87f832a0f027aace9e1955a12a0ea28c84bae782e812eaa0439264fc44f05038faa5767bb9fff0f89985e8be7a86c84c1552664db3c1918ab1db12bcbd32cc14384ca25202f500f6492cd00f12f7243b98a85aad93aebec2bb3c0271769b12fc14f1a2ee23bb2f154ee013a03831324a6f20eae845af2c91f6680bd09a41a126a3b8fc82757786b237e9325e34f7478a278d67f5fa92f0509d121caf8507d50991bb06b23b03cc329586367d6f098e5d721dd117cbe7a16bf79198588bb4227e1821f386911d2de9b63a4c98886183114245be67008e011d2cf01b852779bbc2bd7fd2c1e56cd2a0928b990bffdf43d022872aba3a986c4e44aab189a580cf02e5ae68821b64c2508bf9a0cd9884f829be99c6366dc44071b2603193bc3bba61dddf9597f9a39312665f66f3df177018f3c744ad253f97e5aea6f6efa0b4cff711319875c11ac9bd5624c585e1c860ef3183f43c7c3a0f6d4ba17a014b80ed2c35a33cf3a7f7b498cce9d2fd747cc833b7a90126f7a79419f7f4a96c973b95bef66c2715e85196e6e273e5e1e34b882e57d9cbf1b0669dbc9dd0d04a140254bf4c7189fbcda54b87fb82e3a47f7389114eca84e5adfa6c2b1fadca9572aa3700bdeb30b866964c1551fdf87ed574108e91425de478f5651ae0fced0f27dd4ef9c292d71f868c51278fe42ebc0af8e25130276b5c2e401999fdde18e66c8bd1cb5ae273f058376d815ec19fa7b4a1153ca192164ff8ba5626c8c2f20146fd7660fd5bd432b4cc842f6df09c67e060f89af42fe8859052046cdecdb7bc5e04c11ddfa540ca36bce516947a68c364ccd81cd8fb8936b9368d00b764ec45c3b1e5f8e76434e45416f8ad86a152a40fee0d71d72d36151682a7f83b21e617fdd4b5c2d93e14cb26e8903dafd0b313f36f77bb115cb9dae779dc48b20520a314bf6fc06afa2bdef6b16ce6d97ddff331384dfd67971f1d9a7c6806b3fe045a4f926fae12f1a8a890dd1fab0b234e02c6a4e4962198c376578338428d5dde92b086aab4479dd4c35c0fa7acf4134b22067f6766773a88c1a286ecee49ac83a3b3dff2841c46d9965ffa72af20244b77effad953e93c0a3fd809a36512e72a2b6be71f3d6e9528b76d16940c51155b8a62da1eb8a6bbb2d4c0c5e9a11f8975b3e19c23b61ac6e1cdf2630296e877d9b79b91e4e3a50a6f7b62930b39c155f41e5433dfcdcb318da49b8b8718fa583284cabbdb9482adaaa2b8a488bb0db8350edfca4fdb517cc52fb8a9a50e47a225b53f6dfda98a2deb39facede4ee4a6b063d8b35698fca9d27af5a137226d879b127b759e91546f369818f62ea898537f1b742e648390949ab7054f1534f086fb88d707c627471428904034f707afa49fe53e5c63eb0248aeabc7ee6a2ab6734fb1de48a4f28e139f8539e9bc458dd46d6f345b3eb3e7f1265666fe0ee8713d4103174cf1414e912c8790bc15825ceac9ce1216fb873f19e460d6142ef5530b660faf7c65b07fbc7991acd23184f94e248357b1c3d14b8dcb496121fd69954e3570acd3fd63dd7613101e0bfcf065015e36336d6d4fd618fac7a2c0145a0b60fda8bf7970716fe181865ef1b25fdbfc597972412cd8f056e06f7f3cd3f6ab9a20256fd85533fb49f25571bd1683dc0f6e73ca008bcd5edae811f6dfd572b94d6a2520b0d02f9475e09bb172a1ee9759dd5ec4516e860599539abf01a3a549eb078f0981a04ba0c6a9a149ad375066e6aee95d8cdaaf656bdf5f78e06296d862c88344b6178547bc138625a4372c2fe71654613e091ffcb9f2864696d095c35dd79ea77248965af71eb0d2df04b2d6758780a586eb0442e749cd64a06720b59aed807306bd2d2ff2903bf40e56ac53219e16864a20bd4e548fd5a1547f35a844702b02cf284b0bc44f7dc05e10371618e1e950af5809bab70c730a90bb1d24b0794e211cb1567be058c2c146352741258c699fdea6df168898feacf2fe13753776cc4390f9d384a33bb12558edf370214e01b1938e600aed17f4c874440f0ba5c6fa05bef430c7be464ab4f20996c8bd5bce58f07eab61221a8c17388bac46d9eea81aaff5f133a03c0c3f47bca16d8ee9d749596cf1b875f6625aeebb8f028c9bee574b2664cd5095ca1e573f473d98c69146ab4f042f2a3709375cc6a4b3baf981da0fdf6d7f23520b8c654f68f932794bcd1bf5e93ae5be140fe803f549c20e5e986bbe32186b879a025ba816d545702becd6e1bf65ceae682a5e291d1f92d37c5f3b4cbed0ddd9b9cf6d99fd1a05a3b4763173003c321ab66bdf368164572c092641f0a69ad74ead3f20230807ee7e9b552c93e07050412ee6e04b8832a7253bd5f59f169b902a35c0de77e75199bade7e176235515ffcace312c27331a5a1fad5af075bd61dfd25f0c574b90069ebfa5772feca49c275f91ac95c0507c6661b37d971de8cf2a8797dc99857a8905360e94778f648140fab49133e683b8da449bf9e8d683bbacb782f6172879e60f065fed318853fb5729ca9f3c9e894a7cdf74226dad38a1fb5e88bd93b6e0e8119bde33885d4f6d2ce011d200a8943f0c182dd6d57a6afd496f7c147486adbf8bb5beb630b239de7caf07a74f280899dd8c4d1f45c296b8954c40c618a58f435f744aa684b3968d36410509ff35d5ae1945b26cec7ce074af2fd9570920d06fbd7c1901146339de4a4a35da640d892f56ee1920249c3e3009c353d4d9c9ea9c0cdbb7606b2dd7b1b65cb8a4014103bd1b4bdad96527e09a0cdccfaf359d89c239ef29a2db8b212e29107b6bbe2a96989a81d0718d96aaaa295474f4ff0ad3a842ff5f9dea8886715e1556c6bdd0d8f2f6ca6f1d31b0d9983d535042706ae89898f65ed3e0e984543bf83fc73607e3d556b0614e303e0338600279eb39a8295e06626e7c0c23c05a49bdd1107857247ed29246de929b97522eefd48d9c168182dd80adc3a5f101ca646f1e67cc65ae777e702a701c7d87433b1d957a9cc3029503f1f6020f88b5392928c20d3063e03edb7c14479c5ca6cbaeee0859ff8ec9fd43d61672ca802b3b56ef2e59965ebdf054a603d5e436eaf157eb70f05cd162e13215bc883c1bf828178b693565abc318d4d2ce6b2b593bb44d52539244d2e15ef863aff10969ea02467399c3174be2fc82cb5448ad45399519fc027e9b3ea97e8250d39aaf949cafbc17c378ad823546fcff5fb88f53418815bb22", 0x1000}, {&(0x7f0000006180)="e9749fddabe64187c5d9620b847c6aa38542b745514e499e4a63279a059613c70d8195fc27913bd5da2b97f2af0eac892590c0", 0x33}, {&(0x7f00000061c0)="9af4f3eae1", 0x5}, {&(0x7f0000006200)="96f2e129b5e126bd6df71dd84de281077320ce5cc7787a969929adae81e6663590464cbd7ddd5e5cf86f79df6c06bcd119250e7e74771464b04829b097b1e556c4104cf2dab9af9ca5ebc9d2acbfc0090293cdd51570aceced357d75aad303a2e0441d48a6135c34881d15", 0x6b}], 0x6, &(0x7f0000006300)=[{0xe8, 0x101, 0x9d9, "d48d75575181daf4ee228c1e78521fc2e671f6535b52c81a80fba3abd09c6ee9dd99311fcaa3e3e7bba0789ccd69ace62383df4ed6668b256eff6c9b71f836edc4a57310ec9c42971f4221b35fcae66605f7e5ce60247f48f105c07ab6100d2122d2b532bab91af365be32e1e82cd96acc7474a205c3c1a95fa803666db428e67f04800ce7ae198032678f1f57c98d206651ff37a7583b6ee4d7f324fe586e47905b2b9d25f1725bb96752254b5a7f1d7de8a7c0ae9d3d741ba26edf2c8e9afca8d9e1e5f2f57a438414e0e2f4208870a273"}], 0xe8, 0x20000000}, 0xffffffff00000000}], 0x7, 0x0) [ 363.122486] binder: 15766:15768 BC_INCREFS_DONE u0000000000000000 no match [ 363.130242] binder: 15766:15768 Release 1 refcount change on invalid ref 1 ret -22 20:30:09 executing program 5: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$nl_netfilter(r0, &(0x7f0000000080)={&(0x7f0000000100), 0xc, &(0x7f00000000c0)={&(0x7f0000000280)=ANY=[@ANYBLOB="1400000003baffff808f00003d88c83f005c1612d610e77d2061a667bc0ed5fae9cc5d14050aa53063822365e8b02ad72b6154360808d6facbcaa3d37c405f9c17b3195c6cbd11908af61142d5894dcaf0a588d1919fe9cdfa753c180153f585a12bb188b9cd379a024c19e49f52aa79d5312f30cd6234917946901c861e00d363699a02551f4d02522382d66596dda7411cf3ba0000000000"], 0x14}}, 0x0) recvmmsg(r0, &(0x7f00000013c0), 0x1ad, 0x0, &(0x7f0000000c40)={0x77359400}) r1 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000140)='/dev/ppp\x00', 0x8000, 0x0) write$P9_RWSTAT(r1, &(0x7f0000000180)={0x7, 0x7f, 0x2}, 0x7) ioctl$SNDRV_TIMER_IOCTL_PARAMS(r1, 0x40505412, &(0x7f0000000200)={0x4, 0x2, 0x6, 0x0, 0xf}) ioctl$sock_SIOCADDDLCI(r1, 0x8980, &(0x7f00000001c0)={'ifb0\x00', 0x4}) bind(r0, &(0x7f0000000000)=@pppol2tp={0x18, 0x1, {0x0, r0, {0x2, 0x4e20, @remote}, 0x1, 0x3, 0x3, 0x3}}, 0x80) socket$nl_netfilter(0x10, 0x3, 0xc) 20:30:09 executing program 3: r0 = socket$inet(0x2, 0x4000000000000001, 0x0) setsockopt$inet_tcp_TCP_CONGESTION(r0, 0x6, 0xd, &(0x7f0000000680)='reno\x00', 0x60c5) sendto$inet(r0, &(0x7f0000a88f88), 0xfffffffffffffe6e, 0x20000000, &(0x7f0000000000)={0x2, 0x0, @local}, 0xc) socket$inet(0x2, 0x5, 0x8) 20:30:09 executing program 4: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) r2 = dup3(r0, r1, 0x0) ioctl$sock_SIOCETHTOOL(r2, 0x8946, &(0x7f0000000080)={'ip_vti0\x00', &(0x7f0000000040)=@ethtool_dump={0x3f}}) getsockopt$sock_cred(r0, 0x1, 0x11, &(0x7f0000000000)={0x0}, &(0x7f00000000c0)=0xc) sched_rr_get_interval(r3, &(0x7f0000000100)) [ 363.297045] audit: type=1400 audit(1542313809.210:57): avc: denied { bind } for pid=15776 comm="syz-executor5" scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tclass=netlink_netfilter_socket permissive=1 20:30:10 executing program 2: r0 = socket$inet(0x2, 0x4000000000000001, 0x0) setsockopt$inet_tcp_TCP_CONGESTION(r0, 0x6, 0xd, &(0x7f0000000680)='reno\x00', 0x60c5) sendto$inet(r0, &(0x7f0000a88f88), 0xfffffffffffffe6e, 0x20000000, &(0x7f0000000000)={0x2, 0x0, @local}, 0xc) socket$inet(0x2, 0x5, 0x8) 20:30:10 executing program 4: r0 = socket$netlink(0x10, 0x3, 0x8000000004) socketpair$unix(0x1, 0x0, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) poll(&(0x7f0000000100)=[{r0, 0x40012}], 0x1, 0xff) sendmsg$IPVS_CMD_FLUSH(r0, &(0x7f0000000380)={&(0x7f0000000000), 0xc, &(0x7f0000000340)={&(0x7f0000000200)={0x14}, 0x14}}, 0x0) openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000040)='/dev/vga_arbiter\x00', 0x10000, 0x0) writev(r0, &(0x7f0000e11ff0)=[{&(0x7f0000000140)="580000001500add427323b470c458c5602067fffffff81004e220000e00000020b4824ca945f64009400050028925aa80000000000000080000efffe1b0000000000fff5dd00000010000100090a1000410400000000fcff", 0x58}], 0x1) 20:30:10 executing program 3: r0 = socket$inet(0x2, 0x4000000000000001, 0x0) setsockopt$inet_tcp_TCP_CONGESTION(r0, 0x6, 0xd, &(0x7f0000000680)='reno\x00', 0x60c5) sendto$inet(r0, &(0x7f0000a88f88), 0xfffffffffffffe6e, 0x20000000, &(0x7f0000e68000)={0x2, 0x0, @local}, 0x10) r1 = openat$selinux_avc_cache_stats(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/avc/cache_stats\x00', 0x0, 0x0) ioctl$RTC_EPOCH_READ(r1, 0x8008700d, &(0x7f0000000040)) 20:30:10 executing program 0: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r0, &(0x7f0000000100)={0xa, 0x4e22, 0x0, @empty, 0x4}, 0x1c) writev(0xffffffffffffffff, &(0x7f0000002980), 0x0) r1 = socket$inet6(0x10, 0x3, 0x0) sendmsg(r1, &(0x7f0000002fc8)={&(0x7f0000000000)=@nl, 0x80, &(0x7f0000002000)=[{&(0x7f0000000340)="5500000018007f5300fe01b2a4a280930a06000000a84308910000003900090008000c00010000001900150006000000000000dc1338d54400009b84136ef75afb83de448daa7227c43ab8220000060cec4fab6513", 0x55}], 0x1, &(0x7f0000000400), 0x0, 0x4}, 0x0) ioctl$EXT4_IOC_GROUP_EXTEND(0xffffffffffffffff, 0x40046607, &(0x7f0000000400)) listen(r0, 0x7c) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) mkdirat$cgroup(0xffffffffffffffff, &(0x7f0000000140)='syz1\x00', 0x1ff) r3 = memfd_create(&(0x7f0000000180)="0004003100", 0x0) ioctl$sock_SIOCGPGRP(r3, 0x8904, &(0x7f00000000c0)=0x0) syz_open_procfs(r4, &(0x7f0000000300)='net/ip_tables_names\x00') write$P9_RFSYNC(r3, &(0x7f0000000240)={0x7, 0x33, 0x1}, 0xfffffffffffffe2d) sendto$inet6(r2, &(0x7f0000000380), 0x0, 0x20000004, &(0x7f000031e000)={0xa, 0x4e22, 0x0, @ipv4}, 0x1c) openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000b80)="2e2f6367726f75702f73797a3100b8458a1392623c2acc07743172c163cfc71523709c3289acba6eaf2919f32ebaa4cbe89ed30167d7d56e8e65c0edbb300c9e287f10f513e776522729d5c85c09fed3f33ea055b94d27bb72a2bb9fd56015f25cf4f9ced65ed81253cfba08e9a329935ac0c64d10a5e701cc58fe4af8cb5b679468e8ad39e103e2d5b7d9078c34eb2832a5852b28958b7efeca8ffc69c09a7ca33d82e59f9e27ea25a7cf5e65bc52987952070ddac3929791a23f905fbd72419d1539", 0x200002, 0x0) fchdir(0xffffffffffffffff) r5 = creat(&(0x7f00000005c0)='./bus\x00', 0x0) r6 = open(&(0x7f0000000540)='./bus\x00', 0x141042, 0x0) sigaltstack(&(0x7f0000ffe000/0x1000)=nil, &(0x7f0000000480)) write$selinux_context(r6, &(0x7f0000000000)='system_u:object_r:crontab_exec_t:s0\x00', 0xfffffffffffffe84) r7 = creat(&(0x7f0000000a00)='./bus\x00', 0x82) r8 = openat$null(0xffffffffffffff9c, &(0x7f00000004c0)='/dev/null\x00', 0x2807fd, 0x0) write(r8, &(0x7f0000000380), 0x0) write$cgroup_type(r5, &(0x7f0000000200)='threaded\x00', 0xfffffeb3) select(0x40, &(0x7f0000000040), &(0x7f0000000080), &(0x7f00000001c0), &(0x7f0000000280)={0x77359400}) getsockopt$IP6T_SO_GET_ENTRIES(r0, 0x29, 0x41, &(0x7f0000000600)=ANY=[@ANYBLOB="73656375726974796d0000000000000000000000000000000000000000000000c40000004e8b4b1c7fa37c911d43b7dfc1540065e2cf063a33e71b903574450eb6fcc611bb94c232461f22877f4a6bfa2e09f7f448f8a2ef823ff78d796ab6ab52f030b8fea1243b4a37836d690100843a8998fea04a2bc474078acbb61c426c93824178b70a4bcff2d634050eca0d4f941bfec0542fd99b2bd8823b4175d0b0e455f170e292c18a967fdc58383f9af93bc9c8b8578b5ed8ba7d2084ab94919aea43e1a3acfd6d899d943862ca8d84436629d2159976a615f1279aaf23ce57319edb9be03d5b849777d956c09bcb8bc5eb1d793fe7b7d0c34d4d6cc6d28cb9f66b0a2f31eda0ce948210375abcde9320750390dc04b3af4959443184210eb68c4fe6dced7e44cd2b39f7d25dc53dab0fd596852191868741cecd379b6e87b1c1a8c0dc6b8004595fb61135ed10927d6df243071d53b4757c13f4ceb4480e4a7b9c730be6258db763d9e9e7baeccd140ed2311fd9c570db36e93131c27442990068d315088680ab638288fb05b1676a9ab2fe9aa99539a1cfbb1ae8b35cd18007ba5105ed92f8914bcc2397da080dd1da393ede4f195953f82d03b9a920391ee4f5bd7485d69e1d8bfc93521ea451a20dd056bd3c133aa93c9bef1e254ad7d19379b21be984d93cc7cfcbffc82708aebe5fe4c4aa7af905248de89163041c16cfdaf96ee5b65715c7bb840274ba8ddc979ae077aa20b5ba0e97ecd80abb2d3cdb2d2b6603b3a003871b7220d71909f230fa5e9a7307c10c954a2ff1c6bf5fe3e153c0ebeb4940c365ef1e9cc8588a51bfc9807e866ea6528a77c930c06eb50e3f14ca8abf929570c05ca0615211cdcce3d034946d4fadcc9df5702fca33cb322c27a54fee8cd7901df1066311b737259dfc65048bcff6eca8f566ed75b5d21b58a3c51907ba6d5ef9e04e24febdea1d345b16288065bf64cf9fa3a746185191dc7b2f4520fd2da2f60434395d6121d7063a6455be070f49e04c8c2fa0da58d878d80a1bf9cc58b6926e3c471cb1e79cb85f6ce2ad91ac6c68f955a507ad55f514d131e0a095329227c9888f9fb19bfe6df77dff07ef08544a33e9f10d72e3ca6a0d70bf0d4b3e607a2238db2aa9c1011d0af4a39786e48004427b8b55fcd1f7ad63a9aa5338475975159310e0e400000000000000000000000000000000000000000000000000008d6e69405d1d910d1f0f3f672554d9b331484ac38835cac9fce56e13861000cb11cdd6e722e372c4d45224e09fcb927675e6f9badc066e43a4a06c0afa9a3220ac9224e131c5c15d8a112c"], &(0x7f00000002c0)=0x1) recvfrom$inet6(r2, &(0x7f0000001840)=""/31, 0xfffffe0e, 0x100, &(0x7f0000001880)={0xa, 0x0, 0xffff}, 0x1c) getsockopt$inet_mreqn(r7, 0x0, 0x23, &(0x7f0000000500)={@multicast1, @multicast1, 0x0}, &(0x7f0000000440)=0xc) setsockopt$inet6_IPV6_PKTINFO(r5, 0x29, 0x32, &(0x7f0000000580)={@remote, r9}, 0x14) r10 = accept4(r0, 0x0, &(0x7f0000000000)=0xfffffffffffffefa, 0x0) sendto$inet6(r10, &(0x7f00000000c0), 0xfffffffffffffe2b, 0x0, 0x0, 0x0) 20:30:10 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$FS_IOC_SETVERSION(r0, 0x40087602, &(0x7f00000001c0)) r1 = syz_open_dev$binder(&(0x7f0000000640)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000000)=[@enter_looper], 0x1, 0x0, &(0x7f0000000040)='+'}) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x0, 0x0, &(0x7f0000000300), 0x0, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0x0, 0x0, &(0x7f0000000780)}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000380)={0x8, 0x0, &(0x7f0000000500)=[@release={0x40046306, 0x1}], 0x0, 0x0, &(0x7f0000000400)}) 20:30:10 executing program 5: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$nl_netfilter(r0, &(0x7f0000000080)={&(0x7f0000000100), 0xc, &(0x7f00000000c0)={&(0x7f0000000340)=ANY=[@ANYBLOB="140000000301ffff808f00003d88c83f00b516ba"], 0x14}}, 0x0) recvmmsg(r0, &(0x7f00000013c0), 0x1ad, 0x0, &(0x7f0000000c40)={0x77359400}) openat$selinux_access(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/access\x00', 0x2, 0x0) [ 364.838809] binder: 15801:15808 ioctl 40087602 200001c0 returned -22 20:30:10 executing program 2: r0 = socket$inet(0x2, 0x1, 0x0) bind$inet(r0, &(0x7f0000000080)={0x2, 0x4e23, @local}, 0x10) sendto$inet(r0, &(0x7f0000000280), 0xff26, 0x20000001, &(0x7f0000e68000)={0x2, 0x4e23}, 0x10) openat$selinux_mls(0xffffffffffffff9c, &(0x7f0000000400)='/selinux/mls\x00', 0x0, 0x0) r1 = dup(r0) setsockopt$inet_tcp_buf(r0, 0x6, 0xe, &(0x7f0000000340)="e6", 0x1) ioctl$VT_OPENQRY(r1, 0x5600, &(0x7f00000000c0)) r2 = syz_open_procfs(0x0, &(0x7f0000000040)='net/tcp\x00') getsockopt$sock_timeval(r2, 0x1, 0x15, &(0x7f0000000380), &(0x7f00000003c0)=0x10) sendfile(r0, r2, &(0x7f0000000000), 0x5d69) ioctl$EXT4_IOC_MOVE_EXT(r0, 0xc028660f, &(0x7f0000000300)={0x0, r1, 0x200000000000005, 0x1000100000001, 0xffffffffffffffff, 0x698}) r3 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000140)='IPVS\x00') sendmsg$IPVS_CMD_NEW_SERVICE(r1, &(0x7f0000000280)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x400}, 0xc, &(0x7f0000000240)={&(0x7f0000000180)={0x94, r3, 0x24, 0x70bd28, 0x25dfdbff, {}, [@IPVS_CMD_ATTR_SERVICE={0x80, 0x1, [@IPVS_SVC_ATTR_PROTOCOL={0x8, 0x2, 0x3c}, @IPVS_SVC_ATTR_FLAGS={0xc, 0x7, {0x0, 0x2e}}, @IPVS_SVC_ATTR_ADDR={0x14, 0x3, @ipv6=@dev={0xfe, 0x80, [], 0x19}}, @IPVS_SVC_ATTR_ADDR={0x14, 0x3, @ipv6=@mcast1}, @IPVS_SVC_ATTR_ADDR={0x14, 0x3, @ipv4=@rand_addr=0xf9}, @IPVS_SVC_ATTR_FWMARK={0x8}, @IPVS_SVC_ATTR_ADDR={0x14, 0x3, @ipv4=@dev={0xac, 0x14, 0x14, 0x15}}, @IPVS_SVC_ATTR_PORT={0x8, 0x4, 0x4e24}, @IPVS_SVC_ATTR_AF={0x8, 0x1, 0xa}]}]}, 0x94}, 0x1, 0x0, 0x0, 0x1}, 0x4000) ioctl$sock_SIOCINQ(r0, 0x541b, &(0x7f00000002c0)) fallocate(r1, 0x7, 0x3, 0x100000000) [ 364.886276] SELinux: unrecognized netlink message: protocol=4 nlmsg_type=0 sclass=netlink_tcpdiag_socket [ 364.933299] binder: 15801:15820 BC_INCREFS_DONE u0000000000000000 no match [ 364.942707] binder: 15801:15820 Release 1 refcount change on invalid ref 1 ret -22 20:30:11 executing program 4: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000340)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = openat$selinux_avc_cache_stats(0xffffffffffffff9c, &(0x7f0000000080)='/selinux/avc/cache_stats\x00', 0x0, 0x0) ioctl$EVIOCSABS2F(r1, 0x401845ef, &(0x7f00000000c0)={0x4, 0x3, 0x5f1, 0x6, 0xfffffffffffffff7, 0x6}) r2 = socket$nl_xfrm(0x10, 0x3, 0x6) r3 = getpid() syz_open_procfs(r3, &(0x7f00000002c0)='fd/4\x00') sendmsg$nl_xfrm(r2, &(0x7f000014f000)={&(0x7f00003c7ff4), 0xc, &(0x7f0000000000)={&(0x7f0000000100)=ANY=[@ANYBLOB="380100001000130700000000000000000000000000000000000000000000000000000000000000000000ffffac14ffaa00000000000000000000000000000000", @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="000000000000000000000000000000000000000033000000ffffffff00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000a0000000000000000000000480001006d6435000000000000000000000000000000000000000014000000000000000000000000000000000000000000000000000000000000000000000000000005fdefe88a862995711200e6707620a1026a28e1f8d7011d49c4953c1b438494314ec72e67eed7e61dcfa97c0d2275ed8b25e284b59e0a3fdf3420f267b01a8f94f79d71aca47495f8ca81a483ac57c1644bf5"], 0x138}}, 0x0) 20:30:11 executing program 4: r0 = openat$null(0xffffffffffffff9c, &(0x7f0000000000)='/dev/null\x00', 0x400000, 0x0) ioctl$UI_DEV_CREATE(r0, 0x5501) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r1, 0x6, 0x13, &(0x7f00000000c0)=0x100000001, 0x151) connect$inet6(r1, &(0x7f0000000080), 0x1c) r2 = dup2(r1, r1) setsockopt$inet6_tcp_TCP_REPAIR_OPTIONS(r2, 0x6, 0x16, &(0x7f0000000440), 0x131f64) clone(0x2102001ff9, 0x0, 0xfffffffffffffffe, &(0x7f0000000140), 0xffffffffffffffff) listen(r1, 0x0) setsockopt$inet_IP_XFRM_POLICY(r2, 0x0, 0x11, 0xfffffffffffffffe, 0x0) clone(0x0, 0x0, 0xfffffffffffffffe, &(0x7f0000000080), 0xffffffffffffffff) [ 365.097938] SELinux: unrecognized netlink message: protocol=4 nlmsg_type=0 sclass=netlink_tcpdiag_socket 20:30:11 executing program 4: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r0, &(0x7f0000000100)={0xa, 0x4e22}, 0x1c) writev(0xffffffffffffffff, &(0x7f0000002980), 0x0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000480)='cpuacct.stat\x00', 0x0, 0x0) ioctl$EXT4_IOC_GROUP_EXTEND(r0, 0x40046607, &(0x7f00000000c0)=0x100000001) listen(r0, 0x7f) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) mkdirat$cgroup(0xffffffffffffffff, &(0x7f0000000140)='syz1\x00', 0x1ff) r2 = memfd_create(&(0x7f0000000180)='syz1\x00', 0x0) write$P9_RFSYNC(r2, &(0x7f0000000400)={0x397, 0x33, 0x1}, 0xfffffffffffffe24) sendto$inet6(r1, &(0x7f0000000380), 0x0, 0x20000004, &(0x7f000031e000)={0xa, 0x4e22}, 0x1c) openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000300)='./cgroup.cpu\x00', 0x200002, 0x0) fchdir(0xffffffffffffffff) listen(r2, 0x81d) connect$inet6(0xffffffffffffffff, &(0x7f00000003c0)={0xa, 0x4e20, 0xfffffffffffffff8, @dev={0xfe, 0x80, [], 0x20}}, 0x1c) fcntl$setstatus(0xffffffffffffffff, 0x4, 0x0) r3 = open(&(0x7f0000000700)='./file1\x00', 0x141042, 0x0) write$selinux_context(r2, &(0x7f0000000440)="7300800cb7aa000000000000000000000000397e86", 0xfffffffffffffff3) write$cgroup_type(0xffffffffffffffff, &(0x7f0000000200)='threaded\x00', 0xfffffeb3) select(0x40, &(0x7f0000000040)={0x0, 0x0, 0x0, 0x0, 0x0, 0x1c00000000000}, &(0x7f0000000080), &(0x7f00000001c0), &(0x7f0000000280)={0x77359400}) getsockopt$IP6T_SO_GET_ENTRIES(r2, 0x29, 0x41, &(0x7f00000008c0)=ANY=[@ANYBLOB="7365637572697479000000000000000000000000000000000000000000230000c40000004e8b4b1e7fa37c911d43b7dfc1540065d6ebc0e2cf063a33e71b902574450eb6fcc611bb94c232461f22877f4a2e09f7f448f8a2ef823ff7695469da8bcd7d9cb8fea1243b4a37836d692868733a8998fea04a0ba374078acbead561a51093ca99b60a426c9382417872b70a4bcff2d634050e7e0d4f941bfec0542fd99b2bd8823b4175d0b0e455f150e292c18a967fdc5c383f9af93bc963375942ab8f827d2084ab94919aea43e1e3acfd6d899dd2159976a615f1279aaf23ce57319edb9be03d5b8495c31516805cb62b95e671701e0b2731466d0d19cea2ce2399a7286eb3a4b89688400f29f9c4436b10e74a99455d827a7d4e4a7ead66bc78cba160cd76c01265c973bc5e5add1f320789df5551b5c8a6dd2468457cccc4141041973aaa5379e560464c9666a5fba727bcdb3abd3d39d826e658967c5d1de780dcefa03d0984"], &(0x7f00000002c0)=0x1) recvfrom$inet6(r1, &(0x7f0000001840)=""/31, 0xfffffe0e, 0x100, &(0x7f0000001880)={0xa, 0x0, 0xffff}, 0x1c) ioctl$FIDEDUPERANGE(r2, 0xc0189436, &(0x7f00000005c0)=ANY=[@ANYBLOB="08b9311733ba1785e1c4e8cbc47440f1872b1103fa0a77c1ef8d230645318abbd0ed0223882d3599e6dd319572b9474affc6eb878131488f1ceb157bb29a0b57f12fed0fc90e99be6c706984da9f46efbd7dfa49f64ba90783e761dec2b51cf78ab359fe1fe1396596890f44b80f4c00008e284fc71f4232c059d33e94f1ed2d87e685df3287cfb56564e6f77bb48128fa95e4630bea63d3789385cfe3b88d0500000000000000e4830eaa8fdf05361eaa4500000000000000000057f0d67c9496df3447dcacc6706a947d69cf380b0e69094c08e0c72c5090e8e1c6b9be4c22c78f4b6e462aa3fe6baf18610106d624226a3483f9b6d05295d04dffc53ef547"]) creat(&(0x7f0000000580)='./bus\x00', 0x1) listen(r3, 0x0) renameat(0xffffffffffffffff, &(0x7f0000000240)='./file0\x00', 0xffffffffffffffff, &(0x7f0000000380)='./bus\x00') r4 = accept4(r0, 0x0, &(0x7f0000000340), 0x80000) fsetxattr$trusted_overlay_origin(r3, &(0x7f00000004c0)='trusted.overlay.origin\x00', &(0x7f0000000500)='y\x00', 0x2, 0x1) sendto$inet6(r4, &(0x7f00000000c0), 0xfffffdda, 0x0, 0x0, 0x0) socket$inet6(0xa, 0x4, 0x8) 20:30:11 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$FS_IOC_SETVERSION(r0, 0x40087602, &(0x7f00000001c0)) r1 = syz_open_dev$binder(&(0x7f0000000640)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000000)=[@enter_looper], 0x1, 0x0, &(0x7f0000000040)='+'}) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, &(0x7f0000000200), &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0x0, 0x0, &(0x7f0000000780)}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000380)={0x8, 0x0, &(0x7f0000000500)=[@release={0x40046306, 0x1}], 0x0, 0x0, &(0x7f0000000400)}) 20:30:11 executing program 3: r0 = socket$inet(0x2, 0x4000000000000001, 0x0) setsockopt$inet_tcp_TCP_CONGESTION(r0, 0x6, 0xd, &(0x7f0000000680)='reno\x00', 0x60c5) sendto$inet(r0, &(0x7f0000a88f88), 0xfffffffffffffe6e, 0x20000000, &(0x7f0000e68000)={0x2, 0x0, @local}, 0x10) setsockopt$inet6_tcp_buf(r0, 0x6, 0x1e, &(0x7f0000000000)="28db12260bd87ba21a06e006172e79f8d7145cd1990d1d3a63bb82cfb0d81ef2a715b9e2a4dea5d2b70f271445f711f8342660642c25d4a2e3a0e4ccebf7a9f4eba12531578990fb6bf1bb13c23b1f4f99c870906c1b7da6cfa1aca7a37f927c5b09106447a792e423fb947836bb4f97eb03ff2c816f9333e3fedaccb9c1d481bc4d146038bd57b80632d27401918bebb6a07a400bed91c196404c1751eb57acd07c051bd160f52c7c8bce0713145378000443d9ab53f298680f70", 0xbb) [ 365.652397] binder: 15852:15853 ioctl 40087602 200001c0 returned -22 20:30:11 executing program 5: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) r1 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) setsockopt$inet6_mtu(r1, 0x29, 0x17, &(0x7f0000000000)=0x7, 0x4) sendmsg$nl_netfilter(r0, &(0x7f0000000080)={&(0x7f0000000100), 0xc, &(0x7f00000000c0)={&(0x7f0000000340)=ANY=[@ANYBLOB="140000000301ffff808f00003d88c83f00b516ba"], 0x14}}, 0x0) recvmmsg(r0, &(0x7f00000013c0), 0x1ad, 0x0, &(0x7f0000000c40)={0x77359400}) ioctl$sock_netdev_private(r0, 0x89fa, &(0x7f0000000140)="4997be9d75377e18f93a7cc836f24e2ce5ba33bc4d9cfd80d5d8a3215d71b0e1f97073456664c88005720eeec95dfcad086db63e5aea13c682f7216434cc891dfc456cd15294fbb58dc7138202fb40772bbfd4eebe9017fd39b4e9034e984bc56c84b2e26dfd75253fc379654795d8c59aed59ea0b7700e38db20d88d7847443ba5231f89b3651f02816e67133e5912d99c5ec665fde0a15e69fc42959275534e33dd35b8d8dc3ebdf69c92f2aca169f9d4a3ddd29") [ 365.716604] binder: 15852:15856 got transaction with invalid offset (0, min 0 max 0) or object. [ 365.732690] binder: 15852:15856 transaction failed 29201/-22, size 0-8 line 3200 20:30:11 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x0, 0x0, &(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) getsockopt$bt_hci(0xffffffffffffffff, 0x0, 0x0, &(0x7f0000000000)=""/101, &(0x7f0000000080)=0x65) clone(0x2102009ff5, 0x0, 0xfffffffffffffffe, &(0x7f00000001c0), 0xffffffffffffffff) getsockopt$IP_VS_SO_GET_DESTS(r1, 0x0, 0x484, &(0x7f0000000c40)=""/95, &(0x7f00000000c0)=0x5f) ioctl$TCSETSW(0xffffffffffffffff, 0x5403, &(0x7f0000000180)) setsockopt$SO_TIMESTAMPING(r2, 0x1, 0x25, &(0x7f0000000200)=0x202, 0x4) write$binfmt_elf64(r2, &(0x7f0000000280)={{0x7f, 0x45, 0x4c, 0x46, 0x4, 0x8, 0x80000001, 0x40, 0x2, 0x3, 0x0, 0x7, 0x3d5, 0x40, 0x90, 0x20000000000000, 0x80, 0x38, 0x2, 0x7fff, 0x4, 0x3}, [{0x5, 0x81, 0x100, 0x80000001, 0x6, 0x800, 0x2, 0x8}], "95b177621d5ee109cb96d80dd24cc41469cd", [[], [], [], [], [], [], [], [], []]}, 0x98a) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046205, 0x0) syz_open_dev$evdev(&(0x7f0000000140)='/dev/input/event#\x00', 0x101, 0x8081) 20:30:11 executing program 2: mmap(&(0x7f0000001000/0x2000)=nil, 0x2000, 0x2, 0x32, 0xffffffffffffffff, 0x0) r0 = syz_open_procfs(0x0, &(0x7f0000000040)="0001705f66696c657300") getdents(r0, &(0x7f0000000080)=""/162, 0x4) getdents(r0, &(0x7f0000000ea9)=""/407, 0x197) 20:30:11 executing program 0: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r0, &(0x7f0000000100)={0xa, 0x4e22, 0x0, @empty, 0x4}, 0x1c) writev(0xffffffffffffffff, &(0x7f0000002980), 0x0) r1 = socket$inet6(0x10, 0x3, 0x0) sendmsg(r1, &(0x7f0000002fc8)={&(0x7f0000000000)=@nl, 0x80, &(0x7f0000002000)=[{&(0x7f0000000340)="5500000018007f5300fe01b2a4a280930a06000000a84308910000003900090008000c00010000001900150006000000000000dc1338d54400009b84136ef75afb83de448daa7227c43ab8220000060cec4fab6513", 0x55}], 0x1, &(0x7f0000000400), 0x0, 0x4}, 0x0) ioctl$EXT4_IOC_GROUP_EXTEND(0xffffffffffffffff, 0x40046607, &(0x7f0000000400)) listen(r0, 0x7c) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) mkdirat$cgroup(0xffffffffffffffff, &(0x7f0000000140)='syz1\x00', 0x1ff) r3 = memfd_create(&(0x7f0000000180)="0004003100", 0x0) ioctl$sock_SIOCGPGRP(r3, 0x8904, &(0x7f00000000c0)=0x0) syz_open_procfs(r4, &(0x7f0000000300)='net/ip_tables_names\x00') write$P9_RFSYNC(r3, &(0x7f0000000240)={0x7, 0x33, 0x1}, 0xfffffffffffffe2d) sendto$inet6(r2, &(0x7f0000000380), 0x0, 0x20000004, &(0x7f000031e000)={0xa, 0x4e22, 0x0, @ipv4}, 0x1c) openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000b80)="2e2f6367726f75702f73797a3100b8458a1392623c2acc07743172c163cfc71523709c3289acba6eaf2919f32ebaa4cbe89ed30167d7d56e8e65c0edbb300c9e287f10f513e776522729d5c85c09fed3f33ea055b94d27bb72a2bb9fd56015f25cf4f9ced65ed81253cfba08e9a329935ac0c64d10a5e701cc58fe4af8cb5b679468e8ad39e103e2d5b7d9078c34eb2832a5852b28958b7efeca8ffc69c09a7ca33d82e59f9e27ea25a7cf5e65bc52987952070ddac3929791a23f905fbd72419d1539", 0x200002, 0x0) fchdir(0xffffffffffffffff) r5 = creat(&(0x7f00000005c0)='./bus\x00', 0x0) r6 = open(&(0x7f0000000540)='./bus\x00', 0x141042, 0x0) sigaltstack(&(0x7f0000ffe000/0x1000)=nil, &(0x7f0000000480)) write$selinux_context(r6, &(0x7f0000000000)='system_u:object_r:crontab_exec_t:s0\x00', 0xfffffffffffffe84) r7 = creat(&(0x7f00000003c0)='./bus\x00', 0x2) r8 = openat$null(0xffffffffffffff9c, &(0x7f00000004c0)='/dev/null\x00', 0x2807fd, 0x0) write(r8, &(0x7f0000000380), 0x0) write$cgroup_type(r5, &(0x7f0000000200)='threaded\x00', 0xfffffeb3) select(0x40, &(0x7f0000000040), &(0x7f0000000080), &(0x7f00000001c0), &(0x7f0000000280)={0x77359400}) getsockopt$IP6T_SO_GET_ENTRIES(r0, 0x29, 0x41, &(0x7f0000000600)=ANY=[@ANYBLOB="7365637572697479830000000000000000000000000000000000000000000000c40000004e8b4b1c7fa09a73fce725f275b621a37c911d43b7df81540065e2cf063a33e71b903574450eb6fcc611bb94c232461f22877f4a6bfa2e09f7f448f8a2ef823ff78d796ab6ab52f030b8fea1243b4a37836d690100843a8998fea04a2bc474078acbb61c426c93824178b70a4bcff2d634050eca0d4f941bfec0542fd99b2bd8823b4175d0b0e455f170e292c18a967fdc58383f9af93bc9c8b8578b5ed8ba8a3e84ab94919aea43e1a3acfd6d899d943862ca8d84436629d2159976a615f1279aaf23ce57319edb9be03d5b849777d956c09bcb8bc5eb1d793fe7b7d0c34d4d6cc6d28cb9f66b0a2f31eda0ce948210375abcde9320750390dc04b3af49594431842c0eb68c4fe6dced7e44cd2b39f7d25dc53dab0fd596852191868741cecd379b6e87b1c1a8c0dc6b8004595fb61135ed10927d6df243071d53b4757c13f4ceb4480e4a7b9c730be6258db763d9e9e7baeccd140ed2311fd9c570db36e93131c27442990068d315088680ab638288fb05b177a964b1c74226676a9ab2fe9aa99539a1cfbb1ae8b35cd18007ba5105ed92f8914bcc2397da080dd1da393ede4f195953f82d03b9a920391ee4f5bd7485d69e1d8bfc93521ea451a20dd056bd3c133aa93c9bef1e254ad7d19379b21be984d93cc7cfcbffc82708aebe5fe4c4aa7af905248de89163041c16cfdaf96ee5b65715c7bb840274ba8ddc979ae077aa20b5ba0e97ecd80abb2d3cdb2d2b6603b3a003871b7220d71909f230fa5e9a7307c10c954a2ff1c6bf5fe3e153c0ebeb4940c365ef1e9cc8588a51bfc9807e866ea6528a77c930c06eb50e3f14ca8abf929570c05ca0615211cdcce3d034946d4fadcc9df5702fca33cb322c27a54fee8cd7901df1066311b737259dfc65048bcff6eca8f566ed75b5d21b58a3c51907ba6d5ef9e04e24febdea1d345b16288065bf64cf9fa3a746185191dc7b2f4520fd2da2f60434395d6121d7063a6455be070f49e04c8c2fa0da58d878d80a1bf9cc58b6926e3c471cb1e79cb85f6ce2ad91ac6c68f955a507ad55f514d131e0a095329227c9888f9fb19bfe6df77dff07ef08544a33e9f10d72e3ca6a0d70bf0d4b3e607a2238db2aa9c1011d0af4a39786e48004427b8b55fcd1f7ad63a9aa5338475975159310e0e40000000000000000000000000000000000000000000000000000"], &(0x7f00000002c0)=0x1) recvfrom$inet6(r2, &(0x7f0000001840)=""/31, 0xfffffe0e, 0x100, &(0x7f0000001880)={0xa, 0x0, 0xffff}, 0x1c) getsockopt$inet_mreqn(r7, 0x0, 0x23, &(0x7f0000000500)={@multicast1, @multicast1, 0x0}, &(0x7f0000000440)=0xc) setsockopt$inet6_IPV6_PKTINFO(r5, 0x29, 0x32, &(0x7f0000000580)={@remote, r9}, 0x14) r10 = accept4(r0, 0x0, &(0x7f0000000000)=0xfffffffffffffefa, 0x0) sendto$inet6(r10, &(0x7f00000000c0), 0xfffffffffffffe2b, 0x0, 0x0, 0x0) [ 365.806288] binder: 15852:15866 BC_INCREFS_DONE u0000000000000000 no match [ 365.806609] binder: 15869:15870 ioctl 40046205 0 returned -22 [ 365.808711] binder: 15869:15872 ioctl 40046205 0 returned -22 [ 365.828032] binder: 15852:15856 Release 1 refcount change on invalid ref 1 ret -22 20:30:11 executing program 2: socketpair$unix(0x1, 0x0, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = syz_open_procfs(0x0, &(0x7f00000001c0)='task\x00') getdents(r1, &(0x7f00000002c0)=""/229, 0x53) ioctl$UI_END_FF_UPLOAD(r1, 0x406855c9, &(0x7f0000000000)={0xc, 0x3, {0x51, 0x8e3, 0x1000, {0xffff, 0xfffffffffffffffc}, {0x5, 0x1}, @const={0x7ff, {0x0, 0x6, 0x13, 0x100000000}}}, {0x56, 0x7, 0x6, {0x10000, 0x1}, {0x2, 0x101}, @const={0x7ff, {0xffffffffffffd5bf, 0x6, 0x6, 0x45ef}}}}) getsockopt$SO_COOKIE(r0, 0x1, 0x39, &(0x7f0000000080), &(0x7f00000000c0)=0x8) exit(0x0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x2400, 0x9) ioctl$RTC_AIE_OFF(r1, 0x7002) getdents(r1, &(0x7f00000004c0)=""/202, 0x24c) [ 365.836703] audit: type=1400 audit(1542313811.750:58): avc: denied { ioctl } for pid=15860 comm="syz-executor5" path="socket:[52978]" dev="sockfs" ino=52978 ioctlcmd=89fa scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tclass=netlink_netfilter_socket permissive=1 20:30:12 executing program 4: socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x0, 0x400000000008031, 0xffffffffffffffff, 0x0) mremap(&(0x7f000000a000/0x1000)=nil, 0x1000, 0x2000, 0x3, &(0x7f0000005000/0x2000)=nil) mremap(&(0x7f0000005000/0x1000)=nil, 0x1000, 0x1000, 0x3, &(0x7f000000a000/0x1000)=nil) ioctl$FS_IOC_GET_ENCRYPTION_PWSALT(r0, 0x40106614, &(0x7f0000000040)={0x0, @speck128}) mremap(&(0x7f0000552000/0x3000)=nil, 0x3000, 0x2000, 0x0, &(0x7f00002fd000/0x2000)=nil) r1 = openat$selinux_commit_pending_bools(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/commit_pending_bools\x00', 0x1, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x2400, 0xdcfa) 20:30:12 executing program 4: open$dir(&(0x7f0000000180)='./file0\x00', 0x80000, 0x101) r0 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000300)="2e2f6367726f75700000000000db887974a9d4b8049e206606a808fcfe3dd31291f786cee92a2ed9cc0eeb0f6e1b21700557d7d321c616f2a69f975e5d5807683103cf48516fd96063603193e1cc3109ac8eeb3489d6a5d86eea6fc66adc6c92378d49", 0x200002, 0x0) fchdir(r0) r1 = open(&(0x7f0000000000)='.\x00', 0x400000000000000, 0x0) getsockopt$IP_VS_SO_GET_SERVICE(r1, 0x0, 0x483, &(0x7f00000000c0), &(0x7f0000000280)=0x8) futex(&(0x7f0000000140)=0x1, 0x3, 0x1, &(0x7f00000001c0)={0x0, 0x989680}, &(0x7f0000000240), 0x1) getdents64(r1, &(0x7f0000000040)=""/127, 0xff22) getdents64(r1, &(0x7f0000000200)=""/54, 0x36) 20:30:12 executing program 4: r0 = creat(&(0x7f0000000280)='./file0\x00', 0x0) write$binfmt_elf64(r0, &(0x7f0000000080)=ANY=[], 0xfffffef6) mknod(&(0x7f0000000080)='./file1\x00', 0x0, 0x0) rename(&(0x7f0000000100)='./file1\x00', &(0x7f0000000040)='./file0\x00') bind(r0, &(0x7f0000000140)=@rc={0x1f, {0xeee2, 0x1, 0x0, 0x5, 0x1000, 0x7ff}, 0x8d}, 0x80) utime(&(0x7f00000006c0)='./file0\x00', &(0x7f0000000700)) 20:30:12 executing program 4: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) socketpair$inet(0x2, 0x80005, 0x5, &(0x7f0000000280)) r1 = socket$inet6(0xa, 0x2, 0x0) getsockopt$inet6_IPV6_XFRM_POLICY(r1, 0x29, 0x23, &(0x7f0000000000)={{{@in6, @in6=@ipv4={[], [], @multicast2}}}, {{@in6=@ipv4={[], [], @multicast2}}, 0x0, @in6}}, &(0x7f0000000240)=0xe8) close(r1) 20:30:12 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$FS_IOC_SETVERSION(r0, 0x40087602, &(0x7f00000001c0)) r1 = syz_open_dev$binder(&(0x7f0000000640)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000000)=[@enter_looper], 0x1, 0x0, &(0x7f0000000040)='+'}) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, &(0x7f0000000200), &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0x0, 0x0, &(0x7f0000000780)}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000380)={0x8, 0x0, &(0x7f0000000500)=[@release={0x40046306, 0x1}], 0x0, 0x0, &(0x7f0000000400)}) 20:30:12 executing program 4: r0 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000000)='smaps\x00') readv(r0, &(0x7f00000013c0)=[{&(0x7f0000000140)=""/48, 0x30}, {&(0x7f0000000180)=""/24, 0x18}, {&(0x7f00000001c0)=""/188, 0xbc}, {&(0x7f0000000280)=""/100, 0x64}, {&(0x7f0000000300)=""/39, 0x27}], 0x5) exit(0x0) personality(0x0) read(r0, &(0x7f0000000540)=""/221, 0xfffffffffffffe41) ioctl$ASHMEM_PURGE_ALL_CACHES(r0, 0x770a, 0x0) [ 366.452223] binder: undelivered TRANSACTION_ERROR: 29201 [ 366.474543] binder: 15909:15911 ioctl 40087602 200001c0 returned -22 20:30:12 executing program 3: r0 = socket$inet(0x2, 0x80001, 0x8f) setsockopt$inet_tcp_TCP_CONGESTION(r0, 0x6, 0xd, &(0x7f0000000680)='reno\x00', 0x60c5) sendto$inet(r0, &(0x7f0000a88f88), 0xfffffffffffffe6e, 0x20000000, &(0x7f0000e68000)={0x2, 0x0, @local}, 0x10) getsockname$inet(r0, &(0x7f0000000000)={0x2, 0x0, @broadcast}, &(0x7f0000000040)=0x10) accept$inet(r0, &(0x7f00000000c0)={0x2, 0x0, @local}, &(0x7f0000000100)=0x10) signalfd(r0, &(0x7f0000000080)={0x4a59}, 0x8) 20:30:12 executing program 5: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$nl_netfilter(r0, &(0x7f0000000080)={&(0x7f0000000100), 0xc, &(0x7f00000000c0)={&(0x7f0000000140)=ANY=[@ANYBLOB="1400000004000000808f00003d88c83f00b516ba64442db2090000007133c14fba7d784957d78457c4545ce81803df3c95cbbb8a4e815bcc74ab274501c7d68ea6312145bcd0197822bbe113040f7bd170d0d08316fd243baaa1f46411c90c9bc50ac6e1b629b4b44ae1aafb3b9a5cdd4379fa7ddbb7c62798066835da9117107751d5b6528d73d65a24ccf224"], 0x14}}, 0x0) recvmmsg(r0, &(0x7f00000013c0), 0x1ad, 0x0, &(0x7f0000000c40)={0x77359400}) socketpair(0x10, 0x800, 0xffff, &(0x7f0000000000)={0xffffffffffffffff}) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) [ 366.529892] binder: 15909:15919 got transaction with invalid offset (0, min 0 max 0) or object. [ 366.539077] binder: 15909:15919 transaction failed 29201/-22, size 0-8 line 3200 [ 366.548626] binder: 15909:15919 Release 1 refcount change on invalid ref 1 ret -22 20:30:12 executing program 3: r0 = memfd_create(&(0x7f0000000000)='reno\x00', 0x6) ioctl$LOOP_CTL_GET_FREE(r0, 0x4c82) r1 = socket$inet(0x2, 0x4000000000000001, 0x0) setsockopt$inet_tcp_TCP_CONGESTION(r1, 0x6, 0xd, &(0x7f0000000680)='reno\x00', 0x60c5) sendto$inet(r1, &(0x7f0000a88f88), 0xfffffffffffffe6e, 0x20000000, &(0x7f0000e68000)={0x2, 0x0, @local}, 0x10) 20:30:12 executing program 2: r0 = memfd_create(&(0x7f0000000140)='+\x00', 0x7) write(r0, &(0x7f0000000040)='6', 0x1) sendfile(r0, r0, &(0x7f0000000080), 0xb516) rename(&(0x7f0000000000)='./file0\x00', &(0x7f00000000c0)='./file0\x00') r1 = socket$inet_tcp(0x2, 0x1, 0x0) ioctl$sock_inet_SIOCSIFFLAGS(r1, 0x8914, &(0x7f00000000c0)={'lo\x00@\x00', 0x101}) r2 = socket$inet_tcp(0x2, 0x1, 0x0) ioctl$sock_inet_SIOCSIFFLAGS(r1, 0x8914, &(0x7f0000000000)={'lo\x00'}) close(r2) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3, 0x8031, 0xffffffffffffffff, 0x0) mlock(&(0x7f000051a000/0x14000)=nil, 0x14000) 20:30:12 executing program 0: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r0, &(0x7f0000000100)={0xa, 0x4e22, 0x0, @empty, 0x4}, 0x1c) writev(0xffffffffffffffff, &(0x7f0000002980), 0x0) r1 = socket$inet6(0x10, 0x3, 0x0) sendmsg(r1, &(0x7f0000002fc8)={&(0x7f0000000000)=@nl, 0x80, &(0x7f0000002000)=[{&(0x7f0000000340)="5500000018007f5300fe01b2a4a280930a06000000a84308910000003900090008000c00010000001900150006000000000000dc1338d54400009b84136ef75afb83de448daa7227c43ab8220000060cec4fab6513", 0x55}], 0x1, &(0x7f0000000400), 0x0, 0x4}, 0x0) ioctl$EXT4_IOC_GROUP_EXTEND(0xffffffffffffffff, 0x40046607, &(0x7f0000000400)) listen(r0, 0x7c) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) mkdirat$cgroup(0xffffffffffffffff, &(0x7f0000000140)='syz1\x00', 0x1ff) r3 = memfd_create(&(0x7f0000000180)="0004003100", 0x0) ioctl$sock_SIOCGPGRP(r3, 0x8904, &(0x7f00000000c0)=0x0) syz_open_procfs(r4, &(0x7f0000000300)='net/ip_tables_names\x00') write$P9_RFSYNC(r3, &(0x7f0000000240)={0x7, 0x33, 0x1}, 0xfffffffffffffe2d) sendto$inet6(r2, &(0x7f0000000380), 0x0, 0x20000004, &(0x7f000031e000)={0xa, 0x4e22, 0x0, @ipv4}, 0x1c) openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000b80)="2e2f6367726f75702f73797a3100b8458a1392623c2acc07743172c163cfc71523709c3289acba6eaf2919f32ebaa4cbe89ed30167d7d56e8e65c0edbb300c9e287f10f513e776522729d5c85c09fed3f33ea055b94d27bb72a2bb9fd56015f25cf4f9ced65ed81253cfba08e9a329935ac0c64d10a5e701cc58fe4af8cb5b679468e8ad39e103e2d5b7d9078c34eb2832a5852b28958b7efeca8ffc69c09a7ca33d82e59f9e27ea25a7cf5e65bc52987952070ddac3929791a23f905fbd72419d1539", 0x200002, 0x0) fchdir(0xffffffffffffffff) r5 = creat(&(0x7f00000005c0)='./bus\x00', 0x0) r6 = open(&(0x7f0000000540)='./bus\x00', 0x141042, 0x0) sigaltstack(&(0x7f0000ffe000/0x1000)=nil, &(0x7f0000000480)) write$selinux_context(r6, &(0x7f0000000000)='system_u:object_r:crontab_exec_t:s0\x00', 0xfffffffffffffe84) r7 = creat(&(0x7f00000003c0)='./bus\x00', 0x2) r8 = openat$null(0xffffffffffffff9c, &(0x7f00000004c0)='/dev/null\x00', 0x2807fd, 0x0) write(r8, &(0x7f0000000380), 0x0) write$cgroup_type(r5, &(0x7f0000000200)='threaded\x00', 0xfffffeb3) select(0x40, &(0x7f0000000040), &(0x7f0000000080), &(0x7f00000001c0), &(0x7f0000000280)={0x77359400}) getsockopt$IP6T_SO_GET_ENTRIES(r0, 0x29, 0x41, &(0x7f0000000600)=ANY=[@ANYBLOB="73656375726974796d0000000000000000000000000000000000000000000000c40000004e8b4b1c7fa37c911d43b7dfc1540065e2cf063a33e71b903574450eb6fcc611bb94c232461f22877f4a6bfa2e09f7f448f8a2ef823ff78d796ab6ab52f030b8fea1243b4a37836d690100843a8998fea04a2bc474078acbb61c426c93824178b70a4bcff2d634050eca0d4f941bfec0542fd99b2bd8823b4175d0b0e455f170e292c18a967fdc58383f9af93bc9c8b8578b5ed8ba7d2084ab94919aea43e1a3acfd090000003862ca8d84436629d2159976a615f1279aaf23ce57319edb9be03d5b849777d956c09bcb8bc5eb1d793fe600d0c34d4d6cc6d28cb9f66b0a2f31eda0ce948210375abcde9320750390dc04b3af4959443184210eb68c4fe6dced7e44cd2b39f7d25dc53dab0fd596852191868741cecd379b6e87b17adfa268e791bd23f50e84456c1e66c1a8c0dc6b8004595fb61135ed10927d6df243071d53b4757c13f4ceb4480e4a7b9c730be6258db763d9e9e7baeccd140ed2311fd9c570db36e93131c27442990068d315088680ab63822e0e0000676a9ab2fe9aa99539a1cfbb1ae8b35cd18007ba5105ed92f8914bcc2397da080dd1da393ede4f195953f82d03b9a920391ee4f5bd7485d69e1d8bfc93521ea451a20dd056bd3c133aa93c9bef1e254ad7d19379b21be984d93cc7cfcbffc82708aebe5fe4c4aa7af905248de89163041c16cfdaf96ee5b65715c7bb840274ba8ddc979ae077aa20b5ba0e97ecd80abb2d3cdb2d2b6603b3a003871b7220d71909f230fa5e9a7307c10c954a2ff1c6bf5fe3e153c0ebeb4940c365ef1e9cc8588a51bfc9807e866ea6528a77c930c06eb50e3f14ca8abf929570c05ca0615211cdcce3d034946d4fadcc9df5702fca33cb322c27a54fee8cd7901df1066311b737259dfc65048bcff6eca8a432ed75b5d21b58a3c51907ba6d5ef9e04e24febdea1d345b16288065bf64cf9fa3a746185191dc7b2f4520fd2da2f60434395d6121d7063a6455b0070f49e04c8c2fa0da58d878d80a1bf9cc58b6926e3c471cb1e79cb85f6ce2ad91ac6c68f955a507ad55f514d131e0a095329227c9888f9fb19bfe6df77dff07ef08544a33e9f10d72e3ca6a0d70bf0d4b3e607a2238db2aa9c1011d0af4a39786e48004427b8b55fcd1f7ad63a9aa5338475975159310e0e400000000000000000000000000000000000000000000000000007704814d463b0a7812a39cc8421f388f8be61f79c71636d31e126d56f55c66ea16f05241681460da012bd13a5d3c24bd2f52735cbfa2fd470ad63a5a4b01289bcf35f23fc0a59ba66d05716fefbf2cea67d1ba440ac3f35240da9daf5fff0acc15d7441cf4893807b230eb6bc3c97370cd6ce81f12f9cf4ea46ece301e4daeee63c05e31"], &(0x7f00000002c0)=0x1) recvfrom$inet6(r2, &(0x7f0000001840)=""/31, 0xfffffe0e, 0x100, &(0x7f0000001880)={0xa, 0x0, 0xffff}, 0x1c) getsockopt$inet_mreqn(r7, 0x0, 0x23, &(0x7f0000000500)={@multicast1, @multicast1, 0x0}, &(0x7f0000000440)=0xc) setsockopt$inet6_IPV6_PKTINFO(r5, 0x29, 0x32, &(0x7f0000000580)={@remote, r9}, 0x14) r10 = accept4(r0, 0x0, &(0x7f0000000000)=0xfffffffffffffefa, 0x0) sendto$inet6(r10, &(0x7f00000000c0), 0xfffffffffffffe2b, 0x0, 0x0, 0x0) [ 366.796560] device lo entered promiscuous mode [ 366.807591] device lo left promiscuous mode [ 366.927181] device lo entered promiscuous mode [ 366.941748] device lo left promiscuous mode 20:30:12 executing program 2: r0 = memfd_create(&(0x7f0000000140)='+\x00', 0x7) write(r0, &(0x7f0000000040)='6', 0x1) sendfile(r0, r0, &(0x7f0000000080), 0xb516) rename(&(0x7f0000000000)='./file0\x00', &(0x7f00000000c0)='./file0\x00') r1 = socket$inet_tcp(0x2, 0x1, 0x0) ioctl$sock_inet_SIOCSIFFLAGS(r1, 0x8914, &(0x7f00000000c0)={'lo\x00@\x00', 0x101}) r2 = socket$inet_tcp(0x2, 0x1, 0x0) ioctl$sock_inet_SIOCSIFFLAGS(r1, 0x8914, &(0x7f0000000000)={'lo\x00'}) close(r2) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3, 0x8031, 0xffffffffffffffff, 0x0) mlock(&(0x7f000051a000/0x14000)=nil, 0x14000) [ 367.047013] device lo entered promiscuous mode [ 367.061901] device lo left promiscuous mode 20:30:13 executing program 2: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000080)="0a5cc80700315f85715070") r1 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000480)='/dev/ptmx\x00', 0x201, 0x0) ioctl$TCSETSW(r1, 0x5403, &(0x7f0000000040)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x40000000}) write$binfmt_aout(r1, &(0x7f0000000180)=ANY=[@ANYRES16], 0x2) fcntl$addseals(r0, 0x409, 0x2) ioctl$TCSETS(r1, 0x40045431, &(0x7f00003b9fdc)) r2 = syz_open_pts(r1, 0x0) readv(r2, &(0x7f00000000c0)=[{&(0x7f0000000000)=""/55, 0x37}], 0x1) openat$selinux_commit_pending_bools(0xffffffffffffff9c, &(0x7f0000000100)='/selinux/commit_pending_bools\x00', 0x1, 0x0) dup3(r2, r1, 0x0) 20:30:13 executing program 2: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000080)="0a5cc80700315f85715070") r1 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000480)='/dev/ptmx\x00', 0x201, 0x0) ioctl$TCSETSW(r1, 0x5403, &(0x7f0000000040)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x40000000}) write$binfmt_aout(r1, &(0x7f0000000180)=ANY=[@ANYRES16], 0x2) fcntl$addseals(r0, 0x409, 0x2) ioctl$TCSETS(r1, 0x40045431, &(0x7f00003b9fdc)) r2 = syz_open_pts(r1, 0x0) readv(r2, &(0x7f00000000c0)=[{&(0x7f0000000000)=""/55, 0x37}], 0x1) openat$selinux_commit_pending_bools(0xffffffffffffff9c, &(0x7f0000000100)='/selinux/commit_pending_bools\x00', 0x1, 0x0) dup3(r2, r1, 0x0) 20:30:13 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$FS_IOC_SETVERSION(r0, 0x40087602, &(0x7f00000001c0)) r1 = syz_open_dev$binder(&(0x7f0000000640)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000000)=[@enter_looper], 0x1, 0x0, &(0x7f0000000040)='+'}) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, &(0x7f0000000200), &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0x0, 0x0, &(0x7f0000000780)}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000380)={0x8, 0x0, &(0x7f0000000500)=[@release={0x40046306, 0x1}], 0x0, 0x0, &(0x7f0000000400)}) 20:30:13 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) getsockopt$inet_tcp_buf(r0, 0x6, 0x3f, &(0x7f00000000c0)=""/225, &(0x7f0000000000)=0xe1) ioctl$sock_ifreq(r0, 0x8929, &(0x7f0000000040)={'rose0\x00', @ifru_map={0x2, 0x2, 0xa0a, 0x10000, 0x5, 0x98e}}) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x30, &(0x7f0000000500)=@broute={'broute\x00', 0x20, 0x1, 0x90, [0x0, 0x0, 0x0, 0x0, 0x0, 0x200002c0], 0x7, &(0x7f0000000080), &(0x7f00000002c0)=[{}, {}, {}]}, 0x108) [ 367.277619] binder: undelivered TRANSACTION_ERROR: 29201 [ 367.291830] binder: 15963:15964 ioctl 40087602 200001c0 returned -22 20:30:13 executing program 2: r0 = socket(0x11, 0x80a, 0x0) bind$netlink(r0, &(0x7f0000000040), 0xc) clone(0x2102001fff, 0x0, 0xfffffffffffffffe, &(0x7f0000000000), 0xffffffffffffffff) ioctl$sock_SIOCGIFBR(r0, 0x8940, &(0x7f0000000240)=@add_del={0x2, &(0x7f0000000080)='yam0\x00', 0x7}) r1 = getpid() sched_setscheduler(r1, 0x5, &(0x7f00000000c0)) getpeername(r0, &(0x7f0000001780)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @broadcast}}}, &(0x7f0000001800)=0x80) write$selinux_user(r2, &(0x7f0000000200)=ANY=[@ANYBLOB="737973746c645f736f5f63616368655f742987bb8e11b9f0ab03a636663a733020756e636f6e666900000000000000009ef3997f8fbad612f2"], 0x30) io_setup(0x7, &(0x7f0000000100)=0x0) io_getevents(r3, 0x7, 0x4, &(0x7f0000000140)=[{}, {}, {}, {}], &(0x7f00000001c0)) r4 = openat$selinux_policy(0xffffffffffffff9c, &(0x7f0000000280)='/selinux/policy\x00', 0x0, 0x0) write$FUSE_WRITE(r4, &(0x7f00000002c0)={0x18, 0x0, 0x2}, 0x18) 20:30:13 executing program 4: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = socket$packet(0x11, 0x3, 0x300) getsockopt$packet_buf(r2, 0x107, 0x20000000000006, &(0x7f0000651000)=""/240, &(0x7f0000ca5ffc)=0xf0) ioctl$TIOCGPGRP(0xffffffffffffff9c, 0x540f, &(0x7f00000021c0)=0x0) r4 = geteuid() lstat(&(0x7f0000002200)='./file0\x00', &(0x7f0000002240)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) fcntl$getownex(r1, 0x10, &(0x7f00000022c0)={0x0, 0x0}) getsockopt$inet_IP_IPSEC_POLICY(r2, 0x0, 0x10, &(0x7f0000002300)={{{@in6=@remote, @in6=@remote, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@dev}, 0x0, @in6}}, &(0x7f0000002400)=0xe8) r8 = getgid() ioctl$sock_FIOGETOWN(r1, 0x8903, &(0x7f0000002440)=0x0) getresuid(&(0x7f0000002480)=0x0, &(0x7f00000024c0), &(0x7f0000002500)) r11 = getgid() r12 = getpgid(0x0) r13 = geteuid() getresgid(&(0x7f00000038c0), &(0x7f0000003900), &(0x7f0000003940)=0x0) r15 = getpgrp(0xffffffffffffffff) stat(&(0x7f0000003980)='./file0\x00', &(0x7f00000039c0)={0x0, 0x0, 0x0, 0x0, 0x0}) getresgid(&(0x7f0000003a40), &(0x7f0000003a80), &(0x7f0000003ac0)=0x0) ioctl$sock_SIOCGPGRP(r1, 0x8904, &(0x7f0000003b00)=0x0) stat(&(0x7f0000003b40)='./file0\x00', &(0x7f0000003b80)={0x0, 0x0, 0x0, 0x0, 0x0}) getsockopt$sock_cred(r1, 0x1, 0x11, &(0x7f0000003c00)={0x0, 0x0, 0x0}, &(0x7f0000003c40)=0xc) r21 = getpgrp(0x0) lstat(&(0x7f0000003ec0)='./file0\x00', &(0x7f0000003f00)={0x0, 0x0, 0x0, 0x0, 0x0}) r23 = getegid() r24 = fcntl$getown(r0, 0x9) r25 = geteuid() lstat(&(0x7f0000003f80)='./file0\x00', &(0x7f0000003fc0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) r27 = getpgid(0xffffffffffffffff) getsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffffff, 0x29, 0x23, &(0x7f0000004040)={{{@in6=@mcast2, @in6=@dev, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@remote}, 0x0, @in6}}, &(0x7f0000004140)=0xe8) r29 = getgid() fcntl$getownex(r2, 0x10, &(0x7f0000004180)={0x0, 0x0}) r31 = geteuid() getgroups(0x7, &(0x7f00000041c0)=[0xffffffffffffffff, 0xee01, 0xffffffffffffffff, 0xee01, 0xee01, 0x0, 0xee01]) sendmmsg$unix(r0, &(0x7f0000004300)=[{&(0x7f0000000040)=@abs={0x1, 0x0, 0x4e21}, 0x6e, &(0x7f0000000300)=[{&(0x7f00000000c0)="046dadabbfa4c1849d93a9b55b19136410f48995f1d8466acce70640cb12b7c74231c8", 0x23}, {&(0x7f0000000100)="cb25ac1d1d45b29f5ff31956321b409fe873791bb753d5d1b3b226fdcc1d44d581a4d9f25e18f3af31d0db66984752a7d6f7dfe0f74815f1e2ec2823559f5134a1c7ec6d9dcb9874c2eecfc1340af958c90de84348c4261e695f4db788538c9fe68842e23a5b7813c2a989fb98a7c403e9e161e58062b1a4117b2efba19b255beeb7491e83a2b60967276d8099c4af17f799576d7788", 0x96}, {&(0x7f00000001c0)="3328d04fe3596d957d9ef54cd43d7d356d46e3ecb9221d4685de93bd29d34da553f0b6dc5e449d9892cab1a8f938dc5dcb8751d109f3754890403d070a8cd2bac7bcb4a0a391cde4dbfacf94924134f176e2f5d47f31ba743e7935d506bf447bcf06609ca6f7fb094ceb7b9a37d33ea4c9261bd3569c8022b1996fb522898f", 0x7f}, {&(0x7f0000000240)="f6cfd50d467a87678b6eb7c091a8ede12ab1a045b9a40ec08df3d00c6d4102b5c05da1d8bffbe5fc0f53725dafbef36be5c56b82b9568b62d3fff7f464500793a8c286e8d9c03f1fb0ef5b027cfad0f35f21b47d9e2450d568fc2fcbab86a4eae078c4ea25039490cd4dabd43337b767fe14cb2f833e0f4d35efcb1414f04695bfbca56af570f074d59e6074263c3850cb458ec7dada52968f39dc9d3037de701d5af0ddc589e47dd02cf5765a8289e84142ea68823f6a632c", 0xb9}], 0x4, 0x0, 0x0, 0x4}, {&(0x7f0000000340)=@file={0x1, './file0\x00'}, 0x6e, &(0x7f00000004c0)=[{&(0x7f00000003c0)="1ed15457f522189bc0c16e5d2bb0279911f6905847d2f4713f08cc4253c683b9cce3791d791805bedcc0ad85f406abae313fbbf84ba4c0c9bda77006a15246a8c077ba00189ee3cc11547a78e58f7b7ba46fa5ddb4ad5b8fd57045063d42a169434fe920d152f73e", 0x68}, {&(0x7f0000000440)="1e29c7cd034f1e851577002534cdd7024ede03a97f18b2965358695ec6c40325d04d3a5ad604c52db52f20cebf7d6689ff42fe433380efdefc7b620b8228ca6bc01ce3748715629db6205fdbbc9e66ffd04b2b7ceb01873fd702c007cacab5fe34025934bc9ac47fdd8589f0d81fd12eae631c34d0eab2ef60d9", 0x7a}], 0x2, &(0x7f0000000500)=[@rights={0x38, 0x1, 0x1, [r1, r2, r2, r0, r2, r1, r2, r0, r2, r2]}], 0x38, 0x20000000}, {&(0x7f0000000540)=@file={0x0, './file0\x00'}, 0x6e, &(0x7f0000001a40)=[{&(0x7f00000005c0)="ca6783f01063d48b1ef3687f1a2e03dbcaa5736e4f74c5c68db5e02b612613c8315941e2a0301f706acfe21d215d4617beb853a7691c19c4d3f591d3b11db996e28f4db34c4a75c8d5538370a3225e53e05e0f0ee6a4965397", 0x59}, {&(0x7f0000000640)="062bb945b678766f039365efd7b2", 0xe}, {&(0x7f0000000680)="49836b1543673a235d29de9d1cf88a6a5824ff77725fa2a241afb311602e9cd14aa058b4c5c88ec556d6a3104a7f60c21f2e0d028c37048d5d1ffe30236924008967a619f3c8fa73125baa8c45", 0x4d}, {&(0x7f0000000700)="1f555cadfe7ce2f5ec90de9568ca50b28fbe73210924189c4079ae79e9118c9d6f", 0x21}, {&(0x7f0000000740)="8530ffb65d7605c4a152cdae43f75b37b817aa0711d13f3daf99550ceb846587be78b2e3248c5d1713b77ff12fc26ccda006e364369f0ddb", 0x38}, {&(0x7f0000000780)="47f40855715ade4f0b7faba436aa0fd00827aff84602853759fbb3a859ac12cd85a39cb07aea12e656c3039303957fcb57708fb4a24aae1f07a44098e0711344de014d0e7b7a70069e3eeb694808e138db497e7fc970445ae9200d7ef5968e5392d23e8a16c374a7f61ca8cd9e67da9ffb70f976452033d65da25a4d96de718216492f2fd3306a3833a20b83ffa020f0a5c95c70ae6cd086eead2e72f66e79b89e1fb22f731c42e77f88895ccfc013782a6ffe59062d172e794944fa3c5c2dce7683dcf9cdf80ee946526f9a7c396677169cb152426b051fddb2d8d81046ca1d396f60dacfbfce7a47bd32311bfa4dff55dd36b0e272bf", 0xf7}, {&(0x7f0000000880)="264d65e1dd6d7d25321ca18a3bca6242bc29fdb3090a25f55725894245903f6b596c7f406f2ec4cfcd9ac2443563d1e0d1642de4897a13dcdd253961b922826d45578fdd1cb91dd4ca5a1c253abe82dc2f5e8b49f02d73e2dc18b3efe8bf7a6405791e2833435eef11b0d90a53e48a0991784dd8b4b0b1d8eafc426a6adec30fe07bc3303a8bbcb507dc0593d37f20d26a30a01a4f15a5749d0f8de33f50dccaf6a2252faf271b5f0e13e825dbd419539c06248953c602218ac872da576644a8672779c74b7dd04f6f75cb65cfb97028fc565a6af8fe1816db91bf9686d3401cf680e5fc99289744a9b4df7970937dfdb108fc796acba6a01679cd98b9418ca368be76bc236e1eab3ae4af5e55b5eb8398bcb62f3190fd3c995425c5a2d70bdcf136120e40a67a79f490aaba41fbedb5701d0ed20d1e72bb2a0552daef3c75a2200f13c6399665984265e4b1149d470fca5c6a465c0de9e04097fb22099ff522e90b48c44037227b374e72923ff33f26083c242ef83c6a0de858b35e41acdf3eb2eb245fa539534e8965e75450c1a2c6a3e41143fc92fc4c69a926b4b2db24616b4ba1b45f2e16f3821889fde9de8fc8333eab06678b709adfd7832d80c5f426d2929db3dde59940aba18be7814d82ec76058e536746eecac5b496fe3c2c5cca769335cced0e484745afc129ceba754ba0f62105ec3ff1f3b55820b0ff5e40ab6fa776753108ea59cf8a96107f38ca1600377e89354ede1d044011c68cceff307dd518e3fda713d936664c33afe82a7a766e6f788657432ccc36fcb0da1fadc58e8164d9ef468ed296fac4215436f9a7d33b0a61c68e739c4824d8a4b007576e5c2f3d48b4da331bfce22136ed6ce2b24ce6be52ce662d7aa1c190b7237e5f9893887c945dbc0b38a8aa9ce8c2128db1a2dfcfaedab8163174c2c7a177d22fe71d32c12dfd1a66c6a786cf607235b754bff69591e2d210f30b360771bd644294425266df49c67a824bb8e1d7120ace869e1f6a51638ebd843dee0bf6c5455d63683936c8de24fcf5a6cb48697e5dffc7fb17ad85e19282e557d3920079aa846beec525d02d089fff079d7efc8418b2ddb29431ca3c332a75214164ed77c3e1313d79ffc907059d4d92d0a6e180fdf7fb87d73f11e115beef6bf5fdd307f00521fb5b6a09a11d9cede0abaf6c43571c5ece8bfbcea496e6a44c64927d62e1d961654af82dd0e53aae80f8822d599c8af02b125f6fd8b117cc6f22a8c40ef849d3e85ef5fff848e0210b4b7cd2b21034cfb6a25a89b2cf78363dfb848b2437b4adc0b6a608453f5158965873db3ebfe1fa4388791d3be6fba75da2a8d8006858a15f07bbd6c9054e48417dc94665fc8b4bd066815f1bb4d462dafe172283f1488171c37f108bb7dd46e925425bb8680b0047797d335bdb70669ecc7ffa45a2be6a129ccc0cb3f88505fee1d17cde0973b7a99acc8d5b9ea27fd78acafec1793f846f50470fafd674d516ad28e63bfab05737cbcc6610f5d0630229cee20eddc86e8fbda42d1f2a5d039e2d1ecb8d7c3ba5171c61574992115146015bafca83038c0645002dd78ff0b62ee27512b52cf8d999e3d32d7cae023eee91bf0ffc59cd07c544f55c17eb8b4d33bc5657ac3872bf4257d77c563c74ac5807fc56f160d6c3511a7b49cf41a20e30011cd9c21ede88e9cb176c97b8db997c6efc24e2962e3d2981d02ef86e02f7897fd89545e21aa4881e59893df680ef0ad135ecc5c4941fd34cfbde1b27ec7c0d77e6d93410a3eb60407259c8a1e95109b0c7ba2ee74f293308a77a4dc2a117ec6d2df230fdf77d61a82eaedfc4eb913c06538ee1219db50a10791654d520ee38b861dc0990ffdda4d9a1ab9e6d5ab1c322a3ee2c985d18916d94ab8a0cea762e4a934d400da4c3853c4286bfa210b5d6312e987611e82a6b3ced8f5fe89218eec4fddfc87d60b620380f3d61020412f893d0ecd5965d355298addb3319fb940e94733f0cf45455df0555d772d5dbf64230905d47b25a6e1bad60789af229555708743fae0ebea54e4ce920e0b6e5ef72c37f7fbb9b8043d2e1f8e851d2675c92fe9c56c16c87594f89f0a9df0f3b721a3243e68d8eb603037d1d52d21d188b3b87a3e7fdfa944bc12dd6adae935e297892030a10e9be64a10749b7991afa80a97c8b067a10e193b1ac26e2604869ffb995462e5a889e56851c7ef7b42d0d2c0e054db88a6d6c6e1b8b6f95ca2838fbec4fdae5ce521271a123e92d627bb443d7067e5b573799a4920ea0f086fb728943ad45d8f0fe78b75f5149f67e45a80e96a8ae0da1e9c992c438ca482d026869a3b9c3bf590701cf066747be13d5d71bbf217a0be686ee95011fffbed0037cfdbedd77811dd462e31283327401d0d87a2361fc1dda8358718b7d04a90bab437056b3b73fc3b29ac5ea4f79c1afd06c14d2e8d534abb4751927a60f7596531055ee510d98af8e734c9e45e508946a5c6e2f7089ef1f004ef85adbf9748f46ca709337de9547d4bde5663d77a6ef51a28e2b956cc529ef71a72fb974e17075b376eea6a06e9ca84e0b1582da1e516340f37e922a8b10752d2674dfa6bbee351d18fe43f2127c1f8c40bb16698bbdb6a54573d2290ff6713d73b1137db2cf4cccbdf49ec1ad42a660ccad3989eeb228135ff671a075d6e77cd95f8d0029bb69d6e415ea36902e3f9ed4a23d4e1e1e4ef0a0220595cd5059e5a5a9a813e62c6d879b3e630fa6a4439e800296cb8acabb7aab47512bb78ec197e8205509f2171185afac51f9722fc2aec4ad780c64929ec4323553937fbc2368bbfdfa8cdbc3b4e365a8a2d4abcb09eac8b2d581428e91e81fea61911a8c04e35352f31c58dd70619e9fbfced1a2796f69a5bb549366b99b217807768ca306790b314f5e585cd5411551aa142761a933448928a1c6b3d7d146758bfc61db23029e94062bba2e8dd55b25c179b81ac77830a4923278d806c0589fa22bef0c106b4e6e91c4181f1be01dd876dd39f9b4d6df7afbca17ccc9cc763a80a43bbd243a1279d31cea371c27cdf43d9ffafd743e02f6dd85b557c995e5ea62a2c1fd9baeba5f11d319465749dceffdea641f62ca86c993d57661e0b15ea2bcbe66de3de8308fa38751853d44bd598c2a1bb60779f7396a4b8837bf201c575a5e9b5cf95472fc78c13967fa0868ebf813ec87bdf36e2245b99fb09bd0a28623aebb31ba9eece7b19352450b8fa7fc62e2aeeeefe8f6d784681d28b6ea85009bdca855faeafbe6aa645f3faa29f2d52f46393e3ecc635aab110d29c9e913fd26dfbfdbd6c35aeb989d3819c42cc0988224abf04f70a0e37a0ec0258afb04ccafb199b968bfd20b9e07c1bfa27654907d3773c3caf6d18be637b369c1aa0cb2443c07286b5c0599eedc3a8c803fbb1cdaee40e30b2f4f9454f26d4d770fa55f1fc9b0702a9bb3e19c9973ea74e19429dc751fe189dc69d1c99d90d0ec9dbdaf180ce0d65dd57c994646a5c22e9ea6fc636a010d3f0a956a1892397a989c3b2ff902000333e1d9843a9307f10ea435068eea8ddbfbcdf6b04b96e087589a2a6e81c564456c639d16362be50d38370e0696ca53ffd03aa182b23b5e0dc0b6d6f82719717086d7084be1777f2fae6597d7f90e0c6a03bf9873f20ff7fe04dd5e4668af025da7f9ca5de686d5c20c2e92b6d2d2abc9c69f76306dda2bc902e31721299db0b0d4a2c393ffd2eb3086299bc39a81531229d2658e5f326d7a5ac4ee5b060adb793cd52720e93e9489aad7fbb7c66c9eb05cafe52d3ab490115ec7b446193cc964e5a9c355c00e20fa22d33567d8d8e377e85b404514147279abcd813654cc82304cd74afb95e1bcacb00a75338d520695ac3c5077635e136e8ea4d826a09f2726475183698602c955a1659178cff400754136d8b709f0ead087f38e98a850e72989b52d088364dd37d1348a2758e6e5c60ff32c31ecac8dc6bf96dacbc4fda891e700c9450a04c19c517d0f632343d079ea7d10739769ae3f4fcabdf135956b06bf76bb11352c76f1066dc857595437c051151c0f1786377092afb4b5658d036568b28627c3bf203758a9df7904d88c9f98ca7948fc1dfba11b0b2937a043d64efd24b810f3bf7218a34d991ea240491945a030d232f7675e73bed5229686487574b69b7eca72ce543e1e5f376ac52d18d5858d3d638034abf6269fe51871924c37bb66de4cd5d414efff5dff6ec88f4d261e633033494b7e56bdbcb970947b71f1b1d53f549eea94ad49c1b315e183335597e6d85cf44f416547c5b04280642b11f41874507dda5fb21b1d6b0ec8327105f386f6a51434cad48ee4a33439bc429c8b8c7378916ebb6565933e36c60ae79b7d6be1d7437e5a388cad08652346045ac3024b069e5abce384d14cdcc37066d3b62606a815b3ce8c31db4a1cbd9aa323ee2c523bfc946fa8a1b54b7fb88cd39f0935396321cde0ed2fa2079376491276a1165abf7b4ca907b2e22346adaeda0d9698ab1feabd76f5029302cda49ef11310fe175907b9748d0574a7f4414f0e14eae70859f63cd137554088d41b7501bb98198c104fb1bad592ea39666c84bb1e9d49c610ba4f2fd9de5a640a4941cc224d3e4c6fc7d2f655527483250f45d721d7df10f4e5b0495b6290dbf0df4668dd19eca6e77def71149baf9e8825f84d86513a2c89c2f6852c3452713790f87e484fee1cd862c0e5d449c271f63acf697fec03f0d18bfffd603d8c34dd5dec52391fe7f1e4a19920c0ca057cfd6699883b327a0b3bf16fe2b0711d7a9dc4ecf91c01bfaa6a864c8503165934300284a997502019ffc9c35306826d7a48284974d4694f3f3d24bd1e5efc93c54b64ef338f8714adc36dbb9b74c5a418b8b1b36d50c9a7cdd896dbc4e4be59ed560565ef062f20159e90774c2341bbd934f8a7b7c09b12aac87a2d957a17ce456160bb0ecc34e015a90bf0ccc6fec98b7c3dbb82dfd7ae3c8582d3f37c73fcfca55463876d53207144d72545b42a740b0a6d84b98ebc56a983c239ee67bb9afaa11df71bee6a5750271b28e598b380c70f1a722f08ed2f87015dd7e6848a34c03ac7dd1e9cab80216624e017a29102330672acc01a552c588fbc20ad4722f1a116609142ea1ff743e633e2ff68857a47fd6191aa7c53a7ca89165022fdcddd2b42cf35f1eca2f765bf9f502013e8b98e6eed44203524c498ab6e8528b99ac0a341530fe4f13f4b2682bc7ef6ab0c05f9e991684af691d31b4c1e2a9e20451280dc2818872376d050e38c6567f6bf0976abf1a889de33825b1232ff20eed98d3a92c1cb47c1f5d475cc955b1ac51d1f62bcaa7331afe38fa091f5b4f87fa9220f382b17c8187883ce2743f9c9f50f75caa1434577986b6b7978fe4bb24b29d1694c5a7c98a475c5b0a0bf947144a8436f15161fb3b408f7679fd8d5fd7883ede63494d690cd52b34042518cb0c5dfef3e0a7c94006cdbf8efe9391a3569171428424b4acd98fa65203d3f057b10d7fee1805dc96e5cd7c6dec0d5a5f79a1723036df5ae17fbb77f318c809b7d56503f14bb3b4e7d41dbbfd0c78084246ad65ab0c83d56c40d39159623ab6be56545ce9e012da64804d9312fc81cdc3ec1b189025f821aa37d709d0f0cbc00db0f3dbfaf44c8223488e2213bd62f11697e50f439782f9a40d9fe4d8125d58605a25b53d562db35a0b01034119a8ab4b91758e26ac6acde03b9c391530d4c9128be24c2dac1eb986792c0465b640208de884efdcccf06334ca6b881", 