc(&(0x7f00000000c0)='/dev/snd/pcmC#D#c\x00', 0x0, 0x0) ioctl$ASHMEM_SET_NAME(r0, 0x41007701, &(0x7f0000000100)='syzkaller0\x00') 13:17:11 executing program 7: r0 = openat$cuse(0xffffffffffffff9c, &(0x7f0000000080)='/dev/cuse\x00', 0x2, 0x0) clone(0x1002102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000640), 0xffffffffffffffff) r1 = getpid() sched_setscheduler(r1, 0x5, &(0x7f0000000000)) write$FUSE_NOTIFY_DELETE(r0, &(0x7f0000000040)={0x29, 0x6, 0x800000000000000}, 0x29) 13:17:11 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r0, &(0x7f0000942000)={0x2, 0x4e20, @multicast1}, 0x10) sendmsg$key(0xffffffffffffffff, &(0x7f0000f56000)={0x0, 0x0, &(0x7f00008feff0)={&(0x7f0000000500)=ANY=[@ANYBLOB="020300090a1500000000000000000000030006190000000002000000e0000001003f00000000000002000100e625aa66dcef85847e479eb3c49000000400000000fd003e"], 0x44}}, 0x0) add_key(&(0x7f0000000080)='logon\x00', &(0x7f0000000100)={0x73, 0x79, 0x7a, 0x1}, &(0x7f0000001240), 0x0, 0xfffffffffffffff8) get_mempolicy(&(0x7f0000000000), &(0x7f00000001c0), 0x1ff, &(0x7f0000fff000/0x1000)=nil, 0x3) setsockopt$sock_int(r0, 0x1, 0x3c, &(0x7f0000d4effc)=0x1, 0x4) connect$inet(r0, &(0x7f0000000000)={0x2, 0x4e20, @dev={0xac, 0x14, 0x14, 0x18}}, 0x10) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f00000001c0)='tunl0\x00', 0x5) sendto$inet(r0, &(0x7f00006d1fd4)="db", 0x1, 0x4000010, &(0x7f00004daff0)={0x2, 0x0, @loopback, [0x0, 0x8000a0ffffffff]}, 0x10) 13:17:11 executing program 5: r0 = syz_open_dev$binder(&(0x7f00000021c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000002340)={0x34, 0x0, &(0x7f0000002240)=[@request_death={0x400c630e, 0x4, 0x4}, @increfs={0x40046304, 0x4}, @increfs_done={0x40106308, 0x0, 0x3}, @increfs], 0x77, 0x0, &(0x7f00000022c0)="b3cd0676d8e2af743c6f523efe14fd20c3c3dd2572734282a761e1b4304e2599c85f198cc82bd5d0c74c4edca2f9ea7b875ff7047ec0784fbb354e15fd3f7d837f533597d5082692a6f2fb748da3cc4157188f7f2a5477ded56f72f5b75c96872db429e44b8fcd781d96dead77a0b58b7af9085a208a22"}) 13:17:11 executing program 3: r0 = syz_open_dev$binder(&(0x7f00000021c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000002340)={0x34, 0x0, &(0x7f0000002240)=[@request_death={0x400c630e, 0x4, 0x4}, @increfs={0x40046304, 0x4}, @increfs_done={0x40106308, 0x0, 0x3}, @increfs], 0x77, 0x3f00, &(0x7f00000022c0)="b3cd0976d8e2af743c6f523efe14fd20c3c3dd2572734282a761e1b4304e2599c85f198cc82bd5d0c74c4edca2f9ea7b875ff7047ec0784fbb354e15fd3f7d837f533597d5082692a6f2fb748da3cc4157188f7f2a5477ded56f72f5b75c96872db429e44b8fcd781d96dead77a0b58b7af9085a208a22"}) 13:17:11 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r0, &(0x7f0000942000)={0x2, 0x4e20, @multicast1}, 0x10) sendmsg$key(0xffffffffffffffff, &(0x7f0000f56000)={0x0, 0x0, &(0x7f00008feff0)={&(0x7f0000000500)=ANY=[@ANYBLOB="020300090a1500000000000000000000030006190000000002000000e0000001003f00000000000002000100e625aa66dcef85847e479eb3c49000000400000000fd003e"], 0x44}}, 0x0) add_key(&(0x7f0000000080)='logon\x00', &(0x7f0000000100)={0x73, 0x79, 0x7a, 0x1}, &(0x7f0000001240), 0x0, 0xfffffffffffffff8) get_mempolicy(&(0x7f0000000000), &(0x7f00000001c0), 0x1ff, &(0x7f0000fff000/0x1000)=nil, 0x3) setsockopt$sock_int(r0, 0x1, 0x3c, &(0x7f0000d4effc)=0x1, 0x4) connect$inet(r0, &(0x7f0000000000)={0x2, 0x4e20, @dev={0xac, 0x14, 0x14, 0x18}}, 0x10) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f00000001c0)='tunl0\x00', 0x5) sendto$inet(r0, &(0x7f00006d1fd4)="db", 0x1, 0x4000010, &(0x7f00004daff0)={0x2, 0x0, @loopback, [0x0, 0xa0010000]}, 0x10) [ 1533.421639] binder: 16165:16170 BC_REQUEST_DEATH_NOTIFICATION invalid ref 4 [ 1533.444172] binder: 16169:16172 BC_REQUEST_DEATH_NOTIFICATION invalid ref 4 13:17:11 executing program 1: r0 = socket$netlink(0x10, 0x3, 0x8000000004) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_TCP_CONGESTION(r1, 0x6, 0xd, &(0x7f0000000180)='vegas\x00', 0x6) bind$inet6(r1, &(0x7f00001fefe4)={0xa, 0x4e22}, 0x1c) sendto$inet6(r1, &(0x7f0000000100), 0x8d2d601e8976aa5, 0x20000004, &(0x7f000031e000)={0xa, 0x4e22}, 0x1c) writev(r0, &(0x7f0000000100)=[{&(0x7f0000000000)="580000001400192340834b80040d8c560a067fb939ff81004e220000000058000b4824ca944f64009400050028925aa8000000000000008000f0fffeffff09000000fff5dd00000010000100000c0900fcff0000040e05a5", 0x58}], 0x1) 13:17:11 executing program 3: r0 = syz_open_dev$binder(&(0x7f00000021c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000002340)={0x34, 0x0, &(0x7f0000002240)=[@request_death={0x400c630e, 0x4, 0x4}, @increfs={0x40046304, 0x4}, @increfs_done={0x40106308, 0x0, 0x3}, @increfs], 0x77, 0x7a, &(0x7f00000022c0)="b3cd0976d8e2af743c6f523efe14fd20c3c3dd2572734282a761e1b4304e2599c85f198cc82bd5d0c74c4edca2f9ea7b875ff7047ec0784fbb354e15fd3f7d837f533597d5082692a6f2fb748da3cc4157188f7f2a5477ded56f72f5b75c96872db429e44b8fcd781d96dead77a0b58b7af9085a208a22"}) 13:17:11 executing program 5: r0 = syz_open_dev$binder(&(0x7f00000021c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000002340)={0x34, 0x0, &(0x7f0000002240)=[@request_death={0x400c630e, 0x4, 0x4}, @increfs={0x40046304, 0x4}, @increfs_done={0x40106308, 0x0, 0x3}, @increfs], 0x77, 0x0, &(0x7f00000022c0)="b3cd0d76d8e2af743c6f523efe14fd20c3c3dd2572734282a761e1b4304e2599c85f198cc82bd5d0c74c4edca2f9ea7b875ff7047ec0784fbb354e15fd3f7d837f533597d5082692a6f2fb748da3cc4157188f7f2a5477ded56f72f5b75c96872db429e44b8fcd781d96dead77a0b58b7af9085a208a22"}) 13:17:11 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r0, &(0x7f0000942000)={0x2, 0x4e20, @multicast1}, 0x10) sendmsg$key(0xffffffffffffffff, &(0x7f0000f56000)={0x0, 0x0, &(0x7f00008feff0)={&(0x7f0000000500)=ANY=[@ANYBLOB="020300090a1500000000000000000000030006190000000002000000e0000001003f00000000000002000100e625aa66dcef85847e479eb3c49000000400000000fd003e"], 0x44}}, 0x0) add_key(&(0x7f0000000080)='logon\x00', &(0x7f0000000100)={0x73, 0x79, 0x7a, 0x1}, &(0x7f0000001240), 0x0, 0xfffffffffffffff8) get_mempolicy(&(0x7f0000000000), &(0x7f00000001c0), 0x1ff, &(0x7f0000fff000/0x1000)=nil, 0x3) setsockopt$sock_int(r0, 0x1, 0x3c, &(0x7f0000d4effc)=0x1, 0x4) connect$inet(r0, &(0x7f0000000000)={0x2, 0x4e20, @dev={0xac, 0x14, 0x14, 0x18}}, 0x10) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f00000001c0)='tunl0\x00', 0x5) sendto$inet(r0, &(0x7f00006d1fd4)="db", 0x1, 0x4000010, &(0x7f00004daff0)={0x2, 0x0, @loopback, [0x0, 0x1000000]}, 0x10) 13:17:12 executing program 6: clone(0x802102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000040), 0xffffffffffffffff) r0 = syz_open_dev$sndtimer(&(0x7f0000000000)='/dev/snd/timer\x00', 0x0, 0x0) r1 = getpid() sched_setscheduler(r1, 0x5, &(0x7f0000000200)) ioctl$SNDRV_TIMER_IOCTL_GPARAMS(r0, 0x40485404, &(0x7f0000000240)={{}, 0x0, 0x2000000000000000, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3000000]}) 13:17:12 executing program 7: r0 = openat$cuse(0xffffffffffffff9c, &(0x7f0000000080)='/dev/cuse\x00', 0x2, 0x0) clone(0x1002102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000640), 0xffffffffffffffff) r1 = getpid() sched_setscheduler(r1, 0x5, &(0x7f0000000000)) write$FUSE_NOTIFY_DELETE(r0, &(0x7f0000000040)={0x29, 0x6, 0xc00000000000000}, 0x29) 13:17:12 executing program 0: perf_event_open(&(0x7f0000000040)={0x2, 0x70, 0x3e5}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f00000021c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000002340)={0xb5, 0x8000a0, &(0x7f00000000c0)=ANY=[@ANYBLOB="0463044000000000b6a571ac965f26c50d500dae115e59afcd8a338d8b2727193c56d4ebef60c214b766ffde6cff6ceef2baa2594a53a0117e77afd5d58e8a35afdae81b258585ce769507333c0238790d5ed750bf1d6ca2a873050056528fce7becfd12f165ac43a826d3462822ff8f29ea992d4e208847cf4fc10ca00b87b5ce2523fa477bad0be1c97e4398aa2ac81d973b5a871d8e0b295e436cd8415f19088c6c82c85f4ed1fac41da062bc6dbfb8eac4276c"], 0x0, 0x0, &(0x7f00000022c0)}) 13:17:12 executing program 4: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = gettid() perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x3e5}, 0x0, 0x0, 0xffffffffffffffff, 0x0) fcntl$setown(r0, 0x8, r1) bind$inet6(r0, &(0x7f0000807fe4)={0xa, 0x4e22}, 0x1c) sendto$inet6(0xffffffffffffffff, &(0x7f0000000380), 0x0, 0x200408d4, &(0x7f000072e000)={0xa, 0x4e22, 0x0, @loopback}, 0x1c) sendto$inet6(r0, &(0x7f0000ad6fad)='\x00', 0x1, 0x3fffffd, &(0x7f0000254000)={0xa, 0x0, 0x0, @loopback}, 0x1c) [ 1533.975075] binder: 16185:16195 BC_REQUEST_DEATH_NOTIFICATION invalid ref 4 [ 1533.990949] binder_thread_write: 24 callbacks suppressed [ 1533.990963] binder: 16189:16196 IncRefs 0 refcount change on invalid ref 4 ret -22 [ 1534.009841] binder: 16185:16195 IncRefs 0 refcount change on invalid ref 4 ret -22 [ 1534.019069] binder_thread_write: 7 callbacks suppressed 13:17:12 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r0, &(0x7f0000942000)={0x2, 0x4e20, @multicast1}, 0x10) sendmsg$key(0xffffffffffffffff, &(0x7f0000f56000)={0x0, 0x0, &(0x7f00008feff0)={&(0x7f0000000500)=ANY=[@ANYBLOB="020300090a1500000000000000000000030006190000000002000000e0000001003f00000000000002000100e625aa66dcef85847e479eb3c49000000400000000fd003e"], 0x44}}, 0x0) add_key(&(0x7f0000000080)='logon\x00', &(0x7f0000000100)={0x73, 0x79, 0x7a, 0x1}, &(0x7f0000001240), 0x0, 0xfffffffffffffff8) get_mempolicy(&(0x7f0000000000), &(0x7f00000001c0), 0x1ff, &(0x7f0000fff000/0x1000)=nil, 0x3) setsockopt$sock_int(r0, 0x1, 0x3c, &(0x7f0000d4effc)=0x1, 0x4) connect$inet(r0, &(0x7f0000000000)={0x2, 0x4e20, @dev={0xac, 0x14, 0x14, 0x18}}, 0x10) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f00000001c0)='tunl0\x00', 0x5) sendto$inet(r0, &(0x7f00006d1fd4)="db", 0x1, 0x4000010, &(0x7f00004daff0)={0x2, 0x0, @loopback, [0x0, 0xf4010000]}, 0x10) 13:17:12 executing program 7: r0 = openat$cuse(0xffffffffffffff9c, &(0x7f0000000080)='/dev/cuse\x00', 0x2, 0x0) clone(0x1002102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000640), 0xffffffffffffffff) r1 = getpid() sched_setscheduler(r1, 0x5, &(0x7f0000000000)) write$FUSE_NOTIFY_DELETE(r0, &(0x7f0000000040)={0x29, 0x6, 0x300}, 0x29) 13:17:12 executing program 6: clone(0x802102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000040), 0xffffffffffffffff) r0 = syz_open_dev$sndtimer(&(0x7f0000000000)='/dev/snd/timer\x00', 0x0, 0x0) r1 = getpid() sched_setscheduler(r1, 0x5, &(0x7f0000000200)) ioctl$SNDRV_TIMER_IOCTL_GPARAMS(r0, 0x40485404, &(0x7f0000000240)={{}, 0x0, 0x2000000000000000, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1000000]}) [ 1534.019084] binder: 16189:16196 BC_INCREFS_DONE u0000000000000000 no match [ 1534.032575] binder: 16189:16196 IncRefs 0 refcount change on invalid ref 0 ret -22 [ 1534.040796] binder: 16185:16195 BC_INCREFS_DONE u0000000000000000 no match [ 1534.048211] binder: 16185:16195 IncRefs 0 refcount change on invalid ref 0 ret -22 13:17:12 executing program 3: r0 = syz_open_dev$binder(&(0x7f00000021c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000002340)={0x34, 0x0, &(0x7f0000002240)=[@request_death={0x400c630e, 0x4, 0x4}, @increfs={0x40046304, 0x4}, @increfs_done={0x40106308, 0x0, 0x3}, @increfs], 0x77, 0xa000000, &(0x7f00000022c0)="b3cd0976d8e2af743c6f523efe14fd20c3c3dd2572734282a761e1b4304e2599c85f198cc82bd5d0c74c4edca2f9ea7b875ff7047ec0784fbb354e15fd3f7d837f533597d5082692a6f2fb748da3cc4157188f7f2a5477ded56f72f5b75c96872db429e44b8fcd781d96dead77a0b58b7af9085a208a22"}) 13:17:12 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r0, &(0x7f0000942000)={0x2, 0x4e20, @multicast1}, 0x10) sendmsg$key(0xffffffffffffffff, &(0x7f0000f56000)={0x0, 0x0, &(0x7f00008feff0)={&(0x7f0000000500)=ANY=[@ANYBLOB="020300090a1500000000000000000000030006190000000002000000e0000001003f00000000000002000100e625aa66dcef85847e479eb3c49000000400000000fd003e"], 0x44}}, 0x0) add_key(&(0x7f0000000080)='logon\x00', &(0x7f0000000100)={0x73, 0x79, 0x7a, 0x1}, &(0x7f0000001240), 0x0, 0xfffffffffffffff8) get_mempolicy(&(0x7f0000000000), &(0x7f00000001c0), 0x1ff, &(0x7f0000fff000/0x1000)=nil, 0x3) setsockopt$sock_int(r0, 0x1, 0x3c, &(0x7f0000d4effc)=0x1, 0x4) connect$inet(r0, &(0x7f0000000000)={0x2, 0x4e20, @dev={0xac, 0x14, 0x14, 0x18}}, 0x10) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f00000001c0)='tunl0\x00', 0x5) sendto$inet(r0, &(0x7f00006d1fd4)="db", 0x1, 0x4000010, &(0x7f00004daff0)={0x2, 0x0, @loopback, [0x0, 0xe00]}, 0x10) 13:17:12 executing program 5: r0 = syz_open_dev$binder(&(0x7f00000021c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000002340)={0x34, 0x0, &(0x7f0000002240)=[@request_death={0x400c630e, 0x4, 0x4}, @increfs={0x40046304, 0x4}, @increfs_done={0x40106308, 0x0, 0x3}, @increfs], 0x77, 0x0, &(0x7f00000022c0)="b3cd0376d8e2af743c6f523efe14fd20c3c3dd2572734282a761e1b4304e2599c85f198cc82bd5d0c74c4edca2f9ea7b875ff7047ec0784fbb354e15fd3f7d837f533597d5082692a6f2fb748da3cc4157188f7f2a5477ded56f72f5b75c96872db429e44b8fcd781d96dead77a0b58b7af9085a208a22"}) [ 1534.222143] binder: 16220:16221 IncRefs 0 refcount change on invalid ref 4 ret -22 [ 1534.232109] binder: 16220:16221 BC_INCREFS_DONE u0000000000000000 no match [ 1534.241984] binder: 16220:16221 IncRefs 0 refcount change on invalid ref 0 ret -22 13:17:12 executing program 3: r0 = syz_open_dev$binder(&(0x7f00000021c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000002340)={0x34, 0x0, &(0x7f0000002240)=[@request_death={0x400c630e, 0x4, 0x4}, @increfs={0x40046304, 0x4}, @increfs_done={0x40106308, 0x0, 0x3}, @increfs], 0x77, 0xffffffffa0028000, &(0x7f00000022c0)="b3cd0976d8e2af743c6f523efe14fd20c3c3dd2572734282a761e1b4304e2599c85f198cc82bd5d0c74c4edca2f9ea7b875ff7047ec0784fbb354e15fd3f7d837f533597d5082692a6f2fb748da3cc4157188f7f2a5477ded56f72f5b75c96872db429e44b8fcd781d96dead77a0b58b7af9085a208a22"}) 13:17:12 executing program 6: clone(0x802102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000040), 0xffffffffffffffff) r0 = syz_open_dev$sndtimer(&(0x7f0000000000)='/dev/snd/timer\x00', 0x0, 0x0) r1 = getpid() sched_setscheduler(r1, 0x5, &(0x7f0000000200)) ioctl$SNDRV_TIMER_IOCTL_GPARAMS(r0, 0x40485404, &(0x7f0000000240)={{}, 0x0, 0x2000000000000000, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x300]}) [ 1534.355095] binder: 16226:16229 IncRefs 0 refcount change on invalid ref 4 ret -22 [ 1534.385834] binder: 16232:16235 IncRefs 0 refcount change on invalid ref 4 ret -22 [ 1534.393978] binder: 16232:16235 BC_INCREFS_DONE u0000000000000000 no match [ 1534.402500] binder: 16232:16235 IncRefs 0 refcount change on invalid ref 0 ret -22 [ 1534.419851] binder: 16226:16229 BC_INCREFS_DONE u0000000000000000 no match [ 1534.447067] binder: 16226:16229 IncRefs 0 refcount change on invalid ref 0 ret -22 13:17:12 executing program 1: r0 = socket$netlink(0x10, 0x3, 0x8000000004) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_TCP_CONGESTION(r1, 0x6, 0xd, &(0x7f0000000180)='vegas\x00', 0x6) bind$inet6(r1, &(0x7f00001fefe4)={0xa, 0x4e22}, 0x1c) sendto$inet6(r1, &(0x7f0000000100), 0x8d2d601e8976aa5, 0x20000004, &(0x7f000031e000)={0xa, 0x4e22}, 0x1c) writev(r0, &(0x7f0000000100)=[{&(0x7f0000000000)="580000001400192340834b80040d8c560a067fbe28ff81004e220000000058000b4824ca944f64009400050028925aa8000000000000008000f0fffeffff09000000fff5dd00000010000100000c0900fcff0000040e05a5", 0x58}], 0x1) 13:17:12 executing program 7: r0 = openat$cuse(0xffffffffffffff9c, &(0x7f0000000080)='/dev/cuse\x00', 0x2, 0x0) clone(0x1002102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000640), 0xffffffffffffffff) r1 = getpid() sched_setscheduler(r1, 0x5, &(0x7f0000000000)) write$FUSE_NOTIFY_DELETE(r0, &(0x7f0000000040)={0x29, 0x6, 0x8002a0ffffffff}, 0x29) 13:17:12 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r0, &(0x7f0000942000)={0x2, 0x4e20, @multicast1}, 0x10) sendmsg$key(0xffffffffffffffff, &(0x7f0000f56000)={0x0, 0x0, &(0x7f00008feff0)={&(0x7f0000000500)=ANY=[@ANYBLOB="020300090a1500000000000000000000030006190000000002000000e0000001003f00000000000002000100e625aa66dcef85847e479eb3c49000000400000000fd003e"], 0x44}}, 0x0) add_key(&(0x7f0000000080)='logon\x00', &(0x7f0000000100)={0x73, 0x79, 0x7a, 0x1}, &(0x7f0000001240), 0x0, 0xfffffffffffffff8) get_mempolicy(&(0x7f0000000000), &(0x7f00000001c0), 0x1ff, &(0x7f0000fff000/0x1000)=nil, 0x3) setsockopt$sock_int(r0, 0x1, 0x3c, &(0x7f0000d4effc)=0x1, 0x4) connect$inet(r0, &(0x7f0000000000)={0x2, 0x4e20, @dev={0xac, 0x14, 0x14, 0x18}}, 0x10) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f00000001c0)='tunl0\x00', 0x5) sendto$inet(r0, &(0x7f00006d1fd4)="db", 0x1, 0x4000010, &(0x7f00004daff0)={0x2, 0x0, @loopback, [0x0, 0x2]}, 0x10) 13:17:12 executing program 6: clone(0x802102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000040), 0xffffffffffffffff) r0 = syz_open_dev$sndtimer(&(0x7f0000000000)='/dev/snd/timer\x00', 0x0, 0x0) r1 = getpid() sched_setscheduler(r1, 0x5, &(0x7f0000000200)) ioctl$SNDRV_TIMER_IOCTL_GPARAMS(r0, 0x40485404, &(0x7f0000000240)={{}, 0x0, 0x2000000000000000, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3]}) 13:17:12 executing program 3: r0 = openat$cuse(0xffffffffffffff9c, &(0x7f0000000080)='/dev/cuse\x00', 0x2, 0x0) clone(0x1002102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000640), 0xffffffffffffffff) r1 = getpid() sched_setscheduler(r1, 0x5, &(0x7f0000000000)) write$FUSE_NOTIFY_DELETE(r0, &(0x7f0000000040)={0x29, 0x5}, 0x29) 13:17:12 executing program 5: r0 = syz_open_dev$binder(&(0x7f00000021c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000002340)={0x34, 0x0, &(0x7f0000002240)=[@request_death={0x400c630e, 0x4, 0x4}, @increfs={0x40046304, 0x4}, @increfs_done={0x40106308, 0x0, 0x3}, @increfs], 0x77, 0x0, &(0x7f00000022c0)="b3cd1076d8e2af743c6f523efe14fd20c3c3dd2572734282a761e1b4304e2599c85f198cc82bd5d0c74c4edca2f9ea7b875ff7047ec0784fbb354e15fd3f7d837f533597d5082692a6f2fb748da3cc4157188f7f2a5477ded56f72f5b75c96872db429e44b8fcd781d96dead77a0b58b7af9085a208a22"}) 13:17:12 executing program 0: perf_event_open(&(0x7f0000000040)={0x2, 0x70, 0x3e5}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f00000021c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000002340)={0xb5, 0x6, &(0x7f00000000c0)=ANY=[@ANYBLOB="0463044000000000b6a571ac965f26c50d500dae115e59afcd8a338d8b2727193c56d4ebef60c214b766ffde6cff6ceef2baa2594a53a0117e77afd5d58e8a35afdae81b258585ce769507333c0238790d5ed750bf1d6ca2a873050056528fce7becfd12f165ac43a826d3462822ff8f29ea992d4e208847cf4fc10ca00b87b5ce2523fa477bad0be1c97e4398aa2ac81d973b5a871d8e0b295e436cd8415f19088c6c82c85f4ed1fac41da062bc6dbfb8eac4276c"], 0x0, 0x0, &(0x7f00000022c0)}) 13:17:12 executing program 4: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = gettid() perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x3e5}, 0x0, 0x0, 0xffffffffffffffff, 0x0) fcntl$setown(r0, 0x8, r1) bind$inet6(r0, &(0x7f0000807fe4)={0xa, 0x4e22}, 0x1c) sendto$inet6(r0, &(0x7f0000000380), 0x0, 0x0, &(0x7f000072e000)={0xa, 0x4e22, 0x0, @loopback}, 0x1c) sendto$inet6(r0, &(0x7f0000ad6fad)='\x00', 0x1, 0x3fffffd, &(0x7f0000254000)={0xa, 0x0, 0x0, @loopback}, 0x1c) 13:17:12 executing program 7: r0 = openat$cuse(0xffffffffffffff9c, &(0x7f0000000080)='/dev/cuse\x00', 0x2, 0x0) clone(0x1002102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000640), 0xffffffffffffffff) r1 = getpid() sched_setscheduler(r1, 0x5, &(0x7f0000000000)) write$FUSE_NOTIFY_DELETE(r0, &(0x7f0000000040)={0x29, 0x6, 0x1a0}, 0x29) 13:17:12 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r0, &(0x7f0000942000)={0x2, 0x4e20, @multicast1}, 0x10) sendmsg$key(0xffffffffffffffff, &(0x7f0000f56000)={0x0, 0x0, &(0x7f00008feff0)={&(0x7f0000000500)=ANY=[@ANYBLOB="020300090a1500000000000000000000030006190000000002000000e0000001003f00000000000002000100e625aa66dcef85847e479eb3c49000000400000000fd003e"], 0x44}}, 0x0) add_key(&(0x7f0000000080)='logon\x00', &(0x7f0000000100)={0x73, 0x79, 0x7a, 0x1}, &(0x7f0000001240), 0x0, 0xfffffffffffffff8) get_mempolicy(&(0x7f0000000000), &(0x7f00000001c0), 0x1ff, &(0x7f0000fff000/0x1000)=nil, 0x3) setsockopt$sock_int(r0, 0x1, 0x3c, &(0x7f0000d4effc)=0x1, 0x4) connect$inet(r0, &(0x7f0000000000)={0x2, 0x4e20, @dev={0xac, 0x14, 0x14, 0x18}}, 0x10) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f00000001c0)='tunl0\x00', 0x5) sendto$inet(r0, &(0x7f00006d1fd4)="db", 0x1, 0x4000010, &(0x7f00004daff0)={0x2, 0x0, @loopback, [0x0, 0xfeffffff00000000]}, 0x10) [ 1534.844429] binder: 16255:16261 BC_INCREFS_DONE u0000000000000000 no match 13:17:13 executing program 7: r0 = openat$cuse(0xffffffffffffff9c, &(0x7f0000000080)='/dev/cuse\x00', 0x2, 0x0) clone(0x1002102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000640), 0xffffffffffffffff) r1 = getpid() sched_setscheduler(r1, 0x5, &(0x7f0000000000)) write$FUSE_NOTIFY_DELETE(r0, &(0x7f0000000040)={0x29, 0x6, 0x500}, 0x29) 13:17:13 executing program 6: clone(0x802102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000040), 0xffffffffffffffff) r0 = syz_open_dev$sndtimer(&(0x7f0000000000)='/dev/snd/timer\x00', 0x0, 0x0) r1 = getpid() sched_setscheduler(r1, 0x5, &(0x7f0000000200)) ioctl$SNDRV_TIMER_IOCTL_GPARAMS(r0, 0x40485404, &(0x7f0000000240)={{}, 0x0, 0x2000000000000000, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x100000000000000]}) 13:17:13 executing program 6: clone(0x802102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000040), 0xffffffffffffffff) r0 = syz_open_dev$sndtimer(&(0x7f0000000000)='/dev/snd/timer\x00', 0x0, 0x0) r1 = getpid() sched_setscheduler(r1, 0x5, &(0x7f0000000200)) ioctl$SNDRV_TIMER_IOCTL_GPARAMS(r0, 0x40485404, &(0x7f0000000240)={{}, 0x0, 0x2000000000000000, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x300000000000000]}) 13:17:13 executing program 5: r0 = syz_open_dev$binder(&(0x7f00000021c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000002340)={0x34, 0x0, &(0x7f0000002240)=[@request_death={0x400c630e, 0x4, 0x4}, @increfs={0x40046304, 0x4}, @increfs_done={0x40106308, 0x0, 0x3}, @increfs], 0x77, 0x0, &(0x7f00000022c0)="b3cd0a76d8e2af743c6f523efe14fd20c3c3dd2572734282a761e1b4304e2599c85f198cc82bd5d0c74c4edca2f9ea7b875ff7047ec0784fbb354e15fd3f7d837f533597d5082692a6f2fb748da3cc4157188f7f2a5477ded56f72f5b75c96872db429e44b8fcd781d96dead77a0b58b7af9085a208a22"}) 13:17:13 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r0, &(0x7f0000942000)={0x2, 0x4e20, @multicast1}, 0x10) sendmsg$key(0xffffffffffffffff, &(0x7f0000f56000)={0x0, 0x0, &(0x7f00008feff0)={&(0x7f0000000500)=ANY=[@ANYBLOB="020300090a1500000000000000000000030006190000000002000000e0000001003f00000000000002000100e625aa66dcef85847e479eb3c49000000400000000fd003e"], 0x44}}, 0x0) add_key(&(0x7f0000000080)='logon\x00', &(0x7f0000000100)={0x73, 0x79, 0x7a, 0x1}, &(0x7f0000001240), 0x0, 0xfffffffffffffff8) get_mempolicy(&(0x7f0000000000), &(0x7f00000001c0), 0x1ff, &(0x7f0000fff000/0x1000)=nil, 0x3) setsockopt$sock_int(r0, 0x1, 0x3c, &(0x7f0000d4effc)=0x1, 0x4) connect$inet(r0, &(0x7f0000000000)={0x2, 0x4e20, @dev={0xac, 0x14, 0x14, 0x18}}, 0x10) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f00000001c0)='tunl0\x00', 0x5) sendto$inet(r0, &(0x7f00006d1fd4)="db", 0x1, 0x4000010, &(0x7f00004daff0)={0x2, 0x0, @loopback, [0x0, 0x500000000000000]}, 0x10) 13:17:13 executing program 7: r0 = openat$cuse(0xffffffffffffff9c, &(0x7f0000000080)='/dev/cuse\x00', 0x2, 0x0) clone(0x1002102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000640), 0xffffffffffffffff) r1 = getpid() sched_setscheduler(r1, 0x5, &(0x7f0000000000)) write$FUSE_NOTIFY_DELETE(r0, &(0x7f0000000040)={0x29, 0x6, 0x100000000000000}, 0x29) [ 1535.079563] binder: 16299:16301 BC_INCREFS_DONE u0000000000000000 no match [ 1535.325784] binder: 16323:16324 unknown command -1514799104 [ 1535.331959] binder: 16323:16324 ioctl c0306201 20002340 returned -22 [ 1535.341687] binder: 16323:16325 unknown command -1514799104 [ 1535.349482] binder: 16323:16325 ioctl c0306201 20002340 returned -22 13:17:13 executing program 1: r0 = socket$netlink(0x10, 0x3, 0x8000000004) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_TCP_CONGESTION(r1, 0x6, 0xd, &(0x7f0000000180)='vegas\x00', 0x6) bind$inet6(r1, &(0x7f00001fefe4)={0xa, 0x4e22}, 0x1c) sendto$inet6(r1, &(0x7f0000000100), 0x8d2d601e8976aa5, 0x20000004, &(0x7f000031e000)={0xa, 0x4e22}, 0x1c) writev(r0, &(0x7f0000000100)=[{&(0x7f0000000000)="580000001400192340834b80040d8c560a067f59eaff81004e220000000058000b4824ca944f64009400050028925aa8000000000000008000f0fffeffff09000000fff5dd00000010000100000c0900fcff0000040e05a5", 0x58}], 0x1) 13:17:13 executing program 5: r0 = syz_open_dev$binder(&(0x7f00000021c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000002340)={0x34, 0x0, &(0x7f0000002240)=[@request_death={0x400c630e, 0x4, 0x4}, @increfs={0x40046304, 0x4}, @increfs_done={0x40106308, 0x0, 0x3}, @increfs], 0x77, 0x0, &(0x7f00000022c0)="b3cd090ad8e2af743c6f523efe14fd20c3c3dd2572734282a761e1b4304e2599c85f198cc82bd5d0c74c4edca2f9ea7b875ff7047ec0784fbb354e15fd3f7d837f533597d5082692a6f2fb748da3cc4157188f7f2a5477ded56f72f5b75c96872db429e44b8fcd781d96dead77a0b58b7af9085a208a22"}) 13:17:13 executing program 3: r0 = openat$cuse(0xffffffffffffff9c, &(0x7f0000000080)='/dev/cuse\x00', 0x2, 0x0) clone(0x1002102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000640), 0xffffffffffffffff) r1 = getpid() sched_setscheduler(r1, 0x5, &(0x7f0000000000)) write$FUSE_NOTIFY_DELETE(r0, &(0x7f0000000040)={0x29, 0x5}, 0x29) 13:17:13 executing program 7: r0 = openat$cuse(0xffffffffffffff9c, &(0x7f0000000080)='/dev/cuse\x00', 0x2, 0x0) clone(0x1002102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000640), 0xffffffffffffffff) r1 = getpid() sched_setscheduler(r1, 0x5, &(0x7f0000000000)) write$FUSE_NOTIFY_DELETE(r0, &(0x7f0000000040)={0x29, 0x6, 0x4000000}, 0x29) 13:17:13 executing program 4: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = gettid() perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x3e5}, 0x0, 0x0, 0xffffffffffffffff, 0x0) fcntl$setown(r0, 0x8, r1) bind$inet6(r0, &(0x7f0000807fe4)={0xa, 0x4e22}, 0x1c) sendto$inet6(r0, &(0x7f0000000380), 0x0, 0x0, &(0x7f000072e000)={0xa, 0x4e22, 0x0, @loopback}, 0x1c) sendto$inet6(r0, &(0x7f0000ad6fad)='\x00', 0x1, 0x3fffffd, &(0x7f0000254000)={0xa, 0x0, 0x0, @loopback}, 0x1c) 13:17:13 executing program 6: clone(0x802102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000040), 0xffffffffffffffff) r0 = syz_open_dev$sndtimer(&(0x7f0000000000)='/dev/snd/timer\x00', 0x0, 0x0) r1 = getpid() sched_setscheduler(r1, 0x5, &(0x7f0000000200)) ioctl$SNDRV_TIMER_IOCTL_GPARAMS(r0, 0x40485404, &(0x7f0000000240)={{}, 0x0, 0x2000000000000000, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x100000000000000]}) 13:17:13 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r0, &(0x7f0000942000)={0x2, 0x4e20, @multicast1}, 0x10) sendmsg$key(0xffffffffffffffff, &(0x7f0000f56000)={0x0, 0x0, &(0x7f00008feff0)={&(0x7f0000000500)=ANY=[@ANYBLOB="020300090a1500000000000000000000030006190000000002000000e0000001003f00000000000002000100e625aa66dcef85847e479eb3c49000000400000000fd003e"], 0x44}}, 0x0) add_key(&(0x7f0000000080)='logon\x00', &(0x7f0000000100)={0x73, 0x79, 0x7a, 0x1}, &(0x7f0000001240), 0x0, 0xfffffffffffffff8) get_mempolicy(&(0x7f0000000000), &(0x7f00000001c0), 0x1ff, &(0x7f0000fff000/0x1000)=nil, 0x3) setsockopt$sock_int(r0, 0x1, 0x3c, &(0x7f0000d4effc)=0x1, 0x4) connect$inet(r0, &(0x7f0000000000)={0x2, 0x4e20, @dev={0xac, 0x14, 0x14, 0x18}}, 0x10) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f00000001c0)='tunl0\x00', 0x5) sendto$inet(r0, &(0x7f00006d1fd4)="db", 0x1, 0x4000010, &(0x7f00004daff0)={0x2, 0x0, @loopback, [0x0, 0x10]}, 0x10) 13:17:13 executing program 0: perf_event_open(&(0x7f0000000040)={0x2, 0x70, 0x3e5}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f00000021c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000002340)={0xb5, 0x6800000000000000, &(0x7f00000000c0)=ANY=[@ANYBLOB="0463044000000000b6a571ac965f26c50d500dae115e59afcd8a338d8b2727193c56d4ebef60c214b766ffde6cff6ceef2baa2594a53a0117e77afd5d58e8a35afdae81b258585ce769507333c0238790d5ed750bf1d6ca2a873050056528fce7becfd12f165ac43a826d3462822ff8f29ea992d4e208847cf4fc10ca00b87b5ce2523fa477bad0be1c97e4398aa2ac81d973b5a871d8e0b295e436cd8415f19088c6c82c85f4ed1fac41da062bc6dbfb8eac4276c"], 0x0, 0x0, &(0x7f00000022c0)}) 13:17:13 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r0, &(0x7f0000942000)={0x2, 0x4e20, @multicast1}, 0x10) sendmsg$key(0xffffffffffffffff, &(0x7f0000f56000)={0x0, 0x0, &(0x7f00008feff0)={&(0x7f0000000500)=ANY=[@ANYBLOB="020300090a1500000000000000000000030006190000000002000000e0000001003f00000000000002000100e625aa66dcef85847e479eb3c49000000400000000fd003e"], 0x44}}, 0x0) add_key(&(0x7f0000000080)='logon\x00', &(0x7f0000000100)={0x73, 0x79, 0x7a, 0x1}, &(0x7f0000001240), 0x0, 0xfffffffffffffff8) get_mempolicy(&(0x7f0000000000), &(0x7f00000001c0), 0x1ff, &(0x7f0000fff000/0x1000)=nil, 0x3) setsockopt$sock_int(r0, 0x1, 0x3c, &(0x7f0000d4effc)=0x1, 0x4) connect$inet(r0, &(0x7f0000000000)={0x2, 0x4e20, @dev={0xac, 0x14, 0x14, 0x18}}, 0x10) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f00000001c0)='tunl0\x00', 0x5) sendto$inet(r0, &(0x7f00006d1fd4)="db", 0x1, 0x4000010, &(0x7f00004daff0)={0x2, 0x0, @loopback, [0x0, 0x3]}, 0x10) 13:17:13 executing program 5: r0 = syz_open_dev$binder(&(0x7f00000021c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000002340)={0x34, 0x0, &(0x7f0000002240)=[@request_death={0x400c630e, 0x4, 0x4}, @increfs={0x40046304, 0x4}, @increfs_done={0x40106308, 0x0, 0x3}, @increfs], 0x77, 0x0, &(0x7f00000022c0)="b3cd0925d8e2af743c6f523efe14fd20c3c3dd2572734282a761e1b4304e2599c85f198cc82bd5d0c74c4edca2f9ea7b875ff7047ec0784fbb354e15fd3f7d837f533597d5082692a6f2fb748da3cc4157188f7f2a5477ded56f72f5b75c96872db429e44b8fcd781d96dead77a0b58b7af9085a208a22"}) 13:17:13 executing program 6: clone(0x802102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000040), 0xffffffffffffffff) r0 = syz_open_dev$sndtimer(&(0x7f0000000000)='/dev/snd/timer\x00', 0x0, 0x0) r1 = getpid() sched_setscheduler(r1, 0x5, &(0x7f0000000200)) ioctl$SNDRV_TIMER_IOCTL_GPARAMS(r0, 0x40485404, &(0x7f0000000240)={{}, 0x0, 0x2000000000000000, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x300000000000000]}) [ 1535.757642] binder: 16332:16345 BC_INCREFS_DONE u0000000000000000 no match 13:17:13 executing program 3: r0 = openat$cuse(0xffffffffffffff9c, &(0x7f0000000080)='/dev/cuse\x00', 0x2, 0x0) clone(0x1002102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000640), 0xffffffffffffffff) r1 = getpid() sched_setscheduler(r1, 0x5, &(0x7f0000000000)) write$FUSE_NOTIFY_DELETE(r0, &(0x7f0000000040)={0x29, 0x5}, 0x29) 13:17:14 executing program 3: r0 = openat$cuse(0xffffffffffffff9c, &(0x7f0000000080)='/dev/cuse\x00', 0x2, 0x0) clone(0x1002102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000640), 0xffffffffffffffff) getpid() write$FUSE_NOTIFY_DELETE(r0, &(0x7f0000000040)={0x29, 0x5}, 0x29) 13:17:14 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r0, &(0x7f0000942000)={0x2, 0x4e20, @multicast1}, 0x10) sendmsg$key(0xffffffffffffffff, &(0x7f0000f56000)={0x0, 0x0, &(0x7f00008feff0)={&(0x7f0000000500)=ANY=[@ANYBLOB="020300090a1500000000000000000000030006190000000002000000e0000001003f00000000000002000100e625aa66dcef85847e479eb3c49000000400000000fd003e"], 0x44}}, 0x0) add_key(&(0x7f0000000080)='logon\x00', &(0x7f0000000100)={0x73, 0x79, 0x7a, 0x1}, &(0x7f0000001240), 0x0, 0xfffffffffffffff8) get_mempolicy(&(0x7f0000000000), &(0x7f00000001c0), 0x1ff, &(0x7f0000fff000/0x1000)=nil, 0x3) setsockopt$sock_int(r0, 0x1, 0x3c, &(0x7f0000d4effc)=0x1, 0x4) connect$inet(r0, &(0x7f0000000000)={0x2, 0x4e20, @dev={0xac, 0x14, 0x14, 0x18}}, 0x10) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f00000001c0)='tunl0\x00', 0x5) sendto$inet(r0, &(0x7f00006d1fd4)="db", 0x1, 0x4000010, &(0x7f00004daff0)={0x2, 0x0, @loopback, [0x0, 0x1b814]}, 0x10) 13:17:14 executing program 7: r0 = openat$cuse(0xffffffffffffff9c, &(0x7f0000000080)='/dev/cuse\x00', 0x2, 0x0) clone(0x1002102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000640), 0xffffffffffffffff) r1 = getpid() sched_setscheduler(r1, 0x5, &(0x7f0000000000)) write$FUSE_NOTIFY_DELETE(r0, &(0x7f0000000040)={0x29, 0x6, 0xc000000}, 0x29) 13:17:14 executing program 6: clone(0x802102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000040), 0xffffffffffffffff) r0 = syz_open_dev$sndtimer(&(0x7f0000000000)='/dev/snd/timer\x00', 0x0, 0x0) r1 = getpid() sched_setscheduler(r1, 0x5, &(0x7f0000000200)) ioctl$SNDRV_TIMER_IOCTL_GPARAMS(r0, 0x40485404, &(0x7f0000000240)={{}, 0x0, 0x2000000000000000, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1000000]}) [ 1535.964829] binder: 16359:16366 BC_INCREFS_DONE u0000000000000000 no match 13:17:14 executing program 1: r0 = socket$netlink(0x10, 0x3, 0x8000000004) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_TCP_CONGESTION(r1, 0x6, 0xd, &(0x7f0000000180)='vegas\x00', 0x6) bind$inet6(r1, &(0x7f00001fefe4)={0xa, 0x4e22}, 0x1c) sendto$inet6(r1, &(0x7f0000000100), 0x8d2d601e8976aa5, 0x20000004, &(0x7f000031e000)={0xa, 0x4e22}, 0x1c) writev(r0, &(0x7f0000000100)=[{&(0x7f0000000000)="580000001400192340834b80040d8c560a067f47d0ff81004e220000000058000b4824ca944f64009400050028925aa8000000000000008000f0fffeffff09000000fff5dd00000010000100000c0900fcff0000040e05a5", 0x58}], 0x1) 13:17:14 executing program 3: r0 = openat$cuse(0xffffffffffffff9c, &(0x7f0000000080)='/dev/cuse\x00', 0x2, 0x0) clone(0x1002102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000640), 0xffffffffffffffff) sched_setscheduler(0x0, 0x5, &(0x7f0000000000)) write$FUSE_NOTIFY_DELETE(r0, &(0x7f0000000040)={0x29, 0x5}, 0x29) 13:17:14 executing program 5: r0 = syz_open_dev$binder(&(0x7f00000021c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000002340)={0x34, 0x0, &(0x7f0000002240)=[@request_death={0x400c630e, 0x4, 0x4}, @increfs={0x40046304, 0x4}, @increfs_done={0x40106308, 0x0, 0x3}, @increfs], 0x77, 0x0, &(0x7f00000022c0)="b3cd0976d8e2af253c6f523efe14fd20c3c3dd2572734282a761e1b4304e2599c85f198cc82bd5d0c74c4edca2f9ea7b875ff7047ec0784fbb354e15fd3f7d837f533597d5082692a6f2fb748da3cc4157188f7f2a5477ded56f72f5b75c96872db429e44b8fcd781d96dead77a0b58b7af9085a208a22"}) 13:17:14 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r0, &(0x7f0000942000)={0x2, 0x4e20, @multicast1}, 0x10) sendmsg$key(0xffffffffffffffff, &(0x7f0000f56000)={0x0, 0x0, &(0x7f00008feff0)={&(0x7f0000000500)=ANY=[@ANYBLOB="020300090a1500000000000000000000030006190000000002000000e0000001003f00000000000002000100e625aa66dcef85847e479eb3c49000000400000000fd003e"], 0x44}}, 0x0) add_key(&(0x7f0000000080)='logon\x00', &(0x7f0000000100)={0x73, 0x79, 0x7a, 0x1}, &(0x7f0000001240), 0x0, 0xfffffffffffffff8) get_mempolicy(&(0x7f0000000000), &(0x7f00000001c0), 0x1ff, &(0x7f0000fff000/0x1000)=nil, 0x3) setsockopt$sock_int(r0, 0x1, 0x3c, &(0x7f0000d4effc)=0x1, 0x4) connect$inet(r0, &(0x7f0000000000)={0x2, 0x4e20, @dev={0xac, 0x14, 0x14, 0x18}}, 0x10) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f00000001c0)='tunl0\x00', 0x5) sendto$inet(r0, &(0x7f00006d1fd4)="db", 0x1, 0x4000010, &(0x7f00004daff0)={0x2, 0x0, @loopback, [0x0, 0x8002a0ffffffff]}, 0x10) 13:17:14 executing program 7: r0 = openat$cuse(0xffffffffffffff9c, &(0x7f0000000080)='/dev/cuse\x00', 0x2, 0x0) clone(0x1002102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000640), 0xffffffffffffffff) r1 = getpid() sched_setscheduler(r1, 0x5, &(0x7f0000000000)) write$FUSE_NOTIFY_DELETE(r0, &(0x7f0000000040)={0x29, 0x6, 0x0, {0x40000}}, 0x29) 13:17:14 executing program 6: clone(0x802102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000040), 0xffffffffffffffff) r0 = syz_open_dev$sndtimer(&(0x7f0000000000)='/dev/snd/timer\x00', 0x0, 0x0) r1 = getpid() sched_setscheduler(r1, 0x5, &(0x7f0000000200)) ioctl$SNDRV_TIMER_IOCTL_GPARAMS(r0, 0x40485404, &(0x7f0000000240)={{}, 0x0, 0x2000000000000000, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3000000]}) 13:17:14 executing program 0: perf_event_open(&(0x7f0000000040)={0x2, 0x70, 0x3e5}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f00000021c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000002340)={0xb5, 0x2000000000000000, &(0x7f00000000c0)=ANY=[@ANYBLOB="0463044000000000b6a571ac965f26c50d500dae115e59afcd8a338d8b2727193c56d4ebef60c214b766ffde6cff6ceef2baa2594a53a0117e77afd5d58e8a35afdae81b258585ce769507333c0238790d5ed750bf1d6ca2a873050056528fce7becfd12f165ac43a826d3462822ff8f29ea992d4e208847cf4fc10ca00b87b5ce2523fa477bad0be1c97e4398aa2ac81d973b5a871d8e0b295e436cd8415f19088c6c82c85f4ed1fac41da062bc6dbfb8eac4276c"], 0x0, 0x0, &(0x7f00000022c0)}) 13:17:14 executing program 4: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = gettid() perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x3e5}, 0x0, 0x0, 0xffffffffffffffff, 0x0) fcntl$setown(r0, 0x8, r1) bind$inet6(r0, &(0x7f0000807fe4)={0xa, 0x4e22}, 0x1c) sendto$inet6(r0, &(0x7f0000000380), 0x0, 0x0, &(0x7f000072e000)={0xa, 0x4e22, 0x0, @loopback}, 0x1c) sendto$inet6(r0, &(0x7f0000ad6fad)='\x00', 0x1, 0x3fffffd, &(0x7f0000254000)={0xa, 0x0, 0x0, @loopback}, 0x1c) 13:17:14 executing program 3: r0 = openat$cuse(0xffffffffffffff9c, &(0x7f0000000080)='/dev/cuse\x00', 0x2, 0x0) clone(0x1002102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000640), 0xffffffffffffffff) sched_setscheduler(0x0, 0x5, &(0x7f0000000000)) write$FUSE_NOTIFY_DELETE(r0, &(0x7f0000000040)={0x29, 0x5}, 0x29) [ 1536.619921] binder_thread_write: 8 callbacks suppressed [ 1536.619933] binder: 16405:16412 BC_REQUEST_DEATH_NOTIFICATION invalid ref 4 [ 1536.643573] binder: 16405:16412 BC_INCREFS_DONE u0000000000000000 no match 13:17:14 executing program 3: r0 = openat$cuse(0xffffffffffffff9c, &(0x7f0000000080)='/dev/cuse\x00', 0x2, 0x0) clone(0x1002102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000640), 0xffffffffffffffff) sched_setscheduler(0x0, 0x5, &(0x7f0000000000)) write$FUSE_NOTIFY_DELETE(r0, &(0x7f0000000040)={0x29, 0x5}, 0x29) 13:17:14 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r0, &(0x7f0000942000)={0x2, 0x4e20, @multicast1}, 0x10) sendmsg$key(0xffffffffffffffff, &(0x7f0000f56000)={0x0, 0x0, &(0x7f00008feff0)={&(0x7f0000000500)=ANY=[@ANYBLOB="020300090a1500000000000000000000030006190000000002000000e0000001003f00000000000002000100e625aa66dcef85847e479eb3c49000000400000000fd003e"], 0x44}}, 0x0) add_key(&(0x7f0000000080)='logon\x00', &(0x7f0000000100)={0x73, 0x79, 0x7a, 0x1}, &(0x7f0000001240), 0x0, 0xfffffffffffffff8) get_mempolicy(&(0x7f0000000000), &(0x7f00000001c0), 0x1ff, &(0x7f0000fff000/0x1000)=nil, 0x3) setsockopt$sock_int(r0, 0x1, 0x3c, &(0x7f0000d4effc)=0x1, 0x4) connect$inet(r0, &(0x7f0000000000)={0x2, 0x4e20, @dev={0xac, 0x14, 0x14, 0x18}}, 0x10) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f00000001c0)='tunl0\x00', 0x5) sendto$inet(r0, &(0x7f00006d1fd4)="db", 0x1, 0x4000010, &(0x7f00004daff0)={0x2, 0x0, @loopback, [0x0, 0x300000000000000]}, 0x10) 13:17:14 executing program 5: r0 = syz_open_dev$binder(&(0x7f00000021c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000002340)={0x34, 0x0, &(0x7f0000002240)=[@request_death={0x400c630e, 0x4, 0x4}, @increfs={0x40046304, 0x4}, @increfs_done={0x40106308, 0x0, 0x3}, @increfs], 0x77, 0x0, &(0x7f00000022c0)="b3cd0976d8e2af0a3c6f523efe14fd20c3c3dd2572734282a761e1b4304e2599c85f198cc82bd5d0c74c4edca2f9ea7b875ff7047ec0784fbb354e15fd3f7d837f533597d5082692a6f2fb748da3cc4157188f7f2a5477ded56f72f5b75c96872db429e44b8fcd781d96dead77a0b58b7af9085a208a22"}) 13:17:14 executing program 7: r0 = openat$cuse(0xffffffffffffff9c, &(0x7f0000000080)='/dev/cuse\x00', 0x2, 0x0) clone(0x1002102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000640), 0xffffffffffffffff) r1 = getpid() sched_setscheduler(r1, 0x5, &(0x7f0000000000)) write$FUSE_NOTIFY_DELETE(r0, &(0x7f0000000040)={0x29, 0x6, 0x0, {0x2}}, 0x29) 13:17:14 executing program 3: r0 = openat$cuse(0xffffffffffffff9c, &(0x7f0000000080)='/dev/cuse\x00', 0x2, 0x0) r1 = getpid() sched_setscheduler(r1, 0x5, &(0x7f0000000000)) write$FUSE_NOTIFY_DELETE(r0, &(0x7f0000000040)={0x29, 0x5}, 0x29) 13:17:15 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r0, &(0x7f0000942000)={0x2, 0x4e20, @multicast1}, 0x10) sendmsg$key(0xffffffffffffffff, &(0x7f0000f56000)={0x0, 0x0, &(0x7f00008feff0)={&(0x7f0000000500)=ANY=[@ANYBLOB="020300090a1500000000000000000000030006190000000002000000e0000001003f00000000000002000100e625aa66dcef85847e479eb3c49000000400000000fd003e"], 0x44}}, 0x0) add_key(&(0x7f0000000080)='logon\x00', &(0x7f0000000100)={0x73, 0x79, 0x7a, 0x1}, &(0x7f0000001240), 0x0, 0xfffffffffffffff8) get_mempolicy(&(0x7f0000000000), &(0x7f00000001c0), 0x1ff, &(0x7f0000fff000/0x1000)=nil, 0x3) setsockopt$sock_int(r0, 0x1, 0x3c, &(0x7f0000d4effc)=0x1, 0x4) connect$inet(r0, &(0x7f0000000000)={0x2, 0x4e20, @dev={0xac, 0x14, 0x14, 0x18}}, 0x10) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f00000001c0)='tunl0\x00', 0x5) sendto$inet(r0, &(0x7f00006d1fd4)="db", 0x1, 0x4000010, &(0x7f00004daff0)={0x2, 0x0, @loopback, [0x0, 0xa0008000]}, 0x10) [ 1536.911612] binder: 16441:16442 BC_REQUEST_DEATH_NOTIFICATION invalid ref 4 13:17:15 executing program 5: r0 = syz_open_dev$binder(&(0x7f00000021c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000002340)={0x34, 0x0, &(0x7f0000002240)=[@request_death={0x400c630e, 0x4, 0x4}, @increfs={0x40046304, 0x4}, @increfs_done={0x40106308, 0x0, 0x3}, @increfs], 0x77, 0x0, &(0x7f00000022c0)="b3cd0976d8e2af744c6f523efe14fd20c3c3dd2572734282a761e1b4304e2599c85f198cc82bd5d0c74c4edca2f9ea7b875ff7047ec0784fbb354e15fd3f7d837f533597d5082692a6f2fb748da3cc4157188f7f2a5477ded56f72f5b75c96872db429e44b8fcd781d96dead77a0b58b7af9085a208a22"}) [ 1537.070099] binder: 16459:16462 BC_REQUEST_DEATH_NOTIFICATION invalid ref 4 [ 1537.084648] binder: 16459:16462 BC_REQUEST_DEATH_NOTIFICATION invalid ref 4 13:17:15 executing program 1: r0 = socket$netlink(0x10, 0x3, 0x8000000004) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_TCP_CONGESTION(r1, 0x6, 0xd, &(0x7f0000000180)='vegas\x00', 0x6) bind$inet6(r1, &(0x7f00001fefe4)={0xa, 0x4e22}, 0x1c) sendto$inet6(r1, &(0x7f0000000100), 0x8d2d601e8976aa5, 0x20000004, &(0x7f000031e000)={0xa, 0x4e22}, 0x1c) writev(r0, &(0x7f0000000100)=[{&(0x7f0000000000)="580000001400192340834b80040d8c560a067f1115ff81004e220000000058000b4824ca944f64009400050028925aa8000000000000008000f0fffeffff09000000fff5dd00000010000100000c0900fcff0000040e05a5", 0x58}], 0x1) 13:17:15 executing program 7: r0 = openat$cuse(0xffffffffffffff9c, &(0x7f0000000080)='/dev/cuse\x00', 0x2, 0x0) clone(0x1002102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000640), 0xffffffffffffffff) r1 = getpid() sched_setscheduler(r1, 0x5, &(0x7f0000000000)) write$FUSE_NOTIFY_DELETE(r0, &(0x7f0000000040)={0x29, 0x6, 0x0, {0x4}}, 0x29) 13:17:15 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r0, &(0x7f0000942000)={0x2, 0x4e20, @multicast1}, 0x10) sendmsg$key(0xffffffffffffffff, &(0x7f0000f56000)={0x0, 0x0, &(0x7f00008feff0)={&(0x7f0000000500)=ANY=[@ANYBLOB="020300090a1500000000000000000000030006190000000002000000e0000001003f00000000000002000100e625aa66dcef85847e479eb3c49000000400000000fd003e"], 0x44}}, 0x0) add_key(&(0x7f0000000080)='logon\x00', &(0x7f0000000100)={0x73, 0x79, 0x7a, 0x1}, &(0x7f0000001240), 0x0, 0xfffffffffffffff8) get_mempolicy(&(0x7f0000000000), &(0x7f00000001c0), 0x1ff, &(0x7f0000fff000/0x1000)=nil, 0x3) setsockopt$sock_int(r0, 0x1, 0x3c, &(0x7f0000d4effc)=0x1, 0x4) connect$inet(r0, &(0x7f0000000000)={0x2, 0x4e20, @dev={0xac, 0x14, 0x14, 0x18}}, 0x10) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f00000001c0)='tunl0\x00', 0x5) sendto$inet(r0, &(0x7f00006d1fd4)="db", 0x1, 0x4000010, &(0x7f00004daff0)={0x2, 0x0, @loopback, [0x0, 0xfeffffff]}, 0x10) 13:17:15 executing program 0: perf_event_open(&(0x7f0000000040)={0x2, 0x70, 0x3e5}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f00000021c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000002340)={0xb5, 0xffffff7f, &(0x7f00000000c0)=ANY=[@ANYBLOB="0463044000000000b6a571ac965f26c50d500dae115e59afcd8a338d8b2727193c56d4ebef60c214b766ffde6cff6ceef2baa2594a53a0117e77afd5d58e8a35afdae81b258585ce769507333c0238790d5ed750bf1d6ca2a873050056528fce7becfd12f165ac43a826d3462822ff8f29ea992d4e208847cf4fc10ca00b87b5ce2523fa477bad0be1c97e4398aa2ac81d973b5a871d8e0b295e436cd8415f19088c6c82c85f4ed1fac41da062bc6dbfb8eac4276c"], 0x0, 0x0, &(0x7f00000022c0)}) 13:17:15 executing program 5: r0 = syz_open_dev$binder(&(0x7f00000021c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000002340)={0x34, 0x0, &(0x7f0000002240)=[@request_death={0x400c630e, 0x4, 0x4}, @increfs={0x40046304, 0x4}, @increfs_done={0x40106308, 0x0, 0x3}, @increfs], 0x77, 0x0, &(0x7f00000022c0)="b3cd0976d8e2af744d6f523efe14fd20c3c3dd2572734282a761e1b4304e2599c85f198cc82bd5d0c74c4edca2f9ea7b875ff7047ec0784fbb354e15fd3f7d837f533597d5082692a6f2fb748da3cc4157188f7f2a5477ded56f72f5b75c96872db429e44b8fcd781d96dead77a0b58b7af9085a208a22"}) 13:17:15 executing program 6: clone(0x802102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000040), 0xffffffffffffffff) r0 = syz_open_dev$sndtimer(&(0x7f0000000000)='/dev/snd/timer\x00', 0x0, 0x0) r1 = getpid() sched_setscheduler(r1, 0x5, &(0x7f0000000200)) ioctl$SNDRV_TIMER_IOCTL_GPARAMS(r0, 0x40485404, &(0x7f0000000240)={{}, 0x0, 0x2000000000000000, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x300]}) 13:17:15 executing program 3: clone(0x1002102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000640), 0xffffffffffffffff) r0 = getpid() sched_setscheduler(r0, 0x5, &(0x7f0000000000)) write$FUSE_NOTIFY_DELETE(0xffffffffffffffff, &(0x7f0000000040)={0x29, 0x5}, 0x29) 13:17:15 executing program 4: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = gettid() perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x3e5}, 0x0, 0x0, 0xffffffffffffffff, 0x0) fcntl$setown(r0, 0x8, r1) bind$inet6(r0, &(0x7f0000807fe4)={0xa, 0x4e22}, 0x1c) sendto$inet6(r0, &(0x7f0000000380), 0x0, 0x200408d4, &(0x7f000072e000)={0xa, 0x0, 0x0, @loopback}, 0x1c) sendto$inet6(r0, &(0x7f0000ad6fad)='\x00', 0x1, 0x3fffffd, &(0x7f0000254000)={0xa, 0x0, 0x0, @loopback}, 0x1c) 13:17:15 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r0, &(0x7f0000942000)={0x2, 0x4e20, @multicast1}, 0x10) sendmsg$key(0xffffffffffffffff, &(0x7f0000f56000)={0x0, 0x0, &(0x7f00008feff0)={&(0x7f0000000500)=ANY=[@ANYBLOB="020300090a1500000000000000000000030006190000000002000000e0000001003f00000000000002000100e625aa66dcef85847e479eb3c49000000400000000fd003e"], 0x44}}, 0x0) add_key(&(0x7f0000000080)='logon\x00', &(0x7f0000000100)={0x73, 0x79, 0x7a, 0x1}, &(0x7f0000001240), 0x0, 0xfffffffffffffff8) get_mempolicy(&(0x7f0000000000), &(0x7f00000001c0), 0x1ff, &(0x7f0000fff000/0x1000)=nil, 0x3) setsockopt$sock_int(r0, 0x1, 0x3c, &(0x7f0000d4effc)=0x1, 0x4) connect$inet(r0, &(0x7f0000000000)={0x2, 0x4e20, @dev={0xac, 0x14, 0x14, 0x18}}, 0x10) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f00000001c0)='tunl0\x00', 0x5) sendto$inet(r0, &(0x7f00006d1fd4)="db", 0x1, 0x4000010, &(0x7f00004daff0)={0x2, 0x0, @loopback, [0x0, 0x700]}, 0x10) 13:17:15 executing program 5: r0 = syz_open_dev$binder(&(0x7f00000021c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000002340)={0x34, 0x0, &(0x7f0000002240)=[@request_death={0x400c630e, 0x4, 0x4}, @increfs={0x40046304, 0x4}, @increfs_done={0x40106308, 0x0, 0x3}, @increfs], 0x77, 0x0, &(0x7f00000022c0)="b3cd0976d8e2af74546f523efe14fd20c3c3dd2572734282a761e1b4304e2599c85f198cc82bd5d0c74c4edca2f9ea7b875ff7047ec0784fbb354e15fd3f7d837f533597d5082692a6f2fb748da3cc4157188f7f2a5477ded56f72f5b75c96872db429e44b8fcd781d96dead77a0b58b7af9085a208a22"}) [ 1537.600090] binder: 16477:16484 BC_REQUEST_DEATH_NOTIFICATION invalid ref 4 13:17:15 executing program 6: clone(0x802102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000040), 0xffffffffffffffff) r0 = syz_open_dev$sndtimer(&(0x7f0000000000)='/dev/snd/timer\x00', 0x0, 0x0) r1 = getpid() sched_setscheduler(r1, 0x5, &(0x7f0000000200)) ioctl$SNDRV_TIMER_IOCTL_GPARAMS(r0, 0x40485404, &(0x7f0000000240)={{}, 0x0, 0x2000000000000000, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3]}) 13:17:15 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r0, &(0x7f0000942000)={0x2, 0x4e20, @multicast1}, 0x10) sendmsg$key(0xffffffffffffffff, &(0x7f0000f56000)={0x0, 0x0, &(0x7f00008feff0)={&(0x7f0000000500)=ANY=[@ANYBLOB="020300090a1500000000000000000000030006190000000002000000e0000001003f00000000000002000100e625aa66dcef85847e479eb3c49000000400000000fd003e"], 0x44}}, 0x0) add_key(&(0x7f0000000080)='logon\x00', &(0x7f0000000100)={0x73, 0x79, 0x7a, 0x1}, &(0x7f0000001240), 0x0, 0xfffffffffffffff8) get_mempolicy(&(0x7f0000000000), &(0x7f00000001c0), 0x1ff, &(0x7f0000fff000/0x1000)=nil, 0x3) setsockopt$sock_int(r0, 0x1, 0x3c, &(0x7f0000d4effc)=0x1, 0x4) connect$inet(r0, &(0x7f0000000000)={0x2, 0x4e20, @dev={0xac, 0x14, 0x14, 0x18}}, 0x10) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f00000001c0)='tunl0\x00', 0x5) sendto$inet(r0, &(0x7f00006d1fd4)="db", 0x1, 0x4000010, &(0x7f00004daff0)={0x2, 0x0, @loopback, [0x0, 0x1100]}, 0x10) 13:17:15 executing program 3: r0 = openat$cuse(0xffffffffffffff9c, &(0x7f0000000080)='/dev/cuse\x00', 0x2, 0x0) clone(0x0, 0x0, 0xfffffffffffffffe, &(0x7f0000000640), 0xffffffffffffffff) r1 = getpid() sched_setscheduler(r1, 0x5, &(0x7f0000000000)) write$FUSE_NOTIFY_DELETE(r0, &(0x7f0000000040)={0x29, 0x5}, 0x29) [ 1537.741107] binder: 16504:16506 BC_REQUEST_DEATH_NOTIFICATION invalid ref 4 13:17:15 executing program 5: r0 = syz_open_dev$binder(&(0x7f00000021c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000002340)={0x34, 0x0, &(0x7f0000002240)=[@request_death={0x400c630e, 0x4, 0x4}, @increfs={0x40046304, 0x4}, @increfs_done={0x40106308, 0x0, 0x3}, @increfs], 0x77, 0x0, &(0x7f00000022c0)="b3cd0976d8e2af74096f523efe14fd20c3c3dd2572734282a761e1b4304e2599c85f198cc82bd5d0c74c4edca2f9ea7b875ff7047ec0784fbb354e15fd3f7d837f533597d5082692a6f2fb748da3cc4157188f7f2a5477ded56f72f5b75c96872db429e44b8fcd781d96dead77a0b58b7af9085a208a22"}) 13:17:15 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r0, &(0x7f0000942000)={0x2, 0x4e20, @multicast1}, 0x10) sendmsg$key(0xffffffffffffffff, &(0x7f0000f56000)={0x0, 0x0, &(0x7f00008feff0)={&(0x7f0000000500)=ANY=[@ANYBLOB="020300090a1500000000000000000000030006190000000002000000e0000001003f00000000000002000100e625aa66dcef85847e479eb3c49000000400000000fd003e"], 0x44}}, 0x0) add_key(&(0x7f0000000080)='logon\x00', &(0x7f0000000100)={0x73, 0x79, 0x7a, 0x1}, &(0x7f0000001240), 0x0, 0xfffffffffffffff8) get_mempolicy(&(0x7f0000000000), &(0x7f00000001c0), 0x1ff, &(0x7f0000fff000/0x1000)=nil, 0x3) setsockopt$sock_int(r0, 0x1, 0x3c, &(0x7f0000d4effc)=0x1, 0x4) connect$inet(r0, &(0x7f0000000000)={0x2, 0x4e20, @dev={0xac, 0x14, 0x14, 0x18}}, 0x10) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f00000001c0)='tunl0\x00', 0x5) sendto$inet(r0, &(0x7f00006d1fd4)="db", 0x1, 0x4000010, &(0x7f00004daff0)={0x2, 0x0, @loopback, [0x0, 0xfffffffd]}, 0x10) 13:17:15 executing program 7: r0 = openat$cuse(0xffffffffffffff9c, &(0x7f0000000080)='/dev/cuse\x00', 0x2, 0x0) clone(0x1002102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000640), 0xffffffffffffffff) r1 = getpid() sched_setscheduler(r1, 0x5, &(0x7f0000000000)) write$FUSE_NOTIFY_DELETE(r0, &(0x7f0000000040)={0x29, 0x6, 0x0, {0x5}}, 0x29) [ 1537.881861] binder: 16519:16520 BC_REQUEST_DEATH_NOTIFICATION invalid ref 4 13:17:16 executing program 1: r0 = socket$netlink(0x10, 0x3, 0x8000000004) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_TCP_CONGESTION(r1, 0x6, 0xd, &(0x7f0000000180)='vegas\x00', 0x6) bind$inet6(r1, &(0x7f00001fefe4)={0xa, 0x4e22}, 0x1c) sendto$inet6(r1, &(0x7f0000000100), 0x8d2d601e8976aa5, 0x20000004, &(0x7f000031e000)={0xa, 0x4e22}, 0x1c) writev(r0, &(0x7f0000000100)=[{&(0x7f0000000000)="580000001400192340834b80040d8c560a067fe70aff81004e220000000058000b4824ca944f64009400050028925aa8000000000000008000f0fffeffff09000000fff5dd00000010000100000c0900fcff0000040e05a5", 0x58}], 0x1) 13:17:16 executing program 6: clone(0x802102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000040), 0xffffffffffffffff) r0 = syz_open_dev$sndtimer(&(0x7f0000000000)='/dev/snd/timer\x00', 0x0, 0x0) r1 = getpid() sched_setscheduler(r1, 0x5, &(0x7f0000000200)) ioctl$SNDRV_TIMER_IOCTL_GPARAMS(r0, 0x40485404, &(0x7f0000000240)={{}, 0x0, 0x2000000000000000, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3]}) 13:17:16 executing program 3: r0 = openat$cuse(0xffffffffffffff9c, &(0x7f0000000080)='/dev/cuse\x00', 0x2, 0x0) clone(0x1002102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000640), 0xffffffffffffffff) getpid() sched_setscheduler(0x0, 0x5, &(0x7f0000000000)) write$FUSE_NOTIFY_DELETE(r0, &(0x7f0000000040)={0x29, 0x5}, 0x29) 13:17:16 executing program 5: r0 = syz_open_dev$binder(&(0x7f00000021c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000002340)={0x34, 0x0, &(0x7f0000002240)=[@request_death={0x400c630e, 0x4, 0x4}, @increfs={0x40046304, 0x4}, @increfs_done={0x40106308, 0x0, 0x3}, @increfs], 0x77, 0x0, &(0x7f00000022c0)="b3cd0976d8e2af743c0a523efe14fd20c3c3dd2572734282a761e1b4304e2599c85f198cc82bd5d0c74c4edca2f9ea7b875ff7047ec0784fbb354e15fd3f7d837f533597d5082692a6f2fb748da3cc4157188f7f2a5477ded56f72f5b75c96872db429e44b8fcd781d96dead77a0b58b7af9085a208a22"}) 13:17:16 executing program 7: r0 = openat$cuse(0xffffffffffffff9c, &(0x7f0000000080)='/dev/cuse\x00', 0x2, 0x0) clone(0x1002102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000640), 0xffffffffffffffff) r1 = getpid() sched_setscheduler(r1, 0x5, &(0x7f0000000000)) write$FUSE_NOTIFY_DELETE(r0, &(0x7f0000000040)={0x29, 0x6, 0x0, {0xa}}, 0x29) 13:17:16 executing program 4: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = gettid() perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x3e5}, 0x0, 0x0, 0xffffffffffffffff, 0x0) fcntl$setown(r0, 0x8, r1) bind$inet6(r0, &(0x7f0000807fe4)={0xa, 0x4e22}, 0x1c) sendto$inet6(r0, &(0x7f0000000380), 0x0, 0x200408d4, &(0x7f000072e000)={0xa, 0x4e22, 0x0, @loopback}, 0x1c) sendto$inet6(0xffffffffffffffff, &(0x7f0000ad6fad)='\x00', 0x1, 0x3fffffd, &(0x7f0000254000)={0xa, 0x0, 0x0, @loopback}, 0x1c) 13:17:16 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r0, &(0x7f0000942000)={0x2, 0x4e20, @multicast1}, 0x10) sendmsg$key(0xffffffffffffffff, &(0x7f0000f56000)={0x0, 0x0, &(0x7f00008feff0)={&(0x7f0000000500)=ANY=[@ANYBLOB="020300090a1500000000000000000000030006190000000002000000e0000001003f00000000000002000100e625aa66dcef85847e479eb3c49000000400000000fd003e"], 0x44}}, 0x0) add_key(&(0x7f0000000080)='logon\x00', &(0x7f0000000100)={0x73, 0x79, 0x7a, 0x1}, &(0x7f0000001240), 0x0, 0xfffffffffffffff8) get_mempolicy(&(0x7f0000000000), &(0x7f00000001c0), 0x1ff, &(0x7f0000fff000/0x1000)=nil, 0x3) setsockopt$sock_int(r0, 0x1, 0x3c, &(0x7f0000d4effc)=0x1, 0x4) connect$inet(r0, &(0x7f0000000000)={0x2, 0x4e20, @dev={0xac, 0x14, 0x14, 0x18}}, 0x10) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f00000001c0)='tunl0\x00', 0x5) sendto$inet(r0, &(0x7f00006d1fd4)="db", 0x1, 0x4000010, &(0x7f00004daff0)={0x2, 0x0, @loopback, [0x0, 0x4]}, 0x10) 13:17:16 executing program 0: perf_event_open(&(0x7f0000000040)={0x2, 0x70, 0x3e5}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f00000021c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000002340)={0xb5, 0x3f000000, &(0x7f00000000c0)=ANY=[@ANYBLOB="0463044000000000b6a571ac965f26c50d500dae115e59afcd8a338d8b2727193c56d4ebef60c214b766ffde6cff6ceef2baa2594a53a0117e77afd5d58e8a35afdae81b258585ce769507333c0238790d5ed750bf1d6ca2a873050056528fce7becfd12f165ac43a826d3462822ff8f29ea992d4e208847cf4fc10ca00b87b5ce2523fa477bad0be1c97e4398aa2ac81d973b5a871d8e0b295e436cd8415f19088c6c82c85f4ed1fac41da062bc6dbfb8eac4276c"], 0x0, 0x0, &(0x7f00000022c0)}) 13:17:16 executing program 7: r0 = openat$cuse(0xffffffffffffff9c, &(0x7f0000000080)='/dev/cuse\x00', 0x2, 0x0) clone(0x1002102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000640), 0xffffffffffffffff) r1 = getpid() sched_setscheduler(r1, 0x5, &(0x7f0000000000)) write$FUSE_NOTIFY_DELETE(r0, &(0x7f0000000040)={0x29, 0x6, 0x0, {0xa00000000000000}}, 0x29) 13:17:16 executing program 6: clone(0x802102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000040), 0xffffffffffffffff) r0 = syz_open_dev$sndtimer(&(0x7f0000000000)='/dev/snd/timer\x00', 0x0, 0x0) r1 = getpid() sched_setscheduler(r1, 0x5, &(0x7f0000000200)) ioctl$SNDRV_TIMER_IOCTL_GPARAMS(r0, 0x40485404, &(0x7f0000000240)={{}, 0x0, 0x2000000000000000, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x100000000000000]}) 13:17:16 executing program 3: r0 = openat$cuse(0xffffffffffffff9c, &(0x7f0000000080)='/dev/cuse\x00', 0x2, 0x0) clone(0x1002102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000640), 0xffffffffffffffff) r1 = getpid() sched_setscheduler(r1, 0x0, &(0x7f0000000000)) write$FUSE_NOTIFY_DELETE(r0, &(0x7f0000000040)={0x29, 0x5}, 0x29) [ 1538.514436] binder: 16554:16564 BC_REQUEST_DEATH_NOTIFICATION invalid ref 4 13:17:16 executing program 3: openat$cuse(0xffffffffffffff9c, &(0x7f0000000080)='/dev/cuse\x00', 0x2, 0x0) clone(0x1002102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000640), 0xffffffffffffffff) r0 = getpid() sched_setscheduler(r0, 0x5, &(0x7f0000000000)) write$FUSE_NOTIFY_DELETE(0xffffffffffffffff, &(0x7f0000000040)={0x29, 0x5}, 0x29) 13:17:16 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r0, &(0x7f0000942000)={0x2, 0x4e20, @multicast1}, 0x10) sendmsg$key(0xffffffffffffffff, &(0x7f0000f56000)={0x0, 0x0, &(0x7f00008feff0)={&(0x7f0000000500)=ANY=[@ANYBLOB="020300090a1500000000000000000000030006190000000002000000e0000001003f00000000000002000100e625aa66dcef85847e479eb3c49000000400000000fd003e"], 0x44}}, 0x0) add_key(&(0x7f0000000080)='logon\x00', &(0x7f0000000100)={0x73, 0x79, 0x7a, 0x1}, &(0x7f0000001240), 0x0, 0xfffffffffffffff8) get_mempolicy(&(0x7f0000000000), &(0x7f00000001c0), 0x1ff, &(0x7f0000fff000/0x1000)=nil, 0x3) setsockopt$sock_int(r0, 0x1, 0x3c, &(0x7f0000d4effc)=0x1, 0x4) connect$inet(r0, &(0x7f0000000000)={0x2, 0x4e20, @dev={0xac, 0x14, 0x14, 0x18}}, 0x10) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f00000001c0)='tunl0\x00', 0x5) sendto$inet(r0, &(0x7f00006d1fd4)="db", 0x1, 0x4000010, &(0x7f00004daff0)={0x2, 0x0, @loopback, [0x0, 0xe803000000000000]}, 0x10) 13:17:16 executing program 5: r0 = syz_open_dev$binder(&(0x7f00000021c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000002340)={0x34, 0x0, &(0x7f0000002240)=[@request_death={0x400c630e, 0x4, 0x4}, @increfs={0x40046304, 0x4}, @increfs_done={0x40106308, 0x0, 0x3}, @increfs], 0x77, 0x0, &(0x7f00000022c0)="b3cd0976d8e2af743c25523efe14fd20c3c3dd2572734282a761e1b4304e2599c85f198cc82bd5d0c74c4edca2f9ea7b875ff7047ec0784fbb354e15fd3f7d837f533597d5082692a6f2fb748da3cc4157188f7f2a5477ded56f72f5b75c96872db429e44b8fcd781d96dead77a0b58b7af9085a208a22"}) 13:17:16 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r0, &(0x7f0000942000)={0x2, 0x4e20, @multicast1}, 0x10) sendmsg$key(0xffffffffffffffff, &(0x7f0000f56000)={0x0, 0x0, &(0x7f00008feff0)={&(0x7f0000000500)=ANY=[@ANYBLOB="020300090a1500000000000000000000030006190000000002000000e0000001003f00000000000002000100e625aa66dcef85847e479eb3c49000000400000000fd003e"], 0x44}}, 0x0) add_key(&(0x7f0000000080)='logon\x00', &(0x7f0000000100)={0x73, 0x79, 0x7a, 0x1}, &(0x7f0000001240), 0x0, 0xfffffffffffffff8) get_mempolicy(&(0x7f0000000000), &(0x7f00000001c0), 0x1ff, &(0x7f0000fff000/0x1000)=nil, 0x3) setsockopt$sock_int(r0, 0x1, 0x3c, &(0x7f0000d4effc)=0x1, 0x4) connect$inet(r0, &(0x7f0000000000)={0x2, 0x4e20, @dev={0xac, 0x14, 0x14, 0x18}}, 0x10) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f00000001c0)='tunl0\x00', 0x5) sendto$inet(r0, &(0x7f00006d1fd4)="db", 0x1, 0x4000010, &(0x7f00004daff0)={0x2, 0x0, @loopback, [0x0, 0xffffffff00000000]}, 0x10) 13:17:16 executing program 5: r0 = syz_open_dev$binder(&(0x7f00000021c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000002340)={0x34, 0x0, &(0x7f0000002240)=[@request_death={0x400c630e, 0x4, 0x4}, @increfs={0x40046304, 0x4}, @increfs_done={0x40106308, 0x0, 0x3}, @increfs], 0x77, 0x0, &(0x7f00000022c0)="b3cd0976d8e2af743c6f0a3efe14fd20c3c3dd2572734282a761e1b4304e2599c85f198cc82bd5d0c74c4edca2f9ea7b875ff7047ec0784fbb354e15fd3f7d837f533597d5082692a6f2fb748da3cc4157188f7f2a5477ded56f72f5b75c96872db429e44b8fcd781d96dead77a0b58b7af9085a208a22"}) [ 1538.710997] binder: 16596:16597 BC_REQUEST_DEATH_NOTIFICATION invalid ref 4 [ 1538.871601] binder: 16607:16611 BC_REQUEST_DEATH_NOTIFICATION invalid ref 4 13:17:17 executing program 1: r0 = socket$netlink(0x10, 0x3, 0x8000000004) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_TCP_CONGESTION(r1, 0x6, 0xd, &(0x7f0000000180)='vegas\x00', 0x6) bind$inet6(r1, &(0x7f00001fefe4)={0xa, 0x4e22}, 0x1c) sendto$inet6(r1, &(0x7f0000000100), 0x8d2d601e8976aa5, 0x20000004, &(0x7f000031e000)={0xa, 0x4e22}, 0x1c) writev(r0, &(0x7f0000000100)=[{&(0x7f0000000000)="580000001400192340834b80040d8c560a067f30b4ff81004e220000000058000b4824ca944f64009400050028925aa8000000000000008000f0fffeffff09000000fff5dd00000010000100000c0900fcff0000040e05a5", 0x58}], 0x1) 13:17:17 executing program 7: r0 = openat$cuse(0xffffffffffffff9c, &(0x7f0000000080)='/dev/cuse\x00', 0x2, 0x0) clone(0x1002102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000640), 0xffffffffffffffff) r1 = getpid() sched_setscheduler(r1, 0x5, &(0x7f0000000000)) write$FUSE_NOTIFY_DELETE(r0, &(0x7f0000000040)={0x29, 0x6, 0x0, {0x1a0ffffffff}}, 0x29) 13:17:17 executing program 6: clone(0x802102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000040), 0xffffffffffffffff) r0 = syz_open_dev$sndtimer(&(0x7f0000000000)='/dev/snd/timer\x00', 0x0, 0x0) r1 = getpid() sched_setscheduler(r1, 0x5, &(0x7f0000000200)) ioctl$SNDRV_TIMER_IOCTL_GPARAMS(r0, 0x40485404, &(0x7f0000000240)={{}, 0x0, 0x2000000000000000, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x300000000000000]}) 13:17:17 executing program 3: r0 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r0, &(0x7f0000942000)={0x2, 0x4e20, @multicast1}, 0x10) sendmsg$key(0xffffffffffffffff, &(0x7f0000f56000)={0x0, 0x0, &(0x7f00008feff0)={&(0x7f0000000500)=ANY=[@ANYBLOB="020300090a1500000000000000000000030006190000000002000000e0000001003f00000000000002000100e625aa66dcef85847e479eb3c49000000400000000fd003e"], 0x44}}, 0x0) add_key(&(0x7f0000000080)='logon\x00', &(0x7f0000000100)={0x73, 0x79, 0x7a, 0x1}, &(0x7f0000001240), 0x0, 0xfffffffffffffff8) get_mempolicy(&(0x7f0000000000), &(0x7f00000001c0), 0x1ff, &(0x7f0000fff000/0x1000)=nil, 0x3) setsockopt$sock_int(r0, 0x1, 0x3c, &(0x7f0000d4effc)=0x1, 0x4) connect$inet(r0, &(0x7f0000000000)={0x2, 0x4e20, @dev={0xac, 0x14, 0x14, 0x18}}, 0x10) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f00000001c0)='tunl0\x00', 0x5) sendto$inet(r0, &(0x7f00006d1fd4)="db", 0x1, 0x4000010, &(0x7f00004daff0)={0x2, 0x0, @loopback, [0x0, 0x300000000000000]}, 0x10) 13:17:17 executing program 5: r0 = syz_open_dev$binder(&(0x7f00000021c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000002340)={0x34, 0x0, &(0x7f0000002240)=[@request_death={0x400c630e, 0x4, 0x4}, @increfs={0x40046304, 0x4}, @increfs_done={0x40106308, 0x0, 0x3}, @increfs], 0x77, 0x0, &(0x7f00000022c0)="b3cd0976d8e2af743c6f543efe14fd20c3c3dd2572734282a761e1b4304e2599c85f198cc82bd5d0c74c4edca2f9ea7b875ff7047ec0784fbb354e15fd3f7d837f533597d5082692a6f2fb748da3cc4157188f7f2a5477ded56f72f5b75c96872db429e44b8fcd781d96dead77a0b58b7af9085a208a22"}) 13:17:17 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r0, &(0x7f0000942000)={0x2, 0x4e20, @multicast1}, 0x10) sendmsg$key(0xffffffffffffffff, &(0x7f0000f56000)={0x0, 0x0, &(0x7f00008feff0)={&(0x7f0000000500)=ANY=[@ANYBLOB="020300090a1500000000000000000000030006190000000002000000e0000001003f00000000000002000100e625aa66dcef85847e479eb3c49000000400000000fd003e"], 0x44}}, 0x0) add_key(&(0x7f0000000080)='logon\x00', &(0x7f0000000100)={0x73, 0x79, 0x7a, 0x1}, &(0x7f0000001240), 0x0, 0xfffffffffffffff8) get_mempolicy(&(0x7f0000000000), &(0x7f00000001c0), 0x1ff, &(0x7f0000fff000/0x1000)=nil, 0x3) setsockopt$sock_int(r0, 0x1, 0x3c, &(0x7f0000d4effc)=0x1, 0x4) connect$inet(r0, &(0x7f0000000000)={0x2, 0x4e20, @dev={0xac, 0x14, 0x14, 0x18}}, 0x10) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f00000001c0)='tunl0\x00', 0x5) sendto$inet(r0, &(0x7f00006d1fd4)="db", 0x1, 0x4000010, &(0x7f00004daff0)={0x2, 0x0, @loopback, [0x0, 0x10000000000000]}, 0x10) 13:17:17 executing program 0: perf_event_open(&(0x7f0000000040)={0x2, 0x70, 0x3e5}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f00000021c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000002340)={0xb5, 0x60000000, &(0x7f00000000c0)=ANY=[@ANYBLOB="0463044000000000b6a571ac965f26c50d500dae115e59afcd8a338d8b2727193c56d4ebef60c214b766ffde6cff6ceef2baa2594a53a0117e77afd5d58e8a35afdae81b258585ce769507333c0238790d5ed750bf1d6ca2a873050056528fce7becfd12f165ac43a826d3462822ff8f29ea992d4e208847cf4fc10ca00b87b5ce2523fa477bad0be1c97e4398aa2ac81d973b5a871d8e0b295e436cd8415f19088c6c82c85f4ed1fac41da062bc6dbfb8eac4276c"], 0x0, 0x0, &(0x7f00000022c0)}) 13:17:17 executing program 4: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = gettid() perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x3e5}, 0x0, 0x0, 0xffffffffffffffff, 0x0) fcntl$setown(r0, 0x8, r1) bind$inet6(r0, &(0x7f0000807fe4)={0xa, 0x4e22}, 0x1c) sendto$inet6(r0, &(0x7f0000000380), 0x0, 0x200408d4, &(0x7f000072e000)={0xa, 0x4e22, 0x0, @loopback}, 0x1c) sendto$inet6(r0, &(0x7f0000ad6fad), 0x0, 0x3fffffd, &(0x7f0000254000)={0xa, 0x0, 0x0, @loopback}, 0x1c) 13:17:17 executing program 6: clone(0x802102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000040), 0xffffffffffffffff) r0 = syz_open_dev$sndtimer(&(0x7f0000000000)='/dev/snd/timer\x00', 0x0, 0x0) r1 = getpid() sched_setscheduler(r1, 0x5, &(0x7f0000000200)) ioctl$SNDRV_TIMER_IOCTL_GPARAMS(r0, 0x40485404, &(0x7f0000000240)={{}, 0x0, 0x2000000000000000, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1000000]}) 13:17:17 executing program 7: r0 = openat$cuse(0xffffffffffffff9c, &(0x7f0000000080)='/dev/cuse\x00', 0x2, 0x0) clone(0x1002102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000640), 0xffffffffffffffff) r1 = getpid() sched_setscheduler(r1, 0x5, &(0x7f0000000000)) write$FUSE_NOTIFY_DELETE(r0, &(0x7f0000000040)={0x29, 0x6, 0x0, {0xffffffffa0028000}}, 0x29) [ 1539.414777] binder_thread_write: 28 callbacks suppressed [ 1539.414792] binder: 16621:16626 IncRefs 0 refcount change on invalid ref 4 ret -22 13:17:17 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r0, &(0x7f0000942000)={0x2, 0x4e20, @multicast1}, 0x10) sendmsg$key(0xffffffffffffffff, &(0x7f0000f56000)={0x0, 0x0, &(0x7f00008feff0)={&(0x7f0000000500)=ANY=[@ANYBLOB="020300090a1500000000000000000000030006190000000002000000e0000001003f00000000000002000100e625aa66dcef85847e479eb3c49000000400000000fd003e"], 0x44}}, 0x0) add_key(&(0x7f0000000080)='logon\x00', &(0x7f0000000100)={0x73, 0x79, 0x7a, 0x1}, &(0x7f0000001240), 0x0, 0xfffffffffffffff8) get_mempolicy(&(0x7f0000000000), &(0x7f00000001c0), 0x1ff, &(0x7f0000fff000/0x1000)=nil, 0x3) setsockopt$sock_int(r0, 0x1, 0x3c, &(0x7f0000d4effc)=0x1, 0x4) connect$inet(r0, &(0x7f0000000000)={0x2, 0x4e20, @dev={0xac, 0x14, 0x14, 0x18}}, 0x10) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f00000001c0)='tunl0\x00', 0x5) sendto$inet(r0, &(0x7f00006d1fd4)="db", 0x1, 0x4000010, &(0x7f00004daff0)={0x2, 0x0, @loopback, [0x0, 0xa6ffffff]}, 0x10) [ 1539.515500] binder_thread_write: 9 callbacks suppressed [ 1539.515515] binder: 16621:16626 BC_INCREFS_DONE u0000000000000000 no match 13:17:17 executing program 3: r0 = openat$cuse(0xffffffffffffff9c, &(0x7f0000000080)='/dev/cuse\x00', 0x2, 0x0) clone(0x1002102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000640), 0xffffffffffffffff) r1 = getpid() sched_setscheduler(r1, 0x5, &(0x7f0000000000)) write$FUSE_NOTIFY_DELETE(r0, &(0x7f0000000040)={0x29, 0x4}, 0x29) 13:17:17 executing program 7: r0 = openat$cuse(0xffffffffffffff9c, &(0x7f0000000080)='/dev/cuse\x00', 0x2, 0x0) clone(0x1002102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000640), 0xffffffffffffffff) r1 = getpid() sched_setscheduler(r1, 0x5, &(0x7f0000000000)) write$FUSE_NOTIFY_DELETE(r0, &(0x7f0000000040)={0x29, 0x6, 0x0, {0x6}}, 0x29) [ 1539.580935] binder: 16621:16626 IncRefs 0 refcount change on invalid ref 0 ret -22 [ 1539.597148] binder: 16621:16626 IncRefs 0 refcount change on invalid ref 4 ret -22 [ 1539.616242] binder: 16621:16626 BC_INCREFS_DONE u0000000000000000 no match 13:17:17 executing program 3: r0 = openat$cuse(0xffffffffffffff9c, &(0x7f0000000080)='/dev/cuse\x00', 0x2, 0x0) clone(0x1002102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000640), 0xffffffffffffffff) r1 = getpid() sched_setscheduler(r1, 0x5, &(0x7f0000000000)) write$FUSE_NOTIFY_DELETE(r0, &(0x7f0000000040)={0x29, 0x4}, 0x29) 13:17:17 executing program 7: r0 = openat$cuse(0xffffffffffffff9c, &(0x7f0000000080)='/dev/cuse\x00', 0x2, 0x0) clone(0x1002102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000640), 0xffffffffffffffff) r1 = getpid() sched_setscheduler(r1, 0x5, &(0x7f0000000000)) write$FUSE_NOTIFY_DELETE(r0, &(0x7f0000000040)={0x29, 0x6, 0x0, {0x3}}, 0x29) [ 1539.666824] binder: 16621:16626 IncRefs 0 refcount change on invalid ref 0 ret -22 13:17:17 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r0, &(0x7f0000942000)={0x2, 0x4e20, @multicast1}, 0x10) sendmsg$key(0xffffffffffffffff, &(0x7f0000f56000)={0x0, 0x0, &(0x7f00008feff0)={&(0x7f0000000500)=ANY=[@ANYBLOB="020300090a1500000000000000000000030006190000000002000000e0000001003f00000000000002000100e625aa66dcef85847e479eb3c49000000400000000fd003e"], 0x44}}, 0x0) add_key(&(0x7f0000000080)='logon\x00', &(0x7f0000000100)={0x73, 0x79, 0x7a, 0x1}, &(0x7f0000001240), 0x0, 0xfffffffffffffff8) get_mempolicy(&(0x7f0000000000), &(0x7f00000001c0), 0x1ff, &(0x7f0000fff000/0x1000)=nil, 0x3) setsockopt$sock_int(r0, 0x1, 0x3c, &(0x7f0000d4effc)=0x1, 0x4) connect$inet(r0, &(0x7f0000000000)={0x2, 0x4e20, @dev={0xac, 0x14, 0x14, 0x18}}, 0x10) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f00000001c0)='tunl0\x00', 0x5) sendto$inet(r0, &(0x7f00006d1fd4)="db", 0x1, 0x4000010, &(0x7f00004daff0)={0x2, 0x0, @loopback, [0x0, 0x3000000]}, 0x10) 13:17:18 executing program 1: r0 = socket$netlink(0x10, 0x3, 0x8000000004) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_TCP_CONGESTION(r1, 0x6, 0xd, &(0x7f0000000180)='vegas\x00', 0x6) bind$inet6(r1, &(0x7f00001fefe4)={0xa, 0x4e22}, 0x1c) sendto$inet6(r1, &(0x7f0000000100), 0x8d2d601e8976aa5, 0x20000004, &(0x7f000031e000)={0xa, 0x4e22}, 0x1c) writev(r0, &(0x7f0000000100)=[{&(0x7f0000000000)="580000001400192340834b80040d8c560a067f1f29ff81004e220000000058000b4824ca944f64009400050028925aa8000000000000008000f0fffeffff09000000fff5dd00000010000100000c0900fcff0000040e05a5", 0x58}], 0x1) 13:17:18 executing program 3: r0 = openat$cuse(0xffffffffffffff9c, &(0x7f0000000080)='/dev/cuse\x00', 0x2, 0x0) clone(0x1002102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000640), 0xffffffffffffffff) r1 = getpid() sched_setscheduler(r1, 0x5, &(0x7f0000000000)) write$FUSE_NOTIFY_DELETE(r0, &(0x7f0000000040)={0x29, 0x4}, 0x29) 13:17:18 executing program 5: r0 = syz_open_dev$binder(&(0x7f00000021c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000002340)={0x34, 0x0, &(0x7f0000002240)=[@request_death={0x400c630e, 0x4, 0x4}, @increfs={0x40046304, 0x4}, @increfs_done={0x40106308, 0x0, 0x3}, @increfs], 0x77, 0x0, &(0x7f00000022c0)="b3cd0976d8e2af743c6f524cfe14fd20c3c3dd2572734282a761e1b4304e2599c85f198cc82bd5d0c74c4edca2f9ea7b875ff7047ec0784fbb354e15fd3f7d837f533597d5082692a6f2fb748da3cc4157188f7f2a5477ded56f72f5b75c96872db429e44b8fcd781d96dead77a0b58b7af9085a208a22"}) 13:17:18 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r0, &(0x7f0000942000)={0x2, 0x4e20, @multicast1}, 0x10) sendmsg$key(0xffffffffffffffff, &(0x7f0000f56000)={0x0, 0x0, &(0x7f00008feff0)={&(0x7f0000000500)=ANY=[@ANYBLOB="020300090a1500000000000000000000030006190000000002000000e0000001003f00000000000002000100e625aa66dcef85847e479eb3c49000000400000000fd003e"], 0x44}}, 0x0) add_key(&(0x7f0000000080)='logon\x00', &(0x7f0000000100)={0x73, 0x79, 0x7a, 0x1}, &(0x7f0000001240), 0x0, 0xfffffffffffffff8) get_mempolicy(&(0x7f0000000000), &(0x7f00000001c0), 0x1ff, &(0x7f0000fff000/0x1000)=nil, 0x3) setsockopt$sock_int(r0, 0x1, 0x3c, &(0x7f0000d4effc)=0x1, 0x4) connect$inet(r0, &(0x7f0000000000)={0x2, 0x4e20, @dev={0xac, 0x14, 0x14, 0x18}}, 0x10) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f00000001c0)='tunl0\x00', 