0x1000}, {&(0x7f0000001880)="4a6ff406030662f3123c34b6208e2acd550f8813eea5d0d025ece7951da17390a59cfc410e6a23ef16b6687b8f38c316440924c1dc94926e0401548d4c3dc70f7ecf5fde221f96c604d88aefa4e9e3772e6d37aad19ffe7878b7d9b327eef9e9bb3eaa1bdf331edf25b7042b3e818e646720088a1079dc9959ea29c1fd25f4a79726b56d09602274fe71193991a4524458b20856e7e5fe92709068fb1c1762aa1b45c43cf98664f02c96f7243b26255ddefea8ec68017e7aba0ed77f47e1da2650255138de6227bd50d0649e97f8efaafd3fa063ff952872c027dffb37b7ce198160c61d52ccfc2ef7d4948ddedd7138", 0xf0}, {&(0x7f0000001980)="d0a49f02d972bcde621029e7ca6afe9e91c5a8bd789012802913933b09103849824095c82d3bd331082bed2385e81a2ca775aa504302d4cf7735af97278925461e5146953bb72f2eeb49b67cbcdf3919998c7dd8d8e59c6dbf07c53b13c2caf931486e79125fa84e4f9f44a977", 0x6d}, {&(0x7f0000001a00)="7a1ae7b61e2b2dbfd11bc7c6cfe733c1970113c7f4", 0x15}], 0xa, 0x0, 0x0, 0x40015}, {&(0x7f0000001b00)=@abs={0x1, 0x0, 0x4e20}, 0x6e, &(0x7f0000002100)=[{&(0x7f0000001b80)="954bab6c42966b7f5acfe357c0698a06386842c701cc672fdaddec08a1b65ce740667b1308284e7756c8a7c1db344ee801233cccf7fbea96500f615e4abafbabe8a79f7d815e0a7934bba35b8f62856f0100c2cebbc400112affd4aa5842114f20b24e16d27445329ceb9a7213faee2d80e968240efb9f009de758f933e94e92cb3dd858b86a11cdaa3868c10fb3949c57a370fdceebe4661ac677d73f00730f123b572e46bc9861ca43fc2850474908f812322da24af07447aeb9849b688816655c840c248b54eec810", 0xca}, {&(0x7f0000001c80)="b7d0fc38aa628c4e935f6fddc911fe8671860420eab8db0a13c3dd728e576c6ce374cf012502ddabd86e99f02e97172439eedc8b5c89f971ee53135f78f6ddde3cdf5fe92b12b045cc860f683d4612c4f7145ca637e1bb7fdb7f8e1dd3c7a8464cd13c1a5e46a0ca0c538df8e52c0ee2e3bf5f61ddbd96b721bde7bc44b6f8850027", 0x82}, {&(0x7f0000001d40)="1c9dee9b979b1d86fffc0e", 0xb}, {&(0x7f0000001d80)="540093335f24bf1d288daaf0f01c7f0ad584a27badc9998059c2487870bce7562fff632233e57be7e1770da91e84212df4f2fb28281d08a8c59ae26601af17933280163025ade71c1ee8dff937051dc6db0e6a4e03db49763f3b7be7d9be18eea7fbeca4ea81ad019d2e782483", 0x6d}, {&(0x7f0000001e00)="bf22d4141ea4b46882041ac6becb39119100d89d60809c8b5c014ffa19b319fcaf702ebab0da8af88d09b6e092b202c6169660ba0dd9c4b8506ceb77503ed27a5964346e95dead5ad89a8bb8a7", 0x4d}, {&(0x7f0000001e80)="ce633e7258931b255312b52e85da722e435c550ce93fac9b55e4a3aedb08e4d34fe253b793d5c4", 0x27}, {&(0x7f0000001ec0)="00413ae2da887a574e575d7e436ecd1a5393f9c2cabd51b6775e345a1af16a01debf65989ff1d596c795ffc65399fa15954ca64c04bf715097aba3fb40ef48008423adbfa4e87a6bcb5b1e1e7ccbf642d658641a300ad494707c8633973c6369f672c9871e1894f44fd1f425bf121bf292373c49543d7829243dc2480de662d9ad8fe1c7eb98d80f20fa9f89814ae8f628ab0dd2cbc58b977b8d7e30715fa1ebc6297a526891b502fea68944e7b651d4d98ffa8dc22b38069f7477483b543c89320628dbbbfbd848c40304", 0xcb}, {&(0x7f0000001fc0)="6609f086dfd95438d7de70", 0xb}, {&(0x7f0000002000)="cd766b8e1f0e6f77d4a7d131ef8d06b702f9ef65113b9f0cdf9219fb386020ac1c1f29ad510f9250d7e5f952bffe90026eb5eea5e2257a28be66e40351bf46b191a2e7c4f832d0d822b3e96466bc2aba6a832fb114a3b67af44528b65247707f55716dc1bddc9878891e1db8f162b7f78839d4740e66066c1e06c63802837ddb05380fac3b5b588c1f3c15f0315f181eceb5c36265040b82f573182827aef5b443e89fc6e28354bb542ac11ba4d1075bc967a8aa511e4cc81e1a973b3254e01a7062c2f6a046302fffbfb887c0a4ab87d837fa8451c8d991e69a11cb3224547060059e30cd119417539d", 0xea}], 0x9, &(0x7f0000002540)=[@rights={0x28, 0x1, 0x1, [r0, r1, r1, r1, r0, r0]}, @rights={0x30, 0x1, 0x1, [r2, r1, r2, r0, r1, r1, r1]}, @cred={0x20, 0x1, 0x2, r3, r4, r5}, @rights={0x18, 0x1, 0x1, [r2]}, @cred={0x20, 0x1, 0x2, r6, r7, r8}, @cred={0x20, 0x1, 0x2, r9, r10, r11}], 0xd0, 0x20000000}, {&(0x7f0000002640)=@file={0x1, './file0\x00'}, 0x6e, &(0x7f0000003840)=[{&(0x7f00000026c0)="7cb79604d5b54949e1f5985e148f6001c04ad3536340351d224971f28d4e66b9321039b7a222cb9daa74cb09e0bd2775494e3dfd351288", 0x37}, {&(0x7f0000002700)="c67a59c648cd484b11672ccefedef0b19886639750725ce667a4984e04616039d353280346d742c43ca0f0f61a4ff7aa7a8f619d274a13837cf731680a5ae955cbc75ee016eb5ea720533e4751d3b0d9a27317be8d3806fde6e2628a3b468b9eb3aad63971bf6e0ef33b40afcf30423a3e68a64f5994f5589432", 0x7a}, {&(0x7f0000002780)="b7b1e34194a2bc2e307600e1335be5b6bf7d8fef36415d11ca266120c81261fc0cb8857af73a716cd16c6b78f95c82ec17dee6d12306b5dc775240d023a6207fa65dbbc234dadee4e7a33c4359a72002e9bc62452bc0700086a6", 0x5a}, {&(0x7f0000002800)="e6fa30710847da9cafd4d611936332974c95100e40d633d5594a792123b63feacb45d94592ef9d825c272ea6cbbbbbffbb12ab015977987e6cbc7e4055811f867693d56bfcf778d089e7142c7895f514e0f4a790819c4fc385881b65a6f7879f06f5019d456ac2a3b71093dc8dfb2343d9b4bdc5ae1317e66b30e772b4c550cba55d931af1ca71dea56c9fa8a868bfdd82a9bb6a454a563a6a7ae5f997a509778d08896116dd4c0a9bcba3caf4faf6c500e563720b4e1de3e8450ceeeff09099a366aaf78ae086b323f0e2c3c8129bfff58620d534cbe126eaca6e1b24bbe5fe4e3a5c95a1448e7bf255c37ebab13b0f83d10e37afebbe09eac218908c4d6523e78be29700aadfa0378d48564165538059195e7d142012f30e9773cb1efda0a613eb9f4f0e32ed5bac199ac001e14c23ca65c302eeca911b4597ae4bc07611cd6f55f6284d32780aeff0f3faf7ec85f43cbfdcb66195558c60e9e9d5764be958541512cadaf28fdd12eb424e75dfae2ac1d192ac121074a360de85dc2acbf9585662841540758e70adb4fd2fbdc62c7c99a43b84cc8a51d576f6defb8e100d582c870a1ca4189e7f3eb15127bdd346f96ea758810b916dada7c215b74d71f1272e0a3f4dc7d7157cc4ff306a961044cfe1f53a5ad12c549e72b028e8c0aff5fe8a31cdac73e876b8605b89dc2a17f726ae1e6a9fd0dfac35cb4ce9b8d74fe40fdddd89c01bf07f61c518f28e906e80c0099e4a6026efe021fd49576fb7612d66e1552616038f184c657a68df3696f7fd2800037d36e055f4108891ed00d105f343490c20bdb0fe6bfa2a7f518704d0b8ed723fb28b935d387af0779a2c9d286cef6c30e4fe3b32056137fb7c38a9e335ed652352a10ec8e9278b0c6504b5ca7a6f9a17259bb092d1cb8e845097e6cab56b0163dd8dd8f4fa2c2bf453b0dd4da2106f0f387b445bdabd8a2256918324ed4dd3188bb8f4dc24075a17f81f45724cef70459eecce3424bd3a9ea2b270b5cbdbebd0ee61debe81acab72e42fe6dbe92c75102c25430bfa0a1158d151808c77a8469b12f7ca22e13345552082338f842f377f817d1ce947006e16deb2cd14e5f4414f940e39d468a6d207e27f21082427b395d441ada30411e00c2082536123ed022a5ae2e4b50216d3958c9b1b9446378595a4c2c45b4849d3074c9f3be188c45281bb0c7cb9e92e13ba0c9eec27b743d0093f5d6b3395c6c346b8ff801d82854eea4505102f409cd402197ad94ff7218db531858e6a7403c14c0e4751d995df339c05ef2dccd86879da45c7a8b33a0a612ab10f05e3e3eb2025ec3f36d28961ed2571ced1d1bcc3a66099a27adc78035f9ef37e48d1ee1049a98cd7ce6f341e811c58ae607195024317c96dacc90b2d60001064ef4f6b36aada2faa5c63758d68f9dcb6761881f0e90de6e15ed9b8ffb3623f2b95496193856d12f4c82cfd2c88b98b12eac9910a15266350a4f542ef348e176c24b59867d63d9ef2c3f1e91a610e6701954b16b43ac9cdcf7752ec54baae9d43599c155da0b0bfa492424364a22465846ef92694338cde9b834bbe664e129cac8bdd7f0221a14b7a1fac31558e30302f3d8c31de1e32fd1a2ce6fed7ac65edd51d5d95bb05b338af71d678f7240beb11da827afc95ae4ce04c441ddeeb545ab6ee99c602e7ca61499761a1ac4914b5446d3e5dd363ba528968a2c1f692d223ad00d732f3bf22994385b0cadd26b23f014632f87a1dafae41a248dfcf35a6b80841313d248794aeaf3861340d913d8de958ea7c962afd8b0df8ff73e49da075201250d50c133f9e6a054c268c173e1b3407ba51bcaa7d8d5767151b6d7126a559470e87cba9b8d8d30570d12dc023eff62aa56243d9bb6d84cead1d5e2a8e34aa0c8f56270d0c1a4d5ceffa32efcca568653bd05bb3c132f33316717be424a2826eb6f995aa123facb06940ffb5e221d580f384520a03216c8244d4e5eb6371ddd2429e12eb3eb5507c50d401020747d28a20746850924e5444b70efd8dc9cdaf6d22cc4e04e14d88c1d4086f5fa760d670d8c7d9bdf4694e714fa471b689722078020420191cb9d2a6ea2810e1d8d834dd417407f5d89d72927cd157925837ce6cba36bac62bf7ff1b3728126b3b96e5d4199ab6fecd5c5762736c9637434d93cc3bd69cbc163dc2df8261610a0f6f47f2ce147c6cade219467e4f852a0bbd6305f5ca9b6537545bc79c339d8acad406cbdc11cae27225859d119e312ed187df4596db0c1e0965c9e7443b86580745aac38e803f35f3ee782714eead952ff73bb1c7ce55c8c5b5fb1f3142f93470368c4cffc00ebc0e63e3a1f259758ecd4f458b185b5a90a8f5e45d6c5e35f353640729e8f6d9dbb80e2ca269a48eafa04aa16fa07e14191037e196881cb122f24d3ba894b700dae37dd1d4803a5682fb53ecb4f0dae97b086f89faa2a533a2e6b8afada9e123531636e6b9a5c2d575ceadf69172fc79bb2d880e490a73f6627d6a1150e6b7cb69130b434338151466c6f2857f9b1c82816017f4b90420b5aaed87bad12a0e39570ea0a665a178f4332ebc701e24c1d39e06f068ca105c7637690c0396fe70e74b1378f7a4a66b694442d315370801995e91215ee6d11e2f6ebcbadfc9c12c060aaa165ec95b29d827ce2857fb989a937fd45ef3c54da006ecb063fff5038378d2561d1d103b9eb41fd9ca7e9ad3ca69c694e26954722019997dc37aebed5c3416fd2dc4927bcb89c427fd71967f1004e5f5066a1b9c9c945b5508b0dc3ffc31d54b036af7070301d5c475bcf2a22a62131a8f2d3a1480f039a4d1d4df3942e5ec9c75f1cdcf87909614c48af14bbbcc610866b3368da6c4dcbda0381605da4d0c0981cdc6580700bf2f2dd7341d35bbacb79bcd184ca875bbc69d625d4774da76ebae88435d75d63e1c0effbdd64b285611e146918db15acc0b6399b2922bb6ac3c7882e49b68efce6e3778bdccb837134213942fccb9d7a5db28a72fd2bfff66bae984d252675672bc4f871ba05ee91d486cf6e02abc33e896161a251015074161eda57214d2cb11a91469f5c09fe8af27b1e5b944d9297ff4df955aac9eaddbec197f7af2a34fea215c0810c7f97b3e7cc71508cd02239109d2c0ff16be45f8d36e2d7f094a31c45390ba77aa94c5f68b47239b3a0137710c50c1bbb2b0e67077fe301f938a0ebe89ea5cec3a94d38ee281d35e2c057be3fb1bed73e82596847035091cdb1b5664265e10d99419f35d43eb1855e3092af30d6bd56cec1e109f2988704d53a32b710fb251533830f0e2e574a82be89118bdf6ccbba99ef99f3f8cf79aec536226287a01f40bae0ce7e4344ac28d5892ca6d3880885f7497214a1e8656cc44e01f9d9860a8434b55405f7eafa288f2081243fa7721b12adab6f8bdeed197591ef062a407343fe7e4b30d31c9b8b6ce8a0a351eacaa6765a7eafc281e558b25ae1e6c520a179e5c45fd3efd4b00509922120ba50126ca3dce042555da907031a629f2b960cd599aaa3d1956c7337a1f0f37e1285286bdfa23661b14a8585f3aef20113b8aeb94861c777b52e052a340ad238b8103d549496faad0bba7134f29b5c9a3e16cb16d83ec0a8c8bda50a6b96f77ac6dd63a4fd5c5ee3f61aee31f58e4dfee68c95d77964e322a2e56c385ce44ddcf43e3928a961d1d8c58d74178b379272c8181be07656a5ba7a6402e2793183fe3c9b317f9e6fc19f16602111a955952fa9a10b4a6953044d8e6ec9fa374ba9ce63afbbeefb825cb2b0d07f200fec9462f51fa34f7fc5230c7d9047f5f49b3ebfbc53db9c76b9e90f086b4ae531ebd59786c976a771f9cba2c0fbc4d2245fc54fa95fa39ea5d5cacb827811d53b7ef94ce5b2c1cc62926eb4c914bbabb2d658ec008d385de6ea1eb9f07fb3a484deb20e0f69147475ce3d28dccf9629d39646f15f0d1e5973233f76495d15b44478f9744e78a139d43c4ae2698d0afe0514d46d275a26cc82cc9e4defab85959f0ea33ca3d274ee5e39abb7a86844a1e209056ec3f2a8510287dbea9285f76570fdc0266b99fd0cd1f69ac000d2c366d7d2e5d23486ff5a72cfcefcbddaf5c0943ea7c6541d98cab13da5a5cdc7e57f524bf4c5f65707ca1c4a6d06e61563af2469f2bac998c4ef620a808b19fb632db9116863dfc0da4d3f09b91bdbe74f0d3c26fdb65fcba4968d45282c53a484106e6e92a91f9f5f6df0f41e7d9b366889203659aed5a3d3d853f9dbb2a67ca0a105bca338f467cde46a1df1ea93b63e313d91dc732c73d126dc222af1c69bfb108d358203e8da1f9adef47e0fbab2285884b57d0c11f086f41dd3071f5af9521f466599b3c450d55506b47e903002941e0867a3f003243fb07726ae23ba62d33796927cc5c1dc4e449084ab5cf23dee4850d41a192762abe0b2ca0f8108a7a02b605326784698fe9193dc93a67a7217b5f2346d13f8ff9dd789437887aa62d551579ba96e93c7c2962700219bb0bbf9eb0da03adb529c3e813eff6d0fec524db0837236e6e8f2c17e4143d346189e12fe654b94308bfba14093e4c4337fdec9c84eb0153a51814b42f64ed43e9c74c63d75f38e3c5a2ae9c8c105319cdc65209fd4ca04cd4e8192cf5ab0bc9c93159ca08d9a2f9848a7a73da99d1a6f8adbac22cc6c4188d7080057d0b531235d11713cfc62cd18dd5f718194aa974efb8f945ca84a05165bb58f2cd9d89e89976cde8d9e4fb28f66962d47e7657947b4ebae46e45143b48d4b8216aa85d09ea36e07681648a08c2ed650b412ddbd782c9857c1de97d5792645bc2f13e24058de2e5bf49469c774f0e7c2c2ddeebefd2385601ccad6a1947e1fcc209427915823300874600ad85d3118b610cfc2c7ca04055ddbf4030f0ecdfaed31090ada0f95e3b7ceae43a8a280e5ffa364ec03d428dc04fac14b2dc8b78b46241052d1720e75af6df6e6867947fa5c0c70abe4a1f681f418796ac9749351e4f6032e0c27a240045509c784ce660360f4c9eb4bd688064345c1f60dff5922e4e64762b8e656c9e8e859ca22a1547bae9d9d08d184d7d131ef9b9f1beca82ccd7275a31832755418b482f1e8daca2f9de316a59b44f6481de43a3178b6e7247a9755e9500cfdf32cdbd8c0d470285e725e48c587a73a9e8e849d984c99563e713fa890dd783a54e0dc775ba3e769ad49d9f21b019b52204da26a3e1d9bd5d63cd9874c8eeeffb79378847ed6a4b8bdc03347325b4bbb06779f06dcc09a397f6d46a56b2fc9f7f24daeb01e2c366179eb900b188be2a7460f2811d4cbef3b8f87937ff8827e563081f73f3e6f16c85552df6798ea8be4e3c706f9a0452a411a80730ca247a55df07cf1b8b4362c10d1d313e5703df879f00087c740be7db12781b238ad215464aaf4a891563699fb0a7378cb0ba628c5208227987ef47432afbea4dc71377e09ae1ea7e319cb660781e59e77b73ff49795f3ed8e87bf375c5cfef893c3323e5a82f8ab7e69d9c15e9e6214247058ead8aa25f9482a49bb8838a6430379e8d4b8bbdb8af75aa129f8d7c005da4fdfc8f7dea189268c71ffacf8ca13a290a4a90820bddbe22ccd7421f32e244ef09443daadfe87d9d82353e04ac46ac917d0fea9c26e8de7a768ff709a23801462e34c525fb42c468587528c2d990f824b615a10f33aa381e959ccc70e5255823ee5a603b65d5ccdd0c2ed269475f6f6f8f11dcbed582701c20d7632f73b5045d47c4baaabcc6104c7b30426fe02ec2ecf8fc3dc21cebedb6fe", 0x1000}, {&(0x7f0000003800)="0dae69e3c815a306995c5f3bf2efe25312e93dbac8db4ae648e890e2ee84c6e8eac3f40c1132df00db68802ac9e6eb7ec77f8bc73dee244abfafda", 0x3b}], 0x5, &(0x7f0000003c80)=[@rights={0x28, 0x1, 0x1, [r2, r1, r0, r0, r0, r1]}, @cred={0x20, 0x1, 0x2, r12, r13, r14}, @cred={0x20, 0x1, 0x2, r15, r16, r17}, @cred={0x20, 0x1, 0x2, r18, r19, r20}], 0x88}, {&(0x7f0000003d40)=@abs={0x0, 0x0, 0x4e24}, 0x6e, &(0x7f0000003e80)=[{&(0x7f0000003dc0)="b2d91433c3b77ea7ce0ffc5f78b2a93d6b38a5ea5a4e19f852fa303d7d", 0x1d}, {&(0x7f0000003e00)="de56d973ee1db94757b9af6d7cd394234bc1", 0x12}, {&(0x7f0000003e40)}], 0x3, &(0x7f0000004200)=[@cred={0x20, 0x1, 0x2, r21, r22, r23}, @cred={0x20, 0x1, 0x2, r24, r25, r26}, @cred={0x20, 0x1, 0x2, r27, r28, r29}, @rights={0x18, 0x1, 0x1, [r1, r1]}, @rights={0x18, 0x1, 0x1, [r2, r0]}, @rights={0x20, 0x1, 0x1, [r2, r2, r2]}, @cred={0x20, 0x1, 0x2, r30, r31, r32}], 0xd0, 0x24000040}], 0x6, 0x4000001) [ 367.349114] binder: 15963:15971 got transaction with invalid offset (0, min 0 max 0) or object. [ 367.362124] binder: 15963:15971 transaction failed 29201/-22, size 0-8 line 3200 [ 367.374712] binder: 15963:15971 Release 1 refcount change on invalid ref 1 ret -22 20:30:13 executing program 5: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$nl_netfilter(r0, &(0x7f0000000080)={&(0x7f0000000100), 0xc, &(0x7f00000000c0)={&(0x7f0000000340)=ANY=[@ANYBLOB="140000000301ffff808f00003d88c83f00b516ba"], 0x14}}, 0x0) recvmmsg(r0, &(0x7f00000013c0), 0x1ad, 0x0, &(0x7f0000000c40)={0x77359400}) pipe2(&(0x7f0000000000)={0xffffffffffffffff}, 0x80000) syz_open_pts(r1, 0x500) 20:30:13 executing program 3: r0 = socket$inet(0x2, 0x4000000000000001, 0x0) r1 = openat$selinux_mls(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/mls\x00', 0x0, 0x0) ioctl$UI_SET_EVBIT(r1, 0x40045564, 0x17) setsockopt$inet_tcp_TCP_CONGESTION(r0, 0x6, 0xd, &(0x7f0000000680)='reno\x00', 0x60c5) sendto$inet(r0, &(0x7f0000000440)="8e4768a4d0e072fac1e2fe4bd10396b56a8d12d01afac308d7a91006c20b794e2a69fa19e3105cadde9364ef167e280494a405a8c249fa7757be7afe147901e150f8a10fdaacd55023d9b2f06b56b7a479b86b05bfc95add5d9ac348c568f4d7673e6f9b89adaf3c16b99c7aa255db208cf93d14eb035014f6c2c0e695cafdd5d7a36de36b3f2d6886b87e680fa14841669657c751bdf72fbde3d078fb3bbf7bd60687a023", 0xa5, 0x20000000, &(0x7f0000e68000)={0x2, 0x0, @local}, 0x10) r2 = add_key(&(0x7f0000000040)='cifs.idmap\x00', &(0x7f0000000080)={'syz', 0x1}, &(0x7f00000000c0)="80f596b73f413926d0f1131af5bf6c858b55462b013598989b52f7e158c79f677e3106dfa816aa6bc6d10a29d8dcb0f96e11146fbb1a3d619d92a0d18d46140c9ded5ff027ae36b91a31cb6a5fe4721f96ddb765b21bc4e0fe4ce2b652dcf30a89aae1080475473c00eb64d97de9749ee6152a650d5bf38527f27c5801cd015aa8c605bb7cab176cf879cb2abeb96004a59174a6fa89d2b90f1c4c98abbe204b8e233a7cc5f199eaa1c65fd85e9edb6ed61f24c2ad4a5ffc716ff8fcd4a95b50132f5b24ffec60f62759bd9a90b85e16", 0xd0, 0xfffffffffffffff9) r3 = add_key$keyring(&(0x7f0000000340)='keyring\x00', &(0x7f0000000280)={'syz', 0x0}, 0x0, 0x0, 0xfffffffffffffffd) keyctl$search(0xa, r2, &(0x7f00000001c0)='cifs.idmap\x00', &(0x7f0000000200)={'syz', 0x0}, r3) 20:30:13 executing program 4: time(&(0x7f0000000000)) r0 = add_key$user(&(0x7f0000000240)='user\x00', &(0x7f0000000280)={'syz'}, &(0x7f00000002c0)='N', 0x1, 0xffffffffffffffff) r1 = openat$cgroup_type(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.type\x00', 0x2, 0x0) pwritev(r1, &(0x7f00000001c0)=[{&(0x7f0000000100)="f3e95b74ffc7bd97f078f1dd3f45fe09c8d5a36c98c10923f578d4dd4011ceade0436ff4cffad43772f2cf8ce487aa0f40f2221a2f4c827a32dd6e76f64680aff4a293fd64b855bfb87ec42e1b4905ecff749c6f43d8cea151c63c7b16316155ca52b2f44312b43350135dbcb3bb5d62e9335026f8180fae7174f3dd5b0ddf6946", 0x81}, {&(0x7f0000000300)="a1055c7c4479c4b163e97ceccb41ccd3080f76aabf1a185e9eb6252dfcd519e10a4efd13380968e35e7d38f6757721f360964b59aa2e7e15a2df4f94057e29543cc43bd4545c5c7c88c000d3357b7025aaac87f7c81f19425de26c59ee798473c0fbe8af531541ecc5334003d9c7b8ef7735049823ca420199f11cff9708b5f1d172a04fad2e7a7aa3455ccd9ead31b32dae34396a859c3c9e827dc4fa05fb66dcf2c5e72fabd1bb2120967775d454513c", 0xb1}], 0x2, 0x12) socketpair$inet_udp(0x2, 0x2, 0x0, &(0x7f0000000200)) keyctl$read(0xb, r0, &(0x7f0000001780)=""/4096, 0x1000) r2 = syz_open_dev$evdev(&(0x7f0000000400)='/dev/input/event#\x00', 0xfffffffffffffe00, 0x400) ioctl$EVIOCRMFF(r2, 0x40044581, &(0x7f0000000440)=0x1f) r3 = fcntl$dupfd(0xffffffffffffffff, 0x406, 0xffffffffffffff9c) ioctl$FS_IOC_SETVERSION(r3, 0x40087602, &(0x7f00000003c0)=0x3) write$FUSE_STATFS(r3, &(0x7f0000000040)={0x60, 0xffffffffffffffda, 0x8, {{0x5, 0x1, 0x1, 0x1, 0x0, 0x1004, 0x6, 0x3}}}, 0x60) 20:30:13 executing program 4: ioctl(0xffffffffffffffff, 0x8912, &(0x7f0000000280)="025cc80700145f8f764070") r0 = socket(0x10, 0x3, 0x0) write$binfmt_elf64(r0, &(0x7f00000002c0)=ANY=[@ANYBLOB="7f454c460081000000000000000000000000000000000000000000000000000040000000000000000000000000000038000000080000000000000000000100000000000000000000000000000000000000000000000000000000000000"], 0x5d) r1 = openat$selinux_status(0xffffffffffffff9c, &(0x7f0000000080)='/selinux/status\x00', 0x0, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x2400, 0x7) fcntl$getownex(0xffffffffffffffff, 0x10, &(0x7f0000000040)={0x0, 0x0}) fcntl$setown(r0, 0x8, r2) write(r0, &(0x7f0000000000)="2400000052001f0014f9f407000904ff0200070208000100ffffffff0800000000000006", 0x24) r3 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000480)='/dev/ptmx\x00', 0x1, 0x0) ioctl$TCSETS(r3, 0x40045431, &(0x7f00003b9fdc)) execveat(r3, &(0x7f0000000000)='./file0\x00', &(0x7f0000000200)=[&(0x7f0000000040)='/dev/ptmx\x00', &(0x7f0000000080)='/dev/ptmx\x00', &(0x7f00000000c0)='/dev/ptmx\x00'], &(0x7f0000000500)=[&(0x7f0000000240)='em1#\x00', &(0x7f0000000280)='/dev/ptmx\x00', &(0x7f00000002c0)='/dev/ptmx\x00', &(0x7f0000000300)="776c616e307d401300", &(0x7f0000000340)='securitymime_type#cgroup]}mime_typewlan1%\x00', &(0x7f0000000380)='/dev/ptmx\x00', &(0x7f0000000400)='/dev/ptmx\x00', &(0x7f0000000440)='{({+wlan1#vboxnet1}[){nodev@vmnet18em1GPLcpuset\x00', &(0x7f00000004c0)='/dev/ptmx\x00'], 0x0) ioctl$TCSETS(r3, 0x5402, &(0x7f00000001c0)) r4 = syz_open_pts(r3, 0x1) ioctl$RTC_AIE_OFF(r1, 0x7002) write(r3, &(0x7f0000c34fff), 0xffffff0b) ioctl$TIOCSETD(r4, 0x5423, &(0x7f0000000140)=0x3) getsockopt$inet_pktinfo(r1, 0x0, 0x8, &(0x7f0000000100)={0x0, @remote, @multicast1}, &(0x7f0000000180)=0xc) ioctl$TIOCLINUX5(r3, 0x541c, &(0x7f0000000640)={0x5, 0x0, 0x53c, 0x1242, 0x293d}) ioctl$RTC_PIE_OFF(r1, 0x7006) [ 367.590695] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=33024 sclass=netlink_route_socket 20:30:13 executing program 0: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r0, &(0x7f0000000100)={0xa, 0x4e22, 0x0, @empty, 0x4}, 0x1c) writev(0xffffffffffffffff, &(0x7f0000002980), 0x0) r1 = socket$inet6(0x10, 0x3, 0x0) sendmsg(r1, &(0x7f0000002fc8)={&(0x7f0000000000)=@nl, 0x80, &(0x7f0000002000)=[{&(0x7f0000000340)="5500000018007f5300fe01b2a4a280930a06000000a84308910000003900090008000c00010000001900150006000000000000dc1338d54400009b84136ef75afb83de448daa7227c43ab8220000060cec4fab6513", 0x55}], 0x1, &(0x7f0000000400), 0x0, 0x4}, 0x0) ioctl$EXT4_IOC_GROUP_EXTEND(0xffffffffffffffff, 0x40046607, &(0x7f0000000400)) listen(r0, 0x7c) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) mkdirat$cgroup(0xffffffffffffffff, &(0x7f0000000140)='syz1\x00', 0x1ff) r3 = memfd_create(&(0x7f0000000180)="0004003100", 0x0) ioctl$sock_SIOCGPGRP(r3, 0x8904, &(0x7f00000000c0)=0x0) r5 = syz_open_procfs(r4, &(0x7f0000000300)='net/ip_tables_names\x00') write$P9_RFSYNC(r5, &(0x7f0000000240)={0xfffffffffffffe71, 0x33, 0x1}, 0x7) sendto$inet6(r2, &(0x7f0000000380), 0x0, 0x20000004, &(0x7f000031e000)={0xa, 0x4e22, 0x0, @ipv4}, 0x1c) openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000b80)="2e2f6367726f75702f73797a3100b8458a1392623c2acc07743172c163cfc71523709c3289acba6eaf2919f32ebaa4cbe89ed30167d7d56e8e65c0edbb300c9e287f10f513e776522729d5c85c09fed3f33ea055b94d27bb72a2bb9fd56015f25cf4f9ced65ed81253cfba08e9a329935ac0c64d10a5e701cc58fe4af8cb5b679468e8ad39e103e2d5b7d9078c34eb2832a5852b28958b7efeca8ffc69c09a7ca33d82e59f9e27ea25a7cf5e65bc52987952070ddac3929791a23f905fbd72419d1539", 0x200002, 0x0) fchdir(0xffffffffffffffff) r6 = creat(&(0x7f00000005c0)='./bus\x00', 0x0) r7 = open(&(0x7f0000000540)='./bus\x00', 0x141042, 0x0) sigaltstack(&(0x7f0000ffe000/0x1000)=nil, &(0x7f0000000480)) write$selinux_context(r7, &(0x7f0000000000)='system_u:object_r:crontab_exec_t:s0\x00', 0xfffffffffffffe84) r8 = creat(&(0x7f00000003c0)='./bus\x00', 0x2) r9 = openat$null(0xffffffffffffff9c, &(0x7f00000004c0)='/dev/null\x00', 0x2807fd, 0x0) write(r9, &(0x7f0000000380), 0x0) select(0x40, &(0x7f0000000040), &(0x7f0000000080), &(0x7f00000001c0), &(0x7f0000000280)={0x77359400}) getsockopt$IP6T_SO_GET_ENTRIES(r0, 0x29, 0x41, &(0x7f0000000600)=ANY=[@ANYBLOB="73656375726974796d0000000000000000000000000000000000000000000000c40000004e8b4b1c7fa37c911d43b7dfc1540065e2cf063a33e71b903574450eb6fcc611bb94c232461f22877f4a6bfa2e09f7f448f8a2ef823ff78d796ab6ab52f030b8fea1243bfe4a37836d690100843a8998fea04a2bc474078acbb61c426c93614178b70a4bcff2d634050eca0d4f941bfec0542fd99b030000004175d0b0e455f170e292c18a967fdc58383f9af93bc9c8b8578b5ed8ba7d2084ab94919aea43e1a3acfd6d899d943862ca8d84436629d2159976a615f1279aaf23ce57319edb9be03d5b849777d956c09bcb8bc5eb1d793fe7b7d0c34d4d6cc6d28cb9f66b0a2f31eda0ce948210375abcde9320700390dc04b3af4959443184210eb68c4fe6dced7e44cd2b39f7d25dc53dab0fd596852191868741cecd379b6e87b1c1a8c0dc6b8004595fb61137ed10927d6df243071d53b4757c13f4ceb4480e4a7b9c730be6258db763d9e9e7baeccd140ed2311fd9c570db36e93131c27442990068d315088680ab638288fb05b1676a9ab2fe9aa99539a1914bcc2397da080dd1da393ede4f195953f82d03b9a920391ee4f5bd7485d69e1d8bfc93521ea451a20dd056bd3c133aa93c9bef1e254ad7d19379b21be984d93cc7cfcbffc82708aebe5fe4c4aa7af905248de89163041c16cfdaf96ee5b65715c7bb840274ba8ddc979ae077aa20b5ba0e97ecd80abb2d3cdb2d2b6603b3a003871b7220d71909f230fa5e9a7307c10c954a2ff1c6bf5fe3e153c0ebeb4940c365ef1e9cc8588a51bfc9807e866ea6528a77c930c06eb50e3f14ca8abf929570c05c00005211cdcce3d034946d4fadcc9df5702fca33cb322c27a54fee8cd7901df1066311f9ff259dfc65048bcff6eca8f566ed75b5d21b58a3c51907ba6d5ef9e04e24febdea1d345b16288065bf64cf9fa3a746185191dc7b2f4520fd2da2f60434395d6121d7063a6455be070f49e04c8c2fa0da58d878d80a1bf9cc58b6926e3c471cb1e79cb85f6ce2ad91ac6c68f955a507ad55f514d131e0a095329227c9888f9fb19bfe6df77dff07ef08544a33e9f10d72e3ca6a0d70bf0d4b3e607a2238db2aa9c1011d0af4a39786e48004427b8b55fcd1f7ad63a9aa5338475975159310e0e40000000000000000000000000000000000000000000000000037adc3643d9d70ca7afd2e6e8aa3ec3f0bd4c1efcc9eef4a44b712b85c2819424288da425e4c26de663015af285a643a"], &(0x7f00000002c0)=0x1) recvfrom$inet6(r2, &(0x7f0000001840)=""/31, 0xfffffe0e, 0x100, &(0x7f0000001880)={0xa, 0x0, 0xffff}, 0x1c) getsockopt$inet_mreqn(r8, 0x0, 0x23, &(0x7f0000000500)={@multicast1, @multicast1, 0x0}, &(0x7f0000000440)=0x2b5) setsockopt$inet6_IPV6_PKTINFO(r6, 0x29, 0x32, &(0x7f0000000580)={@remote, r10}, 0x14) r11 = accept4(r0, 0x0, &(0x7f0000000000)=0xfffffffffffffefa, 0x0) sendto$inet6(r11, &(0x7f00000000c0), 0xfffffffffffffe2b, 0x0, 0x0, 0x0) 20:30:13 executing program 2: r0 = socket$inet6(0xa, 0x1, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) rt_sigaction(0x13, &(0x7f0000000240)={&(0x7f0000000180)="c462e9969600000080c4a125f3850c000000d8cd0f6822c4c253f61866430feb560ec4837917e7dd2e66440f383873ff35008000000fa0", {}, 0x0, &(0x7f00000001c0)="f336672e400fa5c736450fab6adec4613df95300c401f9d6d5c48179d60cb7c4026d47e6d22d00000100c422512cb875000000c462c0f316c48259b9f1"}, &(0x7f0000000300)={&(0x7f0000000280)="6566420fe23883172126f20f79d18f0978c14976134201c4c1fb2ca600000100420faa66420f1a2764f2470f5de8652e0f613a", {}, 0x0, &(0x7f00000002c0)="67f041837671fe4180a95a9c000000c4a2d0f536c48165fe6745c4c27d212983a00000000000c442adaaec660f3a083804c4c2fd332db807f1dcc4c18d72d400"}, 0x8, &(0x7f0000000340)) r3 = dup2(r0, r1) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) clone(0x802102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000040), 0xffffffffffffffff) r4 = getpid() fcntl$notify(r2, 0x402, 0x2) sched_setscheduler(r4, 0x5, &(0x7f0000000480)) accept4$packet(r3, &(0x7f0000000000)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @remote}, &(0x7f0000000080)=0x14, 0x800) ioctl$sock_inet6_SIOCSIFADDR(r3, 0x8916, &(0x7f0000000140)={@mcast1, 0x78, r5}) shutdown(0xffffffffffffffff, 0x0) setsockopt$inet_buf(r3, 0x0, 0x0, &(0x7f0000000100)="77be3d1e2720b50b5d03bd226ce747d783", 0x11) 20:30:13 executing program 2: clone(0x3102001ffb, 0x0, 0xfffffffffffffffe, &(0x7f0000000000), 0xffffffffffffffff) r0 = gettid() wait4(0x0, &(0x7f00000003c0), 0x80000000, &(0x7f0000000340)) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x1b) ptrace$cont(0x18, r0, 0x6, 0xfffffffffffffffd) gettid() ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f00000000c0)={[], 0x0, 0x0, 0x0, 0x0, 0x6}) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x1f, r0, 0x0, 0x0) 20:30:13 executing program 2: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/net/tun\x00', 0x0, 0x0) openat$selinux_policy(0xffffffffffffff9c, &(0x7f0000000280)='/selinux/policy\x00', 0x0, 0x0) r2 = syz_open_dev$mice(&(0x7f0000000480)='/dev/input/mice\x00', 0x0, 0x8021) r3 = openat$cgroup_ro(r2, &(0x7f0000000380)='cpuacct.usage_percpu\x00', 0x0, 0x0) ioctl$KDGKBMETA(r3, 0x4b62, &(0x7f0000000180)) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) r5 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f00000003c0)='./cgroup\x00', 0x200002, 0x0) fchdir(r5) r6 = open(&(0x7f0000000140)='./bus\x00', 0x141042, 0x0) r7 = creat(&(0x7f0000000080)='./bus\x00', 0x0) mount$fuseblk(&(0x7f00000002c0)='/dev/loop0\x00', &(0x7f0000000300)='./bus\x00', &(0x7f0000000340)='fuseblk\x00', 0x0, &(0x7f00000006c0)={{'fd'}, 0x2c, {'rootmode'}, 0x2c, {'user_id'}, 0x2c, {'group_id'}}) write$binfmt_aout(r6, &(0x7f00000004c0)=ANY=[@ANYBLOB="6808010007b300b25698f9c83b007d000000ffff00000000000000000000008394efb4b7dde50bbc9c50fdba8d8144e29ff74e3ebef59c270634000000000000002df27acf23e0a5d0d577d59544924a68d9968b954459e639700bc468799cf3fe59a673070c"], 0x66) ioctl$TUNGETVNETHDRSZ(r6, 0x800454d7, &(0x7f0000000100)) r8 = open(&(0x7f0000000040)='./bus\x00', 0x141042, 0x0) sendfile(r7, r8, 0x0, 0x5a92) sendfile(r8, r8, &(0x7f00000000c0), 0xbf99) read$FUSE(r8, &(0x7f0000000880), 0x1000) sendfile(r8, r6, &(0x7f0000000240), 0xffffffff) inotify_add_watch(r3, &(0x7f0000000540)='./bus\x00', 0x8) ioctl$FS_IOC_GETVERSION(0xffffffffffffffff, 0x80047601, &(0x7f00000000c0)) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000600)={'ip_vti0\x00', 0x201f}) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000001fc0)={'ip_vti0\x00', 0x0}) fgetxattr(r8, &(0x7f0000000400)=@known='trusted.overlay.impure\x00', &(0x7f0000000440)=""/59, 0x3b) r10 = getpgid(0xffffffffffffffff) fcntl$setown(r0, 0x8, r10) setsockopt$inet6_tcp_TCP_CONGESTION(r8, 0x6, 0xd, &(0x7f0000000580)='westwood\x00', 0x9) setsockopt$inet6_MCAST_LEAVE_GROUP(r7, 0x29, 0x2d, &(0x7f0000000740)={0x1, {{0xa, 0x4e24, 0x3ff, @loopback, 0x7fff}}}, 0x88) ioctl$sock_inet6_SIOCSIFADDR(r0, 0x8916, &(0x7f0000000200)={@remote, 0x1c, r9}) 20:30:14 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$FS_IOC_SETVERSION(r0, 0x40087602, &(0x7f00000001c0)) r1 = syz_open_dev$binder(&(0x7f0000000640)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000000)=[@enter_looper], 0x1, 0x0, &(0x7f0000000040)='+'}) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0x0, 0x0, &(0x7f0000000780)}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000380)={0x8, 0x0, &(0x7f0000000500)=[@release={0x40046306, 0x1}], 0x0, 0x0, &(0x7f0000000400)}) [ 368.092384] binder: undelivered TRANSACTION_ERROR: 29201 [ 368.112012] binder: 16032:16033 ioctl 40087602 200001c0 returned -22 [ 368.167280] binder: 16032:16034 got transaction with invalid offset (0, min 0 max 24) or object. [ 368.176745] binder: 16032:16034 transaction failed 29201/-22, size 24-8 line 3200 [ 368.185749] binder: 16032:16034 BC_INCREFS_DONE u0000000000000000 no match [ 368.193916] binder: 16032:16034 Release 1 refcount change on invalid ref 1 ret -22 20:30:14 executing program 5: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$nl_netfilter(r0, &(0x7f0000000080)={&(0x7f0000000100), 0xc, &(0x7f00000000c0)={&(0x7f0000000340)=ANY=[@ANYBLOB="140000000301ffff808f00003d88c83f00b516ba"], 0x14}}, 0x0) recvmmsg(r0, &(0x7f00000013c0), 0x4000000000003eb, 0x20, &(0x7f0000000c40)) 20:30:14 executing program 5: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$nl_netfilter(r0, &(0x7f0000000080)={&(0x7f0000000100), 0xc, &(0x7f00000000c0)={&(0x7f0000000b00)=ANY=[@ANYBLOB="47f4b3c903010000000000000188c83f00b522abec60575d7d7b72232ae8e9e4a44521e947632ab03c2fbca45c905f21712d6975d37600625963b93c79e072b13d8d2aaab1ebc06e03629e5411"], 0x14}}, 0x0) socket$inet6_udp(0xa, 0x2, 0x0) recvmmsg(r0, &(0x7f0000000a80)=[{{&(0x7f0000000000)=@pppoe={0x18, 0x0, {0x0, @link_local}}, 0x80, &(0x7f00000004c0)=[{&(0x7f0000000140)=""/86, 0x56}, {&(0x7f0000000c80)=""/4096, 0x1000}, {&(0x7f00000001c0)=""/1, 0x1}, {&(0x7f0000000200)=""/164, 0xa4}, {&(0x7f00000002c0)=""/91, 0x5b}, {&(0x7f0000001c80)=""/4096, 0x1000}, {&(0x7f0000000380)=""/246, 0xf6}, {&(0x7f0000000480)=""/23, 0x17}], 0x8, 0x0, 0x0, 0xbf}, 0x80000001}, {{0x0, 0x0, &(0x7f0000000940)=[{&(0x7f0000000540)=""/82, 0x52}, {&(0x7f00000005c0)=""/29, 0x1d}, {&(0x7f0000000600)=""/153, 0x99}, {&(0x7f00000006c0)=""/130, 0x82}, {&(0x7f0000000780)=""/47, 0x2f}, {&(0x7f0000002c80)=""/4096, 0x1000}, {&(0x7f00000007c0)=""/166, 0xa6}, {&(0x7f0000000880)=""/163, 0xa3}, {&(0x7f0000003c80)=""/4096, 0x1000}, {&(0x7f0000004c80)=""/4096, 0x1000}], 0xa, &(0x7f0000000a00)=""/66, 0x42, 0x7}, 0x7ff}], 0x2, 0x20, &(0x7f0000000c40)={0x77359400}) 20:30:14 executing program 3: r0 = socket$inet(0x2, 0x4000000000000001, 0x0) rt_sigpending(&(0x7f0000000040), 0x8) ioctl$sock_SIOCINQ(r0, 0x541b, &(0x7f0000000000)) setsockopt$inet_tcp_TCP_CONGESTION(r0, 0x6, 0xd, &(0x7f0000000680)='reno\x00', 0x60c5) sendto$inet(r0, &(0x7f0000a88f88), 0xfffffffffffffe6e, 0x20000000, &(0x7f0000e68000)={0x2, 0x0, @local}, 0x10) [ 368.391129] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=33024 sclass=netlink_route_socket 20:30:14 executing program 4: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$nl_netfilter(r0, &(0x7f0000000080)={&(0x7f0000000100), 0xc, &(0x7f00000000c0)={&(0x7f0000000340)=ANY=[@ANYBLOB="140000000301ffff808f00003d88c83f00b516ba"], 0x14}}, 0x0) recvmmsg(r0, &(0x7f00000013c0), 0x4000000000003eb, 0x20, &(0x7f0000000c40)) 20:30:14 executing program 4: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) chdir(&(0x7f00000000c0)='./bus\x00') ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) open(&(0x7f0000000380)='./bus\x00', 0x47f, 0x40) lsetxattr$security_selinux(&(0x7f0000000000)='./bus\x00', &(0x7f0000000240)='security.selinux\x00', &(0x7f0000000100)="73797374656d5f00006f62986563745f723a6d6f756e745d657865635f743a733000", 0x22, 0xffffffeffffffffe) execve(&(0x7f0000000040)='./bus\x00', &(0x7f0000000400), &(0x7f0000000340)) 20:30:14 executing program 4: r0 = openat$ppp(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ppp\x00', 0x0, 0x0) setsockopt$inet6_tcp_TCP_MD5SIG(r0, 0x6, 0xe, &(0x7f0000000100)={@in6={{0xa, 0x4e24, 0x1000, @dev={0xfe, 0x80, [], 0x20}, 0x9}}, 0x1000, 0x8, 0x2ff, "a44e46bb29ab2387af930561d31833ee84cb0b6a97f1c86241e088963c8cf55c2145baad1ee924a2cb2b06b751a976d831102fc4715405cf2360775aaecfb92f332ad71261209156ab6892120141f10e"}, 0xd8) r1 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r1, &(0x7f0000000000)={0x40000000, 0x0, &(0x7f0000000040)={&(0x7f0000000080)={0x2, 0x7, 0x0, 0x9, 0x2}, 0x10}}, 0x0) r2 = openat(r0, &(0x7f0000000240)='./file0\x00', 0x0, 0x0) getsockopt$IPT_SO_GET_INFO(r2, 0x0, 0x40, &(0x7f0000000280)={'filter\x00'}, &(0x7f0000000300)=0x54) syz_open_dev$mice(&(0x7f0000000200)='/dev/input/mice\x00', 0x0, 0x200) 20:30:14 executing program 0: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r0, &(0x7f0000000100)={0xa, 0x4e22, 0x0, @empty, 0x4}, 0x1c) writev(0xffffffffffffffff, &(0x7f0000002980), 0x0) r1 = socket$inet6(0x10, 0x3, 0x0) sendmsg(r1, &(0x7f0000002fc8)={&(0x7f0000000000)=@nl, 0x80, &(0x7f0000002000)=[{&(0x7f0000000340)="5500000018007f5300fe01b2a4a280930a06000000a84308910000003900090008000c00010000001900150006000000000000dc1338d54400009b84136ef75afb83de448daa7227c43ab8220000060cec4fab6513", 0x55}], 0x1, &(0x7f0000000400), 0x0, 0x4}, 0x0) ioctl$EXT4_IOC_GROUP_EXTEND(0xffffffffffffffff, 0x40046607, &(0x7f0000000400)) listen(r0, 0x7c) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) mkdirat$cgroup(0xffffffffffffffff, &(0x7f0000000140)='syz1\x00', 0x1ff) r3 = memfd_create(&(0x7f0000000180)="0004003100", 0x0) ioctl$sock_SIOCGPGRP(r3, 0x8904, &(0x7f00000000c0)=0x0) syz_open_procfs(r4, &(0x7f0000000300)='net/ip_tables_names\x00') write$P9_RFSYNC(r3, &(0x7f0000000240)={0x7, 0x33, 0x1}, 0xfffffffffffffe2d) sendto$inet6(r2, &(0x7f0000000380), 0x0, 0x20000004, &(0x7f000031e000)={0xa, 0x4e22, 0x0, @ipv4}, 0x1c) openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000b80)="2e2f6367726f75702f73797a3100b8458a1392623c2acc07743172c163cfc71523709c3289acba6eaf2919f32ebaa4cbe89ed30167d7d56e8e65c0edbb300c9e287f10f513e776522729d5c85c09fed3f33ea055b94d27bb72a2bb9fd56015f25cf4f9ced65ed81253cfba08e9a329935ac0c64d10a5e701cc58fe4af8cb5b679468e8ad39e103e2d5b7d9078c34eb2832a5852b28958b7efeca8ffc69c09a7ca33d82e59f9e27ea25a7cf5e65bc52987952070ddac3929791a23f905fbd72419d1539", 0x200002, 0x0) fchdir(0xffffffffffffffff) r5 = creat(&(0x7f00000005c0)='./bus\x00', 0x0) r6 = open(&(0x7f0000000540)='./bus\x00', 0x141042, 0x0) sigaltstack(&(0x7f0000ffe000/0x1000)=nil, &(0x7f0000000480)) write$selinux_context(r6, &(0x7f0000000000)='system_u:object_r:crontab_exec_t:s0\x00', 0xfffffffffffffe84) r7 = creat(&(0x7f00000003c0)='./bus\x00', 0x2) r8 = openat$null(0xffffffffffffff9c, &(0x7f00000004c0)='/dev/null\x00', 0x2807fd, 0x0) write(r8, &(0x7f0000000380), 0x0) write$cgroup_type(r5, &(0x7f0000000200)='threaded\x00', 0xfffffeb3) select(0x40, &(0x7f0000000040), &(0x7f0000000080), &(0x7f00000001c0), &(0x7f0000000280)={0x77359400}) getsockopt$IP6T_SO_GET_ENTRIES(r0, 0x29, 0x41, &(0x7f0000000c80)=ANY=[@ANYBLOB="73656375726974796d0000000000000000000000000000c035e3ac0000000000c40000004e8b4b1c7fa37c911d43b7dfc1540065e2cf063a33e71b903574450eb6fcc611bb94c232461f22877f4a6bfa2e09f7f448f8a2ef823ff78d796ab6ab52f030b8fea1243b4a37836d690100843a8998fea04a2bc474078acbb61c426c93824178b70a4bcff2d634050eca0d4f941bfec0542fd99b2bd8823b4175d0b0e455f170e292c18a967fdc58383f9af93bc9c8b8578b5ed8ba7d2084ab94919aea43e1a3acfd6d899d943862ca8d84436629d2159976a615f1279aaf23ce57319edb9be03d5b849777d956c09bcb8bc5eb1d793fe7b7d0c34d4d6cc6d28cb9f66b0a2f31eda0ce948210375abcde9320750390dc04b3af4959443184210eb68c4fe6dced7e44cd2b39f7d25dc53dab0fd596852191868741cecd379b6e87b1c1a8c0dc6b8004595fb61135ed10927d6df243071d53b4757c13f4ceb4480e4a7b9c730be6258db763d9e9e7baeccd140ed2311fd9c570db36e93131c27442990068d315088680ab638288fb05b1676a9ab2fe9aa99539a1cfbb1ae8b35cd18007ba5105ed92f8914bcc2397da080dd1da393ede4f195953f82d03b9a920391ee4f5bd7485d69e1d8bfc93521ea451a20dd056bd3c133aa93c9bef1e254ad7d19379b21be984d93cc7cfcbffc82708aebe5fe4c4aa7af905248de89163041c16cfdaf96ee5b65715c7bb840274ba8ddc979ae077aa20b5ba0e97ecd80abb2d3cdb2d2b6603b3a003871b7220d71909f230fa5e9a7307c10c954a2ff1c6bf5fe3e153c0ebeb4940c365ef1e9cc8588a51bfc9807e866ea6528a77c930c06eb50e3f14ca8abf929570c05ca0615211cdcce3d034946d4fadcc9df5702fca33cb322c27a54fee8cd7901df1066311b737259dfc65048bcff6eca8f566ed75b5d21b58a3c51907ba6d5ef9e04e24febdea1d345b16288065bf64cf9fa3a746185191dc7b2f4520fd2da2f60434395d6121d7063a6455be070f49e04c8c2fa0da58d878d80a1bf9cc58b6926e3c471cb1e79cb85f6ce2ad91ac6c68f955a507ad55f514d131e0a095329227c9888f9fb19bfe6df77dff07ef08544a33e9f10d72e3ca6a0d70bf0d4b3e607a2238db2aa9c1011d0af4a39786e48004427b8b55fcd1f7ad63a9aa5338475975159310e0e40000000000000000000000000000000000000000000000000000"], &(0x7f00000002c0)=0x1) recvfrom$inet6(r2, &(0x7f0000001840)=""/31, 0xfffffe0e, 0x100, &(0x7f0000001880)={0xa, 0x0, 0xffff}, 0x1c) getsockopt$inet_mreqn(r7, 0x0, 0x23, &(0x7f0000000500)={@multicast1, @multicast1, 0x0}, &(0x7f0000000440)=0xc) setsockopt$inet6_IPV6_PKTINFO(r5, 0x29, 0x32, &(0x7f0000000580)={@remote, r9}, 0x14) r10 = accept4(r0, 0x0, &(0x7f0000000000)=0xfffffffffffffefa, 0x0) sendto$inet6(r10, &(0x7f00000000c0), 0xfffffffffffffe2b, 0x0, 0x0, 0x0) 20:30:14 executing program 2: sendmsg$key(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000000c0)=ANY=[], 0x176}}, 0x0) sendmsg$key(0xffffffffffffffff, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000184000)=ANY=[@ANYBLOB="020100021000000000000600000000000800120000ffff1500000000000000fd39000000000000000000800000000000e00000010000000000000000000035000000000000000000000000ff00000000030006000000000002000003e80000bb000000000000004add25bda56c09c7000200423b1d632b010020000000000000"], 0x80}}, 0x0) openat$ppp(0xffffffffffffff9c, &(0x7f0000000440)='/dev/ppp\x00', 0x0, 0x0) openat$selinux_avc_cache_threshold(0xffffffffffffff9c, &(0x7f0000000480)='/selinux/avc/cache_threshold\x00', 0x2, 0x0) openat$selinux_avc_hash_stats(0xffffffffffffff9c, &(0x7f00000004c0)='/selinux/avc/hash_stats\x00', 0x0, 0x0) r0 = socket$key(0xf, 0x3, 0x2) pipe(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) write(r2, &(0x7f00000001c0), 0xfffffef3) read(r1, &(0x7f0000000200)=""/250, 0x50c7e3e3) r3 = socket$inet6(0xa, 0x800, 0xc270) setsockopt$inet_tcp_TCP_CONGESTION(0xffffffffffffffff, 0x6, 0xd, &(0x7f0000000340)='illinois\x00', 0x9) r4 = socket$inet6(0xa, 0x2, 0x0) r5 = socket$inet6(0xa, 0x1000000000002, 0x0) r6 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000001440)='cgroup.stat\x00', 0x0, 0x0) write$FUSE_IOCTL(r6, &(0x7f0000001480)={0x20, 0x0, 0x0, {0x8, 0x0, 0x1, 0x7fffffff}}, 0x20) openat$full(0xffffffffffffff9c, &(0x7f0000000400)='/dev/full\x00', 0x8000, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000240)={&(0x7f0000000000), 0xc, &(0x7f0000000380)={&(0x7f0000000180)=ANY=[@ANYBLOB], 0x1}, 0x1, 0x0, 0x0, 0x1}, 0x40000) iopl(0xdc1) setsockopt$SO_BINDTODEVICE(r5, 0x1, 0x19, &(0x7f0000001280)='ip6gretap0\x00', 0x10) getsockopt$inet_mreqn(r1, 0x0, 0x27, &(0x7f0000000c00)={@dev, @broadcast, 0x0}, &(0x7f0000000c40)=0xc) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000d00)={&(0x7f00000003c0), 0xc, &(0x7f0000000cc0)={&(0x7f0000000c80)=@dellink={0x30, 0x11, 0x800, 0x70bd29, 0x25dfdbfb, {0x0, 0x0, 0x0, r7, 0x10000, 0x4000}, [@IFLA_NUM_RX_QUEUES={0x8, 0x20, 0x81}, @IFLA_EXT_MASK={0x8, 0x1d, 0xad5}]}, 0x30}, 0x1, 0x0, 0x0, 0x20000050}, 0x48080) connect$inet6(r4, &(0x7f0000000100)={0xa, 0x0, 0x0, @dev, 0x2}, 0x1c) ioctl$sock_ifreq(r2, 0x8956, &(0x7f00000001c0)={'veth0_to_bond\x00', @ifru_addrs=@ax25={0x3, {"ee75b8edf7dee0"}, 0x40}}) dup(r6) connect$inet6(r4, &(0x7f0000000300)={0xa, 0x4e24, 0x0, @ipv4={[], [], @loopback}}, 0x1c) sync_file_range(r3, 0x4, 0x6, 0x4) chroot(&(0x7f0000000040)='./file0\x00') sendmmsg(r4, &(0x7f00000092c0), 0x4ff, 0x0) socket$inet6_udp(0xa, 0x2, 0x0) read$eventfd(r6, &(0x7f0000000180), 0x8) sendmmsg(r0, &(0x7f0000000040), 0x8000000000000d2, 0x40000) munlockall() 20:30:14 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$FS_IOC_SETVERSION(r0, 0x40087602, &(0x7f00000001c0)) r1 = syz_open_dev$binder(&(0x7f0000000640)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000000)=[@enter_looper], 0x1, 0x0, &(0x7f0000000040)='+'}) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0x0, 0x0, &(0x7f0000000780)}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000380)={0x8, 0x0, &(0x7f0000000500)=[@release={0x40046306, 0x1}], 0x0, 0x0, &(0x7f0000000400)}) [ 368.959593] binder: 16122:16123 ioctl 40087602 200001c0 returned -22 [ 369.016137] binder: 16122:16129 got transaction with invalid offset (0, min 0 max 24) or object. [ 369.026152] binder: 16122:16129 transaction failed 29201/-22, size 24-8 line 3200 [ 369.036072] binder: 16122:16129 BC_INCREFS_DONE u0000000000000000 no match [ 369.044097] binder: 16122:16129 Release 1 refcount change on invalid ref 1 ret -22 20:30:15 executing program 5: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) memfd_create(&(0x7f0000000080)='\x00', 0x7) sendmsg$nl_netfilter(r0, &(0x7f0000000000)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x40000}, 0xc, &(0x7f00000000c0)={&(0x7f0000000040)=ANY=[@ANYBLOB="140000000301ffff808f00003d88c83f00b516ba"], 0xe}}, 0x0) recvmmsg(r0, &(0x7f00000013c0), 0x1ad, 0x0, &(0x7f0000000c40)={0x77359400}) 20:30:15 executing program 3: r0 = socket$inet(0x2, 0x4000000000000001, 0x0) setsockopt$inet_tcp_TCP_CONGESTION(r0, 0x6, 0xd, &(0x7f0000000680)='reno\x00', 0x60c5) setsockopt$inet_msfilter(r0, 0x0, 0x29, &(0x7f0000000000)=ANY=[@ANYBLOB="eeff00007f000001010000000100f3ffdf000001"], 0x14) write(r0, &(0x7f0000000d40)="7fa718e96d285c14e90b4f473b8d86fee81d9581770ec2b67f0077d3b9be6dd0a22c4b43d52c7cc2787ca4bdeebe55a5b97c8a3777623793e7293e12c93b8fee49dd46a84bd4115d7e009bdbc783cf0cf51177d90692be3d768ff43e5b688b38e500cee803d6ee7384650a45e48cbb405b2b609c46634ab43d1eab0b62806e2010df9ac77e429ea935fcdabee3bc54a7d3ceaf6c4c85d71ba0e4df464c61f62780da83ed9f7c21efd6bf0a12a39bed2e5d925eb18642c8a4fc1cf202491d630e1797ea1a4101cf14bcd8a25cc79ebb983649b826e75295a7895e2ad40426d55613f7f83c79558788090f45fefa132bf4349cf30a382c5e9845a5fd0d6f16d8726ce1a705208fda5d2f6eb027ace7f9e463758f830eeb391f3d6523ccf4821268eabe3c2fc280325b2e0d3bd25a065a630a38f23934db510abafcbcfa66cad33365ecc0a7114b6e1f0ce0f44fd6754ffc4b4be419deb0e35a0a37819ebcee81d257497523c32b1a4d5797d2bb23d5e032c3a0568e5437dacc0adbdd49159164b1a4e88d9bbdd94de4a10710dab394ebcbec5e9282fff39fce442a9341a17743d7d5b0ded88ee218fa5a6ef293a55d219a791abe739abd0d29910ce9e5e1f9fd5f84767aaa34e6a0c587b39440998e69709b643b57ad900919165f64ccf89bf687e55646b7e6dbbb4bb17e9d30d40cfcef6125d7dadd85aa885608ea5533f17a3ef7d1591e660767d6e587eb88abd14ee6b77d21e00054d53b3b09b537f81e57f61c5c8dbd3ac176e5d7a823f9a3f35b6e31012acae0e989418e68e13b99c83f088242775af3200900a561a4ab353d6c6f919aa77bd54ba8c837e1461ab5f3afcea4643552423ac4cc66597ebc2b42ed6aefedcbed3185e19a4ece6b8b7a90a5835f0fe32bbbd1f95349ae99cb076b371d2d2e2005fdf46c340ddf19da15428234a93306dd5611501dcfe0055bc4718338e84c8ae56a4c1f8e8a4ead4dfb3095069a4703c2498831918e9c51cd719c3a588ae512c10d7f9bdde333bef6c007ae7a50352cb9994b3a3f15f01d48894d42ca5694c2923dbdf75b2f91c5e991cb347dc9e4127757fe758148611a8ef0211fd7d15682df612eac63f2d88935a50fdf657ea19862e2d0689114dd667cd5b4b78e40d5837410d068ff44027d272079496e66293da31f67719251d366db4ec4bd73a4764cb08651b84ea6a26e13c20eafd951399fc70bb0a9d737e808f302afd7124433e8433e7b5a01328a25733e3eaad7282b1c8d6d64e110a789a1c692d4f4b0bc514918070cdbb45005a9ff96db9f9c0aeed531506b147814022fef4f643fce808e4de58e3a6c5a55507ec1494643db825e704d10859a77265c0ad022dc6359a6f0d658f924553b6d6be5675ed64ede401880cf9a5a633ce4f40d728aabd39bd8e2b82bad391a7e69a931bfbfcc24187b356d517555b851c922246a46b365ad988857ac346428078d3146fc87ed81a34d4b00b7c602f43317871822c30f7f7bc9b9f945f3ebe97ff178a95f17cc3c9ce4878c694fcb1b1a7ee13252341c68aa943d041b29caf0c89b3c289accc803b544fe95b2b7ed289ed5922b1ae410f56757721a9f1ce0ebe4e1ec1f01125aa6f46fd1f02205b56131aa5683c96799addcd953f6fc77f6a66f7888c43a8ed2dd76f233ac3d38100c8015f4b1de3d034a3136b16aab7df9334c5a5b1de5e2ff33e332b6e18f1f5207d2b4d40daa0337b032c84d4ba2d3f21fe84692e88561c860c2698a1c9129f3779eea0637ecd395f37b0d601d7dc4078e711cfece23b50de07dcfdfc00f3dfd57ea5e6e04f63043040d64051ad89e95e442a0776f209bdcb900f49b4ba13565f6b6a3dffeb899c2450c885f0c0d3661e0d867d57ed92a7289d0b1f57392912d2aff700ec132ac5a969331a719ca2746264bab44cbc41d689a328fa6b45b199e4b382ab5ca19bbeca0d40bc7ddf6e163511b765fc7d02ac4757308efd5fc6f8572ffc24869f5b6c9e8e7c9f24500f36eb4a533277ea343b008130516f61564e989f742df6413ff4b4581ec3ee3328ff15fb323840773ededdd9c6ad578755c26d16a34634e1f94ba1277161afa1f0b7954395cd9484be8ae0fd95ee5dab906b402c672e7587a5955781c14b3a2239e05a7c7a49306cdc77231fe6ae3916ee8d880a3734bed1e88f4dc610c1cc54e49a958ac3bdc2f4e3d731f866cd5532a5d380c0b9eaa4792fdfe355ff1cbf444c58aa1632289465d8ee7a18624082fa767999ec5cc74470984fe0e62b26a2120ccacab93a8a2ce81ffd17211c89ff98f1fdf98f06dd0ae1277831532bbe753e9c041a6d86971b252073d8fed200c7ea4f8d69768a28f828bdfaa403f2c0135c8e8590463786ca781c1f266cd6e565c95cc0e8833876579b2c0ab5b9c500a311fdf54b224336b7a31dc02008a8081f19b20b78f34454e9eec83e254340e85759556470bb357546461793bae8248073dffd56cabfe8fdfa3afe4958be82d54e152b0ad247b4f3721e74c36cc6a50c0f0db33ab86bcbb557243d112a468afd48f0f671c24dafe9030d01ebbd80e17edabe4a1517b0c8148863385eea6e8d3b878261d7c21529d8630a95a5dc19eea0d5c1e383d298b695a751af38263aee64186f3aef60abbc39b97fc17657cdd4273795f1d23970a01ac98fec503ded717e277972404213868ddf14aee30830ace0689884fb6f84ab768294b144d49184d2d19b406d9aefe3e2168adfe697af1359f94c7f5125874723a9f54dc58859775882083dcf35a34785329971a5bdeeb4305654bbe2b8ddcdafd84351d7cd70c525d78d2ff72d206940d1fc8b1f9555d23e481e51ac847cdfbc0491a2a622278758e08306e8a12de260d83e660eda990fe236a463c39a4665bb34a203392b8b9a834f37fcd925ea940c3c95f30aeaf0f3d284aeb363887593d4db0c58b3133ef29120db65ef68ad8e6c9936fe194c705cdae717edb20439339f6018affd27ad5528d30fb23e005ce1e70273d8d2480cd9278b06ecc2f997e07b0b91ff1f3c688fa07c2c30876cfd2e731fad572e48a4bad6a0dd4d0300fc0e3b070ee49249074d5c24b4f13f01a1bd3fec5b732b5d36d217dd5814ea49e7a73862aecab0ccc2d5b57c06073a1a6011640bb9e254f6a4d376e17406374e3c8052665a01a308d99d296ee268d6503f64d8c4f8b72ac6af818d00271a897db75951698ff73f138825f59ac6a3e1e2cc03aa3420b0d902f91ced123d43ff6bd9944a0c04492bb8afa9b30434a9aee5ed8d1d5e42723341d383b9ad013365dc7a4f8dfaf4d4284e2be94b3bda13341ebdeada2ae2a0139b37cf66612e22309f51ab7897878046c7cf459af01212bff9b92ca5bdd4ec0cb3dca96426864a6a99cc02390b3f950318d2fa12187178bf109970e3881d7dbc901de76a6ec64148482511b6e6480c318cd5e0325912a51f183ad471359ca4c0ac37b8232e1838c3d7c84754819b83a9563b9afa7718477595f61150a82415227ea0ea0d5b6de830aaca8adaf3e80a20426812fae063b4485ad4ca6f67154d19d3a5ba05c1f3ddd85afbb5f77d763d8bcc4b8263285084a56961996fdc39668ede36d22f320a27d97939efbd9f81e639228a519ef5500c7992b35ec6d37da9f70a6cdff017b027528cb38d5560a01a4fa406f96b46ccf8509635bb118a8604698e106a21698d76a7a0fe79ff7bdd88c23b1280aff96806c35e81b283b70d866aefd7b18c4f53e5bd066f646157b11e07984e6fe89c136f70453dd83ecf0e3a7ff40cb58ec0cbd50124a47e5bffd0c090eb92af0835c4b5a9e5c691aafdd46148b1d9a0d74a46c4a9485bca3489d589dc7e01508b32d0463910b9af49d86a6ddba63f6325f163db311d76712cf2a743418b0e4166398be5453dd93d9a885b0652c4fd3eb3d83d66c544590fc16e5ba786212101eebab332ef7a082ba242f0a18ab29e535fbb3d4ace8d1099fc0ea6ea3341a3fc5e25494442398aadeb6771e6dcde05f14302fb874ab62305c520e510b2d0a7964ee270967791e19c525e17dae0ff3593f99251567617ef97149171b527f1b405f4e80d6f6963b498be102ca69bcb580fa2ed3d6772acf2cbbe8800294f0a898ac5c0e902cb9a837cb2b3d9f45fdb2bf80ce9df893bfa94bbd333933678abdd57e158d3fff3cf0f8ea93e9ff46bc8bb091036680554fb914f39327e2b39180774a0e96cf6be626501781965e23da9176577118d4ad00522f2ba796d7d86aea0517ba77a12fbca9e69f93a7063e36f7268a03c7ac43d7a4f8013e2848c9328a53f87d67d4c8ef018da355e032c53cdd9543ff6f3770aa7b15cbd4dd69a07c65d98da77f2b2d0c4ae61422023c968e43bb147bc1d89ff0cc45591c361922944f100e1a6c743d22f70826cda6e0ef4689aad5842b048e16357e909d89b93a73c7198bc5a1706cfd7a14f735e07f0936ed3d3480f1fd6d8a34362283ff665d9161ce6f4f2e9a6fa260bc9af3c31f733bbea899285e83b8f8f27e8dd62de19a866d4973ed9e2201f71b5a64669480cb49905feb16edf7ba0e248fefa76c7523f8e595af2883d3b53d6be14f636c8e90b10c993b3f4cf1a0d1dd6d66939277d7a8c190ff19a70fd901ded61c1c8b3ed6193543f12377c8b37a048ea59da0b015f761e8aae74e214ba041bfa8df843cd4e6cc97c79ce9b2694daca5d541ad7ef9a551e5487104d3c97c456fb3517abb2403729739a3e4323c05735cb63f9637554772591ead3a162c7d84a5eddecd9c4672683a4d91f1d8c883b2f31e0c881f420156a89581b759fb2f98f0a3bfa7a2656459fd143f994e593d071ad5e2a484b42475b22088153520053412ed9aa16d343ef175fe9f08a345d2d3bd0ea844ce4c7eb42296c131c5fdd712b7a46f54dbf08ddfade2990205847ff18ca37b81e7ffe689f0ae6bede48ef657b071f272d531d878dfc382fefbfe856a27cacf66007e394ab8f549d079aa4909a998a333d7758a68415f9c113acf824c9c09554ff3c894eeb4597f637605a473ee228e9ce66ca0a7f2eb1167a37104b43453d0c138cd555e17a65d6c5599909dc4266c9fd1598a1ca9576045b2d31cab7017492952250f088a51b14414efe5eb13f05d45d46d4c6dfd5ce6597dedd17585e4162796ced0c561b7b566b9c7c9105648ff3e4d5b20969aa805b92803774563c48029471fcb3de6a4946ac75aa4241c3cd71f3a12f7df8a2de260b426ed4b8e2f24b3c401834fff8f6a1345c53ddafa8bb5883315d5288aa6c1c5bfdb3256a2542d298e4eb8a66b72830a6e03fe94e8c284fa8b1dec24be719f695b6fc22d79337159d06793a6e82ff21d6e9e5e41041a8defd93b3ce1e3e053cd89729cc79780c584cd5ee2d3dc2efebf1232eadcb0029ed61a3c59f4dacb47771d85293462968e04bfde5236571b6fe41de1dce60498bf5e52e9daee9a56f34f0d2776fd0457b9e4777a1a1b1cc3fe701eb3b2f2c78ca287ff6b5b52f9adc979f88ef37491b0900d5acbcf3518e5aa07a41d2e901e656953fc7d9b688dfda168cf07736fe697f67d37f3ad05df0bacd882a548e7f8b53e3c4d4a9163778989c6a7ccce00da5bd20e74828450fe3767f88d31aa92396cfcc0f93669be9d908043dbc87730f90613d5cb356c7ebe0b5e1bc1ef7422f962fccf8ef3a8b6bbaa0cd164ac0b1869cb6608aeaf929f454686d58a61a3d51a13d5de8d0f5809a58737966240711b50ad5e5c3c57f05f77a51118ca6084546b06d4a1755a3d8fb6", 0x1000) sendto$inet(r0, &(0x7f0000a88f88), 0xfffffffffffffe6e, 0x20000000, &(0x7f0000e68000)={0x2, 0x0, @local}, 0x10) stat(&(0x7f0000000080)='./file0\x00', &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x0, 0x0}) getsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x11, &(0x7f0000000140)={{{@in=@broadcast, @in6=@ipv4={[], [], @loopback}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@ipv4={[], [], @multicast1}}, 0x0, @in=@multicast2}}, &(0x7f0000000240)=0xe8) stat(&(0x7f0000000280)='./file0\x00', &(0x7f00000002c0)={0x0, 0x0, 0x0, 0x0, 0x0}) r4 = geteuid() getsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x11, &(0x7f0000000340)={{{@in6=@mcast2, @in=@remote, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in=@multicast1}, 0x0, @in6=@remote}}, &(0x7f0000000440)=0xe8) r6 = getegid() getsockopt$sock_cred(r0, 0x1, 0x11, &(0x7f0000000480)={0x0, 0x0, 0x0}, &(0x7f00000004c0)=0xc) r8 = socket(0x5, 0x80003, 0x9) getsockname$inet6(r8, &(0x7f0000000800)={0xa, 0x0, 0x0, @ipv4={[], [], @rand_addr}}, &(0x7f0000000840)=0x1c) getgroups(0x2, &(0x7f0000000500)=[0xee01, 0xee01]) getsockopt$sock_cred(r0, 0x1, 0x11, &(0x7f0000000540)={0x0, 0x0, 0x0}, &(0x7f0000001d40)=0xc) lstat(&(0x7f00000005c0)='./file0\x00', &(0x7f0000000600)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f0000000cc0)=@broute={'broute\x00', 0x20, 0x3, 0x400, [0x0, 0x0, 0x0, 0x0, 0x0, 0x200008c0], 0x0, &(0x7f0000000880), &(0x7f00000008c0)=[{}, {0x0, '\x00', 0x0, 0xfffffffffffffffe, 0x2, [{{{0x3, 0x15, 0x892f, 'ip6_vti0\x00', 'ip6_vti0\x00', 'syz_tun\x00', 'ip6gre0\x00', @random="689ba6e36bb6", [0xff, 0xff, 0x0, 0xff, 0x0, 0xff], @empty, [0xff, 0x0, 0x0, 0xff, 0x0, 0xff], 0xb0, 0xb0, 0xe8, [@quota={'quota\x00', 0x18, {{0x1, 0x0, 0x81, 0x89}}}]}}, @common=@mark={'mark\x00', 0x10, {{0xfffffff0, 0xfffffffffffffffe}}}}, {{{0x5, 0x10, 0x886c, 'team_slave_1\x00', 'ip6tnl0\x00', 'bond_slave_1\x00', 'teql0\x00', @empty, [0xff, 0xff, 0x0, 0x0, 0xff, 0xff], @remote, [0xff, 0xff, 0x0, 0xff, 0x0, 0xff], 0xd0, 0x120, 0x168, [@arp={'arp\x00', 0x38, {{0x13, 0x0, 0x4, @rand_addr=0x9, 0xffffffff, @multicast2, 0x0, @local, [0xff, 0xff, 0xff, 0xff], @remote, [0x0, 0xff, 0x0, 0xff, 0x0, 0xff], 0x26}}}]}, [@common=@IDLETIMER={'IDLETIMER\x00', 0x28, {{0x3, 'syz1\x00', 0x12000}}}]}, @common=@RATEEST={'RATEEST\x00', 0x20, {{'syz1\x00', 0x80, 0xfffffffffffffff7, 0x10000}}}}]}, {0x0, '\x00', 0x2, 0xfffffffffffffffe, 0x1, [{{{0xb, 0x79, 0x0, 'veth1_to_bond\x00', 'eql\x00', 'syzkaller0\x00', 'veth0_to_bond\x00', @empty, [0xff, 0x0, 0xff, 0xff, 0xff], @empty, [0xff, 0xff, 0xff, 0x0, 0xff, 0xff], 0x70, 0xa8, 0x120}, [@common=@dnat={'dnat\x00', 0x10, {{@local, 0xfffffffffffffffe}}}]}, @common=@nflog={'nflog\x00', 0x50, {{0x0, 0xffffffffffffff02, 0x0, 0x0, 0x0, "39fb344560ddda4686d1716ffd38f9172eb6b38bacb76bbed5d7fed95cc8166b8eb127090f323ad3ffc66d38ae1e373f67b9eb2daf9aa6a7ee3bd7a19b5e35ba"}}}}]}]}, 0x478) stat(&(0x7f00000006c0)='./file0\x00', &(0x7f0000000700)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) fsetxattr$system_posix_acl(r0, &(0x7f0000000040)='system.posix_acl_access\x00', &(0x7f0000000780)={{}, {0x1, 0x1}, [{0x2, 0x4, r1}, {0x2, 0x4, r2}, {0x2, 0x2, r3}, {0x2, 0x5, r4}, {0x2, 0x5, r5}], {0x4, 0x5}, [{0x8, 0x0, r6}, {0x8, 0x7, r7}, {0x8, 0x1, r9}, {0x8, 0x1, r10}, {0x8, 0x0, r11}, {0x8, 0x7, r12}], {0x10, 0x5}, {0x20, 0x2}}, 0x7c, 0x2) 20:30:15 executing program 3: r0 = socket$inet(0x2, 0x3, 0x1100000080) setsockopt$inet_tcp_TCP_CONGESTION(r0, 0x6, 0xd, &(0x7f0000000680)='reno\x00', 0x60c5) sendto$inet(r0, &(0x7f0000a88f88), 0xfffffffffffffe6e, 0x20000000, &(0x7f0000e68000)={0x2, 0x0, @local}, 0x10) sendto$inet(r0, &(0x7f0000000000), 0x0, 0x4004800, &(0x7f0000000040)={0x2, 0x4e23, @rand_addr=0x81}, 0x10) 20:30:15 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$FS_IOC_SETVERSION(r0, 0x40087602, &(0x7f00000001c0)) r1 = syz_open_dev$binder(&(0x7f0000000640)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000000)=[@enter_looper], 0x1, 0x0, &(0x7f0000000040)='+'}) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0x0, 0x0, &(0x7f0000000780)}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000380)={0x8, 0x0, &(0x7f0000000500)=[@release={0x40046306, 0x1}], 0x0, 0x0, &(0x7f0000000400)}) 20:30:15 executing program 3: r0 = socket$inet(0x2, 0x4000000000000001, 0x0) pipe(&(0x7f0000000000)={0xffffffffffffffff}) ioctl$PIO_FONTRESET(r1, 0x4b6d, 0x0) setsockopt$inet_tcp_TCP_CONGESTION(r0, 0x6, 0xd, &(0x7f0000000680)='reno\x00', 0x60c5) open(&(0x7f0000000040)='./file0\x00', 0x101081, 0x3a) sendto$inet(r0, &(0x7f0000a88f88), 0xfffffffffffffe6e, 0x20000000, &(0x7f0000e68000)={0x2, 0x0, @local}, 0x10) [ 369.559929] binder: 16193:16200 ioctl 40087602 200001c0 returned -22 20:30:15 executing program 0: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r0, &(0x7f0000000100)={0xa, 0x4e22, 0x0, @empty, 0x4}, 0x1c) writev(0xffffffffffffffff, &(0x7f0000002980), 0x0) r1 = socket$inet6(0x10, 0x3, 0x0) sendmsg(r1, &(0x7f0000002fc8)={&(0x7f0000000000)=@nl, 0x80, &(0x7f0000002000)=[{&(0x7f0000000340)="5500000018007f5300fe01b2a4a280930a06000000a84308910000003900090008000c00010000001900150006000000000000dc1338d54400009b84136ef75afb83de448daa7227c43ab8220000060cec4fab6513", 0x55}], 0x1, &(0x7f0000000400), 0x0, 0x4}, 0x0) ioctl$EXT4_IOC_GROUP_EXTEND(0xffffffffffffffff, 0x40046607, &(0x7f0000000400)) listen(r0, 0x7c) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) mkdirat$cgroup(0xffffffffffffffff, &(0x7f0000000140)='syz1\x00', 0x1ff) r3 = memfd_create(&(0x7f0000000180)="0004003100", 0x0) ioctl$sock_SIOCGPGRP(r3, 0x8904, &(0x7f00000000c0)=0x0) syz_open_procfs(r4, &(0x7f0000000300)='net/ip_tables_names\x00') write$P9_RFSYNC(r3, &(0x7f0000000240)={0x7, 0x33, 0x1}, 0xfffffffffffffe2d) sendto$inet6(r2, &(0x7f0000000380), 0x0, 0x20000004, &(0x7f000031e000)={0xa, 0x4e22, 0x0, @ipv4}, 0x1c) openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000b80)="2e2f6367726f75702f73797a3100b8458a1392623c2acc07743172c163cfc71523709c3289acba6eaf2919f32ebaa4cbe89ed30167d7d56e8e65c0edbb300c9e287f10f513e776522729d5c85c09fed3f33ea055b94d27bb72a2bb9fd56015f25cf4f9ced65ed81253cfba08e9a329935ac0c64d10a5e701cc58fe4af8cb5b679468e8ad39e103e2d5b7d9078c34eb2832a5852b28958b7efeca8ffc69c09a7ca33d82e59f9e27ea25a7cf5e65bc52987952070ddac3929791a23f905fbd72419d1539", 0x200002, 0x0) fchdir(0xffffffffffffffff) r5 = creat(&(0x7f00000005c0)='./bus\x00', 0x0) r6 = open(&(0x7f0000000540)='./bus\x00', 0x141042, 0x0) sigaltstack(&(0x7f0000ffe000/0x1000)=nil, &(0x7f0000000480)) write$selinux_context(r6, &(0x7f0000000000)='system_u:object_r:crontab_exec_t:s0\x00', 0xfffffffffffffe84) r7 = creat(&(0x7f00000003c0)='./bus\x00', 0x2) r8 = openat$null(0xffffffffffffff9c, &(0x7f00000004c0)='/dev/null\x00', 0x2807fd, 0x0) write(r8, &(0x7f0000000380), 0x0) write$cgroup_type(r5, &(0x7f0000000200)='threaded\x00', 0xfffffeb3) select(0x40, &(0x7f0000000040), &(0x7f0000000080), &(0x7f00000001c0), &(0x7f0000000280)={0x77359400}) getsockopt$IP6T_SO_GET_ENTRIES(r0, 0x29, 