0x5) sendto$inet(r0, &(0x7f00006d1fd4)="db", 0x1, 0x4000010, &(0x7f00004daff0)={0x2, 0x0, @loopback, [0x0, 0x8055]}, 0x10) 13:17:18 executing program 6: clone(0x802102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000040), 0xffffffffffffffff) r0 = syz_open_dev$sndtimer(&(0x7f0000000000)='/dev/snd/timer\x00', 0x0, 0x0) r1 = getpid() sched_setscheduler(r1, 0x5, &(0x7f0000000200)) ioctl$SNDRV_TIMER_IOCTL_GPARAMS(r0, 0x40485404, &(0x7f0000000240)={{}, 0x0, 0x2000000000000000, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3000000]}) 13:17:18 executing program 0: perf_event_open(&(0x7f0000000040)={0x2, 0x70, 0x3e5}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f00000021c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000002340)={0xb5, 0x74, &(0x7f00000000c0)=ANY=[@ANYBLOB="0463044000000000b6a571ac965f26c50d500dae115e59afcd8a338d8b2727193c56d4ebef60c214b766ffde6cff6ceef2baa2594a53a0117e77afd5d58e8a35afdae81b258585ce769507333c0238790d5ed750bf1d6ca2a873050056528fce7becfd12f165ac43a826d3462822ff8f29ea992d4e208847cf4fc10ca00b87b5ce2523fa477bad0be1c97e4398aa2ac81d973b5a871d8e0b295e436cd8415f19088c6c82c85f4ed1fac41da062bc6dbfb8eac4276c"], 0x0, 0x0, &(0x7f00000022c0)}) 13:17:18 executing program 7: r0 = openat$cuse(0xffffffffffffff9c, &(0x7f0000000080)='/dev/cuse\x00', 0x2, 0x0) clone(0x1002102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000640), 0xffffffffffffffff) r1 = getpid() sched_setscheduler(r1, 0x5, &(0x7f0000000000)) write$FUSE_NOTIFY_DELETE(r0, &(0x7f0000000040)={0x29, 0x6, 0x0, {0xa000000}}, 0x29) 13:17:18 executing program 4: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = gettid() perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x3e5}, 0x0, 0x0, 0xffffffffffffffff, 0x0) fcntl$setown(r0, 0x8, r1) bind$inet6(r0, &(0x7f0000807fe4)={0xa, 0x4e22}, 0x1c) sendto$inet6(r0, &(0x7f0000000380), 0x0, 0x200408d4, &(0x7f000072e000)={0xa, 0x4e22, 0x0, @loopback}, 0x1c) sendto$inet6(r0, &(0x7f0000ad6fad)='\x00', 0x1, 0x0, &(0x7f0000254000)={0xa, 0x0, 0x0, @loopback}, 0x1c) 13:17:18 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r0, &(0x7f0000942000)={0x2, 0x4e20, @multicast1}, 0x10) sendmsg$key(0xffffffffffffffff, &(0x7f0000f56000)={0x0, 0x0, &(0x7f00008feff0)={&(0x7f0000000500)=ANY=[@ANYBLOB="020300090a1500000000000000000000030006190000000002000000e0000001003f00000000000002000100e625aa66dcef85847e479eb3c49000000400000000fd003e"], 0x44}}, 0x0) add_key(&(0x7f0000000080)='logon\x00', &(0x7f0000000100)={0x73, 0x79, 0x7a, 0x1}, &(0x7f0000001240), 0x0, 0xfffffffffffffff8) get_mempolicy(&(0x7f0000000000), &(0x7f00000001c0), 0x1ff, &(0x7f0000fff000/0x1000)=nil, 0x3) setsockopt$sock_int(r0, 0x1, 0x3c, &(0x7f0000d4effc)=0x1, 0x4) connect$inet(r0, &(0x7f0000000000)={0x2, 0x4e20, @dev={0xac, 0x14, 0x14, 0x18}}, 0x10) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f00000001c0)='tunl0\x00', 0x5) sendto$inet(r0, &(0x7f00006d1fd4)="db", 0x1, 0x4000010, &(0x7f00004daff0)={0x2, 0x0, @loopback, [0x0, 0x0, 0x5]}, 0x10) 13:17:18 executing program 3: r0 = openat$cuse(0xffffffffffffff9c, &(0x7f0000000080)='/dev/cuse\x00', 0x2, 0x0) clone(0x1002102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000640), 0xffffffffffffffff) getpid() write$FUSE_NOTIFY_DELETE(r0, &(0x7f0000000040)={0x29, 0x4}, 0x29) 13:17:18 executing program 6: clone(0x802102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000040), 0xffffffffffffffff) r0 = syz_open_dev$sndtimer(&(0x7f0000000000)='/dev/snd/timer\x00', 0x0, 0x0) r1 = getpid() sched_setscheduler(r1, 0x5, &(0x7f0000000200)) ioctl$SNDRV_TIMER_IOCTL_GPARAMS(r0, 0x40485404, &(0x7f0000000240)={{}, 0x0, 0x2000000000000000, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x300]}) [ 1540.309240] binder: 16691:16706 IncRefs 0 refcount change on invalid ref 4 ret -22 [ 1540.329718] binder: 16691:16706 BC_INCREFS_DONE u0000000000000000 no match [ 1540.337601] binder: 16691:16706 IncRefs 0 refcount change on invalid ref 0 ret -22 13:17:18 executing program 5: r0 = syz_open_dev$binder(&(0x7f00000021c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000002340)={0x34, 0x0, &(0x7f0000002240)=[@request_death={0x400c630e, 0x4, 0x4}, @increfs={0x40046304, 0x4}, @increfs_done={0x40106308, 0x0, 0x3}, @increfs], 0x77, 0x0, &(0x7f00000022c0)="b3cd0976d8e2af743c6f524dfe14fd20c3c3dd2572734282a761e1b4304e2599c85f198cc82bd5d0c74c4edca2f9ea7b875ff7047ec0784fbb354e15fd3f7d837f533597d5082692a6f2fb748da3cc4157188f7f2a5477ded56f72f5b75c96872db429e44b8fcd781d96dead77a0b58b7af9085a208a22"}) 13:17:18 executing program 7: r0 = openat$cuse(0xffffffffffffff9c, &(0x7f0000000080)='/dev/cuse\x00', 0x2, 0x0) clone(0x1002102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000640), 0xffffffffffffffff) r1 = getpid() sched_setscheduler(r1, 0x5, &(0x7f0000000000)) write$FUSE_NOTIFY_DELETE(r0, &(0x7f0000000040)={0x29, 0x6, 0x0, {0x100000000000000}}, 0x29) 13:17:18 executing program 3: r0 = openat$cuse(0xffffffffffffff9c, &(0x7f0000000080)='/dev/cuse\x00', 0x2, 0x0) clone(0x1002102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000640), 0xffffffffffffffff) sched_setscheduler(0x0, 0x5, &(0x7f0000000000)) write$FUSE_NOTIFY_DELETE(r0, &(0x7f0000000040)={0x29, 0x4}, 0x29) 13:17:18 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r0, &(0x7f0000942000)={0x2, 0x4e20, @multicast1}, 0x10) sendmsg$key(0xffffffffffffffff, &(0x7f0000f56000)={0x0, 0x0, &(0x7f00008feff0)={&(0x7f0000000500)=ANY=[@ANYBLOB="020300090a1500000000000000000000030006190000000002000000e0000001003f00000000000002000100e625aa66dcef85847e479eb3c49000000400000000fd003e"], 0x44}}, 0x0) add_key(&(0x7f0000000080)='logon\x00', &(0x7f0000000100)={0x73, 0x79, 0x7a, 0x1}, &(0x7f0000001240), 0x0, 0xfffffffffffffff8) get_mempolicy(&(0x7f0000000000), &(0x7f00000001c0), 0x1ff, &(0x7f0000fff000/0x1000)=nil, 0x3) setsockopt$sock_int(r0, 0x1, 0x3c, &(0x7f0000d4effc)=0x1, 0x4) connect$inet(r0, &(0x7f0000000000)={0x2, 0x4e20, @dev={0xac, 0x14, 0x14, 0x18}}, 0x10) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f00000001c0)='tunl0\x00', 0x5) sendto$inet(r0, &(0x7f00006d1fd4)="db", 0x1, 0x4000010, &(0x7f00004daff0)={0x2, 0x0, @loopback, [0x0, 0x0, 0xffffffffa0008000]}, 0x10) 13:17:18 executing program 3: r0 = openat$cuse(0xffffffffffffff9c, &(0x7f0000000080)='/dev/cuse\x00', 0x2, 0x0) clone(0x1002102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000640), 0xffffffffffffffff) sched_setscheduler(0x0, 0x5, &(0x7f0000000000)) write$FUSE_NOTIFY_DELETE(r0, &(0x7f0000000040)={0x29, 0x4}, 0x29) [ 1540.535036] binder: 16730:16737 IncRefs 0 refcount change on invalid ref 4 ret -22 [ 1540.556862] binder: 16730:16737 BC_INCREFS_DONE u0000000000000000 no match [ 1540.566084] binder: 16730:16737 IncRefs 0 refcount change on invalid ref 0 ret -22 [ 1540.762774] binder: 16755:16760 unknown command 1200103502 [ 1540.768760] binder: 16755:16760 ioctl c0306201 20002340 returned -22 [ 1540.804582] binder: 16755:16762 unknown command 1200103502 [ 1540.810440] binder: 16755:16762 ioctl c0306201 20002340 returned -22 13:17:19 executing program 1: r0 = socket$netlink(0x10, 0x3, 0x8000000004) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_TCP_CONGESTION(r1, 0x6, 0xd, &(0x7f0000000180)='vegas\x00', 0x6) bind$inet6(r1, &(0x7f00001fefe4)={0xa, 0x4e22}, 0x1c) sendto$inet6(r1, &(0x7f0000000100), 0x8d2d601e8976aa5, 0x20000004, &(0x7f000031e000)={0xa, 0x4e22}, 0x1c) writev(r0, &(0x7f0000000100)=[{&(0x7f0000000000)="580000001400192340834b80040d8c560a067fbd5bff81004e220000000058000b4824ca944f64009400050028925aa8000000000000008000f0fffeffff09000000fff5dd00000010000100000c0900fcff0000040e05a5", 0x58}], 0x1) 13:17:19 executing program 5: r0 = syz_open_dev$binder(&(0x7f00000021c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000002340)={0x34, 0x0, &(0x7f0000002240)=[@request_death={0x400c630e, 0x4, 0x4}, @increfs={0x40046304, 0x4}, @increfs_done={0x40106308, 0x0, 0x3}, @increfs], 0x77, 0x0, &(0x7f00000022c0)="b3cd0976d8e2af743c6f5254fe14fd20c3c3dd2572734282a761e1b4304e2599c85f198cc82bd5d0c74c4edca2f9ea7b875ff7047ec0784fbb354e15fd3f7d837f533597d5082692a6f2fb748da3cc4157188f7f2a5477ded56f72f5b75c96872db429e44b8fcd781d96dead77a0b58b7af9085a208a22"}) 13:17:19 executing program 3: r0 = openat$cuse(0xffffffffffffff9c, &(0x7f0000000080)='/dev/cuse\x00', 0x2, 0x0) clone(0x1002102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000640), 0xffffffffffffffff) sched_setscheduler(0x0, 0x5, &(0x7f0000000000)) write$FUSE_NOTIFY_DELETE(r0, &(0x7f0000000040)={0x29, 0x4}, 0x29) 13:17:19 executing program 6: clone(0x802102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000040), 0xffffffffffffffff) r0 = syz_open_dev$sndtimer(&(0x7f0000000000)='/dev/snd/timer\x00', 0x0, 0x0) r1 = getpid() sched_setscheduler(r1, 0x5, &(0x7f0000000200)) ioctl$SNDRV_TIMER_IOCTL_GPARAMS(r0, 0x40485404, &(0x7f0000000240)={{}, 0x0, 0x2000000000000000, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x100000000000000]}) 13:17:19 executing program 7: r0 = openat$cuse(0xffffffffffffff9c, &(0x7f0000000080)='/dev/cuse\x00', 0x2, 0x0) clone(0x1002102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000640), 0xffffffffffffffff) r1 = getpid() sched_setscheduler(r1, 0x5, &(0x7f0000000000)) write$FUSE_NOTIFY_DELETE(r0, &(0x7f0000000040)={0x29, 0x6, 0x0, {0x5000000}}, 0x29) 13:17:19 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r0, &(0x7f0000942000)={0x2, 0x4e20, @multicast1}, 0x10) sendmsg$key(0xffffffffffffffff, &(0x7f0000f56000)={0x0, 0x0, &(0x7f00008feff0)={&(0x7f0000000500)=ANY=[@ANYBLOB="020300090a1500000000000000000000030006190000000002000000e0000001003f00000000000002000100e625aa66dcef85847e479eb3c49000000400000000fd003e"], 0x44}}, 0x0) add_key(&(0x7f0000000080)='logon\x00', &(0x7f0000000100)={0x73, 0x79, 0x7a, 0x1}, &(0x7f0000001240), 0x0, 0xfffffffffffffff8) get_mempolicy(&(0x7f0000000000), &(0x7f00000001c0), 0x1ff, &(0x7f0000fff000/0x1000)=nil, 0x3) setsockopt$sock_int(r0, 0x1, 0x3c, &(0x7f0000d4effc)=0x1, 0x4) connect$inet(r0, &(0x7f0000000000)={0x2, 0x4e20, @dev={0xac, 0x14, 0x14, 0x18}}, 0x10) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f00000001c0)='tunl0\x00', 0x5) sendto$inet(r0, &(0x7f00006d1fd4)="db", 0x1, 0x4000010, &(0x7f00004daff0)={0x2, 0x0, @loopback, [0x0, 0x0, 0x700000000000000]}, 0x10) 13:17:19 executing program 4 (fault-call:6 fault-nth:0): r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = gettid() perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x3e5}, 0x0, 0x0, 0xffffffffffffffff, 0x0) fcntl$setown(r0, 0x8, r1) bind$inet6(r0, &(0x7f0000807fe4)={0xa, 0x4e22}, 0x1c) sendto$inet6(r0, &(0x7f0000000380), 0x0, 0x200408d4, &(0x7f000072e000)={0xa, 0x4e22, 0x0, @loopback}, 0x1c) sendto$inet6(r0, &(0x7f0000ad6fad)='\x00', 0x1, 0x3fffffd, &(0x7f0000254000)={0xa, 0x0, 0x0, @loopback}, 0x1c) 13:17:19 executing program 0: perf_event_open(&(0x7f0000000040)={0x2, 0x70, 0x3e5}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f00000021c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000002340)={0xb5, 0x2, &(0x7f00000000c0)=ANY=[@ANYBLOB="0463044000000000b6a571ac965f26c50d500dae115e59afcd8a338d8b2727193c56d4ebef60c214b766ffde6cff6ceef2baa2594a53a0117e77afd5d58e8a35afdae81b258585ce769507333c0238790d5ed750bf1d6ca2a873050056528fce7becfd12f165ac43a826d3462822ff8f29ea992d4e208847cf4fc10ca00b87b5ce2523fa477bad0be1c97e4398aa2ac81d973b5a871d8e0b295e436cd8415f19088c6c82c85f4ed1fac41da062bc6dbfb8eac4276c"], 0x0, 0x0, &(0x7f00000022c0)}) 13:17:19 executing program 3: r0 = openat$cuse(0xffffffffffffff9c, &(0x7f0000000080)='/dev/cuse\x00', 0x2, 0x0) r1 = getpid() sched_setscheduler(r1, 0x5, &(0x7f0000000000)) write$FUSE_NOTIFY_DELETE(r0, &(0x7f0000000040)={0x29, 0x4}, 0x29) 13:17:19 executing program 6: clone(0x802102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000040), 0xffffffffffffffff) r0 = syz_open_dev$sndtimer(&(0x7f0000000000)='/dev/snd/timer\x00', 0x0, 0x0) r1 = getpid() sched_setscheduler(r1, 0x5, &(0x7f0000000200)) ioctl$SNDRV_TIMER_IOCTL_GPARAMS(r0, 0x40485404, &(0x7f0000000240)={{}, 0x0, 0x2000000000000000, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x300000000000000]}) [ 1541.197745] binder: 16763:16775 IncRefs 0 refcount change on invalid ref 4 ret -22 [ 1541.210999] binder: 16763:16775 BC_INCREFS_DONE u0000000000000000 no match [ 1541.230480] binder: 16763:16775 IncRefs 0 refcount change on invalid ref 0 ret -22 13:17:19 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r0, &(0x7f0000942000)={0x2, 0x4e20, @multicast1}, 0x10) sendmsg$key(0xffffffffffffffff, &(0x7f0000f56000)={0x0, 0x0, &(0x7f00008feff0)={&(0x7f0000000500)=ANY=[@ANYBLOB="020300090a1500000000000000000000030006190000000002000000e0000001003f00000000000002000100e625aa66dcef85847e479eb3c49000000400000000fd003e"], 0x44}}, 0x0) add_key(&(0x7f0000000080)='logon\x00', &(0x7f0000000100)={0x73, 0x79, 0x7a, 0x1}, &(0x7f0000001240), 0x0, 0xfffffffffffffff8) get_mempolicy(&(0x7f0000000000), &(0x7f00000001c0), 0x1ff, &(0x7f0000fff000/0x1000)=nil, 0x3) setsockopt$sock_int(r0, 0x1, 0x3c, &(0x7f0000d4effc)=0x1, 0x4) connect$inet(r0, &(0x7f0000000000)={0x2, 0x4e20, @dev={0xac, 0x14, 0x14, 0x18}}, 0x10) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f00000001c0)='tunl0\x00', 0x5) sendto$inet(r0, &(0x7f00006d1fd4)="db", 0x1, 0x4000010, &(0x7f00004daff0)={0x2, 0x0, @loopback, [0x0, 0x0, 0xf4010000]}, 0x10) 13:17:19 executing program 5: r0 = syz_open_dev$binder(&(0x7f00000021c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000002340)={0x34, 0x0, &(0x7f0000002240)=[@request_death={0x400c630e, 0x4, 0x4}, @increfs={0x40046304, 0x4}, @increfs_done={0x40106308, 0x0, 0x3}, @increfs], 0x77, 0x0, &(0x7f00000022c0)="b3cd0976d8e2af743c6f523efe3bfd20c3c3dd2572734282a761e1b4304e2599c85f198cc82bd5d0c74c4edca2f9ea7b875ff7047ec0784fbb354e15fd3f7d837f533597d5082692a6f2fb748da3cc4157188f7f2a5477ded56f72f5b75c96872db429e44b8fcd781d96dead77a0b58b7af9085a208a22"}) 13:17:19 executing program 6: clone(0x802102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000040), 0xffffffffffffffff) r0 = syz_open_dev$sndtimer(&(0x7f0000000000)='/dev/snd/timer\x00', 0x0, 0x0) r1 = getpid() sched_setscheduler(r1, 0x5, &(0x7f0000000200)) ioctl$SNDRV_TIMER_IOCTL_GPARAMS(r0, 0x40485404, &(0x7f0000000240)={{}, 0x0, 0x2000000000000000, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1000000]}) 13:17:19 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r0, &(0x7f0000942000)={0x2, 0x4e20, @multicast1}, 0x10) sendmsg$key(0xffffffffffffffff, &(0x7f0000f56000)={0x0, 0x0, &(0x7f00008feff0)={&(0x7f0000000500)=ANY=[@ANYBLOB="020300090a1500000000000000000000030006190000000002000000e0000001003f00000000000002000100e625aa66dcef85847e479eb3c49000000400000000fd003e"], 0x44}}, 0x0) add_key(&(0x7f0000000080)='logon\x00', &(0x7f0000000100)={0x73, 0x79, 0x7a, 0x1}, &(0x7f0000001240), 0x0, 0xfffffffffffffff8) get_mempolicy(&(0x7f0000000000), &(0x7f00000001c0), 0x1ff, &(0x7f0000fff000/0x1000)=nil, 0x3) setsockopt$sock_int(r0, 0x1, 0x3c, &(0x7f0000d4effc)=0x1, 0x4) connect$inet(r0, &(0x7f0000000000)={0x2, 0x4e20, @dev={0xac, 0x14, 0x14, 0x18}}, 0x10) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f00000001c0)='tunl0\x00', 0x5) sendto$inet(r0, &(0x7f00006d1fd4)="db", 0x1, 0x4000010, &(0x7f00004daff0)={0x2, 0x0, @loopback, [0x0, 0x0, 0x8000000]}, 0x10) 13:17:19 executing program 5: r0 = syz_open_dev$binder(&(0x7f00000021c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000002340)={0x34, 0x0, &(0x7f0000002240)=[@request_death={0x400c630e, 0x4, 0x4}, @increfs={0x40046304, 0x4}, @increfs_done={0x40106308, 0x0, 0x3}, @increfs], 0x77, 0x0, &(0x7f00000022c0)="b3cd0976d8e2af743c6f523efe4cfd20c3c3dd2572734282a761e1b4304e2599c85f198cc82bd5d0c74c4edca2f9ea7b875ff7047ec0784fbb354e15fd3f7d837f533597d5082692a6f2fb748da3cc4157188f7f2a5477ded56f72f5b75c96872db429e44b8fcd781d96dead77a0b58b7af9085a208a22"}) [ 1541.420581] binder: 16800:16805 BC_INCREFS_DONE u0000000000000000 no match 13:17:19 executing program 7: r0 = openat$cuse(0xffffffffffffff9c, &(0x7f0000000080)='/dev/cuse\x00', 0x2, 0x0) clone(0x1002102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000640), 0xffffffffffffffff) r1 = getpid() sched_setscheduler(r1, 0x5, &(0x7f0000000000)) write$FUSE_NOTIFY_DELETE(r0, &(0x7f0000000040)={0x29, 0x6, 0x0, {0xffffffffa0010000}}, 0x29) [ 1541.557877] binder: 16819:16823 BC_INCREFS_DONE u0000000000000000 no match [ 1541.681428] binder: 16835:16837 unknown command 16388 [ 1541.691407] binder: 16835:16837 ioctl c0306201 20002340 returned -22 [ 1541.720413] binder: 16835:16839 unknown command 16388 [ 1541.726278] binder: 16835:16839 ioctl c0306201 20002340 returned -22 13:17:20 executing program 1: r0 = socket$netlink(0x10, 0x3, 0x8000000004) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_TCP_CONGESTION(r1, 0x6, 0xd, &(0x7f0000000180)='vegas\x00', 0x6) bind$inet6(r1, &(0x7f00001fefe4)={0xa, 0x4e22}, 0x1c) sendto$inet6(r1, &(0x7f0000000100), 0x8d2d601e8976aa5, 0x20000004, &(0x7f000031e000)={0xa, 0x4e22}, 0x1c) writev(r0, &(0x7f0000000100)=[{&(0x7f0000000000)="580000001400192340834b80040d8c560a067f9f1aff81004e220000000058000b4824ca944f64009400050028925aa8000000000000008000f0fffeffff09000000fff5dd00000010000100000c0900fcff0000040e05a5", 0x58}], 0x1) 13:17:20 executing program 6: clone(0x802102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000040), 0xffffffffffffffff) r0 = syz_open_dev$sndtimer(&(0x7f0000000000)='/dev/snd/timer\x00', 0x0, 0x0) r1 = getpid() sched_setscheduler(r1, 0x5, &(0x7f0000000200)) ioctl$SNDRV_TIMER_IOCTL_GPARAMS(r0, 0x40485404, &(0x7f0000000240)={{}, 0x0, 0x2000000000000000, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3000000]}) 13:17:20 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r0, &(0x7f0000942000)={0x2, 0x4e20, @multicast1}, 0x10) sendmsg$key(0xffffffffffffffff, &(0x7f0000f56000)={0x0, 0x0, &(0x7f00008feff0)={&(0x7f0000000500)=ANY=[@ANYBLOB="020300090a1500000000000000000000030006190000000002000000e0000001003f00000000000002000100e625aa66dcef85847e479eb3c49000000400000000fd003e"], 0x44}}, 0x0) add_key(&(0x7f0000000080)='logon\x00', &(0x7f0000000100)={0x73, 0x79, 0x7a, 0x1}, &(0x7f0000001240), 0x0, 0xfffffffffffffff8) get_mempolicy(&(0x7f0000000000), &(0x7f00000001c0), 0x1ff, &(0x7f0000fff000/0x1000)=nil, 0x3) setsockopt$sock_int(r0, 0x1, 0x3c, &(0x7f0000d4effc)=0x1, 0x4) connect$inet(r0, &(0x7f0000000000)={0x2, 0x4e20, @dev={0xac, 0x14, 0x14, 0x18}}, 0x10) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f00000001c0)='tunl0\x00', 0x5) sendto$inet(r0, &(0x7f00006d1fd4)="db", 0x1, 0x4000010, &(0x7f00004daff0)={0x2, 0x0, @loopback, [0x0, 0x0, 0x4002]}, 0x10) 13:17:20 executing program 3: clone(0x1002102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000640), 0xffffffffffffffff) r0 = getpid() sched_setscheduler(r0, 0x5, &(0x7f0000000000)) write$FUSE_NOTIFY_DELETE(0xffffffffffffffff, &(0x7f0000000040)={0x29, 0x4}, 0x29) 13:17:20 executing program 4: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = gettid() perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x3e5}, 0x0, 0x0, 0xffffffffffffffff, 0x0) fcntl$setown(r0, 0x8, r1) bind$inet6(r0, &(0x7f0000807fe4)={0xa, 0x4e22}, 0x1c) sendto$inet6(r0, &(0x7f0000000380), 0x0, 0x200408d4, &(0x7f000072e000)={0xa, 0x4e22, 0x0, @loopback}, 0x1c) sendto$inet6(r0, &(0x7f0000ad6fad)='\x00', 0x1, 0x3fffffd, &(0x7f0000254000)={0xa, 0x0, 0x0, @loopback}, 0x1c) 13:17:20 executing program 5: r0 = syz_open_dev$binder(&(0x7f00000021c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000002340)={0x34, 0x0, &(0x7f0000002240)=[@request_death={0x400c630e, 0x4, 0x4}, @increfs={0x40046304, 0x4}, @increfs_done={0x40106308, 0x0, 0x3}, @increfs], 0x77, 0x0, &(0x7f00000022c0)="b3cd0976d8e2af743c6f523efe4dfd20c3c3dd2572734282a761e1b4304e2599c85f198cc82bd5d0c74c4edca2f9ea7b875ff7047ec0784fbb354e15fd3f7d837f533597d5082692a6f2fb748da3cc4157188f7f2a5477ded56f72f5b75c96872db429e44b8fcd781d96dead77a0b58b7af9085a208a22"}) 13:17:20 executing program 0: perf_event_open(&(0x7f0000000040)={0x2, 0x70, 0x3e5}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f00000021c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000002340)={0xb5, 0xffffffffa0028000, &(0x7f00000000c0)=ANY=[@ANYBLOB="0463044000000000b6a571ac965f26c50d500dae115e59afcd8a338d8b2727193c56d4ebef60c214b766ffde6cff6ceef2baa2594a53a0117e77afd5d58e8a35afdae81b258585ce769507333c0238790d5ed750bf1d6ca2a873050056528fce7becfd12f165ac43a826d3462822ff8f29ea992d4e208847cf4fc10ca00b87b5ce2523fa477bad0be1c97e4398aa2ac81d973b5a871d8e0b295e436cd8415f19088c6c82c85f4ed1fac41da062bc6dbfb8eac4276c"], 0x0, 0x0, &(0x7f00000022c0)}) 13:17:20 executing program 7: r0 = openat$cuse(0xffffffffffffff9c, &(0x7f0000000080)='/dev/cuse\x00', 0x2, 0x0) clone(0x1002102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000640), 0xffffffffffffffff) r1 = getpid() sched_setscheduler(r1, 0x5, &(0x7f0000000000)) write$FUSE_NOTIFY_DELETE(r0, &(0x7f0000000040)={0x29, 0x6, 0x0, {0x8}}, 0x29) [ 1542.059055] binder_thread_write: 7 callbacks suppressed [ 1542.059068] binder: 16849:16851 BC_REQUEST_DEATH_NOTIFICATION invalid ref 4 [ 1542.080445] binder: 16849:16851 BC_INCREFS_DONE u0000000000000000 no match 13:17:20 executing program 5: r0 = syz_open_dev$binder(&(0x7f00000021c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000002340)={0x34, 0x0, &(0x7f0000002240)=[@request_death={0x400c630e, 0x4, 0x4}, @increfs={0x40046304, 0x4}, @increfs_done={0x40106308, 0x0, 0x3}, @increfs], 0x77, 0x0, &(0x7f00000022c0)="b3cd0976d8e2af743c6f523efe54fd20c3c3dd2572734282a761e1b4304e2599c85f198cc82bd5d0c74c4edca2f9ea7b875ff7047ec0784fbb354e15fd3f7d837f533597d5082692a6f2fb748da3cc4157188f7f2a5477ded56f72f5b75c96872db429e44b8fcd781d96dead77a0b58b7af9085a208a22"}) 13:17:20 executing program 7: r0 = openat$cuse(0xffffffffffffff9c, &(0x7f0000000080)='/dev/cuse\x00', 0x2, 0x0) clone(0x1002102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000640), 0xffffffffffffffff) r1 = getpid() sched_setscheduler(r1, 0x5, &(0x7f0000000000)) write$FUSE_NOTIFY_DELETE(r0, &(0x7f0000000040)={0x29, 0x6, 0x0, {0x700000000000000}}, 0x29) 13:17:20 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r0, &(0x7f0000942000)={0x2, 0x4e20, @multicast1}, 0x10) sendmsg$key(0xffffffffffffffff, &(0x7f0000f56000)={0x0, 0x0, &(0x7f00008feff0)={&(0x7f0000000500)=ANY=[@ANYBLOB="020300090a1500000000000000000000030006190000000002000000e0000001003f00000000000002000100e625aa66dcef85847e479eb3c49000000400000000fd003e"], 0x44}}, 0x0) add_key(&(0x7f0000000080)='logon\x00', &(0x7f0000000100)={0x73, 0x79, 0x7a, 0x1}, &(0x7f0000001240), 0x0, 0xfffffffffffffff8) get_mempolicy(&(0x7f0000000000), &(0x7f00000001c0), 0x1ff, &(0x7f0000fff000/0x1000)=nil, 0x3) setsockopt$sock_int(r0, 0x1, 0x3c, &(0x7f0000d4effc)=0x1, 0x4) connect$inet(r0, &(0x7f0000000000)={0x2, 0x4e20, @dev={0xac, 0x14, 0x14, 0x18}}, 0x10) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f00000001c0)='tunl0\x00', 0x5) sendto$inet(r0, &(0x7f00006d1fd4)="db", 0x1, 0x4000010, &(0x7f00004daff0)={0x2, 0x0, @loopback, [0x0, 0x0, 0x3e8]}, 0x10) 13:17:20 executing program 6: clone(0x802102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000040), 0xffffffffffffffff) r0 = syz_open_dev$sndtimer(&(0x7f0000000000)='/dev/snd/timer\x00', 0x0, 0x0) r1 = getpid() sched_setscheduler(r1, 0x5, &(0x7f0000000200)) ioctl$SNDRV_TIMER_IOCTL_GPARAMS(r0, 0x40485404, &(0x7f0000000240)={{}, 0x0, 0x2000000000000000, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x300]}) 13:17:20 executing program 3: r0 = openat$cuse(0xffffffffffffff9c, &(0x7f0000000080)='/dev/cuse\x00', 0x2, 0x0) clone(0x0, 0x0, 0xfffffffffffffffe, &(0x7f0000000640), 0xffffffffffffffff) r1 = getpid() sched_setscheduler(r1, 0x5, &(0x7f0000000000)) write$FUSE_NOTIFY_DELETE(r0, &(0x7f0000000040)={0x29, 0x4}, 0x29) [ 1542.258101] binder: 16874:16877 BC_REQUEST_DEATH_NOTIFICATION invalid ref 4 [ 1542.303568] binder: 16874:16877 BC_INCREFS_DONE u0000000000000000 no match 13:17:20 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r0, &(0x7f0000942000)={0x2, 0x4e20, @multicast1}, 0x10) sendmsg$key(0xffffffffffffffff, &(0x7f0000f56000)={0x0, 0x0, &(0x7f00008feff0)={&(0x7f0000000500)=ANY=[@ANYBLOB="020300090a1500000000000000000000030006190000000002000000e0000001003f00000000000002000100e625aa66dcef85847e479eb3c49000000400000000fd003e"], 0x44}}, 0x0) add_key(&(0x7f0000000080)='logon\x00', &(0x7f0000000100)={0x73, 0x79, 0x7a, 0x1}, &(0x7f0000001240), 0x0, 0xfffffffffffffff8) get_mempolicy(&(0x7f0000000000), &(0x7f00000001c0), 0x1ff, &(0x7f0000fff000/0x1000)=nil, 0x3) setsockopt$sock_int(r0, 0x1, 0x3c, &(0x7f0000d4effc)=0x1, 0x4) connect$inet(r0, &(0x7f0000000000)={0x2, 0x4e20, @dev={0xac, 0x14, 0x14, 0x18}}, 0x10) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f00000001c0)='tunl0\x00', 0x5) sendto$inet(r0, &(0x7f00006d1fd4)="db", 0x1, 0x4000010, &(0x7f00004daff0)={0x2, 0x0, @loopback, [0x0, 0x0, 0xa6ffffff00000000]}, 0x10) 13:17:20 executing program 6: clone(0x802102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000040), 0xffffffffffffffff) r0 = syz_open_dev$sndtimer(&(0x7f0000000000)='/dev/snd/timer\x00', 0x0, 0x0) r1 = getpid() sched_setscheduler(r1, 0x5, &(0x7f0000000200)) ioctl$SNDRV_TIMER_IOCTL_GPARAMS(r0, 0x40485404, &(0x7f0000000240)={{}, 0x0, 0x2000000000000000, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3]}) 13:17:20 executing program 7: r0 = openat$cuse(0xffffffffffffff9c, &(0x7f0000000080)='/dev/cuse\x00', 0x2, 0x0) clone(0x1002102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000640), 0xffffffffffffffff) r1 = getpid() sched_setscheduler(r1, 0x5, &(0x7f0000000000)) write$FUSE_NOTIFY_DELETE(r0, &(0x7f0000000040)={0x29, 0x6, 0x0, {0x4000000000000}}, 0x29) 13:17:21 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r0, &(0x7f0000942000)={0x2, 0x4e20, @multicast1}, 0x10) sendmsg$key(0xffffffffffffffff, &(0x7f0000f56000)={0x0, 0x0, &(0x7f00008feff0)={&(0x7f0000000500)=ANY=[@ANYBLOB="020300090a1500000000000000000000030006190000000002000000e0000001003f00000000000002000100e625aa66dcef85847e479eb3c49000000400000000fd003e"], 0x44}}, 0x0) add_key(&(0x7f0000000080)='logon\x00', &(0x7f0000000100)={0x73, 0x79, 0x7a, 0x1}, &(0x7f0000001240), 0x0, 0xfffffffffffffff8) get_mempolicy(&(0x7f0000000000), &(0x7f00000001c0), 0x1ff, &(0x7f0000fff000/0x1000)=nil, 0x3) setsockopt$sock_int(r0, 0x1, 0x3c, &(0x7f0000d4effc)=0x1, 0x4) connect$inet(r0, &(0x7f0000000000)={0x2, 0x4e20, @dev={0xac, 0x14, 0x14, 0x18}}, 0x10) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f00000001c0)='tunl0\x00', 0x5) sendto$inet(r0, &(0x7f00006d1fd4)="db", 0x1, 0x4000010, &(0x7f00004daff0)={0x2, 0x0, @loopback, [0x0, 0x0, 0x3f00000000000000]}, 0x10) 13:17:21 executing program 5: r0 = syz_open_dev$binder(&(0x7f00000021c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000002340)={0x34, 0x0, &(0x7f0000002240)=[@request_death={0x400c630e, 0x4, 0x4}, @increfs={0x40046304, 0x4}, @increfs_done={0x40106308, 0x0, 0x3}, @increfs], 0x77, 0x0, &(0x7f00000022c0)="b3cd0976d8e2af743c6f523efe5cfd20c3c3dd2572734282a761e1b4304e2599c85f198cc82bd5d0c74c4edca2f9ea7b875ff7047ec0784fbb354e15fd3f7d837f533597d5082692a6f2fb748da3cc4157188f7f2a5477ded56f72f5b75c96872db429e44b8fcd781d96dead77a0b58b7af9085a208a22"}) 13:17:21 executing program 3: r0 = openat$cuse(0xffffffffffffff9c, &(0x7f0000000080)='/dev/cuse\x00', 0x2, 0x0) clone(0x1002102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000640), 0xffffffffffffffff) getpid() sched_setscheduler(0x0, 0x5, &(0x7f0000000000)) write$FUSE_NOTIFY_DELETE(r0, &(0x7f0000000040)={0x29, 0x4}, 0x29) 13:17:21 executing program 7: r0 = openat$cuse(0xffffffffffffff9c, &(0x7f0000000080)='/dev/cuse\x00', 0x2, 0x0) clone(0x1002102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000640), 0xffffffffffffffff) r1 = getpid() sched_setscheduler(r1, 0x5, &(0x7f0000000000)) write$FUSE_NOTIFY_DELETE(r0, &(0x7f0000000040)={0x29, 0x6, 0x0, {0x8002a0ffffffff}}, 0x29) 13:17:21 executing program 6: clone(0x802102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000040), 0xffffffffffffffff) r0 = syz_open_dev$sndtimer(&(0x7f0000000000)='/dev/snd/timer\x00', 0x0, 0x0) r1 = getpid() sched_setscheduler(r1, 0x5, &(0x7f0000000200)) ioctl$SNDRV_TIMER_IOCTL_GPARAMS(r0, 0x40485404, &(0x7f0000000240)={{}, 0x0, 0x2000000000000000, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x100000000000000]}) 13:17:21 executing program 0: perf_event_open(&(0x7f0000000040)={0x2, 0x70, 0x3e5}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f00000021c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000002340)={0xb5, 0x500000000000000, &(0x7f00000000c0)=ANY=[@ANYBLOB="0463044000000000b6a571ac965f26c50d500dae115e59afcd8a338d8b2727193c56d4ebef60c214b766ffde6cff6ceef2baa2594a53a0117e77afd5d58e8a35afdae81b258585ce769507333c0238790d5ed750bf1d6ca2a873050056528fce7becfd12f165ac43a826d3462822ff8f29ea992d4e208847cf4fc10ca00b87b5ce2523fa477bad0be1c97e4398aa2ac81d973b5a871d8e0b295e436cd8415f19088c6c82c85f4ed1fac41da062bc6dbfb8eac4276c"], 0x0, 0x0, &(0x7f00000022c0)}) 13:17:21 executing program 4: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = gettid() perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x3e5}, 0x0, 0x0, 0xffffffffffffffff, 0x0) fcntl$setown(r0, 0x8, r1) bind$inet6(r0, &(0x7f0000807fe4)={0xa, 0x4e22}, 0x1c) sendto$inet6(r0, &(0x7f0000000380), 0x0, 0x200408d4, &(0x7f000072e000)={0xa, 0x4e22, 0x0, @loopback}, 0x1c) sendto$inet6(r0, &(0x7f0000ad6fad)='\n', 0x1, 0x3fffffd, &(0x7f0000254000)={0xa, 0x0, 0x0, @loopback}, 0x1c) 13:17:21 executing program 1: r0 = socket$netlink(0x10, 0x3, 0x8000000004) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_TCP_CONGESTION(r1, 0x6, 0xd, &(0x7f0000000180)='vegas\x00', 0x6) bind$inet6(r1, &(0x7f00001fefe4)={0xa, 0x4e22}, 0x1c) sendto$inet6(r1, &(0x7f0000000100), 0x8d2d601e8976aa5, 0x20000004, &(0x7f000031e000)={0xa, 0x4e22}, 0x1c) writev(r0, &(0x7f0000000100)=[{&(0x7f0000000000)="580000001400192340834b80040d8c560a067f8258ff81004e220000000058000b4824ca944f64009400050028925aa8000000000000008000f0fffeffff09000000fff5dd00000010000100000c0900fcff0000040e05a5", 0x58}], 0x1) 13:17:21 executing program 3: r0 = openat$cuse(0xffffffffffffff9c, &(0x7f0000000080)='/dev/cuse\x00', 0x2, 0x0) clone(0x1002102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000640), 0xffffffffffffffff) getpid() sched_setscheduler(0x0, 0x5, &(0x7f0000000000)) write$FUSE_NOTIFY_DELETE(r0, &(0x7f0000000040)={0x29, 0x4}, 0x29) [ 1543.022853] binder: 16927:16936 BC_REQUEST_DEATH_NOTIFICATION invalid ref 4 [ 1543.038013] binder: 16927:16936 BC_INCREFS_DONE u0000000000000000 no match 13:17:21 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r0, &(0x7f0000942000)={0x2, 0x4e20, @multicast1}, 0x10) sendmsg$key(0xffffffffffffffff, &(0x7f0000f56000)={0x0, 0x0, &(0x7f00008feff0)={&(0x7f0000000500)=ANY=[@ANYBLOB="020300090a1500000000000000000000030006190000000002000000e0000001003f00000000000002000100e625aa66dcef85847e479eb3c49000000400000000fd003e"], 0x44}}, 0x0) add_key(&(0x7f0000000080)='logon\x00', &(0x7f0000000100)={0x73, 0x79, 0x7a, 0x1}, &(0x7f0000001240), 0x0, 0xfffffffffffffff8) get_mempolicy(&(0x7f0000000000), &(0x7f00000001c0), 0x1ff, &(0x7f0000fff000/0x1000)=nil, 0x3) setsockopt$sock_int(r0, 0x1, 0x3c, &(0x7f0000d4effc)=0x1, 0x4) connect$inet(r0, &(0x7f0000000000)={0x2, 0x4e20, @dev={0xac, 0x14, 0x14, 0x18}}, 0x10) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f00000001c0)='tunl0\x00', 0x5) sendto$inet(r0, &(0x7f00006d1fd4)="db", 0x1, 0x4000010, &(0x7f00004daff0)={0x2, 0x0, @loopback, [0x0, 0x0, 0x2000000]}, 0x10) 13:17:21 executing program 3: r0 = openat$cuse(0xffffffffffffff9c, &(0x7f0000000080)='/dev/cuse\x00', 0x2, 0x0) clone(0x1002102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000640), 0xffffffffffffffff) getpid() sched_setscheduler(0x0, 0x5, &(0x7f0000000000)) write$FUSE_NOTIFY_DELETE(r0, &(0x7f0000000040)={0x29, 0x4}, 0x29) 13:17:21 executing program 5: r0 = syz_open_dev$binder(&(0x7f00000021c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000002340)={0x34, 0x0, &(0x7f0000002240)=[@request_death={0x400c630e, 0x4, 0x4}, @increfs={0x40046304, 0x4}, @increfs_done={0x40106308, 0x0, 0x3}, @increfs], 0x77, 0x0, &(0x7f00000022c0)="b3cd0976d8e2af743c6f523efe14fd25c3c3dd2572734282a761e1b4304e2599c85f198cc82bd5d0c74c4edca2f9ea7b875ff7047ec0784fbb354e15fd3f7d837f533597d5082692a6f2fb748da3cc4157188f7f2a5477ded56f72f5b75c96872db429e44b8fcd781d96dead77a0b58b7af9085a208a22"}) 13:17:21 executing program 3: r0 = openat$cuse(0xffffffffffffff9c, &(0x7f0000000080)='/dev/cuse\x00', 0x2, 0x0) clone(0x1002102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000640), 0xffffffffffffffff) r1 = getpid() sched_setscheduler(r1, 0x0, &(0x7f0000000000)) write$FUSE_NOTIFY_DELETE(r0, &(0x7f0000000040)={0x29, 0x4}, 0x29) 13:17:21 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r0, &(0x7f0000942000)={0x2, 0x4e20, @multicast1}, 0x10) sendmsg$key(0xffffffffffffffff, &(0x7f0000f56000)={0x0, 0x0, &(0x7f00008feff0)={&(0x7f0000000500)=ANY=[@ANYBLOB="020300090a1500000000000000000000030006190000000002000000e0000001003f00000000000002000100e625aa66dcef85847e479eb3c49000000400000000fd003e"], 0x44}}, 0x0) add_key(&(0x7f0000000080)='logon\x00', &(0x7f0000000100)={0x73, 0x79, 0x7a, 0x1}, &(0x7f0000001240), 0x0, 0xfffffffffffffff8) get_mempolicy(&(0x7f0000000000), &(0x7f00000001c0), 0x1ff, &(0x7f0000fff000/0x1000)=nil, 0x3) setsockopt$sock_int(r0, 0x1, 0x3c, &(0x7f0000d4effc)=0x1, 0x4) connect$inet(r0, &(0x7f0000000000)={0x2, 0x4e20, @dev={0xac, 0x14, 0x14, 0x18}}, 0x10) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f00000001c0)='tunl0\x00', 0x5) sendto$inet(r0, &(0x7f00006d1fd4)="db", 0x1, 0x4000010, &(0x7f00004daff0)={0x2, 0x0, @loopback, [0x0, 0x0, 0xe803]}, 0x10) 13:17:21 executing program 3: openat$cuse(0xffffffffffffff9c, &(0x7f0000000080)='/dev/cuse\x00', 0x2, 0x0) clone(0x1002102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000640), 0xffffffffffffffff) r0 = getpid() sched_setscheduler(r0, 0x5, &(0x7f0000000000)) write$FUSE_NOTIFY_DELETE(0xffffffffffffffff, &(0x7f0000000040)={0x29, 0x4}, 0x29) [ 1543.277965] binder: 16966:16967 BC_REQUEST_DEATH_NOTIFICATION invalid ref 4 13:17:21 executing program 5: r0 = syz_open_dev$binder(&(0x7f00000021c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000002340)={0x34, 0x0, &(0x7f0000002240)=[@request_death={0x400c630e, 0x4, 0x4}, @increfs={0x40046304, 0x4}, @increfs_done={0x40106308, 0x0, 0x3}, @increfs], 0x77, 0x0, &(0x7f00000022c0)="b3cd0976d8e2af743c6f523efe14fd3bc3c3dd2572734282a761e1b4304e2599c85f198cc82bd5d0c74c4edca2f9ea7b875ff7047ec0784fbb354e15fd3f7d837f533597d5082692a6f2fb748da3cc4157188f7f2a5477ded56f72f5b75c96872db429e44b8fcd781d96dead77a0b58b7af9085a208a22"}) 13:17:21 executing program 3: openat$cuse(0xffffffffffffff9c, &(0x7f0000000080)='/dev/cuse\x00', 0x2, 0x0) clone(0x1002102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000640), 0xffffffffffffffff) r0 = getpid() sched_setscheduler(r0, 0x5, &(0x7f0000000000)) write$FUSE_NOTIFY_DELETE(0xffffffffffffffff, &(0x7f0000000040)={0x29, 0x4}, 0x29) 13:17:21 executing program 7: r0 = openat$cuse(0xffffffffffffff9c, &(0x7f0000000080)='/dev/cuse\x00', 0x2, 0x0) clone(0x1002102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000640), 0xffffffffffffffff) r1 = getpid() sched_setscheduler(r1, 0x5, &(0x7f0000000000)) write$FUSE_NOTIFY_DELETE(r0, &(0x7f0000000040)={0x29, 0x6, 0x0, {0x1000000}}, 0x29) 13:17:21 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r0, &(0x7f0000942000)={0x2, 0x4e20, @multicast1}, 0x10) sendmsg$key(0xffffffffffffffff, &(0x7f0000f56000)={0x0, 0x0, &(0x7f00008feff0)={&(0x7f0000000500)=ANY=[@ANYBLOB="020300090a1500000000000000000000030006190000000002000000e0000001003f00000000000002000100e625aa66dcef85847e479eb3c49000000400000000fd003e"], 0x44}}, 0x0) add_key(&(0x7f0000000080)='logon\x00', &(0x7f0000000100)={0x73, 0x79, 0x7a, 0x1}, &(0x7f0000001240), 0x0, 0xfffffffffffffff8) get_mempolicy(&(0x7f0000000000), &(0x7f00000001c0), 0x1ff, &(0x7f0000fff000/0x1000)=nil, 0x3) setsockopt$sock_int(r0, 0x1, 0x3c, &(0x7f0000d4effc)=0x1, 0x4) connect$inet(r0, &(0x7f0000000000)={0x2, 0x4e20, @dev={0xac, 0x14, 0x14, 0x18}}, 0x10) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f00000001c0)='tunl0\x00', 0x5) sendto$inet(r0, &(0x7f00006d1fd4)="db", 0x1, 0x4000010, &(0x7f00004daff0)={0x2, 0x0, @loopback, [0x0, 0x0, 0xa00]}, 0x10) 13:17:21 executing program 3 (fault-call:4 fault-nth:0): r0 = openat$cuse(0xffffffffffffff9c, &(0x7f0000000080)='/dev/cuse\x00', 0x2, 0x0) clone(0x1002102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000640), 0xffffffffffffffff) r1 = getpid() sched_setscheduler(r1, 0x5, &(0x7f0000000000)) write$FUSE_NOTIFY_DELETE(r0, &(0x7f0000000040)={0x29, 0x4}, 0x29) [ 1543.505579] binder: 16990:16994 BC_REQUEST_DEATH_NOTIFICATION invalid ref 4 13:17:21 executing program 6: clone(0x802102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000040), 0xffffffffffffffff) r0 = syz_open_dev$sndtimer(&(0x7f0000000000)='/dev/snd/timer\x00', 0x0, 0x0) r1 = getpid() sched_setscheduler(r1, 0x5, &(0x7f0000000200)) ioctl$SNDRV_TIMER_IOCTL_GPARAMS(r0, 0x40485404, &(0x7f0000000240)={{}, 0x0, 0x2000000000000000, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x300000000000000]}) 13:17:21 executing program 7: r0 = openat$cuse(0xffffffffffffff9c, &(0x7f0000000080)='/dev/cuse\x00', 0x2, 0x0) clone(0x1002102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000640), 0xffffffffffffffff) r1 = getpid() sched_setscheduler(r1, 0x5, &(0x7f0000000000)) write$FUSE_NOTIFY_DELETE(r0, &(0x7f0000000040)={0x29, 0x6, 0x0, {0xa00}}, 0x29) 13:17:21 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r0, &(0x7f0000942000)={0x2, 0x4e20, @multicast1}, 0x10) sendmsg$key(0xffffffffffffffff, &(0x7f0000f56000)={0x0, 0x0, &(0x7f00008feff0)={&(0x7f0000000500)=ANY=[@ANYBLOB="020300090a1500000000000000000000030006190000000002000000e0000001003f00000000000002000100e625aa66dcef85847e479eb3c49000000400000000fd003e"], 0x44}}, 0x0) add_key(&(0x7f0000000080)='logon\x00', &(0x7f0000000100)={0x73, 0x79, 0x7a, 0x1}, &(0x7f0000001240), 0x0, 0xfffffffffffffff8) get_mempolicy(&(0x7f0000000000), &(0x7f00000001c0), 0x1ff, &(0x7f0000fff000/0x1000)=nil, 0x3) setsockopt$sock_int(r0, 0x1, 0x3c, &(0x7f0000d4effc)=0x1, 0x4) connect$inet(r0, &(0x7f0000000000)={0x2, 0x4e20, @dev={0xac, 0x14, 0x14, 0x18}}, 0x10) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f00000001c0)='tunl0\x00', 0x5) sendto$inet(r0, &(0x7f00006d1fd4)="db", 0x1, 0x4000010, &(0x7f00004daff0)={0x2, 0x0, @loopback, [0x0, 0x0, 0xfffffffd]}, 0x10) 13:17:21 executing program 1: r0 = socket$netlink(0x10, 0x3, 0x8000000004) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_TCP_CONGESTION(r1, 0x6, 0xd, &(0x7f0000000180)='vegas\x00', 0x6) bind$inet6(r1, &(0x7f00001fefe4)={0xa, 0x4e22}, 0x1c) sendto$inet6(r1, &(0x7f0000000100), 0x8d2d601e8976aa5, 0x20000004, &(0x7f000031e000)={0xa, 0x4e22}, 0x1c) writev(r0, &(0x7f0000000100)=[{&(0x7f0000000000)="580000001400192340834b80040d8c560a067f73a9ff81004e220000000058000b4824ca944f64009400050028925aa8000000000000008000f0fffeffff09000000fff5dd00000010000100000c0900fcff0000040e05a5", 0x58}], 0x1) 13:17:21 executing program 4: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = gettid() perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x3e5}, 0x0, 0x0, 0xffffffffffffffff, 0x0) fcntl$setown(r0, 0x8, r1) bind$inet6(r0, &(0x7f0000807fe4)={0xa, 0x4e22}, 0x1c) sendto$inet6(r0, &(0x7f0000000380), 0x0, 0x200408d4, &(0x7f000072e000)={0xa, 0x4e22, 0x0, @loopback}, 0x1c) sendto$inet6(r0, &(0x7f0000ad6fad)="b8", 0x1, 0x3fffffd, &(0x7f0000254000)={0xa, 0x0, 0x0, @loopback}, 0x1c) 13:17:21 executing program 7: r0 = openat$cuse(0xffffffffffffff9c, &(0x7f0000000080)='/dev/cuse\x00', 0x2, 0x0) clone(0x1002102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000640), 0xffffffffffffffff) r1 = getpid() sched_setscheduler(r1, 0x5, &(0x7f0000000000)) write$FUSE_NOTIFY_DELETE(r0, &(0x7f0000000040)={0x29, 0x6, 0x0, {0xb}}, 0x29) 13:17:21 executing program 0: perf_event_open(&(0x7f0000000040)={0x2, 0x70, 0x3e5}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f00000021c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000002340)={0xb5, 0x4c00000000000000, &(0x7f00000000c0)=ANY=[@ANYBLOB="0463044000000000b6a571ac965f26c50d500dae115e59afcd8a338d8b2727193c56d4ebef60c214b766ffde6cff6ceef2baa2594a53a0117e77afd5d58e8a35afdae81b258585ce769507333c0238790d5ed750bf1d6ca2a873050056528fce7becfd12f165ac43a826d3462822ff8f29ea992d4e208847cf4fc10ca00b87b5ce2523fa477bad0be1c97e4398aa2ac81d973b5a871d8e0b295e436cd8415f19088c6c82c85f4ed1fac41da062bc6dbfb8eac4276c"], 0x0, 0x0, &(0x7f00000022c0)}) 13:17:21 executing program 6: clone(0x802102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000040), 0xffffffffffffffff) r0 = syz_open_dev$sndtimer(&(0x7f0000000000)='/dev/snd/timer\x00', 0x0, 0x0) r1 = getpid() sched_setscheduler(r1, 0x5, &(0x7f0000000200)) ioctl$SNDRV_TIMER_IOCTL_GPARAMS(r0, 0x40485404, &(0x7f0000000240)={{}, 0x0, 0x2000000000000000, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1000000]}) 13:17:21 executing program 3: r0 = openat$cuse(0xffffffffffffff9c, &(0x7f0000000080)='/dev/cuse\x00', 0x2, 0x0) clone(0x1002102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000640), 0xffffffffffffffff) r1 = getpid() sched_setscheduler(r1, 0x5, &(0x7f0000000000)) write$FUSE_NOTIFY_DELETE(r0, &(0x7f0000000040)={0x29, 0x4}, 0x29) 13:17:21 executing program 5: r0 = syz_open_dev$binder(&(0x7f00000021c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000002340)={0x34, 0x0, &(0x7f0000002240)=[@request_death={0x400c630e, 0x4, 0x4}, @increfs={0x40046304, 0x4}, @increfs_done={0x40106308, 0x0, 0x3}, @increfs], 0x77, 0x0, &(0x7f00000022c0)="b3cd0976d8e2af743c6f523efe14fd4cc3c3dd2572734282a761e1b4304e2599c85f198cc82bd5d0c74c4edca2f9ea7b875ff7047ec0784fbb354e15fd3f7d837f533597d5082692a6f2fb748da3cc4157188f7f2a5477ded56f72f5b75c96872db429e44b8fcd781d96dead77a0b58b7af9085a208a22"}) 13:17:21 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r0, &(0x7f0000942000)={0x2, 0x4e20, @multicast1}, 0x10) sendmsg$key(0xffffffffffffffff, &(0x7f0000f56000)={0x0, 0x0, &(0x7f00008feff0)={&(0x7f0000000500)=ANY=[@ANYBLOB="020300090a1500000000000000000000030006190000000002000000e0000001003f00000000000002000100e625aa66dcef85847e479eb3c49000000400000000fd003e"], 0x44}}, 0x0) add_key(&(0x7f0000000080)='logon\x00', &(0x7f0000000100)={0x73, 0x79, 0x7a, 0x1}, &(0x7f0000001240), 0x0, 0xfffffffffffffff8) get_mempolicy(&(0x7f0000000000), &(0x7f00000001c0), 0x1ff, &(0x7f0000fff000/0x1000)=nil, 0x3) setsockopt$sock_int(r0, 0x1, 0x3c, &(0x7f0000d4effc)=0x1, 0x4) connect$inet(r0, &(0x7f0000000000)={0x2, 0x4e20, @dev={0xac, 0x14, 0x14, 0x18}}, 0x10) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f00000001c0)='tunl0\x00', 0x5) sendto$inet(r0, &(0x7f00006d1fd4)="db", 0x1, 0x4000010, &(0x7f00004daff0)={0x2, 0x0, @loopback, [0x0, 0x0, 0xfeffffff00000000]}, 0x10) 13:17:22 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r0, &(0x7f0000942000)={0x2, 0x4e20, @multicast1}, 0x10) sendmsg$key(0xffffffffffffffff, &(0x7f0000f56000)={0x0, 0x0, &(0x7f00008feff0)={&(0x7f0000000500)=ANY=[@ANYBLOB="020300090a1500000000000000000000030006190000000002000000e0000001003f00000000000002000100e625aa66dcef85847e479eb3c49000000400000000fd003e"], 0x44}}, 0x0) add_key(&(0x7f0000000080)='logon\x00', &(0x7f0000000100)={0x73, 0x79, 0x7a, 0x1}, &(0x7f0000001240), 0x0, 0xfffffffffffffff8) get_mempolicy(&(0x7f0000000000), &(0x7f00000001c0), 0x1ff, &(0x7f0000fff000/0x1000)=nil, 0x3) setsockopt$sock_int(r0, 0x1, 0x3c, &(0x7f0000d4effc)=0x1, 0x4) connect$inet(r0, &(0x7f0000000000)={0x2, 0x4e20, @dev={0xac, 0x14, 0x14, 0x18}}, 0x10) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f00000001c0)='tunl0\x00', 0x5) sendto$inet(r0, &(0x7f00006d1fd4)="db", 0x1, 0x4000010, &(0x7f00004daff0)={0x2, 0x0, @loopback, [0x0, 0x0, 0x14b8010000000000]}, 0x10) [ 1543.917319] binder: 17050:17055 BC_REQUEST_DEATH_NOTIFICATION invalid ref 4 13:17:22 executing program 5: r0 = syz_open_dev$binder(&(0x7f00000021c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000002340)={0x34, 0x0, &(0x7f0000002240)=[@request_death={0x400c630e, 0x4, 0x4}, @increfs={0x40046304, 0x4}, @increfs_done={0x40106308, 0x0, 0x3}, @increfs], 0x77, 0x0, &(0x7f00000022c0)="b3cd0976d8e2af743c6f523efe14fd4dc3c3dd2572734282a761e1b4304e2599c85f198cc82bd5d0c74c4edca2f9ea7b875ff7047ec0784fbb354e15fd3f7d837f533597d5082692a6f2fb748da3cc4157188f7f2a5477ded56f72f5b75c96872db429e44b8fcd781d96dead77a0b58b7af9085a208a22"}) 13:17:22 executing program 3: r0 = openat$cuse(0xffffffffffffff9c, &(0x7f0000000080)='/dev/cuse\x00', 0x2, 0x0) clone(0x1002102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000640), 0xffffffffffffffff) r1 = getpid() sched_setscheduler(r1, 0x5, &(0x7f0000000000)) write$FUSE_NOTIFY_DELETE(r0, &(0x7f0000000040)={0x20000069, 0x4}, 0x29) 13:17:22 executing program 7: r0 = openat$cuse(0xffffffffffffff9c, &(0x7f0000000080)='/dev/cuse\x00', 0x2, 0x0) clone(0x1002102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000640), 0xffffffffffffffff) r1 = getpid() sched_setscheduler(r1, 0x5, &(0x7f0000000000)) write$FUSE_NOTIFY_DELETE(r0, &(0x7f0000000040)={0x29, 0x6, 0x0, {0x8000a0ffffffff}}, 0x29) 13:17:22 executing program 6: clone(0x802102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000040), 0xffffffffffffffff) r0 = syz_open_dev$sndtimer(&(0x7f0000000000)='/dev/snd/timer\x00', 0x0, 0x0) r1 = getpid() sched_setscheduler(r1, 0x5, &(0x7f0000000200)) ioctl$SNDRV_TIMER_IOCTL_GPARAMS(r0, 0x40485404, &(0x7f0000000240)={{}, 0x0, 0x2000000000000000, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3000000]}) 13:17:22 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r0, &(0x7f0000942000)={0x2, 0x4e20, @multicast1}, 0x10) sendmsg$key(0xffffffffffffffff, &(0x7f0000f56000)={0x0, 0x0, &(0x7f00008feff0)={&(0x7f0000000500)=ANY=[@ANYBLOB="020300090a1500000000000000000000030006190000000002000000e0000001003f00000000000002000100e625aa66dcef85847e479eb3c49000000400000000fd003e"], 0x44}}, 0x0) add_key(&(0x7f0000000080)='logon\x00', &(0x7f0000000100)={0x73, 0x79, 0x7a, 0x1}, &(0x7f0000001240), 0x0, 0xfffffffffffffff8) get_mempolicy(&(0x7f0000000000), &(0x7f00000001c0), 0x1ff, &(0x7f0000fff000/0x1000)=nil, 0x3) setsockopt$sock_int(r0, 0x1, 0x3c, &(0x7f0000d4effc)=0x1, 0x4) connect$inet(r0, &(0x7f0000000000)={0x2, 0x4e20, @dev={0xac, 0x14, 0x14, 0x18}}, 0x10) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f00000001c0)='tunl0\x00', 0x5) sendto$inet(r0, &(0x7f00006d1fd4)="db", 0x1, 0x4000010, &(0x7f00004daff0)={0x2, 0x0, @loopback, [0x0, 0x0, 0x40020000]}, 0x10) 13:17:22 executing program 3: r0 = openat$cuse(0xffffffffffffff9c, &(0x7f0000000080)='/dev/cuse\x00', 0x2, 0x0) clone(0x1002102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000640), 0xffffffffffffffff) r1 = getpid() sched_setscheduler(r1, 0x5, &(0x7f0000000000)) write$FUSE_NOTIFY_DELETE(r0, &(0x7f0000000040)={0xf, 0x4}, 0x29) [ 1544.116161] binder: 17086:17088 BC_REQUEST_DEATH_NOTIFICATION invalid ref 4 13:17:22 executing program 5: r0 = syz_open_dev$binder(&(0x7f00000021c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000002340)={0x34, 0x0, &(0x7f0000002240)=[@request_death={0x400c630e, 0x4, 0x4}, @increfs={0x40046304, 0x4}, @increfs_done={0x40106308, 0x0, 0x3}, @increfs], 0x77, 0x0, &(0x7f00000022c0)="b3cd0976d8e2af743c6f523efe14fd0ac3c3dd2572734282a761e1b4304e2599c85f198cc82bd5d0c74c4edca2f9ea7b875ff7047ec0784fbb354e15fd3f7d837f533597d5082692a6f2fb748da3cc4157188f7f2a5477ded56f72f5b75c96872db429e44b8fcd781d96dead77a0b58b7af9085a208a22"}) [ 1544.246954] binder: 17108:17110 BC_REQUEST_DEATH_NOTIFICATION invalid ref 4 13:17:22 executing program 1: r0 = socket$netlink(0x10, 0x3, 0x8000000004) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_TCP_CONGESTION(r1, 0x6, 0xd, &(0x7f0000000180)='vegas\x00', 0x6) bind$inet6(r1, &(0x7f00001fefe4)={0xa, 0x4e22}, 0x1c) sendto$inet6(r1, &(0x7f0000000100), 0x8d2d601e8976aa5, 0x20000004, &(0x7f000031e000)={0xa, 0x4e22}, 0x1c) writev(r0, &(0x7f0000000100)=[{&(0x7f0000000000)="580000001400192340834b80040d8c560a067fa916ff81004e220000000058000b4824ca944f64009400050028925aa8000000000000008000f0fffeffff09000000fff5dd00000010000100000c0900fcff0000040e05a5", 0x58}], 0x1) 13:17:22 executing program 7: r0 = openat$cuse(0xffffffffffffff9c, &(0x7f0000000080)='/dev/cuse\x00', 0x2, 0x0) clone(0x1002102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000640), 0xffffffffffffffff) r1 = getpid() sched_setscheduler(r1, 0x5, &(0x7f0000000000)) write$FUSE_NOTIFY_DELETE(r0, &(0x7f0000000040)={0x29, 0x6, 0x0, {0xc00}}, 0x29) 13:17:22 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r0, &(0x7f0000942000)={0x2, 0x4e20, @multicast1}, 0x10) sendmsg$key(0xffffffffffffffff, &(0x7f0000f56000)={0x0, 0x0, &(0x7f00008feff0)={&(0x7f0000000500)=ANY=[@ANYBLOB="020300090a1500000000000000000000030006190000000002000000e0000001003f00000000000002000100e625aa66dcef85847e479eb3c49000000400000000fd003e"], 0x44}}, 0x0) add_key(&(0x7f0000000080)='logon\x00', &(0x7f0000000100)={0x73, 0x79, 0x7a, 0x1}, &(0x7f0000001240), 0x0, 0xfffffffffffffff8) get_mempolicy(&(0x7f0000000000), &(0x7f00000001c0), 0x1ff, &(0x7f0000fff000/0x1000)=nil, 0x3) setsockopt$sock_int(r0, 0x1, 0x3c, &(0x7f0000d4effc)=0x1, 0x4) connect$inet(r0, &(0x7f0000000000)={0x2, 0x4e20, @dev={0xac, 0x14, 0x14, 0x18}}, 0x10) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f00000001c0)='tunl0\x00', 0x5) sendto$inet(r0, &(0x7f00006d1fd4)="db", 0x1, 0x4000010, &(0x7f00004daff0)={0x2, 0x0, @loopback, [0x0, 0x0, 0x1000000]}, 0x10) 13:17:22 executing program 3: r0 = openat$cuse(0xffffffffffffff9c, &(0x7f0000000080)='/dev/cuse\x00', 0x2, 0x0) clone(0x1002102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000640), 0xffffffffffffffff) r1 = getpid() sched_setscheduler(r1, 0x5, &(0x7f0000000000)) write$FUSE_NOTIFY_DELETE(r0, &(0x7f0000000040)={0x29, 0x5}, 0x29) 13:17:22 executing program 5: r0 = syz_open_dev$binder(&(0x7f00000021c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000002340)={0x34, 0x0, &(0x7f0000002240)=[@request_death={0x400c630e, 0x4, 0x4}, @increfs={0x40046304, 0x4}, @increfs_done={0x40106308, 0x0, 0x3}, @increfs], 0x77, 0x0, &(0x7f00000022c0)="b3cd0976d8e2af743c6f523efe14fd60c3c3dd2572734282a761e1b4304e2599c85f198cc82bd5d0c74c4edca2f9ea7b875ff7047ec0784fbb354e15fd3f7d837f533597d5082692a6f2fb748da3cc4157188f7f2a5477ded56f72f5b75c96872db429e44b8fcd781d96dead77a0b58b7af9085a208a22"}) 13:17:22 executing program 6: clone(0x802102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000040), 0xffffffffffffffff) r0 = syz_open_dev$sndtimer(&(0x7f0000000000)='/dev/snd/timer\x00', 0x0, 0x0) r1 = getpid() sched_setscheduler(r1, 0x5, &(0x7f0000000200)) ioctl$SNDRV_TIMER_IOCTL_GPARAMS(r0, 0x40485404, &(0x7f0000000240)={{}, 0x0, 0x2000000000000000, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x300]}) 13:17:22 executing program 0: perf_event_open(&(0x7f0000000040)={0x2, 0x70, 0x3e5}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f00000021c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000002340)={0xb5, 0x300, &(0x7f00000000c0)=ANY=[@ANYBLOB="0463044000000000b6a571ac965f26c50d500dae115e59afcd8a338d8b2727193c56d4ebef60c214b766ffde6cff6ceef2baa2594a53a0117e77afd5d58e8a35afdae81b258585ce769507333c0238790d5ed750bf1d6ca2a873050056528fce7becfd12f165ac43a826d3462822ff8f29ea992d4e208847cf4fc10ca00b87b5ce2523fa477bad0be1c97e4398aa2ac81d973b5a871d8e0b295e436cd8415f19088c6c82c85f4ed1fac41da062bc6dbfb8eac4276c"], 0x0, 0x0, &(0x7f00000022c0)}) 13:17:22 executing program 4: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = gettid() perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x3e5}, 0x0, 0x0, 0xffffffffffffffff, 0x0) fcntl$setown(r0, 0x8, r1) bind$inet6(r0, &(0x7f0000807fe4)={0xa, 0x4e22}, 0x1c) sendto$inet6(r0, &(0x7f0000000380), 0x0, 0x200408d4, &(0x7f000072e000)={0xa, 0x4e22, 0x0, @loopback}, 0x1c) sendto$inet6(r0, &(0x7f0000ad6fad)='@', 0x1, 0x3fffffd, &(0x7f0000254000)={0xa, 0x0, 0x0, @loopback}, 0x1c) [ 1544.775123] binder: 17132:17136 BC_REQUEST_DEATH_NOTIFICATION invalid ref 4 [ 1544.794410] binder_thread_write: 20 callbacks suppressed [ 1544.794433] binder: 17132:17136 IncRefs 0 refcount change on invalid ref 4 ret -22 [ 1544.813953] binder_thread_write: 5 callbacks suppressed 13:17:22 executing program 7: r0 = openat$cuse(0xffffffffffffff9c, &(0x7f0000000080)='/dev/cuse\x00', 0x2, 0x0) clone(0x1002102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000640), 0xffffffffffffffff) r1 = getpid() sched_setscheduler(r1, 0x5, &(0x7f0000000000)) write$FUSE_NOTIFY_DELETE(r0, &(0x7f0000000040)={0x29, 0x6, 0x0, {0xa0028000}}, 0x29) 13:17:22 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r0, &(0x7f0000942000)={0x2, 0x4e20, @multicast1}, 0x10) sendmsg$key(0xffffffffffffffff, &(0x7f0000f56000)={0x0, 0x0, &(0x7f00008feff0)={&(0x7f0000000500)=ANY=[@ANYBLOB="020300090a1500000000000000000000030006190000000002000000e0000001003f00000000000002000100e625aa66dcef85847e479eb3c49000000400000000fd003e"], 0x44}}, 0x0) add_key(&(0x7f0000000080)='logon\x00', &(0x7f0000000100)={0x73, 0x79, 0x7a, 0x1}, &(0x7f0000001240), 0x0, 0xfffffffffffffff8) get_mempolicy(&(0x7f0000000000), &(0x7f00000001c0), 0x1ff, &(0x7f0000fff000/0x1000)=nil, 0x3) setsockopt$sock_int(r0, 0x1, 0x3c, &(0x7f0000d4effc)=0x1, 0x4) connect$inet(r0, &(0x7f0000000000)={0x2, 0x4e20, @dev={0xac, 0x14, 0x14, 0x18}}, 0x10) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f00000001c0)='tunl0\x00', 0x5) sendto$inet(r0, &(0x7f00006d1fd4)="db", 0x1, 0x4000010, &(0x7f00004daff0)={0x2, 0x0, @loopback, [0x0, 0x0, 0x4]}, 0x10) [ 1544.813968] binder: 17132:17136 BC_INCREFS_DONE u0000000000000000 no match [ 1544.831085] binder: 17132:17136 IncRefs 0 refcount change on invalid ref 0 ret -22 13:17:23 executing program 5: r0 = syz_open_dev$binder(&(0x7f00000021c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000002340)={0x34, 0x0, &(0x7f0000002240)=[@request_death={0x400c630e, 0x4, 0x4}, @increfs={0x40046304, 0x4}, @increfs_done={0x40106308, 0x0, 0x3}, @increfs], 0x77, 0x0, &(0x7f00000022c0)="b3cd0976d8e2af743c6f523efe14fd54c3c3dd2572734282a761e1b4304e2599c85f198cc82bd5d0c74c4edca2f9ea7b875ff7047ec0784fbb354e15fd3f7d837f533597d5082692a6f2fb748da3cc4157188f7f2a5477ded56f72f5b75c96872db429e44b8fcd781d96dead77a0b58b7af9085a208a22"}) 13:17:23 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r0, &(0x7f0000942000)={0x2, 0x4e20, @multicast1}, 0x10) sendmsg$key(0xffffffffffffffff, &(0x7f0000f56000)={0x0, 0x0, &(0x7f00008feff0)={&(0x7f0000000500)=ANY=[@ANYBLOB="020300090a1500000000000000000000030006190000000002000000e0000001003f00000000000002000100e625aa66dcef85847e479eb3c49000000400000000fd003e"], 0x44}}, 0x0) add_key(&(0x7f0000000080)='logon\x00', &(0x7f0000000100)={0x73, 0x79, 0x7a, 0x1}, &(0x7f0000001240), 0x0, 0xfffffffffffffff8) get_mempolicy(&(0x7f0000000000), &(0x7f00000001c0), 0x1ff, &(0x7f0000fff000/0x1000)=nil, 0x3) setsockopt$sock_int(r0, 0x1, 0x3c, &(0x7f0000d4effc)=0x1, 0x4) connect$inet(r0, &(0x7f0000000000)={0x2, 0x4e20, @dev={0xac, 0x14, 0x14, 0x18}}, 0x10) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f00000001c0)='tunl0\x00', 0x5) sendto$inet(r0, &(0x7f00006d1fd4)="db", 0x1, 0x4000010, &(0x7f00004daff0)={0x2, 0x0, @loopback, [0x0, 0x0, 0xffffffffa0028000]}, 0x10) 13:17:23 executing program 3: r0 = openat$cuse(0xffffffffffffff9c, &(0x7f0000000080)='/dev/cuse\x00', 0x2, 0x0) clone(0x1002102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000640), 0xffffffffffffffff) r1 = getpid() sched_setscheduler(r1, 0x5, &(0x7f0000000000)) write$FUSE_NOTIFY_DELETE(r0, &(0x7f0000000040)={0x29}, 0x29) 13:17:23 executing program 7: r0 = openat$cuse(0xffffffffffffff9c, &(0x7f0000000080)='/dev/cuse\x00', 0x2, 0x0) clone(0x1002102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000640), 0xffffffffffffffff) r1 = getpid() sched_setscheduler(r1, 0x5, &(0x7f0000000000)) write$FUSE_NOTIFY_DELETE(r0, &(0x7f0000000040)={0x29, 0x6, 0x0, {0x8000000}}, 0x29) [ 1545.013133] binder: 17164:17167 BC_REQUEST_DEATH_NOTIFICATION invalid ref 4 [ 1545.021130] binder: 17164:17167 IncRefs 0 refcount change on invalid ref 4 ret -22 13:17:23 executing program 7: r0 = openat$cuse(0xffffffffffffff9c, &(0x7f0000000080)='/dev/cuse\x00', 0x2, 0x0) clone(0x1002102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000640), 0xffffffffffffffff) r1 = getpid() sched_setscheduler(r1, 0x5, &(0x7f0000000000)) write$FUSE_NOTIFY_DELETE(r0, &(0x7f0000000040)={0x29, 0x6, 0x0, {0x1a0}}, 0x29) 13:17:23 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r0, &(0x7f0000942000)={0x2, 0x4e20, @multicast1}, 0x10) sendmsg$key(0xffffffffffffffff, &(0x7f0000f56000)={0x0, 0x0, &(0x7f00008feff0)={&(0x7f0000000500)=ANY=[@ANYBLOB="020300090a1500000000000000000000030006190000000002000000e0000001003f00000000000002000100e625aa66dcef85847e479eb3c49000000400000000fd003e"], 0x44}}, 0x0) add_key(&(0x7f0000000080)='logon\x00', &(0x7f0000000100)={0x73, 0x79, 0x7a, 0x1}, &(0x7f0000001240), 0x0, 0xfffffffffffffff8) get_mempolicy(&(0x7f0000000000), &(0x7f00000001c0), 0x1ff, &(0x7f0000fff000/0x1000)=nil, 0x3) setsockopt$sock_int(r0, 0x1, 0x3c, &(0x7f0000d4effc)=0x1, 0x4) connect$inet(r0, &(0x7f0000000000)={0x2, 0x4e20, @dev={0xac, 0x14, 0x14, 0x18}}, 0x10) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f00000001c0)='tunl0\x00', 0x5) sendto$inet(r0, &(0x7f00006d1fd4)="db", 0x1, 0x4000010, &(0x7f00004daff0)={0x2, 0x0, @loopback, [0x0, 0x0, 0x2]}, 0x10) [ 1545.069230] binder: 17164:17167 BC_INCREFS_DONE u0000000000000000 no match [ 1545.114144] binder: 17164:17167 IncRefs 0 refcount change on invalid ref 0 ret -22 13:17:23 executing program 1: r0 = socket$netlink(0x10, 0x3, 0x8000000004) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_TCP_CONGESTION(r1, 0x6, 0xd, &(0x7f0000000180)='vegas\x00', 0x6) bind$inet6(r1, &(0x7f00001fefe4)={0xa, 0x4e22}, 0x1c) sendto$inet6(r1, &(0x7f0000000100), 0x8d2d601e8976aa5, 0x20000004, &(0x7f000031e000)={0xa, 0x4e22}, 0x1c) writev(r0, &(0x7f0000000100)=[{&(0x7f0000000000)="580000001400192340834b80040d8c560a067ff071ff81004e220000000058000b4824ca944f64009400050028925aa8000000000000008000f0fffeffff09000000fff5dd00000010000100000c0900fcff0000040e05a5", 0x58}], 0x1) 13:17:23 executing program 5: r0 = syz_open_dev$binder(&(0x7f00000021c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000002340)={0x34, 0x0, &(0x7f0000002240)=[@request_death={0x400c630e, 0x4, 0x4}, @increfs={0x40046304, 0x4}, @increfs_done={0x40106308, 0x0, 0x3}, @increfs], 0x77, 0x0, &(0x7f00000022c0)="b3cd0976d8e2af743c6f523efe14fd2fc3c3dd2572734282a761e1b4304e2599c85f198cc82bd5d0c74c4edca2f9ea7b875ff7047ec0784fbb354e15fd3f7d837f533597d5082692a6f2fb748da3cc4157188f7f2a5477ded56f72f5b75c96872db429e44b8fcd781d96dead77a0b58b7af9085a208a22"}) 13:17:23 executing program 7: r0 = openat$cuse(0xffffffffffffff9c, &(0x7f0000000080)='/dev/cuse\x00', 0x2, 0x0) clone(0x1002102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000640), 0xffffffffffffffff) r1 = getpid() sched_setscheduler(r1, 0x5, &(0x7f0000000000)) write$FUSE_NOTIFY_DELETE(r0, &(0x7f0000000040)={0x29, 0x6, 0x0, {0x4000000}}, 0x29) 13:17:23 executing program 3: r0 = openat$cuse(0xffffffffffffff9c, &(0x7f0000000080)='/dev/cuse\x00', 0x2, 0x0) clone(0x1002102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000640), 0xffffffffffffffff) r1 = getpid() sched_setscheduler(r1, 0x5, &(0x7f0000000000)) write$FUSE_NOTIFY_DELETE(r0, &(0x7f0000000040)={0x29, 0x2}, 0x29) 13:17:23 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r0, &(0x7f0000942000)={0x2, 0x4e20, @multicast1}, 0x10) sendmsg$key(0xffffffffffffffff, &(0x7f0000f56000)={0x0, 0x0, &(0x7f00008feff0)={&(0x7f0000000500)=ANY=[@ANYBLOB="020300090a1500000000000000000000030006190000000002000000e0000001003f00000000000002000100e625aa66dcef85847e479eb3c49000000400000000fd003e"], 0x44}}, 0x0) add_key(&(0x7f0000000080)='logon\x00', &(0x7f0000000100)={0x73, 0x79, 0x7a, 0x1}, &(0x7f0000001240), 0x0, 0xfffffffffffffff8) get_mempolicy(&(0x7f0000000000), &(0x7f00000001c0), 0x1ff, &(0x7f0000fff000/0x1000)=nil, 0x3) setsockopt$sock_int(r0, 0x1, 0x3c, &(0x7f0000d4effc)=0x1, 0x4) connect$inet(r0, &(0x7f0000000000)={0x2, 0x4e20, @dev={0xac, 0x14, 0x14, 0x18}}, 0x10) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f00000001c0)='tunl0\x00', 0x5) sendto$inet(r0, &(0x7f00006d1fd4)="db", 0x1, 0x4000010, &(0x7f00004daff0)={0x2, 0x0, @loopback, [0x0, 0x0, 0x8055000000000000]}, 0x10) 13:17:23 executing program 6: clone(0x802102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000040), 0xffffffffffffffff) r0 = syz_open_dev$sndtimer(&(0x7f0000000000)='/dev/snd/timer\x00', 0x0, 0x0) r1 = getpid() sched_setscheduler(r1, 0x5, &(0x7f0000000200)) ioctl$SNDRV_TIMER_IOCTL_GPARAMS(r0, 0x40485404, &(0x7f0000000240)={{}, 0x0, 0x2000000000000000, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3]}) 13:17:23 executing program 0: perf_event_open(&(0x7f0000000040)={0x2, 0x70, 0x3e5}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f00000021c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000002340)={0xb5, 0x4, &(0x7f00000000c0)=ANY=[@ANYBLOB="0463044000000000b6a571ac965f26c50d500dae115e59afcd8a338d8b2727193c56d4ebef60c214b766ffde6cff6ceef2baa2594a53a0117e77afd5d58e8a35afdae81b258585ce769507333c0238790d5ed750bf1d6ca2a873050056528fce7becfd12f165ac43a826d3462822ff8f29ea992d4e208847cf4fc10ca00b87b5ce2523fa477bad0be1c97e4398aa2ac81d973b5a871d8e0b295e436cd8415f19088c6c82c85f4ed1fac41da062bc6dbfb8eac4276c"], 0x0, 0x0, &(0x7f00000022c0)}) 13:17:23 executing program 4: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = gettid() perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x3e5}, 0x0, 0x0, 0xffffffffffffffff, 0x0) fcntl$setown(r0, 0x8, r1) bind$inet6(r0, &(0x7f0000807fe4)={0xa, 0x4e22}, 0x1c) sendto$inet6(r0, &(0x7f0000000380), 0x0, 0x200408d4, &(0x7f000072e000)={0xa, 0x4e22, 0x0, @loopback}, 0x1c) sendto$inet6(r0, &(0x7f0000ad6fad)='\x00', 0x1, 0x3fffffd, &(0x7f0000254000)={0xa, 0x0, 0x0, @loopback}, 0x1c) 13:17:23 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r0, &(0x7f0000942000)={0x2, 0x4e20, @multicast1}, 0x10) sendmsg$key(0xffffffffffffffff, &(0x7f0000f56000)={0x0, 0x0, &(0x7f00008feff0)={&(0x7f0000000500)=ANY=[@ANYBLOB="020300090a1500000000000000000000030006190000000002000000e0000001003f00000000000002000100e625aa66dcef85847e479eb3c49000000400000000fd003e"], 0x44}}, 0x0) add_key(&(0x7f0000000080)='logon\x00', &(0x7f0000000100)={0x73, 0x79, 0x7a, 0x1}, &(0x7f0000001240), 0x0, 0xfffffffffffffff8) get_mempolicy(&(0x7f0000000000), &(0x7f00000001c0), 0x1ff, &(0x7f0000fff000/0x1000)=nil, 0x3) setsockopt$sock_int(r0, 0x1, 0x3c, &(0x7f0000d4effc)=0x1, 0x4) connect$inet(r0, &(0x7f0000000000)={0x2, 0x4e20, @dev={0xac, 0x14, 0x14, 0x18}}, 0x10) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f00000001c0)='tunl0\x00', 0x5) sendto$inet(r0, &(0x7f00006d1fd4)="db", 0x1, 0x4000010, &(0x7f00004daff0)={0x2, 0x0, @loopback, [0x0, 0x0, 0xf2ffffff00000000]}, 0x10) [ 1545.707328] binder: 17204:17224 IncRefs 0 refcount change on invalid ref 4 ret -22 13:17:23 executing program 3: r0 = openat$cuse(0xffffffffffffff9c, &(0x7f0000000080)='/dev/cuse\x00', 0x2, 0x0) clone(0x1002102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000640), 0xffffffffffffffff) r1 = getpid() sched_setscheduler(r1, 0x5, &(0x7f0000000000)) write$FUSE_NOTIFY_DELETE(r0, &(0x7f0000000040)={0x29, 0x3}, 0x29) 13:17:23 executing program 7: r0 = openat$cuse(0xffffffffffffff9c, &(0x7f0000000080)='/dev/cuse\x00', 0x2, 0x0) clone(0x1002102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000640), 0xffffffffffffffff) r1 = getpid() sched_setscheduler(r1, 0x5, &(0x7f0000000000)) write$FUSE_NOTIFY_DELETE(r0, &(0x7f0000000040)={0x29, 0x6, 0x0, {0x8002a0}}, 0x29) 13:17:23 executing program 6: clone(0x802102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000040), 0xffffffffffffffff) r0 = syz_open_dev$sndtimer(&(0x7f0000000000)='/dev/snd/timer\x00', 0x0, 0x0) r1 = getpid() sched_setscheduler(r1, 0x5, &(0x7f0000000200)) ioctl$SNDRV_TIMER_IOCTL_GPARAMS(r0, 0x40485404, &(0x7f0000000240)={{}, 0x0, 0x2000000000000000, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3000000]}) [ 1545.798907] binder: 17204:17224 BC_INCREFS_DONE u0000000000000000 no match 13:17:23 executing program 3: r0 = openat$cuse(0xffffffffffffff9c, &(0x7f0000000080)='/dev/cuse\x00', 0x2, 0x0) clone(0x1002102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000640), 0xffffffffffffffff) r1 = getpid() sched_setscheduler(r1, 0x5, &(0x7f0000000000)) write$FUSE_NOTIFY_DELETE(r0, &(0x7f0000000040)={0x29, 0x4, 0x200000000000000}, 0x29) 13:17:23 executing program 7: r0 = openat$cuse(0xffffffffffffff9c, &(0x7f0000000080)='/dev/cuse\x00', 0x2, 0x0) clone(0x1002102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000640), 0xffffffffffffffff) r1 = getpid() sched_setscheduler(r1, 0x5, &(0x7f0000000000)) write$FUSE_NOTIFY_DELETE(r0, &(0x7f0000000040)={0x29, 0x6, 0x0, {0x500}}, 0x29) 13:17:24 executing program 3: r0 = openat$cuse(0xffffffffffffff9c, &(0x7f0000000080)='/dev/cuse\x00', 0x2, 0x0) clone(0x1002102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000640), 0xffffffffffffffff) r1 = getpid() sched_setscheduler(r1, 0x5, &(0x7f0000000000)) write$FUSE_NOTIFY_DELETE(r0, &(0x7f0000000040)={0x29, 0x4, 0x500000000000000}, 0x29) 13:17:24 executing program 7: r0 = openat$cuse(0xffffffffffffff9c, &(0x7f0000000080)='/dev/cuse\x00', 0x2, 0x0) clone(0x1002102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000640), 0xffffffffffffffff) r1 = getpid() sched_setscheduler(r1, 0x5, &(0x7f0000000000)) write$FUSE_NOTIFY_DELETE(r0, &(0x7f0000000040)={0x29, 0x6, 0x0, {0xb00000000000000}}, 0x29) [ 1545.876650] binder: 17204:17224 IncRefs 0 refcount change on invalid ref 0 ret -22 [ 1546.093395] binder: 17278:17284 unknown command 0 [ 1546.115543] binder: 17278:17284 ioctl c0306201 20002340 returned -22 [ 1546.133160] binder: 17278:17287 unknown command 0 [ 1546.138557] binder: 17278:17287 ioctl c0306201 20002340 returned -22 13:17:24 executing program 1: r0 = socket$netlink(0x10, 0x3, 0x8000000004) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_TCP_CONGESTION(r1, 0x6, 0xd, &(0x7f0000000180)='vegas\x00', 0x6) bind$inet6(r1, &(0x7f00001fefe4)={0xa, 0x4e22}, 0x1c) sendto$inet6(r1, &(0x7f0000000100), 0x8d2d601e8976aa5, 0x20000004, &(0x7f000031e000)={0xa, 0x4e22}, 0x1c) writev(r0, &(0x7f0000000100)=[{&(0x7f0000000000)="580000001400192340834b80040d8c560a067f2633ff81004e220000000058000b4824ca944f64009400050028925aa8000000000000008000f0fffeffff09000000fff5dd00000010000100000c0900fcff0000040e05a5", 0x58}], 0x1) 13:17:24 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r0, &(0x7f0000942000)={0x2, 0x4e20, @multicast1}, 0x10) sendmsg$key(0xffffffffffffffff, &(0x7f0000f56000)={0x0, 0x0, &(0x7f00008feff0)={&(0x7f0000000500)=ANY=[@ANYBLOB="020300090a1500000000000000000000030006190000000002000000e0000001003f00000000000002000100e625aa66dcef85847e479eb3c49000000400000000fd003e"], 0x44}}, 0x0) add_key(&(0x7f0000000080)='logon\x00', &(0x7f0000000100)={0x73, 0x79, 0x7a, 0x1}, &(0x7f0000001240), 0x0, 0xfffffffffffffff8) get_mempolicy(&(0x7f0000000000), &(0x7f00000001c0), 0x1ff, &(0x7f0000fff000/0x1000)=nil, 0x3) setsockopt$sock_int(r0, 0x1, 0x3c, &(0x7f0000d4effc)=0x1, 0x4) connect$inet(r0, &(0x7f0000000000)={0x2, 0x4e20, @dev={0xac, 0x14, 0x14, 0x18}}, 0x10) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f00000001c0)='tunl0\x00', 0x5) sendto$inet(r0, &(0x7f00006d1fd4)="db", 0x1, 0x4000010, &(0x7f00004daff0)={0x2, 0x0, @loopback, [0x0, 0x0, 0xf401]}, 0x10) 13:17:24 executing program 5: r0 = syz_open_dev$binder(&(0x7f00000021c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000002340)={0x34, 0x0, &(0x7f0000002240)=[@request_death={0x400c630e, 0x4, 0x4}, @increfs={0x40046304, 0x4}, @increfs_done={0x40106308, 0x0, 0x3}, @increfs], 0x77, 0x0, &(0x7f00000022c0)="b3cd0976d8e2af743c6f523efe14fd20c3c3dd4d72734282a761e1b4304e2599c85f198cc82bd5d0c74c4edca2f9ea7b875ff7047ec0784fbb354e15fd3f7d837f533597d5082692a6f2fb748da3cc4157188f7f2a5477ded56f72f5b75c96872db429e44b8fcd781d96dead77a0b58b7af9085a208a22"}) 13:17:24 executing program 3: r0 = openat$cuse(0xffffffffffffff9c, &(0x7f0000000080)='/dev/cuse\x00', 0x2, 0x0) clone(0x1002102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000640), 0xffffffffffffffff) r1 = getpid() sched_setscheduler(r1, 0x5, &(0x7f0000000000)) write$FUSE_NOTIFY_DELETE(r0, &(0x7f0000000040)={0x29, 0x4, 0x3000000}, 0x29) 13:17:24 executing program 6: clone(0x802102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000040), 0xffffffffffffffff) r0 = syz_open_dev$sndtimer(&(0x7f0000000000)='/dev/snd/timer\x00', 0x0, 0x0) r1 = getpid() sched_setscheduler(r1, 0x5, &(0x7f0000000200)) ioctl$SNDRV_TIMER_IOCTL_GPARAMS(r0, 0x40485404, &(0x7f0000000240)={{}, 0x0, 0x2000000000000000, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x300]}) 13:17:24 executing program 7: r0 = openat$cuse(0xffffffffffffff9c, &(0x7f0000000080)='/dev/cuse\x00', 0x2, 0x0) clone(0x1002102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000640), 0xffffffffffffffff) r1 = getpid() sched_setscheduler(r1, 0x5, &(0x7f0000000000)) write$FUSE_NOTIFY_DELETE(r0, &(0x7f0000000040)={0x29, 0x6, 0x0, {0xc00000000000000}}, 0x29) 13:17:24 executing program 4: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = gettid() perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x3e5}, 0x0, 0x0, 0xffffffffffffffff, 0x0) fcntl$setown(r0, 0x8, r1) bind$inet6(r0, &(0x7f0000807fe4)={0xa, 0x4e22}, 0x1c) sendto$inet6(r0, &(0x7f0000000380), 0x0, 0x200408d4, &(0x7f000072e000)={0xa, 0x4e22, 0x0, @loopback}, 0x1c) sendto$inet6(r0, &(0x7f0000ad6fad)='\x00', 0x1, 0x3fffffd, &(0x7f0000254000)={0xa, 0x0, 0x0, @loopback}, 0x1c) 13:17:24 executing program 0: perf_event_open(&(0x7f0000000040)={0x2, 0x70, 0x3e5}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f00000021c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000002340)={0xb5, 0x7a, &(0x7f00000000c0)=ANY=[@ANYBLOB="0463044000000000b6a571ac965f26c50d500dae115e59afcd8a338d8b2727193c56d4ebef60c214b766ffde6cff6ceef2baa2594a53a0117e77afd5d58e8a35afdae81b258585ce769507333c0238790d5ed750bf1d6ca2a873050056528fce7becfd12f165ac43a826d3462822ff8f29ea992d4e208847cf4fc10ca00b87b5ce2523fa477bad0be1c97e4398aa2ac81d973b5a871d8e0b295e436cd8415f19088c6c82c85f4ed1fac41da062bc6dbfb8eac4276c"], 0x0, 0x0, &(0x7f00000022c0)}) [ 1546.587976] binder: 17289:17302 IncRefs 0 refcount change on invalid ref 4 ret -22 [ 1546.619056] binder: 17289:17302 BC_INCREFS_DONE u0000000000000000 no match 13:17:24 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r0, &(0x7f0000942000)={0x2, 0x4e20, @multicast1}, 0x10) sendmsg$key(0xffffffffffffffff, &(0x7f0000f56000)={0x0, 0x0, &(0x7f00008feff0)={&(0x7f0000000500)=ANY=[@ANYBLOB="020300090a1500000000000000000000030006190000000002000000e0000001003f00000000000002000100e625aa66dcef85847e479eb3c49000000400000000fd003e"], 0x44}}, 0x0) add_key(&(0x7f0000000080)='logon\x00', &(0x7f0000000100)={0x73, 0x79, 0x7a, 0x1}, &(0x7f0000001240), 0x0, 0xfffffffffffffff8) get_mempolicy(&(0x7f0000000000), &(0x7f00000001c0), 0x1ff, &(0x7f0000fff000/0x1000)=nil, 0x3) setsockopt$sock_int(r0, 0x1, 0x3c, &(0x7f0000d4effc)=0x1, 0x4) connect$inet(r0, &(0x7f0000000000)={0x2, 0x4e20, @dev={0xac, 0x14, 0x14, 0x18}}, 0x10) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f00000001c0)='tunl0\x00', 0x5) sendto$inet(r0, &(0x7f00006d1fd4)="db", 0x1, 0x4000010, &(0x7f00004daff0)={0x2, 0x0, @loopback, [0x0, 0x0, 0x400000000000000]}, 0x10) [ 1546.742532] binder: 17289:17302 IncRefs 0 refcount change on invalid ref 0 ret -22 13:17:24 executing program 5: r0 = syz_open_dev$binder(&(0x7f00000021c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000002340)={0x34, 0x0, &(0x7f0000002240)=[@request_death={0x400c630e, 0x4, 0x4}, @increfs={0x40046304, 0x4}, @increfs_done={0x40106308, 0x0, 0x3}, @increfs], 0x77, 0x0, &(0x7f00000022c0)="b3cd0976d8e2af743c6f523efe14fd20c3c3dd5472734282a761e1b4304e2599c85f198cc82bd5d0c74c4edca2f9ea7b875ff7047ec0784fbb354e15fd3f7d837f533597d5082692a6f2fb748da3cc4157188f7f2a5477ded56f72f5b75c96872db429e44b8fcd781d96dead77a0b58b7af9085a208a22"}) [ 1546.870052] binder: 17318:17321 IncRefs 0 refcount change on invalid ref 4 ret -22 13:17:25 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r0, &(0x7f0000942000)={0x2, 0x4e20, @multicast1}, 0x10) sendmsg$key(0xffffffffffffffff, &(0x7f0000f56000)={0x0, 0x0, &(0x7f00008feff0)={&(0x7f0000000500)=ANY=[@ANYBLOB="020300090a1500000000000000000000030006190000000002000000e0000001003f00000000000002000100e625aa66dcef85847e479eb3c49000000400000000fd003e"], 0x44}}, 0x0) add_key(&(0x7f0000000080)='logon\x00', &(0x7f0000000100)={0x73, 0x79, 0x7a, 0x1}, &(0x7f0000001240), 0x0, 0xfffffffffffffff8) get_mempolicy(&(0x7f0000000000), &(0x7f00000001c0), 0x1ff, &(0x7f0000fff000/0x1000)=nil, 0x3) setsockopt$sock_int(r0, 0x1, 0x3c, &(0x7f0000d4effc)=0x1, 0x4) connect$inet(r0, &(0x7f0000000000)={0x2, 0x4e20, @dev={0xac, 0x14, 0x14, 0x18}}, 0x10) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f00000001c0)='tunl0\x00', 0x5) sendto$inet(r0, &(0x7f00006d1fd4)="db", 0x1, 0x4000010, &(0x7f00004daff0)={0x2, 0x0, @loopback, [0x0, 0x0, 0x4000000]}, 0x10) [ 1546.918065] binder: 17318:17321 BC_INCREFS_DONE u0000000000000000 no match [ 1546.942063] binder: 17318:17321 IncRefs 0 refcount change on invalid ref 0 ret -22 13:17:25 executing program 5: r0 = syz_open_dev$binder(&(0x7f00000021c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000002340)={0x34, 0x0, &(0x7f0000002240)=[@request_death={0x400c630e, 0x4, 0x4}, @increfs={0x40046304, 0x4}, @increfs_done={0x40106308, 0x0, 0x3}, @increfs], 0x77, 0x0, &(0x7f00000022c0)="b3cd0976d8e2af743c6f523efe14fd20c3c3dd3b72734282a761e1b4304e2599c85f198cc82bd5d0c74c4edca2f9ea7b875ff7047ec0784fbb354e15fd3f7d837f533597d5082692a6f2fb748da3cc4157188f7f2a5477ded56f72f5b75c96872db429e44b8fcd781d96dead77a0b58b7af9085a208a22"}) 13:17:25 executing program 7: r0 = openat$cuse(0xffffffffffffff9c, &(0x7f0000000080)='/dev/cuse\x00', 0x2, 0x0) clone(0x1002102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000640), 0xffffffffffffffff) r1 = getpid() sched_setscheduler(r1, 0x5, &(0x7f0000000000)) write$FUSE_NOTIFY_DELETE(r0, &(0x7f0000000040)={0x29, 0x6, 0x0, {0x300000000000000}}, 0x29) 13:17:25 executing program 3: r0 = openat$cuse(0xffffffffffffff9c, &(0x7f0000000080)='/dev/cuse\x00', 0x2, 0x0) clone(0x1002102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000640), 0xffffffffffffffff) r1 = getpid() sched_setscheduler(r1, 0x5, &(0x7f0000000000)) write$FUSE_NOTIFY_DELETE(r0, &(0x7f0000000040)={0x29, 0x4, 0x5000000}, 0x29) 13:17:25 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r0, &(0x7f0000942000)={0x2, 0x4e20, @multicast1}, 0x10) sendmsg$key(0xffffffffffffffff, &(0x7f0000f56000)={0x0, 0x0, &(0x7f00008feff0)={&(0x7f0000000500)=ANY=[@ANYBLOB="020300090a1500000000000000000000030006190000000002000000e0000001003f00000000000002000100e625aa66dcef85847e479eb3c49000000400000000fd003e"], 0x44}}, 0x0) add_key(&(0x7f0000000080)='logon\x00', &(0x7f0000000100)={0x73, 0x79, 0x7a, 0x1}, &(0x7f0000001240), 0x0, 0xfffffffffffffff8) get_mempolicy(&(0x7f0000000000), &(0x7f00000001c0), 0x1ff, &(0x7f0000fff000/0x1000)=nil, 0x3) setsockopt$sock_int(r0, 0x1, 0x3c, &(0x7f0000d4effc)=0x1, 0x4) connect$inet(r0, &(0x7f0000000000)={0x2, 0x4e20, @dev={0xac, 0x14, 0x14, 0x18}}, 0x10) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f00000001c0)='tunl0\x00', 0x5) sendto$inet(r0, &(0x7f00006d1fd4)="db", 0x1, 0x4000010, &(0x7f00004daff0)={0x2, 0x0, @loopback, [0x0, 0x0, 0x100000]}, 0x10) [ 1547.173925] binder_thread_write: 3 callbacks suppressed [ 1547.173939] binder: 17329:17333 BC_REQUEST_DEATH_NOTIFICATION invalid ref 4 [ 1547.273372] binder: 17329:17333 BC_INCREFS_DONE u0000000000000000 no match 13:17:25 executing program 5: r0 = syz_open_dev$binder(&(0x7f00000021c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000002340)={0x34, 0x0, &(0x7f0000002240)=[@request_death={0x400c630e, 0x4, 0x4}, @increfs={0x40046304, 0x4}, @increfs_done={0x40106308, 0x0, 0x3}, @increfs], 0x77, 0x0, &(0x7f00000022c0)="b3cd0976d8e2af743c6f523efe14fd20c3c3dd4c72734282a761e1b4304e2599c85f198cc82bd5d0c74c4edca2f9ea7b875ff7047ec0784fbb354e15fd3f7d837f533597d5082692a6f2fb748da3cc4157188f7f2a5477ded56f72f5b75c96872db429e44b8fcd781d96dead77a0b58b7af9085a208a22"}) 13:17:25 executing program 1: r0 = socket$netlink(0x10, 0x3, 0x8000000004) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_TCP_CONGESTION(r1, 0x6, 0xd, &(0x7f0000000180)='vegas\x00', 0x6) bind$inet6(r1, &(0x7f00001fefe4)={0xa, 0x4e22}, 0x1c) sendto$inet6(r1, &(0x7f0000000100), 0x8d2d601e8976aa5, 0x20000004, &(0x7f000031e000)={0xa, 0x4e22}, 0x1c) writev(r0, &(0x7f0000000100)=[{&(0x7f0000000000)="580000001400192340834b80040d8c560a067feb48ff81004e220000000058000b4824ca944f64009400050028925aa8000000000000008000f0fffeffff09000000fff5dd00000010000100000c0900fcff0000040e05a5", 0x58}], 0x1) [ 1547.402147] binder: 17352:17354 BC_REQUEST_DEATH_NOTIFICATION invalid ref 4 [ 1547.435294] binder: 17352:17354 BC_INCREFS_DONE u0000000000000000 no match 13:17:25 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r0, &(0x7f0000942000)={0x2, 0x4e20, @multicast1}, 0x10) sendmsg$key(0xffffffffffffffff, &(0x7f0000f56000)={0x0, 0x0, &(0x7f00008feff0)={&(0x7f0000000500)=ANY=[@ANYBLOB="020300090a1500000000000000000000030006190000000002000000e0000001003f00000000000002000100e625aa66dcef85847e479eb3c49000000400000000fd003e"], 0x44}}, 0x0) add_key(&(0x7f0000000080)='logon\x00', &(0x7f0000000100)={0x73, 0x79, 0x7a, 0x1}, &(0x7f0000001240), 0x0, 0xfffffffffffffff8) get_mempolicy(&(0x7f0000000000), &(0x7f00000001c0), 0x1ff, &(0x7f0000fff000/0x1000)=nil, 0x3) setsockopt$sock_int(r0, 0x1, 0x3c, &(0x7f0000d4effc)=0x1, 0x4) connect$inet(r0, &(0x7f0000000000)={0x2, 0x4e20, @dev={0xac, 0x14, 0x14, 0x18}}, 0x10) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f00000001c0)='tunl0\x00', 0x5) sendto$inet(r0, &(0x7f00006d1fd4)="db", 0x1, 0x4000010, &(0x7f00004daff0)={0x2, 0x0, @loopback, [0x0, 0x0, 0xffffffffa0010000]}, 0x10) 13:17:25 executing program 5: r0 = syz_open_dev$binder(&(0x7f00000021c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000002340)={0x34, 0x0, &(0x7f0000002240)=[@request_death={0x400c630e, 0x4, 0x4}, @increfs={0x40046304, 0x4}, @increfs_done={0x40106308, 0x0, 0x3}, @increfs], 0x77, 0x0, &(0x7f00000022c0)="b3cd0976d8e2af743c6f523efe14fd20c3c3dd2525734282a761e1b4304e2599c85f198cc82bd5d0c74c4edca2f9ea7b875ff7047ec0784fbb354e15fd3f7d837f533597d5082692a6f2fb748da3cc4157188f7f2a5477ded56f72f5b75c96872db429e44b8fcd781d96dead77a0b58b7af9085a208a22"}) 13:17:25 executing program 6: clone(0x802102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000040), 0xffffffffffffffff) r0 = syz_open_dev$sndtimer(&(0x7f0000000000)='/dev/snd/timer\x00', 0x0, 0x0) r1 = getpid() sched_setscheduler(r1, 0x5, &(0x7f0000000200)) ioctl$SNDRV_TIMER_IOCTL_GPARAMS(r0, 0x40485404, &(0x7f0000000240)={{}, 0x0, 0x2000000000000000, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3]}) 13:17:25 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r0, &(0x7f0000942000)={0x2, 0x4e20, @multicast1}, 0x10) sendmsg$key(0xffffffffffffffff, &(0x7f0000f56000)={0x0, 0x0, &(0x7f00008feff0)={&(0x7f0000000500)=ANY=[@ANYBLOB="020300090a1500000000000000000000030006190000000002000000e0000001003f00000000000002000100e625aa66dcef85847e479eb3c49000000400000000fd003e"], 0x44}}, 0x0) add_key(&(0x7f0000000080)='logon\x00', &(0x7f0000000100)={0x73, 0x79, 0x7a, 0x1}, &(0x7f0000001240), 0x0, 0xfffffffffffffff8) get_mempolicy(&(0x7f0000000000), &(0x7f00000001c0), 0x1ff, &(0x7f0000fff000/0x1000)=nil, 0x3) setsockopt$sock_int(r0, 0x1, 0x3c, &(0x7f0000d4effc)=0x1, 0x4) connect$inet(r0, &(0x7f0000000000)={0x2, 0x4e20, @dev={0xac, 0x14, 0x14, 0x18}}, 0x10) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f00000001c0)='tunl0\x00', 0x5) sendto$inet(r0, &(0x7f00006d1fd4)="db", 0x1, 0x4000010, &(0x7f00004daff0)={0x2, 0x0, @loopback, [0x0, 0x0, 0x1b814]}, 0x10) [ 1547.669221] binder: 17367:17371 BC_REQUEST_DEATH_NOTIFICATION invalid ref 4 [ 1547.703771] binder: 17367:17371 BC_INCREFS_DONE u0000000000000000 no match 13:17:25 executing program 5: r0 = syz_open_dev$binder(&(0x7f00000021c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000002340)={0x34, 0x0, &(0x7f0000002240)=[@request_death={0x400c630e, 0x4, 0x4}, @increfs={0x40046304, 0x4}, @increfs_done={0x40106308, 0x0, 0x3}, @increfs], 0x77, 0x0, &(0x7f00000022c0)="b3cd0976d8e2af743c6f523efe14fd20c3c3dd250a734282a761e1b4304e2599c85f198cc82bd5d0c74c4edca2f9ea7b875ff7047ec0784fbb354e15fd3f7d837f533597d5082692a6f2fb748da3cc4157188f7f2a5477ded56f72f5b75c96872db429e44b8fcd781d96dead77a0b58b7af9085a208a22"}) [ 1547.719487] binder: 17291:17379 unknown command 195038401 [ 1547.725353] binder: 17291:17379 ioctl c0306201 20002340 returned -22 [ 1547.734203] binder: 17291:17380 unknown command 195038401 [ 1547.815115] binder: 17291:17380 ioctl c0306201 20002340 returned -22 [ 1547.845196] binder: 17385:17387 BC_REQUEST_DEATH_NOTIFICATION invalid ref 4 [ 1547.864485] binder: 17385:17387 BC_INCREFS_DONE u0000000000000000 no match 13:17:26 executing program 4: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = gettid() perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x3e5}, 0x0, 0x0, 0xffffffffffffffff, 0x0) fcntl$setown(r0, 0x8, r1) bind$inet6(r0, &(0x7f0000807fe4)={0xa, 0x4e22}, 0x1c) sendto$inet6(r0, &(0x7f0000000380), 0x0, 0x200408d4, &(0x7f000072e000)={0xa, 0x4e22, 0x0, @loopback}, 0x1c) sendto$inet6(r0, &(0x7f0000ad6fad)='\x00', 0x1, 0x3fffffd, &(0x7f0000254000)={0xa, 0x0, 0x0, @loopback}, 0x1c) 13:17:26 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r0, &(0x7f0000942000)={0x2, 0x4e20, @multicast1}, 0x10) sendmsg$key(0xffffffffffffffff, &(0x7f0000f56000)={0x0, 0x0, &(0x7f00008feff0)={&(0x7f0000000500)=ANY=[@ANYBLOB="020300090a1500000000000000000000030006190000000002000000e0000001003f00000000000002000100e625aa66dcef85847e479eb3c49000000400000000fd003e"], 0x44}}, 0x0) add_key(&(0x7f0000000080)='logon\x00', &(0x7f0000000100)={0x73, 0x79, 0x7a, 0x1}, &(0x7f0000001240), 0x0, 0xfffffffffffffff8) get_mempolicy(&(0x7f0000000000), &(0x7f00000001c0), 0x1ff, &(0x7f0000fff000/0x1000)=nil, 0x3) setsockopt$sock_int(r0, 0x1, 0x3c, &(0x7f0000d4effc)=0x1, 0x4) connect$inet(r0, &(0x7f0000000000)={0x2, 0x4e20, @dev={0xac, 0x14, 0x14, 0x18}}, 0x10) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f00000001c0)='tunl0\x00', 0x5) sendto$inet(r0, &(0x7f00006d1fd4)="db", 0x1, 0x4000010, &(0x7f00004daff0)={0x2, 0x0, @loopback, [0x0, 0x0, 0x281400]}, 0x10) 13:17:26 executing program 7: r0 = openat$cuse(0xffffffffffffff9c, &(0x7f0000000080)='/dev/cuse\x00', 0x2, 0x0) clone(0x1002102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000640), 0xffffffffffffffff) r1 = getpid() sched_setscheduler(r1, 0x5, &(0x7f0000000000)) write$FUSE_NOTIFY_DELETE(r0, &(0x7f0000000040)={0x29, 0x6, 0x0, {0x900}}, 0x29) 13:17:26 executing program 3: r0 = openat$cuse(0xffffffffffffff9c, &(0x7f0000000080)='/dev/cuse\x00', 0x2, 0x0) clone(0x1002102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000640), 0xffffffffffffffff) r1 = getpid() sched_setscheduler(r1, 0x5, &(0x7f0000000000)) write$FUSE_NOTIFY_DELETE(r0, &(0x7f0000000040)={0x29, 0x4, 0x4000000}, 0x29) 13:17:26 executing program 6: clone(0x802102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000040), 0xffffffffffffffff) r0 = syz_open_dev$sndtimer(&(0x7f0000000000)='/dev/snd/timer\x00', 0x0, 0x0) r1 = getpid() sched_setscheduler(r1, 0x5, &(0x7f0000000200)) ioctl$SNDRV_TIMER_IOCTL_GPARAMS(r0, 0x40485404, &(0x7f0000000240)={{}, 0x0, 0x2000000000000000, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x100000000000000]}) 13:17:26 executing program 5: r0 = syz_open_dev$binder(&(0x7f00000021c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000002340)={0x34, 0x0, &(0x7f0000002240)=[@request_death={0x400c630e, 0x4, 0x4}, @increfs={0x40046304, 0x4}, @increfs_done={0x40106308, 0x0, 0x3}, @increfs], 0x77, 0x0, &(0x7f00000022c0)="b3cd0976d8e2af743c6f523efe14fd20c3c3dd2572644282a761e1b4304e2599c85f198cc82bd5d0c74c4edca2f9ea7b875ff7047ec0784fbb354e15fd3f7d837f533597d5082692a6f2fb748da3cc4157188f7f2a5477ded56f72f5b75c96872db429e44b8fcd781d96dead77a0b58b7af9085a208a22"}) 13:17:26 executing program 0: perf_event_open(&(0x7f0000000040)={0x2, 0x70, 0x3e5}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f00000021c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000002340)={0xb5, 0x600, &(0x7f00000000c0)=ANY=[@ANYBLOB="0463044000000000b6a571ac965f26c50d500dae115e59afcd8a338d8b2727193c56d4ebef60c214b766ffde6cff6ceef2baa2594a53a0117e77afd5d58e8a35afdae81b258585ce769507333c0238790d5ed750bf1d6ca2a873050056528fce7becfd12f165ac43a826d3462822ff8f29ea992d4e208847cf4fc10ca00b87b5ce2523fa477bad0be1c97e4398aa2ac81d973b5a871d8e0b295e436cd8415f19088c6c82c85f4ed1fac41da062bc6dbfb8eac4276c"], 0x0, 0x0, &(0x7f00000022c0)}) 13:17:26 executing program 6: clone(0x802102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000040), 0xffffffffffffffff) r0 = syz_open_dev$sndtimer(&(0x7f0000000000)='/dev/snd/timer\x00', 0x0, 0x0) r1 = getpid() sched_setscheduler(r1, 0x5, &(0x7f0000000200)) ioctl$SNDRV_TIMER_IOCTL_GPARAMS(r0, 0x40485404, &(0x7f0000000240)={{}, 0x0, 0x2000000000000000, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x300000000000000]}) 13:17:26 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r0, &(0x7f0000942000)={0x2, 0x4e20, @multicast1}, 0x10) sendmsg$key(0xffffffffffffffff, &(0x7f0000f56000)={0x0, 0x0, &(0x7f00008feff0)={&(0x7f0000000500)=ANY=[@ANYBLOB="020300090a1500000000000000000000030006190000000002000000e0000001003f00000000000002000100e625aa66dcef85847e479eb3c49000000400000000fd003e"], 0x44}}, 0x0) add_key(&(0x7f0000000080)='logon\x00', &(0x7f0000000100)={0x73, 0x79, 0x7a, 0x1}, &(0x7f0000001240), 0x0, 0xfffffffffffffff8) get_mempolicy(&(0x7f0000000000), &(0x7f00000001c0), 0x1ff, &(0x7f0000fff000/0x1000)=nil, 0x3) setsockopt$sock_int(r0, 0x1, 0x3c, &(0x7f0000d4effc)=0x1, 0x4) connect$inet(r0, &(0x7f0000000000)={0x2, 0x4e20, @dev={0xac, 0x14, 0x14, 0x18}}, 0x10) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f00000001c0)='tunl0\x00', 0x5) sendto$inet(r0, &(0x7f00006d1fd4)="db", 0x1, 0x4000010, &(0x7f00004daff0)={0x2, 0x0, @loopback, [0x0, 0x0, 0xa0028000]}, 0x10) [ 1548.001251] binder: 17402:17407 BC_REQUEST_DEATH_NOTIFICATION invalid ref 4 [ 1548.032605] binder: 17402:17407 BC_INCREFS_DONE u0000000000000000 no match 13:17:26 executing program 5: r0 = syz_open_dev$binder(&(0x7f00000021c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000002340)={0x34, 0x0, &(0x7f0000002240)=[@request_death={0x400c630e, 0x4, 0x4}, @increfs={0x40046304, 0x4}, @increfs_done={0x40106308, 0x0, 0x3}, @increfs], 0x77, 0x0, &(0x7f00000022c0)="b3cd0976d8e2af743c6f523efe14fd20c3c3dd25722d4282a761e1b4304e2599c85f198cc82bd5d0c74c4edca2f9ea7b875ff7047ec0784fbb354e15fd3f7d837f533597d5082692a6f2fb748da3cc4157188f7f2a5477ded56f72f5b75c96872db429e44b8fcd781d96dead77a0b58b7af9085a208a22"}) [ 1548.177081] binder: 17423:17425 BC_REQUEST_DEATH_NOTIFICATION invalid ref 4 13:17:26 executing program 5: r0 = syz_open_dev$binder(&(0x7f00000021c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000002340)={0x34, 0x0, &(0x7f0000002240)=[@request_death={0x400c630e, 0x4, 0x4}, @increfs={0x40046304, 0x4}, @increfs_done={0x40106308, 0x0, 0x3}, @increfs], 0x77, 0x0, &(0x7f00000022c0)="b3cd0976d8e2af743c6f523efe14fd20c3c3dd2572704282a761e1b4304e2599c85f198cc82bd5d0c74c4edca2f9ea7b875ff7047ec0784fbb354e15fd3f7d837f533597d5082692a6f2fb748da3cc4157188f7f2a5477ded56f72f5b75c96872db429e44b8fcd781d96dead77a0b58b7af9085a208a22"}) 13:17:26 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r0, &(0x7f0000942000)={0x2, 0x4e20, @multicast1}, 0x10) sendmsg$key(0xffffffffffffffff, &(0x7f0000f56000)={0x0, 0x0, &(0x7f00008feff0)={&(0x7f0000000500)=ANY=[@ANYBLOB="020300090a1500000000000000000000030006190000000002000000e0000001003f00000000000002000100e625aa66dcef85847e479eb3c49000000400000000fd003e"], 0x44}}, 0x0) add_key(&(0x7f0000000080)='logon\x00', &(0x7f0000000100)={0x73, 0x79, 0x7a, 0x1}, &(0x7f0000001240), 0x0, 0xfffffffffffffff8) get_mempolicy(&(0x7f0000000000), &(0x7f00000001c0), 0x1ff, &(0x7f0000fff000/0x1000)=nil, 0x3) setsockopt$sock_int(r0, 0x1, 0x3c, &(0x7f0000d4effc)=0x1, 0x4) connect$inet(r0, &(0x7f0000000000)={0x2, 0x4e20, @dev={0xac, 0x14, 0x14, 0x18}}, 0x10) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f00000001c0)='tunl0\x00', 0x5) sendto$inet(r0, &(0x7f00006d1fd4)="db", 0x1, 0x4000010, &(0x7f00004daff0)={0x2, 0x0, @loopback, [0x0, 0x0, 0xf2ffffff]}, 0x10) 13:17:26 executing program 7: r0 = openat$cuse(0xffffffffffffff9c, &(0x7f0000000080)='/dev/cuse\x00', 0x2, 0x0) clone(0x1002102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000640), 0xffffffffffffffff) r1 = getpid() sched_setscheduler(r1, 0x5, &(0x7f0000000000)) write$FUSE_NOTIFY_DELETE(r0, &(0x7f0000000040)={0x29, 0x6, 0x0, {0xc}}, 0x29) 13:17:26 executing program 6: clone(0x802102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000040), 0xffffffffffffffff) r0 = syz_open_dev$sndtimer(&(0x7f0000000000)='/dev/snd/timer\x00', 0x0, 0x0) r1 = getpid() sched_setscheduler(r1, 0x5, &(0x7f0000000200)) ioctl$SNDRV_TIMER_IOCTL_GPARAMS(r0, 0x40485404, &(0x7f0000000240)={{}, 0x0, 0x2000000000000000, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1000000]}) 13:17:26 executing program 1: r0 = socket$netlink(0x10, 0x3, 0x8000000004) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_TCP_CONGESTION(r1, 0x6, 0xd, &(0x7f0000000180)='vegas\x00', 0x6) bind$inet6(r1, &(0x7f00001fefe4)={0xa, 0x4e22}, 0x1c) sendto$inet6(r1, &(0x7f0000000100), 0x8d2d601e8976aa5, 0x20000004, &(0x7f000031e000)={0xa, 0x4e22}, 0x1c) writev(r0, &(0x7f0000000100)=[{&(0x7f0000000000)="580000001400192340834b80040d8c560a067f2b98ff81004e220000000058000b4824ca944f64009400050028925aa8000000000000008000f0fffeffff09000000fff5dd00000010000100000c0900fcff0000040e05a5", 0x58}], 0x1) 13:17:26 executing program 0: perf_event_open(&(0x7f0000000040)={0x2, 0x70, 0x3e5}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f00000021c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000002340)={0xb5, 0x3f00, &(0x7f00000000c0)=ANY=[@ANYBLOB="0463044000000000b6a571ac965f26c50d500dae115e59afcd8a338d8b2727193c56d4ebef60c214b766ffde6cff6ceef2baa2594a53a0117e77afd5d58e8a35afdae81b258585ce769507333c0238790d5ed750bf1d6ca2a873050056528fce7becfd12f165ac43a826d3462822ff8f29ea992d4e208847cf4fc10ca00b87b5ce2523fa477bad0be1c97e4398aa2ac81d973b5a871d8e0b295e436cd8415f19088c6c82c85f4ed1fac41da062bc6dbfb8eac4276c"], 0x0, 0x0, &(0x7f00000022c0)}) [ 1548.488296] binder: 17439:17450 BC_REQUEST_DEATH_NOTIFICATION invalid ref 4 13:17:26 executing program 4: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = gettid() perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x3e5}, 0x0, 0x0, 0xffffffffffffffff, 0x0) fcntl$setown(r0, 0x8, r1) bind$inet6(r0, &(0x7f0000807fe4)={0xa, 0x4e22}, 0x1c) sendto$inet6(r0, &(0x7f0000000380), 0x0, 0x200408d4, &(0x7f000072e000)={0xa, 0x4e22, 0x0, @loopback}, 0x1c) sendto$inet6(r0, &(0x7f0000ad6fad)='\x00', 0x1, 0x3fffffd, &(0x7f0000254000)={0xa, 0x0, 0x0, @loopback}, 0x1c) 13:17:26 executing program 3: r0 = openat$cuse(0xffffffffffffff9c, &(0x7f0000000080)='/dev/cuse\x00', 0x2, 0x0) clone(0x1002102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000640), 0xffffffffffffffff) r1 = getpid() sched_setscheduler(r1, 0x5, &(0x7f0000000000)) write$FUSE_NOTIFY_DELETE(r0, &(0x7f0000000040)={0x29, 0x4, 0x3}, 0x29) 13:17:26 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r0, &(0x7f0000942000)={0x2, 0x4e20, @multicast1}, 0x10) sendmsg$key(0xffffffffffffffff, &(0x7f0000f56000)={0x0, 0x0, &(0x7f00008feff0)={&(0x7f0000000500)=ANY=[@ANYBLOB="020300090a1500000000000000000000030006190000000002000000e0000001003f00000000000002000100e625aa66dcef85847e479eb3c49000000400000000fd003e"], 0x44}}, 0x0) add_key(&(0x7f0000000080)='logon\x00', &(0x7f0000000100)={0x73, 0x79, 0x7a, 0x1}, &(0x7f0000001240), 0x0, 0xfffffffffffffff8) get_mempolicy(&(0x7f0000000000), &(0x7f00000001c0), 0x1ff, &(0x7f0000fff000/0x1000)=nil, 0x3) setsockopt$sock_int(r0, 0x1, 0x3c, &(0x7f0000d4effc)=0x1, 0x4) connect$inet(r0, &(0x7f0000000000)={0x2, 0x4e20, @dev={0xac, 0x14, 0x14, 0x18}}, 0x10) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f00000001c0)='tunl0\x00', 0x5) sendto$inet(r0, &(0x7f00006d1fd4)="db", 0x1, 0x4000010, &(0x7f00004daff0)={0x2, 0x0, @loopback, [0x0, 0x0, 0x800000000000000]}, 0x10) 13:17:26 executing program 5: r0 = syz_open_dev$binder(&(0x7f00000021c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000002340)={0x34, 0x0, &(0x7f0000002240)=[@request_death={0x400c630e, 0x4, 0x4}, @increfs={0x40046304, 0x4}, @increfs_done={0x40106308, 0x0, 0x3}, @increfs], 0x77, 0x0, &(0x7f00000022c0)="b3cd0976d8e2af743c6f523efe14fd20c3c3dd2572694282a761e1b4304e2599c85f198cc82bd5d0c74c4edca2f9ea7b875ff7047ec0784fbb354e15fd3f7d837f533597d5082692a6f2fb748da3cc4157188f7f2a5477ded56f72f5b75c96872db429e44b8fcd781d96dead77a0b58b7af9085a208a22"}) 13:17:26 executing program 6: clone(0x802102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000040), 0xffffffffffffffff) r0 = syz_open_dev$sndtimer(&(0x7f0000000000)='/dev/snd/timer\x00', 0x0, 0x0) r1 = getpid() sched_setscheduler(r1, 0x5, &(0x7f0000000200)) ioctl$SNDRV_TIMER_IOCTL_GPARAMS(r0, 0x40485404, &(0x7f0000000240)={{}, 0x0, 0x2000000000000000, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3]}) 13:17:26 executing program 7: r0 = openat$cuse(0xffffffffffffff9c, &(0x7f0000000080)='/dev/cuse\x00', 0x2, 0x0) clone(0x1002102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000640), 0xffffffffffffffff) r1 = getpid() sched_setscheduler(r1, 0x5, &(0x7f0000000000)) write$FUSE_NOTIFY_DELETE(r0, &(0x7f0000000040)={0x29, 0x6, 0x0, {0x500000000000000}}, 0x29) 13:17:26 executing program 0: perf_event_open(&(0x7f0000000040)={0x2, 0x70, 0x3e5}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f00000021c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000002340)={0xb5, 0x6800, &(0x7f00000000c0)=ANY=[@ANYBLOB="0463044000000000b6a571ac965f26c50d500dae115e59afcd8a338d8b2727193c56d4ebef60c214b766ffde6cff6ceef2baa2594a53a0117e77afd5d58e8a35afdae81b258585ce769507333c0238790d5ed750bf1d6ca2a873050056528fce7becfd12f165ac43a826d3462822ff8f29ea992d4e208847cf4fc10ca00b87b5ce2523fa477bad0be1c97e4398aa2ac81d973b5a871d8e0b295e436cd8415f19088c6c82c85f4ed1fac41da062bc6dbfb8eac4276c"], 0x0, 0x0, &(0x7f00000022c0)}) 13:17:26 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r0, &(0x7f0000942000)={0x2, 0x4e20, @multicast1}, 0x10) sendmsg$key(0xffffffffffffffff, &(0x7f0000f56000)={0x0, 0x0, &(0x7f00008feff0)={&(0x7f0000000500)=ANY=[@ANYBLOB="020300090a1500000000000000000000030006190000000002000000e0000001003f00000000000002000100e625aa66dcef85847e479eb3c49000000400000000fd003e"], 0x44}}, 0x0) add_key(&(0x7f0000000080)='logon\x00', &(0x7f0000000100)={0x73, 0x79, 0x7a, 0x1}, &(0x7f0000001240), 0x0, 0xfffffffffffffff8) get_mempolicy(&(0x7f0000000000), &(0x7f00000001c0), 0x1ff, &(0x7f0000fff000/0x1000)=nil, 0x3) setsockopt$sock_int(r0, 0x1, 0x3c, &(0x7f0000d4effc)=0x1, 0x4) connect$inet(r0, &(0x7f0000000000)={0x2, 0x4e20, @dev={0xac, 0x14, 0x14, 0x18}}, 0x10) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f00000001c0)='tunl0\x00', 0x5) sendto$inet(r0, &(0x7f00006d1fd4)="db", 0x1, 0x4000010, &(0x7f00004daff0)={0x2, 0x0, @loopback, [0x0, 0x0, 0xa0008000]}, 0x10) [ 1548.836933] binder: 17473:17477 BC_REQUEST_DEATH_NOTIFICATION invalid ref 4 13:17:26 executing program 5: r0 = syz_open_dev$binder(&(0x7f00000021c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000002340)={0x34, 0x0, &(0x7f0000002240)=[@request_death={0x400c630e, 0x4, 0x4}, @increfs={0x40046304, 0x4}, @increfs_done={0x40106308, 0x0, 0x3}, @increfs], 0x77, 0x0, &(0x7f00000022c0)="b3cd0976d8e2af743c6f523efe14fd20c3c3dd25726c4282a761e1b4304e2599c85f198cc82bd5d0c74c4edca2f9ea7b875ff7047ec0784fbb354e15fd3f7d837f533597d5082692a6f2fb748da3cc4157188f7f2a5477ded56f72f5b75c96872db429e44b8fcd781d96dead77a0b58b7af9085a208a22"}) 13:17:27 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r0, &(0x7f0000942000)={0x2, 0x4e20, @multicast1}, 0x10) sendmsg$key(0xffffffffffffffff, &(0x7f0000f56000)={0x0, 0x0, &(0x7f00008feff0)={&(0x7f0000000500)=ANY=[@ANYBLOB="020300090a1500000000000000000000030006190000000002000000e0000001003f00000000000002000100e625aa66dcef85847e479eb3c49000000400000000fd003e"], 0x44}}, 0x0) add_key(&(0x7f0000000080)='logon\x00', &(0x7f0000000100)={0x73, 0x79, 0x7a, 0x1}, &(0x7f0000001240), 0x0, 0xfffffffffffffff8) get_mempolicy(&(0x7f0000000000), &(0x7f00000001c0), 0x1ff, &(0x7f0000fff000/0x1000)=nil, 0x3) setsockopt$sock_int(r0, 0x1, 0x3c, &(0x7f0000d4effc)=0x1, 0x4) connect$inet(r0, &(0x7f0000000000)={0x2, 0x4e20, @dev={0xac, 0x14, 0x14, 0x18}}, 0x10) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f00000001c0)='tunl0\x00', 0x5) sendto$inet(r0, &(0x7f00006d1fd4)="db", 0x1, 0x4000010, &(0x7f00004daff0)={0x2, 0x0, @loopback, [0x0, 0x0, 0xa6ffffff]}, 0x10) 13:17:27 executing program 3: r0 = openat$cuse(0xffffffffffffff9c, &(0x7f0000000080)='/dev/cuse\x00', 0x2, 0x0) clone(0x1002102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000640), 0xffffffffffffffff) r1 = getpid() sched_setscheduler(r1, 0x5, &(0x7f0000000000)) write$FUSE_NOTIFY_DELETE(r0, &(0x7f0000000040)={0x29, 0x4, 0x400000000000000}, 0x29) [ 1549.303177] binder: 17500:17501 BC_REQUEST_DEATH_NOTIFICATION invalid ref 4 13:17:27 executing program 6: clone(0x802102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000040), 0xffffffffffffffff) r0 = syz_open_dev$sndtimer(&(0x7f0000000000)='/dev/snd/timer\x00', 0x0, 0x0) r1 = getpid() sched_setscheduler(r1, 0x5, &(0x7f0000000200)) ioctl$SNDRV_TIMER_IOCTL_GPARAMS(r0, 0x40485404, &(0x7f0000000240)={{}, 0x0, 0x2000000000000000, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x100000000000000]}) 13:17:27 executing program 1: r0 = socket$netlink(0x10, 0x3, 0x8000000004) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_TCP_CONGESTION(r1, 0x6, 0xd, &(0x7f0000000180)='vegas\x00', 0x6) bind$inet6(r1, &(0x7f00001fefe4)={0xa, 0x4e22}, 0x1c) sendto$inet6(r1, &(0x7f0000000100), 0x8d2d601e8976aa5, 0x20000004, &(0x7f000031e000)={0xa, 0x4e22}, 0x1c) writev(r0, &(0x7f0000000100)=[{&(0x7f0000000000)="580000001400192340834b80040d8c560a067f0c13ff81004e220000000058000b4824ca944f64009400050028925aa8000000000000008000f0fffeffff09000000fff5dd00000010000100000c0900fcff0000040e05a5", 0x58}], 0x1) 13:17:27 executing program 5: r0 = syz_open_dev$binder(&(0x7f00000021c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000002340)={0x34, 0x0, &(0x7f0000002240)=[@request_death={0x400c630e, 0x4, 0x4}, @increfs={0x40046304, 0x4}, @increfs_done={0x40106308, 0x0, 0x3}, @increfs], 0x77, 0x0, &(0x7f00000022c0)="b3cd0976d8e2af743c6f523efe14fd20c3c3dd2572584282a761e1b4304e2599c85f198cc82bd5d0c74c4edca2f9ea7b875ff7047ec0784fbb354e15fd3f7d837f533597d5082692a6f2fb748da3cc4157188f7f2a5477ded56f72f5b75c96872db429e44b8fcd781d96dead77a0b58b7af9085a208a22"}) 13:17:27 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r0, &(0x7f0000942000)={0x2, 0x4e20, @multicast1}, 0x10) sendmsg$key(0xffffffffffffffff, &(0x7f0000f56000)={0x0, 0x0, &(0x7f00008feff0)={&(0x7f0000000500)=ANY=[@ANYBLOB="020300090a1500000000000000000000030006190000000002000000e0000001003f00000000000002000100e625aa66dcef85847e479eb3c49000000400000000fd003e"], 0x44}}, 0x0) add_key(&(0x7f0000000080)='logon\x00', &(0x7f0000000100)={0x73, 0x79, 0x7a, 0x1}, &(0x7f0000001240), 0x0, 0xfffffffffffffff8) get_mempolicy(&(0x7f0000000000), &(0x7f00000001c0), 0x1ff, &(0x7f0000fff000/0x1000)=nil, 0x3) setsockopt$sock_int(r0, 0x1, 0x3c, &(0x7f0000d4effc)=0x1, 0x4) connect$inet(r0, &(0x7f0000000000)={0x2, 0x4e20, @dev={0xac, 0x14, 0x14, 0x18}}, 0x10) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f00000001c0)='tunl0\x00', 0x5) sendto$inet(r0, &(0x7f00006d1fd4)="db", 0x1, 0x4000010, &(0x7f00004daff0)={0x2, 0x0, @loopback, [0x0, 0x0, 0x4900]}, 0x10) 13:17:27 executing program 6: clone(0x802102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000040), 0xffffffffffffffff) r0 = syz_open_dev$sndtimer(&(0x7f0000000000)='/dev/snd/timer\x00', 0x0, 0x0) r1 = getpid() sched_setscheduler(r1, 0x5, &(0x7f0000000200)) ioctl$SNDRV_TIMER_IOCTL_GPARAMS(r0, 0x40485404, &(0x7f0000000240)={{}, 0x0, 0x2000000000000000, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x300000000000000]}) [ 1549.597402] binder: 17524:17531 BC_REQUEST_DEATH_NOTIFICATION invalid ref 4 13:17:27 executing program 4: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = gettid() perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x3e5}, 0x0, 0x0, 0xffffffffffffffff, 0x0) fcntl$setown(r0, 0x8, r1) bind$inet6(r0, &(0x7f0000807fe4)={0xa, 0x4e22}, 0x1c) sendto$inet6(r0, &(0x7f0000000380), 0x0, 0x200408d4, &(0x7f000072e000)={0xa, 0x4e22, 0x0, @loopback}, 0x1c) sendto$inet6(r0, &(0x7f0000ad6fad)='\x00', 0x1, 0x3fffffd, &(0x7f0000254000)={0xa, 0x0, 0x0, @loopback}, 0x1c) 13:17:27 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r0, &(0x7f0000942000)={0x2, 0x4e20, @multicast1}, 0x10) sendmsg$key(0xffffffffffffffff, &(0x7f0000f56000)={0x0, 0x0, &(0x7f00008feff0)={&(0x7f0000000500)=ANY=[@ANYBLOB="020300090a1500000000000000000000030006190000000002000000e0000001003f00000000000002000100e625aa66dcef85847e479eb3c49000000400000000fd003e"], 0x44}}, 0x0) add_key(&(0x7f0000000080)='logon\x00', &(0x7f0000000100)={0x73, 0x79, 0x7a, 0x1}, &(0x7f0000001240), 0x0, 0xfffffffffffffff8) get_mempolicy(&(0x7f0000000000), &(0x7f00000001c0), 0x1ff, &(0x7f0000fff000/0x1000)=nil, 0x3) setsockopt$sock_int(r0, 0x1, 0x3c, &(0x7f0000d4effc)=0x1, 0x4) connect$inet(r0, &(0x7f0000000000)={0x2, 0x4e20, @dev={0xac, 0x14, 0x14, 0x18}}, 0x10) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f00000001c0)='tunl0\x00', 0x5) sendto$inet(r0, &(0x7f00006d1fd4)="db", 0x1, 0x4000010, &(0x7f00004daff0)={0x2, 0x0, @loopback, [0x0, 0x0, 0x240]}, 0x10) 13:17:27 executing program 7: r0 = openat$cuse(0xffffffffffffff9c, &(0x7f0000000080)='/dev/cuse\x00', 0x2, 0x0) clone(0x1002102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000640), 0xffffffffffffffff) r1 = getpid() sched_setscheduler(r1, 0x5, &(0x7f0000000000)) write$FUSE_NOTIFY_DELETE(r0, &(0x7f0000000040)={0x29, 0x6, 0x0, {0xa0008000}}, 0x29) 13:17:27 executing program 5: r0 = syz_open_dev$binder(&(0x7f00000021c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000002340)={0x34, 0x0, &(0x7f0000002240)=[@request_death={0x400c630e, 0x4, 0x4}, @increfs={0x40046304, 0x4}, @increfs_done={0x40106308, 0x0, 0x3}, @increfs], 0x77, 0x0, &(0x7f00000022c0)="b3cd0976d8e2af743c6f523efe14fd20c3c3dd2572784282a761e1b4304e2599c85f198cc82bd5d0c74c4edca2f9ea7b875ff7047ec0784fbb354e15fd3f7d837f533597d5082692a6f2fb748da3cc4157188f7f2a5477ded56f72f5b75c96872db429e44b8fcd781d96dead77a0b58b7af9085a208a22"}) 13:17:27 executing program 3: r0 = openat$cuse(0xffffffffffffff9c, &(0x7f0000000080)='/dev/cuse\x00', 0x2, 0x0) clone(0x1002102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000640), 0xffffffffffffffff) r1 = getpid() sched_setscheduler(r1, 0x5, &(0x7f0000000000)) write$FUSE_NOTIFY_DELETE(r0, &(0x7f0000000040)={0x29, 0x4, 0xb00}, 0x29) 13:17:27 executing program 6: clone(0x802102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000040), 0xffffffffffffffff) r0 = syz_open_dev$sndtimer(&(0x7f0000000000)='/dev/snd/timer\x00', 0x0, 0x0) r1 = getpid() sched_setscheduler(r1, 0x5, &(0x7f0000000200)) ioctl$SNDRV_TIMER_IOCTL_GPARAMS(r0, 0x40485404, &(0x7f0000000240)={{}, 0x0, 0x2000000000000000, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1000000]}) 13:17:28 executing program 0: perf_event_open(&(0x7f0000000040)={0x2, 0x70, 0x3e5}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f00000021c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000002340)={0xb5, 0x5, &(0x7f00000000c0)=ANY=[@ANYBLOB="0463044000000000b6a571ac965f26c50d500dae115e59afcd8a338d8b2727193c56d4ebef60c214b766ffde6cff6ceef2baa2594a53a0117e77afd5d58e8a35afdae81b258585ce769507333c0238790d5ed750bf1d6ca2a873050056528fce7becfd12f165ac43a826d3462822ff8f29ea992d4e208847cf4fc10ca00b87b5ce2523fa477bad0be1c97e4398aa2ac81d973b5a871d8e0b295e436cd8415f19088c6c82c85f4ed1fac41da062bc6dbfb8eac4276c"], 0x0, 0x0, &(0x7f00000022c0)}) 13:17:28 executing program 6: clone(0x802102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000040), 0xffffffffffffffff) r0 = syz_open_dev$sndtimer(&(0x7f0000000000)='/dev/snd/timer\x00', 0x0, 0x0) r1 = getpid() sched_setscheduler(r1, 0x5, &(0x7f0000000200)) ioctl$SNDRV_TIMER_IOCTL_GPARAMS(r0, 0x40485404, &(0x7f0000000240)={{}, 0x0, 0x2000000000000000, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3000000]}) 13:17:28 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r0, &(0x7f0000942000)={0x2, 0x4e20, @multicast1}, 0x10) sendmsg$key(0xffffffffffffffff, &(0x7f0000f56000)={0x0, 0x0, &(0x7f00008feff0)={&(0x7f0000000500)=ANY=[@ANYBLOB="020300090a1500000000000000000000030006190000000002000000e0000001003f00000000000002000100e625aa66dcef85847e479eb3c49000000400000000fd003e"], 0x44}}, 0x0) add_key(&(0x7f0000000080)='logon\x00', &(0x7f0000000100)={0x73, 0x79, 0x7a, 0x1}, &(0x7f0000001240), 0x0, 0xfffffffffffffff8) get_mempolicy(&(0x7f0000000000), &(0x7f00000001c0), 0x1ff, &(0x7f0000fff000/0x1000)=nil, 0x3) setsockopt$sock_int(r0, 0x1, 0x3c, &(0x7f0000d4effc)=0x1, 0x4) connect$inet(r0, &(0x7f0000000000)={0x2, 0x4e20, @dev={0xac, 0x14, 0x14, 0x18}}, 0x10) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f00000001c0)='tunl0\x00', 0x5) sendto$inet(r0, &(0x7f00006d1fd4)="db", 0x1, 0x4000010, &(0x7f00004daff0)={0x2, 0x0, @loopback, [0x0, 0x0, 0x8002a0]}, 0x10) [ 1549.903958] binder_thread_write: 20 callbacks suppressed [ 1549.903973] binder: 17561:17566 IncRefs 0 refcount change on invalid ref 4 ret -22 13:17:28 executing program 4: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = gettid() perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x3e5}, 0x0, 0x0, 0xffffffffffffffff, 0x0) fcntl$setown(r0, 0x8, r1) bind$inet6(r0, &(0x7f0000807fe4)={0xa, 0x4e22}, 0x1c) sendto$inet6(r0, &(0x7f0000000380), 0x0, 0x200408d4, &(0x7f000072e000)={0xa, 0x4e22, 0x0, @loopback}, 0x1c) sendto$inet6(r0, &(0x7f0000ad6fad)='\x00', 0x1, 0x3fffffd, &(0x7f0000254000)={0xa, 0x0, 0x0, @loopback}, 0x1c) [ 1549.946930] binder_thread_write: 5 callbacks suppressed [ 1549.946943] binder: 17561:17566 BC_INCREFS_DONE u0000000000000000 no match [ 1549.985991] binder: 17561:17566 IncRefs 0 refcount change on invalid ref 0 ret -22 13:17:28 executing program 3: r0 = openat$cuse(0xffffffffffffff9c, &(0x7f0000000080)='/dev/cuse\x00', 0x2, 0x0) clone(0x1002102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000640), 0xffffffffffffffff) r1 = getpid() sched_setscheduler(r1, 0x5, &(0x7f0000000000)) write$FUSE_NOTIFY_DELETE(r0, &(0x7f0000000040)={0x29, 0x4, 0xc}, 0x29) 13:17:28 executing program 7: r0 = openat$cuse(0xffffffffffffff9c, &(0x7f0000000080)='/dev/cuse\x00', 0x2, 0x0) clone(0x1002102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000640), 0xffffffffffffffff) r1 = getpid() sched_setscheduler(r1, 0x5, &(0x7f0000000000)) write$FUSE_NOTIFY_DELETE(r0, &(0x7f0000000040)={0x29, 0x6, 0x0, {0x7}}, 0x29) 13:17:28 executing program 6: clone(0x802102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000040), 0xffffffffffffffff) r0 = syz_open_dev$sndtimer(&(0x7f0000000000)='/dev/snd/timer\x00', 0x0, 0x0) r1 = getpid() sched_setscheduler(r1, 0x5, &(0x7f0000000200)) ioctl$SNDRV_TIMER_IOCTL_GPARAMS(r0, 0x40485404, &(0x7f0000000240)={{}, 0x0, 0x2000000000000000, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x300]}) 13:17:28 executing program 5: r0 = syz_open_dev$binder(&(0x7f00000021c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000002340)={0x34, 0x0, &(0x7f0000002240)=[@request_death={0x400c630e, 0x4, 0x4}, @increfs={0x40046304, 0x4}, @increfs_done={0x40106308, 0x0, 0x3}, @increfs], 0x77, 0x0, &(0x7f00000022c0)="b3cd0976d8e2af743c6f523efe14fd20c3c3dd25722e4282a761e1b4304e2599c85f198cc82bd5d0c74c4edca2f9ea7b875ff7047ec0784fbb354e15fd3f7d837f533597d5082692a6f2fb748da3cc4157188f7f2a5477ded56f72f5b75c96872db429e44b8fcd781d96dead77a0b58b7af9085a208a22"}) 13:17:28 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r0, &(0x7f0000942000)={0x2, 0x4e20, @multicast1}, 0x10) sendmsg$key(0xffffffffffffffff, &(0x7f0000f56000)={0x0, 0x0, &(0x7f00008feff0)={&(0x7f0000000500)=ANY=[@ANYBLOB="020300090a1500000000000000000000030006190000000002000000e0000001003f00000000000002000100e625aa66dcef85847e479eb3c49000000400000000fd003e"], 0x44}}, 0x0) add_key(&(0x7f0000000080)='logon\x00', &(0x7f0000000100)={0x73, 0x79, 0x7a, 0x1}, &(0x7f0000001240), 0x0, 0xfffffffffffffff8) get_mempolicy(&(0x7f0000000000), &(0x7f00000001c0), 0x1ff, &(0x7f0000fff000/0x1000)=nil, 0x3) setsockopt$sock_int(r0, 0x1, 0x3c, &(0x7f0000d4effc)=0x1, 0x4) connect$inet(r0, &(0x7f0000000000)={0x2, 0x4e20, @dev={0xac, 0x14, 0x14, 0x18}}, 0x10) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f00000001c0)='tunl0\x00', 0x5) sendto$inet(r0, &(0x7f00006d1fd4)="db", 0x1, 0x4000010, &(0x7f00004daff0)={0x2, 0x0, @loopback, [0x0, 0x0, 0x11000000]}, 0x10) 13:17:28 executing program 7: r0 = openat$cuse(0xffffffffffffff9c, &(0x7f0000000080)='/dev/cuse\x00', 0x2, 0x0) clone(0x1002102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000640), 0xffffffffffffffff) r1 = getpid() sched_setscheduler(r1, 0x5, &(0x7f0000000000)) write$FUSE_NOTIFY_DELETE(r0, &(0x7f0000000040)={0x29, 0x6, 0x0, {0x600000000000000}}, 0x29) 13:17:28 executing program 3: r0 = openat$cuse(0xffffffffffffff9c, &(0x7f0000000080)='/dev/cuse\x00', 0x2, 0x0) clone(0x1002102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000640), 0xffffffffffffffff) r1 = getpid() sched_setscheduler(r1, 0x5, &(0x7f0000000000)) write$FUSE_NOTIFY_DELETE(r0, &(0x7f0000000040)={0x29, 0x4, 0x2000000}, 0x29) 13:17:28 executing program 1: r0 = socket$netlink(0x10, 0x3, 0x8000000004) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_TCP_CONGESTION(r1, 0x6, 0xd, &(0x7f0000000180)='vegas\x00', 0x6) bind$inet6(r1, &(0x7f00001fefe4)={0xa, 0x4e22}, 0x1c) sendto$inet6(r1, &(0x7f0000000100), 0x8d2d601e8976aa5, 0x20000004, &(0x7f000031e000)={0xa, 0x4e22}, 0x1c) writev(r0, &(0x7f0000000100)=[{&(0x7f0000000000)="580000001400192340834b80040d8c560a067fc162ff81004e220000000058000b4824ca944f64009400050028925aa8000000000000008000f0fffeffff09000000fff5dd00000010000100000c0900fcff0000040e05a5", 0x58}], 0x1) 13:17:28 executing program 4: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = gettid() perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x3e5}, 0x0, 0x0, 0xffffffffffffffff, 0x0) fcntl$setown(r0, 0x8, r1) bind$inet6(r0, &(0x7f0000807fe4)={0xa, 0x4e22}, 0x1c) sendto$inet6(r0, &(0x7f0000000380), 0x0, 0x200408d4, &(0x7f000072e000)={0xa, 0x4e22, 0x0, @loopback}, 0x1c) sendto$inet6(r0, &(0x7f0000ad6fad)="02", 0x1, 0x3fffffd, &(0x7f0000254000)={0xa, 0x0, 0x0, @loopback}, 0x1c) [ 1550.207374] binder: 17606:17610 unknown command -1241513984 [ 1550.213557] binder: 17606:17610 ioctl c0306201 20002340 returned -22 [ 1550.223233] binder: 17606:17612 unknown command -1241513984 [ 1550.235057] binder: 17606:17612 ioctl c0306201 20002340 returned -22 13:17:28 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r0, &(0x7f0000942000)={0x2, 0x4e20, @multicast1}, 0x10) sendmsg$key(0xffffffffffffffff, &(0x7f0000f56000)={0x0, 0x0, &(0x7f00008feff0)={&(0x7f0000000500)=ANY=[@ANYBLOB="020300090a1500000000000000000000030006190000000002000000e0000001003f00000000000002000100e625aa66dcef85847e479eb3c49000000400000000fd003e"], 0x44}}, 0x0) add_key(&(0x7f0000000080)='logon\x00', &(0x7f0000000100)={0x73, 0x79, 0x7a, 0x1}, &(0x7f0000001240), 0x0, 0xfffffffffffffff8) get_mempolicy(&(0x7f0000000000), &(0x7f00000001c0), 0x1ff, &(0x7f0000fff000/0x1000)=nil, 0x3) setsockopt$sock_int(r0, 0x1, 0x3c, &(0x7f0000d4effc)=0x1, 0x4) connect$inet(r0, &(0x7f0000000000)={0x2, 0x4e20, @dev={0xac, 0x14, 0x14, 0x18}}, 0x10) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f00000001c0)='tunl0\x00', 0x5) sendto$inet(r0, &(0x7f00006d1fd4)="db", 0x1, 0x4000010, &(0x7f00004daff0)={0x2, 0x0, @loopback, [0x0, 0x0, 0x8000a0]}, 0x10) 13:17:28 executing program 6: clone(0x802102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000040), 0xffffffffffffffff) r0 = syz_open_dev$sndtimer(&(0x7f0000000000)='/dev/snd/timer\x00', 0x0, 0x0) r1 = getpid() sched_setscheduler(r1, 0x5, &(0x7f0000000200)) ioctl$SNDRV_TIMER_IOCTL_GPARAMS(r0, 0x40485404, &(0x7f0000000240)={{}, 0x0, 0x2000000000000000, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1000000]}) 13:17:28 executing program 3: r0 = openat$cuse(0xffffffffffffff9c, &(0x7f0000000080)='/dev/cuse\x00', 0x2, 0x0) clone(0x1002102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000640), 0xffffffffffffffff) r1 = getpid() sched_setscheduler(r1, 0x5, &(0x7f0000000000)) write$FUSE_NOTIFY_DELETE(r0, &(0x7f0000000040)={0x29, 0x4, 0x900000000000000}, 0x29) [ 1550.315122] binder: 17623:17626 IncRefs 0 refcount change on invalid ref 4 ret -22 [ 1550.346778] binder: 17623:17626 BC_INCREFS_DONE u0000000000000000 no match [ 1550.390960] binder: 17623:17626 IncRefs 0 refcount change on invalid ref 0 ret -22 13:17:28 executing program 0: perf_event_open(&(0x7f0000000040)={0x2, 0x70, 0x3e5}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f00000021c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000002340)={0xb5, 0x1a0, &(0x7f00000000c0)=ANY=[@ANYBLOB="0463044000000000b6a571ac965f26c50d500dae115e59afcd8a338d8b2727193c56d4ebef60c214b766ffde6cff6ceef2baa2594a53a0117e77afd5d58e8a35afdae81b258585ce769507333c0238790d5ed750bf1d6ca2a873050056528fce7becfd12f165ac43a826d3462822ff8f29ea992d4e208847cf4fc10ca00b87b5ce2523fa477bad0be1c97e4398aa2ac81d973b5a871d8e0b295e436cd8415f19088c6c82c85f4ed1fac41da062bc6dbfb8eac4276c"], 0x0, 0x0, &(0x7f00000022c0)}) 13:17:28 executing program 7: r0 = openat$cuse(0xffffffffffffff9c, &(0x7f0000000080)='/dev/cuse\x00', 0x2, 0x0) clone(0x1002102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000640), 0xffffffffffffffff) r1 = getpid() sched_setscheduler(r1, 0x5, &(0x7f0000000000)) write$FUSE_NOTIFY_DELETE(r0, &(0x7f0000000040)={0x29, 0x6, 0x0, {0x700}}, 0x29) 13:17:28 executing program 5: r0 = syz_open_dev$binder(&(0x7f00000021c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000002340)={0x34, 0x0, &(0x7f0000002240)=[@request_death={0x400c630e, 0x4, 0x4}, @increfs={0x40046304, 0x4}, @increfs_done={0x40106308, 0x0, 0x3}, @increfs], 0x77, 0x0, &(0x7f00000022c0)="b3cd0976d8e2af743c6f523efe14fd20c3c3dd2572754282a761e1b4304e2599c85f198cc82bd5d0c74c4edca2f9ea7b875ff7047ec0784fbb354e15fd3f7d837f533597d5082692a6f2fb748da3cc4157188f7f2a5477ded56f72f5b75c96872db429e44b8fcd781d96dead77a0b58b7af9085a208a22"}) 13:17:28 executing program 3: r0 = openat$cuse(0xffffffffffffff9c, &(0x7f0000000080)='/dev/cuse\x00', 0x2, 0x0) clone(0x1002102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000640), 0xffffffffffffffff) r1 = getpid() sched_setscheduler(r1, 0x5, &(0x7f0000000000)) write$FUSE_NOTIFY_DELETE(r0, &(0x7f0000000040)={0x29, 0x4, 0x6000000}, 0x29) 13:17:28 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r0, &(0x7f0000942000)={0x2, 0x4e20, @multicast1}, 0x10) sendmsg$key(0xffffffffffffffff, &(0x7f0000f56000)={0x0, 0x0, &(0x7f00008feff0)={&(0x7f0000000500)=ANY=[@ANYBLOB="020300090a1500000000000000000000030006190000000002000000e0000001003f00000000000002000100e625aa66dcef85847e479eb3c49000000400000000fd003e"], 0x44}}, 0x0) add_key(&(0x7f0000000080)='logon\x00', &(0x7f0000000100)={0x73, 0x79, 0x7a, 0x1}, &(0x7f0000001240), 0x0, 0xfffffffffffffff8) get_mempolicy(&(0x7f0000000000), &(0x7f00000001c0), 0x1ff, &(0x7f0000fff000/0x1000)=nil, 0x3) setsockopt$sock_int(r0, 0x1, 0x3c, &(0x7f0000d4effc)=0x1, 0x4) connect$inet(r0, &(0x7f0000000000)={0x2, 0x4e20, @dev={0xac, 0x14, 0x14, 0x18}}, 0x10) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f00000001c0)='tunl0\x00', 0x5) sendto$inet(r0, &(0x7f00006d1fd4)="db", 0x1, 0x4000010, &(0x7f00004daff0)={0x2, 0x0, @loopback, [0x0, 0x0, 0x1f4]}, 0x10) 13:17:28 executing program 6: clone(0x802102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000040), 0xffffffffffffffff) r0 = syz_open_dev$sndtimer(&(0x7f0000000000)='/dev/snd/timer\x00', 0x0, 0x0) r1 = getpid() sched_setscheduler(r1, 0x5, &(0x7f0000000200)) ioctl$SNDRV_TIMER_IOCTL_GPARAMS(r0, 0x40485404, &(0x7f0000000240)={{}, 0x0, 0x2000000000000000, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3000000]}) 13:17:28 executing program 7: r0 = openat$cuse(0xffffffffffffff9c, &(0x7f0000000080)='/dev/cuse\x00', 0x2, 0x0) clone(0x1002102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000640), 0xffffffffffffffff) r1 = getpid() sched_setscheduler(r1, 0x5, &(0x7f0000000000)) write$FUSE_NOTIFY_DELETE(r0, &(0x7f0000000040)={0x29, 0x6, 0x0, {0xb00}}, 0x29) 13:17:28 executing program 7: r0 = openat$cuse(0xffffffffffffff9c, &(0x7f0000000080)='/dev/cuse\x00', 0x2, 0x0) clone(0x1002102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000640), 0xffffffffffffffff) r1 = getpid() sched_setscheduler(r1, 0x5, &(0x7f0000000000)) write$FUSE_NOTIFY_DELETE(r0, &(0x7f0000000040)={0x29, 0x6, 0x0, {0xb000000}}, 0x29) [ 1550.601240] binder: 17669:17675 IncRefs 0 refcount change on invalid ref 4 ret -22 [ 1550.612328] binder: 17669:17675 BC_INCREFS_DONE u0000000000000000 no match [ 1550.621972] binder: 17669:17675 IncRefs 0 refcount change on invalid ref 0 ret -22 13:17:28 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r0, &(0x7f0000942000)={0x2, 0x4e20, @multicast1}, 0x10) sendmsg$key(0xffffffffffffffff, &(0x7f0000f56000)={0x0, 0x0, &(0x7f00008feff0)={&(0x7f0000000500)=ANY=[@ANYBLOB="020300090a1500000000000000000000030006190000000002000000e0000001003f00000000000002000100e625aa66dcef85847e479eb3c49000000400000000fd003e"], 0x44}}, 0x0) add_key(&(0x7f0000000080)='logon\x00', &(0x7f0000000100)={0x73, 0x79, 0x7a, 0x1}, &(0x7f0000001240), 0x0, 0xfffffffffffffff8) get_mempolicy(&(0x7f0000000000), &(0x7f00000001c0), 0x1ff, &(0x7f0000fff000/0x1000)=nil, 0x3) setsockopt$sock_int(r0, 0x1, 0x3c, &(0x7f0000d4effc)=0x1, 0x4) connect$inet(r0, &(0x7f0000000000)={0x2, 0x4e20, @dev={0xac, 0x14, 0x14, 0x18}}, 0x10) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f00000001c0)='tunl0\x00', 0x5) sendto$inet(r0, &(0x7f00006d1fd4)="db", 0x1, 0x4000010, &(0x7f00004daff0)={0x2, 0x0, @loopback, [0x0, 0x0, 0x8000a0ffffffff]}, 0x10) 13:17:28 executing program 5: r0 = syz_open_dev$binder(&(0x7f00000021c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000002340)={0x34, 0x0, &(0x7f0000002240)=[@request_death={0x400c630e, 0x4, 0x4}, @increfs={0x40046304, 0x4}, @increfs_done={0x40106308, 0x0, 0x3}, @increfs], 0x77, 0x0, &(0x7f00000022c0)="b3cd0976d8e2af743c6f523efe14fd20c3c3dd25720a4282a761e1b4304e2599c85f198cc82bd5d0c74c4edca2f9ea7b875ff7047ec0784fbb354e15fd3f7d837f533597d5082692a6f2fb748da3cc4157188f7f2a5477ded56f72f5b75c96872db429e44b8fcd781d96dead77a0b58b7af9085a208a22"}) 13:17:28 executing program 3: r0 = openat$cuse(0xffffffffffffff9c, &(0x7f0000000080)='/dev/cuse\x00', 0x2, 0x0) clone(0x1002102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000640), 0xffffffffffffffff) r1 = getpid() sched_setscheduler(r1, 0x5, &(0x7f0000000000)) write$FUSE_NOTIFY_DELETE(r0, &(0x7f0000000040)={0x29, 0x4, 0x300000000000000}, 0x29) [ 1550.830216] binder: 17709:17711 IncRefs 0 refcount change on invalid ref 4 ret -22 [ 1550.843073] binder: 17709:17711 BC_INCREFS_DONE u0000000000000000 no match [ 1550.852111] binder: 17709:17711 IncRefs 0 refcount change on invalid ref 0 ret -22 13:17:29 executing program 1: r0 = socket$netlink(0x10, 0x3, 0x8000000004) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_TCP_CONGESTION(r1, 0x6, 0xd, &(0x7f0000000180)='vegas\x00', 0x6) bind$inet6(r1, &(0x7f00001fefe4)={0xa, 0x4e22}, 0x1c) sendto$inet6(r1, &(0x7f0000000100), 0x8d2d601e8976aa5, 0x20000004, &(0x7f000031e000)={0xa, 0x4e22}, 0x1c) writev(r0, &(0x7f0000000100)=[{&(0x7f0000000000)="580000001400192340834b80040d8c560a067fe737ff81004e220000000058000b4824ca944f64009400050028925aa8000000000000008000f0fffeffff09000000fff5dd00000010000100000c0900fcff0000040e05a5", 0x58}], 0x1) 13:17:29 executing program 6: clone(0x802102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000040), 0xffffffffffffffff) r0 = syz_open_dev$sndtimer(&(0x7f0000000000)='/dev/snd/timer\x00', 0x0, 0x0) r1 = getpid() sched_setscheduler(r1, 0x5, &(0x7f0000000200)) ioctl$SNDRV_TIMER_IOCTL_GPARAMS(r0, 0x40485404, &(0x7f0000000240)={{}, 0x0, 0x2000000000000000, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x300]}) 13:17:29 executing program 7: r0 = openat$cuse(0xffffffffffffff9c, &(0x7f0000000080)='/dev/cuse\x00', 0x2, 0x0) clone(0x1002102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000640), 0xffffffffffffffff) r1 = getpid() sched_setscheduler(r1, 0x5, &(0x7f0000000000)) write$FUSE_NOTIFY_DELETE(r0, &(0x7f0000000040)={0x29, 0x6, 0x0, {0x6000000}}, 0x29) 13:17:29 executing program 3: r0 = openat$cuse(0xffffffffffffff9c, &(0x7f0000000080)='/dev/cuse\x00', 0x2, 0x0) clone(0x1002102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000640), 0xffffffffffffffff) r1 = getpid() sched_setscheduler(r1, 0x5, &(0x7f0000000000)) write$FUSE_NOTIFY_DELETE(r0, &(0x7f0000000040)={0x29, 0x4, 0x7000000}, 0x29) 13:17:29 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r0, &(0x7f0000942000)={0x2, 0x4e20, @multicast1}, 0x10) sendmsg$key(0xffffffffffffffff, &(0x7f0000f56000)={0x0, 0x0, &(0x7f00008feff0)={&(0x7f0000000500)=ANY=[@ANYBLOB="020300090a1500000000000000000000030006190000000002000000e0000001003f00000000000002000100e625aa66dcef85847e479eb3c49000000400000000fd003e"], 0x44}}, 0x0) add_key(&(0x7f0000000080)='logon\x00', &(0x7f0000000100)={0x73, 0x79, 0x7a, 0x1}, &(0x7f0000001240), 0x0, 0xfffffffffffffff8) get_mempolicy(&(0x7f0000000000), &(0x7f00000001c0), 0x1ff, &(0x7f0000fff000/0x1000)=nil, 0x3) setsockopt$sock_int(r0, 0x1, 0x3c, &(0x7f0000d4effc)=0x1, 0x4) connect$inet(r0, &(0x7f0000000000)={0x2, 0x4e20, @dev={0xac, 0x14, 0x14, 0x18}}, 0x10) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f00000001c0)='tunl0\x00', 0x5) sendto$inet(r0, &(0x7f00006d1fd4)="db", 0x1, 0x4000010, &(0x7f00004daff0)={0x2, 0x0, @loopback, [0x0, 0x0, 0x1100000000000000]}, 0x10) 13:17:29 executing program 4: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = gettid() perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x3e5}, 0x0, 0x0, 0xffffffffffffffff, 0x0) fcntl$setown(r0, 0x8, r1) bind$inet6(r0, &(0x7f0000807fe4)={0xa, 0x4e22}, 0x1c) sendto$inet6(r0, &(0x7f0000000380), 0x0, 0x200408d4, &(0x7f000072e000)={0xa, 0x4e22, 0x0, @loopback}, 0x1c) sendto$inet6(r0, &(0x7f0000ad6fad)='\x00', 0x1, 0x3fffffd, &(0x7f0000254000)={0xa, 0x0, 0x0, @loopback}, 0x1c) 13:17:29 executing program 5: r0 = syz_open_dev$binder(&(0x7f00000021c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000002340)={0x34, 0x0, &(0x7f0000002240)=[@request_death={0x400c630e, 0x4, 0x4}, @increfs={0x40046304, 0x4}, @increfs_done={0x40106308, 0x0, 0x3}, @increfs], 0x77, 0x0, &(0x7f00000022c0)="b3cd0976d8e2af743c6f523efe14fd20c3c3dd2572634282a761e1b4304e2599c85f198cc82bd5d0c74c4edca2f9ea7b875ff7047ec0784fbb354e15fd3f7d837f533597d5082692a6f2fb748da3cc4157188f7f2a5477ded56f72f5b75c96872db429e44b8fcd781d96dead77a0b58b7af9085a208a22"}) 13:17:29 executing program 0: perf_event_open(&(0x7f0000000040)={0x2, 0x70, 0x3e5}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f00000021c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000002340)={0xb5, 0x5000000, &(0x7f00000000c0)=ANY=[@ANYBLOB="0463044000000000b6a571ac965f26c50d500dae115e59afcd8a338d8b2727193c56d4ebef60c214b766ffde6cff6ceef2baa2594a53a0117e77afd5d58e8a35afdae81b258585ce769507333c0238790d5ed750bf1d6ca2a873050056528fce7becfd12f165ac43a826d3462822ff8f29ea992d4e208847cf4fc10ca00b87b5ce2523fa477bad0be1c97e4398aa2ac81d973b5a871d8e0b295e436cd8415f19088c6c82c85f4ed1fac41da062bc6dbfb8eac4276c"], 0x0, 0x0, &(0x7f00000022c0)}) [ 1551.173677] binder: 17728:17737 IncRefs 0 refcount change on invalid ref 4 ret -22 [ 1551.212202] binder: 17728:17737 BC_INCREFS_DONE u0000000000000000 no match 13:17:29 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r0, &(0x7f0000942000)={0x2, 0x4e20, @multicast1}, 0x10) sendmsg$key(0xffffffffffffffff, &(0x7f0000f56000)={0x0, 0x0, &(0x7f00008feff0)={&(0x7f0000000500)=ANY=[@ANYBLOB="020300090a1500000000000000000000030006190000000002000000e0000001003f00000000000002000100e625aa66dcef85847e479eb3c49000000400000000fd003e"], 0x44}}, 0x0) add_key(&(0x7f0000000080)='logon\x00', &(0x7f0000000100)={0x73, 0x79, 0x7a, 0x1}, &(0x7f0000001240), 0x0, 0xfffffffffffffff8) get_mempolicy(&(0x7f0000000000), &(0x7f00000001c0), 0x1ff, &(0x7f0000fff000/0x1000)=nil, 0x3) setsockopt$sock_int(r0, 0x1, 0x3c, &(0x7f0000d4effc)=0x1, 0x4) connect$inet(r0, &(0x7f0000000000)={0x2, 0x4e20, @dev={0xac, 0x14, 0x14, 0x18}}, 0x10) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f00000001c0)='tunl0\x00', 0x5) sendto$inet(r0, &(0x7f00006d1fd4)="db", 0x1, 0x4000010, &(0x7f00004daff0)={0x2, 0x0, @loopback, [0x0, 0x0, 0x300000000000000]}, 0x10) [ 1551.220066] binder: 17728:17737 IncRefs 0 refcount change on invalid ref 0 ret -22 13:17:29 executing program 5: r0 = syz_open_dev$binder(&(0x7f00000021c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000002340)={0x34, 0x0, &(0x7f0000002240)=[@request_death={0x400c630e, 0x4, 0x4}, @increfs={0x40046304, 0x4}, @increfs_done={0x40106308, 0x0, 0x3}, @increfs], 0x77, 0x0, &(0x7f00000022c0)="b3cd0976d8e2af743c6f523efe14fd20c3c3dd25722a4282a761e1b4304e2599c85f198cc82bd5d0c74c4edca2f9ea7b875ff7047ec0784fbb354e15fd3f7d837f533597d5082692a6f2fb748da3cc4157188f7f2a5477ded56f72f5b75c96872db429e44b8fcd781d96dead77a0b58b7af9085a208a22"}) 13:17:29 executing program 7: r0 = openat$cuse(0xffffffffffffff9c, &(0x7f0000000080)='/dev/cuse\x00', 0x2, 0x0) clone(0x1002102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000640), 0xffffffffffffffff) r1 = getpid() sched_setscheduler(r1, 0x5, &(0x7f0000000000)) write$FUSE_NOTIFY_DELETE(r0, &(0x7f0000000040)={0x29, 0x6, 0x0, {0x2000000}}, 0x29) [ 1551.320548] binder: 17759:17760 BC_INCREFS_DONE u0000000000000000 no match 13:17:29 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r0, &(0x7f0000942000)={0x2, 0x4e20, @multicast1}, 0x10) sendmsg$key(0xffffffffffffffff, &(0x7f0000f56000)={0x0, 0x0, &(0x7f00008feff0)={&(0x7f0000000500)=ANY=[@ANYBLOB="020300090a1500000000000000000000030006190000000002000000e0000001003f00000000000002000100e625aa66dcef85847e479eb3c49000000400000000fd003e"], 0x44}}, 0x0) add_key(&(0x7f0000000080)='logon\x00', &(0x7f0000000100)={0x73, 0x79, 0x7a, 0x1}, &(0x7f0000001240), 0x0, 0xfffffffffffffff8) get_mempolicy(&(0x7f0000000000), &(0x7f00000001c0), 0x1ff, &(0x7f0000fff000/0x1000)=nil, 0x3) setsockopt$sock_int(r0, 0x1, 0x3c, &(0x7f0000d4effc)=0x1, 0x4) connect$inet(r0, &(0x7f0000000000)={0x2, 0x4e20, @dev={0xac, 0x14, 0x14, 0x18}}, 0x10) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f00000001c0)='tunl0\x00', 0x5) sendto$inet(r0, &(0x7f00006d1fd4)="db", 0x1, 0x4000010, &(0x7f00004daff0)={0x2, 0x0, @loopback, [0x0, 0x0, 0x10]}, 0x10) 13:17:29 executing program 5: r0 = syz_open_dev$binder(&(0x7f00000021c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000002340)={0x34, 0x0, &(0x7f0000002240)=[@request_death={0x400c630e, 0x4, 0x4}, @increfs={0x40046304, 0x4}, @increfs_done={0x40106308, 0x0, 0x3}, @increfs], 0x77, 0x0, &(0x7f00000022c0)="b3cd0976d8e2af743c6f523efe14fd20c3c3dd2572234282a761e1b4304e2599c85f198cc82bd5d0c74c4edca2f9ea7b875ff7047ec0784fbb354e15fd3f7d837f533597d5082692a6f2fb748da3cc4157188f7f2a5477ded56f72f5b75c96872db429e44b8fcd781d96dead77a0b58b7af9085a208a22"}) 13:17:29 executing program 6: clone(0x802102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000040), 0xffffffffffffffff) r0 = syz_open_dev$sndtimer(&(0x7f0000000000)='/dev/snd/timer\x00', 0x0, 0x0) r1 = getpid() sched_setscheduler(r1, 0x5, &(0x7f0000000200)) ioctl$SNDRV_TIMER_IOCTL_GPARAMS(r0, 0x40485404, &(0x7f0000000240)={{}, 0x0, 0x2000000000000000, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3]}) 13:17:29 executing program 3: r0 = openat$cuse(0xffffffffffffff9c, &(0x7f0000000080)='/dev/cuse\x00', 0x2, 0x0) clone(0x1002102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000640), 0xffffffffffffffff) r1 = getpid() sched_setscheduler(r1, 0x5, &(0x7f0000000000)) write$FUSE_NOTIFY_DELETE(r0, &(0x7f0000000040)={0x29, 0x4, 0xa00}, 0x29) 13:17:29 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r0, &(0x7f0000942000)={0x2, 0x4e20, @multicast1}, 0x10) sendmsg$key(0xffffffffffffffff, &(0x7f0000f56000)={0x0, 0x0, &(0x7f00008feff0)={&(0x7f0000000500)=ANY=[@ANYBLOB="020300090a1500000000000000000000030006190000000002000000e0000001003f00000000000002000100e625aa66dcef85847e479eb3c49000000400000000fd003e"], 0x44}}, 0x0) add_key(&(0x7f0000000080)='logon\x00', &(0x7f0000000100)={0x73, 0x79, 0x7a, 0x1}, &(0x7f0000001240), 0x0, 0xfffffffffffffff8) get_mempolicy(&(0x7f0000000000), &(0x7f00000001c0), 0x1ff, &(0x7f0000fff000/0x1000)=nil, 0x3) setsockopt$sock_int(r0, 0x1, 0x3c, &(0x7f0000d4effc)=0x1, 0x4) connect$inet(r0, &(0x7f0000000000)={0x2, 0x4e20, @dev={0xac, 0x14, 0x14, 0x18}}, 0x10) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f00000001c0)='tunl0\x00', 0x5) sendto$inet(r0, &(0x7f00006d1fd4)="db", 0x1, 0x4000010, &(0x7f00004daff0)={0x2, 0x0, @loopback, [0x0, 0x0, 0xe]}, 0x10) [ 1551.508289] binder: 17782:17785 BC_INCREFS_DONE u0000000000000000 no match 13:17:30 executing program 1: r0 = socket$netlink(0x10, 0x3, 0x8000000004) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_TCP_CONGESTION(r1, 0x6, 0xd, &(0x7f0000000180)='vegas\x00', 0x6) bind$inet6(r1, &(0x7f00001fefe4)={0xa, 0x4e22}, 0x1c) sendto$inet6(r1, &(0x7f0000000100), 0x8d2d601e8976aa5, 0x20000004, &(0x7f000031e000)={0xa, 0x4e22}, 0x1c) writev(r0, &(0x7f0000000100)=[{&(0x7f0000000000)="580000001400192340834b80040d8c560a067fc101ff81004e220000000058000b4824ca944f64009400050028925aa8000000000000008000f0fffeffff09000000fff5dd00000010000100000c0900fcff0000040e05a5", 0x58}], 0x1) 13:17:30 executing program 5: r0 = syz_open_dev$binder(&(0x7f00000021c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000002340)={0x34, 0x0, &(0x7f0000002240)=[@request_death={0x400c630e, 0x4, 0x4}, @increfs={0x40046304, 0x4}, @increfs_done={0x40106308, 0x0, 0x3}, @increfs], 0x77, 0x0, &(0x7f00000022c0)="b3cd0976d8e2af743c6f523efe14fd20c3c3dd25722b4282a761e1b4304e2599c85f198cc82bd5d0c74c4edca2f9ea7b875ff7047ec0784fbb354e15fd3f7d837f533597d5082692a6f2fb748da3cc4157188f7f2a5477ded56f72f5b75c96872db429e44b8fcd781d96dead77a0b58b7af9085a208a22"}) 13:17:30 executing program 3: r0 = openat$cuse(0xffffffffffffff9c, &(0x7f0000000080)='/dev/cuse\x00', 0x2, 0x0) clone(0x1002102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000640), 0xffffffffffffffff) r1 = getpid() sched_setscheduler(r1, 0x5, &(0x7f0000000000)) write$FUSE_NOTIFY_DELETE(r0, &(0x7f0000000040)={0x29, 0x4, 0x8000000000000000}, 0x29) 13:17:30 executing program 7: r0 = openat$cuse(0xffffffffffffff9c, &(0x7f0000000080)='/dev/cuse\x00', 0x2, 0x0) clone(0x1002102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000640), 0xffffffffffffffff) r1 = getpid() sched_setscheduler(r1, 0x5, &(0x7f0000000000)) write$FUSE_NOTIFY_DELETE(r0, &(0x7f0000000040)={0x29, 0x6, 0x0, {0x800000000000000}}, 0x29) 13:17:30 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r0, &(0x7f0000942000)={0x2, 0x4e20, @multicast1}, 0x10) sendmsg$key(0xffffffffffffffff, &(0x7f0000f56000)={0x0, 0x0, &(0x7f00008feff0)={&(0x7f0000000500)=ANY=[@ANYBLOB="020300090a1500000000000000000000030006190000000002000000e0000001003f00000000000002000100e625aa66dcef85847e479eb3c49000000400000000fd003e"], 0x44}}, 0x0) add_key(&(0x7f0000000080)='logon\x00', &(0x7f0000000100)={0x73, 0x79, 0x7a, 0x1}, &(0x7f0000001240), 0x0, 0xfffffffffffffff8) get_mempolicy(&(0x7f0000000000), &(0x7f00000001c0), 0x1ff, &(0x7f0000fff000/0x1000)=nil, 0x3) setsockopt$sock_int(r0, 0x1, 0x3c, &(0x7f0000d4effc)=0x1, 0x4) connect$inet(r0, &(0x7f0000000000)={0x2, 0x4e20, @dev={0xac, 0x14, 0x14, 0x18}}, 0x10) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f00000001c0)='tunl0\x00', 0x5) sendto$inet(r0, &(0x7f00006d1fd4)="db", 0x1, 0x4000010, &(0x7f00004daff0)={0x2, 0x0, @loopback, [0x0, 0x0, 0x4900000000000000]}, 0x10) 13:17:30 executing program 4: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = gettid() perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x3e5}, 0x0, 0x0, 0xffffffffffffffff, 0x0) fcntl$setown(r0, 0x8, r1) bind$inet6(r0, &(0x7f0000807fe4)={0xa, 0x4e22}, 0x1c) sendto$inet6(r0, &(0x7f0000000380), 0x0, 0x200408d4, &(0x7f000072e000)={0xa, 0x4e22, 0x0, @loopback}, 0x1c) sendto$inet6(r0, &(0x7f0000ad6fad)="04", 0x1, 0x3fffffd, &(0x7f0000254000)={0xa, 0x0, 0x0, @loopback}, 0x1c) 13:17:30 executing program 6: clone(0x802102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000040), 0xffffffffffffffff) r0 = syz_open_dev$sndtimer(&(0x7f0000000000)='/dev/snd/timer\x00', 0x0, 0x0) r1 = getpid() sched_setscheduler(r1, 0x5, &(0x7f0000000200)) ioctl$SNDRV_TIMER_IOCTL_GPARAMS(r0, 0x40485404, &(0x7f0000000240)={{}, 0x0, 0x2000000000000000, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x100000000000000]}) 13:17:30 executing program 0: perf_event_open(&(0x7f0000000040)={0x2, 0x70, 0x3e5}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f00000021c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000002340)={0xb5, 0xffffffffa0008000, &(0x7f00000000c0)=ANY=[@ANYBLOB="0463044000000000b6a571ac965f26c50d500dae115e59afcd8a338d8b2727193c56d4ebef60c214b766ffde6cff6ceef2baa2594a53a0117e77afd5d58e8a35afdae81b258585ce769507333c0238790d5ed750bf1d6ca2a873050056528fce7becfd12f165ac43a826d3462822ff8f29ea992d4e208847cf4fc10ca00b87b5ce2523fa477bad0be1c97e4398aa2ac81d973b5a871d8e0b295e436cd8415f19088c6c82c85f4ed1fac41da062bc6dbfb8eac4276c"], 0x0, 0x0, &(0x7f00000022c0)}) [ 1552.054005] binder: 17815:17825 BC_INCREFS_DONE u0000000000000000 no match 13:17:30 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r0, &(0x7f0000942000)={0x2, 0x4e20, @multicast1}, 0x10) sendmsg$key(0xffffffffffffffff, &(0x7f0000f56000)={0x0, 0x0, &(0x7f00008feff0)={&(0x7f0000000500)=ANY=[@ANYBLOB="020300090a1500000000000000000000030006190000000002000000e0000001003f00000000000002000100e625aa66dcef85847e479eb3c49000000400000000fd003e"], 0x44}}, 0x0) add_key(&(0x7f0000000080)='logon\x00', &(0x7f0000000100)={0x73, 0x79, 0x7a, 0x1}, &(0x7f0000001240), 0x0, 0xfffffffffffffff8) get_mempolicy(&(0x7f0000000000), &(0x7f00000001c0), 0x1ff, &(0x7f0000fff000/0x1000)=nil, 0x3) setsockopt$sock_int(r0, 0x1, 0x3c, &(0x7f0000d4effc)=0x1, 0x4) connect$inet(r0, &(0x7f0000000000)={0x2, 0x4e20, @dev={0xac, 0x14, 0x14, 0x18}}, 0x10) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f00000001c0)='tunl0\x00', 0x5) sendto$inet(r0, &(0x7f00006d1fd4)="db", 0x1, 0x4000010, &(0x7f00004daff0)={0x2, 0x0, @loopback, [0x0, 0x0, 0x1a0]}, 0x10) 13:17:30 executing program 5: r0 = syz_open_dev$binder(&(0x7f00000021c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000002340)={0x34, 0x0, &(0x7f0000002240)=[@request_death={0x400c630e, 0x4, 0x4}, @increfs={0x40046304, 0x4}, @increfs_done={0x40106308, 0x0, 0x3}, @increfs], 0x77, 0x0, &(0x7f00000022c0)="b3cd0976d8e2af743c6f523efe14fd20c3c3dd2572254282a761e1b4304e2599c85f198cc82bd5d0c74c4edca2f9ea7b875ff7047ec0784fbb354e15fd3f7d837f533597d5082692a6f2fb748da3cc4157188f7f2a5477ded56f72f5b75c96872db429e44b8fcd781d96dead77a0b58b7af9085a208a22"}) 13:17:30 executing program 5: r0 = syz_open_dev$binder(&(0x7f00000021c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000002340)={0x34, 0x0, &(0x7f0000002240)=[@request_death={0x400c630e, 0x4, 0x4}, @increfs={0x40046304, 0x4}, @increfs_done={0x40106308, 0x0, 0x3}, @increfs], 0x77, 0x0, &(0x7f00000022c0)="b3cd0976d8e2af743c6f523efe14fd20c3c3dd2572304282a761e1b4304e2599c85f198cc82bd5d0c74c4edca2f9ea7b875ff7047ec0784fbb354e15fd3f7d837f533597d5082692a6f2fb748da3cc4157188f7f2a5477ded56f72f5b75c96872db429e44b8fcd781d96dead77a0b58b7af9085a208a22"}) [ 1552.159219] binder: 17841:17842 BC_INCREFS_DONE u0000000000000000 no match 13:17:30 executing program 3: r0 = openat$cuse(0xffffffffffffff9c, &(0x7f0000000080)='/dev/cuse\x00', 0x2, 0x0) clone(0x1002102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000640), 0xffffffffffffffff) r1 = getpid() sched_setscheduler(r1, 0x5, &(0x7f0000000000)) write$FUSE_NOTIFY_DELETE(r0, &(0x7f0000000040)={0x29, 0x4, 0x700000000000000}, 0x29) 13:17:30 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r0, &(0x7f0000942000)={0x2, 0x4e20, @multicast1}, 0x10) sendmsg$key(0xffffffffffffffff, &(0x7f0000f56000)={0x0, 0x0, &(0x7f00008feff0)={&(0x7f0000000500)=ANY=[@ANYBLOB="020300090a1500000000000000000000030006190000000002000000e0000001003f00000000000002000100e625aa66dcef85847e479eb3c49000000400000000fd003e"], 0x44}}, 0x0) add_key(&(0x7f0000000080)='logon\x00', &(0x7f0000000100)={0x73, 0x79, 0x7a, 0x1}, &(0x7f0000001240), 0x0, 0xfffffffffffffff8) get_mempolicy(&(0x7f0000000000), &(0x7f00000001c0), 0x1ff, &(0x7f0000fff000/0x1000)=nil, 0x3) setsockopt$sock_int(r0, 0x1, 0x3c, &(0x7f0000d4effc)=0x1, 0x4) connect$inet(r0, &(0x7f0000000000)={0x2, 0x4e20, @dev={0xac, 0x14, 0x14, 0x18}}, 0x10) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f00000001c0)='tunl0\x00', 0x5) sendto$inet(r0, &(0x7f00006d1fd4)="db", 0x1, 0x4000010, &(0x7f00004daff0)={0x2, 0x0, @loopback, [0x0, 0x0, 0xe00]}, 0x10) 13:17:30 executing program 7: r0 = openat$cuse(0xffffffffffffff9c, &(0x7f0000000080)='/dev/cuse\x00', 0x2, 0x0) clone(0x1002102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000640), 0xffffffffffffffff) r1 = getpid() sched_setscheduler(r1, 0x5, &(0x7f0000000000)) write$FUSE_NOTIFY_DELETE(r0, &(0x7f0000000040)={0x29, 0x6, 0x0, {0xc000000}}, 0x29) [ 1552.274774] binder_thread_write: 9 callbacks suppressed [ 1552.274787] binder: 17847:17851 BC_REQUEST_DEATH_NOTIFICATION invalid ref 4 13:17:30 executing program 3: r0 = openat$cuse(0xffffffffffffff9c, &(0x7f0000000080)='/dev/cuse\x00', 0x2, 0x0) clone(0x1002102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000640), 0xffffffffffffffff) r1 = getpid() sched_setscheduler(r1, 0x5, &(0x7f0000000000)) write$FUSE_NOTIFY_DELETE(r0, &(0x7f0000000040)={0x29, 0x4, 0xb}, 0x29) 13:17:30 executing program 6: clone(0x802102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000040), 0xffffffffffffffff) r0 = syz_open_dev$sndtimer(&(0x7f0000000000)='/dev/snd/timer\x00', 0x0, 0x0) r1 = getpid() sched_setscheduler(r1, 0x5, &(0x7f0000000200)) ioctl$SNDRV_TIMER_IOCTL_GPARAMS(r0, 0x40485404, &(0x7f0000000240)={{}, 0x0, 0x2000000000000000, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x300000000000000]}) [ 1552.323621] binder: 17847:17851 BC_INCREFS_DONE u0000000000000000 no match 13:17:30 executing program 1: r0 = socket$netlink(0x10, 0x3, 0x8000000004) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_TCP_CONGESTION(r1, 0x6, 0xd, &(0x7f0000000180)='vegas\x00', 0x6) bind$inet6(r1, &(0x7f00001fefe4)={0xa, 0x4e22}, 0x1c) sendto$inet6(r1, &(0x7f0000000100), 0x8d2d601e8976aa5, 0x20000004, &(0x7f000031e000)={0xa, 0x4e22}, 0x1c) writev(r0, &(0x7f0000000100)=[{&(0x7f0000000000)="580000001400192340834b80040d8c560a067f2dc9ff81004e220000000058000b4824ca944f64009400050028925aa8000000000000008000f0fffeffff09000000fff5dd00000010000100000c0900fcff0000040e05a5", 0x58}], 0x1) 13:17:30 executing program 7: r0 = openat$cuse(0xffffffffffffff9c, &(0x7f0000000080)='/dev/cuse\x00', 0x2, 0x0) clone(0x1002102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000640), 0xffffffffffffffff) r1 = getpid() sched_setscheduler(r1, 0x5, &(0x7f0000000000)) write$FUSE_NOTIFY_DELETE(r0, &(0x7f0000000040)={0x29, 0x6, 0x0, {0x9000000}}, 0x29) 13:17:30 executing program 6: clone(0x802102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000040), 0xffffffffffffffff) r0 = syz_open_dev$sndtimer(&(0x7f0000000000)='/dev/snd/timer\x00', 0x0, 0x0) r1 = getpid() sched_setscheduler(r1, 0x5, &(0x7f0000000200)) ioctl$SNDRV_TIMER_IOCTL_GPARAMS(r0, 0x40485404, &(0x7f0000000240)={{}, 0x0, 0x2000000000000000, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3000000]}) 13:17:30 executing program 3: r0 = openat$cuse(0xffffffffffffff9c, &(0x7f0000000080)='/dev/cuse\x00', 0x2, 0x0) clone(0x1002102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000640), 0xffffffffffffffff) r1 = getpid() sched_setscheduler(r1, 0x5, &(0x7f0000000000)) write$FUSE_NOTIFY_DELETE(r0, &(0x7f0000000040)={0x29, 0x4, 0x9000000}, 0x29) 13:17:30 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r0, &(0x7f0000942000)={0x2, 0x4e20, @multicast1}, 0x10) sendmsg$key(0xffffffffffffffff, &(0x7f0000f56000)={0x0, 0x0, &(0x7f00008feff0)={&(0x7f0000000500)=ANY=[@ANYBLOB="020300090a1500000000000000000000030006190000000002000000e0000001003f00000000000002000100e625aa66dcef85847e479eb3c49000000400000000fd003e"], 0x44}}, 0x0) add_key(&(0x7f0000000080)='logon\x00', &(0x7f0000000100)={0x73, 0x79, 0x7a, 0x1}, &(0x7f0000001240), 0x0, 0xfffffffffffffff8) get_mempolicy(&(0x7f0000000000), &(0x7f00000001c0), 0x1ff, &(0x7f0000fff000/0x1000)=nil, 0x3) setsockopt$sock_int(r0, 0x1, 0x3c, &(0x7f0000d4effc)=0x1, 0x4) connect$inet(r0, &(0x7f0000000000)={0x2, 0x4e20, @dev={0xac, 0x14, 0x14, 0x18}}, 0x10) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f00000001c0)='tunl0\x00', 0x5) sendto$inet(r0, &(0x7f00006d1fd4)="db", 0x1, 0x4000010, &(0x7f00004daff0)={0x2, 0x0, @loopback, [0x0, 0x0, 0x300]}, 0x10) 13:17:30 executing program 5: r0 = syz_open_dev$binder(&(0x7f00000021c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000002340)={0x34, 0x0, &(0x7f0000002240)=[@request_death={0x400c630e, 0x4, 0x4}, @increfs={0x40046304, 0x4}, @increfs_done={0x40106308, 0x0, 0x3}, @increfs], 0x77, 0x0, &(0x7f00000022c0)="b3cd0976d8e2af743c6f523efe14fd20c3c3dd25726f4282a761e1b4304e2599c85f198cc82bd5d0c74c4edca2f9ea7b875ff7047ec0784fbb354e15fd3f7d837f533597d5082692a6f2fb748da3cc4157188f7f2a5477ded56f72f5b75c96872db429e44b8fcd781d96dead77a0b58b7af9085a208a22"}) 13:17:30 executing program 0: perf_event_open(&(0x7f0000000040)={0x2, 0x70, 0x3e5}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f00000021c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000002340)={0xb5, 0xffffff7f00000000, &(0x7f00000000c0)=ANY=[@ANYBLOB="0463044000000000b6a571ac965f26c50d500dae115e59afcd8a338d8b2727193c56d4ebef60c214b766ffde6cff6ceef2baa2594a53a0117e77afd5d58e8a35afdae81b258585ce769507333c0238790d5ed750bf1d6ca2a873050056528fce7becfd12f165ac43a826d3462822ff8f29ea992d4e208847cf4fc10ca00b87b5ce2523fa477bad0be1c97e4398aa2ac81d973b5a871d8e0b295e436cd8415f19088c6c82c85f4ed1fac41da062bc6dbfb8eac4276c"], 0x0, 0x0, &(0x7f00000022c0)}) 13:17:30 executing program 4: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = gettid() perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x3e5}, 0x0, 0x0, 0xffffffffffffffff, 0x0) fcntl$setown(r0, 0x8, r1) bind$inet6(r0, &(0x7f0000807fe4)={0xa, 0x4e22}, 0x1c) sendto$inet6(r0, &(0x7f0000000380), 0x0, 0x200408d4, &(0x7f000072e000)={0xa, 0x4e22, 0x0, @loopback}, 0x1c) sendto$inet6(r0, &(0x7f0000ad6fad)='\x00', 0x20ad6fae, 0x3fffffd, &(0x7f0000254000)={0xa, 0x0, 0x0, @loopback}, 0x1c) [ 1552.924930] binder: 17897:17909 BC_REQUEST_DEATH_NOTIFICATION invalid ref 4 13:17:31 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r0, &(0x7f0000942000)={0x2, 0x4e20, @multicast1}, 0x10) sendmsg$key(0xffffffffffffffff, &(0x7f0000f56000)={0x0, 0x0, &(0x7f00008feff0)={&(0x7f0000000500)=ANY=[@ANYBLOB="020300090a1500000000000000000000030006190000000002000000e0000001003f00000000000002000100e625aa66dcef85847e479eb3c49000000400000000fd003e"], 0x44}}, 0x0) add_key(&(0x7f0000000080)='logon\x00', &(0x7f0000000100)={0x73, 0x79, 0x7a, 0x1}, &(0x7f0000001240), 0x0, 0xfffffffffffffff8) get_mempolicy(&(0x7f0000000000), &(0x7f00000001c0), 0x1ff, &(0x7f0000fff000/0x1000)=nil, 0x3) setsockopt$sock_int(r0, 0x1, 0x3c, &(0x7f0000d4effc)=0x1, 0x4) connect$inet(r0, &(0x7f0000000000)={0x2, 0x4e20, @dev={0xac, 0x14, 0x14, 0x18}}, 0x10) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f00000001c0)='tunl0\x00', 0x5) sendto$inet(r0, &(0x7f00006d1fd4)="db", 0x1, 0x4000010, &(0x7f00004daff0)={0x2, 0x0, @loopback, [0x0, 0x0, 0x7]}, 0x10) 13:17:31 executing program 5: r0 = syz_open_dev$binder(&(0x7f00000021c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000002340)={0x34, 0x0, &(0x7f0000002240)=[@request_death={0x400c630e, 0x4, 0x4}, @increfs={0x40046304, 0x4}, @increfs_done={0x40106308, 0x0, 0x3}, @increfs], 0x77, 