0x41, &(0x7f0000000c80)=ANY=[@ANYBLOB="73656375726974796d0000000000000000000000000000000000000000000000c40000004e8b4b1c7fa37c911d43b7dfc1540065e2cf063a33e71b903574450eb6fcc611bb94c232461f22877f4a6bfa2e09f7f448f8a2ef823ff78d796ab6ab52f030b8fea1243b4a37836d690100843a8998fea04a2bc474078acbb61c426c93824178b70a4bcff2d634050eca0d4f941bfec0542fd99b2bd8823b4175d0b0e455f170e292c18a967fdc58383f9af93bc9c8b8578b5ed8ba7d2084ab94919aea43e1a3acfd6d899d943862ca8d84436629d2159976a615f1279aaf23ce57319edb9be03d5b849777d956c09bcb8bc5eb1d793fe7b7d0c34d4d6cc6d28cb9f66b0a2f31eda0ce948210375abcde9320750390dc04b3af4959443184210eb68c4fe6dced7e44cd2b39f7d25dc53dab0fd596852191868741cecd379b6e87b1c1a8c0dc6b8004595fb61135ed10927d6df243071d53b4757c13f4ceb4480e4a7b9c730be6258db763d9e9e7baeccd140ed2311fd9c570db36e93131c27442990068d315088680ab638288fb05b1676a9ab2fe9aa99539a1cfbb1ae8b35cd18007ba5105ed92f8914bcc2397da080dd1da393ede4f195953f82d03b9a920391ee4f5bd7485d69e1d8bfc93521ea451a20dd056bd3c133aa93c9bef1e254ad7d19379b21be984d93cc7cfcbffc80908aebe5fe4c4aa7af905248de89163041c16cfdaf96ee5b65715c7bb840274ba8ddc979ae077aa20b5ba0e97ecd80abb2d3cdb2d2b6603b3a003871b7220d71909f230fa5e9a7307c10c954a2ff1c6bf5fe3e153c0ebeb4940c365ef1e9cc8588a51bfc9807e866ea6528a77c930c06eb50e3f14ca8abf929570c05ca0615211cdcce3d034946d4fadcc9df5702fca33cb322c27a54fee8cd7901df1066311b737259dfc65048bcff6eca8f566ed75b5d21b58a3c51907ba6d5ef9e04e24febdea1d345b16288065bf64cf9fa3a746185191dc7b2f4520fd2da2f60434395d6121d7063a6455be070f49e04c8c2fa0da58d878d80a1bf9cc58b6926e3c471cb1e79cb85f6ce2ad91ac6c68f955a507ad55f514d131e0a095329227c9888f9fb19bfe6df77dff07ef08544a33e9f10d72e3ca6a0d70bf0d4b3e607a2238db2aa9c1011d0af4a39786e48004427b8b55fcd1f7ad63a9aa5338475975159310e0e40000000000000000000000000000000000000000000000000000"], &(0x7f00000002c0)=0x1) recvfrom$inet6(r2, &(0x7f0000001840)=""/31, 0xfffffe0e, 0x100, &(0x7f0000001880)={0xa, 0x0, 0xffff}, 0x1c) getsockopt$inet_mreqn(r7, 0x0, 0x23, &(0x7f0000000500)={@multicast1, @multicast1, 0x0}, &(0x7f0000000440)=0xc) setsockopt$inet6_IPV6_PKTINFO(r5, 0x29, 0x32, &(0x7f0000000580)={@remote, r9}, 0x14) r10 = accept4(r0, 0x0, &(0x7f0000000000)=0xfffffffffffffefa, 0x0) sendto$inet6(r10, &(0x7f00000000c0), 0xfffffffffffffe2b, 0x0, 0x0, 0x0) [ 369.631924] binder: BINDER_SET_CONTEXT_MGR already set [ 369.682303] binder: 16193:16200 got transaction with invalid offset (0, min 0 max 24) or object. [ 369.692301] binder: 16193:16210 ioctl 40046207 0 returned -16 20:30:15 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$FS_IOC_SETVERSION(r0, 0x40087602, &(0x7f00000001c0)) r1 = syz_open_dev$binder(&(0x7f0000000640)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000000)=[@enter_looper], 0x1, 0x0, &(0x7f0000000040)='+'}) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0x0, 0x0, &(0x7f0000000780)}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000380)={0x8, 0x0, &(0x7f0000000500)=[@release={0x40046306, 0x1}], 0x0, 0x0, &(0x7f0000000400)}) [ 369.726246] binder: 16193:16215 BC_INCREFS_DONE u0000000000000000 no match [ 369.726554] binder: 16193:16200 transaction failed 29201/-22, size 24-8 line 3200 20:30:15 executing program 4: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000040)='/dev/ptmx\x00', 0x0, 0x0) truncate(&(0x7f0000000000)='./file0\x00', 0x100000001) clock_adjtime(0x0, &(0x7f00000000c0)={0x7, 0x2, 0xfe6, 0x0, 0x3f, 0x15, 0x100000001, 0x40, 0xff, 0x86, 0x5, 0xb0, 0x3, 0x3, 0x6, 0x1, 0x81, 0x8, 0x4, 0x5, 0x4, 0x101, 0x401, 0x100000001, 0x3f, 0xc}) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000280)) ioctl$sock_FIOGETOWN(r0, 0x8903, &(0x7f00000001c0)=0x0) prlimit64(r2, 0xc, &(0x7f0000000200)={0x4}, &(0x7f0000000240)) ioctl$TIOCGSOFTCAR(r1, 0x5456, &(0x7f00000010c0)) [ 369.773015] binder: 16193:16200 Release 1 refcount change on invalid ref 1 ret -22 [ 369.818397] binder: 16216:16218 ioctl 40087602 200001c0 returned -22 20:30:15 executing program 4: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r0, &(0x7f0000000100)={0xa, 0x4e22, 0x7fffffff, @dev={0xfe, 0x80, [], 0xb}, 0x2}, 0x1c) writev(r0, &(0x7f0000000540), 0xffffe97) ioctl$EXT4_IOC_GROUP_EXTEND(0xffffffffffffffff, 0x40046607, &(0x7f0000000400)) listen(r0, 0x201f39e40d) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) mkdirat$cgroup(0xffffffffffffffff, &(0x7f0000000140)='syz1\x00', 0x1ff) r2 = memfd_create(&(0x7f0000000180)='syz1\x00', 0x0) write$P9_RFSYNC(r2, &(0x7f0000000500)={0x4, 0x33, 0x1}, 0xffffffffffffff3e) sendto$inet6(r1, &(0x7f0000000380), 0x0, 0x20000004, &(0x7f000031e000)={0xa, 0x4e22}, 0x1c) r3 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000300)='./cgroup.cpu\x00', 0x200002, 0x0) fchdir(0xffffffffffffffff) r4 = creat(&(0x7f0000000440)='./bus\x00', 0x100) fcntl$setstatus(r0, 0x4, 0x400000000000) r5 = open(&(0x7f00000000c0)='./bus\x00', 0x141042, 0x0) write$selinux_context(r5, &(0x7f0000000000)='system_u:object_r:crontab_exec_t:s0\x00', 0xfffffffffffffe84) setsockopt$inet6_tcp_TCP_CONGESTION(r1, 0x6, 0xd, &(0x7f0000000580)='htcp\x00', 0x5) write(r3, &(0x7f0000000380), 0xffffffffffffff6c) write$cgroup_type(r4, &(0x7f0000000200)='threaded\x00', 0xfffffeb3) write(r4, &(0x7f0000000480)="b2cf691ae07fcba019ebbd60fb6f9efe0b945bf832517fc6ea632764b345fa475d494fbe60cf259fd297b6a2", 0x2c) select(0x40, &(0x7f0000000040)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff}, &(0x7f0000000080), &(0x7f00000001c0), &(0x7f0000000280)={0x77359400}) getsockopt$IP6T_SO_GET_ENTRIES(r0, 0x29, 0x41, &(0x7f0000000a00)=ANY=[@ANYBLOB="7365637572690180000000000000000000000000000000000000000000000000c40000004e8b4b2f7fa37c911d43b7dfb6540065d6549ec8402c4611921b902574450eb6fcc611de94c232461f22877f4a0c40e759d2942e09f5f448f8a2ef823ff78d79dbd147c4ecb6ab52f030b8fea1243b4a37836d7f0068843a8998fea04a0bc4740782cbead505001093ca99b61c426c9382417876b70a4bcff2d634050eca0d4f941bfec0542feb9b2bd8823b383f9af92e2a35d55c8815f86f423bc9c8b8578b5ed8ba7d2084ab94919aea433802acfd6d899dd28bcca65a15f1279aaf23ef57319edb9be03d5b581140d19899bac4077ef28472a0af33321a4d9b56776453712916a73e100e73f4fd20402faf20d6fdd9b4fe6efcc3b0a95a6dca5d14f6c6fb118d9fbe423d6d903f08d6c7d337b8c29f53a5523c79f4852c1a781b724f395e63a79a000000c8b4bf33ec220b53dc4d92f35e2cd0281e39c1696e769976f175b4f62d271371e555ea97e1dfa4f685e7a6449700ea69e004aa57d3ce73653d0f9ced4904585ea0588663a9faa5080f5c010fe00dace4780b467b4a3ca1b660bf789dcc8eeb045a4922917e440aab7d194f5e3f4f483350a2ab3953544188f452dbfdb3bda4f82b63cb1e07b2e05d388cd54653a8fa97298ce81f5554dc774ab20400000000000000e5bb511f6a748f8f4eab347424f06d7e14fbbaff1435fe9dc0e8ad47f7af69fc5c99de097a328d287f3810ff52c0292381eda420c52c6b2037a047e94b0d7158ce24ba55b773ce2aacc11ec549e6d20d0b8e11960b0f9a9d14ba952fdf949fd8261344af888141fce0e16213a27c927ae78c56a9c28b52e52b7fe994e1747c5f84c485e1a2b8f0b6973bff83a45ebb7582741a1806c228a81d293969a47a1de6975dfbe3ef7e1a92f7f558e0d3d342666363ceece9b6fb6c82ecb45f37a50dee9db52f9569a3089819cea0efb9b7162af140e761efebfdfabf3ce599ecae01a2555fae405143d8dd70d28da429773bedb3a1c023aa9e5b590b425ca4425ab01db632e02c6e234f129192ef12678b88c9a3c202955aba1c6cc0d42df19039db82d2f2ddf9791abd5615520c0cb8c69d76f6d3d043d7f868cf4272f198e29bc12dc1f307000000eae7fe6de5ae3ed89e66e41ef20582e41f7aaa30f254a1ef83a88951ef6f2615b6bf9cb8008bad007e1a2886d74320937458ec97cb7b64d019d8f579de8210f41b1f6b5ef7729055e01563f931cb86f5d516ac0ed9e59f14993488cd3d674692bb6a9e2b56d8cacdd8fb63fc46446945d52d5f04bfdd4398d6ca594d11c8fd7e1c12130f1fefaa8f3781306f6dbba068c63d3f0013a86ad1557572e7c060fbfe5c41acfa1d6d0ca544075722049ba1943e41ef2ed1d00000000000000000000000000000000028d72cdbd52573c70b1c36d4a5310a6b19d784b796411b6dae0d9734c04a4dae85a65055b80a0d6721e72d8b5e8469c07f17ffff6401e8a3a3a779cf1ed79488c3c5c4af4dfffeb781d9233fb132fe5577d18333781a0a68ceca5e5759e1fe2e4c8a663c325760f79d19fcc407a1ce68d62b01fc5acf6364e771274089a5efa7382018b35385f6ce6a0e3a75d76965935e2a489411b6f2ee571fca5efc07facf1de0c5cf9fe2a426d29e574319ecf43f302e398af425c3913b0650dc7e1b77bf7250629a54003fcb0eb5e3b0e1587a863683cc1834bd5c4f7c01283930f390b492c832890b8f7060197ba596a705"], &(0x7f00000002c0)=0x1) recvfrom$inet6(r1, &(0x7f0000001840)=""/31, 0xfffffe0e, 0x100, &(0x7f0000001880)={0xa, 0x0, 0xffff}, 0x1c) ioctl$FIDEDUPERANGE(r4, 0xc0189436, &(0x7f0000000f00)=ANY=[@ANYBLOB="0000bf550800000000040000000000100000000040000000475ce5dcbc4649cdac1a3719c61608000000ea4c14694f0eefd7014b7ef942cd2bb97097dd99a3c66a2e60ebb35660ea354cc72582666afa17b234152b363127039268a0fa7fc81d2d3bdebc6b7001003c9a97611289c83619128719a6c41a679d1c4d7c083d617d1441082d4c94f69811a116a3488694454543f834b5dc6dc49f4f1c033ffe4284b2f5d6086562530e55d5d30414e8458f9e520db706e8b6e567e0bfe338543921cf4b09ddd24b6c1d69e27348b7f0c6ee57a6b5c117197f8170e8b4397c6d07bc39add82f396438174f3abbf8c5762236ab6b643a5391476f43508000447725ce8a07c1d50d581cde481d6e043dd03146690670f69a636ad1e2dced3a7b689aebb53acc28442d629ab19b962d0038fe65deaa47d01e58f47e4658544318886d4c02c74e45baae58bd714014a14093d7146320a51829eca017899dcfc91ec7c40b06a2edb0142ca0aeedd967af922e94b13e5c38c36fa5c03147ed434742fd5d88fdedf45fe1f5e489fc83d9a705363b4baf77fa65a54e16c4f0924f36f3fee210a46ac71c7a16495eb4bc56b7d86931e9ae900dadc9b381f56ade10f22bc2d685e49a42d146bdd476986ec630feebad6bd5100c7bda908ad771fe4d207d7eff1d80a02d481134f00cec1144b71a9d33c9ebc0142caa23e507844848b8808848f4e77d816a21a01a72b279c3d6ed6e59398c1ad2bb6ed16a6c0f5d3de1dd2e3da541baecd8b1b65b040bf206a13057701a1a9c2cba067ef3d04f89259268643e"]) listen(r3, 0x400000000000) renameat(r4, &(0x7f0000000340)='./bus\x00', r4, &(0x7f0000000380)='./bus\x00') open(&(0x7f00000004c0)='./bus\x00', 0x200, 0xa) r6 = accept4(r0, 0x0, &(0x7f0000000000)=0xfffffffffffffefa, 0x0) sendto$inet6(r0, &(0x7f0000000240), 0x0, 0x2, 0x0, 0x0) setsockopt$inet6_tcp_buf(r6, 0x6, 0x4000000000001a, &(0x7f00000003c0)="a511d63ef4328d3e4e043d386651e7940518d24e023cb7ca79b352ec9c89ca98636cdabf44898afe5b15b35abfcbfc6f5c60b89080", 0x35) [ 369.898367] binder: 16216:16226 got transaction with invalid offset (0, min 0 max 24) or object. [ 369.930851] binder: 16216:16226 transaction failed 29201/-22, size 24-8 line 3200 [ 369.953943] binder: 16216:16230 BC_INCREFS_DONE u0000000000000000 no match [ 369.990034] binder: 16216:16226 Release 1 refcount change on invalid ref 1 ret -22 20:30:16 executing program 5: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$nl_netfilter(r0, &(0x7f0000000080)={&(0x7f0000000100), 0xc, &(0x7f00000000c0)={&(0x7f0000000340)=ANY=[@ANYBLOB="140000000301ffff808f00003d88c83f00b516ba"], 0x14}}, 0x0) fcntl$F_GET_FILE_RW_HINT(r0, 0x40d, &(0x7f0000000000)) syz_open_dev$mice(&(0x7f0000000040)='/dev/input/mice\x00', 0x0, 0x800) 20:30:16 executing program 2: sendmsg$key(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000000c0)=ANY=[], 0x176}}, 0x0) sendmsg$key(0xffffffffffffffff, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000184000)=ANY=[@ANYBLOB="020100021000000000000600000000000800120000ffff1500000000000000fd39000000000000000000800000000000e00000010000000000000000000035000000000000000000000000ff00000000030006000000000002000003e80000bb000000000000004add25bda56c09c7000200423b1d632b010020000000000000"], 0x80}}, 0x0) openat$ppp(0xffffffffffffff9c, &(0x7f0000000440)='/dev/ppp\x00', 0x0, 0x0) openat$selinux_avc_cache_threshold(0xffffffffffffff9c, &(0x7f0000000480)='/selinux/avc/cache_threshold\x00', 0x2, 0x0) openat$selinux_avc_hash_stats(0xffffffffffffff9c, &(0x7f00000004c0)='/selinux/avc/hash_stats\x00', 0x0, 0x0) r0 = socket$key(0xf, 0x3, 0x2) pipe(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) write(r2, &(0x7f00000001c0), 0xfffffef3) read(r1, &(0x7f0000000200)=""/250, 0x50c7e3e3) r3 = socket$inet6(0xa, 0x800, 0xc270) setsockopt$inet_tcp_TCP_CONGESTION(0xffffffffffffffff, 0x6, 0xd, &(0x7f0000000340)='illinois\x00', 0x9) r4 = socket$inet6(0xa, 0x2, 0x0) r5 = socket$inet6(0xa, 0x1000000000002, 0x0) r6 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000001440)='cgroup.stat\x00', 0x0, 0x0) write$FUSE_IOCTL(r6, &(0x7f0000001480)={0x20, 0x0, 0x0, {0x8, 0x0, 0x1, 0x7fffffff}}, 0x20) openat$full(0xffffffffffffff9c, &(0x7f0000000400)='/dev/full\x00', 0x8000, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000240)={&(0x7f0000000000), 0xc, &(0x7f0000000380)={&(0x7f0000000180)=ANY=[@ANYBLOB], 0x1}, 0x1, 0x0, 0x0, 0x1}, 0x40000) iopl(0xdc1) setsockopt$SO_BINDTODEVICE(r5, 0x1, 0x19, &(0x7f0000001280)='ip6gretap0\x00', 0x10) getsockopt$inet_mreqn(r1, 0x0, 0x27, &(0x7f0000000c00)={@dev, @broadcast, 0x0}, &(0x7f0000000c40)=0xc) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000d00)={&(0x7f00000003c0), 0xc, &(0x7f0000000cc0)={&(0x7f0000000c80)=@dellink={0x30, 0x11, 0x800, 0x70bd29, 0x25dfdbfb, {0x0, 0x0, 0x0, r7, 0x10000, 0x4000}, [@IFLA_NUM_RX_QUEUES={0x8, 0x20, 0x81}, @IFLA_EXT_MASK={0x8, 0x1d, 0xad5}]}, 0x30}, 0x1, 0x0, 0x0, 0x20000050}, 0x48080) connect$inet6(r4, &(0x7f0000000100)={0xa, 0x0, 0x0, @dev, 0x2}, 0x1c) ioctl$sock_ifreq(r2, 0x8956, &(0x7f00000001c0)={'veth0_to_bond\x00', @ifru_addrs=@ax25={0x3, {"ee75b8edf7dee0"}, 0x40}}) dup(r6) connect$inet6(r4, &(0x7f0000000300)={0xa, 0x4e24, 0x0, @ipv4={[], [], @loopback}}, 0x1c) sync_file_range(r3, 0x4, 0x6, 0x4) chroot(&(0x7f0000000040)='./file0\x00') sendmmsg(r4, &(0x7f00000092c0), 0x4ff, 0x0) socket$inet6_udp(0xa, 0x2, 0x0) read$eventfd(r6, &(0x7f0000000180), 0x8) sendmmsg(r0, &(0x7f0000000040), 0x8000000000000d2, 0x40000) munlockall() 20:30:16 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$FS_IOC_SETVERSION(r0, 0x40087602, &(0x7f00000001c0)) r1 = syz_open_dev$binder(&(0x7f0000000640)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000000)=[@enter_looper], 0x1, 0x0, &(0x7f0000000040)='+'}) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x0, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0x0, 0x0, &(0x7f0000000780)}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000380)={0x8, 0x0, &(0x7f0000000500)=[@release={0x40046306, 0x1}], 0x0, 0x0, &(0x7f0000000400)}) 20:30:16 executing program 5: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$nl_netfilter(r0, &(0x7f0000000080)={&(0x7f0000000100), 0x9, &(0x7f0000000040)={&(0x7f0000000340)=ANY=[@ANYPTR=&(0x7f0000000180)=ANY=[@ANYRES32=r0, @ANYPTR64=&(0x7f0000000140)=ANY=[@ANYRESDEC=r0, @ANYRES16=r0, @ANYRESHEX=r0]]], 0xfffffffffffffee4}}, 0x20000000) recvmmsg(r0, &(0x7f00000013c0), 0x1ad, 0x0, &(0x7f0000000c40)={0x77359400}) 20:30:16 executing program 4: clone(0x3102001ffe, 0x0, 0xfffffffffffffffe, &(0x7f0000000000), 0xffffffffffffffff) r0 = gettid() wait4(0x0, &(0x7f00000003c0), 0x80000000, &(0x7f0000000340)) r1 = openat$selinux_enforce(0xffffffffffffff9c, &(0x7f0000000040)='/selinux/enforce\x00', 0x40, 0x0) setsockopt$IP_VS_SO_SET_STOPDAEMON(r1, 0x0, 0x48c, &(0x7f0000000080)={0x1, 'veth1_to_team\x00', 0x3}, 0x18) ptrace$cont(0x7, r0, 0x5, 0x99) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x23) ptrace$cont(0x18, r0, 0x0, 0x0) ioctl$TIOCSSOFTCAR(r1, 0x541a, &(0x7f0000000140)=0x6) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f00000000c0)={[], 0x0, 0x0, 0x1, 0x0, 0x65}) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) r2 = socket$inet6_udplite(0xa, 0x2, 0x88) ioctl(r2, 0x20000000008912, &(0x7f0000000240)="0a580f0209316e85717070") ptrace$cont(0x1f, r0, 0x0, 0x3) 20:30:16 executing program 3: r0 = socket$inet(0x2, 0x3, 0x6d) setsockopt$inet_tcp_TCP_CONGESTION(r0, 0x6, 0xd, &(0x7f0000000000)='reno\x00', 0x5) r1 = accept(r0, 0x0, &(0x7f0000000040)) r2 = syz_genetlink_get_family_id$fou(&(0x7f00000000c0)='fou\x00') sendmsg$FOU_CMD_DEL(r1, &(0x7f0000000180)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x200000}, 0xc, &(0x7f0000000140)={&(0x7f0000000100)={0x20, r2, 0x400, 0x70bd25, 0x25dfdbfc, {}, [@FOU_ATTR_TYPE={0x8, 0x4, 0x1}, @FOU_ATTR_REMCSUM_NOPARTIAL={0x4}]}, 0x20}, 0x1, 0x0, 0x0, 0x4000800}, 0x8010) sendto$inet(r0, &(0x7f0000a88f88), 0xfffffffffffffe6e, 0x20000000, &(0x7f0000e68000)={0x2, 0x0, @local}, 0x10) 20:30:16 executing program 3: r0 = socket$inet(0x2, 0x4000000000000001, 0x0) setsockopt$inet_tcp_TCP_CONGESTION(r0, 0x6, 0xd, &(0x7f0000000680)='reno\x00', 0x60c5) sendto$inet(r0, &(0x7f0000a88f88), 0xfffffffffffffe6e, 0x20000000, &(0x7f0000e68000)={0x2, 0x0, @local}, 0x10) r1 = memfd_create(&(0x7f0000000040)='reno\x00', 0x1) getsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffffff, 0x29, 0x23, &(0x7f00000000c0)={{{@in6=@local, @in6=@local, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@ipv4={[], [], @multicast2}}, 0x0, @in6=@dev}}, &(0x7f0000000280)=0xe8) sendmsg$nl_generic(r1, &(0x7f0000000240)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x2}, 0xc, &(0x7f0000000200)={&(0x7f00000006c0)={0x213c, 0x28, 0x300, 0x70bd2b, 0x25dfdbfb, {0x6}, [@nested={0x2124, 0x83, [@generic="58ef3bd5bf8a7979e76b297db1519bf3f7d1a98834daf2f02fc5a8d0647825240c55cc31cadd8f0e6a30568fd6fba34c798afb407609023a781e785ca98f4f36ae42f1de2b1a5baf6f125e911746a0c9defdbdaf4cc97ea1c52da9014a928145fc724bf6076757ec360314eec595e0a29010293389c817bbc6417e14be656f767c54def1ab11d29c482c68202d8d25b6d98f80bda717e516bda0fb08ac8327505f239ff68e55341f346ca60ae59f01fec1d04acffbe81a537645d3d01472badb01c7de903f8765542dc1691fb089a668be5698e4bd530e0be54c135b90d79f0dd6bf35616acb421739743f9c5b6ae2f53be824d3e3c7998259c87a5d35fe7d9b0030ec78e3bc85507c1163eb8acf74fca1b22dcb8b35bc7ebd798ea0fdddd520c9f898f32b7a931ef543a28175ba81895ba3adff2ba4f6faf10e7d5a40abf9632904bd8e245a306f33cf4f99f2501ae090b0254d59e4ee94ee1012ad8d352236197257cd5ac5dbbf20622f8b986adff8bff8e60d1731b4a666dfd577d2b3bc81c3e2ecdc4275330fbd25e6b5aa119c384e3e64364eea623148e77d211e6f6cb71836e29c72d0e583cc4a58dcf9e325cecd211322a373e619059214d6813533948d8ccd15454edf545e1b1ea1490db71c0cec93e4b6024cec7366f641062a15ea571887263f0d68e138ed1e3ab0d2c140287c4e532e92737d13b02171a19a317dd54c477b6cf46116def9e3e5053b340f0d12b0677e1c27574579c88a9424ffd8eccfb4d5cdc5b65c86ffa09ad90204e4c38c1e1daf6d29a7b9bc84f88f8c685a5525e2ec60189b7e0333f3ce787f6ed15f4271d4015b0ce14ecaee18394d7c72d0cc86e5d8d35dd6ff188dc3fe28281a08c3fb8ba84db50a84c8329404bd8feb4e8b29b1eaa73f1fd7bc6fac7376ff350cbe2263e545afac2d36829045fa484b7b3f1c8f50a99ad143a6789568bf394ab4d5e62f66f071abb0764ba26f7a28214118171a89fb601c1d1981d96c61d8c4a5b7bf57de5d09a596dc30dd07b9843370ebdd3ff5899e9419dc8624ce2be0ef79d7d62f3d2424268233f6cabed7222063c872dca862b1a8e9b9ba0710a299f34e201c43648647d85cb1caf758c01735d7eba2efefe4705419ae9878143b8cbe2f84b47229dbd09ba9995a30717810daa3f9ee89e8f185631cf859e0627281a44379f8c5b4fa9af5467d9128ccf51a6f024cbb549187ab88f2b2b579e7ae491e25fd97111b94511b4f8eb88ba0d349f212a0b626063b6caa4e2749a84e8547ea8ffb8a5455e1a1302d5416b0576cda293aca4c46bd15b4e37b7dcf74e05fdbd8fba08d76743f3e89e1565406ca8bf552bd0ba241f441af910de002e30d4e73e81927262f4c3ea1c6fcf291548d28e39ba7929302cc116cc7cb7d92dbeea4f1d272d4212b2a57bae77b96fda4933ae2f8255c7348ff23a8f170da10efade3a5ef4176ea16508e7cb63bfe903c3c4437267f1b35629143dba6f47a5313050fdc24216acf59f23bd0e4bb0fef9ea22925e4d7b7aaf47f92bd0888c7d40a0233b83856f24c1d1b5c6e99133d69fa7b94ef57f18bf564ba161178ee2963966401052781b3b33a71b9dff002bb3d4a9de78736eed9d364d7d1f1d71aef29918ea5b80d7f31be66942fe22567d31fd834b6e09c0f71e8eb6cf15fa46320228e2fc63e396bab9f4ea2c9f603ae699508c15dd2aba481866649d2153ea16f1a522ff3a5fe15b8974b8eaa4c345a407406a19c39c17343d911d68b5d79826c9e04cb8d5ef05ac9f578477cbe9afd4d0dd7d537ef6c128f6472d5c429fe8ef42c6664cc8597ce0c8bd93871ce5968bc7d7f6ad604e70859917411b0ab99d0bcd7fc9e1409dddd3e7213bf9be9718225575acc89434d0fffaac5e291cfeac04133beca83189fbbade7e818a3b83f3c7e9192e225541b00c9cff480cd045853ce447a9d14873d770dce59eb02ee6d2ab921bb567c36dc1324a2a21ee20ef89f9a33518529a5b6baa24bfc40a86d9a7075209a099e7f5c066dbaa6571992fe1ec0b3824ab65a241607379ce607e6a522f549ef844a354086270030d64d52e9b663e27db60b7bf7a83c93a1fb9aed65cc5afbbb2678e5b89eccdf9d86fa559a5ba4e8c28ce886c9bdfe982ef278bc8bcd981cf671a5b699baa710b38efb5f3917ccc2ed37b00feb0da005d9b1134e0b55e2faf6f25a1f43a2704d801be803db396aa08acdddbe1e0f2f89ddb2b376a88c6111652581b0b07070403f252c62b5ee150046ffbe5cb622312bd41d9d784b81bee6c7f9ad7b3efc2ff5e70bc195281a4c6e3e7588159692ebdf1f83fc833f56e30a80bed53a0658ad6f609cc7a8e2e87ecc26ca32a05847e27d95deefc7c9078e39d67aab0e7c6e6596cb8ffeb1f561448022cec1d7d64f528bd603c6b3a63c88bb2e163a0d4caf0b6cf1b2f780d5ce858baef18972b6f4396171eab53e54a4f3ae80643d4169d17ba16b73ec720855f5eb8960df8565e95c3273cd6920bc6d7b7c1c786c85963aa6ea041f521c1facf0274cbcb0df224459f6b27c85ff0da3add4844a095bb46d93064fabc751f07a6f3529e9975835fc3abbdb2b671d5d1cad714127079f3261e8415f68102cf8142b66dcf284720b7a66e987bbe3c75f03fcecd57dee2a6e4586a40099469c063fad254a937f444a4a87092e58d91afde597cbd8157a6f1eef235ff0cf2e9653fc2ee0a895c8b31845cbc12ffb86392b073fd999af0e7fb058f1a86027aed9870a3b4d045a934bc92a554eaf6f473ded74f2d7634822ddd89f1e460ba3071e0674800258439d7785597e6458f3a164aa8eef40e12a276585db96dc8054f8addeefd84433aa0af4fc0b1d78e213e086e27d7590f428e03c8cd3a3038a8d60683e7d21fdc7d2d3919b9d7143d10c05f83e14f6e0ab96f1f16549448acc00cf6eb571862a8b8fc50004f0013502e9992d1e4a752a5ca2cf4ff702dbd842d680027801046ffe29add05d31f91634d7249cf9913121d781a91d2cb38b1977831a1dde2cc5e923868dd9370f4b605514e751f1e939a317a5b3c2e7ba970824175cb55368852299b6d4987e4d790011a345d623b50d93062a46782389850ae65c5e3b27400886d8570cc4a2e183c5c5fea0f95b46f10246b2d6d147f81f3c5a7004705739e3314ceb5db86fc37f3dc908264774ea7f01c12d7da4cf32c9de011f9c844c285a160b14cb80ac68582cbb701bc2b56d29aebfdfb8866262a2e907e0c4d6e827fe985eb6ffb68bde5e7a06504106a4c738501401e02041a60a63f5c88cdbc7c4a0a4d13509a8e59eabb674823f2413a91f068fc8d12fd280926ca8ef5ba1821435ff8a3b28343954354fa5acf73d6ff47e20e86baf430b031cfe3686f44448eab87ddd8760cb6286a93e96fc8328c18c0049342de24146cb169b0b1d66d8cc601e638daefde9be227673338c34b9d100d9c649a05607fa668ed86922d03eeb4e1be9868b9c52f289720dc5ca23be3e242dde03c6817a092885845e0b9aa638086b3c96c6f6201cce024e95348a0255ef05bc46c65b7ba892226f0df89f7a43a2cb279789e196e99af4f9da8758c78c8c01f4c519937bd89d10b953694aa3ccf0ba2d08522a81b0b8b051584f1db14adafe61e08093d756aa24691d0e6e477b25c99193b1796579bf0a6257972d3769b70481cff89a8e837c7b2c0a6d2f1e13ebed53b199bcce3beff8747f88763e1ff8a42a276a78b407dd57bfdd051436bb90f146f3bcfc4ae17d46ed0a3c7e33593fca6414cf78c515a611763f656b399948b68bd9fa2de63248001885a44a8423418b7b065cfef4eb9afab94ab48eadbbd670d7f0f770b438f37dc3b08ebecacf1c70f26b2fa9c9057ea3e991e0e802ea040d516491a0b98a5588db98465d8c9072ac83e14988dedbb4d72666f1e9de6ada119e731b5fd9c92193341352cfc22f5036d152dd02041f6fa5db5538c380079413da4bd2dd355d5b63d5b8f362a5e9bef201e0de24717ad0f50bc25dbf75ea2e0b4b4d3d38029bd5e7ee714355e331fa268bbf11564898439e0b81f31b7a60c3cd10959b7947f7dba8379c262fe58b3c9aac3269201f30ddd80054435e5e661d9003e02721039365575e0f1e0cb9fdf4e10648d3dc3df0ebe03cb5971745f7f9e49b991d775d64c15d85f97f897ee2b94f4654ab290067c5b4a807e045cd99584015b62f90384820e99f6541f2fea13af759439f3b7cb855f2b449a5d307b4889a4d7acbfb0b50afbc39e61409aa8eea4d427e46d2e785a0f094f9ff1f29edafd63932de33470051280ab39aabbbdf44a15b3ec922594058fafd56e391ba114a3abc5def2ff48e917c6ba678f602a4357216a0cd4de75ee3dfc2e1539a9bae55fa88c7d7ff40407c1f8b3f4d5f1465efea5212a8b9e195bd45f4e710be9886fc22bd15a0a73fe38c3c7893d9baa80762b79329291651e50895fca0e6c9fcd5466aa3ff5cead1d8e12f314f72f4a938657f718373fe77adb8ce746d7e6587dec68574b8c13956fdfa4d37d4e3cf80fcfc7bb39434acfad9e0ed68f2299d9d6ad00c00df117964f0603933307d1f65c53d8368802fe49715a0e0c7a57a77ad8f9380ea153fe91cf9ff42fdf1c8d82c467eecae1cf39110b26126fb9f514da3f24576273cac2d052f85b975394484426b782adc9530d21ee1fb0b72bf424867914f1c9252af7e5b4dbe1baa8b15ae60d7813da6ec06b93573317b0e4c8e7ae106b286d7a84087d73de7bf78083edf2b0d5ad8dbd250b5daf517a3857d282bcaef778d5d6d7181820229f15847b6d3ede9bcce749b17a4c6ae886892b15759c23c1a3c0365075f74ad48dd4def038cb3bac8474a8223ce65a1cdecf18e0fe8dfd744b1ccaebc76994d95a640b8c3619781045244850e0ad29a9b06cf2aef5d2f44ca0c114f0d7ba4d682178a8e220e28da047d3f69ff31aa42c9608e768edc86825640638fa23277fd6cfff0e5b13374a17099c9bef27dda08d93cf894090ed0262a1a85cc9451f6d10fe71f7a29cf305c428bcad365ac94cae32ec0567f121d9bac8ee10c26691b3fcb9b71b4b140e9a188a85f318e2b36b03f73654f5e1c62e871cfb872e71109e42f6b6122553909cb54f4041e7b270c772d7cb8772868cddae4940ab90597b62c1d22572028e40a0e90d2cc2790cac2dafc26483cd871e43824792b63cb0c33582bf40e0ba859fef7af31ddd0b2eebe578d0abfa08a9e3a09b4510f2181640ee2c1582b3eee234dcfc196c374689d0c57928a8d51765ce794a3c267e42c4ded5fd6149aa8e5986491fc5d353b655f61ac6b7eb870581ee36f44a87c9c54d0098c71fab0006b3814ec02c7c4d78e19e02fcce16c6e4b39113b27e4518af8487ad5561110db638a0bcca2deaeba788e2bd6bf78da4817c7390069426adc4cca9cf404165e3e76e4d75a1e140f10f0be7ebb1f9240eb2c5fcf7d2173be9e1bab2435f23c642d288b63e1d520ecab03f8c36b0a2a0bb270f82b4e427c30b04b80579130a3b5fdfb6ad34604c1293b8c2478b23790e199688f765a2a22257ca5eb1781f5a7b25deb39486675ca65321d007f65d339409c868960b07d87d91d57892ba6160613fe80b5ac95e28f235fd75b59258547d5546ab813c45d1e0434f6eaa03649ebd144256445a463185e7e89f3fc76c769c5f102a7d47ece00c23c9ada0daa89b96ebbfc0cd8acb78f2a9f6ab972d6796289bfe84b0f599dce76814e286776d60d992fd0e3ba168e6b695f95cbe215", @typed={0x4, 0x8f}, @generic="4907fc5640a13e7da8ab690df70c6555938ded1afd672d9b82a3b14267bbebba1077f21ea1013f17eb32b01bf5b3fe72ebd16d3cf8b18efb5bec80fdf9cad35229a43482a0556ed90d4f965de04b3abff1fa340f18057fd4e5cd50a5a863444da84493d95231ff038954b3a8dc9c56f45af7107a4d22ba352e3c4d4326e5aed0345b96d68f55b5a482a5544564015922cf7d3b664d8f9029ec4929f78e877648dd67fe3975c6a396294594feb8c59d5c9228aab5099c6a1d8f7c298bbd4b276bd5746e4b009f84afabd0752b59319bb44959f95a37158dfdc6b0ac04789c332fa5a178e3351ad0f06043de1f5a7f", @typed={0x8, 0x84, @uid=r2}, @generic="ba601a3aafe5e6f944003a16847e600693f9252fe969f4605a31cb239787cc277fc32b30dd292368762bf995cb090f82c634f747c4546daa15650e28d0894b2c72bcfbbba1beb043e99c61fad550511e307018e7732493e3f5bd0e236383d68e9471f3a8d05373c127705ecc128f9358881f9cde2ff7db21da40450691efd8dce7cc8f02dd9731d433f1d59cf532fcd7cd79a63a9494525328d64d7040bf072976cf8eb0cff0c6bca6eb80163aba440ff013e3fe70123583c1992a0a221f60ab72faf8acb01d0b89c928fe56ff48a1c847daae06ccf71d212688075d9e217a04fa0b30f6fa78eef49439c8bf90c8e5d1a88374d15ddb763775da8aa9f9f122ef68d0c96d1cf3cbf54b896e294153899a61b76cf3e666751199aebaacedfee1eac57c44348986386ae1a85932996d9465574fa6e6466b948dc80bf6dcaba62e4c82ffc7c61c9d089b664b8272d6bed35229c8fc9dfa1e675cadf7946d5f2be3de0c4b6d7f140fa637943825c90e1e944e81b213f5e8e73ea572436612cb847a64c6c4174e6c2b52c7a2d73910dae4197d10696de570b6a5806a90d220d7b523f60cdc92abba68791fa3cd7eb1b48d684cbd4f22bfafd27a1a704ec71c6d2e153b1f6a6105b9a54071d105bf0fb9f354bc4248894d61549fb1dd0e8c00b022181e04ae283e97f5e4674a1d168fd4e6ffe2033480f79a90a1348993f28e5ced5b0e7b5d8d103b7b6bf2600097d5d164c7965eb4d069f1cb9e9c6a76e3a0c4f69ce393bbee8280e32d26bd9d2756df1ca48262a9b25f0579e77b490003d92c99d1f375e2081e451f61e524768d2095d51dfc6d1b9cec924fabf72f83e34b4202648db24403ab82e018ac5ce70d18ecc03177d8317b57e9096f0169605bbc51db461311ade3f01e0b50b4d16bd9311bdb064099be0cdca2dad5682db0ff099925118b390c250ea320fa8e1ccb8aa77128d4546725c305d04e4c6fddb1f1e2358a1cfcbdb0f8f2122394a18acf1bd9ab00879e5abc4990fc94c71ab1170c51fe92cf3b89d14a66e59329d3a3b2ab8232acfae698aae9bcd2e9490d3d988d564fdb1075b291e450e8604d481f09aa2c48a1fc4b215e5cfd2270ff2c8c8a0abaf43210399056608186fd5568c469cde2e865bfe4bd42c2ba799d0453aec5fbc6785a219e8e93a0acd7f36d7cb512c094a2126b7977eab465f9bb57d7bfae208712b8c585cc3788b8e05e45f7809dac249ecc9cc6441f37e912f8f2b25b1693fa17cdaaf7f41d6604dd217450a9c392f529e5419d63b893295cb39919bfc74784d84a27893f60852979aa763cb3b023d5c76c783a5436aa1f2d0b7ca785b039ead35407e09fd5a4d8147785e1a7027b0001c9d99dafd0a6e0d950c906e5f0e1e65d26654e63720ab6bb4f5c69f1eb27e636170fe0a4f6b6ba1d8a13946375d3823856a306c22a56a3244c09ecdbbc4a42e4b727cec5d4509423627bbd96e726175b5edc1cb5836415a363e2d0324b99c4ad48ef52821aa4c2d626af327651697d040184c392e5805ab05e054f71c455d0ad773c24d30f8a3a3d7928f60fa8a01d81fd20e7d605faf0e165aeb8d75784f1ebda4f233a9da07a847ffaaf6d643d711b3baf308232a1b8cd3f1eaf50826d7317bb4f0ca0a67c6b7dc49dbd51ac9cbf8ffbd9b7806bd6d849be98bd8f4de7dd5af54695a4dc4d177925a1a5bf97fb66d72cfa2b7e57e22c0045b7d98e93c925aa04ccdf121a2c8ee18478ee4103bfccdb47dceb4a92c1c4ec2a059a72be21fcc16467fe0c6f4eac9091b78a1af1f5c00b47a249edc9045adb18193060ee1d44aa0caa0b2b863026f171bbe69ecc9f7fcc00b3e57fbdc663b7b704058cb1c1d218e2fd37d8ff1461aa6b7d94e73e9d98567d847824cd818a55fff952e522d39c2afee71d6d7ca25344f96c42e8ff1ba4acbeeceeb6b75f739b8ac14800bad4e9be7e48424632021d61e0913a43e2127824fc14e07a9b1e2677d9e7bf183b4626d7da1f6d7244ed1b56d293cc744b49e5ce385ade9f4053545feb4053cf12413ed1fa7450a134d1d094a195586cb0d4fa961f7b13cc2c942e75be1c22436cbc9a3374f23e4ab641f425f2f712f0228ee0f354fbc0fc791f0ab056d421b1d4f8e9b21ce43fa3debb1d778643c561ba43f947e9eda65f9199c85706cd6b3a3ec6bd2d8482f78097e9316658bf9fe199d8f099b1ed4ae1d05f459e765263e919cda049a59d62b6259ea0b480beeaf66d981ef87d3160a9e3b5cfb006d56f7f0e24d4b0655d286fda879e1569935dc7b8a40bf2ce05aa47c31fc7a04de647ff3241005bd48cb2c3074b82d61648572f26d230479b9bfec5aa48a68043b0c386dca6bfc1134e96fa1f5df44d260c5e1082b94b285c9db253f39f9d795b220491c91cf65d0b5d2ded2a7b90cd88e150fb6f2fc33bf1e14b559b24b23543596cb0f0a1c0d4e543b5b06da619ad706d8a8681ded7d5e2a57471eb6f0e3443a147955d96a59c43619c6679e59ccf4e1326ce4e9388e48bd364ab7ab605dc1044d21249979eef8d7e9283aca912eef9ac8d0236a59ee927af004e62c4e9771d314e33abbf83f5659100650d5e41c916659466a8e5a8e72691e8f477e98bcab91a30a8186a59835f7b3dd0f89046616890ef6075cf301b53af4bf2743563b62f9af34ce5fd4f189dda303177ea10385b3484149eb20e000fb90b708a6a033adb1bd409f0f8ea1344d374fdd90bf211fed897022475fc3d468c72637baab3f44679f180e41ee34a10790b2ef547e397e69e0a04ad6ec8b549fa13e44d9e161b8fd0e20bcf58ee418433287d58b88693c77d9c4fc269c6bce8c5be50cf931ef2952f86c6cda8b5b2f55017b95e06c5e1c7101693df4364def62101ddbacd458710a1e338108d648258db74997d4a4ba67168b082e7432ebd6aa04bbe18db1fd00b1cf0fabed0d812db66f9b78f57e9dc6f302271c18bb3d8f1258d7984180f979e3817685f9198c4cc6634c6b09560110d7f7ceaec12b1437106dacf69c1e74d2fd4cb2e2732fcb49d4a2fe2dba69bbb76ce7b8d25d6960105e8bb0191bc88878bbe1d9ee13efbb49e716f300e2b1f84f8c51242a10ff06844a57d57b2a9bcf9e66d58a626f825629b6efc4deb1abf1d87a441a925f011b24fbbc1cf4dbce7317d2e9d3c45adc99c41fcbd1b30cf752c64e60008dd00a08add82f8d2c6fe38ca438b0479f5822bda0b7fbfdeaec3e145fef340097f19d01150a7a30b58fc802103cba1e0afd5a06f3b230e2c584b9acd69609c5268d3c85564a3300fbe30808e00de19a024a81813011f51b86531898f3e96a371d896a6bbb750d7e5269e8b2c7db6c67f076628f63a8d8c075f21e75dabc40765fbe77623973111ae7db6717155e091c5828a013fc2038987787bafe1f9bcd601d3c51b24649e9891a7c51db9ecc502264da8cbfc92064ec860d2869fed1f25c6848a2622458766e71a99f5d99f286e2badfb9350e4817575e7f80a248ad6cecd7557147812e66170824ed0efb77bf026a77409af8c80ed39b95ef5436602433cee53add8554d6c48863409504838f0f100c813e55d517fd2deb91037a2db8d29eef2bf71677de33a8861b828bef07425286263e18b5bd698533c9367bf0dcf4e4e778bea6a4f085bca6f66299e4b6c6bab56154d888c2188c844c3480c9c2edb09eb6501d8c070204c84231ebfc45c70198d489b0bcf0935ecec80523c944aa5c36c451e173b6b46d4a4a9f7fe8efd17f25f6acefe0cca8ef9c85de3da05637909b0486ce00dc2a163974bbbfde9b695d2acd8f78a5e5628e990a18ce90e36c3b20081bc21207fd3e06f6a24d7048884581c4ef288794d177c7baa03581b135a3d5f3e0456bf51de37ce453af85505f5ff720cb1c341c93c161d0947bd330915fc3e750f9847817ef642e6800284a0247aea074c4ac57d7a73a5b802155b7b9100f131578adaa8327c9ab2f6a4fa81b32114555ae063cace54477e3fccff9a99153a14b39c4d2a24553a6d11955d4a15fb1814cce6276a382b3f9bca109e54496c4be1f2cf815fe787010e06d31115245e34c57080989e1ee42dc9221200cedb8aea9f9843aedb61316d0d831ede75f97b63dc80412668c4916f7213589ae165eabbb4ce722f1c88bf7a565dc2f3a6882221c44a8b31c528d3ec278951a05b8e2c7867904861437cc674bd1f43af8e3e2adaf7bb4aae27def4c8cc15e8de6a836cce3fe6249928cacdedec00e4eae196e53f9e0007e046c959e7af3ff6cf57d9bb1b9770505bd3700234d6f60cc05957bec83a0815e610e1507ce1d3a0274a24afa10c4dd3b1ac9714687e572a8486288c934215d9ff508f2b87bf3ccd72c8f70b358d674141d34d1d253636bbbd26410e1feaa0348986e4824a7ed413d8993869a9f16a19526ff16c3590e403008f55127f313e434f533da19738b1e2603a04161da62cee63d326809c5587128625f63eeecb2bf419472e9ec5d4cd91ee2dc471064d46d049823233f899105fc4068cbc00093d5b93b7e5cd82c262f9f0cfaf7387239d0afc5212acf60be64ead11751c741473605197306946c6fab38d5551aa6ff90ef7b5f4fc839dbfcba3e6f65de3d69d3df3ee2821922ad1c6054763ea462dab7f0eca82aa61a5a2ad29ad652985941322cea683bc01a3c1c00543830c583f845c2995b9f151baa0b9d728aca240fe9494c620c82812bf6cd6733edec387cb9899d42ade885e70c1b892d268c86a17e750a80b7ee96b266df469c4d2227f842e82e8b5077d2768ca8158b4fd142370f53c2f97cde2962537a63f7e92904743d7bb19eb81cfd7538eddab64145c186b78868fb932286efedc2287ac203b3052a168781e3d9d690bd66a2adb0328dc85d2346e3b82ad72cfc3a9afb30e72d89df2d8bebb7b3fe6db8895730f142de439f8a335a81a363f75191de61c899b5fbc0d57213bb3c99d76cae4d92987d0b586f03b345f79856bf5b11766844be11997a50f6d0f77e89be98893b9acd0850c0b7737b1d3f25596882ef44d853c91a2ed255b8412234a30bfc204709381ade74ffbce0a5074aeb91ed0899742ac187180e5b82eeeeb9516febf50c154d4c30226cc9f7a1bf4386f0eb0b887eaab24e4018738ab7c7b801e421d7ab4c31c90eaba8d4369f89758f9083b6ba9a2d8acb52fbec9eddc2fe14b157d622ac5a61f248958b1bb697bac5697905b50745b1f92a5d2bac763064f4ea53497dfadee2f5a1af3d5f2ff03c0e7e7e0ea42c3146cd2ceefec86dd2cefe203b3c6aa3f0820f209dc352811f81cd61f8c6bf6ae132b4b8a65e60709cf9ad395fd2ca40b12c78a2be70171696a518f72435bd206edf8d702ccc085b692ad7e040610dc6c1108e122d501a224f4446a5e4c8184885b430d2fa8823303e59e4ca16e7ca15efa5906b76085ad1b428c91f7b97692c5e52c1ce15df284ff4df74c78e9736f8ea08fee0ebed8a657107ec0e8c5c598243e1bf1ada5da6afcc555dd12bbd965ed1431b8f72356de2f397d23df0222bd38d074d06f16b6d823e9e8139ac21393554519aa49c484eab50541a0b8ecf0a108892eebbc222ddb99f1da1d174f232eb83cc63779f57bc5454c7176bb9a9e5cb1d06db3889ddb8bf97c2b28b268389e40d737ddc80a1f8353c0c3141aa9f2453dd05064c9c4f521a9e1d07065fc38cf0b0a2c97c311f59f3a313d99afb784d8c547431a2b935f20ae06d35d66dc6e37d52fca7daa363afc0764057c41aeb5c3eadfe9a5d3fb93bc1e64", @typed={0x8, 0x61, @ipv4=@rand_addr=0x100000001}, @generic="66bf55992bfa5a15140f82c160e5e0035bdb929f", @typed={0x8, 0x44, @str='+\x00'}]}, @typed={0x4, 0x7c}]}, 0x213c}, 0x1, 0x0, 0x0, 0x20000000}, 0x0) ioctl$sock_SIOCGPGRP(r1, 0x8904, &(0x7f00000001c0)) times(&(0x7f0000000000)) 20:30:16 executing program 4: r0 = openat$full(0xffffffffffffff9c, &(0x7f0000000500)='/dev/full\x00', 0x40005, 0x0) ioctl$TIOCGSID(r0, 0x5429, &(0x7f0000000600)) ioctl$TIOCGSID(0xffffffffffffffff, 0x5429, &(0x7f0000000680)=0x0) rt_tgsigqueueinfo(r1, 0x0, 0x0, &(0x7f00000006c0)={0x11, 0x0, 0x4b2d}) r2 = socket$inet6(0xa, 0x2, 0x0) r3 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000780)='/dev/ppp\x00', 0x9, 0x0) openat$ptmx(0xffffffffffffff9c, &(0x7f0000000100)='/dev/ptmx\x00', 0x601, 0x0) setsockopt$inet6_udp_int(r2, 0x11, 0x6f, &(0x7f0000000180)=0x1, 0x4) prctl$setfpexc(0xc, 0x40000) getsockopt$inet6_mreq(0xffffffffffffffff, 0x29, 0x15, &(0x7f0000000340)={@mcast1}, &(0x7f00000004c0)=0x14) connect$inet6(r3, &(0x7f00000001c0)={0xa, 0x2, 0xfffffffffffffffe, @ipv4={[], [], @local}}, 0x1c) r4 = syz_open_dev$sndtimer(&(0x7f0000000000)='/dev/snd/timer\x00', 0x0, 0x0) openat$pfkey(0xffffffffffffff9c, &(0x7f0000000300)='/proc/self/net/pfkey\x00', 0x90000, 0x0) ioctl$SNDRV_TIMER_IOCTL_SELECT(r4, 0x40345410, &(0x7f0000000040)={{0x1}}) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000140)) writev(r0, &(0x7f0000000980)=[{&(0x7f0000000540)="f2c6b4fc90a9105761ae0269f1afa9dcd5bbca698e634ec75e4992310ad39b3da740f912c5b12bf8c91031af4e44005f3db94af2caffbe6bbebd47a34757f1c55c07365d842ef5b82144298d58e75250caa2102f9384067bd77eb53f30132eeb9e8d9818dcae", 0x66}, {&(0x7f00000005c0)="d741420bbbfa5e21111ffe81d5fb9a3edfdba1ad5ade222d1791be", 0x1b}, {&(0x7f0000000640)="272d792f5ea6811b7561c66bd1d06f123a92181563e44d", 0x17}, {&(0x7f0000000700)="d14ccea674c9baeb746dcffdb776b66e8a0eff50151580bce63c40bf448d263ecff84def24b3cb7cf93673798669da88a481114590c341be4a22d376d9498043ac723f811bef1a5312a334f76b2ac73c8cf64bf67b1ae3270f698642", 0x5c}, {&(0x7f0000000840)="9906849187f3fb14a9591a543a6ae199fa2b612d4638c9e214bea93289ebab9abd9aaa49f677658a3a44cea2c77fe0365270d59143e97f38985e6036cd6272ab6b5d5c84d8fad333aeac5ef69a480253e2cd2a720dde", 0x56}, {&(0x7f00000007c0)="aa97cbac5f29f9fe965a933103862b04a26de19ae706adeabb0e394625bf6c9527c35387c3d59892ebfddf", 0x2b}, {&(0x7f00000008c0)="1f7f466424ea65da666b21fe0f40008eb842a02ca8227c6e8ace9b5286a48cdde4a5ff2773a1c52b8022011206bb7f267f15ef7f5fd59fe7cd2688a4ab2c0a1b93748d35c66552adf164540ea5e38e3525eaaadccb6287bc79e9e9bdcae0c91277dc820516a5564d5d48d356a2f189f840e3a91613f0ebdcda4df4e64ea0fd", 0x7f}, {&(0x7f0000000940)="2bda97c742dc43dbef945e38a4b5660eb1fe8fb09a18f59035fef3a3687938dcb61c0ed80222a043a8a3ac34dd54", 0x2e}], 0x8) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x0) sendto$inet6(r3, &(0x7f0000000400)="62c7eb17d654b5898a5059ac64dc006d6cb6c2927e4b526a17e1f625eeba670fc7181f8cba", 0x25, 0x40000, &(0x7f0000000440)={0xa, 0x4e21, 0x4c29b199, @mcast1, 0x8bc1}, 0x1c) write$FUSE_NOTIFY_POLL(r3, &(0x7f0000000480)={0x18, 0x1, 0x0, {0x5}}, 0x18) ioctl$RTC_WKALM_RD(r3, 0x80287010, &(0x7f0000000800)) ioctl$EVIOCSREP(r3, 0x40084503, &(0x7f0000000a00)=[0x80000000, 0xfffffffffffffffd]) setsockopt$inet6_IPV6_FLOWLABEL_MGR(r2, 0x29, 0x20, &(0x7f0000000080)={@mcast2, 0x0, 0x0, 0x3, 0x1}, 0x20) setsockopt$inet6_IPV6_ADDRFORM(r2, 0x29, 0x1, &(0x7f0000000000), 0x4) ioctl$RTC_PLL_GET(r3, 0x80207011, &(0x7f00000003c0)) openat$ashmem(0xffffffffffffff9c, &(0x7f0000000380)='/dev/ashmem\x00', 0x0, 0x0) truncate(&(0x7f00000000c0)='./file0\x00', 0xfffffffffffffffa) r5 = syz_open_procfs(r1, &(0x7f0000000200)="6e65742f6970365f666c6f776c6162656c006ec03114893458edc1c9d8dc4b0d8dae982640d0e60400d7ff596e1c92de0eaa311f0a4d43697c2bcd77f017365af160acf33bd66432ebe50c0e8bdaf7fc39feff34ef27a1397193227f4733c145e66536c6c275112520e72b3097843b5cdac480c3b1384ebf592505f88589fcd2d7000000") sendfile(r5, r5, &(0x7f00000002c0)=0x202, 0x3) [ 370.679716] binder: 16262:16263 ioctl 40087602 200001c0 returned -22 20:30:16 executing program 0: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r0, &(0x7f0000000100)={0xa, 0x4e22, 0x0, @empty, 0x4}, 0x1c) writev(0xffffffffffffffff, &(0x7f0000002980), 0x0) r1 = socket$inet6(0x10, 0x3, 0x0) sendmsg(r1, &(0x7f0000002fc8)={&(0x7f0000000600)=@nl, 0xfffffffffffffe0d, &(0x7f0000002000), 0x1, &(0x7f0000000400), 0x0, 0x800}, 0x0) ioctl$EXT4_IOC_GROUP_EXTEND(0xffffffffffffffff, 0x40046607, &(0x7f0000000400)) listen(r0, 0x7c) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) mkdirat$cgroup(0xffffffffffffffff, &(0x7f0000000140)='syz1\x00', 0x1ff) r3 = memfd_create(&(0x7f0000000180)="0004003100", 0x0) ioctl$sock_SIOCGPGRP(r3, 0x8904, &(0x7f00000000c0)=0x0) syz_open_procfs(r4, &(0x7f0000000300)='net/ip_tables_names\x00') write$P9_RFSYNC(r3, &(0x7f0000000240)={0x7, 0x33, 0x1}, 0xfffffffffffffe2d) sendto$inet6(r2, &(0x7f0000000380), 0x0, 0x20000004, &(0x7f000031e000)={0xa, 0x4e22, 0x0, @ipv4}, 0x1c) openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000b80)="2e2f6367726f75702f73797a3100b8458a1392623c2acc07743172c163cfc71523709c3289acba6eaf2919f32ebaa4cbe89ed30167d7d56e8e65c0edbb300c9e287f10f513e776522729d5c85c09fed3f33ea055b94d27bb72a2bb9fd56015f25cf4f9ced65ed81253cfba08e9a329935ac0c64d10a5e701cc58fe4af8cb5b679468e8ad39e103e2d5b7d9078c34eb2832a5852b28958b7efeca8ffc69c09a7ca33d82e59f9e27ea25a7cf5e65bc52987952070ddac3929791a23f905fbd72419d1539", 0x200002, 0x0) fchdir(0xffffffffffffffff) r5 = creat(&(0x7f00000005c0)='./bus\x00', 0x0) r6 = open(&(0x7f0000000540)='./bus\x00', 0x141042, 0x0) sigaltstack(&(0x7f0000ffe000/0x1000)=nil, &(0x7f0000000480)) write$selinux_context(r6, &(0x7f0000000000)='system_u:object_r:crontab_exec_t:s0\x00', 0xfffffffffffffe84) r7 = creat(&(0x7f00000003c0)='./bus\x00', 0x2) r8 = openat$null(0xffffffffffffff9c, &(0x7f00000004c0)='/dev/null\x00', 0x2807fd, 0x0) write(r8, &(0x7f0000000380), 0x0) write$cgroup_type(r5, &(0x7f0000000200)='threaded\x00', 0xfffffeb3) select(0x40, &(0x7f0000000040), &(0x7f0000000080), &(0x7f00000001c0), &(0x7f0000000280)={0x77359400}) getsockopt$IP6T_SO_GET_ENTRIES(r0, 0x29, 0x41, &(0x7f0000000c80)=ANY=[@ANYBLOB="736563757c6974796d0000000000000000000000000000000000000000000000c40000004e8b4b1c7fa37c911d43b7dfc1540065e2cf063a33e71b903574450eb6fcc611bb94c232461f22877f4a6bfa2e09f7f448f8a2ef823ff78d796ab6ab52f030b8fea1243b4a37836d690100843a8998fea04a2bc474078acbb61c426c93824178b70a4bcff2d634050eca0d4f941bfec0542fd99b2bd8823b4175d0b0e455f170e292c18a967fdc58383f9af93bc9c8b8578b5ed8ba7d2084ab94919aea43e1a3acfd6d899d943862ca8d84436629d2159976a615f1279aaf23ce57319edb9be03d5b849777d956c09bcb8bc5eb1d793fe7b7d0c34d4d6cc6d28cb9f66b0a2f31eda0ce948210375abcde9320750390dc04b3af4959443184210eb68c4fe6dced7e44cd2b39f7d25dc53dab0fd596852191868741cecd379b6e87b1c1a8c0dc6b8004595fb61135ed10927d6df243071d53b4757c13f4ceb4480e4a7b9c730be6258db763d9e9e7baeccd140ed2311fd9c570db36e93131c27442990068d315088680ab638288fb05b1676a9ab2fe9aa99539a1cfbb1ae8b35cd18007ba5105ed92f8914bcc2397da080dd1da393ede4f195953f82d03b9a920391ee4f5bd7485d69e1d8bfc93521ea451a20dd056bd3c133aa93c9bef1e254ad7d19379b21be984d93cc7cfcbffc82708aebe5fe4c4aa7af905248de89163041c16cfdaf96ee5b65715c7bb840274ba8ddc979ae077aa20b5ba0e97ecd80abb2d3cdb2d2b6603b3a003871b7220d71909f230fa5e9a7307c10c954a2ff1c6bf5fe3e153c0ebeb4940c365ef1e9cc8588a51bfc9807e866ea6528a77c930c06eb50e3f14ca8abf929570c05ca0615211cdcce3d034946d4fadcc9df5702fca33cb322c27a54fee8cd7901df1066311b737259dfc65048bcff6eca8f566ed75b5d21b58a3c51907ba6d5ef9e04e24febdea1d345b16288065bf64cf9fa3a746185191dc7b2f4520fd2da2f60434395d6121d7063a6455be070f49e04c8c2fa0da58d878d80a1bf9cc58b6926e3c471cb1e79cb8b684e2ad91ac6c68f955a507ad55f514d131e0a095329227c9888f9fb19bfe6df77dff07ef08544a33e9f10d72e3ca6a0d70bf0d4b3e607a2238db2aa9c1011d0af4a39786e48004427b8b55fcd1f7ad63a9aa5338475975159310e0e40000000000000000000000000000000000000000000000000000"], &(0x7f00000002c0)=0x1) recvfrom$inet6(r2, &(0x7f0000001840)=""/31, 0xfffffe0e, 0x100, &(0x7f0000001880)={0xa, 0x0, 0xffff}, 0x1c) getsockopt$inet_mreqn(r7, 0x0, 0x23, &(0x7f0000000500)={@multicast1, @multicast1, 0x0}, &(0x7f0000000440)=0xc) setsockopt$inet6_IPV6_PKTINFO(r5, 0x29, 0x32, &(0x7f0000000580)={@remote, r9}, 0x14) r10 = accept4(r0, 0x0, &(0x7f0000000000)=0xfffffffffffffefa, 0x0) sendto$inet6(r10, &(0x7f00000000c0), 0xfffffffffffffe2b, 0x0, 0x0, 0x0) 20:30:16 executing program 4: personality(0x640000b) r0 = accept4(0xffffffffffffff9c, &(0x7f00000010c0)=@nfc, &(0x7f0000001140)=0x80, 0x800) r1 = syz_genetlink_get_family_id$fou(&(0x7f00000011c0)='fou\x00') sendmsg$FOU_CMD_GET(r0, &(0x7f00000012c0)={&(0x7f0000001180)={0x10, 0x0, 0x0, 0x3000001}, 0x2be, &(0x7f0000001280)={&(0x7f0000001540)=ANY=[@ANYBLOB='h\x00\x00\x00', @ANYRES16=r1, @ANYBLOB="040028bd7000ffdbdf250300000004000500080004000300000008000200020000000800020002000000080001004e2400000800020002000000080003003b000000"], 0x48}, 0x1, 0x0, 0x0, 0x14}, 0x2004083c) mprotect(&(0x7f0000a43000/0x3000)=nil, 0x3000, 0x1) r2 = open(&(0x7f0000000000)='./file0\x00', 0x0, 0x0) r3 = openat$zero(0xffffffffffffff9c, &(0x7f0000001300)='/dev/zero\x00', 0x43, 0x0) mmap$perf(&(0x7f0000a44000/0x4000)=nil, 0x4000, 0x1000002, 0x80010, r2, 0x0) setsockopt$netlink_NETLINK_LISTEN_ALL_NSID(r3, 0x10e, 0x8, &(0x7f0000001340)=0x3, 0x4) ioctl$EVIOCGBITSW(r2, 0x80404525, &(0x7f00000000c0)=""/4096) setsockopt$inet6_MRT6_DEL_MFC(r2, 0x29, 0xcd, &(0x7f0000000040)={{0xa, 0x4e20, 0x7fffffff, @empty, 0x40}, {0xa, 0x4e20, 0x7, @empty, 0x401}, 0xffffffff, [0xa02, 0x1, 0x3, 0x6, 0x800, 0x200, 0x2, 0x2]}, 0x5c) getsockopt$inet_pktinfo(r2, 0x0, 0x8, &(0x7f00000013c0)={0x0, @rand_addr, @multicast2}, &(0x7f0000001400)=0xc) sendmsg$nl_route_sched(r2, &(0x7f0000001500)={&(0x7f0000001380)={0x10, 0x0, 0x0, 0x400820}, 0xc, &(0x7f00000014c0)={&(0x7f0000001440)=@newtclass={0x58, 0x28, 0x4, 0x70bd2a, 0x25dfdbfc, {0x0, r4, {0x9, 0xffe5}, {0xe}, {0xe, 0x7}}, [@TCA_RATE={0x8, 0x5, {0x400, 0x7}}, @tclass_kind_options=@c_drr={{0x8, 0x1, 'drr\x00'}, {0xc, 0x2, @TCA_DRR_QUANTUM={0x8, 0x1, 0x1ff}}}, @tclass_kind_options=@c_dsmark={{0xc, 0x1, 'dsmark\x00'}, {0xc, 0x2, @TCA_DSMARK_MASK={0x8, 0x4, 0x4}}}]}, 0x58}}, 0x4c040) [ 370.752294] binder: 16262:16274 BC_INCREFS_DONE u0000000000000000 no match [ 370.791571] binder: 16262:16274 Release 1 refcount change on invalid ref 1 ret -22 20:30:16 executing program 4: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00009e3ff6)='/dev/ptmx\x00', 0x0, 0x0) fcntl$getownex(r0, 0x10, &(0x7f0000000080)) fcntl$getownex(r0, 0x10, &(0x7f0000000040)={0x0, 0x0}) r2 = syz_open_procfs(r1, &(0x7f0000000100)='pagemap\x00') pread64(r2, &(0x7f0000e3e000)=""/8, 0xffd8, 0x103f00) 20:30:16 executing program 4: io_setup(0x81, &(0x7f0000000040)) io_setup(0x7, &(0x7f00000000c0)) io_setup(0xcb3, &(0x7f0000000140)) r0 = openat$selinux_checkreqprot(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/checkreqprot\x00', 0x400, 0x0) setsockopt$IP_VS_SO_SET_DELDEST(r0, 0x0, 0x488, &(0x7f0000000240)={{0xbf, @empty, 0x4e20, 0x2, 'nq\x00', 0x30, 0x5, 0x1}, {@dev={0xac, 0x14, 0x14, 0x14}, 0x4e22, 0x4, 0x0, 0x9, 0x8}}, 0x44) io_setup(0xe2c, &(0x7f0000000180)) io_setup(0x1, &(0x7f0000000200)) 20:30:16 executing program 4: socketpair$unix(0x1, 0x20002000000001, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) clone(0x3102001ffe, 0x0, 0xfffffffffffffffe, &(0x7f0000000200), 0xffffffffffffffff) r1 = gettid() wait4(0x0, &(0x7f00000003c0), 0x80000000, &(0x7f0000000340)) ptrace$setopts(0x4206, r1, 0x0, 0x0) tkill(r1, 0x1b) ptrace$cont(0x18, r1, 0x0, 0x0) ioctl$sock_inet6_SIOCADDRT(0xffffffffffffffff, 0x890b, &(0x7f00000000c0)={@mcast2, @mcast1, @mcast2, 0x1, 0x0, 0x0, 0xfa}) ptrace$setregs(0xd, r1, 0x0, &(0x7f0000000080)) ptrace$cont(0x21, r1, 0x0, 0x0) r2 = syz_open_dev$mice(&(0x7f0000000000)='/dev/input/mice\x00', 0x0, 0x20000) ioctl$EVIOCSFF(r2, 0x40304580, &(0x7f0000000080)={0x57, 0xffffffffffff8000, 0x7, {0x0, 0x2}, {0xd3, 0x80000001}, @rumble={0x3ff, 0x2}}) [ 371.477059] binder: release 16262:16274 transaction 296 out, still active [ 371.494471] binder: undelivered TRANSACTION_COMPLETE [ 371.515817] binder: send failed reply for transaction 296, target dead 20:30:17 executing program 2: r0 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000040)='/dev/uinput\x00', 0x0, 0x0) clone(0x10000, 0x0, 0xfffffffffffffffe, &(0x7f0000000100), 0xffffffffffffffff) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f00000000c0)={0x0}, &(0x7f0000000140)=0xc) sched_setscheduler(r1, 0x3, &(0x7f0000000180)=0xff) socket$inet6_tcp(0xa, 0x1, 0x0) r2 = getpid() sched_setscheduler(r2, 0x5, &(0x7f0000000000)) ioctl$UI_END_FF_ERASE(r0, 0x4004556a, &(0x7f0000000080)) 20:30:17 executing program 4: unshare(0x400) r0 = signalfd(0xffffffffffffffff, &(0x7f0000000180), 0x8) r1 = signalfd4(r0, &(0x7f0000000100), 0x8, 0x0) r2 = openat$selinux_mls(0xffffffffffffff9c, &(0x7f0000000040)='/selinux/mls\x00', 0x0, 0x0) getsockopt$IP6T_SO_GET_REVISION_MATCH(r2, 0x29, 0x44, &(0x7f0000000080)={'ah\x00'}, &(0x7f00000000c0)=0x1e) signalfd4(r1, &(0x7f0000000000)={0x7fffffff}, 0x8, 0x80800) fcntl$addseals(r1, 0x409, 0x8) 20:30:17 executing program 5: r0 = accept4(0xffffffffffffff9c, 0x0, &(0x7f0000000000), 0x80800) ioctl$FS_IOC_GETVERSION(r0, 0x80087601, &(0x7f0000000740)) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$nl_netfilter(r1, &(0x7f0000000080)={&(0x7f0000000100), 0xc, &(0x7f00000000c0)={&(0x7f0000000340)=ANY=[@ANYBLOB="140000000301ffff808f00003d88c83f00b516ba"], 0x14}}, 0x0) ioctl$FS_IOC_GETFSLABEL(r1, 0x81009431, &(0x7f0000000800)) recvmmsg(r1, &(0x7f00000013c0), 0x1ad, 0x0, &(0x7f0000000c40)={0x77359400}) r2 = open(&(0x7f00000007c0)='./file0\x00', 0x128ffd, 0x8) write$P9_RLERROR(r2, &(0x7f0000000040)={0xf, 0x7, 0x2, {0x6, 'vmnet1'}}, 0xf) getpeername$packet(r2, &(0x7f0000000500)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @random}, &(0x7f0000000540)=0x14) sendmsg$nl_route_sched(r2, &(0x7f0000000700)={&(0x7f00000004c0)={0x10, 0x0, 0x0, 0x1}, 0xc, &(0x7f00000006c0)={&(0x7f0000000580)=@deltclass={0x12c, 0x29, 0x910, 0x70bd29, 0x25dfdbfc, {0x0, r3, {0xfff3, 0xfff2}, {0x4}, {0x2, 0x6}}, [@TCA_RATE={0x8, 0x5, {0x15}}, @tclass_kind_options=@c_cbq={{0x8, 0x1, 'cbq\x00'}, {0x54, 0x2, [@TCA_CBQ_LSSOPT={0x18, 0x1, {0x1f, 0x1, 0x20, 0xe0, 0x6b, 0xda92, 0xff, 0x1}}, @TCA_CBQ_FOPT={0x10, 0x3, {{0xffff, 0x7}, 0x2}}, @TCA_CBQ_WRROPT={0x10, 0x2, {0xfffffffffffffbff, 0x2, 0x6, 0x7fff, 0xce7, 0x8000}}, @TCA_CBQ_LSSOPT={0x18, 0x1, {0x1e, 0x2, 0x19, 0x1ff, 0x8, 0x100000000, 0xfffffffffffffffb, 0x1}}]}}, @tclass_kind_options=@c_qfq={{0x8, 0x1, 'qfq\x00'}, {0x2c, 0x2, [@TCA_QFQ_WEIGHT={0x8, 0x1, 0x6}, @TCA_QFQ_LMAX={0x8, 0x2, 0x7}, @TCA_QFQ_WEIGHT={0x8, 0x1, 0x3cc}, @TCA_QFQ_LMAX={0x8, 0x2, 0x20}, @TCA_QFQ_LMAX={0x8, 0x2, 0x4a1d17cd}]}}, @tclass_kind_options=@c_drr={{0x8, 0x1, 'drr\x00'}, {0xc, 0x2, @TCA_DRR_QUANTUM={0x8, 0x1, 0x7}}}, @TCA_RATE={0x8, 0x5, {0x800, 0x9}}, @TCA_RATE={0x8, 0x5, {0xfffffffffffffff7, 0x1}}, @tclass_kind_options=@c_atm={{0x8, 0x1, 'atm\x00'}, {0x44, 0x2, [@TCA_ATM_EXCESS={0x8, 0x4, {0xf, 0x5}}, @TCA_ATM_EXCESS={0x8, 0x4, {0xffff, 0xb}}, @TCA_ATM_FD={0x8, 0x1, r1}, @TCA_ATM_HDR={0x28, 0x3, "d05d5082063969ae0d012158416abcab46f8d4c15afc5ae9cab08fe386befbe1bdf4"}]}}]}, 0x12c}, 0x1, 0x0, 0x0, 0x1}, 0x80) sendmsg(r1, &(0x7f0000000480)={&(0x7f0000000140)=@in6={0xa, 0x4e22, 0xfffffffffffffff8, @ipv4, 0x7}, 0x80, &(0x7f0000000380)=[{&(0x7f00000001c0)="0380e6a012daeadc8a309ab7b3d1ec220ecdad578a0083b43b7180ef453fff55cc159e048e4ef38525b3937322ce601e042755ce699ca17a2beaa4f45e4a3f706a0f52bdd34512a28630a2239d0f30ddded322613a31c4f1e4d9bf6a3f", 0x5d}, {&(0x7f0000000240)="23d45ef1e8932b0276707ac55452d679f89f7014f4687f25f7747a7bd4360ff1186d4388ed6f883630475f530ae76b1d5c97246c8d5843bf3f056854a2bb53", 0x3f}, {&(0x7f0000000280)="d7030f794bbe6823275b98cab7336427839e7f139ee109d9aabe7702cd1c4d6ff1b38f8d75449445d60c7abcf569502d502833fd63bffb9fff581ab41721a36f1be1d60a48b996d4852186a568f9d0d728bab7728c0ac40b18eca3e672541398043a38a86f", 0x65}, {&(0x7f0000000300)="41c21f2a2e2e425563c0b07716c03275d40727a03244808c481f7bb5e96d98e0b6a2d88da2290509445ba9ebde53a697e1fc", 0x32}], 0x4, &(0x7f00000003c0)=ANY=[@ANYBLOB="48000000000000001f010000d20a0000ffdf6e72f012e514b8eebb88a89c15f7b92d6bfebcb0545fafee5f0f1958dd24d2eab9f86bb1321ce4e9c25bcea7e6d63d36e801dd2500006000000000000000ff010000010000008cb6a24b2c181135589bc31b31350ba383b0657e0754f50f3bf319c30f1746fdff3ceb5664a4d20b750ec78d88de3ab6f1d91252deb316f2a47c3805ac935204947b7286a6055383b674000000000000"], 0xa8}, 0x20000805) 20:30:17 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$FS_IOC_SETVERSION(r0, 0x40087602, &(0x7f00000001c0)) r1 = syz_open_dev$binder(&(0x7f0000000640)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000000)=[@enter_looper], 0x1, 0x0, &(0x7f0000000040)='+'}) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x0, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0x0, 0x0, &(0x7f0000000780)}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000380)={0x8, 0x0, &(0x7f0000000500)=[@release={0x40046306, 0x1}], 0x0, 0x0, &(0x7f0000000400)}) 20:30:17 executing program 3: r0 = socket$inet(0x2, 0x4000000000000001, 0x0) setsockopt$inet_tcp_TCP_CONGESTION(r0, 0x6, 0xd, &(0x7f0000000680)='reno\x00', 0x60c5) sendto$inet(r0, &(0x7f0000a88f88), 0xfffffffffffffe6e, 0x20000000, &(0x7f0000e68000)={0x2, 0x0, @local}, 0x10) write$binfmt_script(r0, &(0x7f0000000000)={'#! ', './file0', [{0x20, 'reno\x00'}, {0x20, 'reno\x00'}], 0xa, "02f373d54b1c405f08ad4475cc8c54b75c9c48d0d261e8cdd0d70ddadd21c8bfb1a1f841c66bb493354f617842bb2841cc06d323527533641d11db77ec8d679b91f7fbb2350cd8917dd3b8ec5cf4d9bd7a805f9d56386700c14cad2b2b9cd1697ed858a68a7fe3ce479632c7f4a15e0d01855e246eeebb3d501f314b4201986d96bd1828f647082f0759f5cc0bd1f3"}, 0xa6) 20:30:17 executing program 4: clone(0x2102001ff8, 0x0, 0xfffffffffffffffe, &(0x7f0000000140), 0xffffffffffffffff) r0 = getpid() r1 = openat$ppp(0xffffffffffffff9c, &(0x7f00000014c0)='/dev/ppp\x00', 0x30000, 0x0) ioctl$UI_SET_MSCBIT(r1, 0x40045568, 0x15) r2 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000180)='/dev/vga_arbiter\x00', 0x402040, 0x0) getsockopt$inet6_IPV6_IPSEC_POLICY(0xffffffffffffff9c, 0x29, 0x22, &(0x7f0000001240)={{{@in6=@local, @in6=@mcast2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in=@loopback}, 0x0, @in=@multicast2}}, &(0x7f00000001c0)=0xe8) stat(&(0x7f0000001340)='./file0\x00', &(0x7f0000001380)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) write$P9_RGETATTR(r2, &(0x7f0000001400)={0xa0, 0x19, 0x1, {0x100, {0x0, 0x4, 0x6}, 0x14, r3, r4, 0x8, 0x9, 0x8, 0x3, 0x3, 0x3f, 0xff, 0x5, 0x7, 0x0, 0x4, 0x7fffffff, 0xfffffffffffffff8, 0x3, 0x3f}}, 0xa0) sysinfo(&(0x7f0000000000)=""/9) sched_setscheduler(r0, 0x5, &(0x7f0000000200)) clone(0x2fdc98bf4c05bf2b, &(0x7f0000000100), &(0x7f0000000100), &(0x7f0000000040), &(0x7f0000000240)) r5 = dup2(0xffffffffffffffff, 0xffffffffffffff9c) ioctl$BLKSECDISCARD(r5, 0x127d, &(0x7f00000000c0)=0x9) pipe(&(0x7f0000000080)={0xffffffffffffffff}) ioctl$EVIOCGKEY(r6, 0x80404518, &(0x7f0000000240)=""/4096) [ 371.585709] binder: 16306:16309 ioctl 40087602 200001c0 returned -22 20:30:17 executing program 4: syz_open_dev$evdev(&(0x7f0000000040)='/dev/input/event#\x00', 0x8, 0x0) ioctl$EVIOCGMASK(0xffffffffffffffff, 0x80104592, &(0x7f0000000200)={0x0, 0x4e, &(0x7f00000000c0)="84a070a7924ae3ab2d53b51461e50f1bf266da3a29c7d13d1cc423b1f29899c34e85fd19d01dca823411ad9e5896711580ceb14ee351276f9a596c24fc5840ba216754d4e8b4038ab0ee23749ece"}) r0 = syz_open_dev$evdev(&(0x7f0000000000)='/dev/input/event#\x00', 0x0, 0x0) ioctl$EVIOCGMTSLOTS(r0, 0x80104592, &(0x7f0000000100)) [ 371.647855] binder: 16306:16321 BC_INCREFS_DONE u0000000000000000 no match [ 371.670747] binder: 16306:16321 Release 1 refcount change on invalid ref 1 ret -22 20:30:17 executing program 0: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r0, &(0x7f0000000100)={0xa, 0x4e22, 0x0, @empty, 0x4}, 0x1c) writev(0xffffffffffffffff, &(0x7f0000002980), 0x0) r1 = socket$inet6(0x10, 0x3, 0x0) sendmsg(r1, &(0x7f0000002fc8)={&(0x7f0000000000)=@nl, 0x80, &(0x7f0000002000)=[{&(0x7f0000000340)="5500000018007f5300fe01b2a4a280930a06000000a84308910000003900090008000c00010000001900150006000000000000dc1338d54400009b84136ef75afb83de448daa7227c43ab8220000060cec4fab6513", 0x55}], 0x1, &(0x7f0000000400), 0x0, 0x4}, 0x0) ioctl$EXT4_IOC_GROUP_EXTEND(0xffffffffffffffff, 0x40046607, &(0x7f0000000400)) listen(r0, 0x7c) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) mkdirat$cgroup(0xffffffffffffffff, &(0x7f0000000140)='syz1\x00', 0x1ff) r3 = memfd_create(&(0x7f0000000600)="0004003100", 0x4) ioctl$sock_SIOCGPGRP(r3, 0x8904, &(0x7f00000000c0)=0x0) syz_open_procfs(r4, &(0x7f0000000300)='net/ip_tables_names\x00') write$P9_RFSYNC(r3, &(0x7f0000000240)={0x7, 0x33, 0x1}, 0xfffffffffffffe2d) sendto$inet6(r2, &(0x7f0000000380), 0x0, 0x20000004, &(0x7f000031e000)={0xa, 0x4e22, 0x0, @ipv4}, 0x1c) openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000b80)="2e2f6367726f75702f73797a3100b8458a1392623c2acc07743172c163cfc71523709c3289acba6eaf2919f32ebaa4cbe89ed30167d7d56e8e65c0edbb300c9e287f10f513e776522729d5c85c09fed3f33ea055b94d27bb72a2bb9fd56015f25cf4f9ced65ed81253cfba08e9a329935ac0c64d10a5e701cc58fe4af8cb5b679468e8ad39e103e2d5b7d9078c34eb2832a5852b28958b7efeca8ffc69c09a7ca33d82e59f9e27ea25a7cf5e65bc52987952070ddac3929791a23f905fbd72419d1539", 0x200002, 0x0) fchdir(0xffffffffffffffff) r5 = creat(&(0x7f00000005c0)='./bus\x00', 0x0) r6 = open(&(0x7f0000000540)='./bus\x00', 0x141042, 0x0) sigaltstack(&(0x7f0000ffe000/0x1000)=nil, &(0x7f0000000480)) write$selinux_context(r6, &(0x7f0000000000)='system_u:object_r:crontab_exec_t:s0\x00', 0xfffffffffffffe84) r7 = creat(&(0x7f00000003c0)='./bus\x00', 0x2) r8 = openat$null(0xffffffffffffff9c, &(0x7f00000004c0)='/dev/null\x00', 0x2807fd, 0x0) write(r8, &(0x7f0000000380), 0x0) write$cgroup_type(r5, &(0x7f0000000200)='threaded\x00', 0xfffffeb3) select(0x40, &(0x7f0000000040), &(0x7f0000000080)={0x0, 0x0, 0x0, 0xffffffffffffffff}, &(0x7f00000001c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2}, &(0x7f0000000280)={0x77359400}) getsockopt$IP6T_SO_GET_ENTRIES(r0, 0x29, 0x41, &(0x7f0000000c80)=ANY=[@ANYBLOB="73656375726974796d0000000000000000000000000000000000000000000000c40000004e8b4b1c7fa37c911d43b7dfc1540065e2cf063a33e71b903574020eb6fcc611bb94c232461f22877f4a6bfa2e09f7f448f8a2ef823ff78d796ab6ab52f030b8fea1243b4a37836d690100843a8998fea04a2bc474078acbb61c426c93824178b70a4bcff2d634050eca0d4f941bfec0542fd99b2bd8823b4175d0b0e455f170e292c18a967fdc58383f9af93bc9c8b8578b5ed8ba7d2084ab94919aea43e1a3acfd6d899d943862ca8d84436629d2159976a615f1279aaf23ce57319edb9be03d5b849777d956c09bcb8bc5eb1d793fe7b7d0c34d4d6cc6d28cb9f66b0a2f31eda0ce948210375abcde9320750390dc04b3af4959443184210eb68c4fe6dced7e44cd2b39f7d25dc53dab0fd596852191868741cecd379b6e87b1c1a8c0dc6b8004595fb61135ed10927d6df243071d53b4757c13f4ceb4480e4a7b9c730be6258db763d9e9e7baeccd140ed2311fd9c570db36e93131c27442990068d315088680ab638288fb05b1676a9ab2fe9aa99539a1cfbb1ae8b35cd18007ba5105ed92f8914bcc2397da080dd1da393ede4f195953f82d03b9a920391ee4f5bd7485d69e1d8bfc93521ea451a20dd056bd3c133aa93c9bef1e254ad7d19379b21be984d93cc7cfcbffc82708aebe5fe4c4aa7af905248de89163041c16cfdaf96ee5b65715c7bb840274ba8ddc979ae077aa20b5ba0e97ecd80abb2d3cdb2d2b6603b3a0039cd455982be80afd30fa5e9a7307c10c954a2ff1c6bf5fe3e153c0ebeb4940c365ef1e9cc8588a51bfc9807e866ea6528a77c930c06eb50e3f14ca8abf929570c05ca0615211cdcce3d034946d4fadcc9df5702fca33cb322c27a54fee8cd7901df1066311b737259dfc65048bcff6eca8f566ed75b5d21b58a3c51907ba6d5ef9e04e24febdea1d345b16288065bf64cf9fa3a746185191dc7b2f4520fd2da2f60434395d6121d7063a6455be070f49e04c8c2fa0da58d878d80a1bf9cc58b6926e3c471cb1e79cb85f6ce2ad91ac6c68f955a507cc92f514d131e0a095329227c9888f9fb19bfe6df77dff07ef08544a33e9f10d72e3ca6a0d70bf0d4b3e607a2238db2aa9c1011d0af4a39786e48004427b8b55fcd1f7ad63a9aa5338475975159310e0e40000000000000000000000000000000000000000000000000000"], &(0x7f00000002c0)=0x1) recvfrom$inet6(r2, &(0x7f0000001840)=""/31, 0xfffffe0e, 0x100, &(0x7f0000001880)={0xa, 0x0, 0xffff}, 0x1c) getsockopt$inet_mreqn(r7, 0x0, 0x23, &(0x7f0000000500)={@multicast1, @multicast1, 0x0}, &(0x7f0000000440)=0xc) setsockopt$inet6_IPV6_PKTINFO(r5, 0x29, 0x32, &(0x7f0000000580)={@remote, r9}, 0x14) accept4(r0, 0x0, &(0x7f0000000000)=0xfffffffffffffefa, 0x0) sendto$inet6(r7, &(0x7f0000000640)="3271160272121fc8b4b63e6f0034d40348bbff394f96455eba38e554c166b880872209da62042e3a06d1f722c1fa2fa8d81926a8cf6275cb5a3cde99351c78686d140d8ef0557c07c83f329785b59ec79450dcffd8520d83f4e1a9ae904e40edef5077df86080ba7dfca965938e19481e66dac891fd8b6e7429ab27baf552b9e646c9527ac087c1a968d5e9b3bfd992531c016e77eeb776a7629df6f9ac13ef536ed3732d867", 0xa6, 0x0, 0x0, 0x0) 20:30:17 executing program 2: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = creat(&(0x7f0000000040)='./file0\x00', 