0x0, &(0x7f00000022c0)="b3cd0976d8e2af743c6f523efe14fd20c3c3dd2572730a82a761e1b4304e2599c85f198cc82bd5d0c74c4edca2f9ea7b875ff7047ec0784fbb354e15fd3f7d837f533597d5082692a6f2fb748da3cc4157188f7f2a5477ded56f72f5b75c96872db429e44b8fcd781d96dead77a0b58b7af9085a208a22"}) 13:17:31 executing program 3: r0 = openat$cuse(0xffffffffffffff9c, &(0x7f0000000080)='/dev/cuse\x00', 0x2, 0x0) clone(0x1002102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000640), 0xffffffffffffffff) r1 = getpid() sched_setscheduler(r1, 0x5, &(0x7f0000000000)) write$FUSE_NOTIFY_DELETE(r0, &(0x7f0000000040)={0x29, 0x4, 0xa000000}, 0x29) 13:17:31 executing program 7: r0 = openat$cuse(0xffffffffffffff9c, &(0x7f0000000080)='/dev/cuse\x00', 0x2, 0x0) clone(0x1002102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000640), 0xffffffffffffffff) r1 = getpid() sched_setscheduler(r1, 0x5, &(0x7f0000000000)) write$FUSE_NOTIFY_DELETE(r0, &(0x7f0000000040)={0x29, 0x6, 0x0, {0xffffffffa0008000}}, 0x29) 13:17:31 executing program 6: clone(0x802102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000040), 0xffffffffffffffff) r0 = syz_open_dev$sndtimer(&(0x7f0000000000)='/dev/snd/timer\x00', 0x0, 0x0) r1 = getpid() sched_setscheduler(r1, 0x5, &(0x7f0000000200)) ioctl$SNDRV_TIMER_IOCTL_GPARAMS(r0, 0x40485404, &(0x7f0000000240)={{}, 0x0, 0x2000000000000000, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x300]}) 13:17:31 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r0, &(0x7f0000942000)={0x2, 0x4e20, @multicast1}, 0x10) sendmsg$key(0xffffffffffffffff, &(0x7f0000f56000)={0x0, 0x0, &(0x7f00008feff0)={&(0x7f0000000500)=ANY=[@ANYBLOB="020300090a1500000000000000000000030006190000000002000000e0000001003f00000000000002000100e625aa66dcef85847e479eb3c49000000400000000fd003e"], 0x44}}, 0x0) add_key(&(0x7f0000000080)='logon\x00', &(0x7f0000000100)={0x73, 0x79, 0x7a, 0x1}, &(0x7f0000001240), 0x0, 0xfffffffffffffff8) get_mempolicy(&(0x7f0000000000), &(0x7f00000001c0), 0x1ff, &(0x7f0000fff000/0x1000)=nil, 0x3) setsockopt$sock_int(r0, 0x1, 0x3c, &(0x7f0000d4effc)=0x1, 0x4) connect$inet(r0, &(0x7f0000000000)={0x2, 0x4e20, @dev={0xac, 0x14, 0x14, 0x18}}, 0x10) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f00000001c0)='tunl0\x00', 0x5) sendto$inet(r0, &(0x7f00006d1fd4)="db", 0x1, 0x4000010, &(0x7f00004daff0)={0x2, 0x0, @loopback, [0x0, 0x0, 0x100000000000000]}, 0x10) 13:17:31 executing program 6: clone(0x802102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000040), 0xffffffffffffffff) r0 = syz_open_dev$sndtimer(&(0x7f0000000000)='/dev/snd/timer\x00', 0x0, 0x0) r1 = getpid() sched_setscheduler(r1, 0x5, &(0x7f0000000200)) ioctl$SNDRV_TIMER_IOCTL_GPARAMS(r0, 0x40485404, &(0x7f0000000240)={{}, 0x0, 0x2000000000000000, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3]}) 13:17:31 executing program 7: r0 = openat$cuse(0xffffffffffffff9c, &(0x7f0000000080)='/dev/cuse\x00', 0x2, 0x0) clone(0x1002102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000640), 0xffffffffffffffff) r1 = getpid() sched_setscheduler(r1, 0x5, &(0x7f0000000000)) write$FUSE_NOTIFY_DELETE(r0, &(0x7f0000000040)={0x29, 0x6, 0x0, {0x200000000000000}}, 0x29) [ 1553.151404] binder: 17947:17948 BC_REQUEST_DEATH_NOTIFICATION invalid ref 4 13:17:31 executing program 1: r0 = socket$netlink(0x10, 0x3, 0x8000000004) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_TCP_CONGESTION(r1, 0x6, 0xd, &(0x7f0000000180)='vegas\x00', 0x6) bind$inet6(r1, &(0x7f00001fefe4)={0xa, 0x4e22}, 0x1c) sendto$inet6(r1, &(0x7f0000000100), 0x8d2d601e8976aa5, 0x20000004, &(0x7f000031e000)={0xa, 0x4e22}, 0x1c) writev(r0, &(0x7f0000000100)=[{&(0x7f0000000000)="580000001400192340834b80040d8c560a067ff574ff81004e220000000058000b4824ca944f64009400050028925aa8000000000000008000f0fffeffff09000000fff5dd00000010000100000c0900fcff0000040e05a5", 0x58}], 0x1) 13:17:31 executing program 3: r0 = openat$cuse(0xffffffffffffff9c, &(0x7f0000000080)='/dev/cuse\x00', 0x2, 0x0) clone(0x1002102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000640), 0xffffffffffffffff) r1 = getpid() sched_setscheduler(r1, 0x5, &(0x7f0000000000)) write$FUSE_NOTIFY_DELETE(r0, &(0x7f0000000040)={0x29, 0x4, 0x1000000}, 0x29) 13:17:31 executing program 5: r0 = syz_open_dev$binder(&(0x7f00000021c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000002340)={0x34, 0x0, &(0x7f0000002240)=[@request_death={0x400c630e, 0x4, 0x4}, @increfs={0x40046304, 0x4}, @increfs_done={0x40106308, 0x0, 0x3}, @increfs], 0x77, 0x0, &(0x7f00000022c0)="b3cd0976d8e2af743c6f523efe14fd20c3c3dd2572734c82a761e1b4304e2599c85f198cc82bd5d0c74c4edca2f9ea7b875ff7047ec0784fbb354e15fd3f7d837f533597d5082692a6f2fb748da3cc4157188f7f2a5477ded56f72f5b75c96872db429e44b8fcd781d96dead77a0b58b7af9085a208a22"}) 13:17:31 executing program 6: clone(0x802102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000040), 0xffffffffffffffff) r0 = syz_open_dev$sndtimer(&(0x7f0000000000)='/dev/snd/timer\x00', 0x0, 0x0) r1 = getpid() sched_setscheduler(r1, 0x5, &(0x7f0000000200)) ioctl$SNDRV_TIMER_IOCTL_GPARAMS(r0, 0x40485404, &(0x7f0000000240)={{}, 0x0, 0x2000000000000000, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x100000000000000]}) 13:17:31 executing program 4: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = gettid() perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x3e5}, 0x0, 0x0, 0xffffffffffffffff, 0x0) fcntl$setown(r0, 0x8, r1) bind$inet6(r0, &(0x7f0000807fe4)={0xa, 0x4e22}, 0x1c) sendto$inet6(r0, &(0x7f0000000380), 0x0, 0x200408d4, &(0x7f000072e000)={0xa, 0x4e22, 0x0, @loopback}, 0x1c) sendto$inet6(r0, &(0x7f0000ad6fad)='\x00', 0x2, 0x3fffffd, &(0x7f0000254000)={0xa, 0x0, 0x0, @loopback}, 0x1c) 13:17:31 executing program 7: r0 = openat$cuse(0xffffffffffffff9c, &(0x7f0000000080)='/dev/cuse\x00', 0x2, 0x0) clone(0x1002102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000640), 0xffffffffffffffff) r1 = getpid() sched_setscheduler(r1, 0x5, &(0x7f0000000000)) write$FUSE_NOTIFY_DELETE(r0, &(0x7f0000000040)={0x29, 0x6, 0x0, {0x900000000000000}}, 0x29) 13:17:31 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r0, &(0x7f0000942000)={0x2, 0x4e20, @multicast1}, 0x10) sendmsg$key(0xffffffffffffffff, &(0x7f0000f56000)={0x0, 0x0, &(0x7f00008feff0)={&(0x7f0000000500)=ANY=[@ANYBLOB="020300090a1500000000000000000000030006190000000002000000e0000001003f00000000000002000100e625aa66dcef85847e479eb3c49000000400000000fd003e"], 0x44}}, 0x0) add_key(&(0x7f0000000080)='logon\x00', &(0x7f0000000100)={0x73, 0x79, 0x7a, 0x1}, &(0x7f0000001240), 0x0, 0xfffffffffffffff8) get_mempolicy(&(0x7f0000000000), &(0x7f00000001c0), 0x1ff, &(0x7f0000fff000/0x1000)=nil, 0x3) setsockopt$sock_int(r0, 0x1, 0x3c, &(0x7f0000d4effc)=0x1, 0x4) connect$inet(r0, &(0x7f0000000000)={0x2, 0x4e20, @dev={0xac, 0x14, 0x14, 0x18}}, 0x10) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f00000001c0)='tunl0\x00', 0x5) sendto$inet(r0, &(0x7f00006d1fd4)="db", 0x1, 0x4000010, &(0x7f00004daff0)={0x2, 0x0, @loopback, [0x0, 0x0, 0x142800]}, 0x10) 13:17:31 executing program 0: perf_event_open(&(0x7f0000000040)={0x2, 0x70, 0x3e5}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f00000021c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000002340)={0xb5, 0x6000000000000000, &(0x7f00000000c0)=ANY=[@ANYBLOB="0463044000000000b6a571ac965f26c50d500dae115e59afcd8a338d8b2727193c56d4ebef60c214b766ffde6cff6ceef2baa2594a53a0117e77afd5d58e8a35afdae81b258585ce769507333c0238790d5ed750bf1d6ca2a873050056528fce7becfd12f165ac43a826d3462822ff8f29ea992d4e208847cf4fc10ca00b87b5ce2523fa477bad0be1c97e4398aa2ac81d973b5a871d8e0b295e436cd8415f19088c6c82c85f4ed1fac41da062bc6dbfb8eac4276c"], 0x0, 0x0, &(0x7f00000022c0)}) [ 1553.808980] binder: 17985:17990 BC_REQUEST_DEATH_NOTIFICATION invalid ref 4 13:17:31 executing program 5: r0 = syz_open_dev$binder(&(0x7f00000021c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000002340)={0x34, 0x0, &(0x7f0000002240)=[@request_death={0x400c630e, 0x4, 0x4}, @increfs={0x40046304, 0x4}, @increfs_done={0x40106308, 0x0, 0x3}, @increfs], 0x77, 0x0, &(0x7f00000022c0)="b3cd0976d8e2af743c6f523efe14fd20c3c3dd2572734d82a761e1b4304e2599c85f198cc82bd5d0c74c4edca2f9ea7b875ff7047ec0784fbb354e15fd3f7d837f533597d5082692a6f2fb748da3cc4157188f7f2a5477ded56f72f5b75c96872db429e44b8fcd781d96dead77a0b58b7af9085a208a22"}) 13:17:31 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r0, &(0x7f0000942000)={0x2, 0x4e20, @multicast1}, 0x10) sendmsg$key(0xffffffffffffffff, &(0x7f0000f56000)={0x0, 0x0, &(0x7f00008feff0)={&(0x7f0000000500)=ANY=[@ANYBLOB="020300090a1500000000000000000000030006190000000002000000e0000001003f00000000000002000100e625aa66dcef85847e479eb3c49000000400000000fd003e"], 0x44}}, 0x0) add_key(&(0x7f0000000080)='logon\x00', &(0x7f0000000100)={0x73, 0x79, 0x7a, 0x1}, &(0x7f0000001240), 0x0, 0xfffffffffffffff8) get_mempolicy(&(0x7f0000000000), &(0x7f00000001c0), 0x1ff, &(0x7f0000fff000/0x1000)=nil, 0x3) setsockopt$sock_int(r0, 0x1, 0x3c, &(0x7f0000d4effc)=0x1, 0x4) connect$inet(r0, &(0x7f0000000000)={0x2, 0x4e20, @dev={0xac, 0x14, 0x14, 0x18}}, 0x10) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f00000001c0)='tunl0\x00', 0x5) sendto$inet(r0, &(0x7f00006d1fd4)="db", 0x1, 0x4000010, &(0x7f00004daff0)={0x2, 0x0, @loopback, [0x0, 0x0, 0x1100]}, 0x10) 13:17:32 executing program 6: clone(0x802102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000040), 0xffffffffffffffff) r0 = syz_open_dev$sndtimer(&(0x7f0000000000)='/dev/snd/timer\x00', 0x0, 0x0) r1 = getpid() sched_setscheduler(r1, 0x5, &(0x7f0000000200)) ioctl$SNDRV_TIMER_IOCTL_GPARAMS(r0, 0x40485404, &(0x7f0000000240)={{}, 0x0, 0x2000000000000000, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x300000000000000]}) 13:17:32 executing program 3: r0 = openat$cuse(0xffffffffffffff9c, &(0x7f0000000080)='/dev/cuse\x00', 0x2, 0x0) clone(0x1002102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000640), 0xffffffffffffffff) r1 = getpid() sched_setscheduler(r1, 0x5, &(0x7f0000000000)) write$FUSE_NOTIFY_DELETE(r0, &(0x7f0000000040)={0x29, 0x4, 0x500}, 0x29) 13:17:32 executing program 6: clone(0x802102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000040), 0xffffffffffffffff) r0 = syz_open_dev$sndtimer(&(0x7f0000000000)='/dev/snd/timer\x00', 0x0, 0x0) r1 = getpid() sched_setscheduler(r1, 0x5, &(0x7f0000000200)) ioctl$SNDRV_TIMER_IOCTL_GPARAMS(r0, 0x40485404, &(0x7f0000000240)={{}, 0x0, 0x2000000000000000, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1000000]}) [ 1553.939751] binder: 18013:18018 BC_REQUEST_DEATH_NOTIFICATION invalid ref 4 13:17:32 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r0, &(0x7f0000942000)={0x2, 0x4e20, @multicast1}, 0x10) sendmsg$key(0xffffffffffffffff, &(0x7f0000f56000)={0x0, 0x0, &(0x7f00008feff0)={&(0x7f0000000500)=ANY=[@ANYBLOB="020300090a1500000000000000000000030006190000000002000000e0000001003f00000000000002000100e625aa66dcef85847e479eb3c49000000400000000fd003e"], 0x44}}, 0x0) add_key(&(0x7f0000000080)='logon\x00', &(0x7f0000000100)={0x73, 0x79, 0x7a, 0x1}, &(0x7f0000001240), 0x0, 0xfffffffffffffff8) get_mempolicy(&(0x7f0000000000), &(0x7f00000001c0), 0x1ff, &(0x7f0000fff000/0x1000)=nil, 0x3) setsockopt$sock_int(r0, 0x1, 0x3c, &(0x7f0000d4effc)=0x1, 0x4) connect$inet(r0, &(0x7f0000000000)={0x2, 0x4e20, @dev={0xac, 0x14, 0x14, 0x18}}, 0x10) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f00000001c0)='tunl0\x00', 0x5) sendto$inet(r0, &(0x7f00006d1fd4)="db", 0x1, 0x4000010, &(0x7f00004daff0)={0x2, 0x0, @loopback, [0x0, 0x0, 0xa000000]}, 0x10) 13:17:32 executing program 5: r0 = syz_open_dev$binder(&(0x7f00000021c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000002340)={0x34, 0x0, &(0x7f0000002240)=[@request_death={0x400c630e, 0x4, 0x4}, @increfs={0x40046304, 0x4}, @increfs_done={0x40106308, 0x0, 0x3}, @increfs], 0x77, 0x0, &(0x7f00000022c0)="b3cd0976d8e2af743c6f523efe14fd20c3c3dd2572735482a761e1b4304e2599c85f198cc82bd5d0c74c4edca2f9ea7b875ff7047ec0784fbb354e15fd3f7d837f533597d5082692a6f2fb748da3cc4157188f7f2a5477ded56f72f5b75c96872db429e44b8fcd781d96dead77a0b58b7af9085a208a22"}) 13:17:32 executing program 3: r0 = openat$cuse(0xffffffffffffff9c, &(0x7f0000000080)='/dev/cuse\x00', 0x2, 0x0) clone(0x1002102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000640), 0xffffffffffffffff) r1 = getpid() sched_setscheduler(r1, 0x5, &(0x7f0000000000)) write$FUSE_NOTIFY_DELETE(r0, &(0x7f0000000040)={0x29, 0x4, 0x7}, 0x29) [ 1554.184917] binder: 18042:18048 BC_REQUEST_DEATH_NOTIFICATION invalid ref 4 13:17:32 executing program 1: r0 = socket$netlink(0x10, 0x3, 0x8000000004) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_TCP_CONGESTION(r1, 0x6, 0xd, &(0x7f0000000180)='vegas\x00', 0x6) bind$inet6(r1, &(0x7f00001fefe4)={0xa, 0x4e22}, 0x1c) sendto$inet6(r1, &(0x7f0000000100), 0x8d2d601e8976aa5, 0x20000004, &(0x7f000031e000)={0xa, 0x4e22}, 0x1c) writev(r0, &(0x7f0000000100)=[{&(0x7f0000000000)="580000001400192340834b80040d8c560a067f6b0dff81004e220000000058000b4824ca944f64009400050028925aa8000000000000008000f0fffeffff09000000fff5dd00000010000100000c0900fcff0000040e05a5", 0x58}], 0x1) 13:17:32 executing program 7: r0 = openat$cuse(0xffffffffffffff9c, &(0x7f0000000080)='/dev/cuse\x00', 0x2, 0x0) clone(0x1002102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000640), 0xffffffffffffffff) r1 = getpid() sched_setscheduler(r1, 0x5, &(0x7f0000000000)) write$FUSE_NOTIFY_DELETE(r0, &(0x7f0000000040)={0x29, 0x6, 0x0, {0x8000a0}}, 0x29) 13:17:32 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r0, &(0x7f0000942000)={0x2, 0x4e20, @multicast1}, 0x10) sendmsg$key(0xffffffffffffffff, &(0x7f0000f56000)={0x0, 0x0, &(0x7f00008feff0)={&(0x7f0000000500)=ANY=[@ANYBLOB="020300090a1500000000000000000000030006190000000002000000e0000001003f00000000000002000100e625aa66dcef85847e479eb3c49000000400000000fd003e"], 0x44}}, 0x0) add_key(&(0x7f0000000080)='logon\x00', &(0x7f0000000100)={0x73, 0x79, 0x7a, 0x1}, &(0x7f0000001240), 0x0, 0xfffffffffffffff8) get_mempolicy(&(0x7f0000000000), &(0x7f00000001c0), 0x1ff, &(0x7f0000fff000/0x1000)=nil, 0x3) setsockopt$sock_int(r0, 0x1, 0x3c, &(0x7f0000d4effc)=0x1, 0x4) connect$inet(r0, &(0x7f0000000000)={0x2, 0x4e20, @dev={0xac, 0x14, 0x14, 0x18}}, 0x10) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f00000001c0)='tunl0\x00', 0x5) sendto$inet(r0, &(0x7f00006d1fd4)="db", 0x1, 0x4000010, &(0x7f00004daff0)={0x2, 0x0, @loopback, [0x0, 0x0, 0x49000000]}, 0x10) 13:17:32 executing program 3: r0 = openat$cuse(0xffffffffffffff9c, &(0x7f0000000080)='/dev/cuse\x00', 0x2, 0x0) clone(0x1002102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000640), 0xffffffffffffffff) r1 = getpid() sched_setscheduler(r1, 0x5, &(0x7f0000000000)) write$FUSE_NOTIFY_DELETE(r0, &(0x7f0000000040)={0x29, 0x4, 0xa}, 0x29) 13:17:32 executing program 5: r0 = syz_open_dev$binder(&(0x7f00000021c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000002340)={0x34, 0x0, &(0x7f0000002240)=[@request_death={0x400c630e, 0x4, 0x4}, @increfs={0x40046304, 0x4}, @increfs_done={0x40106308, 0x0, 0x3}, @increfs], 0x77, 0x0, &(0x7f00000022c0)="b3cd0976d8e2af743c6f523efe14fd20c3c3dd2572730982a761e1b4304e2599c85f198cc82bd5d0c74c4edca2f9ea7b875ff7047ec0784fbb354e15fd3f7d837f533597d5082692a6f2fb748da3cc4157188f7f2a5477ded56f72f5b75c96872db429e44b8fcd781d96dead77a0b58b7af9085a208a22"}) 13:17:32 executing program 6: clone(0x802102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000040), 0xffffffffffffffff) r0 = syz_open_dev$sndtimer(&(0x7f0000000000)='/dev/snd/timer\x00', 0x0, 0x0) r1 = getpid() sched_setscheduler(r1, 0x5, &(0x7f0000000200)) ioctl$SNDRV_TIMER_IOCTL_GPARAMS(r0, 0x40485404, &(0x7f0000000240)={{}, 0x0, 0x2000000000000000, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3000000]}) 13:17:32 executing program 4: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = gettid() perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x3e5}, 0x0, 0x0, 0xffffffffffffffff, 0x0) fcntl$setown(r0, 0x8, r1) bind$inet6(r0, &(0x7f0000807fe4)={0xa, 0x4e22}, 0x1c) sendto$inet6(r0, &(0x7f0000000380), 0x0, 0x200408d4, &(0x7f000072e000)={0xa, 0x4e22, 0x0, @loopback}, 0x1c) sendto$inet6(r0, &(0x7f0000ad6fad)='\x00', 0x300, 0x3fffffd, &(0x7f0000254000)={0xa, 0x0, 0x0, @loopback}, 0x1c) 13:17:32 executing program 0: perf_event_open(&(0x7f0000000040)={0x2, 0x70, 0x3e5}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f00000021c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000002340)={0xb5, 0x7000000, &(0x7f00000000c0)=ANY=[@ANYBLOB="0463044000000000b6a571ac965f26c50d500dae115e59afcd8a338d8b2727193c56d4ebef60c214b766ffde6cff6ceef2baa2594a53a0117e77afd5d58e8a35afdae81b258585ce769507333c0238790d5ed750bf1d6ca2a873050056528fce7becfd12f165ac43a826d3462822ff8f29ea992d4e208847cf4fc10ca00b87b5ce2523fa477bad0be1c97e4398aa2ac81d973b5a871d8e0b295e436cd8415f19088c6c82c85f4ed1fac41da062bc6dbfb8eac4276c"], 0x0, 0x0, &(0x7f00000022c0)}) [ 1554.710407] binder: 18072:18077 BC_REQUEST_DEATH_NOTIFICATION invalid ref 4 13:17:32 executing program 7: r0 = openat$cuse(0xffffffffffffff9c, &(0x7f0000000080)='/dev/cuse\x00', 0x2, 0x0) clone(0x1002102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000640), 0xffffffffffffffff) r1 = getpid() sched_setscheduler(r1, 0x5, &(0x7f0000000000)) write$FUSE_NOTIFY_DELETE(r0, &(0x7f0000000040)={0x29, 0x6, 0x0, {0x300}}, 0x29) 13:17:32 executing program 5: r0 = syz_open_dev$binder(&(0x7f00000021c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000002340)={0x34, 0x0, &(0x7f0000002240)=[@request_death={0x400c630e, 0x4, 0x4}, @increfs={0x40046304, 0x4}, @increfs_done={0x40106308, 0x0, 0x3}, @increfs], 0x77, 0x0, &(0x7f00000022c0)="b3cd0976d8e2af743c6f523efe14fd20c3c3dd2572736382a761e1b4304e2599c85f198cc82bd5d0c74c4edca2f9ea7b875ff7047ec0784fbb354e15fd3f7d837f533597d5082692a6f2fb748da3cc4157188f7f2a5477ded56f72f5b75c96872db429e44b8fcd781d96dead77a0b58b7af9085a208a22"}) 13:17:32 executing program 6: clone(0x802102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000040), 0xffffffffffffffff) r0 = syz_open_dev$sndtimer(&(0x7f0000000000)='/dev/snd/timer\x00', 0x0, 0x0) r1 = getpid() sched_setscheduler(r1, 0x5, &(0x7f0000000200)) ioctl$SNDRV_TIMER_IOCTL_GPARAMS(r0, 0x40485404, &(0x7f0000000240)={{}, 0x0, 0x2000000000000000, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x300]}) 13:17:32 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r0, &(0x7f0000942000)={0x2, 0x4e20, @multicast1}, 0x10) sendmsg$key(0xffffffffffffffff, &(0x7f0000f56000)={0x0, 0x0, &(0x7f00008feff0)={&(0x7f0000000500)=ANY=[@ANYBLOB="020300090a1500000000000000000000030006190000000002000000e0000001003f00000000000002000100e625aa66dcef85847e479eb3c49000000400000000fd003e"], 0x44}}, 0x0) add_key(&(0x7f0000000080)='logon\x00', &(0x7f0000000100)={0x73, 0x79, 0x7a, 0x1}, &(0x7f0000001240), 0x0, 0xfffffffffffffff8) get_mempolicy(&(0x7f0000000000), &(0x7f00000001c0), 0x1ff, &(0x7f0000fff000/0x1000)=nil, 0x3) setsockopt$sock_int(r0, 0x1, 0x3c, &(0x7f0000d4effc)=0x1, 0x4) connect$inet(r0, &(0x7f0000000000)={0x2, 0x4e20, @dev={0xac, 0x14, 0x14, 0x18}}, 0x10) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f00000001c0)='tunl0\x00', 0x5) sendto$inet(r0, &(0x7f00006d1fd4)="db", 0x1, 0x4000010, &(0x7f00004daff0)={0x2, 0x0, @loopback, [0x0, 0x0, 0x8]}, 0x10) 13:17:32 executing program 3: r0 = openat$cuse(0xffffffffffffff9c, &(0x7f0000000080)='/dev/cuse\x00', 0x2, 0x0) clone(0x1002102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000640), 0xffffffffffffffff) r1 = getpid() sched_setscheduler(r1, 0x5, &(0x7f0000000000)) write$FUSE_NOTIFY_DELETE(r0, &(0x7f0000000040)={0x29, 0x4, 0x5}, 0x29) 13:17:33 executing program 0: perf_event_open(&(0x7f0000000040)={0x2, 0x70, 0x3e5}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f00000021c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000002340)={0xb5, 0x6000000, &(0x7f00000000c0)=ANY=[@ANYBLOB="0463044000000000b6a571ac965f26c50d500dae115e59afcd8a338d8b2727193c56d4ebef60c214b766ffde6cff6ceef2baa2594a53a0117e77afd5d58e8a35afdae81b258585ce769507333c0238790d5ed750bf1d6ca2a873050056528fce7becfd12f165ac43a826d3462822ff8f29ea992d4e208847cf4fc10ca00b87b5ce2523fa477bad0be1c97e4398aa2ac81d973b5a871d8e0b295e436cd8415f19088c6c82c85f4ed1fac41da062bc6dbfb8eac4276c"], 0x0, 0x0, &(0x7f00000022c0)}) 13:17:33 executing program 4: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = gettid() perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x3e5}, 0x0, 0x0, 0xffffffffffffffff, 0x0) fcntl$setown(r0, 0x8, r1) bind$inet6(r0, &(0x7f0000807fe4)={0xa, 0x4e22}, 0x1c) sendto$inet6(r0, &(0x7f0000000380), 0x0, 0x200408d4, &(0x7f000072e000)={0xa, 0x4e22, 0x0, @loopback}, 0x1c) sendto$inet6(r0, &(0x7f0000ad6fad)='\x00', 0x1, 0x3fffffd, &(0x7f0000254000)={0xa, 0xa, 0x0, @loopback}, 0x1c) 13:17:33 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r0, &(0x7f0000942000)={0x2, 0x4e20, @multicast1}, 0x10) sendmsg$key(0xffffffffffffffff, &(0x7f0000f56000)={0x0, 0x0, &(0x7f00008feff0)={&(0x7f0000000500)=ANY=[@ANYBLOB="020300090a1500000000000000000000030006190000000002000000e0000001003f00000000000002000100e625aa66dcef85847e479eb3c49000000400000000fd003e"], 0x44}}, 0x0) add_key(&(0x7f0000000080)='logon\x00', &(0x7f0000000100)={0x73, 0x79, 0x7a, 0x1}, &(0x7f0000001240), 0x0, 0xfffffffffffffff8) get_mempolicy(&(0x7f0000000000), &(0x7f00000001c0), 0x1ff, &(0x7f0000fff000/0x1000)=nil, 0x3) setsockopt$sock_int(r0, 0x1, 0x3c, &(0x7f0000d4effc)=0x1, 0x4) connect$inet(r0, &(0x7f0000000000)={0x2, 0x4e20, @dev={0xac, 0x14, 0x14, 0x18}}, 0x10) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f00000001c0)='tunl0\x00', 0x5) sendto$inet(r0, &(0x7f00006d1fd4)="db", 0x1, 0x4000010, &(0x7f00004daff0)={0x2, 0x0, @loopback, [0x0, 0x0, 0xe803000000000000]}, 0x10) [ 1554.901905] binder: 18105:18113 BC_REQUEST_DEATH_NOTIFICATION invalid ref 4 [ 1554.935999] binder_thread_write: 22 callbacks suppressed [ 1554.936020] binder: 18105:18113 IncRefs 0 refcount change on invalid ref 4 ret -22 [ 1554.970914] binder_thread_write: 6 callbacks suppressed [ 1554.970931] binder: 18105:18113 BC_INCREFS_DONE u0000000000000000 no match [ 1554.984021] binder: 18105:18113 IncRefs 0 refcount change on invalid ref 0 ret -22 13:17:33 executing program 1: r0 = socket$netlink(0x10, 0x3, 0x8000000004) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_TCP_CONGESTION(r1, 0x6, 0xd, &(0x7f0000000180)='vegas\x00', 0x6) bind$inet6(r1, &(0x7f00001fefe4)={0xa, 0x4e22}, 0x1c) sendto$inet6(r1, &(0x7f0000000100), 0x8d2d601e8976aa5, 0x20000004, &(0x7f000031e000)={0xa, 0x4e22}, 0x1c) writev(r0, &(0x7f0000000100)=[{&(0x7f0000000000)="580000001400192340834b80040d8c560a067f107aff81004e220000000058000b4824ca944f64009400050028925aa8000000000000008000f0fffeffff09000000fff5dd00000010000100000c0900fcff0000040e05a5", 0x58}], 0x1) 13:17:33 executing program 7: r0 = openat$cuse(0xffffffffffffff9c, &(0x7f0000000080)='/dev/cuse\x00', 0x2, 0x0) clone(0x1002102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000640), 0xffffffffffffffff) r1 = getpid() sched_setscheduler(r1, 0x5, &(0x7f0000000000)) write$FUSE_NOTIFY_DELETE(r0, &(0x7f0000000040)={0x29, 0x6, 0x0, {0x600}}, 0x29) 13:17:33 executing program 5: r0 = syz_open_dev$binder(&(0x7f00000021c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000002340)={0x34, 0x0, &(0x7f0000002240)=[@request_death={0x400c630e, 0x4, 0x4}, @increfs={0x40046304, 0x4}, @increfs_done={0x40106308, 0x0, 0x3}, @increfs], 0x77, 0x0, &(0x7f00000022c0)="b3cd0976d8e2af743c6f523efe14fd20c3c3dd2572734282a70ae1b4304e2599c85f198cc82bd5d0c74c4edca2f9ea7b875ff7047ec0784fbb354e15fd3f7d837f533597d5082692a6f2fb748da3cc4157188f7f2a5477ded56f72f5b75c96872db429e44b8fcd781d96dead77a0b58b7af9085a208a22"}) 13:17:33 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r0, &(0x7f0000942000)={0x2, 0x4e20, @multicast1}, 0x10) sendmsg$key(0xffffffffffffffff, &(0x7f0000f56000)={0x0, 0x0, &(0x7f00008feff0)={&(0x7f0000000500)=ANY=[@ANYBLOB="020300090a1500000000000000000000030006190000000002000000e0000001003f00000000000002000100e625aa66dcef85847e479eb3c49000000400000000fd003e"], 0x44}}, 0x0) add_key(&(0x7f0000000080)='logon\x00', &(0x7f0000000100)={0x73, 0x79, 0x7a, 0x1}, &(0x7f0000001240), 0x0, 0xfffffffffffffff8) get_mempolicy(&(0x7f0000000000), &(0x7f00000001c0), 0x1ff, &(0x7f0000fff000/0x1000)=nil, 0x3) setsockopt$sock_int(r0, 0x1, 0x3c, &(0x7f0000d4effc)=0x1, 0x4) connect$inet(r0, &(0x7f0000000000)={0x2, 0x4e20, @dev={0xac, 0x14, 0x14, 0x18}}, 0x10) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f00000001c0)='tunl0\x00', 0x5) sendto$inet(r0, &(0x7f00006d1fd4)="db", 0x1, 0x4000010, &(0x7f00004daff0)={0x2, 0x0, @loopback, [0x0, 0x0, 0xfdffffff00000000]}, 0x10) 13:17:33 executing program 6: clone(0x802102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000040), 0xffffffffffffffff) r0 = syz_open_dev$sndtimer(&(0x7f0000000000)='/dev/snd/timer\x00', 0x0, 0x0) r1 = getpid() sched_setscheduler(r1, 0x5, &(0x7f0000000200)) ioctl$SNDRV_TIMER_IOCTL_GPARAMS(r0, 0x40485404, &(0x7f0000000240)={{}, 0x0, 0x2000000000000000, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3]}) 13:17:33 executing program 3: r0 = openat$cuse(0xffffffffffffff9c, &(0x7f0000000080)='/dev/cuse\x00', 0x2, 0x0) clone(0x1002102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000640), 0xffffffffffffffff) r1 = getpid() sched_setscheduler(r1, 0x5, &(0x7f0000000000)) write$FUSE_NOTIFY_DELETE(r0, &(0x7f0000000040)={0x29, 0x4, 0x800000000000000}, 0x29) 13:17:33 executing program 0: perf_event_open(&(0x7f0000000040)={0x2, 0x70, 0x3e5}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f00000021c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000002340)={0xb5, 0x300000000000000, &(0x7f00000000c0)=ANY=[@ANYBLOB="0463044000000000b6a571ac965f26c50d500dae115e59afcd8a338d8b2727193c56d4ebef60c214b766ffde6cff6ceef2baa2594a53a0117e77afd5d58e8a35afdae81b258585ce769507333c0238790d5ed750bf1d6ca2a873050056528fce7becfd12f165ac43a826d3462822ff8f29ea992d4e208847cf4fc10ca00b87b5ce2523fa477bad0be1c97e4398aa2ac81d973b5a871d8e0b295e436cd8415f19088c6c82c85f4ed1fac41da062bc6dbfb8eac4276c"], 0x0, 0x0, &(0x7f00000022c0)}) 13:17:33 executing program 4: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = gettid() perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x3e5}, 0x0, 0x0, 0xffffffffffffffff, 0x0) fcntl$setown(r0, 0x8, r1) bind$inet6(r0, &(0x7f0000807fe4)={0xa, 0x4e22}, 0x1c) sendto$inet6(r0, &(0x7f0000000380), 0x0, 0x200408d4, &(0x7f000072e000)={0xa, 0x4e22, 0x0, @loopback}, 0x1c) sendto$inet6(r0, &(0x7f0000ad6fad)='\x00', 0x1, 0x3fffffd, &(0x7f0000254000)={0xa, 0x4002000000000000, 0x0, @loopback}, 0x1c) 13:17:33 executing program 6: clone(0x802102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000040), 0xffffffffffffffff) r0 = syz_open_dev$sndtimer(&(0x7f0000000000)='/dev/snd/timer\x00', 0x0, 0x0) r1 = getpid() sched_setscheduler(r1, 0x5, &(0x7f0000000200)) ioctl$SNDRV_TIMER_IOCTL_GPARAMS(r0, 0x40485404, &(0x7f0000000240)={{}, 0x0, 0x2000000000000000, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x100000000000000]}) [ 1555.588122] binder: 18155:18163 BC_REQUEST_DEATH_NOTIFICATION invalid ref 4 [ 1555.596158] binder: 18155:18163 IncRefs 0 refcount change on invalid ref 4 ret -22 [ 1555.605843] binder: 18155:18163 BC_INCREFS_DONE u0000000000000000 no match 13:17:33 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r0, &(0x7f0000942000)={0x2, 0x4e20, @multicast1}, 0x10) sendmsg$key(0xffffffffffffffff, &(0x7f0000f56000)={0x0, 0x0, &(0x7f00008feff0)={&(0x7f0000000500)=ANY=[@ANYBLOB="020300090a1500000000000000000000030006190000000002000000e0000001003f00000000000002000100e625aa66dcef85847e479eb3c49000000400000000fd003e"], 0x44}}, 0x0) add_key(&(0x7f0000000080)='logon\x00', &(0x7f0000000100)={0x73, 0x79, 0x7a, 0x1}, &(0x7f0000001240), 0x0, 0xfffffffffffffff8) get_mempolicy(&(0x7f0000000000), &(0x7f00000001c0), 0x1ff, &(0x7f0000fff000/0x1000)=nil, 0x3) setsockopt$sock_int(r0, 0x1, 0x3c, &(0x7f0000d4effc)=0x1, 0x4) connect$inet(r0, &(0x7f0000000000)={0x2, 0x4e20, @dev={0xac, 0x14, 0x14, 0x18}}, 0x10) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f00000001c0)='tunl0\x00', 0x5) sendto$inet(r0, &(0x7f00006d1fd4)="db", 0x1, 0x4000010, &(0x7f00004daff0)={0x2, 0x0, @loopback, [0x0, 0x0, 0x200000000000000]}, 0x10) [ 1555.652824] binder: 18155:18163 IncRefs 0 refcount change on invalid ref 0 ret -22 [ 1555.669857] binder: 18155:18163 BC_REQUEST_DEATH_NOTIFICATION invalid ref 4 [ 1555.685957] binder: 18155:18163 IncRefs 0 refcount change on invalid ref 4 ret -22 [ 1555.694666] binder: 18155:18163 BC_INCREFS_DONE u0000000000000000 no match [ 1555.712538] binder: 18155:18163 IncRefs 0 refcount change on invalid ref 0 ret -22 13:17:33 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r0, &(0x7f0000942000)={0x2, 0x4e20, @multicast1}, 0x10) sendmsg$key(0xffffffffffffffff, &(0x7f0000f56000)={0x0, 0x0, &(0x7f00008feff0)={&(0x7f0000000500)=ANY=[@ANYBLOB="020300090a1500000000000000000000030006190000000002000000e0000001003f00000000000002000100e625aa66dcef85847e479eb3c49000000400000000fd003e"], 0x44}}, 0x0) add_key(&(0x7f0000000080)='logon\x00', &(0x7f0000000100)={0x73, 0x79, 0x7a, 0x1}, &(0x7f0000001240), 0x0, 0xfffffffffffffff8) get_mempolicy(&(0x7f0000000000), &(0x7f00000001c0), 0x1ff, &(0x7f0000fff000/0x1000)=nil, 0x3) setsockopt$sock_int(r0, 0x1, 0x3c, &(0x7f0000d4effc)=0x1, 0x4) connect$inet(r0, &(0x7f0000000000)={0x2, 0x4e20, @dev={0xac, 0x14, 0x14, 0x18}}, 0x10) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f00000001c0)='tunl0\x00', 0x5) sendto$inet(r0, &(0x7f00006d1fd4)="db", 0x1, 0x4000010, &(0x7f00004daff0)={0x2, 0x0, @loopback, [0x0, 0x0, 0xa0010000]}, 0x10) 13:17:33 executing program 5: r0 = syz_open_dev$binder(&(0x7f00000021c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000002340)={0x34, 0x0, &(0x7f0000002240)=[@request_death={0x400c630e, 0x4, 0x4}, @increfs={0x40046304, 0x4}, @increfs_done={0x40106308, 0x0, 0x3}, @increfs], 0x77, 0x0, &(0x7f00000022c0)="b3cd0976d8e2af743c6f523efe14fd20c3c3dd2572734282a725e1b4304e2599c85f198cc82bd5d0c74c4edca2f9ea7b875ff7047ec0784fbb354e15fd3f7d837f533597d5082692a6f2fb748da3cc4157188f7f2a5477ded56f72f5b75c96872db429e44b8fcd781d96dead77a0b58b7af9085a208a22"}) 13:17:33 executing program 7: r0 = openat$cuse(0xffffffffffffff9c, &(0x7f0000000080)='/dev/cuse\x00', 0x2, 0x0) clone(0x1002102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000640), 0xffffffffffffffff) r1 = getpid() sched_setscheduler(r1, 0x5, &(0x7f0000000000)) write$FUSE_NOTIFY_DELETE(r0, &(0x7f0000000040)={0x29, 0x6, 0x0, {0x9}}, 0x29) 13:17:33 executing program 3: r0 = openat$cuse(0xffffffffffffff9c, &(0x7f0000000080)='/dev/cuse\x00', 0x2, 0x0) clone(0x1002102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000640), 0xffffffffffffffff) r1 = getpid() sched_setscheduler(r1, 0x5, &(0x7f0000000000)) write$FUSE_NOTIFY_DELETE(r0, &(0x7f0000000040)={0x29, 0x4, 0xa00000000000000}, 0x29) 13:17:33 executing program 6: clone(0x802102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000040), 0xffffffffffffffff) r0 = syz_open_dev$sndtimer(&(0x7f0000000000)='/dev/snd/timer\x00', 0x0, 0x0) r1 = getpid() sched_setscheduler(r1, 0x5, &(0x7f0000000200)) ioctl$SNDRV_TIMER_IOCTL_GPARAMS(r0, 0x40485404, &(0x7f0000000240)={{}, 0x0, 0x2000000000000000, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x300000000000000]}) 13:17:33 executing program 7: r0 = openat$cuse(0xffffffffffffff9c, &(0x7f0000000080)='/dev/cuse\x00', 0x2, 0x0) clone(0x1002102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000640), 0xffffffffffffffff) r1 = getpid() sched_setscheduler(r1, 0x5, &(0x7f0000000000)) write$FUSE_NOTIFY_DELETE(r0, &(0x7f0000000040)={0x29, 0x6, 0x0, {0x400000000000000}}, 0x29) [ 1555.856472] binder: 18189:18193 IncRefs 0 refcount change on invalid ref 4 ret -22 [ 1555.966281] binder: 18189:18193 BC_INCREFS_DONE u0000000000000000 no match [ 1555.973731] binder: 18189:18193 IncRefs 0 refcount change on invalid ref 0 ret -22 13:17:34 executing program 1: r0 = socket$netlink(0x10, 0x3, 0x8000000004) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_TCP_CONGESTION(r1, 0x6, 0xd, &(0x7f0000000180)='vegas\x00', 0x6) bind$inet6(r1, &(0x7f00001fefe4)={0xa, 0x4e22}, 0x1c) sendto$inet6(r1, &(0x7f0000000100), 0x8d2d601e8976aa5, 0x20000004, &(0x7f000031e000)={0xa, 0x4e22}, 0x1c) writev(r0, &(0x7f0000000100)=[{&(0x7f0000000000)="580000001400192340834b80040d8c560a067f0813ff81004e220000000058000b4824ca944f64009400050028925aa8000000000000008000f0fffeffff09000000fff5dd00000010000100000c0900fcff0000040e05a5", 0x58}], 0x1) 13:17:34 executing program 6: clone(0x802102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000040), 0xffffffffffffffff) r0 = syz_open_dev$sndtimer(&(0x7f0000000000)='/dev/snd/timer\x00', 0x0, 0x0) r1 = getpid() sched_setscheduler(r1, 0x5, &(0x7f0000000200)) ioctl$SNDRV_TIMER_IOCTL_GPARAMS(r0, 0x40485404, &(0x7f0000000240)={{}, 0x0, 0x2000000000000000, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1000000]}) 13:17:34 executing program 7: r0 = openat$cuse(0xffffffffffffff9c, &(0x7f0000000080)='/dev/cuse\x00', 0x2, 0x0) clone(0x1002102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000640), 0xffffffffffffffff) r1 = getpid() sched_setscheduler(r1, 0x5, &(0x7f0000000000)) write$FUSE_NOTIFY_DELETE(r0, &(0x7f0000000040)={0x29, 0x6, 0x0, {0x3000000}}, 0x29) 13:17:34 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r0, &(0x7f0000942000)={0x2, 0x4e20, @multicast1}, 0x10) sendmsg$key(0xffffffffffffffff, &(0x7f0000f56000)={0x0, 0x0, &(0x7f00008feff0)={&(0x7f0000000500)=ANY=[@ANYBLOB="020300090a1500000000000000000000030006190000000002000000e0000001003f00000000000002000100e625aa66dcef85847e479eb3c49000000400000000fd003e"], 0x44}}, 0x0) add_key(&(0x7f0000000080)='logon\x00', &(0x7f0000000100)={0x73, 0x79, 0x7a, 0x1}, &(0x7f0000001240), 0x0, 0xfffffffffffffff8) get_mempolicy(&(0x7f0000000000), &(0x7f00000001c0), 0x1ff, &(0x7f0000fff000/0x1000)=nil, 0x3) setsockopt$sock_int(r0, 0x1, 0x3c, &(0x7f0000d4effc)=0x1, 0x4) connect$inet(r0, &(0x7f0000000000)={0x2, 0x4e20, @dev={0xac, 0x14, 0x14, 0x18}}, 0x10) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f00000001c0)='tunl0\x00', 0x5) sendto$inet(r0, &(0x7f00006d1fd4)="db", 0x1, 0x4000010, &(0x7f00004daff0)={0x2, 0x0, @loopback, [0x0, 0x0, 0xe000000]}, 0x10) 13:17:34 executing program 0: perf_event_open(&(0x7f0000000040)={0x2, 0x70, 0x3e5}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f00000021c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000002340)={0xb5, 0x1a0ffffffff, &(0x7f00000000c0)=ANY=[@ANYBLOB="0463044000000000b6a571ac965f26c50d500dae115e59afcd8a338d8b2727193c56d4ebef60c214b766ffde6cff6ceef2baa2594a53a0117e77afd5d58e8a35afdae81b258585ce769507333c0238790d5ed750bf1d6ca2a873050056528fce7becfd12f165ac43a826d3462822ff8f29ea992d4e208847cf4fc10ca00b87b5ce2523fa477bad0be1c97e4398aa2ac81d973b5a871d8e0b295e436cd8415f19088c6c82c85f4ed1fac41da062bc6dbfb8eac4276c"], 0x0, 0x0, &(0x7f00000022c0)}) 13:17:34 executing program 4: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = gettid() perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x3e5}, 0x0, 0x0, 0xffffffffffffffff, 0x0) fcntl$setown(r0, 0x8, r1) bind$inet6(r0, &(0x7f0000807fe4)={0xa, 0x4e22}, 0x1c) sendto$inet6(r0, &(0x7f0000000380), 0x0, 0x200408d4, &(0x7f000072e000)={0xa, 0x4e22, 0x0, @loopback}, 0x1c) sendto$inet6(r0, &(0x7f0000ad6fad)='\x00', 0x1, 0x3fffffd, &(0x7f0000254000)={0xa, 0xb8040000, 0x0, @loopback}, 0x1c) 13:17:34 executing program 3: r0 = openat$cuse(0xffffffffffffff9c, &(0x7f0000000080)='/dev/cuse\x00', 0x2, 0x0) clone(0x1002102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000640), 0xffffffffffffffff) r1 = getpid() sched_setscheduler(r1, 0x5, &(0x7f0000000000)) write$FUSE_NOTIFY_DELETE(r0, &(0x7f0000000040)={0x29, 0x4, 0x600000000000000}, 0x29) 13:17:34 executing program 5: r0 = syz_open_dev$binder(&(0x7f00000021c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000002340)={0x34, 0x0, &(0x7f0000002240)=[@request_death={0x400c630e, 0x4, 0x4}, @increfs={0x40046304, 0x4}, @increfs_done={0x40106308, 0x0, 0x3}, @increfs], 0x77, 0x0, &(0x7f00000022c0)="b3cd0976d8e2af743c6f523efe14fd20c3c3dd2572734282a761e1b4234e2599c85f198cc82bd5d0c74c4edca2f9ea7b875ff7047ec0784fbb354e15fd3f7d837f533597d5082692a6f2fb748da3cc4157188f7f2a5477ded56f72f5b75c96872db429e44b8fcd781d96dead77a0b58b7af9085a208a22"}) 13:17:34 executing program 6: clone(0x802102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000040), 0xffffffffffffffff) r0 = openat(0xffffffffffffffff, &(0x7f0000000080)='./file0\x00', 0x800, 0x2b) ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r1 = syz_open_dev$sndtimer(&(0x7f0000000000)='/dev/snd/timer\x00', 0x0, 0x0) r2 = getpid() sched_setscheduler(r2, 0x5, &(0x7f0000000200)) ioctl$SNDRV_TIMER_IOCTL_GPARAMS(r1, 0x40485404, &(0x7f0000000240)={{}, 0x0, 0x2000000000000000}) 13:17:34 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r0, &(0x7f0000942000)={0x2, 0x4e20, @multicast1}, 0x10) sendmsg$key(0xffffffffffffffff, &(0x7f0000f56000)={0x0, 0x0, &(0x7f00008feff0)={&(0x7f0000000500)=ANY=[@ANYBLOB="020300090a1500000000000000000000030006190000000002000000e0000001003f00000000000002000100e625aa66dcef85847e479eb3c49000000400000000fd003e"], 0x44}}, 0x0) add_key(&(0x7f0000000080)='logon\x00', &(0x7f0000000100)={0x73, 0x79, 0x7a, 0x1}, &(0x7f0000001240), 0x0, 0xfffffffffffffff8) get_mempolicy(&(0x7f0000000000), &(0x7f00000001c0), 0x1ff, &(0x7f0000fff000/0x1000)=nil, 0x3) setsockopt$sock_int(r0, 0x1, 0x3c, &(0x7f0000d4effc)=0x1, 0x4) connect$inet(r0, &(0x7f0000000000)={0x2, 0x4e20, @dev={0xac, 0x14, 0x14, 0x18}}, 0x10) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f00000001c0)='tunl0\x00', 0x5) sendto$inet(r0, &(0x7f00006d1fd4)="db", 0x1, 0x4000010, &(0x7f00004daff0)={0x2, 0x0, @loopback, [0x0, 0x0, 0x7000000]}, 0x10) [ 1556.450532] binder: 18234:18245 IncRefs 0 refcount change on invalid ref 4 ret -22 [ 1556.489774] binder: 18234:18245 BC_INCREFS_DONE u0000000000000000 no match [ 1556.527001] binder: 18234:18245 IncRefs 0 refcount change on invalid ref 0 ret -22 13:17:34 executing program 5: r0 = syz_open_dev$binder(&(0x7f00000021c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000002340)={0x34, 0x0, &(0x7f0000002240)=[@request_death={0x400c630e, 0x4, 0x4}, @increfs={0x40046304, 0x4}, @increfs_done={0x40106308, 0x0, 0x3}, @increfs], 0x77, 0x0, &(0x7f00000022c0)="b3cd0976d8e2af743c6f523efe14fd20c3c3dd2572734282a761e1b44d4e2599c85f198cc82bd5d0c74c4edca2f9ea7b875ff7047ec0784fbb354e15fd3f7d837f533597d5082692a6f2fb748da3cc4157188f7f2a5477ded56f72f5b75c96872db429e44b8fcd781d96dead77a0b58b7af9085a208a22"}) 13:17:34 executing program 3: r0 = openat$cuse(0xffffffffffffff9c, &(0x7f0000000080)='/dev/cuse\x00', 0x2, 0x0) clone(0x1002102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000640), 0xffffffffffffffff) r1 = getpid() sched_setscheduler(r1, 0x5, &(0x7f0000000000)) write$FUSE_NOTIFY_DELETE(r0, &(0x7f0000000040)={0x29, 0x4, 0x700}, 0x29) 13:17:34 executing program 6: clone(0x802102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000040), 0xffffffffffffffff) r0 = syz_open_dev$sndtimer(&(0x7f0000000000)='/dev/snd/timer\x00', 0x0, 0x0) r1 = openat$selinux_checkreqprot(0xffffffffffffff9c, &(0x7f00000000c0)='/selinux/checkreqprot\x00', 0x400000, 0x0) getsockopt$IP_VS_SO_GET_TIMEOUT(r1, 0x0, 0x486, &(0x7f0000000100), &(0x7f0000000140)=0xc) r2 = getpid() sched_setscheduler(r2, 0x5, &(0x7f0000000200)) ioctl$SNDRV_TIMER_IOCTL_SELECT(r0, 0x40345410, &(0x7f0000000080)={{0xffffffffffffffff, 0x2, 0x3, 0x0, 0x98}}) ioctl$TIOCSWINSZ(r1, 0x5414, &(0x7f0000000180)={0xfffffffffffffff7, 0x8, 0x9, 0x2}) ioctl$SNDRV_TIMER_IOCTL_GPARAMS(r0, 0x40485404, &(0x7f0000000240)={{}, 0x0, 0x2000000000000000}) 13:17:34 executing program 7: r0 = openat$cuse(0xffffffffffffff9c, &(0x7f0000000080)='/dev/cuse\x00', 0x2, 0x0) clone(0x1002102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000640), 0xffffffffffffffff) r1 = getpid() sched_setscheduler(r1, 0x5, &(0x7f0000000000)) write$FUSE_NOTIFY_DELETE(r0, &(0x7f0000000040)={0x29, 0x6, 0x0, {0xa0010000}}, 0x29) 13:17:34 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r0, &(0x7f0000942000)={0x2, 0x4e20, @multicast1}, 0x10) sendmsg$key(0xffffffffffffffff, &(0x7f0000f56000)={0x0, 0x0, &(0x7f00008feff0)={&(0x7f0000000500)=ANY=[@ANYBLOB="020300090a1500000000000000000000030006190000000002000000e0000001003f00000000000002000100e625aa66dcef85847e479eb3c49000000400000000fd003e"], 0x44}}, 0x0) add_key(&(0x7f0000000080)='logon\x00', &(0x7f0000000100)={0x73, 0x79, 0x7a, 0x1}, &(0x7f0000001240), 0x0, 0xfffffffffffffff8) get_mempolicy(&(0x7f0000000000), &(0x7f00000001c0), 0x1ff, &(0x7f0000fff000/0x1000)=nil, 0x3) setsockopt$sock_int(r0, 0x1, 0x3c, &(0x7f0000d4effc)=0x1, 0x4) connect$inet(r0, &(0x7f0000000000)={0x2, 0x4e20, @dev={0xac, 0x14, 0x14, 0x18}}, 0x10) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f00000001c0)='tunl0\x00', 0x5) sendto$inet(r0, &(0x7f00006d1fd4)="db", 0x1, 0x4000010, &(0x7f00004daff0)={0x2, 0x0, @loopback, [0x0, 0x0, 0x700]}, 0x10) 13:17:34 executing program 6: clone(0x802102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000040), 0xffffffffffffffff) r0 = syz_open_dev$sndtimer(&(0x7f0000000000)='/dev/snd/timer\x00', 0x0, 0x2) r1 = getpid() sched_setscheduler(r1, 0x3, &(0x7f0000000080)) r2 = openat$selinux_commit_pending_bools(0xffffffffffffff9c, &(0x7f00000000c0)='/selinux/commit_pending_bools\x00', 0x1, 0x0) ioctl$sock_inet_tcp_SIOCATMARK(r2, 0x8905, &(0x7f0000000100)) ioctl$SNDRV_TIMER_IOCTL_GPARAMS(r0, 0x40485404, &(0x7f0000000240)={{}, 0x0, 0x2000000000000000}) [ 1556.729311] binder: 18285:18293 BC_INCREFS_DONE u0000000000000000 no match 13:17:35 executing program 1: r0 = socket$netlink(0x10, 0x3, 0x8000000004) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_TCP_CONGESTION(r1, 0x6, 0xd, &(0x7f0000000180)='vegas\x00', 0x6) bind$inet6(r1, &(0x7f00001fefe4)={0xa, 0x4e22}, 0x1c) sendto$inet6(r1, &(0x7f0000000100), 0x8d2d601e8976aa5, 0x20000004, &(0x7f000031e000)={0xa, 0x4e22}, 0x1c) writev(r0, &(0x7f0000000100)=[{&(0x7f0000000000)="580000001400192340834b80040d8c560a067fc813ff81004e220000000058000b4824ca944f64009400050028925aa8000000000000008000f0fffeffff09000000fff5dd00000010000100000c0900fcff0000040e05a5", 0x58}], 0x1) 13:17:35 executing program 3: r0 = openat$cuse(0xffffffffffffff9c, &(0x7f0000000080)='/dev/cuse\x00', 0x2, 0x0) clone(0x1002102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000640), 0xffffffffffffffff) r1 = getpid() sched_setscheduler(r1, 0x5, &(0x7f0000000000)) write$FUSE_NOTIFY_DELETE(r0, &(0x7f0000000040)={0x29, 0x4, 0x600}, 0x29) 13:17:35 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r0, &(0x7f0000942000)={0x2, 0x4e20, @multicast1}, 0x10) sendmsg$key(0xffffffffffffffff, &(0x7f0000f56000)={0x0, 0x0, &(0x7f00008feff0)={&(0x7f0000000500)=ANY=[@ANYBLOB="020300090a1500000000000000000000030006190000000002000000e0000001003f00000000000002000100e625aa66dcef85847e479eb3c49000000400000000fd003e"], 0x44}}, 0x0) add_key(&(0x7f0000000080)='logon\x00', &(0x7f0000000100)={0x73, 0x79, 0x7a, 0x1}, &(0x7f0000001240), 0x0, 0xfffffffffffffff8) get_mempolicy(&(0x7f0000000000), &(0x7f00000001c0), 0x1ff, &(0x7f0000fff000/0x1000)=nil, 0x3) setsockopt$sock_int(r0, 0x1, 0x3c, &(0x7f0000d4effc)=0x1, 0x4) connect$inet(r0, &(0x7f0000000000)={0x2, 0x4e20, @dev={0xac, 0x14, 0x14, 0x18}}, 0x10) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f00000001c0)='tunl0\x00', 0x5) sendto$inet(r0, &(0x7f00006d1fd4)="db", 0x1, 0x4000010, &(0x7f00004daff0)={0x2, 0x0, @loopback, [0x0, 0x0, 0x3f000000]}, 0x10) 13:17:35 executing program 6: clone(0x802102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000040), 0xffffffffffffffff) r0 = syz_open_dev$sndtimer(&(0x7f0000000000)='/dev/snd/timer\x00', 0x0, 0x0) r1 = getpid() sched_setscheduler(r1, 0x7, &(0x7f0000000200)) syz_extract_tcp_res$synack(&(0x7f0000000080), 0x1, 0x0) ioctl$SNDRV_TIMER_IOCTL_GPARAMS(r0, 0x40485404, &(0x7f0000000240)={{}, 0x0, 0x2000000000000000}) 13:17:35 executing program 7: r0 = openat$cuse(0xffffffffffffff9c, &(0x7f0000000080)='/dev/cuse\x00', 0x2, 0x0) clone(0x1002102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000640), 0xffffffffffffffff) r1 = getpid() sched_setscheduler(r1, 0x5, &(0x7f0000000000)) write$FUSE_NOTIFY_DELETE(r0, &(0x7f0000000040)={0x29, 0x6, 0x0, {0x7000000}}, 0x29) 13:17:35 executing program 5: r0 = syz_open_dev$binder(&(0x7f00000021c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000002340)={0x34, 0x0, &(0x7f0000002240)=[@request_death={0x400c630e, 0x4, 0x4}, @increfs={0x40046304, 0x4}, @increfs_done={0x40106308, 0x0, 0x3}, @increfs], 0x77, 0x0, &(0x7f00000022c0)="b3cd0976d8e2af743c6f523efe14fd20c3c3dd2572734282a761e1b42b4e2599c85f198cc82bd5d0c74c4edca2f9ea7b875ff7047ec0784fbb354e15fd3f7d837f533597d5082692a6f2fb748da3cc4157188f7f2a5477ded56f72f5b75c96872db429e44b8fcd781d96dead77a0b58b7af9085a208a22"}) 13:17:35 executing program 4: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = gettid() perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x3e5}, 0x0, 0x0, 0xffffffffffffffff, 0x0) fcntl$setown(r0, 0x8, r1) bind$inet6(r0, &(0x7f0000807fe4)={0xa, 0x4e22}, 0x1c) sendto$inet6(r0, &(0x7f0000000380), 0x0, 0x200408d4, &(0x7f000072e000)={0xa, 0x4e22, 0x0, @loopback}, 0x1c) sendto$inet6(r0, &(0x7f0000ad6fad)='\x00', 0x1, 0x3fffffd, &(0x7f0000254000)={0xa, 0x40020000, 0x0, @loopback}, 0x1c) 13:17:35 executing program 0: perf_event_open(&(0x7f0000000040)={0x2, 0x70, 0x3e5}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f00000021c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000002340)={0xb5, 0x3000000, &(0x7f00000000c0)=ANY=[@ANYBLOB="0463044000000000b6a571ac965f26c50d500dae115e59afcd8a338d8b2727193c56d4ebef60c214b766ffde6cff6ceef2baa2594a53a0117e77afd5d58e8a35afdae81b258585ce769507333c0238790d5ed750bf1d6ca2a873050056528fce7becfd12f165ac43a826d3462822ff8f29ea992d4e208847cf4fc10ca00b87b5ce2523fa477bad0be1c97e4398aa2ac81d973b5a871d8e0b295e436cd8415f19088c6c82c85f4ed1fac41da062bc6dbfb8eac4276c"], 0x0, 0x0, &(0x7f00000022c0)}) 13:17:35 executing program 3: r0 = openat$cuse(0xffffffffffffff9c, &(0x7f0000000080)='/dev/cuse\x00', 0x2, 0x0) clone(0x1002102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000640), 0xffffffffffffffff) r1 = getpid() sched_setscheduler(r1, 0x5, &(0x7f0000000000)) write$FUSE_NOTIFY_DELETE(r0, &(0x7f0000000040)={0x29, 0x4, 0x4}, 0x29) [ 1557.404086] binder_thread_write: 3 callbacks suppressed [ 1557.404100] binder: 18326:18333 BC_REQUEST_DEATH_NOTIFICATION invalid ref 4 13:17:35 executing program 6: clone(0x802102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000040), 0xffffffffffffffff) r0 = getpid() sched_setscheduler(r0, 0x5, &(0x7f0000000200)) ioctl$SNDRV_TIMER_IOCTL_GPARAMS(0xffffffffffffffff, 0x40485404, &(0x7f0000000080)={{0x0, 0x0, 0x5}, 0x4000, 0x2000000000000000}) 13:17:35 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r0, &(0x7f0000942000)={0x2, 0x4e20, @multicast1}, 0x10) sendmsg$key(0xffffffffffffffff, &(0x7f0000f56000)={0x0, 0x0, &(0x7f00008feff0)={&(0x7f0000000500)=ANY=[@ANYBLOB="020300090a1500000000000000000000030006190000000002000000e0000001003f00000000000002000100e625aa66dcef85847e479eb3c49000000400000000fd003e"], 0x44}}, 0x0) add_key(&(0x7f0000000080)='logon\x00', &(0x7f0000000100)={0x73, 0x79, 0x7a, 0x1}, &(0x7f0000001240), 0x0, 0xfffffffffffffff8) get_mempolicy(&(0x7f0000000000), &(0x7f00000001c0), 0x1ff, &(0x7f0000fff000/0x1000)=nil, 0x3) setsockopt$sock_int(r0, 0x1, 0x3c, &(0x7f0000d4effc)=0x1, 0x4) connect$inet(r0, &(0x7f0000000000)={0x2, 0x4e20, @dev={0xac, 0x14, 0x14, 0x18}}, 0x10) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f00000001c0)='tunl0\x00', 0x5) sendto$inet(r0, &(0x7f00006d1fd4)="db", 0x1, 0x4000010, &(0x7f00004daff0)={0x2, 0x0, @loopback, [0x0, 0x0, 0x49]}, 0x10) [ 1557.462144] binder: 18326:18333 BC_INCREFS_DONE u0000000000000000 no match 13:17:35 executing program 3: r0 = openat$cuse(0xffffffffffffff9c, &(0x7f0000000080)='/dev/cuse\x00', 0x2, 0x0) clone(0x1002102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000640), 0xffffffffffffffff) r1 = getpid() sched_setscheduler(r1, 0x5, &(0x7f0000000000)) write$FUSE_NOTIFY_DELETE(r0, &(0x7f0000000040)={0x29, 0x4, 0x8}, 0x29) 13:17:35 executing program 6: clone(0x802102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000040), 0xffffffffffffffff) r0 = syz_open_dev$sndtimer(&(0x7f0000000000)='/dev/snd/timer\x00', 0x0, 0x0) r1 = getpid() sched_setscheduler(r1, 0x5, &(0x7f0000000200)) ioctl$SNDRV_TIMER_IOCTL_GPARAMS(r0, 0x40485404, &(0x7f0000000240)={{}, 0x0, 0x2000000000000000}) dup3(r0, r0, 0x80000) 13:17:35 executing program 7: r0 = openat$cuse(0xffffffffffffff9c, &(0x7f0000000080)='/dev/cuse\x00', 0x2, 0x0) clone(0x1002102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000640), 0xffffffffffffffff) r1 = getpid() sched_setscheduler(r1, 0x5, &(0x7f0000000000)) write$FUSE_NOTIFY_DELETE(r0, &(0x7f0000000040)={0x29, 0x6, 0x0, {0x0, 0x300000000000000}}, 0x29) 13:17:35 executing program 5: r0 = syz_open_dev$binder(&(0x7f00000021c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000002340)={0x34, 0x0, &(0x7f0000002240)=[@request_death={0x400c630e, 0x4, 0x4}, @increfs={0x40046304, 0x4}, @increfs_done={0x40106308, 0x0, 0x3}, @increfs], 0x77, 0x0, &(0x7f00000022c0)="b3cd0976d8e2af743c6f523efe14fd20c3c3dd2572734282a761e1b42d4e2599c85f198cc82bd5d0c74c4edca2f9ea7b875ff7047ec0784fbb354e15fd3f7d837f533597d5082692a6f2fb748da3cc4157188f7f2a5477ded56f72f5b75c96872db429e44b8fcd781d96dead77a0b58b7af9085a208a22"}) 13:17:35 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r0, &(0x7f0000942000)={0x2, 0x4e20, @multicast1}, 0x10) sendmsg$key(0xffffffffffffffff, &(0x7f0000f56000)={0x0, 0x0, &(0x7f00008feff0)={&(0x7f0000000500)=ANY=[@ANYBLOB="020300090a1500000000000000000000030006190000000002000000e0000001003f00000000000002000100e625aa66dcef85847e479eb3c49000000400000000fd003e"], 0x44}}, 0x0) add_key(&(0x7f0000000080)='logon\x00', &(0x7f0000000100)={0x73, 0x79, 0x7a, 0x1}, &(0x7f0000001240), 0x0, 0xfffffffffffffff8) get_mempolicy(&(0x7f0000000000), &(0x7f00000001c0), 0x1ff, &(0x7f0000fff000/0x1000)=nil, 0x3) setsockopt$sock_int(r0, 0x1, 0x3c, &(0x7f0000d4effc)=0x1, 0x4) connect$inet(r0, &(0x7f0000000000)={0x2, 0x4e20, @dev={0xac, 0x14, 0x14, 0x18}}, 0x10) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f00000001c0)='tunl0\x00', 0x5) sendto$inet(r0, &(0x7f00006d1fd4)="db", 0x1, 0x4000010, &(0x7f00004daff0)={0x2, 0x0, @loopback, [0x0, 0x0, 0x4002000000000000]}, 0x10) [ 1557.681696] binder: 18374:18375 BC_REQUEST_DEATH_NOTIFICATION invalid ref 4 [ 1557.699828] binder: 18374:18375 BC_INCREFS_DONE u0000000000000000 no match 13:17:36 executing program 1: r0 = socket$netlink(0x10, 0x3, 0x8000000004) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_TCP_CONGESTION(r1, 0x6, 0xd, &(0x7f0000000180)='vegas\x00', 0x6) bind$inet6(r1, &(0x7f00001fefe4)={0xa, 0x4e22}, 0x1c) sendto$inet6(r1, &(0x7f0000000100), 0x8d2d601e8976aa5, 0x20000004, &(0x7f000031e000)={0xa, 0x4e22}, 0x1c) writev(r0, &(0x7f0000000100)=[{&(0x7f0000000000)="580000001400192340834b80040d8c560a067f8922ff81004e220000000058000b4824ca944f64009400050028925aa8000000000000008000f0fffeffff09000000fff5dd00000010000100000c0900fcff0000040e05a5", 0x58}], 0x1) 13:17:36 executing program 0: perf_event_open(&(0x7f0000000040)={0x2, 0x70, 0x3e5}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f00000021c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000002340)={0xb5, 0x500, &(0x7f00000000c0)=ANY=[@ANYBLOB="0463044000000000b6a571ac965f26c50d500dae115e59afcd8a338d8b2727193c56d4ebef60c214b766ffde6cff6ceef2baa2594a53a0117e77afd5d58e8a35afdae81b258585ce769507333c0238790d5ed750bf1d6ca2a873050056528fce7becfd12f165ac43a826d3462822ff8f29ea992d4e208847cf4fc10ca00b87b5ce2523fa477bad0be1c97e4398aa2ac81d973b5a871d8e0b295e436cd8415f19088c6c82c85f4ed1fac41da062bc6dbfb8eac4276c"], 0x0, 0x0, &(0x7f00000022c0)}) 13:17:36 executing program 5: r0 = syz_open_dev$binder(&(0x7f00000021c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000002340)={0x34, 0x0, &(0x7f0000002240)=[@request_death={0x400c630e, 0x4, 0x4}, @increfs={0x40046304, 0x4}, @increfs_done={0x40106308, 0x0, 0x3}, @increfs], 0x77, 0x0, &(0x7f00000022c0)="b3cd0976d8e2af743c6f523efe14fd20c3c3dd2572734282a761e1b43b4e2599c85f198cc82bd5d0c74c4edca2f9ea7b875ff7047ec0784fbb354e15fd3f7d837f533597d5082692a6f2fb748da3cc4157188f7f2a5477ded56f72f5b75c96872db429e44b8fcd781d96dead77a0b58b7af9085a208a22"}) 13:17:36 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r0, &(0x7f0000942000)={0x2, 0x4e20, @multicast1}, 0x10) sendmsg$key(0xffffffffffffffff, &(0x7f0000f56000)={0x0, 0x0, &(0x7f00008feff0)={&(0x7f0000000500)=ANY=[@ANYBLOB="020300090a1500000000000000000000030006190000000002000000e0000001003f00000000000002000100e625aa66dcef85847e479eb3c49000000400000000fd003e"], 0x44}}, 0x0) add_key(&(0x7f0000000080)='logon\x00', &(0x7f0000000100)={0x73, 0x79, 0x7a, 0x1}, &(0x7f0000001240), 0x0, 0xfffffffffffffff8) get_mempolicy(&(0x7f0000000000), &(0x7f00000001c0), 0x1ff, &(0x7f0000fff000/0x1000)=nil, 0x3) setsockopt$sock_int(r0, 0x1, 0x3c, &(0x7f0000d4effc)=0x1, 0x4) connect$inet(r0, &(0x7f0000000000)={0x2, 0x4e20, @dev={0xac, 0x14, 0x14, 0x18}}, 0x10) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f00000001c0)='tunl0\x00', 0x5) sendto$inet(r0, &(0x7f00006d1fd4)="db", 0x1, 0x4000010, &(0x7f00004daff0)={0x2, 0x0, @loopback, [0x0, 0x0, 0x10000000000000]}, 0x10) 13:17:36 executing program 3: r0 = openat$cuse(0xffffffffffffff9c, &(0x7f0000000080)='/dev/cuse\x00', 0x2, 0x0) clone(0x1002102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000640), 0xffffffffffffffff) r1 = getpid() sched_setscheduler(r1, 0x5, &(0x7f0000000000)) write$FUSE_NOTIFY_DELETE(r0, &(0x7f0000000040)={0x29, 0x4, 0x900}, 0x29) 13:17:36 executing program 7: r0 = openat$cuse(0xffffffffffffff9c, &(0x7f0000000080)='/dev/cuse\x00', 0x2, 0x0) clone(0x1002102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000640), 0xffffffffffffffff) r1 = getpid() sched_setscheduler(r1, 0x5, &(0x7f0000000000)) write$FUSE_NOTIFY_DELETE(r0, &(0x7f0000000040)={0x29, 0x6, 0x0, {0x0, 0x2000000}}, 0x29) 13:17:36 executing program 6: clone(0x802102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000040), 0xffffffffffffffff) r0 = syz_open_dev$sndtimer(&(0x7f0000000000)='/dev/snd/timer\x00', 0x0, 0x0) r1 = getpid() ioctl$UI_SET_RELBIT(r0, 0x40045566, 0x0) sched_setscheduler(r1, 0x5, &(0x7f0000000200)) ioctl$SNDRV_TIMER_IOCTL_GPARAMS(r0, 0x40485404, &(0x7f0000000240)={{}, 0x0, 0x2000000000000000}) 13:17:36 executing program 4: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = gettid() perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x3e5}, 0x0, 0x0, 0xffffffffffffffff, 0x0) fcntl$setown(r0, 0x8, r1) bind$inet6(r0, &(0x7f0000807fe4)={0xa, 0x4e22}, 0x1c) sendto$inet6(r0, &(0x7f0000000380), 0x0, 0x200408d4, &(0x7f000072e000)={0xa, 0x4e22, 0x0, @loopback}, 0x1c) sendto$inet6(r0, &(0x7f0000ad6fad)='\x00', 0x1, 0x3fffffd, &(0x7f0000254000)={0xa, 0xa00, 0x0, @loopback}, 0x1c) 13:17:36 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r0, &(0x7f0000942000)={0x2, 0x4e20, @multicast1}, 0x10) sendmsg$key(0xffffffffffffffff, &(0x7f0000f56000)={0x0, 0x0, &(0x7f00008feff0)={&(0x7f0000000500)=ANY=[@ANYBLOB="020300090a1500000000000000000000030006190000000002000000e0000001003f00000000000002000100e625aa66dcef85847e479eb3c49000000400000000fd003e"], 0x44}}, 0x0) add_key(&(0x7f0000000080)='logon\x00', &(0x7f0000000100)={0x73, 0x79, 0x7a, 0x1}, &(0x7f0000001240), 0x0, 0xfffffffffffffff8) get_mempolicy(&(0x7f0000000000), &(0x7f00000001c0), 0x1ff, &(0x7f0000fff000/0x1000)=nil, 0x3) setsockopt$sock_int(r0, 0x1, 0x3c, &(0x7f0000d4effc)=0x1, 0x4) connect$inet(r0, &(0x7f0000000000)={0x2, 0x4e20, @dev={0xac, 0x14, 0x14, 0x18}}, 0x10) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f00000001c0)='tunl0\x00', 0x5) sendto$inet(r0, &(0x7f00006d1fd4)="db", 0x1, 0x4000010, &(0x7f00004daff0)={0x2, 0x0, @loopback, [0x0, 0x0, 0x1a0ffffffff]}, 0x10) [ 1558.296971] binder: 18417:18427 BC_REQUEST_DEATH_NOTIFICATION invalid ref 4 [ 1558.321741] binder: 18417:18427 BC_INCREFS_DONE u0000000000000000 no match 13:17:36 executing program 6: clone(0x20124100, 0x0, 0xfffffffffffffffe, &(0x7f0000000040), 0xffffffffffffffff) r0 = syz_open_dev$sndtimer(&(0x7f00000000c0)='/dev/snd/timer\x00', 0x0, 0x800) r1 = getpid() sched_setscheduler(r1, 0x5, &(0x7f0000000200)) r2 = openat$selinux_commit_pending_bools(0xffffffffffffff9c, &(0x7f0000000080)='/selinux/commit_pending_bools\x00', 0x1, 0x0) fcntl$lock(r0, 0x7, &(0x7f0000000000)={0x2, 0x3, 0x3, 0x10001, r1}) ioctl$RTC_RD_TIME(r2, 0x80247009, 0xfffffffffffffffe) ioctl$SNDRV_TIMER_IOCTL_GPARAMS(r0, 0x40485404, &(0x7f0000000240)={{}, 0x0, 0x2000000000000000}) 13:17:36 executing program 5: r0 = syz_open_dev$binder(&(0x7f00000021c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000002340)={0x34, 0x0, &(0x7f0000002240)=[@request_death={0x400c630e, 0x4, 0x4}, @increfs={0x40046304, 0x4}, @increfs_done={0x40106308, 0x0, 0x3}, @increfs], 0x77, 0x0, &(0x7f00000022c0)="b3cd0976d8e2af743c6f523efe14fd20c3c3dd2572734282a761e1b4544e2599c85f198cc82bd5d0c74c4edca2f9ea7b875ff7047ec0784fbb354e15fd3f7d837f533597d5082692a6f2fb748da3cc4157188f7f2a5477ded56f72f5b75c96872db429e44b8fcd781d96dead77a0b58b7af9085a208a22"}) 13:17:36 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r0, &(0x7f0000942000)={0x2, 0x4e20, @multicast1}, 0x10) sendmsg$key(0xffffffffffffffff, &(0x7f0000f56000)={0x0, 0x0, &(0x7f00008feff0)={&(0x7f0000000500)=ANY=[@ANYBLOB="020300090a1500000000000000000000030006190000000002000000e0000001003f00000000000002000100e625aa66dcef85847e479eb3c49000000400000000fd003e"], 0x44}}, 0x0) add_key(&(0x7f0000000080)='logon\x00', &(0x7f0000000100)={0x73, 0x79, 0x7a, 0x1}, &(0x7f0000001240), 0x0, 0xfffffffffffffff8) get_mempolicy(&(0x7f0000000000), &(0x7f00000001c0), 0x1ff, &(0x7f0000fff000/0x1000)=nil, 0x3) setsockopt$sock_int(r0, 0x1, 0x3c, &(0x7f0000d4effc)=0x1, 0x4) connect$inet(r0, &(0x7f0000000000)={0x2, 0x4e20, @dev={0xac, 0x14, 0x14, 0x18}}, 0x10) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f00000001c0)='tunl0\x00', 0x5) sendto$inet(r0, &(0x7f00006d1fd4)="db", 0x1, 0x4000010, &(0x7f00004daff0)={0x2, 0x0, @loopback, [0x0, 0x0, 0xfeffffff]}, 0x10) [ 1558.478307] binder: 18454:18455 BC_REQUEST_DEATH_NOTIFICATION invalid ref 4 [ 1558.486508] binder: 18454:18455 BC_INCREFS_DONE u0000000000000000 no match 13:17:36 executing program 7: r0 = openat$cuse(0xffffffffffffff9c, &(0x7f0000000080)='/dev/cuse\x00', 0x2, 0x0) clone(0x1002102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000640), 0xffffffffffffffff) r1 = getpid() sched_setscheduler(r1, 0x5, &(0x7f0000000000)) write$FUSE_NOTIFY_DELETE(r0, &(0x7f0000000040)={0x29, 0x6, 0x0, {0x0, 0x40000}}, 0x29) 13:17:36 executing program 3: r0 = openat$cuse(0xffffffffffffff9c, &(0x7f0000000080)='/dev/cuse\x00', 0x2, 0x0) clone(0x1002102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000640), 0xffffffffffffffff) r1 = getpid() sched_setscheduler(r1, 0x5, &(0x7f0000000000)) write$FUSE_NOTIFY_DELETE(r0, &(0x7f0000000040)={0x29, 0x4, 0xc000000}, 0x29) 13:17:36 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r0, &(0x7f0000942000)={0x2, 0x4e20, @multicast1}, 0x10) sendmsg$key(0xffffffffffffffff, &(0x7f0000f56000)={0x0, 0x0, &(0x7f00008feff0)={&(0x7f0000000500)=ANY=[@ANYBLOB="020300090a1500000000000000000000030006190000000002000000e0000001003f00000000000002000100e625aa66dcef85847e479eb3c49000000400000000fd003e"], 0x44}}, 0x0) add_key(&(0x7f0000000080)='logon\x00', &(0x7f0000000100)={0x73, 0x79, 0x7a, 0x1}, &(0x7f0000001240), 0x0, 0xfffffffffffffff8) get_mempolicy(&(0x7f0000000000), &(0x7f00000001c0), 0x1ff, &(0x7f0000fff000/0x1000)=nil, 0x3) setsockopt$sock_int(r0, 0x1, 0x3c, &(0x7f0000d4effc)=0x1, 0x4) connect$inet(r0, &(0x7f0000000000)={0x2, 0x4e20, @dev={0xac, 0x14, 0x14, 0x18}}, 0x10) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f00000001c0)='tunl0\x00', 0x5) sendto$inet(r0, &(0x7f00006d1fd4)="db", 0x1, 0x4000010, &(0x7f00004daff0)={0x2, 0x0, @loopback, [0x0, 0x0, 0x5000000]}, 0x10) 13:17:36 executing program 5: r0 = syz_open_dev$binder(&(0x7f00000021c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000002340)={0x34, 0x0, &(0x7f0000002240)=[@request_death={0x400c630e, 0x4, 0x4}, @increfs={0x40046304, 0x4}, @increfs_done={0x40106308, 0x0, 0x3}, @increfs], 0x77, 0x0, &(0x7f00000022c0)="b3cd0976d8e2af743c6f523efe14fd20c3c3dd2572734282a761e1b42f4e2599c85f198cc82bd5d0c74c4edca2f9ea7b875ff7047ec0784fbb354e15fd3f7d837f533597d5082692a6f2fb748da3cc4157188f7f2a5477ded56f72f5b75c96872db429e44b8fcd781d96dead77a0b58b7af9085a208a22"}) [ 1558.679411] binder: 18473:18474 BC_REQUEST_DEATH_NOTIFICATION invalid ref 4 13:17:37 executing program 1: r0 = socket$netlink(0x10, 0x3, 0x8000000004) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_TCP_CONGESTION(r1, 0x6, 0xd, &(0x7f0000000180)='vegas\x00', 0x6) bind$inet6(r1, &(0x7f00001fefe4)={0xa, 0x4e22}, 0x1c) sendto$inet6(r1, &(0x7f0000000100), 0x8d2d601e8976aa5, 0x20000004, &(0x7f000031e000)={0xa, 0x4e22}, 0x1c) writev(r0, &(0x7f0000000100)=[{&(0x7f0000000000)="580000001400192340834b80040d8c560a067f79d1ff81004e220000000058000b4824ca944f64009400050028925aa8000000000000008000f0fffeffff09000000fff5dd00000010000100000c0900fcff0000040e05a5", 0x58}], 0x1) 13:17:37 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r0, &(0x7f0000942000)={0x2, 0x4e20, @multicast1}, 0x10) sendmsg$key(0xffffffffffffffff, &(0x7f0000f56000)={0x0, 0x0, &(0x7f00008feff0)={&(0x7f0000000500)=ANY=[@ANYBLOB="020300090a1500000000000000000000030006190000000002000000e0000001003f00000000000002000100e625aa66dcef85847e479eb3c49000000400000000fd003e"], 0x44}}, 0x0) add_key(&(0x7f0000000080)='logon\x00', &(0x7f0000000100)={0x73, 0x79, 0x7a, 0x1}, &(0x7f0000001240), 0x0, 0xfffffffffffffff8) get_mempolicy(&(0x7f0000000000), &(0x7f00000001c0), 0x1ff, &(0x7f0000fff000/0x1000)=nil, 0x3) setsockopt$sock_int(r0, 0x1, 0x3c, &(0x7f0000d4effc)=0x1, 0x4) connect$inet(r0, &(0x7f0000000000)={0x2, 0x4e20, @dev={0xac, 0x14, 0x14, 0x18}}, 0x10) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f00000001c0)='tunl0\x00', 0x5) sendto$inet(r0, &(0x7f00006d1fd4)="db", 0x1, 0x4000010, &(0x7f00004daff0)={0x2, 0x0, @loopback, [0x0, 0x0, 0x14b80100]}, 0x10) 13:17:37 executing program 7: r0 = openat$cuse(0xffffffffffffff9c, &(0x7f0000000080)='/dev/cuse\x00', 0x2, 0x0) clone(0x1002102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000640), 0xffffffffffffffff) r1 = getpid() sched_setscheduler(r1, 0x5, &(0x7f0000000000)) write$FUSE_NOTIFY_DELETE(r0, &(0x7f0000000040)={0x29, 0x6, 0x0, {0x0, 0xc00}}, 0x29) 13:17:37 executing program 3: r0 = openat$cuse(0xffffffffffffff9c, &(0x7f0000000080)='/dev/cuse\x00', 0x2, 0x0) clone(0x1002102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000640), 0xffffffffffffffff) r1 = getpid() sched_setscheduler(r1, 0x5, &(0x7f0000000000)) write$FUSE_NOTIFY_DELETE(r0, &(0x7f0000000040)={0x29, 0x4, 0xc00}, 0x29) 13:17:37 executing program 6: clone(0x802102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000040), 0xffffffffffffffff) r0 = syz_open_dev$sndtimer(&(0x7f0000000000)='/dev/snd/timer\x00', 0x0, 0x0) r1 = getpid() sched_setscheduler(r1, 0x5, &(0x7f0000000200)) ioctl$SNDRV_TIMER_IOCTL_GPARAMS(r0, 0x40485404, &(0x7f0000000240)={{}, 0x0, 0x2000000000000000}) setpgid(r1, r1) r2 = openat$vhci(0xffffffffffffff9c, &(0x7f0000000080)='/dev/vhci\x00', 0x400, 0x0) ioctl$UFFDIO_REGISTER(r2, 0xc020aa00, &(0x7f00000000c0)={{&(0x7f0000ffe000/0x1000)=nil, 0x1000}}) 13:17:37 executing program 0: perf_event_open(&(0x7f0000000040)={0x2, 0x70, 0x3e5}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f00000021c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000002340)={0xb5, 0x68, &(0x7f00000000c0)=ANY=[@ANYBLOB="0463044000000000b6a571ac965f26c50d500dae115e59afcd8a338d8b2727193c56d4ebef60c214b766ffde6cff6ceef2baa2594a53a0117e77afd5d58e8a35afdae81b258585ce769507333c0238790d5ed750bf1d6ca2a873050056528fce7becfd12f165ac43a826d3462822ff8f29ea992d4e208847cf4fc10ca00b87b5ce2523fa477bad0be1c97e4398aa2ac81d973b5a871d8e0b295e436cd8415f19088c6c82c85f4ed1fac41da062bc6dbfb8eac4276c"], 0x0, 0x0, &(0x7f00000022c0)}) 13:17:37 executing program 5: r0 = syz_open_dev$binder(&(0x7f00000021c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000002340)={0x34, 0x0, &(0x7f0000002240)=[@request_death={0x400c630e, 0x4, 0x4}, @increfs={0x40046304, 0x4}, @increfs_done={0x40106308, 0x0, 0x3}, @increfs], 0x77, 0x0, &(0x7f00000022c0)="b3cd0976d8e2af743c6f523efe14fd20c3c3dd2572734282a761e1b44c4e2599c85f198cc82bd5d0c74c4edca2f9ea7b875ff7047ec0784fbb354e15fd3f7d837f533597d5082692a6f2fb748da3cc4157188f7f2a5477ded56f72f5b75c96872db429e44b8fcd781d96dead77a0b58b7af9085a208a22"}) 13:17:37 executing program 4: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = gettid() perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x3e5}, 0x0, 0x0, 0xffffffffffffffff, 0x0) fcntl$setown(r0, 0x8, r1) bind$inet6(r0, &(0x7f0000807fe4)={0xa, 0x4e22}, 0x1c) sendto$inet6(r0, &(0x7f0000000380), 0x0, 0x200408d4, &(0x7f000072e000)={0xa, 0x4e22, 0x0, @loopback}, 0x1c) sendto$inet6(r0, &(0x7f0000ad6fad)='\x00', 0x1, 0x3fffffd, &(0x7f0000254000)={0xa, 0xb804, 0x0, @loopback}, 0x1c) 13:17:37 executing program 7: r0 = openat$cuse(0xffffffffffffff9c, &(0x7f0000000080)='/dev/cuse\x00', 0x2, 0x0) clone(0x1002102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000640), 0xffffffffffffffff) r1 = getpid() sched_setscheduler(r1, 0x5, &(0x7f0000000000)) write$FUSE_NOTIFY_DELETE(r0, &(0x7f0000000040)={0x29, 0x6, 0x0, {0x0, 0x900}}, 0x29) 13:17:37 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r0, &(0x7f0000942000)={0x2, 0x4e20, @multicast1}, 0x10) sendmsg$key(0xffffffffffffffff, &(0x7f0000f56000)={0x0, 0x0, &(0x7f00008feff0)={&(0x7f0000000500)=ANY=[@ANYBLOB="020300090a1500000000000000000000030006190000000002000000e0000001003f00000000000002000100e625aa66dcef85847e479eb3c49000000400000000fd003e"], 0x44}}, 0x0) add_key(&(0x7f0000000080)='logon\x00', &(0x7f0000000100)={0x73, 0x79, 0x7a, 0x1}, &(0x7f0000001240), 0x0, 0xfffffffffffffff8) get_mempolicy(&(0x7f0000000000), &(0x7f00000001c0), 0x1ff, &(0x7f0000fff000/0x1000)=nil, 0x3) setsockopt$sock_int(r0, 0x1, 0x3c, &(0x7f0000d4effc)=0x1, 0x4) connect$inet(r0, &(0x7f0000000000)={0x2, 0x4e20, @dev={0xac, 0x14, 0x14, 0x18}}, 0x10) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f00000001c0)='tunl0\x00', 0x5) sendto$inet(r0, &(0x7f00006d1fd4)="db", 0x1, 0x4000010, &(0x7f00004daff0)={0x2, 0x0, @loopback, [0x0, 0x0, 0x80550000]}, 0x10) [ 1559.220185] binder: 18513:18516 BC_REQUEST_DEATH_NOTIFICATION invalid ref 4 13:17:37 executing program 5: r0 = syz_open_dev$binder(&(0x7f00000021c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000002340)={0x34, 0x0, &(0x7f0000002240)=[@request_death={0x400c630e, 0x4, 0x4}, @increfs={0x40046304, 0x4}, @increfs_done={0x40106308, 0x0, 0x3}, @increfs], 0x77, 0x0, &(0x7f00000022c0)="b3cd0976d8e2af743c6f523efe14fd20c3c3dd2572734282a761e1b40a4e2599c85f198cc82bd5d0c74c4edca2f9ea7b875ff7047ec0784fbb354e15fd3f7d837f533597d5082692a6f2fb748da3cc4157188f7f2a5477ded56f72f5b75c96872db429e44b8fcd781d96dead77a0b58b7af9085a208a22"}) 13:17:37 executing program 3: r0 = openat$cuse(0xffffffffffffff9c, &(0x7f0000000080)='/dev/cuse\x00', 0x2, 0x0) clone(0x1002102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000640), 0xffffffffffffffff) r1 = getpid() sched_setscheduler(r1, 0x5, &(0x7f0000000000)) write$FUSE_NOTIFY_DELETE(r0, &(0x7f0000000040)={0x29, 0x4, 0x300}, 0x29) 13:17:37 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r0, &(0x7f0000942000)={0x2, 0x4e20, @multicast1}, 0x10) sendmsg$key(0xffffffffffffffff, &(0x7f0000f56000)={0x0, 0x0, &(0x7f00008feff0)={&(0x7f0000000500)=ANY=[@ANYBLOB="020300090a1500000000000000000000030006190000000002000000e0000001003f00000000000002000100e625aa66dcef85847e479eb3c49000000400000000fd003e"], 0x44}}, 0x0) add_key(&(0x7f0000000080)='logon\x00', &(0x7f0000000100)={0x73, 0x79, 0x7a, 0x1}, &(0x7f0000001240), 0x0, 0xfffffffffffffff8) get_mempolicy(&(0x7f0000000000), &(0x7f00000001c0), 0x1ff, &(0x7f0000fff000/0x1000)=nil, 0x3) setsockopt$sock_int(r0, 0x1, 0x3c, &(0x7f0000d4effc)=0x1, 0x4) connect$inet(r0, &(0x7f0000000000)={0x2, 0x4e20, @dev={0xac, 0x14, 0x14, 0x18}}, 0x10) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f00000001c0)='tunl0\x00', 0x5) sendto$inet(r0, &(0x7f00006d1fd4)="db", 0x1, 0x4000010, &(0x7f00004daff0)={0x2, 0x0, @loopback, [0x0, 0x0, 0xffffffa6]}, 0x10) 13:17:37 executing program 6: r0 = socket$inet(0x2, 0x1, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f0000000180)=@broute={'broute\x00', 0x20, 0x1, 0x2d0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x20000c00], 0x0, &(0x7f0000000040), &(0x7f0000000c00)=ANY=[@ANYBLOB="00000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000feffffff01000000190000000000000008006c6f00000000000000000000000000007465716c3000000000000000000000006970365f76746930000000000000000062637366300000000000000000000000ffffffffffff000000000000aaaaaaaaaa000000000000000000e0010000100200004002000069700000000000000000000000000000000000000000000000000000000000002000000000000000ac1414bbffffffff000000000000000089da41790000ffffff7f000000000000636f6d6d656e740000000000000000000000000000000000000000000000000000010000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000010000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000041554449540000000000000000000000000000000000000000000000000000000800000000000000000000000000000041554449540000000000000000000000000000000000000000000000000000000800000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000ffffffff00000000"]}, 0x348) clone(0x802102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000040), 0xffffffffffffffff) r1 = syz_open_dev$sndtimer(&(0x7f0000000000)='/dev/snd/timer\x00', 0x0, 0x0) r2 = getpid() r3 = dup(r0) accept4$inet(r3, &(0x7f0000005340)={0x2, 0x0, @multicast2}, &(0x7f0000005380)=0x10, 0x800) sched_setscheduler(r2, 0x5, &(0x7f0000000200)) ioctl$SNDRV_TIMER_IOCTL_GPARAMS(r1, 0x40485404, &(0x7f0000000240)={{}, 0x0, 0x2000000000000000}) [ 1559.403889] binder: 18533:18535 BC_REQUEST_DEATH_NOTIFICATION invalid ref 4 13:17:37 executing program 5: r0 = syz_open_dev$binder(&(0x7f00000021c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000002340)={0x34, 0x0, &(0x7f0000002240)=[@request_death={0x400c630e, 0x4, 0x4}, @increfs={0x40046304, 0x4}, @increfs_done={0x40106308, 0x0, 0x3}, @increfs], 0x77, 0x0, &(0x7f00000022c0)="b3cd0976d8e2af743c6f523efe14fd20c3c3dd2572734282a761e1b4254e2599c85f198cc82bd5d0c74c4edca2f9ea7b875ff7047ec0784fbb354e15fd3f7d837f533597d5082692a6f2fb748da3cc4157188f7f2a5477ded56f72f5b75c96872db429e44b8fcd781d96dead77a0b58b7af9085a208a22"}) 13:17:37 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r0, &(0x7f0000942000)={0x2, 0x4e20, @multicast1}, 0x10) sendmsg$key(0xffffffffffffffff, &(0x7f0000f56000)={0x0, 0x0, &(0x7f00008feff0)={&(0x7f0000000500)=ANY=[@ANYBLOB="020300090a1500000000000000000000030006190000000002000000e0000001003f00000000000002000100e625aa66dcef85847e479eb3c49000000400000000fd003e"], 0x44}}, 0x0) add_key(&(0x7f0000000080)='logon\x00', &(0x7f0000000100)={0x73, 0x79, 0x7a, 0x1}, &(0x7f0000001240), 0x0, 0xfffffffffffffff8) get_mempolicy(&(0x7f0000000000), &(0x7f00000001c0), 0x1ff, &(0x7f0000fff000/0x1000)=nil, 0x3) setsockopt$sock_int(r0, 0x1, 0x3c, &(0x7f0000d4effc)=0x1, 0x4) connect$inet(r0, &(0x7f0000000000)={0x2, 0x4e20, @dev={0xac, 0x14, 0x14, 0x18}}, 0x10) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f00000001c0)='tunl0\x00', 0x5) sendto$inet(r0, &(0x7f00006d1fd4)="db", 0x1, 0x4000010, &(0x7f00004daff0)={0x2, 0x0, @loopback, [0x0, 0x0, 0xa]}, 0x10) [ 1559.592274] binder: 18562:18565 BC_REQUEST_DEATH_NOTIFICATION invalid ref 4 [ 1559.683678] binder: 18558:18568 unknown command 1188243112 [ 1559.707913] binder: 18558:18568 ioctl c0306201 20002340 returned -22 [ 1559.718202] binder: 18558:18575 unknown command 1188243112 [ 1559.724049] binder: 18558:18575 ioctl c0306201 20002340 returned -22 13:17:38 executing program 1: r0 = socket$netlink(0x10, 0x3, 0x8000000004) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_TCP_CONGESTION(r1, 0x6, 0xd, &(0x7f0000000180)='vegas\x00', 0x6) bind$inet6(r1, &(0x7f00001fefe4)={0xa, 0x4e22}, 0x1c) sendto$inet6(r1, &(0x7f0000000100), 0x8d2d601e8976aa5, 0x20000004, &(0x7f000031e000)={0xa, 0x4e22}, 0x1c) writev(r0, &(0x7f0000000100)=[{&(0x7f0000000000)="580000001400192340834b80040d8c560a067f39d1ff81004e220000000058000b4824ca944f64009400050028925aa8000000000000008000f0fffeffff09000000fff5dd00000010000100000c0900fcff0000040e05a5", 0x58}], 0x1) 13:17:38 executing program 7: r0 = openat$cuse(0xffffffffffffff9c, &(0x7f0000000080)='/dev/cuse\x00', 0x2, 0x0) clone(0x1002102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000640), 0xffffffffffffffff) r1 = getpid() sched_setscheduler(r1, 0x5, &(0x7f0000000000)) write$FUSE_NOTIFY_DELETE(r0, &(0x7f0000000040)={0x29, 0x6, 0x0, {0x0, 0x6}}, 0x29) 13:17:38 executing program 3: r0 = openat$cuse(0xffffffffffffff9c, &(0x7f0000000080)='/dev/cuse\x00', 0x2, 0x0) clone(0x1002102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000640), 0xffffffffffffffff) r1 = getpid() sched_setscheduler(r1, 0x5, &(0x7f0000000000)) write$FUSE_NOTIFY_DELETE(r0, &(0x7f0000000040)={0x29, 0x4, 0x2}, 0x29) 13:17:38 executing program 5: r0 = syz_open_dev$binder(&(0x7f00000021c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000002340)={0x34, 0x0, &(0x7f0000002240)=[@request_death={0x400c630e, 0x4, 0x4}, @increfs={0x40046304, 0x4}, @increfs_done={0x40106308, 0x0, 0x3}, @increfs], 0x77, 0x0, &(0x7f00000022c0)="b3cd0976d8e2af743c6f523efe14fd20c3c3dd2572734282a761e1b430542599c85f198cc82bd5d0c74c4edca2f9ea7b875ff7047ec0784fbb354e15fd3f7d837f533597d5082692a6f2fb748da3cc4157188f7f2a5477ded56f72f5b75c96872db429e44b8fcd781d96dead77a0b58b7af9085a208a22"}) 13:17:38 executing program 6: clone(0x802102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000040), 0xffffffffffffffff) r0 = syz_open_dev$sndtimer(&(0x7f0000000000)='/dev/snd/timer\x00', 0x0, 0x0) r1 = getpid() sched_setscheduler(r1, 0x5, &(0x7f0000000200)) ioctl$SNDRV_TIMER_IOCTL_GPARAMS(r0, 0x40485404, &(0x7f0000000240)={{}, 0x0, 0x2000000000000000}) r2 = msgget$private(0x0, 0x49d7623e86ffa245) msgsnd(r2, &(0x7f0000000080)={0x1, "797b6d90abede6f5f8acde585b2295066a7695b3568b1806cb173cebf9987a032516f8f2a7ca08a8b9a41847bdd7ce8cdd2d58fc7dd818aea51a2b35f00187fbeffad25ad570b7cc0352fd7843bbff9862ada76ffe3beb914ea81bcd1120d9e57092d4de15c8900466126303d10594ee16e85cf68de88eee19a61b0d1529fce7fdd02bb05dc8e6"}, 0x8f, 0x800) 13:17:38 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r0, &(0x7f0000942000)={0x2, 0x4e20, @multicast1}, 0x10) sendmsg$key(0xffffffffffffffff, &(0x7f0000f56000)={0x0, 0x0, &(0x7f00008feff0)={&(0x7f0000000500)=ANY=[@ANYBLOB="020300090a1500000000000000000000030006190000000002000000e0000001003f00000000000002000100e625aa66dcef85847e479eb3c49000000400000000fd003e"], 0x44}}, 0x0) add_key(&(0x7f0000000080)='logon\x00', &(0x7f0000000100)={0x73, 0x79, 0x7a, 0x1}, &(0x7f0000001240), 0x0, 0xfffffffffffffff8) get_mempolicy(&(0x7f0000000000), &(0x7f00000001c0), 0x1ff, &(0x7f0000fff000/0x1000)=nil, 0x3) setsockopt$sock_int(r0, 0x1, 0x3c, &(0x7f0000d4effc)=0x1, 0x4) connect$inet(r0, &(0x7f0000000000)={0x2, 0x4e20, @dev={0xac, 0x14, 0x14, 0x18}}, 0x10) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f00000001c0)='tunl0\x00', 0x5) sendto$inet(r0, &(0x7f00006d1fd4)="db", 0x1, 0x4000010, &(0x7f00004daff0)={0x2, 0x0, @loopback, [0x0, 0x0, 0xfffffffe]}, 0x10) 13:17:38 executing program 4: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = gettid() perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x3e5}, 0x0, 0x0, 0xffffffffffffffff, 0x0) fcntl$setown(r0, 0x8, r1) bind$inet6(r0, &(0x7f0000807fe4)={0xa, 0x4e22}, 0x1c) sendto$inet6(r0, &(0x7f0000000380), 0x0, 0x200408d4, &(0x7f000072e000)={0xa, 0x4e22, 0x0, @loopback}, 0x1c) sendto$inet6(r0, &(0x7f0000ad6fad)='\x00', 0x1, 0x3fffffd, &(0x7f0000254000)={0xa, 0x4b8, 0x0, @loopback}, 0x1c) 13:17:38 executing program 0: perf_event_open(&(0x7f0000000040)={0x2, 0x70, 0x3e5}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f00000021c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000002340)={0xb5, 0x3, &(0x7f00000000c0)=ANY=[@ANYBLOB="0463044000000000b6a571ac965f26c50d500dae115e59afcd8a338d8b2727193c56d4ebef60c214b766ffde6cff6ceef2baa2594a53a0117e77afd5d58e8a35afdae81b258585ce769507333c0238790d5ed750bf1d6ca2a873050056528fce7becfd12f165ac43a826d3462822ff8f29ea992d4e208847cf4fc10ca00b87b5ce2523fa477bad0be1c97e4398aa2ac81d973b5a871d8e0b295e436cd8415f19088c6c82c85f4ed1fac41da062bc6dbfb8eac4276c"], 0x0, 0x0, &(0x7f00000022c0)}) [ 1560.057970] binder: 18579:18581 BC_REQUEST_DEATH_NOTIFICATION invalid ref 4 [ 1560.077980] binder_thread_write: 18 callbacks suppressed [ 1560.077996] binder: 18579:18581 IncRefs 0 refcount change on invalid ref 4 ret -22 [ 1560.095370] binder_thread_write: 4 callbacks suppressed [ 1560.095383] binder: 18579:18581 BC_INCREFS_DONE u0000000000000000 no match 13:17:38 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r0, &(0x7f0000942000)={0x2, 0x4e20, @multicast1}, 0x10) sendmsg$key(0xffffffffffffffff, &(0x7f0000f56000)={0x0, 0x0, &(0x7f00008feff0)={&(0x7f0000000500)=ANY=[@ANYBLOB="020300090a1500000000000000000000030006190000000002000000e0000001003f00000000000002000100e625aa66dcef85847e479eb3c49000000400000000fd003e"], 0x44}}, 0x0) add_key(&(0x7f0000000080)='logon\x00', &(0x7f0000000100)={0x73, 0x79, 0x7a, 0x1}, &(0x7f0000001240), 0x0, 0xfffffffffffffff8) get_mempolicy(&(0x7f0000000000), &(0x7f00000001c0), 0x1ff, &(0x7f0000fff000/0x1000)=nil, 0x3) setsockopt$sock_int(r0, 0x1, 0x3c, &(0x7f0000d4effc)=0x1, 0x4) connect$inet(r0, &(0x7f0000000000)={0x2, 0x4e20, @dev={0xac, 0x14, 0x14, 0x18}}, 0x10) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f00000001c0)='tunl0\x00', 0x5) sendto$inet(r0, &(0x7f00006d1fd4)="db", 0x1, 0x4000010, &(0x7f00004daff0)={0x2, 0x0, @loopback, [0x0, 0x0, 0x3]}, 0x10) [ 1560.133013] binder: 18579:18581 IncRefs 0 refcount change on invalid ref 0 ret -22 [ 1560.153529] binder: 18579:18581 BC_REQUEST_DEATH_NOTIFICATION invalid ref 4 13:17:38 executing program 3: r0 = openat$cuse(0xffffffffffffff9c, &(0x7f0000000080)='/dev/cuse\x00', 0x2, 0x0) clone(0x1002102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000640), 0xffffffffffffffff) r1 = getpid() sched_setscheduler(r1, 0x5, &(0x7f0000000000)) write$FUSE_NOTIFY_DELETE(r0, &(0x7f0000000040)={0x29, 0x4, 0x100000000000000}, 0x29) [ 1560.180590] binder: 18579:18581 IncRefs 0 refcount change on invalid ref 4 ret -22 13:17:38 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r0, &(0x7f0000942000)={0x2, 0x4e20, @multicast1}, 0x10) sendmsg$key(0xffffffffffffffff, &(0x7f0000f56000)={0x0, 0x0, &(0x7f00008feff0)={&(0x7f0000000500)=ANY=[@ANYBLOB="020300090a1500000000000000000000030006190000000002000000e0000001003f00000000000002000100e625aa66dcef85847e479eb3c49000000400000000fd003e"], 0x44}}, 0x0) add_key(&(0x7f0000000080)='logon\x00', &(0x7f0000000100)={0x73, 0x79, 0x7a, 0x1}, &(0x7f0000001240), 0x0, 0xfffffffffffffff8) get_mempolicy(&(0x7f0000000000), &(0x7f00000001c0), 0x1ff, &(0x7f0000fff000/0x1000)=nil, 0x3) setsockopt$sock_int(r0, 0x1, 0x3c, &(0x7f0000d4effc)=0x1, 0x4) connect$inet(r0, &(0x7f0000000000)={0x2, 0x4e20, @dev={0xac, 0x14, 0x14, 0x18}}, 0x10) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f00000001c0)='tunl0\x00', 0x5) sendto$inet(r0, &(0x7f00006d1fd4)="db", 0x1, 0x4000010, &(0x7f00004daff0)={0x2, 0x0, @loopback, [0x0, 0x0, 0xa00000000000000]}, 0x10) [ 1560.206717] binder: 18579:18581 BC_INCREFS_DONE u0000000000000000 no match [ 1560.227415] binder: 18579:18581 IncRefs 0 refcount change on invalid ref 0 ret -22 13:17:38 executing program 5: r0 = syz_open_dev$binder(&(0x7f00000021c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000002340)={0x34, 0x0, &(0x7f0000002240)=[@request_death={0x400c630e, 0x4, 0x4}, @increfs={0x40046304, 0x4}, @increfs_done={0x40106308, 0x0, 0x3}, @increfs], 0x77, 0x0, &(0x7f00000022c0)="b3cd0976d8e2af743c6f523efe14fd20c3c3dd2572734282a761e1b4300a2599c85f198cc82bd5d0c74c4edca2f9ea7b875ff7047ec0784fbb354e15fd3f7d837f533597d5082692a6f2fb748da3cc4157188f7f2a5477ded56f72f5b75c96872db429e44b8fcd781d96dead77a0b58b7af9085a208a22"}) 13:17:38 executing program 7: r0 = openat$cuse(0xffffffffffffff9c, &(0x7f0000000080)='/dev/cuse\x00', 0x2, 0x0) clone(0x1002102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000640), 0xffffffffffffffff) r1 = getpid() sched_setscheduler(r1, 0x5, &(0x7f0000000000)) write$FUSE_NOTIFY_DELETE(r0, &(0x7f0000000040)={0x29, 0x6, 0x0, {0x0, 0x9}}, 0x29) 13:17:38 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r0, &(0x7f0000942000)={0x2, 0x4e20, @multicast1}, 0x10) sendmsg$key(0xffffffffffffffff, &(0x7f0000f56000)={0x0, 0x0, &(0x7f00008feff0)={&(0x7f0000000500)=ANY=[@ANYBLOB="020300090a1500000000000000000000030006190000000002000000e0000001003f00000000000002000100e625aa66dcef85847e479eb3c49000000400000000fd003e"], 0x44}}, 0x0) add_key(&(0x7f0000000080)='logon\x00', &(0x7f0000000100)={0x73, 0x79, 0x7a, 0x1}, &(0x7f0000001240), 0x0, 0xfffffffffffffff8) get_mempolicy(&(0x7f0000000000), &(0x7f00000001c0), 0x1ff, &(0x7f0000fff000/0x1000)=nil, 0x3) setsockopt$sock_int(r0, 0x1, 0x3c, &(0x7f0000d4effc)=0x1, 0x4) connect$inet(r0, &(0x7f0000000000)={0x2, 0x4e20, @dev={0xac, 0x14, 0x14, 0x18}}, 0x10) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f00000001c0)='tunl0\x00', 0x5) sendto$inet(r0, &(0x7f00006d1fd4)="db", 0x1, 0x4000010, &(0x7f00004daff0)={0x2, 0x0, @loopback, [0x0, 0x0, 0xe00000000000000]}, 0x10) 13:17:38 executing program 6: r0 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000100)='/dev/ppp\x00', 0x402, 0x0) ioctl$SNDRV_TIMER_IOCTL_GSTATUS(r0, 0xc0505405, &(0x7f0000000440)={{0x3, 0x3, 0x7, 0x2, 0x200}, 0x442, 0x401, 0x7ff}) clone(0x802102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000040), 0xffffffffffffffff) r1 = syz_open_dev$sndtimer(&(0x7f0000000000)='/dev/snd/timer\x00', 0x0, 0x0) r2 = getpid() sched_setscheduler(r2, 0x5, &(0x7f0000000200)) ioctl$SNDRV_TIMER_IOCTL_GPARAMS(r1, 0x40485404, &(0x7f0000000240)={{}, 0x0, 0x2000000000000000}) sched_setscheduler(r2, 0x6, &(0x7f0000000080)=0x6) ioctl$EVIOCSFF(r0, 0x40304580, &(0x7f00000004c0)={0x56, 0x10001, 0x9, {0x0, 0x3}, {0x80, 0x3ff}, @period={0x5c, 0x4d9, 0x1, 0x159, 0x200000000000000, {0x8001, 0x3, 0x100000001, 0x5}, 0xa, &(0x7f00000002c0)=[0x8, 0x2, 0x40, 0x9, 0x401, 0x5, 0x10001, 0x2824, 0x2, 0x7]}}) r3 = syz_open_dev$midi(&(0x7f0000000140)='/dev/midi#\x00', 0x3, 0x180) accept4$packet(r3, &(0x7f0000000180)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @link_local}, &(0x7f00000001c0)=0x14, 0x80000) r4 = syz_open_dev$usbmon(&(0x7f00000000c0)='/dev/usbmon#\x00', 0x5, 0x8000) ioctl$VHOST_GET_VRING_ENDIAN(r4, 0x4008af14, &(0x7f0000000300)={0x1, 0x7}) ioctl$KVM_SET_ONE_REG(r0, 0x4010aeac, &(0x7f0000000500)={0x80, 0x7}) ioctl$EVIOCGBITSW(r3, 0x80404525, &(0x7f0000000340)=""/222) [ 1560.332729] binder: 18621:18622 IncRefs 0 refcount change on invalid ref 4 ret -22 [ 1560.341317] binder: 18621:18622 BC_INCREFS_DONE u0000000000000000 no match [ 1560.351308] binder: 18621:18622 IncRefs 0 refcount change on invalid ref 0 ret -22 13:17:38 executing program 3: r0 = openat$cuse(0xffffffffffffff9c, &(0x7f0000000080)='/dev/cuse\x00', 0x2, 0x0) clone(0x1002102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000640), 0xffffffffffffffff) r1 = getpid() sched_setscheduler(r1, 0x5, &(0x7f0000000000)) write$FUSE_NOTIFY_DELETE(r0, &(0x7f0000000040)={0x29, 0x4, 0xc00000000000000}, 0x29) [ 1560.568212] binder: 18651:18652 unknown command 64 [ 1560.573537] binder: 18651:18652 ioctl c0306201 20002340 returned -22 [ 1560.600025] binder: 18651:18654 unknown command 64 [ 1560.606770] binder: 18651:18654 ioctl c0306201 20002340 returned -22 13:17:39 executing program 1: r0 = socket$netlink(0x10, 0x3, 0x8000000004) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_TCP_CONGESTION(r1, 0x6, 0xd, &(0x7f0000000180)='vegas\x00', 0x6) bind$inet6(r1, &(0x7f00001fefe4)={0xa, 0x4e22}, 0x1c) sendto$inet6(r1, &(0x7f0000000100), 0x8d2d601e8976aa5, 0x20000004, &(0x7f000031e000)={0xa, 0x4e22}, 0x1c) writev(r0, &(0x7f0000000100)=[{&(0x7f0000000000)="580000001400192340834b80040d8c560a067f4564ff81004e220000000058000b4824ca944f64009400050028925aa8000000000000008000f0fffeffff09000000fff5dd00000010000100000c0900fcff0000040e05a5", 0x58}], 0x1) 13:17:39 executing program 7: r0 = openat$cuse(0xffffffffffffff9c, &(0x7f0000000080)='/dev/cuse\x00', 0x2, 0x0) clone(0x1002102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000640), 0xffffffffffffffff) r1 = getpid() sched_setscheduler(r1, 0x5, &(0x7f0000000000)) write$FUSE_NOTIFY_DELETE(r0, &(0x7f0000000040)={0x29, 0x6, 0x0, {0x0, 0xa0008000}}, 0x29) 13:17:39 executing program 5: r0 = syz_open_dev$binder(&(0x7f00000021c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000002340)={0x34, 0x0, &(0x7f0000002240)=[@request_death={0x400c630e, 0x4, 0x4}, @increfs={0x40046304, 0x4}, @increfs_done={0x40106308, 0x0, 0x3}, @increfs], 0x77, 0x0, &(0x7f00000022c0)="b3cd0976d8e2af743c6f523efe14fd20c3c3dd2572734282a761e1b4304e5499c85f198cc82bd5d0c74c4edca2f9ea7b875ff7047ec0784fbb354e15fd3f7d837f533597d5082692a6f2fb748da3cc4157188f7f2a5477ded56f72f5b75c96872db429e44b8fcd781d96dead77a0b58b7af9085a208a22"}) 13:17:39 executing program 3: r0 = openat$cuse(0xffffffffffffff9c, &(0x7f0000000080)='/dev/cuse\x00', 0x2, 0x0) clone(0x1002102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000640), 0xffffffffffffffff) r1 = getpid() sched_setscheduler(r1, 0x5, &(0x7f0000000000)) write$FUSE_NOTIFY_DELETE(r0, &(0x7f0000000040)={0x29, 0x4, 0xb00000000000000}, 0x29) 13:17:39 executing program 6: clone(0x802102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000040), 0xffffffffffffffff) r0 = syz_open_dev$sndtimer(&(0x7f0000000000)='/dev/snd/timer\x00', 0x0, 0x0) openat$selinux_member(0xffffffffffffff9c, &(0x7f0000000080)='/selinux/member\x00', 0x2, 0x0) r1 = getpid() sched_setscheduler(r1, 0x5, &(0x7f0000000200)) ioctl$SNDRV_TIMER_IOCTL_GPARAMS(r0, 0x40485404, &(0x7f0000000240)={{}, 0x0, 0x2000000000000000}) 13:17:39 executing program 4: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = gettid() perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x3e5}, 0x0, 0x0, 0xffffffffffffffff, 0x0) fcntl$setown(r0, 0x8, r1) bind$inet6(r0, &(0x7f0000807fe4)={0xa, 0x4e22}, 0x1c) sendto$inet6(r0, &(0x7f0000000380), 0x0, 0x200408d4, &(0x7f000072e000)={0xa, 0x4e22, 0x0, @loopback}, 0x1c) sendto$inet6(r0, &(0x7f0000ad6fad)='\x00', 0x1, 0x3fffffd, &(0x7f0000254000)={0xa, 0x240, 0x0, @loopback}, 0x1c) 13:17:39 executing program 0: perf_event_open(&(0x7f0000000040)={0x2, 0x70, 0x3e5}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f00000021c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000002340)={0xb5, 0x7a00000000000000, &(0x7f00000000c0)=ANY=[@ANYBLOB="0463044000000000b6a571ac965f26c50d500dae115e59afcd8a338d8b2727193c56d4ebef60c214b766ffde6cff6ceef2baa2594a53a0117e77afd5d58e8a35afdae81b258585ce769507333c0238790d5ed750bf1d6ca2a873050056528fce7becfd12f165ac43a826d3462822ff8f29ea992d4e208847cf4fc10ca00b87b5ce2523fa477bad0be1c97e4398aa2ac81d973b5a871d8e0b295e436cd8415f19088c6c82c85f4ed1fac41da062bc6dbfb8eac4276c"], 0x0, 0x0, &(0x7f00000022c0)}) 13:17:39 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r0, &(0x7f0000942000)={0x2, 0x4e20, @multicast1}, 0x10) sendmsg$key(0xffffffffffffffff, &(0x7f0000f56000)={0x0, 0x0, &(0x7f00008feff0)={&(0x7f0000000500)=ANY=[@ANYBLOB="020300090a1500000000000000000000030006190000000002000000e0000001003f00000000000002000100e625aa66dcef85847e479eb3c49000000400000000fd003e"], 0x44}}, 0x0) add_key(&(0x7f0000000080)='logon\x00', &(0x7f0000000100)={0x73, 0x79, 0x7a, 0x1}, &(0x7f0000001240), 0x0, 0xfffffffffffffff8) get_mempolicy(&(0x7f0000000000), &(0x7f00000001c0), 0x1ff, &(0x7f0000fff000/0x1000)=nil, 0x3) setsockopt$sock_int(r0, 0x1, 0x3c, &(0x7f0000d4effc)=0x1, 0x4) connect$inet(r0, &(0x7f0000000000)={0x2, 0x4e20, @dev={0xac, 0x14, 0x14, 0x18}}, 0x10) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f00000001c0)='tunl0\x00', 0x5) sendto$inet(r0, &(0x7f00006d1fd4)="db", 0x1, 0x4000010, &(0x7f00004daff0)={0x2, 0x0, @loopback, [0x0, 0x0, 0x500]}, 0x10) 13:17:39 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r0, &(0x7f0000942000)={0x2, 0x4e20, @multicast1}, 0x10) sendmsg$key(0xffffffffffffffff, &(0x7f0000f56000)={0x0, 0x0, &(0x7f00008feff0)={&(0x7f0000000500)=ANY=[@ANYBLOB="020300090a1500000000000000000000030006190000000002000000e0000001003f00000000000002000100e625aa66dcef85847e479eb3c49000000400000000fd003e"], 0x44}}, 0x0) add_key(&(0x7f0000000080)='logon\x00', &(0x7f0000000100)={0x73, 0x79, 0x7a, 0x1}, &(0x7f0000001240), 0x0, 0xfffffffffffffff8) get_mempolicy(&(0x7f0000000000), &(0x7f00000001c0), 0x1ff, &(0x7f0000fff000/0x1000)=nil, 0x3) setsockopt$sock_int(r0, 0x1, 0x3c, &(0x7f0000d4effc)=0x1, 0x4) connect$inet(r0, &(0x7f0000000000)={0x2, 0x4e20, @dev={0xac, 0x14, 0x14, 0x18}}, 0x10) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f00000001c0)='tunl0\x00', 0x5) sendto$inet(r0, &(0x7f00006d1fd4)="db", 0x1, 0x4000010, &(0x7f00004daff0)={0x2, 0x0, @loopback, [0x0, 0x0, 0xffffffff00000000]}, 0x10) 13:17:39 executing program 6: clone(0x802102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000040), 0xffffffffffffffff) r0 = syz_open_dev$sndtimer(&(0x7f0000000000)='/dev/snd/timer\x00', 0x0, 0x80000008840) r1 = getpid() sysfs$1(0x1, &(0x7f0000000080)='.user\x00') sched_setscheduler(r1, 0x5, &(0x7f0000000200)) ioctl$SNDRV_TIMER_IOCTL_GPARAMS(r0, 0x40485404, &(0x7f0000000240)={{}, 0x0, 0x2000000000000000}) 13:17:39 executing program 3: r0 = openat$cuse(0xffffffffffffff9c, &(0x7f0000000080)='/dev/cuse\x00', 0x2, 0x0) clone(0x1002102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000640), 0xffffffffffffffff) r1 = getpid() sched_setscheduler(r1, 0x5, &(0x7f0000000000)) write$FUSE_NOTIFY_DELETE(r0, &(0x7f0000000040)={0x29, 0x4, 0xb000000}, 0x29) [ 1561.003412] binder: 18660:18670 IncRefs 0 refcount change on invalid ref 4 ret -22 [ 1561.014521] binder: 18660:18670 BC_INCREFS_DONE u0000000000000000 no match [ 1561.023036] binder: 18660:18670 IncRefs 0 refcount change on invalid ref 0 ret -22 13:17:39 executing program 3: r0 = openat$cuse(0xffffffffffffff9c, &(0x7f0000000080)='/dev/cuse\x00', 0x2, 0x0) clone(0x1002102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000640), 0xffffffffffffffff) r1 = getpid() sched_setscheduler(r1, 0x5, &(0x7f0000000000)) write$FUSE_NOTIFY_DELETE(r0, &(0x7f0000000040)={0x29, 0x4, 0x8000000}, 0x29) 13:17:39 executing program 6: clone(0x802102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000040), 0xffffffffffffffff) r0 = gettid() sched_setattr(r0, &(0x7f0000000000)={0x30, 0x6, 0x1, 0x1c, 0x0, 0x9, 0x100}, 0x0) r1 = syz_open_dev$sndtimer(&(0x7f0000000100)='/dev/snd/timer\x00', 0x0, 0x200) r2 = getpid() sched_setscheduler(r2, 0x3, &(0x7f0000000200)=0x8) ioctl$SNDRV_TIMER_IOCTL_GPARAMS(r1, 0x40485404, &(0x7f0000000240)={{}, 0x0, 0x2000000000000000}) 13:17:39 executing program 5: r0 = syz_open_dev$binder(&(0x7f00000021c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000002340)={0x34, 0x0, &(0x7f0000002240)=[@request_death={0x400c630e, 0x4, 0x4}, @increfs={0x40046304, 0x4}, @increfs_done={0x40106308, 0x0, 0x3}, @increfs], 0x77, 0x0, &(0x7f00000022c0)="b3cd0976d8e2af743c6f523efe14fd20c3c3dd2572734282a761e1b4304e3b99c85f198cc82bd5d0c74c4edca2f9ea7b875ff7047ec0784fbb354e15fd3f7d837f533597d5082692a6f2fb748da3cc4157188f7f2a5477ded56f72f5b75c96872db429e44b8fcd781d96dead77a0b58b7af9085a208a22"}) 13:17:39 executing program 6: clone(0x802102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000040), 0xffffffffffffffff) r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000800)='cpuacct.usage_percpu\x00', 0x0, 0x0) bpf$MAP_LOOKUP_ELEM(0x1, &(0x7f0000000a00)={r0, &(0x7f0000000900)="9dc793951f85d9e5e7a5d9b87d74cd4da37b5112715ebaa67b0275697c3a2120afd161a7f454642a42c28be621602ef4650659685ddcc6e1325c29e1fdedb248df21816ea5fc", &(0x7f0000000980)=""/122}, 0x18) r1 = syz_open_dev$sndtimer(&(0x7f0000000840)='/dev/snd/timer\x00', 0x0, 0x10000) r2 = syz_open_dev$dmmidi(&(0x7f0000000000)='/dev/dmmidi#\x00', 0x5, 0x80) write$selinux_validatetrans(r2, &(0x7f0000000880)=ANY=[@ANYBLOB="73797774656d5f753a6f626a6563745f723a6b736d5f6465766963655f743a73302073797374656d5f753a6f626a6563745f723a6574635f72756e74696d655f743a7330203030303030303030303030303030303030303634202f7573722f7362696e2f637570732d62726f773d1d94ee"], 0x71) r3 = getpid() sched_setscheduler(r3, 0x5, &(0x7f0000000200)) ioctl$SNDRV_TIMER_IOCTL_GPARAMS(r1, 0x40485404, &(0x7f0000000240)={{}, 0x0, 0x2000000000000000}) r4 = request_key(&(0x7f0000000140)='syzkaller\x00', &(0x7f0000000180)={0x73, 0x79, 0x7a, 0x2}, &(0x7f00000001c0)='/dev/snd/timer\x00', 0xfffffffffffffffa) request_key(&(0x7f0000000080)='cifs.idmap\x00', &(0x7f00000000c0)={0x73, 0x79, 0x7a, 0x1}, &(0x7f0000000100)='/dev/snd/timer\x00', r4) r5 = openat$null(0xffffffffffffff9c, &(0x7f00000002c0)='/dev/null\x00', 0x0, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_READ(r5, 0xc4c85512, &(0x7f0000000300)={{0x3, 0xf624b10609ae7a72, 0x80, 0x1, '\x00', 0x4b46cc27}, 0x1, [0x38ef93fd, 0x3, 0x5, 0xffffffffffff6a0a, 0x8001, 0xfff, 0x0, 0x449, 0x0, 0x1c01, 0x4, 0x4, 0xbb5, 0x100000001, 0x7, 0x4, 0xea, 0x2, 0xfffffffffffffffa, 0x48000000000, 0x7fff, 0x6, 0x5, 0x16, 0x80, 0x80000000, 0x81, 0x6, 0x7fff, 0x5, 0x5, 0x43, 0x3, 0x6, 0x1, 0xd811, 0xeb, 0x7f, 0x8, 0xfffffffffffffffd, 0xa76, 0x1ff, 0x6, 0x7, 0x0, 0x3, 0x8, 0x5, 0x5, 0x2db, 0x1c7a, 0x4653, 0x24c6, 0x6, 0x0, 0x5, 0x0, 0x1ff, 0x9, 0x1, 0x2, 0xd5, 0x2, 0x6, 0x7fffffff, 0x7, 0x20, 0x923, 0x101, 0x8, 0x994, 0x7ff, 0x5, 0x2, 0xabc, 0x0, 0xfff, 0xb9, 0x9, 0x7, 0x20f6d20d, 0x7, 0x8124, 0x3, 0x1f, 0xffffffffffffff01, 0x15d, 0x6, 0x2, 0xca, 0x2, 0x3f, 0x5fca, 0x6, 0x6, 0x0, 0x9, 0x3f, 0x80000001, 0x6ec, 0xfffffffffffffe01, 0x8000, 0xfffffffffffff664, 0x1, 0x10000, 0x1f, 0x2, 0x1, 0x0, 0x1f, 0x0, 0x200, 0x2, 0x3, 0xe2ef, 0xabba, 0x81, 0x1f, 0x20, 0x7fff, 0x101, 0x0, 0x7fffffff, 0xaf4, 0xd84, 0x9, 0x4, 0x3], {0x0, 0x989680}}) 13:17:39 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r0, &(0x7f0000942000)={0x2, 0x4e20, @multicast1}, 0x10) sendmsg$key(0xffffffffffffffff, &(0x7f0000f56000)={0x0, 0x0, &(0x7f00008feff0)={&(0x7f0000000500)=ANY=[@ANYBLOB="020300090a1500000000000000000000030006190000000002000000e0000001003f00000000000002000100e625aa66dcef85847e479eb3c49000000400000000fd003e"], 0x44}}, 0x0) add_key(&(0x7f0000000080)='logon\x00', &(0x7f0000000100)={0x73, 0x79, 0x7a, 0x1}, &(0x7f0000001240), 0x0, 0xfffffffffffffff8) get_mempolicy(&(0x7f0000000000), &(0x7f00000001c0), 0x1ff, &(0x7f0000fff000/0x1000)=nil, 0x3) setsockopt$sock_int(r0, 0x1, 0x3c, &(0x7f0000d4effc)=0x1, 0x4) connect$inet(r0, &(0x7f0000000000)={0x2, 0x4e20, @dev={0xac, 0x14, 0x14, 0x18}}, 0x10) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f00000001c0)='tunl0\x00', 0x5) sendto$inet(r0, &(0x7f00006d1fd4)="db", 0x1, 0x4000010, &(0x7f00004daff0)={0x2, 0x0, @loopback, [0x0, 0x0, 0xe8030000]}, 0x10) [ 1561.248961] binder: 18714:18715 IncRefs 0 refcount change on invalid ref 4 ret -22 [ 1561.291560] binder: 18714:18715 BC_INCREFS_DONE u0000000000000000 no match [ 1561.321051] binder: 18714:18715 IncRefs 0 refcount change on invalid ref 0 ret -22 13:17:39 executing program 3: r0 = openat$cuse(0xffffffffffffff9c, &(0x7f0000000080)='/dev/cuse\x00', 0x2, 0x0) clone(0x1002102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000640), 0xffffffffffffffff) r1 = getpid() sched_setscheduler(r1, 0x5, &(0x7f0000000000)) write$FUSE_NOTIFY_DELETE(r0, &(0x7f0000000040)={0x29, 0x4, 0x6}, 0x29) 13:17:39 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r0, &(0x7f0000942000)={0x2, 0x4e20, @multicast1}, 0x10) sendmsg$key(0xffffffffffffffff, &(0x7f0000f56000)={0x0, 0x0, &(0x7f00008feff0)={&(0x7f0000000500)=ANY=[@ANYBLOB="020300090a1500000000000000000000030006190000000002000000e0000001003f00000000000002000100e625aa66dcef85847e479eb3c49000000400000000fd003e"], 0x44}}, 0x0) add_key(&(0x7f0000000080)='logon\x00', &(0x7f0000000100)={0x73, 0x79, 0x7a, 0x1}, &(0x7f0000001240), 0x0, 0xfffffffffffffff8) get_mempolicy(&(0x7f0000000000), &(0x7f00000001c0), 0x1ff, &(0x7f0000fff000/0x1000)=nil, 0x3) setsockopt$sock_int(r0, 0x1, 0x3c, &(0x7f0000d4effc)=0x1, 0x4) connect$inet(r0, &(0x7f0000000000)={0x2, 0x4e20, @dev={0xac, 0x14, 0x14, 0x18}}, 0x10) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f00000001c0)='tunl0\x00', 0x5) sendto$inet(r0, &(0x7f00006d1fd4)="db", 0x1, 0x4000010, &(0x7f00004daff0)={0x2, 0x0, @loopback, [0x0, 0x0, 0x5580]}, 0x10) 13:17:39 executing program 5: r0 = syz_open_dev$binder(&(0x7f00000021c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000002340)={0x34, 0x0, &(0x7f0000002240)=[@request_death={0x400c630e, 0x4, 0x4}, @increfs={0x40046304, 0x4}, @increfs_done={0x40106308, 0x0, 0x3}, @increfs], 0x77, 0x0, &(0x7f00000022c0)="b3cd0976d8e2af743c6f523efe14fd20c3c3dd2572734282a761e1b4304e4c99c85f198cc82bd5d0c74c4edca2f9ea7b875ff7047ec0784fbb354e15fd3f7d837f533597d5082692a6f2fb748da3cc4157188f7f2a5477ded56f72f5b75c96872db429e44b8fcd781d96dead77a0b58b7af9085a208a22"}) 13:17:39 executing program 6: clone(0x802102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000040), 0xffffffffffffffff) r0 = syz_open_dev$sndtimer(&(0x7f0000000080)='/dev/snd/timer\x00', 0x0, 0x0) r1 = getpid() sched_setscheduler(r1, 0x5, &(0x7f0000000200)) ioctl$SNDRV_TIMER_IOCTL_GPARAMS(r0, 0x40485404, &(0x7f0000000240)={{}, 0x0, 0x2000000000000000}) 13:17:39 executing program 7: r0 = openat$cuse(0xffffffffffffff9c, &(0x7f0000000080)='/dev/cuse\x00', 0x2, 0x0) clone(0x1002102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000640), 0xffffffffffffffff) r1 = getpid() sched_setscheduler(r1, 0x5, &(0x7f0000000000)) write$FUSE_NOTIFY_DELETE(r0, &(0x7f0000000040)={0x29, 0x6, 0x0, {0x0, 0xa00}}, 0x29) 13:17:39 executing program 4: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = gettid() perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x3e5}, 0x0, 0x0, 0xffffffffffffffff, 0x0) fcntl$setown(r0, 0x8, r1) bind$inet6(r0, &(0x7f0000807fe4)={0xa, 0x4e22}, 0x1c) sendto$inet6(r0, &(0x7f0000000380), 0x0, 0x200408d4, &(0x7f000072e000)={0xa, 0x4e22, 0x0, @loopback}, 0x1c) sendto$inet6(r0, &(0x7f0000ad6fad)='\x00', 0x1, 0x3fffffd, &(0x7f0000254000)={0xa, 0xa00000000000000, 0x0, @loopback}, 0x1c) 13:17:39 executing program 1: r0 = socket$netlink(0x10, 0x3, 0x8000000004) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_TCP_CONGESTION(r1, 0x6, 0xd, &(0x7f0000000180)='vegas\x00', 0x6) bind$inet6(r1, &(0x7f00001fefe4)={0xa, 0x4e22}, 0x1c) sendto$inet6(r1, &(0x7f0000000100), 0x8d2d601e8976aa5, 0x20000004, &(0x7f000031e000)={0xa, 0x4e22}, 0x1c) writev(r0, &(0x7f0000000100)=[{&(0x7f0000000000)="580000001400192340834b80040d8c560a067ff52fff81004e220000000058000b4824ca944f64009400050028925aa8000000000000008000f0fffeffff09000000fff5dd00000010000100000c0900fcff0000040e05a5", 0x58}], 0x1) 13:17:39 executing program 0: perf_event_open(&(0x7f0000000040)={0x2, 0x70, 0x3e5}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f00000021c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000002340)={0xb5, 0x8002a0, &(0x7f00000000c0)=ANY=[@ANYBLOB="0463044000000000b6a571ac965f26c50d500dae115e59afcd8a338d8b2727193c56d4ebef60c214b766ffde6cff6ceef2baa2594a53a0117e77afd5d58e8a35afdae81b258585ce769507333c0238790d5ed750bf1d6ca2a873050056528fce7becfd12f165ac43a826d3462822ff8f29ea992d4e208847cf4fc10ca00b87b5ce2523fa477bad0be1c97e4398aa2ac81d973b5a871d8e0b295e436cd8415f19088c6c82c85f4ed1fac41da062bc6dbfb8eac4276c"], 0x0, 0x0, &(0x7f00000022c0)}) 13:17:39 executing program 7: r0 = openat$cuse(0xffffffffffffff9c, &(0x7f0000000080)='/dev/cuse\x00', 0x2, 0x0) clone(0x1002102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000640), 0xffffffffffffffff) r1 = getpid() sched_setscheduler(r1, 0x5, &(0x7f0000000000)) write$FUSE_NOTIFY_DELETE(r0, &(0x7f0000000040)={0x29, 0x6, 0x0, {0x0, 0xffffffffa0008000}}, 0x29) [ 1561.862430] binder: 18747:18753 BC_INCREFS_DONE u0000000000000000 no match 13:17:40 executing program 5: r0 = syz_open_dev$binder(&(0x7f00000021c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000002340)={0x34, 0x0, &(0x7f0000002240)=[@request_death={0x400c630e, 0x4, 0x4}, @increfs={0x40046304, 0x4}, @increfs_done={0x40106308, 0x0, 0x3}, @increfs], 0x77, 0x0, &(0x7f00000022c0)="b3cd0976d8e2af743c6f523efe14fd20c3c3dd2572734282a761e1b4304e4d99c85f198cc82bd5d0c74c4edca2f9ea7b875ff7047ec0784fbb354e15fd3f7d837f533597d5082692a6f2fb748da3cc4157188f7f2a5477ded56f72f5b75c96872db429e44b8fcd781d96dead77a0b58b7af9085a208a22"}) 13:17:40 executing program 7: r0 = openat$cuse(0xffffffffffffff9c, &(0x7f0000000080)='/dev/cuse\x00', 0x2, 0x0) clone(0x1002102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000640), 0xffffffffffffffff) r1 = getpid() sched_setscheduler(r1, 0x5, &(0x7f0000000000)) write$FUSE_NOTIFY_DELETE(r0, &(0x7f0000000040)={0x29, 0x6, 0x0, {0x0, 0xffffffffa0010000}}, 0x29) 13:17:40 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r0, &(0x7f0000942000)={0x2, 0x4e20, @multicast1}, 0x10) sendmsg$key(0xffffffffffffffff, &(0x7f0000f56000)={0x0, 0x0, &(0x7f00008feff0)={&(0x7f0000000500)=ANY=[@ANYBLOB="020300090a1500000000000000000000030006190000000002000000e0000001003f00000000000002000100e625aa66dcef85847e479eb3c49000000400000000fd003e"], 0x44}}, 0x0) add_key(&(0x7f0000000080)='logon\x00', &(0x7f0000000100)={0x73, 0x79, 0x7a, 0x1}, &(0x7f0000001240), 0x0, 0xfffffffffffffff8) get_mempolicy(&(0x7f0000000000), &(0x7f00000001c0), 0x1ff, &(0x7f0000fff000/0x1000)=nil, 0x3) setsockopt$sock_int(r0, 0x1, 0x3c, &(0x7f0000d4effc)=0x1, 0x4) connect$inet(r0, &(0x7f0000000000)={0x2, 0x4e20, @dev={0xac, 0x14, 0x14, 0x18}}, 0x10) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f00000001c0)='tunl0\x00', 0x5) sendto$inet(r0, &(0x7f00006d1fd4)="db", 0x1, 0x4000010, &(0x7f00004daff0)={0x2, 0x0, @loopback, [0x0, 0x0, 0xfffffff2]}, 0x10) 13:17:40 executing program 3: r0 = openat$cuse(0xffffffffffffff9c, &(0x7f0000000080)='/dev/cuse\x00', 0x2, 0x0) clone(0x1002102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000640), 0xffffffffffffffff) r1 = getpid() sched_setscheduler(r1, 0x5, &(0x7f0000000000)) write$FUSE_NOTIFY_DELETE(r0, &(0x7f0000000040)={0x29, 0x4, 0x9}, 0x29) 13:17:40 executing program 7: r0 = openat$cuse(0xffffffffffffff9c, &(0x7f0000000080)='/dev/cuse\x00', 0x2, 0x0) clone(0x1002102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000640), 0xffffffffffffffff) r1 = getpid() sched_setscheduler(r1, 0x5, &(0x7f0000000000)) write$FUSE_NOTIFY_DELETE(r0, &(0x7f0000000040)={0x29, 0x6, 0x0, {0x0, 0x400000000000000}}, 0x29) 13:17:40 executing program 6: clone(0x802102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000040), 0xffffffffffffffff) r0 = syz_open_dev$sndtimer(&(0x7f0000000000)='/dev/snd/timer\x00', 0x0, 0x0) r1 = openat$selinux_avc_cache_stats(0xffffffffffffff9c, &(0x7f0000000080)='/selinux/avc/cache_stats\x00', 0x0, 0x0) setsockopt$bt_hci_HCI_TIME_STAMP(r1, 0x0, 0x3, &(0x7f00000000c0)=0x7fff, 0x4) r2 = getpid() sched_setscheduler(r2, 0x5, &(0x7f0000000200)) ioctl$SNDRV_TIMER_IOCTL_GPARAMS(r0, 0x40485404, &(0x7f0000000240)={{}, 0x0, 0x2000000000000000}) 13:17:40 executing program 6: syz_open_dev$sndtimer(&(0x7f0000000200)='/dev/snd/timer\x00', 0x0, 0x80) clone(0x802102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000040), 0xffffffffffffffff) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000000300)={0x0, 0x0}, &(0x7f0000000340)=0xc) stat(&(0x7f0000000380)='./file0\x00', &(0x7f00000003c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_mount_image$msdos(&(0x7f00000000c0)='msdos\x00', &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f00000002c0)=[{&(0x7f0000000140)="bd72b92fad44d98387f501a318f4a682fa8203a277be43bf8c7851970db706d6d016a199baa359e124a2d043150c8f433d3ea779494be3c3a71702465dfb53c6aa9c8a3581f9aaeb3b5bcd", 0x4b, 0xfff}, {&(0x7f00000001c0)="173809345532a4d2f8f6057cd100b4a8e0ae0efa7caa0461874d75ece509f49d9ac71a68", 0x24, 0x8}], 0x40, &(0x7f0000000440)=ANY=[@ANYBLOB='dots,uid=', @ANYRESHEX=r0, @ANYBLOB="2c67c5663d", @ANYRESHEX=r1, @ANYBLOB=',time_offset=0x0000000000000045,nodots,nodots,nodots,sys_immutable,showexec,\x00']) r2 = syz_open_dev$sndtimer(&(0x7f0000000000)='/dev/snd/timer\x00', 0x0, 0x0) r3 = getpid() r4 = openat$ipvs(0xffffffffffffff9c, &(0x7f0000000500)='/proc/sys/net/ipv4/vs/sync_qlen_max\x00', 0x2, 0x0) ioctl$EVIOCRMFF(r4, 0x40044581, &(0x7f0000000540)=0x6) sched_setscheduler(r3, 0x5, &(0x7f00000004c0)=0x5) r5 = openat$audio(0xffffffffffffff9c, &(0x7f0000000080)='/dev/audio\x00', 0x80000, 0x0) ioctl$KDADDIO(r5, 0x4b34, 0x8) ioctl$SNDRV_TIMER_IOCTL_GPARAMS(r2, 0x40485404, &(0x7f0000000240)={{}, 0x0, 0x2000000000000000}) fcntl$getown(r2, 0x9) 13:17:40 executing program 3: r0 = openat$cuse(0xffffffffffffff9c, &(0x7f0000000080)='/dev/cuse\x00', 0x2, 0x0) clone(0x1002102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000640), 0xffffffffffffffff) r1 = getpid() sched_setscheduler(r1, 0x5, &(0x7f0000000000)) write$FUSE_NOTIFY_DELETE(r0, &(0x7f0000000040)={0x29, 0x4, 0x0, {0x6}}, 0x29) [ 1562.110559] binder: 18790:18803 BC_INCREFS_DONE u0000000000000000 no match 13:17:40 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r0, &(0x7f0000942000)={0x2, 0x4e20, @multicast1}, 0x10) sendmsg$key(0xffffffffffffffff, &(0x7f0000f56000)={0x0, 0x0, &(0x7f00008feff0)={&(0x7f0000000500)=ANY=[@ANYBLOB="020300090a1500000000000000000000030006190000000002000000e0000001003f00000000000002000100e625aa66dcef85847e479eb3c49000000400000000fd003e"], 0x44}}, 0x0) add_key(&(0x7f0000000080)='logon\x00', &(0x7f0000000100)={0x73, 0x79, 0x7a, 0x1}, &(0x7f0000001240), 0x0, 0xfffffffffffffff8) get_mempolicy(&(0x7f0000000000), &(0x7f00000001c0), 0x1ff, &(0x7f0000fff000/0x1000)=nil, 0x3) setsockopt$sock_int(r0, 0x1, 0x3c, &(0x7f0000d4effc)=0x1, 0x4) connect$inet(r0, &(0x7f0000000000)={0x2, 0x4e20, @dev={0xac, 0x14, 0x14, 0x18}}, 0x10) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f00000001c0)='tunl0\x00', 0x5) sendto$inet(r0, &(0x7f00006d1fd4)="db", 0x1, 0x4000010, &(0x7f00004daff0)={0x2, 0x0, @loopback, [0x0, 0x0, 0x11]}, 0x10) 13:17:40 executing program 3: r0 = openat$cuse(0xffffffffffffff9c, &(0x7f0000000080)='/dev/cuse\x00', 0x2, 0x0) clone(0x1002102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000640), 0xffffffffffffffff) r1 = getpid() sched_setscheduler(r1, 0x5, &(0x7f0000000000)) write$FUSE_NOTIFY_DELETE(r0, &(0x7f0000000040)={0x29, 0x4, 0x0, {0x9}}, 0x29) 13:17:40 executing program 5: r0 = syz_open_dev$binder(&(0x7f00000021c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000002340)={0x34, 0x0, &(0x7f0000002240)=[@request_death={0x400c630e, 0x4, 0x4}, @increfs={0x40046304, 0x4}, @increfs_done={0x40106308, 0x0, 0x3}, @increfs], 0x77, 0x0, &(0x7f00000022c0)="b3cd0976d8e2af743c6f523efe14fd20c3c3dd2572734282a761e1b4304e2599c80a198cc82bd5d0c74c4edca2f9ea7b875ff7047ec0784fbb354e15fd3f7d837f533597d5082692a6f2fb748da3cc4157188f7f2a5477ded56f72f5b75c96872db429e44b8fcd781d96dead77a0b58b7af9085a208a22"}) 13:17:40 executing program 6: clone(0x802102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000040), 0xffffffffffffffff) r0 = syz_open_dev$sndtimer(&(0x7f0000000000)='/dev/snd/timer\x00', 0x0, 0x0) r1 = getpid() sched_setscheduler(r1, 0x5, &(0x7f0000000200)) ioctl$SNDRV_TIMER_IOCTL_GPARAMS(r0, 0x40485404, &(0x7f0000000240)={{}, 0x0, 0x2000000000000000}) [ 1562.348386] binder: 18845:18846 BC_INCREFS_DONE u0000000000000000 no match 13:17:40 executing program 7: r0 = openat$cuse(0xffffffffffffff9c, &(0x7f0000000080)='/dev/cuse\x00', 0x2, 0x0) clone(0x1002102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000640), 0xffffffffffffffff) r1 = getpid() sched_setscheduler(r1, 0x5, &(0x7f0000000000)) write$FUSE_NOTIFY_DELETE(r0, &(0x7f0000000040)={0x29, 0x6, 0x0, {0x0, 0x600000000000000}}, 0x29) 13:17:40 executing program 1: r0 = socket$netlink(0x10, 0x3, 0x8000000004) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_TCP_CONGESTION(r1, 0x6, 0xd, &(0x7f0000000180)='vegas\x00', 0x6) bind$inet6(r1, &(0x7f00001fefe4)={0xa, 0x4e22}, 0x1c) sendto$inet6(r1, &(0x7f0000000100), 0x8d2d601e8976aa5, 0x20000004, &(0x7f000031e000)={0xa, 0x4e22}, 0x1c) writev(r0, &(0x7f0000000100)=[{&(0x7f0000000000)="580000001400192340834b80040d8c560a067f408cff81004e220000000058000b4824ca944f64009400050028925aa8000000000000008000f0fffeffff09000000fff5dd00000010000100000c0900fcff0000040e05a5", 0x58}], 0x1) 13:17:40 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r0, &(0x7f0000942000)={0x2, 0x4e20, @multicast1}, 0x10) sendmsg$key(0xffffffffffffffff, &(0x7f0000f56000)={0x0, 0x0, &(0x7f00008feff0)={&(0x7f0000000500)=ANY=[@ANYBLOB="020300090a1500000000000000000000030006190000000002000000e0000001003f00000000000002000100e625aa66dcef85847e479eb3c49000000400000000fd003e"], 0x44}}, 0x0) add_key(&(0x7f0000000080)='logon\x00', &(0x7f0000000100)={0x73, 0x79, 0x7a, 0x1}, &(0x7f0000001240), 0x0, 0xfffffffffffffff8) get_mempolicy(&(0x7f0000000000), &(0x7f00000001c0), 0x1ff, &(0x7f0000fff000/0x1000)=nil, 0x3) setsockopt$sock_int(r0, 0x1, 0x3c, &(0x7f0000d4effc)=0x1, 0x4) connect$inet(r0, &(0x7f0000000000)={0x2, 0x4e20, @dev={0xac, 0x14, 0x14, 0x18}}, 0x10) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f00000001c0)='tunl0\x00', 0x5) sendto$inet(r0, &(0x7f00006d1fd4)="db", 0x1, 0x4000010, &(0x7f00004daff0)={0x2, 0x0, @loopback, [0x0, 0x0, 0x500000000000000]}, 0x10) 13:17:40 executing program 6: clone(0x802102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f00000002c0), 0xffffffffffffffff) r0 = syz_open_dev$sndtimer(&(0x7f0000000300)='/dev/snd/timer\x00', 0x0, 0x10001) r1 = getpid() r2 = syz_open_dev$admmidi(&(0x7f0000000040)='/dev/admmidi#\x00', 0x41, 0x2) write$P9_RRENAME(r2, &(0x7f0000000340)={0x7, 0x15, 0x1}, 0x7) sched_setscheduler(r1, 0x5, &(0x7f0000000200)) ioctl$SNDRV_TIMER_IOCTL_GPARAMS(r0, 0x40485404, &(0x7f0000000240)={{}, 0x0, 0x2000000000000000}) sched_getaffinity(r1, 0xffffffffffffff16, &(0x7f0000000080)) perf_event_open(&(0x7f0000000380)={0x2, 0x70, 0x2, 0x6, 0x9, 0x6, 0x0, 0x6, 0x20, 0xf, 0x7fff, 0x5, 0xad34, 0xfffffffffffffff7, 0xdb0, 0x0, 0x92e, 0x3ff800000000000, 0x8001, 0x7, 0x4, 0x6, 0x9, 0x7, 0x1, 0x3, 0x5, 0x7, 0x1, 0x6, 0x80000001, 0x1, 0x8, 0x4, 0x1ff, 0x536, 0x0, 0x101, 0x0, 0x3, 0x4, @perf_config_ext={0x743, 0xd9}, 0x40, 0x3c, 0x0, 0x1, 0x1, 0x5, 0x7}, r1, 0xd, r2, 0x8) ptrace(0x4208, r1) ioctl$SNDRV_TIMER_IOCTL_GSTATUS(r0, 0xc0505405, &(0x7f00000000c0)={{0x1, 0xcb33d0a2ea85b644, 0x6, 0x3, 0x100000000}, 0x6, 0x9, 0x9}) r3 = syz_open_dev$admmidi(&(0x7f00000001c0)='/dev/admmidi#\x00', 0x80000000, 0x80000) perf_event_open(&(0x7f0000000140)={0x7, 0x70, 0x8, 0x3, 0x2, 0x4, 0x0, 0x1800000, 0x8000, 0x4, 0x3, 0xffffffffffffffa1, 0x9, 0x8000, 0x1, 0x9, 0x2, 0x7fffffff, 0x5de, 0x2, 0x4, 0xffffffff, 0xffffffff, 0x4, 0xf1f, 0x3, 0x17a6, 0x0, 0x8, 0xc00000, 0xfffffffffffffff7, 0x8, 0x3, 0xd71, 0x3, 0x1, 0xd909, 0x100, 0x0, 0x9, 0x4, @perf_bp={&(0x7f0000000000), 0x4}, 0x206, 0x101, 0x0, 0x7, 0x6, 0x2f, 0x396e5512}, r1, 0x0, r3, 0x2) 13:17:40 executing program 5: r0 = syz_open_dev$binder(&(0x7f00000021c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000002340)={0x34, 0x0, &(0x7f0000002240)=[@request_death={0x400c630e, 0x4, 0x4}, @increfs={0x40046304, 0x4}, @increfs_done={0x40106308, 0x0, 0x3}, @increfs], 0x77, 0x0, &(0x7f00000022c0)="b3cd0976d8e2af743c6f523efe14fd20c3c3dd2572734282a761e1b4304e2599c85f4d8cc82bd5d0c74c4edca2f9ea7b875ff7047ec0784fbb354e15fd3f7d837f533597d5082692a6f2fb748da3cc4157188f7f2a5477ded56f72f5b75c96872db429e44b8fcd781d96dead77a0b58b7af9085a208a22"}) 13:17:40 executing program 3: r0 = openat$cuse(0xffffffffffffff9c, &(0x7f0000000080)='/dev/cuse\x00', 0x2, 0x0) clone(0x1002102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000640), 0xffffffffffffffff) r1 = getpid() sched_setscheduler(r1, 0x5, &(0x7f0000000000)) write$FUSE_NOTIFY_DELETE(r0, &(0x7f0000000040)={0x29, 0x4, 0x0, {0xa}}, 0x29) 13:17:40 executing program 4: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = gettid() perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x3e5}, 0x0, 0x0, 0xffffffffffffffff, 0x0) fcntl$setown(r0, 0x8, r1) bind$inet6(r0, &(0x7f0000807fe4)={0xa, 0x4e22}, 0x1c) sendto$inet6(r0, &(0x7f0000000380), 0x0, 0x200408d4, &(0x7f000072e000)={0xa, 0x4e22, 0x0, @loopback}, 0x1c) sendto$inet6(r0, &(0x7f0000ad6fad)='\x00', 0x1, 0x3fffffd, &(0x7f0000254000)={0xa, 0xb804000000000000, 0x0, @loopback}, 0x1c) 13:17:40 executing program 0: perf_event_open(&(0x7f0000000040)={0x2, 0x70, 0x3e5}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f00000021c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000002340)={0xb5, 0x2000000, &(0x7f00000000c0)=ANY=[@ANYBLOB="0463044000000000b6a571ac965f26c50d500dae115e59afcd8a338d8b2727193c56d4ebef60c214b766ffde6cff6ceef2baa2594a53a0117e77afd5d58e8a35afdae81b258585ce769507333c0238790d5ed750bf1d6ca2a873050056528fce7becfd12f165ac43a826d3462822ff8f29ea992d4e208847cf4fc10ca00b87b5ce2523fa477bad0be1c97e4398aa2ac81d973b5a871d8e0b295e436cd8415f19088c6c82c85f4ed1fac41da062bc6dbfb8eac4276c"], 0x0, 0x0, &(0x7f00000022c0)}) 13:17:40 executing program 7: r0 = openat$cuse(0xffffffffffffff9c, &(0x7f0000000080)='/dev/cuse\x00', 0x2, 0x0) clone(0x1002102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000640), 0xffffffffffffffff) r1 = getpid() sched_setscheduler(r1, 0x5, &(0x7f0000000000)) write$FUSE_NOTIFY_DELETE(r0, &(0x7f0000000040)={0x29, 0x6, 0x0, {0x0, 0x5000000}}, 0x29) 13:17:40 executing program 7: r0 = openat$cuse(0xffffffffffffff9c, &(0x7f0000000080)='/dev/cuse\x00', 0x2, 0x0) clone(0x1002102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000640), 0xffffffffffffffff) r1 = getpid() sched_setscheduler(r1, 0x5, &(0x7f0000000000)) write$FUSE_NOTIFY_DELETE(r0, &(0x7f0000000040)={0x29, 0x6, 0x0, {0x0, 0x4}}, 0x29) 13:17:40 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r0, &(0x7f0000942000)={0x2, 0x4e20, @multicast1}, 0x10) sendmsg$key(0xffffffffffffffff, &(0x7f0000f56000)={0x0, 0x0, &(0x7f00008feff0)={&(0x7f0000000500)=ANY=[@ANYBLOB="020300090a1500000000000000000000030006190000000002000000e0000001003f00000000000002000100e625aa66dcef85847e479eb3c49000000400000000fd003e"], 0x44}}, 0x0) add_key(&(0x7f0000000080)='logon\x00', &(0x7f0000000100)={0x73, 0x79, 0x7a, 0x1}, &(0x7f0000001240), 0x0, 0xfffffffffffffff8) get_mempolicy(&(0x7f0000000000), &(0x7f00000001c0), 0x1ff, &(0x7f0000fff000/0x1000)=nil, 0x3) setsockopt$sock_int(r0, 0x1, 0x3c, &(0x7f0000d4effc)=0x1, 0x4) connect$inet(r0, &(0x7f0000000000)={0x2, 0x4e20, @dev={0xac, 0x14, 0x14, 0x18}}, 0x10) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f00000001c0)='tunl0\x00', 0x5) sendto$inet(r0, &(0x7f00006d1fd4)="db", 0x1, 0x4000010, &(0x7f00004daff0)={0x2, 0x0, @loopback, [0x0, 0x0, 0x8002a0ffffffff]}, 0x10) [ 1562.764163] binder_thread_write: 6 callbacks suppressed [ 1562.764176] binder: 18873:18878 BC_REQUEST_DEATH_NOTIFICATION invalid ref 4 [ 1562.778671] binder: 18873:18878 BC_INCREFS_DONE u0000000000000000 no match 13:17:40 executing program 5: r0 = syz_open_dev$binder(&(0x7f00000021c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000002340)={0x34, 0x0, &(0x7f0000002240)=[@request_death={0x400c630e, 0x4, 0x4}, @increfs={0x40046304, 0x4}, @increfs_done={0x40106308, 0x0, 0x3}, @increfs], 0x77, 0x0, &(0x7f00000022c0)="b3cd0976d8e2af743c6f523efe14fd20c3c3dd2572734282a761e1b4304e2599c85f548cc82bd5d0c74c4edca2f9ea7b875ff7047ec0784fbb354e15fd3f7d837f533597d5082692a6f2fb748da3cc4157188f7f2a5477ded56f72f5b75c96872db429e44b8fcd781d96dead77a0b58b7af9085a208a22"}) 13:17:41 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r0, &(0x7f0000942000)={0x2, 0x4e20, @multicast1}, 0x10) sendmsg$key(0xffffffffffffffff, &(0x7f0000f56000)={0x0, 0x0, &(0x7f00008feff0)={&(0x7f0000000500)=ANY=[@ANYBLOB="020300090a1500000000000000000000030006190000000002000000e0000001003f00000000000002000100e625aa66dcef85847e479eb3c49000000400000000fd003e"], 0x44}}, 0x0) add_key(&(0x7f0000000080)='logon\x00', &(0x7f0000000100)={0x73, 0x79, 0x7a, 0x1}, &(0x7f0000001240), 0x0, 0xfffffffffffffff8) get_mempolicy(&(0x7f0000000000), &(0x7f00000001c0), 0x1ff, &(0x7f0000fff000/0x1000)=nil, 0x3) setsockopt$sock_int(r0, 0x1, 0x3c, &(0x7f0000d4effc)=0x1, 0x4) connect$inet(r0, &(0x7f0000000000)={0x2, 0x4e20, @dev={0xac, 0x14, 0x14, 0x18}}, 0x10) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f00000001c0)='tunl0\x00', 0x5) sendto$inet(r0, &(0x7f00006d1fd4)="db", 0x1, 0x4000010, &(0x7f00004daff0)={0x2, 0x0, @loopback, [0x0, 0x0, 0x14280000000000]}, 0x10) 13:17:41 executing program 6: clone(0x802102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000040), 0xffffffffffffffff) r0 = syz_open_dev$sndtimer(&(0x7f0000000000)='/dev/snd/timer\x00', 0x0, 0x0) r1 = getpid() sched_setscheduler(r1, 0x5, &(0x7f0000000200)) r2 = dup3(r0, r0, 0x80000) ioctl$TIOCGPGRP(r2, 0x540f, &(0x7f0000000080)) ioctl$SNDRV_TIMER_IOCTL_GPARAMS(r0, 0x40485404, &(0x7f0000000240)={{}, 0x0, 0x2000000000000000}) [ 1562.917598] binder: 18908:18910 BC_REQUEST_DEATH_NOTIFICATION invalid ref 4 [ 1562.942375] binder: 18908:18910 BC_INCREFS_DONE u0000000000000000 no match 13:17:41 executing program 5: r0 = syz_open_dev$binder(&(0x7f00000021c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000002340)={0x34, 0x0, &(0x7f0000002240)=[@request_death={0x400c630e, 0x4, 0x4}, @increfs={0x40046304, 0x4}, @increfs_done={0x40106308, 0x0, 0x3}, @increfs], 0x77, 0x0, &(0x7f00000022c0)="b3cd0976d8e2af743c6f523efe14fd20c3c3dd2572734282a761e1b4304e2599c85f3b8cc82bd5d0c74c4edca2f9ea7b875ff7047ec0784fbb354e15fd3f7d837f533597d5082692a6f2fb748da3cc4157188f7f2a5477ded56f72f5b75c96872db429e44b8fcd781d96dead77a0b58b7af9085a208a22"}) 13:17:41 executing program 6: clone(0x802102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000040), 0xffffffffffffffff) r0 = syz_open_dev$sndtimer(&(0x7f0000000000)='/dev/snd/timer\x00', 0x0, 0x0) r1 = syz_open_dev$dmmidi(&(0x7f0000000080)='/dev/dmmidi#\x00', 0x1, 0x20001) r2 = syz_genetlink_get_family_id$team(&(0x7f0000000100)='team\x00') sendmsg$TEAM_CMD_PORT_LIST_GET(r1, &(0x7f00000001c0)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x40000}, 0xc, &(0x7f0000000180)={&(0x7f0000000140)={0x14, r2, 0x100, 0x70bd2a, 0x25dfdbfd}, 0x14}, 0x1, 0x0, 0x0, 0x804}, 0x880) r3 = getpid() sched_setscheduler(r3, 0x5, &(0x7f0000000200)) ioctl$SNDRV_TIMER_IOCTL_GPARAMS(r0, 0x40485404, &(0x7f0000000240)={{}, 0x0, 0x2000000000000000}) 13:17:41 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r0, &(0x7f0000942000)={0x2, 0x4e20, @multicast1}, 0x10) sendmsg$key(0xffffffffffffffff, &(0x7f0000f56000)={0x0, 0x0, &(0x7f00008feff0)={&(0x7f0000000500)=ANY=[@ANYBLOB="020300090a1500000000000000000000030006190000000002000000e0000001003f00000000000002000100e625aa66dcef85847e479eb3c49000000400000000fd003e"], 0x44}}, 0x0) add_key(&(0x7f0000000080)='logon\x00', &(0x7f0000000100)={0x73, 0x79, 0x7a, 0x1}, &(0x7f0000001240), 0x0, 0xfffffffffffffff8) get_mempolicy(&(0x7f0000000000), &(0x7f00000001c0), 0x1ff, &(0x7f0000fff000/0x1000)=nil, 0x3) setsockopt$sock_int(r0, 0x1, 0x3c, &(0x7f0000d4effc)=0x1, 0x4) connect$inet(r0, &(0x7f0000000000)={0x2, 0x4e20, @dev={0xac, 0x14, 0x14, 0x18}}, 0x10) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f00000001c0)='tunl0\x00', 0x5) sendto$inet(r0, &(0x7f00006d1fd4)="db", 0x1, 0x4000010, &(0x7f00004daff0)={0x2, 0x0, @loopback, [0x0, 0x0, 0xfdffffff]}, 0x10) [ 1563.131974] binder: 18928:18932 BC_REQUEST_DEATH_NOTIFICATION invalid ref 4 13:17:41 executing program 1: r0 = socket$netlink(0x10, 0x3, 0x8000000004) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_TCP_CONGESTION(r1, 0x6, 0xd, &(0x7f0000000180)='vegas\x00', 0x6) bind$inet6(r1, &(0x7f00001fefe4)={0xa, 0x4e22}, 0x1c) sendto$inet6(r1, &(0x7f0000000100), 0x8d2d601e8976aa5, 0x20000004, &(0x7f000031e000)={0xa, 0x4e22}, 0x1c) writev(r0, &(0x7f0000000100)=[{&(0x7f0000000000)="580000001400192340834b80040d8c560a067f4ff6ff81004e220000000058000b4824ca944f64009400050028925aa8000000000000008000f0fffeffff09000000fff5dd00000010000100000c0900fcff0000040e05a5", 0x58}], 0x1) 13:17:41 executing program 6: clone(0x802102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000040), 0xffffffffffffffff) r0 = syz_open_dev$sndtimer(&(0x7f0000000000)='/dev/snd/timer\x00', 0x0, 0x0) r1 = getpid() chmod(&(0x7f0000000100)='./file0\x00', 0x0) membarrier(0x20, 0x0) r2 = syz_open_dev$vcsa(&(0x7f0000000180)='/dev/vcsa#\x00', 0x1, 0x6000) ioctl$DRM_IOCTL_GEM_FLINK(r2, 0xc008640a, &(0x7f00000001c0)={0x0, 0x0}) ioctl$DRM_IOCTL_GEM_FLINK(r2, 0xc008640a, &(0x7f00000002c0)={0x0}) ioctl$DRM_IOCTL_GEM_OPEN(r0, 0xc010640b, &(0x7f0000000300)={r3, r4, 0x6}) ioctl$sock_bt_bnep_BNEPGETCONNINFO(r2, 0x800442d3, &(0x7f00000000c0)={0x3f, 0x2, 0x1, @local, 'irlan0\x00'}) sched_setscheduler(r1, 0x5, &(0x7f0000000200)) ioctl$SNDRV_TIMER_IOCTL_GPARAMS(r0, 0x40485404, &(0x7f0000000240)={{}, 0x0, 0x2000000000000000}) getsockopt$ARPT_SO_GET_INFO(r2, 0x0, 0x60, &(0x7f0000000340)={'filter\x00'}, &(0x7f00000003c0)=0x44) r5 = add_key$keyring(&(0x7f0000000080)='keyring\x00', &(0x7f0000000140)={0x73, 0x79, 0x7a, 0x3}, 0x0, 0x0, 0xfffffffffffffffd) keyctl$get_keyring_id(0x0, r5, 0x20000000000000) 13:17:41 executing program 7: r0 = openat$cuse(0xffffffffffffff9c, &(0x7f0000000080)='/dev/cuse\x00', 0x2, 0x0) clone(0x1002102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000640), 0xffffffffffffffff) r1 = getpid() sched_setscheduler(r1, 0x5, &(0x7f0000000000)) write$FUSE_NOTIFY_DELETE(r0, &(0x7f0000000040)={0x29, 0x6, 0x0, {0x0, 0xb000000}}, 0x29) 13:17:41 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r0, &(0x7f0000942000)={0x2, 0x4e20, @multicast1}, 0x10) sendmsg$key(0xffffffffffffffff, &(0x7f0000f56000)={0x0, 0x0, &(0x7f00008feff0)={&(0x7f0000000500)=ANY=[@ANYBLOB="020300090a1500000000000000000000030006190000000002000000e0000001003f00000000000002000100e625aa66dcef85847e479eb3c49000000400000000fd003e"], 0x44}}, 0x0) add_key(&(0x7f0000000080)='logon\x00', &(0x7f0000000100)={0x73, 0x79, 0x7a, 0x1}, &(0x7f0000001240), 0x0, 0xfffffffffffffff8) get_mempolicy(&(0x7f0000000000), &(0x7f00000001c0), 0x1ff, &(0x7f0000fff000/0x1000)=nil, 0x3) setsockopt$sock_int(r0, 0x1, 0x3c, &(0x7f0000d4effc)=0x1, 0x4) connect$inet(r0, &(0x7f0000000000)={0x2, 0x4e20, @dev={0xac, 0x14, 0x14, 0x18}}, 0x10) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f00000001c0)='tunl0\x00', 0x5) sendto$inet(r0, &(0x7f00006d1fd4)="db", 0x1, 0x4000010, &(0x7f00004daff0)={0x2, 0x0, @loopback, [0x0, 0x0, 0x3000000]}, 0x10) 13:17:41 executing program 3: r0 = openat$cuse(0xffffffffffffff9c, &(0x7f0000000080)='/dev/cuse\x00', 0x2, 0x0) clone(0x1002102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000640), 0xffffffffffffffff) r1 = getpid() sched_setscheduler(r1, 0x5, &(0x7f0000000000)) write$FUSE_NOTIFY_DELETE(r0, &(0x7f0000000040)={0x29, 0x4, 0x0, {0x7}}, 0x29) 13:17:41 executing program 4: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = gettid() perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x3e5}, 0x0, 0x0, 0xffffffffffffffff, 0x0) fcntl$setown(r0, 0x8, r1) bind$inet6(r0, &(0x7f0000807fe4)={0xa, 0x4e22}, 0x1c) sendto$inet6(r0, &(0x7f0000000380), 0x0, 0x200408d4, &(0x7f000072e000)={0xa, 0x4e22, 0x0, @loopback}, 0x1c) sendto$inet6(r0, &(0x7f0000ad6fad)='\x00', 0x1, 0x3fffffd, &(0x7f0000254000)={0xa, 0xa000000, 0x0, @loopback}, 0x1c) 13:17:41 executing program 5: r0 = syz_open_dev$binder(&(0x7f00000021c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000002340)={0x34, 0x0, &(0x7f0000002240)=[@request_death={0x400c630e, 0x4, 0x4}, @increfs={0x40046304, 0x4}, @increfs_done={0x40106308, 0x0, 0x3}, @increfs], 0x77, 0x0, &(0x7f00000022c0)="b3cd0976d8e2af743c6f523efe14fd20c3c3dd2572734282a761e1b4304e2599c85f4c8cc82bd5d0c74c4edca2f9ea7b875ff7047ec0784fbb354e15fd3f7d837f533597d5082692a6f2fb748da3cc4157188f7f2a5477ded56f72f5b75c96872db429e44b8fcd781d96dead77a0b58b7af9085a208a22"}) 13:17:41 executing program 0: perf_event_open(&(0x7f0000000040)={0x2, 0x70, 0x3e5}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f00000021c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000002340)={0xb5, 0x48000000, &(0x7f00000000c0)=ANY=[@ANYBLOB="0463044000000000b6a571ac965f26c50d500dae115e59afcd8a338d8b2727193c56d4ebef60c214b766ffde6cff6ceef2baa2594a53a0117e77afd5d58e8a35afdae81b258585ce769507333c0238790d5ed750bf1d6ca2a873050056528fce7becfd12f165ac43a826d3462822ff8f29ea992d4e208847cf4fc10ca00b87b5ce2523fa477bad0be1c97e4398aa2ac81d973b5a871d8e0b295e436cd8415f19088c6c82c85f4ed1fac41da062bc6dbfb8eac4276c"], 0x0, 0x0, &(0x7f00000022c0)}) [ 1563.672860] binder: 18955:18962 BC_REQUEST_DEATH_NOTIFICATION invalid ref 4 13:17:41 executing program 7: r0 = openat$cuse(0xffffffffffffff9c, &(0x7f0000000080)='/dev/cuse\x00', 0x2, 0x0) clone(0x1002102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000640), 0xffffffffffffffff) r1 = getpid() sched_setscheduler(r1, 0x5, &(0x7f0000000000)) write$FUSE_NOTIFY_DELETE(r0, &(0x7f0000000040)={0x29, 0x6, 0x0, {0x0, 0x6000000}}, 0x29) 13:17:41 executing program 5: r0 = syz_open_dev$binder(&(0x7f00000021c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000002340)={0x34, 0x0, &(0x7f0000002240)=[@request_death={0x400c630e, 0x4, 0x4}, @increfs={0x40046304, 0x4}, @increfs_done={0x40106308, 0x0, 0x3}, @increfs], 0x77, 0x0, &(0x7f00000022c0)="b3cd0976d8e2af743c6f523efe14fd20c3c3dd2572734282a761e1b4304e2599c85f198cc854d5d0c74c4edca2f9ea7b875ff7047ec0784fbb354e15fd3f7d837f533597d5082692a6f2fb748da3cc4157188f7f2a5477ded56f72f5b75c96872db429e44b8fcd781d96dead77a0b58b7af9085a208a22"}) 13:17:41 executing program 3: r0 = openat$cuse(0xffffffffffffff9c, &(0x7f0000000080)='/dev/cuse\x00', 0x2, 0x0) clone(0x1002102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000640), 0xffffffffffffffff) r1 = getpid() sched_setscheduler(r1, 0x5, &(0x7f0000000000)) write$FUSE_NOTIFY_DELETE(r0, &(0x7f0000000040)={0x29, 0x4, 0x0, {0x300000000000000}}, 0x29) 13:17:41 executing program 6: clone(0x802102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000040), 0xffffffffffffffff) r0 = syz_open_dev$sndtimer(&(0x7f0000000000)='/dev/snd/timer\x00', 0x0, 0x0) r1 = openat$vsock(0xffffffffffffff9c, &(0x7f0000000080)='/dev/vsock\x00', 0x2, 0x0) getsockopt$IP_VS_SO_GET_DAEMON(r1, 0x0, 0x487, &(0x7f00000000c0), &(0x7f0000000100)=0x30) r2 = getpid() sched_setscheduler(r2, 0x5, &(0x7f0000000200)) ioctl$SNDRV_TIMER_IOCTL_GPARAMS(r0, 0x40485404, &(0x7f0000000240)={{}, 0x0, 0x2000000000000000}) 13:17:41 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r0, &(0x7f0000942000)={0x2, 0x4e20, @multicast1}, 0x10) sendmsg$key(0xffffffffffffffff, &(0x7f0000f56000)={0x0, 0x0, &(0x7f00008feff0)={&(0x7f0000000500)=ANY=[@ANYBLOB="020300090a1500000000000000000000030006190000000002000000e0000001003f00000000000002000100e625aa66dcef85847e479eb3c49000000400000000fd003e"], 0x44}}, 0x0) add_key(&(0x7f0000000080)='logon\x00', &(0x7f0000000100)={0x73, 0x79, 0x7a, 0x1}, &(0x7f0000001240), 0x0, 0xfffffffffffffff8) get_mempolicy(&(0x7f0000000000), &(0x7f00000001c0), 0x1ff, &(0x7f0000fff000/0x1000)=nil, 0x3) setsockopt$sock_int(r0, 0x1, 0x3c, &(0x7f0000d4effc)=0x1, 0x4) connect$inet(r0, &(0x7f0000000000)={0x2, 0x4e20, @dev={0xac, 0x14, 0x14, 0x18}}, 0x10) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f00000001c0)='tunl0\x00', 0x5) sendto$inet(r0, &(0x7f00006d1fd4)="db", 0x1, 0x4000010, &(0x7f00004daff0)={0x2, 0x0, @loopback, [0x0, 0x0, 0x3f00]}, 0x10) 13:17:41 executing program 7: r0 = openat$cuse(0xffffffffffffff9c, &(0x7f0000000080)='/dev/cuse\x00', 0x2, 0x0) clone(0x1002102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000640), 0xffffffffffffffff) r1 = getpid() sched_setscheduler(r1, 0x5, &(0x7f0000000000)) write$FUSE_NOTIFY_DELETE(r0, &(0x7f0000000040)={0x29, 0x6, 0x0, {0x0, 0x500}}, 0x29) 13:17:42 executing program 5: r0 = syz_open_dev$binder(&(0x7f00000021c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000002340)={0x34, 0x0, &(0x7f0000002240)=[@request_death={0x400c630e, 0x4, 0x4}, @increfs={0x40046304, 0x4}, @increfs_done={0x40106308, 0x0, 0x3}, @increfs], 0x77, 0x0, &(0x7f00000022c0)="b3cd0976d8e2af743c6f523efe14fd20c3c3dd2572734282a761e1b4304e2599c85f198cc83bd5d0c74c4edca2f9ea7b875ff7047ec0784fbb354e15fd3f7d837f533597d5082692a6f2fb748da3cc4157188f7f2a5477ded56f72f5b75c96872db429e44b8fcd781d96dead77a0b58b7af9085a208a22"}) [ 1563.889098] binder: 18997:19001 BC_REQUEST_DEATH_NOTIFICATION invalid ref 4 13:17:42 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r0, &(0x7f0000942000)={0x2, 0x4e20, @multicast1}, 0x10) sendmsg$key(0xffffffffffffffff, &(0x7f0000f56000)={0x0, 0x0, &(0x7f00008feff0)={&(0x7f0000000500)=ANY=[@ANYBLOB="020300090a1500000000000000000000030006190000000002000000e0000001003f00000000000002000100e625aa66dcef85847e479eb3c49000000400000000fd003e"], 0x44}}, 0x0) add_key(&(0x7f0000000080)='logon\x00', &(0x7f0000000100)={0x73, 0x79, 0x7a, 0x1}, &(0x7f0000001240), 0x0, 0xfffffffffffffff8) get_mempolicy(&(0x7f0000000000), &(0x7f00000001c0), 0x1ff, &(0x7f0000fff000/0x1000)=nil, 0x3) setsockopt$sock_int(r0, 0x1, 0x3c, &(0x7f0000d4effc)=0x1, 0x4) connect$inet(r0, &(0x7f0000000000)={0x2, 0x4e20, @dev={0xac, 0x14, 0x14, 0x18}}, 0x10) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f00000001c0)='tunl0\x00', 0x5) sendto$inet(r0, &(0x7f00006d1fd4)="db", 0x1, 0x4000010, &(0x7f00004daff0)={0x2, 0x0, @loopback, [0x0, 0x0, 0x8055]}, 0x10) [ 1564.026454] binder: 19010:19014 BC_REQUEST_DEATH_NOTIFICATION invalid ref 4 [ 1564.060213] binder: 19010:19014 BC_REQUEST_DEATH_NOTIFICATION invalid ref 4 13:17:42 executing program 1: r0 = socket$netlink(0x10, 0x3, 0x8000000004) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_TCP_CONGESTION(r1, 0x6, 0xd, &(0x7f0000000180)='vegas\x00', 0x6) bind$inet6(r1, &(0x7f00001fefe4)={0xa, 0x4e22}, 0x1c) sendto$inet6(r1, &(0x7f0000000100), 0x8d2d601e8976aa5, 0x20000004, &(0x7f000031e000)={0xa, 0x4e22}, 0x1c) writev(r0, &(0x7f0000000100)=[{&(0x7f0000000000)="580000001400192340834b80040d8c560a067f50c3ff81004e220000000058000b4824ca944f64009400050028925aa8000000000000008000f0fffeffff09000000fff5dd00000010000100000c0900fcff0000040e05a5", 0x58}], 0x1) 13:17:42 executing program 7: r0 = openat$cuse(0xffffffffffffff9c, &(0x7f0000000080)='/dev/cuse\x00', 0x2, 0x0) clone(0x1002102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000640), 0xffffffffffffffff) r1 = getpid() sched_setscheduler(r1, 0x5, &(0x7f0000000000)) write$FUSE_NOTIFY_DELETE(r0, &(0x7f0000000040)={0x29, 0x6, 0x0, {0x0, 0xffffffffa0028000}}, 0x29) 13:17:42 executing program 6: clone(0x802102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000040), 0xffffffffffffffff) r0 = syz_open_dev$sndtimer(&(0x7f0000000080)='/dev/snd/timer\x00', 0x0, 0x8002) r1 = getpid() r2 = dup(r0) getsockopt$inet_IP_IPSEC_POLICY(0xffffffffffffff9c, 0x0, 0x10, &(0x7f00000000c0)={{{@in=@multicast1, @in6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@local}, 0x0, @in=@local}}, &(0x7f00000001c0)=0xe8) ioctl$TUNSETOWNER(r2, 0x400454cc, r3) connect$l2tp(r0, &(0x7f0000000000)=@pppol2tpin6={0x18, 0x1, {0x0, 0xffffffffffffffff, 0x2, 0x0, 0x2, 0x3, {0xa, 0x4e23, 0xfffffffffffffffb, @remote, 0x9}}}, 0x32) r4 = add_key$keyring(&(0x7f0000000380)='keyring\x00', &(0x7f00000003c0)={0x73, 0x79, 0x7a, 0x1}, 0x0, 0x0, 0x0) request_key(&(0x7f00000002c0)='blacklist\x00', &(0x7f0000000300)={0x73, 0x79, 0x7a, 0x1}, &(0x7f0000000340)='/dev/snd/timer\x00', r4) ioperm(0x7, 0x6, 0x1) sched_setscheduler(r1, 0x5, &(0x7f0000000200)) ioctl$SNDRV_TIMER_IOCTL_GPARAMS(r0, 0x40485404, &(0x7f0000000240)={{}, 0x0, 0x2000000000000000}) 13:17:42 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r0, &(0x7f0000942000)={0x2, 0x4e20, @multicast1}, 0x10) sendmsg$key(0xffffffffffffffff, &(0x7f0000f56000)={0x0, 0x0, &(0x7f00008feff0)={&(0x7f0000000500)=ANY=[@ANYBLOB="020300090a1500000000000000000000030006190000000002000000e0000001003f00000000000002000100e625aa66dcef85847e479eb3c49000000400000000fd003e"], 0x44}}, 0x0) add_key(&(0x7f0000000080)='logon\x00', &(0x7f0000000100)={0x73, 0x79, 0x7a, 0x1}, &(0x7f0000001240), 0x0, 0xfffffffffffffff8) get_mempolicy(&(0x7f0000000000), &(0x7f00000001c0), 0x1ff, &(0x7f0000fff000/0x1000)=nil, 0x3) setsockopt$sock_int(r0, 0x1, 0x3c, &(0x7f0000d4effc)=0x1, 0x4) connect$inet(r0, &(0x7f0000000000)={0x2, 0x4e20, @dev={0xac, 0x14, 0x14, 0x18}}, 0x10) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f00000001c0)='tunl0\x00', 0x5) sendto$inet(r0, &(0x7f00006d1fd4)="db", 0x1, 0x4000010, &(0x7f00004daff0)={0x2, 0x0, @loopback, [0x0, 0x0, 0xffffffffffffffff]}, 0x10) 13:17:42 executing program 3: r0 = openat$cuse(0xffffffffffffff9c, &(0x7f0000000080)='/dev/cuse\x00', 0x2, 0x0) clone(0x1002102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000640), 0xffffffffffffffff) r1 = getpid() sched_setscheduler(r1, 0x5, &(0x7f0000000000)) write$FUSE_NOTIFY_DELETE(r0, &(0x7f0000000040)={0x29, 0x4, 0x0, {0x400000000000000}}, 0x29) 13:17:42 executing program 0: perf_event_open(&(0x7f0000000040)={0x2, 0x70, 0x3e5}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f00000021c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000002340)={0xb5, 0x4c00, &(0x7f00000000c0)=ANY=[@ANYBLOB="0463044000000000b6a571ac965f26c50d500dae115e59afcd8a338d8b2727193c56d4ebef60c214b766ffde6cff6ceef2baa2594a53a0117e77afd5d58e8a35afdae81b258585ce769507333c0238790d5ed750bf1d6ca2a873050056528fce7becfd12f165ac43a826d3462822ff8f29ea992d4e208847cf4fc10ca00b87b5ce2523fa477bad0be1c97e4398aa2ac81d973b5a871d8e0b295e436cd8415f19088c6c82c85f4ed1fac41da062bc6dbfb8eac4276c"], 0x0, 0x0, &(0x7f00000022c0)}) 13:17:42 executing program 5: r0 = syz_open_dev$binder(&(0x7f00000021c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000002340)={0x34, 0x0, &(0x7f0000002240)=[@request_death={0x400c630e, 0x4, 0x4}, @increfs={0x40046304, 0x4}, @increfs_done={0x40106308, 0x0, 0x3}, @increfs], 0x77, 0x0, &(0x7f00000022c0)="b3cd0976d8e2af743c6f523efe14fd20c3c3dd2572734282a761e1b4304e2599c85f198cc84cd5d0c74c4edca2f9ea7b875ff7047ec0784fbb354e15fd3f7d837f533597d5082692a6f2fb748da3cc4157188f7f2a5477ded56f72f5b75c96872db429e44b8fcd781d96dead77a0b58b7af9085a208a22"}) 13:17:42 executing program 4: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = gettid() perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x3e5}, 0x0, 0x0, 0xffffffffffffffff, 0x0) fcntl$setown(r0, 0x8, r1) bind$inet6(r0, &(0x7f0000807fe4)={0xa, 0x4e22}, 0x1c) sendto$inet6(r0, &(0x7f0000000380), 0x0, 0x200408d4, &(0x7f000072e000)={0xa, 0x4e22, 0x0, @loopback}, 0x1c) sendto$inet6(r0, &(0x7f0000ad6fad)='\x00', 0x1, 0x3fffffd, &(0x7f0000254000)={0xa, 0x4002, 0x0, @loopback}, 0x1c) 13:17:42 executing program 7: r0 = openat$cuse(0xffffffffffffff9c, &(0x7f0000000080)='/dev/cuse\x00', 0x2, 0x0) clone(0x1002102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000640), 0xffffffffffffffff) r1 = getpid() sched_setscheduler(r1, 0x5, &(0x7f0000000000)) write$FUSE_NOTIFY_DELETE(r0, &(0x7f0000000040)={0x29, 0x6, 0x0, {0x0, 0x1a0ffffffff}}, 0x29) 13:17:42 executing program 5: r0 = syz_open_dev$binder(&(0x7f00000021c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000002340)={0x34, 0x0, &(0x7f0000002240)=[@request_death={0x400c630e, 0x4, 0x4}, @increfs={0x40046304, 0x4}, @increfs_done={0x40106308, 0x0, 0x3}, @increfs], 0x77, 0x0, &(0x7f00000022c0)="b3cd0976d8e2af743c6f523efe14fd20c3c3dd2572734282a761e1b4304e2599c85f198cc84dd5d0c74c4edca2f9ea7b875ff7047ec0784fbb354e15fd3f7d837f533597d5082692a6f2fb748da3cc4157188f7f2a5477ded56f72f5b75c96872db429e44b8fcd781d96dead77a0b58b7af9085a208a22"}) [ 1564.570238] binder: 19033:19042 BC_REQUEST_DEATH_NOTIFICATION invalid ref 4 13:17:42 executing program 6: clone(0x802102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000080), 0xffffffffffffffff) r0 = syz_open_dev$sndtimer(&(0x7f0000000000)='/dev/snd/timer\x00', 0x0, 0x0) r1 = getpid() sched_setscheduler(r1, 0x5, &(0x7f0000000200)) ioctl$SNDRV_TIMER_IOCTL_GPARAMS(r0, 0x40485404, &(0x7f0000000240)={{}, 0x0, 0x2000000000000000}) 13:17:42 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r0, &(0x7f0000942000)={0x2, 0x4e20, @multicast1}, 0x10) sendmsg$key(0xffffffffffffffff, &(0x7f0000f56000)={0x0, 0x0, &(0x7f00008feff0)={&(0x7f0000000500)=ANY=[@ANYBLOB="020300090a1500000000000000000000030006190000000002000000e0000001003f00000000000002000100e625aa66dcef85847e479eb3c49000000400000000fd003e"], 0x44}}, 0x0) add_key(&(0x7f0000000080)='logon\x00', &(0x7f0000000100)={0x73, 0x79, 0x7a, 0x1}, &(0x7f0000001240), 0x0, 0xfffffffffffffff8) get_mempolicy(&(0x7f0000000000), &(0x7f00000001c0), 0x1ff, &(0x7f0000fff000/0x1000)=nil, 0x3) setsockopt$sock_int(r0, 0x1, 0x3c, &(0x7f0000d4effc)=0x1, 0x4) connect$inet(r0, &(0x7f0000000000)={0x2, 0x4e20, @dev={0xac, 0x14, 0x14, 0x18}}, 0x10) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f00000001c0)='tunl0\x00', 0x5) sendto$inet(r0, &(0x7f00006d1fd4)="db", 0x1, 0x4000010, &(0x7f00004daff0)={0x2, 0x0, @loopback, [0x0, 0x0, 0xf401000000000000]}, 0x10) 13:17:42 executing program 3: r0 = openat$cuse(0xffffffffffffff9c, &(0x7f0000000080)='/dev/cuse\x00', 0x2, 0x0) clone(0x1002102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000640), 0xffffffffffffffff) r1 = getpid() sched_setscheduler(r1, 0x5, &(0x7f0000000000)) write$FUSE_NOTIFY_DELETE(r0, &(0x7f0000000040)={0x29, 0x4, 0x0, {0xb}}, 0x29) 13:17:42 executing program 6: clone(0x802102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000040), 0xffffffffffffffff) r0 = syz_open_dev$sndtimer(&(0x7f0000000000)='/dev/snd/timer\x00', 0x0, 0x0) r1 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r1, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") r2 = socket$inet(0x10, 0x2000000000003, 0x0) sendmsg(r2, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000040)="24000000290007031dfffd946fa2830020200a00090000000600f0ffffffffffff00ff7e280000001100ffffba16a0aa1c0009b3ebea8653b1cc7e63975c0ac47a6268e3406cf055d90f15a3", 0x4c}], 0x1}, 0x0) r3 = getpid() sched_setscheduler(r3, 0x5, &(0x7f0000000200)) ioctl$SNDRV_TIMER_IOCTL_GPARAMS(r0, 0x40485404, &(0x7f0000000240)={{}, 0x0, 0x2000000000000000}) sysfs$2(0x2, 0x7f, &(0x7f0000000080)=""/205) r4 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000300)='/dev/rtc0\x00', 0x14b000, 0x0) mount$9p_fd(0x0, &(0x7f0000000700)='./file0/file0\x00', &(0x7f0000000740)='9p\x00', 0x1100400, &(0x7f0000000780)={'trans=fd,', {'rfdno', 0x3d, r4}, 0x2c, {'wfdno', 0x3d, r1}, 0x2c, {[{@noextend='noextend'}, {@cache_mmap='cache=mmap'}, {@access_user='access=user'}, {@debug={'debug', 0x3d, 0xe17f}}, {@cache_mmap='cache=mmap'}, {@version_9p2000='version=9p2000'}, {@uname={'uname', 0x3d, '/dev/rtc0\x00'}}, {@msize={'msize', 0x3d, 0x5}}, {@nodevmap='nodevmap'}, {@nodevmap='nodevmap'}]}}) getsockopt$inet_IP_IPSEC_POLICY(0xffffffffffffff9c, 0x0, 0x10, &(0x7f0000000340)={{{@in=@remote, @in6=@mcast1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in=@multicast1}, 0x0, @in6=@remote}}, &(0x7f0000000440)=0xe8) r6 = socket$inet6_tcp(0xa, 0x1, 0x0) r7 = open(&(0x7f000000fffa)='./bus\x00', 0x141042, 0x0) mmap(&(0x7f0000001000/0xa000)=nil, 0xa000, 0x0, 0x11, r7, 0x0) setsockopt$inet6_tcp_int(r6, 0x6, 0x13, &(0x7f00000000c0)=0x100000001, 0x151) connect$inet6(r6, &(0x7f0000000140), 0x1c) setsockopt$inet6_tcp_TCP_ULP(r6, 0x6, 0x1f, &(0x7f0000000080)='tls\x00', 0x152) setsockopt$inet6_tcp_TLS_TX(r6, 0x11a, 0x1, &(0x7f0000000100), 0x28) sendmsg$TEAM_CMD_PORT_LIST_GET(r6, &(0x7f000000f840)={&(0x7f0000000040), 0xc, &(0x7f000000f800)={&(0x7f00000004c0)=ANY=[@ANYBLOB], 0x1}}, 0x8000) sendto$inet6(r6, &(0x7f00000005c0), 0xfffffdef, 0x0, &(0x7f0000000000)={0xa, 0x0, 0x0, @remote}, 0x1c) lstat(&(0x7f0000000480)='./file0\x00', &(0x7f00000004c0)={0x0, 0x0, 0x0, 0x0, 0x0}) setsockopt$inet6_IPV6_XFRM_POLICY(r4, 0x29, 0x23, &(0x7f0000000540)={{{@in6=@local, @in, 0x4e21, 0x4, 0x4e24, 0x0, 0xa, 0x80, 0x80, 0xef, r5, r8}, {0x80000000, 0x2, 0x8, 0x1, 0x6, 0x8, 0xe49, 0x9}, {0x8, 0x4, 0xd8c, 0x7}, 0x8, 0x0, 0x3, 0x1, 0x3}, {{@in=@dev={0xac, 0x14, 0x14, 0x16}, 0x4d4, 0x3c}, 0xa, @in=@multicast1, 0x34ff, 0x2, 0x0, 0x4, 0x391, 0x6, 0x7}}, 0xe8) r9 = syz_genetlink_get_family_id$ipvs(&(0x7f00000001c0)='IPVS\x00') sendmsg$IPVS_CMD_SET_CONFIG(r4, &(0x7f00000006c0)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x800}, 0xc, &(0x7f00000002c0)={&(0x7f0000000640)=ANY=[@ANYBLOB="80000000", @ANYRES16=r9, @ANYBLOB="00042c7b2b558ea854f0bd7000fddbdf250c0000003800010008000500040000001400030000000000000000000000000000000000080009000a0000000800050004000000080009005100000008000600ac140000080006000300000008000600090000001c0002000800070005000000080004000000000008"], 0x80}, 0x1, 0x0, 0x0, 0x4000000}, 0x4004000) [ 1564.727935] binder: 19064:19067 BC_REQUEST_DEATH_NOTIFICATION invalid ref 4 13:17:42 executing program 5: r0 = syz_open_dev$binder(&(0x7f00000021c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000002340)={0x34, 0x0, &(0x7f0000002240)=[@request_death={0x400c630e, 0x4, 0x4}, @increfs={0x40046304, 0x4}, @increfs_done={0x40106308, 0x0, 0x3}, @increfs], 0x77, 0x0, &(0x7f00000022c0)="b3cd0976d8e2af743c6f523efe14fd20c3c3dd2572734282a761e1b4304e2599c85f198cc82bd5d0c74a4edca2f9ea7b875ff7047ec0784fbb354e15fd3f7d837f533597d5082692a6f2fb748da3cc4157188f7f2a5477ded56f72f5b75c96872db429e44b8fcd781d96dead77a0b58b7af9085a208a22"}) 13:17:42 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r0, &(0x7f0000942000)={0x2, 0x4e20, @multicast1}, 0x10) sendmsg$key(0xffffffffffffffff, &(0x7f0000f56000)={0x0, 0x0, &(0x7f00008feff0)={&(0x7f0000000500)=ANY=[@ANYBLOB="020300090a1500000000000000000000030006190000000002000000e0000001003f00000000000002000100e625aa66dcef85847e479eb3c49000000400000000fd003e"], 0x44}}, 0x0) add_key(&(0x7f0000000080)='logon\x00', &(0x7f0000000100)={0x73, 0x79, 0x7a, 0x1}, &(0x7f0000001240), 0x0, 0xfffffffffffffff8) get_mempolicy(&(0x7f0000000000), &(0x7f00000001c0), 0x1ff, &(0x7f0000fff000/0x1000)=nil, 0x3) setsockopt$sock_int(r0, 0x1, 0x3c, &(0x7f0000d4effc)=0x1, 0x4) connect$inet(r0, &(0x7f0000000000)={0x2, 0x4e20, @dev={0xac, 0x14, 0x14, 0x18}}, 0x10) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f00000001c0)='tunl0\x00', 0x5) sendto$inet(r0, &(0x7f00006d1fd4)="db", 0x1, 0x4000010, &(0x7f00004daff0)={0x2, 0x0, @loopback, [0x0, 0x0, 0x0, 0x4900000000000000]}, 0x10) [ 1564.867802] netlink: 8 bytes leftover after parsing attributes in process `syz-executor6'. [ 1564.941465] audit: type=1400 audit(1536499063.007:60): avc: denied { map } for pid=19072 comm="syz-executor6" path="/root/syzkaller-testdir029144596/syzkaller.V2XSRx/2494/bus" dev="sda1" ino=17538 scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:object_r:user_home_t:s0 tclass=file permissive=1 [ 1564.945860] binder: 19084:19087 BC_REQUEST_DEATH_NOTIFICATION invalid ref 4 [ 1565.250624] netlink: 8 bytes leftover after parsing attributes in process `syz-executor6'. 