0x88) getsockopt$inet6_IPV6_IPSEC_POLICY(0xffffffffffffffff, 0x29, 0x22, &(0x7f00000000c0)={{{@in6=@mcast1, @in=@remote, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in=@multicast2}, 0x0, @in6=@mcast1}}, &(0x7f00000001c0)=0xe8) connect$packet(r1, &(0x7f0000000200)={0x11, 0x7, r2, 0x1, 0x2}, 0x14) r3 = accept$packet(r1, &(0x7f0000000240)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @remote}, &(0x7f0000000280)=0x14) connect$packet(r1, &(0x7f00000002c0)={0x11, 0x16, r4, 0x1, 0x6}, 0x14) ftruncate(r3, 0xfffffffffffffffd) setsockopt$inet6_MRT6_ADD_MFC_PROXY(r1, 0x29, 0xd2, &(0x7f0000000300)={{0xa, 0x4e24, 0x873, @ipv4={[], [], @broadcast}, 0x7f}, {0xa, 0x4e21, 0x6, @local}, 0x202000, [0x2, 0x47b, 0xb2d, 0x8, 0x40, 0x1, 0x0, 0x2]}, 0x5c) ioctl$FS_IOC_GETFSLABEL(r3, 0x81009431, &(0x7f0000000380)) getsockopt$IP6T_SO_GET_ENTRIES(r1, 0x29, 0x41, &(0x7f0000000480)={'filter\x00', 0x95, "318142dcd8c70e25827d6e1ad95d6968db76d96f994c0c344f65521a7d4c14f018cef545173687dff3133aba28c07ea0691d89535db12063cde25ec47dc526d564bffdd4372080e9392b614dd9d1b56c5728639a066d3e7ee7387100d85f28fd7ef05e749628a27e9dd3e00ea74c71448b2fd1ec12634337434b92dc4951937448e466c1cd083dd7aa7b19fddb5ee3dfac25fca4be"}, &(0x7f0000000540)=0xb9) utime(&(0x7f0000000580)='./file0\x00', &(0x7f00000005c0)) getsockopt$packet_int(r0, 0x107, 0xc, &(0x7f0000000600), &(0x7f0000000640)=0x4) getsockname$packet(r3, &(0x7f0000000680)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f00000006c0)=0x14) write$UHID_CREATE(r1, &(0x7f0000000740)={0x0, 'syz0\x00', 'syz0\x00', 'syz1\x00', &(0x7f0000000700)=""/61, 0x3d, 0x401, 0x2, 0x5, 0x10000, 0x3}, 0x120) setxattr$security_evm(&(0x7f0000000880)='./file0\x00', &(0x7f00000008c0)='security.evm\x00', &(0x7f0000000900)=@md5={0x1, "0a46d55a74563b5fe01f5916b5ede9db"}, 0x11, 0x2) epoll_ctl$EPOLL_CTL_MOD(r1, 0x3, r1, &(0x7f0000000940)={0x11}) write$binfmt_misc(r1, &(0x7f0000000980)={'syz1', "2b5fdea8bd1bb8f20ca0bae2b2fef24f0935cf8b822d98346b683690eccd5a4f3a2f775a78c683c1c3d43243043dbd5889d1c9a5f68a98bb2f7ab61e0deef2c9663957136e0e2d122adfd701668c01480d35b5bddb5fbe02adbf75d10a74312847d86345f1740e52c4642cb40298df43ebc2de623f283e6440aea17ea488c3ca2b67a28974d6ed9062def46227cb8a163df6e87e36fc49c88edcc49891271806fc693f8aaaecc6db3386ff40b5474e97df00f94f8a5a8822ffec0adf88b080a484242cf2687c793dfe999e05e369ff9262ddf575449661738352f2b5971deafc370f110b7aff83ca9613defe4a699a155c7270ba2e8af225303f6e48952c2faf1d7a3e85397ac637fb882517448fe4ef76c9434f263f9459b20a3810f6a1be2f8d9c77b08fe904b525fb4b2b2b6c01a44f8a2318f90c1249944215c875857f993051dfee2774f8b2958ce31efa83c86163b2458c62d360479076f3c81a3481466044bc94b0ee99792a6d3e163b27fd8486f8f9c613d4d2d2cf8a8b0118c295b37b0b43c89c6b898b3e12640ed5cdeb5ed199a52171ad47ed68c206f1e0172afead6599661c0add586fda4e0923c1f9041960ad77cdf57fa325841973899aae1064e83ed1f9057386fe5dcfe98cadad2462a7ef4bb633710ad01aee0bc3ec0a9a6d67a2343720681dddd34378ee344a9b47c7c229f6b01fedbbda7c195fce4efc4e2d9ea205ac630e62f2e0fcaa49ee3165746a98ee3c89e4d03c9f3c68db15c9bf1c5b801662ad80fe5e5b82a772ab0504e711ceecefca230f3bb03914073833e365dd17a9e3a506cd0af47cb91695c9e108549f61f653b4dcf06f9ba4cdb9f4c1415b02a71ac56de84b59a6c60d848b7b30cf3ec2482305e161fe2be4957638b4fe53718d979695a702cd8f3fd51a1f8544b139523527b905f43071fcc896529728ac132f9ebf71cc3fc36d7ee1603733622374c6db0c8a18e5ac587e55e941dd7ca69eebdc48440851381c0c68dd99d3424b7ef9376ab335a0dc74724f78d88b05316422a3c3d4e8c47c15d74d03489055e6d93180e9f6faa26cd5a0073b470586526c16bd8b5274ba1a3261ae652efd487c28fd8ece62fa6dd268ad2aed73559267d2146879877d6e4282a5686d78a6b591a01777d631d2f113f2a0916fe21516f38bce70b96037ed3afba2af1c95a5531f0ca19b08d5453b5289a8e9c6b244208d8e1a272d4e3c0208b32a89bd30bd049182423c747778215c5047853c1127f3e15f28c6fd48002d8c2997e539c6c2d7164c7ea0e02ad8bcca4315be6f4a706432d8ad4be8bc45e9132bf5c52af905ddb50ee690e64fe8c007dea2ff28c17beff6d363605437f856fce7807bd9703ad643ba73beaf18ce935350dea11c58a5160be7e983c2a9c599aeb2425ead4a723026a2116a912b96efb65c2d014cb1ae2abc02e30fd958d148ab90969a0c54a7b3fe20619660b0d78e2ea3cc10bfca173b19752d7014cdc0ca575e165a4f501a45de1d0586724aa16c7a066fb002dadf49e9c9c17f95b304166a0227ea2db6aad740ea3bee5e753ab30799caf1ab6bc243f625b804a96bc82538fdd3971b2c27aeb87bcaa30cfd8bdc3e718f40537c4d1885a8e5efbc73d5d3a303c2f38b41f938c2ce4ef2ea0c84b166a131d0181d2ca0efc03023a6ae35cd388459aa885153c50494ce00ffc4adb584b8f8aeb9ec3b60df5d29abfece9a4266ceeb268ba3f24b2eb81c86653698f781e07cf7b48d6e8d48d0510954561a9b239226f8c1a19d56505d1c113cc89df60aab7ad8b044731e435640d0dc5e6b5a5d343e8d397f13d19f82def09af13e7da129e580dbe9d14e52e9fca9da690210aa3a0baaaa920d62b913ad9824496e9c3ec9ae8e33da554ca900c1c85a5b0e1d82525373f89330c5231b49aa76905571eb0b0a6232333cfc4356a8c740d22f54e669482f1fa8b33f6cf3b38767a4d89b8de528c10a70be8e81cce4442b896bce5fe4dafcb9fa31dfb89c1fbc208f64e9c5449531d6a158edc4903e085221fabeac08504d65be714cac905b39f9ece98856e16d205ccd71e0541fbcfc4f3cc7b669af42b6df76f0cce322999e2276f0f692ad532838b296d3aa567f19cf6563252019c5b6be776585dac67032332c12e5de385196433206d02ffda804ce82b2b1210070a5d2b621282d2ae72720c41e7339ff34664fb56f0aa402e2322892483a6422a5bff115bf1408c5a7abc1a8fc556188dc280350a9184aa3966f41eae31d4e80285cd8a50b7ceeba6a53f4f14bc57aaf54a024a6beecc8072a230347d8010182a516b7d9e63a1da5ed097818605ef8b37907fa37e4cdb59964c755276e30faa43f771125b69cac8653578ecdf6e6d4cf94dcd798441ba8791cb57025a6ceecec2ec2e7807898d8007e9d7d8dd5015877fafcb928026871649505a4c21122852979894d847c295c1fc2c8f9db190527f8f095332d8f7574c9115611f84994fa54a0df6932eb59a1f9486a265416cac751e9ded4ea1754450aea17e068f94b6938e2d9e796f70a64fefea8c97c37366a1aaf29910d17018557d5e5f6bb0785412426bf0941009ec3c0894769c189ca1ae1195a4c5fa307e55acefc01dc441fe787819dc9a0a6f97567b5d238dfe0eec8c959d8a14bc44fd32f8b46b1604ca8fab93d8d2037775d6fa6f7c41441c47a2be603800088283924194fc7727a280b98045d249a07999ee062328811c3c4adf9a832735266715f9c6e4fadb29deb783828428c70075e6736f2249245c69692d9f64f60f6237dbcef80c7bf6face1bb6ba1a71aa56d676e5b24ecfda97d5e9f07adea84fa0b13fdf64063ee5265a978ea01f4a98f640d4812948532e675e10fd88f857680c11fafe9e0019b8c2012c3d3179f4f9d4536c4e5a043e303caf0502dd7593fa759774b2920fa4ee59132a0e6acd08ea082dafa231ff5f85ce6b29933954c5e72a015abf442da59adcde6aae3e097d8d1b2e47dce568d022814c22358381ec4cfcf70d6f71e6c8355ea9002ee396f2c8ec374f279ba56ac0bd0d385a82e1f8c4290421c5f52d920575d7b299cd1a5f496bf9d31feccc410706ecf8993742c6074431fe44177d27373f4e0132e21040b185de2601a07c1449ffe6266288cc867332ff4276e611527da1ec798157f0d063add5e9a61dc8940d7d00bda6fe5a9a151893a1d08c0ec412418ad58434725fca9b0a7bf844997f2bb484b7d477edecc42d480b6c22f4af5588c44cdfc06516df7f959f8af687d7f2861226b3acd1459789fada8297ba6e8a615ed767aa661a6c32382d36aece8f329fe965a98d64203bc2ff84fc4357506f0a57aacedd474b6915ef9b7a53dad01adc497aefccdbf6cc2e8072987b86d6e6b22602b5c3a12055bc7dad4d4f5c635ff8c21fa1c9d63003aa6c4fa494fa04d67125514aacfee29ce432e05dde99a42e1e027960ab62bf25439c7828bcdc8c6edb48eb7101412f5001b3c954bf6490a5253e2a9dd88faa657ddadb590a64d73a4eca75d1f651ae99faa8c63cd66252a689e98f37e18000d8f631683b3b0a4fcbaffdba3decc0943a8ea271b7f3a49fe04e8c6a70176ba77621b10442ed4f74a8fa6c084a58a0b4fd3a03bb7a8e6c28fbbef1e1ec44b67489175b549787727ed2c0a1d8d0de1e7b9c6e00e09cc1578506604b5f424642b5bb2d7217913ceda3b59d276815c8d7fd268c9780be449685c7bd2b5523b734bf577b00de397a7d93921c0876ac59c1d5cb1f9adedcacb9c71395c728e03b57ab95ed21304f5cf43abc6322c07a7ed2b038314a0e8193e47fc331aab89aaf72e61cae3ee2248b842470fc88b0b76a28efca539b695d818d0f1dbafd7e6ef2ed9e2c571f133b3b77a9ef5e356d0e34cb48969cbcf2670e65359437871508c3ef25d79e1c7ecb5a7877d88e3c735c4240d96cd2c94154f78c1146b8a886f180a2d7d86c8ce699251aebcf2e5fcf5c90682d3d5457c2a4bf0199649f20ce8116ef23e7ec7c7aa18be0d9cae8387339dd152a225ef0f172502b7febd37e48d72b683384301fd16c9b9569c68145cf93b4961d50b5a97a6c2abc19683a450beff3a59c1a6e87f3a3a2e3fc0e8c0a0b1598de042eed1a9bd4b1526029b442bc237daf595fc5fa1d66870b4428726d2ec34645c3edde1a67ef1dec26caa5d8cc5dee9f1e8337b64641e8f4538a2aec6995d1eadbfbfc49a9460f5b9ef0ba77687d8350e51e5ac623e4e46873b133bdb3321013435a9a045c6297aed7a2b17de736d464def2f2dc518751134ba6b998d1c1f7a67c0a1a7e6a4d54fe9685eaf7ad2ebf01762cf94af1fe2183fafc8fa4199842a002e99c35d1a60dc5c0110d58fd97dc4acd9b082fb0cd19963be82f0502b4e2b5791e90b2b95113ee9753b4776064c9ddfe1053b73c3c8caff72fe98dac3597cf92c236a1c7c5112b85b852fbb5d6ff6c0c3f01b9fc57abaf5503d4428f5490b8a2c62e2a02820fdbefbb007de64fcc1d571b7a41b21347202520cb9d238a41f93bb750a686eebe0c01a463c1af65160bf0f15fe5bb94dcc191b3f21dfe8525ebb5ab1ab8648ae86ebc10b5701020da813256fcda7323b392edbb093113c23f691c04a929a2d0aeab8c09886c9dfe99cbb9308bda43b956c26b4ac571f8561994ad004d016df57bd0e67d5172237134ddc32a48fca2e5c1897f930e9bbf07579ecbc9b862a8838b3091b5fa0e031c85e0dc69f8af610d1db7b52e466a67225324e15a580a86bf324f2a736f441dc6a4089d073b1f7e03c98bb7159037c3b2b5a33ac0e9950c23c8ade6afd8708f3cd87fa80f4f2d4aeceffcfaa4181248564f2c995096d46eab594513e434a2d3a643b4a09f42a8cb8e62d996c7f373b7b354e63fa61c7bb4024ec71bf89f14644ef2757d7bc73213228417d292ea3355640b235cb69aca41d640e629cc08fdfde23ab1f614331e5c176ee46d481ab085a8fedeb02f7188af247613bc91fdb554916198b8d1fec68029dbe2c3fe66b73fe4446da9875ae3b951958d9d012391dfd6f52817e4c6835346e9df6b1169bb08056c00c9bf63e242a241508a2a1a671942584cbd269fec478cfbfef1d573bd40233fd93b666e551208bbe55a66ac2d913b973217e436b991e7d27df5d40c3106057d2012a775a55cd3026011920d3d6672b42bd0341bdb933db7c3aa7643f218c1dceb59343510c348a2b00df80d05ba14910cb7a17047918841952d42f93757b65bccd33141fc09ef7cfa2d5b3f63e881915306835d48a840a235e705864b4a0c1e8537a42d9ef7244e09d0358ea01a54c007625e708721fd85a5f9fe1e98529eaaed88243e35906be35eaf6dc600f051c655fa3a6123abf6549b44883f114fa68aad50198875a54e35ed9737b0062c55f0455f096d0688861327419f1f1226f5c2aad3329d2b0e4bb5a5e0108179dbd296ae57c699d715f6452f1b835b2e3958ab7441565032bcf63877f87a4211abd9eee919c740a20e68db17202fe89483bad0344254e594af1dc8b8fb47463fb23ae3304a5ba4288b2e5c7203203dcc34be118fe58896c46f1e6e59799474570eaea2b94551d3a62dd10067de546264381d4982571fac0706c3c77c088c87070e0bcee8c40e40b00fd37b240fcd8303169e34dc13e028697c70ee98d5cf760578127bb68486d1688be72148bde857c6f659716967f932df328b32998a2e90e23e96534b7cdacd09b403358a1692e18db45537f5fc16b61535facd7083d39c9360322c0819274b9"}, 0x1004) r5 = openat(r1, &(0x7f00000019c0)='./file0\x00', 0x600200, 0x40) write$FUSE_IOCTL(r5, &(0x7f0000001a00)={0x20, 0xfffffffffffffffe, 0x2, {0xbcf6, 0x0, 0x1, 0x1f}}, 0x20) ioctl$sock_SIOCBRADDBR(r5, 0x89a0, &(0x7f0000001a40)='bridge0\x00') write$FUSE_BMAP(r1, &(0x7f0000001a80)={0x18, 0x0, 0x5, {0x8}}, 0x18) getsockopt$sock_timeval(r1, 0x1, 0x14, &(0x7f0000001ac0), &(0x7f0000001b00)=0x10) ioctl$sock_FIOGETOWN(r3, 0x8903, &(0x7f0000001b40)=0x0) ptrace$setopts(0x4206, r6, 0x3, 0x40) getsockopt$IP_VS_SO_GET_DESTS(r0, 0x0, 0x484, &(0x7f0000001b80)=""/168, &(0x7f0000001c40)=0xa8) ioperm(0x4, 0x3, 0x100000000) ioctl$KDGETLED(r5, 0x4b31, &(0x7f0000001c80)) ioctl$PERF_EVENT_IOC_PERIOD(r5, 0x40082404, &(0x7f0000001cc0)=0x7f) epoll_ctl$EPOLL_CTL_ADD(r5, 0x1, r5, &(0x7f0000001d00)={0x40000000}) r7 = request_key(&(0x7f0000001d40)='ceph\x00', &(0x7f0000001d80)={'syz', 0x0}, &(0x7f0000001dc0)='\x00', 0xfffffffffffffffd) keyctl$clear(0x7, r7) 20:30:17 executing program 4: r0 = perf_event_open$cgroup(&(0x7f00000005c0)={0x3, 0x70, 0x1ff, 0x7fff, 0xffffffffffffff90, 0xf6, 0x0, 0x6, 0xab5963fa1c8ed219, 0x4, 0xdaa, 0x8001, 0x1, 0x94, 0x7f8, 0x6, 0x2, 0x101, 0xb26, 0x7, 0x1, 0x5, 0x4, 0x4, 0x2, 0x401, 0x8, 0x3, 0x1, 0x4040, 0x7, 0xffffffffffffffc0, 0xffffffff, 0x0, 0x1, 0x4, 0x8, 0x9, 0x0, 0xfffffffffffffc01, 0x5, @perf_config_ext={0x40, 0x1ff}, 0x8, 0x4, 0x7ff, 0x4, 0x0, 0x6, 0x7f}, 0xffffffffffffff9c, 0xe, 0xffffffffffffff9c, 0x1) r1 = fcntl$dupfd(0xffffffffffffff9c, 0x406, r0) r2 = openat$selinux_avc_cache_threshold(0xffffffffffffff9c, &(0x7f0000000400)='/selinux/avc/cache_threshold\x00', 0x2, 0x0) ioctl$sock_SIOCGPGRP(0xffffffffffffffff, 0x8904, &(0x7f0000000480)=0x0) r4 = gettid() lstat(&(0x7f0000004180)='./file0\x00', &(0x7f00000041c0)={0x0, 0x0, 0x0, 0x0, 0x0}) getsockopt$inet6_IPV6_IPSEC_POLICY(0xffffffffffffffff, 0x29, 0x22, &(0x7f0000000680)={{{@in6, @in6=@remote, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@local}, 0x0, @in6=@local}}, &(0x7f0000000780)=0xe8) r7 = dup3(0xffffffffffffffff, 0xffffffffffffffff, 0x80000) r8 = getpgid(0xffffffffffffffff) getresuid(&(0x7f00000007c0), &(0x7f0000000800)=0x0, &(0x7f0000000840)) r10 = getpid() stat(&(0x7f0000002680)='./file0\x00', &(0x7f00000026c0)={0x0, 0x0, 0x0, 0x0, 0x0}) ioctl$sock_SIOCGPGRP(0xffffffffffffff9c, 0x8904, &(0x7f0000003a40)=0x0) getsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffffff, 0x29, 0x23, &(0x7f0000003a80)={{{@in6=@remote, @in=@multicast1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6}, 0x0, @in6=@mcast1}}, 0xfffffffffffffffd) fstat(0xffffffffffffffff, &(0x7f0000003b80)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) r15 = getpgid(0x0) getsockopt$inet6_IPV6_IPSEC_POLICY(0xffffffffffffffff, 0x29, 0x22, &(0x7f0000003c00)={{{@in=@local, @in6=@mcast2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in=@dev}, 0x0, @in6}}, &(0x7f0000003d00)=0xe8) getresgid(&(0x7f0000003d40)=0x0, &(0x7f0000003d80), &(0x7f0000003dc0)) r18 = accept$inet6(0xffffffffffffffff, &(0x7f0000003e00)={0xa, 0x0, 0x0, @loopback}, &(0x7f0000003e40)=0x1c) r19 = openat$fuse(0xffffffffffffff9c, &(0x7f0000003e80)='/dev/fuse\x00', 0x2, 0x0) r20 = openat$smack_task_current(0xffffffffffffff9c, &(0x7f0000003ec0)='/proc/self/attr/current\x00', 0x2, 0x0) r21 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000003f00)='./cgroup/syz1\x00', 0x200002, 0x0) r22 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000003f40)='/dev/ptmx\x00', 0x4000, 0x0) socketpair$packet(0x11, 0x3, 0x300, &(0x7f0000003f80)={0xffffffffffffffff}) r24 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000003fc0)='/dev/vga_arbiter\x00', 0x0, 0x0) r25 = openat$selinux_enforce(0xffffffffffffff9c, &(0x7f0000004000)='/selinux/enforce\x00', 0x542, 0x0) r26 = openat$uinput(0xffffffffffffff9c, &(0x7f0000004040)='/dev/uinput\x00', 0x2, 0x0) sendmsg$netlink(r1, &(0x7f0000004140)={&(0x7f0000000280)=@proc={0x10, 0x0, 0x25dfdbfd, 0x80001}, 0xc, &(0x7f00000039c0)=[{&(0x7f00000004c0)=ANY=[@ANYBLOB="d40000002300040d2abd7000ffdbdf2508000100", @ANYRES32=r2, @ANYBLOB="135ab3f9023ae8d27873b7ed312f9ba58e0e5a511495b93507a3cd0c3197087b4d2131faff8877bc2441530d6242a2f2521624a27e5cd5646ff46206cd23b74147f1665565e447dbfbe6fc0fd12e5a6c004d0008005c00", @ANYRES32=r3, @ANYBLOB='\x00\x00\x00\x00', @ANYRES32=r4, @ANYBLOB="67c924ed28617115b8ce59014983d08fb9b044001f00387763a546570e7eef797d34ac7d0ffcf4d2aeee129f1690115b4bb98758e6cf99351029c1c1620195c021d40389ae3df290561f3407867f41547b45c4af7700000000"], 0xd4}, {&(0x7f0000000880)={0x5b8, 0x37, 0x0, 0x70bd26, 0x25dfdbff, "", [@typed={0x14, 0x1e, @ipv6=@dev={0xfe, 0x80, [], 0x10}}, @typed={0x8, 0x7f, @uid=r5}, @nested={0x15c, 0x10, [@generic="43ce14ac437a1f04fd109bc36b6d52927a8bb0285cd74519b40e24d417b2522fda67a088ae5128bcff5529b4fce1bc5a7085ac01fb250b9295dd5ce86e0d55570c83497c02807ba1a89834026a271fa3184620e118ba14296f8f72e0d9181d93266261430310e94f2f6474ce14cab82da449baf38953489000b4f7280a8bf7232e44cb3aae99d57ad609502a111d3022699dea2a1e237b2249ea7706abf1c871c28c1f9a55d41d68431f0fa15859f44b68320daa53e2bb2970863b5430f693", @typed={0x4, 0x1a}, @generic="5a587841d6ff0f804594a90a73fc3e8443e6c0b26f47cdb7bdd37a3946d95ac38bb8ac8b46b385067175c8a93eda9d0b53a096da348d2a4c324156cad7448231a91c7fe22e07616d994f3e44436f1b380fb2272ff7a464fe90b1bf2a63cb2af763f8f1090d756e4bbe9bc0089b756c0b6ecb38a604350dde0a08944a1a", @typed={0x8, 0x82, @uid=r6}, @typed={0x8, 0x8c, @fd=r7}, @typed={0x8, 0x2c, @pid=r8}]}, @typed={0x8, 0x23, @uid=r9}, @nested={0x360, 0x56, [@generic="64f901abdafbfbbfe68532670d3802c96fac1a", @generic="2d237174d98718f7a0be05ff5f1196d6e8497410484c69eabd1359b1fb6a556c1484ee211f5c25bb66beb6c6dd29b55ae880718e781fd50ffa67ad5e4d39f59e1b9cd2ba0df7f409feb91f62baca0ba4164ba239a77359", @typed={0x4c, 0x82, @binary="dd716df8b9ab05d520e96256f07d890e6cef186d8940b728062b3d19aa634f1eb04ae85936840678e956bd42996f53e8438d9c55b4f8445cecc8f9c72115b09b37c1450ed1ae"}, @generic="26a162d4f126bae6e07286fa33964b957786c53455e91ce5a2e8d8c35c5892f37e2297ab3563ff2f01e8cf1f144f90f20e462b2b2ca5ad7a4df2fdd2e9864e21fc3418f9e8d9c454390c39bde4e7a78a5b62eedd0be40e16eaa6362102bbf614f5d4b5bdaa76b37128d1b0238297e233432b4c4470bec44a1999767a07ee35c24fe59474908fa7370c9762d0ac2f307853fcc40b2e06e8b4ae88c12d69eeb316915be44980d7c64241", @typed={0x10, 0xffff, @str='/dev/ptmx\x00'}, @generic="efdf9023759fe7cbd3b94e3a8c711a786cb6e98a1807aa15c6384b40cb406952b3639b7bb4bed8c95f5de9558f26129297112111cb8aec97762799a01b84e3662df97b75060848dcf629771d3486ff895241cabea35c4ed0597856254a989f9de9c55d8dae8e698fd2a9c435da8063f17439c96301beb7c89ce043420a389532e9bcbd49760eebe1bcc3665657c6b23331d418213f5a744efa9a19aa12061c8c7cd9a0f88dc7e267af3cf131ce3ab121d25984b56ca9a5", @generic="449a3f58d8d8aa5d6922dfe26dd6765042738145815bdd2510a549f93012590f7439408ff0632ce4102831", @generic="bfca158c1b1cbbc1c3f6d89aced8c5b2116cf24b9fca5940ece305910ba94f2f243be9f1852c8d8c750238421edff454df58a7705ae996d5df2b6cb06742bc04fe46a9d9b9eb15784c1a11f9c9edb476e4fc30a363861a1c90503184cc969591aec2c9d3478edd9ef2d314c1e49005021bb170548ea27fb9345816eba805b23e4ee387c214630529dda1ee63b8eca713f321c7757fc2da99757ab2b2babe005137efc986cfa68e4a2b2d19a91270d60df76c5e9d189cd484e2b768c248e0bc48402055008a848c16bf1224356f148c16bc9958d7d4b613757d2beb78348e415019712b749c2727f8edf9ee5c30260e98021cfdbcc07343", @typed={0x14, 0x8f, @str='/selinux/policy\x00'}]}, @generic="ad48148b9b8494120a03a4d92b76c153ddc37fedec90a38d835c88206374717a7dc383c538d537f5949fe2ff330b1ea308946337fb92037468e46fffdf7cf24b67820e5be5036306c733042f5d8742ac42e23bce278b25d2fdf7bcc273e4acd33f1c21fdc93d25d187058ffea9f7e945cd7e83f68a60cb5cd8bc69ecfcc6a91bec6f1ee22ef2521b7977992352027db5b88c791da32291b50771dc77579b925471ab978c7d3ca7557778d190e40ab30dbb43a6a320b25a4ccc366e899324172527c5ad760b1f96b0"]}, 0x5b8}, {&(0x7f0000000e40)={0x308, 0x1d, 0x800, 0x70bd2b, 0x25dfdbfb, "", [@typed={0x48, 0x29, @binary="646a1c08ca5b6873548273a774285d85b38c16cc0cc514dde7cf8fd84586e80c186266fbc247f5d6a76628e326364834599635879aaea1235fbc4d4924db2ca5a51b"}, @typed={0x8, 0x53, @u32=0x9}, @typed={0xc, 0x80, @u64=0x100000001}, @nested={0x294, 0x54, [@generic="7a43037038bbd59cff50d7e46ae907623d3eecbf2321b309738c54f5c2ee8084d68576bacfb7c61569551f3c3064d947e55d7efa17dbcf4a70ae5719bf2073dd3e18f601d39e73e691d7", @typed={0x8, 0x92, @u32=0xfd3f}, @generic="41a4d772e852008e586887b1b75d677ea6c31836a3d15a7fdc981e11d1d5fff948585a039e530016cb8059bf6bec978087f64ef631d21d0260", @typed={0xc, 0x75, @u64=0x4}, @generic="ce5455d54029ff36ba058bf157f88a2c9020cd94495e0c2d1b15686b5ca69857aa1e7b2dee7db85ca0ccab5e799d615121c068e8d886a10cd915bf87e445", @generic="88d6cb29db1089e29f16f4bce0bee4a2d6aaff08ee11004d221c8c37199e8cd72ebb211b3c5f6a6c74070ccd20c7ef25a8663f8dd4346c8a4d7bd3b8bcb043e95a88406920f4d8c1228ca3798e0a1e07b25818debd03ac3043563931c5010873c1d3ad77768a1def7efb1feb5ad93ca1c5fe0c63d4ff56c5156487b1f5cb07bfa6587de55a3e9338eb9cc1b8b5d08485e2c8520e9019d16aa389c152904079620b8a712c4a4c981d9b5bd8b956e079336ea3ea75725e74f7df92e14ba37db48ede36f000adb5605dde", @typed={0x10, 0x34, @str='/dev/ptmx\x00'}, @generic="177fbd37a39c3f63456020a373bcad928ed183b5f87de154d14c3d392ad324e306014ba8e00ef7543fb6b7febf0fc2f1e2f6fae1612ef2f2d3f33778fc37218a9b30091b695563c0cb14b326dd34f2ab657ca08798f090221dde83554013da2ff0f35610247f3e9bc72882d58fea0ac81ddd97dce98e76ca4dd605d72d429c191dfabcaf2688a71c2fab365c556fb1c38fa911943f00ca04093d09d2ae3af83e225c93", @generic="c54fe4473fe95e2852a3747119edbac819e4d2db1c2d14bcc221377385874b9a4b1e724ac07dabb189e6404ca71c49ac7c39c8460a6c0cfada73cfbb2a7e", @generic]}, @typed={0x8, 0x87, @pid=r10}]}, 0x308}, {&(0x7f0000001180)={0xe0, 0x2d, 0x2, 0x70bd29, 0x92, "", [@generic="c04ce58ee84f35513d4c4068cdc43079c956b52403aca229b92d91cd83b1e142ebfe6d6835c935b603331cd22af17e88287982255d9a3c36e9ad1fd842cf3b45a04e51fdd44aa5141d7fa0d53a2422ec7254cc514478d08d67172169345beb4e72ef0e53fb6164bf599fa65d5fe776443658fadcde5e86d087b00a41ab837e71fbe8dd2e35e9c2fb22e64069a87547b547c65fe94cb93c787d522318b3ca37dafb0a5f24b4024742088305c7b3dd50a0603bb042918c3aa3b329db75f6f0c002ebbaab41551bdd1c5af3b05264fa"]}, 0xe0}, {&(0x7f0000004240)=ANY=[@ANYBLOB="d0130000180000002dbd7000fbdbdf25a1f60a8b586f0bfa5dbcaf4e265bf5aabb99d65db5ec61a45933db5b84dd780357a679a2c6071cbed93bb2bf9edcc5a4c25a15fa33d9928bd91ab9db462ee190cf77d5f52d9417b83c6625407d41ea3fa82c40f83f5c00367b9a2e0d3f7bb58be9d82e1fd5b2ccc88768eecbdd0f64f846cf795518f92587c8e1a7cdd867f46bad4055e508355c8f57b22c93ddd65c1f98ced18903f847b4ea9153c4bd6789b7701c60657db5ced9531e3fc4c4bfe98921e537b9b6f970387b14447ba5ee43b441a318e7f6009d91be0d56590a9ee120ecb97d356cf2b715e2c0e2d512d14c6071c5d5951ba7206431b9251234e3463c21613d0a0a093a0aaa8edac56368fbcde15649f1ec1a0d38b37f95acdca4c32d7d11e0baa5467b2efa0ea307a734a2d92305d1350e2093fc2166f1e972ddcb7634cc44f436be532dc3359fd097620aeb455f8da9797ee244bec33d3217e1a5ffc07b4529815afa73afcb8473c1c476a1b2f8d92cc2e58cd37368a877834b35bebc0824e81e05d4a95799a240dec29d859d59c59c4f40f57374518a493656acadbd1ad16a13938acfffbdce54e5481130003a00078da2cf57bf6e5e39c85be3f7d2be14fee9e1d5fc75b188fe2ecafda09236adaf01d9922730b16ce3576500240131005a14cb79889c92ca23819550bd5c5aa2a89aa698913d8d61ceda2f6cc87caaa6266e1a7983875c5d235e5812a05f725af295589134f59d1300675de54c3ce0736f0e9d1a5e587057a4f1ff630992ef4e1a7821ae516914434f8561dcf18ca39a1f2c9888df5d21a31f2a70b429f1d247477c838dd2df5645ab57e320d40dec31582f8640873e0948990ac12e2f5a9bd4569f597e86f5c0e85750e0accf2ac5d884c424e2c159b89348345e460239d797b877ecfad1b9a3331a19ae2ca1db52318aa679b9cb4c41a80efd11880a9053e7d4af19cda5f0a7bd188ca785de43110690e34be59e9c2463e128a575cbca8224b692df47600f15a36c87d27c15b9a140e7bd0f17f1908a1512adf427cfb6525b806319f057888b0b4dc1dabdc0000000c8003b00b88eadb3645c1fde53f597ccd70211a10d5343775a51f233ea4f424bf71e9e487dd105ba16df61c6b3fd1e3b456a763d60d5ce0d530bf00e3c5572cd45fd749896c038c8c5fb5c37a2911968cc31faf0d41d24bfb39e906e70a7e0170ac54103bfc5973b694238e92c86036c03573c116962d134beda27d4689f19f1e24e493a528a9ba0f9a4c8b85ba015877cc9e705f5a80d241cf7452066ce57aeb995f7d64afcbfadec1d217cb2e4a1ec6896d0b569d373b23b026a7faab93bec410d981f4164c100041035006441a3c62a1325901f73f68852bcb1995fd9c3337f3a308b0b537b48df17af5fdffb5abe451eb65486da1ffaca1b5e152edaa480491bfae7b94b76bd6e92500f6e99b4045f3c628beadcf488ce7a8704ea343584f4e33da95890d5adf5ffb011b36ed417b9152aabda4e4f8fe85fc7ffc6fbbc3071b5edb1889f7ae3d49b1f2ce161126adeef3316d5ba2aee768b2a8a0c9033907fb149f722a36644f4177123264ffca60aaa78e0534784f65a11f556a01afb51204e37fbd526d1b35d4068af252cdf2d35c0263d5198b9c1b8a6a6399c2ee77b556c997bd3f345259d5a107818aa57e8f1051ca46103f0ede9857258ffe4c46f4708da5ce9059f7a244491ed45ee6b2999ea060b4abb7e4f4c3d719585677a7b5de38a11e094ddf15a0c5fe5b37887efd55b8c6115b2cd34132b59576edc0ce3c9d6729e2836f4ed9fbbc31b2eba822a5f8c2c00789c975c5c0bb6b3f1963e2acf2abe87417dbc3be8dd902b707206b19aae847e9115a0ec9f868ac6236163fbe66f67862c3e6840e770ead24d87d579f090135630744ff735fb28e3e5700fc5ce3b0f1269cb52f7c6799dcc9760d3abead1a47de171e5b23b12b6baa1f855b7bcea0c3f935066c03cc58732b775e908a52b3e45372b999ff95ab50046e664a8f2311c5de0e3b1218eeaa0960eb953a72ef3fd08eb7ad45d2f639b1337de419252343e05d0e7075df141c283c162b6f92d2130afc4881f915d738dcc40cf8a0c223eb3bf67ead105cb1525768b2e759f975529ab77afec8baaef03352fb03835dbf37c0914fa54b99ca9fb0ec14250bf1fcc41f248e272e02eac54e25c927ce86d46f426240f558d9993491bf5955d683df5baddfa38050ef89a77ef0433a586ebca3a90d10c5d7f044fe669c17e20a91a9dc4ee614b39335b458518acf2081e95eb78cda2a731be89860b977c99746f0131c6f9ee5e5320714d7d8800cce4c88f287afc0eb61edbb1eb246a29750f0fcce795e78ee3e04e1f03c44d2e73a65abe93dcc6e4b20f6e3a19879762585143972647f2170ad128adb974ac274249d35878ea1fac52bfc874a187c16334844b3dcb14914d55de626fe798629ebcb4d647651c06d6963b7cd2c522b3f81ffcbfcc487c045820ac89ab724ec2a472a9ca0b31d0fc9fbcd58ae5ba671cdf8699293bf897dd0c05e83e3f0f01fbf286b198c8f9282af8e75d9624c09a99d1c8bb16d374523ee2a35fa1cb0b29cf837010ba4cc7069b72d829601a587f2b688c237ae1782c4f439e4170ab5da65546cd62e97f8d3bed245538d8ef1f61b4d32f1c67abc2ebf16a3a048ec94039fd2ebac34499c0b80877ab993cfe0278eefa077e7f7613a60c12aea3bd623cb247cb8c71f67f346dc226f723c7bf09d612d504ed97ebd2e90d3a34aa456963fc6c07711d207ea638b1bd6a0197a14a860b0cfaed34a4fdf5cb909104fadb2b5c29b9b9ec41364a0aa8e2b4151b27f61a4fd887c5590186ab54316f3535d788c669995dc7eff1e8a65ce709423a744c095d7cf81ad8bd083abc76731905ee80ce9ffa2119eb5d79fd68c51463da7f0193c35da97fdfbaf8a9edb21779ba09b18cda685bd5de558633b929b3a82ab6f081b4fdf80fa80f75737d4b5e63d34f1e8daedba1c2ff6d5d81414a9758dd1aa66c6898968d81b6c17f83cf963566854401be464f178aada0e91000bfc79e21135c2f928b230139549eb3407cb992d675f27d219f8d6a49b0a478186f2ea70c49a573c6eb358c934322cf0d5f2a7f0d45228304dd238382639f8cb56cf234cb75fb79067be01f5145a0270f118b73e51ed387d8f1c27c5d1ff90382af6db6e6ff95859fc9c8b929cc32988bc202351fec4448c37fe283ecde4d8f0741de704e5e1f28c1eba15f1538dbbd67b931eff3e8f9309fc5cb7250a728e60e353c8ea7754231d47f6d57b6720b4bbea476d2c11764317f117fc744d7ff7f83ee944c7f2c6585f9651ba127d18a8cdad53d549d04b32627a6c21bdae071123a21e8498eb73b6d3574cafef7053b8e4632d698ed1ca15eef492e567bdeeb776b2d2d5a2720ddd2860265eafe00dfcbb35f6092a94ae2e09fa3466fc93ff0108b69ddd4ea56a05a0a451a6fe27600e81659e0d905b39feb4128d5b519ce30462446381a9e6ff9f5b22145ce456e5509c6b9fbbb7504722933c9c07ae00a4d17d2a94d89755e0ccd8e56703990042b0bb2256dcff29847611210bf47ed978e588faf8ac13ff5fe194cb016cd55d6eb88c4b28648d34bca2699df0b1f054dea98286851d33a7af4052a8cfa6f6f4673b977123017ba039efcebc0c1a3a1c11aedffd4bf9dc8db663db9456a814def2c31efb9246bd44595ffe3c1540c8acd2d72951c10b1a0a6622f1e417f8024149ce7855426d6ca5c56358f4f602877f56e01a2a90c559a80dfff086f29e84f24cc9e8fe4e7360bb3fa462e5ce0ba7132ba087e5b8a16832bffdfd8af4c56e43cbd3b6eef3d2cf278057cfccd4488cc64b74a806f37fa80711c3782cea98b76985100dd5aadbe5ea02d3f45caabf36f2f7e55c98d571cced13405b557cbf9ce7ebe8e948b3c24fe67db2e6d1bc0baea357c447be1cd7a19970b0d4d489c528a0f669cb7ba2f9707617803f76f349931f562a0f5b6e651bdcfc4d0a27afe5d64a575faa9b3dc36f10e01ccf7ed08578f6949f568e5c916164f893ec5b379ea6fd35aa6b00209de890c2329bc9cc9575f9a7f3372cd2972c9f36e56ea84206a45668b952bc70c049999d601f4eab4cf284dfaaa1dc1e3cd4c0c8e2ab5fca6179b83402ca5187ccd6cfeb25f1088366dc04ea3508d233167637139f4ac4afe078cfcbe94debbaf271b365226869bcb2636554ef75d5738cbe32de63bf0c7cb3b8e08f2fd7d5607241622d00c81b124246a610fbd2d0ab4d4de3c73b441aab5a9f34efa32b529200167b1b1d3a8fbc69439bf8e49f77160267a9fc2e673888aa330eb1d939d5bbbd32eb8834d3522fdb521bb568ae2efd4cd0700572b243d3e7a0786ff285af0715c562ff8f79a62f4de68b2bc47a3f73c5294fedb8f236727995cbb75fb1bd6b5bbaf5db19b4e85fb6681fd2bea553ac448d3872670dad3691e2d4b2243e5f815fdbe931a0836f6a426b830feb3fe7c9a477e8d9f018def5a24159b0672bd4dd99dd1eb0879eb769f48d8b570400164b544a8d33b6ba47b09835dec7f9309b18e05adf8701db6015689d5ba6e53b1ee6c50ce7d657068051cef3ad23dd44c832e02273a63758a50effc0995a789aca1a4f622d97baa9a734936009fa11541c088d982a210226526dcae57788d4040a32d66918a82f451abd0f6fbfd38359e539f7f1bbeb3b7105707e7369e02d5563c444af0061bdeae734e73bc33e590ad336e343f9cf5d030ada985dcc8b6b10c402d8a34ae4f655cc35d264050d3df1b3bb9702d49abe32211ced8fff0dde850ce53bb6afee3ebd88676e799e3a485d2cbaa4c8a1edf0e6c9a1490ec17facc4ad2cc8263bd82355309cb2d2aa866dab38c557f5a96ef9647e98d5f916e578663f0ed5a29ce2d64600f1b325c20430b433e51ccfdf8076dd2691edd1ff160332457f91b4f5aa1d76b9cef604f9a1bbef206e9a57f5a5b1cd5443c357d5a962f517a0fb565197231678ac57129aead2357189f56553261b1185ac2ed878dc2d37ca431c2cd2fec0e2af1229a4335343d685bda7f8d17264d1a88011fee58557100818185bb0b867ef39f60fae5b3f509f96d5e155671b7400318d55e30e93e99648c6fe1e98146aa7a24fca3b792f2d7b374f2df5ddda916fa9582eb7038c1330695da7c56a1d1368753fdec6b9d4c98bb7f87d608a021e1a1f941cc727cd27952d9cb0177af5b1d88732113b946076c28a002c57afe207714bbbb8874ce9fa22c488b310e7dfe162fa3a4025bac450d41134d9ef6785328cbe20c471cb25a085417c6783cd7cb718c00b5402105ea7531e2eb1423865046fd23ccee134d17b606709488a60c49b540eae043a83aa76fcc2266172e508f1179404036b22b13636800ecdbc2f9ad6b3576464180913f50d82a9da1df84304298ffab91eef423a18d36d93ff0f51c423d555a3ef33adb837427bce4fb465c75c1239c698f8d3da1aa9d6381eed21b51b44c4fd5fdd2ff7f59ed65f283faa3acd156d2531b45d2327ae0db836ae0d1fbc1ca8b7de9a96d5f86a515f53b0a59e28e8f3a338a6e72a2d400ca77dc247ed054ef6cfd00570c80acc10d0b9d6d7f8ccb31f9fddb70f814ad562b3773c9637d3b71e2fcd948adbbdde6b8b87aba612028fd7ca4f3389496dc94ceb89dda632bae42c9a62bc1372cd3fe6351971ce6370ca090a1581bd23448fd644ed2a6bba44fc950f6977a27cb425bf0ee1f95a3919ece4a71b200c10b5fb97d8fe55bb4f02095739c57f53656a2bacce9d3ca6780d453536633e0c463a7d245edfc815b9bdf8760fb2c09b316a777db589a4b11f2867a8bd899896a2dfe83dd21fd6d77c4008794c6183db194ba4af4b8b3508334ab7639d663bfa57c248baf33216f09ce9ef4f015894f833a8e555f689a902eec84c2ea7ad53e1a6de1082bd001c1884c81ee8920e780776b0f331521e8946481e82a4d9ce73ef1710d1ca2f78de418f9b0c8d4b18fcd47ab899f3689141ddf5d12bd5c52359b7bb450b8630f594cf0e87325eae7413fd15015636bd758bfbb0425f00e3c23fe3b89059fffdb00f33a6eab2db349e76087fbd54ac3de4df31dcf600b51c5c5361c5413cd8dfe6b1dacd33443d1a51ef70d021fad587308398480d22ddd904eb2fe8a6d693209c19e3cf3808994746b1d55f54593e669734dc759beac75744843bfb9863cff8265e40052dd66bd331241f9364f659a0b718d7ff10441bd47f12ca01a94a626b7b261bbb9aaf1b8b968a20f7da6c22d8fb751b2a1cd4985de0aadf1117168944f5eb7d26c41de01ddb4b1c28e959eed27165e3749701d5819ae2421220973b404f304e519cd38004b6ee7be4a5f720e26f13190e94f831cf0f76200c28c6422a06ae619a0289e3b46fba2fb025a66ae9f19b22e7f77ae597455b3e2a550dfdb48fbd78f10f491ee0f93307fe74b13ab9d48807f05a0a52b8fb9df743552008237a7b070584042072b0d72f2fa3acb8608b9cd3ed4d0b0e7c4deb28de997ed66f64e6b6433c29cd4085185ded189d1baca25a7d64894112aed903e519df3aae2b90f2ff217220fa30cee700e0215762a1e1808759f2027d86f33d34c58f0cdf48067267da08777dd153d288243d4618ffa8119e1900dfd57eb992c06b74fecb02a1113ed92282e45b1e7bdc399884dc02f9b70a958e6ccb69b671edec01272bfea958e2238d005e471565fb9db6dfe2b685477389190070f640a1363e3d60ea62f96fbff2edd4098a5407a9c8f17ebcdbd3098d29d63121811841610dd0b8537b060a1feb06d01cf41f4cd1ef2d96601c3dc6059773a412ed64e85a28c04ee0b3881607930cd7556bb5d018bfdd4888a9654870e82169d953cc6892743b39edadf54aab6b2faba982804af03a34d03c5bfb509708a24d1d9f8068c0fe47188acbbbd5f158176485a124d183927e8b6882fac2dfe522274d468430ac422d0a275963cc4dbaae2f2cdf66640d66b064941fcb9eca650ce65072cc73bb2f0ac076a5098bd0c621aa172c308ef224b4a36552477d96cab3e9ea28df5a7774ad588cf26139bc286bfa400c9dc60552e26ad7e3178148026798e4cd59df77a4d8194b5dec91000cb32a322c2793b1883a6e715a0b5457dbd966e5cad06823ac8a9b2369215a66954380f0c732e8d4922bc6bc93027de0ea1fee16621d9bcede64bb18347ecc2ea15a73a801f03a82211bb416129caa5cf00a793043dcbe01ee97c885f37982b6bc0a3ff91e6ea6315bc18af17aeca1b8eaf3d14b776f210c792eec99d4463c7655a07c070e901"], 0x13d0}, {&(0x7f0000002740)={0x1254, 0x32, 0x100, 0x70bd2a, 0x25dfdbfe, "", [@nested={0xa4, 0x4a, [@generic="eb6ecec51b7e6616f028658d6af4c8c27a27b03b8c9dbd0dcf01ff1214fd691249c9b3e9654e1d5ec31762f728f47d6e28372052e391dfc18c81a9613df39283292e60532feedce7545383284cc0964419641c12e16d2885745af81d26f43b3c65b626a2d714f1c14d8c286aed30df1c863f952a9fe2da3505ffed56ab2f637a99ac5bcab6aba9f42a6e596c3f8f681e1f69eda36e59b2a6", @typed={0x8, 0x3a, @uid=r11}]}, @nested={0x10dc, 0x2d, [@generic="e1aa90fd04aa8dc1ffa6e82f883ae3ae9713339d28b946fb1a2de657f6b5089e57a389fd203b4eae118e37f7aba03de0da345aa40cd2e1f6562daf716edbc5fbbd14066116ca145bb8dbd69b1e5bebe1330058eca108b7193ae242dc30d1bb73b23772dd1ff15e2691f5bf6b01530a2ec09f97b120f1a610a542abf86841270a4c8fa6c9baedda032fb4598d4f0b8b49396368a7f09e9707e0119e959033962f309524bcfad92db984ec2920f0bc54a64ae92ff2cb1279480455a7", @typed={0x8, 0x8a, @ipv4=@broadcast}, @typed={0x14, 0x5f, @ipv6=@mcast1}, @generic="67666c0178b89dc835ffd91a2c9367f3f3bb5aac9777721e2cf498d9a8443ac69b75e6c18b7ec46e218fef0df07de9ce57db1b3c8275cc7e5c9c9251bc13039049ed9bc2267a303796e2ad0b331dd57b8d7a747494c08f3c17e7d2fe47836da6846bc4b011e756196227f4040ebadf539e3c4ac6581d184b7aa589de1a1a639d4b0aaed8609f9c2bdeee725ea51b8fe1fddcb941d02e64976c5b575d574b4ac087d469586d73f2db6fbfcf9ce4d753ef37a6b1432a97a9ae04c3f59435b98a28efe2d755c9e4873f5a295c926488f13a0627af4d96198fb42f203680ff025c4aaefb3aad223fbb2378b4eb9b176c9033e8a63cc2cc118b5d01bfba9f7f211d90cb7b93d99421193da67eb0e025bfeec0bb4727f883221adbbbc78302488de797e2cfa3afff1a9fbedfc338b23dc4561b33c4fb5b1c849beb635ccc55c4171fc0e3499d69c8aadfb9af3cb81890513da3722423a0c214d0db66fa5d47b88ee78c26366f9fe2ee2dcecb8006f2673427dbff3611d1ecd34e28a85996fba582ff6e56a097d7dc4e4a08b0ce0f796dd5fb0d2d490f5865229f43140e77ac4153b2a3159a057287cb49927dc3510c65f6a3ee4985f5a4a71c848012676a6fdac5b1874adcb3832421eed65e7531d15a31779f2f50f8a26a249d6216f548b87d45bbf292f2c8b805af5472f60c51083b73b493bc8c1b2c0b48d1b1e3e4b63fa5462c2fcb99c72e68ddb7cd09fa28fbc6896eac37953680b39850ce9634cdbc6b6ff852296337c6908a032c795058b79977be7dbc9ec97dddb89f8ce700b3f407e40f404b258f0dd46488f193b9123988ef957df6f9c65d8cdd5ce0fc672a57b56d7ca509de269c5960dc06db401489da1f82da4881e30716550d59c36459ae36a2fac251e5f79c50b0426fb7986787788e50564972dc194ca8cda6a44320cc8d716545fbc80c35d296593626c119aac916ce401e890f9a331708617950c19890d29c27590d35068cfd35e6a7076c7929b91850c494a30ba13d6c697be7544cebbdcec2aade29594206507c518854edd30d27b8ce4b3499e66a47c0cd4d69a85386333c6826e4889ffe244170b2819a16f83564d67cdcf2c5118cbb91fe8f5eb551b25e8f0eeaff653bd7abf8f3c632445da9ff79d8b0cedf1f3e324cb0d058b9f6c26c79f64becbc99dc1740d39bca619717f7e688e75c1e5fc28ab14d58915ba58061f889d25b7ea51a035ead475016a42d38ec31d6a9be733b98ce5e435c17c2b764a9eb31e221b613ed1cfb1797738dbe2e874c401420ec9ba5cc83ed2b9e984f349fe7dba5c32c627ce25c5bb01ecb15d7691f69ce49a271c0308308d138b1a3f5778d29f28960e5d4e17f4328cdb7ae9b5d6adf21d9da26de403e0311fb28276ef15b6b7f5aeb451d378b61c221e7cafb0cb9368f7ce24a648ac835954185b13c53d4bebb652ffcc5841f5ace9ff7757dc25dcb8ba5247f37a9db215b5fc8807f4189000113b3e8ea31c3cfe98f2cf1e1af87b15423039deda140ab4477004f3cf14291b67e3492343e9db80ccc6e8a7ff9942357358e4abffcf71341108ec7e391aeb64f39d62dcb84d9481f1ac952b7f62e0a86f3cf74b1382c69b3bf0ff6569b24f76733c1a0b4e92615dcd4d53f730373680f9bc042faedcff01e7b83cd095316591479a8dd2f5edebd761b3415452d66446782200d5fe40db3101e9a701eb690bbc22e26a94c01450de3f1ba8ceb775a943f4796b9a9393b2e79cbc77aff8155072fd21b4add76a8c57ba04b7f71e1ce74b8272791e9605757ee33862cc6c418ee0925d6187026a372ffac10c6cfc6626ff1d26d90761545b8eaa13b1ece8bf7645889da0a273e15544b1578194413e495a13e801c64d2850fbba65def9bbfd8e1f35b747fee76f52e7e519fb91e8825dc7720c5f56082a8460c9300abf2a6dd1dc3555acfba727e912a3a46f29d5f6da17c61c591beca1337fd70cc27e1c6e12d70c1cb7a6ca4fe5eae11690e702f4cf3d78772f4ec64b97fced29642b86a4f6025a877d883ce899a51b5937bb4923b7378743b338e7cb76f181c9b950dcfffc1c30d9c246c0c2c5ecab44cd25d4f8d39793669be77aa44a125a6a81f35d6a83cb6f65a84d5a450d2a20689f6014bc169271b6ec1166164d46414ef801f58bc7338e58aa47446bc0875b9495e96e52de638ac979649f42f75abb04f053d5def54f851b84272f6586e85a250d77c396a193d32afb84b6541264f743ce60aa07f63f08d839e54ef344730a27059fb54f6685dd5a5d809b7ab8a6f0402dc0cf247e141a61c8b7980dc77e503087d6d507269c2e7d491789694d9f1f3bac63327606fb43049b0c2819afcc72a61aed769773651735eb81bac5042d6af60a600b3c002710b19a733891cc64c3d5c163b4d8da695b3f237d57ae1caabdf7d760c62488bac4ea107b768c5d689e26e538b3cd985b492814e5c9976df1ddaaba36d8247f46d3bd61da79ebf2076fae61b23a93fb7d877395571a5946e4d26d4934a18a5d6e2d0f99d20f51edaef982935ad859d24f659f2e98982facd26102a671526a0ef155e55e3978e021266663c3b7d98f22f9b8f0b617bad24d2394d1c5058d24099eb597c8d2ff32abdc79bf4aec7d915388b171f6dffab47227bb7cf361d1443ff8e33ee16ffad2aaa377fcbd2a36f6138b4af3792a1bf38c7192121d70865b4caf29df2fcd08deadfef690cffda17bc02ad354dae83479155a2241afd6eb04a6b91c5f34d2f11dace9376687e2e268f382237017a29dbd0285a4ce84fbc186b50fcef83ada9530c0b04f1d21ad67a04c4ec72e060d1ca9fc247560950196d694a467f0dedf35af825f187e81cd2ba751e7bdf2fc282611e8ef30c3c9f867209645f5050bc23fb3fe624e1a18825858b1e4a1e038719d76536f68b2d3704ad466032927d5ff6b5e0c48272e287b7a2601a267e1dcc8edb3027b90f86721125d5a926f513e006cb7fc7d9c3431d9c193c68b55a1a93ee94c88ed2b61b1306844d4e1d16bc94b4bbb3bcdcc416651c4afa7bab25ca370a2e23d55b8685082f92c35a8a6df1a989fa2dbe6969f89e10727ef2fca2553e6112b43a542b50179f597bac8f31d3a19db78fc1f7137e15516418a741379efc04da9c4ad3965275717508d0de3ec27afa0652b62c62c956a02e822d38d181fc433e2dfefebfb8064137e9b8f43623a2e16bc666eda804e1b991a3bbbda538299a439dcfd4512de9cf93bce62a9586624c9e286acc502377ec13199f185287263705c5ebc5a158adeb6d10386dec25baefdeadef1865dfb973de32fbf2b4e1daf86c95fe9e2d155009fe96ce55fc9cc46b4efca6229f2aa91b51ddad205f4b85859b3acdedad568d3541f01f39aef73a880c6eb827fbecc998a4a943a710ff4516ae88dacc062c2b8cbc3a10da000961c60c40893c97c102a021c25ee995cf6c56adcc670b86b95070510c6a4b792f85318ccf7bd648d918f0b59106c4af9fd24ce4da0b79c74a9b2a9563a7db2f4e9daa2e85d3ca9e68f5e4d3aebc7f16d1643a32cd6bd74e3ad2bb54f975cb2bcd518a2e1e1c680bbe921efe3997ee42e4a6ea72c1688b07a5729104fd3580b1f2683a751231453dd05c0f5fcbde1e2b0fb03e1dc782b6b49fe0905764168e9cff317a4411cadc98bc2e28ef32fdaa4d4cf7858fa1f54522b5f926dd28797bffa2d435f19186868749e80a7e1d12ad85bf1e2689ddf0b35e3eb01b25b53dfd711c6f80c5815eaf8f367b13c1603b3d3d361112ed4365445433f076df04dcd5256ff5faf7730a4caf8ee4ceecd6608ef8cd973df634f998c209d32875cbe854fd76d638d675a52a4fa3556aadbac1c5660c1e19fa1ba232f25ce09d3e03af1c8143538e00a1b6d0902c66e624100fcda56758cbcd04e05a4fa79888a72d392a71bf5a5e67f037d4cfec4a453a47f51720692f633f697248b8235eeb99abc9c8c2e3815e7a34b97c091df7d7a9ac3f6d1eaef742d6bfe6c798b241d21830aa1de1a609b690d3f4e5800a3f0e13859de70f98426fa7421089949efd6512a82733cdef2e634bf68f9d4a036f8bc998e61fb4293c18d2c066d7b471197cc66547a734e80cbd4ef3a940d6d62bc435c4ce8f8597547446b047ff073d21e924f9cd2763f826f0c0dc5bca230da6cea9daf790b7ff686290f51238620098e364ba2c5d2bbc38e63a9d5699c36b25240623ec48a082fc7172a3635380ddd9975accf36fbda1952b88b2429d1ebbf4844781aabf1cc6590116da6ebdfcbcb9232035eb10d6072d650c5740771b5248ba4b0617cff9dd15082acefcbd8e1f5d9c51a4926f47a69bbb33ba3fbb22d114137da0707868942f663885ae80c6a5478c3b51876fbbbc5826c8a98984308d961580d4afc0ef45e03c84fbaa421f53c594088850c8b56023718ec4aa1b4826bcfc9fa997691773daa124b4819643bc947488ff1997121c63b12a0305a3a810817847a58473b6e4262985d0a95ddfb66783294b536a8eb6119886108ddfbb3565111b21a31a745b7db592b5227e801c3484f72355f7328c3459f4167b99824a0a17007768b21c4ae2c1c32a50b5d874874ada43205d640f03c2f3d052f289fcf09bf7950930a5cfb3826eedf696d00f32d3892357cf2e12c1517421261e4ce18aa5f981c3e3dd6e44249905f00381ef7bbe85335b1545cf15eb7ed0f94b61e4890a561369f97b66c095d7d5ed3217036e52162cbdf1bbbb223008ef553fad2c8b6c9d4a1e2cd61487262ba803d92cc9163e42b9ff217f4aa3482dbcd07a2f6998ffdbfda07131e5c462da000c633fa71256a86872594c99d154d5dd318bb33b943e20c76c3845095f397110cb9e55e9e299a9f2c3661ac09bb7fc79b52a681fc57a09c6336203d126b9db969a227eb99b77b94255710aa2bec9ac21536c81f0a7fd1dde4209206ea4071a5aee2f0a9bc7d17d481e9c9a280731b46c6a278b0339bc0ea9d2a5f5b88449723bd0592fabe51594c5bd6d29ccbf745fcab819a477dedcae80b30ece97745146865a891ee4c4ef6026deefa015547fc1f09fb46fa71481e1717cfb974241878fe1237a283b7ce4d64a83279a1191484719720cee0c87b5d3c0ebd9b815bc390a77ad52fb664faca1895af4340479937e6b201f2b748461445a88f8fe9553ce1729795f998c06eaa46e6de718cca0f71d1abc2f3453ba8ff618e0daed7c000ad9845df730fbc8cf8fa83727f49e3027e3fa95fc2becfe636d59b2b2abfbfc1fb3a7bcd47d2eb4cd025a8ee8c32642b57d86b2e3493ab63a2150ac6de5e443e27e2db89729166530fc377554268320cf0a1ffe96408b140e7701bcd581c1518d015eca4adef38762086114615c07510a5a001b8b8f94bc003738df31c8a681522981483936d8fcd6ff0478e59a03f16967c220dcd429fbc566c9d8fb3983d717a911a57728f6f1efc401cfe10b9b043558e2d3ac7619d67479e07b29f64e93ff363eb0431b20e011d82a901aec7966315b3195f933850c492d656d3863782813996e6fa20fa6330a95a06fcec81481d19e1075db4423975cfe0e68e84ed86177cc0a4cd432a3a5d0bcb3099c9510ac09f92fc30a24bc67651aaed50d3b7cc55bcfe7d3c1c5412a411c6c7a32fd4f432adb8421eb3e152e90cba3cbbfcd87881db58ae9f18a5b905ea293a9f807b73819c0afb96cd2bd5586f8686fbb5e85bd91dfd6be547f2324bd013a67d6951c784e07b788326aa46e91283bc4173283c02ca0f52299452a0c76"]}, @generic="e9d386702d737deeca2aded619b4410d98543e0a0bc356f22b789bfb780d8466732341b48c831438317b61b3009896a7c4998fe47670283b03585b2f6b39364ea4f5b5c3f3c9ef5855bbfafc8e928c385fb260caadb8b5bab3ddf7756d700c540e4eb7f8e9033822de492327147b119c07100a9c10b3c28a9e16c0076da6813503f9df20a9913f173ae1ba597991a78dc1b1524ab680a682bf71746809ef75a30912b50f43c7f006ff", @typed={0xc, 0x34, @str='eth0\x00'}, @typed={0xc, 0x93, @u64=0x4}]}, 0x1254}], 0x6, &(0x7f0000004080)=[@cred={0x20, 0x1, 0x2, r12, r13, r14}, @cred={0x20, 0x1, 0x2, r15, r16, r17}, @rights={0x28, 0x1, 0x1, [r18, r19, r20, r21, r22]}, @rights={0x18, 0x1, 0x1, [r23, r24]}, @rights={0x18, 0x1, 0x1, [r25, r26]}], 0x98, 0x80}, 0x40004) r27 = socket$nl_route(0x10, 0x3, 0x0) r28 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000240)='/dev/rtc0\x00', 0x104, 0x0) ioctl$TIOCSETD(r28, 0x5423, &(0x7f00000001c0)) fcntl$setsig(r27, 0xa, 0x26) r29 = socket$inet6_udp(0xa, 0x2, 0x0) r30 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ptmx\x00', 0x2100, 0x0) ioctl$VT_GETSTATE(r30, 0x5603, &(0x7f0000000140)={0x4, 0x1000, 0x400}) setsockopt$inet6_opts(r29, 0x29, 0x3b, &(0x7f0000000040)=ANY=[@ANYBLOB="3c02000000651095cfa6ad060000000000"], 0x20) sendmsg$nl_route(r27, &(0x7f0000000100)={&(0x7f00000002c0), 0xc, &(0x7f0000000080)={&(0x7f0000000440)=@bridge_getneigh={0x28, 0x1e, 0x601, 0x0, 0x0, {}, [@IFLA_MTU={0x8}]}, 0x28}}, 0x0) setsockopt$netlink_NETLINK_NO_ENOBUFS(r27, 0x10e, 0x5, &(0x7f0000000200)=0x80000, 0x4) r31 = openat$selinux_policy(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/policy\x00', 0x0, 0x0) ioctl$SNDRV_TIMER_IOCTL_START(r31, 0x54a0) setsockopt$sock_linger(r28, 0x1, 0xd, &(0x7f0000000180)={0x0, 0xff}, 0x8) recvfrom(r28, &(0x7f0000000300)=""/96, 0x60, 0x10100, &(0x7f0000000380)=@pppol2tpv3in6={0x18, 0x1, {0x0, r31, 0x0, 0x4, 0x4, 0x0, {0xa, 0x4e23, 0x2f2, @empty, 0x8001}}}, 0x80) 20:30:17 executing program 2: mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x4, 0x31, 0xffffffffffffffff, 0x0) clock_gettime(0x0, &(0x7f0000000000)) setitimer(0x3, &(0x7f0000000080)={{0x77359400}, {0x77359400}}, 0x0) 20:30:17 executing program 2: r0 = openat$ashmem(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ashmem\x00', 0x80, 0x0) ioctl$ASHMEM_SET_SIZE(r0, 0x40087703, 0xfffffffe) mmap(&(0x7f00006ff000/0x3000)=nil, 0x3000, 0x0, 0x12, r0, 0x0) ioctl$ASHMEM_SET_NAME(r0, 0x40087708, &(0x7f0000000100)="000008800000800000de8b9f4d4478c8cbde196d9732bfd8dd7d5892e2ca3feb8a41fca88bb3b07896dbb8dd07000000d41e1202f69039f12c5730d1000000010000000000000000000099543430f62332c4d3c98e9c3a93ef1220454220d7ef602bf5c2792eece742b942bc51a93900c627cbc57a5990a0") socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) close(r0) 20:30:17 executing program 2: setsockopt$SO_BINDTODEVICE(0xffffffffffffffff, 0x1, 0x19, &(0x7f00000000c0)='bridge0\x00', 0xffffffffffffffe8) r0 = socket$packet(0x11, 0x3, 0x300) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='cpu.stat\x00', 0x0, 0x0) ioctl$ifreq_SIOCGIFINDEX_team(r0, 0x8933, &(0x7f0000000300)={'team0\x00', 0x0}) sendmsg$nl_route(r1, &(0x7f0000000400)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x2000000}, 0xc, &(0x7f00000003c0)={&(0x7f0000000340)=@ipv4_getaddr={0x70, 0x16, 0x206, 0x70bd25, 0x25dfdbfe, {0x2, 0x38, 0x400, 0xff, r2}, [@IFA_LABEL={0x14, 0x3, 'vlan0\x00'}, @IFA_FLAGS={0x8, 0x8, 0x1a0}, @IFA_ADDRESS={0x8, 0x1, @rand_addr=0x4}, @IFA_LOCAL={0x8}, @IFA_LABEL={0x14, 0x3, 'ip6_vti0\x00'}, @IFA_FLAGS={0x8, 0x8, 0x58d}, @IFA_FLAGS={0x8}, @IFA_ADDRESS={0x8, 0x1, @dev={0xac, 0x14, 0x14, 0x1e}}]}, 0x70}}, 0x4000000) setsockopt$packet_int(r0, 0x107, 0xf, &(0x7f0000000000)=0x6, 0x4) getsockopt$inet6_opts(0xffffffffffffffff, 0x29, 0x0, &(0x7f0000000200)=""/143, &(0x7f00000000c0)=0x465) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000640), 0xffffffffffffffff) r3 = getpid() sched_setscheduler(r3, 0x5, &(0x7f0000000200)) sendto$inet6(r0, &(0x7f00000000c0), 0xfffffffffffffe66, 0x0, &(0x7f0000000100)={0xa, 0x0, 0x100000002, @mcast2}, 0x1c) getsockopt$IPT_SO_GET_ENTRIES(r1, 0x0, 0x41, &(0x7f0000000140)={'mangle\x00', 0x67, "583931f261f2519bd48c6ef47882ef018ec638a640467832724cd6ec69a74550d2068591d684421cc2ea1b2dbdf54710673fc2f96f90b255bea8daf3229d12ee11e95d617deeba396e4de4bb370ef0c0984dbf421860eeabc1aaa16ffe49aafe2627231c016a0e"}, &(0x7f00000002c0)=0x8b) 20:30:17 executing program 4: r0 = syz_open_procfs(0x0, &(0x7f0000000540)="6e730066827d7232f2f07c3c1485481cbab6064192f9cc848fd27e8c8472edcaea1539f07ba9c635d0adad1884ed220ce5026bcd6b1f4e63728dfd1b69b6af2a4c9a5f77228d3f448f5b30d9b8be5e899ff8eda1e7e1944afd2d8485d9a415cfad507e4eb3918f3a91e5bb8d1432947d65982a482f4243dd2c6c6dbd88f58575c74323267409a928583a3695f4cd8f77588fd3de55fd9a4a2cdb15aa64b34c528a586e13559342d838d5f0c0246fec9a7a84a133e1ab73e59b17fa4a00ac63ae3740e1028568aba3000dcef4495dc6a4a9dde93176c5dc3a4c5bc8e4ebe160fa6c8e") socketpair$unix(0x1, 0x20002000000001, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) getpgrp(0x0) mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0xfffffffffffffffe, 0x200031, 0xffffffffffffffff, 0x0) setsockopt$sock_linger(r0, 0x1, 0xd, &(0x7f0000000000)={0x0, 0x7fff}, 0x8) fstat(r0, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x0, 0x0}) ioprio_set$uid(0x3, r2, 0x2) 20:30:18 executing program 5: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$nl_netfilter(r0, &(0x7f0000000080)={&(0x7f0000000100), 0xc, &(0x7f00000000c0)={&(0x7f0000000000)=ANY=[@ANYBLOB="1438865f6f59cf3606880c393f526f05665d7eae31e955c313"], 0x14}}, 0x0) recvmmsg(r0, &(0x7f00000013c0), 0x1ad, 0x0, &(0x7f0000000c40)={0x77359400}) 20:30:18 executing program 4: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = getpid() getsockopt$inet_IP_XFRM_POLICY(0xffffffffffffffff, 0x0, 0x11, &(0x7f00000003c0)={{{@in=@local, @in=@rand_addr, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@local}, 0x0, @in=@dev}}, &(0x7f00000004c0)=0xe8) getgroups(0x3, &(0x7f0000000500)=[0xffffffffffffffff, 0xee00, 0x0]) r5 = getpgid(0xffffffffffffffff) getresuid(&(0x7f0000000540)=0x0, &(0x7f0000000580), &(0x7f00000005c0)) r7 = getegid() r8 = getpgrp(0xffffffffffffffff) getsockopt$inet6_IPV6_IPSEC_POLICY(0xffffffffffffff9c, 0x29, 0x22, &(0x7f0000000600)={{{@in6=@ipv4={[], [], @local}, @in=@loopback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{}, 0x0, @in6=@ipv4={[], [], @multicast1}}}, &(0x7f0000000700)=0xe8) r10 = getgid() r11 = getpgid(0x0) getsockopt$inet6_IPV6_IPSEC_POLICY(0xffffffffffffffff, 0x29, 0x22, &(0x7f0000000740)={{{@in6=@ipv4={[], [], @local}, @in6=@mcast2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@mcast2}, 0x0, @in=@dev}}, &(0x7f0000000840)=0xe8) getsockopt$sock_cred(r0, 0x1, 0x11, &(0x7f0000000880)={0x0, 0x0, 0x0}, &(0x7f00000008c0)=0xc) fcntl$getownex(r0, 0x10, &(0x7f0000000900)={0x0, 0x0}) getsockopt$inet_IP_XFRM_POLICY(0xffffffffffffff9c, 0x0, 0x11, &(0x7f0000000940)={{{@in=@remote, @in=@loopback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in=@multicast2}, 0x0, @in=@broadcast}}, &(0x7f0000000a40)=0xe8) r16 = getgid() getsockopt$sock_cred(r1, 0x1, 0x11, &(0x7f0000000dc0)={0x0}, &(0x7f0000000e00)=0xc) r18 = getuid() getsockopt$sock_cred(r0, 0x1, 0x11, &(0x7f0000000e40)={0x0, 0x0, 0x0}, &(0x7f0000000e80)=0xc) ioctl$sock_FIOGETOWN(r0, 0x8903, &(0x7f0000000ec0)=0x0) getresuid(&(0x7f0000000f00)=0x0, &(0x7f0000000f40), &(0x7f0000000f80)) getsockopt$sock_cred(r0, 0x1, 0x11, &(0x7f0000000fc0)={0x0, 0x0, 0x0}, &(0x7f0000001000)=0xc) r23 = getpgrp(0x0) r24 = geteuid() stat(&(0x7f0000001140)='./file0\x00', &(0x7f0000001180)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) r26 = getpgrp(0xffffffffffffffff) getsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffffff, 0x29, 0x23, &(0x7f0000001200)={{{@in6=@loopback, @in=@loopback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6}, 0x0, @in=@remote}}, &(0x7f0000001300)=0xe8) getgroups(0x4, &(0x7f0000001340)=[0xffffffffffffffff, 0xffffffffffffffff, 0xee01, 0xee01]) ioctl$sock_SIOCGPGRP(r1, 0x8904, &(0x7f0000001380)=0x0) stat(&(0x7f00000013c0)='./file0\x00', &(0x7f0000001400)={0x0, 0x0, 0x0, 0x0, 0x0}) r31 = getgid() ioctl$sock_FIOGETOWN(r0, 0x8903, &(0x7f0000001480)=0x0) fstat(r0, &(0x7f00000014c0)={0x0, 0x0, 0x0, 0x0, 0x0}) getgroups(0x3, &(0x7f0000001540)=[0x0, 0xffffffffffffffff, 0x0]) r35 = getpid() r36 = geteuid() r37 = getgid() r38 = gettid() r39 = geteuid() getresgid(&(0x7f0000003380)=0x0, &(0x7f00000033c0), &(0x7f0000003400)) r41 = gettid() getsockopt$inet6_IPV6_IPSEC_POLICY(0xffffffffffffff9c, 0x29, 0x22, &(0x7f0000003440)={{{@in=@broadcast, @in6=@local, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@mcast2}, 0x0, @in=@rand_addr}}, &(0x7f0000003540)=0xe8) getgroups(0x6, &(0x7f0000003580)=[0xee00, 0xee00, 0xee00, 0xee01, 0x0, 0xee01]) ioctl$sock_FIOGETOWN(r1, 0x8903, &(0x7f00000035c0)=0x0) getsockopt$inet_IP_XFRM_POLICY(0xffffffffffffffff, 0x0, 0x11, &(0x7f0000003600)={{{@in=@dev, @in=@multicast1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in=@loopback}, 0x0, @in=@multicast1}}, &(0x7f0000003700)=0xe8) r46 = getgid() r47 = fcntl$getown(r1, 0x9) getsockopt$inet_IP_XFRM_POLICY(0xffffffffffffff9c, 0x0, 0x11, &(0x7f0000003740)={{{@in6=@loopback, @in6=@local, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@ipv4={[], [], @multicast1}}, 0x0, @in6}}, &(0x7f0000003840)=0xe8) getsockopt$sock_cred(r0, 0x1, 0x11, &(0x7f0000003880)={0x0, 0x0, 0x0}, &(0x7f00000038c0)=0xc) sendmmsg$unix(r0, &(0x7f0000004440)=[{&(0x7f0000000140)=@file={0x1, './file0\x00'}, 0x6e, &(0x7f0000000040)=[{&(0x7f00000001c0)="7ac2dc77d1c7023cd2fa21dbb94dfb8620b31117e901f6ba6fcec4f6fd54e36830afe317a4393514ed30a7576a962076aa50fd218c1d1f759221e9164cb9951b3b53b699781f4d5cedf71f331d67cb692b42bba997347e", 0x57}, {&(0x7f0000000240)="19e9724d07ca12417de9d999c0a702796618fca4474dca3c908a499915e7fea405d73607e968bc9498f75c3ddad99ebbb134b01a4215987857f047da1e4da8707e74be5a2751aa32b1801ac35a31720fa5cf820aad4a7597055d6de302f29a56fec1aa806ef2448559873d5889d147c4946f976b18361a0dbfc932af9468d271cc5e506392c279ee23d784314716406550f3fa8413e292c88e99410e6dc265e1ed96e27ff9af36a9889f65736a1020e00692c35e3ac41ca54a688f0cfc9c61ccf0c566594048895c50ccbc656b5a97c33cc8c78192840bf6c250c532c19817f85b7faa35f6bd33d61f44d3dfd45450bece7251f73c532bc78b3e25", 0xfb}, {&(0x7f0000000340)="e6b553078b8a206730cb23d12b407abe504c28723ad00ce34b861c83ae14f56371812721022a4709b8c5fa0bae157beafcdaded3560750957c41ccc25132bbd041e4a497b0f99a597fb4303586bf64e60cd0169ad866aaef937c87a459ac261e520d4eb3a87326e458c418f6bf1e4f91510839cd9b07c9d4fdf2c0da", 0x7c}], 0x3, &(0x7f0000000a80)=[@cred={0x20, 0x1, 0x2, r2, r3, r4}, @cred={0x20, 0x1, 0x2, r5, r6, r7}, @rights={0x20, 0x1, 0x1, [r0, r0, r1]}, @cred={0x20, 0x1, 0x2, r8, r9, r10}, @rights={0x18, 0x1, 0x1, [r1]}, @cred={0x20, 0x1, 0x2, r11, r12, r13}, @cred={0x20, 0x1, 0x2, r14, r15, r16}], 0xd8, 0x4001}, {&(0x7f0000000b80)=@abs={0x1, 0x0, 0x4e24}, 0x6e, &(0x7f0000000d80)=[{&(0x7f0000000c00)="8ea9c76118c1ff7b63c69c3a5ec869057872e126ba89e8e030bc311065603e1a542998b8254b57efc0f120e94f618fd4064e3656e070d58570866895ea1d17d22764d855a184cb145a7b2f2a0db528554ab888a3cfd7da727299f27c5913ef4b84ed9bba0f69bcbc8931770d2eb8d816c60b81947e774a74372319ff30672103f153281e70609fae791c6232e878bac8c36c7b6eb912ae287a631c48313389", 0x9f}, {&(0x7f0000000cc0)="4f2548a23db3cbc22ee86474f04061e8181c6972afc4270159cac5dc30ac809fcaa6e2b09df0b36b5d6070cf6903c4c6db66cef76694ce9a9d6b0da0713e7c92aec9dd09a758a24533558064f2", 0x4d}, {&(0x7f0000000d40)="dbef9783c7ade0d5c87af9ba66fd22dbcbda584221ca3e4e547472ff6e201b755e1b68a34c1fe39391bf0c8908e4c3c8be0a98f45af4c37b434d941375337ec5", 0x40}], 0x3, &(0x7f0000001040)=[@cred={0x20, 0x1, 0x2, r17, r18, r19}, @rights={0x20, 0x1, 0x1, [r0, r1, r1]}, @rights={0x18, 0x1, 0x1, [r0, r1]}, @cred={0x20, 0x1, 0x2, r20, r21, r22}], 0x78, 0x4010}, {&(0x7f00000010c0)=@abs={0x1, 0x0, 0x4e21}, 0x6e, 0xffffffffffffffff, 0x0, &(0x7f0000001580)=[@rights={0x30, 0x1, 0x1, [r1, r0, r0, r0, r0, r0, r0, r1]}, @cred={0x20, 0x1, 0x2, r23, r24, r25}, @cred={0x20, 0x1, 0x2, r26, r27, r28}, @rights={0x20, 0x1, 0x1, [r0, r1, r0]}, @cred={0x20, 0x1, 0x2, r29, r30, r31}, @cred={0x20, 0x1, 0x2, r32, r33, r34}], 0xd0}, {&(0x7f0000001680)=@abs={0x1, 0x0, 0x4e23}, 0x6e, &(0x7f0000002bc0)=[{&(0x7f0000001700)="9e1612dd8352904a1791532e9ea21ecc0118cbe9193eb72199b20420a27a3adbde7d6ac9613eeccee02c0a148d27c899ec001e7d422825886d4193167adb5fce133e038f1f34c5a69dd4c1cb45f093c3dd77dd6df42b37a0ee9ab1c901f6f0fadc4bf9eb61819b5601fd95764785aa75c082688b976cc876a637dcc29527626d0bf1e4a49da095136b2b0be0c233b68e0e6ded8b235c31e3edb173cddbebb442ee90392710f47a286dbca859731c256bee7089d3dbb0618e29b4df3c25804d4132cb787731f7c031bd9aede375da2893655ccec87cdcce282294b7ecc01c67e6aa85b2680e6ab7fee5dcdfb5c6633b7beb9a0af94ce78f51", 0xf8}, {&(0x7f0000001800)="6ae2153e1d27967d1aba09d7b7b3d864ad2a4501cf75def10175061a3e2bec59cd2758091befdde4a5425c5f8160e7067992a2e85af753dc8631058a0cb274bec9201730ad5db5be281536821a4ce984e1aa8e50934cd8e9c36946aa659f158bdcc044679e82e0a0f2982aa35dbbdb62e6213d46c49d449576d8b4ff02c4db2cf5d5dcfa37b2160b07c940aa4dd8ab4c56e348e778d8e2ebce12547d78b44d229be4b10adf362582a8ed3ddb452c22c84da603a19b62845035f6529afc8eb9f679da9391f04cd7371ec1dfe3ff776ef0f4af4807518b1c59ae4f88d9bac5902e68c1ee228bfe5c01b3aeeb935c81f03e3c7fff18a4f7b4254543875e57", 0xfd}, {&(0x7f0000001900)="8320698e3f8951bca8abb196e014ecec4a2d6674bc46797ed39c38fcaf76afe9cbe57d48758421f15b20d802ac9c4de799046283ef03b1099dbf508dd003b43d9a4b0bc9bc8a89d1ccaeee2ee86cb0483496ffc2337cae92bf587348164ba39366effb86efa9", 0x66}, {&(0x7f0000001980)="15fa91c1f6f343297ede1069b64dcab9304f4b3c0fc0fb05615c192441070ef6b4c582e02fcef0ba1d9e75e637d0944d30efc8188f6bc2c7324316fbb7db720a02d7fb1a4d7519688b7774e856149376d425ddcae0ddebc94397fd7de75c6fb2b792a99cf9232f3eff840951", 0x6c}, {&(0x7f0000001a00)="cf8b895689365430861b12b613426fc0f64ee49c45e6d071f19b787d30f8ece72410e0ce810df4bd19283341073430db363abdafcb14ed65d99f46d57daf122597580d3fbf95f32812ca7aa8a688bff1afcb5c69ba4a63935ea50e10add253e96e38ee0125415439a7b56c492e74b5191707774f73ace36903fe8687b55695821db33e4027e06a1a2b49d41deacaf9c84cc9302bfceeb051beabf0cafbce9a5f2b732f38bcae50c06b8287f9ff469bf30c1590d1ac24163a8ea74ab710781d8e40fb3ed13454ed9811d24d4bd39cf6f8a984b3091401134c6d5683d662d3a09fdb51ad3c9b2fd951d9acf315f6c8f6062ba0778299a643c40d068a5c9bc17cd24866b6946d782618051af9bcbb687ebc2b0f36d72e3583aa14ce038a8ef52e3ed24bcb5d5093086c55a2a557b3557a95d561ec25faa3d541641cc9cfa48b8466d289d5ba3d850a67406d31372254e731e6773c0cb62e86e7d85ad2cc33c2e26d4038a4172f4a79cb554cc7990f0ad4079859cc4a82157f90b8a7ce1040e29afb5d9e65cf947f12668a6d8dc51006133d2ecf491f5414cdb44891bd91646348cc6485c5dfa1acd87b363cf4664f1dc0f67f0475dcd50a96eac5cd0576fcb15039b25da360d46062b185997006419a49e93c2e2a263ee59c222e119480c7812eb5501dcdc955b8957a3c69dd727fc0890cb4d6e26e338f7303d0b7bd5ccc4492b0377aecb4915aa24825691fae9da3d073860de896c33c68e135a38fe0f48bfccced1bd84e669af84bdd57e5fe416a683940aa47e6abc5ac71f8cc168daec8e9f169fa3fb606d88e9e85fc1a46b600fb361e643271b361b54866c57683aad6b7b6bd70cec5420b5e0c03ea10e50fa383d8bc25d4eafd00bc6a66cec9f792fbf1f81878274d5877d398b8ebe8d54571bed1351a4d31e382e5ec06d1430a75232bab963b0e08b4483cdf7fc33a641a2454f897c1ee7f2a043f3620444da238a3062e2f6e059a1d29433d9f321634ebb2ca67412aad170cb8ca65af0b21265dd61d679c7b6e5106a9ffc76c032f7e4bc04a7b7e8048cab8060954252c33d9401a20b580e40f9f1d8450de8558b1bda368389fc6c74b98d8a79430f06f213026bb31106fc4de1deab0d47ab383ee637cea83a651a024ed507ae765a1602d47d2e109448aeee7e3168417861debe20d56a5cf1491e07cd95c4a9c9ca51058b60833d2439dd4f8a0e9da79ba62608131ec2893e3c6f347fdfbc5b573db06759fdb3de155238883247d066c110c0c257d4d0d90c75a049e22f02db938b581ba8d61cad8915b0ad58bb7eee9255a3808655e5c551223d248c5363a2f143a518f6d27fc9295303cd81ecaa3d09583e8dd5dac0caa9e87fbb888b09cbafce56e43571685ad2805a7f941961f1f55d33dd1312c70144c37e69ac365d35d4859299494e2938dae004360e976908140901a9283f60111a0b9f5c0e4a9b36e16ac8bcfae6ef3a1ebfc6a2820f93b5919ca617662cb70a46e3e99ea1d0287d3038b4704b5e5ab9fd4c31e6a7aa5e6f423ce7fd2ad085ceebe1a6d5d1a728987e73eda48af52e955078f7e950e33fe93c106c4bef659d8a75850866bbbdc52bbaf5df24076bde9f480fe9e42ad97f31092cac005b609437722ff6a6e2ee92a7764dd239ad44636fefac19abaa5fa7fcc3f34d0c8718d5c00f6f68d7c89ec6c364fead0bbb33c15131282f1988ad0954733ff4b379f11aad44ebb0426d61e860d37634de070589e05c217ae481000843572e8ce4488c9d557e34353d8dcc37b0c262716474655581baa8845ee4f0ba2b3dd0b938eaeb8378c256fefc38aeeb6c7a284ddbdcb26fd2f410ebf90de0eedf10e48c3bfbb60395be215a98134d9c4a00924eb87d339e8d841e9adebf1c6024e3f06bbc64f762f271e540be92280af3a1a4f025813c829116ea22a0d7a9fc2680c40ef98ec178a881ccedb176eb6c72f833127f5e5b18ae8161d2fa3566cb1cd6f324c56bd60418f4621228b93277f59b2f3f808d79813870110e74d85b300b0954fc030f079154b90db3e7317ef971b714f8d86d0a5609f9ecbef2e6663662799af6c02a8dbcff8da05c9ee94508608223a74eb12ddf200f8d73e28a4dc8a971a4489cb2e7de96660c7b5d1393ebabcebf4a25ba552a266b2ed18de90caada1665e2f7ca6a2aa6a3e7dd00b25893bb7ee2f9b00b5ab4accbc61480d8d2ebe4b4b8b623a6ad8d19bb63cc747417bc9e9d67c8b1bd5410e6160890eeb1854f8197446f51db4434d350f27847151c5244aa8699b4fa9e204dd2762b5f55fb302f0cb34e2854f14dac9cb64630eb62d0dd814970f9e06e0b8758587f7fc10a90fe0f9e4a789c05655f927af084ca6dd40b559b736023b69001553648b9c31791ba22731c5a6113386d1a26f6d02c00f3ae8ee70986f83d9cf1cdb0e704ca615825921360e83dfa94cb9f02436ab0bb91f15858cf0e2bf91d050f678487786876119d3e23f2bf55654150063466d12cf54ef753ede5d11647be427fa815acbb80af9f1bbbc14e90253985c406aa1cbfc01fd8c371ae3b8bbb6bced30165bdbbbd16eb63a663b11607f9987c0881e2b143cf6ae996bd29308dd94b36585d848c6b13bd1a4c114e4ab98f1a4b462ebaf93601e408a8d3c720d5ff8bd5516d37cf47901563bf74a08e06e294d172540e3167ba475a9f1adac4c441bd88af5411da31f1c21d856cafe3f3b9b8b2e082bd5d44a1804e56b7ac2a92f97e3d59bf912a82c7fbb147d85786a901f6a5f4eae1ce1b436f22a8ad96e3a45f573cc7ce7a183774728de0884860d62ecebb625de026d44058a482bf4346a9262d61fc78c18bd868e48d1e3ae43012116721904dc9e05e0130ccceb17c308de5625e7b1cb20127fea3e356ecfd727b00cbf666d984a63d37c497e418dba4aa1f1644b6ed00532239badf839c2be88b490c2b71eaaab62c4f3a82b25791804607870c6e92dfab6ac563a386499507d6e3d5b6837be1602839c307400676686114adfbc93f2b65c35c77d700633de1c789e768d603c5db8ab6730f23cadf552ac2b8b9624b36ea262c630d7e45c867de8fb58a0d237bde68df599acf32c0b0ca09b25991a2080cdeebe5efa0220be10de3fbe6746ecbf36f3d4e8576426687c48b7811f54ae621ed27f6ad5b0d9ee49041159d6db3315af5c8cdf387c0e643f83e773e2b23688114d3ee932d2ec4b8a63b912df6c6d6a5872df457fd31e174416747bfeb63655baa80845d272fc4a4ad980c593e971da5bfb6e5ad7a4f2a9a6448b1a30b214aeccbcf5b258012136060392169bf67a892448a8289ddbf9548fd9ab090b2ea5320d7b98d6e8561acf6c1960dbb734fbfc4fa52294189575fecc629638ddc3037621fc7457ed89e969ba1f6e8a495e5eefb759c1fe9753bfef95d965cf8ce83cf82e2662a2972d4e0e75ec34ec14b450c8aa98115f9baa776464129b61dd781bfd6e225e9a5ac1d7d7a4fe454f8785c9b4e1ec2e48eb37752d1e099b95d53ac3e038384910dfa16c07d7a696cfa66038c4ddc347285c835c253364dc9c4f18f9d734cb7d6436037b4e9fda0e167b0e880bd22a522455ac95957a21468fadd97e1696d72ef4c3044b89a76381d3c9add3180af19b33cface136903f4d4d427b8af452a3234d635b2bff0b922f42400fb581f3d1463edd4c368bc869dab2dd280e3710b3907a0b4c1efa76a64bc40de7cdaa13208764c1ff1923aec23f488c82540e7c39e45703e76c9dafd821fda6750d664a9d46f3997a43330aac83baf9196390135306ba375a1247a3259b1cee36949ebc21cf8dc81045526eed5cfbd541af067401d249c435fbf5d3a26d04989c8f1d800a53d39ac1275ee9eedd01e27a3b26e9a8699f4f1e1691a5bd7f29f511987b8ca0693b4c8d97bfb302312cf35aceda26a4f41f0cb809da0e2ebc7d6e86d5df642a642a58630e88ee3bffa8309c8f56f990884d26756ba674bae0aed59a98b5096bbf8558ea6dc8d15fe4a128770ff2ea895c70e3a99a2a3aa199242875903a50de835bca72c06a83f20612f57797c7cf32bb7810ca98c0ef827bb91e4b9267a9eff90f4d29636211eb224a7a443d88531b665ad6bd4a64fc2f88d231fd5db009eb94bbfcf59113e13af252afba24da223f4f9ff5bab149379dc21eb173a388d8bc7ba49531afa2214e2ea74a9368a11954f8b7e3e2e0b26ccfc8142fd13effac9695ebde3933c7576ada4ac79b13b11af562405c842ae27e57792660416af37faba601f30f0eab6b0a8c0b123209c6a2ee4300689a9b0dabe8ee46e14322787337038fc9841d6deda98f9af589834402c3c4beeb303bb286348b872df951704228d973849ba28aaf104fb5e8987bd1ee527b9f27c5f1446f682e8b01603cecb532b2b9f340cfce8e173de83c214cc505cd43ba5e45c06044910882217d8269f121561125a65f12e2361129929d62293ed7e4bd1499b20bc692bfecf74e5d4779ee4f3606b7f3daa3497cca4dbcf2af542c38f71728f59ca6117d3361653b18ab697e2dec2b467ab2124fa046c0abb43b693686f0b42b25486c133c8e173e7bc2a1b9b9b7fd058f74ac18559784dfba3890ee99d34bd6e39f796780c0d5015d4f60e8fbbb9fb7358e01127240c3d27d468665de5b0557b1d007277a42a6d0c6e8717b0b11aded0afa08e4c487914a977a4680c7c5c57af10f5aad273785a7044f56965f80128e24a163356e02691f3b18acc829929a2d48472e3944c781140771578ec82dbe84a547a19522e5cf3b6390a951be72fd1bddfc4b94ac6e1201b1f069f79b1e6dceaf9b4439391eb0d37cf9796f7d86914cd4ccc2e4e7c32b526b95fd5d3ca78162846aaa33e764064048d0d55e33dfa1e22e7c3d6ea540def6438ed7880369d892788fac2472aaf82c0b4a67e28ff784ec35fd2ecb6decd92754a4347884b053173c106bb68e80cb9f919728fb8f76016102befd7e4952f434e8a6cc4ceb8f645eb81d92cb173ae5af249d9fffdeb56ce9efd25020c3e6e44bab3ac12afb0f0aa77800feae710dab47ea1be0295fedf2605adac31d1395c690f62d10315f01f88cd15ce9a575c24a37c2f9b196f3e3abf50c7c1a8a95b06c5c9fe6bfaebb38a0459952d43a4b77d147b6f5b458f663c8cc308e36e776660848af9b94391b438f6a08878be58a36f2570475b428e3cb592054e327cc6732702016a5d3edf319291bfce41b78cd803efc40be109d840199c5d1ed99353448a0f3f67a828e5273af6f7045ba25aac78da4fb11d292e7492a38d70a982e45ef2d621e2da07808355796ce6b0f575e0a4e03652c88f28c1d635fddcfcf57addcde121980e75f02476adc054c3bc7cc0645a48915dfc46413850104c99bc52d7d76fd5b8d1ccceb09fbe79b0122f167849198871471471baf3b30f0e5143a3c894c27098bd499e15df382d506f219b4977581c9871ca904aad8dc2b4bc36a664bc4a88622e2ac51929be0830e8f8dca5982eaa2254c9d09c08f5216a07a4e7df247982f2871c06aa451d2c73972fa6f08b09fc3f51b5cfee0bd817a6335b31d0fdef6a65a0c14a9f55a7ec1b81995ced052ab39c36dfc808e4771632a1e60404e94456d984dd9ca43863f0c7382bb1b04830384a0cb41004f8e8c6bbcda6694bdc93e9465096db05517d9d41c43d14df5c3a95b979c1dff99822c639050f61a895dba986389c49a0e80e7c98802b7bbb41d26e3eede1a3ea329995942bae108abfd8832619ee22d3ca6fd90b0ed0d70", 