13:17:43 executing program 1: r0 = socket$netlink(0x10, 0x3, 0x8000000004) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_TCP_CONGESTION(r1, 0x6, 0xd, &(0x7f0000000180)='vegas\x00', 0x6) bind$inet6(r1, &(0x7f00001fefe4)={0xa, 0x4e22}, 0x1c) sendto$inet6(r1, &(0x7f0000000100), 0x8d2d601e8976aa5, 0x20000004, &(0x7f000031e000)={0xa, 0x4e22}, 0x1c) writev(r0, &(0x7f0000000100)=[{&(0x7f0000000000)="580000001400192340834b80040d8c560a067f11b1ff81004e220000000058000b4824ca944f64009400050028925aa8000000000000008000f0fffeffff09000000fff5dd00000010000100000c0900fcff0000040e05a5", 0x58}], 0x1) 13:17:43 executing program 3: r0 = openat$cuse(0xffffffffffffff9c, &(0x7f0000000080)='/dev/cuse\x00', 0x2, 0x0) clone(0x1002102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000640), 0xffffffffffffffff) r1 = getpid() sched_setscheduler(r1, 0x5, &(0x7f0000000000)) write$FUSE_NOTIFY_DELETE(r0, &(0x7f0000000040)={0x29, 0x4, 0x0, {0x3}}, 0x29) 13:17:43 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r0, &(0x7f0000942000)={0x2, 0x4e20, @multicast1}, 0x10) sendmsg$key(0xffffffffffffffff, &(0x7f0000f56000)={0x0, 0x0, &(0x7f00008feff0)={&(0x7f0000000500)=ANY=[@ANYBLOB="020300090a1500000000000000000000030006190000000002000000e0000001003f00000000000002000100e625aa66dcef85847e479eb3c49000000400000000fd003e"], 0x44}}, 0x0) add_key(&(0x7f0000000080)='logon\x00', &(0x7f0000000100)={0x73, 0x79, 0x7a, 0x1}, &(0x7f0000001240), 0x0, 0xfffffffffffffff8) get_mempolicy(&(0x7f0000000000), &(0x7f00000001c0), 0x1ff, &(0x7f0000fff000/0x1000)=nil, 0x3) setsockopt$sock_int(r0, 0x1, 0x3c, &(0x7f0000d4effc)=0x1, 0x4) connect$inet(r0, &(0x7f0000000000)={0x2, 0x4e20, @dev={0xac, 0x14, 0x14, 0x18}}, 0x10) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f00000001c0)='tunl0\x00', 0x5) sendto$inet(r0, &(0x7f00006d1fd4)="db", 0x1, 0x4000010, &(0x7f00004daff0)={0x2, 0x0, @loopback, [0x0, 0x0, 0x0, 0x8000000]}, 0x10) 13:17:43 executing program 7: r0 = openat$cuse(0xffffffffffffff9c, &(0x7f0000000080)='/dev/cuse\x00', 0x2, 0x0) clone(0x1002102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000640), 0xffffffffffffffff) r1 = getpid() sched_setscheduler(r1, 0x5, &(0x7f0000000000)) write$FUSE_NOTIFY_DELETE(r0, &(0x7f0000000040)={0x29, 0x6, 0x0, {0x0, 0xa00000000000000}}, 0x29) 13:17:43 executing program 0: perf_event_open(&(0x7f0000000040)={0x2, 0x70, 0x3e5}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f00000021c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000002340)={0xb5, 0x6c00, &(0x7f00000000c0)=ANY=[@ANYBLOB="0463044000000000b6a571ac965f26c50d500dae115e59afcd8a338d8b2727193c56d4ebef60c214b766ffde6cff6ceef2baa2594a53a0117e77afd5d58e8a35afdae81b258585ce769507333c0238790d5ed750bf1d6ca2a873050056528fce7becfd12f165ac43a826d3462822ff8f29ea992d4e208847cf4fc10ca00b87b5ce2523fa477bad0be1c97e4398aa2ac81d973b5a871d8e0b295e436cd8415f19088c6c82c85f4ed1fac41da062bc6dbfb8eac4276c"], 0x0, 0x0, &(0x7f00000022c0)}) 13:17:43 executing program 5: r0 = syz_open_dev$binder(&(0x7f00000021c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000002340)={0x34, 0x0, &(0x7f0000002240)=[@request_death={0x400c630e, 0x4, 0x4}, @increfs={0x40046304, 0x4}, @increfs_done={0x40106308, 0x0, 0x3}, @increfs], 0x77, 0x0, &(0x7f00000022c0)="b3cd0976d8e2af743c6f523efe14fd20c3c3dd2572734282a761e1b4304e2599c85f198cc82bd5d0c7234edca2f9ea7b875ff7047ec0784fbb354e15fd3f7d837f533597d5082692a6f2fb748da3cc4157188f7f2a5477ded56f72f5b75c96872db429e44b8fcd781d96dead77a0b58b7af9085a208a22"}) 13:17:43 executing program 4: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = gettid() perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x3e5}, 0x0, 0x0, 0xffffffffffffffff, 0x0) fcntl$setown(r0, 0x8, r1) bind$inet6(r0, &(0x7f0000807fe4)={0xa, 0x4e22}, 0x1c) sendto$inet6(r0, &(0x7f0000000380), 0x0, 0x200408d4, &(0x7f000072e000)={0xa, 0x4e22, 0x0, @loopback}, 0x1c) sendto$inet6(r0, &(0x7f0000ad6fad)='\x00', 0x1, 0x3fffffd, &(0x7f0000254000)={0xa, 0x0, 0xa00000000000000, @loopback}, 0x1c) 13:17:43 executing program 6: clone(0x802102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000040), 0xffffffffffffffff) r0 = syz_open_dev$sndtimer(&(0x7f0000000000)='/dev/snd/timer\x00', 0x0, 0x0) r1 = getpid() ioctl$SNDRV_TIMER_IOCTL_PVERSION(r0, 0x80045400, &(0x7f0000000080)) sched_setscheduler(r1, 0x9, &(0x7f0000000200)=0xffffffff) ioctl$SNDRV_TIMER_IOCTL_GPARAMS(r0, 0x40485404, &(0x7f0000000240)={{}, 0x0, 0x2000000000000000}) [ 1565.439331] binder_thread_write: 26 callbacks suppressed [ 1565.439346] binder: 19118:19124 IncRefs 0 refcount change on invalid ref 4 ret -22 [ 1565.461133] binder_thread_write: 8 callbacks suppressed [ 1565.461147] binder: 19118:19124 BC_INCREFS_DONE u0000000000000000 no match 13:17:43 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r0, &(0x7f0000942000)={0x2, 0x4e20, @multicast1}, 0x10) sendmsg$key(0xffffffffffffffff, &(0x7f0000f56000)={0x0, 0x0, &(0x7f00008feff0)={&(0x7f0000000500)=ANY=[@ANYBLOB="020300090a1500000000000000000000030006190000000002000000e0000001003f00000000000002000100e625aa66dcef85847e479eb3c49000000400000000fd003e"], 0x44}}, 0x0) add_key(&(0x7f0000000080)='logon\x00', &(0x7f0000000100)={0x73, 0x79, 0x7a, 0x1}, &(0x7f0000001240), 0x0, 0xfffffffffffffff8) get_mempolicy(&(0x7f0000000000), &(0x7f00000001c0), 0x1ff, &(0x7f0000fff000/0x1000)=nil, 0x3) setsockopt$sock_int(r0, 0x1, 0x3c, &(0x7f0000d4effc)=0x1, 0x4) connect$inet(r0, &(0x7f0000000000)={0x2, 0x4e20, @dev={0xac, 0x14, 0x14, 0x18}}, 0x10) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f00000001c0)='tunl0\x00', 0x5) sendto$inet(r0, &(0x7f00006d1fd4)="db", 0x1, 0x4000010, &(0x7f00004daff0)={0x2, 0x0, @loopback, [0x0, 0x0, 0x0, 0x1000000]}, 0x10) [ 1565.502291] binder: 19118:19124 IncRefs 0 refcount change on invalid ref 0 ret -22 [ 1565.517013] binder: 19118:19124 IncRefs 0 refcount change on invalid ref 4 ret -22 [ 1565.528983] binder: 19118:19124 BC_INCREFS_DONE u0000000000000000 no match [ 1565.548889] binder: 19118:19124 IncRefs 0 refcount change on invalid ref 0 ret -22 13:17:43 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r0, &(0x7f0000942000)={0x2, 0x4e20, @multicast1}, 0x10) sendmsg$key(0xffffffffffffffff, &(0x7f0000f56000)={0x0, 0x0, &(0x7f00008feff0)={&(0x7f0000000500)=ANY=[@ANYBLOB="020300090a1500000000000000000000030006190000000002000000e0000001003f00000000000002000100e625aa66dcef85847e479eb3c49000000400000000fd003e"], 0x44}}, 0x0) add_key(&(0x7f0000000080)='logon\x00', &(0x7f0000000100)={0x73, 0x79, 0x7a, 0x1}, &(0x7f0000001240), 0x0, 0xfffffffffffffff8) get_mempolicy(&(0x7f0000000000), &(0x7f00000001c0), 0x1ff, &(0x7f0000fff000/0x1000)=nil, 0x3) setsockopt$sock_int(r0, 0x1, 0x3c, &(0x7f0000d4effc)=0x1, 0x4) connect$inet(r0, &(0x7f0000000000)={0x2, 0x4e20, @dev={0xac, 0x14, 0x14, 0x18}}, 0x10) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f00000001c0)='tunl0\x00', 0x5) sendto$inet(r0, &(0x7f00006d1fd4)="db", 0x1, 0x4000010, &(0x7f00004daff0)={0x2, 0x0, @loopback, [0x0, 0x0, 0x0, 0xf4010000]}, 0x10) 13:17:43 executing program 5: r0 = syz_open_dev$binder(&(0x7f00000021c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000002340)={0x34, 0x0, &(0x7f0000002240)=[@request_death={0x400c630e, 0x4, 0x4}, @increfs={0x40046304, 0x4}, @increfs_done={0x40106308, 0x0, 0x3}, @increfs], 0x77, 0x0, &(0x7f00000022c0)="b3cd0976d8e2af743c6f523efe14fd20c3c3dd2572734282a761e1b4304e2599c85f198cc82bd5d0c70d4edca2f9ea7b875ff7047ec0784fbb354e15fd3f7d837f533597d5082692a6f2fb748da3cc4157188f7f2a5477ded56f72f5b75c96872db429e44b8fcd781d96dead77a0b58b7af9085a208a22"}) 13:17:43 executing program 6: clone(0x802102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000040), 0xffffffffffffffff) r0 = syz_open_dev$sndtimer(&(0x7f0000000000)='/dev/snd/timer\x00', 0x0, 0x0) r1 = getpid() syz_extract_tcp_res(&(0x7f0000000080)={0x41424344}, 0x6, 0x42c) syz_extract_tcp_res(&(0x7f00000000c0)={0x41424344, 0x41424344}, 0x9, 0x20) syz_emit_ethernet(0x181, &(0x7f00000002c0)={@link_local, @empty, [], {@ipv4={0x800, {{0xf, 0x4, 0x914, 0x0, 0x173, 0x64, 0x6, 0x0, 0x89, 0x0, @local, @multicast1, {[@lsrr={0x83, 0x1b, 0x80000001, [@multicast2, @empty, @multicast2, @remote, @dev={0xac, 0x14, 0x14, 0xc}, @broadcast]}, @ra={0x94, 0x6, 0x7ff}, @ra={0x94, 0x6, 0x10000}]}}, @tcp={{0xd881, 0x4e24, r2, r3, 0x9, 0x0, 0xf, 0xc2, 0x1f, 0x0, 0x6, {[@sack={0x5, 0x22, [0x37, 0xfffffffffffffff9, 0x7, 0xaf7a, 0x3f, 0x9, 0x4, 0x8000]}, @window={0x3, 0x3, 0x8}]}}, {"114937bbd2152f97c13fd07f2b1493b0e28a31297fcc5ac649503f507226e5fb0a08095096ad23eb027f974f4db8101af9fc48a55be166b446f3917c3adb43f0c29d443657ce91fc8e9175c5ce8041476432ae76433db2477066aa80ed61c3d00bc73ea50e8e5124aa156071636372672069acc5c5c0cb80045bc41c2b5b3b1204392a5aa73ae8f6b04a4e748dd53eca7954c4598ddc1f40c4dea86b62de44738bf7776a0cd1735ae93fe2a42278196efa8784207d93e4c010cc8d4c953413f0fc67308540b3087df41e2ac880cd84bfe5a5dffd1cd0d70c0a592480290d41f715a61e424d1328d9bbb9661faad889893e6e187a5dfb70095afbfb"}}}}}}, &(0x7f0000000100)={0x0, 0x4, [0xe0a, 0x168, 0x524, 0xa6e]}) sched_setscheduler(r1, 0x5, &(0x7f0000000200)) ioctl$SNDRV_TIMER_IOCTL_GPARAMS(r0, 0x40485404, &(0x7f0000000240)={{}, 0x0, 0x2000000000000000}) 13:17:43 executing program 7: r0 = openat$cuse(0xffffffffffffff9c, &(0x7f0000000080)='/dev/cuse\x00', 0x2, 0x0) clone(0x1002102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000640), 0xffffffffffffffff) r1 = getpid() sched_setscheduler(r1, 0x5, &(0x7f0000000000)) write$FUSE_NOTIFY_DELETE(r0, &(0x7f0000000040)={0x29, 0x6, 0x0, {0x0, 0x8002a0}}, 0x29) 13:17:43 executing program 6: clone(0x802102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000040), 0xffffffffffffffff) r0 = syz_open_dev$sndtimer(&(0x7f0000000000)='/dev/snd/timer\x00', 0x0, 0x0) r1 = getpid() sched_setscheduler(r1, 0x5, &(0x7f0000000200)) openat$fuse(0xffffffffffffff9c, &(0x7f0000000080)='/dev/fuse\x00', 0x2, 0x0) ioctl$SNDRV_TIMER_IOCTL_GPARAMS(r0, 0x40485404, &(0x7f0000000240)={{}, 0x0, 0x2000000000000000}) 13:17:43 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r0, &(0x7f0000942000)={0x2, 0x4e20, @multicast1}, 0x10) sendmsg$key(0xffffffffffffffff, &(0x7f0000f56000)={0x0, 0x0, &(0x7f00008feff0)={&(0x7f0000000500)=ANY=[@ANYBLOB="020300090a1500000000000000000000030006190000000002000000e0000001003f00000000000002000100e625aa66dcef85847e479eb3c49000000400000000fd003e"], 0x44}}, 0x0) add_key(&(0x7f0000000080)='logon\x00', &(0x7f0000000100)={0x73, 0x79, 0x7a, 0x1}, &(0x7f0000001240), 0x0, 0xfffffffffffffff8) get_mempolicy(&(0x7f0000000000), &(0x7f00000001c0), 0x1ff, &(0x7f0000fff000/0x1000)=nil, 0x3) setsockopt$sock_int(r0, 0x1, 0x3c, &(0x7f0000d4effc)=0x1, 0x4) connect$inet(r0, &(0x7f0000000000)={0x2, 0x4e20, @dev={0xac, 0x14, 0x14, 0x18}}, 0x10) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f00000001c0)='tunl0\x00', 0x5) sendto$inet(r0, &(0x7f00006d1fd4)="db", 0x1, 0x4000010, &(0x7f00004daff0)={0x2, 0x0, @loopback, [0x0, 0x0, 0x0, 0x3f00]}, 0x10) 13:17:43 executing program 3: r0 = openat$cuse(0xffffffffffffff9c, &(0x7f0000000080)='/dev/cuse\x00', 0x2, 0x0) clone(0x1002102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000640), 0xffffffffffffffff) r1 = getpid() sched_setscheduler(r1, 0x5, &(0x7f0000000000)) write$FUSE_NOTIFY_DELETE(r0, &(0x7f0000000040)={0x29, 0x4, 0x0, {0x800000000000000}}, 0x29) [ 1565.719139] binder: 19153:19156 IncRefs 0 refcount change on invalid ref 4 ret -22 [ 1565.781029] binder: 19153:19156 BC_INCREFS_DONE u0000000000000000 no match [ 1565.803616] binder: 19153:19156 IncRefs 0 refcount change on invalid ref 0 ret -22 13:17:44 executing program 1: r0 = socket$netlink(0x10, 0x3, 0x8000000004) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_TCP_CONGESTION(r1, 0x6, 0xd, &(0x7f0000000180)='vegas\x00', 0x6) bind$inet6(r1, &(0x7f00001fefe4)={0xa, 0x4e22}, 0x1c) sendto$inet6(r1, &(0x7f0000000100), 0x8d2d601e8976aa5, 0x20000004, &(0x7f000031e000)={0xa, 0x4e22}, 0x1c) writev(r0, &(0x7f0000000100)=[{&(0x7f0000000000)="580000001400192340834b80040d8c560a067fa114ff81004e220000000058000b4824ca944f64009400050028925aa8000000000000008000f0fffeffff09000000fff5dd00000010000100000c0900fcff0000040e05a5", 0x58}], 0x1) 13:17:44 executing program 7: r0 = openat$cuse(0xffffffffffffff9c, &(0x7f0000000080)='/dev/cuse\x00', 0x2, 0x0) clone(0x1002102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000640), 0xffffffffffffffff) r1 = getpid() sched_setscheduler(r1, 0x5, &(0x7f0000000000)) write$FUSE_NOTIFY_DELETE(r0, &(0x7f0000000040)={0x29, 0x6, 0x0, {0x0, 0x700000000000000}}, 0x29) 13:17:44 executing program 6: clone(0x802102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000040), 0xffffffffffffffff) r0 = syz_open_dev$sndtimer(&(0x7f0000000000)='/dev/snd/timer\x00', 0x0, 0x0) r1 = getpid() sched_setscheduler(r1, 0x5, &(0x7f0000000200)) ioctl$SNDRV_TIMER_IOCTL_GPARAMS(r0, 0x40485404, &(0x7f0000000240)={{}, 0x0, 0x2000000000000000}) r2 = syz_open_dev$vcsn(&(0x7f0000000080)='/dev/vcs#\x00', 0x9, 0x40000) write$P9_RSYMLINK(r2, &(0x7f00000000c0)={0x14, 0x11, 0x2, {0x44, 0x2}}, 0x14) 13:17:44 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r0, &(0x7f0000942000)={0x2, 0x4e20, @multicast1}, 0x10) sendmsg$key(0xffffffffffffffff, &(0x7f0000f56000)={0x0, 0x0, &(0x7f00008feff0)={&(0x7f0000000500)=ANY=[@ANYBLOB="020300090a1500000000000000000000030006190000000002000000e0000001003f00000000000002000100e625aa66dcef85847e479eb3c49000000400000000fd003e"], 0x44}}, 0x0) add_key(&(0x7f0000000080)='logon\x00', &(0x7f0000000100)={0x73, 0x79, 0x7a, 0x1}, &(0x7f0000001240), 0x0, 0xfffffffffffffff8) get_mempolicy(&(0x7f0000000000), &(0x7f00000001c0), 0x1ff, &(0x7f0000fff000/0x1000)=nil, 0x3) setsockopt$sock_int(r0, 0x1, 0x3c, &(0x7f0000d4effc)=0x1, 0x4) connect$inet(r0, &(0x7f0000000000)={0x2, 0x4e20, @dev={0xac, 0x14, 0x14, 0x18}}, 0x10) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f00000001c0)='tunl0\x00', 0x5) sendto$inet(r0, &(0x7f00006d1fd4)="db", 0x1, 0x4000010, &(0x7f00004daff0)={0x2, 0x0, @loopback, [0x0, 0x0, 0x0, 0x11]}, 0x10) 13:17:44 executing program 3: r0 = openat$cuse(0xffffffffffffff9c, &(0x7f0000000080)='/dev/cuse\x00', 0x2, 0x0) clone(0x1002102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000640), 0xffffffffffffffff) r1 = getpid() sched_setscheduler(r1, 0x5, &(0x7f0000000000)) write$FUSE_NOTIFY_DELETE(r0, &(0x7f0000000040)={0x29, 0x4, 0x0, {0xa000000}}, 0x29) 13:17:44 executing program 5: r0 = syz_open_dev$binder(&(0x7f00000021c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000002340)={0x34, 0x0, &(0x7f0000002240)=[@request_death={0x400c630e, 0x4, 0x4}, @increfs={0x40046304, 0x4}, @increfs_done={0x40106308, 0x0, 0x3}, @increfs], 0x77, 0x0, &(0x7f00000022c0)="b3cd0976d8e2af743c6f523efe14fd20c3c3dd2572734282a761e1b4304e2599c85f198cc82bd5d0c7074edca2f9ea7b875ff7047ec0784fbb354e15fd3f7d837f533597d5082692a6f2fb748da3cc4157188f7f2a5477ded56f72f5b75c96872db429e44b8fcd781d96dead77a0b58b7af9085a208a22"}) 13:17:44 executing program 4: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = gettid() perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x3e5}, 0x0, 0x0, 0xffffffffffffffff, 0x0) fcntl$setown(r0, 0x8, r1) bind$inet6(r0, &(0x7f0000807fe4)={0xa, 0x4e22}, 0x1c) sendto$inet6(r0, &(0x7f0000000380), 0x0, 0x200408d4, &(0x7f000072e000)={0xa, 0x4e22, 0x0, @loopback}, 0x1c) sendto$inet6(r0, &(0x7f0000ad6fad)='\x00', 0x1, 0x3fffffd, &(0x7f0000254000)={0xa, 0x0, 0xb804000000000000, @loopback}, 0x1c) 13:17:44 executing program 0: perf_event_open(&(0x7f0000000040)={0x2, 0x70, 0x3e5}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f00000021c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000002340)={0xb5, 0x4800, &(0x7f00000000c0)=ANY=[@ANYBLOB="0463044000000000b6a571ac965f26c50d500dae115e59afcd8a338d8b2727193c56d4ebef60c214b766ffde6cff6ceef2baa2594a53a0117e77afd5d58e8a35afdae81b258585ce769507333c0238790d5ed750bf1d6ca2a873050056528fce7becfd12f165ac43a826d3462822ff8f29ea992d4e208847cf4fc10ca00b87b5ce2523fa477bad0be1c97e4398aa2ac81d973b5a871d8e0b295e436cd8415f19088c6c82c85f4ed1fac41da062bc6dbfb8eac4276c"], 0x0, 0x0, &(0x7f00000022c0)}) 13:17:44 executing program 7: r0 = openat$cuse(0xffffffffffffff9c, &(0x7f0000000080)='/dev/cuse\x00', 0x2, 0x0) clone(0x1002102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000640), 0xffffffffffffffff) r1 = getpid() sched_setscheduler(r1, 0x5, &(0x7f0000000000)) write$FUSE_NOTIFY_DELETE(r0, &(0x7f0000000040)={0x29, 0x6, 0x0, {0x0, 0x4000000000000}}, 0x29) 13:17:44 executing program 3: r0 = openat$cuse(0xffffffffffffff9c, &(0x7f0000000080)='/dev/cuse\x00', 0x2, 0x0) clone(0x1002102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000640), 0xffffffffffffffff) r1 = getpid() sched_setscheduler(r1, 0x5, &(0x7f0000000000)) write$FUSE_NOTIFY_DELETE(r0, &(0x7f0000000040)={0x29, 0x4, 0x0, {0x600}}, 0x29) [ 1566.322995] binder: 19195:19199 IncRefs 0 refcount change on invalid ref 4 ret -22 [ 1566.337608] binder: 19195:19199 BC_INCREFS_DONE u0000000000000000 no match [ 1566.347150] binder: 19195:19199 IncRefs 0 refcount change on invalid ref 0 ret -22 13:17:44 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r0, &(0x7f0000942000)={0x2, 0x4e20, @multicast1}, 0x10) sendmsg$key(0xffffffffffffffff, &(0x7f0000f56000)={0x0, 0x0, &(0x7f00008feff0)={&(0x7f0000000500)=ANY=[@ANYBLOB="020300090a1500000000000000000000030006190000000002000000e0000001003f00000000000002000100e625aa66dcef85847e479eb3c49000000400000000fd003e"], 0x44}}, 0x0) add_key(&(0x7f0000000080)='logon\x00', &(0x7f0000000100)={0x73, 0x79, 0x7a, 0x1}, &(0x7f0000001240), 0x0, 0xfffffffffffffff8) get_mempolicy(&(0x7f0000000000), &(0x7f00000001c0), 0x1ff, &(0x7f0000fff000/0x1000)=nil, 0x3) setsockopt$sock_int(r0, 0x1, 0x3c, &(0x7f0000d4effc)=0x1, 0x4) connect$inet(r0, &(0x7f0000000000)={0x2, 0x4e20, @dev={0xac, 0x14, 0x14, 0x18}}, 0x10) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f00000001c0)='tunl0\x00', 0x5) sendto$inet(r0, &(0x7f00006d1fd4)="db", 0x1, 0x4000010, &(0x7f00004daff0)={0x2, 0x0, @loopback, [0x0, 0x0, 0x0, 0xfeffffff00000000]}, 0x10) 13:17:44 executing program 5: r0 = syz_open_dev$binder(&(0x7f00000021c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000002340)={0x34, 0x0, &(0x7f0000002240)=[@request_death={0x400c630e, 0x4, 0x4}, @increfs={0x40046304, 0x4}, @increfs_done={0x40106308, 0x0, 0x3}, @increfs], 0x77, 0x0, &(0x7f00000022c0)="b3cd0976d8e2af743c6f523efe14fd20c3c3dd2572734282a761e1b4304e2599c85f198cc82bd5d0c72b4edca2f9ea7b875ff7047ec0784fbb354e15fd3f7d837f533597d5082692a6f2fb748da3cc4157188f7f2a5477ded56f72f5b75c96872db429e44b8fcd781d96dead77a0b58b7af9085a208a22"}) 13:17:44 executing program 6: clone(0x802102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000040), 0xffffffffffffffff) r0 = syz_open_dev$sndtimer(&(0x7f0000000000)='/dev/snd/timer\x00', 0x0, 0x0) r1 = getpid() r2 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000080)='/dev/rtc0\x00', 0x800, 0x0) getsockopt$inet_sctp6_SCTP_AUTOCLOSE(r2, 0x84, 0x4, &(0x7f00000000c0), &(0x7f0000000100)=0x4) sched_setscheduler(r1, 0x5, &(0x7f0000000200)) ioctl$SNDRV_TIMER_IOCTL_GPARAMS(r0, 0x40485404, &(0x7f0000000240)={{}, 0x0, 0x2000000000000000}) 13:17:44 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r0, &(0x7f0000942000)={0x2, 0x4e20, @multicast1}, 0x10) sendmsg$key(0xffffffffffffffff, &(0x7f0000f56000)={0x0, 0x0, &(0x7f00008feff0)={&(0x7f0000000500)=ANY=[@ANYBLOB="020300090a1500000000000000000000030006190000000002000000e0000001003f00000000000002000100e625aa66dcef85847e479eb3c49000000400000000fd003e"], 0x44}}, 0x0) add_key(&(0x7f0000000080)='logon\x00', &(0x7f0000000100)={0x73, 0x79, 0x7a, 0x1}, &(0x7f0000001240), 0x0, 0xfffffffffffffff8) get_mempolicy(&(0x7f0000000000), &(0x7f00000001c0), 0x1ff, &(0x7f0000fff000/0x1000)=nil, 0x3) setsockopt$sock_int(r0, 0x1, 0x3c, &(0x7f0000d4effc)=0x1, 0x4) connect$inet(r0, &(0x7f0000000000)={0x2, 0x4e20, @dev={0xac, 0x14, 0x14, 0x18}}, 0x10) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f00000001c0)='tunl0\x00', 0x5) sendto$inet(r0, &(0x7f00006d1fd4)="db", 0x1, 0x4000010, &(0x7f00004daff0)={0x2, 0x0, @loopback, [0x0, 0x0, 0x0, 0xa00000000000000]}, 0x10) [ 1566.538483] binder: 19225:19227 IncRefs 0 refcount change on invalid ref 4 ret -22 13:17:44 executing program 3: r0 = openat$cuse(0xffffffffffffff9c, &(0x7f0000000080)='/dev/cuse\x00', 0x2, 0x0) clone(0x1002102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000640), 0xffffffffffffffff) r1 = getpid() sched_setscheduler(r1, 0x5, &(0x7f0000000000)) write$FUSE_NOTIFY_DELETE(r0, &(0x7f0000000040)={0x29, 0x4, 0x0, {0x4}}, 0x29) [ 1566.586217] binder: 19225:19227 BC_INCREFS_DONE u0000000000000000 no match [ 1566.593469] binder: 19225:19227 IncRefs 0 refcount change on invalid ref 0 ret -22 13:17:44 executing program 5: r0 = syz_open_dev$binder(&(0x7f00000021c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000002340)={0x34, 0x0, &(0x7f0000002240)=[@request_death={0x400c630e, 0x4, 0x4}, @increfs={0x40046304, 0x4}, @increfs_done={0x40106308, 0x0, 0x3}, @increfs], 0x77, 0x0, &(0x7f00000022c0)="b3cd0976d8e2af743c6f523efe14fd20c3c3dd2572734282a761e1b4304e2599c85f198cc82bd5d0c7294edca2f9ea7b875ff7047ec0784fbb354e15fd3f7d837f533597d5082692a6f2fb748da3cc4157188f7f2a5477ded56f72f5b75c96872db429e44b8fcd781d96dead77a0b58b7af9085a208a22"}) [ 1566.776828] binder: 19254:19258 BC_INCREFS_DONE u0000000000000000 no match 13:17:45 executing program 1: r0 = socket$netlink(0x10, 0x3, 0x8000000004) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_TCP_CONGESTION(r1, 0x6, 0xd, &(0x7f0000000180)='vegas\x00', 0x6) bind$inet6(r1, &(0x7f00001fefe4)={0xa, 0x4e22}, 0x1c) sendto$inet6(r1, &(0x7f0000000100), 0x8d2d601e8976aa5, 0x20000004, &(0x7f000031e000)={0xa, 0x4e22}, 0x1c) writev(r0, &(0x7f0000000100)=[{&(0x7f0000000000)="580000001400192340834b80040d8c560a067fb544ff81004e220000000058000b4824ca944f64009400050028925aa8000000000000008000f0fffeffff09000000fff5dd00000010000100000c0900fcff0000040e05a5", 0x58}], 0x1) 13:17:45 executing program 3: r0 = openat$cuse(0xffffffffffffff9c, &(0x7f0000000080)='/dev/cuse\x00', 0x2, 0x0) clone(0x1002102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000640), 0xffffffffffffffff) r1 = getpid() sched_setscheduler(r1, 0x5, &(0x7f0000000000)) write$FUSE_NOTIFY_DELETE(r0, &(0x7f0000000040)={0x29, 0x4, 0x0, {0xc00000000000000}}, 0x29) 13:17:45 executing program 7: r0 = openat$cuse(0xffffffffffffff9c, &(0x7f0000000080)='/dev/cuse\x00', 0x2, 0x0) clone(0x1002102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000640), 0xffffffffffffffff) r1 = getpid() sched_setscheduler(r1, 0x5, &(0x7f0000000000)) write$FUSE_NOTIFY_DELETE(r0, &(0x7f0000000040)={0x29, 0x6, 0x0, {0x0, 0xc00000000000000}}, 0x29) 13:17:45 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r0, &(0x7f0000942000)={0x2, 0x4e20, @multicast1}, 0x10) sendmsg$key(0xffffffffffffffff, &(0x7f0000f56000)={0x0, 0x0, &(0x7f00008feff0)={&(0x7f0000000500)=ANY=[@ANYBLOB="020300090a1500000000000000000000030006190000000002000000e0000001003f00000000000002000100e625aa66dcef85847e479eb3c49000000400000000fd003e"], 0x44}}, 0x0) add_key(&(0x7f0000000080)='logon\x00', &(0x7f0000000100)={0x73, 0x79, 0x7a, 0x1}, &(0x7f0000001240), 0x0, 0xfffffffffffffff8) get_mempolicy(&(0x7f0000000000), &(0x7f00000001c0), 0x1ff, &(0x7f0000fff000/0x1000)=nil, 0x3) setsockopt$sock_int(r0, 0x1, 0x3c, &(0x7f0000d4effc)=0x1, 0x4) connect$inet(r0, &(0x7f0000000000)={0x2, 0x4e20, @dev={0xac, 0x14, 0x14, 0x18}}, 0x10) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f00000001c0)='tunl0\x00', 0x5) sendto$inet(r0, &(0x7f00006d1fd4)="db", 0x1, 0x4000010, &(0x7f00004daff0)={0x2, 0x0, @loopback, [0x0, 0x0, 0x0, 0x300]}, 0x10) 13:17:45 executing program 6: clone(0x802102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000040), 0xffffffffffffffff) r0 = syz_open_dev$sndtimer(&(0x7f0000000000)='/dev/snd/timer\x00', 0x0, 0x0) r1 = getpid() sched_setscheduler(r1, 0x5, &(0x7f0000000200)) ioctl$SNDRV_TIMER_IOCTL_GPARAMS(r0, 0x40485404, &(0x7f0000000240)={{}, 0x0, 0x2000000000000000}) r2 = socket$inet6_udplite(0xa, 0x2, 0x88) getsockopt$inet6_mtu(r2, 0x29, 0x17, &(0x7f0000000080), &(0x7f00000000c0)=0x4) 13:17:45 executing program 5: r0 = syz_open_dev$binder(&(0x7f00000021c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000002340)={0x34, 0x0, &(0x7f0000002240)=[@request_death={0x400c630e, 0x4, 0x4}, @increfs={0x40046304, 0x4}, @increfs_done={0x40106308, 0x0, 0x3}, @increfs], 0x77, 0x0, &(0x7f00000022c0)="b3cd0976d8e2af743c6f523efe14fd20c3c3dd2572734282a761e1b4304e2599c85f198cc82bd5d0c7164edca2f9ea7b875ff7047ec0784fbb354e15fd3f7d837f533597d5082692a6f2fb748da3cc4157188f7f2a5477ded56f72f5b75c96872db429e44b8fcd781d96dead77a0b58b7af9085a208a22"}) 13:17:45 executing program 0: perf_event_open(&(0x7f0000000040)={0x2, 0x70, 0x3e5}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f00000021c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000002340)={0xb5, 0x48, &(0x7f00000000c0)=ANY=[@ANYBLOB="0463044000000000b6a571ac965f26c50d500dae115e59afcd8a338d8b2727193c56d4ebef60c214b766ffde6cff6ceef2baa2594a53a0117e77afd5d58e8a35afdae81b258585ce769507333c0238790d5ed750bf1d6ca2a873050056528fce7becfd12f165ac43a826d3462822ff8f29ea992d4e208847cf4fc10ca00b87b5ce2523fa477bad0be1c97e4398aa2ac81d973b5a871d8e0b295e436cd8415f19088c6c82c85f4ed1fac41da062bc6dbfb8eac4276c"], 0x0, 0x0, &(0x7f00000022c0)}) 13:17:45 executing program 4: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = gettid() perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x3e5}, 0x0, 0x0, 0xffffffffffffffff, 0x0) fcntl$setown(r0, 0x8, r1) bind$inet6(r0, &(0x7f0000807fe4)={0xa, 0x4e22}, 0x1c) sendto$inet6(r0, &(0x7f0000000380), 0x0, 0x200408d4, &(0x7f000072e000)={0xa, 0x4e22, 0x0, @loopback}, 0x1c) sendto$inet6(r0, &(0x7f0000ad6fad)='\x00', 0x1, 0x3fffffd, &(0x7f0000254000)={0xa, 0x0, 0xb8040000, @loopback}, 0x1c) 13:17:45 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r0, &(0x7f0000942000)={0x2, 0x4e20, @multicast1}, 0x10) sendmsg$key(0xffffffffffffffff, &(0x7f0000f56000)={0x0, 0x0, &(0x7f00008feff0)={&(0x7f0000000500)=ANY=[@ANYBLOB="020300090a1500000000000000000000030006190000000002000000e0000001003f00000000000002000100e625aa66dcef85847e479eb3c49000000400000000fd003e"], 0x44}}, 0x0) add_key(&(0x7f0000000080)='logon\x00', &(0x7f0000000100)={0x73, 0x79, 0x7a, 0x1}, &(0x7f0000001240), 0x0, 0xfffffffffffffff8) get_mempolicy(&(0x7f0000000000), &(0x7f00000001c0), 0x1ff, &(0x7f0000fff000/0x1000)=nil, 0x3) setsockopt$sock_int(r0, 0x1, 0x3c, &(0x7f0000d4effc)=0x1, 0x4) connect$inet(r0, &(0x7f0000000000)={0x2, 0x4e20, @dev={0xac, 0x14, 0x14, 0x18}}, 0x10) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f00000001c0)='tunl0\x00', 0x5) sendto$inet(r0, &(0x7f00006d1fd4)="db", 0x1, 0x4000010, &(0x7f00004daff0)={0x2, 0x0, @loopback, [0x0, 0x0, 0x0, 0x800000000000000]}, 0x10) [ 1567.194129] binder: 19267:19281 BC_INCREFS_DONE u0000000000000000 no match 13:17:45 executing program 5: r0 = syz_open_dev$binder(&(0x7f00000021c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000002340)={0x34, 0x0, &(0x7f0000002240)=[@request_death={0x400c630e, 0x4, 0x4}, @increfs={0x40046304, 0x4}, @increfs_done={0x40106308, 0x0, 0x3}, @increfs], 0x77, 0x0, &(0x7f00000022c0)="b3cd0976d8e2af743c6f523efe14fd20c3c3dd2572734282a761e1b4304e2599c85f198cc82bd5d0c74b4edca2f9ea7b875ff7047ec0784fbb354e15fd3f7d837f533597d5082692a6f2fb748da3cc4157188f7f2a5477ded56f72f5b75c96872db429e44b8fcd781d96dead77a0b58b7af9085a208a22"}) 13:17:45 executing program 3: r0 = openat$cuse(0xffffffffffffff9c, &(0x7f0000000080)='/dev/cuse\x00', 0x2, 0x0) clone(0x1002102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000640), 0xffffffffffffffff) r1 = getpid() sched_setscheduler(r1, 0x5, &(0x7f0000000000)) write$FUSE_NOTIFY_DELETE(r0, &(0x7f0000000040)={0x29, 0x4, 0x0, {0x5000000}}, 0x29) 13:17:45 executing program 6: clone(0x802102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000040), 0xffffffffffffffff) r0 = syz_open_dev$sndtimer(&(0x7f0000000000)='/dev/snd/timer\x00', 0x0, 0x0) r1 = getpid() r2 = syz_open_procfs(r1, &(0x7f0000000080)='net/icmp6\x00') sched_setscheduler(r1, 0x5, &(0x7f0000000200)) fcntl$addseals(r0, 0x409, 0x1) ioctl$SNDRV_TIMER_IOCTL_GPARAMS(r0, 0x40485404, &(0x7f0000000140)={{0xffffffffffffffff, 0x0, 0xfffffffffffffffd, 0x8000000002, 0xfffffffffffffffd}, 0x0, 0xfffffffffffffffa}) ioctl$BLKGETSIZE64(r2, 0x80081272, &(0x7f00000000c0)) 13:17:45 executing program 5: r0 = syz_open_dev$binder(&(0x7f00000021c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000002340)={0x34, 0x0, &(0x7f0000002240)=[@request_death={0x400c630e, 0x4, 0x4}, @increfs={0x40046304, 0x4}, @increfs_done={0x40106308, 0x0, 0x3}, @increfs], 0x77, 0x0, &(0x7f00000022c0)="b3cd0976d8e2af743c6f523efe14fd20c3c3dd2572734282a761e1b4304e2599c85f198cc82bd5d0c7414edca2f9ea7b875ff7047ec0784fbb354e15fd3f7d837f533597d5082692a6f2fb748da3cc4157188f7f2a5477ded56f72f5b75c96872db429e44b8fcd781d96dead77a0b58b7af9085a208a22"}) 13:17:45 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r0, &(0x7f0000942000)={0x2, 0x4e20, @multicast1}, 0x10) sendmsg$key(0xffffffffffffffff, &(0x7f0000f56000)={0x0, 0x0, &(0x7f00008feff0)={&(0x7f0000000500)=ANY=[@ANYBLOB="020300090a1500000000000000000000030006190000000002000000e0000001003f00000000000002000100e625aa66dcef85847e479eb3c49000000400000000fd003e"], 0x44}}, 0x0) add_key(&(0x7f0000000080)='logon\x00', &(0x7f0000000100)={0x73, 0x79, 0x7a, 0x1}, &(0x7f0000001240), 0x0, 0xfffffffffffffff8) get_mempolicy(&(0x7f0000000000), &(0x7f00000001c0), 0x1ff, &(0x7f0000fff000/0x1000)=nil, 0x3) setsockopt$sock_int(r0, 0x1, 0x3c, &(0x7f0000d4effc)=0x1, 0x4) connect$inet(r0, &(0x7f0000000000)={0x2, 0x4e20, @dev={0xac, 0x14, 0x14, 0x18}}, 0x10) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f00000001c0)='tunl0\x00', 0x5) sendto$inet(r0, &(0x7f00006d1fd4)="db", 0x1, 0x4000010, &(0x7f00004daff0)={0x2, 0x0, @loopback, [0x0, 0x0, 0x0, 0x5000000]}, 0x10) [ 1567.368236] binder: 19303:19310 BC_INCREFS_DONE u0000000000000000 no match 13:17:45 executing program 6: clone(0x802102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000040), 0xffffffffffffffff) syz_open_dev$sndtimer(&(0x7f0000000000)='/dev/snd/timer\x00', 0x0, 0x0) r0 = getpid() sched_setscheduler(r0, 0x5, &(0x7f0000000200)) 13:17:45 executing program 3: r0 = openat$cuse(0xffffffffffffff9c, &(0x7f0000000080)='/dev/cuse\x00', 0x2, 0x0) clone(0x1002102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000640), 0xffffffffffffffff) r1 = getpid() sched_setscheduler(r1, 0x5, &(0x7f0000000000)) write$FUSE_NOTIFY_DELETE(r0, &(0x7f0000000040)={0x29, 0x4, 0x0, {0xc00}}, 0x29) [ 1567.464076] binder: 19317:19319 BC_INCREFS_DONE u0000000000000000 no match [ 1567.630600] binder: 19328:19338 unknown command 856135030 [ 1567.671877] binder: 19328:19338 ioctl c0306201 20002340 returned -22 [ 1567.710674] binder: 19328:19345 unknown command 856135030 [ 1567.725770] binder: 19328:19345 ioctl c0306201 20002340 returned -22 13:17:46 executing program 1: r0 = socket$netlink(0x10, 0x3, 0x8000000004) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_TCP_CONGESTION(r1, 0x6, 0xd, &(0x7f0000000180)='vegas\x00', 0x6) bind$inet6(r1, &(0x7f00001fefe4)={0xa, 0x4e22}, 0x1c) sendto$inet6(r1, &(0x7f0000000100), 0x8d2d601e8976aa5, 0x20000004, &(0x7f000031e000)={0xa, 0x4e22}, 0x1c) writev(r0, &(0x7f0000000100)=[{&(0x7f0000000000)="580000001400192340834b80040d8c560a067f8d56ff81004e220000000058000b4824ca944f64009400050028925aa8000000000000008000f0fffeffff09000000fff5dd00000010000100000c0900fcff0000040e05a5", 0x58}], 0x1) 13:17:46 executing program 5: r0 = syz_open_dev$binder(&(0x7f00000021c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000002340)={0x34, 0x0, &(0x7f0000002240)=[@request_death={0x400c630e, 0x4, 0x4}, @increfs={0x40046304, 0x4}, @increfs_done={0x40106308, 0x0, 0x3}, @increfs], 0x77, 0x0, &(0x7f00000022c0)="b3cd0976d8e2af743c6f523efe14fd20c3c3dd2572734282a761e1b4304e2599c85f198cc82bd5d0c70a4edca2f9ea7b875ff7047ec0784fbb354e15fd3f7d837f533597d5082692a6f2fb748da3cc4157188f7f2a5477ded56f72f5b75c96872db429e44b8fcd781d96dead77a0b58b7af9085a208a22"}) 13:17:46 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r0, &(0x7f0000942000)={0x2, 0x4e20, @multicast1}, 0x10) sendmsg$key(0xffffffffffffffff, &(0x7f0000f56000)={0x0, 0x0, &(0x7f00008feff0)={&(0x7f0000000500)=ANY=[@ANYBLOB="020300090a1500000000000000000000030006190000000002000000e0000001003f00000000000002000100e625aa66dcef85847e479eb3c49000000400000000fd003e"], 0x44}}, 0x0) add_key(&(0x7f0000000080)='logon\x00', &(0x7f0000000100)={0x73, 0x79, 0x7a, 0x1}, &(0x7f0000001240), 0x0, 0xfffffffffffffff8) get_mempolicy(&(0x7f0000000000), &(0x7f00000001c0), 0x1ff, &(0x7f0000fff000/0x1000)=nil, 0x3) setsockopt$sock_int(r0, 0x1, 0x3c, &(0x7f0000d4effc)=0x1, 0x4) connect$inet(r0, &(0x7f0000000000)={0x2, 0x4e20, @dev={0xac, 0x14, 0x14, 0x18}}, 0x10) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f00000001c0)='tunl0\x00', 0x5) sendto$inet(r0, &(0x7f00006d1fd4)="db", 0x1, 0x4000010, &(0x7f00004daff0)={0x2, 0x0, @loopback, [0x0, 0x0, 0x0, 0xa00]}, 0x10) 13:17:46 executing program 7: r0 = openat$cuse(0xffffffffffffff9c, &(0x7f0000000080)='/dev/cuse\x00', 0x2, 0x0) clone(0x1002102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000640), 0xffffffffffffffff) r1 = getpid() sched_setscheduler(r1, 0x5, &(0x7f0000000000)) write$FUSE_NOTIFY_DELETE(r0, &(0x7f0000000040)={0x29, 0x6, 0x0, {0x0, 0xc000000}}, 0x29) 13:17:46 executing program 6: clone(0x802102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000040), 0xffffffffffffffff) r0 = syz_open_dev$usb(&(0x7f0000000080)='/dev/bus/usb/00#/00#\x00', 0x8, 0x640000) ioctl$EVIOCGABS2F(r0, 0x8018456f, &(0x7f00000000c0)=""/12) r1 = syz_open_dev$sndtimer(&(0x7f0000000000)='/dev/snd/timer\x00', 0x0, 0x800000000000000) r2 = getpid() sched_setscheduler(r2, 0x5, &(0x7f0000000200)) ioctl$SNDRV_TIMER_IOCTL_GPARAMS(r1, 0x40485404, &(0x7f0000000240)={{}, 0x0, 0x2000000000000000}) 13:17:46 executing program 3: r0 = openat$cuse(0xffffffffffffff9c, &(0x7f0000000080)='/dev/cuse\x00', 0x2, 0x0) clone(0x1002102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000640), 0xffffffffffffffff) r1 = getpid() sched_setscheduler(r1, 0x5, &(0x7f0000000000)) write$FUSE_NOTIFY_DELETE(r0, &(0x7f0000000040)={0x29, 0x4, 0x0, {0x2}}, 0x29) 13:17:46 executing program 4: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = gettid() perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x3e5}, 0x0, 0x0, 0xffffffffffffffff, 0x0) fcntl$setown(r0, 0x8, r1) bind$inet6(r0, &(0x7f0000807fe4)={0xa, 0x4e22}, 0x1c) sendto$inet6(r0, &(0x7f0000000380), 0x0, 0x200408d4, &(0x7f000072e000)={0xa, 0x4e22, 0x0, @loopback}, 0x1c) sendto$inet6(r0, &(0x7f0000ad6fad)='\x00', 0x1, 0x3fffffd, &(0x7f0000254000)={0xa, 0x0, 0xa00, @loopback}, 0x1c) 13:17:46 executing program 0: perf_event_open(&(0x7f0000000040)={0x2, 0x70, 0x3e5}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f00000021c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000002340)={0xb5, 0x8000a0ffffffff, &(0x7f00000000c0)=ANY=[@ANYBLOB="0463044000000000b6a571ac965f26c50d500dae115e59afcd8a338d8b2727193c56d4ebef60c214b766ffde6cff6ceef2baa2594a53a0117e77afd5d58e8a35afdae81b258585ce769507333c0238790d5ed750bf1d6ca2a873050056528fce7becfd12f165ac43a826d3462822ff8f29ea992d4e208847cf4fc10ca00b87b5ce2523fa477bad0be1c97e4398aa2ac81d973b5a871d8e0b295e436cd8415f19088c6c82c85f4ed1fac41da062bc6dbfb8eac4276c"], 0x0, 0x0, &(0x7f00000022c0)}) 13:17:46 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r0, &(0x7f0000942000)={0x2, 0x4e20, @multicast1}, 0x10) sendmsg$key(0xffffffffffffffff, &(0x7f0000f56000)={0x0, 0x0, &(0x7f00008feff0)={&(0x7f0000000500)=ANY=[@ANYBLOB="020300090a1500000000000000000000030006190000000002000000e0000001003f00000000000002000100e625aa66dcef85847e479eb3c49000000400000000fd003e"], 0x44}}, 0x0) add_key(&(0x7f0000000080)='logon\x00', &(0x7f0000000100)={0x73, 0x79, 0x7a, 0x1}, &(0x7f0000001240), 0x0, 0xfffffffffffffff8) get_mempolicy(&(0x7f0000000000), &(0x7f00000001c0), 0x1ff, &(0x7f0000fff000/0x1000)=nil, 0x3) setsockopt$sock_int(r0, 0x1, 0x3c, &(0x7f0000d4effc)=0x1, 0x4) connect$inet(r0, &(0x7f0000000000)={0x2, 0x4e20, @dev={0xac, 0x14, 0x14, 0x18}}, 0x10) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f00000001c0)='tunl0\x00', 0x5) sendto$inet(r0, &(0x7f00006d1fd4)="db", 0x1, 0x4000010, &(0x7f00004daff0)={0x2, 0x0, @loopback, [0x0, 0x0, 0x0, 0x14b80100]}, 0x10) [ 1568.074167] binder_thread_write: 9 callbacks suppressed [ 1568.074180] binder: 19351:19358 BC_REQUEST_DEATH_NOTIFICATION invalid ref 4 [ 1568.130132] binder: 19351:19358 BC_INCREFS_DONE u0000000000000000 no match 13:17:46 executing program 3: r0 = openat$cuse(0xffffffffffffff9c, &(0x7f0000000080)='/dev/cuse\x00', 0x2, 0x0) clone(0x1002102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000640), 0xffffffffffffffff) r1 = getpid() sched_setscheduler(r1, 0x5, &(0x7f0000000000)) write$FUSE_NOTIFY_DELETE(r0, &(0x7f0000000040)={0x29, 0x4, 0x0, {0x5}}, 0x29) 13:17:46 executing program 5: r0 = syz_open_dev$binder(&(0x7f00000021c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000002340)={0x34, 0x0, &(0x7f0000002240)=[@request_death={0x400c630e, 0x4, 0x4}, @increfs={0x40046304, 0x4}, @increfs_done={0x40106308, 0x0, 0x3}, @increfs], 0x77, 0x0, &(0x7f00000022c0)="b3cd0976d8e2af743c6f523efe14fd20c3c3dd2572734282a761e1b4304e2599c85f198cc82bd5d0c7474edca2f9ea7b875ff7047ec0784fbb354e15fd3f7d837f533597d5082692a6f2fb748da3cc4157188f7f2a5477ded56f72f5b75c96872db429e44b8fcd781d96dead77a0b58b7af9085a208a22"}) 13:17:46 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r0, &(0x7f0000942000)={0x2, 0x4e20, @multicast1}, 0x10) sendmsg$key(0xffffffffffffffff, &(0x7f0000f56000)={0x0, 0x0, &(0x7f00008feff0)={&(0x7f0000000500)=ANY=[@ANYBLOB="020300090a1500000000000000000000030006190000000002000000e0000001003f00000000000002000100e625aa66dcef85847e479eb3c49000000400000000fd003e"], 0x44}}, 0x0) add_key(&(0x7f0000000080)='logon\x00', &(0x7f0000000100)={0x73, 0x79, 0x7a, 0x1}, &(0x7f0000001240), 0x0, 0xfffffffffffffff8) get_mempolicy(&(0x7f0000000000), &(0x7f00000001c0), 0x1ff, &(0x7f0000fff000/0x1000)=nil, 0x3) setsockopt$sock_int(r0, 0x1, 0x3c, &(0x7f0000d4effc)=0x1, 0x4) connect$inet(r0, &(0x7f0000000000)={0x2, 0x4e20, @dev={0xac, 0x14, 0x14, 0x18}}, 0x10) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f00000001c0)='tunl0\x00', 0x5) sendto$inet(r0, &(0x7f00006d1fd4)="db", 0x1, 0x4000010, &(0x7f00004daff0)={0x2, 0x0, @loopback, [0x0, 0x0, 0x0, 0x1100]}, 0x10) 13:17:46 executing program 6: r0 = syz_open_dev$sndtimer(&(0x7f0000000000)='/dev/snd/timer\x00', 0x0, 0x0) r1 = getpid() semget$private(0x0, 0x3, 0x2) sched_setscheduler(r1, 0x5, &(0x7f0000000200)) ioctl$SNDRV_TIMER_IOCTL_GPARAMS(r0, 0x40485404, &(0x7f0000000240)={{}, 0x0, 0x2000000000000000}) r2 = fcntl$dupfd(r0, 0x406, r0) getsockopt$inet_sctp_SCTP_DEFAULT_SNDINFO(0xffffffffffffff9c, 0x84, 0x22, &(0x7f0000000100)={0x3, 0x8004, 0x0, 0x6, 0x0}, &(0x7f0000000140)=0x10) setsockopt$inet_sctp6_SCTP_SET_PEER_PRIMARY_ADDR(r2, 0x84, 0x5, &(0x7f00000002c0)={r3, @in={{0x2, 0x4e21, @broadcast}}}, 0x84) socketpair(0x0, 0x0, 0x4, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$UI_GET_SYSNAME(r4, 0x8040552c, &(0x7f00000000c0)) [ 1568.310909] binder: 19390:19391 BC_REQUEST_DEATH_NOTIFICATION invalid ref 4 13:17:46 executing program 5: r0 = syz_open_dev$binder(&(0x7f00000021c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000002340)={0x34, 0x0, &(0x7f0000002240)=[@request_death={0x400c630e, 0x4, 0x4}, @increfs={0x40046304, 0x4}, @increfs_done={0x40106308, 0x0, 0x3}, @increfs], 0x77, 0x0, &(0x7f00000022c0)="b3cd0976d8e2af743c6f523efe14fd20c3c3dd2572734282a761e1b4304e2599c85f198cc82bd5d0c70c4edca2f9ea7b875ff7047ec0784fbb354e15fd3f7d837f533597d5082692a6f2fb748da3cc4157188f7f2a5477ded56f72f5b75c96872db429e44b8fcd781d96dead77a0b58b7af9085a208a22"}) 13:17:46 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r0, &(0x7f0000942000)={0x2, 0x4e20, @multicast1}, 0x10) sendmsg$key(0xffffffffffffffff, &(0x7f0000f56000)={0x0, 0x0, &(0x7f00008feff0)={&(0x7f0000000500)=ANY=[@ANYBLOB="020300090a1500000000000000000000030006190000000002000000e0000001003f00000000000002000100e625aa66dcef85847e479eb3c49000000400000000fd003e"], 0x44}}, 0x0) add_key(&(0x7f0000000080)='logon\x00', &(0x7f0000000100)={0x73, 0x79, 0x7a, 0x1}, &(0x7f0000001240), 0x0, 0xfffffffffffffff8) get_mempolicy(&(0x7f0000000000), &(0x7f00000001c0), 0x1ff, &(0x7f0000fff000/0x1000)=nil, 0x3) setsockopt$sock_int(r0, 0x1, 0x3c, &(0x7f0000d4effc)=0x1, 0x4) connect$inet(r0, &(0x7f0000000000)={0x2, 0x4e20, @dev={0xac, 0x14, 0x14, 0x18}}, 0x10) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f00000001c0)='tunl0\x00', 0x5) sendto$inet(r0, &(0x7f00006d1fd4)="db", 0x1, 0x4000010, &(0x7f00004daff0)={0x2, 0x0, @loopback, [0x0, 0x0, 0x0, 0x3e8]}, 0x10) 13:17:46 executing program 7: r0 = openat$cuse(0xffffffffffffff9c, &(0x7f0000000080)='/dev/cuse\x00', 0x2, 0x0) clone(0x1002102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000640), 0xffffffffffffffff) r1 = getpid() sched_setscheduler(r1, 0x5, &(0x7f0000000000)) write$FUSE_NOTIFY_DELETE(r0, &(0x7f0000000040)={0x29, 0x6, 0x0, {0x0, 0x7000000}}, 0x29) [ 1568.445678] binder: 19410:19413 BC_REQUEST_DEATH_NOTIFICATION invalid ref 4 13:17:47 executing program 3: r0 = openat$cuse(0xffffffffffffff9c, &(0x7f0000000080)='/dev/cuse\x00', 0x2, 0x0) clone(0x1002102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000640), 0xffffffffffffffff) r1 = getpid() sched_setscheduler(r1, 0x5, &(0x7f0000000000)) write$FUSE_NOTIFY_DELETE(r0, &(0x7f0000000040)={0x29, 0x4, 0x0, {0x600000000000000}}, 0x29) 13:17:47 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r0, &(0x7f0000942000)={0x2, 0x4e20, @multicast1}, 0x10) sendmsg$key(0xffffffffffffffff, &(0x7f0000f56000)={0x0, 0x0, &(0x7f00008feff0)={&(0x7f0000000500)=ANY=[@ANYBLOB="020300090a1500000000000000000000030006190000000002000000e0000001003f00000000000002000100e625aa66dcef85847e479eb3c49000000400000000fd003e"], 0x44}}, 0x0) add_key(&(0x7f0000000080)='logon\x00', &(0x7f0000000100)={0x73, 0x79, 0x7a, 0x1}, &(0x7f0000001240), 0x0, 0xfffffffffffffff8) get_mempolicy(&(0x7f0000000000), &(0x7f00000001c0), 0x1ff, &(0x7f0000fff000/0x1000)=nil, 0x3) setsockopt$sock_int(r0, 0x1, 0x3c, &(0x7f0000d4effc)=0x1, 0x4) connect$inet(r0, &(0x7f0000000000)={0x2, 0x4e20, @dev={0xac, 0x14, 0x14, 0x18}}, 0x10) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f00000001c0)='tunl0\x00', 0x5) sendto$inet(r0, &(0x7f00006d1fd4)="db", 0x1, 0x4000010, &(0x7f00004daff0)={0x2, 0x0, @loopback, [0x0, 0x0, 0x0, 0x3f00000000000000]}, 0x10) 13:17:47 executing program 5: r0 = syz_open_dev$binder(&(0x7f00000021c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000002340)={0x34, 0x0, &(0x7f0000002240)=[@request_death={0x400c630e, 0x4, 0x4}, @increfs={0x40046304, 0x4}, @increfs_done={0x40106308, 0x0, 0x3}, @increfs], 0x77, 0x0, &(0x7f00000022c0)="b3cd0976d8e2af743c6f523efe14fd20c3c3dd2572734282a761e1b4304e2599c85f198cc82bd5d0c7424edca2f9ea7b875ff7047ec0784fbb354e15fd3f7d837f533597d5082692a6f2fb748da3cc4157188f7f2a5477ded56f72f5b75c96872db429e44b8fcd781d96dead77a0b58b7af9085a208a22"}) 13:17:47 executing program 6: clone(0x802102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000040), 0xffffffffffffffff) r0 = syz_open_dev$sndtimer(&(0x7f0000000000)='/dev/snd/timer\x00', 0x0, 0x0) r1 = syz_open_dev$dspn(&(0x7f0000000080)='/dev/dsp#\x00', 0x8, 0x800) ioctl$ASHMEM_GET_PROT_MASK(r1, 0x7706, &(0x7f00000000c0)) r2 = getpid() sched_setscheduler(r2, 0x5, &(0x7f0000000200)) ioctl$SNDRV_TIMER_IOCTL_GPARAMS(r0, 0x40485404, &(0x7f0000000240)={{}, 0x0, 0x2000000000000000}) 13:17:47 executing program 7: r0 = openat$cuse(0xffffffffffffff9c, &(0x7f0000000080)='/dev/cuse\x00', 0x2, 0x0) clone(0x1002102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000640), 0xffffffffffffffff) r1 = getpid() sched_setscheduler(r1, 0x5, &(0x7f0000000000)) write$FUSE_NOTIFY_DELETE(r0, &(0x7f0000000040)={0x29, 0x6, 0x0, {0x0, 0x9000000}}, 0x29) 13:17:47 executing program 0: perf_event_open(&(0x7f0000000040)={0x2, 0x70, 0x3e5}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f00000021c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000002340)={0xb5, 0x8002a0ffffffff, &(0x7f00000000c0)=ANY=[@ANYBLOB="0463044000000000b6a571ac965f26c50d500dae115e59afcd8a338d8b2727193c56d4ebef60c214b766ffde6cff6ceef2baa2594a53a0117e77afd5d58e8a35afdae81b258585ce769507333c0238790d5ed750bf1d6ca2a873050056528fce7becfd12f165ac43a826d3462822ff8f29ea992d4e208847cf4fc10ca00b87b5ce2523fa477bad0be1c97e4398aa2ac81d973b5a871d8e0b295e436cd8415f19088c6c82c85f4ed1fac41da062bc6dbfb8eac4276c"], 0x0, 0x0, &(0x7f00000022c0)}) 13:17:47 executing program 1: r0 = socket$netlink(0x10, 0x3, 0x8000000004) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_TCP_CONGESTION(r1, 0x6, 0xd, &(0x7f0000000180)='vegas\x00', 0x6) bind$inet6(r1, &(0x7f00001fefe4)={0xa, 0x4e22}, 0x1c) sendto$inet6(r1, &(0x7f0000000100), 0x8d2d601e8976aa5, 0x20000004, &(0x7f000031e000)={0xa, 0x4e22}, 0x1c) writev(r0, &(0x7f0000000100)=[{&(0x7f0000000000)="580000001400192340834b80040d8c560a067f3a5eff81004e220000000058000b4824ca944f64009400050028925aa8000000000000008000f0fffeffff09000000fff5dd00000010000100000c0900fcff0000040e05a5", 0x58}], 0x1) 13:17:47 executing program 4: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = gettid() perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x3e5}, 0x0, 0x0, 0xffffffffffffffff, 0x0) fcntl$setown(r0, 0x8, r1) bind$inet6(r0, &(0x7f0000807fe4)={0xa, 0x4e22}, 0x1c) sendto$inet6(r0, &(0x7f0000000380), 0x0, 0x200408d4, &(0x7f000072e000)={0xa, 0x4e22, 0x0, @loopback}, 0x1c) sendto$inet6(r0, &(0x7f0000ad6fad)='\x00', 0x1, 0x3fffffd, &(0x7f0000254000)={0xa, 0x0, 0x4002, @loopback}, 0x1c) 13:17:47 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r0, &(0x7f0000942000)={0x2, 0x4e20, @multicast1}, 0x10) sendmsg$key(0xffffffffffffffff, &(0x7f0000f56000)={0x0, 0x0, &(0x7f00008feff0)={&(0x7f0000000500)=ANY=[@ANYBLOB="020300090a1500000000000000000000030006190000000002000000e0000001003f00000000000002000100e625aa66dcef85847e479eb3c49000000400000000fd003e"], 0x44}}, 0x0) add_key(&(0x7f0000000080)='logon\x00', &(0x7f0000000100)={0x73, 0x79, 0x7a, 0x1}, &(0x7f0000001240), 0x0, 0xfffffffffffffff8) get_mempolicy(&(0x7f0000000000), &(0x7f00000001c0), 0x1ff, &(0x7f0000fff000/0x1000)=nil, 0x3) setsockopt$sock_int(r0, 0x1, 0x3c, &(0x7f0000d4effc)=0x1, 0x4) connect$inet(r0, &(0x7f0000000000)={0x2, 0x4e20, @dev={0xac, 0x14, 0x14, 0x18}}, 0x10) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f00000001c0)='tunl0\x00', 0x5) sendto$inet(r0, &(0x7f00006d1fd4)="db", 0x1, 0x4000010, &(0x7f00004daff0)={0x2, 0x0, @loopback, [0x0, 0x0, 0x0, 0x8000a0]}, 0x10) [ 1568.984911] binder: 19431:19440 BC_REQUEST_DEATH_NOTIFICATION invalid ref 4 13:17:47 executing program 5: r0 = syz_open_dev$binder(&(0x7f00000021c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000002340)={0x34, 0x0, &(0x7f0000002240)=[@request_death={0x400c630e, 0x4, 0x4}, @increfs={0x40046304, 0x4}, @increfs_done={0x40106308, 0x0, 0x3}, @increfs], 0x77, 0x0, &(0x7f00000022c0)="b3cd0976d8e2af743c6f523efe14fd20c3c3dd2572734282a761e1b4304e2599c85f198cc82bd5d0c7124edca2f9ea7b875ff7047ec0784fbb354e15fd3f7d837f533597d5082692a6f2fb748da3cc4157188f7f2a5477ded56f72f5b75c96872db429e44b8fcd781d96dead77a0b58b7af9085a208a22"}) 13:17:47 executing program 7: r0 = openat$cuse(0xffffffffffffff9c, &(0x7f0000000080)='/dev/cuse\x00', 0x2, 0x0) clone(0x1002102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000640), 0xffffffffffffffff) r1 = getpid() sched_setscheduler(r1, 0x5, &(0x7f0000000000)) write$FUSE_NOTIFY_DELETE(r0, &(0x7f0000000040)={0x29, 0x6, 0x0, {0x0, 0xc}}, 0x29) 13:17:47 executing program 6: clone(0x10000, 0x0, 0xfffffffffffffffe, &(0x7f0000000040), 0xffffffffffffffff) r0 = syz_open_dev$sndtimer(&(0x7f0000000000)='/dev/snd/timer\x00', 0x0, 0x0) r1 = getpid() sched_setscheduler(r1, 0x5, &(0x7f0000000200)) ioctl$SNDRV_TIMER_IOCTL_CONTINUE(r0, 0x54a2) r2 = openat$ipvs(0xffffffffffffff9c, &(0x7f0000000380)='/proc/sys/net/ipv4/vs/sync_ports\x00', 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(0xffffffffffffff9c, &(0x7f0000000140)={0x0, 0x18, 0xfa00, {0x3, &(0x7f0000000100)={0xffffffffffffffff}, 0x2}}, 0x20) write$RDMA_USER_CM_CMD_MIGRATE_ID(r2, &(0x7f0000000180)={0x12, 0x10, 0xfa00, {&(0x7f00000000c0), r3, r0}}, 0x18) ioctl$SNDRV_TIMER_IOCTL_GPARAMS(r0, 0x40485404, &(0x7f0000000240)={{}, 0x0, 0x2000000000000000}) 13:17:47 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r0, &(0x7f0000942000)={0x2, 0x4e20, @multicast1}, 0x10) sendmsg$key(0xffffffffffffffff, &(0x7f0000f56000)={0x0, 0x0, &(0x7f00008feff0)={&(0x7f0000000500)=ANY=[@ANYBLOB="020300090a1500000000000000000000030006190000000002000000e0000001003f00000000000002000100e625aa66dcef85847e479eb3c49000000400000000fd003e"], 0x44}}, 0x0) add_key(&(0x7f0000000080)='logon\x00', &(0x7f0000000100)={0x73, 0x79, 0x7a, 0x1}, &(0x7f0000001240), 0x0, 0xfffffffffffffff8) get_mempolicy(&(0x7f0000000000), &(0x7f00000001c0), 0x1ff, &(0x7f0000fff000/0x1000)=nil, 0x3) setsockopt$sock_int(r0, 0x1, 0x3c, &(0x7f0000d4effc)=0x1, 0x4) connect$inet(r0, &(0x7f0000000000)={0x2, 0x4e20, @dev={0xac, 0x14, 0x14, 0x18}}, 0x10) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f00000001c0)='tunl0\x00', 0x5) sendto$inet(r0, &(0x7f00006d1fd4)="db", 0x1, 0x4000010, &(0x7f00004daff0)={0x2, 0x0, @loopback, [0x0, 0x0, 0x0, 0x14280000000000]}, 0x10) 13:17:47 executing program 3: r0 = openat$cuse(0xffffffffffffff9c, &(0x7f0000000080)='/dev/cuse\x00', 0x2, 0x0) clone(0x1002102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000640), 0xffffffffffffffff) r1 = getpid() sched_setscheduler(r1, 0x5, &(0x7f0000000000)) write$FUSE_NOTIFY_DELETE(r0, &(0x7f0000000040)={0x29, 0x4, 0x0, {0x200000000000000}}, 0x29) 13:17:47 executing program 5: r0 = syz_open_dev$binder(&(0x7f00000021c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000002340)={0x34, 0x0, &(0x7f0000002240)=[@request_death={0x400c630e, 0x4, 0x4}, @increfs={0x40046304, 0x4}, @increfs_done={0x40106308, 0x0, 0x3}, @increfs], 0x77, 0x0, &(0x7f00000022c0)="b3cd0976d8e2af743c6f523efe14fd20c3c3dd2572734282a761e1b4304e2599c85f198cc82bd5d0c7264edca2f9ea7b875ff7047ec0784fbb354e15fd3f7d837f533597d5082692a6f2fb748da3cc4157188f7f2a5477ded56f72f5b75c96872db429e44b8fcd781d96dead77a0b58b7af9085a208a22"}) [ 1569.210990] binder: 19467:19471 BC_REQUEST_DEATH_NOTIFICATION invalid ref 4 13:17:47 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r0, &(0x7f0000942000)={0x2, 0x4e20, @multicast1}, 0x10) sendmsg$key(0xffffffffffffffff, &(0x7f0000f56000)={0x0, 0x0, &(0x7f00008feff0)={&(0x7f0000000500)=ANY=[@ANYBLOB="020300090a1500000000000000000000030006190000000002000000e0000001003f00000000000002000100e625aa66dcef85847e479eb3c49000000400000000fd003e"], 0x44}}, 0x0) add_key(&(0x7f0000000080)='logon\x00', &(0x7f0000000100)={0x73, 0x79, 0x7a, 0x1}, &(0x7f0000001240), 0x0, 0xfffffffffffffff8) get_mempolicy(&(0x7f0000000000), &(0x7f00000001c0), 0x1ff, &(0x7f0000fff000/0x1000)=nil, 0x3) setsockopt$sock_int(r0, 0x1, 0x3c, &(0x7f0000d4effc)=0x1, 0x4) connect$inet(r0, &(0x7f0000000000)={0x2, 0x4e20, @dev={0xac, 0x14, 0x14, 0x18}}, 0x10) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f00000001c0)='tunl0\x00', 0x5) sendto$inet(r0, &(0x7f00006d1fd4)="db", 0x1, 0x4000010, &(0x7f00004daff0)={0x2, 0x0, @loopback, [0x0, 0x0, 0x0, 0xe8030000]}, 0x10) 13:17:47 executing program 7: r0 = openat$cuse(0xffffffffffffff9c, &(0x7f0000000080)='/dev/cuse\x00', 0x2, 0x0) clone(0x1002102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000640), 0xffffffffffffffff) r1 = getpid() sched_setscheduler(r1, 0x5, &(0x7f0000000000)) write$FUSE_NOTIFY_DELETE(r0, &(0x7f0000000040)={0x29, 0x6, 0x0, {0x0, 0x2}}, 0x29) 13:17:47 executing program 5: r0 = syz_open_dev$binder(&(0x7f00000021c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000002340)={0x34, 0x0, &(0x7f0000002240)=[@request_death={0x400c630e, 0x4, 0x4}, @increfs={0x40046304, 0x4}, @increfs_done={0x40106308, 0x0, 0x3}, @increfs], 0x77, 0x0, &(0x7f00000022c0)="b3cd0976d8e2af743c6f523efe14fd20c3c3dd2572734282a761e1b4304e2599c85f198cc82bd5d0c7144edca2f9ea7b875ff7047ec0784fbb354e15fd3f7d837f533597d5082692a6f2fb748da3cc4157188f7f2a5477ded56f72f5b75c96872db429e44b8fcd781d96dead77a0b58b7af9085a208a22"}) 13:17:47 executing program 7: r0 = openat$cuse(0xffffffffffffff9c, &(0x7f0000000080)='/dev/cuse\x00', 0x2, 0x0) clone(0x1002102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000640), 0xffffffffffffffff) r1 = getpid() sched_setscheduler(r1, 0x5, &(0x7f0000000000)) write$FUSE_NOTIFY_DELETE(r0, &(0x7f0000000040)={0x29, 0x6, 0x0, {0x0, 0x8002a0ffffffff}}, 0x29) [ 1569.364457] binder: 19484:19489 BC_REQUEST_DEATH_NOTIFICATION invalid ref 4 13:17:47 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r0, &(0x7f0000942000)={0x2, 0x4e20, @multicast1}, 0x10) sendmsg$key(0xffffffffffffffff, &(0x7f0000f56000)={0x0, 0x0, &(0x7f00008feff0)={&(0x7f0000000500)=ANY=[@ANYBLOB="020300090a1500000000000000000000030006190000000002000000e0000001003f00000000000002000100e625aa66dcef85847e479eb3c49000000400000000fd003e"], 0x44}}, 0x0) add_key(&(0x7f0000000080)='logon\x00', &(0x7f0000000100)={0x73, 0x79, 0x7a, 0x1}, &(0x7f0000001240), 0x0, 0xfffffffffffffff8) get_mempolicy(&(0x7f0000000000), &(0x7f00000001c0), 0x1ff, &(0x7f0000fff000/0x1000)=nil, 0x3) setsockopt$sock_int(r0, 0x1, 0x3c, &(0x7f0000d4effc)=0x1, 0x4) connect$inet(r0, &(0x7f0000000000)={0x2, 0x4e20, @dev={0xac, 0x14, 0x14, 0x18}}, 0x10) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f00000001c0)='tunl0\x00', 0x5) sendto$inet(r0, &(0x7f00006d1fd4)="db", 0x1, 0x4000010, &(0x7f00004daff0)={0x2, 0x0, @loopback, [0x0, 0x0, 0x0, 0xfeffffff]}, 0x10) 13:17:47 executing program 3: r0 = openat$cuse(0xffffffffffffff9c, &(0x7f0000000080)='/dev/cuse\x00', 0x2, 0x0) clone(0x1002102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000640), 0xffffffffffffffff) r1 = getpid() sched_setscheduler(r1, 0x5, &(0x7f0000000000)) write$FUSE_NOTIFY_DELETE(r0, &(0x7f0000000040)={0x29, 0x4, 0x0, {0x7000000}}, 0x29) [ 1569.531138] binder: 19512:19519 BC_REQUEST_DEATH_NOTIFICATION invalid ref 4 13:17:47 executing program 0: perf_event_open(&(0x7f0000000040)={0x2, 0x70, 0x3e5}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f00000021c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000002340)={0xb5, 0x400000000000000, &(0x7f00000000c0)=ANY=[@ANYBLOB="0463044000000000b6a571ac965f26c50d500dae115e59afcd8a338d8b2727193c56d4ebef60c214b766ffde6cff6ceef2baa2594a53a0117e77afd5d58e8a35afdae81b258585ce769507333c0238790d5ed750bf1d6ca2a873050056528fce7becfd12f165ac43a826d3462822ff8f29ea992d4e208847cf4fc10ca00b87b5ce2523fa477bad0be1c97e4398aa2ac81d973b5a871d8e0b295e436cd8415f19088c6c82c85f4ed1fac41da062bc6dbfb8eac4276c"], 0x0, 0x0, &(0x7f00000022c0)}) 13:17:47 executing program 1: r0 = socket$netlink(0x10, 0x3, 0x8000000004) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_TCP_CONGESTION(r1, 0x6, 0xd, &(0x7f0000000180)='vegas\x00', 0x6) bind$inet6(r1, &(0x7f00001fefe4)={0xa, 0x4e22}, 0x1c) sendto$inet6(r1, &(0x7f0000000100), 0x8d2d601e8976aa5, 0x20000004, &(0x7f000031e000)={0xa, 0x4e22}, 0x1c) writev(r0, &(0x7f0000000100)=[{&(0x7f0000000000)="580000001400192340834b80040d8c560a067f6a63ff81004e220000000058000b4824ca944f64009400050028925aa8000000000000008000f0fffeffff09000000fff5dd00000010000100000c0900fcff0000040e05a5", 0x58}], 0x1) 13:17:47 executing program 6: clone(0x802102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000040), 0xffffffffffffffff) r0 = syz_open_dev$sndtimer(&(0x7f0000000000)='/dev/snd/timer\x00', 0x0, 0x0) r1 = getpid() r2 = openat$snapshot(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/snapshot\x00', 0x0, 0x0) r3 = syz_open_dev$sndpcmc(&(0x7f0000000100)='/dev/snd/pcmC#D#c\x00', 0x1, 0x0) ioctl$VHOST_SET_LOG_FD(r2, 0x4004af07, &(0x7f0000000140)=r3) sched_setscheduler(r1, 0x6, &(0x7f0000000080)=0xdabe) ioctl$SNDRV_TIMER_IOCTL_GPARAMS(r0, 0x40485404, &(0x7f0000000240)={{}, 0x0, 0x2000000000000000}) 13:17:47 executing program 7: r0 = openat$cuse(0xffffffffffffff9c, &(0x7f0000000080)='/dev/cuse\x00', 0x2, 0x0) clone(0x1002102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000640), 0xffffffffffffffff) r1 = getpid() sched_setscheduler(r1, 0x5, &(0x7f0000000000)) write$FUSE_NOTIFY_DELETE(r0, &(0x7f0000000040)={0x29, 0x6, 0x0, {0x0, 0xb00000000000000}}, 0x29) 13:17:47 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r0, &(0x7f0000942000)={0x2, 0x4e20, @multicast1}, 0x10) sendmsg$key(0xffffffffffffffff, &(0x7f0000f56000)={0x0, 0x0, &(0x7f00008feff0)={&(0x7f0000000500)=ANY=[@ANYBLOB="020300090a1500000000000000000000030006190000000002000000e0000001003f00000000000002000100e625aa66dcef85847e479eb3c49000000400000000fd003e"], 0x44}}, 0x0) add_key(&(0x7f0000000080)='logon\x00', &(0x7f0000000100)={0x73, 0x79, 0x7a, 0x1}, &(0x7f0000001240), 0x0, 0xfffffffffffffff8) get_mempolicy(&(0x7f0000000000), &(0x7f00000001c0), 0x1ff, &(0x7f0000fff000/0x1000)=nil, 0x3) setsockopt$sock_int(r0, 0x1, 0x3c, &(0x7f0000d4effc)=0x1, 0x4) connect$inet(r0, &(0x7f0000000000)={0x2, 0x4e20, @dev={0xac, 0x14, 0x14, 0x18}}, 0x10) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f00000001c0)='tunl0\x00', 0x5) sendto$inet(r0, &(0x7f00006d1fd4)="db", 0x1, 0x4000010, &(0x7f00004daff0)={0x2, 0x0, @loopback, [0x0, 0x0, 0x0, 0xe00]}, 0x10) 13:17:47 executing program 5: r0 = syz_open_dev$binder(&(0x7f00000021c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000002340)={0x34, 0x0, &(0x7f0000002240)=[@request_death={0x400c630e, 0x4, 0x4}, @increfs={0x40046304, 0x4}, @increfs_done={0x40106308, 0x0, 0x3}, @increfs], 0x77, 0x0, &(0x7f00000022c0)="b3cd0976d8e2af743c6f523efe14fd20c3c3dd2572734282a761e1b4304e2599c85f198cc82bd5d0c7354edca2f9ea7b875ff7047ec0784fbb354e15fd3f7d837f533597d5082692a6f2fb748da3cc4157188f7f2a5477ded56f72f5b75c96872db429e44b8fcd781d96dead77a0b58b7af9085a208a22"}) 13:17:47 executing program 3: r0 = openat$cuse(0xffffffffffffff9c, &(0x7f0000000080)='/dev/cuse\x00', 0x2, 0x0) clone(0x1002102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000640), 0xffffffffffffffff) r1 = getpid() sched_setscheduler(r1, 0x5, &(0x7f0000000000)) write$FUSE_NOTIFY_DELETE(r0, &(0x7f0000000040)={0x29, 0x4, 0x0, {0x8000000}}, 0x29) 13:17:47 executing program 4: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = gettid() perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x3e5}, 0x0, 0x0, 0xffffffffffffffff, 0x0) fcntl$setown(r0, 0x8, r1) bind$inet6(r0, &(0x7f0000807fe4)={0xa, 0x4e22}, 0x1c) sendto$inet6(r0, &(0x7f0000000380), 0x0, 0x200408d4, &(0x7f000072e000)={0xa, 0x4e22, 0x0, @loopback}, 0x1c) sendto$inet6(r0, &(0x7f0000ad6fad)='\x00', 0x1, 0x3fffffd, &(0x7f0000254000)={0xa, 0x0, 0xa, @loopback}, 0x1c) 13:17:47 executing program 0: perf_event_open(&(0x7f0000000040)={0x2, 0x70, 0x3e5}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f00000021c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000002340)={0xb5, 0x20000000, &(0x7f00000000c0)=ANY=[@ANYBLOB="0463044000000000b6a571ac965f26c50d500dae115e59afcd8a338d8b2727193c56d4ebef60c214b766ffde6cff6ceef2baa2594a53a0117e77afd5d58e8a35afdae81b258585ce769507333c0238790d5ed750bf1d6ca2a873050056528fce7becfd12f165ac43a826d3462822ff8f29ea992d4e208847cf4fc10ca00b87b5ce2523fa477bad0be1c97e4398aa2ac81d973b5a871d8e0b295e436cd8415f19088c6c82c85f4ed1fac41da062bc6dbfb8eac4276c"], 0x0, 0x0, &(0x7f00000022c0)}) 13:17:48 executing program 3: r0 = openat$cuse(0xffffffffffffff9c, &(0x7f0000000080)='/dev/cuse\x00', 0x2, 0x0) clone(0x1002102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000640), 0xffffffffffffffff) r1 = getpid() sched_setscheduler(r1, 0x5, &(0x7f0000000000)) write$FUSE_NOTIFY_DELETE(r0, &(0x7f0000000040)={0x29, 0x4, 0x0, {0x900}}, 0x29) 13:17:48 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r0, &(0x7f0000942000)={0x2, 0x4e20, @multicast1}, 0x10) sendmsg$key(0xffffffffffffffff, &(0x7f0000f56000)={0x0, 0x0, &(0x7f00008feff0)={&(0x7f0000000500)=ANY=[@ANYBLOB="020300090a1500000000000000000000030006190000000002000000e0000001003f00000000000002000100e625aa66dcef85847e479eb3c49000000400000000fd003e"], 0x44}}, 0x0) add_key(&(0x7f0000000080)='logon\x00', &(0x7f0000000100)={0x73, 0x79, 0x7a, 0x1}, &(0x7f0000001240), 0x0, 0xfffffffffffffff8) get_mempolicy(&(0x7f0000000000), &(0x7f00000001c0), 0x1ff, &(0x7f0000fff000/0x1000)=nil, 0x3) setsockopt$sock_int(r0, 0x1, 0x3c, &(0x7f0000d4effc)=0x1, 0x4) connect$inet(r0, &(0x7f0000000000)={0x2, 0x4e20, @dev={0xac, 0x14, 0x14, 0x18}}, 0x10) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f00000001c0)='tunl0\x00', 0x5) sendto$inet(r0, &(0x7f00006d1fd4)="db", 0x1, 0x4000010, &(0x7f00004daff0)={0x2, 0x0, @loopback, [0x0, 0x0, 0x0, 0xfffffff2]}, 0x10) 13:17:48 executing program 6: clone(0x40000, 0x0, 0xfffffffffffffffe, &(0x7f0000000140), 0xffffffffffffffff) r0 = syz_open_dev$sndtimer(&(0x7f0000000000)='/dev/snd/timer\x00', 0x0, 0x0) r1 = getpid() sched_setscheduler(r1, 0x5, &(0x7f0000000200)) ioctl$SNDRV_TIMER_IOCTL_GPARAMS(r0, 0x40485404, &(0x7f0000000240)={{}, 0x0, 0x2000000000000000}) [ 1569.945743] binder: 19538:19554 BC_REQUEST_DEATH_NOTIFICATION invalid ref 4 13:17:48 executing program 5: r0 = syz_open_dev$binder(&(0x7f00000021c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000002340)={0x34, 0x0, &(0x7f0000002240)=[@request_death={0x400c630e, 0x4, 0x4}, @increfs={0x40046304, 0x4}, @increfs_done={0x40106308, 0x0, 0x3}, @increfs], 0x77, 0x0, &(0x7f00000022c0)="b3cd0976d8e2af743c6f523efe14fd20c3c3dd2572734282a761e1b4304e2599c85f198cc82bd5d0c71c4edca2f9ea7b875ff7047ec0784fbb354e15fd3f7d837f533597d5082692a6f2fb748da3cc4157188f7f2a5477ded56f72f5b75c96872db429e44b8fcd781d96dead77a0b58b7af9085a208a22"}) 13:17:48 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r0, &(0x7f0000942000)={0x2, 0x4e20, @multicast1}, 0x10) sendmsg$key(0xffffffffffffffff, &(0x7f0000f56000)={0x0, 0x0, &(0x7f00008feff0)={&(0x7f0000000500)=ANY=[@ANYBLOB="020300090a1500000000000000000000030006190000000002000000e0000001003f00000000000002000100e625aa66dcef85847e479eb3c49000000400000000fd003e"], 0x44}}, 0x0) add_key(&(0x7f0000000080)='logon\x00', &(0x7f0000000100)={0x73, 0x79, 0x7a, 0x1}, &(0x7f0000001240), 0x0, 0xfffffffffffffff8) get_mempolicy(&(0x7f0000000000), &(0x7f00000001c0), 0x1ff, &(0x7f0000fff000/0x1000)=nil, 0x3) setsockopt$sock_int(r0, 0x1, 0x3c, &(0x7f0000d4effc)=0x1, 0x4) connect$inet(r0, &(0x7f0000000000)={0x2, 0x4e20, @dev={0xac, 0x14, 0x14, 0x18}}, 0x10) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f00000001c0)='tunl0\x00', 0x5) sendto$inet(r0, &(0x7f00006d1fd4)="db", 0x1, 0x4000010, &(0x7f00004daff0)={0x2, 0x0, @loopback, [0x0, 0x0, 0x0, 0xa]}, 0x10) 13:17:48 executing program 7: r0 = openat$cuse(0xffffffffffffff9c, &(0x7f0000000080)='/dev/cuse\x00', 0x2, 0x0) clone(0x1002102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000640), 0xffffffffffffffff) r1 = getpid() sched_setscheduler(r1, 0x5, &(0x7f0000000000)) write$FUSE_NOTIFY_DELETE(r0, &(0x7f0000000040)={0x29, 0x6, 0x0, {0x0, 0x8000a0}}, 0x29) [ 1570.137283] binder: 19575:19576 BC_REQUEST_DEATH_NOTIFICATION invalid ref 4 13:17:48 executing program 5: r0 = syz_open_dev$binder(&(0x7f00000021c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000002340)={0x34, 0x0, &(0x7f0000002240)=[@request_death={0x400c630e, 0x4, 0x4}, @increfs={0x40046304, 0x4}, @increfs_done={0x40106308, 0x0, 0x3}, @increfs], 0x77, 0x0, &(0x7f00000022c0)="b3cd0976d8e2af743c6f523efe14fd20c3c3dd2572734282a761e1b4304e2599c85f198cc82bd5d0c71a4edca2f9ea7b875ff7047ec0784fbb354e15fd3f7d837f533597d5082692a6f2fb748da3cc4157188f7f2a5477ded56f72f5b75c96872db429e44b8fcd781d96dead77a0b58b7af9085a208a22"}) 13:17:48 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r0, &(0x7f0000942000)={0x2, 0x4e20, @multicast1}, 0x10) sendmsg$key(0xffffffffffffffff, &(0x7f0000f56000)={0x0, 0x0, &(0x7f00008feff0)={&(0x7f0000000500)=ANY=[@ANYBLOB="020300090a1500000000000000000000030006190000000002000000e0000001003f00000000000002000100e625aa66dcef85847e479eb3c49000000400000000fd003e"], 0x44}}, 0x0) add_key(&(0x7f0000000080)='logon\x00', &(0x7f0000000100)={0x73, 0x79, 0x7a, 0x1}, &(0x7f0000001240), 0x0, 0xfffffffffffffff8) get_mempolicy(&(0x7f0000000000), &(0x7f00000001c0), 0x1ff, &(0x7f0000fff000/0x1000)=nil, 0x3) setsockopt$sock_int(r0, 0x1, 0x3c, &(0x7f0000d4effc)=0x1, 0x4) connect$inet(r0, &(0x7f0000000000)={0x2, 0x4e20, @dev={0xac, 0x14, 0x14, 0x18}}, 0x10) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f00000001c0)='tunl0\x00', 0x5) sendto$inet(r0, &(0x7f00006d1fd4)="db", 0x1, 0x4000010, &(0x7f00004daff0)={0x2, 0x0, @loopback, [0x0, 0x0, 0x0, 0x8000a0ffffffff]}, 0x10) [ 1570.283345] binder: 19596:19598 BC_REQUEST_DEATH_NOTIFICATION invalid ref 4 13:17:48 executing program 7: r0 = openat$cuse(0xffffffffffffff9c, &(0x7f0000000080)='/dev/cuse\x00', 0x2, 0x0) clone(0x1002102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000640), 0xffffffffffffffff) r1 = getpid() sched_setscheduler(r1, 0x5, &(0x7f0000000000)) write$FUSE_NOTIFY_DELETE(r0, &(0x7f0000000040)={0x29, 0x6, 0x0, {0x0, 0x5}}, 0x29) 13:17:48 executing program 5: r0 = syz_open_dev$binder(&(0x7f00000021c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000002340)={0x34, 0x0, &(0x7f0000002240)=[@request_death={0x400c630e, 0x4, 0x4}, @increfs={0x40046304, 0x4}, @increfs_done={0x40106308, 0x0, 0x3}, @increfs], 0x77, 0x0, &(0x7f00000022c0)="b3cd0976d8e2af743c6f523efe14fd20c3c3dd2572734282a761e1b4304e2599c85f198cc82bd5d0c72c4edca2f9ea7b875ff7047ec0784fbb354e15fd3f7d837f533597d5082692a6f2fb748da3cc4157188f7f2a5477ded56f72f5b75c96872db429e44b8fcd781d96dead77a0b58b7af9085a208a22"}) 13:17:48 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r0, &(0x7f0000942000)={0x2, 0x4e20, @multicast1}, 0x10) sendmsg$key(0xffffffffffffffff, &(0x7f0000f56000)={0x0, 0x0, &(0x7f00008feff0)={&(0x7f0000000500)=ANY=[@ANYBLOB="020300090a1500000000000000000000030006190000000002000000e0000001003f00000000000002000100e625aa66dcef85847e479eb3c49000000400000000fd003e"], 0x44}}, 0x0) add_key(&(0x7f0000000080)='logon\x00', &(0x7f0000000100)={0x73, 0x79, 0x7a, 0x1}, &(0x7f0000001240), 0x0, 0xfffffffffffffff8) get_mempolicy(&(0x7f0000000000), &(0x7f00000001c0), 0x1ff, &(0x7f0000fff000/0x1000)=nil, 0x3) setsockopt$sock_int(r0, 0x1, 0x3c, &(0x7f0000d4effc)=0x1, 0x4) connect$inet(r0, &(0x7f0000000000)={0x2, 0x4e20, @dev={0xac, 0x14, 0x14, 0x18}}, 0x10) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f00000001c0)='tunl0\x00', 0x5) sendto$inet(r0, &(0x7f00006d1fd4)="db", 0x1, 0x4000010, &(0x7f00004daff0)={0x2, 0x0, @loopback, [0x0, 0x0, 0x0, 0x3]}, 0x10) 13:17:48 executing program 1: r0 = socket$netlink(0x10, 0x3, 0x8000000004) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_TCP_CONGESTION(r1, 0x6, 0xd, &(0x7f0000000180)='vegas\x00', 0x6) bind$inet6(r1, &(0x7f00001fefe4)={0xa, 0x4e22}, 0x1c) sendto$inet6(r1, &(0x7f0000000100), 0x8d2d601e8976aa5, 0x20000004, &(0x7f000031e000)={0xa, 0x4e22}, 0x1c) writev(r0, &(0x7f0000000100)=[{&(0x7f0000000000)="580000001400192340834b80040d8c560a067f6bbdff81004e220000000058000b4824ca944f64009400050028925aa8000000000000008000f0fffeffff09000000fff5dd00000010000100000c0900fcff0000040e05a5", 0x58}], 0x1) 13:17:48 executing program 4: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = gettid() perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x3e5}, 0x0, 0x0, 0xffffffffffffffff, 0x0) fcntl$setown(r0, 0x8, r1) bind$inet6(r0, &(0x7f0000807fe4)={0xa, 0x4e22}, 0x1c) sendto$inet6(r0, &(0x7f0000000380), 0x0, 0x200408d4, &(0x7f000072e000)={0xa, 0x4e22, 0x0, @loopback}, 0x1c) sendto$inet6(r0, &(0x7f0000ad6fad)='\x00', 0x1, 0x3fffffd, &(0x7f0000254000)={0xa, 0x0, 0x240, @loopback}, 0x1c) 13:17:48 executing program 0: perf_event_open(&(0x7f0000000040)={0x2, 0x70, 0x3e5}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f00000021c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000002340)={0xb5, 0x7, &(0x7f00000000c0)=ANY=[@ANYBLOB="0463044000000000b6a571ac965f26c50d500dae115e59afcd8a338d8b2727193c56d4ebef60c214b766ffde6cff6ceef2baa2594a53a0117e77afd5d58e8a35afdae81b258585ce769507333c0238790d5ed750bf1d6ca2a873050056528fce7becfd12f165ac43a826d3462822ff8f29ea992d4e208847cf4fc10ca00b87b5ce2523fa477bad0be1c97e4398aa2ac81d973b5a871d8e0b295e436cd8415f19088c6c82c85f4ed1fac41da062bc6dbfb8eac4276c"], 0x0, 0x0, &(0x7f00000022c0)}) 13:17:48 executing program 3: r0 = openat$cuse(0xffffffffffffff9c, &(0x7f0000000080)='/dev/cuse\x00', 0x2, 0x0) clone(0x1002102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000640), 0xffffffffffffffff) r1 = getpid() sched_setscheduler(r1, 0x5, &(0x7f0000000000)) write$FUSE_NOTIFY_DELETE(r0, &(0x7f0000000040)={0x29, 0x4, 0x0, {0x700}}, 0x29) 13:17:48 executing program 6: r0 = socket$netlink(0x10, 0x3, 0xf) r1 = syz_genetlink_get_family_id$ipvs(&(0x7f00000000c0)='IPVS\x00') sendmsg$IPVS_CMD_DEL_DEST(r0, &(0x7f00000001c0)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x1}, 0xc, &(0x7f0000000180)={&(0x7f0000000100)={0x50, r1, 0x2, 0x70bd25, 0x25dfdbff, {}, [@IPVS_CMD_ATTR_DEST={0x34, 0x2, [@IPVS_DEST_ATTR_L_THRESH={0x8, 0x6, 0x9}, @IPVS_DEST_ATTR_U_THRESH={0x8, 0x5, 0x8}, @IPVS_DEST_ATTR_ACTIVE_CONNS={0x8, 0x7, 0x1}, @IPVS_DEST_ATTR_L_THRESH={0x8, 0x6, 0x25d}, @IPVS_DEST_ATTR_U_THRESH={0x8, 0x5, 0x80}, @IPVS_DEST_ATTR_INACT_CONNS={0x8, 0x8, 0xffff}]}, @IPVS_CMD_ATTR_TIMEOUT_UDP={0x8, 0x6, 0xfffffffffffff001}]}, 0x50}, 0x1, 0x0, 0x0, 0x20000000}, 0x1) clone(0x802102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000040), 0xffffffffffffffff) r2 = syz_open_dev$sndtimer(&(0x7f0000000000)='/dev/snd/timer\x00', 0x0, 0x0) r3 = getpid() sched_setscheduler(r3, 0x5, &(0x7f0000000200)) ioctl$SNDRV_TIMER_IOCTL_GPARAMS(r2, 0x40485404, &(0x7f0000000240)={{}, 0x0, 0x2000000000000000}) 13:17:48 executing program 7: r0 = openat$cuse(0xffffffffffffff9c, &(0x7f0000000080)='/dev/cuse\x00', 0x2, 0x0) clone(0x1002102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000640), 0xffffffffffffffff) r1 = getpid() sched_setscheduler(r1, 0x5, &(0x7f0000000000)) write$FUSE_NOTIFY_DELETE(r0, &(0x7f0000000040)={0x29, 0x6, 0x0, {0x0, 0xb}}, 0x29) 13:17:48 executing program 3: r0 = openat$cuse(0xffffffffffffff9c, &(0x7f0000000080)='/dev/cuse\x00', 0x2, 0x0) clone(0x1002102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000640), 0xffffffffffffffff) r1 = getpid() sched_setscheduler(r1, 0x5, &(0x7f0000000000)) write$FUSE_NOTIFY_DELETE(r0, &(0x7f0000000040)={0x29, 0x4, 0x0, {0xc}}, 0x29) [ 1570.812717] binder_thread_write: 28 callbacks suppressed [ 1570.812733] binder: 19614:19622 IncRefs 0 refcount change on invalid ref 4 ret -22 [ 1570.830994] binder_thread_write: 9 callbacks suppressed [ 1570.831008] binder: 19614:19622 BC_INCREFS_DONE u0000000000000000 no match [ 1570.843050] binder: 19615:19636 unknown command 1906685440 13:17:48 executing program 3: r0 = openat$cuse(0xffffffffffffff9c, &(0x7f0000000080)='/dev/cuse\x00', 0x2, 0x0) clone(0x1002102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000640), 0xffffffffffffffff) r1 = getpid() sched_setscheduler(r1, 0x5, &(0x7f0000000000)) write$FUSE_NOTIFY_DELETE(r0, &(0x7f0000000040)={0x29, 0x4, 0x0, {0x100000000000000}}, 0x29) 13:17:49 executing program 7: r0 = openat$cuse(0xffffffffffffff9c, &(0x7f0000000080)='/dev/cuse\x00', 0x2, 0x0) clone(0x1002102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000640), 0xffffffffffffffff) r1 = getpid() sched_setscheduler(r1, 0x5, &(0x7f0000000000)) write$FUSE_NOTIFY_DELETE(r0, &(0x7f0000000040)={0x29, 0x6, 0x0, {0x0, 0xa000000}}, 0x29) 13:17:49 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r0, &(0x7f0000942000)={0x2, 0x4e20, @multicast1}, 0x10) sendmsg$key(0xffffffffffffffff, &(0x7f0000f56000)={0x0, 0x0, &(0x7f00008feff0)={&(0x7f0000000500)=ANY=[@ANYBLOB="020300090a1500000000000000000000030006190000000002000000e0000001003f00000000000002000100e625aa66dcef85847e479eb3c49000000400000000fd003e"], 0x44}}, 0x0) add_key(&(0x7f0000000080)='logon\x00', &(0x7f0000000100)={0x73, 0x79, 0x7a, 0x1}, &(0x7f0000001240), 0x0, 0xfffffffffffffff8) get_mempolicy(&(0x7f0000000000), &(0x7f00000001c0), 0x1ff, &(0x7f0000fff000/0x1000)=nil, 0x3) setsockopt$sock_int(r0, 0x1, 0x3c, &(0x7f0000d4effc)=0x1, 0x4) connect$inet(r0, &(0x7f0000000000)={0x2, 0x4e20, @dev={0xac, 0x14, 0x14, 0x18}}, 0x10) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f00000001c0)='tunl0\x00', 0x5) sendto$inet(r0, &(0x7f00006d1fd4)="db", 0x1, 0x4000010, &(0x7f00004daff0)={0x2, 0x0, @loopback, [0x0, 0x0, 0x0, 0x2]}, 0x10) [ 1570.903234] binder: 19614:19622 IncRefs 0 refcount change on invalid ref 0 ret -22 [ 1570.921915] binder: 19615:19636 ioctl c0306201 20002340 returned -22 13:17:49 executing program 5: r0 = syz_open_dev$binder(&(0x7f00000021c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000002340)={0x34, 0x0, &(0x7f0000002240)=[@request_death={0x400c630e, 0x4, 0x4}, @increfs={0x40046304, 0x4}, @increfs_done={0x40106308, 0x0, 0x3}, @increfs], 0x77, 0x0, &(0x7f00000022c0)="b3cd0976d8e2af743c6f523efe14fd20c3c3dd2572734282a761e1b4304e2599c85f198cc82bd5d0c7384edca2f9ea7b875ff7047ec0784fbb354e15fd3f7d837f533597d5082692a6f2fb748da3cc4157188f7f2a5477ded56f72f5b75c96872db429e44b8fcd781d96dead77a0b58b7af9085a208a22"}) 13:17:49 executing program 6: clone(0x400, 0x0, 0xfffffffffffffffe, &(0x7f0000000140), 0xffffffffffffffff) r0 = syz_open_dev$sndtimer(&(0x7f0000000000)='/dev/snd/timer\x00', 0x0, 0x0) r1 = getpid() sched_setscheduler(r1, 0x4, &(0x7f0000000200)) ioctl$SNDRV_TIMER_IOCTL_GPARAMS(r0, 0x40485404, &(0x7f0000000240)={{}, 0x0, 0x2000000000000000}) 13:17:49 executing program 7: r0 = openat$cuse(0xffffffffffffff9c, &(0x7f0000000080)='/dev/cuse\x00', 0x2, 0x0) clone(0x1002102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000640), 0xffffffffffffffff) r1 = getpid() sched_setscheduler(r1, 0x5, &(0x7f0000000000)) write$FUSE_NOTIFY_DELETE(r0, &(0x7f0000000040)={0x29, 0x6, 0x0, {0x0, 0x1a0}}, 0x29) 13:17:49 executing program 3: r0 = openat$cuse(0xffffffffffffff9c, &(0x7f0000000080)='/dev/cuse\x00', 0x2, 0x0) clone(0x1002102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000640), 0xffffffffffffffff) r1 = getpid() sched_setscheduler(r1, 0x5, &(0x7f0000000000)) write$FUSE_NOTIFY_DELETE(r0, &(0x7f0000000040)={0x29, 0x4, 0x0, {0x1000000}}, 0x29) 13:17:49 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r0, &(0x7f0000942000)={0x2, 0x4e20, @multicast1}, 0x10) sendmsg$key(0xffffffffffffffff, &(0x7f0000f56000)={0x0, 0x0, &(0x7f00008feff0)={&(0x7f0000000500)=ANY=[@ANYBLOB="020300090a1500000000000000000000030006190000000002000000e0000001003f00000000000002000100e625aa66dcef85847e479eb3c49000000400000000fd003e"], 0x44}}, 0x0) add_key(&(0x7f0000000080)='logon\x00', &(0x7f0000000100)={0x73, 0x79, 0x7a, 0x1}, &(0x7f0000001240), 0x0, 0xfffffffffffffff8) get_mempolicy(&(0x7f0000000000), &(0x7f00000001c0), 0x1ff, &(0x7f0000fff000/0x1000)=nil, 0x3) setsockopt$sock_int(r0, 0x1, 0x3c, &(0x7f0000d4effc)=0x1, 0x4) connect$inet(r0, &(0x7f0000000000)={0x2, 0x4e20, @dev={0xac, 0x14, 0x14, 0x18}}, 0x10) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f00000001c0)='tunl0\x00', 0x5) sendto$inet(r0, &(0x7f00006d1fd4)="db", 0x1, 0x4000010, &(0x7f00004daff0)={0x2, 0x0, @loopback, [0x0, 0x0, 0x0, 0x8055]}, 0x10) 13:17:49 executing program 3: r0 = openat$cuse(0xffffffffffffff9c, &(0x7f0000000080)='/dev/cuse\x00', 0x2, 0x0) clone(0x1002102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000640), 0xffffffffffffffff) r1 = getpid() sched_setscheduler(r1, 0x5, &(0x7f0000000000)) write$FUSE_NOTIFY_DELETE(r0, &(0x7f0000000040)={0x29, 0x4, 0x0, {0x300}}, 0x29) 13:17:49 executing program 6: clone(0x802102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000040), 0xffffffffffffffff) r0 = syz_open_dev$sndtimer(&(0x7f0000000000)='/dev/snd/timer\x00', 0x0, 0x0) ioctl$TIOCGPGRP(0xffffffffffffff9c, 0x540f, &(0x7f0000000080)=0x0) sched_rr_get_interval(r1, &(0x7f00000000c0)) r2 = getpid() r3 = dup3(r0, r0, 0x80000) write$tun(r3, &(0x7f00000001c0)={@val={0x0, 0xc337}, @void, @eth={@link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x1}, @broadcast, [], {@mpls_uc={0x8847, {[{0x7ff, 0x5}, {0x6, 0x0, 0x9, 0x100}], @llc={@snap={0x0, 0x1, "1e0e", "19120d", 0xaafd, "391a120a92dcf8d4947024dc3426c1c97fd6e8ee9e16d6fd053c"}}}}}}}, 0x3d) write$RDMA_USER_CM_CMD_CREATE_ID(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x18, 0xfa00, {0x2, &(0x7f0000000100)={0xffffffffffffffff}, 0x106, 0xa}}, 0x20) write$RDMA_USER_CM_CMD_QUERY_ROUTE(r3, &(0x7f0000000180)={0x5, 0x10, 0xfa00, {&(0x7f00000002c0), r4, 0x3}}, 0x18) sched_setscheduler(r2, 0x5, &(0x7f0000000200)) ioctl$SNDRV_TIMER_IOCTL_GPARAMS(r0, 0x40485404, &(0x7f0000000240)={{}, 0x0, 0x2000000000000000}) [ 1571.182443] binder: 19675:19688 IncRefs 0 refcount change on invalid ref 4 ret -22 [ 1571.207565] binder: 19675:19688 BC_INCREFS_DONE u0000000000000000 no match [ 1571.270069] binder: 19675:19688 IncRefs 0 refcount change on invalid ref 0 ret -22 13:17:49 executing program 1: r0 = socket$netlink(0x10, 0x3, 0x8000000004) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_TCP_CONGESTION(r1, 0x6, 0xd, &(0x7f0000000180)='vegas\x00', 0x6) bind$inet6(r1, &(0x7f00001fefe4)={0xa, 0x4e22}, 0x1c) sendto$inet6(r1, &(0x7f0000000100), 0x8d2d601e8976aa5, 0x20000004, &(0x7f000031e000)={0xa, 0x4e22}, 0x1c) writev(r0, &(0x7f0000000100)=[{&(0x7f0000000000)="580000001400192340834b80040d8c560a067f04e3ff81004e220000000058000b4824ca944f64009400050028925aa8000000000000008000f0fffeffff09000000fff5dd00000010000100000c0900fcff0000040e05a5", 0x58}], 0x1) 13:17:49 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r0, &(0x7f0000942000)={0x2, 0x4e20, @multicast1}, 0x10) sendmsg$key(0xffffffffffffffff, &(0x7f0000f56000)={0x0, 0x0, &(0x7f00008feff0)={&(0x7f0000000500)=ANY=[@ANYBLOB="020300090a1500000000000000000000030006190000000002000000e0000001003f00000000000002000100e625aa66dcef85847e479eb3c49000000400000000fd003e"], 0x44}}, 0x0) add_key(&(0x7f0000000080)='logon\x00', &(0x7f0000000100)={0x73, 0x79, 0x7a, 0x1}, &(0x7f0000001240), 0x0, 0xfffffffffffffff8) get_mempolicy(&(0x7f0000000000), &(0x7f00000001c0), 0x1ff, &(0x7f0000fff000/0x1000)=nil, 0x3) setsockopt$sock_int(r0, 0x1, 0x3c, &(0x7f0000d4effc)=0x1, 0x4) connect$inet(r0, &(0x7f0000000000)={0x2, 0x4e20, @dev={0xac, 0x14, 0x14, 0x18}}, 0x10) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f00000001c0)='tunl0\x00', 0x5) sendto$inet(r0, &(0x7f00006d1fd4)="db", 0x1, 0x4000010, &(0x7f00004daff0)={0x2, 0x0, @loopback, [0x0, 0x0, 0x0, 0x49]}, 0x10) 13:17:49 executing program 6: clone(0x802102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000040), 0xffffffffffffffff) r0 = syz_open_dev$sndtimer(&(0x7f0000000000)='/dev/snd/timer\x00', 0x0, 0x0) r1 = getpid() sched_setscheduler(r1, 0x5, &(0x7f0000000200)) ioctl$SNDRV_TIMER_IOCTL_GPARAMS(r0, 0x40485404, &(0x7f0000000240)={{}, 0x0, 0x2000000000000000}) r2 = socket$inet6(0xa, 0x1, 0x0) getsockopt$inet_sctp6_SCTP_RECVNXTINFO(r2, 0x84, 0x21, &(0x7f0000001a80), &(0x7f0000001ac0)=0x4) r3 = bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000000c0)={&(0x7f0000000080)='eth0\x00', 0xffffffffffffff9c}, 0x10) r4 = dup3(r0, r0, 0x80000) r5 = openat$qat_adf_ctl(0xffffffffffffff9c, &(0x7f0000000100)='/dev/qat_adf_ctl\x00', 0x180, 0x0) ioctl$sock_bt_hidp_HIDPCONNADD(r3, 0x400448c8, &(0x7f00000003c0)={r4, r5, 0x7fff, 0x9, &(0x7f00000002c0)="cc390826f9ded5d460a22d16e59b403f5a8381046b38d365cc0d0b1332f668e2e5edcb9c8de4a9bbaff6738395e1a45928788e31bcabce4e15d325e3bef7296ed506f6a64149d3e2438f56c62efc3bc7e141bbc3fcc4146ff1a44358aee66e9c933ce15a28e9f20e8a4712f41b58c7c34eed875648599c353f8f5b3c4ac6dcbfb28682336292203ace74e67d585a7f875073c13d786f1d2c9df8cab360704e14e9d873391e3db0bf4c405eba23aeb8cc67da2f22e0132b9c0a524bc3045592cfa38c1670c4244a605e3dbc", 0x129f560c, 0x1000, 0x3ff, 0x3, 0x100, 0x4, 0x42d, "b697752661dc43e353759496f000209281e0844d4f09acdeeb6cea1151ef44e8c0e4081e63fc68b1e6cf4ad698e68b54c85dbede443e603155c0eb8b00ef5e26c649637b9b995e8aeac92f7a207fe8606dd90a4d7fd2261c4fde019c6736a87386ff273c4a4efd96dc94c6b176e2b3a15ca33f231b98c28ac496ec50cfb079918d9aed6c675124f9079cf309129cbbd84ed9abfd5424e2827d423978860ca072679fc65c9296184a3307d782f0ed05e288621ff547fb32469a04eff08f17c28708a0e80334698a4ef537beb4067d8e82c70d004a04186a4351de2bf139c47e19f2f1f94b39810a16a84da5dd26a09d3916138daf45e9601be2282bdb9d5999d97bcf5b1a424eeb0f5a1a3ffc769c60aa1f928f4abad100201879375e16c6e90f3098b682528b5d6a9d73fb75e26467cc076eb70ce689294e1849eee25094308d1ffede77f49492f710953ab4a823569c5785e4cbad9ec3baff9a90aa693435714d6cb349ad14899de81b180ac361147d47e7a255522fe93dd6361847b6e11b870628b04b364d8f2b6daa84b8ed5d95224c3c9061f0fd32c8533015823bce488a2764add0e0131c0cf053492f1ec8557355ab2f1c23c193531214489346edb11a527906634df5e2a1e22d41d14bb701b49592e8fbf74fc251114425460a4fd72bb8079d5c874ede46030465ad249b579e54c066dfc992dc8a9ef8c0671b9e0fbb66b30b5862a659af30cb009f15bb974998c80fbad565fca3dbc2f56e1e57af8b462ae5db0ebf2793efbb054dcedbeb336f8fd672d8ec930c28e937cdf34df990556765fe68f9887ee7d5d97591b7f5ecdaa74ce5e09e5f85b5f2d2bc0248af0d33cdab45a8f1821730943180ab8ac7b751d2ba02525af3750ad32d6af9074ad46150050551bbe1d00d200db02e4136e4e5c507f589977fe4ec593584a74b835b6bb0b82cfa4e871c9283ab3601232fb56431b12ca3062f6beaf2f0b165c63bdc737ce7796a20586fe8d8c6bf76f98e0ebd929d21fb0f80a737cf7e1081c4488e4f83ff4f4c1b49caee054e37e3c62725056304f1806ad15c893c7debbac40dbe3e1b1df876e2dc0f91767bb1542181971d86a9535495ecf3b420bc90b6d843a0ea81cb432460b3f2db9a76fbecadd977984774e9f3780279711aac3f124df5dd2468db10f4e2033b59cdc65d6e91870fa3e317abe7c9146aa713b176cf2b9071bb36c28e33cbadbaa0f4ef495962f2cf9fc3176617a8119a9167f247479499f74f08540c8db0c590e905490fce60d45142195cec8e7b0af919fb035d445ece56e2c33dfb891c8e907a260edea7fee7dbe1507c66cabe0886b6222d156a37957d22177a5f402da4188703fcb3137a4483c315d13aa9545e2ea600207ca1918195366eddd36f8b3bee51bb886b6e16e795cbdfe4ef4c7ee49cfa048789062b514e89b234e5049c76c1afd36c9cb41038636a6d3740ba0936ef24da09c19e063bd41124e9f6483636cf21f5f10748b78dd932d27cc293e6b1c43600e1814ac3d9917e35a3fc37d1bf057ed7c8d1da69eb499e8b48a4a2d16da1341a34e1fc7e4cedc3af3b7a5140784436a8b2c63267752939cbf097f32f6f897c95630ea008ed38f9849e25253e3c005697b4c12233c70986267a2df821bded7920d33c5dc7f029b9a817c5e517f9f1cff27195153a4ba9fd2fa81d99e9a243834ce31126570b1ba98d9624574cd5391be7a2d8a031eee64fdc19cdb933a3aeebb46df5bb5e4fa5d4c91a22f58a246b4eb3b14ebed775665a3d63676aef6f2747864030b7f2725346840bde3ed49b761fa63a88ad36e1b5803bded8eb340861b49f84d163f0edabdf51e7a26012781ec7eb997fba2c14f966ae46e506c8dd6e9e9f0672cb9045dc5c3221c8dedcb0a0c98438c44872e9def583272366092d4942fbc28396e8282a64bc84be877fe0fe17afcc89037e166a736c028f0f3d342d64f238689e76075fab040e14f7a6214a24f29150bc7a8086806e6e929e28b7ae1b02d6c60f1711ec7262366f0ffc5d16ba407e42cee4d7940cd053fe8ff982a004806941c0a6ab07dfbfbedbe947a3423872953c731827abdec0f4adcd69e767a00e2fea6d3a293eefa4e9a77d7fc48cb434c33b568faf92bf31b5a99d00843d675111f5ad8d2d57299839ed83f97fe94d5664e72f9ecd53a3c2ead69d475b52984dbca5c042b304cdfb9a1f06904c8f64b052984ca773b1c0b18c90f6be401f1fe8673a113bc24b674382b67041b62e2a270a7489b32611bc41226e47c279aba4500e3eef99c173902a682cc0ddcadd1cae987794ce4b92979cfc3ec8bd6e05d820716a8f3e52278e5c634bc6460c552255f980202c4f393227c7a1fba96b584b0573dc14950cffbc236ba6645e2e3585e4d4b030fb61b078ba07d9407c9d9131ef227bc01ad19a43484aa43f073eb848b7479ba836d0e4d2d056b10b59d120d89c813645615121307de61aec09693dfe55cf511d3443b0646ad1e2c83a6c3dad8871200346b9683ad6f79bc197f2532fd9e6262ff8362b87d1b6d2d6253c023631678b3f3bba76e039e642227380763a3b255cd7ae2902e1e6c85453a93f3843d1a60ef69b4d487adbd4821a1b2a8ed2d037261286a11d89cbabeda5df68feb56a58c166fc066c95c71f6042e2399951dfd9bb74d14f41ae6f025460c83e7e7ca080fb6781792ae47f3e5d5041dc36f071a02b97a437b8d6d5426913a3b5abf428c8c5116608ac6c54efa57eab4934dd83cabc4efd730182e347d2af92a7703148676a985825c66cfc798e58217bb441fd7825f9d684450645d859e27335a2ab811fe612af957be9e0e54e582da4f61369ec3db0c6e8d18f9e0f8542a4b78540d41bdf692e21b5129bd9e1de2551277e2cca3f05dadac6388ed586954438f6d4991aa7cdda0016ea45ad9f1a7a687575cc6ddba366e69937d5e7b3ab0ada20846925939600ec18a7ca8e46d31736f36d070dfc9ea52e0c79308472829f5991e0e3c5e4b33fdecbb5c2b82fe624c9b6551a528760344faa2e809dbda79e34d1e60d8499fd27d51c3d498e09e4ad57a32fcf38cca3db3239db700f351b9060fb1f57acb16759ef9ffc588bb2abcad2dfd2ff9c52793877c4ed8ec23768f756ee84ebc2ba550f71042bea1007af7a6fc31ecabffb39e4eabd62683a414cc72653d5b26807644cfe13a269909ea0eec857f8a501401262e9c8a2b082e0f7c385effc874600d2bcc5a4f5fa4573e370d93c6914854bdacbde997019741a5e7bb78316a1a78b5ad7751e0e8333148ed3fd81ae1b35c2dd9dbfd2e641f7b8f9ec9b4011f602b33cf58717161eefd3bd1547d97554bb43c7dab0508278ad56814055e37cdf281043570e69e370cb460974f2886bc70af5dde96a659c6b958f55232700e7bca591c21aab30e415c3c03028146f0d0c6a5b47272ab603069de1b323e69b74d5dd2e68f123ac15aff22a50461f32cb567ebe380976786aa845309214c987492bc0034e7fa40c8c0dee0519a191a8ce5ea7378ba5511f732e3e70cfeef8eb649ec5267db20ece3ca1c58b8228fe16c576deffab9c04d4e8e4d3a4415599bd80c16b13a61a0e551c9256018b41f86373c64394fe46be47883ccdf4058ae00b84d17f1ea4ff914b95e9a8cd3bd930f9808fc6a162df1d7c64e7dc1588c376a802ce0147727319a8b3cb904fe59de2aeaafe34b27924c617b626a33177749a87ad91332572e990c3eb5c5a8b7cd268d310471f2deb1e1d47f7b8f7608a426bc722856fd8d0ddff55aa4a0baf09be989dcc559748f8a9b3e305cbc96eca0b4899d8339f015c343fd181914c71f8e91754a281d27bd496fe9ddd992174c9a9d80016913b31fe16d42c3a23d72c555bca1ea19bb221379e29d38d29cb96a34e7377b653f7a45e60c28f690238221e279128bb9d6b6902afecea3e4cd7e11ce2231d6e722746599b3b012c73967f6f13346cbc1c13e44b1ddefce4dfc9bff9e2307d4e358098a46f4ae93298447c6e754dffd543cdb9028ebcf4b3d02af494622d06ace9962bed60f2bfe6f5857d03501a6f4d040e13a95b3bbb5935ab87136b8cde35f1ff066e3fc9bb12fb9a86a251b1049c33dd0df0518300dc6076b80733557e74b7d27905613c2cca2bcd853487c319e257484c758fb0e696a102049ca4ffaa94ce08d43e80c1ca01f49f868412e4beed947667db0d84c14a2ee8ceb14ecd9433ca9215d3e300e10da9e02be9bc3243c82186191a697c7197cfb22d4f7d5cb1db462d753be3cf0de950eafcbeb8bd808320ae3fcc8916c59506e4eb4604c205fe99cbd35b255c029a307728273c15ef74ec30604fd013a6a972a42893399b7d977c206263f02a6b0ad2e4e3618a8afedbf66c0b3ef58fbe187009146a6760b29d9b6a4a6c115cf996795cac1c9379f27c8ae842c7f234dba4ba99c7d39d0e9a30b918b42eb8b1574eaf3737c90bceffa47885fd4d2c8651f8dfefa010825d35d51c52810d819c19e9842db292382dd60d3b58355822dda013a7405548aa2fc6e7e49ebac08e3863b127f1e8a17e53a9a8c88082f8049877f1a42616fb1f9a924f21b9e9506bd0701ea4ba65a01921dddb52f87d33f12bf79a04096a6d548455c837f956f61abe27bba37fbcebe81b2807728f251fefc6d5d9b2bfb507075196b323220b730b5a9757e278ddd55e586487d015a06a59c23a9bbca541d2ff3c2b80af1e2f7624fc4dca819efa845d583c194a9e58008dc4b794d5698831d4014151d39bcb6c0084f8c15193273bfc8f1c4f08056cfa59fc9b456d5a788f3fb0e864a4d142dd03f3604e3a3909db0709cab7449d64d20db49536186f3019f9891d3525112a6d9816b8e93c5c5e155e823379a2d5540fca7650e91478c214bf3ed9bfa46745954be1c495992544a663197dcbf6f84716fb4a91995dae05532e5c889ba8cfefc1c1c0aa738b2ac868ac2337c52c2fa93ad36bacd1945cc198f6989695aeccfdde701df523678a3df2316e66ac11846ee6a60055c9bea81b61ea92aff60f46cda6e1bac7ca783943c7ecc53e2b2a8afd18f8cda5c640b02a2ba3f38c2f19e6e8846a3ad0e37ce88ffe0542054c07c93898f396941d7cafee77e00f338346c0da3bd09aad087fd12740ef5585620013675582c51affa53cda2bfe028db61bdc6092575b96ccbc9681b4a42f25d595042012f1aa9dd3f363cc437685a147d8a60154fc78bf681bfbd0baa4f86413a2304f20fc572f29f250c6c5761020cee4ed41666cc30cc945c095558eb2ba64a8e72e37c926867e2f61f8e1b4fd4a37e3aa2700c7539941d0947811222d010120a61d1c4813b98a632b3b4bc5e2f95318ae3c2bd7ec5531fe46eefac6cda6d2ede32420bc11319d63bcd2e822f8564b4acb45fd1e0ab27cbaa6499ab4943b7877923fd23e59ab6bf08e3463627e1460e413db69e869eb4980a551444d80cede289719daaf62d4d5ece656e4825a0b3c455dbf53571a51389d399bd6920916a5126cdfca02a57360c735d92f928608a8840b8772b01a1dfc778312388463895ecbbb46b95591f65371fd6881f1cfafd5f3c57b450f3f741e71ede82a9bb39fece530a78e19b40d94d2a42da4bbe64a38ae6d9c4fa5f41880bc1a8cc255925f29d451e79a6207087a23be50d40676175e35eac5322b2a75c0b7393c00eb7fb58ed4477c34b55d8ab1b000ae729a406326134a13b53300fdf6e6c14099cdf85c9c296cbe06a227d669aac05bae389f8d4b393378700180a6"}) 13:17:49 executing program 5: r0 = syz_open_dev$binder(&(0x7f00000021c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000002340)={0x34, 0x0, &(0x7f0000002240)=[@request_death={0x400c630e, 0x4, 0x4}, @increfs={0x40046304, 0x4}, @increfs_done={0x40106308, 0x0, 0x3}, @increfs], 0x77, 0x0, &(0x7f00000022c0)="b3cd0976d8e2af743c6f523efe14fd20c3c3dd2572734282a761e1b4304e2599c85f198cc82bd5d0c70b4edca2f9ea7b875ff7047ec0784fbb354e15fd3f7d837f533597d5082692a6f2fb748da3cc4157188f7f2a5477ded56f72f5b75c96872db429e44b8fcd781d96dead77a0b58b7af9085a208a22"}) 13:17:49 executing program 3: r0 = openat$cuse(0xffffffffffffff9c, &(0x7f0000000080)='/dev/cuse\x00', 0x2, 0x0) clone(0x1002102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000640), 0xffffffffffffffff) r1 = getpid() sched_setscheduler(r1, 0x5, &(0x7f0000000000)) write$FUSE_NOTIFY_DELETE(r0, &(0x7f0000000040)={0x29, 0x4, 0x0, {0x8}}, 0x29) 13:17:49 executing program 0: perf_event_open(&(0x7f0000000040)={0x2, 0x70, 0x3e5}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f00000021c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000002340)={0xb5, 0x700, &(0x7f00000000c0)=ANY=[@ANYBLOB="0463044000000000b6a571ac965f26c50d500dae115e59afcd8a338d8b2727193c56d4ebef60c214b766ffde6cff6ceef2baa2594a53a0117e77afd5d58e8a35afdae81b258585ce769507333c0238790d5ed750bf1d6ca2a873050056528fce7becfd12f165ac43a826d3462822ff8f29ea992d4e208847cf4fc10ca00b87b5ce2523fa477bad0be1c97e4398aa2ac81d973b5a871d8e0b295e436cd8415f19088c6c82c85f4ed1fac41da062bc6dbfb8eac4276c"], 0x0, 0x0, &(0x7f00000022c0)}) 13:17:49 executing program 7: r0 = openat$cuse(0xffffffffffffff9c, &(0x7f0000000080)='/dev/cuse\x00', 0x2, 0x0) clone(0x1002102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000640), 0xffffffffffffffff) r1 = getpid() sched_setscheduler(r1, 0x5, &(0x7f0000000000)) write$FUSE_NOTIFY_DELETE(r0, &(0x7f0000000040)={0x29, 0x6, 0x0, {0x0, 0x7}}, 0x29) 13:17:49 executing program 4: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = gettid() perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x3e5}, 0x0, 0x0, 0xffffffffffffffff, 0x0) fcntl$setown(r0, 0x8, r1) bind$inet6(r0, &(0x7f0000807fe4)={0xa, 0x4e22}, 0x1c) sendto$inet6(r0, &(0x7f0000000380), 0x0, 0x200408d4, &(0x7f000072e000)={0xa, 0x4e22, 0x0, @loopback}, 0x1c) sendto$inet6(r0, &(0x7f0000ad6fad)='\x00', 0x1, 0x3fffffd, &(0x7f0000254000)={0xa, 0x0, 0xa000000, @loopback}, 0x1c) 13:17:49 executing program 3: r0 = openat$cuse(0xffffffffffffff9c, &(0x7f0000000080)='/dev/cuse\x00', 0x2, 0x0) clone(0x1002102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000640), 0xffffffffffffffff) r1 = getpid() sched_setscheduler(r1, 0x5, &(0x7f0000000000)) write$FUSE_NOTIFY_DELETE(r0, &(0x7f0000000040)={0x29, 0x4, 0x0, {0x900000000000000}}, 0x29) 13:17:49 executing program 6: clone(0x802102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000040), 0xffffffffffffffff) r0 = syz_open_dev$sndtimer(&(0x7f0000000000)='/dev/snd/timer\x00', 0x0, 0x0) r1 = getpid() r2 = accept$inet6(0xffffffffffffff9c, &(0x7f0000000080)={0xa, 0x0, 0x0, @mcast2}, &(0x7f00000000c0)=0x1c) getsockopt$IP6T_SO_GET_INFO(r2, 0x29, 0x40, &(0x7f0000000100)={'security\x00'}, &(0x7f0000000180)=0x54) sched_setscheduler(r1, 0x5, &(0x7f0000000200)) ioctl$SNDRV_TIMER_IOCTL_GPARAMS(r0, 0x40485404, &(0x7f0000000240)={{}, 0x0, 0x2000000000000000}) [ 1571.671186] binder: 19727:19732 IncRefs 0 refcount change on invalid ref 4 ret -22 13:17:49 executing program 6: clone(0x802102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000040), 0xffffffffffffffff) r0 = syz_open_dev$sndtimer(&(0x7f0000000000)='/dev/snd/timer\x00', 0x0, 0x0) r1 = getpid() r2 = openat$qat_adf_ctl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/qat_adf_ctl\x00', 0x200080, 0x0) faccessat(r2, &(0x7f0000000100)='./file0\x00', 0xfffffffffffffffe, 0xd00) ptrace$peek(0x2, r1, &(0x7f00000000c0)) sched_setscheduler(r1, 0x5, &(0x7f0000000200)) ioctl$SNDRV_TIMER_IOCTL_GPARAMS(r0, 0x40485404, &(0x7f0000000240)={{}, 0x0, 0x2000000000000000}) 13:17:49 executing program 3: r0 = openat$cuse(0xffffffffffffff9c, &(0x7f0000000080)='/dev/cuse\x00', 0x2, 0x0) clone(0x1002102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000640), 0xffffffffffffffff) r1 = getpid() sched_setscheduler(r1, 0x5, &(0x7f0000000000)) write$FUSE_NOTIFY_DELETE(r0, &(0x7f0000000040)={0x29, 0x4, 0x0, {0x8000000000000000}}, 0x29) [ 1571.743177] binder: 19727:19732 BC_INCREFS_DONE u0000000000000000 no match [ 1571.758612] binder: 19727:19732 IncRefs 0 refcount change on invalid ref 0 ret -22 13:17:49 executing program 7: r0 = openat$cuse(0xffffffffffffff9c, &(0x7f0000000080)='/dev/cuse\x00', 0x2, 0x0) clone(0x1002102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000640), 0xffffffffffffffff) r1 = getpid() sched_setscheduler(r1, 0x5, &(0x7f0000000000)) write$FUSE_NOTIFY_DELETE(r0, &(0x7f0000000040)={0x29, 0x6, 0x0, {0x0, 0x800000000000000}}, 0x29) 13:17:49 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r0, &(0x7f0000942000)={0x2, 0x4e20, @multicast1}, 0x10) sendmsg$key(0xffffffffffffffff, &(0x7f0000f56000)={0x0, 0x0, &(0x7f00008feff0)={&(0x7f0000000500)=ANY=[@ANYBLOB="020300090a1500000000000000000000030006190000000002000000e0000001003f00000000000002000100e625aa66dcef85847e479eb3c49000000400000000fd003e"], 0x44}}, 0x0) add_key(&(0x7f0000000080)='logon\x00', &(0x7f0000000100)={0x73, 0x79, 0x7a, 0x1}, &(0x7f0000001240), 0x0, 0xfffffffffffffff8) get_mempolicy(&(0x7f0000000000), &(0x7f00000001c0), 0x1ff, &(0x7f0000fff000/0x1000)=nil, 0x3) setsockopt$sock_int(r0, 0x1, 0x3c, &(0x7f0000d4effc)=0x1, 0x4) connect$inet(r0, &(0x7f0000000000)={0x2, 0x4e20, @dev={0xac, 0x14, 0x14, 0x18}}, 0x10) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f00000001c0)='tunl0\x00', 0x5) sendto$inet(r0, &(0x7f00006d1fd4)="db", 0x1, 0x4000010, &(0x7f00004daff0)={0x2, 0x0, @loopback, [0x0, 0x0, 0x0, 0x100000000000000]}, 0x10) 13:17:49 executing program 5: r0 = syz_open_dev$binder(&(0x7f00000021c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000002340)={0x34, 0x0, &(0x7f0000002240)=[@request_death={0x400c630e, 0x4, 0x4}, @increfs={0x40046304, 0x4}, @increfs_done={0x40106308, 0x0, 0x3}, @increfs], 0x77, 0x0, &(0x7f00000022c0)="b3cd0976d8e2af743c6f523efe14fd20c3c3dd2572734282a761e1b4304e2599c85f198cc82bd5d0c7464edca2f9ea7b875ff7047ec0784fbb354e15fd3f7d837f533597d5082692a6f2fb748da3cc4157188f7f2a5477ded56f72f5b75c96872db429e44b8fcd781d96dead77a0b58b7af9085a208a22"}) 13:17:50 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r0, &(0x7f0000942000)={0x2, 0x4e20, @multicast1}, 0x10) sendmsg$key(0xffffffffffffffff, &(0x7f0000f56000)={0x0, 0x0, &(0x7f00008feff0)={&(0x7f0000000500)=ANY=[@ANYBLOB="020300090a1500000000000000000000030006190000000002000000e0000001003f00000000000002000100e625aa66dcef85847e479eb3c49000000400000000fd003e"], 0x44}}, 0x0) add_key(&(0x7f0000000080)='logon\x00', &(0x7f0000000100)={0x73, 0x79, 0x7a, 0x1}, &(0x7f0000001240), 0x0, 0xfffffffffffffff8) get_mempolicy(&(0x7f0000000000), &(0x7f00000001c0), 0x1ff, &(0x7f0000fff000/0x1000)=nil, 0x3) setsockopt$sock_int(r0, 0x1, 0x3c, &(0x7f0000d4effc)=0x1, 0x4) connect$inet(r0, &(0x7f0000000000)={0x2, 0x4e20, @dev={0xac, 0x14, 0x14, 0x18}}, 0x10) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f00000001c0)='tunl0\x00', 0x5) sendto$inet(r0, &(0x7f00006d1fd4)="db", 0x1, 0x4000010, &(0x7f00004daff0)={0x2, 0x0, @loopback, [0x0, 0x0, 0x0, 0x500000000000000]}, 0x10) [ 1571.969948] binder: 19783:19784 IncRefs 0 refcount change on invalid ref 4 ret -22 [ 1572.010419] binder: 19783:19784 BC_INCREFS_DONE u0000000000000000 no match [ 1572.018456] binder: 19783:19784 IncRefs 0 refcount change on invalid ref 0 ret -22 13:17:50 executing program 1: r0 = socket$netlink(0x10, 0x3, 0x8000000004) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_TCP_CONGESTION(r1, 0x6, 0xd, &(0x7f0000000180)='vegas\x00', 0x6) bind$inet6(r1, &(0x7f00001fefe4)={0xa, 0x4e22}, 0x1c) sendto$inet6(r1, &(0x7f0000000100), 0x8d2d601e8976aa5, 0x20000004, &(0x7f000031e000)={0xa, 0x4e22}, 0x1c) writev(r0, &(0x7f0000000100)=[{&(0x7f0000000000)="580000001400192340834b80040d8c560a067fd76fff81004e220000000058000b4824ca944f64009400050028925aa8000000000000008000f0fffeffff09000000fff5dd00000010000100000c0900fcff0000040e05a5", 0x58}], 0x1) 13:17:50 executing program 3: r0 = openat$cuse(0xffffffffffffff9c, &(0x7f0000000080)='/dev/cuse\x00', 0x2, 0x0) clone(0x1002102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000640), 0xffffffffffffffff) r1 = getpid() sched_setscheduler(r1, 0x5, &(0x7f0000000000)) write$FUSE_NOTIFY_DELETE(r0, &(0x7f0000000040)={0x29, 0x4, 0x0, {0xc000000}}, 0x29) 13:17:50 executing program 7: r0 = openat$cuse(0xffffffffffffff9c, &(0x7f0000000080)='/dev/cuse\x00', 0x2, 0x0) clone(0x1002102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000640), 0xffffffffffffffff) r1 = getpid() sched_setscheduler(r1, 0x5, &(0x7f0000000000)) write$FUSE_NOTIFY_DELETE(r0, &(0x7f0000000040)={0x29, 0x6, 0x0, {0x0, 0xa0010000}}, 0x29) 13:17:50 executing program 6: clone(0x802102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000040), 0xffffffffffffffff) r0 = syz_open_dev$sndtimer(&(0x7f0000000000)='/dev/snd/timer\x00', 0x0, 0x0) r1 = getpid() sched_setscheduler(r1, 0x5, &(0x7f0000000200)) ioctl$SNDRV_TIMER_IOCTL_GPARAMS(r0, 0x40485404, &(0x7f0000000240)={{0x0, 0xfffffffffffffffd}, 0x0, 0x2000000000000000}) 13:17:50 executing program 5: r0 = syz_open_dev$binder(&(0x7f00000021c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000002340)={0x34, 0x0, &(0x7f0000002240)=[@request_death={0x400c630e, 0x4, 0x4}, @increfs={0x40046304, 0x4}, @increfs_done={0x40106308, 0x0, 0x3}, @increfs], 0x77, 0x0, &(0x7f00000022c0)="b3cd0976d8e2af743c6f523efe14fd20c3c3dd2572734282a761e1b4304e2599c85f198cc82bd5d0c7054edca2f9ea7b875ff7047ec0784fbb354e15fd3f7d837f533597d5082692a6f2fb748da3cc4157188f7f2a5477ded56f72f5b75c96872db429e44b8fcd781d96dead77a0b58b7af9085a208a22"}) 13:17:50 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r0, &(0x7f0000942000)={0x2, 0x4e20, @multicast1}, 0x10) sendmsg$key(0xffffffffffffffff, &(0x7f0000f56000)={0x0, 0x0, &(0x7f00008feff0)={&(0x7f0000000500)=ANY=[@ANYBLOB="020300090a1500000000000000000000030006190000000002000000e0000001003f00000000000002000100e625aa66dcef85847e479eb3c49000000400000000fd003e"], 0x44}}, 0x0) add_key(&(0x7f0000000080)='logon\x00', &(0x7f0000000100)={0x73, 0x79, 0x7a, 0x1}, &(0x7f0000001240), 0x0, 0xfffffffffffffff8) get_mempolicy(&(0x7f0000000000), &(0x7f00000001c0), 0x1ff, &(0x7f0000fff000/0x1000)=nil, 0x3) setsockopt$sock_int(r0, 0x1, 0x3c, &(0x7f0000d4effc)=0x1, 0x4) connect$inet(r0, &(0x7f0000000000)={0x2, 0x4e20, @dev={0xac, 0x14, 0x14, 0x18}}, 0x10) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f00000001c0)='tunl0\x00', 0x5) sendto$inet(r0, &(0x7f00006d1fd4)="db", 0x1, 0x4000010, &(0x7f00004daff0)={0x2, 0x0, @loopback, [0x0, 0x0, 0x0, 0xa000000]}, 0x10) 13:17:50 executing program 0: perf_event_open(&(0x7f0000000040)={0x2, 0x70, 0x3e5}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f00000021c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000002340)={0xb5, 0x4000000, &(0x7f00000000c0)=ANY=[@ANYBLOB="0463044000000000b6a571ac965f26c50d500dae115e59afcd8a338d8b2727193c56d4ebef60c214b766ffde6cff6ceef2baa2594a53a0117e77afd5d58e8a35afdae81b258585ce769507333c0238790d5ed750bf1d6ca2a873050056528fce7becfd12f165ac43a826d3462822ff8f29ea992d4e208847cf4fc10ca00b87b5ce2523fa477bad0be1c97e4398aa2ac81d973b5a871d8e0b295e436cd8415f19088c6c82c85f4ed1fac41da062bc6dbfb8eac4276c"], 0x0, 0x0, &(0x7f00000022c0)}) 13:17:50 executing program 4: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = gettid() perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x3e5}, 0x0, 0x0, 0xffffffffffffffff, 0x0) fcntl$setown(r0, 0x8, r1) bind$inet6(r0, &(0x7f0000807fe4)={0xa, 0x4e22}, 0x1c) sendto$inet6(r0, &(0x7f0000000380), 0x0, 0x200408d4, &(0x7f000072e000)={0xa, 0x4e22, 0x0, @loopback}, 0x1c) sendto$inet6(r0, &(0x7f0000ad6fad)='\x00', 0x1, 0x3fffffd, &(0x7f0000254000)={0xa, 0x0, 0x40020000, @loopback}, 0x1c) 13:17:50 executing program 7: r0 = openat$cuse(0xffffffffffffff9c, &(0x7f0000000080)='/dev/cuse\x00', 0x2, 0x0) clone(0x1002102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000640), 0xffffffffffffffff) r1 = getpid() sched_setscheduler(r1, 0x5, &(0x7f0000000000)) write$FUSE_NOTIFY_DELETE(r0, &(0x7f0000000040)={0x29, 0x6, 0x0, {0x0, 0x700}}, 0x29) 13:17:50 executing program 6: r0 = syz_open_dev$sndtimer(&(0x7f0000000000)='/dev/snd/timer\x00', 0x0, 0x0) r1 = getpid() sched_setscheduler(r1, 0x5, &(0x7f0000000200)) ioctl$SNDRV_TIMER_IOCTL_GPARAMS(r0, 0x40485404, &(0x7f0000000240)={{}, 0x0, 0x2000000000000000}) 13:17:50 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r0, &(0x7f0000942000)={0x2, 0x4e20, @multicast1}, 0x10) sendmsg$key(0xffffffffffffffff, &(0x7f0000f56000)={0x0, 0x0, &(0x7f00008feff0)={&(0x7f0000000500)=ANY=[@ANYBLOB="020300090a1500000000000000000000030006190000000002000000e0000001003f00000000000002000100e625aa66dcef85847e479eb3c49000000400000000fd003e"], 0x44}}, 0x0) add_key(&(0x7f0000000080)='logon\x00', &(0x7f0000000100)={0x73, 0x79, 0x7a, 0x1}, &(0x7f0000001240), 0x0, 0xfffffffffffffff8) get_mempolicy(&(0x7f0000000000), &(0x7f00000001c0), 0x1ff, &(0x7f0000fff000/0x1000)=nil, 0x3) setsockopt$sock_int(r0, 0x1, 0x3c, &(0x7f0000d4effc)=0x1, 0x4) connect$inet(r0, &(0x7f0000000000)={0x2, 0x4e20, @dev={0xac, 0x14, 0x14, 0x18}}, 0x10) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f00000001c0)='tunl0\x00', 0x5) sendto$inet(r0, &(0x7f00006d1fd4)="db", 0x1, 0x4000010, &(0x7f00004daff0)={0x2, 0x0, @loopback, [0x0, 0x0, 0x0, 0x1a0]}, 0x10) 13:17:50 executing program 7: r0 = openat$cuse(0xffffffffffffff9c, &(0x7f0000000080)='/dev/cuse\x00', 0x2, 0x0) clone(0x1002102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000640), 0xffffffffffffffff) r1 = getpid() sched_setscheduler(r1, 0x5, &(0x7f0000000000)) write$FUSE_NOTIFY_DELETE(r0, &(0x7f0000000040)={0x29, 0x6, 0x0, {0x0, 0x600}}, 0x29) 13:17:50 executing program 5: r0 = syz_open_dev$binder(&(0x7f00000021c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000002340)={0x34, 0x0, &(0x7f0000002240)=[@request_death={0x400c630e, 0x4, 0x4}, @increfs={0x40046304, 0x4}, @increfs_done={0x40106308, 0x0, 0x3}, @increfs], 0x77, 0x0, &(0x7f00000022c0)="b3cd0976d8e2af743c6f523efe14fd20c3c3dd2572734282a761e1b4304e2599c85f198cc82bd5d0c7444edca2f9ea7b875ff7047ec0784fbb354e15fd3f7d837f533597d5082692a6f2fb748da3cc4157188f7f2a5477ded56f72f5b75c96872db429e44b8fcd781d96dead77a0b58b7af9085a208a22"}) 13:17:50 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r0, &(0x7f0000942000)={0x2, 0x4e20, @multicast1}, 0x10) sendmsg$key(0xffffffffffffffff, &(0x7f0000f56000)={0x0, 0x0, &(0x7f00008feff0)={&(0x7f0000000500)=ANY=[@ANYBLOB="020300090a1500000000000000000000030006190000000002000000e0000001003f00000000000002000100e625aa66dcef85847e479eb3c49000000400000000fd003e"], 0x44}}, 0x0) add_key(&(0x7f0000000080)='logon\x00', &(0x7f0000000100)={0x73, 0x79, 0x7a, 0x1}, &(0x7f0000001240), 0x0, 0xfffffffffffffff8) get_mempolicy(&(0x7f0000000000), &(0x7f00000001c0), 0x1ff, &(0x7f0000fff000/0x1000)=nil, 0x3) setsockopt$sock_int(r0, 0x1, 0x3c, &(0x7f0000d4effc)=0x1, 0x4) connect$inet(r0, &(0x7f0000000000)={0x2, 0x4e20, @dev={0xac, 0x14, 0x14, 0x18}}, 0x10) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f00000001c0)='tunl0\x00', 0x5) sendto$inet(r0, &(0x7f00006d1fd4)="db", 0x1, 0x4000010, &(0x7f00004daff0)={0x2, 0x0, @loopback, [0x0, 0x0, 0x0, 0xe803]}, 0x10) 13:17:50 executing program 3: r0 = openat$cuse(0xffffffffffffff9c, &(0x7f0000000080)='/dev/cuse\x00', 0x2, 0x0) clone(0x1002102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000640), 0xffffffffffffffff) r1 = getpid() sched_setscheduler(r1, 0x5, &(0x7f0000000000)) write$FUSE_NOTIFY_DELETE(r0, &(0x7f0000000040)={0x29, 0x4, 0x0, {0xb000000}}, 0x29) [ 1572.771590] binder: 19852:19856 IncRefs 0 refcount change on invalid ref 4 ret -22 13:17:50 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r0, &(0x7f0000942000)={0x2, 0x4e20, @multicast1}, 0x10) sendmsg$key(0xffffffffffffffff, &(0x7f0000f56000)={0x0, 0x0, &(0x7f00008feff0)={&(0x7f0000000500)=ANY=[@ANYBLOB="020300090a1500000000000000000000030006190000000002000000e0000001003f00000000000002000100e625aa66dcef85847e479eb3c49000000400000000fd003e"], 0x44}}, 0x0) add_key(&(0x7f0000000080)='logon\x00', &(0x7f0000000100)={0x73, 0x79, 0x7a, 0x1}, &(0x7f0000001240), 0x0, 0xfffffffffffffff8) get_mempolicy(&(0x7f0000000000), &(0x7f00000001c0), 0x1ff, &(0x7f0000fff000/0x1000)=nil, 0x3) setsockopt$sock_int(r0, 0x1, 0x3c, &(0x7f0000d4effc)=0x1, 0x4) connect$inet(r0, &(0x7f0000000000)={0x2, 0x4e20, @dev={0xac, 0x14, 0x14, 0x18}}, 0x10) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f00000001c0)='tunl0\x00', 0x5) sendto$inet(r0, &(0x7f00006d1fd4)="db", 0x1, 0x4000010, &(0x7f00004daff0)={0x2, 0x0, @loopback, [0x0, 0x0, 0x0, 0xffffffa6]}, 0x10) [ 1572.812118] binder: 19852:19856 BC_INCREFS_DONE u0000000000000000 no match [ 1572.819909] binder: 19852:19856 IncRefs 0 refcount change on invalid ref 0 ret -22 13:17:51 executing program 3: r0 = openat$cuse(0xffffffffffffff9c, &(0x7f0000000080)='/dev/cuse\x00', 0x2, 0x0) clone(0x1002102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000640), 0xffffffffffffffff) r1 = getpid() sched_setscheduler(r1, 0x5, &(0x7f0000000000)) write$FUSE_NOTIFY_DELETE(r0, &(0x7f0000000040)={0x29, 0x4, 0x0, {0xa00}}, 0x29) 13:17:51 executing program 5: r0 = syz_open_dev$binder(&(0x7f00000021c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000002340)={0x34, 0x0, &(0x7f0000002240)=[@request_death={0x400c630e, 0x4, 0x4}, @increfs={0x40046304, 0x4}, @increfs_done={0x40106308, 0x0, 0x3}, @increfs], 0x77, 0x0, &(0x7f00000022c0)="b3cd0976d8e2af743c6f523efe14fd20c3c3dd2572734282a761e1b4304e2599c85f198cc82bd5d0c7434edca2f9ea7b875ff7047ec0784fbb354e15fd3f7d837f533597d5082692a6f2fb748da3cc4157188f7f2a5477ded56f72f5b75c96872db429e44b8fcd781d96dead77a0b58b7af9085a208a22"}) 13:17:51 executing program 7: r0 = openat$cuse(0xffffffffffffff9c, &(0x7f0000000080)='/dev/cuse\x00', 0x2, 0x0) clone(0x1002102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000640), 0xffffffffffffffff) r1 = getpid() sched_setscheduler(r1, 0x5, &(0x7f0000000000)) write$FUSE_NOTIFY_DELETE(r0, &(0x7f0000000040)={0x29, 0x6, 0x0, {0x0, 0x500000000000000}}, 0x29) 13:17:51 executing program 6: clone(0xffffe, 0x0, 0xfffffffffffffffe, &(0x7f0000000180), 0xffffffffffffffff) r0 = syz_open_dev$sndtimer(&(0x7f0000000000)='/dev/snd/timer\x00', 0x0, 0x0) r1 = getpid() sched_setscheduler(r1, 0x6, &(0x7f0000000200)) r2 = syz_open_dev$audion(&(0x7f0000000040)='/dev/audio#\x00', 0x8000, 0x4000) ioctl$EVIOCGABS3F(r2, 0x8018457f, &(0x7f0000000080)) ioctl$SNDRV_TIMER_IOCTL_GPARAMS(r0, 0x40485404, &(0x7f0000000240)={{}, 0x0, 0x2000000000000000}) 13:17:51 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r0, &(0x7f0000942000)={0x2, 0x4e20, @multicast1}, 0x10) sendmsg$key(0xffffffffffffffff, &(0x7f0000f56000)={0x0, 0x0, &(0x7f00008feff0)={&(0x7f0000000500)=ANY=[@ANYBLOB="020300090a1500000000000000000000030006190000000002000000e0000001003f00000000000002000100e625aa66dcef85847e479eb3c49000000400000000fd003e"], 0x44}}, 0x0) add_key(&(0x7f0000000080)='logon\x00', &(0x7f0000000100)={0x73, 0x79, 0x7a, 0x1}, &(0x7f0000001240), 0x0, 0xfffffffffffffff8) get_mempolicy(&(0x7f0000000000), &(0x7f00000001c0), 0x1ff, &(0x7f0000fff000/0x1000)=nil, 0x3) setsockopt$sock_int(r0, 0x1, 0x3c, &(0x7f0000d4effc)=0x1, 0x4) connect$inet(r0, &(0x7f0000000000)={0x2, 0x4e20, @dev={0xac, 0x14, 0x14, 0x18}}, 0x10) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f00000001c0)='tunl0\x00', 0x5) sendto$inet(r0, &(0x7f00006d1fd4)="db", 0x1, 0x4000010, &(0x7f00004daff0)={0x2, 0x0, @loopback, [0x0, 0x0, 0x0, 0xffffffffa0028000]}, 0x10) 13:17:51 executing program 0: perf_event_open(&(0x7f0000000040)={0x2, 0x70, 0x3e5}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f00000021c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000002340)={0xb5, 0x7a00, &(0x7f00000000c0)=ANY=[@ANYBLOB="0463044000000000b6a571ac965f26c50d500dae115e59afcd8a338d8b2727193c56d4ebef60c214b766ffde6cff6ceef2baa2594a53a0117e77afd5d58e8a35afdae81b258585ce769507333c0238790d5ed750bf1d6ca2a873050056528fce7becfd12f165ac43a826d3462822ff8f29ea992d4e208847cf4fc10ca00b87b5ce2523fa477bad0be1c97e4398aa2ac81d973b5a871d8e0b295e436cd8415f19088c6c82c85f4ed1fac41da062bc6dbfb8eac4276c"], 0x0, 0x0, &(0x7f00000022c0)}) 13:17:51 executing program 1: r0 = socket$netlink(0x10, 0x3, 0x8000000004) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_TCP_CONGESTION(r1, 0x6, 0xd, &(0x7f0000000180)='vegas\x00', 0x6) bind$inet6(r1, &(0x7f00001fefe4)={0xa, 0x4e22}, 0x1c) sendto$inet6(r1, &(0x7f0000000100), 0x8d2d601e8976aa5, 0x20000004, &(0x7f000031e000)={0xa, 0x4e22}, 0x1c) writev(r0, &(0x7f0000000100)=[{&(0x7f0000000000)="580000001400192340834b80040d8c560a067fed21ff81004e220000000058000b4824ca944f64009400050028925aa8000000000000008000f0fffeffff09000000fff5dd00000010000100000c0900fcff0000040e05a5", 0x58}], 0x1) 13:17:51 executing program 4: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = gettid() perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x3e5}, 0x0, 0x0, 0xffffffffffffffff, 0x0) fcntl$setown(r0, 0x8, r1) bind$inet6(r0, &(0x7f0000807fe4)={0xa, 0x4e22}, 0x1c) sendto$inet6(r0, &(0x7f0000000380), 0x0, 0x200408d4, &(0x7f000072e000)={0xa, 0x4e22, 0x0, @loopback}, 0x1c) sendto$inet6(r0, &(0x7f0000ad6fad)='\x00', 0x1, 0x3fffffd, &(0x7f0000254000)={0xa, 0x0, 0xb804, @loopback}, 0x1c) 13:17:51 executing program 6: clone(0x10000000, 0x0, 0xfffffffffffffffe, &(0x7f0000000080), 0xffffffffffffffff) r0 = syz_open_dev$sndtimer(&(0x7f0000000000)='/dev/snd/timer\x00', 0x0, 0x0) r1 = getpid() sched_setscheduler(r1, 0x5, &(0x7f0000000200)) ioctl$SNDRV_TIMER_IOCTL_GPARAMS(r0, 0x40485404, &(0x7f0000000240)={{}, 0x0, 0x2000000000000000}) [ 1573.412282] binder_thread_write: 5 callbacks suppressed [ 1573.412295] binder: 19880:19889 BC_REQUEST_DEATH_NOTIFICATION invalid ref 4 [ 1573.449722] binder: 19880:19889 BC_INCREFS_DONE u0000000000000000 no match 13:17:51 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r0, &(0x7f0000942000)={0x2, 0x4e20, @multicast1}, 0x10) sendmsg$key(0xffffffffffffffff, &(0x7f0000f56000)={0x0, 0x0, &(0x7f00008feff0)={&(0x7f0000000500)=ANY=[@ANYBLOB="020300090a1500000000000000000000030006190000000002000000e0000001003f00000000000002000100e625aa66dcef85847e479eb3c49000000400000000fd003e"], 0x44}}, 0x0) add_key(&(0x7f0000000080)='logon\x00', &(0x7f0000000100)={0x73, 0x79, 0x7a, 0x1}, &(0x7f0000001240), 0x0, 0xfffffffffffffff8) get_mempolicy(&(0x7f0000000000), &(0x7f00000001c0), 0x1ff, &(0x7f0000fff000/0x1000)=nil, 0x3) setsockopt$sock_int(r0, 0x1, 0x3c, &(0x7f0000d4effc)=0x1, 0x4) connect$inet(r0, &(0x7f0000000000)={0x2, 0x4e20, @dev={0xac, 0x14, 0x14, 0x18}}, 0x10) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f00000001c0)='tunl0\x00', 0x5) sendto$inet(r0, &(0x7f00006d1fd4)="db", 0x1, 0x4000010, &(0x7f00004daff0)={0x2, 0x0, @loopback, [0x0, 0x0, 0x0, 0x4002000000000000]}, 0x10) 13:17:51 executing program 7: r0 = openat$cuse(0xffffffffffffff9c, &(0x7f0000000080)='/dev/cuse\x00', 0x2, 0x0) clone(0x1002102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000640), 0xffffffffffffffff) r1 = getpid() sched_setscheduler(r1, 0x5, &(0x7f0000000000)) write$FUSE_NOTIFY_DELETE(r0, &(0x7f0000000040)={0x29, 0x6, 0x0, {0x0, 0x8}}, 0x29) 13:17:51 executing program 5: r0 = syz_open_dev$binder(&(0x7f00000021c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000002340)={0x34, 0x0, &(0x7f0000002240)=[@request_death={0x400c630e, 0x4, 0x4}, @increfs={0x40046304, 0x4}, @increfs_done={0x40106308, 0x0, 0x3}, @increfs], 0x77, 0x0, &(0x7f00000022c0)="b3cd0976d8e2af743c6f523efe14fd20c3c3dd2572734282a761e1b4304e2599c85f198cc82bd5d0c72f4edca2f9ea7b875ff7047ec0784fbb354e15fd3f7d837f533597d5082692a6f2fb748da3cc4157188f7f2a5477ded56f72f5b75c96872db429e44b8fcd781d96dead77a0b58b7af9085a208a22"}) 13:17:51 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r0, &(0x7f0000942000)={0x2, 0x4e20, @multicast1}, 0x10) sendmsg$key(0xffffffffffffffff, &(0x7f0000f56000)={0x0, 0x0, &(0x7f00008feff0)={&(0x7f0000000500)=ANY=[@ANYBLOB="020300090a1500000000000000000000030006190000000002000000e0000001003f00000000000002000100e625aa66dcef85847e479eb3c49000000400000000fd003e"], 0x44}}, 0x0) add_key(&(0x7f0000000080)='logon\x00', &(0x7f0000000100)={0x73, 0x79, 0x7a, 0x1}, &(0x7f0000001240), 0x0, 0xfffffffffffffff8) get_mempolicy(&(0x7f0000000000), &(0x7f00000001c0), 0x1ff, &(0x7f0000fff000/0x1000)=nil, 0x3) setsockopt$sock_int(r0, 0x1, 0x3c, &(0x7f0000d4effc)=0x1, 0x4) connect$inet(r0, &(0x7f0000000000)={0x2, 0x4e20, @dev={0xac, 0x14, 0x14, 0x18}}, 0x10) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f00000001c0)='tunl0\x00', 0x5) sendto$inet(r0, &(0x7f00006d1fd4)="db", 0x1, 0x4000010, &(0x7f00004daff0)={0x2, 0x0, @loopback, [0x0, 0x0, 0x0, 0x5]}, 0x10) [ 1573.683787] binder: 19919:19920 BC_REQUEST_DEATH_NOTIFICATION invalid ref 4 [ 1573.719436] binder: 19919:19920 BC_INCREFS_DONE u0000000000000000 no match 13:17:51 executing program 5: r0 = syz_open_dev$binder(&(0x7f00000021c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000002340)={0x34, 0x0, &(0x7f0000002240)=[@request_death={0x400c630e, 0x4, 0x4}, @increfs={0x40046304, 0x4}, @increfs_done={0x40106308, 0x0, 0x3}, @increfs], 0x77, 0x0, &(0x7f00000022c0)="b3cd0976d8e2af743c6f523efe14fd20c3c3dd2572734282a761e1b4304e2599c85f198cc82bd5d0c7344edca2f9ea7b875ff7047ec0784fbb354e15fd3f7d837f533597d5082692a6f2fb748da3cc4157188f7f2a5477ded56f72f5b75c96872db429e44b8fcd781d96dead77a0b58b7af9085a208a22"}) 13:17:51 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r0, &(0x7f0000942000)={0x2, 0x4e20, @multicast1}, 0x10) sendmsg$key(0xffffffffffffffff, &(0x7f0000f56000)={0x0, 0x0, &(0x7f00008feff0)={&(0x7f0000000500)=ANY=[@ANYBLOB="020300090a1500000000000000000000030006190000000002000000e0000001003f00000000000002000100e625aa66dcef85847e479eb3c49000000400000000fd003e"], 0x44}}, 0x0) add_key(&(0x7f0000000080)='logon\x00', &(0x7f0000000100)={0x73, 0x79, 0x7a, 0x1}, &(0x7f0000001240), 0x0, 0xfffffffffffffff8) get_mempolicy(&(0x7f0000000000), &(0x7f00000001c0), 0x1ff, &(0x7f0000fff000/0x1000)=nil, 0x3) setsockopt$sock_int(r0, 0x1, 0x3c, &(0x7f0000d4effc)=0x1, 0x4) connect$inet(r0, &(0x7f0000000000)={0x2, 0x4e20, @dev={0xac, 0x14, 0x14, 0x18}}, 0x10) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f00000001c0)='tunl0\x00', 0x5) sendto$inet(r0, &(0x7f00006d1fd4)="db", 0x1, 0x4000010, &(0x7f00004daff0)={0x2, 0x0, @loopback, [0x0, 0x0, 0x0, 0xa0028000]}, 0x10) 13:17:51 executing program 5: r0 = syz_open_dev$binder(&(0x7f00000021c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000002340)={0x34, 0x0, &(0x7f0000002240)=[@request_death={0x400c630e, 0x4, 0x4}, @increfs={0x40046304, 0x4}, @increfs_done={0x40106308, 0x0, 0x3}, @increfs], 0x77, 0x0, &(0x7f00000022c0)="b3cd0976d8e2af743c6f523efe14fd20c3c3dd2572734282a761e1b4304e2599c85f198cc82bd5d0c72e4edca2f9ea7b875ff7047ec0784fbb354e15fd3f7d837f533597d5082692a6f2fb748da3cc4157188f7f2a5477ded56f72f5b75c96872db429e44b8fcd781d96dead77a0b58b7af9085a208a22"}) [ 1573.797005] binder: 19927:19928 BC_REQUEST_DEATH_NOTIFICATION invalid ref 4 [ 1573.808594] binder: 19927:19928 BC_INCREFS_DONE u0000000000000000 no match [ 1573.881562] binder: 19932:19934 BC_REQUEST_DEATH_NOTIFICATION invalid ref 4 [ 1573.891400] binder: 19932:19934 BC_INCREFS_DONE u0000000000000000 no match 13:17:52 executing program 3: r0 = openat$cuse(0xffffffffffffff9c, &(0x7f0000000080)='/dev/cuse\x00', 0x2, 0x0) clone(0x1002102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000640), 0xffffffffffffffff) r1 = getpid() sched_setscheduler(r1, 0x5, &(0x7f0000000000)) write$FUSE_NOTIFY_DELETE(r0, &(0x7f0000000040)={0x29, 0x4, 0x0, {0xb00}}, 0x29) 13:17:52 executing program 5: r0 = syz_open_dev$binder(&(0x7f00000021c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000002340)={0x34, 0x0, &(0x7f0000002240)=[@request_death={0x400c630e, 0x4, 0x4}, @increfs={0x40046304, 0x4}, @increfs_done={0x40106308, 0x0, 0x3}, @increfs], 0x77, 0x0, &(0x7f00000022c0)="b3cd0976d8e2af743c6f523efe14fd20c3c3dd2572734282a761e1b4304e2599c85f198cc82bd5d0c71e4edca2f9ea7b875ff7047ec0784fbb354e15fd3f7d837f533597d5082692a6f2fb748da3cc4157188f7f2a5477ded56f72f5b75c96872db429e44b8fcd781d96dead77a0b58b7af9085a208a22"}) 13:17:52 executing program 7: r0 = openat$cuse(0xffffffffffffff9c, &(0x7f0000000080)='/dev/cuse\x00', 0x2, 0x0) clone(0x1002102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000640), 0xffffffffffffffff) r1 = getpid() sched_setscheduler(r1, 0x5, &(0x7f0000000000)) write$FUSE_NOTIFY_DELETE(r0, &(0x7f0000000040)={0x29, 0x6, 0x0, {0x0, 0xa}}, 0x29) 13:17:52 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r0, &(0x7f0000942000)={0x2, 0x4e20, @multicast1}, 0x10) sendmsg$key(0xffffffffffffffff, &(0x7f0000f56000)={0x0, 0x0, &(0x7f00008feff0)={&(0x7f0000000500)=ANY=[@ANYBLOB="020300090a1500000000000000000000030006190000000002000000e0000001003f00000000000002000100e625aa66dcef85847e479eb3c49000000400000000fd003e"], 0x44}}, 0x0) add_key(&(0x7f0000000080)='logon\x00', &(0x7f0000000100)={0x73, 0x79, 0x7a, 0x1}, &(0x7f0000001240), 0x0, 0xfffffffffffffff8) get_mempolicy(&(0x7f0000000000), &(0x7f00000001c0), 0x1ff, &(0x7f0000fff000/0x1000)=nil, 0x3) setsockopt$sock_int(r0, 0x1, 0x3c, &(0x7f0000d4effc)=0x1, 0x4) connect$inet(r0, &(0x7f0000000000)={0x2, 0x4e20, @dev={0xac, 0x14, 0x14, 0x18}}, 0x10) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f00000001c0)='tunl0\x00', 0x5) sendto$inet(r0, &(0x7f00006d1fd4)="db", 0x1, 0x4000010, &(0x7f00004daff0)={0x2, 0x0, @loopback, [0x0, 0x0, 0x0, 0x4000000]}, 0x10) [ 1574.011264] binder: 19942:19952 BC_REQUEST_DEATH_NOTIFICATION invalid ref 4 [ 1574.022055] binder: 19942:19952 BC_INCREFS_DONE u0000000000000000 no match 13:17:52 executing program 5: r0 = syz_open_dev$binder(&(0x7f00000021c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000002340)={0x34, 0x0, &(0x7f0000002240)=[@request_death={0x400c630e, 0x4, 0x4}, @increfs={0x40046304, 0x4}, @increfs_done={0x40106308, 0x0, 0x3}, @increfs], 0x77, 0x0, &(0x7f00000022c0)="b3cd0976d8e2af743c6f523efe14fd20c3c3dd2572734282a761e1b4304e2599c85f198cc82bd5d0c70e4edca2f9ea7b875ff7047ec0784fbb354e15fd3f7d837f533597d5082692a6f2fb748da3cc4157188f7f2a5477ded56f72f5b75c96872db429e44b8fcd781d96dead77a0b58b7af9085a208a22"}) [ 1574.101646] binder: 19956:19957 BC_REQUEST_DEATH_NOTIFICATION invalid ref 4 13:17:52 executing program 0: perf_event_open(&(0x7f0000000040)={0x2, 0x70, 0x3e5}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f00000021c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000002340)={0xb5, 0x3f00000000000000, &(0x7f00000000c0)=ANY=[@ANYBLOB="0463044000000000b6a571ac965f26c50d500dae115e59afcd8a338d8b2727193c56d4ebef60c214b766ffde6cff6ceef2baa2594a53a0117e77afd5d58e8a35afdae81b258585ce769507333c0238790d5ed750bf1d6ca2a873050056528fce7becfd12f165ac43a826d3462822ff8f29ea992d4e208847cf4fc10ca00b87b5ce2523fa477bad0be1c97e4398aa2ac81d973b5a871d8e0b295e436cd8415f19088c6c82c85f4ed1fac41da062bc6dbfb8eac4276c"], 0x0, 0x0, &(0x7f00000022c0)}) 13:17:52 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r0, &(0x7f0000942000)={0x2, 0x4e20, @multicast1}, 0x10) sendmsg$key(0xffffffffffffffff, &(0x7f0000f56000)={0x0, 0x0, &(0x7f00008feff0)={&(0x7f0000000500)=ANY=[@ANYBLOB="020300090a1500000000000000000000030006190000000002000000e0000001003f00000000000002000100e625aa66dcef85847e479eb3c49000000400000000fd003e"], 0x44}}, 0x0) add_key(&(0x7f0000000080)='logon\x00', &(0x7f0000000100)={0x73, 0x79, 0x7a, 0x1}, &(0x7f0000001240), 0x0, 0xfffffffffffffff8) get_mempolicy(&(0x7f0000000000), &(0x7f00000001c0), 0x1ff, &(0x7f0000fff000/0x1000)=nil, 0x3) setsockopt$sock_int(r0, 0x1, 0x3c, &(0x7f0000d4effc)=0x1, 0x4) connect$inet(r0, &(0x7f0000000000)={0x2, 0x4e20, @dev={0xac, 0x14, 0x14, 0x18}}, 0x10) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f00000001c0)='tunl0\x00', 0x5) sendto$inet(r0, &(0x7f00006d1fd4)="db", 0x1, 0x4000010, &(0x7f00004daff0)={0x2, 0x0, @loopback, [0x0, 0x0, 0x0, 0xe000000]}, 0x10) 13:17:52 executing program 5: r0 = syz_open_dev$binder(&(0x7f00000021c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000002340)={0x34, 0x0, &(0x7f0000002240)=[@request_death={0x400c630e, 0x4, 0x4}, @increfs={0x40046304, 0x4}, @increfs_done={0x40106308, 0x0, 0x3}, @increfs], 0x77, 0x0, &(0x7f00000022c0)="b3cd0976d8e2af743c6f523efe14fd20c3c3dd2572734282a761e1b4304e2599c85f198cc82bd5d0c7174edca2f9ea7b875ff7047ec0784fbb354e15fd3f7d837f533597d5082692a6f2fb748da3cc4157188f7f2a5477ded56f72f5b75c96872db429e44b8fcd781d96dead77a0b58b7af9085a208a22"}) 13:17:52 executing program 7: r0 = openat$cuse(0xffffffffffffff9c, &(0x7f0000000080)='/dev/cuse\x00', 0x2, 0x0) clone(0x1002102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000640), 0xffffffffffffffff) r1 = getpid() sched_setscheduler(r1, 0x5, &(0x7f0000000000)) write$FUSE_NOTIFY_DELETE(r0, &(0x7f0000000040)={0x29, 0x6, 0x0, {0x0, 0x200000000000000}}, 0x29) 13:17:52 executing program 3: r0 = openat$cuse(0xffffffffffffff9c, &(0x7f0000000080)='/dev/cuse\x00', 0x2, 0x0) clone(0x1002102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000640), 0xffffffffffffffff) r1 = getpid() sched_setscheduler(r1, 0x5, &(0x7f0000000000)) write$FUSE_NOTIFY_DELETE(r0, &(0x7f0000000040)={0x29, 0x4, 0x0, {0x500000000000000}}, 0x29) 13:17:52 executing program 1: r0 = socket$netlink(0x10, 0x3, 0x8000000004) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_TCP_CONGESTION(r1, 0x6, 0xd, &(0x7f0000000180)='vegas\x00', 0x6) bind$inet6(r1, &(0x7f00001fefe4)={0xa, 0x4e22}, 0x1c) sendto$inet6(r1, &(0x7f0000000100), 0x8d2d601e8976aa5, 0x20000004, &(0x7f000031e000)={0xa, 0x4e22}, 0x1c) writev(r0, &(0x7f0000000100)=[{&(0x7f0000000000)="580000001400192340834b80040d8c560a067faf06ff81004e220000000058000b4824ca944f64009400050028925aa8000000000000008000f0fffeffff09000000fff5dd00000010000100000c0900fcff0000040e05a5", 0x58}], 0x1) 13:17:52 executing program 6: clone(0x802102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000040), 0xffffffffffffffff) r0 = syz_open_dev$sndtimer(&(0x7f0000000000)='/dev/snd/timer\x00', 0x0, 0x0) r1 = getpid() sched_setscheduler(r1, 0x5, &(0x7f0000000200)=0x4) ioctl$SNDRV_TIMER_IOCTL_GPARAMS(r0, 0x40485404, &(0x7f0000000240)={{}, 0x0, 0x2000000000000000}) 13:17:52 executing program 4: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = gettid() perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x3e5}, 0x0, 0x0, 0xffffffffffffffff, 0x0) fcntl$setown(r0, 0x8, r1) bind$inet6(r0, &(0x7f0000807fe4)={0xa, 0x4e22}, 0x1c) sendto$inet6(r0, &(0x7f0000000380), 0x0, 0x200408d4, &(0x7f000072e000)={0xa, 0x4e22, 0x0, @loopback}, 0x1c) sendto$inet6(r0, &(0x7f0000ad6fad)='\x00', 0x1, 0x3fffffd, &(0x7f0000254000)={0xa, 0x0, 0x4b8, @loopback}, 0x1c) 13:17:52 executing program 6: clone(0x802102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000040), 0xffffffffffffffff) r0 = syz_open_dev$sndtimer(&(0x7f0000000100)='/dev/snd/timer\x00', 0x0, 0x10107e) sched_setscheduler(0x0, 0x5, &(0x7f0000000200)=0x1ff) ioctl$SNDRV_TIMER_IOCTL_GPARAMS(r0, 0x40485404, &(0x7f0000000240)={{}, 0x0, 0x2000000000000000}) r1 = openat$selinux_status(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/status\x00', 0x0, 0x0) ioctl$IOC_PR_REGISTER(r1, 0x401870c8, &(0x7f0000000080)={0x80000000, 0x7f7, 0x1}) shmget(0x2, 0x4000, 0x84, &(0x7f0000ffc000/0x4000)=nil) [ 1574.391051] binder: 19978:19980 BC_REQUEST_DEATH_NOTIFICATION invalid ref 4 13:17:52 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r0, &(0x7f0000942000)={0x2, 0x4e20, @multicast1}, 0x10) sendmsg$key(0xffffffffffffffff, &(0x7f0000f56000)={0x0, 0x0, &(0x7f00008feff0)={&(0x7f0000000500)=ANY=[@ANYBLOB="020300090a1500000000000000000000030006190000000002000000e0000001003f00000000000002000100e625aa66dcef85847e479eb3c49000000400000000fd003e"], 0x44}}, 0x0) add_key(&(0x7f0000000080)='logon\x00', &(0x7f0000000100)={0x73, 0x79, 0x7a, 0x1}, &(0x7f0000001240), 0x0, 0xfffffffffffffff8) get_mempolicy(&(0x7f0000000000), &(0x7f00000001c0), 0x1ff, &(0x7f0000fff000/0x1000)=nil, 0x3) setsockopt$sock_int(r0, 0x1, 0x3c, &(0x7f0000d4effc)=0x1, 0x4) connect$inet(r0, &(0x7f0000000000)={0x2, 0x4e20, @dev={0xac, 0x14, 0x14, 0x18}}, 0x10) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f00000001c0)='tunl0\x00', 0x5) sendto$inet(r0, &(0x7f00006d1fd4)="db", 0x1, 0x4000010, &(0x7f00004daff0)={0x2, 0x0, @loopback, [0x0, 0x0, 0x0, 0x2000000]}, 0x10) 13:17:52 executing program 7: r0 = openat$cuse(0xffffffffffffff9c, &(0x7f0000000080)='/dev/cuse\x00', 0x2, 0x0) clone(0x1002102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000640), 0xffffffffffffffff) r1 = getpid() sched_setscheduler(r1, 0x5, &(0x7f0000000000)) write$FUSE_NOTIFY_DELETE(r0, &(0x7f0000000040)={0x29, 0x6, 0x0, {0x0, 0x900000000000000}}, 0x29) 13:17:52 executing program 5: r0 = syz_open_dev$binder(&(0x7f00000021c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000002340)={0x34, 0x0, &(0x7f0000002240)=[@request_death={0x400c630e, 0x4, 0x4}, @increfs={0x40046304, 0x4}, @increfs_done={0x40106308, 0x0, 0x3}, @increfs], 0x77, 0x0, &(0x7f00000022c0)="b3cd0976d8e2af743c6f523efe14fd20c3c3dd2572734282a761e1b4304e2599c85f198cc82bd5d0c7334edca2f9ea7b875ff7047ec0784fbb354e15fd3f7d837f533597d5082692a6f2fb748da3cc4157188f7f2a5477ded56f72f5b75c96872db429e44b8fcd781d96dead77a0b58b7af9085a208a22"}) 13:17:52 executing program 6: clone(0x802102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000040), 0xffffffffffffffff) r0 = syz_open_dev$sndtimer(&(0x7f0000000000)='/dev/snd/timer\x00', 0x0, 0x0) r1 = getpid() r2 = syz_open_dev$dri(&(0x7f0000000080)='/dev/dri/card#\x00', 0x9, 0x840) ioctl$DRM_IOCTL_AGP_ALLOC(0xffffffffffffff9c, 0xc0206434, &(0x7f0000000100)={0x8, 0x0, 0x0, 0x9}) ioctl$DRM_IOCTL_SG_FREE(r2, 0x40106439, &(0x7f0000000140)={0x1, r3}) sched_setscheduler(r1, 0x5, &(0x7f00000000c0)=0xfffffffffffffffc) r4 = memfd_create(&(0x7f0000000180)='/dev/dri/card#\x00', 0x1) ioctl$EVIOCGID(r4, 0x80084502, &(0x7f00000002c0)=""/4096) ioctl$SNDRV_TIMER_IOCTL_GPARAMS(r0, 0x40485404, &(0x7f0000000240)={{0x0, 0x0, 0x0, 0x2}, 0x0, 0x2000000000000000}) 13:17:52 executing program 3: r0 = openat$cuse(0xffffffffffffff9c, &(0x7f0000000080)='/dev/cuse\x00', 0x2, 0x0) clone(0x1002102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000640), 0xffffffffffffffff) r1 = getpid() sched_setscheduler(r1, 0x5, &(0x7f0000000000)) write$FUSE_NOTIFY_DELETE(r0, &(0x7f0000000040)={0x29, 0x4, 0x0, {0xa00000000000000}}, 0x29) 13:17:52 executing program 6: syz_open_dev$loop(&(0x7f0000000000)='/dev/loop#\x00', 0x81, 0x40) clone(0x802102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000040), 0xffffffffffffffff) r0 = getpid() r1 = syz_open_dev$loop(&(0x7f0000000080)='/dev/loop#\x00', 0x8, 0x40000) ioctl$BLKROGET(r1, 0x125e, &(0x7f0000000140)) sched_setscheduler(r0, 0x5, &(0x7f0000000200)) ioctl$SNDRV_TIMER_IOCTL_GPARAMS(0xffffffffffffffff, 0x40485404, &(0x7f0000000240)={{}, 0x0, 0x2000000000000000}) 13:17:52 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r0, &(0x7f0000942000)={0x2, 0x4e20, @multicast1}, 0x10) sendmsg$key(0xffffffffffffffff, &(0x7f0000f56000)={0x0, 0x0, &(0x7f00008feff0)={&(0x7f0000000500)=ANY=[@ANYBLOB="020300090a1500000000000000000000030006190000000002000000e0000001003f00000000000002000100e625aa66dcef85847e479eb3c49000000400000000fd003e"], 0x44}}, 0x0) add_key(&(0x7f0000000080)='logon\x00', &(0x7f0000000100)={0x73, 0x79, 0x7a, 0x1}, &(0x7f0000001240), 0x0, 0xfffffffffffffff8) get_mempolicy(&(0x7f0000000000), &(0x7f00000001c0), 0x1ff, &(0x7f0000fff000/0x1000)=nil, 0x3) setsockopt$sock_int(r0, 0x1, 0x3c, &(0x7f0000d4effc)=0x1, 0x4) connect$inet(r0, &(0x7f0000000000)={0x2, 0x4e20, @dev={0xac, 0x14, 0x14, 0x18}}, 0x10) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f00000001c0)='tunl0\x00', 0x5) sendto$inet(r0, &(0x7f00006d1fd4)="db", 0x1, 0x4000010, &(0x7f00004daff0)={0x2, 0x0, @loopback, [0x0, 0x0, 0x0, 0x4]}, 0x10) [ 1574.703784] binder: 20034:20037 BC_REQUEST_DEATH_NOTIFICATION invalid ref 4 13:17:53 executing program 0: perf_event_open(&(0x7f0000000040)={0x2, 0x70, 0x3e5}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f00000021c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000002340)={0xb5, 0x7a000000, &(0x7f00000000c0)=ANY=[@ANYBLOB="0463044000000000b6a571ac965f26c50d500dae115e59afcd8a338d8b2727193c56d4ebef60c214b766ffde6cff6ceef2baa2594a53a0117e77afd5d58e8a35afdae81b258585ce769507333c0238790d5ed750bf1d6ca2a873050056528fce7becfd12f165ac43a826d3462822ff8f29ea992d4e208847cf4fc10ca00b87b5ce2523fa477bad0be1c97e4398aa2ac81d973b5a871d8e0b295e436cd8415f19088c6c82c85f4ed1fac41da062bc6dbfb8eac4276c"], 0x0, 0x0, &(0x7f00000022c0)}) 13:17:53 executing program 3: r0 = openat$cuse(0xffffffffffffff9c, &(0x7f0000000080)='/dev/cuse\x00', 0x2, 0x0) clone(0x1002102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000640), 0xffffffffffffffff) r1 = getpid() sched_setscheduler(r1, 0x5, &(0x7f0000000000)) write$FUSE_NOTIFY_DELETE(r0, &(0x7f0000000040)={0x29, 0x4, 0x0, {0x700000000000000}}, 0x29) 13:17:53 executing program 5: r0 = syz_open_dev$binder(&(0x7f00000021c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000002340)={0x34, 0x0, &(0x7f0000002240)=[@request_death={0x400c630e, 0x4, 0x4}, @increfs={0x40046304, 0x4}, @increfs_done={0x40106308, 0x0, 0x3}, @increfs], 0x77, 0x0, &(0x7f00000022c0)="b3cd0976d8e2af743c6f523efe14fd20c3c3dd2572734282a761e1b4304e2599c85f198cc82bd5d0c7044edca2f9ea7b875ff7047ec0784fbb354e15fd3f7d837f533597d5082692a6f2fb748da3cc4157188f7f2a5477ded56f72f5b75c96872db429e44b8fcd781d96dead77a0b58b7af9085a208a22"}) 13:17:53 executing program 7: r0 = openat$cuse(0xffffffffffffff9c, &(0x7f0000000080)='/dev/cuse\x00', 0x2, 0x0) clone(0x1002102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000640), 0xffffffffffffffff) r1 = getpid() sched_setscheduler(r1, 0x5, &(0x7f0000000000)) write$FUSE_NOTIFY_DELETE(r0, &(0x7f0000000040)={0x29, 0x6, 0x0, {0x0, 0x4000000}}, 0x29) 13:17:53 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r0, &(0x7f0000942000)={0x2, 0x4e20, @multicast1}, 0x10) sendmsg$key(0xffffffffffffffff, &(0x7f0000f56000)={0x0, 0x0, &(0x7f00008feff0)={&(0x7f0000000500)=ANY=[@ANYBLOB="020300090a1500000000000000000000030006190000000002000000e0000001003f00000000000002000100e625aa66dcef85847e479eb3c49000000400000000fd003e"], 0x44}}, 0x0) add_key(&(0x7f0000000080)='logon\x00', &(0x7f0000000100)={0x73, 0x79, 0x7a, 0x1}, &(0x7f0000001240), 0x0, 0xfffffffffffffff8) get_mempolicy(&(0x7f0000000000), &(0x7f00000001c0), 0x1ff, &(0x7f0000fff000/0x1000)=nil, 0x3) setsockopt$sock_int(r0, 0x1, 0x3c, &(0x7f0000d4effc)=0x1, 0x4) connect$inet(r0, &(0x7f0000000000)={0x2, 0x4e20, @dev={0xac, 0x14, 0x14, 0x18}}, 0x10) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f00000001c0)='tunl0\x00', 0x5) sendto$inet(r0, &(0x7f00006d1fd4)="db", 0x1, 0x4000010, &(0x7f00004daff0)={0x2, 0x0, @loopback, [0x0, 0x0, 0x0, 0xffffffffffffffff]}, 0x10) [ 1574.953044] binder: 20067:20068 BC_REQUEST_DEATH_NOTIFICATION invalid ref 4 13:17:53 executing program 7: r0 = openat$cuse(0xffffffffffffff9c, &(0x7f0000000080)='/dev/cuse\x00', 0x2, 0x0) clone(0x1002102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000640), 0xffffffffffffffff) r1 = getpid() sched_setscheduler(r1, 0x5, &(0x7f0000000000)) write$FUSE_NOTIFY_DELETE(r0, &(0x7f0000000040)={0x29, 0x6, 0x0, {0x0, 0x1000000}}, 0x29) 13:17:53 executing program 6: clone(0x802102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000040), 0xffffffffffffffff) r0 = syz_open_dev$sndtimer(&(0x7f0000000000)='/dev/snd/timer\x00', 0x0, 0x0) r1 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$IP_VS_SO_SET_TIMEOUT(r1, 0x0, 0x48a, &(0x7f0000000080)={0x2, 0x7b9, 0x9}, 0xc) r2 = getpid() sched_setscheduler(r2, 0x5, &(0x7f0000000200)) ioctl$SNDRV_TIMER_IOCTL_GPARAMS(r0, 0x40485404, &(0x7f0000000240)={{}, 0x0, 0x2000000000000000}) 13:17:53 executing program 4: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = gettid() perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x3e5}, 0x0, 0x0, 0xffffffffffffffff, 0x0) fcntl$setown(r0, 0x8, r1) bind$inet6(r0, &(0x7f0000807fe4)={0xa, 0x4e22}, 0x1c) sendto$inet6(r0, &(0x7f0000000380), 0x0, 0x200408d4, &(0x7f000072e000)={0xa, 0x4e22, 0x0, @loopback}, 0x1c) sendto$inet6(r0, &(0x7f0000ad6fad)='\x00', 0x1, 0x3fffffd, &(0x7f0000254000)={0xa, 0x0, 0x4002000000000000, @loopback}, 0x1c) 13:17:53 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r0, &(0x7f0000942000)={0x2, 0x4e20, @multicast1}, 0x10) sendmsg$key(0xffffffffffffffff, &(0x7f0000f56000)={0x0, 0x0, &(0x7f00008feff0)={&(0x7f0000000500)=ANY=[@ANYBLOB="020300090a1500000000000000000000030006190000000002000000e0000001003f00000000000002000100e625aa66dcef85847e479eb3c49000000400000000fd003e"], 0x44}}, 0x0) add_key(&(0x7f0000000080)='logon\x00', &(0x7f0000000100)={0x73, 0x79, 0x7a, 0x1}, &(0x7f0000001240), 0x0, 0xfffffffffffffff8) get_mempolicy(&(0x7f0000000000), &(0x7f00000001c0), 0x1ff, &(0x7f0000fff000/0x1000)=nil, 0x3) setsockopt$sock_int(r0, 0x1, 0x3c, &(0x7f0000d4effc)=0x1, 0x4) connect$inet(r0, &(0x7f0000000000)={0x2, 0x4e20, @dev={0xac, 0x14, 0x14, 0x18}}, 0x10) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f00000001c0)='tunl0\x00', 0x5) sendto$inet(r0, &(0x7f00006d1fd4)="db", 0x1, 0x4000010, &(0x7f00004daff0)={0x2, 0x0, @loopback, [0x0, 0x0, 0x0, 0x8]}, 0x10) 13:17:53 executing program 5: r0 = syz_open_dev$binder(&(0x7f00000021c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000002340)={0x34, 0x0, &(0x7f0000002240)=[@request_death={0x400c630e, 0x4, 0x4}, @increfs={0x40046304, 0x4}, @increfs_done={0x40106308, 0x0, 0x3}, @increfs], 0x77, 0x0, &(0x7f00000022c0)="b3cd0976d8e2af743c6f523efe14fd20c3c3dd2572734282a761e1b4304e2599c85f198cc82bd5d0c71d4edca2f9ea7b875ff7047ec0784fbb354e15fd3f7d837f533597d5082692a6f2fb748da3cc4157188f7f2a5477ded56f72f5b75c96872db429e44b8fcd781d96dead77a0b58b7af9085a208a22"}) 13:17:53 executing program 3: r0 = openat$cuse(0xffffffffffffff9c, &(0x7f0000000080)='/dev/cuse\x00', 0x2, 0x0) clone(0x1002102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000640), 0xffffffffffffffff) r1 = getpid() sched_setscheduler(r1, 0x5, &(0x7f0000000000)) write$FUSE_NOTIFY_DELETE(r0, &(0x7f0000000040)={0x29, 0x4, 0x0, {0x4000000}}, 0x29) 13:17:53 executing program 1: r0 = socket$netlink(0x10, 0x3, 0x8000000004) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_TCP_CONGESTION(r1, 0x6, 0xd, &(0x7f0000000180)='vegas\x00', 0x6) bind$inet6(r1, &(0x7f00001fefe4)={0xa, 0x4e22}, 0x1c) sendto$inet6(r1, &(0x7f0000000100), 0x8d2d601e8976aa5, 0x20000004, &(0x7f000031e000)={0xa, 0x4e22}, 0x1c) writev(r0, &(0x7f0000000100)=[{&(0x7f0000000000)="580000001400192340834b80040d8c560a067f4fd1ff81004e220000000058000b4824ca944f64009400050028925aa8000000000000008000f0fffeffff09000000fff5dd00000010000100000c0900fcff0000040e05a5", 0x58}], 0x1) 13:17:53 executing program 0: perf_event_open(&(0x7f0000000040)={0x2, 0x70, 0x3e5}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f00000021c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000002340)={0xb5, 0x7400, &(0x7f00000000c0)=ANY=[@ANYBLOB="0463044000000000b6a571ac965f26c50d500dae115e59afcd8a338d8b2727193c56d4ebef60c214b766ffde6cff6ceef2baa2594a53a0117e77afd5d58e8a35afdae81b258585ce769507333c0238790d5ed750bf1d6ca2a873050056528fce7becfd12f165ac43a826d3462822ff8f29ea992d4e208847cf4fc10ca00b87b5ce2523fa477bad0be1c97e4398aa2ac81d973b5a871d8e0b295e436cd8415f19088c6c82c85f4ed1fac41da062bc6dbfb8eac4276c"], 0x0, 0x0, &(0x7f00000022c0)}) 13:17:53 executing program 6: clone(0x200, 0x0, 0xfffffffffffffffe, &(0x7f0000000140), 0xffffffffffffffff) r0 = syz_open_dev$sndtimer(&(0x7f0000000000)='/dev/snd/timer\x00', 0x0, 0x0) r1 = accept$inet(0xffffffffffffffff, &(0x7f0000000080)={0x2, 0x0, @dev}, &(0x7f00000000c0)=0x10) shutdown(r1, 0x0) r2 = getpid() sched_setscheduler(r2, 0x6, &(0x7f0000000200)) ioctl$SNDRV_TIMER_IOCTL_GPARAMS(r0, 0x40485404, &(0x7f0000000240)={{}, 0x0, 0x2000000000000000}) getsockopt$IP6T_SO_GET_REVISION_MATCH(r0, 0x29, 0x44, &(0x7f0000000040)={'icmp\x00'}, &(0x7f0000000100)=0x1e) [ 1575.256848] binder: 20099:20100 BC_REQUEST_DEATH_NOTIFICATION invalid ref 4 13:17:53 executing program 5: r0 = syz_open_dev$binder(&(0x7f00000021c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000002340)={0x34, 0x0, &(0x7f0000002240)=[@request_death={0x400c630e, 0x4, 0x4}, @increfs={0x40046304, 0x4}, @increfs_done={0x40106308, 0x0, 0x3}, @increfs], 0x77, 0x0, &(0x7f00000022c0)="b3cd0976d8e2af743c6f523efe14fd20c3c3dd2572734282a761e1b4304e2599c85f198cc82bd5d0c7494edca2f9ea7b875ff7047ec0784fbb354e15fd3f7d837f533597d5082692a6f2fb748da3cc4157188f7f2a5477ded56f72f5b75c96872db429e44b8fcd781d96dead77a0b58b7af9085a208a22"}) 13:17:53 executing program 3: r0 = openat$cuse(0xffffffffffffff9c, &(0x7f0000000080)='/dev/cuse\x00', 0x2, 0x0) clone(0x1002102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000640), 0xffffffffffffffff) r1 = getpid() sched_setscheduler(r1, 0x5, &(0x7f0000000000)) write$FUSE_NOTIFY_DELETE(r0, &(0x7f0000000040)={0x29, 0x4, 0x0, {0x2000000}}, 0x29) 13:17:53 executing program 7: r0 = openat$cuse(0xffffffffffffff9c, &(0x7f0000000080)='/dev/cuse\x00', 0x2, 0x0) clone(0x1002102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000640), 0xffffffffffffffff) r1 = getpid() sched_setscheduler(r1, 0x5, &(0x7f0000000000)) write$FUSE_NOTIFY_DELETE(r0, &(0x7f0000000040)={0x29, 0x6, 0x0, {0x0, 0x100000000000000}}, 0x29) 13:17:53 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r0, &(0x7f0000942000)={0x2, 0x4e20, @multicast1}, 0x10) sendmsg$key(0xffffffffffffffff, &(0x7f0000f56000)={0x0, 0x0, &(0x7f00008feff0)={&(0x7f0000000500)=ANY=[@ANYBLOB="020300090a1500000000000000000000030006190000000002000000e0000001003f00000000000002000100e625aa66dcef85847e479eb3c49000000400000000fd003e"], 0x44}}, 0x0) add_key(&(0x7f0000000080)='logon\x00', &(0x7f0000000100)={0x73, 0x79, 0x7a, 0x1}, &(0x7f0000001240), 0x0, 0xfffffffffffffff8) get_mempolicy(&(0x7f0000000000), &(0x7f00000001c0), 0x1ff, &(0x7f0000fff000/0x1000)=nil, 0x3) setsockopt$sock_int(r0, 0x1, 0x3c, &(0x7f0000d4effc)=0x1, 0x4) connect$inet(r0, &(0x7f0000000000)={0x2, 0x4e20, @dev={0xac, 0x14, 0x14, 0x18}}, 0x10) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f00000001c0)='tunl0\x00', 0x5) sendto$inet(r0, &(0x7f00006d1fd4)="db", 0x1, 0x4000010, &(0x7f00004daff0)={0x2, 0x0, @loopback, [0x0, 0x0, 0x0, 0x40020000]}, 0x10) 13:17:53 executing program 6: clone(0x802102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000040), 0xffffffffffffffff) r0 = syz_open_dev$sndtimer(&(0x7f0000000000)='/dev/snd/timer\x00', 0x0, 0x101000) r1 = getpid() sched_setscheduler(r1, 0x5, &(0x7f0000000200)) r2 = syz_open_dev$amidi(&(0x7f0000000080)='/dev/amidi#\x00', 0x2000, 0x200) ioctl$TIOCGETD(r2, 0x5424, &(0x7f00000000c0)) ioctl$SNDRV_TIMER_IOCTL_GPARAMS(r0, 0x40485404, &(0x7f0000000240)={{}, 0x0, 0x2000000000000000}) fcntl$setlease(r2, 0x400, 0x4) 13:17:53 executing program 5: r0 = syz_open_dev$binder(&(0x7f00000021c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000002340)={0x34, 0x0, &(0x7f0000002240)=[@request_death={0x400c630e, 0x4, 0x4}, @increfs={0x40046304, 0x4}, @increfs_done={0x40106308, 0x0, 0x3}, @increfs], 0x77, 0x0, &(0x7f00000022c0)="b3cd0976d8e2af743c6f523efe14fd20c3c3dd2572734282a761e1b4304e2599c85f198cc82bd5d0c73c4edca2f9ea7b875ff7047ec0784fbb354e15fd3f7d837f533597d5082692a6f2fb748da3cc4157188f7f2a5477ded56f72f5b75c96872db429e44b8fcd781d96dead77a0b58b7af9085a208a22"}) 13:17:53 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r0, &(0x7f0000942000)={0x2, 0x4e20, @multicast1}, 0x10) sendmsg$key(0xffffffffffffffff, &(0x7f0000f56000)={0x0, 0x0, &(0x7f00008feff0)={&(0x7f0000000500)=ANY=[@ANYBLOB="020300090a1500000000000000000000030006190000000002000000e0000001003f00000000000002000100e625aa66dcef85847e479eb3c49000000400000000fd003e"], 0x44}}, 0x0) add_key(&(0x7f0000000080)='logon\x00', &(0x7f0000000100)={0x73, 0x79, 0x7a, 0x1}, &(0x7f0000001240), 0x0, 0xfffffffffffffff8) get_mempolicy(&(0x7f0000000000), &(0x7f00000001c0), 0x1ff, &(0x7f0000fff000/0x1000)=nil, 0x3) setsockopt$sock_int(r0, 0x1, 0x3c, &(0x7f0000d4effc)=0x1, 0x4) connect$inet(r0, &(0x7f0000000000)={0x2, 0x4e20, @dev={0xac, 0x14, 0x14, 0x18}}, 0x10) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f00000001c0)='tunl0\x00', 0x5) sendto$inet(r0, &(0x7f00006d1fd4)="db", 0x1, 0x4000010, &(0x7f00004daff0)={0x2, 0x0, @loopback, [0x0, 0x0, 0x0, 0x3000000]}, 0x10) 13:17:53 executing program 3: r0 = openat$cuse(0xffffffffffffff9c, &(0x7f0000000080)='/dev/cuse\x00', 0x2, 0x0) clone(0x1002102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000640), 0xffffffffffffffff) r1 = getpid() sched_setscheduler(r1, 0x5, &(0x7f0000000000)) write$FUSE_NOTIFY_DELETE(r0, &(0x7f0000000040)={0x29, 0x4, 0x0, {0x3000000}}, 0x29) 13:17:53 executing program 6: clone(0x20002, 0x0, 0xfffffffffffffffe, &(0x7f0000000140), 0xffffffffffffffff) r0 = syz_open_dev$sndtimer(&(0x7f0000000000)='/dev/snd/timer\x00', 0x0, 0x0) r1 = getpid() sched_setscheduler(r1, 0x5, &(0x7f0000000200)) ioctl$SNDRV_TIMER_IOCTL_GPARAMS(r0, 0x40485404, &(0x7f0000000240)={{}, 0x0, 0x2000000000000000}) 13:17:53 executing program 4: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = gettid() perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x3e5}, 0x0, 0x0, 0xffffffffffffffff, 0x0) fcntl$setown(r0, 0x8, r1) bind$inet6(r0, &(0x7f0000807fe4)={0xa, 0x4e22}, 0x1c) sendto$inet6(r0, &(0x7f0000000380), 0x0, 0x200408d4, &(0x7f000072e000)={0xa, 0x4e22, 0x0, @loopback}, 0x1c) sendto$inet6(r0, &(0x7f0000ad6fad)='\x00', 0x1, 0x3fffffd, &(0x7f0000254000)={0xa, 0x0, 0x0, @loopback={0xa}}, 0x1c) 13:17:53 executing program 7: r0 = openat$cuse(0xffffffffffffff9c, &(0x7f0000000080)='/dev/cuse\x00', 0x2, 0x0) clone(0x1002102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000640), 0xffffffffffffffff) r1 = getpid() sched_setscheduler(r1, 0x5, &(0x7f0000000000)) write$FUSE_NOTIFY_DELETE(r0, &(0x7f0000000040)={0x29, 0x6, 0x0, {0x0, 0x8000a0ffffffff}}, 0x29) 13:17:53 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r0, &(0x7f0000942000)={0x2, 0x4e20, @multicast1}, 0x10) sendmsg$key(0xffffffffffffffff, &(0x7f0000f56000)={0x0, 0x0, &(0x7f00008feff0)={&(0x7f0000000500)=ANY=[@ANYBLOB="020300090a1500000000000000000000030006190000000002000000e0000001003f00000000000002000100e625aa66dcef85847e479eb3c49000000400000000fd003e"], 0x44}}, 0x0) add_key(&(0x7f0000000080)='logon\x00', &(0x7f0000000100)={0x73, 0x79, 0x7a, 0x1}, &(0x7f0000001240), 0x0, 0xfffffffffffffff8) get_mempolicy(&(0x7f0000000000), &(0x7f00000001c0), 0x1ff, &(0x7f0000fff000/0x1000)=nil, 0x3) setsockopt$sock_int(r0, 0x1, 0x3c, &(0x7f0000d4effc)=0x1, 0x4) connect$inet(r0, &(0x7f0000000000)={0x2, 0x4e20, @dev={0xac, 0x14, 0x14, 0x18}}, 0x10) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f00000001c0)='tunl0\x00', 0x5) sendto$inet(r0, &(0x7f00006d1fd4)="db", 0x1, 0x4000010, &(0x7f00004daff0)={0x2, 0x0, @loopback, [0x0, 0x0, 0x0, 0x4900]}, 0x10) 13:17:53 executing program 5: r0 = syz_open_dev$binder(&(0x7f00000021c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000002340)={0x34, 0x0, &(0x7f0000002240)=[@request_death={0x400c630e, 0x4, 0x4}, @increfs={0x40046304, 0x4}, @increfs_done={0x40106308, 0x0, 0x3}, @increfs], 0x77, 0x0, &(0x7f00000022c0)="b3cd0976d8e2af743c6f523efe14fd20c3c3dd2572734282a761e1b4304e2599c85f198cc82bd5d0c7094edca2f9ea7b875ff7047ec0784fbb354e15fd3f7d837f533597d5082692a6f2fb748da3cc4157188f7f2a5477ded56f72f5b75c96872db429e44b8fcd781d96dead77a0b58b7af9085a208a22"}) 13:17:54 executing program 1: r0 = socket$netlink(0x10, 0x3, 0x8000000004) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_TCP_CONGESTION(r1, 0x6, 0xd, &(0x7f0000000180)='vegas\x00', 0x6) bind$inet6(r1, &(0x7f00001fefe4)={0xa, 0x4e22}, 0x1c) sendto$inet6(r1, &(0x7f0000000100), 0x8d2d601e8976aa5, 0x20000004, &(0x7f000031e000)={0xa, 0x4e22}, 0x1c) writev(r0, &(0x7f0000000100)=[{&(0x7f0000000000)="580000001400192340834b80040d8c560a067f735bff81004e220000000058000b4824ca944f64009400050028925aa8000000000000008000f0fffeffff09000000fff5dd00000010000100000c0900fcff0000040e05a5", 0x58}], 0x1) 13:17:54 executing program 3: r0 = openat$cuse(0xffffffffffffff9c, &(0x7f0000000080)='/dev/cuse\x00', 0x2, 0x0) clone(0x1002102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000640), 0xffffffffffffffff) r1 = getpid() sched_setscheduler(r1, 0x5, &(0x7f0000000000)) write$FUSE_NOTIFY_DELETE(r0, &(0x7f0000000040)={0x29, 0x4, 0x0, {0x6000000}}, 0x29) 13:17:54 executing program 5: r0 = syz_open_dev$binder(&(0x7f00000021c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000002340)={0x34, 0x0, &(0x7f0000002240)=[@request_death={0x400c630e, 0x4, 0x4}, @increfs={0x40046304, 0x4}, @increfs_done={0x40106308, 0x0, 0x3}, @increfs], 0x77, 0x0, &(0x7f00000022c0)="b3cd0976d8e2af743c6f523efe14fd20c3c3dd2572734282a761e1b4304e2599c85f198cc82bd5d0c70f4edca2f9ea7b875ff7047ec0784fbb354e15fd3f7d837f533597d5082692a6f2fb748da3cc4157188f7f2a5477ded56f72f5b75c96872db429e44b8fcd781d96dead77a0b58b7af9085a208a22"}) 13:17:54 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r0, &(0x7f0000942000)={0x2, 0x4e20, @multicast1}, 0x10) sendmsg$key(0xffffffffffffffff, &(0x7f0000f56000)={0x0, 0x0, &(0x7f00008feff0)={&(0x7f0000000500)=ANY=[@ANYBLOB="020300090a1500000000000000000000030006190000000002000000e0000001003f00000000000002000100e625aa66dcef85847e479eb3c49000000400000000fd003e"], 0x44}}, 0x0) add_key(&(0x7f0000000080)='logon\x00', &(0x7f0000000100)={0x73, 0x79, 0x7a, 0x1}, &(0x7f0000001240), 0x0, 0xfffffffffffffff8) get_mempolicy(&(0x7f0000000000), &(0x7f00000001c0), 0x1ff, &(0x7f0000fff000/0x1000)=nil, 0x3) setsockopt$sock_int(r0, 0x1, 0x3c, &(0x7f0000d4effc)=0x1, 0x4) connect$inet(r0, &(0x7f0000000000)={0x2, 0x4e20, @dev={0xac, 0x14, 0x14, 0x18}}, 0x10) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f00000001c0)='tunl0\x00', 0x5) sendto$inet(r0, &(0x7f00006d1fd4)="db", 0x1, 0x4000010, &(0x7f00004daff0)={0x2, 0x0, @loopback, [0x0, 0x0, 0x0, 0xf401]}, 0x10) 13:17:54 executing program 7: r0 = openat$cuse(0xffffffffffffff9c, &(0x7f0000000080)='/dev/cuse\x00', 0x2, 0x0) clone(0x1002102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000640), 0xffffffffffffffff) r1 = getpid() sched_setscheduler(r1, 0x5, &(0x7f0000000000)) write$FUSE_NOTIFY_DELETE(r0, &(0x7f0000000040)={0x29, 0x6, 0x0, {0x0, 0x8000000}}, 0x29) 13:17:54 executing program 4: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = gettid() perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x3e5}, 