0x1000}, {&(0x7f0000002a00)="47c36fabc470f531e4cacd8fdd41abe63cbc8df5f76fc778415b9ba2bb0829ddbe32876410e2bff640d2853c6ca8cc5e2795d40839690890fabe16dba54cfae8462522c062be7b8ab3d42f5373aea52d24635047ac14680753144eec5c283932b40f52d1ae5c05abac8a5686903598a7ccd3277b5ef76c8edd6409aa766746a0ef", 0x81}, {&(0x7f0000002ac0)="f754eb67fbdc42af463b2cf192f871283421d4e0c437656ad712954b3b22f0433c920fb7ce435af922234d329e19d9e68590b99714f7a2649d8614ceb4498eec390a756bbdfbe8ab04bd16da4e2f85903629b57e107f091d7759859e78a9010ec633d451d563bd37ff5ba713a0667c318dee129adf136865a8954ff99904f3862b58747e0729de33fd9d88c8aee83b78e01c06c49cf3212b9a2b441112c4ae1a125acea44711b2497f991a425ea69189ab7bbfc5427c9a5242b14d5674065a381cbe6a0c5a958443581b49567662f20eca5da5178cd5c597d705462c4295ab6bf7e84559ec674f8b75a84f43be88a9332ea1dedab29ea40a1e05b6612fe97c", 0xff}], 0x7, &(0x7f0000002c40)=[@cred={0x20, 0x1, 0x2, r35, r36, r37}, @rights={0x18, 0x1, 0x1, [r0, r0]}, @rights={0x28, 0x1, 0x1, [r1, r1, r1, r1, r0]}, @rights={0x20, 0x1, 0x1, [r0, r1, r1]}, @rights={0x10}], 0x90, 0x40000}, {&(0x7f0000002d00)=@abs={0x1, 0x0, 0x4e23}, 0x6e, &(0x7f00000032c0)=[{&(0x7f0000002d80)="33fa49abbf747b7cba28c05d37e2948837", 0x11}, {&(0x7f0000002dc0)="b77b56694f9dbc2b051e7d9b19a92ee0496c0c9ef336c582cb524d73e0c5571fd83c835f2cb36ba87c801c7b7e57b97afc2372d4e45ea372a4db4232489a4bfa2c28c147e45f4b063b1262486a54ede93bb5f8e5dc759c8948289242972c4ac86dfe9cbffe313cc0d02dd5141808fd5da2fd3f3a80b712e88874c2bcfabd48a2f469029d9119e50db77ebf8e89e15965a2", 0x91}, {&(0x7f0000002e80)="83e9cf8ba3dabe6086b4880a0b939f860e7645ecb916ed981fac38da10b3eb64ddf703f1b6952ec7cd56f07d73bcf02355f2e69265010e1de843a5ddddbbadf64b326826429052cbc6ffce2be20a96525ed5c67e91b7ed39126147c6ceff9a7a8ee34f35d4d032d1ef9703f42126ba1b6c121ac0558ccdfb83146586d7f3a848fc470fe55f26f35d60510e99b85b0157da162709bf5e62044124205041fb89b5fe458d522d0d3ab38f76f91d17823740882ded8facaf50aeef4483f6fee93f9b9613e5db3c64c7e159e95d0a61943b965e8576aa4f7cfce417fbea81c7c9a6b06064ad6d4dbf4070f32b70", 0xeb}, {&(0x7f0000002f80)="4d38d485ab9914e0e941c3249c7ba092f1ca4b7a555dedd385832b7d0385ffce1c95fd4798e99efea963a89767d289a4ade2e4b408cf98", 0x37}, {&(0x7f0000002fc0)="da9c478a1dc10041d8e4513b0d74ff3a2263da34d58f064799b7e4f45cc3a626aabd093cb5e202da38e1ded41e2ad5abb82e4e59a08b5ada10e77efaad3296c8ecb10551e4d4b6fcaa78607b5b0ba4caab906673ea5c3687df3e165d52e8c03c710e7e728ea0197760dbdd8acf239addde9fd7f1f5d806c7cc88f981f24cc438f58261ea5214be9adeb9bb66186f1e6daed821b89193fff269498b2571403788d2c6d63b7255538e39523eeafaba00e18a88", 0xb2}, {&(0x7f0000003080)="6d332fcd240842fd9df0dda96f1ac3bd4b29d263cc0c2aee6a3abec7aca66d85780b319777f75074571231dc0f1ec8a461d9d62a96809070501cf0d818673e3af7b4f90b9ad0e01230414190f260d5d12664ac132174d9fc6e49eebad8f9e9875dfb80f8ebcdd9b0d030faf86b06ce9ed82c98607fc5", 0x76}, {&(0x7f0000003100)="5230080323ac1538cd85c4086c81afdc8b5c60403859ec4012685056", 0x1c}, {&(0x7f0000003140)="9bcbb674248c1504cf3894f4ad691611", 0x10}, {&(0x7f0000003180)="219b0dda30db808c7ac5d07b5e6106a97f17eb5b2d3c9664aac8021f1a21ee61dcadcabafb8b2a659c92078a39e086d69a3c4830eaed8f4d7d2def8f364b400e05b1cd43df4cae6c048309e1b13f3bbb9c384cad2e1b9e4fd649379d10ed1860339821820378c40e45f52dc7a15fa23101c9", 0x72}, {&(0x7f0000003200)="47002818f11e3a37281eca35c1cabdf0bdb9945e8506a3ffc505027660061db2e3fd70e90f72bcf5383175d93623c8d3768e127f8145205d0e15593c7a74289f77d6c510c18fc2983cdf3c1a2b3b0021d495d005a484e1ba9911f41e94e6a66190a37812b6ddb36ff9a07ead0b89227a31cecbcc5cf20a7f584033f3c813c2fe9a22f71d59256d6de54da652bbaea9d70511117846e9768b10c4f5d5fbd0e36936221a445eb92d3f0587b0678954a03e2f17cf45889c204af0cda68f2b066b", 0xbf}], 0xa, &(0x7f0000003900)=[@rights={0x20, 0x1, 0x1, [r0, r1, r0]}, @rights={0x28, 0x1, 0x1, [r0, r0, r1, r1, r1, r0]}, @cred={0x20, 0x1, 0x2, r38, r39, r40}, @rights={0x18, 0x1, 0x1, [r1, r0]}, @cred={0x20, 0x1, 0x2, r41, r42, r43}, @rights={0x30, 0x1, 0x1, [r0, r1, r1, r1, r1, r0, r0]}, @cred={0x20, 0x1, 0x2, r44, r45, r46}, @cred={0x20, 0x1, 0x2, r47, r48, r49}], 0x110, 0x8000}, {&(0x7f0000003a40)=@file={0x1, './file0\x00'}, 0x6e, &(0x7f0000003c80)=[{&(0x7f0000003ac0)="22dbb6d3087e4ca53606d38609fd461f9946bc0bbc60dbca6fbc95ce839909fa2d4991358fb48a3569d90cb5dbd8b2094cfd", 0x32}, {&(0x7f0000003b00)="e7c885f3ab58bfb69021539d4f88851d9714b693fd3d35dee72ef4bad36d4d3787ac46559221a24e537b963fbdd0", 0x2e}, {&(0x7f0000003b40)="b576d817e4ad3dc72dd3ee29b00ca7a4cac585a2846fdc239dcab0019b3c33d4fc939e00ffca5f0dd1628e81ea649c7e6f9b59a9ff5bb5a7e7cb5cb71ff3ea1016faca9411554980fac50b5a90564c541f26e112fa15eb51644e65a1607fed8988b3fd7974f1622baf5823a64a9c3168b47e887e32c165b24ea1f3be3ecf414d0a5b106f06ab4fdd814f3c853502c3afbadc1d3aa941aa5baabe9a135119d54b997c3d5bc02857f7a854ca5fbbf3ee34b94cc60b9ca38bae8128da3357b02a5147812bff5f", 0xc5}, {&(0x7f0000003c40)="77bc6a26e90fe39a3dacaf9ba7d78237cabc89a43d0940f7fa8a838ece50dc10b68ec0829d2ed8d946be8e980e4eae24d1a57fcb9763223258", 0x39}], 0x4, 0x0, 0x0, 0x20004000}, {&(0x7f0000003cc0)=@abs={0x1, 0x0, 0x4e22}, 0x6e, &(0x7f0000004300)=[{&(0x7f0000003d40)="c5644d1ddff6569bd2ab350cdb09bfbcf7b0528780a90ec5d3622a983fea398f3db61bfd6997d60308a3273c707d8d06d0874395ce33cdbd04baf14813281080fc540186b624875657de3681eb528bac2ac88563cb39f733513d9b237b5a53d33583e5017a3c173f88e210ce782e569e4f5dc7852b0b16988ee983ce15e13d6d77d7eec6329ff100678d551225df0577311fed7ce8ff10e22c8acbef06a5fab975e227819d5b62ddaecc7ac5f311c9eb89a27a61a7fe45b467afd28a66662d1d7380c5c0f70f62a6f8e402c7dec6813d2074cef7493d0e2e9495de74e7d504696e42d96a7756a6ad247e7cc5611e184bf444", 0xf2}, {&(0x7f0000003e40)="d754c4fdfcc74c455b38d5efa83af2687ad4350cb98330c0bd0a8ca4cfb04af32b253e64579ee1659ac050de4a4da11005c7a5da8af527d574c821be", 0x3c}, {&(0x7f0000003e80)="6bb6cf5eb04ff9b95d12cbe08167c70165ea2e92727a93092dc065d7add0432b36c2cc2b201d63d9065b2faf4af57986fe076ccc30e4dc9c2345b960a5981267ecdfd995af243cbaced3e3fd861bb97fa51ef527ae89b418e06b2bbe683ce3485788eb451f8e6e680c3acb57dc80858edc68ec9a6be0874563f8072668cd06cdcc3a8ccb912c55f8f8b5767c3a2a96399f763f93bfc3bf419011b50b9fc2bc4af5f9d31261d5023c701f71dce8de0fe14863135ac810d33a34102dfb12c30d39256b44da667145886205aac6cd1c1e9e43ec01a50b7f28c7ab543c714dac1361dc775d6e73b9691fd7974042566158", 0xef}, {&(0x7f0000003f80)="6b1d38eedb2dafb577d0076c0bd03f3fdda0eb98188d352423edf263b13c86ced901b640ff866e99f879ed2a3d0b45e56db2acc92f9c38e1b32b3cfbed22228d5e9ed656293fe2c518265f9c7df92f0ccc402e5a7d1b865dd5f716c0957bffc2e2e139d760ac375bdab385c9b088b273dbfae1a0d1c741f0eb27136ac3996ddede4323550f5aba97e7f62061e450c8d49b3ed8070303a0b6cc3daa4ecf810ae37a15ada2fbcd274e54c6d902b0c144b60ece7c4391d523ce7f2ce38d89efe9e6f93a9fb6e7271c7697a2fbd55bf8e1594540e494ffd9df2fcaa2de3944ab958748f3a6e036399a2cf13369487dc59c88a16955de098e2dd871aff212", 0xfc}, {&(0x7f0000004080)="3f1e5653758147e558d560b72558a292972bffb21763c302b31ee512e0d68327e5ec021f685e7aac4d7017315d4fed13db93d7fe7e8c45e1a76fe821281da585191b7a6c2ff9ef59436e57fbec46e14d47ccc2f675388edaa215f671ad3e8dfff6b2a6ca238253904f7e932887b00032ce", 0x71}, {0xfffffffffffffffe}, {&(0x7f0000004100)="bebf033c5c1a4cca1573e0064d7575a9ff87a6c899f85695fa5b390aff60872e15b5e94631eb99e7e25835a0cc22b4a327485a1771d5bcb6bb60e3792a39ea5cc9a10a4bdae1938156df3addbd57305c71404e8ce769c6d5e077d52c18c80e1ef362e7cd732381643860cef4b0206cd962d2e7553370e40611e52252d91ffcd92fee11a82c5eff811d3cdc1c612c1420", 0x90}, {&(0x7f00000041c0)="e41171ae5c61044451802b55b1f1675635bd3fc607a106a5f1f40f855297d32faf31a8201afbee6cbf537364f1c18056143e3450fb92da15819f56274537991e19bc943489f91de3888e34d54ed1879a85c5b95341ceddb96405b1d1a2e74351721c627d7e7dccdd979d3fe3b1b777b33c70f7dac437cf0bd0d7d230b9ff57b77c2a86585710fbe093b217a411e2e13ad20494e579b788bad8e15689c711dacd10a6ce689317ef2575cf27a0d02a841e512d326b37b57d42c5b2019a9793257bbed0a4911c33c9bb35bf5d29f89d622b76a0522c5f43bf56194f6ed768d98b49ddedd5", 0xe3}, {&(0x7f00000042c0)="0cfc0cccb7246f7a199e24ff813f6511f46037007b1ac9007e43d7822e0fc1c6d44baa98a5bee943681f0fc7", 0x2c}], 0x9, &(0x7f00000043c0)=[@rights={0x30, 0x1, 0x1, [r0, r0, r0, r1, r1, r0, r0, r1]}, @rights={0x28, 0x1, 0x1, [r0, r1, r0, r0, r0, r1]}], 0x58, 0x20000040}], 0x7, 0x800) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) mknod(&(0x7f0000000100)='./file0\x00', 0x1040, 0x0) open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) open$dir(&(0x7f00000000c0)='./file0\x00', 0x185840, 0x0) [ 372.384993] binder: release 16306:16321 transaction 298 out, still active [ 372.392207] binder: undelivered TRANSACTION_COMPLETE [ 372.397546] binder: send failed reply for transaction 298, target dead 20:30:18 executing program 3: r0 = socket$inet(0x2, 0x4000000000000001, 0x0) ioctl$int_in(r0, 0x5452, &(0x7f0000000100)=0x5) setsockopt$inet_tcp_TCP_CONGESTION(r0, 0x6, 0xd, &(0x7f00000000c0)='reno\x00', 0x5) r1 = creat(&(0x7f0000000000)='./file0\x00', 0x80) write$selinux_access(r1, &(0x7f0000000040)={'system_u:object_r:systemd_logind_sessions_t:s0', 0x20, '/sbin/dhclient', 0x20, 0x3}, 0x53) sendto$inet(r0, &(0x7f0000a88f88), 0xfffffffffffffe6e, 0x20000000, &(0x7f0000e68000)={0x2, 0x0, @local}, 0x10) 20:30:18 executing program 2: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000a40)={&(0x7f0000000040), 0xc, &(0x7f0000000a00)={&(0x7f00000005c0)=ANY=[@ANYBLOB="3c01000010000502000000000000000000000000000000000000000000000000ac1414aa00000000000000000000000000000000000000000000000000000000", @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="00000000000000000000000010000001000000002b000000ac1414aa00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000a00000000000000000000004c0014007368613338342d617678000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000c996"], 0x13c}}, 0x0) 20:30:18 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$FS_IOC_SETVERSION(r0, 0x40087602, &(0x7f00000001c0)) r1 = syz_open_dev$binder(&(0x7f0000000640)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000000)=[@enter_looper], 0x1, 0x0, &(0x7f0000000040)='+'}) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x0, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0x0, 0x0, &(0x7f0000000780)}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000380)={0x8, 0x0, &(0x7f0000000500)=[@release={0x40046306, 0x1}], 0x0, 0x0, &(0x7f0000000400)}) [ 372.488090] binder: 16375:16379 ioctl 40087602 200001c0 returned -22 [ 372.553371] binder: 16375:16384 BC_INCREFS_DONE u0000000000000000 no match [ 372.561230] binder: 16375:16384 Release 1 refcount change on invalid ref 1 ret -22 20:30:18 executing program 0: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r0, &(0x7f0000000100)={0xa, 0x4e22, 0x0, @empty, 0x4}, 0x1c) writev(0xffffffffffffffff, &(0x7f0000002980), 0x0) r1 = socket$inet6(0x10, 0x3, 0x0) sendmsg(r1, &(0x7f0000002fc8)={&(0x7f0000000000)=@nl, 0x80, &(0x7f0000002000)=[{&(0x7f0000000340)="5500000018007f5300fe01b2a4a280930a06000000a84308910000003900090008000c00010000001900150006000000000000dc1338d54400009b84136ef75afb83de448daa7227c43ab8220000060cec4fab6513", 0x55}], 0x1, &(0x7f0000000400), 0x0, 0x4}, 0x0) ioctl$EXT4_IOC_GROUP_EXTEND(0xffffffffffffffff, 0x40046607, &(0x7f0000000400)) listen(r0, 0x7c) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) mkdirat$cgroup(0xffffffffffffffff, &(0x7f0000000140)='syz1\x00', 0x1ff) r3 = memfd_create(&(0x7f0000000180)="0004003100", 0x0) ioctl$sock_SIOCGPGRP(r3, 0x8904, &(0x7f00000000c0)=0x0) syz_open_procfs(r4, &(0x7f0000000300)='net/ip_tables_names\x00') write$P9_RFSYNC(r3, &(0x7f0000000240)={0x7, 0x33, 0x1}, 0xfffffffffffffe2d) sendto$inet6(r2, &(0x7f0000000380), 0x0, 0x20000004, &(0x7f000031e000)={0xa, 0x4e22, 0x0, @ipv4}, 0x1c) openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000b80)="2e2f6367726f75702f73797a3100b8458a1392623c2acc07743172c163cfc71523709c3289acba6eaf2919f32ebaa4cbe89ed30167d7d56e8e65c0edbb300c9e287f10f513e776522729d5c85c09fed3f33ea055b94d27bb72a2bb9fd56015f25cf4f9ced65ed81253cfba08e9a329935ac0c64d10a5e701cc58fe4af8cb5b679468e8ad39e103e2d5b7d9078c34eb2832a5852b28958b7efeca8ffc69c09a7ca33d82e59f9e27ea25a7cf5e65bc52987952070ddac3929791a23f905fbd72419d1539", 0x200002, 0x0) fchdir(0xffffffffffffffff) r5 = creat(&(0x7f00000005c0)='./bus\x00', 0x0) r6 = open(&(0x7f0000000540)='./bus\x00', 0x141042, 0x0) write$selinux_context(r6, &(0x7f0000000000)='system_u:object_r:crontab_exec_t:s0\x00', 0xfffffffffffffe84) r7 = creat(&(0x7f00000003c0)='./bus\x00', 0x2) r8 = openat$null(0xffffffffffffff9c, &(0x7f00000004c0)='/dev/null\x00', 0x2807fd, 0x0) write(r8, &(0x7f0000000380), 0x0) write$cgroup_type(r5, &(0x7f0000000200)='threaded\x00', 0xfffffeb3) getsockopt$IP6T_SO_GET_ENTRIES(r0, 0x29, 0x41, &(0x7f0000000c80)=ANY=[@ANYBLOB="73656375726974796d0000000000000000000000000000000000000000000000c40000004e8b4b1c7fa37c911d43b7dfc1540065e2cf063a33e71b903574450eb6fcc611bb94c232461f22877f4a6bfa2e09f7f448f8a2ef823ff78d796ab6ab52f030b8fea1243b4a37836d690100843a8998fea04a2bc474078acbb61c426c93824178b70a4bcff2d634050eca0d4f941bfec0542fd99b2bd8823b4175d0b0e455f170e292c18a967fdc58383f9af93bc9c8b8578b5ed8ba7d2084ab94919aea43e1a3acfd6d899d943862ca8d84436629d2159976a615f1279aaf23ce57319edb9be03d5b849777d956c09bcb8bc5eb1d793fe7b7d0c34d4d6cc6d28cb9f66b0a2f31eda0ce948210375abcde9320750390dc04b3af4959443184210eb68c4fe6dced7e44cd2b39f7d25dc53dab0fd596852191868741cecd379b6e87b1c1a8c0dc6b8004595fb61135ed10927d6df243071d53b4757c13f4ceb4480e4a7b9c730be6258db763d9e9e7baeccd140ed2311fd9c570db36e93131c27442990068d315088680ab638288fb05b1676a9ab2fe9aa99539a1cfbb1ae8b35cd18007ba5105ed92f8914bcc2397da080dd1da393ede4f195953f82d03b9a920391ee4f5bd7485d69e1d8bfc93521ea451a20dd056bd3c133aa93c9bef1e254ad7d19379b21be984d93cc7cfcbffc82708aebe5fe4c4aa7af905248de89163041c16cfdaf96ee5b65715c7bb840274ba8ddc979ae077aa20b5ba0e97ecd80abb2d3cdb2d2b6603b3a003871b7220d71909f230fa5e9a7307c10c954a2ff1c6bf5fe3e153c0ebeb4940c365ef1e9cc8588a51bfc9807e866ea6528a77c930c06eb50e3f14ca8abf929570c05ca0615211cdcce3d034946d4fadcc9df5702fca33cb322c27a54fee8cd7901df1066311b737259dfc65048bcff6eca8f566ed75b5d21b58a3c51907ba6d5ef9e04e24febdea1d345b16288065bf64cf9fa3a746185191dc7b2f4520fd2da2f60434395d6121d7063a6455be070f49e04c8c2fa0da58d878d80a1bf9cc58b6926e3c471cb1e79cb85f6ce2ad91ac6c68f955a507ad55f514d131e0a095329227c9888f9fb19bfe6df77dff07ef08544a33e9f10d72e3ca6a0d70bf0d4b3e607a2238db2aa9c1011d0af4a39786e48004427b8b55fcd1f7ad63a9aa5338475975159310e0e40000000000000000000000000000000000000000000000000000"], &(0x7f00000002c0)=0x1) recvfrom$inet6(r2, &(0x7f0000001840)=""/31, 0xfffffe0e, 0x100, &(0x7f0000001880)={0xa, 0x0, 0xffff}, 0x1c) getsockopt$inet_mreqn(r7, 0x0, 0x23, &(0x7f0000000500)={@multicast1, @multicast1, 0x0}, &(0x7f0000000440)=0xc) setsockopt$inet6_IPV6_PKTINFO(r5, 0x29, 0x32, &(0x7f0000000580)={@remote, r9}, 0x14) r10 = accept4(r0, 0x0, &(0x7f0000000000)=0xfffffffffffffefa, 0x0) sendto$inet6(r10, &(0x7f00000000c0), 0xfffffffffffffe2b, 0x0, 0x0, 0x0) 20:30:18 executing program 2: setsockopt$netlink_NETLINK_DROP_MEMBERSHIP(0xffffffffffffffff, 0x10e, 0x2, &(0x7f0000000080)=0x10, 0x4) 20:30:18 executing program 2: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r0, &(0x7f0000000100)={0xa, 0x4e22, 0x0, @empty, 0x4}, 0x1c) writev(0xffffffffffffffff, &(0x7f0000002980), 0x0) r1 = socket$inet6(0x10, 0x3, 0x0) sendmsg(r1, &(0x7f0000002fc8)={&(0x7f0000000000)=@nl, 0x80, &(0x7f0000002000)=[{&(0x7f0000000340)="5500000018007f5300fe01b2a4a280930a06000000a84308910000003900090008000c00010000001900150006000000000000dc1338d54400009b84136ef75afb83de448daa7227c43ab8220000060cec4fab6513", 0x55}], 0x1, &(0x7f0000000400), 0x0, 0x4}, 0x0) ioctl$EXT4_IOC_GROUP_EXTEND(0xffffffffffffffff, 0x40046607, &(0x7f0000000400)) listen(r0, 0x7c) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) mkdirat$cgroup(0xffffffffffffffff, &(0x7f0000000140)='syz1\x00', 0x1ff) r3 = memfd_create(&(0x7f0000000600)="0004003100", 0x4) ioctl$sock_SIOCGPGRP(r3, 0x8904, &(0x7f00000000c0)=0x0) syz_open_procfs(r4, &(0x7f0000000300)='net/ip_tables_names\x00') write$P9_RFSYNC(r3, &(0x7f0000000240)={0x7, 0x33, 0x1}, 0xfffffffffffffe2d) sendto$inet6(r2, &(0x7f0000000380), 0x0, 0x20000004, &(0x7f000031e000)={0xa, 0x4e22, 0x0, @ipv4}, 0x1c) openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000b80)="2e2f6367726f75702f73797a3100b8458a1392623c2acc07743172c163cfc71523709c3289acba6eaf2919f32ebaa4cbe89ed30167d7d56e8e65c0edbb300c9e287f10f513e776522729d5c85c09fed3f33ea055b94d27bb72a2bb9fd56015f25cf4f9ced65ed81253cfba08e9a329935ac0c64d10a5e701cc58fe4af8cb5b679468e8ad39e103e2d5b7d9078c34eb2832a5852b28958b7efeca8ffc69c09a7ca33d82e59f9e27ea25a7cf5e65bc52987952070ddac3929791a23f905fbd72419d1539", 0x200002, 0x0) fchdir(0xffffffffffffffff) r5 = creat(&(0x7f00000005c0)='./bus\x00', 0x0) r6 = open(&(0x7f0000000540)='./bus\x00', 0x141042, 0x0) sigaltstack(&(0x7f0000ffe000/0x1000)=nil, &(0x7f0000000480)) write$selinux_context(r6, &(0x7f0000000000)='system_u:object_r:crontab_exec_t:s0\x00', 0xfffffffffffffe84) r7 = creat(&(0x7f00000003c0)='./bus\x00', 0x2) r8 = openat$null(0xffffffffffffff9c, &(0x7f00000004c0)='/dev/null\x00', 0x2807fd, 0x0) write(r8, &(0x7f0000000380), 0x0) write$cgroup_type(r5, &(0x7f0000000200)='threaded\x00', 0xfffffeb3) select(0x40, &(0x7f0000000040), &(0x7f0000000080)={0x0, 0x0, 0x0, 0xffffffffffffffff}, &(0x7f00000001c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2}, &(0x7f0000000280)={0x77359400}) getsockopt$IP6T_SO_GET_ENTRIES(r0, 0x29, 0x41, &(0x7f0000000c80)=ANY=[@ANYBLOB="73656375726974796d0000000000000000000000000000000000000000000000c40000004e8b4b1c7fa37c911d43b7dfc1540065e2cf063a33e71b903574020eb6fcc611bb94c232461f22877f4a6bfa2e09f7f448f8a2ef823ff78d796ab6ab52f030b8fea1243b4a37836d690100843a8998fea04a2bc474078acbb61c426c93824178b70a4bcff2d634050eca0d4f941bfec0542fd99b2bd8823b4175d0b0e455f170e292c18a967fdc58383f9af93bc9c8b8578b5ed8ba7d2084ab94919aea43e1a3acfd6d899d943862ca8d84436629d2159976a615f1279aaf23ce57319edb9be03d5b849777d956c09bcb8bc5eb1d793fe7b7d0c34d4d6cc6d28cb9f66b0a2f31eda0ce948210375abcde9320750390dc04b3af4959443184210eb68c4fe6dced7e44cd2b39f7d25dc53dab0fd596852191868741cecd379b6e87b1c1a8c0dc6b8004595fb61135ed10927d6df243071d53b4757c13f4ceb4480e4a7b9c730be6258db763d9e9e7baeccd140ed2311fd9c570db36e93131c27442990068d315088680ab638288fb05b1676a9ab2fe9aa99539a1cfbb1ae8b35cd18007ba5105ed92f8914bcc2397da080dd1da393ede4f195953f82d03b9a920391ee4f5bd7485d69e1d8bfc93521ea451a20dd056bd3c133aa93c9bef1e254ad7d19379b21be984d93cc7cfcbffc82708aebe5fe4c4aa7af905248de89163041c16cfdaf96ee5b65715c7bb840274ba8ddc979ae077aa20b5ba0e97ecd80abb2d3cdb2d2b6603b3a0039cd455982be80afd30fa5e9a7307c10c954a2ff1c6bf5fe3e153c0ebeb4940c365ef1e9cc8588a51bfc9807e866ea6528a77c930c06eb50e3f14ca8abf929570c05ca0615211cdcce3d034946d4fadcc9df5702fca33cb322c27a54fee8cd7901df1066311b737259dfc65048bcff6eca8f566ed75b5d21b58a3c51907ba6d5ef9e04e24febdea1d345b16288065bf64cf9fa3a746185191dc7b2f4520fd2da2f60434395d6121d7063a6455be070f49e04c8c2fa0da58d878d80a1bf9cc58b6926e3c471cb1e79cb85f6ce2ad91ac6c68f955a507cc92f514d131e0a095329227c9888f9fb19bfe6df77dff07ef08544a33e9f10d72e3ca6a0d70bf0d4b3e607a2238db2aa9c1011d0af4a39786e48004427b8b55fcd1f7ad63a9aa5338475975159310e0e40000000000000000000000000000000000000000000000000000"], &(0x7f00000002c0)=0x1) recvfrom$inet6(r2, &(0x7f0000001840)=""/31, 0xfffffe0e, 0x100, &(0x7f0000001880)={0xa, 0x0, 0xffff}, 0x1c) getsockopt$inet_mreqn(r7, 0x0, 0x23, &(0x7f0000000500)={@multicast1, @multicast1, 0x0}, &(0x7f0000000440)=0xc) setsockopt$inet6_IPV6_PKTINFO(r5, 0x29, 0x32, &(0x7f0000000580)={@remote, r9}, 0x14) accept4(r0, 0x0, &(0x7f0000000000)=0xfffffffffffffefa, 0x0) sendto$inet6(r7, &(0x7f0000000640)="3271160272121fc8b4b63e6f0034d40348bbff394f96455eba38e554c166b880872209da62042e3a06d1f722c1fa2fa8d81926a8cf6275cb5a3cde99351c78686d140d8ef0557c07c83f329785b59ec79450dcffd8520d83f4e1a9ae904e40edef5077df86080ba7dfca965938e19481e66dac891fd8b6e7429ab27baf552b9e646c9527ac087c1a968d5e9b3bfd992531c016e77eeb776a7629df6f9ac13ef536ed3732d867", 0xa6, 0x0, 0x0, 0x0) 20:30:19 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$FS_IOC_SETVERSION(r0, 0x40087602, &(0x7f00000001c0)) r1 = syz_open_dev$binder(&(0x7f0000000640)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000000)=[@enter_looper], 0x1, 0x0, &(0x7f0000000040)='+'}) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0x0, 0x0, &(0x7f0000000780)}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000380)={0x8, 0x0, &(0x7f0000000500)=[@release={0x40046306, 0x1}], 0x0, 0x0, &(0x7f0000000400)}) 20:30:19 executing program 3: r0 = socket$inet(0x2, 0x4000000000000001, 0x0) ioctl$sock_inet_SIOCDARP(r0, 0x8953, &(0x7f0000000000)={{0x2, 0x4e23, @loopback}, {0x0, @remote}, 0x4, {0x2, 0x4e21, @broadcast}, 'team_slave_0\x00'}) setsockopt$inet_tcp_TCP_CONGESTION(r0, 0x6, 0xd, &(0x7f0000000680)='reno\x00', 0x60c5) connect$inet(r0, &(0x7f0000000080)={0x2, 0xff, @local}, 0x10) sendto$inet(r0, &(0x7f0000a88f88), 0xfffffffffffffe6e, 0x20000000, &(0x7f0000e68000)={0x2, 0x0, @local}, 0x10) lseek(r0, 0x0, 0x0) 20:30:19 executing program 5: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$nl_netfilter(r0, &(0x7f0000000080)={&(0x7f0000000100), 0xc, &(0x7f00000000c0)={&(0x7f0000000340)=ANY=[@ANYBLOB="140000000301ffff808f00003d88c83f00b516ba"], 0x14}}, 0x0) recvmmsg(r0, &(0x7f00000013c0), 0x1ad, 0x0, &(0x7f0000000c40)={0x77359400}) write$FUSE_INIT(r0, &(0x7f0000000000)={0x50, 0x0, 0x3, {0x7, 0x1c, 0x4, 0x20000, 0x1bb, 0x20, 0x40, 0xffff}}, 0x50) [ 373.290783] binder: send failed reply for transaction 300 to 16375:16384 [ 373.313430] binder: undelivered TRANSACTION_COMPLETE 20:30:19 executing program 4: r0 = openat$zero(0xffffffffffffff9c, &(0x7f0000000000)='/dev/zero\x00', 0x400, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) pipe2(&(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}, 0x800) r5 = syz_open_procfs(0x0, &(0x7f0000000280)='net/ip6_tables_names\x00') mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x2, 0x31, 0xffffffffffffffff, 0x0) fcntl$getownex(r0, 0x10, &(0x7f0000001600)={0x0, 0x0}) getsockopt$sock_cred(r5, 0x1, 0x11, &(0x7f0000001640)={0x0, 0x0}, &(0x7f0000001680)=0xc) r8 = getegid() r9 = getpid() stat(&(0x7f0000007440)='./file0/file0\x00', &(0x7f00000073c0)={0x0, 0x0, 0x0, 0x0, 0x0}) stat(&(0x7f0000001780)='./file0\x00', &(0x7f00000017c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) r12 = getpgrp(0x0) getresuid(&(0x7f0000001840)=0x0, &(0x7f0000001880), &(0x7f00000018c0)) getgroups(0x3, &(0x7f0000001900)=[0x0, 0x0, 0xffffffffffffffff]) ioctl$TIOCGSID(r0, 0x5429, &(0x7f0000007180)=0x0) r16 = getuid() getresgid(&(0x7f0000002b80)=0x0, &(0x7f0000002bc0), &(0x7f0000002c00)) r18 = fcntl$getown(r2, 0x9) stat(&(0x7f0000002c40)='./file0\x00', &(0x7f0000002c80)={0x0, 0x0, 0x0, 0x0, 0x0}) r20 = getegid() ioctl$TIOCGPGRP(r3, 0x540f, &(0x7f0000002d00)=0x0) getsockopt$inet_IP_IPSEC_POLICY(r1, 0x0, 0x10, &(0x7f0000002d40)={{{@in6, @in=@broadcast, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in=@dev}, 0x0, @in=@broadcast}}, &(0x7f0000002e40)=0xe8) fstat(r3, &(0x7f0000002e80)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) r24 = fcntl$getown(r4, 0x9) getresuid(&(0x7f0000002f00)=0x0, &(0x7f0000002f40), &(0x7f0000002f80)) fstat(r2, &(0x7f0000002fc0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) ioctl$sock_FIOGETOWN(r0, 0x8903, &(0x7f0000003040)=0x0) getsockopt$inet6_IPV6_XFRM_POLICY(r3, 0x29, 0x23, &(0x7f0000003080)={{{@in6=@mcast2, @in6=@mcast1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@loopback}, 0x0, @in=@loopback}}, &(0x7f0000003180)=0xe8) getgroups(0x7, &(0x7f00000031c0)=[0xffffffffffffffff, 0xee00, 0xee00, 0xee00, 0xee00, 0xee00, 0xee01]) r30 = getpgrp(0x0) getsockopt$sock_cred(r0, 0x1, 0x11, &(0x7f0000004c80)={0x0, 0x0}, &(0x7f0000004cc0)=0xc) stat(&(0x7f0000004d00)='./file0\x00', &(0x7f0000004d40)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) ioctl$TIOCGSID(r0, 0x5429, &(0x7f0000004dc0)=0x0) getresuid(&(0x7f00000016c0), &(0x7f0000004e80)=0x0, &(0x7f0000001740)) lstat(&(0x7f0000004f00)='./file0\x00', &(0x7f0000004f40)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) ioctl$sock_FIOGETOWN(r1, 0x8903, &(0x7f0000005680)=0x0) getsockopt$inet_IP_IPSEC_POLICY(r0, 0x0, 0x10, &(0x7f00000056c0)={{{@in=@local, @in=@remote, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in=@loopback}, 0x0, @in6=@remote}}, &(0x7f00000057c0)=0xe8) stat(&(0x7f0000005800)='./file0\x00', &(0x7f0000005840)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) r39 = gettid() lstat(&(0x7f0000006d00)='./file0\x00', &(0x7f0000006d40)={0x0, 0x0, 0x0, 0x0, 0x0}) getgroups(0x3, &(0x7f0000006dc0)=[0xee01, 0xffffffffffffffff, 0xee00]) ioctl$TIOCGPGRP(r3, 0x540f, &(0x7f0000006e00)=0x0) stat(&(0x7f0000006e40)='./file0\x00', &(0x7f0000006e80)={0x0, 0x0, 0x0, 0x0, 0x0}) r44 = getegid() sendmmsg$unix(r0, &(0x7f0000006f80)=[{&(0x7f0000000140)=@file={0x1, './file0\x00'}, 0x6e, &(0x7f0000001580)=[{&(0x7f00000002c0)="ffe210946b254f92cdf0dac7c7ff547dce578e18a1b3f0c481540cf6920ea1cc40f3a9f3607a02b27ab5e26c6a849ed5f6e59158569761d7d91d6ea78f14cf08aa35072880442ac56ef6e727bb7cca5679d79dec1ec3d17bc987bc", 0x5b}, {&(0x7f0000000340)="adc82f815b4bb8d43010fabc37fbc6f46d8a71ebd8e46b0bc91db915af65a101b20802c901302992f507798d74db151c741646ff5506dfb535711cb2f6d21eb6effd0642627131191cd0427171feb1d1d6107f620dd98d9d969de87c09d0517437", 0x61}, {&(0x7f00000003c0)="9dfa5556f41c3fba2b62433f8abc6531b5a6848b5f1a3903f1b3fc7957fdc89c6fac68d54a93e0a61734ef12230c531bf75fdeb41927ffbec8d8a3ec930139f69b960eb9c08334d2db9e1bc1b2a58fd531e21b05ab144b2132a9a58064592ea0fa755bf3260c26ffd28ac370a53f0c24a4606b14b673a95479193b765475a8269f91b00e148b5e31747fa270a782204f46e909ba162f5954709faf7655abac039eaec7ecd37849311ad4d94fd77cefcf5285d0d6255e4265f4ed7909ba208b0c836b09e7c99ac14b32e22f5c3672662bc19e9255089559a6edb79a6c35c3841e682e9128932247238423de1ac2bcb52ab2dc8ad03e1c5282d782f31209d78c9a2c0e57d07518ccf73ecfa49c1fd08369d4e1637566bcba395872aa40bd7bf378ae830e828590add3c1d9af495f2e86d7fca17305a8d7fecd72c7b826728a41fdb9834d503e96aeb2d460f4206b697f99ac0ea71987cc523512d6d757fb8ea944f2660c7800e8ff5e18050fae397b7643359f11be2aab0a5f0078ee7c505b45aa82036654df2540ef1d512b9e5924cb079b3b3977aeb2de032f52a9b9cba76431e4b20f594de420341b379e03f323023a1b4062b7b055cc5627ade27b1b186f98c3b200d2889f1325d15e7117deb0051d64da036bbfa2b730f2c1f6fe65e1a76d5441e3bd1a778c41cda83465c2af9b220b86f263a35caa030dae858ce3f13e10756ab0bbe139d88a7d9e77619c7bc3647e981921ee2e2e7b5cdfd057a52199849afe73587cdf4a2f156e8f1e57047a487f8d3943f4a243a3a6e08f9f466670e9482ebb8fd6ea496fcc23988f37f2ed4ed74720e4ee2713b78226d42cfe16541c9401649c36c6867e975515611460bf5feb76f26c923aebf012157f67ac0118e5ef9e755c520b512194ef8b1189a3773d0a60b7807bdee309c8c13ebfa0921a669eaaf4f9fbe385baa14a135c5f5b7c9613ffb7ba6e990552ddc1b8025c21c4fdb0773388c4d6549fe1eb1d87ba273c14f92ec6b64532f48d3e0dd4c68d87d7a5af15e817f71ed42cb095319e818530ee565efcf9ed74ccfce07c1f89106fb339d0d372c5dced8ec4d7e7fd5c09d2c190964641d619239ecc77f6a73181288746d0887fe3bcb07a605d8c3b07c90b4d5b232c547cedd58537e7b0dac5e2db23e37711b5cc663bc5c7c785fb525cfb9023c5d3fef9ab286d21f2bf36a266c48c195d2f1895fdba1e518727c3f3fc828028fef877ca59f100def14296d3dd07d96de2faf977fd400eadcac15edf9532d8148662a41d3350d9c3e84d16fe9bcaa031c158b1f6172990b86abde1a9291f2cc67446c37cc54e19979078a20eea08a06ffc2078b8a26df71d58ed6ff17ed365f99dc2355e34ce365417cf676de300d2be176082a5dc862112df6aab2dea588f72e0e88d97c9d521037e5a4ffd45e5b614a066b84ade0da8e7347e8012ad13a9ce79338b231ba843b572ba621974786b84439618ca752d49702be90e86e28745ec20d4f33e8674e06d22548aa0e87079a29d06ea6ff37a1653e01c159d757dfe2e6969755928103fd3754c11df439a0c068e768ee03384b3eabf6920d21d2a290bb1765006c42b357b31577e691596071a277150f3a9a320154d8060edd8585059fa1b3eed1940e3b48e5a61a446061b214241f27a087dbfa5e781dc4ef088197778e13c9f1d2be112de3fe9e0c07d3cc1c8d8e3f9424ccdb0eca6dab76fa9678ce5ee8c0bf28e5d0932d7551bf396b85497121e886985f0ca44a3e0f1115a3edc1fcfe0fd84bf90ead31d2a4bc005be2e1dd5e2897b4f8fc24e91b6ae59c17bca14582026e4e35f86a8ec81dd3371115a46acbb4ff9704725a090421c40b18d65b2094d5efc6aba887e00af9b0db92cf50109ebeb5c5aa1910254f20c25195fd0009a00d7e3bf76f7cfffa6260c28b7cf02dc2f5147b6d517ba73a81ab2042ba24ccf4da704d2502ae1669ba2fba470fa93305a0db63e8c93076c5e487462f22b477bed3ec92fda08c5274642c9fb3bc86ab0e8a429df07ab3989acbda0d62ae1f5413b9da3759fb1651e2343137da277a69177395a3c7d683aa232e56240a63ab93fa33ceb432bbef28379b8bf48174a86df668a4b003b28cb91b7eb4eccaa3eb73b2f52d84249d9175ba17bbcb28cff35d1c5f7271478faa7b4c6536beccb3374e051a7d794e6203bf1a0a1b6f93178ea8d10c393db01b77418deffb0996bae1c7c0bef1e30c45ff408fe251d126fa4c534af29e51e7c99f3292e9af39d2c0ddd8ea0b5c07d5d1feb525238f1dc2dff36b9e4dee58ca7ab755011533ab5f730028dff4bfa8b6c47d11d8c1d931d896e396599c2d54d427c14efec7d29419191ce876fe08197acafe8920c46b9ee058f3232eae1b8e082bb24dbc5bbc0c72aa532e00a11b468b37df74b68f058acddb85883216e2256605e1b86f1416d3c8953edf7973b658fb8aebfb90b487c6a5bcdab09334ddf0b58783f537051100fa11166c5cd7fca2fb4c9822d35fdf26aeeed7fa9b638cf97e8315bf4a99204d62a04e07170e32208275639919587d0a7ad930c57da94f4a545d3c616a80f4b1e86166677990251f1e5348fc934d29568ed03c03a0474750ffb0902d4fa0f805bef8f74a53234e975084fb71d75ee9fb2cb49e2c0171c045040acb1a100abfa6da6425756dfc8c244125097f72d45c54b103dddbeddf9bb42b00dd71339ccce20823b7887c4952d8fd5c07cc48afa375636929ab972cb3a2228ae03db9e325f18be062a320acea12fd752baca01d1e377962c81623251c7897f6ef0a0661bf5834f2a87a52b2540738141c5b628ece5dd371c8448054e7af223c01a1e0180ab6e95a3499948fd7cb9131ea08596394d4cd80cc14e69f65fd2daee532eead5d41c4ce32fbb4759ad6f494e4f7f37bc0fa64dd09558abca209f7062f96c76f8c877e266d3af94c5d71f64375640ce675862680cf6cc01e4038c1ab1c547b4829e40a6a53ff08cdcb7bfe91364a450b6c10d5a25603a9d59496170b0047e70e1db6be53f2a3467efb0ea707c9d5142b6a52be590d0681a73a4c4fc866876f6ddde31f92cbae8adfc2a80a2a416d63957df3ec5487028b0aab4a929c8eaaa5e7e97636314213b6e3349984213015513900f8d17f4bf0e11ef5a48da4da2cc1e3b87dba898b981ad2cdc34d1518b7cbdf9387ef288902168007283ef9530b234522d766f05a4f32886e626a10b532765ba6eb0fec7d5347b00ddff7537f96541560077f10aeccc5f1e5e134fd239bc1e4382b2d4a467502969b00dcd65d440c0a4f998fa3bc82d93105ad84e301b04b4f36223458e7007fc73d13097a38bc692df77fa73ced1c34ccc14b8569cdefb44a7ed8d2e264ff5285c74a0f144070e36548ceb123b96d11dbf6171b8aa419905418889fff19705c95c95f5be369246608ed42b424c08696b6b658af98b509d498c45cc34b967bf5d230b2589a57910e5bab2cfcd3aeda35c9a20bcf8e0e56099fe3063ac46d4395772838944f3b501010dfeb5d06f4b9ed7d4336d997244cf11e38697198656967a686f8d42a965c5498c1abbb96a0f55b6959048446b59bbad6ba8640909bf16bf62a90ed5a5e7f15ac5d22cb628fadf031c30b5522f02fa3625ce96a3736c1e1d27a8de8140729fd714c7d1dd5c4a93766adc314f931bfd2da68130b57f83cd7c0e027e99694e1c846061f7c68f27b804792de54f38292100df2b5006351c3bb9ac9eefa6a9cac9d119c339705de2974fd5cbbeee41c43ecb45fbd9bca793429c3d5fd2d3b116b891cdb96befd2a12bcba17bf92d147761aeb8f03d383818094e6ef87f3cbfd20520e8ccec7273a9f49b15e3f538ed49c9c7a7c70cf52e748afca5fb906dfd5f5641746915a3d77b3c29075df305e245f8b8a639e346a1d765127c9930f402e83aadf0147fc3d36f0493a4e91231597f9e1c29cae0032a92c0ff6a3fba102e16b83945ce0c792a452e4908fbec22d6fbfb826953ea2075370bcf5e650a02f5fc2036bd00762f5df4194bfa5c79300cbd30991092b95a6d7db393e9edccc780464f505b1cf1365973ab546235a48aec90b3d7f2105fbe9cc3a3b9e279a21d499d6a7800561d5af3027c5918bfeec1df66e90d53cb98ddd7ad0b01ffe39923c38184e3c5def51585d52752f616ad02eeb5cbabf4f1fef960da9e9f9cd1139cb8db094026b2640b0afb65d562264e1c1abb17ac0d75fa13c169d25010b5d43a40fc7f1e5492d9488cff914a5e16b43aaf966497cafd68073adc4498befd1b2a9729a6868dd17b2f4e0a43d0780692bb449f32c6f2bd49392b92cc289fca72b7aa6a6559cff9981af1cdee5a2027379bf68fafb669a87b534d649da0cc9240e0d7d8fc08801e24596c140ee003cbfe7c47c50e04bc5519fc86f46f82bb879e2395d206bdb3cc4c2469c3344824313137203bf3bbf8bf26faf570320efe710b4971deeb79a91ec788b87cc6bfe997cbd21f43d38f4697fa90c7121fa302f7402e347f3dfdd424a8f4286b2475de31322d3fc0af2a65f59474985351355574af16500b3a2c0decb78e2118de18cc82214bc6dadce86c76b99a2845b5117451cdf8e6e48c306f46e558f559b8a81ccfa315fe7ec7c5192e4f81dbce9bcfaa30e965516728315135ed3ba966a8e514b72a30a1f9d75e76ca09b3485758b2c8f743528e4abf1a93de2fbce31f2ee10b9402600074310c21dceec68e7cca9356b09534fa4dd023207f4b53ce8a8da5fec0972225d090a2426465c531d1278b7933c001658172fe183b19ed6c8b87146bcdb9f8a234ee308794cf76b62ac39f87df425f4dd87538890538514023ba3b09eb93e1446c6054cc933f3dbfc44b2425f49ac1ce3f799190bdc75785e15d1aff7c274deb64184d8f8e7e1672dbff0d62aaf8b2738f100a47562ceee743a8b46bf9ff9ba704e22c3c6dab5451c4d2c0916f9f6ae83153dc3f8ad0ac9ca49fcdd06212ac5ed0f1e0fc0824bd05005ab88bb6f3669782618ca40f43d457022092e55833d81b1d131d224f2e4d15470645b72754e30cab39fd11dbd513afad2dbad817135d0da6f6cc8f8ef1f126b56f3f97e0cf435c7f92869ffa247ac620c628aa0aeb44cb5ee59b218987862f13234ba21aea2f4ccb561d73bd94b3cf74a29f920cef05a0974864bb6275448038b326dede846362078dbe2a20aec143a584e3c7bf7a39eefd8fdee1055986b5ddc486cd4acb6bb94175e173f0edac51cea44ef02471e186dc4336e6a9ba4d4bf46319a19e9fbc20f221cc19dbb2e8d9a723233f94e219ee674a09c96d50225e1a52a62576437079937d8c4b04f564d01884bc585d41beaebcc19a74391b97bfbb48a1c51191472c9bcec505a5fd4c282a7639eabee3322746adc7823883db28a9387507956f83e356492109dadd4f66f460d2c7d8731abee894a673cb75fe5864bfa10ca60ffa419ad7651375e6e74ade5d8c0e3af5cdc22445acb4ee7cff4861f0715993703dacf49036d00ec430ecd7f93702cd4a8c28232acde77c71dc0b28266b97d55f7e4f60b1dc43eb1f5863ae1abebbe13e85d89413ae9a19e73d3d0d39db945cf47486bf20af5e2c5827104282c347646df03b4ae3b745d9b51e7d79591e82b125d763f8da5c72009626d9d308cfe65b9741f00f23a960e95269139d46ab0281f430f263a0d40f02be914619555c91b85888dddae84a208b41b5281c3da9b0f21e0ffd284e51573c91a0781dd6481dec5f7dab44e95e5484bb6f27", 0x1000}, {&(0x7f00000013c0)="e4e37157c23851f41dae276b1fd05da36f06301688c682868eb42f2f1438b5f14166435c4c11c5d330447711a2f83290041f536dcb327ad46d3733ece7a597e94302a18d5024b0e9bbf8c3d30269f4d5c98c6b8c5ac011b386ff5cda78f31cb05f57b0573762213ca8bd90208a38e2ff82ab326d24452d416b35dc450ed3eeb19f8a249b056b1ab3a9be93ad5e0436e3e680a1c0d36b5a4238e5b2883b338d25dd3194b9bc92675775d98c85932018eb2b71b7c66eab5c96bee744165f8cfae7ae6bbef9497ecd4dca0fab950e97800d6b7dbbe22d814281d9", 0xd9}, {&(0x7f00000014c0)="6e0b9f22a65d2412c952bb5c3b0d379383cd6b2ecd21d4a4eb415e35fb128add95dc3677e6bca97f6fcd10023a066c95164b4b776dc6fc5fbf0c421b626ed185857277821ab377aaa90652ce8a8418ff4898f50e4f8324f1190dab3a0d4bdc37cdea9af7a295667f0899f880796a845c165edf81", 0x74}, {&(0x7f0000001540)="c9d3feeb32213fd3eb7c3adffb6b38104fe2a3e11a8e644fc2cfd8c5e489d3726e3fcb0895071dbbe9854adaeea591a57407fcab", 0x34}], 0x6, &(0x7f0000001940)=ANY=[@ANYBLOB="18000000000000000100000001000000", @ANYRES32=r2, @ANYBLOB="0000000020000000000000000100000002000000", @ANYRES32=r6, @ANYRES32=r7, @ANYRES32=r8, @ANYBLOB="0000000020000000000000000100000001000000", @ANYRES32=r3, @ANYRES32=r4, @ANYRES32=r1, @ANYBLOB="0000000028000000000000000100000001000000", @ANYRES32=r2, @ANYRES32=r2, @ANYRES32=r5, @ANYRES32=r0, @ANYRES32=r2, @ANYRES32=r4, @ANYBLOB="20000000000000000100000002000000", @ANYRES32=r9, @ANYRES32=r10, @ANYRES32=r11, @ANYBLOB="0000000020000000000000000100000002000000", @ANYRES32=r12, @ANYRES32=r13, @ANYRES32=r14, @ANYBLOB="00eb006a"], 0xc0, 0x5}, {&(0x7f0000001a00)=@abs={0x1, 0x0, 0x4e21}, 0x6e, &(0x7f0000002b00)=[{&(0x7f0000001a80)="6f7f325df74ef961f6efc35fe1521d21ff179edbce083a723b548492517359cc39411c8541a5006e922219685f03769eeb5554a332b7e4011212c4f2f84c0435daab834e37c364197ef60224f208e148abf3bcd9de4f019b4f991665296fcfbd9363fb85ca074acc2fbe7f059e38d97f2e5ee1b8dade0df8fe71a782d01978e93e03cdbb55a2ff8e21a80a7033d3c765fac04603243f1ce2e3170dc617282aacd88d927de5cae7a27ff51ffe23080c640740d090ba0d5af4f7154c5362f3d55e224e7ab42cea3fec88f602a910d725fb5eabedd92b59940c20c6adfd906a8660bacbcd4416ab181bcc0af2c3047fdac176c0d425c9175f96b967e3f95d5cb879a999efaa855a89917848195be1428097227e17b36a63ccb444247105e0bbbaa6956e223efd75665e8405a640ee8c80905fbc0e87b40fc7d5137e64789d5b15007b81318a1b19748d8182e0d5f5325371caf1f7cfc5a58961783e03443f5576b3ce3065335cf8027946f99f6933b4f4e7bddcfbf093198a6fbe49cc2a3fab84b5b6fc497baf7c737478070ba0024984fc455562ac3dfdc93458f5a6f5a355129b5177fb25fe8f772c32c6bbeee1a58c796fa76658616f9e5911bfc027932a25c84d8c8baa7f5f9e0068ff11f7941845f18546b9dab1187f97d348401978b2fde3d76df96369a2b05259d52a4f28e1689cff1b0038d408d4d6d8a9f15212d8659059237a5fd48aa14f9ddf886b99df3af8216f133b604e477a2806a546c248f3cd80c6c68bc7d5c3bef5e672a2a68eed4a3f4c5ff1268488b4bee0b2b141237dad456c9afb749302c00cb0450249d3ed4f632c1fdea8ee9773280f155746e1bfc3f0fd4eef1ebe0680503b9de4965d7675ca6d0b343c966b3ecdca8bf0dc8c802d28d9623d9694881d92d7b12c2eb54a700a0a9f7b33947e86863cf903ed077f5fa8c9a49970a216482a5a1a99fd849ebe8e0d51d974002bc7c5482be55eb06320dd6a2d3060ab3bcd1891c45f606da954272f4465888d589d711082e2110c0284f553010f7cb0a7a040ddb873ed3f17f7a41e711ea28585936a679b4177538d402a9198e503bcab53cbf7a8145a1f3c6dd129b4346d2f7e9964e933ea5f6e3d5d469c233f259f3bd0702bafb51de84352796e9ff1e45ce1e384a3e4020d2deea8160c90769d3e9f55beb1a4b6301be5f36d1a916312d32abc27efaaa25f014d96e853d6a539317f10bb416bf699c779e14108b0b952ea734ba4c1417e9f51030ce3edac09a9a2f5ef43740b797c5c1ce0ea3760164d5d699b9cf6504e8744b6c5f13c95ba95a822ff086611ee3540784a50a0996a3ffa038e862e9f59ef73386deff440add2777971c065b15e9a529720fcd85bc04aea1bfa16e4bb030be423605070abf4e2fb01d1a57db0852c950947d957ff3f0c46e4ff96e6d35bc800da696e9f4370ad1ab2b75925567ce703cdfde890eaf954a116bc128c1f3c3f7fe88afa5cd333940b30e79875e1c803a55fc3a40076d457a4370e18b04527671bcc1bc073d1099394ae3bb8aef20de475c9edc31645657e711578ffb003b78f96ac3f17e77a66edb423c89bb05b43819afa6e05fb8e37f381aba81660872e3f8d95f9a70793788e15a869321764e80d8d9c435843dfd28d3156b4d0f6254c9dfa0a624c8432d4aa4f1d754be1f99922749319f1101b3ea82d1b4a0f1ebe58d0f50369479e8fb729457a54ca231236b766e903dafb287c433db5473c4b568dea1a80c0f95e16f154d208add1c811eab955542e6af0ecde896082870d9e809e8cabf4b1117ef170e1228e0f59b080d1e067be6976bf79b870d9e17800840bb42d4a23aa6715c04aa5906f2e4dd6ec7faae9d40fb93fc25cc0eda9a2f71a57f3d505295516a60ff285ff4577ecd02432677f1270393191748f182819a254f0696071b5f47f5bfc49222ac4e170a7c55dd7cc037e68cb1be7966c4d87b1cf9bbbb2bef8410a283ab4d62e511cd4c516a51682df0e6747f878d570f92d0c161a7115fb35b250e9b97d112d87156575ad556782ed777cdee745a8d40b4565f584599b6f0b7b6cc8b6546f283dd78b7a15581f49d64572f857e2a19c901f160ca2b287bb72cdf18704d21f392df9bb47c5d2ea07fb6af75974634ebd6da4a42216982e6f1b456b00ab8186ab5f8aed1f8db6df04f54552aae8306ae4b1153df90a6f4418d4ad5eb76c4b2fea4aa2ddb2e3a507c56a2083c2d50b34c08a861309daf764cd49257f6433a457c1be4e1fa89f8389de4c03ac16e51c3869fedb5dbf2bed3242e8810f7ca13f8f41d0813ff9d1d86c2e6f9e84695551ea38e6d76d8fe404ddbf56fdda3cffb0f3c653e6fd93979e6012829c4280fd92580d3d6acd19ed7ec0e39d9f8239518b0c84abb2dbfe23fee7dfe9f9c9964e38ee26a586c5692c3deb14c2055ff644d5f9cc9ca7f6c13905f396de1177fbffa9d51bd1543813a854e5b4437e4c0570e6f74a05c3367af4af3f24fecb10d05a910475eefef0e09362cdf56948ef2a2e1eb36c33b9859dbb380dc1890d56863e54afa2f56ea8ac775eabe36d3ce3e1621176e4397c39502fc1d52e1bafa88734b089e43187ed3340cec08785647e99b42add3d6e5c4e24f3944db9fbb4156b43bc04da49cbed9f472b2f7e905e819d86c63ec779588bde900b54f0ac5e418935121871bad0064aaeff2390d8d6b445b3fae15a6634ad5a0f8eedb1ce103c9c98bf9d9c684b0055866ca389679842527382929e84293af14b55fdd353d6d114aee0a4349d4e06cc6784709cd36954c5df7062b308152e8ac60309ee922ad07bdddb4147534e76917debc4ebd7e93ab2afd6d82738a5194eb8bfd7c5c3abc6447d4657f07811d950ec0aab75d64fb4ca4d6cbf8b8a54739d35fbe5ba6ce626d66fd7f3bfb199ae09f657a8193df6d60cdaae7cec7980e9bd0496a88228df353bc304ad07044f88db03b77c48fb0c37ac5953eab7deecceb3062bd5bcf27dbdf3fc02e84ae1127e65bd210368fe67b4c1edca68646437eb7b56263024c3e20869cef0abefdcb652954dd524289d0a16add464fc63139783eaf0b5c48eb05c998950e8bb6be17a3d8851735b37d64e757041f0815bea88f4a0d9104af08c14ae276eacec907ae2e966df7d98e554635372533d2274b6dc47d8a5d4b2df3b57d2a916caa9488a76a5128fa3c35fec6c67d02bd1a1942d51e20e2fddfe46871a69374508e4159105be07cc78a2746545e417d08aca03a35310fd4ed3e9946ea0e503023c93651150bda0da210fa7c0cbdc6bab68a39066a85be80feaed862bb4f1d6b6b0ca4e40b1939112e94beb0074e5a522bb4eb2ca3aca7d8a42db7b130cdc913e5ec9d8b6cecd6216d3203f04e1a7eb12af6e1b0467b03a9ecbe38d7655edf3159c6c5dd30de362d901099e61a7c36a7a44d5e46b1507815723043fd745924a5e5e492eea01cbc3b8b13d4af22ff54db42d252ac82f9f311c9f2c57ebecb9b82d45cacb27d8283bcc088edb4e0db135eead7465e905c07a72336e444495ec89856cafdc45bd27f5d7c8648bb6ef9d86a4f824107d38d0b4a07d55916f2809ff8fc86d0adf2ea6697ad26766dfca6cddbad7a6683fccf70a5dca4cf64b365a93f775bf6752a9207781bf70bcfdc366c47465ef9b7b40db83a4e310a1d29147ba46ecaff6dedd39d8d4d3d5c56f6567a0ac8ed702f35a004c51e9ae0e96c6b963ec79acc6c4a38bb78736b8b2cac8d72afdfde9542d296c025dfc8e8c262ab816c2066e20b5b271a79146e420834c61c7a29289e6debccbe7f98183317e96e2876e284bd934f4f10a39d36b004c0ef2eb9d4916281ab9b5d1ee8e6d30c7af22f2509c78073d46955c5320082bbea0ada68395aa2f0212537e61fc2c51bd56777f25999c501c3b9b0e4f965c0b4f5b43c1ee81d0c273c8a717ab9b5615e74f79ee6e6064058abac02228fcb42cdfe5984af011245893d4ce7f79c5c2f37a8df2db8aa668204b2832d688f5b0a0599fa9aed019e976449982c54c339eab14d06d7d8e1dae7a1120526a276743fc0d3961728be881dd47c1eb68b6d21a5ddfd99daca990a46907b262ccc5f45e14547bdd89edb67c4f1ad4a1da8b71ca2752afcbda669063fba4eaca47246ca34e580296647f6596d5c9119a80917ecd0fd5752218786ce0ca98724dddd1446d83a5633c0442bdda1514ff717c4d144e7f0c29a030496622ccf6e71ccba50ece71126f9b35a1bfb87c6eed80332836ad7e81ac94c243f0f27d3ce6752c7f6a9b8ef881c1f1c3fb7e086623bdf33254d63451e1a5a22038afbbc43e8c60c9e9e54844dd9d2d1b948a2c352aecddc155539f18999ec590bbdc4b30bb0f9a8707a011012bc3e088fe0b52260ca2a50af63af53646282e1a80f52f336b8f598db1be549bb2561275b32d2bb2e1d5f2e87cf8b3251739f13bf9f3610bee2a663b1d38f9284bb6588450f9e335ffbcbf9611eaa94aae0fd5ffad1ecff93b4c2299fb2ec8eab973403f562cde3b7f6e6e2b340e76e09fbddc502f5c75b202e96e5467433c753c16cfa64f6ed42498be9fc78053044a5fc7287eee849eb99fb7f9b205c71847e4539e2e33ba4ff663ea79c7349bf49cca865e3b10e06d2fdf9411790c5731cbe3733654ccd6d03907cd6eae039c1924db0830190fd4b3fd572df6c79d54224243cd43ec3660ca7579107aee3619adf867cfeec9949bc773ca863ffdca811240c63f215b3beadf5e83397197b4595d6778abe87a254f278dc21bf23b660289507a0717afeb4369f8db833bf5e4c6a6a414a0c572dab9b8e67303feee9ca9d898be622a025f518635d96da32bfe10b3871a2641feec70450c67d544b546b24449f35ce0efe92362697b01985537a743985836025eedd03dff8dea95d56e311cb0411249c5d20ca4369e6b9f416fc5231613e9bf604ab87686876584932594a78028e9b5dffb3d9f735a79426b7c2d1ac813beba2f912e5f39c0aa0ee66b83f3f7322e06c4d2e5a97eca602690471c2da6eefbeca235966e4287e59fb21b86427d61e04beef424e8b36fd37b0b151d614be37416aa0e0357b29145b689bca82b1d949c71ad81110ab4f4fdae76ab4902bed48982114db826c5d3b0b9dc324251df296a6fe4f92eb54b4bb54d46129a536af51d274f5fa607a8843b4c24db2d0a834141bc59fc06eee2d250c553423cc1713684f2e5dfab82424474f5abcc0f12de4afbaf3f0a3f9751ae0ddf3bef3be98b72227760e41857cef8d48e49148b42f5ee6aacb58b19821fd480d212cd215633ea324d43b83317926104a7bc7a68ed6fcd6b6d0f5a2eee754347fb957ecfde568ffde862fdca36dbbf7c133e9a4417d33b54fe105b706adfa72ed543f5e26393b50f7f35214898ab6839b48ed483916abcbda13c1109bb070127ac1f051fd1a144895f397393de876a698581d32e65459f81a24a645df9ba9c0b0cea24b144f6a3f2d8818def40e9490677bbcedc14e5320add4fe71ef12e93425ebc784c672de75a837eb8ad2b0d79427ceb9b34dd973738095eaf2a1b81b9ff2a823e89267152300b50f4c37ab969124d8fd4557c88b158df2dcfbe09057cb50caa042a778a8a3376d48e31cc5a6ca149453d788c649289d262a34e10325134ca7310ba305795b3dc866e44fff522d26f6fbba6ba15951434ac953f68f1000530a5cd2df007960e695a809f3a564b88fc4248c318d2b26fecd1866033b2dc58d24ae5dddc70093db2ebe0986ff8c93d0343751192a4a5", 0x1000}, {&(0x7f0000002a80)="41c57f3717087a2353f799a5537c1eecf58790426c85bad2b3ad9ff98af9685a7712063901acd402aeedf6780459b03479c497b964abf2786d18a87624a9b7ab67366e0b497096bed8fb8302e01ead13e5", 0x51}], 0x2, &(0x7f0000003200)=ANY=[@ANYBLOB="20000000000000000100000002000000", @ANYRES32=r15, @ANYRES32=r16, @ANYRES32=r17, @ANYBLOB="0000000028000000000000000100000001000000", @ANYRES32=r0, @ANYRES32=r2, @ANYRES32=r2, @ANYRES32=r5, @ANYRES32=r4, @ANYRES32=r4, @ANYBLOB="30000000000000000100000001000000", @ANYRES32=r5, @ANYRES32=r4, @ANYRES32=r1, @ANYRES32=r0, @ANYRES32=r5, @ANYRES32=r4, @ANYRES32=r2, @ANYRES32=r1, @ANYBLOB="20000000000000000100000002000000", @ANYRES32=r18, @ANYRES32=r19, @ANYRES32=r20, @ANYBLOB="0000000020000000000000000100000002000000", @ANYRES32=r21, @ANYRES32=r22, @ANYRES32=r23, @ANYBLOB="0000000038000000001e000001000000c8000000", @ANYRES32=r3, @ANYRES32=r1, @ANYRES32=r1, @ANYRES32=r5, @ANYRES32=r1, @ANYRES32=r3, @ANYRES32=r3, @ANYRES32=r1, @ANYRES32=r2, @ANYBLOB="0000000020000000000000000100000002000000", @ANYRES32=r24, @ANYRES32=r25, @ANYRES32=r26, @ANYBLOB="0000000020000000000000000100000002000000", @ANYRES32=r27, @ANYRES32=r28, @ANYRES32=r29, @ANYBLOB='\x00\x00\x00\x00'], 0x130, 0x4000000}, {&(0x7f0000003340)=@abs={0x0, 0x0, 0x4e23}, 0x6e, &(0x7f00000045c0)=[{&(0x7f00000033c0)="426a6540c0825bbe1ca05d62a0c051fa99155b0d526c6dbb0b8228cb03667520c16d421f41ae9947755ac078b8d359ac986f6049ade7456b7ca3e8c2742ed457d5edbc465bef83514bd824171f13f20a8b5483f1fb7879d01d2d51f65a8ca58390bd281bba8b19885b25", 0x6a}, {&(0x7f0000003440)="9820982ec68c90a1a4a2019d071690e49478fb072806c94978b6c9d3601cfd63729fb5272d6a976e7919dca566725e8aac7001640a96e114c68d721ffa0f806051deb2a1067f687eb73b62820458da17e80b0b7720e1da910b9ed7cced4a58e56c6492227c48fc75791c0c185539475c86ab63fdba65b69de443e2c75861ca1f885fd04b2336ca707fee49a414dc6c7ceb7d64f8ed74505c5af5209d7236f9dfbf225162dc0fb9bcdf6f5045ade2c9e75b9205a7390ee607bbc7e4ce12bb2a78d868240eb8e64678f2e2120b0c132524aa4bc7c440e585f36492aca1ebae32330bedac5358f09c65090268a8ac513849138d36c4541d912443f11c717ec832eaa81fad80107d33699da27a8e37d2f31f1c7f4b02d5819b547f3104001575cea86d8d51d21b7917feb3a59dbf573dd233f5b18c0b30ce5f9186e91c20227f821873075092488c179cedf8971d168f7d1ebaf77fcde07818b98b90c8c0a9d79ec33d9ab78990117a638b20f6ee4e9bb14d96691a722eb84c41c2edb6240a3e9c72207229954b455ae06db52dbff685e835c16f36f81eef117f64bdf3ac5c585509ccbce2303d6a4b429ee77a7af55372b8a4b5ae92c8431f7b48588a3342816c3103943498ab6706596421ec93bcd9713f6246b0eaceeab348e1fe87f6af4bfb5e1392a697709e6b28d23c86ac84c2f33031763016b999b11ec0c71f09060ef2f99b0e274b20626ffe91fffc9f9a49cc9860c8e01bc22fbfe203e418d54fb08bc678c917ba621e2e8299eaaea7e8d8eafd7cc5623e8e62d5068105f075e36f5de626ff3de18f21c9d70a56064a7218d90ebdf6970eba6346a2b57554bc4ac623163f52264559701abc5c8d2dd0d739bb323b38a2e08f595bf31a55f3570a4bfe24ed4b9047dcc526c55b9f921d9768c948e322d7342b2d59216de0d528cf76e63a1374113d78866dc8bbc63ff80436703d14d734021118fc57e176b467c54d39df1c36d72bdbc5b899975570df6c8adef3dc6692eefd6105ea9d47e945f487f8f99f3392d320985b32362ba39cd21cc7e6db788a940cc0fbc61ef2daf9e37da1b25283d80c257255908d100dcceccff64d8ca0b6605a076a2ac576cd0f5ac4c1a40184d7980108a8b2c515f025e974d536123f8e58a0e8119315468c99561b0bf5ea2818bb2f2ac8de09eaae9cc61cb970735cc491fe21460cc827c78512a403812e6a76a88beecde3452f048c8f3de540958a54fbc7f4c59aed618d4346a5e229bf8d0abd5aa7570f99b7144b95dd7ff3d67a57c0153b57adae78c0b59c19803c5033b41fc143c9471a04fdecb74d95a0319241f1b59040f9598486e9cfa3faadd8cc61c4148c7b8777d8640202769bcf4836a806e327077b864e797a1e08fdfe6606fcdd34584173a0ca06dfcbddbcba68d52bb0c23218bff029d7fff5272594a3bea9c8fe570399ae986ccf4c563545680116a15044ed9ee818444f4d5801f9e2c03861c86060ce4cb20a8ae8cb0424eab16ea583b55189b04d0b9f70e4d3e9c8b8d7fef60c10e4cf9cf2105b494b3d6c1b3fd154e04988a528f3b4abb815547f9ba7e5f46d1fd70bc5c661cedf3d634a0e8639d84bd1d0c85d05543d1b035e0aad45b71af6775f849b08761c30a25fef22cc99202faed914892cf8baf2c3a5f3135be6e2de136103b5c232cd75283d33e8426f8307e57ebc6ec147b2db63d4f358d89b62d04c9c8687555e228bd536e67aacf11e708096dc6a2f6f4e019a881bd87d85cc0aec621a196c11e3e851e0213d3b270a8d79af5375f2d656b117d02e7a13a33730fad4852f21db3665653a6cd7c1bae0faaee5106300311d8535527c3f2cf16608dd85f359f8b0da2b4cde6074af36c2ce4afd1635f8fe11e1c4a4577d858f3edee887b553e9debc38cbaf61534de3bff1d32fd6aa95d68efdfc9ec044286444aa70d799b3f4df84a106a1f535fb01ed5e98e54ed9d4212690833fe721a7874180fd96e5b983eec81251169d9806e69f2c898da510355e9128268d8808defbc3e80eb7c4c226f31473633601b8a45a0829ebdb89cb3ad5d7d0f756a8aa90cd5e50eb2baec1fb5085971cf95f4853a08f286a3afd13cb9b0305b495c3f1380698767f194df1b5c44ccdf47002729893c023b89bdbdace082a6324a114d65dfc6ad3d593b45062aa23eb524962706bc833782954590c18f07e30133d06cd9cd6475c8226bd746503a8b8557d88254610196d8364d46dd416b9d72ab2e55c52e38e0441ebc81c15c3dccd9b2d7a832e48c1579dd8b18c53df06e1cc6e6d0a1b4b3bc38b81c74379e22cc343649fd7e678a8324959efde034238869be8622d97c4624d2de4975864bdec2ab46ef156c72a3d930aaee3f159f3d39cfb1acf7497fdf3b0105929982191a7dd6592a8c7d932db0d71b4dfb777d2ac2ac7e2d2a99d98c82700f7a14f2d09b4153441642ee368192f20b489b315386c88f526a7a5ff6d960787efd60689e8cba564a4b88f8a5936464f94a379e970b60f72e8835e597b72d385bb519d0d9c7e52a158895646e004505292027598148687c045a13b0bce998014b0dcae6b3b7c5466f9b8b2bfba46c7f25f90ece4b3044240705506aa131b05d09e7d407eb7ff0bb84bf021845c7108b39461bbf36b75f39ecaa78d266579bc2b2307d36789446b1b38462fc5fc46eaa89ce4c87596686116bfa4ccc84c8186b73db2e78edd6d8464fc5d11645992ad4b431a8f57759eb1cf0ceb77e50509251bbf02cdd0152c9f4b5d6d1c5856efc6e0e703be6eaf8fa47b26d7d02b1ddd4ce40a67d497fb73b2ccbc18cdab8af7600c4fd17671539a37541b620cb625e816c5066e0ca2de4abd9e93bfad8c9f9920942d000b651b10f133edac968b4d4144fe1357c96dfee31a4674a028b861a45daf0f878b73e46d75a94a021a24a431f07c0053fdc61daca381208df4db9bf603ba12c3a7496e4131ea2aeaf1b95730c6e13f5146b13181f8b343e3ee996b37d3a1ac794c49a91b24accc224d1def30469c68e5c3661757c73d013a13555adea311853020c4e6b957a92106e3050d58c91066114acb1d4fbddf9ee4eadde1ba05ea8caa86fe48b597374a58aff5f35ed39813602f53334339de498f1ac0a65ca7fdcc4b55acd6f6f90db9678967931a7b48a72a7da19b73d2081bfdbd49d45026a5d3e86a16cf810f9b2eeaaf910dd82445a4a735335d7e4ea646712a36f3b8f2c5a9f8c700757a46d76d0856ab7f50a979bdc6219d0df87684dbb486c9665ab2f9decbce9b1929abfc181d3dc18189a555515fb49528f9a1b70d78e5823dd452a506b4683532a6a2c928c58d6272a37df290194d901414a6d5a2ba744aef9e805a84b93ab76841f4e136a13c6a0b3ebc8ff24a86e9c7fbbc7c3623682e224083d89ede7ed7ec9e180dde3c46e1efdaf253ed339c5c403b205162d4c59d4cd54b28a153f5fecf608f2e34a58ffdf8e78ba368cc293efd536de3276bdd0c66fb1268f9ce539bc827e10486d6b6803a6388cb05a0b3def142113254e82d85ae7dc3172d6fa01409fd8991ace7c609ca5b086357bb77488454e60bf8404f0923bb23676034feabd20e4d5b91be572f4019d3b1c776c8dd2d14c6a3458a60ad9a4630907d7c34d02cb1749d5bace0a4a6b33fbd60b262c90fccf56815e6c8c8b8e195f426c7d0082f604ebd1a1a2f0b6b5499581312564780f0453588d6512dfc9237aaf29b7e69a0064793813845c28b349c94b24e26399b828768815e5a9e0e69eecb167ebd6b573da5067e51470c6013bc832b9ba59c838f1f389bd318e2d8f2940517957d0a9d71254a3b538d1dce12b68a7ae705277fc813d311233ffa34cc89371cb515d25921003a057589cc3dad977a4dbc356af29064e23f9a2c105edd740efc26649a9748ec333937ee3ade778d2928773bbe63c6dc287696c5a8c4cf46940edebac0fd1c8b3064a7354267f75337c88f8732ef0bed96eaab7efd8ce716a0fd1c229fd326227f0bcff1f4c7158ed8bbfb1dd043feb98f9b18f6b5f4cd5812a6cbc9324a1f672453c478d6a0dc273a9c5cfb2d867e06952e445023c35e194351db13ccc2c7c8b33ede82d17da60cf57014398b61178b23470701ac1d3e2d7a5f80e94062467fa086bf20db27b4be402acb14e564f8f4b27f64d484e0b2b8c23894d1d842265948fe29368b8555e5241f6525911f4346c704b09e7dbb4f6d3a44b49e6d6873a94a744e8d4a39f15b7c81a39eddce169d375e6da4ac0cc0853558cc9422090b9e431f857b1beb513161419882a5d5b8994f07fed53a0f29a02e7d1e750a1ef3f510cd0594be905073af61381cb7136bffb39c41b49c3e795f4d061b2a505ad110746ca02cb86115b21c40b0fa13e1e559776838559f718b2dbb485c0f26cdcd9065776222c010fc31afce1e134d87302b6064a2ce9c91c444876e9b08cd3cd4d997538574913c9710e0b91ab840e1886b0d3d9f8c1c17ae378a71a5e4653cd5b4e6d028aba85f5cfc8e2cc24af90c58af95874e88d8bdbda9e507fbd34345b3b60ecdaf6f3fd97a0bcbd58fdc51c8885ce11f4f57321dbd00d8c09ecec59867d7c80049722ab257e31f886aee39f0f0dc2aa9cfed9cb428bd72fb3f0ef51a731d1c88a57a04bfc944b1d1fe6818b128433a163868540e805649f6bea22016fb03d5a3951ca44dc5b41a168245f5d232c606340cffc98a19888f64770b75d914a60528260df149d5f3ad093b861de1beb34f0e99b18a96d523ae42a54a925cce1992af56733317ffb55533831a73eda9f506fc3c0ae69057903f8e88de106a12618f089ae53593e5fb0d17f6cdf7d9296ac443d283017853370dfcdcb98b67040776dc2f935332a686f2858f762863f6644ffec6dda075b76fa259f6f49519737c025aff2529b5e4f8454203285ac24b48e5521ed2339ef2bd5ca6e95c9e18903b9ac0a121d4d82ab271ecf9292fdd248b1fd001f68f68dfd1429f72aa5180709162eac9aa14507368e83e0f2572ee0e269c815c2a5bb6788c7c46a2d6ab3e0b7141634cc3eea9f3a576ae1c50c2645dc307854113d7f3ba00f8cfb5f0ae697b7c3b55c15739bae69609320354da8c774b0473ccd21ab1ce0b4c7a9e5d8f297f02d3d58ab49ddbc8376546c54a204af61d21918491825db72d3274a98d3966e2bac30c91fa9b360306f278aa40f27c6ac6fed0bc3623aef3320129424728c8e99dd7656f8be5162b6f78bef6f09b71c07b70af31cf04df5f61ce4f94b643f5f35cdcb12087ee9ca7673dc16c447cc644d4e1a5289bb7edfa6c66e14ad0642e9be39c6bc6af0ecbafd277765f293d26839e79394cbd38820fb42317d15f6605910a5b477caa55eb646efe04e96cb7a9300518b172a168d2fa586fe311536a26a41df44bf09c03d5c244610b22f49f339aed9091bb7fe1abaacc65147ce2e92a3b26c351f86bc62fd6d98863bdefe09e45a6250a425d0b617758914940f86e4ea994d4aaedd092e3f580dd4ae2b60fb86cba180b3ddec21d32112e24e9e5611b4dccc0b7ad28df4811d144b5b99e5f6c2ce9eed00c5a84b4be936a6983201a06226fee24dead80f8a2a13c3daf6028e67c39ab7017f921ba3ad9b11d09884c698a532ac72265e60494b594516a07a3edebfa5818bc0718452de7f5c69f7dae8f27d3dc7b8a5d2f9ce907835daf41aa8e9960276eeec8276102bdce5330ea91422efa7ba8cda0f0de09023ab38dfac25c6ae10922241c200c5b07c7f5f97f852b26325f18", 0x1000}, {&(0x7f0000004440)="4cca409b720b6c15b66f896f121e243bf6931eeb4b68c10d306f35ad31b38f570c5d1cb95f3eacbf0db55af7c54788d4a5011879fb0d0f705030a891eeb557ae7ec96096a06eb3e77d74451530d549870a6f72c77f21", 0x56}, {&(0x7f00000044c0)="2aae1e65cf2c87b6c2a8bf4a74ac49bede555101ca841b99480a", 0x1a}, {&(0x7f0000004500)="6808dbe8683eaf2745156a4bc8c66dbd5dac925227e3baf7f85e4e04ee1bda9a3f89a8e94f0e3625b4d5eaf1a020766729d34386abe4af58a5c29e31c6293ddfa36e86a7af06ea12573e1b4b1f5fa00792f9185526a498b2ad0c23cfeb30c5a4d709932c71c597f9d4de52d17b7bc443cb5c52be9fa9ad78d27f5040d852cf69d1f0b6b946932aaa12b8c77498c833397545c9ff07d887b38e8850b93121e543709ab09a0b", 0xa5}], 0x5, 0x0, 0x0, 0x4000800}, {&(0x7f0000004640)=@abs={0x1, 0x0, 0x4e23}, 0x6e, &(0x7f00000049c0)=[{&(0x7f00000046c0)="bfa4b1511811a1736f9d733914ff1d6367c5b9a055485903901d29a8d73943a8f4d9da8c9a689106cdd91f494ed17eea74c0c28f07ba40d9e4b0d8328228bc3c2c5ed684e5a2a64a6d90b4f173d16d5ee986064e820e73810d33a68cc3dc1207662cab552626d1d18b89dc54cfe139fe91a9f8f562015b4c14e7d107fb20c40a5cc845210f476292d738", 0x8a}, {&(0x7f0000004780)="767ce3dc3f0f9b70967f1244970cfdafb588e3c122991c88434a824532a6aec40c28df25cdbe86ccd7e2dc911b8e192c8398854d9035e6a5e866cc135ed61405d529bcd70dbfdbb1125e4f31c258e6ae6a5f68b1e8046d9ddb8362e4e32b72573c8fd026edff3410c179e3fee98ef2", 0x6f}, {&(0x7f0000004800)="c53406e7178b4a923b9be0ca1b6afb35c18482011c322133c6908faace40dbf516e2edf0dfd3b560309ee66af4e972ac4f15098f49150a7bb02a08cfb368391de6ab81f032c4b5ecf3683cbc364e3b88fbe8eb6b8bdfdc67eed24136b50aec", 0x5f}, {&(0x7f0000004880)="59d736f613fd28d8bcb26fec5a7d80bb4daa209b3b57a71a12944cc696615a8d85c422a480672b789c9d94afba6a38b6a687247660492d17f3d136de106f214be51bf803af46a757590257c5752345406db4eb436bfe427ba481ab9de0e6c21faf75a7d5db0e0790660580b94dfa", 0x6e}, {&(0x7f0000004900)="d3bc928a98bf71d6fc08da2f13095f4594678bb7fc71a76fdea3050e0a67fbab00", 0x21}, {&(0x7f0000004940)="733510f006fa5d880233a830812ba5d65873b7dd3b606d235ba3919058a6b635f70a0d1b300af4bcca9e937438ba62c54bded949571e67090f2f8c27b6efe6ab3c", 0x41}], 0x6, 0x0, 0x0, 0x800}, {&(0x7f0000004a40)=@file={0x1, './file0\x00'}, 0x6e, &(0x7f0000004c40)=[{&(0x7f0000004ac0)="fe83918c9413bf1b32b0dcdf7ba47db782c6479f9a3c839c804fd78b467a4bb5274f344027f92d7f50168d4602658aa93003715995d944892d422480395ce21e4480d51a4f14cbdde5594cdc50ce1fbd6cf696978c2a6dc61daab6becbe544074b6f58a852339d06763053dbfee6c534d87c8972ecc3db11153c89cb57f9508cd6df776c17a5d7a9312722ee626d00a07d5756c9f442e203f41c70f75faa6c7e5712ef486fe004fd0aca4108b36c8e588df1cb8994c7899dddc4b967b69f", 0xbe}, {&(0x7f0000004b80)="68280166b64e0387b2e98e46f768e306a8a933c677fe8e1c020b68e32f36e01d78a2ab5250e9cdc1157ca1312f0588c772c017919453ca690e21f7ea998f61b5db7fddbfe3caebceee40256c0c9a2e1dc3b89874ab9e09ad6e4bbca9970f79ec434ac9a1b66fa5d047e0673614bb26aa3e31213006cce2e080b574b1f74efd557f187ae9df", 0x85}], 0x2, &(0x7f0000004fc0)=[@cred={0x20, 0x1, 0x2, r30, r31, r32}, @cred={0x20, 0x1, 0x2, r33, r34, r35}, @rights={0x28, 0x1, 0x1, [r4, r1, r1, r3, r4]}], 0x68, 0x1}, {&(0x7f0000005040)=@abs={0x0, 0x0, 0x4e21}, 0x6e, &(0x7f0000005600)=[{&(0x7f00000050c0)="897dee785ed46367e4b343b2219b0b0b32037cd331393d7f0bf49b1f3f5ee9613cabed4787d8760d8c29118e435093c6b0b5dd0657ca0782098927db74e165ec0a65f327d8e73fb9dba1c932bcec7fd43413932e6d6c18eb27953e9f1e11fde5f71763e883af5fea89a14342a51e61cc7abd8ac15549f11a61d401b77c67edb48bcb448bd7bf025c1835f0af2029be547cc436d9cb58", 0x96}, {&(0x7f0000005180)="781ef53fddacd51d5855443fc8341334f99141ba861fe7abc2a0cdb7c06aca9c0c32a6b83d2d163e9f218d0779be86b58b990598c37240351780090705abac087ac891e60b751817042323b2cdb060968d598d3d90f842c20568c34cbb12fc172fb15d39f08dacb48ab2a14d9a27bedfd6ee02e1ff490d9ed5ec4721b008016e5be4978d2081d03f0a8005451efd1891213125eb97573aee138a65b49e7d4eb7be51337da6bd94672e0c33d04c0de985fea697d2d48cd16a6178e27047c844b7e66b0a3b70590d2dc2045fb70233a1880559f807d5b0c8ec7c7f8ceaea66aded10542dd0ec15c9af806633f41b", 0xed}, {&(0x7f0000005280)="7dd70c2060962395a944e6362a10ec29da4a6d505258c4dd4337f7f15ced2cea56863fec2a773b36d234d422feacfffe02e7d1662693b915c98658652b6b09d3497a7d6362d53c902be26c56a82f2d2c85d2796cced72d67df56b12b380b788ee9fb7d059702c3156c833b9e9caca0b09b6ac5ba8c7dbd5ffd30941b573deb7ee10773e6d277aa07f9f1912350b231070de26bfad67f383e729ccaf9a03932b272faeda71b8e55f0", 0xa8}, {&(0x7f0000005340)="dc612b5d2ffade88c14b3b1721dc45f763e4d8c7a6c71bf1f2099ddb4f72e51a302165c52dd221dafa9b6a154f58dad6b7d3afadf7fa988da5467b8c11aa953698f5823f9624259957f037ed74dac4076460f8f2d7fe9f987d64b3c67f8c86bdfefc9ecb79cf594bed854ca18888d01cce76e3ec8df20c075ad0278dd87072a463094714c129f6a551ea0f6e539abbb78481e935a142448defc7f30d779f8adba25645cdded401f7e550166008d4b6ba2c580548621c34f3", 0xb8}, {&(0x7f0000005400)="54f19db9210a0357f8f1acde3b5bb16d201c6bb1c303d3afe09a41dc254cd973287fff", 0x23}, {&(0x7f0000005440)="8621d9f7b087c0b113e8b64a2887f90ae2d767bda0127a2e6c16b450bf7ca4cfa54c42ac7a03e1f91c33a559131516868dc2c2ea89881b19ba8efe1d8aa091b375e0eff6572454e280b55265011332b558df459c1b", 0x55}, {&(0x7f00000054c0)="43a908ea3ba0fb86bfd51d08db9125ad2717bb9792afdb55960e1361c8491031af2a2500fe3f78a6e1afafb128321d3e3bf81af48cc0560a0be524c91f672c1f7957b702006b406497ba9ad3f9fd4878b3de554fdccf29a696abd01a1b22fd7a02b2fcebd327a5a2ea2fd646f56f15790591a28dddd37ff76346ee4bb5e121587b73ac0a4cbaede43d452e22ad8a8546faee00982894aa7ef72f424f77eccb65d3eda3f2503fd3c2afd3aee38213434ce09389f206583012c18ff523722eea22865079e12d95dda23a0f03ed8f1a7e4906997d94a770a7dcdb", 0xd9}, {&(0x7f00000055c0)="a8f80978fcdf4912dd4eb4b3332e725e544e42a89777edfb4d1ebbe9f0615ed0fecb0b265a2bbd4c579337", 0x2b}], 0x8, &(0x7f00000058c0)=[@cred={0x20, 0x1, 0x2, r36, r37, r38}], 0x20, 0x4}, {&(0x7f0000005900)=@file={0x0, './file0\x00'}, 0x6e, &(0x7f0000006c80)=[{&(0x7f0000005980)="16488ddaa7f17870d113f6ebf961c8898fa610dcd623141344b2956b86a38ff43fefffe413681f28d641f53fb579edb1ef26d6afda8b069add06d5e58ded7a2ccb112f149bd27b952ebfbea401cfa7a41dfc34da698964c829d3212fb5e4556d87c6710acdf7b3c60cf16c451d3db57541413ead08c454abe474f0280f020a3fed0a297ce1fb87578e6eca256a133b39e7594d98e7c136a78372202283bca96c5b8b1b4dc87bab34d30e870ae354bbe61cfbb4c3a052886214c8b43b7a9b1b1cbff6edc63474420bca590e58be7c1e0f1075e6d3509d195bcf478865", 0xdc}, {&(0x7f0000005a80)="ef0ecda7f72bd63ee8019f0294e4c25574e1d61bc311d11aff44ddc7965b6ac5ea6be4d5a2d7a9183d6e9fad9c20fca6dc2f7b4aa10c5c4957b56d2e", 0x3c}, {&(0x7f0000005ac0)="a571927ae2b0d75de3e9314d8d279134caa7afd682afbf69ff2e3c37093e50e72817d7f0251628806db5498f2f0802cc287247c09ef06ba5dd61b9f8de25d02049ff5b1ffd9f1bce201e63fdcc1f782d9833c3d7a34134748e5f96260d8e42973f68722d146553aaaf84812a6a603e89079ce27be7fcfbd95ecd46d924ab46c28faee5f1a50886cbfe7bd6a51faaa7c9b7986df3b4aff84772db76238674d54927a9890e4cf49662015c11f74ac77ec67baea5b2fc45f74735d200edcb3d43e0036f88f2a27bb0f3d8295ebcd6a2e443bbd56d", 0xd3}, {&(0x7f0000005bc0)="9f07b15cc32d47fb9e5dbe34bdf3b36a77c4054872a23216", 0x18}, {&(0x7f0000005c00)='<', 0x1}, {&(0x7f0000005c40)="f45ec19a799c3f9d78a74756d19a7bd2ddd890c4d33f08edb59bc62c225a0d01e849731cd571c2505660d27047af5cd1cd", 0x31}, {&(0x7f0000005c80)="f26c4b775a49ac54ef63d9361cb985ff160ac05b492e29a93ebbd49a45e2e315af74b0e4d88799aad8a56bfbd4c230e265d0f86953c20821d823c3bcb7aa549c64a08b65c20730492f8f48dceef159448d8a5710f84db8b6d3ae119083ce776f8d8d047e257bee67acab19cb0f91ea93284ff8d5d58ffc373f5fdefe81a6ac0d7fcde369a3b18bbe68eac8bc54b8eb0de6d101205aca890669b9cf2ede407e9fc440ca1336507e19eac8d58b893de79b5b9b7fde5a5f8daf166188f03d934b3b856b4b382a4f5a43da3071b753bcff27191126ddadb1f420c133c42e6669a0cc64d2ab975bf5c5566746804e237bf2eb931ac76ee76ad7b63aef02052dbf885b1e7473563518b547511eca20e39f56fb2ed033e2d2c50f96c0d4397b0ec5d2c26eb6b85c7c46d406d8ba0576a7a12b3bcb1da27bd2ab2c0b3c52881cd331a61913b25e1ffa878dafd0afa5727b20a982d99caacab5a93047201fb55f046f5f0e8d1cb95f13c4762bfd934c02fc28acd829866c294f46c4edc3cba8b9e7ddb109f6251b174e022830fb16021f33f5340ba3a5da71ac3bf1f43196fe2d0ffe686f8f113b625fe4d226e8e5a1cb2ab89f4ce59e64765af8df2dfedb6edd11553b637101bb2a862416261d0a1537e8840626b2a8f2bf0d747603cde87c664db6be5b38115bee5c742da3c6732f0a26ad9e72cc529ee8da3bf835de59e9fbff16531b4a4ff169522a26ad23dd641aa43570e51f4cbc6ef592d6ea0445d13597a8a49e6dd1034abad6c64b6e28052ddacf604c5fad533003c39ca5a0538de34e3765fe7ad40a571698d74f654a547165474d7b8ad603b57fcdf8d45e2d8072ae780b9bee2413051462fe20abfa56d119896e76194e77038e3d6db5e6d22d91e4e03e5b4dd96b44b0e8f09c932fc77c7c17bf16daef8e6fd956230053bed2baca879299ac2f0b9d79dc8421837a72ed1f6842f5fae62133b0179aa5d4fa75249aa1272dd9e91c89f1485f8bd817a77e6ffce864b269d790b9835b5685fb0897de949185f3961295719932dfed95a5d11f39c3a42c3a32b6b9e57a975d95a20e4ba44d62b39765d4385954e3feb4e47239e6b1aeb7c92e4bc9e0da3c0eaccda1aeef71f5506a84e6be4fd6b11a76fc25f297cfbdaf94afb0fbaff7887e33576b967a9bc41f0a45ae26c91904ec20a1b05e4023f8194242f1c2ee4e123e684f8130eea36cf0fe2d38ce34144af2294d64120473396c2206e6ca23f8bff4e4766497eb4cdc2cd1abf34962434570ec48d433101b0a78f0553df0ddf32def1b4b9bad2231d3c9380e89f66705f4aff8304edb73096c3557fac147aa24a54139d9775d7e77d011b44634f72642983820fc714d477a50b445136bd0b636225781d18e5b2105df8ace802593e1b3576c881b3b8d13a0352bcd07bed1638d6375ecc3b4cf87a953b5689c919a8b0b627cfe61ccc6eaf03200170dbfcd188653be6d92f6c7744a23af72f3b570df06f74724e4b625b516239e422a925b3452a39a97dc4adbb0f308cf0b820b242952bdfcae3e7d1935ed6716bdf31fea1ffff85dd51ca1c7b25c6d480aab951be89b72efa383f3b6a0d3c2b8ac6d22cba51f198fc45ee50cb6a3e10b706cc1bc916f67e7fa125034f737ab8a7f02afb7e608e399fdd0970c980f96de83486bd5c82c5977438db0e2fb9dbca9ccee8e57ee3b6422306bdec7e60ef890495c0e2345cacf9f970af201cbf4901f88b7d57265dc296b66b1e1528ba3c7291f8ac454c052c9511ffd4da61b37e0ce183d5a7cb6e206153f42e5c320ad4c64376b819b558411dde8d9e21d127ca43ad79b4ca83531df5cf223fc6eed17c91c1da1ff072ca45f6a65eb01f2b0d9fc8d8703ad38cc368cf34fbbc24bb73a09b9b1d89c2b8d1440393f68fb849f54204201c23bf09fc0af539ebc89216698a0ff7c922c793e02fdac424855887961133677567575f625aa1fbd4431e32796232d3d932b71a1563a8f8ce9507cdc745375ba216871b31aed9b3f66a9cbcfbc56b6cf2e2979d0eaf4043bad2ed82f9128d820740a5924da6bc1c6c4bd9f85688ebad705bcc36b392e8d6f947de33b207b1a972f27321c05bfb315fca2de4ea82162cb7c0137b5ab4c16b43be4f16d951cb87e5c7aa147ee41e59cbaab6fd7ee0119dda233c182aa91ff458e1d58cc8ce2a35ff8b22bbffbc54ab760366094e38d58810c9373ebcd690059647043e93ecc0f308971b53e4ffce03cf44722f89063ca0eac968feb23a2140e8b49d6ebec66d7c16fa9ffb9f1892cfcf338822ef20a88df925cc7fc013daeb46b8373129999b80d3b6044ff91c06a3e3910cad29c11862a2cc6547ced6cce03746ae6f94b356657cfee5fc445f0d16cd7c50170e4435ff8c54692c471169cd9bc7fdeb837d314aaef184878c848ca21dc75e1349cda3384b590f2f597c90e44ba7b5e7248213a28f9d061e284c8f3ec55a034871c2beb8759ecb9a184edb9c566309a16fa33a0657a33e73f994449e64b477d0004749f00ea3242cea06685724d9da70d9498ce076cf922fde6cdc26a24550467c51d2cff6d1cf8f68f9b5c55aa61025525021610567ef94f1439d0b13bb6fce6b168eb99f4dd320807a11bde899b625ad85f7c0768284d71f238e256f44e698337519d42430bff83cacf7206de104afed22ce1242b3b92f8dc5e2fd1b0d9718bdcb5b6590c438ce95efc2656402cc0a3ce299889d865938a08e0bc8ac6bf21210205e63ef3fa7c74047e2f3a675b64559026452134b6e55274c4b45962dee67759364fa7d668574b76758b127764ee4247d3528af92b86189fb68753769da3f596755ece536b72b71c1455dd3dd27ca8da92e50cefca9fd38f1f2c206e3100566cb002cf8ef404d1339e7ff71524760f29dd94130a44561c39622c4930ec23109c4f70d3c32f655b2c743c56e8089024e3dfb55b279f38fdb543b059f888b0ab7788cd92118d33a49b2bed0b962c24920269e647139625214aed3dd689f973515bf13c1e3b2aaaf803f27e71734d1bf666dbb095f46ecafa481487d23d3fa52d8c2badeeb89e266062dcb89441f4c2af57ebe63fcbc281dce53e391b9d62255107993744206851b62d1cef48d39cab0e88dac756e8f2b36efe307a2373ea8a56601905d77efbb2e79022791fdcd6f07f1011448a071b67e80be1b4c42241368a53cefd7f514ea873846db9fbbd5c96ef2afccc2dbcb32fb7a7ee802ca23e4261ec398baa52818e11e92bf8e99f4dea3829815bf2e7d76dcd1afebf5b6cf65812ea5c624aa4fd39eee648a6e7c58f5f6b31d67769a42412ea24206092f71c8fad4fce670e47e041bcea6f09178a929eaadf18ed48c6f9cccde9e5113952142d2806a269d1795564c687cf608b73310707e92af9a9185e2891c5c55da3c678b4e01392da1eb1ec655a95a56a31344095cb30a23b036cb1ed3b99328ef34a3ddb73174384da1dfdca897d001cc2b6ffbdfeb083a1a06d6ed943ee1073e3973d1fe35f251c0a61e7767e3e70375934bde95c83423e311210f38e45c0f32af84d61cd35c76b50cd9404c6e53237f4f0e3e505b4eb58d6e4e4d9b05441f87fbbdf7e99f5103bc02838273436d729e8880694d288315abf6137d402d59d855ac786c4446f7928315a3e22e342a51036c05a38a0e63ce65c762a15d9a46d9b1c846984f5e08fa5cad516dc2efe7afd9d6474c5694035db56d8e7b3d0db178f77498ae90b5be1e77c3ccaca006b68dc265dc92356069ab57416d0729e28b41991789741a35659fdbcd87eba5505021c45ab579c98c0c8ee02beeaea1b9d46ff62bae4eb0c53fd344d90a0568966873e24206ecfddddfe8a9870421f1476bbd6a6bc295018f0eda2dccb1866dd366d81e730b23386be10bb11792ce2bf93c5427499d9eb75873030f6cf3970556afe54351ebbfdb9b81b0736124f70e9051e4ed5571535ec9eeb30783e359a07cd4389cc1c66ed0673bc6623b3dca72565b0fa9cd3125df4ec8e09d8bb131e65254fbc6130b805d555b3032f4cc2272ec5f7693378f6e48b6fe4bb37ab1e9e9a465e6959791b58aef2adbd617e05ce841d7fa79fdca6d5b1a3cbe02ed867f89cfcd4002fc533c3138cb6d4ce54a997e5fe2ac4481cb6dc0db268e55a714fbe59e6ce9bde20d702727acdc3a1e1ea68df75669413623b05ec6728d636e2ffa7d48aa65d89f4598eca244146fa465d6d3f6f77c090394e97d67f46cf04eed508a6e3d7464ad8c4303a43e996ba3bf3a92ba39310485fe5934618992f6dfede867765fdf776b42ea41b17c3339ca7bd750988f8f29f73f92f14fc3df62434ddd8edea22e104d41413e5703f8c9de618798918402620093c4a4d2c90c7c70b2a5ae5969c0a2e5abc6fe0362abf1ce9aea164251879b5af92853b9cc003d1c350890d61fdeb5a165efb9976c7ba9f1b84cff2db3edd2438f8b54dbf2d6ee69aa539045b46682fa670795de3fe8b4165ad6ace3a812ec7b58a77328cb4e72e0d768dda8a0f6185a35457c24a99c55b84872863c782eb2047a4cde3021f9899b8be1967597204f88827a54521427faf1d96d083ec1a1ea614de65e9ac0bbe82c5115ed8a74b9e1e5a5ca49d7135bae6d56073305afc68bee11967879440a56f39f548af2ebfd9bc9ffb7d540f079bed57e8f924be645fb25ba03bf7194c11c43cfe47db90c61d130d43d70c1387d5666753f14fa8c0c89e2e252d03d3121c57b54df5aff6992757d33dc2085ee7a240f4ede9edaad810a3084532f71067208f5559040c637a4e9871ac4b3e56a3f71620333a8e2cafd2426f4b4a9a84a63ff8d4b68c9d35640bfa8b25fe2909255121c241cb9eb556e33b42036465ecedd7465484128f1df7e35e80bb5fcde590e434f134a552d1f342da7b88e0c6a605d1707923216fc130db643b9f52bf91c081169e874236e70012e09f5dd94811027057171633cd57ec4ae4dad7f1f19f81da122c5cf65c036c94bad5366a5706568f2c3594b959fff5db8996e48ce25558e2875aa2d5bd15c2d33bf7a5e7e47ce63d7eedfebd84ca1bed540be96b5f395f475722aa3db65351575661a5195753e38cc33b70f9d526ef0ba0625f6070ec6acd574a5f79984207e2873c6684dba18d54a01e7a654eeba14fc5d2ac614abb4403c84dcb628d055619c291a1c0487b4cc82bf4f82124b00db4a7578331bada114426104d3fa4dd5c851436d5732abad1ed5c4b1d27613bbf853df8b2e49b90ab09c0f5f6e938a897ad92f105f7fc8ee961a8847a420650bd4e58387721578d60a4edf54915fcae9f54135cf1ed12ecffa61cbcd88b9e7d4f30b85018bbbd479c43d60581e56e4f85b4006e520a7ea686b0e789b937806c65f1370f2cf8b4f0cbb214b35ef780dbea15222d63c88f02edf19b4573092e3019bb5b639cea0927fb955a14bd81a99ee9c2023270d2186bf7e20c688082e502f170b1b305428a8d0ec96124aea054d18fadedbac9e6f4b192d9064d930ea7581cc38282babb93e23d7aac89179e23b24a53aa650da47a96cc0940c695a7f3532269270569aed3cf51b32f7fe547cae579abe2cd848604cdf668fa7406fd353e05b35851f9ded1125c11e149350bd13a4c638d822aa9f502b13b5f19fa034db2f62f1f3e3c444ea0850081dbbf096eb52300bda48312a5fecd5979a381e64b61b999e0395b1bf7373e21695e887640f4608a73bcb47ea7aa1ee2985b1710026533e434bcce20ef0e8bbaa11c2e0c0874ae3f6dbfeff39eb9c1", 0x1000}], 0x7, &(0x7f0000006f00)=[@rights={0x18, 0x1, 0x1, [r2, r2]}, @cred={0x20, 0x1, 0x2, r39, r40, r41}, @cred={0x20, 0x1, 0x2, r42, r43, r44}], 0x58, 0x5}], 0x7, 0x8000) write$P9_RLINK(r0, &(0x7f0000000080)={0x7, 0x47, 0x2}, 0x7) ioctl$TIOCSSOFTCAR(r5, 0x541a, &(0x7f00000000c0)=0x1) flistxattr(r5, &(0x7f00000001c0)=""/184, 0x2a7) 20:30:19 executing program 4: getegid() r0 = openat$pfkey(0xffffffffffffff9c, &(0x7f0000001600)='/proc/self/net/pfkey\x00', 0x0, 0x0) perf_event_open(&(0x7f0000001240)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x60000000, 0x4b95, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffeb, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x7}, 0x0, 0xffffffffffff8c04}, 0x0, 0x0, r0, 0x0) socket$inet6(0xa, 0x7, 0x2) perf_event_open(&(0x7f0000000040)={0x0, 0x70}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = socket$inet6(0xa, 0x2, 0x0) socket$inet_tcp(0x2, 0x1, 0x0) connect$inet6(r1, &(0x7f0000000200)={0xa, 0x0, 0x0, @remote, 0x2}, 0x1c) setsockopt$inet6_IPV6_XFRM_POLICY(r1, 0x29, 0x23, &(0x7f00000013c0)={{{@in, @in6=@ipv4={[], [], @rand_addr}, 0x0, 0x0, 0x0, 0x0, 0x2}, {}, {}, 0x0, 0x0, 0x1}, {{@in6=@local, 0x0, 0x32}, 0x0, @in6, 0x0, 0x0, 0x0, 0x5}}, 0xe8) connect$inet6(r1, &(0x7f0000000140)={0xa, 0xffffffffffffffff, 0x0, @ipv4={[], [], @dev={0xac, 0x14, 0x14, 0x18}}}, 0x1c) sendmmsg(r1, &(0x7f0000000240), 0x5c3, 0x0) [ 373.355729] binder: undelivered TRANSACTION_ERROR: 29189 [ 373.379655] binder: 16408:16412 ioctl 40087602 200001c0 returned -22 20:30:19 executing program 4: getegid() r0 = openat$pfkey(0xffffffffffffff9c, &(0x7f0000001600)='/proc/self/net/pfkey\x00', 0x0, 0x0) perf_event_open(&(0x7f0000001240)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x60000000, 0x4b95, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffeb, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x7}, 0x0, 0xffffffffffff8c04}, 0x0, 0x0, r0, 0x0) socket$inet6(0xa, 0x7, 0x2) perf_event_open(&(0x7f0000000040)={0x0, 0x70}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = socket$inet6(0xa, 0x2, 0x0) socket$inet_tcp(0x2, 0x1, 0x0) connect$inet6(r1, &(0x7f0000000200)={0xa, 0x0, 0x0, @remote, 0x2}, 0x1c) setsockopt$inet6_IPV6_XFRM_POLICY(r1, 0x29, 0x23, &(0x7f00000013c0)={{{@in, @in6=@ipv4={[], [], @rand_addr}, 0x0, 0x0, 0x0, 0x0, 0x2}, {}, {}, 0x0, 0x0, 0x1}, {{@in6=@local, 0x0, 0x32}, 0x0, @in6, 0x0, 0x0, 0x0, 0x5}}, 0xe8) connect$inet6(r1, &(0x7f0000000140)={0xa, 0xffffffffffffffff, 0x0, @ipv4={[], [], @dev={0xac, 0x14, 0x14, 0x18}}}, 0x1c) sendmmsg(r1, &(0x7f0000000240), 0x5c3, 0x0) 20:30:19 executing program 2: r0 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000300)='./cgroup.cpu\x00', 0x200002, 0x0) fchdir(r0) r1 = creat(&(0x7f0000000580)='./bus\x00', 0x0) fcntl$setstatus(r1, 0x4, 0x6100) ftruncate(r1, 0x8200) r2 = open(&(0x7f000000fffa)='./bus\x00', 0x141042, 0x0) mmap(&(0x7f0000001000/0xa000)=nil, 0xa000, 0x800002, 0x40000000011, r2, 0x0) mmap(&(0x7f0000ffb000/0x4000)=nil, 0x4000, 0x3, 0x12, r2, 0x0) mlock(&(0x7f0000004000/0x2000)=nil, 0x2000) socket$packet(0x11, 0x3, 0x300) mlock2(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x0) write$cgroup_type(r1, &(0x7f0000000200)='threaded\x00', 0xfffffeb3) 20:30:19 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000003000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, &(0x7f00000003c0)}) r2 = socket$inet6_udplite(0xa, 0x2, 0x88) ioctl(r2, 0x20000000008912, &(0x7f0000000140)="0a5c2d0240316285717070") ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000500), 0x0, 0x0, &(0x7f0000000640)}) 20:30:19 executing program 0: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r0, &(0x7f0000000100)={0xa, 0x4e22, 0x0, @empty, 0x8}, 0xffffffffffffff66) writev(0xffffffffffffffff, &(0x7f0000002980), 0x0) r1 = socket$inet6(0x10, 0x3, 0x0) sendmsg(r1, &(0x7f0000002fc8)={&(0x7f0000000000)=@nl, 0x80, &(0x7f0000002000)=[{&(0x7f0000000340)="5500000018007f5300fe01b2a4a280930a06000000a84308910000003900090008000c00010000001900150006000000000000dc1338d54400009b84136ef75afb83de448daa7227c43ab8220000060cec4fab6513", 0x55}], 0x1, &(0x7f0000000400), 0x0, 0x4}, 0x0) ioctl$EXT4_IOC_GROUP_EXTEND(0xffffffffffffffff, 0x40046607, &(0x7f0000000400)) listen(r0, 0x7c) mkdirat$cgroup(0xffffffffffffffff, &(0x7f0000000140)='syz1\x00', 0x1ff) r2 = memfd_create(&(0x7f0000000180)="0004003100", 0x0) ioctl$sock_SIOCGPGRP(r2, 0x8904, &(0x7f00000000c0)=0x0) syz_open_procfs(r3, &(0x7f0000000300)='net/ip_tables_names\x00') write$P9_RFSYNC(r2, &(0x7f0000000240)={0x7, 0x33, 0x1}, 0xfffffffffffffe2d) sendto$inet6(0xffffffffffffffff, &(0x7f0000000380), 0x0, 0x20000004, &(0x7f000031e000)={0xa, 0x4e22, 0x0, @ipv4}, 0x1c) openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000b80)="2e2f6367726f75702f73797a3100b8458a1392623c2acc07743172c163cfc71523709c3289acba6eaf2919f32ebaa4cbe89ed30167d7d56e8e65c0edbb300c9e287f10f513e776522729d5c85c09fed3f33ea055b94d27bb72a2bb9fd56015f25cf4f9ced65ed81253cfba08e9a329935ac0c64d10a5e701cc58fe4af8cb5b679468e8ad39e103e2d5b7d9078c34eb2832a5852b28958b7efeca8ffc69c09a7ca33d82e59f9e27ea25a7cf5e65bc52987952070ddac3929791a23f905fbd72419d1539", 0x200002, 0x0) fchdir(0xffffffffffffffff) r4 = creat(&(0x7f00000005c0)='./bus\x00', 0x0) r5 = open(&(0x7f0000000540)='./bus\x00', 0x141042, 0x0) sigaltstack(&(0x7f0000ffe000/0x1000)=nil, &(0x7f0000000480)) write$selinux_context(r5, &(0x7f0000000000)='system_u:object_r:crontab_exec_t:s0\x00', 0xfffffffffffffe84) r6 = creat(&(0x7f00000003c0)='./bus\x00', 0x2) r7 = openat$null(0xffffffffffffff9c, &(0x7f00000004c0)='/dev/null\x00', 0x2807fd, 0x0) write(r7, &(0x7f0000000380), 0x0) write$cgroup_type(r4, &(0x7f0000000200)='threaded\x00', 0xfffffeb3) select(0x40, &(0x7f0000000040), &(0x7f0000000080), &(0x7f00000001c0), &(0x7f0000000280)={0x77359400}) getsockopt$IP6T_SO_GET_ENTRIES(r0, 0x29, 0x41, &(0x7f0000000c80)=ANY=[@ANYBLOB="73656375726974796d0000000000000000000000000000000000000000000000c40000004e8b4b1c7fa37c911d43b7dfc1540065e2cf063a33e71b903574450eb6fcc611bb94c232461f22877f4a6bfa2e09f7f448f8a2ef823ff78d796ab6ab52f030b8fea1243b4a37836d690100843a8998fea04a2bc474078acbb61c426c93824178b70a4bcff2d634050eca0d4f941bfec0542fd99b2bd8823b4175d0b0e455f170e292c18a967fdc58383f9af93bc9c8b8578b5ed8ba7d2084ab94919aea43e1a3acfd6d899d943862ca8d84436629d2159976a615f1279aaf23ce57319edb9be03d5b849777d956c09bcb8bc5eb1d793fe7b7d0c34d4d6cc6d28cb9f66b0a2f31eda0ce948210375abcde9320750390dc04b3af4959443184210eb68c4fe6dced7e44cd2b39f7d25dc53dab0fd596852191868741cecd379b6e87b1c1a8c0dc6b8004595fb61135ed10927d6df243071d53b4757c13f4ceb4480e4a7b9c730be6258db763d9e9e7baeccd140ed2311fd9c570db36e93131c27442990068d315088680ab638288fb05b1676a9ab2fe9aa99539a1cfbb1ae8b35cd18007ba5105ed92f8914bcc2397da080dd1da393ede4f195953f82d03b9a920391ee4f5bd7485d69e1d8bfc93521ea451a20dd056bd3c133aa93c9bef1e254ad7d19379b21be984d93cc7cfcbffc82708aebe5fe4c4aa7af905248de89163041c16cfdaf96ee5b65715c7bb840274ba8ddc979ae077aa20b5ba0e97ecd80abb2d3cdb2d2b6603b3a003871b7220d71909f230fa5e9a7307c10c954a2ff1c6bf5fe3e153c0ebeb4940c365ef1e9cc8588a51bfc9807e866ea6528a77c930c06eb50e3f14ca8abf929570c05ca0615211cdcce3d034946d4fadcc9df5702fca33cb322c27a54fee8cd7901df1066311b737259dfc65048bcff6eca8f566ed75b5d21b58a3c51907ba6d5ef9e04e24febdea1d345b16288065bf64cf9fa3a746185191dc7b2f4520fd2da2f60434395d6121d7063a6455be070f49e04c8c2fa0da58d878d80a1bf9cc58b6926e3c471cb1e79cb85f6ce2ad91ac6c68f955a507ad55f514d131e0a095329227c9888f9fb19bfe6df77dff07ef08544a33e9f10d72e3ca6a0d70bf0d4b3e607a2238db2aa9c1011d0af4a39786e48004427b8b55fcd1f7ad63a9aa5338475975159310e0e40000000000000000000000000000000000000000000000000000"], &(0x7f00000002c0)=0x1) recvfrom$inet6(0xffffffffffffffff, &(0x7f0000001840)=""/31, 0xfffffe0e, 0x100, &(0x7f0000001880)={0xa, 0x0, 0xffff}, 0x1c) getsockopt$inet_mreqn(r6, 0x0, 0x23, &(0x7f0000000500)={@multicast1, @multicast1, 0x0}, &(0x7f0000000440)=0xfffffffffffffce8) setsockopt$inet6_IPV6_PKTINFO(r4, 0x29, 0x32, &(0x7f0000000580)={@remote, r8}, 0x14) r9 = accept4(r0, 0x0, &(0x7f0000000000)=0xfffffffffffffefa, 0x0) sendto$inet6(r9, &(0x7f00000000c0), 0xfffffffffffffe2b, 0x0, 0x0, 0x0) [ 373.673072] binder: BINDER_SET_CONTEXT_MGR already set [ 373.679167] binder: 16443:16444 ioctl 40046207 0 returned -16 [ 373.712173] binder_alloc: binder_alloc_mmap_handler: 16443 20003000-20006000 already mapped failed -16 20:30:19 executing program 4: socket$packet(0x11, 0x2, 0x300) ioctl$sock_proto_private(0xffffffffffffffff, 0x0, &(0x7f0000000300)) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) write(r1, &(0x7f00000001c0), 0xfffffef3) read(r0, &(0x7f0000000200)=""/250, 0x50c7e5e2) r2 = socket$inet_udp(0x2, 0x2, 0x0) readahead(r1, 0x3ff, 0x1000000000000003) ioctl$EVIOCGREP(r1, 0x80084503, &(0x7f00000000c0)=""/244) bind$inet(r2, &(0x7f00000001c0)={0x2, 0x0, @local}, 0x10) setsockopt$sock_int(r2, 0x1, 0x6, &(0x7f0000000080)=0x5dd7d56a, 0x4) ioctl$void(r2, 0x5450) connect$inet(r2, &(0x7f0000000040)={0x2, 0x0, @broadcast}, 0x10) sendmmsg(r2, &(0x7f0000007fc0), 0x5654807, 0x0) getsockopt$inet6_IPV6_FLOWLABEL_MGR(r0, 0x29, 0x20, &(0x7f0000000000)={@mcast1, 0xfffffffffffffbff, 0x1, 0x2, 0x4, 0xff, 0x3f, 0xfffffffffffffffb}, &(0x7f0000000340)=0x20) [ 373.731736] binder: BINDER_SET_CONTEXT_MGR already set [ 373.742111] binder: 16443:16444 ioctl 40046207 0 returned -16 [ 373.750035] binder: release 16443:16448 transaction 306 out, still active [ 373.759499] binder: undelivered TRANSACTION_COMPLETE 20:30:19 executing program 2: r0 = socket$inet6(0xa, 0x2, 0x0) r1 = socket$key(0xf, 0x3, 0x2) socket$key(0xf, 0x3, 0x2) r2 = gettid() r3 = openat$selinux_mls(0xffffffffffffff9c, &(0x7f0000000040)='/selinux/mls\x00', 0x0, 0x0) write$nbd(r3, &(0x7f0000000080)={0x67446698, 0x0, 0x0, 0x3, 0x2, "f8a8e91783c9a8e951e0138db5c9216f4899e13ac9b247b1b3d0b5ac61054445ae7dc9266112512854575e765ac8b6f37eafeb5482de6cdb40eaf3c1c64f005a6bf056e86703b1204de10c9fc403daa0096ef20391370d87af1d8de012b2a2b51def8225931fbea5d5a0003ed7030258ae6fbf6d0100582125060b1106fac0ca7c1af3514ce8f2592b337913ed88cfad49cbbe925576ae1610030e1fd8538694c4115ceef68762195ba0b26b156c5510d230991e60e981f0c2a343ebae9060324a629b45cde9"}, 0xd6) close(r1) syz_open_procfs(r2, &(0x7f0000000000)='limits\x00') setsockopt$inet6_IPV6_XFRM_POLICY(r0, 0x29, 0x23, &(0x7f0000000200)={{{@in6=@loopback, @in=@multicast2, 0x0, 0x0, 0x0, 0x0, 0x2}, {}, {}, 0x0, 0x0, 0x1}, {{@in=@multicast1, 0x0, 0x2b}, 0x0, @in6=@dev, 0x0, 0x0, 0x0, 0x1}}, 0xe8) sendmmsg(r0, &(0x7f0000002000)=[{{&(0x7f0000000740)=@in={0x2, 0xc67a}, 0x80, &(0x7f0000000600), 0x0, &(0x7f0000000280)}}], 0x1, 0x0) [ 373.783356] binder: release 16443:16444 transaction 305 out, still active [ 373.799122] binder: undelivered TRANSACTION_COMPLETE 20:30:19 executing program 2: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000100)) unshare(0x600) pselect6(0x40, &(0x7f0000000000)={0x8}, &(0x7f0000000040), &(0x7f0000000300), &(0x7f0000000340)={0x0, 0x1c9c380}, &(0x7f00000003c0)={&(0x7f0000000380), 0x8}) r0 = openat$selinux_checkreqprot(0xffffffffffffff9c, &(0x7f0000000080)='/selinux/checkreqprot\x00', 0x4000, 0x0) ioctl$TIOCLINUX7(r0, 0x541c, &(0x7f00000000c0)) 20:30:20 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$FS_IOC_SETVERSION(r0, 0x40087602, &(0x7f00000001c0)) r1 = syz_open_dev$binder(&(0x7f0000000640)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000000)=[@enter_looper], 0x1, 0x0, &(0x7f0000000040)='+'}) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0x0, 0x0, &(0x7f0000000780)}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000380)={0x8, 0x0, &(0x7f0000000500)=[@release={0x40046306, 0x1}], 0x0, 0x0, &(0x7f0000000400)}) 20:30:20 executing program 3: r0 = socket$inet(0x2, 0x4000000000000001, 0x0) ioctl$sock_inet_SIOCRTMSG(r0, 0x890d, &(0x7f0000000040)={0x40, {0x2, 0x4e22, @dev={0xac, 0x14, 0x14, 0x10}}, {0x2, 0x4e20, @loopback}, {0x2, 0x4e20, @broadcast}, 0x2, 0x1, 0x0, 0x3f, 0x1, &(0x7f0000000000)='veth0_to_bond\x00', 0x2, 0x51, 0x9}) setsockopt$inet_tcp_TCP_CONGESTION(r0, 0x6, 0xd, &(0x7f0000000680)='reno\x00', 0x60c5) sendto$inet(r0, &(0x7f0000a88f88), 0xfffffffffffffe6e, 0x20000000, &(0x7f0000e68000)={0x2, 0x0, @local}, 0x10) 20:30:20 executing program 5: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) r1 = getpgrp(0x0) sendmsg$nl_netfilter(r0, &(0x7f0000000140)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x2001020}, 0xc, &(0x7f0000000040)={&(0x7f0000000c80)={0x12d4, 0x5, 0x4, 0x2, 0x70bd27, 0x25dfdbfe, {0x0, 0x0, 0xa3bf}, [@generic="bd45e2fa36329debb97c4be865d237f06921977376f9b899fe81bc6a0bc9d2b80d2d0bdc637955fcb6d9626cbc8d6a03d6206d9a5b", @typed={0x2c, 0x38, @str='trusted}ppp0!em0\')bdevGPLkeyring-em0\x00'}, @nested={0x20, 0x2a, [@generic="e61c931ea4a23eee7317ee47e3b9c95d80669bf88ed69f3a8d8985"]}, @typed={0xb8, 0x0, @binary="30411615eaf7ddf506f8d969f7a5826fdab23d8af198f58ff1cf3a6517d7f6a73f6ec60c4153cd9b8855863fa525445c3a1836bb4ee3540b6ad98709a29ddb6c34e6f6f6a54b6ebce68414e45ebf297a907af31c53d901a86cf54accec902a872bd51aa70636c67ff3171bccf3fa5228e0a54da684588ac4b3aec840cdf97f5d9418ceb21b20bd8713d0727b0052d667b0bd1561b6c2fd682ce6808f6665e7648d15cfd4bf8167656e1c4f323efda211ed1e79b7"}, @typed={0xc, 0x74, @u64=0x1}, @nested={0x1178, 0x56, [@typed={0x8, 0x6, @u32=0x7e65}, @typed={0x8, 0x2, @pid=r1}, @typed={0x5c, 0x1c, @binary="5095382fdc5ca59b3bfd1a40773f9882732806a2b05979b07cada01451b62fbcf22093751352192e81bfd8593b2f26fa79530ea00123badbeb82b6cdbaf5d958679ba72da3211b3456a3e00278a6141d1a811910cb1d"}, @generic="77936100d67abf3d1ac4851b1b604d1b31ed3529f9990ca34174585ad8cbcfce03c1b62d73b8cb716a2e716044bc6ef1bc54c12b4fc3925766cfc3dd39c60f0187605d07cc47dbddba5b0ac7b3d8bf307b67a236d83985e60b5cff9c6433b89adf98aafed04b13adaae98218fea4d74b31fcef5337fcae7e0a2f5fffaff8376ab1ce73f4669e64c202b5116adf44308eb58d2f28683de73fa1a90d08f0cdc307a5c8b3323901a495ef1f8bb25230e99f99c1210bec473e05a6fa1a3db1dbe8456fff59d0202ab35f6df7a134d8830413c023497e1bfc01b685e16763ccd2ce40c1", @typed={0x4, 0x36}, @typed={0x8, 0x59, @str='\x00'}, @generic="c89baff2d390306a87b940ddd8", @typed={0x4, 0x4f}, @generic="43129eef12c1e2bdf6e42bbf1b928f9c9511afbd72b0c1760e7288c36fc78566f9c0b5b0066900ca2bd48b7c7933189ec14057cd80d6a27b366e5753ad17b697c43f70ef2572013ac1f65bbe8ab23b2e5201a6cb89f55d40c6b5b35104061292a1c2044e0cf8f7ff2cd74a96d88f877332b8f8a0cca87795feca9c260f875cebd6d3278d6a311a973e73a291df2a3a506c87299c6e55b42795bb9788f2bb690a040c6ebef04fd2fb8db73bd8d8701b3bc7baf096283227e48172fcd69d6fb66fb83ed963a8fc2ec770307e595b7e3b326e911b5ac467bb098af0ead87b397b1d4a647883ba62262c42143ffef25828285af4f8696e37eaefedd1a8a9203cb306df2215faaabab9337a260a60a6a7c07848b926f0084142a1964f205ae5150be2aa3513d2784d9b442ddc2d7d9dc72e210d2763d6cc3abfa4ab2d4d3190974d9ab8d10b7593a4b8190f976e2ecd6c54d05c4a5b8b4f738e3328f61f555897567ca3ab5b7f9758c361017de2260acf777cc11222480b7aeab353ed0299596be6ee42f6963167dbaafff55bd2686eeb651747e09bdb652a6296ffe1aa7acb651046ac6b248ecf26f094c03fb967d4056814f386256d63c79a04f77c0b72d587ee266a27b99f8f609cd9b2f56663750131b924c9a8b8a7d88ae354a059e79643bedddb7c990c28876f60d23e2324da1fcf6b3dd617cbb3a402bfee63202c46305dce237431aa44577c59ef47a2c8d4d39b20fd8057ed7daecd7a57c4a5265da75e4559af1cf2c2d78204298e935e42d80ba11cd468339ad5687539fa992e5530eaf33d1bf0ff86be0d50d515b507716e70cdfe580215b21a7ecad2b90d5afc252197e3fa396d4d3231841853b53be7e733eb8d5268ce2f59cfd2d38a4052ed8f35713d77c328b10c451687de697ccc720aa82e9ac316070957e06e4daf7f8024822956b7d0c14d6765238c5a9f342d069363485337ae832d66b64a7491bd6ee6980ad6f8d531665ac7c7db4112e3015cfb21df62c7854807f59ba34f1b76ead2ec078d4c5713eac270c957f6313911d1932a6505190762dcaf041c6ac715df432ad378ab94071a859f8f762a3cf99d626c2589130b5adc6c3bfeccec1d3f388b42535fd6e400eaab763eabd51e00a598d9cdd6750ae0597de10cf414660e98bef6560595572396c002aa8979f98c877e5944e735855e3770aefa227ebfd64324754fef1352acd06c4df9f1dd19b301bd9d695109ea41af8fd4c7d338ae9b51f2c9dd20a025e01bcb9dfcaf0007dd191cb04398a14d8f6271b0f043d50ffa131a0cc279390f57bbc0226777dd7c7decd4f5de74b1422034dc9a8d1aacaff7cb8382370ea4d3ce07478e68332c9a9b8de6635a1df941e1ac500d1ab4dddb6c4fe84b3e1776942f61f207ebf776b889614fe933e82827bc3e4d5870aa0171fd9e22183f968994e92d52716f44d5d29b1b48571e5a9e19f7cfb589970c819c11808c89d64c42b29aba7945eef3334f93406944661d078f8cd8758fcade04bcb5436375b5496f813268c9deb34a1838402e6829332d1c600bc8987ff00ea9a540bde54d7cb919dfc9b5b3ca9e41c44793a9de4573d04601cf5b9ee6a5bd9603775b6002f7196dfbac193193fd556697f0745c94e5b189d4bfb68440d6f7492f5d0e0410ee5e88a0d34e70c28605f9dc816983e70a1b7c4fc2713a8bf520853779a20d6cd9d8ad1f8f526660b3e1d0e797dfff6e108a77720327d61a61f2747e882bc357a0d1e022f3edf26695f91e59a8de599079d8da8d9c38b9d27538a6f538aee47940eab9e97523a370e4cb4a359f0332856093ce3817169409bbe3d5934082b4522d1630d07f52967c65d81f659e6e7bad683914c8faa2b015e93d0faa3a652c71d1b3741a7a4e493fe6c1103dce86d68edabb6276e30f17cdfa1e122d1783583ca2dfc1247a916728f61a4ba243a2290ad68fc474bc36f1b1978b5f037f1eec32a44ab446ec7ad1dc927adb96a810352dd86c234e552afa3e8811bc7530ae6ab39a7a09ad6a80b82fca50f0d5b6dc6748f724e4e7d844fd6ae504c4cf1fa5ded2d61e6d291f2ebf337cd23a3938364077bde2c3efcf1f262d34eb906b388aa8dc8fb1af588ecec4d3ca62f95298a5dc06f0421e7085649ee2aa6a09196dc2eb1c0ab3e732485c5b204a52b523e10da3c3edf12dd91d51be308a917b42012386699404669c3f5fa4fc3de87e712026e60e6f2757117cd05fb13143b48bb486b9b9c4dece432aeda99b0c5ff6990b8a4e605afada3158c7a7b9e9e7330edcf09f1624644f4ba436808611d0f0ad495fda769640f8b9f4301afe3477b75d23cf2b005719425f2f367cdfa5cadbf344e9635250abd9401f610a9cbb973790da0b85eb7648ed55b61e08ad89a04afca398d89ee0b6db147503ffa93e74f531939c29e4021104ae9d8b0f9caca94b5879feeb51a21d1f3d84bd1565f012d5b195993837912bde6f0800b324839b8380df951e8e8e19856f0e120f9bca139157619db5ca6579e2f2bef52724e8a4468a83f0a9f5378603a9a483e75040d0892ec6ef7a7c9c9b11bd2b83b271125b781221019197f40b7669c4167906eeb267079ce47e87df50494aff6e37f4ab509d5c6a0e1733929f6b6a7ce3c01ed3b2552f47f0048e4b14e35054fc388c85341dd3110e76ffa9f29d6662393f3c6ae7633130fdb1088dc711780b8bad80d754dd55cc9f7c943a6ce13d01df4b651db5741558705b3505c5c6548f69a0f05eccd50617b19960a6d9bfd165cdec03cb9bce6180fcd47a7da2db55a5dd2bf6c3891638d3bca7ff73c685c1e48e3da6270cadcb7665318f9b57640bb8569aa7e0cca97ec1cbc611a4b47a3499023f3c363f10b32f4a49b80998c7efefc641d9ebbbe94833c8e5adef4960ba37bc5f0c29ad73663062c38014a4b022d864b663237b09c2650667385f5f8ae0dd52b1e65da2c6b19cc9de2148a363053789ea4469e80400ad79eb6ec9fec0ceaf9d51e15eb46a0a1e552a21e679d1b4c7d7040a7189d6373cebb3f28079ed01a2132dc31d00761ff698780b040f8fddc607357c24e9598457160b212fe5d88e486b3ddec38be091dc8559407308af0c2aaa7a58c5144e80a0a7d0b62fe0f61f1c36238ad892dab1f7b6c7bec5f5256307e554fed3bc4918c05b736bbb765ccf86c0dc606e7be63a07ffbcfe19b626b5f8606ee37102fff2b4dab8813b7597846dc2f3563f175d848a47b63d59920a3053a2b0c8dd803cb44b08e82a6fe4ad3df2ef707f4de1ec7ce55cace8bff3f7fd4647580cb67405ec651bb4669d34e235e0eec9a776f92c9f5b9d3ef8633ecf92e191763481e023a646ba586d3acd1372174725b457fb40659d634350e7acf17fc3d6c23986a53fedfac74b61a8ea237637ae2844dbfab89c26b768508d9236198554853f1e95129821882f6c167a7954f4400d242e8bf0f568d69dea717830d7fd805fe82f60e84a9ff3b9ebe0de722cefeac94e0a1b439571a4351cca12314b1b55c2a8bef665ecbf6eb671b1625c879c4622bfe636ed7a1572630032cdee685b3340b4b44bd0b3d98494f66afaf3279444c68c98e61858620f0fbe4702ca27ed0eb35123141e753524a85d1618636ffe3fa57c64ace2bcb01f8366cd4a3a521a1ee53409641ac0398c5c20af45b4dc8c84ee7f19643f7c5296ab50bd01409a8b7b96a9742077ee6a21afe2acdd72689520cdad74919352f18f73610502bd03395820106f4144732e8310339a4867283b23e3ebe7f90c7050be476005580dfbdaee124bc0e4bd1da28eefc7af1872146b363ae2e1e546ae61ffa977107a7fb1ddde84770d338c9d6e534567e83247df754e62be9d996a06a0c915a065b1933903f3f53ad7e15280812497b695b713d35e4818dfa935165b843779ba81413f238ed2c346a83fbb4590209492e50a5b37d39812043f94ddad3833c407fe1a061dd20e9c8ca0e667b9ff33c53e9e3d22e65d11988be3fdc5152cfde26d533b7c6b55533e7838aec4a217238a3edc2a1ac013f67e53aff09f22c0f68a75d7d5faac3cfb6760821956f4560a18e7c65586ad5d7fd2d5c1d1a40136205e0874b70ec50b45e9aa2db046df5adabae245b23fb0f2a9d86ef25bbe29d0db6bd0269246ad7094309960ece6718b0424e594e88deeeaa4968945ec8318bbe08653057eaa54a5e26bbbc3058c8d69ba6ce44523ec97f80392db724d992901b2a42d13d9b10ab63788e864dd8765ceec2bbd8a8828cae82c38d0358f7d7837e9752448ccd19927e3883775bbcd37e3b4a48f35fa9533639cf7f1d29934241b2e0b050b15e258b83380416428df7ca0f21ea4e67146f6089b5da7a7e47cd85d344f9051cf883e3b20ba578249e98484e26e93d0b0c219b2771224af2528d9157a24bd0ccb9275f354aa339f7fa378a654ecf570cafc8ef1038800469a71b90465c85fe9907c74bb10d0f5e9df47d925de7d7521d8260c05b0c14e57106cf6fede40872c7f0559ced8dde1d30d1cf7b52dfc1a15db6ed3325e1349fea06839073754e1e7d4831969804d0aa9bcdbed3a6ac3333178e73f75738fe04d57577d1ddc1b72e6032725f01914021db6c1c7ad11e53f757a02ed2e99236fe1704dd724164c3115978402b9fb78f8b5f2ad200626b1243cbae03cd061c56a1dbb6a2f378d2cb40ab5ab7311e71304255e37a3786196f43852f557a71af21edbcf2e8046b692845679ab4aeafed63488f964fdfcf5eae54765a2e6865400638c98a46ebcfd9defd50fd351eb75bebb636a6ab9faa90d0ac86703660d0559eac87c2ddbac6b5beb1077e8ce9d8d8f28e7ad5370eccaa3679c0c77da85549bb4f3aef573d7084bd1b09d437c604329fafc1bb2841a891c1db1473f19504d2c8cd1722fdced3fa3d3ef1088abce9abe95625494be431f1e1a366d82e0983c550fdc4ebe110e987337ea3f3ef2855f1ebd909336b258d7bf602525b319cec888065edbdf92a318e20cd2bb2872815e33835bc8e2d9db48fbe019a3856ea64f84bde5390b68008d7ab7a3e70f861f3b1d896fa949d4e9a47171d8f64ca476a4c38552be8838561c8ea9ceea5dab8f2f0256fb6335fd6c71731c0c7e44937623ce0cc405729ce7721933b119fecac90f8b751e5ad08822608dd2ea6a4336ede2679054988e86e805af1920aabfbb9a8e47bd12a8f9cececa10425d566ef16afa34370c6385b1a43c5af536244ab3fb3fab1efedd337956459c1b8173b6f5f37368d81f25f4c8ff3e4629e844bc336efb80cc0c74ebd630da35139dec9e79af569a0430d30d98230b7f08abb3e13df069313fee2328e4ef8c0e940f114c43a347ad75cdfd8a3590985eebdf2a7f81f2aba95b137ad394bf9f33f7e7418f5ad195a83124c401e910302ae2b59cbdefeff45a2d79c12745d3c3c0ab2f8b2784f9af1c6be0c72766b104165874ff1b3cbe8aa6e13c1486354a3c5c0324d1d78b45b29fe4c7493a5913b8a289b49181fd8eee1b83ff722579c2989656ed9256ce2b8f79a931898907154e15978896de551e00e78cef8b3c06e77ef9e76c150266d58cad238d41284084604f67bb08a158ef412fbc30706182a68f21a25ad90bd108fba238b6a24bf077f335712b54c4a26ab12ecb438adeee720d480e90ebaaca39c7e64948395097428cc6458b86bb3c063f7f82b28443fa63c7721b14228d67928c1e24ede497ffec3b5dbe31528dac87cc41aa908082a4bfadb510331f44d0cf1f377acd4356c1d462722207", @typed={0x8, 0x8c, @str='\t\x00'}]}]}, 0x12d4}, 0x1, 0x0, 0x0, 0x4000844}, 0x10) sendmsg$nl_netfilter(r0, &(0x7f0000000080)={&(0x7f0000000100), 0xc, &(0x7f00000000c0)={&(0x7f0000000340)=ANY=[@ANYBLOB="140000000301ffff808f00003d88c83f00b516ba"], 0x14}}, 0x0) recvmmsg(r0, &(0x7f00000013c0), 0x1ad, 0x0, &(0x7f0000000c40)={0x77359400}) 20:30:20 executing program 2: r0 = socket$inet(0x2, 0x4000000000000001, 0x0) setsockopt$inet_tcp_int(r0, 0x6, 0x80000000000002, &(0x7f0000000140)=0x7b, 0x4) ioctl$int_in(r0, 0x5473, &(0x7f0000000180)=0x8) bind$inet(r0, &(0x7f0000deb000)={0x2, 0x4e23, @broadcast}, 0x10) setsockopt$SO_ATTACH_FILTER(r0, 0x1, 0x1a, &(0x7f0000b86000)={0x1, &(0x7f0000f40ff8)=[{0x6, 0x0, 0x0, 0xe8}]}, 0x10) sendto$inet(r0, &(0x7f0000000280), 0x0, 0x200007fd, &(0x7f00000002c0)={0x2, 0x4e23, @loopback}, 0x10) setsockopt$inet_tcp_TCP_CONGESTION(r0, 0x6, 0xd, &(0x7f00000000c0)='reno\x00', 0xffffffffffffff28) sendmsg(r0, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000780)="6e6f0e9fdecfafe574d71cd2f5ff679d46c992e3c7a1e012e5d8f30c4f823063d537ae3d7e76aec21aaab6baee581942b28c7d1679f0af3592d78d0a63ae2da1790dd11eab0f9033b0e9ce1a383fc42d7b2eae6023870a80e8d96cf811e18f01ba88d9a4fa569628180220e010ab31099853c0a7d2dfcff54db45de2233d52daa2feef847e73cd30a92d84d8c1f3782eeaf477956d02d4f39e674dc543eb834a623ac23a0fc23ee481fc5f7cc2338a80e285f6137d51ebd815507271505c95a231d5101bd654e816e33430fcb5ea7e491c1831ec0b4def5f5245fddca3cb300fb510b9c0b536423256dd0a83df7723cbbe2cef6fb89c988857c5a91beade0da222a39017533bf36d6f4c156d6f9de2fee49e051548a712d5a73bfbab7921be7f0c5df04025e1180d54c3b6e6856049ba16dc9d5b31f023e0611e439d09dee78aef3dcab1c31f5c752cfa8b51af2804be0d865208c0eab0c22e8c8bd9764b7b27e0d2a3be0de042280d4dcd5ec9946f60448612aacd997ececd19c67356e4e5e44b6afad44e0a2aec2226c68e29291c5c2a820d94d81b166c9d6528ab5a7b103af97160aee1f7248c2a3a7ab476bfb40f0a1efe072af3b3acaf3f335e606692efb5d97b183365bdec6da5dcd8dffde5fb0e021e263911e6c38526c50b432ed7f545c811bc4706ef3a187e8b6694288b54a4104c7d58e2f03b25fda6d8aee2aedb8cc343334f8ea9d5577eb5274c22bc5414b5e8780452b0cc6813a221e57a4004504fb7389b4b28e5c05293a0f15a71a82280b47c9a2d73423d44a1fae4f7dadb11f4d82b1b70cbf13c2605edb15398c603fbe3dcbddfbe91cdf6a8a1ae9384732d1b2630d770cf25994b5e80d8dde9c2f172b66b5feef22701005a1de0f9f74597f3c390207c5c997983d3b4cb6f269770c98174c4fe3fbdc3b030293c57cb9669fca1b9a3684fc7556b8060ea1ea88c69a7d18436eb770d6696338c9605c16f98e4c2f85ec01ccbafcf20440991702a4375814df8025b0ba1cb87001532d788fafe869c99064190f10aff86febc5dc1eabc5e7fbe1cfa8da26643ce511773ee8f664a5c4097c67137847a680b3963906083d6c0843a66be26caef0584e1c4ee2925d1bfccec689400980f570c63c35c1d823bc2868aab7a2bbe2f366c216926b9dc4069b3dd60ca2048c7807107c39808006390c8b4f923b7e542efcbbef5bb6a93133617b04d2edee264183e9192691132316ed7e945776095f7d8a1975cf61fe1b3db4d78fb46eab7e6df7e29b40e21354ef481445dbdb7bc20dd93b3fa16d53b7a449321736bb84e02df514115d81cbb0461a3542b7d53e045f6ac6646885e0c66df647814845a34f4fc20056505f5aa8e9092dc8fe9e475437629ef75bb953d4ad05723ee7e31675ab12a328f020a07925fb8b073dff619b559020ef656324b6b3f76e3a824c81d1bb98e05267d0c8d6e7450f34375b16be3dacf9e28186adb9b0a264127d46302a2cf0269ddd3f0484b0ad0b3b0eebac6a45386e35909252e3e82c975c5c4f9b624c35ef7760e37055a994ca41986c8c720766320e2505c4b34b31e718951a16c0d8e1288120971530c1788c87db541800449927e95e2b8c86bccba00cf05caf435e83313407e76d35e4e09c1ba398a8cb2cad75805c502f9606a654c3599e3bca9d2302b7afd12b917372451b3416260f0b073d6b443f443ecdbd17379c5c9b2601ed3962837fa1578c5ce56a01584b551d5f5174afdf8b93bae0cee75086cb8290fe65087e58516b10fce97e1b22e62909708f5c8f9feacc035c80777c84b767aa078aa9a5ffe03cfa22aeef00fbafba9b1be4f74bf61ce86cc356cbff245d1afed6b3fc96b8eeb29940c824cc8a0eb02b801daf1d7d177e4e5111243a1f8b94da20fe4a443c683adfd9ec302682a3c8475dbd2e5067482629a311215500b42302bafc6b042d3330cb8ed852fb01b90719170d7773c2f4212d803f15c7d4e51d810ad55dab364f48bf157657afac3f92aa20a9c3af95bb63d122b6a8bdb81520d23d29bf10ec6658a281e5e6fed7e26ac759026e6e49125ef2fe8717f9124c6782e420640c67625b2c3c417eada5ac08b02b6308c4718aef1c53ec99d8bcd6a95cfffaa256b3347adbcf26aab2dc58d96bdc2e0665d20ff5b4531420299013042e1d91ecde5b5020d638af385cba9916c2606be32f96c64e3341b3f724b43aff8c9b724546a69ef5f18a9c455a4688848d9dde0fb5ea9d9bb80b7fb007e30fa9d2ceb90dcfcdf64d69c9584f239bbae134fb1053ad78f31c324e047e8cb8545f6127b024ff293e3f7b28e7588c7bcee1cffc9d8df1b1e6f3d33fa155a93b2be6074fb4daa67857a4ce38cb4e01743f2a45ff4065f00e1a37655661d2973b0e8bc899981aa71feb55089b644f054a2a1c87143b4eb4e59fb18a99aa8af10598cb4befea33057389d3d78f86527c11229100bacd8e8f98fe1f26cc4931cb5ce90a9be15f6af021b76fcfb86f90328177f356c280470276594b1130928038fea6f5fc7e83cde791638377f96e48465faf1e1b5b88e62c128a1dddfd703b84e7d09af3fbd2ef52d0ee42ab18abb54f7009584eee101224c23a49e6c061fcdc25c91972e2964c680745ae88a1899ad2ee0c092a522b489daa89f9a9fa40d4d3eaf354e8bf94c6439db5ed4ed12d057a3c62ef7b562f0c1b0c119af2c1e4d67cd986cdc873f92446e0647044ab547defb7eb576614eec257cdf69605ef6cf55d9d09194b443994a25838ea01518698554b0345d985b7f871ff36150819ccb95fb96d2cd7837f4f7bf8166b3062fc958cba1cb1e259575e05f994a76416a54e37512eb3abd61878b4ded1bd349d23e8ee0aef832b35b4fef0ab95889276512d4847a24a207071912368df0bdcf72791582b596e4f0edcf216f9e066720f11676a82c721f23bcf854d8e7db65a2f6c1dd130f080c666f49760edbffaa687b2847216295648398076d5593d16190d6b24c924ff34f5a0e8fc2e780", 0x861}], 0x1, &(0x7f0000001780)}, 0x0) recvmsg(r0, &(0x7f0000000240)={&(0x7f0000000040)=@nfc, 0x80, &(0x7f0000000100)=[{&(0x7f00000022c0)=""/4096, 0x1000}], 0x1, &(0x7f0000000200)=""/20, 0x14}, 0x100) [ 374.187603] binder: release 16408:16422 transaction 302 out, still active [ 374.223929] binder: send failed reply for transaction 302, target dead [ 374.249572] binder: send failed reply for transaction 305, target dead [ 374.266544] binder: 16473:16479 ioctl 40087602 200001c0 returned -22 [ 374.273902] binder: send failed reply for transaction 306, target dead 20:30:20 executing program 5: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$nl_netfilter(r0, &(0x7f0000000080)={&(0x7f0000000100), 0xc, &(0x7f00000000c0)={&(0x7f0000000340)=ANY=[@ANYBLOB="140000000301ffff808f00003d88c83f00b516ba"], 0x14}}, 0x0) sendmsg(r0, &(0x7f0000000680)={0x0, 0x0, &(0x7f00000004c0)=[{&(0x7f0000000000)="7f3d70653c7e2719e905469104bd1ca6294e2c492fbf4c4359ea7935faada92216a20e99bc2c3900284d12ab01bc0ada26063d4f3a3efd18750a4919e8527a5d73ac87c0ed8dd53b54fae286394a78c492237528c8d2cac19196d7e2a886c23e94b2f77d5be5009b187bbd4df4c2a30d48f4c0c2d3bb58a3d5e0", 0x7a}, {&(0x7f0000000140)="93872b6e5104c620db6f8bb185d1428363d211c7f4212669b950a744598084f9f142071e6252ce239cf97725363b768ce53835e837bdbca9405fd588a63eaa1c01215eed458857de32e848801fefa560cf844981e305d69e54ef53b2cb4feb44efb81a869c0a76100fa6e99cb490945bde9451a6518838f51431756dbf5d84f25aa41cc2c2ecda0bbc37b121f3918c3baa894c0a189c5c4466fda90c95aea1a57e90b165c8812430704ea715ef92ab59bfaf933347ccf14e58ea29ef1ca74025c2", 0xc1}, {&(0x7f0000000240)="eac7e87fc66581112526b4f9af79e10e77c3e035eda812f9dfa0c3c34dd0ae0ecf80794c99aa56074335bbaaf1c11c514d558031ed67fd2a0697414c66e81cd0e08b17b0651127cf65593da24b1d8f41bd669c4eb7bac5aab26c5e320e9fd8f845ee09937ebbb77cd106a3123a1a828b7fb1b98a2b3e52666666f8a6fd47badc78595f17834c30de84497761bf4d12d5e17bfa8333f68ab2324ebae8ebae73bb8e2c14678affba8c79b299337d", 0xad}, {&(0x7f0000000380)="1362500297cae3f0db341247df228eb46dc4a44d18a29807fadd8272d7f1a309fe1fab0c5e49e439ee353b1cbc2d2e0bb8cead8f64abcd782bcd296ee8d45286c83ba42ca05dac9ca41a9d311241f49d63912d4285d540543420ddbc", 0x5c}, {&(0x7f0000000300)="2ef4e673d3ed4412652992d3b31029f91e7fddff5e5d069217", 0x19}, {&(0x7f0000000400)="80dff4fafc3a18af3998dd0340807930685314d7be60e711ad6bee8f4b3cb298fe57410f230d30c655ad7e8731187e428f1da8903bc97e542923f20fbf8c39a6a9abd232fc6e6eb6db5d404d4d54b4af29d579af3483fc0d9f8ac756cd24b45abb490a90af9d3b2c1a6f27211072f50a0ae8eabc63daa79bd6f3bfa8108475d11ebafc7568dcb595ceb73144130cfeab8a75855eb2afe285edfb0ef0192b51c0f87f150b", 0xa4}], 0x6, &(0x7f0000000540)=[{0x110, 0x115, 0x9, "839335dfe89256feddf4a6ca042893950aa105ae12118f6c027fb75d99c816111827035bee903f4cb3d28af9612c39767cc564e845259b874173fa42ffb2b91338607a58db1bcef12f0a9e6606f6b5cd7e3d5c3411bbdb22665c061228c6e0162311915ac27d5e491f873ff2f2d32bd3ef17e6471e8a5235699794deacf27dd85be2a7eefaebf5af8cbb2f90ac58cc77f209feb708fea9b341d235ebee604ffcf47a59e1017de8ba4f85b3479182105ea1eaf1cbfc89042dfa0688f15c656500c0a366da703ab4eb922c97f6866aaf985527772c79ca76f65290b8695a7de3a8e0bd93f5bb56e648148a6eae1519b011e6a4f811dd63686cb1"}], 0x110, 0x40000}, 0x24000811) recvmmsg(r0, &(0x7f00000013c0), 0x1ad, 0x0, &(0x7f0000000c40)={0x77359400}) 20:30:20 executing program 4: socket$packet(0x11, 0x2, 0x300) ioctl$sock_proto_private(0xffffffffffffffff, 0x0, &(0x7f0000000300)) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) write(r1, &(0x7f00000001c0), 0xfffffef3) read(r0, &(0x7f0000000200)=""/250, 0x50c7e5e2) r2 = socket$inet_udp(0x2, 0x2, 0x0) readahead(r1, 0x3ff, 0x1000000000000003) ioctl$EVIOCGREP(r1, 0x80084503, &(0x7f00000000c0)=""/244) bind$inet(r2, &(0x7f00000001c0)={0x2, 0x0, @local}, 0x10) setsockopt$sock_int(r2, 0x1, 0x6, &(0x7f0000000080)=0x5dd7d56a, 0x4) ioctl$void(r2, 0x5450) connect$inet(r2, &(0x7f0000000040)={0x2, 0x0, @broadcast}, 0x10) sendmmsg(r2, &(0x7f0000007fc0), 0x5654807, 0x0) getsockopt$inet6_IPV6_FLOWLABEL_MGR(r0, 0x29, 0x20, &(0x7f0000000000)={@mcast1, 0xfffffffffffffbff, 0x1, 0x2, 0x4, 0xff, 0x3f, 0xfffffffffffffffb}, &(0x7f0000000340)=0x20) 20:30:20 executing program 0: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r0, &(0x7f0000000100)={0xa, 0x4e22, 0x0, @empty, 0x4}, 0x1c) writev(0xffffffffffffffff, &(0x7f0000002980), 0x0) r1 = socket$inet6(0x10, 0x3, 0x0) sendmsg(r1, &(0x7f0000002fc8)={&(0x7f0000000000)=@nl, 0x80, &(0x7f0000002000)=[{&(0x7f0000000340)="5500000018007f5300fe01b2a4a280930a06000000a84308910000003900090008000c00010000001900150006000000000000dc1338d54400009b84136ef75afb83de448daa7227c43ab8220000060cec4fab6513", 0x55}], 0x1, &(0x7f0000000400), 0x0, 0x4}, 0x0) ioctl$EXT4_IOC_GROUP_EXTEND(0xffffffffffffffff, 0x40046607, &(0x7f0000000400)) listen(r0, 0x7c) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) mkdirat$cgroup(0xffffffffffffffff, &(0x7f0000000140)='syz1\x00', 0x1ff) r3 = memfd_create(&(0x7f0000000180)="0004003100", 0x0) ioctl$sock_SIOCGPGRP(r3, 0x8904, &(0x7f00000000c0)=0x0) syz_open_procfs(r4, &(0x7f0000000300)='net/ip_tables_names\x00') write$P9_RFSYNC(r3, &(0x7f0000000240)={0x7, 0x33, 0x1}, 0xfffffffffffffe2d) sendto$inet6(r2, &(0x7f0000000380), 0x0, 0x20000004, &(0x7f000031e000)={0xa, 0x4e22, 0x0, @ipv4}, 0x1c) openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000b80)="2e2f6367726f75702f73797a3100b8458a1392623c2acc07743172c163cfc71523709c3289acba6eaf2919f32ebaa4cbe89ed30167d7d56e8e65c0edbb300c9e287f10f513e776522729d5c85c09fed3f33ea055b94d27bb72a2bb9fd56015f25cf4f9ced65ed81253cfba08e9a329935ac0c64d10a5e701cc58fe4af8cb5b679468e8ad39e103e2d5b7d9078c34eb2832a5852b28958b7efeca8ffc69c09a7ca33d82e59f9e27ea25a7cf5e65bc52987952070ddac3929791a23f905fbd72419d1539", 0x200002, 0x0) fchdir(0xffffffffffffffff) r5 = creat(&(0x7f00000005c0)='./bus\x00', 0x0) r6 = open(&(0x7f0000000540)='./bus\x00', 0x141042, 0x0) sigaltstack(&(0x7f0000ffe000/0x1000)=nil, &(0x7f0000000480)) write$selinux_context(r6, &(0x7f0000000000)='system_u:object_r:crontab_exec_t:s0\x00', 0xfffffffffffffe84) r7 = creat(&(0x7f00000003c0)='./bus\x00', 0x2) r8 = openat$null(0xffffffffffffff9c, &(0x7f00000004c0)='/dev/null\x00', 0x2807fd, 0x0) write(r8, &(0x7f0000000380), 0x0) write$cgroup_type(r5, &(0x7f0000000200)='threaded\x00', 0xfffffeb3) select(0x40, &(0x7f0000000040), &(0x7f0000000080), &(0x7f00000001c0), &(0x7f0000000280)={0x77359400}) getsockopt$IP6T_SO_GET_ENTRIES(r0, 0x29, 0x41, &(0x7f0000000c80)=ANY=[@ANYBLOB="73656375726974796d0000000000000000000000000000000000000000000000c40000004e8b4b1c7fa37c911d43b7dfc1540065e2cf063a33e71b903574450eb6fcc611bb94c232461f22877f4a6bfa2e09f7f448f8a2ef823ff78d796ab6ab52f030b8fea1243b4a37836d690100843a8998fea04a2bc474078acbb61c426c93824178b70a4bcff2d634050eca0d4f941bfec0542fd99b2bd8823b4175d0b0e455f170e292c18a967fdc58383f9af93bc9c8b8578b5ed8ba7d2084ab94919aea43e1a3acfd6d899d943862ca8d84436629d2159976a615f1279aaf23ce57319edb9be03d5b849777d956c09bcb8bc5eb1d793fe7b7d0c34d4d6cc6d28cb9f66b0a2f31eda0ce948210375abcde9320750390dc04b3af4959443184210eb68c4fe6dced7e44cd2b39f7d25dc53dab0fd596852191868741cecd379b6e87b1c1a8c0dc6b8004595fb61135ed10927d6df243071d53b4757c13f4ceb4480e4a7b9c730be6258db763d9e9e7baeccd140ed2311fd9c570db36e93131c27442990068d315088680ab638288fb05b1676a9ab2fe9aa99539a1cfbb1ae8b35cd18007ba5105ed92f8914bcc2397da080dd1da393ede4f195953f82d03b9a920391ee4f5bd7485d69e1d8bfc93521ea451a20dd056bd3c133aa93c9bef1e254ad7d19379b21be984d93cc7cfcbffc82708aebe5fe4c4aa7af905248de89163041c16cfdaf96ee5b65715c7bb840274ba8ddc979ae077aa20b5ba0e97ecd80abb2d3cdb2d2b6603b3a003871b7220d71909f230fa5e9a7307c10c954a2ff1c6bf5fe3e153c0ebeb4940c365ef1e9cc8588a51bfc9807e866ea6528a77c930c06eb50e3f14ca8abf929570c05ca0615211cdcce3d034946d4fadcc9df5702fca33cb322c27a54fee8cd7901df1066311b737259dfc65048bcff6eca8f566ed75b5d21b58a3c51907ba6d5ef9e04e24febdea1d345b16288065bf64cf9fa3a746185191dc7b2f4520fd2da2f60434395d6121d7063a6455be070f49e04c8c2fa0da58d878d80a1bf9cc58b6926e3c471cb1e79cb85f6ce2ad91ac6c68f955a507ad55f514d131e0a095329227c9888f9fb19bfe6df77dff07ef08544a33e9f10d72e3ca6a0d70bf0d4b3e607a2238db2aa9c1011d0af4a39786e48004427b8b55fcd1f7ad63a9aa5338475975159310e0e40000000000000000000000000000000000000000000000000000"], &(0x7f00000002c0)=0x1) recvfrom$inet6(r2, &(0x7f0000001840)=""/31, 0xfffffe0e, 0x100, &(0x7f0000001880)={0xa, 0x0, 0xffff}, 0x1c) getsockopt$inet_mreqn(r7, 0x0, 0x23, &(0x7f0000000500)={@multicast1, @multicast1, 0x0}, &(0x7f0000000440)=0xc) setsockopt$inet6_IPV6_PKTINFO(r5, 0x29, 0x32, &(0x7f0000000580)={@remote, r9}, 0x14) r10 = accept4(r0, 0x0, &(0x7f0000000000), 0xfffffffffffffffd) sendto$inet6(r10, &(0x7f00000000c0), 0xfffffffffffffe2b, 0x0, 0x0, 0x0) 20:30:20 executing program 4: socket$packet(0x11, 0x2, 0x300) ioctl$sock_proto_private(0xffffffffffffffff, 0x0, &(0x7f0000000300)) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) write(r1, &(0x7f00000001c0), 0xfffffef3) read(r0, &(0x7f0000000200)=""/250, 0x50c7e5e2) r2 = socket$inet_udp(0x2, 0x2, 0x0) readahead(r1, 0x3ff, 0x1000000000000003) ioctl$EVIOCGREP(r1, 0x80084503, &(0x7f00000000c0)=""/244) bind$inet(r2, &(0x7f00000001c0)={0x2, 0x0, @local}, 0x10) setsockopt$sock_int(r2, 0x1, 0x6, &(0x7f0000000080)=0x5dd7d56a, 0x4) ioctl$void(r2, 0x5450) connect$inet(r2, &(0x7f0000000040)={0x2, 0x0, @broadcast}, 0x10) sendmmsg(r2, &(0x7f0000007fc0), 0x5654807, 0x0) getsockopt$inet6_IPV6_FLOWLABEL_MGR(r0, 0x29, 0x20, &(0x7f0000000000)={@mcast1, 0xfffffffffffffbff, 0x1, 0x2, 0x4, 0xff, 0x3f, 0xfffffffffffffffb}, &(0x7f0000000340)=0x20) 20:30:20 executing program 2: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = openat$null(0xffffffffffffff9c, &(0x7f0000000000)='/dev/null\x00', 0x402200, 0x0) ioctl$LOOP_CHANGE_FD(r2, 0x4c06, r0) r3 = socket$inet(0x2, 0x2, 0x0) getsockopt$inet_int(r3, 0x0, 0x14, &(0x7f00006ed000), &(0x7f0000000240)=0x39d) rename(&(0x7f0000000040)='./file0\x00', &(0x7f0000000080)='./file0\x00') socket$unix(0x1, 0x7, 0x0) 20:30:21 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$FS_IOC_SETVERSION(r0, 0x40087602, &(0x7f00000001c0)) r1 = syz_open_dev$binder(&(0x7f0000000640)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000000)=[@enter_looper], 0x1, 0x0, &(0x7f0000000040)='+'}) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0x0, 0x0, &(0x7f0000000780)}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000380)={0x8, 0x0, &(0x7f0000000500)=[@release={0x40046306, 0x1}], 0x0, 0x0, &(0x7f0000000400)}) 20:30:21 executing program 3: r0 = socket$inet(0x2, 0x4000000000000001, 0x0) setsockopt$inet_tcp_TCP_CONGESTION(r0, 0x6, 0xd, &(0x7f0000000680)='reno\x00', 0x60c5) socketpair$inet_icmp_raw(0x2, 0x3, 0x1, &(0x7f0000000000)={0xffffffffffffffff}) ioctl$sock_SIOCDELDLCI(r1, 0x8981, &(0x7f0000000040)={'bridge0\x00', 0xa2e}) sendto$inet(r0, &(0x7f0000a88f88), 0xfffffffffffffe6e, 0x20000000, &(0x7f0000e68000)={0x2, 0x0, @local}, 0x10) [ 375.057728] binder: release 16473:16483 transaction 308 out, still active [ 375.087006] binder: send failed reply for transaction 308, target dead 20:30:21 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$FS_IOC_SETVERSION(r0, 0x40087602, &(0x7f00000001c0)) r1 = syz_open_dev$binder(&(0x7f0000000640)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000000)=[@enter_looper], 0x1, 0x0, &(0x7f0000000040)='+'}) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0x0, 0x0, &(0x7f0000000780)}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000380)={0x8, 0x0, &(0x7f0000000500)=[@release={0x40046306, 0x1}], 0x0, 0x0, &(0x7f0000000400)}) [ 375.125984] binder: 16513:16515 ioctl 40087602 200001c0 returned -22 20:30:21 executing program 5: sendmsg$nl_netfilter(0xffffffffffffffff, &(0x7f0000000080)={&(0x7f0000000100), 0xc, &(0x7f00000000c0)={&(0x7f0000000340)=ANY=[@ANYBLOB="140000000301ffff808f00003d88c83f00b516ba"], 0x14}}, 0x0) recvmmsg(0xffffffffffffffff, &(0x7f00000013c0), 0x1ad, 0x0, &(0x7f0000000c40)={0x77359400}) r0 = timerfd_create(0x1, 0x80000) getresuid(&(0x7f0000000140), &(0x7f0000000180)=0x0, &(0x7f00000001c0)) getsockopt$inet6_IPV6_IPSEC_POLICY(0xffffffffffffffff, 0x29, 0x22, &(0x7f0000000200)={{{@in=@rand_addr, @in6=@remote, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in=@loopback}, 0x0, @in6=@dev}}, &(0x7f0000000300)=0xe8) getsockopt$sock_cred(0xffffffffffffff9c, 0x1, 0x11, &(0x7f0000000380)={0x0, 0x0}, &(0x7f00000003c0)=0xc) stat(&(0x7f0000000400)='./file0\x00', &(0x7f0000000440)={0x0, 0x0, 0x0, 0x0, 0x0}) r5 = getegid() fsetxattr$system_posix_acl(r0, &(0x7f0000000040)='system.posix_acl_default\x00', &(0x7f00000004c0)={{}, {0x1, 0x1}, [{0x2, 0x4, r1}, {0x2, 0x3, r2}, {0x2, 0x7, r3}, {0x2, 0x4, r4}], {0x4, 0x1}, [{0x8, 0x5, r5}], {0x10, 0x4}, {0x20, 0x1}}, 0x4c, 0x3) clock_gettime(0x6, &(0x7f0000000000)) [ 375.218520] binder: 16520:16524 ioctl 40087602 200001c0 returned -22 20:30:21 executing program 5: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$nl_netfilter(r0, &(0x7f0000000080)={&(0x7f0000000100), 0xc, &(0x7f00000000c0)={&(0x7f0000000340)=ANY=[@ANYBLOB="140000000301ffff808f00003d88c83f00b516ba"], 0x14}}, 0x0) recvmmsg(r0, &(0x7f0000000a00)=[{{&(0x7f0000000140)=@can, 0x80, &(0x7f00000002c0)=[{&(0x7f00000001c0)=""/194, 0xc2}], 0x1, &(0x7f0000000380)=""/154, 0x9a, 0x1ff}, 0x1c0000000000000}, {{&(0x7f0000000440)=@in={0x2, 0x0, @multicast1}, 0x80, &(0x7f0000000940)=[{&(0x7f0000000300)=""/15, 0xf}, {&(0x7f00000004c0)=""/62, 0x3e}, {&(0x7f0000000c80)=""/4096, 0x1000}, {&(0x7f0000000500)=""/247, 0xf7}, {&(0x7f0000000600)=""/26, 0x1a}, {&(0x7f0000000640)=""/120, 0x78}, {&(0x7f00000006c0)=""/35, 0x23}, {&(0x7f0000000700)=""/179, 0xb3}, {&(0x7f00000007c0)=""/100, 0x64}, {&(0x7f0000000840)=""/193, 0xc1}], 0xa, 0x0, 0x0, 0x80000001}}], 0x2, 0x0, &(0x7f0000000c40)={0x77359400}) splice(r0, &(0x7f0000000000), r0, &(0x7f0000000040), 0x9fac, 0x9) [ 375.287038] binder: BINDER_SET_CONTEXT_MGR already set [ 375.300489] binder: 16520:16527 ioctl 40046207 0 returned -16 [ 375.318320] binder: 16520:16527 Release 1 refcount change on invalid ref 1 ret -22 20:30:21 executing program 5: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$nl_netfilter(r0, &(0x7f0000000080)={&(0x7f0000000100), 0xc, &(0x7f00000000c0)={&(0x7f0000000340)=ANY=[@ANYBLOB="140000000301ffff808f00003d88c83f00b516ba"], 0x14}}, 0x0) r1 = syz_genetlink_get_family_id$fou(&(0x7f0000000140)='fou\x00') sendmsg$FOU_CMD_ADD(r0, &(0x7f0000000200)={&(0x7f0000000040), 0xc, &(0x7f00000001c0)={&(0x7f0000000180)={0x1c, r1, 0x410, 0x70bd2d, 0x25dfdbfe, {}, [@FOU_ATTR_TYPE={0x8, 0x4, 0x2}]}, 0x1c}, 0x1, 0x0, 0x0, 0x40000}, 0x20000004) r2 = openat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0xbac7a61932bc4fce, 0x8) epoll_ctl$EPOLL_CTL_DEL(r2, 0x2, r0) recvmmsg(r0, &(0x7f00000013c0), 0x1ad, 0x0, &(0x7f0000000c40)={0x77359400}) 20:30:21 executing program 0: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r0, &(0x7f0000000100)={0xa, 0x4e22, 0x0, @empty, 0x1000}, 0x1c) writev(0xffffffffffffffff, &(0x7f0000002980), 0x0) r1 = socket$inet6(0x10, 0x3, 0x0) sendmsg(r1, &(0x7f0000002fc8)={&(0x7f0000000000)=@nl, 0x80, &(0x7f0000002000)=[{&(0x7f0000000340)="5500000018007f5300fe01b2a4a280930a06000000a84308910000003900090008000c00010000001900150006000000000000dc1338d54400009b84136ef75afb83de448daa7227c43ab8220000060cec4fab6513", 0x55}], 0x1, &(0x7f0000000400), 0x0, 0x4}, 0x0) ioctl$EXT4_IOC_GROUP_EXTEND(0xffffffffffffffff, 0x40046607, &(0x7f0000000400)) listen(r0, 0x7c) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) mkdirat$cgroup(0xffffffffffffffff, &(0x7f0000000140)='syz1\x00', 0x1ff) r3 = memfd_create(&(0x7f0000000180)="0004003100", 0x0) ioctl$sock_SIOCGPGRP(r3, 0x8904, &(0x7f00000000c0)=0x0) syz_open_procfs(r4, &(0x7f0000000300)='net/ip_tables_names\x00') write$P9_RFSYNC(r3, &(0x7f0000000240)={0x7, 0x33, 0x1}, 0xfffffffffffffe2d) sendto$inet6(r2, &(0x7f0000000380), 0x0, 0x20000004, &(0x7f000031e000)={0xa, 0x4e22, 0x0, @ipv4}, 0x1c) openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000b80)="2e2f6367726f75702f73797a3100b8458a1392623c2acc07743172c163cfc71523709c3289acba6eaf2919f32ebaa4cbe89ed30167d7d56e8e65c0edbb300c9e287f10f513e776522729d5c85c09fed3f33ea055b94d27bb72a2bb9fd56015f25cf4f9ced65ed81253cfba08e9a329935ac0c64d10a5e701cc58fe4af8cb5b679468e8ad39e103e2d5b7d9078c34eb2832a5852b28958b7efeca8ffc69c09a7ca33d82e59f9e27ea25a7cf5e65bc52987952070ddac3929791a23f905fbd72419d1539", 0x200002, 0x0) fchdir(r3) r5 = creat(&(0x7f00000005c0)='./bus\x00', 0x0) r6 = open(&(0x7f0000000540)='./bus\x00', 0x141042, 0x0) sigaltstack(&(0x7f0000ffe000/0x1000)=nil, &(0x7f0000000480)) write$selinux_context(r6, &(0x7f0000000000)='system_u:object_r:crontab_exec_t:s0\x00', 0xfffffffffffffe84) r7 = creat(&(0x7f0000000600)='./bus\x00', 0x2) r8 = openat$null(0xffffffffffffff9c, &(0x7f00000004c0)='/dev/null\x00', 0x2807fd, 0x0) write(r8, &(0x7f0000000380), 0x0) write$cgroup_type(r5, &(0x7f0000000200)='threaded\x00', 0xfffffeb3) select(0x40, &(0x7f0000000040), &(0x7f0000000080), &(0x7f00000001c0), &(0x7f0000000280)={0x77359400}) getsockopt$IP6T_SO_GET_ENTRIES(r0, 0x29, 