0x0, 0x0, 0xffffffffffffffff, 0x0) fcntl$setown(r0, 0x8, r1) bind$inet6(r0, &(0x7f0000807fe4)={0xa, 0x4e22}, 0x1c) sendto$inet6(r0, &(0x7f0000000380), 0x0, 0x200408d4, &(0x7f000072e000)={0xa, 0x4e22, 0x0, @loopback}, 0x1c) sendto$inet6(r0, &(0x7f0000ad6fad)='\x00', 0x1, 0x3fffffd, &(0x7f0000254000)={0xa, 0x0, 0x0, @loopback={0xb804000000000000}}, 0x1c) 13:17:54 executing program 6: r0 = syz_open_dev$sndtimer(&(0x7f0000000000)='/dev/snd/timer\x00', 0x0, 0x0) r1 = getpid() sched_setscheduler(r1, 0x5, &(0x7f0000000200)) ioctl$SNDRV_TIMER_IOCTL_GPARAMS(r0, 0x40485404, &(0x7f0000000240)={{}, 0x0, 0x2000000000000000}) 13:17:54 executing program 0: perf_event_open(&(0x7f0000000040)={0x2, 0x70, 0x3e5}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f00000021c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000002340)={0xb5, 0x0, &(0x7f00000000c0)=ANY=[@ANYBLOB="1263044000000000b6a571ac965f26c50d500dae115e59afcd8a338d8b2727193c56d4ebef60c214b766ffde6cff6ceef2baa2594a53a0117e77afd5d58e8a35afdae81b258585ce769507333c0238790d5ed750bf1d6ca2a873050056528fce7becfd12f165ac43a826d3462822ff8f29ea992d4e208847cf4fc10ca00b87b5ce2523fa477bad0be1c97e4398aa2ac81d973b5a871d8e0b295e436cd8415f19088c6c82c85f4ed1fac41da062bc6dbfb8eac4276c"], 0x0, 0x0, &(0x7f00000022c0)}) [ 1576.153044] binder_thread_write: 26 callbacks suppressed [ 1576.153059] binder: 20208:20212 IncRefs 0 refcount change on invalid ref 4 ret -22 13:17:54 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r0, &(0x7f0000942000)={0x2, 0x4e20, @multicast1}, 0x10) sendmsg$key(0xffffffffffffffff, &(0x7f0000f56000)={0x0, 0x0, &(0x7f00008feff0)={&(0x7f0000000500)=ANY=[@ANYBLOB="020300090a1500000000000000000000030006190000000002000000e0000001003f00000000000002000100e625aa66dcef85847e479eb3c49000000400000000fd003e"], 0x44}}, 0x0) add_key(&(0x7f0000000080)='logon\x00', &(0x7f0000000100)={0x73, 0x79, 0x7a, 0x1}, &(0x7f0000001240), 0x0, 0xfffffffffffffff8) get_mempolicy(&(0x7f0000000000), &(0x7f00000001c0), 0x1ff, &(0x7f0000fff000/0x1000)=nil, 0x3) setsockopt$sock_int(r0, 0x1, 0x3c, &(0x7f0000d4effc)=0x1, 0x4) connect$inet(r0, &(0x7f0000000000)={0x2, 0x4e20, @dev={0xac, 0x14, 0x14, 0x18}}, 0x10) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f00000001c0)='tunl0\x00', 0x5) sendto$inet(r0, &(0x7f00006d1fd4)="db", 0x1, 0x4000010, &(0x7f00004daff0)={0x2, 0x0, @loopback, [0x0, 0x0, 0x0, 0x1b814]}, 0x10) 13:17:54 executing program 5: r0 = syz_open_dev$binder(&(0x7f00000021c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000002340)={0x34, 0x0, &(0x7f0000002240)=[@request_death={0x400c630e, 0x4, 0x4}, @increfs={0x40046304, 0x4}, @increfs_done={0x40106308, 0x0, 0x3}, @increfs], 0x77, 0x0, &(0x7f00000022c0)="b3cd0976d8e2af743c6f523efe14fd20c3c3dd2572734282a761e1b4304e2599c85f198cc82bd5d0c73d4edca2f9ea7b875ff7047ec0784fbb354e15fd3f7d837f533597d5082692a6f2fb748da3cc4157188f7f2a5477ded56f72f5b75c96872db429e44b8fcd781d96dead77a0b58b7af9085a208a22"}) [ 1576.197487] binder_thread_write: 8 callbacks suppressed [ 1576.197502] binder: 20208:20212 BC_INCREFS_DONE u0000000000000000 no match [ 1576.217453] binder: 20208:20212 IncRefs 0 refcount change on invalid ref 0 ret -22 13:17:54 executing program 3: r0 = openat$cuse(0xffffffffffffff9c, &(0x7f0000000080)='/dev/cuse\x00', 0x2, 0x0) clone(0x1002102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000640), 0xffffffffffffffff) r1 = getpid() sched_setscheduler(r1, 0x5, &(0x7f0000000000)) write$FUSE_NOTIFY_DELETE(r0, &(0x7f0000000040)={0x29, 0x4, 0x0, {0x9000000}}, 0x29) 13:17:54 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r0, &(0x7f0000942000)={0x2, 0x4e20, @multicast1}, 0x10) sendmsg$key(0xffffffffffffffff, &(0x7f0000f56000)={0x0, 0x0, &(0x7f00008feff0)={&(0x7f0000000500)=ANY=[@ANYBLOB="020300090a1500000000000000000000030006190000000002000000e0000001003f00000000000002000100e625aa66dcef85847e479eb3c49000000400000000fd003e"], 0x44}}, 0x0) add_key(&(0x7f0000000080)='logon\x00', &(0x7f0000000100)={0x73, 0x79, 0x7a, 0x1}, &(0x7f0000001240), 0x0, 0xfffffffffffffff8) get_mempolicy(&(0x7f0000000000), &(0x7f00000001c0), 0x1ff, &(0x7f0000fff000/0x1000)=nil, 0x3) setsockopt$sock_int(r0, 0x1, 0x3c, &(0x7f0000d4effc)=0x1, 0x4) connect$inet(r0, &(0x7f0000000000)={0x2, 0x4e20, @dev={0xac, 0x14, 0x14, 0x18}}, 0x10) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f00000001c0)='tunl0\x00', 0x5) sendto$inet(r0, &(0x7f00006d1fd4)="db", 0x1, 0x4000010, &(0x7f00004daff0)={0x2, 0x0, @loopback, [0x0, 0x0, 0x0, 0xf2ffffff00000000]}, 0x10) 13:17:54 executing program 7: r0 = openat$cuse(0xffffffffffffff9c, &(0x7f0000000080)='/dev/cuse\x00', 0x2, 0x0) clone(0x1002102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000640), 0xffffffffffffffff) r1 = getpid() sched_setscheduler(r1, 0x5, &(0x7f0000000000)) write$FUSE_NOTIFY_DELETE(r0, &(0x7f0000000040)={0x29, 0x6, 0x0, {0x0, 0x300}}, 0x29) [ 1576.360780] binder: 20233:20234 IncRefs 0 refcount change on invalid ref 4 ret -22 [ 1576.369232] binder: 20233:20234 BC_INCREFS_DONE u0000000000000000 no match [ 1576.386513] binder: 20233:20234 IncRefs 0 refcount change on invalid ref 0 ret -22 13:17:54 executing program 5: r0 = syz_open_dev$binder(&(0x7f00000021c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000002340)={0x34, 0x0, &(0x7f0000002240)=[@request_death={0x400c630e, 0x4, 0x4}, @increfs={0x40046304, 0x4}, @increfs_done={0x40106308, 0x0, 0x3}, @increfs], 0x77, 0x0, &(0x7f00000022c0)="b3cd0976d8e2af743c6f523efe14fd20c3c3dd2572734282a761e1b4304e2599c85f198cc82bd5d0c7194edca2f9ea7b875ff7047ec0784fbb354e15fd3f7d837f533597d5082692a6f2fb748da3cc4157188f7f2a5477ded56f72f5b75c96872db429e44b8fcd781d96dead77a0b58b7af9085a208a22"}) 13:17:54 executing program 3: r0 = openat$cuse(0xffffffffffffff9c, &(0x7f0000000080)='/dev/cuse\x00', 0x2, 0x0) clone(0x1002102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000640), 0xffffffffffffffff) r1 = getpid() sched_setscheduler(r1, 0x5, &(0x7f0000000000)) write$FUSE_NOTIFY_DELETE(r0, &(0x7f0000000040)={0x29, 0x4, 0x0, {0xb00000000000000}}, 0x29) 13:17:54 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r0, &(0x7f0000942000)={0x2, 0x4e20, @multicast1}, 0x10) sendmsg$key(0xffffffffffffffff, &(0x7f0000f56000)={0x0, 0x0, &(0x7f00008feff0)={&(0x7f0000000500)=ANY=[@ANYBLOB="020300090a1500000000000000000000030006190000000002000000e0000001003f00000000000002000100e625aa66dcef85847e479eb3c49000000400000000fd003e"], 0x44}}, 0x0) add_key(&(0x7f0000000080)='logon\x00', &(0x7f0000000100)={0x73, 0x79, 0x7a, 0x1}, &(0x7f0000001240), 0x0, 0xfffffffffffffff8) get_mempolicy(&(0x7f0000000000), &(0x7f00000001c0), 0x1ff, &(0x7f0000fff000/0x1000)=nil, 0x3) setsockopt$sock_int(r0, 0x1, 0x3c, &(0x7f0000d4effc)=0x1, 0x4) connect$inet(r0, &(0x7f0000000000)={0x2, 0x4e20, @dev={0xac, 0x14, 0x14, 0x18}}, 0x10) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f00000001c0)='tunl0\x00', 0x5) sendto$inet(r0, &(0x7f00006d1fd4)="db", 0x1, 0x4000010, &(0x7f00004daff0)={0x2, 0x0, @loopback, [0x0, 0x0, 0x0, 0x80550000]}, 0x10) [ 1576.496460] binder: 20231:20249 unknown command 1074029330 [ 1576.582163] binder: 20257:20262 IncRefs 0 refcount change on invalid ref 4 ret -22 [ 1576.601393] binder: 20257:20262 BC_INCREFS_DONE u0000000000000000 no match [ 1576.609599] binder: 20257:20262 IncRefs 0 refcount change on invalid ref 0 ret -22 [ 1576.705757] binder: 20231:20249 ioctl c0306201 20002340 returned -22 [ 1576.734134] binder: 20231:20271 unknown command 1074029330 [ 1576.742759] binder: 20231:20271 ioctl c0306201 20002340 returned -22 13:17:55 executing program 1: r0 = socket$netlink(0x10, 0x3, 0x8000000004) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_TCP_CONGESTION(r1, 0x6, 0xd, &(0x7f0000000180)='vegas\x00', 0x6) bind$inet6(r1, &(0x7f00001fefe4)={0xa, 0x4e22}, 0x1c) sendto$inet6(r1, &(0x7f0000000100), 0x8d2d601e8976aa5, 0x20000004, &(0x7f000031e000)={0xa, 0x4e22}, 0x1c) writev(r0, &(0x7f0000000100)=[{&(0x7f0000000000)="580000001400192340834b80040d8c560a067fd236ff81004e220000000058000b4824ca944f64009400050028925aa8000000000000008000f0fffeffff09000000fff5dd00000010000100000c0900fcff0000040e05a5", 0x58}], 0x1) 13:17:55 executing program 7: r0 = openat$cuse(0xffffffffffffff9c, &(0x7f0000000080)='/dev/cuse\x00', 0x2, 0x0) clone(0x1002102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000640), 0xffffffffffffffff) r1 = getpid() sched_setscheduler(r1, 0x5, &(0x7f0000000000)) write$FUSE_NOTIFY_DELETE(r0, &(0x7f0000000040)={0x29, 0x6, 0x0, {0x0, 0x3}}, 0x29) 13:17:55 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r0, &(0x7f0000942000)={0x2, 0x4e20, @multicast1}, 0x10) sendmsg$key(0xffffffffffffffff, &(0x7f0000f56000)={0x0, 0x0, &(0x7f00008feff0)={&(0x7f0000000500)=ANY=[@ANYBLOB="020300090a1500000000000000000000030006190000000002000000e0000001003f00000000000002000100e625aa66dcef85847e479eb3c49000000400000000fd003e"], 0x44}}, 0x0) add_key(&(0x7f0000000080)='logon\x00', &(0x7f0000000100)={0x73, 0x79, 0x7a, 0x1}, &(0x7f0000001240), 0x0, 0xfffffffffffffff8) get_mempolicy(&(0x7f0000000000), &(0x7f00000001c0), 0x1ff, &(0x7f0000fff000/0x1000)=nil, 0x3) setsockopt$sock_int(r0, 0x1, 0x3c, &(0x7f0000d4effc)=0x1, 0x4) connect$inet(r0, &(0x7f0000000000)={0x2, 0x4e20, @dev={0xac, 0x14, 0x14, 0x18}}, 0x10) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f00000001c0)='tunl0\x00', 0x5) sendto$inet(r0, &(0x7f00006d1fd4)="db", 0x1, 0x4000010, &(0x7f00004daff0)={0x2, 0x0, @loopback, [0x0, 0x0, 0x0, 0x49000000]}, 0x10) 13:17:55 executing program 5: r0 = syz_open_dev$binder(&(0x7f00000021c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000002340)={0x34, 0x0, &(0x7f0000002240)=[@request_death={0x400c630e, 0x4, 0x4}, @increfs={0x40046304, 0x4}, @increfs_done={0x40106308, 0x0, 0x3}, @increfs], 0x77, 0x0, &(0x7f00000022c0)="b3cd0976d8e2af743c6f523efe14fd20c3c3dd2572734282a761e1b4304e2599c85f198cc82bd5d0c73e4edca2f9ea7b875ff7047ec0784fbb354e15fd3f7d837f533597d5082692a6f2fb748da3cc4157188f7f2a5477ded56f72f5b75c96872db429e44b8fcd781d96dead77a0b58b7af9085a208a22"}) 13:17:55 executing program 3: r0 = openat$cuse(0xffffffffffffff9c, &(0x7f0000000080)='/dev/cuse\x00', 0x2, 0x0) clone(0x1002102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000640), 0xffffffffffffffff) r1 = getpid() sched_setscheduler(r1, 0x5, &(0x7f0000000000)) write$FUSE_NOTIFY_DELETE(r0, &(0x7f0000000040)={0x29, 0x4, 0x0, {0x500}}, 0x29) 13:17:55 executing program 6: r0 = openat$selinux_status(0xffffffffffffff9c, &(0x7f00000000c0)='/selinux/status\x00', 0x0, 0x0) ioctl$TIOCSLCKTRMIOS(r0, 0x5457, &(0x7f0000000100)) clone(0x802102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000040), 0xffffffffffffffff) r1 = syz_open_dev$sndtimer(&(0x7f0000000000)='/dev/snd/timer\x00', 0x0, 0x0) r2 = getpid() sched_setscheduler(r2, 0x5, &(0x7f0000000200)) r3 = dup(r1) ioctl$KVM_S390_VCPU_FAULT(r3, 0x4008ae52, &(0x7f0000000080)=0xffffffffffffff81) ioctl$NBD_DO_IT(r3, 0xab03) ioctl$SNDRV_TIMER_IOCTL_GPARAMS(r1, 0x40485404, &(0x7f0000000240)={{}, 0x0, 0x2000000000000000}) 13:17:55 executing program 4: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = gettid() perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x3e5}, 0x0, 0x0, 0xffffffffffffffff, 0x0) fcntl$setown(r0, 0x8, r1) bind$inet6(r0, &(0x7f0000807fe4)={0xa, 0x4e22}, 0x1c) sendto$inet6(r0, &(0x7f0000000380), 0x0, 0x200408d4, &(0x7f000072e000)={0xa, 0x4e22, 0x0, @loopback}, 0x1c) sendto$inet6(r0, &(0x7f0000ad6fad)='\x00', 0x1, 0x3fffffd, &(0x7f0000254000)={0xa, 0x0, 0x0, @loopback={0x4002000000000000}}, 0x1c) 13:17:55 executing program 0: perf_event_open(&(0x7f0000000040)={0x2, 0x70, 0x3e5}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f00000021c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000002340)={0xb5, 0x0, &(0x7f00000000c0)=ANY=[@ANYBLOB="0363044000000000b6a571ac965f26c50d500dae115e59afcd8a338d8b2727193c56d4ebef60c214b766ffde6cff6ceef2baa2594a53a0117e77afd5d58e8a35afdae81b258585ce769507333c0238790d5ed750bf1d6ca2a873050056528fce7becfd12f165ac43a826d3462822ff8f29ea992d4e208847cf4fc10ca00b87b5ce2523fa477bad0be1c97e4398aa2ac81d973b5a871d8e0b295e436cd8415f19088c6c82c85f4ed1fac41da062bc6dbfb8eac4276c"], 0x0, 0x0, &(0x7f00000022c0)}) 13:17:55 executing program 7: r0 = openat$cuse(0xffffffffffffff9c, &(0x7f0000000080)='/dev/cuse\x00', 0x2, 0x0) clone(0x1002102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000640), 0xffffffffffffffff) r1 = getpid() sched_setscheduler(r1, 0x5, &(0x7f0000000000)) write$FUSE_NOTIFY_DELETE(r0, &(0x7f0000000040)={0x29, 0x6, 0x0, {0x0, 0xa0028000}}, 0x29) [ 1577.037572] binder: 20276:20285 IncRefs 0 refcount change on invalid ref 4 ret -22 [ 1577.053832] binder: 20276:20285 BC_INCREFS_DONE u0000000000000000 no match [ 1577.073090] binder: 20276:20285 IncRefs 0 refcount change on invalid ref 0 ret -22 13:17:55 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r0, &(0x7f0000942000)={0x2, 0x4e20, @multicast1}, 0x10) sendmsg$key(0xffffffffffffffff, &(0x7f0000f56000)={0x0, 0x0, &(0x7f00008feff0)={&(0x7f0000000500)=ANY=[@ANYBLOB="020300090a1500000000000000000000030006190000000002000000e0000001003f00000000000002000100e625aa66dcef85847e479eb3c49000000400000000fd003e"], 0x44}}, 0x0) add_key(&(0x7f0000000080)='logon\x00', &(0x7f0000000100)={0x73, 0x79, 0x7a, 0x1}, &(0x7f0000001240), 0x0, 0xfffffffffffffff8) get_mempolicy(&(0x7f0000000000), &(0x7f00000001c0), 0x1ff, &(0x7f0000fff000/0x1000)=nil, 0x3) setsockopt$sock_int(r0, 0x1, 0x3c, &(0x7f0000d4effc)=0x1, 0x4) connect$inet(r0, &(0x7f0000000000)={0x2, 0x4e20, @dev={0xac, 0x14, 0x14, 0x18}}, 0x10) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f00000001c0)='tunl0\x00', 0x5) sendto$inet(r0, &(0x7f00006d1fd4)="db", 0x1, 0x4000010, &(0x7f00004daff0)={0x2, 0x0, @loopback, [0x0, 0x0, 0x0, 0x7000000]}, 0x10) 13:17:55 executing program 3: r0 = openat$cuse(0xffffffffffffff9c, &(0x7f0000000080)='/dev/cuse\x00', 0x2, 0x0) clone(0x1002102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000640), 0xffffffffffffffff) r1 = getpid() sched_setscheduler(r1, 0x5, &(0x7f0000000000)) write$FUSE_NOTIFY_DELETE(r0, &(0x7f0000000040)={0x29, 0x4, 0x0, {0x0, 0x2000000}}, 0x29) 13:17:55 executing program 7: r0 = openat$cuse(0xffffffffffffff9c, &(0x7f0000000080)='/dev/cuse\x00', 0x2, 0x0) clone(0x1002102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000640), 0xffffffffffffffff) r1 = getpid() sched_setscheduler(r1, 0x5, &(0x7f0000000000)) write$FUSE_NOTIFY_DELETE(r0, &(0x7f0000000040)={0x29, 0x6, 0x0, {0x0, 0x3000000}}, 0x29) 13:17:55 executing program 5: r0 = syz_open_dev$binder(&(0x7f00000021c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000002340)={0x34, 0x0, &(0x7f0000002240)=[@request_death={0x400c630e, 0x4, 0x4}, @increfs={0x40046304, 0x4}, @increfs_done={0x40106308, 0x0, 0x3}, @increfs], 0x77, 0x0, &(0x7f00000022c0)="b3cd0976d8e2af743c6f523efe14fd20c3c3dd2572734282a761e1b4304e2599c85f198cc82bd5d0c7364edca2f9ea7b875ff7047ec0784fbb354e15fd3f7d837f533597d5082692a6f2fb748da3cc4157188f7f2a5477ded56f72f5b75c96872db429e44b8fcd781d96dead77a0b58b7af9085a208a22"}) 13:17:55 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r0, &(0x7f0000942000)={0x2, 0x4e20, @multicast1}, 0x10) sendmsg$key(0xffffffffffffffff, &(0x7f0000f56000)={0x0, 0x0, &(0x7f00008feff0)={&(0x7f0000000500)=ANY=[@ANYBLOB="020300090a1500000000000000000000030006190000000002000000e0000001003f00000000000002000100e625aa66dcef85847e479eb3c49000000400000000fd003e"], 0x44}}, 0x0) add_key(&(0x7f0000000080)='logon\x00', &(0x7f0000000100)={0x73, 0x79, 0x7a, 0x1}, &(0x7f0000001240), 0x0, 0xfffffffffffffff8) get_mempolicy(&(0x7f0000000000), &(0x7f00000001c0), 0x1ff, &(0x7f0000fff000/0x1000)=nil, 0x3) setsockopt$sock_int(r0, 0x1, 0x3c, &(0x7f0000d4effc)=0x1, 0x4) connect$inet(r0, &(0x7f0000000000)={0x2, 0x4e20, @dev={0xac, 0x14, 0x14, 0x18}}, 0x10) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f00000001c0)='tunl0\x00', 0x5) sendto$inet(r0, &(0x7f00006d1fd4)="db", 0x1, 0x4000010, &(0x7f00004daff0)={0x2, 0x0, @loopback, [0x0, 0x0, 0x0, 0x11000000]}, 0x10) [ 1577.263407] binder: 20316:20318 IncRefs 0 refcount change on invalid ref 4 ret -22 [ 1577.282971] binder: 20316:20318 BC_INCREFS_DONE u0000000000000000 no match [ 1577.295162] binder: 20316:20318 IncRefs 0 refcount change on invalid ref 0 ret -22 13:17:55 executing program 5: r0 = syz_open_dev$binder(&(0x7f00000021c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000002340)={0x34, 0x0, &(0x7f0000002240)=[@request_death={0x400c630e, 0x4, 0x4}, @increfs={0x40046304, 0x4}, @increfs_done={0x40106308, 0x0, 0x3}, @increfs], 0x77, 0x0, &(0x7f00000022c0)="b3cd0976d8e2af743c6f523efe14fd20c3c3dd2572734282a761e1b4304e2599c85f198cc82bd5d0c7244edca2f9ea7b875ff7047ec0784fbb354e15fd3f7d837f533597d5082692a6f2fb748da3cc4157188f7f2a5477ded56f72f5b75c96872db429e44b8fcd781d96dead77a0b58b7af9085a208a22"}) 13:17:55 executing program 7: r0 = openat$cuse(0xffffffffffffff9c, &(0x7f0000000080)='/dev/cuse\x00', 0x2, 0x0) clone(0x1002102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000640), 0xffffffffffffffff) r1 = getpid() sched_setscheduler(r1, 0x5, &(0x7f0000000000)) write$FUSE_NOTIFY_DELETE(r0, &(0x7f0000000040)={0x29, 0x6, 0x0, {0x0, 0xb00}}, 0x29) [ 1577.397254] binder: 20335:20336 unknown command 1074029315 [ 1577.403256] binder: 20335:20336 ioctl c0306201 20002340 returned -22 [ 1577.492289] binder: 20337:20345 BC_INCREFS_DONE u0000000000000000 no match [ 1577.515407] binder: 20335:20346 unknown command 1074029315 [ 1577.521620] binder: 20335:20346 ioctl c0306201 20002340 returned -22 13:17:55 executing program 1: r0 = socket$netlink(0x10, 0x3, 0x8000000004) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_TCP_CONGESTION(r1, 0x6, 0xd, &(0x7f0000000180)='vegas\x00', 0x6) bind$inet6(r1, &(0x7f00001fefe4)={0xa, 0x4e22}, 0x1c) sendto$inet6(r1, &(0x7f0000000100), 0x8d2d601e8976aa5, 0x20000004, &(0x7f000031e000)={0xa, 0x4e22}, 0x1c) writev(r0, &(0x7f0000000100)=[{&(0x7f0000000000)="580000001400192340834b80040d8c560a067f9a79ff81004e220000000058000b4824ca944f64009400050028925aa8000000000000008000f0fffeffff09000000fff5dd00000010000100000c0900fcff0000040e05a5", 0x58}], 0x1) 13:17:55 executing program 3: r0 = openat$cuse(0xffffffffffffff9c, &(0x7f0000000080)='/dev/cuse\x00', 0x2, 0x0) clone(0x1002102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000640), 0xffffffffffffffff) r1 = getpid() sched_setscheduler(r1, 0x5, &(0x7f0000000000)) write$FUSE_NOTIFY_DELETE(r0, &(0x7f0000000040)={0x29, 0x4, 0x0, {0x0, 0x300}}, 0x29) 13:17:55 executing program 6: clone(0x802102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000040), 0xffffffffffffffff) ioctl$ION_IOC_ALLOC(0xffffffffffffff9c, 0xc0184900, &(0x7f0000000380)={0x1, 0x10, 0x1, 0xffffffffffffff9c}) r0 = syz_open_procfs(0xffffffffffffffff, &(0x7f00000003c0)='syscall\x00') r1 = syz_open_dev$dri(&(0x7f0000000400)='/dev/dri/card#\x00', 0x7, 0x100) bpf$OBJ_GET_MAP(0x7, &(0x7f0000000480)={&(0x7f0000000440)='./file0\x00', 0x0, 0x8}, 0x10) r2 = accept4$packet(0xffffffffffffff9c, &(0x7f00000004c0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @local}, &(0x7f0000000500)=0x14, 0x80800) r3 = dup3(r1, r2, 0xfffffffffffffffc) ioctl$EVIOCGNAME(r0, 0x80404506, &(0x7f0000000640)=""/150) r4 = syz_open_dev$sndtimer(&(0x7f0000000340)='/dev/snd/timer\x00', 0x0, 0x3) fcntl$setpipe(r3, 0x407, 0x0) ioctl$sock_FIOGETOWN(r3, 0x8903, &(0x7f00000001c0)=0x0) sched_setparam(r5, &(0x7f00000002c0)=0x3) write$P9_RFLUSH(r3, &(0x7f0000000300)={0x7, 0x6d, 0x1}, 0x7) r6 = getpid() sched_setscheduler(r6, 0x9, &(0x7f0000000200)=0x10000000000000) ioctl$SNDRV_TIMER_IOCTL_GPARAMS(r4, 0x40485404, &(0x7f0000000240)={{}, 0x0, 0x2000000000000000}) setsockopt$inet_sctp_SCTP_INITMSG(r3, 0x84, 0x2, &(0x7f0000000540)={0x99, 0x9, 0x0, 0x908a}, 0x8) write$cgroup_subtree(r3, &(0x7f0000000180)={[{0x0, 'rdma'}, {0x2d, 'io'}, {0x2f, 'io'}, {0x2d, 'rdma'}, {0x2d, 'rdma'}, {0x2b, 'rdma'}]}, 0x20) r7 = syz_open_dev$midi(&(0x7f0000000080)='/dev/midi#\x00', 0x4, 0x8002) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r7, 0x6, 0x1d, &(0x7f00000000c0)={0x80000001, 0x8, 0x7, 0x0, 0x9}, 0x14) setsockopt$inet_sctp_SCTP_PARTIAL_DELIVERY_POINT(r7, 0x84, 0x13, &(0x7f0000000000)=0x7, 0x4) ioctl$sock_inet_SIOCGIFPFLAGS(r3, 0x8935, &(0x7f0000000100)={'tunl0\x00', 0x5}) bind$bt_rfcomm(r3, &(0x7f0000000140)={0x1f, {0xffff, 0x9, 0x9aef, 0x4, 0x7f, 0xad80}, 0x4}, 0xa) 13:17:55 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r0, &(0x7f0000942000)={0x2, 0x4e20, @multicast1}, 0x10) sendmsg$key(0xffffffffffffffff, &(0x7f0000f56000)={0x0, 0x0, &(0x7f00008feff0)={&(0x7f0000000500)=ANY=[@ANYBLOB="020300090a1500000000000000000000030006190000000002000000e0000001003f00000000000002000100e625aa66dcef85847e479eb3c49000000400000000fd003e"], 0x44}}, 0x0) add_key(&(0x7f0000000080)='logon\x00', &(0x7f0000000100)={0x73, 0x79, 0x7a, 0x1}, &(0x7f0000001240), 0x0, 0xfffffffffffffff8) get_mempolicy(&(0x7f0000000000), &(0x7f00000001c0), 0x1ff, &(0x7f0000fff000/0x1000)=nil, 0x3) setsockopt$sock_int(r0, 0x1, 0x3c, &(0x7f0000d4effc)=0x1, 0x4) connect$inet(r0, &(0x7f0000000000)={0x2, 0x4e20, @dev={0xac, 0x14, 0x14, 0x18}}, 0x10) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f00000001c0)='tunl0\x00', 0x5) sendto$inet(r0, &(0x7f00006d1fd4)="db", 0x1, 0x4000010, &(0x7f00004daff0)={0x2, 0x0, @loopback, [0x0, 0x0, 0x0, 0x7]}, 0x10) 13:17:55 executing program 7: r0 = openat$cuse(0xffffffffffffff9c, &(0x7f0000000080)='/dev/cuse\x00', 0x2, 0x0) clone(0x1002102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000640), 0xffffffffffffffff) r1 = getpid() sched_setscheduler(r1, 0x5, &(0x7f0000000000)) write$FUSE_NOTIFY_DELETE(r0, &(0x7f0000000040)={0x29, 0x6, 0x0, {0x0, 0x0, 0x4000000}}, 0x29) 13:17:55 executing program 5: r0 = syz_open_dev$binder(&(0x7f00000021c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000002340)={0x34, 0x0, &(0x7f0000002240)=[@request_death={0x400c630e, 0x4, 0x4}, @increfs={0x40046304, 0x4}, @increfs_done={0x40106308, 0x0, 0x3}, @increfs], 0x77, 0x0, &(0x7f00000022c0)="b3cd0976d8e2af743c6f523efe14fd20c3c3dd2572734282a761e1b4304e2599c85f198cc82bd5d0c7504edca2f9ea7b875ff7047ec0784fbb354e15fd3f7d837f533597d5082692a6f2fb748da3cc4157188f7f2a5477ded56f72f5b75c96872db429e44b8fcd781d96dead77a0b58b7af9085a208a22"}) 13:17:55 executing program 4: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = gettid() perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x3e5}, 0x0, 0x0, 0xffffffffffffffff, 0x0) fcntl$setown(r0, 0x8, r1) bind$inet6(r0, &(0x7f0000807fe4)={0xa, 0x4e22}, 0x1c) sendto$inet6(r0, &(0x7f0000000380), 0x0, 0x200408d4, &(0x7f000072e000)={0xa, 0x4e22, 0x0, @loopback}, 0x1c) sendto$inet6(r0, &(0x7f0000ad6fad)='\x00', 0x1, 0x3fffffd, &(0x7f0000254000)={0xa, 0x0, 0x0, @loopback={0xa00000000000000}}, 0x1c) 13:17:55 executing program 0: perf_event_open(&(0x7f0000000040)={0x2, 0x70, 0x3e5}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f00000021c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000002340)={0xb5, 0x0, &(0x7f00000000c0)=ANY=[@ANYBLOB="0f630c4000000000b6a571ac965f26c50d500dae115e59afcd8a338d8b2727193c56d4ebef60c214b766ffde6cff6ceef2baa2594a53a0117e77afd5d58e8a35afdae81b258585ce769507333c0238790d5ed750bf1d6ca2a873050056528fce7becfd12f165ac43a826d3462822ff8f29ea992d4e208847cf4fc10ca00b87b5ce2523fa477bad0be1c97e4398aa2ac81d973b5a871d8e0b295e436cd8415f19088c6c82c85f4ed1fac41da062bc6dbfb8eac4276c"], 0x0, 0x0, &(0x7f00000022c0)}) 13:17:55 executing program 6: clone(0x802102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000040), 0xffffffffffffffff) r0 = syz_open_dev$sndtimer(&(0x7f0000000000)='/dev/snd/timer\x00', 0x0, 0x0) r1 = getpid() sched_setscheduler(r1, 0x5, &(0x7f0000000200)) ioctl$SNDRV_TIMER_IOCTL_GPARAMS(r0, 0x40485404, &(0x7f0000000240)={{}, 0x0, 0x2000000000000000}) r2 = openat$sequencer(0xffffffffffffff9c, &(0x7f0000000080)='/dev/sequencer\x00', 0x30001, 0x0) ioctl$EVIOCRMFF(r2, 0x40044581, &(0x7f00000000c0)=0xfffffffffffffff7) [ 1577.919078] binder: 20358:20368 BC_INCREFS_DONE u0000000000000000 no match 13:17:56 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r0, &(0x7f0000942000)={0x2, 0x4e20, @multicast1}, 0x10) sendmsg$key(0xffffffffffffffff, &(0x7f0000f56000)={0x0, 0x0, &(0x7f00008feff0)={&(0x7f0000000500)=ANY=[@ANYBLOB="020300090a1500000000000000000000030006190000000002000000e0000001003f00000000000002000100e625aa66dcef85847e479eb3c49000000400000000fd003e"], 0x44}}, 0x0) add_key(&(0x7f0000000080)='logon\x00', &(0x7f0000000100)={0x73, 0x79, 0x7a, 0x1}, &(0x7f0000001240), 0x0, 0xfffffffffffffff8) get_mempolicy(&(0x7f0000000000), &(0x7f00000001c0), 0x1ff, &(0x7f0000fff000/0x1000)=nil, 0x3) setsockopt$sock_int(r0, 0x1, 0x3c, &(0x7f0000d4effc)=0x1, 0x4) connect$inet(r0, &(0x7f0000000000)={0x2, 0x4e20, @dev={0xac, 0x14, 0x14, 0x18}}, 0x10) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f00000001c0)='tunl0\x00', 0x5) sendto$inet(r0, &(0x7f00006d1fd4)="db", 0x1, 0x4000010, &(0x7f00004daff0)={0x2, 0x0, @loopback, [0x0, 0x0, 0x0, 0x200000000000000]}, 0x10) 13:17:56 executing program 6: clone(0x802102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000040), 0xffffffffffffffff) r0 = syz_open_dev$sndtimer(&(0x7f0000000000)='/dev/snd/timer\x00', 0x0, 0x0) r1 = getpid() sched_setscheduler(r1, 0x5, &(0x7f0000000200)) syz_emit_ethernet(0x1e, &(0x7f0000000080)={@dev={[], 0x10}, @random="1a09f9615648", [], {@can={0xc, {{0x4, 0x6, 0x111d, 0x8}, 0x3, 0x1, 0x0, 0x0, "423df0b8f7ffe6f9"}}}}, &(0x7f00000000c0)={0x0, 0x4, [0x5ed, 0x594, 0x80, 0x4c3]}) ioctl$SNDRV_TIMER_IOCTL_GPARAMS(r0, 0x40485404, &(0x7f0000000240)={{}, 0x0, 0x2000000000000000}) 13:17:56 executing program 5: r0 = syz_open_dev$binder(&(0x7f00000021c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000002340)={0x34, 0x0, &(0x7f0000002240)=[@request_death={0x400c630e, 0x4, 0x4}, @increfs={0x40046304, 0x4}, @increfs_done={0x40106308, 0x0, 0x3}, @increfs], 0x77, 0x0, &(0x7f00000022c0)="b3cd0976d8e2af743c6f523efe14fd20c3c3dd2572734282a761e1b4304e2599c85f198cc82bd5d0c72d4edca2f9ea7b875ff7047ec0784fbb354e15fd3f7d837f533597d5082692a6f2fb748da3cc4157188f7f2a5477ded56f72f5b75c96872db429e44b8fcd781d96dead77a0b58b7af9085a208a22"}) 13:17:56 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r0, &(0x7f0000942000)={0x2, 0x4e20, @multicast1}, 0x10) sendmsg$key(0xffffffffffffffff, &(0x7f0000f56000)={0x0, 0x0, &(0x7f00008feff0)={&(0x7f0000000500)=ANY=[@ANYBLOB="020300090a1500000000000000000000030006190000000002000000e0000001003f00000000000002000100e625aa66dcef85847e479eb3c49000000400000000fd003e"], 0x44}}, 0x0) add_key(&(0x7f0000000080)='logon\x00', &(0x7f0000000100)={0x73, 0x79, 0x7a, 0x1}, &(0x7f0000001240), 0x0, 0xfffffffffffffff8) get_mempolicy(&(0x7f0000000000), &(0x7f00000001c0), 0x1ff, &(0x7f0000fff000/0x1000)=nil, 0x3) setsockopt$sock_int(r0, 0x1, 0x3c, &(0x7f0000d4effc)=0x1, 0x4) connect$inet(r0, &(0x7f0000000000)={0x2, 0x4e20, @dev={0xac, 0x14, 0x14, 0x18}}, 0x10) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f00000001c0)='tunl0\x00', 0x5) sendto$inet(r0, &(0x7f00006d1fd4)="db", 0x1, 0x4000010, &(0x7f00004daff0)={0x2, 0x0, @loopback, [0x0, 0x0, 0x0, 0xf401000000000000]}, 0x10) 13:17:56 executing program 7: r0 = openat$cuse(0xffffffffffffff9c, &(0x7f0000000080)='/dev/cuse\x00', 0x2, 0x0) clone(0x1002102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000640), 0xffffffffffffffff) r1 = getpid() sched_setscheduler(r1, 0x5, &(0x7f0000000000)) write$FUSE_NOTIFY_DELETE(r0, &(0x7f0000000040)={0x29, 0x6, 0x0, {0x0, 0x0, 0xb000000}}, 0x29) 13:17:56 executing program 6: clone(0x802102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000040), 0xffffffffffffffff) r0 = syz_open_dev$sndtimer(&(0x7f0000000000)='/dev/snd/timer\x00', 0x0, 0x400000003fffd) r1 = getpid() sched_setscheduler(r1, 0x5, &(0x7f0000000200)) r2 = accept(0xffffffffffffff9c, &(0x7f0000000080)=@xdp, &(0x7f0000000100)=0x80) setsockopt$ALG_SET_AEAD_AUTHSIZE(r2, 0x117, 0x5, 0x0, 0x0) ioctl$SNDRV_TIMER_IOCTL_GPARAMS(r0, 0x40485404, &(0x7f0000000240)={{}, 0x0, 0x2000000000000000}) r3 = memfd_create(&(0x7f0000000140)='?,#vboxnet1\x00', 0x2) ioctl$KVM_NMI(r3, 0xae9a) 13:17:56 executing program 3: r0 = openat$cuse(0xffffffffffffff9c, &(0x7f0000000080)='/dev/cuse\x00', 0x2, 0x0) clone(0x1002102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000640), 0xffffffffffffffff) r1 = getpid() sched_setscheduler(r1, 0x5, &(0x7f0000000000)) write$FUSE_NOTIFY_DELETE(r0, &(0x7f0000000040)={0x29, 0x4, 0x0, {0x0, 0x900}}, 0x29) [ 1578.100361] binder: 20393:20394 BC_INCREFS_DONE u0000000000000000 no match [ 1578.384144] binder: 20422:20424 unknown command -1374859251 [ 1578.397704] binder: 20422:20424 ioctl c0306201 20002340 returned -22 [ 1578.427077] binder_thread_write: 12 callbacks suppressed [ 1578.427091] binder: 20422:20427 BC_CLEAR_DEATH_NOTIFICATION invalid ref 0 [ 1578.479902] binder: 20422:20427 unknown command -1374859251 [ 1578.486218] binder: 20422:20427 ioctl c0306201 20002340 returned -22 13:17:56 executing program 7: r0 = openat$cuse(0xffffffffffffff9c, &(0x7f0000000080)='/dev/cuse\x00', 0x2, 0x0) clone(0x1002102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000640), 0xffffffffffffffff) r1 = getpid() sched_setscheduler(r1, 0x5, &(0x7f0000000000)) write$FUSE_NOTIFY_DELETE(r0, &(0x7f0000000040)={0x29, 0x6, 0x0, {0x0, 0x0, 0xc00000000000000}}, 0x29) 13:17:56 executing program 3: r0 = openat$cuse(0xffffffffffffff9c, &(0x7f0000000080)='/dev/cuse\x00', 0x2, 0x0) clone(0x1002102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000640), 0xffffffffffffffff) r1 = getpid() sched_setscheduler(r1, 0x5, &(0x7f0000000000)) write$FUSE_NOTIFY_DELETE(r0, &(0x7f0000000040)={0x29, 0x4, 0x0, {0x0, 0xb00000000000000}}, 0x29) 13:17:56 executing program 6: r0 = openat$selinux_avc_cache_threshold(0xffffffffffffff9c, &(0x7f0000000080)='/selinux/avc/cache_threshold\x00', 0x2, 0x0) ioctl$SNDRV_TIMER_IOCTL_PARAMS(r0, 0x40505412, &(0x7f00000000c0)={0x1, 0x8, 0xaf8, 0x0, 0xc}) clone(0x802102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000040), 0xffffffffffffffff) r1 = syz_open_dev$sndtimer(&(0x7f0000000000)='/dev/snd/timer\x00', 0x0, 0x0) r2 = getpid() sched_setscheduler(r2, 0x5, &(0x7f0000000200)) ioctl$SNDRV_TIMER_IOCTL_GPARAMS(r1, 0x40485404, &(0x7f0000000240)={{}, 0x0, 0x2000000000000000}) 13:17:56 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r0, &(0x7f0000942000)={0x2, 0x4e20, @multicast1}, 0x10) sendmsg$key(0xffffffffffffffff, &(0x7f0000f56000)={0x0, 0x0, &(0x7f00008feff0)={&(0x7f0000000500)=ANY=[@ANYBLOB="020300090a1500000000000000000000030006190000000002000000e0000001003f00000000000002000100e625aa66dcef85847e479eb3c49000000400000000fd003e"], 0x44}}, 0x0) add_key(&(0x7f0000000080)='logon\x00', &(0x7f0000000100)={0x73, 0x79, 0x7a, 0x1}, &(0x7f0000001240), 0x0, 0xfffffffffffffff8) get_mempolicy(&(0x7f0000000000), &(0x7f00000001c0), 0x1ff, &(0x7f0000fff000/0x1000)=nil, 0x3) setsockopt$sock_int(r0, 0x1, 0x3c, &(0x7f0000d4effc)=0x1, 0x4) connect$inet(r0, &(0x7f0000000000)={0x2, 0x4e20, @dev={0xac, 0x14, 0x14, 0x18}}, 0x10) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f00000001c0)='tunl0\x00', 0x5) sendto$inet(r0, &(0x7f00006d1fd4)="db", 0x1, 0x4000010, &(0x7f00004daff0)={0x2, 0x0, @loopback, [0x0, 0x0, 0x0, 0xffffffff00000000]}, 0x10) 13:17:56 executing program 1: r0 = socket$netlink(0x10, 0x3, 0x8000000004) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_TCP_CONGESTION(r1, 0x6, 0xd, &(0x7f0000000180)='vegas\x00', 0x6) bind$inet6(r1, &(0x7f00001fefe4)={0xa, 0x4e22}, 0x1c) sendto$inet6(r1, &(0x7f0000000100), 0x8d2d601e8976aa5, 0x20000004, &(0x7f000031e000)={0xa, 0x4e22}, 0x1c) writev(r0, &(0x7f0000000100)=[{&(0x7f0000000000)="580000001400192340834b80040d8c560a067f48c6ff81004e220000000058000b4824ca944f64009400050028925aa8000000000000008000f0fffeffff09000000fff5dd00000010000100000c0900fcff0000040e05a5", 0x58}], 0x1) 13:17:56 executing program 4: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = gettid() perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x3e5}, 0x0, 0x0, 0xffffffffffffffff, 0x0) fcntl$setown(r0, 0x8, r1) bind$inet6(r0, &(0x7f0000807fe4)={0xa, 0x4e22}, 0x1c) sendto$inet6(r0, &(0x7f0000000380), 0x0, 0x200408d4, &(0x7f000072e000)={0xa, 0x4e22, 0x0, @loopback}, 0x1c) sendto$inet6(r0, &(0x7f0000ad6fad)='\x00', 0x1, 0x3fffffd, &(0x7f0000254000)={0xa, 0x0, 0x0, @loopback={0x40020000}}, 0x1c) 13:17:56 executing program 3: r0 = openat$cuse(0xffffffffffffff9c, &(0x7f0000000080)='/dev/cuse\x00', 0x2, 0x0) clone(0x1002102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000640), 0xffffffffffffffff) r1 = getpid() sched_setscheduler(r1, 0x5, &(0x7f0000000000)) write$FUSE_NOTIFY_DELETE(r0, &(0x7f0000000040)={0x29, 0x4, 0x0, {0x0, 0x4}}, 0x29) 13:17:56 executing program 0: perf_event_open(&(0x7f0000000040)={0x2, 0x70, 0x3e5}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f00000021c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000002340)={0xb5, 0x0, &(0x7f00000000c0)=ANY=[@ANYBLOB="0963104000000000b6a571ac965f26c50d500dae115e59afcd8a338d8b2727193c56d4ebef60c214b766ffde6cff6ceef2baa2594a53a0117e77afd5d58e8a35afdae81b258585ce769507333c0238790d5ed750bf1d6ca2a873050056528fce7becfd12f165ac43a826d3462822ff8f29ea992d4e208847cf4fc10ca00b87b5ce2523fa477bad0be1c97e4398aa2ac81d973b5a871d8e0b295e436cd8415f19088c6c82c85f4ed1fac41da062bc6dbfb8eac4276c"], 0x0, 0x0, &(0x7f00000022c0)}) 13:17:56 executing program 5: r0 = syz_open_dev$binder(&(0x7f00000021c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000002340)={0x34, 0x0, &(0x7f0000002240)=[@request_death={0x400c630e, 0x4, 0x4}, @increfs={0x40046304, 0x4}, @increfs_done={0x40106308, 0x0, 0x3}, @increfs], 0x77, 0x0, &(0x7f00000022c0)="b3cd0976d8e2af743c6f523efe14fd20c3c3dd2572734282a761e1b4304e2599c85f198cc82bd5d0c7314edca2f9ea7b875ff7047ec0784fbb354e15fd3f7d837f533597d5082692a6f2fb748da3cc4157188f7f2a5477ded56f72f5b75c96872db429e44b8fcd781d96dead77a0b58b7af9085a208a22"}) 13:17:56 executing program 7: r0 = openat$cuse(0xffffffffffffff9c, &(0x7f0000000080)='/dev/cuse\x00', 0x2, 0x0) clone(0x1002102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000640), 0xffffffffffffffff) r1 = getpid() sched_setscheduler(r1, 0x5, &(0x7f0000000000)) write$FUSE_NOTIFY_DELETE(r0, &(0x7f0000000040)={0x29, 0x6, 0x0, {0x0, 0x0, 0x1000000}}, 0x29) [ 1578.853235] binder: 20455:20456 BC_REQUEST_DEATH_NOTIFICATION invalid ref 4 [ 1578.868767] binder: 20455:20456 BC_INCREFS_DONE u0000000000000000 no match 13:17:56 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r0, &(0x7f0000942000)={0x2, 0x4e20, @multicast1}, 0x10) sendmsg$key(0xffffffffffffffff, &(0x7f0000f56000)={0x0, 0x0, &(0x7f00008feff0)={&(0x7f0000000500)=ANY=[@ANYBLOB="020300090a1500000000000000000000030006190000000002000000e0000001003f00000000000002000100e625aa66dcef85847e479eb3c49000000400000000fd003e"], 0x44}}, 0x0) add_key(&(0x7f0000000080)='logon\x00', &(0x7f0000000100)={0x73, 0x79, 0x7a, 0x1}, &(0x7f0000001240), 0x0, 0xfffffffffffffff8) get_mempolicy(&(0x7f0000000000), &(0x7f00000001c0), 0x1ff, &(0x7f0000fff000/0x1000)=nil, 0x3) setsockopt$sock_int(r0, 0x1, 0x3c, &(0x7f0000d4effc)=0x1, 0x4) connect$inet(r0, &(0x7f0000000000)={0x2, 0x4e20, @dev={0xac, 0x14, 0x14, 0x18}}, 0x10) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f00000001c0)='tunl0\x00', 0x5) sendto$inet(r0, &(0x7f00006d1fd4)="db", 0x1, 0x4000010, &(0x7f00004daff0)={0x2, 0x0, @loopback, [0x0, 0x0, 0x0, 0x8055000000000000]}, 0x10) 13:17:57 executing program 5: r0 = syz_open_dev$binder(&(0x7f00000021c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000002340)={0x34, 0x0, &(0x7f0000002240)=[@request_death={0x400c630e, 0x4, 0x4}, @increfs={0x40046304, 0x4}, @increfs_done={0x40106308, 0x0, 0x3}, @increfs], 0x77, 0x0, &(0x7f00000022c0)="b3cd0976d8e2af743c6f523efe14fd20c3c3dd2572734282a761e1b4304e2599c85f198cc82bd5d0c7024edca2f9ea7b875ff7047ec0784fbb354e15fd3f7d837f533597d5082692a6f2fb748da3cc4157188f7f2a5477ded56f72f5b75c96872db429e44b8fcd781d96dead77a0b58b7af9085a208a22"}) 13:17:57 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r0, &(0x7f0000942000)={0x2, 0x4e20, @multicast1}, 0x10) sendmsg$key(0xffffffffffffffff, &(0x7f0000f56000)={0x0, 0x0, &(0x7f00008feff0)={&(0x7f0000000500)=ANY=[@ANYBLOB="020300090a1500000000000000000000030006190000000002000000e0000001003f00000000000002000100e625aa66dcef85847e479eb3c49000000400000000fd003e"], 0x44}}, 0x0) add_key(&(0x7f0000000080)='logon\x00', &(0x7f0000000100)={0x73, 0x79, 0x7a, 0x1}, &(0x7f0000001240), 0x0, 0xfffffffffffffff8) get_mempolicy(&(0x7f0000000000), &(0x7f00000001c0), 0x1ff, &(0x7f0000fff000/0x1000)=nil, 0x3) setsockopt$sock_int(r0, 0x1, 0x3c, &(0x7f0000d4effc)=0x1, 0x4) connect$inet(r0, &(0x7f0000000000)={0x2, 0x4e20, @dev={0xac, 0x14, 0x14, 0x18}}, 0x10) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f00000001c0)='tunl0\x00', 0x5) sendto$inet(r0, &(0x7f00006d1fd4)="db", 0x1, 0x4000010, &(0x7f00004daff0)={0x2, 0x0, @loopback, [0x0, 0x0, 0x0, 0x1100000000000000]}, 0x10) 13:17:57 executing program 3: r0 = openat$cuse(0xffffffffffffff9c, &(0x7f0000000080)='/dev/cuse\x00', 0x2, 0x0) clone(0x1002102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000640), 0xffffffffffffffff) r1 = getpid() sched_setscheduler(r1, 0x5, &(0x7f0000000000)) write$FUSE_NOTIFY_DELETE(r0, &(0x7f0000000040)={0x29, 0x4, 0x0, {0x0, 0x200000000000000}}, 0x29) [ 1579.019106] binder: 20472:20473 BC_REQUEST_DEATH_NOTIFICATION invalid ref 4 [ 1579.027950] binder: 20472:20473 BC_INCREFS_DONE u0000000000000000 no match 13:17:57 executing program 6: openat$autofs(0xffffffffffffff9c, &(0x7f0000000080)='/dev/autofs\x00', 0x2, 0x0) clone(0x100802102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f00000001c0), 0xffffffffffffffff) r0 = syz_open_dev$sndtimer(&(0x7f0000000000)='/dev/snd/timer\x00', 0x0, 0x0) r1 = getpid() sched_setscheduler(r1, 0x5, &(0x7f0000000200)) pwritev(r0, &(0x7f0000000600)=[{&(0x7f00000000c0)="a36adbe01a894c00f56493272fd90b646617a79d5604070de7dcfb7bb15a1734ab3e053784e1a51c54a11dc0e85d42905bb778b752ee6bb6d7ef20030a63b1e776f92e39f4fbca6fa3ece9cdd67d42008008f60b15cbb8ae27238239a59121fd1d9ced4c23fcc73018b08ca805d7fb2bb340b327532376bda1158b4e6dc6ba51c77621938dd6", 0x86}, {&(0x7f00000002c0)="545a1fdcd039b867806708bf6dd2a89d4b92c24c280fb37aee7fbdb972ecdea65c3ce3441d4346d678a6525ee44b90a9e58d7ef5646e2773a710dc7e2efefbcc6396c56b3ac023d3e1be7535eb9de57e65561e861cdc75efa97c1a260a2517e3e7e3b741f54ebade55bdf9cf483d119bf4046f4db3d7dbc43ffb797f3a7b7dcd6261f38ada33a7e4b3eba1ffcdeb443c71af5424782366a0ee80485c1396dc22c604cbfcf0a3f6fb456ad1c9981a6bdf4c1c30e08a2e144139", 0xb9}, {&(0x7f0000000380)="e35e5997367b0500bcff14574c21d3f060f57f1a6bdeb90dbd0c0113030a11140f2c0ff6f765458b34614eaa606d0716693d65ae95d31ea0a24f4900e243fe3f3c043da0e9ff00b2af04aa09be76078c8d4075bda030b0013ca720d9c4e367b9ff2ed94b0a122a3a9a917ab595acd707410942938ca12a9b8d8685c3f026dd4d6aca525bf94f", 0x86}, {&(0x7f0000000440)="c5e480545cf7870b2bb38645d5f69497acd076e458357c67017846db107069f19538d91297e4f3cdc829ede587240478d11cdbdfe11724f052ae40d677abd725f386ac9053cc1446e3105c139db5077f0deb099e3ac1093f57662f9174cc1f91f8bf2c1538165435890aaa319a6324604855fe4c5a24a7dfe8710b02c955bffb9ea4e302278588a5d7ec7e2b17212f5143a37f", 0x93}, {&(0x7f0000000180)="5d3d61ebe3ad920d9218227318bba161151c1c13ebf272179fa3680d8cb098f2e8bc869107cc56bc7ce233aa00799a96ecaaf2db2cc1ed0a6364977a", 0x3c}, {&(0x7f0000000500)="6b0356fce461a76d062d443d2729d0d0f83272ae55fccd44b8bc5b98af16a3e1d0d4ce7221f22034a70296b839c676187a01c4286b67e748bd4bf0e48d5ba2e8eace21f2e508e064b2c6cd501451deed18a24e0f9fc4d99d5c9978a4102658d05156e0ab6e862ac9cb4247bea895823240fb6f80fb94ce546d0f454d672dbc6cd1fb1242af73f3d909efc7a3e1ccc71470aca625d6cc86b0fbe8fc06e769a82f5f20794d6cf28ee8dc59721b26aabb452a6de5f084651071160996d762e4df7ca6c00422a54ee01ea1fc62f927566ad32c0948819d5c9302b686b57fc3629803fd74acf83edaefbd6f08429a6353f781618b022866de23fd", 0xf8}], 0x6, 0x0) ioctl$SNDRV_TIMER_IOCTL_GPARAMS(r0, 0x40485404, &(0x7f0000000240)={{}, 0x0, 0x2000000000000000}) 13:17:57 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r0, &(0x7f0000942000)={0x2, 0x4e20, @multicast1}, 0x10) sendmsg$key(0xffffffffffffffff, &(0x7f0000f56000)={0x0, 0x0, &(0x7f00008feff0)={&(0x7f0000000500)=ANY=[@ANYBLOB="020300090a1500000000000000000000030006190000000002000000e0000001003f00000000000002000100e625aa66dcef85847e479eb3c49000000400000000fd003e"], 0x44}}, 0x0) add_key(&(0x7f0000000080)='logon\x00', &(0x7f0000000100)={0x73, 0x79, 0x7a, 0x1}, &(0x7f0000001240), 0x0, 0xfffffffffffffff8) get_mempolicy(&(0x7f0000000000), &(0x7f00000001c0), 0x1ff, &(0x7f0000fff000/0x1000)=nil, 0x3) setsockopt$sock_int(r0, 0x1, 0x3c, &(0x7f0000d4effc)=0x1, 0x4) connect$inet(r0, &(0x7f0000000000)={0x2, 0x4e20, @dev={0xac, 0x14, 0x14, 0x18}}, 0x10) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f00000001c0)='tunl0\x00', 0x5) sendto$inet(r0, &(0x7f00006d1fd4)="db", 0x1, 0x4000010, &(0x7f00004daff0)={0x2, 0x0, @loopback, [0x0, 0x0, 0x0, 0x300000000000000]}, 0x10) 13:17:57 executing program 5: r0 = syz_open_dev$binder(&(0x7f00000021c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000002340)={0x34, 0x0, &(0x7f0000002240)=[@request_death={0x400c630e, 0x4, 0x4}, @increfs={0x40046304, 0x4}, @increfs_done={0x40106308, 0x0, 0x3}, @increfs], 0x77, 0x0, &(0x7f00000022c0)="b3cd0976d8e2af743c6f523efe14fd20c3c3dd2572734282a761e1b4304e2599c85f198cc82bd5d0c73a4edca2f9ea7b875ff7047ec0784fbb354e15fd3f7d837f533597d5082692a6f2fb748da3cc4157188f7f2a5477ded56f72f5b75c96872db429e44b8fcd781d96dead77a0b58b7af9085a208a22"}) 13:17:57 executing program 6: clone(0x802102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000040), 0xffffffffffffffff) r0 = syz_open_dev$sndtimer(&(0x7f0000000000)='/dev/snd/timer\x00', 0x0, 0x0) r1 = getpid() sched_setscheduler(r1, 0x5, &(0x7f0000000200)) r2 = openat$vsock(0xffffffffffffff9c, &(0x7f0000000180)='/dev/vsock\x00', 0x400000, 0x0) ioctl$LOOP_CTL_GET_FREE(r2, 0x4c82) ioctl$SNDRV_TIMER_IOCTL_GPARAMS(r0, 0x40485404, &(0x7f0000000240)={{}, 0x0, 0x2000000000000000}) r3 = openat$sequencer(0xffffffffffffff9c, &(0x7f0000000080)='/dev/sequencer\x00', 0x105002, 0x0) sendmsg$nl_xfrm(r3, &(0x7f0000000140)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x1001}, 0xc, &(0x7f0000000100)={&(0x7f00000002c0)=@delsa={0x121c, 0x11, 0x422, 0x70bd26, 0x25dfdbfc, {@in6=@mcast2, 0x4d6, 0x2, 0x6f}, [@encap={0x1c, 0x4, {0xffffffffffffffff, 0x4e21, 0x4e23, @in6=@ipv4={[], [], @remote}}}, @algo_aead={0x144, 0x12, {{'aegis256-aesni\x00'}, 0x7a8, 0xc0, "e3538b00d529cebc8ab3f4dd27c6c8f548e96da09c9819c524fc90d7ad1f6bb1dcf619ec7e34dffa008d232ce9a33a5279b3ed542a8ff7068bd26a1bbf93305addbb483cfd1c83f237ac90eda3147fb8eb9626200a4e02c6912cdc6c61afb12fd15f22477e75abd89aae5832fdb6a3707553e2d0519798b0ae1c294074733368a778bc32e54edb770bd6ecc5513782b528caf53f0a06f721f40267252de4bac5e14ef393e6ae5d0dcc95f60124726d97c07ab273552b36f3a77692b4c0a33bee0d83bbb77dfbe031b6a06101a9e12e8a42714b5f05c94024443cadcb74f2f957f33fbfab2c9517f9a92d7719c6262428ed8fc03390"}}, @coaddr={0x14, 0xe, @in6=@ipv4={[], [], @broadcast}}, @sec_ctx={0x100c, 0x8, {0x1008, 0x8, 0x1, 0x0, 0x1000, "0294f9b1366144d4322ac33ea19e7ce5638571a4748116d00ccea95afaaf3bf0b0eaf8b23c9fdee64de3454f399092918e5b37cb51e403d85729651b44f53513d2257938ccced99bbb27ffaf4bca8d8a644a3f5f09a7a32f53887391f486eec4eb1acada01d88391387c37dfcc471e4e66de5307facfd17f6aa9315851ad55eb784153f6d9890e30f8d943d9be8153094832baf3b196f0e8f78563d4cac65838315c62f5210cb0a7cb404dc798d4a912a910f610ca0aa2f9624d5d553083f40db97e2e75080194dc26815eeb43ca65aef2df3295d61aac0533f3d7513038aed8f491062f2d08a6a28b4139b76d03f9f07ec04bdb8e35d69b6b74863bbd7cdeddd3e98ea77fdd16db2738dc9f0418a8dac91f9f6e08ec67469d8791ab390eed17d2af571b19eb8fad8092073ac0e91d291a891f3d5a546f0640f6ba492731bb85eb342e67a3e44426185251ba7f9dbe02956be1d9b777949c77b00b523a4ca0b75921d4f254e7ce69f848d15cff952286deb13ec76bd886a3fde9592ef9b8c5532d60dfe12b26b875babd22e446a6d7e5e27ecd2660f448a16153b7fe22fb7e6f8d3b6a66849e3a0568b071f9faebd1a63bf8ee8ed28d6e6058fa12ace9df531ebd81aba468fc08599dd2c3b03800d48ca66a2d4a9e4875080f8e29d6a876b0b4896aea08819c6ce387e91ca1466f43b4cf1585099752358b5c512387aa00eaa84e8b8de1d18f594908023400ed30d20a14c7900439339db91615455f5abc96a4bafbd53fcf0a95497528ca03f69913b757f6f493c9e55f82a6d78646f96b16b24114324cb5731a962a69e44a095ac1958fe8bcd26b4be9c53c788220127aaec1978f1c173afc4bc6c63beeacf0b631033dcac548746ab7db38a1a2cc0b3a85d371d6647b674abed386433992be8c4a54ae652c30c52eff109e1fd867d97bbaaa0a5bb69af43a8f03c9600202c9b085e3bacc9b740d27ce8d8ddb42667fe8afbdc006d3ef66551fa7dd90dadef4082db9fd1189a5743a7c7302ce2b145d8dec4ccef96106d3ac796ee25368e858fb7ff8e7445e9c9f72846469eabde6689fa77511310aa61548fa01ccaa19bb5c531393b8459b57ec7489bc9665586483e13e8c89433c9806ce10c43b7500892ac06a8983ec90ac5a7c0fc93c4c79fa3ca57107485e26219c7087ebc4e08ff44af35c94738cefc0828c0e850ab1a4a2c6e838957e1d903bb0812611fe19178639ba5478e036fd2504a242e94e58e628bbdece04b394e6df340317376e40dc62b62963a05d9013bed0d651ffca418c60c479113688ddcccf1509551863f0da5805977e5015ec356e1288d607b4d4b23c4f6967de048ebfef5bdc91c6d55f3741fba26f8d6effcd3ec7edf81d9036bed497b95b5b19dcf2b4cc2caf363025b271bb3573cfcb9b1fc1fa1c4edac199518be3d66a0c3451aae23bd977ed14dae4b8d23945e26dffc0dc3484a853fbde57039baf72d01464ea0454f4cd268f59169065586ee4f6b68edbe07cd72052644ba8ffda74f4f36ef51249c75f97b259edc0697f5a411dce67bd74d2fbe43ce76839f5349bab20006ec14fdcd517883fb292d398f24d5d0e22ca6f4d3b3d2643797242d05f0e73b676cc2f9aecb711185cdcc1cf9626fba728afc49486be0ff486d6ceccdba4b48fdcc932ea6d7c68af8c96bb860ea11f45af381affce9290e510edd2b45815df3203706a5e4f9d42a381a3f3816da4a9c9d7335912b8ca68772b437c8175e063d37b348886c17f60c9c97d60e10d09c0450db8e3cc3d4e56098d8ced75df7e2b813614fc8a20173ac49c1b3b68ba25d9cfc5b80a096705c8564063a081f706e840ef2732532b86e3d6bc4b0bc86870e29e095e3ed068d0f4ba6e741e52a53cde57bc61875aebb973bb4da4a37fd35b39520a9584ce2bc8827040555f10f46b7328757d056ed3c78f56a3c48d08c754f0bb585a35d8986c7ce0a4367411247b909aa629987f1176b226cda333ad59e2fb0363d1493e6429048b12988233d7df8421c9c41f4c7f4a9e9ee9d1c92b614f31a4505f554070782d0d51527ef31b8cbeaf805fba4110cdaba86b4aa7272c394cdc570812ad479df629cb3c82c18520398fa80c37714a270a45dae16ce022d27077914b0bd9858cc1ed2a8ef6721796e78d1523c138e4a03e306293246bc5f56a60f0489cd391d4ebed00ec84a347beb399be20959bcf3c6400983c05100e6506b67fb7142b71bcbda2aa54046724824dd452d68bee0698f6a72c29a9912170d8fd19b67ed534ad53c547307b0e8c07ade334456ffcbb40a36628128fa5f2616b3305a902aec2cfa5e6593e74ffd8dcb8dac0ac4f03ff27c69370098ee2f51b311e7587a66f9f64dbfececd7ea7a24d51f115ac98a9d61682f14b7b17dc74f5adecde3d971a31bc3206d8de0565d6814fa065a03b2a58f8b7dfa024eb7041789ae179f0adf57e3611251bae1a07359ff0c2a986a2ff6559b652058d0c18e880c8613e6da0bd2f591c911ba9ae4885d7624d40c3357955ee3b4d83e514051337db96c5302290ca74854f1d34477d81a4276ed05ba6ec71d4776c91f46df248f0888bcc18334d6638b4904315be7bf0723881eb073dd6abd186861f0a361271e4c85a8c35a2c83c5ca28433199f89104cf20e1116409eec6f71f0e08299353366d7729b3e4ed6028396e4cac99386acdba25b5a38fc2d34a5a562316407dd70bb7ac239ff7cb7d3f3e235078e5b341ed473ed80fce19129132028a2724d5103db9f5b869a7ac4715887c247aa8c0b48e71d2269e4ac6be2c012d5cb65e6cdbac63da8fb9a79d397d5d85b15143610ebd213410a1270bf6c305cdec84e5b73e931a35393f2c5072869e4c8ea88c0e4f76da191265db92008cef80562e5d40f97b77bb3ac9504a5f183fc8da001d92f92d1e65cf68072335d761df199c55b73b6cd807f76e309ee8967fd43a913b6f212817f319704897d74717d8f71b0f5e04e61e9caccf7e1c3626dbeb014167c4ea95871de7e4e6e87697b8d04175784647e7aade356aee9d273d85c72dc6525e0f3e7ff959330da1e1367842f20d0d9a2ecb29121126e636deaf2484fb736cb2b5fbd8fcd99c4ed8250ca9a0e5eb1207da4f6d28da4ffd2163f7dd867581d81d959b1bed4a1f596360415beafd5d6507f6db31a22cb6c936e3a87a76b143f65bfa972a1fe544a9d78fb5d684964a4f62c2c1df188c9b0820f24472e2bac47f6fdc13b22b8ff2c9b9c1dab5b3044026434d9a45980cfbd78ebdc3ad5d0e3684baa91e757e153e7c05c9ea8639cb28c721aa82db25f4ca376f0696e9b389fb3cc9113a690290619e26e473fb903d0b62b9e73dae2be9e38c1b9d7900299381ff87ab7b1ae298e027037b29ebb4296291c8f8585ee370fa0de38fcefcaab395fd40609a6e97d3efd9b5aa6eb45ee664a576ed17c73ccaec77e4057c7f7c744de4bca1525337d2950450f3f71786859ed493d1028171c023c8d2adff24ece28fe3a30c99705e3a3e59dbf85b06db9eaf252b53f30245a13efcc99ba9af98978695dfc5a0f0f745ac89ac814dfead9d01b1cd57a2435dafdd102716bdd9270d7c0d815009f0b7185aa42ab234470d19ef998fad96196a9527af00df4a56da2dbd10dac1cf6c7c3647b285aabef10a036c9350571cf8f537cccbb5732770379b0e89c5eedbb6ebd71bc62e221c64d6486fb27b6c3b6f9241ccc200bd82c08a48b919a230c146b081c5858c988d095657e0d2f8f3233645bbf92a862bbaf2c5b446f58ae616be1e5b881d33caf19e1647194d38ad38926606148ec25c1a42eef011d3c69ef51ad0bd03844f2b1d45668783abf9a2bfeef00740b14a77cfe228d7ed63bf3958207966a70c3f7a56df76625ad62b9aa777b5c928cb71198e222491e10d2469c3fc6b78bed0edf003eca1959510c49aeec3121e3be3684ba5c2fa10f9c477c930af1ce9eeb54533c06ecf121f83d7d0cd22cb07057c08228fcacc9ee1fd2f2ab9836379fe9b0f422b35443792b507b603619922ff7ea62e2525b24e09c89df7812cde49d1945b6b59ac0681da714c97bde44386ef3cc862950f2f9ab7df9e9f1e66ff950b8683eb6345c4da6efc674c865953ac5944335045ea178cec9b7c0768a14b8427fef460a1e4bdee7b68a01db14cb2e882e723daa4a5280173e26e63163b32c7944b634647ba7ffa52dbbaf44d10f4c4392f21c83b46d8f8770b4764bd9287d02e543c6463840b8b69b66c17884ba163649a9bfe6701830c5fab36b6093f5ba592de75efcddd08993767ea3c20f0b747e092e65a7f7050ff8a41b216ee2695a7128cd76f533c4898e59d958a5aa26f40a2c1533458bd414ef5c28071511b6d0950e17463296b596bb41d41222cff249276b826a8f1c3cccacd727ab8a6fab745bc9bffe42cc2b2c40fc720304adedcab5a08bb194470a9829f5bc15688750c9e2b19ff0cb992190f24477d24a888fc27441c55ce324d7381eb49ce26a8f29f9b6eeefef2414ffd84204cf298f06dd9085fdd621bd0e97fcc6841477bd4ad13deaeb109303f8aed97b3ff5ea9d2b88d0f89a4f8f606d1f33904050c8c4afda2ba49b5c7aed191aec9cb600e7aab034e710aa47fe75729384280f49c72d596972980a8558d8c7d48ac5998587f586f356024552a9032bccd1a6d0e06df4701adcacc3fce03afd5f7e49b83f47205ee3de6585d04a7417c0435fca4c6fdaac419165cd23bba13df1fac25216d37f906d485d4d20af2855e0d4a78d887152e8877d36364b82a85a36951eb820d697bc908f32924e7a5b716d3bc88879050df67b8cb509f3c8b780392c906773c8e79537c020a333c8ec786310b0c536226a80bf2fac2436e810386750636e2ffc19842258f1a051d1428039df74cbe4473c5dea7baacab48bbc7d77b5a3db4d905601824031b7723ae4f5f15a567428e6d00c25d98860d906c3bdbac62356b4182d59eaa0c0e8d160d98e92e9b653777771be687767fff0521dc1507b3bb21125dbf887f2a00a4730a32b48ebc8eb7fb6eaa9b26d9bb879b724aa2b72ff6280243f04bc5e6e9fe08095a78ce7eefd2f8a2148dce5c3a94c1782b5d077dfc58bc4f395c377da0e8d0a2bba6db7f475be7667744ac77644ac1d8cf8df744a25314b815d5d0687659bf27aae692f3a3ad98fb9011602b8000844ad1ffafc95a2e01eb034ea86b8cb3d39538c952989b86f88da9d66cccf38ea665fa10f1e5284d858f15dc9e79b2e8fc6054c0513288b19ba6bc5f87e22b19e939e6eac79dce7cfe8f429289f1b367b49d3c715a1ab60f0b618a6ca65f1d1a73ed40585e49ecd47726f60ce991a4ebdbd2a9bf5d87abf391fa85753a08eb0d7f675d866d5ed857d067d4e4fed753e21ae60b4bd1700502ace70ad3672deb19d4b285104c42abdd61ce27379ab08eb48da2544debcb3502a45d41a3061facb1acd99af94289eefe5d93a5630ec900aa7c289163af887288db81e5c075b82606766d2ff44325079fcb4fd5bcb4c0dc9eeaf4859ca85452b9326bb9c3a0aca8345d5f0d92cb2e77a81faee9cdf7c88894b7c5b6d635ac7e211bbcaf1c65054dc86de764587577c9f8bee1947e6c31aefe712bb3f75b6acdaf62a4179da001de6b137203be223cc4962b176fc542b10702bf9050caa750155eddddf70b5dea80ffe33ca0df4a5081e29d74c4f67eb09249a93b6371636aad4efb1f32f8f7abd5037cdf592ec5947aabb52a4cab04541df811a76aeb8dba0d1ccb96468"}}, @algo_auth={0x74, 0x1, {{'sha3-224\x00'}, 0x150, "c9de2bd86961f34ee180cff3ed672a50eb81401aab5a3953a4a628074c010ce2f10c98df0b0113686958"}}]}, 0x121c}, 0x1, 0x0, 0x0, 0x800}, 0x8000) [ 1579.255167] binder: 20503:20508 BC_REQUEST_DEATH_NOTIFICATION invalid ref 4 [ 1579.282648] binder: 20500:20516 unknown command -1353097711 [ 1579.289034] binder: 20500:20516 ioctl c0306201 20002340 returned -22 [ 1579.299555] binder: 20500:20518 unknown command -1353097711 13:17:57 executing program 0: perf_event_open(&(0x7f0000000040)={0x2, 0x70, 0x3e5}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f00000021c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000002340)={0xb5, 0x0, &(0x7f00000000c0)=ANY=[@ANYBLOB="1263484000000000b6a571ac965f26c50d500dae115e59afcd8a338d8b2727193c56d4ebef60c214b766ffde6cff6ceef2baa2594a53a0117e77afd5d58e8a35afdae81b258585ce769507333c0238790d5ed750bf1d6ca2a873050056528fce7becfd12f165ac43a826d3462822ff8f29ea992d4e208847cf4fc10ca00b87b5ce2523fa477bad0be1c97e4398aa2ac81d973b5a871d8e0b295e436cd8415f19088c6c82c85f4ed1fac41da062bc6dbfb8eac4276c"], 0x0, 0x0, &(0x7f00000022c0)}) 13:17:57 executing program 6: clone(0x802102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000040), 0xffffffffffffffff) r0 = dup2(0xffffffffffffffff, 0xffffffffffffffff) ioctl$BLKFRASET(r0, 0x1264, &(0x7f0000000640)=0x8) r1 = syz_open_dev$sndtimer(&(0x7f0000000680)='/dev/snd/timer\x00', 0x0, 0x0) r2 = getpid() vmsplice(r1, &(0x7f00000004c0)=[{&(0x7f0000000240)="1d5ea5d91bb38dfe0d2b18b4d81900083f17e1749d11c9f66ea9e64851bf5f367d5e77a70375b21c3623f38af935c65568bb822de10ebd162ba94c163c1afaa614e4616527189c48d2f6df732088232794c270bac0e28c07e52f32739da5417914c2e304f9269a59de39", 0x6a}, {&(0x7f00000002c0)="87c6ff4a2780c51407f7a06650c99f1ca78eb886c04c8811aff26048a121c1a1cbc20086cffa1ce4a4e79043d60e2fbd7a41f193c6d666bf15e7192d590315ba5b95df16cbf4ec125ad65bd1514e61a65738318019130b24ed5bd9f574c3789d8a11a55f0a95ef3ff973b713adcd972ae46c246d6bad0bc56158e8eb01c547b8b1dd164df5caee134d2daf1b26f67556ced520f8ec7004e114c2a949e5ab8ec905133b5197dfa0c7b893098796769410467d5bcf21289c3f8fd7194b4a2fc4", 0xbf}, {&(0x7f0000000380)="b7b21ce966c04b5b7536260b064638ab7c0143b1ad6f5ae9bd34115b843677fd1e725d4612dc236cc7594322d9792c329829eaaf4d9931986ab0f42e653daa99e78233ecbb50", 0x46}, {&(0x7f0000000400)="6203d36546f69dfca91f1732b94396715eb7879795ae93e700307b9f2cdc6037a128233b3850849da1589cb3804c6ee1476da0ec5b95e4a3e4e1a75636b2024f447e448456d507f01969709b1519a6d867b3435afa86623944e8826caae4a74c22c0a0b6d4c9235c227471eb87e2c60ba4950a921a0477e2d005ba15bd6cb1004eb693cfd9", 0x85}], 0x4, 0x2) socketpair$inet6_icmp_raw(0xa, 0x3, 0x3a, &(0x7f0000000540)) getsockopt$inet_sctp6_SCTP_DELAYED_SACK(r0, 0x84, 0x10, &(0x7f0000000580)=@sack_info={0x0, 0x9, 0x200}, &(0x7f00000005c0)=0xc) setsockopt$inet_sctp_SCTP_ENABLE_STREAM_RESET(r0, 0x84, 0x76, &(0x7f0000000600)={r3, 0xfffffffffffffffa}, 0x8) ioctl$SG_SET_FORCE_PACK_ID(r0, 0x227b, &(0x7f0000000100)) sched_setscheduler(r2, 0x5, &(0x7f0000000200)) ioctl$SNDRV_TIMER_IOCTL_GPARAMS(r1, 0x40485404, &(0x7f0000000080)={{0x0, 0x3}, 0x0, 0x2000000000000000}) openat$vsock(0xffffffffffffff9c, &(0x7f0000000500)='/dev/vsock\x00', 0x101000, 0x0) ppoll(&(0x7f0000000140)=[{r1, 0x400}, {r0, 0x460}], 0x2, &(0x7f0000000180)={0x0, 0x1c9c380}, &(0x7f00000001c0)={0x3ff}, 0x8) [ 1579.378833] binder: 20500:20518 ioctl c0306201 20002340 returned -22 13:17:57 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r0, &(0x7f0000942000)={0x2, 0x4e20, @multicast1}, 0x10) sendmsg$key(0xffffffffffffffff, &(0x7f0000f56000)={0x0, 0x0, &(0x7f00008feff0)={&(0x7f0000000500)=ANY=[@ANYBLOB="020300090a1500000000000000000000030006190000000002000000e0000001003f00000000000002000100e625aa66dcef85847e479eb3c49000000400000000fd003e"], 0x44}}, 0x0) add_key(&(0x7f0000000080)='logon\x00', &(0x7f0000000100)={0x73, 0x79, 0x7a, 0x1}, &(0x7f0000001240), 0x0, 0xfffffffffffffff8) get_mempolicy(&(0x7f0000000000), &(0x7f00000001c0), 0x1ff, &(0x7f0000fff000/0x1000)=nil, 0x3) setsockopt$sock_int(r0, 0x1, 0x3c, &(0x7f0000d4effc)=0x1, 0x4) connect$inet(r0, &(0x7f0000000000)={0x2, 0x4e20, @dev={0xac, 0x14, 0x14, 0x18}}, 0x10) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f00000001c0)='tunl0\x00', 0x5) sendto$inet(r0, &(0x7f00006d1fd4)="db", 0x1, 0x4000010, &(0x7f00004daff0)={0x2, 0x0, @loopback, [0x0, 0x0, 0x0, 0x14b8010000000000]}, 0x10) 13:17:57 executing program 4: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = gettid() perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x3e5}, 0x0, 0x0, 0xffffffffffffffff, 0x0) fcntl$setown(r0, 0x8, r1) bind$inet6(r0, &(0x7f0000807fe4)={0xa, 0x4e22}, 0x1c) sendto$inet6(r0, &(0x7f0000000380), 0x0, 0x200408d4, &(0x7f000072e000)={0xa, 0x4e22, 0x0, @loopback}, 0x1c) sendto$inet6(r0, &(0x7f0000ad6fad)='\x00', 0x1, 0x3fffffd, &(0x7f0000254000)={0xa, 0x0, 0x0, @loopback={0xa000000}}, 0x1c) [ 1579.573292] binder: 20546:20547 got reply transaction with no transaction stack [ 1579.581598] binder: 20546:20547 transaction failed 29201/-71, size -2378069141715001105-6458930368147685228 line 2762 [ 1579.596582] binder: 20546:20548 got reply transaction with no transaction stack [ 1579.604217] binder: 20546:20548 transaction failed 29201/-71, size -2378069141715001105-6458930368147685228 line 2762 [ 1579.615768] binder: undelivered TRANSACTION_ERROR: 29201 13:17:57 executing program 1: r0 = socket$netlink(0x10, 0x3, 0x8000000004) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_TCP_CONGESTION(r1, 0x6, 0xd, &(0x7f0000000180)='vegas\x00', 0x6) bind$inet6(r1, &(0x7f00001fefe4)={0xa, 0x4e22}, 0x1c) sendto$inet6(r1, &(0x7f0000000100), 0x8d2d601e8976aa5, 0x20000004, &(0x7f000031e000)={0xa, 0x4e22}, 0x1c) writev(r0, &(0x7f0000000100)=[{&(0x7f0000000000)="580000001400192340834b80040d8c560a067f5f8aff81004e220000000058000b4824ca944f64009400050028925aa8000000000000008000f0fffeffff09000000fff5dd00000010000100000c0900fcff0000040e05a5", 0x58}], 0x1) 13:17:57 executing program 7: r0 = openat$cuse(0xffffffffffffff9c, &(0x7f0000000080)='/dev/cuse\x00', 0x2, 0x0) clone(0x1002102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000640), 0xffffffffffffffff) r1 = getpid() sched_setscheduler(r1, 0x5, &(0x7f0000000000)) write$FUSE_NOTIFY_DELETE(r0, &(0x7f0000000040)={0x29, 0x6, 0x0, {0x0, 0x0, 0x5}}, 0x29) 13:17:57 executing program 3: r0 = openat$cuse(0xffffffffffffff9c, &(0x7f0000000080)='/dev/cuse\x00', 0x2, 0x0) clone(0x1002102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000640), 0xffffffffffffffff) r1 = getpid() sched_setscheduler(r1, 0x5, &(0x7f0000000000)) write$FUSE_NOTIFY_DELETE(r0, &(0x7f0000000040)={0x29, 0x4, 0x0, {0x0, 0x800000000000000}}, 0x29) 13:17:57 executing program 5: r0 = syz_open_dev$binder(&(0x7f00000021c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000002340)={0x34, 0x0, &(0x7f0000002240)=[@request_death={0x400c630e, 0x4, 0x4}, @increfs={0x40046304, 0x4}, @increfs_done={0x40106308, 0x0, 0x3}, @increfs], 0x77, 0x0, &(0x7f00000022c0)="b3cd0976d8e2af743c6f523efe14fd20c3c3dd2572734282a761e1b4304e2599c85f198cc82bd5d0c7214edca2f9ea7b875ff7047ec0784fbb354e15fd3f7d837f533597d5082692a6f2fb748da3cc4157188f7f2a5477ded56f72f5b75c96872db429e44b8fcd781d96dead77a0b58b7af9085a208a22"}) 13:17:57 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r0, &(0x7f0000942000)={0x2, 0x4e20, @multicast1}, 0x10) sendmsg$key(0xffffffffffffffff, &(0x7f0000f56000)={0x0, 0x0, &(0x7f00008feff0)={&(0x7f0000000500)=ANY=[@ANYBLOB="020300090a1500000000000000000000030006190000000002000000e0000001003f00000000000002000100e625aa66dcef85847e479eb3c49000000400000000fd003e"], 0x44}}, 0x0) add_key(&(0x7f0000000080)='logon\x00', &(0x7f0000000100)={0x73, 0x79, 0x7a, 0x1}, &(0x7f0000001240), 0x0, 0xfffffffffffffff8) get_mempolicy(&(0x7f0000000000), &(0x7f00000001c0), 0x1ff, &(0x7f0000fff000/0x1000)=nil, 0x3) setsockopt$sock_int(r0, 0x1, 0x3c, &(0x7f0000d4effc)=0x1, 0x4) connect$inet(r0, &(0x7f0000000000)={0x2, 0x4e20, @dev={0xac, 0x14, 0x14, 0x18}}, 0x10) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f00000001c0)='tunl0\x00', 0x5) sendto$inet(r0, &(0x7f00006d1fd4)="db", 0x1, 0x4000010, &(0x7f00004daff0)={0x2, 0x0, @loopback, [0x0, 0x0, 0x0, 0xe803000000000000]}, 0x10) 13:17:57 executing program 6: clone(0x802102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000040), 0xffffffffffffffff) r0 = syz_open_dev$sndtimer(&(0x7f0000000000)='/dev/snd/timer\x00', 0x0, 0x0) pause() r1 = getpid() sched_setscheduler(r1, 0x5, &(0x7f0000000200)) ioctl$SNDRV_TIMER_IOCTL_GPARAMS(r0, 0x40485404, &(0x7f0000000240)={{}, 0x0, 0x2000000000000000}) [ 1579.621396] binder: undelivered TRANSACTION_ERROR: 29201 13:17:57 executing program 4: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = gettid() perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x3e5}, 0x0, 0x0, 0xffffffffffffffff, 0x0) fcntl$setown(r0, 0x8, r1) bind$inet6(r0, &(0x7f0000807fe4)={0xa, 0x4e22}, 0x1c) sendto$inet6(r0, &(0x7f0000000380), 0x0, 0x200408d4, &(0x7f000072e000)={0xa, 0x4e22, 0x0, @loopback}, 0x1c) sendto$inet6(r0, &(0x7f0000ad6fad)='\x00', 0x1, 0x3fffffd, &(0x7f0000254000)={0xa, 0x0, 0x0, @loopback={0x4b8}}, 0x1c) 13:17:57 executing program 0: perf_event_open(&(0x7f0000000040)={0x2, 0x70, 0x3e5}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f00000021c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000002340)={0xb5, 0x0, &(0x7f00000000c0)=ANY=[@ANYBLOB="0263044000000000b6a571ac965f26c50d500dae115e59afcd8a338d8b2727193c56d4ebef60c214b766ffde6cff6ceef2baa2594a53a0117e77afd5d58e8a35afdae81b258585ce769507333c0238790d5ed750bf1d6ca2a873050056528fce7becfd12f165ac43a826d3462822ff8f29ea992d4e208847cf4fc10ca00b87b5ce2523fa477bad0be1c97e4398aa2ac81d973b5a871d8e0b295e436cd8415f19088c6c82c85f4ed1fac41da062bc6dbfb8eac4276c"], 0x0, 0x0, &(0x7f00000022c0)}) 13:17:57 executing program 5: r0 = syz_open_dev$binder(&(0x7f00000021c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000002340)={0x34, 0x0, &(0x7f0000002240)=[@request_death={0x400c630e, 0x4, 0x4}, @increfs={0x40046304, 0x4}, @increfs_done={0x40106308, 0x0, 0x3}, @increfs], 0x77, 0x0, &(0x7f00000022c0)="b3cd0976d8e2af743c6f523efe14fd20c3c3dd2572734282a761e1b4304e2599c85f198cc82bd5d0c72a4edca2f9ea7b875ff7047ec0784fbb354e15fd3f7d837f533597d5082692a6f2fb748da3cc4157188f7f2a5477ded56f72f5b75c96872db429e44b8fcd781d96dead77a0b58b7af9085a208a22"}) 13:17:57 executing program 7: r0 = openat$cuse(0xffffffffffffff9c, &(0x7f0000000080)='/dev/cuse\x00', 0x2, 0x0) clone(0x1002102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000640), 0xffffffffffffffff) r1 = getpid() sched_setscheduler(r1, 0x5, &(0x7f0000000000)) write$FUSE_NOTIFY_DELETE(r0, &(0x7f0000000040)={0x29, 0x6, 0x0, {0x0, 0x0, 0x800000000000000}}, 0x29) [ 1579.702886] binder: 20556:20560 BC_REQUEST_DEATH_NOTIFICATION invalid ref 4 13:17:57 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r0, &(0x7f0000942000)={0x2, 0x4e20, @multicast1}, 0x10) sendmsg$key(0xffffffffffffffff, &(0x7f0000f56000)={0x0, 0x0, &(0x7f00008feff0)={&(0x7f0000000500)=ANY=[@ANYBLOB="020300090a1500000000000000000000030006190000000002000000e0000001003f00000000000002000100e625aa66dcef85847e479eb3c49000000400000000fd003e"], 0x44}}, 0x0) add_key(&(0x7f0000000080)='logon\x00', &(0x7f0000000100)={0x73, 0x79, 0x7a, 0x1}, &(0x7f0000001240), 0x0, 0xfffffffffffffff8) get_mempolicy(&(0x7f0000000000), &(0x7f00000001c0), 0x1ff, &(0x7f0000fff000/0x1000)=nil, 0x3) setsockopt$sock_int(r0, 0x1, 0x3c, &(0x7f0000d4effc)=0x1, 0x4) connect$inet(r0, &(0x7f0000000000)={0x2, 0x4e20, @dev={0xac, 0x14, 0x14, 0x18}}, 0x10) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f00000001c0)='tunl0\x00', 0x5) sendto$inet(r0, &(0x7f00006d1fd4)="db", 0x1, 0x4000010, &(0x7f00004daff0)={0x2, 0x0, @loopback, [0x0, 0x0, 0x0, 0x1a0ffffffff]}, 0x10) 13:17:57 executing program 5: r0 = syz_open_dev$binder(&(0x7f00000021c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000002340)={0x34, 0x0, &(0x7f0000002240)=[@request_death={0x400c630e, 0x4, 0x4}, @increfs={0x40046304, 0x4}, @increfs_done={0x40106308, 0x0, 0x3}, @increfs], 0x77, 0x0, &(0x7f00000022c0)="b3cd0976d8e2af743c6f523efe14fd20c3c3dd2572734282a761e1b4304e2599c85f198cc82bd5d0c7374edca2f9ea7b875ff7047ec0784fbb354e15fd3f7d837f533597d5082692a6f2fb748da3cc4157188f7f2a5477ded56f72f5b75c96872db429e44b8fcd781d96dead77a0b58b7af9085a208a22"}) [ 1579.837228] binder: 20579:20584 BC_REQUEST_DEATH_NOTIFICATION invalid ref 4 13:17:57 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r0, &(0x7f0000942000)={0x2, 0x4e20, @multicast1}, 0x10) sendmsg$key(0xffffffffffffffff, &(0x7f0000f56000)={0x0, 0x0, &(0x7f00008feff0)={&(0x7f0000000500)=ANY=[@ANYBLOB="020300090a1500000000000000000000030006190000000002000000e0000001003f00000000000002000100e625aa66dcef85847e479eb3c49000000400000000fd003e"], 0x44}}, 0x0) add_key(&(0x7f0000000080)='logon\x00', &(0x7f0000000100)={0x73, 0x79, 0x7a, 0x1}, &(0x7f0000001240), 0x0, 0xfffffffffffffff8) get_mempolicy(&(0x7f0000000000), &(0x7f00000001c0), 0x1ff, &(0x7f0000fff000/0x1000)=nil, 0x3) setsockopt$sock_int(r0, 0x1, 0x3c, &(0x7f0000d4effc)=0x1, 0x4) connect$inet(r0, &(0x7f0000000000)={0x2, 0x4e20, @dev={0xac, 0x14, 0x14, 0x18}}, 0x10) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f00000001c0)='tunl0\x00', 0x5) sendto$inet(r0, &(0x7f00006d1fd4)="db", 0x1, 0x4000010, &(0x7f00004daff0)={0x2, 0x0, @loopback, [0x0, 0x0, 0x0, 0xa0008000]}, 0x10) 13:17:58 executing program 6: r0 = openat$selinux_policy(0xffffffffffffff9c, &(0x7f0000000040)='/selinux/policy\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_GETRESOURCES(r0, 0xc04064a0, &(0x7f0000000180)={&(0x7f0000000080)=[0x0, 0x0, 0x0], &(0x7f00000000c0)=[0x0], &(0x7f0000000100)=[0x0, 0x0, 0x0, 0x0, 0x0], &(0x7f0000000140)=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0], 0x3, 0x1, 0x5, 0x8}) r1 = syz_open_dev$sndtimer(&(0x7f0000000000)='/dev/snd/timer\x00', 0x0, 0x0) r2 = getpid() sched_setscheduler(r2, 0x5, &(0x7f0000000200)) ioctl$SNDRV_TIMER_IOCTL_GPARAMS(r1, 0x40485404, &(0x7f0000000240)={{}, 0x0, 0x2000000000000000}) [ 1579.982611] binder: 20597:20598 BC_REQUEST_DEATH_NOTIFICATION invalid ref 4 13:17:58 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r0, &(0x7f0000942000)={0x2, 0x4e20, @multicast1}, 0x10) sendmsg$key(0xffffffffffffffff, &(0x7f0000f56000)={0x0, 0x0, &(0x7f00008feff0)={&(0x7f0000000500)=ANY=[@ANYBLOB="020300090a1500000000000000000000030006190000000002000000e0000001003f00000000000002000100e625aa66dcef85847e479eb3c49000000400000000fd003e"], 0x44}}, 0x0) add_key(&(0x7f0000000080)='logon\x00', &(0x7f0000000100)={0x73, 0x79, 0x7a, 0x1}, &(0x7f0000001240), 0x0, 0xfffffffffffffff8) get_mempolicy(&(0x7f0000000000), &(0x7f00000001c0), 0x1ff, &(0x7f0000fff000/0x1000)=nil, 0x3) setsockopt$sock_int(r0, 0x1, 0x3c, &(0x7f0000d4effc)=0x1, 0x4) connect$inet(r0, &(0x7f0000000000)={0x2, 0x4e20, @dev={0xac, 0x14, 0x14, 0x18}}, 0x10) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f00000001c0)='tunl0\x00', 0x5) sendto$inet(r0, &(0x7f00006d1fd4)="db", 0x1, 0x4000010, &(0x7f00004daff0)={0x2, 0x0, @loopback, [0x0, 0x0, 0x0, 0xa6ffffff]}, 0x10) 13:17:58 executing program 7: r0 = openat$cuse(0xffffffffffffff9c, &(0x7f0000000080)='/dev/cuse\x00', 0x2, 0x0) clone(0x1002102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000640), 0xffffffffffffffff) r1 = getpid() sched_setscheduler(r1, 0x5, &(0x7f0000000000)) write$FUSE_NOTIFY_DELETE(r0, &(0x7f0000000040)={0x29, 0x6, 0x0, {0x0, 0x0, 0x300000000000000}}, 0x29) [ 1580.249890] binder: BC_ACQUIRE_RESULT not supported [ 1580.255478] binder: 20620:20623 ioctl c0306201 20002340 returned -22 [ 1580.267354] binder: BC_ACQUIRE_RESULT not supported [ 1580.272827] binder: 20620:20624 ioctl c0306201 20002340 returned -22 [ 1580.542110] WARNING: CPU: 1 PID: 20569 at net/ipv4/tcp.c:2415 tcp_close+0xf59/0x1300 [ 1580.550374] Kernel panic - not syncing: panic_on_warn set ... [ 1580.550374] [ 1580.557755] CPU: 1 PID: 20569 Comm: syz-executor1 Not tainted 4.19.0-rc2+ #8 [ 1580.564940] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 1580.574290] Call Trace: [ 1580.576891] dump_stack+0x1c4/0x2b4 [ 1580.580526] ? dump_stack_print_info.cold.2+0x52/0x52 [ 1580.585741] panic+0x238/0x4e7 [ 1580.588942] ? add_taint.cold.5+0x16/0x16 [ 1580.593101] ? __warn.cold.8+0x148/0x1ba [ 1580.597175] ? tcp_close+0xf59/0x1300 [ 1580.600984] __warn.cold.8+0x163/0x1ba [ 1580.604881] ? rcu_bh_qs+0xc0/0xc0 [ 1580.608431] ? tcp_close+0xf59/0x1300 [ 1580.612312] report_bug+0x254/0x2d0 [ 1580.615960] do_error_trap+0x1fc/0x4d0 [ 1580.619858] ? math_error+0x3f0/0x3f0 [ 1580.623680] ? trace_hardirqs_off_thunk+0x1a/0x1c [ 1580.628532] ? trace_hardirqs_on_caller+0x310/0x310 [ 1580.633572] ? trace_hardirqs_off_thunk+0x1a/0x1c [ 1580.638432] do_invalid_op+0x1b/0x20 [ 1580.642151] invalid_op+0x14/0x20 [ 1580.645614] RIP: 0010:tcp_close+0xf59/0x1300 [ 1580.650030] Code: ff ff e8 7a be f5 fa be 07 00 00 00 48 89 df e8 ad e5 fe ff 4c 8d 63 28 48 89 df e8 01 db fd ff e9 cc f6 ff ff e8 57 be f5 fa <0f> 0b e9 55 f8 ff ff e8 4b be f5 fa be 07 00 00 00 48 89 df e8 7e [ 1580.668937] RSP: 0018:ffff8801bc83f660 EFLAGS: 00010246 [ 1580.674308] RAX: 0000000000040000 RBX: ffff880113475300 RCX: ffffc900024df000 [ 1580.681577] RDX: 0000000000040000 RSI: ffffffff868910e9 RDI: 0000000000000005 [ 1580.688847] RBP: ffff8801bc83f720 R08: ffff880082594040 R09: ffffed002268ea71 [ 1580.696120] R10: ffffed002268ea71 R11: ffff88011347538b R12: ffff880113475328 [ 1580.703388] R13: ffff880113475388 R14: ffff880113475380 R15: 0000000000000007 [ 1580.710698] ? tcp_close+0xf59/0x1300 [ 1580.714526] ? tcp_check_oom+0x530/0x530 [ 1580.718600] ? ipv6_sock_mc_close+0x162/0x1d0 [ 1580.723099] ? ip_mc_drop_socket+0x20b/0x270 [ 1580.727513] ? down_write+0x8a/0x130 [ 1580.731241] inet_release+0x104/0x1f0 [ 1580.735056] inet6_release+0x50/0x70 [ 1580.738780] __sock_release+0xd7/0x250 [ 1580.742684] ? __sock_release+0x250/0x250 [ 1580.746839] sock_close+0x19/0x20 [ 1580.750296] __fput+0x385/0xa30 [ 1580.753591] ? get_max_files+0x20/0x20 [ 1580.757482] ? trace_hardirqs_on+0xbd/0x310 [ 1580.761813] ? kasan_check_read+0x11/0x20 [ 1580.765970] ? task_work_run+0x1af/0x2a0 [ 1580.770039] ? __bpf_trace_preemptirq_template+0x30/0x30 [ 1580.775504] ? kasan_check_write+0x14/0x20 [ 1580.779744] ? do_raw_spin_lock+0xc1/0x200 [ 1580.783990] ____fput+0x15/0x20 [ 1580.787275] task_work_run+0x1e8/0x2a0 [ 1580.791173] ? task_work_cancel+0x240/0x240 [ 1580.795502] ? release_sock+0x1ec/0x2c0 [ 1580.799483] ? release_sock+0x1ec/0x2c0 [ 1580.803472] get_signal+0x155e/0x1980 [ 1580.807281] ? lock_sock_nested+0x9a/0x120 [ 1580.811518] ? __release_sock+0x3a0/0x3a0 [ 1580.815681] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 1580.821227] ? check_preemption_disabled+0x48/0x200 [ 1580.826251] ? ptrace_notify+0x130/0x130 [ 1580.830323] ? kick_process+0xed/0x170 [ 1580.834226] ? task_work_add+0x123/0x1f0 [ 1580.838300] ? cpumask_weight.constprop.5+0x3f/0x3f [ 1580.843328] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 1580.848875] ? security_socket_sendmsg+0x94/0xc0 [ 1580.853651] do_signal+0x9c/0x21e0 [ 1580.857208] ? __sys_sendto+0x475/0x670 [ 1580.861196] ? __ia32_sys_getpeername+0xb0/0xb0 [ 1580.865882] ? setup_sigcontext+0x7d0/0x7d0 [ 1580.870220] ? __sanitizer_cov_trace_const_cmp1+0x1a/0x20 [ 1580.875759] ? fput+0x130/0x1a0 [ 1580.879049] ? __sys_bind+0x1d1/0x440 [ 1580.882859] ? exit_to_usermode_loop+0x8c/0x380 [ 1580.887535] ? exit_to_usermode_loop+0x8c/0x380 [ 1580.892218] ? lockdep_hardirqs_on+0x421/0x5c0 [ 1580.896811] ? trace_hardirqs_on+0xbd/0x310 [ 1580.901136] ? fput+0x130/0x1a0 [ 1580.904420] ? do_syscall_64+0x6be/0x820 [ 1580.908486] ? __bpf_trace_preemptirq_template+0x30/0x30 [ 1580.913945] ? __x64_sys_futex+0x47f/0x6a0 [ 1580.918189] ? do_syscall_64+0x9a/0x820 [ 1580.922175] ? do_syscall_64+0x9a/0x820 [ 1580.926167] exit_to_usermode_loop+0x2e5/0x380 [ 1580.930763] ? syscall_slow_exit_work+0x520/0x520 [ 1580.935617] ? __x64_sys_sendto+0xe1/0x1a0 [ 1580.939866] do_syscall_64+0x6be/0x820 [ 1580.943770] ? entry_SYSCALL_64_after_hwframe+0x3e/0xbe [ 1580.949143] ? syscall_return_slowpath+0x5e0/0x5e0 [ 1580.954082] ? trace_hardirqs_on_caller+0x310/0x310 [ 1580.959103] ? prepare_exit_to_usermode+0x3b0/0x3b0 [ 1580.964127] ? recalc_sigpending_tsk+0x180/0x180 [ 1580.968889] ? kasan_check_write+0x14/0x20 [ 1580.973141] ? trace_hardirqs_off_thunk+0x1a/0x1c [ 1580.978005] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 1580.983207] RIP: 0033:0x457099 [ 1580.986427] Code: fd b4 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 cb b4 fb ff c3 66 2e 0f 1f 84 00 00 00 00 [ 1581.005330] RSP: 002b:00007f6196a7cc78 EFLAGS: 00000246 ORIG_RAX: 000000000000002c [ 1581.013046] RAX: 00000000004e3f90 RBX: 00007f6196a7d6d4 RCX: 0000000000457099 [ 1581.020327] RDX: 08d2d601e8976aa5 RSI: 0000000020000100 RDI: 0000000000000004 [ 1581.027599] RBP: 00000000009300a0 R08: 000000002031e000 R09: 000000000000001c [ 1581.034870] R10: 0000000020000004 R11: 0000000000000246 R12: 00000000ffffffff [ 1581.042145] R13: 00000000004d4cc8 R14: 00000000004c91af R15: 0000000000000000 [ 1581.049866] Dumping ftrace buffer: [ 1581.053758] (ftrace buffer empty) [ 1581.058135] Kernel Offset: disabled [ 1581.061765] Rebooting in 86400 seconds..