0x41, &(0x7f0000000c80)=ANY=[@ANYBLOB="73656375726974796d0000000000000000000000000000000000000000000000c40000004e8b4b1c7fa37c911d43b7dfc1540065e2cf063a33e71b903574440eb6fcc611bb94c232461f22877f4a6bfa2e09f7f448f8a2ef823ff78d796ab6ab52f030b8fea1243b4a37836d690100843a8998fea04a2bc474078acbb61c426c93824178b70a4bcff2d634050eca0d4f941bfec0542fd99b2bd8823b4175d0b0e455f170e292c18a967fdc58383f9af93bc9c8b8578b5ed8ba7d2084ab94919aea43e1a3acfd6d899d943862ca8d84436629d2159976a615f1279aaf23ce57319edb9be03d5b849777d956c09bcb8bc5eb1d793fe7b7d0c34d4d6cc6d28cb9f66b0a2f31eda0ce948210375abcde9320750390dc04b3af4959443184210eb68c4fe6dced7e44cd2b39f7d25dc53dab0fd596852191868741cecd379b6e87b1c1a8c0dc6b8004595fb61135ed10927d6df243071d53b4757c13f4ceb4480e4a7b9c730be6258db763d9e9e7baeccd140ad2311fd9c570db36e93131c27442990068d315088680ab638288fb05cd676a9ab2fe9aa99539a1cfbb1ae8b35cd18007ba5105ed92f8914bcc2397da080dd1da393ede4f195953f82d03b9a920391ee4f5bd7485d69e1d8bfc93521ea451a20dd056bd3c133aa93c9bef1e254ad7d19379b21be984d93cc7cfcbffc82708aebe5fe4c4aa7af905248de89163041c16cfdaf96ee5b65715c7bb840274ba8ddc979ae077aa20b5ba0e97ecd80abb2d3cdb2d2b6603b3a003871b7220d71909f230fa5e9a7307c10c954a2ff1c6bf5fe3e153c0ebeb4940c365ef1e9cc8588a51bfc9807e866ea6528a77c930c06eb50e3f14ca8abf929570c05ca0615211cdcce3d034946d4fadcc9df5702fca33cb0700000000000000901df1066311b737259dfc65048bcff6eca8f566ed75b5d21b58a3c51907ba6d5ef9e04e24febdea1d345b00008065bf64cf9fa3a746185191dc7b2f4520fd2da2f60434395d6121d7063a6455be070f49e04c8c2fa0da58d878d80a1bf9cc58b6926e3c471cb1e79cb85f6ce2ad91ac6c68f955a507ad55f514d131e0a095329227c9888f9fb19bfe6df77dff07ef08544a33e9f10d72e3ca6a0d70bf0d4b3e607a2238db2aa9c1011d0af4a39786e48004427b8b55fcd1f7ad63a9aa5338475975159310e0e40000000000000000000000000000000000000000000000000000"], &(0x7f00000002c0)=0x1) recvfrom$inet6(r2, &(0x7f0000001840)=""/31, 0xfffffe0e, 0x100, &(0x7f0000001880)={0xa, 0x0, 0xffff}, 0x1c) getsockopt$inet_mreqn(r7, 0x0, 0x23, &(0x7f0000000500)={@multicast1, @multicast1, 0x0}, &(0x7f0000000440)=0xc) setsockopt$inet6_IPV6_PKTINFO(r5, 0x29, 0x32, &(0x7f0000000580)={@remote, r9}, 0x14) r10 = accept4(r0, 0x0, &(0x7f0000000000)=0xfffffffffffffefa, 0x0) sendto$inet6(r10, &(0x7f00000000c0), 0xfffffffffffffe2b, 0x0, 0x0, 0x0) 20:30:21 executing program 4: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r0, &(0x7f0000000100)={0xa, 0x4e22, 0x0, @empty, 0x4}, 0x1c) writev(0xffffffffffffffff, &(0x7f0000002980), 0x0) r1 = socket$inet6(0x10, 0x3, 0x0) sendmsg(r1, &(0x7f0000002fc8)={&(0x7f0000000000)=@nl, 0x80, &(0x7f0000002000)=[{&(0x7f0000000340)="5500000018007f5300fe01b2a4a280930a06000000a84308910000003900090008000c00010000001900150006000000000000dc1338d54400009b84136ef75afb83de448daa7227c43ab8220000060cec4fab6513", 0x55}], 0x1, &(0x7f0000000400), 0x0, 0x4}, 0x0) ioctl$EXT4_IOC_GROUP_EXTEND(0xffffffffffffffff, 0x40046607, &(0x7f0000000400)) listen(r0, 0x7c) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) mkdirat$cgroup(0xffffffffffffffff, &(0x7f0000000140)='syz1\x00', 0x1ff) r3 = memfd_create(&(0x7f0000000180)="0004003100", 0x0) ioctl$sock_SIOCGPGRP(r3, 0x8904, &(0x7f00000000c0)=0x0) syz_open_procfs(r4, &(0x7f0000000300)='net/ip_tables_names\x00') write$P9_RFSYNC(r3, &(0x7f0000000240)={0x7, 0x33, 0x1}, 0xfffffffffffffe2d) sendto$inet6(r2, &(0x7f0000000380), 0x0, 0x20000004, &(0x7f000031e000)={0xa, 0x4e22, 0x0, @ipv4}, 0x1c) openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000b80)="2e2f6367726f75702f73797a3100b8458a1392623c2acc07743172c163cfc71523709c3289acba6eaf2919f32ebaa4cbe89ed30167d7d56e8e65c0edbb300c9e287f10f513e776522729d5c85c09fed3f33ea055b94d27bb72a2bb9fd56015f25cf4f9ced65ed81253cfba08e9a329935ac0c64d10a5e701cc58fe4af8cb5b679468e8ad39e103e2d5b7d9078c34eb2832a5852b28958b7efeca8ffc69c09a7ca33d82e59f9e27ea25a7cf5e65bc52987952070ddac3929791a23f905fbd72419d1539", 0x200002, 0x0) fchdir(0xffffffffffffffff) r5 = creat(&(0x7f00000005c0)='./bus\x00', 0x0) r6 = open(&(0x7f0000000540)='./bus\x00', 0x141042, 0x0) sigaltstack(&(0x7f0000ffe000/0x1000)=nil, &(0x7f0000000480)) write$selinux_context(r6, &(0x7f0000000000)='system_u:object_r:crontab_exec_t:s0\x00', 0xfffffffffffffe84) r7 = creat(&(0x7f00000003c0)='./bus\x00', 0x2) r8 = openat$null(0xffffffffffffff9c, &(0x7f00000004c0)='/dev/null\x00', 0x2807fd, 0x0) write(r8, &(0x7f0000000380), 0x0) write$cgroup_type(r5, &(0x7f0000000200)='threaded\x00', 0xfffffeb3) select(0x40, &(0x7f0000000040), &(0x7f0000000080), &(0x7f00000001c0), &(0x7f0000000280)={0x77359400}) getsockopt$IP6T_SO_GET_ENTRIES(r0, 0x29, 0x41, &(0x7f0000000c80)=ANY=[@ANYBLOB="73656375726974796d0000000000000000000000000000000000000000000000c40000004e8b4b1c7fa37c911d43b7dfc1540065e2cf063a33e71b903574450eb6fcc611bb94c232461f22877f4a6bfa2e09f7f448f8a2ef823ff78d796ab6ab52f030b8fea1243b4a37836d690100843a8998fea04a2bc474078acbb61c426c93824178b70a4bcff2d634050eca0d4f941bfec0542fd99b2bd8823b4175d0b0e455f170e292c18a967fdc58383f9af93bc9c8b8578b5ed8ba7d2084ab94919aea43e1a3acfd6d899d943862ca8d84436629d2159976a615f1279aaf23ce57319edb9be03d5b849777d956c09bcb8bc5eb1d793fe7b7d0c34d4d6cc6d28cb9f66b0a2f31eda0ce948210375abcde9320750390dc04b3af4959443184210eb68c4fe6dced7e44cd2b39f7d25dc53dab0fd596852191868741cecd379b6e87b1c1a8c0dc6b8004595fb61135ed10927d6df243071d53b4757c13f4ceb4480e4a7b9c730be6258db763d9e9e7baeccd140ed2311fd9c570db36e93131c27442990068d315088680ab638288fb05b1676a9ab2fe9aa99539a1cfbb1ae8b35cd18007ba5105ed92f8914bcc2397da080dd1da393ede4f195953f82d03b9a920391ee4f5bd7485d69e1d8bfc93521ea451a20dd056bd3c133aa93c9bef1e254ad7d19379b21be984d93cc7cfcbffc82708aebe5fe4c4aa7af905248de89163041c16cfdaf96ee5b65715c7bb840274ba8ddc979ae077aa20b5ba0e97ecd80abb2d3cdb2d2b6603b3a003871b7220d71909f230fa5e9a7307c10c954a2ff1c6bf5fe3e153c0ebeb4940c365ef1e9cc8588a51bfc9807e866ea6528a77c930c06eb50e3f14ca8abf929570c05ca0615211cdcce3d034946d4fadcc9df5702fca33cb322c27a54fee8cd7901df1066311b737259dfc65048bcff6eca8f566ed75b5d21b58a3c51907ba6d5ef9e04e24febdea1d345b16288065bf64cf9fa3a746185191dc7b2f4520fd2da2f60434395d6121d7063a6455be070f49e04c8c2fa0da58d878d80a1bf9cc58b6926e3c471cb1e79cb85f6ce2ad91ac6c68f955a507ad55f514d131e0a095329227c9888f9fb19bfe6df77dff07ef08544a33e9f10d72e3ca6a0d70bf0d4b3e607a2238db2aa9c1011d0af4a39786e48004427b8b55fcd1f7ad63a9aa5338475975159310e0e40000000000000000000000000000000000000000000000000000"], &(0x7f00000002c0)=0x1) recvfrom$inet6(r2, &(0x7f0000001840)=""/31, 0xfffffe0e, 0x100, &(0x7f0000001880)={0xa, 0x0, 0xffff}, 0x1c) getsockopt$inet_mreqn(r7, 0x0, 0x23, &(0x7f0000000500)={@multicast1, @multicast1, 0x0}, &(0x7f0000000440)=0xc) setsockopt$inet6_IPV6_PKTINFO(r5, 0x29, 0x32, &(0x7f0000000580)={@remote, r9}, 0x14) r10 = accept4(r0, 0x0, &(0x7f0000000000), 0xfffffffffffffffd) sendto$inet6(r10, &(0x7f00000000c0), 0xfffffffffffffe2b, 0x0, 0x0, 0x0) 20:30:21 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$FS_IOC_SETVERSION(r0, 0x40087602, &(0x7f00000001c0)) r1 = syz_open_dev$binder(&(0x7f0000000640)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000000)=[@enter_looper], 0x1, 0x0, &(0x7f0000000040)='+'}) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280), 0x0, 0x0, &(0x7f0000000780)}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000380)={0x8, 0x0, &(0x7f0000000500)=[@release={0x40046306, 0x1}], 0x0, 0x0, &(0x7f0000000400)}) 20:30:21 executing program 3: r0 = dup2(0xffffffffffffff9c, 0xffffffffffffffff) ioctl$EVIOCSABS0(r0, 0x401845c0, &(0x7f0000000140)={0x6, 0x80000001, 0x8e, 0x8, 0x9, 0x7f}) r1 = socket$inet(0x2, 0x7, 0x2) setsockopt$inet_tcp_TCP_CONGESTION(r1, 0x6, 0xd, &(0x7f0000000240)="27d91e9351f71d35356874637000", 0x6c) ioctl$EXT4_IOC_MIGRATE(r1, 0x6609) socketpair(0x5, 0x803, 0xb4c3, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) getsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x11, &(0x7f0000000280)={{{@in=@multicast1, @in, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@remote}, 0x0, @in6=@dev}}, &(0x7f00000001c0)=0xe8) getsockopt$inet6_IPV6_IPSEC_POLICY(r2, 0x29, 0x22, &(0x7f0000000380)={{{@in=@multicast2, @in6=@remote, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@ipv4={[], [], @rand_addr}}, 0x0, @in=@loopback}}, &(0x7f0000000200)=0xe8) setsockopt$inet6_IPV6_XFRM_POLICY(r3, 0x29, 0x23, &(0x7f0000000480)={{{@in=@broadcast, @in=@multicast2, 0x4e21, 0xff, 0x4e23, 0x100000000, 0xa, 0x0, 0x80, 0x88, r4, r5}, {0x0, 0x2000000000, 0xfff, 0x77, 0x2, 0xe268, 0xa, 0x800}, {0x9, 0x3f, 0x57ee, 0xad}, 0x1ff, 0x0, 0x1, 0x1, 0x1, 0x1}, {{@in=@remote, 0x4d6, 0x7c}, 0xa, @in6=@remote, 0x34ff, 0x7, 0x1, 0x80, 0x6, 0xdf4c, 0xfffffffffffffffb}}, 0xe8) setsockopt$inet6_tcp_TCP_REPAIR_WINDOW(r3, 0x6, 0x1d, &(0x7f0000000100)={0x1f, 0x400, 0x9edd, 0xfffffffffffffffe, 0x800}, 0x14) sendto$inet(r1, &(0x7f0000a88f88), 0xfffffffffffffe6e, 0x20000000, &(0x7f0000e68000)={0x2, 0x0, @local}, 0x10) getsockname$inet(r1, &(0x7f0000000000)={0x2, 0x0, @multicast2}, &(0x7f0000000040)=0x10) socketpair(0x0, 0x0, 0x6, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) r7 = dup2(r1, r1) ioctl$KDGKBENT(r7, 0x4b46, &(0x7f0000000180)={0x3f, 0x8, 0x22df}) ioctl$TIOCGSID(r6, 0x5429, &(0x7f0000000580)=0x0) ptrace$setregset(0x4205, r8, 0x0, &(0x7f00000006c0)={&(0x7f00000005c0)="1aadf0bbe6949189c9a4acdeaa55a379985c63bad3089f6358c9bc8ac58fa91528de5ad1bb82b5e4333cac49d061e5b90348abbdd2975269e62ddf5023f70f900c6febdf3155a958a6ffa8dc92ec36cdf970984e7ecc6482d78286e4abd139e3791c4871e0ef9434279d408c2f9023f367f67812e462c5a9fccdffb9b6bc3a7c26343240bc7f3883aceb255f67332643f1199075b5248104df48f4486157a3bff079be18dd8c26b8d0f71faa5257a0b1ef2e962cfeec9039b7ec83ac409d88adb897c2ea", 0xc4}) ioctl$FS_IOC_GETVERSION(r7, 0x80087601, &(0x7f0000000700)) ioctl$PERF_EVENT_IOC_SET_OUTPUT(r6, 0x2405, r7) [ 375.924162] binder: send failed reply for transaction 312 to 16513:16523 [ 375.931144] binder: send failed reply for transaction 315 to 16520:16527 [ 375.938509] binder: undelivered TRANSACTION_ERROR: 29189 [ 375.944676] binder: 16554:16555 ioctl 40087602 200001c0 returned -22 20:30:21 executing program 2: r0 = socket(0xa, 0x1, 0x0) setsockopt$inet6_icmp_ICMP_FILTER(r0, 0x1, 0x1, &(0x7f0000000080)={0x84f}, 0x4) r1 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000040)={"6c6f0000000041000000001000", 0x0}) sendmsg$nl_route(r1, &(0x7f0000000000)={&(0x7f00000002c0), 0xc, &(0x7f00000000c0)={&(0x7f0000000100)=ANY=[@ANYBLOB="0000000014000b0900000000000000000a000000", @ANYRES32=r2, @ANYBLOB="140002008f800000a507622f700e6700000000000000000000000014000196a633d02c04296d0000000000000000010800527608c3751260b632fc97eec1b0381dd5f8da20af3a0e5b850b859f6de6547881207369402cb22c6f6c8e26d856010000000100000076ed8f44f105a24d4ec17b695d78ab486fa0ee435b07e06f861af2c11f6b71293dd8cea067feb0"], 0x48}}, 0x0) 20:30:21 executing program 3: r0 = socket$inet(0x2, 0x4000000000000001, 0x0) r1 = dup(r0) sendto$inet(r0, &(0x7f0000a88f88), 0xfffffffffffffe6e, 0x20000000, &(0x7f0000e68000)={0x2, 0x0, @local}, 0x10) r2 = add_key$keyring(&(0x7f0000000000)='keyring\x00', &(0x7f0000000040)={'syz', 0x0}, 0x0, 0x0, 0xfffffffffffffffa) keyctl$invalidate(0x15, r2) accept(r1, &(0x7f0000000080)=@hci, &(0x7f0000000100)=0x80) 20:30:22 executing program 2: r0 = openat$tun(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000140)={"76657469c4a20e0008004000bdefff09", 0x43732e5398416f1a}) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000100)) r1 = openat$null(0xffffffffffffff9c, &(0x7f0000000040)='/dev/null\x00', 0x181141, 0x0) ioctl$RTC_WKALM_SET(r1, 0x4028700f, &(0x7f0000000080)={0x1, 0x1, {0x2d, 0x1d, 0x13, 0x19, 0xb, 0x1000, 0x0, 0xe7, 0x1}}) r2 = openat$keychord(0xffffffffffffff9c, &(0x7f0000000000)='/dev/keychord\x00', 0x101200, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x2) poll(&(0x7f0000000200)=[{r0}], 0x1, 0x1000) [ 376.018342] binder: undelivered TRANSACTION_ERROR: 29189 20:30:22 executing program 5: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$nl_netfilter(r0, &(0x7f0000000080)={&(0x7f0000000100), 0xc, &(0x7f00000000c0)={&(0x7f0000000340)=ANY=[@ANYBLOB="140000000301ffff808f00003d88c83f00b516ba"], 0x14}}, 0x0) ioctl$FS_IOC_GET_ENCRYPTION_POLICY(r0, 0x400c6615, &(0x7f0000000000)) recvmmsg(r0, &(0x7f00000013c0), 0x1ad, 0x0, &(0x7f0000000c40)={0x77359400}) 20:30:22 executing program 0: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r0, &(0x7f0000000100)={0xa, 0x4e22, 0x0, @empty, 0x4}, 0x1c) writev(0xffffffffffffffff, &(0x7f0000002980), 0x0) r1 = socket$inet6(0x10, 0x3, 0x0) sendmsg(r1, &(0x7f0000002fc8)={&(0x7f0000000000)=@nl, 0x80, &(0x7f0000002000)=[{&(0x7f0000000340)="5500000018007f5300fe01b2a4a280930a06000000a84308910000003900090008000c00010000001900150006000000000000dc1338d54400009b84136ef75afb83de448daa7227c43ab8220000060cec4fab6513", 0x55}], 0x1, &(0x7f0000000400), 0x0, 0x4}, 0x0) ioctl$EXT4_IOC_GROUP_EXTEND(0xffffffffffffffff, 0x40046607, &(0x7f0000000400)) listen(r0, 0x7c) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) mkdirat$cgroup(0xffffffffffffffff, &(0x7f0000000140)='syz1\x00', 0x1ff) r3 = memfd_create(&(0x7f0000000180)="0004003100", 0x0) ioctl$sock_SIOCGPGRP(r3, 0x8904, &(0x7f00000000c0)=0x0) syz_open_procfs(r4, &(0x7f0000000300)='net/ip_tables_names\x00') write$P9_RFSYNC(r3, &(0x7f0000000600)={0xffffffffffffff8a, 0x33, 0x1}, 0xfffffffffffffe2d) sendto$inet6(r2, &(0x7f0000000380), 0x0, 0x20000004, &(0x7f000031e000)={0xa, 0x4e22, 0x0, @ipv4}, 0x1c) openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000b80)="2e2f6367726f75702f73797a3100b8458a1392623c2acc07743172c163cfc71523709c3289acba6eaf2919f32ebaa4cbe89ed30167d7d56e8e65c0edbb300c9e287f10f513e776522729d5c85c09fed3f33ea055b94d27bb72a2bb9fd56015f25cf4f9ced65ed81253cfba08e9a329935ac0c64d10a5e701cc58fe4af8cb5b679468e8ad39e103e2d5b7d9078c34eb2832a5852b28958b7efeca8ffc69c09a7ca33d82e59f9e27ea25a7cf5e65bc52987952070ddac3929791a23f905fbd72419d1539", 0x200002, 0x0) fchdir(0xffffffffffffffff) r5 = creat(&(0x7f00000005c0)='./bus\x00', 0x0) r6 = open(&(0x7f0000000540)='./bus\x00', 0x141042, 0x0) sigaltstack(&(0x7f0000ffe000/0x1000)=nil, &(0x7f0000000480)) write$selinux_context(r6, &(0x7f0000000000)='system_u:object_r:crontab_exec_t:s0\x00', 0xfffffffffffffe84) r7 = creat(&(0x7f00000003c0)='./bus\x00', 0x2) r8 = openat$null(0xffffffffffffff9c, &(0x7f00000004c0)='/dev/null\x00', 0x2807fd, 0x0) write(r8, &(0x7f0000000380), 0x0) write$cgroup_type(r5, &(0x7f0000000200)='threaded\x00', 0xfffffeb3) select(0x40, &(0x7f0000000040), &(0x7f0000000080), &(0x7f00000001c0), &(0x7f0000000280)={0x77359400}) getsockopt$IP6T_SO_GET_ENTRIES(r0, 0x29, 0x41, &(0x7f0000000c80)=ANY=[@ANYBLOB="73656375726974796d0000000000000000000000000000000000000000000000c40000004e8b4b1c7f33e71b903574450eb6fcc611bb94c232461f22877f4a6bfa2e09f7f448f8a2ef823ff78d796ab6ab52f030b8fea1243b4a37836d690100843a8998fea04a2bc474078acbb61c426c8b824178b70a4bcff2d634050eca0d4f941bfec0542fd99b2bd8823b4175d0b0e455f170e292c18a967fdc58383f9af93bc9c8b8578b5ed8ba7d2084ab94919aea43e1a3acfd6d899d943862ca8d84436629d2159976a615f1279aaf23ce57319edb9be03d5b849777d956c09bcb8bc5eb1d793fe7b7d0c34d4d6cc6d28cb9f66b0a2f31eda0ce948210375abcde9320750390dc04b3af4959443184210eb68c4fe6dced7e44cd2b39f7d25dc53dab0fd596852191868741cecd379b6e87b1c1a8c0dc6b8004595fb61135ed10927d6df243071d53b4757c13f4ceb4480e4a7b9c730be6258db763d9e9e7baeccd140ed2311fd9c570db36e93131c27442990068d315088680ab638288fb05b1676a9ab2fe9aa99539a1cfbb1ae8b35cd18007ba5105ed92f8914bcc2397da080dd1da393ede4f195953f82d03b9a920391ee4f5bd7485d69e1d8bfc93521ea451a20dd056bd3c133aa93c9bef1e254ad7d19379b21be984d93cc7cfcbffc82708aebe5fe4c4aa7af905248de89163041c16cfdaf96ee5b65715c7bb840274ba8ddc979ae077ff7f00000e97ecd80abb2d3cdb2d2b6603b3a003871b7220d71909f230fa5e9a7307c10c954a2ff1c6bf5fe3e153c0ebeb4940c365ef1e9cc8588a51807e866ea6528a77c930c06eb50e3f14ca8abf929570c05ca0615211cdcce3d034946d4fadcc9df5702fca33cb322c27a54fee8cd7901df1066311b737259dfc65048bcff6eca8f566ed75b5d21b58a3c51907ba6d5ef9e04e24febdea1d345b16288065bf64cf9fa3a746185191dc7b2f4520fd2da2f60434395d6121d7063a6455be070f49e04c8c2fa0da58d878d80a1bf9cc58b6926e3c471cb1e79cb85f6ce2ad91ac6c68f955a507ad55f514d131e0a095329227c9888f9fb19bfe6df77dff07ef08544a33e9f10d72e3ca6a0d70bf0d4b3e607a2238db2aa9c1011d0af4a39786e48004427b8b55fcd1f7ad63a9aa5338475975159310e0e40000000000000000000000000000000000000000000000000000"], &(0x7f00000002c0)=0x1) recvfrom$inet6(r2, &(0x7f0000001840)=""/31, 0xfffffe0e, 0x100, &(0x7f0000001880)={0xa, 0x0, 0xffff}, 0x1c) getsockopt$inet_mreqn(r7, 0x0, 0x23, &(0x7f0000000500)={@multicast1, @multicast1, 0x0}, &(0x7f0000000440)=0xc) setsockopt$inet6_IPV6_PKTINFO(r5, 0x29, 0x32, &(0x7f0000000580)={@remote, r9}, 0x14) r10 = accept4(r0, 0x0, &(0x7f0000000000)=0xfffffffffffffefa, 0x0) sendto$inet6(r10, &(0x7f00000000c0), 0xfffffffffffffe2b, 0x0, 0x0, 0x0) 20:30:22 executing program 4: r0 = openat$selinux_member(0xffffffffffffff9c, &(0x7f0000000080)='/selinux/member\x00', 0x2, 0x0) write$selinux_access(r0, &(0x7f00000000c0)=ANY=[], 0x0) 20:30:22 executing program 4: mprotect(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x1) clone(0x400, 0x0, 0xfffffffffffffffe, &(0x7f0000000080), 0xffffffffffffffff) r0 = getpid() sched_setscheduler(r0, 0x5, &(0x7f0000000000)) futex(&(0x7f0000000200), 0x3, 0x0, &(0x7f0000000100), &(0x7f00000000c0), 0x0) r1 = openat$zero(0xffffffffffffff9c, &(0x7f0000000040)='/dev/zero\x00', 0x20000, 0x0) write$FUSE_OPEN(r1, &(0x7f0000000140)={0x20, 0x0, 0x4, {0x0, 0x7}}, 0x20) 20:30:22 executing program 4: r0 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r0, &(0x7f0000000000)={0x2, 0x4e20, @broadcast}, 0x10) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) recvfrom(r0, &(0x7f0000f9cf9b)=""/101, 0xffffffffffffffda, 0x120, 0x0, 0xffffffffffffffeb) ioctl$TIOCGPGRP(0xffffffffffffffff, 0x540f, &(0x7f00000000c0)=0x0) wait4(r3, 0x0, 0x1, &(0x7f0000000100)) r4 = dup(r1) execveat(r4, &(0x7f0000000080)='./file0\x00', &(0x7f0000000400)=[&(0x7f00000001c0)='vboxnet0\x00', &(0x7f0000000200)='lotrusted%usersecuritylo\x00', &(0x7f0000000240)='}-eth0\x00', &(0x7f0000000280)='mime_type(\x00', &(0x7f00000002c0)='\x00', &(0x7f0000000300)='ppp0\x00', &(0x7f0000000340)="7d2f8200", &(0x7f0000000380)='bdev\x00', &(0x7f00000003c0)='])wlan1GPL\x00'], &(0x7f00000004c0)=[&(0x7f0000000480)='.$wlan0\x00'], 0x400) 20:30:22 executing program 4: prctl$seccomp(0x16, 0x2, &(0x7f0000000140)={0x1, &(0x7f00000000c0)=[{0x6, 0x0, 0x0, 0xfffffffffffffff9}]}) gettid() clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000240), 0xffffffffffffffff) getpriority(0x0, 0x0) r0 = getpid() sched_setscheduler(r0, 0x5, &(0x7f0000000200)) prlimit64(0xffffffffffffffff, 0xa, &(0x7f00000001c0), 0x0) prctl$setptracer(0x59616d61, 0x0) fstat(0xffffffffffffffff, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x0, 0x0}) r2 = geteuid() getsockopt$inet_IP_XFRM_POLICY(0xffffffffffffffff, 0x0, 0x11, &(0x7f0000000480)={{{@in, @in=@remote, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@mcast1}, 0x0, @in=@multicast2}}, &(0x7f0000000100)=0xe8) stat(&(0x7f0000000300)='./file0\x00', &(0x7f0000000580)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) stat(&(0x7f0000000600)='./file0\x00', &(0x7f0000000640)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) fstat(0xffffffffffffff9c, &(0x7f00000006c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) fstat(0xffffffffffffff9c, &(0x7f0000000740)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) fstat(0xffffffffffffff9c, &(0x7f00000007c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) fstat(0xffffffffffffff9c, &(0x7f0000000840)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) getresgid(&(0x7f00000008c0), &(0x7f0000000900)=0x0, &(0x7f0000000940)) setxattr$system_posix_acl(&(0x7f0000000000)='./file0\x00', &(0x7f0000000080)='system.posix_acl_access\x00', &(0x7f0000000ac0)=ANY=[@ANYBLOB="02000000010001000000000002000700", @ANYRES32=r1, @ANYBLOB="02000000", @ANYRES32=r2, @ANYBLOB="f2edf86ba5ceccdfea42d08c6492f5cbd2de7eb200000000000000000000008dae688124fc0f18c824a96f14dbed0fe6f2514a1db81379b2f731318893f4d3e11a9f2db7b869e3d1a8cf8839800a6e61db7977222ee897210db6e777429147cc19feeb0861562766f4796054d1b812b45060655dcb91e486db2062a07b350ee434c543c326b461d8ec50ea6c16a92cd4ac", @ANYRES32=r3, @ANYBLOB="040002000000000008000200", @ANYRES32=r4, @ANYBLOB="0800cab5", @ANYRES32=r5, @ANYBLOB="08000500", @ANYRES32=r6, @ANYBLOB="08000300", @ANYRES32=r7, @ANYBLOB="08000100", @ANYRES32=r8, @ANYBLOB="08000500", @ANYRES32=r9, @ANYBLOB="08000500", @ANYRES32=r10, @ANYBLOB="10000200000000002000010000000000"], 0x74, 0x3) inotify_add_watch(0xffffffffffffffff, &(0x7f0000000040)='./file0\x00', 0x10000004) readv(0xffffffffffffffff, &(0x7f00000014c0)=[{&(0x7f0000000180)=""/7, 0x7}, {&(0x7f0000000340)=""/146, 0x92}, {&(0x7f0000000280)=""/76, 0x4c}], 0x3) getpid() 20:30:22 executing program 4: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$nl_netfilter(r0, &(0x7f0000d65000)={&(0x7f0000de2ff4), 0xc, &(0x7f0000000000)={&(0x7f0000000040)=ANY=[@ANYBLOB="14000000031c01044e3d00"], 0x14}}, 0x0) pipe(&(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) write$selinux_load(r1, &(0x7f00000000c0)={0xf97cff8c, 0x8, 'SE Linux', "2d75e3b13598a99c8df43634d7c31134904fc7dff3fd6a8f53ea2427c87ed13618ee2b04afb3757fe4d098b61fb49650299cec9aa750b466a03348d186b69735669e20ca082f3fffd0a4a98abede06fb084a882647289d241b3c1a65bb7eba6a77a090dbffa4e86752e96c6d6daf3e6419f04441d8b3f5a72a0ab3a872be27cda392689c5163281cd52813a4cb892379815a8e5d4593473d911b57b0630e918bb089ea2b1512f1df3d2c432b4afad08133c57633acb8adce8bde9a17ba81d1c09fda99ba6a1b8304a0d1629d7628a4c03f5c55655ea530a9cac5a4e9f72f5a014469a4c241e4571c2a440e2793515c60b303a4"}, 0x103) 20:30:22 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$FS_IOC_SETVERSION(r0, 0x40087602, &(0x7f00000001c0)) r1 = syz_open_dev$binder(&(0x7f0000000640)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000000)=[@enter_looper], 0x1, 0x0, &(0x7f0000000040)='+'}) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280), 0x0, 0x0, &(0x7f0000000780)}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000380)={0x8, 0x0, &(0x7f0000000500)=[@release={0x40046306, 0x1}], 0x0, 0x0, &(0x7f0000000400)}) 20:30:22 executing program 4: r0 = socket$netlink(0x10, 0x3, 0x0) writev(r0, &(0x7f0000000000)=[{&(0x7f0000000040)="390000001300090468fe0700000000000000ff3f03000000450001070000001419001a0004000200030000000000000000005d14a4e91ee438", 0xfffffffffffffd1e}], 0x1) 20:30:22 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$FS_IOC_SETVERSION(r0, 0x40087602, &(0x7f00000001c0)) r1 = syz_open_dev$binder(&(0x7f0000000640)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000000)=[@enter_looper], 0x1, 0x0, &(0x7f0000000040)='+'}) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280), 0x0, 0x0, &(0x7f0000000780)}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000380)={0x8, 0x0, &(0x7f0000000500)=[@release={0x40046306, 0x1}], 0x0, 0x0, &(0x7f0000000400)}) [ 376.740459] binder: release 16554:16562 transaction 319 out, still active [ 376.757346] binder: send failed reply for transaction 319, target dead [ 376.758724] binder: 16616:16618 ioctl 40087602 200001c0 returned -22 [ 376.789073] binder: 16621:16622 ioctl 40087602 200001c0 returned -22 [ 376.844070] binder: BINDER_SET_CONTEXT_MGR already set [ 376.849660] binder: 16621:16624 ioctl 40046207 0 returned -16 [ 376.859576] binder: 16621:16624 Release 1 refcount change on invalid ref 1 ret -22 20:30:22 executing program 3: r0 = socket$inet(0x2, 0x4000000000000001, 0x0) setsockopt$inet_tcp_TCP_CONGESTION(r0, 0x6, 0xd, &(0x7f0000000680)='reno\x00', 0x60c5) sendto$inet(r0, &(0x7f0000a88f88), 0xfffffffffffffe6e, 0x20000000, &(0x7f0000e68000)={0x2, 0x0, @local}, 0x10) r1 = open(&(0x7f0000000080)='./file0\x00', 0x10000, 0x100) ioctl$BLKZEROOUT(r1, 0x127f, &(0x7f00000000c0)={0x7ff, 0x3}) r2 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000880)='/dev/uinput\x00', 0x805, 0x0) write$uinput_user_dev(r2, &(0x7f0000000400)={'syz1\x00'}, 0x45c) ioctl$UI_SET_EVBIT(r2, 0x40045564, 0x11) ioctl$UI_DEV_SETUP(r2, 0x5501, &(0x7f0000000300)={{}, 'syz1\x00'}) r3 = openat$null(0xffffffffffffff9c, &(0x7f0000000000)='/dev/null\x00', 0x200000, 0x0) ioctl$TUNGETVNETHDRSZ(r3, 0x800454d7, &(0x7f0000000040)) 20:30:22 executing program 2: r0 = socket(0xa, 0x802, 0x88) capset(&(0x7f00002d0ff8)={0x19980330}, &(0x7f0000cc0000)) r1 = socket$netlink(0x10, 0x3, 0x4) r2 = open(&(0x7f00000002c0)='./file0\x00', 0x200000, 0x40) ioctl$RTC_EPOCH_READ(r2, 0x8008700d, &(0x7f0000000300)) getsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000380), &(0x7f00000003c0)=0x14) connect$inet6(r0, &(0x7f0000000000)={0xa, 0x0, 0x0, @ipv4={[], [], @loopback}}, 0x1c) writev(r1, &(0x7f0000fb1000)=[{&(0x7f0000000180)="480000001400197f09004b0101048c590a88ffffff010001000000000028213ee20600d4ff5bffff00c7e5ed5e00000000000000000000eaf60d18125d4b18857a9eace3dbe8b12c", 0x48}], 0x1) r3 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000240)='/dev/rtc0\x00', 0x2, 0x0) ioctl$SNDRV_TIMER_IOCTL_STATUS(r3, 0x80605414, &(0x7f00000016c0)=""/211) sendto$packet(r3, &(0x7f0000000280)="a449af2569b6685fd802a19cdd41755eaa852efb957f08a5d6ae1b5f39015a6f81f0b3099ee18891f7a87d9866a4886ad5cb64879eb7fba6ac1f06177cd76e25", 0x40, 0x4044000, 0x0, 0x0) setsockopt$inet_IP_IPSEC_POLICY(r0, 0x0, 0x10, &(0x7f0000001580)={{{@in6=@dev={0xfe, 0x80, [], 0x11}, @in=@local, 0x4e20, 0x0, 0x4e23, 0x4, 0xa, 0xa0, 0x20}, {0xfffffffeffffffff, 0x6d0, 0x1442, 0x0, 0x8, 0x48, 0x2, 0x101}, {0xff, 0x7, 0x1000, 0x8}, 0x7ffffffd, 0x6e6bc0, 0x1, 0x0, 0x2, 0x3}, {{@in=@loopback, 0x4d3, 0x6f}, 0x2, @in=@broadcast, 0x0, 0x327a7fcfaa3fcedd, 0x3, 0x9, 0x2f, 0x800, 0x4}}, 0xe8) setsockopt$inet_IP_IPSEC_POLICY(r0, 0x0, 0x10, &(0x7f00000018c0)={{{@in6=@mcast1, @in=@multicast2, 0x4e20, 0x0, 0x4e21, 0x2, 0xa, 0x80, 0x80}, {0x6, 0x8, 0x2, 0x7fff, 0x2, 0x81, 0x8, 0x3}, {0x5, 0x0, 0x86, 0x40}, 0x7, 0x6e6bbe, 0x3, 0x0, 0x64631339c1f66952, 0x3}, {{@in6=@remote, 0x4d4, 0x7c}, 0xa, @in6=@local, 0x3501, 0x1, 0x0, 0x5, 0x9, 0x8, 0x3}}, 0xe8) sendmsg(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000140)=[{&(0x7f0000000040)="a3c8df4de67d7c54cbe4e092d5281329fdb80d985b119493f607ee6fe7976e867830d78ebfc7d5acddbe40d0e4ef342ae97c1e71bc2cbd616adca38a69bda674f9cfc7d469f12d25f4142e3243b90a1ef1729439ca14a500353b99c6c527c9180b7780ad03877b8ff73429795b69d5a41dac43e453b5e128e21f39388fcd31e640a640d29a2a344f1b503f92983950cabb6a10872a83db1dc077d97d53bae6de0f95bb6154a7056fdfc11047e2c9b8ce0f4a950350fb27cc5eb5a4e18d8f3aea1c325f0c4342a0d2899523c2e4a3849309b2acb9f50b7fa1d00611293634a84a05b7d19a6c7851907947d256a677bd45db804c41c2547b7d", 0xf8}], 0x1, &(0x7f0000001a00)=ANY=[@ANYBLOB="70000000000000000f010000200000004feb94125ba158b09eab220fbdf4e59ef1544d8af83aa6449d6bcddfe33f01ca428d6c1a8f54266ed9ee28b2af6f01e30862cfe47052d589a26b9c91dafd586f8eda4831b041148d46a7f142761eb3a41284581f38e606a59ea900000000000088000000000000001101000001000000a6ca59ef5c5f448057b6ca105a171755642d4ab77e6275e0eaa4a3d81a3d0eeca99ccd340122a92f12d67dbfbb3e83eea019c050d55cd1a696f4045b994579e4516bbdab5084d687d3cc0aff39bc909b9624c1cf08efba844693e46a517789315e1c558329a29d3a3b1df17981d01d13278da6e197980000101000000000000016010000060000007a76621ef5f3b0bdd3f8a53c468301d8ab5347ac66ccf5a26ae815827018e358901c4af0313fc376043b8f3bf3ee56086b07587069564033084f72965970187fe7a651d845c88543b673689f7ebb4b335a00ea09c78bdb7b568611bba14f3c62677c9bfcc90eae83544497f11210321cc4883ab85625f4d7c0f2727e89f2162e474b0f045dac411704c03ce5c55aee77a9e52d4389c7ea1e0b56049388512bfb078a8e17c7d5ef1fa29e4c0f7f7ba4a6cb931d969cfcd68b9b5d38cb91edee823cf8be0b32e40e27e64c972940f5600aa1ae6a76352cfd875e0263c33e28b218fa703b416d12ec4370656e7504a389065662445dfcc3fb3cc86f8b3941b914695663f14811f11ec36461f41faea630d24a605472b4b1540465d96884fd57cae3a1642256f7fccf469e91b4743815fa71e7cb076623914b07b8a50d18d117b13bacef9b6123150f363f87f1429c6b994fb390f057901762f2bb0803e1e75112f2ab1745c58a13cd9dcfd10380d9a0fb85cdce50154a937c1bdad69fe7dca7238dbd1c39d8637835b2cca59064d3d67d0f68ee8fad6f2a8c2557068a7f7332757dcbd0540631b2799a8e0d3a0cf557369b4edc1431826467ca1cfb0ddae9c8ad55e7df21643e8d3e4caa4e014a4fe90c2768439d5db5efd83ad0d40a03a9cf07d6b06c085ad394717edf14cc741d5640087c28bbf2c0d088cd2d1408469041b175aff32f795f1e6d2b4f9fec4af57f3c02097023421e6dc3c55a586650b9f3201423b51e00c33888dbd831e367bebae8657ac625f15ee7b7538c31761fc5af9e2bcf04218a8fc52f8642d696879aa134c4633a967cf9bbf7960d9dbebef61bfb13c616aee64a41d536eb61454964e829be46f2c4ac917fb63785e5547499bdf98ca118be82540d0981566a1292d533b08e95158da22fa4ac3d023e3cead4eb5565b6bac7d575f56e4298bfa5093abe66cf7db5d91b910d2dcf209fc8db5c32b99d17e9d9dd4031e7bb0fb4ec20eb1be471de2197778a3265fe3f1ccd8a3d661854727747fb0af706ddfa0cbad05e9747b1bcddaf9222beb37cd4e4a755c5495247930b3f83c8aff02b6b7a2488c235e87d09cd89cb7535aa0888876b7e38e40179fbc77b56272c95a911f182a74619fdc2c38e2c532dc1c0e6de3bf5228f71d2e2d6b60792044a2a27b9faa77ac24eb6f58e13621d4e8b02f8f5ce0fd841ae0a8b285483a76e187f5cf802bd6d6526ed46741a8962979f463a0f53e642a12ecccb226849bca861c554c83a598c8a932ee157a87ee213a014c2276483e3a9876e5c7e3076b0b83edaebc5f381d9556e3b09f5a61158ecd8e82a4b9ba08c5b4cb011e6c37b642e5eabfca12420a27c57b8876c67fe2371bd4cc292ae9bc9c80fa9a18e17fafbf0bfe531a4cf81a061bb7681430225b726961c5ee3858c2d02d315128110e4e1449b58418a0ef09dadfce4a024a73dc2e72f7a0d2679550d50708acf5c2a32c759b48255578ad1bb67440b69bd99253045ff67657e1cf52c774ef0ae2ecbe9ffe89e3fa0fbabb01379d07a4f0a91a8c8638d17583cc24138bc74c465e9bd8dc13cbbb65197e21804587db113fb4b97a11532ddd9b55f527660863a11fb931b4c9b207b1e6cf3baa4fc899447914859a7a35fb452863e591e3c29bffde578330ea843265798beeb1d85de4cd19715ad706cb0d5e88984b177f551810120a48d5c99c10ed38c90e50475840bf604ab700ce3e49630e2f599ba5f75e45a9f2aea53317b3ea32ca44071fc789d3eb71bba29a09cfce770e0ba568cb7202c3b0ad79bad94d9b51d898ec6ec68a393c85b2b76ef716b79e152ea4cd0679afb89fd857df3cfeb89c1139a412934e168f1f4a1bcfabfb3c17225150f2180997de105942f274cdd617239ec53c4be00ac8cde5d0bbe9c1b1484a300755ccb170d5b4a15707753b883d3604a046da4f1cd33738903f6e7c43fd9036050e859f7addb76a1beceabdcefca3806988f5e48fea028e7480e5b06595a61164a16cf6b6afd99db5ef2ce876e4c2db91b6df21f4d1047968199aa3b1c25a8962ccc8f6974261abd1c88eb0cceea46f1179de297f61ca90725fbe0fc1e2772d38633424f2d5f4d67186ea9385e6b3c82234e8d563c031e0dfdf3463d6607af88eaf96ad51c6e2ecc73687b87c2daf1ba10c4c7c016d34c62c47395bf2451bd16ea139d7a8a5743c059d59a6e0d9d01f466a488ee06638821f63a3f917e375ddc6250d2d67080ecf0927ce0f15791f3c576ca9801dc8007bcbac644aac0e6fe66ef27d9d081bc70c0a1a716dda5227440ad72406b3bb5990cfca0f260dffc286e9b74f7744ef7653be3b8783c1ccaaabec895f4c3b54601a7e7bd35115b0bc0647de77f0d77c98928cfe74dfc02040a748f1a901e76fca5613eeb0a26c4308e6576903158080b9e08d33c50fcd3fe3eadeeaa7ea365bfbdbbd34e65c5c12d3cbd519dd8f4938938f6a24576fe6812e117d00fc889e175b9f40b7823fbbe9dc45bbe4d0d8a3cb5362cb5411a9dd624f3cd0dc9453c6c321c9e38233d6311468c68af6146c9e1bb60a8fc8682684bb536c28b6e1e947e35c750a33e6bcb510336bc54db89e38e304ddb537179e2be2278cfd8daee118d8b3a15902e79c761384b4a512debc43ce657a2694f9ff9c74a75c55357cb6d99dde7e7af12138fbff70cc110150c3cf5393b16ffcb8c7b21f2966998d056606642992236a26b39ae41dfbadf482f71a5bada30ce339b968494f813283be72c99552694e66c026180a50580d05b319e7ac01116d891a48df9247b92d31b81fe8c7b94a1ffbb018fd5d65f8f9648a22b7fdc617b8a7e2a558ffa34d54db0e5d695bb708104fe4cd059c9292c2d9f7b33867a5117e7d9009148ec57e0c9b16c5a9b844bb7c6607c36c37fbb20999d33b96286ef3826242f0c4d5737a30692f83ce58bc286a4dd82a18fbd88bdf6cdbe4cf3cb9de0be4d76ca368d855a0ae132c5e6ad3e4bcf99afe0ea6dab63c843af0b7fbb58ad7d0bb63ba252f35c0e19ee019789491c16ff0fc44a85605fd9f0d255c4dd9d41bc4980202dc1ec72669904129f7d5b32513f5c0ab37fcef8ba6aa7c6e052332b9e1693c3cba206558477490bf2ad7795f713dd5c7d83fae73b010c69e80a15c83cfd4aa784f5e5b3f210c66d5413cc0eb7caf1848922931707ca90cff6f2b7775977f71d59809427258a0c577180834839bf8f8560505eb1bccdbd5da01ee4406852fa4ed5633eb846bebef2302cdb8f03f100c4c2d752cd70fa097565398c1ff4165c4f34022caaca174098782042c2878ce9f1398a158940de868bc51d8165cc1bdcebb371d458cdbe579fc2acc0a859e1493567fbe944a7176c6e7a1dd9f38ce9378504dd3ab82d0e7f1c3d9c5a90d0bb6fc7812ebba2bd54e2cfbcf83246a299675b798147eccef884508b8c2e417f2714d123647d404eef7d9243ed59aea4cb221b2d2b4fa7d3a87b34521b67c45a17def4fc16ec5883703c86f24a4fe1e4970ca5a6f2484d3f076fa646d0f1da4f8d099f90b7f6c8fe4dbca78f2accd9444613761f8c2be75d2bf6129014ed1ac5b1a65e393a747055fcb1124cb1527bd456131a596486eda4f957b3c6b3cbac6ab47af4dbe40e14785d38b24243b420a87ffae93d6a25e9f2f995f0fadb8cdaf5a632259492c2f36d42c074da9bcc40b2e179eb6e5f633926b51b47369e866318ec35b5dd9d02f848f1dd1913c4a88159739122bfdbb2f5147207f2c5d59f540920fa04c0fdd45660c7e2a22cd480b500c7bc1fb8d2c134b591c75b7e7fd624253af718023e3db98d44781c296cec8ff6f14b5fa8bf872280b4633f8138292d53ab0c88d88f17ea83b3fbf0aac8e5d010528047ef72fb717271d40f3c6666e0f45b572a0652223e115c3383e411ad0e5b6fbaca8b031d90cc10ec3902c17c0b364ef993451846968e230c4946bbb303ad887c49658fbfebb960ee5e89e1a8655931d49614409f88fa0de261c88fefc8f6123870d98ed61fdae6b14b7f50fa7f122c081c7d5471f079c1f087a7723504d21200b2babbb74cffc4b440f822d58cd03842c94a201c30f784553a2b7607d85e67c199f396e3c0b63a210af5a3c899811e3569758c4cacfe89d8417fe5c9b6b05855fd316ac8ec96f94002e4ef5b0d9ef20146344213a0ba4156e5dce44bf20010ee68ed5b0bfc112c0725ddd1c5ced82c594648ec679f8eef2e811975c5137ed9b0eac391bc266a9ff0974b3b99a03fd8d4af0391304f54422dcd41830800484fd5d872f2201ac362e8c0b12691d5232d921f48cc510d0d5f53da93b065472d517c25e2ecebee12c37527b10a15cbe1a2849335bd122f28405338ae6bc63f72ffd7c7df6280a6f8a054b2528d693e55ffb1c927d056d56c978d40764b2a3fc526a228a8a83cce1c70d4809c948cfab6787139ed2e2b0c48b1d600f14a9eaae3e3529b2dd00dc02a4e371ceef622718dd95b9c7d02aa5c1eefed634da9c370197b0773d39a763ea6947ad21d0cbfbf5de27ee98ff35e352e576e1a9eb1300def18de6fa6977c3955d6888d84624764de35c5cb06f05354edef461bea85531e426a4f1822fae27b1196e2f456b9c9ce3379de70e898e71ced4c411d6cccf09a68fcf78c81c4c5e6e11c9dac4c18a72d3b3f68d816b0acad5fd82729aa1883a5220f3b7e112c9eb588c76e8d3bded0efd2c1719fd513bcf8b9f33ada54b4fad76ea20db420f096da261e62ea7406302f85a1fc4f909e154bba9bc92add1901a092032c2339c4009cc5ae10ca3dcc456123e559d09002f257618dbeb9e840ee3ecbf228b91a3c4f983a8332c1d6c9ad1ae56d371060e19ab0f7dbb77a66dccd5907ce0cb000abdebf1884c649352b54228542cf3b6cb44828d69c219884c8448bef00961b2245521091d25d9538a447405dfae297663c733e004531e1288fc3c873bdaa11b4038b3ba6cba0cfb962eab10a8f0ff93bbeb21fd53d77d3c4a56ea7e005e9d762d9206f792788770fdbb0847e152e4e260dc8d98e8c69422ccf9464802738017990970aa83e29a8563322acbdda66605be3f16d8eb421b5d628466f7dc2f0f2b84ad8cf7692a3249ee67020420d93a5ff5b893719fef211ed05368083c7cfc99114a716930970a19cd03a1c64f4ececd45f56d6c0f34130130a1e526e8239336441683984b209e49cd52cdd518e684f6a25521a7add08c6f794dbdd4225c16fbfcba8d922f7b27e5ac95d7451a722be028e151d1518368f700681298f1cd010b1b8de87edfd3f4a412d0413a75fd517b8b7d14dc60a43978266d054890fd0e389b1db1e21e497cd0ff99d83f2c2f5c600ab25fdc97f273c4cbb0c46cff97c7347e58222385144eba65f1bac4e747fbcf46e99e0cc5ca57106033ae6b2d58448edd83dd5c8a66ad9e9c44bceba57b0c586dcd8fbe8dd04f5af4687769aac21814be03610aff80439d7d10ac18113a4e5497213a702f071140c36cd8d0e8e4fb011cb4b249f16f67e93b2cb1d619f647b15a9bcd551d37149b74d7ce77c9f73fe187315de9d2e807d0ee3f9f114df210f462139212dbe8d5e9896ac9b7f5f43883f01ff7839dcc77ccc28c3607e3e75520ed5166275eb2190975c6aef787dcb5b83032adacb26e3735cb567a50ee8ed6012a30f3f15acb7278a306ccf06cf18ef53074f0cd1f9cc1a603080b6c1c01f30c42462d2fad95ffeaadd52a451ff72f571de6b3e818fc85c67a0de91899e35e927900d58bf59e9c9b3ebea0bade590a101600000000000000000000000070000004497e0956dea8560163d1bfa889269ac8dbe8c656865c811187ec788acbd5799f79105a9a65d3ffdff0c4e27ccc8df4678ebc66bea06bf69e28dce8b6780f0bdba4ca33cdd76bdd9a5dab00958230000c800000000000000000000007f00000064137a7cc77cdafa3ac2e200cee20ae0a393bfe457a6545376b304d2da591ff0b0b3d1e32b4409b7eea9130442e3c93819772bedb48203a847284d080666b5ebaa6ce68dbe60d278cee365699fbbd9daeace0d56f67e7b08d627481c51a27add93f21f9053fcb70dbd5e6e1f8315a522c9e9d9bfc3ae3c0dc2dc8330defc6dfe84caad57b9c80751a44c74be758387fc8056b71f3963e9ca6dad59aee6a10618fb56ffa32af7b8ff926a82fc4858d3954435f60000000000709afe5f3cbad55ea88210e22fbacee1d00379770ba4711f49562d74c1270dd4c86715f46438f10816965e043114cc25b19fa151a22708607fdb3c1a8843b67c7b836f31920eca5bd2cbb2805f610a216313570079d55e38d87197b8ca624bcd38f63e876ae08c9c13cf177a968ab131fb3d89cbbeff59f17a8cf4e9655950ad7090a510c57ee2a7870ca3bc730df079a63d1a3e7dd631be90c3f37e0564cdb8056406f494f98ae7dd2276bb02bdf75b98c2262f17b900"], 0x1230, 0x8000}, 0x0) setsockopt$inet_tcp_int(r0, 0x6, 0x4, &(0x7f00000019c0)=0x8, 0x4) ioctl$sock_ifreq(r1, 0x89f1, &(0x7f0000000340)={'team_slave_1\x00', @ifru_ivalue=0x8}) readv(r1, &(0x7f0000001580), 0x12d) [ 376.968290] input: syz1 as /devices/virtual/input/input49 [ 376.974217] input: failed to attach handler leds to device input49, error: -6 20:30:23 executing program 5: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$nl_netfilter(r0, &(0x7f0000000080)={&(0x7f0000000100), 0xc, &(0x7f00000000c0)={&(0x7f0000000040)=ANY=[@ANYBLOB="140000000301ff0600004ad65e73779508d08300000000003f00b516ba"], 0x14}}, 0x0) recvmmsg(r0, &(0x7f00000013c0), 0x1ad, 0x0, &(0x7f0000000c40)={0x77359400}) openat$selinux_load(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/load\x00', 0x2, 0x0) 20:30:23 executing program 0: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r0, &(0x7f0000000100)={0xa, 0x4e22, 0x0, @empty, 0x4}, 0x1c) writev(0xffffffffffffffff, &(0x7f0000002980), 0x0) r1 = socket$inet6(0x10, 0x3, 0x0) sendmsg(r1, &(0x7f0000002fc8)={&(0x7f0000000000)=@nl, 0x80, &(0x7f0000002000)=[{&(0x7f0000000340)="5500000018007f5300fe01b2a4a280930a06000000a84308910000003900090008000c00010000001900150006000000000000dc1338d54400009b84136ef75afb83de448daa7227c43ab8220000060cec4fab6513", 0x55}], 0x1, &(0x7f0000000400), 0x0, 0x4}, 0x0) ioctl$EXT4_IOC_GROUP_EXTEND(0xffffffffffffffff, 0x40046607, &(0x7f0000000400)) listen(r0, 0x7c) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) mkdirat$cgroup(0xffffffffffffffff, &(0x7f0000000140)='syz1\x00', 0x1ff) r3 = memfd_create(&(0x7f0000000180)="0004003100", 0x0) ioctl$sock_SIOCGPGRP(r3, 0x8904, &(0x7f00000000c0)=0x0) syz_open_procfs(r4, &(0x7f0000000300)='net/ip_tables_names\x00') write$P9_RFSYNC(r3, &(0x7f0000000240)={0x7, 0x33, 0x1}, 0xfffffffffffffe2d) sendto$inet6(r2, &(0x7f0000000380), 0x0, 0x20000004, &(0x7f000031e000)={0xa, 0x4e22, 0x0, @ipv4}, 0x1c) openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000b80)="2e2f6367726f75702f73797a3100b8458a1392623c2acc07743172c163cfc71523709c3289acba6eaf2919f32ebaa4cbe89ed30167d7d56e8e65c0edbb300c9e287f10f513e776522729d5c85c09fed3f33ea055b94d27bb72a2bb9fd56015f25cf4f9ced65ed81253cfba08e9a329935ac0c64d10a5e701cc58fe4af8cb5b679468e8ad39e103e2d5b7d9078c34eb2832a5852b28958b7efeca8ffc69c09a7ca33d82e59f9e27ea25a7cf5e65bc52987952070ddac3929791a23f905fbd72419d1539", 0x200002, 0x0) fchdir(0xffffffffffffffff) r5 = creat(&(0x7f00000005c0)='./bus\x00', 0x0) r6 = open(&(0x7f0000000540)='./bus\x00', 0x141042, 0x0) sigaltstack(&(0x7f0000ffe000/0x1000)=nil, &(0x7f0000000480)) write$selinux_context(r6, &(0x7f0000000000)='system_u:object_r:crontab_exec_t:s0\x00', 0xfffffffffffffe84) r7 = creat(&(0x7f00000003c0)='./bus\x00', 0x2) r8 = openat$null(0xffffffffffffff9c, &(0x7f00000004c0)='/dev/null\x00', 0x2807fd, 0x0) write(r8, &(0x7f0000000380), 0x0) write$cgroup_type(r5, &(0x7f0000000200)='threaded\x00', 0xfffffeb3) select(0x40, &(0x7f0000000040), &(0x7f0000000080), &(0x7f00000001c0), &(0x7f0000000280)={0x77359400}) getsockopt$IP6T_SO_GET_ENTRIES(r0, 0x29, 0x41, &(0x7f0000000c80)=ANY=[@ANYBLOB="73656375726974796d0000000000000000000000000000000000000000000000c40000004e8b4b1c7fa37c911d43b7dfc1540065e2cf063a33e71b903574450eb6fcc611bb94c232461f22877f4a6bfa2e09f7f448f8a2ef823ff78d796ab6ab52f030b8fea1243b4a37836d690100843a8998fea04a2bc474078acbb61c426c93824178b70a4bcff2d634050eca0d4f941bfec0542fd99b2bc7823b4175d0b0e455f170e292c18a967fdc58383f9af93bc9c8b8578b5ed8ba7d2084ab94919aea43e1a3acfd6d899d943862ca8d84436629d2159976a615f1279aaf23ce57319edb9be03d5b849777d956c09bcb8bc5eb1d793fe7b7d0c34d4d6cc6d28c99f66b0a2f31eda0ce948210375abcde9320750390dc04b3af4959443184210eb68c4fe6dced7e44cd2b39f7d25dc53dab0fd596852191868741cecd379b6e87b1c1a8c0dc6b8004595fb61135ed10927d6df243071d53b4757c13f4ceb4480e4a7b9c730be6258db763d9e9e7baeccd140ed2311fd9c570db36e93131c27442990068d315088680ab638288fb05b1676a9ab2fe9aa99539a1cfbb1ae8b35cd18007ba5105ed92f8914bcc2397da080dd1da393ede4f195953f82d03b9a920391ee4f5bd7485d69e1d8bfc93521ea451a20dd056bd3c133aa93c9bef1e254ad7d19379b21be984d93cc7cfcbffc82708aebe5fe4c4aa7af905248de89163041c16cfdaf96ee5b65715c7bb840274ba8ddc979ae077aa20b5ba0e97ecd80abb2d3cdb2d2b6603b3a003871b7220d71909f230fa5e9a7307c10c954a2ff1c6bf5fe3e153c0ebeb4940c365ef1e9cc8588a51bfc9807e866ea6528a77c930c06eb50e3f14ca8abf929570c05ca0615211cdcce3d034946d4fadcc9df5702fca33cb322c27a54fee8cd7901df1066311b737259dfc65048bcff6eca8f566ed75b5d21b58a3c51907ba6d5ef9e04e24febdea1d345b16288065bf64cf9fa3a746185191dc7b2f4520fd2da2f60434395d6121d7063a6455be070f49e04c8c2fa0da58d878d80a1bf9cc58b6926e3c471cb1e79cb85f6ce2ad91ac6c68f955a507ad55f514d131e0a095329227c9888f9fb19bfe6df77dff07ef08544a33e9f10d72e3ca6a0d70bf0d4b3e607a2238db2aa9c1011d0af4a39786e48004427b8b55fcd1f7ad63a9aa5338475975159310e0e40000000000000000000011a5447ff5211a75000000000000000065b1b54687c18308d3e0beb2e1007a25bddbb2c1c3de0b901b40123a8cc18eefc39e2ed9d0898586e82d3b16f3c5093189bf2590f6dfa8e0191119f831d248766edb21087b5a7b6921e43b3e34c22799d80ae2237588c019a9cad524382cffb6236d9171803387e6aa703b06aa899f9433f6bf0c358480b0c2756959384350edf7ac9f555d8561a32916ed0fe7648cf1da35a5a9a83e5b8468fdc9fb69a4d23596455582c66114a87fa96acaa58aa9f720ac57"], &(0x7f00000002c0)=0x1) recvfrom$inet6(r2, &(0x7f0000001840)=""/31, 0xfffffe0e, 0x100, &(0x7f0000001880)={0xa, 0x0, 0xffff}, 0x1c) getsockopt$inet_mreqn(r7, 0x0, 0x23, &(0x7f0000000500)={@multicast1, @multicast1, 0x0}, &(0x7f0000000440)=0xc) setsockopt$inet6_IPV6_PKTINFO(r5, 0x29, 0x32, &(0x7f0000000580)={@remote, r9}, 0x14) r10 = accept4(r0, 0x0, &(0x7f0000000000)=0xfffffffffffffefa, 0x0) sendto$inet6(r10, &(0x7f00000000c0), 0xfffffffffffffe2b, 0x0, 0x0, 0x0) 20:30:23 executing program 2: r0 = socket(0x10, 0x3, 0x0) r1 = openat$selinux_commit_pending_bools(0xffffffffffffff9c, &(0x7f0000000040)='/selinux/commit_pending_bools\x00', 0x1, 0x0) epoll_ctl$EPOLL_CTL_DEL(r1, 0x2, r0) ioctl$sock_ifreq(r0, 0x89f0, &(0x7f0000000000)={'ip_vti0\x00h\x00\x00\x00@\x00', @ifru_addrs=@in={0x2, 0x4e20, @rand_addr}}) 20:30:23 executing program 2: mmap(&(0x7f0000011000/0x3000)=nil, 0x3000, 0x0, 0x810, 0xffffffffffffffff, 0x0) pipe(&(0x7f0000001240)={0xffffffffffffffff, 0xffffffffffffffff}) write(r1, &(0x7f0000000240)="b74f45c78ae6870f83826888326269d7afbeaa8db6dd5d1de7f60df829debc43e778827874a00991b23a6a597f20123eb6940f97f1a9f8c86ea7ab989283b58cf32d5d5cbfdcda7cba1b5e52ce4b18a71a90aa09d526110017369c53939409a9e7b3fe8e7c118b30be5c4e589094d5ccb526fb19aa2750b6a92636544e5c659d67152dc447e35d9b01a350210e94e931ca697dc95c2310c276b3dfc7be92c3ba0e97b2b87a6bf0a7908a2b82dba6bf0b95a9495f8601fce23e4ba59634254922c191c20bf1549d5b7476906ee8ad498e359087f0cccee4726e43a368f9fcf96b0c69c6946e949ca009f998156199ca8e4c9f10a584d322c52fe39d6ba84bf009341faa4fb32c86021d274a436e02b89c20ba112629e29d929d2862306d53ba5a0a1e94a13fcb6fe5eefe3731080e513c5b2f4ab5713e4aa5eca24d5d7c1dd23d88d0d593b4778441b75828722fa1009687eadf0cd61a576deee4e592d2c512f7bc26662125409c1c07e248832fb05adee4280154a40cdb13177485252771c56ef4b2893bf8dd63daab7fc5787102db3b33c94890eca2c0148c8a956f1eca5efc52eed43159a2a2259dd412d4f2834dc3a18ddd6dec0d6081196c33930a936f4428114999ac05ec81151ff2664c31515eac6531d24855ed41f9f60670e60b9ce1fe8955883fcd30a53d61731bc3826172ac937d3646fceb15895e98225aefa41fb9d055f8dd0364d4170b50a54f420b5b122a138a5a3e5f3ddb9a70048e9a0b5f1db6de7d8fbd55744bff383d6845649f69375dea00ad620b852aea77dfe2f15d6a325d2b02528eac940a934117ddb2f05d0aa4bb2c3346167ede07af6b0ea9b7e6ccb26af35d2adaef566c18f53c9cc1b666b41dfe835d841315db7262ebf3415667a075f5ae9e8e4e82cd044539b07b0303497be5f0a6d181571858fb278fce699025086cc61f7b2feadc64ba3771798dfdf7aa576ba2b95c3a28a568fb2d3576a01c5a7e773d1ede68c5c428df60256b232bf4c0fdbc96a74b7440c3b1cfb873da2978b5a6f1eee549181504cf3c674b7c52b1ab4f90a6591d2932ae863c70095f4cf8a236a37ba0b5e074c919fb39c8032fdcf9dae5a31fbca184ca9865ccecd53604dff799d3b36b0858b2d72941efa5a7aa4c742fc4b8ef67323961b170092fcbcc7f9c4d6b041e3f4b10a9713dfd7bd8e2fe2418bd8f32763b8c07e6e710085a57e7b336643ec92276b224abc971f7f2db4c90efc8035287d96baf96a6df4a08f4e96d684b834a46e381b3284f71a01c12b43f538a309cdf49211777384cd897fef26a315e2aaac947f9fbbe17b8489dfc23c4340d5f157daf2acc2e2ea0f41e1deaf488aa9ba5be5755c3da115d78f5c0675a8a5492648dec35ed4e54d7f45f23d124d768166dc4e6439eed0281bc6a161a76bb7d787bb837df63cc8e5520adac544d752e7b6bf11bb5fb49defde7cc380502b8bde8d348ea08395e234b129cdce2e65bfac21123eeb51bf611311da77f5acc3992cab9dcef634eb927ca442ee6787c196d252b0b2bb49bd35e03866611c86ab2d7ca9c40993bb4c92b0e5273b5e563f82fc8e0d7c67e9762f9122393b49547f011feaecdb011bd83c98050758298a2053bc73b90ef1fcf4effdd3d3508a14b78ed766dc225c672119382cfcc1f6542ece895c4ddf726d408d443f094c4323981b03d32593556a2b3a4e36bb290594e9f2464cc2d72ebc78ee59554121ca048799bc07618204349053178fdeeeb6e05e8d8d75f68d326e66852582170441478f559bf2ec5bf0dd36d5693a7c5d7dd3af1ea6754e0736e51dd5a8c4ccb0518f607d168a3105a17e230bf7e19414bb043219626ad9770ca685ec94676065dd99e7c03463752e69f85d36aeb5b955d254bba1fdce3cee1bf9fb605a41df6d9360823728a4e5db9b1f00bddbd4f7f08476ce6528caa110ab336ee912e3e2f6d8fca0618eb6a64a15ee4644fce482772ac2f1ba37c07067f883aff736f27fac2f6c866bd2a2f6dca50d040572ea909b4a4efb67d0bb5b8d2cf37b00e0e5bb1cb447dff7b1a0bff69fe0dbc18dd9d477c77689dbf795fa80b59026c259cd646ff214816a276eca69921816d6e2f9d49fb8a0894fce6065a99d46b9876d29510a22ac18f1974b7a98aea9d1fb42bf02062af46d720048976bfbbcceb269f30a3e99b11485100e4040a3f9d7f7d4faa6ab6f9a0a1a27626fb651df1f48e3774daa8a53b98b3fbb39acd5d18bd35bea69ad881b10793700a1d96858d8755275671b0d3e0c8339a951aad458c2e0b2551ca4a27ab379ede7c6a13b5face09c58988840bff29cf25d595194312593aa4ca1a1153ebc5c92a0f591abd55f5966d76c7813ee5c2e65c59f66ace4262cab79d0e733e0f358be9355a2166242f44de95bad21e56c780194c4ff4879862be618110962e3dacc85bf2d17d016106ce3c7051dcc367799b6e4710b9c9ddcbec751158dfa12784dedd07dbc56970804bab64a6ea4603f60a6aa82c200be5fe1b459eb575e417a924dd51aecf5ff37262a5bfb4529c30f614525ebecc626e71ce9152c0fd373a36ac1d2e56efd1ce8214d261c70afe733b61198f473eae22236d8c255f49ad8e136f136386c0b3c66b16572febae50770ac6c136ca2b6af3e31bfced2d4feac5cb2f877b0888fe22e6ba58f056e2412f7c9f41eed681f6e5ba4d2307d538c82c96507dbd455f81a2dca0b1aa28f4b0d0ef0b007df5f99f91c0e1f203d3edcdf9049ec92a3ab509844706e7ae77447c6182bfda47ee0c127202ec945d9e023e05a9542b2b57032a762a90fc91eea06135559833c093306166b1d51663e3fe0bdf0af6a375c798f3c9503a146fd34ea708e5ae0d4bd22c96a9c8aff5b5184bdafd8002c0237bfb58bbf40d76f769f9f2e492c430ddbbacdd1b0c4fffec3b2bba39f07074fa6917cfce930da5d851e2454ddcad99c4c878713f3cb1b21b5c52129270216873281baa4798f5039cc88a0b3da88826bcee715dd37b960677929af528970e5038f586f75519824ba0d6c8603216cc148c8547257ea03565c2a75083e2d1f3c63c54f373eb74f2c2feaf7a7360e09103178aa3783fd79b464b82aaa5b86360161e137b8627e6e73864b4a7cd952c9f33e3d87f4138906d57b2f89fefb300603b455ba307e17bc7761ce2a90268d4ce29c0449a1583b0ce5b17a3428b26fe7fa78cdb518657fc1e4bdee521e3cec5674f99df96da559308d723e3125edd93cee4686c3851c6eea644af8837a2a17e9a4f0f170294bb7a558e878e98369eadeeb6025bbd0de4e948c051c9ff9334d55eb884b333f59abb091ffeb7f309ca2bbab4758a31e8f28be8165806a356099ddaca94943300a963de93b811ada1b46286dad48c4e64d0352055bac92ecbec3cea6c0e0557f56824abd40c9d0d0397df34fa6b7b5715a79273962dcda5c3bf44eb820d7b03159658001821475d0987cff4f58ad73e6ae3552eca31fad321b07f2596e0497e6f6943e3d465b39f6c99c5b41a3b6cd7a128f2e95dae9539ce6c53414f11c75189c12e9fcf4b55aad699b8518b6f20c63cf1246179830b53127b32fffc9d857be24639ee221fcbb31be86c8e918a4fe91b225b7bb64e685f74e19c6e16d3747faa53b28204e3b2c63c4bf5aac5a6134178bf4c77e77c27efcd8c36e0af4a33bd23beba00aca34fd5de9d2b78d37f1da7fd45d5d078f34d5ffbee78390686a120dbb0a1809d2fa3e0a1d70b5dfe4590edeff5b6dad5fdb1049134799263968169697120340c91e68468bb5cb1e4d626d4268875c98426efe35bdf4478f8c3e3ec975259448ef37fdf3833e1ac5faa29264bae8b5b9ce0ac529bb110f6b0e4fb3511e5795ba65ccceffbb9bfcf5d8c6640d389ec8f83ab2d14d18365d940a0839255425e58ac05fe181ca05f197ea3053b3dfdb3f09d7ec6c80bb72bbc6816129905148c6bacfc2db10c76db481d10180ba3c82e7152d6c698484787a0726a099021ab8fb32dafed57137441d8b471777b60261b299fe78cb52f10191e6b0a4128c5298ea78e8abfb316cc0bde6d8b9bb9141fdd05de91c533a3a3047a11b315f8fc904dadf35c06ab3c8fbd5da273bff3e7ca57e6302666458120715a6c154825a96a4b45616395e8a23e232f95be538f4e52b9e086d69179b93d191435980a1b6ee19295c83b19f8ad879af9ee82f5cbde233a709d9597d5e9d50eab41f4de29d0ae8c1f14ae8d4e07fd37ebcb3d3260054606cf166f8b97db38a32cdd62e35ba8f734c19b21b830abb1b76044bcf89939e8b5f58579aac2d7608be227faa61ad195fecb12e4dccf50dbab21463f547d7d5b43579ca7cf4f618b9c7129668e8875e6ab02d6057532310efca2dcde42abb91495ed61c2e8bcc466b690ea7bc3013d8ec5ea74f492634ee761a58d8bd07e1aea8a072b9aded12f49cb087bf2067d004e0eff24a945e01b10329604609c301a580b04fb5bbc7a8cd9fed33017f26947994c5bc9e3eca29077ca37018057c1e4f5e132c289536374d91fd379c97c764e08526584d6ab6f16e4b5ed945240076144b10a88159b15e626c0a17f8fa3d07c80a3d89f407638acf4320cf1d1e1ce1f8688621dc6b21f8380909b814ca79cd2257b1361fcf4f35338e98803043709e41ec1b8e78a051410ef2aaf2328a98feb932d44e80459e3f5b80dea8d5020f2c95df19bacbf36788060d15c0542746562f6b7e9b46997cb08215af9fe90a6621161752fad041a47b696e73c425f7097ed176c42f260db055c23803434efb600fef17f62693bbc9d1a79a4cabba025d693a7553704594cea480a92e91994fea9462ec061d6ea418d28a3b0a4000ef1bedca90b39b3e9b3cfefceb2b244a793528f62c3eb4356981bb3aa96354242a81dea739d70bc813d692f80b88c5e158291962b0e31f74a094e131b5ec7a0a94a3c98aff1a5678ec0d8a4a38463143e828a9ad367d4fe0586f7581e4f9f2139f78b386acbeac5b2ae555da6b0265ad5dbf5ef8b0602e9f276ad306c4d1f210e1fa5eb76b389f40183b39babe8183218f388b32503cad97fda42b803644ede6b7af0a0557d0549390e3d75b84c9d9938a37aac69c6cd593f007203ac4d385ce1ec4f5a452211516635c5f96df72cf93af9aa80a20cf1bb9d22b266e706a72fdb0a8896fdbd9246460b0d78c59aeb0a101ea232d6fff2ded3a9ad75e47cbb50a71c738ff23197664c1d739b24458c8242b9aad272976dfb9ca57735a55e9c2d08a9d0e1544d38dfd5b9e603155024c112c0c307747bc90a9a526cb2fb89337f649383dfa42b32da3c2a255e45b163283dda6595a3b3ed0023094db1a376b47a06a8c924e72f30b8eaa8176f2356511f79fadb80199c8e731816232f7d7929efd64c2afe41f18ad894618d91e65ae272611681ea9c813c9f901669d95c4c68a8d5e96f0857fda30b4fb88737eb105520c03a997729b79acbfc5891be0653cee940d4759f287c27ca4e3353abed35513c93ebd16d1bfe0a9c567a45b5241d1a55a2cae53eade6f4f61480186b73d293f84fcdd3e6889869527dbe8c6d4a21a02e7f768199e9c0b35b759fb1cfcfde7a4bf70a2dd40522de9b8193d40a836188ecf3daa6c13fb489cdd7a1029bb5da938ce308a7c161b6b7739c72d360a7df0bc5e6e9536a5cac7f2256849a7645e5a2c77d0ed9b19f05021d1cca53c90ee9b27119fbb70fa0dd67d7b4f2f91b6355bb5c0d59372ce7d2728750065cc105589893c896e54f1e8a58", 0x1000) vmsplice(r1, &(0x7f0000000000)=[{&(0x7f0000000040), 0xfffffe3a}], 0x1, 0x0) r2 = add_key$user(&(0x7f0000000040)='user\x00', &(0x7f0000000140)={'syz', 0x0}, &(0x7f0000000180)="a9e312aae6d5f564bc309c4c1916ad1bdd9cf697b136742600e4c420", 0x1c, 0xffffffffffffffff) getsockopt$IP6T_SO_GET_ENTRIES(r0, 0x29, 0x41, &(0x7f0000002680)={'raw\x00', 0x84, "d2605165b8ed14de24e3af42be0c1984daedfd212cbc7d5d039f7a382e7596bd050c665236a8f5a6ad1183efa4502f9168f8abc40d71e670f2bde7b8b8035f397d5671d2ac50b34b7ce0b2864e5b6ea381b727800568a423737535ea1b39adffceb79d8741af1319b57d21fc16cda6dfc74a4b6aaf8914cb1245c0d92b646dd520236976"}, &(0x7f00000001c0)=0xa8) r3 = request_key(&(0x7f0000000200)='user\x00', &(0x7f0000002500)={'syz', 0x0}, &(0x7f0000002540)='net/ip_mr_vif\x00', 0xfffffffffffffff9) keyctl$instantiate_iov(0x14, r2, &(0x7f0000002480)=[{&(0x7f0000001280)="53eb8e1ef227ae3cad0c993d4ab8be274a91370040bc5215f18a918a2c0c069821fcfcc210ebb936a162d8e3c226e8bb233f31ae824310a1d81c928768a0340523486c6b060e0154c9dbb2d87ad0ae43aab8f77e00e751ad449928b2b563ef952163c9c69d6e3bb20fba5d99f97447dae133666db2d3ba5f75e4d257915798992c374440e001326af571", 0x8a}, {&(0x7f00000001c0)}, {&(0x7f0000001340)="9649a118f39b0ff572615d537a27fb985d4d1ee029ad87c0ac94cce58d12b9ba2b5b74d3ebd16e354a7f96621f7c524092ab6c01f2384101f83e68fb715cd8628913ea0a9a82da8f2af6822c1873446787b801cd7020f9ff33f218e76ddd69e52ee7de492486b172675b8c6e41065c30181cad0c878093c61bd2d52585044f1dbb127b", 0x83}, {&(0x7f0000001400)="2d13096612fd433e4db7b1316e5977fcbf100c4d2354b15c24c03bce9b2172ec1d5c4dba6179578fa1e9780c8109d5abed29247e3fa1ba4be6d5fdf6cab5e5d068908f63b547ed68db42bf723fc235c442e1e0375dff3ec6d681e64519354f31d64c6bfea37f1f402b71c3d9524a936b5e", 0x71}, {&(0x7f0000001480)="2b99311cf87a9cb1ba577959443a2765ef998178d1f5ad366480ee29b5a7cb9b955fbcea8be2c00260d3581043b07ef652e429b7ce31ad984392662391a39707138ebefdd32adc507a8b03a35fd11d314eeb30518103ba4bd8125768e66623175bb5c378de8870d183aa231c00681a79ded9fe000164d92696952f171ab58d460ad62d73ceadca4e5c65ee286eb1ca03ec3284122f2930541544613f50565d3f40fdd7cb3a69a5af8b14bceb7d802cb63035ff97311a24f7ff376d8b03cb782a56581009c5160f79f045298ed646590ce9057401d53ac08b14bddd940d169c28a00000ab9025d3f772807f88d9336c72c18a0c445ff87de2082a20096777ae44e165a608fc4fb1f488d48ea40d37c7dfb7933a66211bc2091dc1667bad0d16d93e6a6a2fbb7caea4b4656740d7f941f34e4ac3ac80ac4689c8fd4294c3536adb904b587092b0641305f666208207886a5fa5e55696006121905a8c360d5543096dd8e671d5174d5c64cbae675e58c7816bd5ddbf113bd68eb2ac58abdcacfce65f6becb7bb2cbf4dfa81669d4c643523a8295380b46058374f4f9d2f2a66f032ff5d8e5d74b93c1b5eb0c63bce7b4cdf6b59711b32c121a77dfc34b5eab073449e9e13687c6001024124bd1efe6a260498975e6d3add33bd8678c5bd54f2182e316e09c31f914c3bdd262e0ba7167cae26e43e4d6241574151e97d3e98e6818fc773e730059ac718037a173e65b43210bd39f448f2745b32fe5e807bcd32b5068172df213b1f118cbf0292ce0b3c70cb212bd246717beeee67e929aa22b7319ef28c119a2d66f25fbf182e19e02e510e5bb08c84e2568ab75e9861c4cace37b30490c1ddd133b11c7809b4d07034bb32a3ee50b767824db1dc53f5630e29f45ce028c068a2d13e36620abd9c5c5ba34fcb8922bbe868c403df60a5f840e46c48b1672727ab91b0d3c252f2fd0047983f1e30ae10602f05152db619ada2f192a8952fd24fa4a293a551a018351d042a511e9c9e14cd56879798703bd7d38bb030dbc60b2d1a042b902274a0346e1ff50461b68039ed50e661803f657e610456bdacfdaf78b608f1e2550dd5fabfc49db1c5c70a194a2992c75070061a09dddf8868cd42ba5f01ee4c7727ec57c1263e9f0bf573b55bfbab25499d969fe4a86511cb21d7626c4472606fe77203de8e2af329ffd17092aa49fa8ae02196918f73327302b888d4944b128cec3c6efb91aeef473ef6e3f9933ccedede8561de860ef99c0e1e0b34152702164494cc5d501c43a7a4d44015e85b0733a59e80efc636349b24f9b56b4d7cc9f9458128ffc84ecbed97bebe280db2412e4f8800524351051704a18327ad8c69e1db1d77066972fd7e73eee38b7a314651aa4cf5e11aeb8abc0b5459418ca38219fe0e873c08ae595a2e47bf8e723b7bdfc0a3ca9b5e52f562ef13f5f22a6b4412477b33f9aee4c2171d18e23ad8af6fdf8ac3c0ab32093b50d83087794c2cd3eb0d8f04852fe17820c73a7c9893bf74c53de54149d955700d15b89347a737884c78a83db661578bf60a6f3aa4c385c34aec260ae95f1ef166102fd60b5ac34c74a11e874bc39f306b684baafd30c649700c6809a0b1982f61266031020a20fcd170ad909e4f522f256f55908722048eec40efb6848eef0fcfb83e01a708481b1f62be7eaf40d592e427a8dc0bf504da615b0a4cf6377c535cae758ff1d9292b4ae21ff9350e76f5f467bc0806755f69bdd63f2ca1fbc653253edc91b5cab194500f46a850856ab613dfc63dc2059083e3bef64f6ba85160c18256f2513e46feced2bda312339d702510007325f73f98fb2bf51d258c567af1e96dbc85ce7d010ff7bfe1c5d68427d8eeecfddd00e3c44426e563903560bc3e2bf45481c423e1e8667253603fdeb6268e4fa5e32d09b8c7b2f70a420c1f0389a583264296a6dbd11fe6e5ce8711e3b970297a009d2113bd7bbb28652a4b07fdae22abaceb7c3e715d642a2fdf50a424d5dbbb2dad306a99670f913904601e51fcd2c1d4f98373755e43cd44af81180fa029d0acf002d2fb41f94f0d227348949caf7d70560890c79dca05dea526c39252926e222ea80709d044fe80430713041373f01e2d7776ad51a39d7cbe3e6ef7fa7ff27911d1e53aef90356f87b905db0c95328a3ecf8ac964e6f518ba743ef77f407eff037f744d57d210e76439b574c7942721b161207419a3fb87988ad5ede0cdf837b714cfab5ceca1fcb06041322d482d8a8183fdc252ae216c3f8fbbeb85eb82c7bd3f03a28b300db2b23440a63a8441d04f721c0042e6f1b826cf3621a188befef205856594df9218d8c261bbe9f7a2c62c710c214d7f405847a26bcf382bbb3e6b5f427c569ead0485505ebadc69226365367de241a5c5f3908f5729c03776855abdcd5f9b682d2c63a1e8283e77342a703d777319c84412ad53deb1e047acad37a0789d30a76bb776d488eaf2849578432b7a78b660e34dd3722c8259a3fa1222bc63b69d07282b6bce0d2635fc26fac12cf048f86e407544199d2c84e8a0288f1931e5d3b0dd2d940dd0ed6d0e3258292eca566d50081e5d592e1c31cf9b9d801a1ef7b34544f74eecb013c97282c2e94c65dff1043d2666677321f96a0b331a0466bcb9a11acabe9f503e41783cc10dbb0dd6602f434150225951a6aea9390fe86d47f5600c7d0fa0c1208e5e0e8c7cf3157d2476a5699d009b50a8e7d4a3aaf0b53306b01076b803e197c48dac7f614d47a8eeaafeede23b77ec09824d506c1dfe2fd94be7d2139318fdade6790d2c358eed468137b43d465a5851b977d24c84faf32f412e6f5eb4518dd48bf3972a7611d5015ad74a071af85dc5adb242a9adc4e1874899e7aef1c429541a78f4969532c2f96a4cd7ad83ddae5006a917fd94273241487b63e88dae3adc0159f7301fe1cfb0d98e8253579f2380db31610130389a9a6bd04b26715d418f21edc814f6c76f9a50c20235bce4aa93bbeb9394cf86546f2774c4e06b4280b62bf54903a5cdcba3afb9d43ffc97d07fbf774041810964a97116a77a059720e6cecf5a9a305c86ebf1e7a407e48ea2ed8696c5a14c9f716ac57256c9de33c899d6715526a7b307e1281d4f0674ef6783475469be65f0d3d9fc5cb02123e1b1704b539cc2881d4116ca040ea149b4ba856be56c12b19b23ccd99a0f769f024450f37fa34359a54773709a7512ca8489b88fc95ff76cf26773af5e5c9b65d5d5c6e8101779268f06874d3c2a77051b8460cb9fd3b163f5ce2a2796af7895ac1b2584311954750841fb855b28b6c73e8f8189af9097a9bd11761b900557db4292a81554758d7ba9effb7eb8a4be53f3b7e58a34108478ad6477c27c2ed043e31aa7bab6adc085177fc3b09db8de7e98c66957538562348ba17b81dc4de210ea04dfb118a06f0cd876b4b18f7401a922c8f0816b5074b92710cc2fe83591b8f8581470498011072b9076a7ecd8bd3d002c33a40a8c5a8d636ca9fcf2dbee56b230dfc0086225cb3b50021c3dadd37b74885f1a84628430d013a1224814af626a431993f8625f282fbf9a7242371012efab2b25972994f88cabf883e75279f3614817650e2bac3e15e111729c41981252de5813397d34775669526f1f4fbd8f02c86bdad8cb0840503b4f61dbd4f6d2eefdd49d567d9d4f68388229f5b9dd0755121a7521da06a97ebe6b4e6698204f39073f5a58fd22515c303795656695827c48d15d7ecaa6b63aa7cfc49a2ab2adf1332050d1b341e7b759c73e1386458db874c8c24e84a543043b7b0a042fa582336ae0101319d1a7a773e185fcb6e65febb1eade4a80473c29c2618e321ef275638b14ff04dd4f985c9ab8ea6ccc4400bdb65829ed0d312858061b63d132d8862631f056004ae42e2fe4c119c4b8b36a9c5a572f741f92e0b7bb0589c750f93d0458c9af599aaefe9999850dc80b1643da88819c7bbed048006ed416d2edc7685be58f6bcfcc909c11eedd6e23be647ac4c329abaffc0552b86c33577dc199724a88335046eb7da4641d14e9715273f8163ef1544199d64297dba91d9e078362910ea1e4d41847f911f26ecaab01fdf525fff05071d124b258e47e74bfdc6cb007dd1471302f2e9b8465ce667312c05ec917b7526926284a28b2df2267c94e831c3afd7853e62d62557b560b105b0be714dc7f3485a1947a96a3f1992abb09d916d03b1fefcef9f4a1a085ddbd0361d58f0a46caacc46267171f4b55a24b4adcc7270dacae5042bccad387f7b0b342c38b05e309f76f56bca5e495518ec562d5338ddcc27fe9d9baf084ebeebf5808f29518c813306ba1d98f104171e6854816700e2c8c28d54b34b5aa6ac6f1c14479993aa598cef498cced140a1b1cf63ad90224ddae0d342dd6665a8e7b6c2d2303b5631c2cb3a613ac63fe8f5621826462a44263887dd69263ee8f5e906f17fae5aaa873b00f81575cdb23650a0c431450d47d1329cda5497a1bab539ec37d6c6e7972b7ec3d39707ed7d4c7a93a6ae5ae5b9eb40ed007759182abdcd4db45d1a39637af1f525a90ac20c1c9bca330aa44ef5436d732a8f3f1abce395600bf3e8522e72eb9ea9585349b70641f086fb05309b05a177deeab1ac1de5e5edbe8d8035190e95c30539446f845de8c275636762d6b16f722c817fe2f866a920774254d871e6b2643c725027c51131d0cb1cd6b7ea918ccf18003fd7447fbae3d2a8606ccc9371a995afea33bd10d3cf9ca476bab8a91a6e2b223c8b0ae2dcfd4cf61d634595352cea014e4916be355cb666a285b7f1375c661a4ad46e80c576237c53feb25dede474e1e93d1c2a6307e378055ca3914427ca01e694ab99188c970bdd813fe28c326d3f802e74f02d15f5cf0b7f7adc3fed8baddd49cecbe39fcae62fbec4cf2f5a8a74a0c6c2bc87bdb5fa763b1381b83379954a19f8e8b74bea126d044e0a4a7a9575a4bd52943f8336d70456336595fe918310a996ad7d831c8cd7a6ac103c43da639d4cda001c5282a6bf53d4f083d435db5eac14f50efe7323e4a52ada09c98b642aea12120944e104e3b1ec23d5af53dbbc6a3012fd0206d875d76c474c59154e71a1cbf9d9df988074e2dda75e66adc17c877c3c9bef03b8dd3718e938816396ec8ad46ffbb9536a49563101cd33ba85a05697c59a2add4580041249343e1683a34bd875af2ddab4d364d17b207b49283d33e3c8998f2c2b119906fd1e237146c0b7d55d4ae7f0349c0fdf0ad36f753a95e5c76cb6ffe8360a61a13d976a4eb6741d32b43dfbb6011063e50d570cb3a0a389ccabc3892d644510b25e82b048ff62fc4049997b8d3f1fa4d570a714df2d276f628c806769fdceab81a2396995a9709df61131242167628191fcfd3cbb237bb80a975dd0bf9cd022dec6e5a98d30ad6ab8a0bf42092772e9f8885d3458ba7ee7dda7721548c9670234c7c28f07a7157370821373fd1c0900ed0dcf2b33d6ea9f97a1e7986d28b58de1736a639ff220f0d564ff01526b2bb3f8886b5512d379e4f17d80730ba842bb3cf36609a60abd7577c9a65547b40d7aa59f185c3e565af7bb835971c64b11aff84314c62b236bea54b7882623a2e5ca32115b4955bdd1db9ab25a97de1da7e1a50427cd70b383bc940cb97d568acbc252e89a0d74999ae2ae083a61781a0fc2c1c2f1cbfeacedcfb42fb3a6f132c0e8b206765cb23f840e8568d630876ab04f9761a304545f4b9c6f9fa27636757d3977b19fb51762f34f59d9a10c0a5126375", 0x1000}], 0x5, r3) add_key$user(&(0x7f0000000100)='user\x00', &(0x7f0000002580)={'syz', 0x2}, &(0x7f00000025c0)="a3f1c8c9a7e6557904efe9e45e5d45362354710469df241e6c94dcd9bf6fac26177ef5a2eef12a2c9d55274ed9864dbad3dbd9b69b1f1e82d9abff826f19562f2024b2dff475", 0x46, r3) ioctl$TIOCGSID(r0, 0x5429, &(0x7f0000000080)=0x0) ioctl$sock_inet_SIOCGIFDSTADDR(r0, 0x8917, &(0x7f0000002640)={'sit0\x00', {0x2, 0x4e24, @dev={0xac, 0x14, 0x14, 0xb}}}) syz_open_procfs(r4, &(0x7f00000000c0)='net/ip_mr_vif\x00') 20:30:23 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$FS_IOC_SETVERSION(r0, 0x40087602, &(0x7f00000001c0)) r1 = syz_open_dev$binder(&(0x7f0000000640)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000000)=[@enter_looper], 0x1, 0x0, &(0x7f0000000040)='+'}) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280), 0x0, 0x0, &(0x7f0000000780)}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000380)={0x8, 0x0, &(0x7f0000000500)=[@release={0x40046306, 0x1}], 0x0, 0x0, &(0x7f0000000400)}) 20:30:23 executing program 4: pipe(&(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) writev(r1, &(0x7f0000000340)=[{&(0x7f0000000580)="b2", 0x1}], 0x1) pipe(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = dup2(r1, r3) fcntl$setpipe(r0, 0x407, 0x0) ioctl$sock_SIOCGPGRP(r3, 0x8904, &(0x7f0000000040)=0x0) getsockopt$inet_IP_IPSEC_POLICY(r4, 0x0, 0x10, &(0x7f0000000140)={{{@in=@multicast1, @in=@dev, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{}, 0x0, @in6=@dev}}, &(0x7f0000000080)=0xe8) r7 = getegid() setsockopt$sock_cred(r1, 0x1, 0x11, &(0x7f00000000c0)={r5, r6, r7}, 0xc) tee(r2, r1, 0x5, 0x0) close(r0) 20:30:23 executing program 2: r0 = socket$inet6(0xa, 0x2, 0x0) r1 = openat$urandom(0xffffffffffffff9c, &(0x7f00000003c0)='/dev/urandom\x00', 0x62000, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x1400200) ioctl$RNDADDTOENTCNT(r1, 0x40045201, &(0x7f0000000000)=0x5) dup2(r0, r2) unlink(&(0x7f0000000080)='./file0\x00') [ 377.557850] binder: release 16616:16623 transaction 323 out, still active [ 377.566808] binder: send failed reply for transaction 323, target dead [ 377.575396] binder: send failed reply for transaction 326 to 16621:16624 [ 377.583045] binder: 16660:16661 ioctl 40087602 200001c0 returned -22 [ 377.590520] binder: undelivered TRANSACTION_ERROR: 29189 20:30:23 executing program 2: socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000000)={0x0, 0x0}) r1 = openat$keychord(0xffffffffffffff9c, &(0x7f0000000040)='/dev/keychord\x00', 0x20000, 0x0) setsockopt$inet6_tcp_TLS_TX(r1, 0x6, 0x1, &(0x7f0000000080), 0x4) r2 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000140)='ns\x00') fchdir(r2) exit(0x0) sendmmsg(r0, &(0x7f0000008600)=[{{0x0, 0x0, &(0x7f0000003140), 0x226}}, {{&(0x7f00000072c0)=@un=@file={0x1, './file0\x00'}, 0xa, &(0x7f0000000400)=[{&(0x7f0000000180)="04d05e1e8f70ab4c2772ecfb5925a273a23cc09774644e290dc597bddecf09681e528837f5ab051446d23e354f6ec2f9106b1cefc5037fb772462a8795e500635792073d272b7dd0de931298fa5755e820bb6682ed40d051f93822841dbb2a6e91fb293d61588132a06f11c9078066e2e3e3df94d711ced96de2673ccb8062499d6adef1ca538e"}, {&(0x7f00000000c0)="883f982d2b04903a62d72e49"}, {&(0x7f0000000100)="2d49fac316b6ddc7a0072bb1a23d47052dc663bcf00d210107e5e1c87cd9ab715f9860778b74"}, {&(0x7f0000000240)="1014ff9df02e3d26bc"}, {&(0x7f0000000280)="b72bcb6e35e8ac2a569154bd1ddd0a8191991a87e31ec784a796949bd25a3c2c1a6f6d374dbe99d8bebef91c92a9bfd1849ef43dd336cec97524774ba52094862ee8e5490782730175142b4c90599035fe62e24e63d8156a063d1a38f13513051ee2ef6b0d5b13cf62a133655517e14ff03112679a3c1377e2742ddde353010f9382d161fbc62d35cb690789bfff9c1ee1b9a1877646a5637f5f891cb647b62f5de3917375946bca4562eb12da19dc84d89c66b54430fa8fffe3b892c6177e898d7c"}, {&(0x7f0000000380)="dc12f60f0cee8bab0278c7a3c1c19547c92965f281e1d33fcde96867e66f2f98b3f0be1424b7f7ebae1c74f36c5a7f5e57b375cd8df7ee3f4ae6c5e7e3345bc1379404059551b19cf21ff5fc642b9a26d36fedda69ab093b"}], 0x0, &(0x7f0000000600), 0xffffffffffffff5f}}], 0x2, 0x0) 20:30:23 executing program 4: socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = socket$netlink(0x10, 0x3, 0x0) getsockopt$netlink(r1, 0x10e, 0x8, &(0x7f00007e0000)=""/4, &(0x7f0000000000)=0x4) 20:30:23 executing program 4: ioctl$FS_IOC_RESVSP(0xffffffffffffffff, 0x40305828, 0x0) 20:30:23 executing program 4: r0 = socket$packet(0x11, 0x3, 0x300) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) syz_emit_ethernet(0x2e, &(0x7f0000000140)=ANY=[@ANYBLOB="aaaa8100000008004500001c0000000000009078000000007f000001000000000008907800000000000000000000"], &(0x7f0000000080)) setsockopt$packet_int(r0, 0x107, 0x8, &(0x7f0000000040)=0x100, 0x4) recvmsg(r0, &(0x7f0000000440)={&(0x7f0000000180)=@can, 0x80, &(0x7f0000000100), 0xfffffffffffffeca, &(0x7f0000000400)=""/50, 0xff4e, 0x8}, 0x0) setsockopt$sock_timeval(r1, 0x1, 0x15, &(0x7f00000000c0), 0x10) 20:30:23 executing program 3: r0 = socket$inet(0x2, 0x3, 0x0) setsockopt$inet_tcp_TCP_CONGESTION(r0, 0x6, 0xd, &(0x7f0000000680)='reno\x00', 0x60c5) ioctl$sock_inet_udp_SIOCINQ(r0, 0x541b, &(0x7f0000000000)) sendto$inet(r0, &(0x7f0000a88f88), 0xfffffffffffffe6e, 0x20000000, &(0x7f0000e68000)={0x2, 0x0, @local}, 0x10) 20:30:23 executing program 5: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$nl_netfilter(r0, &(0x7f0000000080)={&(0x7f0000000100), 0xc, &(0x7f00000000c0)={&(0x7f0000000340)=ANY=[@ANYBLOB="140000000301ffff808f00003d88c83f00b516ba"], 0x14}}, 0x0) r1 = memfd_create(&(0x7f0000000000)='\'*eth1\x00', 0x1) sendto$inet(r1, &(0x7f0000000140)="14d811076364175a8d130a7628e06c4237d37a634ca9921f7cc7f3dea39098fde13a7e19044a2dc743c6ace85945fff0ad74dc508dc5c9a05f21dc7c9e48b3b6c0b19eab5f73502f8ed844901806ac94", 0x50, 0x20000094, &(0x7f0000000040)={0x2, 0x4e24, @broadcast}, 0x10) recvmmsg(r0, &(0x7f00000013c0), 0x1ad, 0x0, &(0x7f0000000c40)={0x77359400}) 20:30:24 executing program 0: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r0, &(0x7f0000000100)={0xa, 0x4e22, 0x0, @empty, 0x4}, 0x1c) writev(0xffffffffffffffff, &(0x7f0000002980), 0x0) r1 = socket$inet6(0x10, 0x3, 0x0) sendmsg(r1, &(0x7f0000002fc8)={&(0x7f0000000000)=@nl, 0x80, &(0x7f0000002000)=[{&(0x7f0000000340)="5500000018007f5300fe01b2a4a280930a06000000a84308910000003900090008000c00010000001900150006000000000000dc1338d54400009b84136ef75afb83de448daa7227c43ab8220000060cec4fab6513", 0x55}], 0x1, &(0x7f0000000400), 0x0, 0x4}, 0x0) ioctl$EXT4_IOC_GROUP_EXTEND(0xffffffffffffffff, 0x40046607, &(0x7f0000000400)) listen(r0, 0x7c) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) mkdirat$cgroup(0xffffffffffffffff, &(0x7f0000000140)='syz1\x00', 0x1ff) r3 = memfd_create(&(0x7f0000000180)="0004003100", 0x0) ioctl$sock_SIOCGPGRP(r3, 0x8904, &(0x7f00000000c0)=0x0) syz_open_procfs(r4, &(0x7f0000000300)='net/ip_tables_names\x00') write$P9_RFSYNC(r3, &(0x7f0000000240)={0x7, 0x33, 0x1}, 0xfffffffffffffe2d) sendto$inet6(r2, &(0x7f0000000380), 0x0, 0x20000004, &(0x7f000031e000)={0xa, 0x4e22, 0x0, @ipv4}, 0x1c) openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000b80)="2e2f6367726f75702f73797a3100b8458a1392623c2acc07743172c163cfc71523709c3289acba6eaf2919f32ebaa4cbe89ed30167d7d56e8e65c0edbb300c9e287f10f513e776522729d5c85c09fed3f33ea055b94d27bb72a2bb9fd56015f25cf4f9ced65ed81253cfba08e9a329935ac0c64d10a5e701cc58fe4af8cb5b679468e8ad39e103e2d5b7d9078c34eb2832a5852b28958b7efeca8ffc69c09a7ca33d82e59f9e27ea25a7cf5e65bc52987952070ddac3929791a23f905fbd72419d1539", 0x200002, 0x0) fchdir(0xffffffffffffffff) r5 = creat(&(0x7f00000005c0)='./bus\x00', 0x0) r6 = open(&(0x7f0000000540)='./bus\x00', 0x141042, 0x0) sigaltstack(&(0x7f0000ffe000/0x1000)=nil, &(0x7f0000000480)) write$selinux_context(r6, &(0x7f0000000000)='system_u:object_r:crontab_exec_t:s0\x00', 0xfffffffffffffe84) r7 = creat(&(0x7f00000003c0)='./bus\x00', 0x2) r8 = openat$null(0xffffffffffffff9c, &(0x7f00000004c0)='/dev/null\x00', 0x2807fd, 0x0) write(r8, &(0x7f0000000380), 0x0) write$cgroup_type(r5, &(0x7f0000000200)='threaded\x00', 0xfffffeb3) select(0x40, &(0x7f0000000040), &(0x7f0000000080), &(0x7f00000001c0), &(0x7f0000000280)={0x77359400}) getsockopt$IP6T_SO_GET_ENTRIES(r0, 0x29, 0x41, &(0x7f0000000600)=ANY=[@ANYBLOB="73656375726974796d0000000000000000000000000000000000000000000000c40000004e8b4b1c7fa37c911d43b7dfc1540065e2cf063a33e71b903574450eb6fcc611bb94c232461f22877f4a6bfa2e09f7f448f8a2ef823ff78d796ab6ab52f030b8fea1243b4a37836d690100843a8998fea04a2bc474078acbb61c426c93824178b70a4bcff2d634050eca0d4f941bfec0542fd99b2bd8823b4175d0b0e455f170e292c18a967fdc58383f9af93bc9c8b8578b5ed8ba7d2084ab94919aea43e1a3acfd6d899d943862ca8d84436629d2159976a615f1279aaf23ce57319edb9be03d5b849777d956c09bcb8bc5eb1d793fe7b7d0c34d4d6cc6d28cb9f66b0a2f31eda0ce948210375abcde9320750390dc04b3af4959443184210eb68c4fe6dced7e44cd2b39f7d25dc53dab0fd596852191868741cecd379b6e87b1c1a8c0dc6b8004595fb61135ed10927d6df243071d53b4757c13f4ceb4480e4a7b9c6e0be6258db763d9e9e7baeccd140ed2311fd9c570db36e93131c27442990068d315088680ab638288fb05b1676a9ab2fe9aa99539a1cfbb1ae8b35cd18007ba5105ed92f8914bcc2397da080dd1da393ede4f195953f82d03b9a920391ee4f5bd7485d69e1d8bfc060000000000000056bd3c133aa93c9bef1e254ad7d19379b21be984d93cc7cfcbffc82708aebe5fe4c4aa7af905248de89163041c16cfdaf96ee5b65715c7bb840274ba8ddc979ae077aa20b5ba0e97ecd80abb2d3cdb2d2b6603b3a003871b7220d71909f230fa5e9a7307c10c954a2ff1c6bf5fe3e153c0ebeb4940c365ef1e9cc8588a51bfc9807e866ea6528a77c930c06eb50e3f14ca8abf929570c05ca0615211cdcce3d034946d4fadcc9df5702fca33cb322c27a54fee8cd7901df1b737259dfc65048bcff6eca8f566ed75b5d21b58a3c51907ba6d5ef9e04e24febdea1d345b16288065bf64cf9fa3a746185191dc7b2f4520fd2da2f60434395d6121d7063a6455be070f49e04c8c2fa0da58d878d80a1bf9cc58b6926e3c471cb1e79cb85f6ce2ad91ac6c68f955a507ad55f514d131e0a095329227c9888f9fb19bfe6df77dff07ef08544a33e9f10d72e3ca6aa7b3bf0d4b3e607a2238db2aa9c1011d0af4a39786e48004427b8b55fcd1f7ad63a9aa5338475975159310e0e40000000000000000000000000000000000000000000000000000e77eae0ceac6e9f5743d4db211a4161976bea46cebb27a2651ed8c780df452c8bf465291a8f20d25beb4eeae3e59c99b9d4259ed55efa5a775c098aea698dcf6ff1bd8afac48040000000000000038b55050b00000008a320370cf03e17afe436f73f0c47f50417d59b96998b861a5a0df64921b9bc288ae30251a33c2bba355c447765687675cd9aeb0771eef296b6e629ae06a41f19fbcc5ae37480c31c0cae1e00f2d6e8b2e81d98360466175845c53c77835d999340e2a770a49f4effac2b35156447af7c1cf31f9684d8da3b5ec10e44f2801a9c8874a2976e014f79ca1d49899d301bc1bb7"], &(0x7f00000002c0)=0x1) recvfrom$inet6(r2, &(0x7f0000001840)=""/31, 0xfffffe0e, 0x100, &(0x7f0000001880)={0xa, 0x0, 0xffff}, 0x1c) getsockopt$inet_mreqn(r7, 0x0, 0x23, &(0x7f0000000500)={@multicast1, @multicast1, 0x0}, &(0x7f0000000440)=0xc) setsockopt$inet6_IPV6_PKTINFO(r5, 0x29, 0x32, &(0x7f0000000580)={@remote, r9}, 0x14) r10 = accept4(r0, 0x0, &(0x7f0000000000)=0xfffffffffffffefa, 0x0) sendto$inet6(r10, &(0x7f00000000c0), 0xfffffffffffffe2b, 0x0, 0x0, 0x0) 20:30:24 executing program 3: r0 = socket$inet(0x2, 0x4000000000000001, 0x0) setsockopt$inet_tcp_TCP_CONGESTION(r0, 0x6, 0xd, &(0x7f0000000680)='reno\x00', 0x60c5) sendto$inet(r0, &(0x7f0000a88f88), 0xfffffffffffffe6e, 0x20000000, &(0x7f0000e68000)={0x2, 0x0, @local}, 0x10) clock_gettime(0x0, &(0x7f0000000000)={0x0, 0x0}) nanosleep(&(0x7f0000000040)={r1, r2+10000000}, &(0x7f0000000080)) 20:30:24 executing program 4: socketpair$unix(0x1, 0xfffffffffffffffe, 0x0, &(0x7f0000000340)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$sock_SIOCBRDELBR(r0, 0x89a1, &(0x7f00000001c0)='sit0\x00') ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) close(r2) openat$fuse(0xffffffffffffff9c, &(0x7f0000000040)='/dev/fuse\x00', 0x2, 0x0) io_setup(0x8, &(0x7f0000000100)=0x0) io_getevents(r4, 0x4000100000001, 0x0, &(0x7f0000000240), &(0x7f00000000c0)={0x0, 0x989680}) syz_open_dev$mice(&(0x7f0000000000)='/dev/input/mice\x00', 0x0, 0x2000) io_submit(r4, 0x1400, &(0x7f0000000600)=[&(0x7f0000000180)={0x0, 0x0, 0x0, 0x800000000001, 0x0, r3, &(0x7f0000000140), 0x4000}]) time(&(0x7f0000000140)) 20:30:24 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$FS_IOC_SETVERSION(r0, 0x40087602, &(0x7f00000001c0)) r1 = syz_open_dev$binder(&(0x7f0000000640)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000000)=[@enter_looper], 0x1, 0x0, &(0x7f0000000040)='+'}) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0x0, 0x0, &(0x7f0000000780)}) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000380)={0x8, 0x0, &(0x7f0000000500)=[@release={0x40046306, 0x1}], 0x0, 0x0, &(0x7f0000000400)}) [ 378.376011] binder: release 16660:16671 transaction 330 out, still active [ 378.397380] binder: send failed reply for transaction 330, target dead 20:30:24 executing program 2: r0 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f00000003c0)='./cgroup\x00', 0x200002, 0x0) fchdir(r0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000005c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x800000008400200) r2 = open(&(0x7f0000000040)='.\x00', 0x0, 0x0) getdents64(r2, &(0x7f0000000180)=""/79, 0x12) ioctl$BLKSECDISCARD(r2, 0x127d, &(0x7f00000000c0)=0x4) lseek(r2, 0x4, 0x1) setsockopt$inet6_udp_int(r2, 0x11, 0x66, &(0x7f0000000080)=0x9, 0xffffff00) getdents(r2, &(0x7f0000000400)=""/119, 0x77) r3 = syz_genetlink_get_family_id$nbd(&(0x7f0000000240)='nbd\x00') sendmsg$NBD_CMD_CONNECT(r2, &(0x7f0000000300)={&(0x7f0000000200)={0x10, 0x0, 0x0, 0x480000}, 0xc, &(0x7f00000002c0)={&(0x7f0000000280)={0x38, r3, 0x9a0f3862bfecb0dc, 0x70bd2b, 0x25dfdbfd, {}, [@NBD_ATTR_TIMEOUT={0xc, 0x4, 0x9}, @NBD_ATTR_SERVER_FLAGS={0xc, 0x5, 0x1}, @NBD_ATTR_SIZE_BYTES={0xc}]}, 0x38}, 0x1, 0x0, 0x0, 0x10}, 0x20040081) getdents64(r2, &(0x7f0000000000)=""/18, 0x12) [ 378.428926] binder: 16715:16717 ioctl 40087602 200001c0 returned -22 20:30:24 executing program 2: clock_gettime(0x0, &(0x7f0000000000)={0x0, 0x0}) clock_nanosleep(0x10000000000000b, 0x0, &(0x7f0000000140)={0x0, r0+10000000}, &(0x7f0000003c00)) r1 = gettid() timer_create(0x0, &(0x7f0000000100)={0x0, 0x12}, &(0x7f0000000080)) r2 = openat$null(0xffffffffffffff9c, &(0x7f0000000040)='/dev/null\x00', 0x200, 0x0) ioctl$RTC_AIE_OFF(r2, 0x7002) timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x8}, {0x0, 0x9}}, &(0x7f00000000c0)) tkill(r1, 0x15) 20:30:24 executing program 4: open(&(0x7f0000000280)='./file0\x00', 0x4000, 0x4) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = syz_open_dev$mice(&(0x7f0000000140)='/dev/input/mice\x00', 0x0, 0x12000) getsockopt$packet_buf(r1, 0x107, 0x0, &(0x7f0000000180)=""/115, &(0x7f0000000240)=0x73) pipe(&(0x7f0000000040)={0xffffffffffffffff}) ioctl$UI_SET_EVBIT(r2, 0x40045564, 0xd) r3 = add_key$user(&(0x7f0000000080)='user\x00', &(0x7f00000000c0)={'syz'}, &(0x7f0000000100)="c6", 0x1, 0xfffffffffffffffd) keyctl$setperm(0x5, r3, 0x8280000) keyctl$revoke(0x3, r3) clock_gettime(0x0, &(0x7f0000000300)={0x0, 0x0}) futex(&(0x7f00000002c0), 0x3, 0x0, &(0x7f0000000340)={r4, r5+30000000}, &(0x7f0000000380)=0x1, 0x0) socketpair$inet6_udplite(0xa, 0x2, 0x88, &(0x7f0000000000)) 20:30:24 executing program 4: socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000023c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = socket$packet(0x11, 0x3, 0x300) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r2, &(0x7f00001fefe4)={0xa, 0x4e22}, 0x1c) listen(r2, 0x9) r3 = socket$inet6_tcp(0xa, 0x1, 0x0) sendto$inet6(r3, &(0x7f0000000280), 0xa5, 0x20000004, &(0x7f000031e000)={0xa, 0x4e22}, 0x1c) r4 = accept4(r2, 0x0, &(0x7f0000000580), 0x0) dup3(r4, r1, 0x0) setsockopt$inet_opts(r1, 0x0, 0x4, &(0x7f0000000300), 0x0) r5 = add_key$keyring(&(0x7f0000000140)='keyring\x00', &(0x7f0000000440)={'syz'}, 0x0, 0x0, 0xfffffffffffffffb) keyctl$setperm(0x5, r5, 0x0) keyctl$describe(0x6, r5, &(0x7f0000000500)=""/4096, 0x1000) 20:30:24 executing program 5: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$nl_netfilter(r0, &(0x7f0000000080)={&(0x7f0000000100), 0xc, &(0x7f00000000c0)={&(0x7f0000000340)=ANY=[@ANYBLOB="140000000301ffff808f00003d88c83f00b516ba"], 0x14}}, 0x0) recvmmsg(r0, &(0x7f00000013c0), 0x1ad, 0x0, &(0x7f0000000c40)={0x77359400}) sendmsg$nl_netfilter(r0, &(0x7f0000000300)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x4}, 0xc, &(0x7f0000000040)={&(0x7f0000000140)={0x1a8, 0x1, 0x0, 0x300, 0x70bd29, 0x25dfdbfb, {0xa, 0x0, 0x1}, [@typed={0x8, 0x2, @u32=0x6}, @typed={0x4, 0x23}, @nested={0x188, 0x51, [@typed={0x10, 0x38, @str='vboxnet1,l\x00'}, @typed={0xa8, 0x5f, @binary="89a42e5414ee4c2b4751d98c76646f5b742fd7dd15b8bfb4cff7ca329f35a0d2b78c2006c1138c0fbc419656284b3ef4417c8e758f9697820259752143846535f6054dc9dd6fb6893850c4d49c1ca892f212d4432216da1096e61e4941d4d38dd2a5ed5e935e599e4e5c03ba4bd1eca6afa7bba7d89d5aeddd136c017b02b00b3a6e3689d14d6373f28bda1f88875634504ba055a55499ed7f61649c363188e1244e"}, @generic="111fdd042cf1e8a71ac4fff1fd789692fd4f6b304d6db7b05ad812e145e03d55d9d9262fdbcd3de5e5ba6dff80b5007aa800d02aa861da4622eded844a7382335f986269cdd732176e11324f05541bf5de2bb168e69bd12307ed899192226bb370d21d06955eaa171870147857e120c2e39373817e51453790f0efd324c565ec6100a18a87b6ea3b8c4b4dcb5c5b1649b41475e1f9b525b0a6c3bb40ac66cce452deec890bd07775952cc780cc63c1407377870c25720fedeec6efcaec1b8ac5f9b1a6f09f82cf9218c5855f"]}]}, 0x1a8}, 0x1, 0x0, 0x0, 0x40840}, 0x4040) 20:30:24 executing program 2: r0 = socket$inet(0x2, 0x4000000000000001, 0x0) bind$inet(r0, &(0x7f0000000040)={0x2, 0x4e23, @multicast2}, 0x10) setsockopt$inet_tcp_TCP_CONGESTION(r0, 0x6, 0xd, &(0x7f0000000000)='dctcp-reno\x00', 0xb) sendto$inet(r0, &(0x7f0000000040), 0x0, 0x20000802, &(0x7f0000000100)={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0xa}}, 0x10) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000080)='ip6_vti0\x00', 0x10) write$binfmt_aout(r0, &(0x7f0000000440)=ANY=[@ANYBLOB='\x00'], 0x1) sendto$inet(r0, &(0x7f00000001c0)="fe", 0x1, 0x0, &(0x7f0000000140)={0x2, 0x0, @multicast1}, 0x10) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) shutdown(r0, 0x1) 20:30:25 executing program 2: socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = socket$inet_tcp(0x2, 0x1, 0x0) getsockopt$inet_tcp_int(r1, 0x6, 0x13, &(0x7f0000bfcffc), &(0x7f0000000040)=0x4) 20:30:25 executing program 2: r0 = socket(0x200000000010, 0x80000000002, 0x0) recvfrom$unix(r0, &(0x7f0000000200)=""/174, 0xae, 0x40000000, 0x0, 0x0) link(&(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)='./file0\x00') write(r0, &(0x7f0000000100)="240000002e007f000000000000ed0300000008ff010000000b0000000004000000080061", 0x24) r1 = openat$selinux_enforce(0xffffffffffffff9c, &(0x7f0000000180)='/selinux/enforce\x00', 0x0, 0x0) syz_open_pts(r1, 0xc0) mkdir(&(0x7f00000001c0)='.\x00', 0x8) syncfs(r1) getpeername(r0, &(0x7f0000000000)=@ll={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000080)=0x80) sync_file_range(r1, 0x10000, 0x2, 0x6) [ 379.228261] binder: release 16715:16720 transaction 334 out, still active [ 379.238396] binder: send failed reply for transaction 334, target dead 20:30:25 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$FS_IOC_SETVERSION(r0, 0x40087602, &(0x7f00000001c0)) r1 = syz_open_dev$binder(&(0x7f0000000640)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000000)=[@enter_looper], 0x1, 0x0, &(0x7f0000000040)='+'}) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0x0, 0x0, &(0x7f0000000780)}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000500), 0x0, 0x0, &(0x7f0000000400)}) 20:30:25 executing program 0: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r0, &(0x7f0000000100)={0xa, 0x4e22, 0x0, @empty, 0x2000004}, 0x1c) writev(0xffffffffffffffff, &(0x7f0000002980), 0x0) r1 = socket$inet6(0x10, 0x3, 0x0) sendmsg(r1, &(0x7f0000002fc8)={&(0x7f0000000000)=@nl, 0x80, &(0x7f0000002000)=[{&(0x7f0000000340)="5500000018007f5300fe01b2a4a280930a06000000a84308910000003900090008000c00010000001900150006000000000000dc1338d54400009b84136ef75afb83de448daa7227c43ab8220000060cec4fab6513", 0x55}], 0x1, &(0x7f0000000400), 0x0, 0x4}, 0x0) ioctl$EXT4_IOC_GROUP_EXTEND(0xffffffffffffffff, 0x40046607, &(0x7f0000000400)) listen(r0, 0x7b) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) mkdirat$cgroup(0xffffffffffffffff, &(0x7f0000000140)='syz1\x00', 0x1ff) r3 = memfd_create(&(0x7f0000000180)="0004003100", 0x0) ioctl$sock_SIOCGPGRP(r3, 0x8904, &(0x7f00000000c0)=0x0) r5 = syz_open_procfs(r4, &(0x7f0000000300)='net/ip_tables_names\x00') write$P9_RFSYNC(r3, &(0x7f0000000240)={0x7, 0x33, 0x1}, 0xfffffffffffffe2d) sendto$inet6(r2, &(0x7f0000000380), 0x0, 0x20000004, &(0x7f000031e000)={0xa, 0x4e22, 0x0, @ipv4}, 0x1c) openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000b80)="2e2f6367726f75702f73797a3100b8458a1392623c2acc07743172c163cfc71523709c3289acba6eaf2919f32ebaa4cbe89ed30167d7d56e8e65c0edbb300c9e287f10f513e776522729d5c85c09fed3f33ea055b94d27bb72a2bb9fd56015f25cf4f9ced65ed81253cfba08e9a329935ac0c64d10a5e701cc58fe4af8cb5b679468e8ad39e103e2d5b7d9078c34eb2832a5852b28958b7efeca8ffc69c09a7ca33d82e59f9e27ea25a7cf5e65bc52987952070ddac3929791a23f905fbd72419d1539", 0x200002, 0x0) fchdir(r1) r6 = creat(&(0x7f00000005c0)='./bus\x00', 0x0) r7 = open(&(0x7f0000000540)='./bus\x00', 0x141042, 0x0) sigaltstack(&(0x7f0000ffe000/0x1000)=nil, &(0x7f0000000480)) write$selinux_context(r7, &(0x7f0000000000)='system_u:object_r:crontab_exec_t:s0\x00', 0xfffffffffffffe84) r8 = creat(&(0x7f00000003c0)='./bus\x00', 0x2) r9 = openat$null(0xffffffffffffff9c, &(0x7f00000004c0)='/dev/null\x00', 0x2807fd, 0x0) write(r9, &(0x7f0000000380), 0x0) write$cgroup_type(r5, &(0x7f0000000a40)='threaded\x00', 0x32af) select(0x40, &(0x7f0000000040), &(0x7f0000000080), &(0x7f00000001c0), &(0x7f0000000280)={0x77359400}) getsockopt$IP6T_SO_GET_ENTRIES(r0, 0x29, 0x41, &(0x7f0000000c80)=ANY=[@ANYBLOB="73656375726974796d0000000000000000000000000000000000000000000000c40000004e8b4b1c7fa37c911d43b7dfc1540065e2cf063a33e71b903574450eb6fcc611bb94c232461f22877f4a6bfa2e09f7f448f8a2ef823ff78d796ab6ab52f030b8fea1243b4a37836d690100843a8998fea04a2bc474078acbb61c426c93824178b70a4bcff2d634050eca0d4f941bfec0542fd99b2bd8823b4175d0b0e455f170e292c18a967fdc58383f9af93bc9c8b8578b5ed8ba7d2084ab94919aea43e1a3acfd6d899d943862ca8d84436629d2159976a615f1279aaf23ce57319edb9be003000000000000009bcb8bc5eb1d793fe7b7d0c34d4d6cc6d28cb9f66b0a2f31eda0ce948210375abcde9320750390dc04b3af4959443184210eb68c4fe6dced7e44cd2b39f7d25dc53dab0fd596852191868741cecd379b6e87b1c1a8c0dc6b8004595fb61135ed10927d6df243071d53b4757c13f4ceb4480e4a7b9c730be6258db763d9e9e7baeccd140ed2311fd9c570db36e93131c27442990068d315088680ab638288fb05b1676a9ab2fe9aa99539a1cfbb1ae8b35cd18007ba5105ed923b76ef17b289f79096f8914bcc2397da080dd1da393ede4f195953f82d03b9a920391ee4f5bd7485d69e1d8bfc93521ea451a20dd056bd3c133aa93c9bef1e254ad7d19379b21be984d93cc7cfcbffc82708aebe5fe4c4aa7af905248de89163041c16cfdaf96ee5b65715c7bb840274ba8ddc979ae077aa20b5ba0e97ecd80abb2d3cdb2d2b6603b3a003871b7220d71909f230fa5e9a7307c10c954a2ff1c6bf5fe3e153c0ebeb4940c365ef1e9cc8588a51bfc9807e866ea6528a77c930c06eb50e3f14ca8abf929570c05ca0615211cdcce3d034946d4fadcc9df5702fca33cb322c27a54fee8cd7901df1066311b737259dfc65048bcff6eca8f566ed75b5d21b58a3c51907ba6d5ef9e04e24febdea1d345b16288065bf64cf9fa3a746185191dc7b2f4520fd2da2f60434395d6121d7063a6455be070f49e04c8c2fa0da58d878d80a1bf9cc58b6926e3c471cb1e79cb85f6ce2ad91ac6c68f955a507ad55f514d131e02095329227c9888f9fb19bfe6df77dff07ef08544a33e9f10d72e3ca6a0d70bf0d4b3e607a2238db2aa9c1011d0af4a39786e48004427b8b55fcd1f7ad63a9aa5338475975159310e0e400000000000000000000000000000000000000000000000000003bf7321dfa772ad209"], &(0x7f00000002c0)=0x1) recvfrom$inet6(r2, &(0x7f0000001840)=""/31, 0xfffffe0e, 0x100, &(0x7f0000001880)={0xa, 0x0, 0xffff}, 0x1c) getsockopt$inet_mreqn(r8, 0x0, 0x23, &(0x7f0000000500)={@multicast1, @multicast1, 0x0}, &(0x7f0000000440)=0xc) setsockopt$inet6_IPV6_PKTINFO(r6, 0x29, 0x32, &(0x7f0000000580)={@remote, r10}, 0x14) r11 = accept4(r0, 0x0, &(0x7f0000000000)=0xfffffffffffffefa, 0x0) sendto$inet6(r11, &(0x7f0000000640), 0x0, 0x0, 0x0, 0x0) 20:30:25 executing program 3: r0 = socket$inet(0x2, 0x4000000000000001, 0x0) setsockopt$inet_tcp_TCP_CONGESTION(r0, 0x6, 0xd, &(0x7f0000000680)='reno\x00', 0x60c5) r1 = open(&(0x7f00000002c0)='./file0\x00', 0x0, 0x9) ioctl$LOOP_CHANGE_FD(r1, 0x4c06, r0) ioctl$FS_IOC_GETFSLABEL(r0, 0x81009431, &(0x7f0000000100)) sendto$inet(r0, &(0x7f0000a88f88), 0xfffffffffffffe6e, 0x20000000, &(0x7f0000e68000)={0x2, 0x0, @local}, 0x10) r2 = openat$zero(0xffffffffffffff9c, &(0x7f0000000000)='/dev/zero\x00', 0x208000, 0x0) accept4$unix(r2, &(0x7f0000000200)=@abs, &(0x7f0000000280)=0x6e, 0x80000) accept4$unix(r2, &(0x7f0000000040), &(0x7f00000000c0)=0x6e, 0x0) 20:30:25 executing program 2: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = syz_genetlink_get_family_id$team(&(0x7f0000000140)='team\x00') getsockopt$inet6_mreq(0xffffffffffffffff, 0x29, 0x1c, &(0x7f0000000180)={@loopback, 0x0}, &(0x7f00000001c0)=0x14) ioctl$ifreq_SIOCGIFINDEX_team(r0, 0x8933, &(0x7f0000000200)={'team0\x00', 0x0}) ioctl$ifreq_SIOCGIFINDEX_team(r0, 0x8933, &(0x7f0000000240)={'team0\x00', 0x0}) getpeername$packet(0xffffffffffffffff, &(0x7f0000000280)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @random}, &(0x7f00000002c0)=0x14) getsockopt$inet6_IPV6_IPSEC_POLICY(0xffffffffffffff9c, 0x29, 0x22, &(0x7f0000000680)={{{@in6, @in6=@remote, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@loopback}, 0x0, @in=@rand_addr}}, &(0x7f0000000780)=0xe8) accept4$packet(0xffffffffffffff9c, &(0x7f00000007c0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @local}, &(0x7f0000000800)=0x14, 0x80800) getsockopt$inet6_mreq(0xffffffffffffffff, 0x29, 0x1b, &(0x7f0000000840)={@empty, 0x0}, &(0x7f0000000880)=0x14) getsockopt$inet_IP_IPSEC_POLICY(0xffffffffffffffff, 0x0, 0x10, &(0x7f0000000980)={{{@in=@remote, @in6=@mcast2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in=@local}, 0x0, @in=@multicast1}}, &(0x7f0000000a80)=0xe8) getsockopt$inet6_mreq(0xffffffffffffff9c, 0x29, 0x15, &(0x7f0000000ac0)={@empty, 0x0}, &(0x7f0000000b00)=0x14) accept4(r0, &(0x7f0000001280)=@ll={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @link_local}, &(0x7f0000001300)=0x80, 0x80800) getsockname$packet(0xffffffffffffff9c, &(0x7f0000001400)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f0000001440)=0x14) getsockopt$inet_IP_IPSEC_POLICY(0xffffffffffffffff, 0x0, 0x10, &(0x7f0000001480)={{{@in=@dev, @in6=@mcast1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in=@rand_addr}, 0x0, @in6=@dev}}, &(0x7f0000001580)=0xe8) getsockopt$inet6_IPV6_IPSEC_POLICY(0xffffffffffffffff, 0x29, 0x22, &(0x7f00000015c0)={{{@in=@rand_addr, @in6=@mcast2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@loopback}, 0x0, @in6=@remote}}, &(0x7f00000016c0)=0xe8) sendmsg$TEAM_CMD_OPTIONS_SET(r0, &(0x7f0000001c80)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x8000}, 0xc, &(0x7f0000001c40)={&(0x7f0000001700)={0x514, r1, 0x500, 0x70bd2c, 0x25dfdbfb, {}, [{{0x8, 0x1, r2}, {0x248, 0x2, [{0x38, 0x1, @activeport={{0x24, 0x1, 'activeport\x00'}, {0x8}, {0x8, 0x4, r3}}}, {0x40, 0x1, @lb_tx_hash_to_port_mapping={{{0x24, 0x1, 'lb_tx_hash_to_port_mapping\x00'}, {0x8}, {0x8, 0x4, r4}}, {0x8}}}, {0x38, 0x1, @mcast_rejoin_interval={{0x24, 0x1, 'mcast_rejoin_interval\x00'}, {0x8}, {0x8}}}, {0x40, 0x1, @lb_hash_stats={{{0x24, 0x1, 'lb_hash_stats\x00'}, {0x8}, {0x8, 0x4, 0xf7f9}}, {0x8}}}, {0x3c, 0x1, @enabled={{{0x24, 0x1, 'enabled\x00'}, {0x8}, {0x4}}, {0x8, 0x6, r5}}}, {0x38, 0x1, @activeport={{0x24, 0x1, 'activeport\x00'}, {0x8}, {0x8, 0x4, r6}}}, {0x38, 0x1, @lb_stats_refresh_interval={{0x24, 0x1, 'lb_stats_refresh_interval\x00'}, {0x8}, {0x8, 0x4, 0x6}}}, {0x38, 0x1, @mcast_rejoin_interval={{0x24, 0x1, 'mcast_rejoin_interval\x00'}, {0x8}, {0x8, 0x4, 0x100}}}, {0x38, 0x1, @mcast_rejoin_interval={{0x24, 0x1, 'mcast_rejoin_interval\x00'}, {0x8}, {0x8, 0x4, 0x9}}}, {0x38, 0x1, @activeport={{0x24, 0x1, 'activeport\x00'}, {0x8}, {0x8, 0x4, r7}}}]}}, {{0x8, 0x1, r8}, {0x224, 0x2, [{0x38, 0x1, @activeport={{0x24, 0x1, 'activeport\x00'}, {0x8}, {0x8, 0x4, r9}}}, {0x40, 0x1, @priority={{{0x24, 0x1, 'priority\x00'}, {0x8}, {0x8}}, {0x8, 0x6, r10}}}, {0x38, 0x1, @activeport={{0x24, 0x1, 'activeport\x00'}, {0x8}, {0x8, 0x4, r11}}}, {0x3c, 0x1, @enabled={{{0x24, 0x1, 'enabled\x00'}, {0x8}, {0x4}}, {0x8, 0x6, r12}}}, {0x84, 0x1, @bpf_hash_func={{0x24, 0x1, 'bpf_hash_func\x00'}, {0x8}, {0x54, 0x4, [{0x35f, 0xfffffffffffffffc, 0x3ff, 0x7}, {0xffff, 0x101, 0x1}, {0x0, 0x4, 0x9, 0x2}, {0x490, 0x8, 0x7fffffff, 0x100}, {0xfffffffffffffff9, 0xffffffffffffffc1, 0x59c, 0x6}, {0x1, 0x7, 0xff, 0x6}, {0x0, 0xb7, 0x1, 0x24}, {0x101, 0x5, 0x7, 0x5}, {0x0, 0x100000000, 0x6, 0xcf0}, {0x0, 0x3e816f7b, 0x2, 0x4}]}}}, {0x40, 0x1, @name={{0x24, 0x1, 'mode\x00'}, {0x8}, {0x10, 0x4, 'broadcast\x00'}}}, {0x38, 0x1, @notify_peers_interval={{0x24, 0x1, 'notify_peers_interval\x00'}, {0x8}, {0x8, 0x4, 0x2}}}, {0x38, 0x1, @mcast_rejoin_interval={{0x24, 0x1, 'mcast_rejoin_interval\x00'}, {0x8}, {0x8, 0x4, 0x7f}}}]}}, {{0x8, 0x1, r13}, {0x7c, 0x2, [{0x3c, 0x1, @name={{0x24, 0x1, 'mode\x00'}, {0x8}, {0xc, 0x4, 'random\x00'}}}, {0x3c, 0x1, @enabled={{{0x24, 0x1, 'enabled\x00'}, {0x8}, {0x4}}, {0x8, 0x6, r14}}}]}}]}, 0x514}}, 0x40000) sendmsg$nl_route(r0, &(0x7f0000000100)={&(0x7f0000000040), 0x1bb, &(0x7f00000000c0)={&(0x7f0000000000)=@newlink={0x30, 0x10, 0x801, 0x0, 0x0, {}, [@IFLA_GROUP={0x8}, @IFLA_PROTO_DOWN={0x8, 0x10, 0x6}]}, 0x30}}, 0x0) [ 379.339944] binder: 16769:16772 ioctl 40087602 200001c0 returned -22 [ 379.367677] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket 20:30:25 executing program 2: r0 = socket$inet(0x10, 0x2, 0x8) sendmsg(r0, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000009ff0)=[{&(0x7f0000000000)="24000000250007031dfffd946fa2830020200a0009000000001d85680c1ba3a20400ff7e", 0x24}], 0x1}, 0x0) [ 379.385829] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket 20:30:25 executing program 2: r0 = openat$selinux_enforce(0xffffffffffffff9c, &(0x7f0000000440)='/selinux/enforce\x00', 0x84000, 0x0) bind$unix(r0, &(0x7f0000000240)=@abs={0x1, 0x0, 0x4e21}, 0x6e) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) getsockopt$inet_IP_IPSEC_POLICY(r0, 0x0, 0x10, &(0x7f00000002c0)={{{@in=@rand_addr, @in, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6}, 0x0, @in=@broadcast}}, &(0x7f0000000180)=0xe8) setuid(r2) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) socketpair$unix(0x1, 0x0, 0x0, &(0x7f0000001300)={0xffffffffffffffff}) mkdir(&(0x7f00000000c0)='./file0\x00', 0x0) clone(0x20002100, 0x0, 0xfffffffffffffffe, &(0x7f0000000080), 0xffffffffffffffff) mount(&(0x7f0000000040)=ANY=[], &(0x7f0000000140)='./file0\x00', &(0x7f00000001c0)='proc\x00', 0x0, &(0x7f0000000200)="6d643573756dcc2d6b657972696e67fd626465766d643573756d2500") socket$key(0xf, 0x3, 0x2) sendfile(r3, r0, &(0x7f0000000100), 0x3f) epoll_create1(0x0) syncfs(0xffffffffffffffff) recvfrom$unix(r1, &(0x7f0000001100)=""/194, 0xc2, 0x0, &(0x7f0000001200)=@file={0x0, './file0\x00'}, 0x6e) [ 379.420257] audit: type=1400 audit(1542313825.330:59): avc: denied { create } for pid=16786 comm="syz-executor2" scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tclass=netlink_iscsi_socket permissive=1 20:30:25 executing program 2: r0 = socket$inet6(0xa, 0x400000000001, 0x0) r1 = dup(r0) bind$inet6(r0, &(0x7f0000000040)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) sendto$inet6(r0, &(0x7f0000e77fff), 0x2bd, 0x20000008, &(0x7f00008d4fe4)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) r2 = getuid() quotactl(0x6, &(0x7f0000003e00)='./file0\x00', r2, &(0x7f000000a300)="beba02533362d9904c04448c3d750f9f3801521bc445effd88fda4b1314aba67854cc8554909840091d5ba013d22313aae5f4e56d6dbdb9c3176a7e985d9ff8af479a643e99cffe84403e94f9fced7e84bfffc8745b0c34f207be67927582d4909b920994ee17fca8af07f07063a1067de0a92808bbeb873b3d491ec407d4353421d3cc54683186baefc1862bb34cdc5f359a092c077fcf1a70cd84b918e3d97fa0745a7d78da406") clone(0x100, &(0x7f0000009240)="041795ed609a4c6c3fde4b96568890139a2efd29994dbc949379256fd65b84d08dd7fbe4dc2de539119bb39dff16fc84a86422b5908cfe045051d50b629f2eb525fb633d4ea070e907e24d1b35f9586a3974bc9c844b42a76bf820818f724bad90a6c5846adf657450b5b70e758f6f4147b1cf52c8f09115cbbf5b1df6a7ed630b1d2de18795789a50d5f2097a18c8a057e28b7eedf6a8b5ea28f6664e495dec725125a81d03006312997f386f7af13d4531f72b114fb55d8ad1bbc59772dc82a535adaed2bb47f31760f70c3d60c0c0fbd425be2f716bda1b77be5aba70c1689d6d94baf96ec5f9808d72dd53d15178a5638febde9c0b2fb7c0e1792d4cae6f8190fba104a57aaf89eabc73ba6e3768b2123775fdab51aaece139f62765ee9f57bb9af4be414bb5377c7ef9cb941c594be718e03aeaf55b5e88107bdadb23e2e59ce19a8935d9d14adb6373f9d53601e10eff6a157ccc5f9b9962cb7ba83b596a2e2a17aa489d57699acf4172713c53e3bc8f0d27b4cfbfeba298c1bb4c5b99479e97e8c7acf5fd8faad51dcef4320ac8bd03d71501d83a639a65c047e23aaa4e542f8bfd6174db54f923ac2fc870174d2581638bc0070fbacf61be8b289e9b19faf93762d0b50565e1723dc1f135b62fd40f938e9bd93d7af6ce2fa933da758dfa7193e0728ad484eb23ca50250b72dcae2c532f42e5a2fb0e2aff1f40e88e4b398a4f047a48e0b3184724b071a436750a23ef29427c906b749208192c0c20500dc9e8ad342e7e9a979cbb6216e42a130172f1df6f79f0be704da3a8776cec91efd6afb0ab71061fc8793ca401aeafe377c350993b0cace33b7cb2d6e6623b1976fb5f0562e80b3de62fb9540cbcd6876757c36467dd30d08e09a59df742ca2bdfa06b3b0ceee15b9f3f97d8b7d003fe6a532774c5b1454f64b537bdfcaa58062cfa517786eadf1cb0b69abaa04c741f0af1b4d63f09dfd4757ab31f7b7500be13a9eb43f03457c472ddd74efa6ae54de84dc227f3e680c4c1ff69e5af5541d45db59728073629136cff484772d4325819795e89882874fd7b517214ad127dc4025649562fa6f83c7b479979117e2dbf43659c9fb9d8d2b26fddde978cf3496c22b9f6ab703694f16380d069d9ec07f575cbf95a190e4af658f2562c237f8197a7bc6c60a468f97e314ea074f9ef125021dab54cbcda29c60042a6895270303fde19c7f514ea9696a0af37200d4f144d50ecf90b570cd5ed76dc571e43ab1391225c1605b01d14ad4f88d43ab9518db143bfdb5631684d696c1a1a73fc99b69fdf05dc5d4e97fb21b3d8ae0cf4fd8b66059610cd43e586787f7c3143f5f9b7a24a229bfd7397737aa3b6ed245bce59bd4d21d1a013b020fa5c339923a994b283e5d0146e1cf1752b99decd5e17b91dfed834ca9800429ac3792c472b821c228787a476c0fd647d6d2127813a84c460a24566e20a5d3e61c79e3ad3c117ad9728b97ac76c54be3eb424ad9fd0cd43231d7bb6479284aeb08abf922a03434f79026709ac6be4ed93361923427c37965b2fc3fbecae45476308a8306ee15d883b4cdb71df30949c8e410e25f2182e89e53a63cd420a72a4560b29a8c8632d2e9f211739992d3ad5a76c89323f6d036dbf1504133b857ea1db85faf3314ca6a5e27d88f27086c8378716e3a8bf1b22ab7d2d632f9e176afb7a379e65ae956e2f170262659c72b64f226da839d13effcb811ffa0d8702daa46801834854e46725f9385eb95dde8ff40bbf39f40c50f4ad921cd60c45da206240dae1d09cc90970bf49f92aac5083e05f4b7913e6e777f73c2d783c7bb6c9dd38f2e8d446fcaf8583744b31a9d33eb503d3a57688cd2cfdfa7f757ba2bb53d582ffb38e924e250e1880d212de4fc8aec11c8a08da9cd876a7937bc592359459eb0e878c38f08fb45a5e860d521b553d84df4f41aa7f5f8a477eb177109808664efe1fedbc7f0b77f508f35a79b3400695b98cfa11a250342415ed1094b23c84ccff5ee05f62ec840566d17073e0ed771f0dd39b672b3bb9f604583d3f2c61f1fe88588a32118b52eb5b462b25b20201911be6d586bce5837c68ee5b71f37f8b3c994aff5814ea135da37b1013381fef52b88a58830d35f5d63cf8390f8e46dc5e77da546709eaaa4c7121b36a94711c84f4b38fdc90c794d6c5e00af7f0350a58dfc8ab57dbe12e9a8650143aef4d3c57dba9d5f9a2ca0943d0961dd1bc835eaf5f073e9a3262de80df5089eabfadc9001bde80edaa07430df0b59dabdf9162723b48d1335db9fafe2f37f285909911c70c3609c6bdb5ef57a0c46817b05ab70422192303c22cf6b201f879e46556471a73acbebd8ac22f9570be3becfd61f191554cb6fd55f1c9378b1e9a7c79a0cfbbe522a15c96f948b4c862bd1fb928517fc83e417cc4b37705d175376ed3c8f0330dae4aa2609b718d4f2988359757590cbbc3af39b3eb85a594a28888abc926f8c5cc896d5b82a92861b7b69591dafb754cabbba42ab318725f2f68c0d8c5cef2422099708ab467d8b0a1c0cbd58fec53235961254bbfdf97392a7d7dae3f5777011899ea57a7624d9594d7161493b63edb24fdb960c7c441a28af3fb60b18f1ee953148f8edff4fa57ec96630a22eda3e1eb7a4af61ac68d071a62ed2ebff1adec4e2fb9aa55f628766cb2a84f6ed204afe17c0576423864a2d16d3b56665d8aaa98a2f12fbf2776277d9b35373ad946ce013f0ce398dbb068839d8bb5ac230d1b5e2753d6cc995cb350b1cf11d28cdd43725b91eb4b53a63ad6b5d975f6ac30cf09e8c1dc4ffbf5b64986cf773a17ef52fa6acaaed8907a81a9a23c769eed1398b5d55189e80f9a92a5363bc430952657a62bec59e08710fad22b978308fa0948e713e6e0e3a91ccb9d6e9522c9c4574bcc53abfbdca0c31edbc673cdd621073af8e01e0acf3c4786949c70fd3a7cf1c10070aed46a0406c9a5a7103604e56ec834a70aef569e003adc9a81423c0f07f83ebb1d79382c651c0a572ad526a6e15671c80a118bf18c6e111252233818d07598a60b9ad9f07d788aa6a1f68cc5adad85db1fcf7f8609fac0a22abfb516bd92e832d4530d4006c7b1675ae2013bf4244eefe91426a6cc65052f7c1d171f5e56ed91840dd0cac994a5d64169229999134c381846dba2f36aa3ee65332cfbce4af20cabeed302fcee302deb26be558a9b11b7f58dde6e0138bd96a09d672f435f4fb32b4353209bb92d22afdb94eb7b49f802c2e5a2945072b8f1e5bfd588c2478a64d89958e87b92020b425e13fcd205956fb3466d6aefeda7115eca27e2dccbe932930a8f74d0e90e1c473a233242bd4b6dcc317d9366be803b39ea3279321984d8d1bd07c8fe30a29c7247112f512791ae45d1e110dc06dcd52cb9c17ac93bb89714caf1232ab7eb8ec1927bb019e80f82fdb2fd27851250a1bb35accaa1d2aa3e3ce793c12893edbc03db4ed30011a677c0b3470897f25d15727cd0a41de09f99e604dbb4ade7c7f35d3b0ec50cad85a63cda03f94135474e26b03b26497a9051af5b7f4045c4d8df44cc91b6a567ece33c6a15492a7a89666526ff05238cda1e9a8d688ed785d6484b4dc1754ba186a389f8ddb0d3ec6bfc338267712eeda48aee0e3848cf27289267db6b0658cc304c4027944e9fc418d2827c75024fcc705f1e8cd7e7ec998fe388fcb83a7b92a13bbc7c192a07751f49e178d04a8ae8e937c7acb88d8d38ea17bf42e43bc21a2c6ab9b46724949b9f38bf3b0b687a1e7a3caa2272a52fb7cd4fa302dac9b4c21cd7a2e30638a9bf535c8bfb0e6c721959be5768b704f02ab960d8bf1b1a93d57ab52e928694fb042d6ffe40eb55cc3eccc3f1f9dfac24a14987ea9923b2fb8ea9a9ab72f66722befa1a169653df3ba453914015ca8171cbdbe944b275e9d4ce56b0202fe1883b0667029efae34e498d99c03649aa1b10dbe2e4486661f42a727bc433c13334f4ddb45266636c1fcb38330bb05ac2a64479c2ac65561b00857a26bcd1cab02cb372158ec693d73a504bd8db3a132a913ccff104f940d2ff9e618465ecfcfad820a92f3081ef2bfc99cb46cc7f0f9cb4e43497cf2575634b9382eaab1c69410900462acfd794caa7824d7e0404119de2b696a6e196d238de6e108d2e83178d6292d7c92b1acae5b7949df5afe13257d722b8dc9b97af2e502abd8726efd4fb1dc27066f34b0a394d3417ae4c73355b84c59ea1a0b60f6f3d7d5dec1295d30abbb301767641ac13ecedb426be749c95211e0e4dbbad91466dc74a2751443d3d4f93c26d971ef07d17bb7f0d9297b4f00a1c29c26adeedcee360ef055a747e52420e6ef05460180b7ed4c90b62c80e75e11cbcd0128e752878cc51de6fe6b45303db8bc7e95ca17d657b16cbd517500af6f08b525a5a574a7ca13d2f15464f5d540bc635572af946f58b797f1ff3558bd25ef6f27b7d4264779d206ecfc45cbf70a14f30cb518de79239380dd9b954b2113028d891ab429a2373b299be2c995f3ca6cf69285e0bd588aadf70acbb5aff79fb22bb5127d204614a35d9b12cfb5d5f4d4102bd1367fab83913f44ed3a8628855ac8825353045fb6760826701da59ef1f64d760dcc278ea5bf89a973507783973805019791c75c7af098bc8a17bd43fe0716bd8b6bbfeb98721097eb9fb412d7a4d2345573a0a10ec36343b251d49ec0e4a98c0aac9439a212cb2f653532a77e358f6dbee83ca060d7e73b7d4bf75989f16d6e7a8e254631c20e21f85b136c5cfb7750b9bd28a5133d1c6ec04f9d945fc588ef0543da6930a3afd665ef16b6e30edaa7ebd8bed7068073db3e0278a7faf124959dee96130afd12c1f2a870204e963fc96216d8e6d0d5ff5dfa36a81658445b69e24827ceb6e4c8ed4d2572a9c0c98d36369300a73e92e445da9b63320222b523c4153ce9e2c900258c1c8b04193e511273377b28d3b24be10b814b163cf7f7c5fbaffd7c848e66587799ebc1086c5466d3314a0e6fae9261eaec2690b113cac6be45fd40965a4b96dfaf952f7f7bc0d0288e50c28760e47f853b419049ee1406e4f90883f289b82a87080a10e8bb0ea4ed01907c0f80e3f47ca5e0fde785ace38870170b8bb333ce7536ae094a7ecd18378ef4f1cae4471265dc201c9873c4e94fb18ea46d040645da1f503f56ebec26cde22200682109572e4b13379dc21420b96c909c239736906c15608a63b7f25d8ce06612e818e4013d47d8bde90b14d59389ed20a83d8340c30ad6171f1d6a011f66fff1d289d61d4242fab366342f0fe5caf2696ec694d38b23488921615a6cf7ea6ca6cbe9b60c7b481395190c4b062b51a09ebc648fd78656a26e18ca71127a154234b7be2a49220d8da63e0f0eea579089d4bc66a95e278ae3b652dcc8ed33de8c01e3f3e56e5685758a039f97a2069829d453b6b5d1aa1b53d6eb12606759f958bf0a0ab038382ca6fc0736210c611480362b892a5744f4397835fc8744754fcc91fc247fbde6228aac00612c5883f76a8d63db7c22a229ff07b16ab81a5ce0629d77c057c897beae1113f077f6c3621bd42333407e8c50f2817d2d3fc308e61d01740ac2a3ec537efa8bc1266cdba226a7e4f63adc6c40a435a9605bce82cc3ef05dc49c5380609f35eca80c7f44f9c020a582504c0c5909ddb240ec0ae8949208e9d2a1c2e5f3db437a4606e85b8e0d67a3debbb8a4eb78522b58d5bd2cf4487164bbb27a0e3e6d0aa27424635a91e3f919709b777e94a75e7fc", &(0x7f00000002c0), &(0x7f0000009180), &(0x7f000000a240)="7c87790ac83e98acce5e907f08cf270c86edae419718ae1899ec854a21ad981c10d86afa7b152f53180cee2d85c075775dd4d606327c223fdaf586bad044dbb12ffe4cdfb15436b84ea9c00b3358a629062ec47bb4f6d8b51fa17d13154e6d4c9e1fe585b015df3ba38e5d571ad03656455272feadec091cf96dc22a564f863ee2b55173") setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f00000000c0)='syz_tun\x00', 0x10) clock_gettime(0x0, &(0x7f0000008e40)={0x0, 0x0}) recvmmsg(r1, &(0x7f0000008d00)=[{{&(0x7f0000000140)=@in={0x2, 0x0, @multicast2}, 0x80, &(0x7f0000001580)=[{&(0x7f00000001c0)=""/239, 0xef}, {&(0x7f0000000300)=""/197, 0xc5}, {&(0x7f0000000400)=""/132, 0x84}, {&(0x7f00000004c0)=""/156, 0x9c}, {&(0x7f0000000580)=""/4096, 0x1000}], 0x5, &(0x7f00000015c0)=""/109, 0x6d, 0x3}, 0x7fffffff}, {{&(0x7f0000001640)=@nfc_llcp, 0x80, &(0x7f0000002940)=[{&(0x7f00000016c0)=""/67, 0x43}, {&(0x7f0000001740)=""/110, 0x6e}, {&(0x7f00000017c0)=""/4096, 0x1000}, {&(0x7f00000027c0)=""/241, 0xf1}, {&(0x7f00000028c0)=""/110, 0x6e}], 0x5, &(0x7f0000002980)=""/135, 0x87, 0x9}, 0x1}, {{&(0x7f0000002a40)=@hci, 0x80, &(0x7f0000002b80)=[{&(0x7f0000002ac0)=""/162, 0xa2}], 0x1, 0x0, 0x0, 0x100000000}, 0x5c}, {{&(0x7f0000002bc0)=@alg, 0x80, &(0x7f0000005000)=[{&(0x7f0000002c40)=""/112, 0x70}, {&(0x7f0000002cc0)=""/243, 0xf3}, {&(0x7f0000002dc0)=""/42, 0x2a}, {&(0x7f0000002e00)=""/4096, 0x1000}, {&(0x7f0000003e00)}, {&(0x7f0000003e40)=""/69, 0x45}, {&(0x7f0000003ec0)=""/13, 0xd}, {&(0x7f0000003f00)=""/194, 0xc2}, {&(0x7f0000004000)=""/4096, 0x1000}], 0x9, 0x0, 0x0, 0x98e1}, 0xca3c}, {{0x0, 0x0, &(0x7f0000005100)=[{&(0x7f0000005080)=""/71, 0x47}], 0x1, &(0x7f0000005140)=""/138, 0x8a, 0xffffffffffffff6f}, 0x58}, {{&(0x7f0000005200)=@xdp, 0x80, &(0x7f0000005340)=[{&(0x7f0000005280)=""/173, 0xad}], 0x1, &(0x7f0000005380)=""/100, 0x64, 0x4}, 0x1ff}, {{&(0x7f0000005400)=@pppoe={0x18, 0x0, {0x0, @local}}, 0x80, &(0x7f00000065c0)=[{&(0x7f0000005480)=""/4096, 0x1000}, {&(0x7f0000006480)=""/230, 0xe6}, {&(0x7f0000006580)=""/41, 0x29}], 0x3, &(0x7f0000006600)=""/4096, 0x1000, 0x6}, 0x8000}, {{&(0x7f0000007600)=@can, 0x80, &(0x7f00000078c0)=[{&(0x7f0000007680)=""/249, 0xf9}, {&(0x7f0000007780)=""/172, 0xac}, {&(0x7f0000007840)=""/112, 0x70}], 0x3, &(0x7f0000007900)=""/27, 0x1b, 0x10000}, 0x13c}, {{&(0x7f0000007940)=@alg, 0x80, &(0x7f0000007a80)=[{&(0x7f00000079c0)=""/41, 0x29}, {&(0x7f0000007a00)=""/76, 0x4c}], 0x2, &(0x7f0000007ac0)=""/255, 0xff, 0xe79}, 0x4}, {{&(0x7f0000007bc0)=@can, 0x80, &(0x7f0000007cc0)=[{&(0x7f0000007c40)=""/96, 0x60}], 0x1, &(0x7f0000007d00)=""/4096, 0x1000}, 0x6}], 0xa, 0x40000000, &(0x7f0000008e80)={r3, r4+30000000}) getsockopt$inet_IP_XFRM_POLICY(r1, 0x0, 0x11, &(0x7f0000008ec0)={{{@in=@remote, @in6=@mcast2}}, {{@in=@remote}, 0x0, @in6=@local}}, &(0x7f0000008fc0)=0xe8) ioctl$IOC_PR_PREEMPT(r1, 0x401870cb, &(0x7f0000000000)={0x8c, 0x6, 0x4, 0x2}) sendmsg$nl_xfrm(r1, &(0x7f0000009200)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x2f4de21f40f1b64a}, 0xc, &(0x7f00000091c0)={&(0x7f0000009000)=ANY=[@ANYBLOB="ffff000000000000faffffffffffffff02000000000000003a01000000000000fc0f00000000000004000000000000001bf8ffffffffffff0300000000000000ff0700000000000098090000000000002309000100000000a98100000000000003000000bb6b6e000001000200000000"], 0x1}, 0x1, 0x0, 0x0, 0x881}, 0x20000000) write$cgroup_type(r1, &(0x7f0000000100)='threaded\x00', 0xffea) socket$key(0xf, 0x3, 0x2) fchdir(r0) 20:30:25 executing program 4: r0 = socket$inet6_udplite(0xa, 0x2, 0x88) r1 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ppp\x00', 0x2000, 0x0) ioctl$TIOCGWINSZ(r1, 0x5413, &(0x7f0000000100)) ioctl(r0, 0x20000000008912, &(0x7f00000001c0)="0a5c2d0240316285717070") r2 = dup3(r0, r0, 0x80000) getsockopt$inet_tcp_TCP_ZEROCOPY_RECEIVE(r2, 0x6, 0x23, &(0x7f0000000000)={&(0x7f0000ffe000/0x1000)=nil, 0x1000}, &(0x7f0000000040)=0x10) r3 = socket$inet_tcp(0x2, 0x1, 0x0) getsockopt$inet_tcp_int(r3, 0x6, 0x18, &(0x7f00000015c0), &(0x7f00000000c0)=0x2) [ 379.482381] proc: unrecognized mount option "md5sumÌ-keyringýbdevmd5sum%" or missing value 20:30:25 executing program 5: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$nl_netfilter(r0, &(0x7f00000001c0)={&(0x7f0000000100), 0xc, &(0x7f00000000c0)={&(0x7f0000000340)=ANY=[@ANYBLOB="140000000301ffff808f00003d88c83f00b516ba"], 0x14}}, 0x0) recvmmsg(r0, &(0x7f00000013c0), 0x1ad, 0x0, &(0x7f0000000c40)={0x77359400}) fstat(r0, &(0x7f0000000140)) r1 = syz_open_procfs(0x0, &(0x7f0000000000)='net/igmp6\x00') ioctl$PERF_EVENT_IOC_QUERY_BPF(r1, 0xc008240a, &(0x7f0000000200)={0x9, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0]}) 20:30:25 executing program 4: r0 = socket$inet6(0xa, 0x2000000000001, 0x0) setsockopt$inet6_int(r0, 0x29, 0x46, &(0x7f00000000c0), 0x1) bind$inet6(r0, &(0x7f0000402000)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) setsockopt$inet6_int(r0, 0x29, 0x3a, &(0x7f0000000040)=0x5, 0x4) sendto$inet6(r0, &(0x7f00007a8fff), 0x3a7, 0x20000000, &(0x7f00000001c0)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) setresuid(0x0, 0x0, 0x0) 20:30:25 executing program 4: openat$ion(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ion\x00', 0x0, 0x0) r0 = syz_open_procfs(0x0, &(0x7f0000000180)='sessionid\x00') read(r0, &(0x7f0000000540)=""/36, 0x24) openat$selinux_load(0xffffffffffffff9c, &(0x7f0000004c00)='/selinux/load\x00', 0x2, 0x0) 20:30:25 executing program 4: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) sendto$inet6(r0, &(0x7f0000000100)="acee0b507750eac135", 0x9, 0x8000, 0x0, 0x0) socket$inet6(0xa, 0x800, 0x7) sendto$inet6(r0, &(0x7f0000000000)="d044bd4502e8b26b44c24bf8e2d777df0ddc8616fec0ab60c00ac9d4813d447bee97f553dd4a631b516c37ed93156bd237da3a9c86184c3e0a24b040050ee87bd30b8a16a72a012ebedb241230380cdc0f91276c0e596d80f3693df1e3d2c5da1d3bc0176e786aa258079c11d42169d693d025adba618e2cbff65544f7724a4697299c1ac4d4e46195bca180540500000037137cf823b92b041c5d497986662330cfdccd61aee555201a76aef0f2349e4294e78f4369f2d3de11cc494fcaf20824db3c95571778239524068e1f5b1ac0dc4be546f65684620d", 0xd9, 0x0, &(0x7f0000000140)={0xa, 0x45, 0x0, @ipv4}, 0x1c) [ 379.885618] nf_conntrack: automatic helper assignment is deprecated and it will be removed soon. Use the iptables CT target to attach helpers instead. 20:30:26 executing program 4: r0 = syz_open_dev$loop(&(0x7f0000000080)='/dev/loop#\x00', 0x0, 0x0) r1 = syz_open_procfs(0x0, &(0x7f0000005880)='attr/keycreate\x00') ioctl$LOOP_CHANGE_FD(r0, 0x4c00, 0xffffffffffffffff) ioctl$LOOP_CHANGE_FD(r0, 0x4c06, r1) getsockopt$IP_VS_SO_GET_DESTS(r1, 0x0, 0x484, &(0x7f00000001c0)=""/4096, &(0x7f00000011c0)=0x1000) r2 = request_key(&(0x7f0000000000)='id_resolver\x00', &(0x7f0000000040)={'syz', 0x0}, &(0x7f00000000c0)='\x00', 0xfffffffffffffffa) r3 = request_key(&(0x7f0000000100)='cifs.spnego\x00', &(0x7f0000000140)={'syz', 0x0}, &(0x7f0000000180)='attr/keycreate\x00', 0xfffffffffffffffe) keyctl$reject(0x13, r2, 0x1000, 0x6, r3) [ 380.140907] binder: release 16769:16782 transaction 338 out, still active [ 380.151182] binder: send failed reply for transaction 338, target dead 20:30:26 executing program 0: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r0, &(0x7f0000000100)={0xa, 0x4e22, 0x0, @empty, 0x4}, 0x1c) writev(0xffffffffffffffff, &(0x7f0000002980), 0x0) r1 = socket$inet6(0x10, 0x3, 0x0) sendmsg(r1, &(0x7f0000002fc8)={&(0x7f0000000000)=@nl, 0x80, &(0x7f0000002000)=[{&(0x7f0000000340)="5500000018007f5300fe01b2a4a280930a06000000a84308910000003900090008000c00010000001900150006000000000000dc1338d54400009b84136ef75afb83de448daa7227c43ab8220000060cec4fab6513", 0x55}], 0x1, &(0x7f0000000400), 0x0, 0x4}, 0x0) ioctl$EXT4_IOC_GROUP_EXTEND(0xffffffffffffffff, 0x40046607, &(0x7f0000000400)) listen(r0, 0x7c) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) mkdirat$cgroup(0xffffffffffffffff, &(0x7f0000000140)='syz1\x00', 0x1ff) r3 = memfd_create(&(0x7f0000000180)="0004003100", 0x0) ioctl$sock_SIOCGPGRP(r3, 0x8904, &(0x7f00000000c0)=0x0) syz_open_procfs(r4, &(0x7f0000000300)='net/ip_tables_names\x00') write$P9_RFSYNC(r3, &(0x7f0000000240)={0x7, 0x33, 0x1}, 0xfffffffffffffe2d) sendto$inet6(r2, &(0x7f0000000380), 0x0, 0x20000004, &(0x7f000031e000)={0xa, 0x4e22, 0x0, @ipv4}, 0x1c) openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000b80)="2e2f6367726f75702f73797a3100b8458a1392623c2acc07743172c163cfc71523709c3289acba6eaf2919f32ebaa4cbe89ed30167d7d56e8e65c0edbb300c9e287f10f513e776522729d5c85c09fed3f33ea055b94d27bb72a2bb9fd56015f25cf4f9ced65ed81253cfba08e9a329935ac0c64d10a5e701cc58fe4af8cb5b679468e8ad39e103e2d5b7d9078c34eb2832a5852b28958b7efeca8ffc69c09a7ca33d82e59f9e27ea25a7cf5e65bc52987952070ddac3929791a23f905fbd72419d1539", 0x200002, 0x0) fchdir(0xffffffffffffffff) r5 = socket$inet(0x2, 0x4000000000000001, 0x0) r6 = inotify_init1(0x0) pipe(&(0x7f00000003c0)={0xffffffffffffffff, 0xffffffffffffffff}) write(r7, &(0x7f00000001c0), 0xfffffef3) read(0xffffffffffffffff, &(0x7f0000000000)=""/250, 0x128b9372) fcntl$setown(r6, 0x8, 0xffffffffffffffff) fcntl$getownex(r6, 0x10, &(0x7f0000000080)={0x0, 0x0}) ptrace$setopts(0x4206, r8, 0x0, 0x0) ptrace(0x4207, r8) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f0000000000)={"79616d300001178b00", 0x4013}) ptrace$setregset(0x4209, r8, 0x20000004, &(0x7f0000000100)={&(0x7f0000000040)}) ioctl$sock_inet_SIOCADDRT(r5, 0x890b, &(0x7f0000000180)={0x0, {0x2, 0x0, @multicast2}, {0x2, 0x0, @multicast1}, {0x2, 0x0, @dev}, 0x9d}) creat(&(0x7f00000005c0)='./bus\x00', 0x0) open(&(0x7f0000000540)='./bus\x00', 0x141042, 0x0) 20:30:26 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$FS_IOC_SETVERSION(r0, 0x40087602, &(0x7f00000001c0)) r1 = syz_open_dev$binder(&(0x7f0000000640)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000000)=[@enter_looper], 0x1, 0x0, &(0x7f0000000040)='+'}) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0x0, 0x0, &(0x7f0000000780)}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000500), 0x0, 0x0, &(0x7f0000000400)}) 20:30:26 executing program 3: r0 = socket$inet(0x2, 0x4000000000000001, 0x0) setsockopt$inet_tcp_TCP_CONGESTION(r0, 0x6, 0xd, &(0x7f0000000000)='dctcp\x00', 0xfffffdcf) sendto$inet(r0, &(0x7f0000a88f88), 0xfffffffffffffe6e, 0x20000000, &(0x7f0000e68000)={0x2, 0x0, @local}, 0x10) 20:30:26 executing program 4: r0 = socket$inet6_udplite(0xa, 0x2, 0x88) ioctl(r0, 0x20000000008912, &(0x7f00000001c0)="0a5c2d0240316285717070") r1 = socket$inet6(0xa, 0x1, 0x0) setsockopt$inet6_MCAST_JOIN_GROUP(r1, 0x29, 0x2a, &(0x7f0000fca000)={0x100000001, {{0xa, 0x0, 0x0, @mcast1}}}, 0x88) setsockopt$inet6_MCAST_MSFILTER(r1, 0x29, 0x30, &(0x7f0000d4b000)={0x100000001, {{0xa, 0x0, 0x0, @mcast1}}, 0x0, 0x3, [{{0xa, 0x0, 0x0, @mcast1}}, {{0xa, 0x0, 0x0, @mcast1}}, {{0xa, 0x0, 0x0, @mcast2}}]}, 0x210) fgetxattr(r0, &(0x7f0000000040)=@random={'security.', '\x00'}, &(0x7f0000000080)=""/96, 0x60) r2 = dup3(r0, r1, 0x0) ioctl$EVIOCRMFF(r2, 0x40044581, &(0x7f0000000000)=0x57bfd9c1) 20:30:26 executing program 4: socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = creat(&(0x7f0000000400)='./file0\x00', 0x0) write$cgroup_type(r1, &(0x7f00000009c0)='threaded\x00', 0xd4b9afd) clone(0x2100001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000640), 0xffffffffffffffff) link(&(0x7f0000000040)='./file0\x00', &(0x7f0000000140)='./file0\x00') getsockopt$inet6_IPV6_XFRM_POLICY(r1, 0x29, 0x23, &(0x7f0000000240)={{{@in6=@ipv4={[], [], @broadcast}, @in6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in=@dev}, 0x0, @in6=@mcast1}}, &(0x7f0000000340)=0xe8) lstat(&(0x7f00000003c0)='./file1\x00', &(0x7f0000000540)) stat(&(0x7f0000000880)='./file0\x00', &(0x7f00000008c0)) rmdir(&(0x7f0000000100)='./file1\x00') ioctl$sock_inet6_SIOCDIFADDR(r1, 0x8936, &(0x7f0000000000)={@local, 0x73, r2}) [ 380.258098] binder: 16841:16845 ioctl 40087602 200001c0 returned -22 20:30:26 executing program 2: r0 = socket$key(0xf, 0x3, 0x2) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000002c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000100), 0xffffffffffffffff) open(&(0x7f0000000000)='./bus\x00', 0x44, 0x146) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000000080), &(0x7f00000001c0)=0xc) prctl$intptr(0x1c, 0x1) execve(&(0x7f0000001340)='./bus\x00', &(0x7f0000000400), &(0x7f0000000380)) sendmsg$key(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000100)=ANY=[]}}, 0x0) sendmsg$key(0xffffffffffffffff, &(0x7f00000001c0)={0x40000000, 0x0, &(0x7f0000000040)={&(0x7f0000000080)=ANY=[]}}, 0x4000) sendmsg$key(0xffffffffffffffff, &(0x7f0000000200)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000240)=ANY=[], 0x2ec}}, 0x0) sendmmsg(r0, &(0x7f0000000180), 0x400000000000117, 0x0) 20:30:26 executing program 4: r0 = socket$inet_tcp(0x2, 0x1, 0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/net/tun\x00', 0x0, 0x0) getcwd(&(0x7f0000000240)=""/4096, 0x1000) setsockopt$inet6_group_source_req(r1, 0x29, 0x2f, &(0x7f0000002240)={0xc, {{0xa, 0x4e24, 0x8, @mcast1, 0x200000}}, {{0xa, 0x4e21, 0x8, @ipv4={[], [], @local}, 0x7c}}}, 0x108) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000200)={'team_slave_0\x00', 0x4e02}) ioctl$TIOCGSID(0xffffffffffffff9c, 0x5429, &(0x7f0000000000)=0x0) ptrace$setregs(0xd, r2, 0x3, &(0x7f0000001240)="3aabf563c36b435a4d63fbffe5276480cf7b2a6a3de656ebbef4ef54d22fd60974c365e40921ca06bdc54ef82d39b7a13a331071e0a0217e1566879a0950ad618d1c92dce4ef9e708ab7560593df7a5fa925342761212be27b390c7ed16593a968f5f67c886793bcae625f1d29b8ccf604491aa5f441ff17e9d6db40d309ff61649683e0b2916aa741462ef746f63918b9c6e99a725193522e2e0f759b472c0bf4a9bf4f32cd00a41cae907431b1fab44d342a2141a875b46ed9ccd703a7a30fb82f64b9304634e05ecf8fd5ff5740af10a7aa474af7c721e0ed818c891e536ddee1c192639991d6f3a4dfa7ed1786f2b3a0a4a78d1f8c1db21b268feecbb6b4d3a43eae58c93783bdd6b9158e2a9e26751f00157d391a27068913b670f8ffa7e9c14e095e092fa6b6b0fc132f0fc42e20ede7fa0910afe961d8852a431280adf8bf961eac6e6bbe30b1a459e46297e4a7010f605c211cc1702398e1868b25bc26ddd7fec69125df57b97c96b5e7f77bba3cb618d97eab25fc798ad1d3fea7d6a2f2556b1c452cc14cd0223f747c5d62725bbf7903779890a709370796bceba2679215a1875076d77947381d70c90fa2e47b03d55d75b5a23468948bfb24cc5164ae661c2876b9d4afa2d04fbf664b8f33d8d72c4f564b3693677e8fba39c7a47e59adc4ec0910895e1fad8e1c0efab0ef23efde5202a757eb94ca068bf93ab9ee1605280b1155590d798da7c5ef2a78989a6b47f155554038759a503ed0c1db2e64625bcacaf89ed200420c5c2474513dbc2e93563d8a8a3fc573777e5eee807032be6505d125939afc8f3e65ffc36ac0a2fa020cb6a5db541571f22ba929d28f9c64d2cc9f7c6a246b237d09ea0bf438514715e51c7de3d3460d4ec68bf16b3f2021c039a38469ea4a72b70b8aa0e209b263350b3ec34128d36a2b9021deea7f0538a468a1e72347fd0fcae7101c95c89cb976c2b232f21185c50a8303737898dbf78b3df03164059486be44c81ad09b7e535b5e278da3aa8be2a459bfc7af25b7b889bebafe8c7dc15fc485f452806b68f41f167f5c3fb86d9449d5481aee59ae7221ab53a7c4067b08fbb885ae88ed183747d080c5c333d951904f69ffe2a8fd549b8e2635b40fc74a99a87f80d283d9abac5291ebd98b548ccb2ab0925332ff4e912ce7147d2e1f6c618f0451a12014da4c8491eed7afc08b7d091bb3970fff5053cb433963b10d2b001cc9d09ef190b2e20ce7c683f4382294760892f5b5875aa61f15c33393cf5a3d5e8bba1259261b2ad0e88ce6417075b5ca8b3898a1a0d110a476fdf4f3cc2d4e8e270585ec8f6694c685635747dfdf95560ccd43739f9b7f07e79189ab8d1c7af27a7f2db44ef4d00ae8152dde8f6559bcec9ebcc2f0ea70a08ae9d973cdca5620b6223a0be530bb00564aa596b4c9f5817196ba1280097b708c57d686f08a0512e5ebff695c83d09660f5db2d9a07042084d7123654355fbd8a557565042811f69bf832ba802aa3f2d95dc91c8d5705d36f23ff2c309e98b6631b49f839e2a9da2460817622dda194d43fff12f926f75bc9bd3fb8263de55dd9ebfb513c68516d33934c317a4641a8218472d84b5d69d1dea5fe0254eb7cac0586998337447fb9ea5ad0b1e31ab1e3a99f03f90747d89b4c0b2a45188b20fbf67c26e2d0aedab58df6f83a9ba2ddc64952510a65bf58f7b7f994225062323442f087c36b5de98061010594bbb5809c85ca64d0b9dce306e3e6be4ed60e2d748e520078504671e45ccea86f2626f6ae64cc11addef85a78ffa1a13f4389995de87a92a2a57fb0069e075e56ccf7cb2da37e695c4cfb0d08855d83da61e8c1c0c8c5fb6fb3594ccd3a55729189b093874a2d000048a881d0be4b1ee97209e85ef066da8b7b52ddf925f08e67204fb41812a2d3b68d82b8f1f413ba30e94389f43b99467a1af4de7d0951ab57ef6e0d66239d1ed4a2ccb8ba6c163c498515d567ded5943922e506e951b128d8ae003e0e98de12ed10026f2f4c3e8dd000754798f727ce226668d6ddedee2c3f1f640fb2eacd2ce76e4eb8f6692405f78aef6e2100ad035e3566db22c756eb25d4336e1afbc5e5c0e6ffd3f21356b78def61d4955fb85e342af63a6ec1f63fe46a00df1601749370ed0610fd1cf56f484036ca6cab58c0dedb2c86827e858d30a5d8501fc040c271823bd5bdd3e17bfef14cffb3be2c2af679c7ed8787b312d2cf32f3a9d6f6a38ad50d15386bf718637bfa501d7024a1cdcb9fc938f2f856031a2e0a3fa995fc8e5470d44e8fdf030e709bc04170e928c44193959dddf47d16b4b9daeaea16c6e0821f1463541c88ff8d4f2b97bc990323fcb3c353b39fd0bc732907aec4a7f1229127b8760c51dd587646b6a12ae2d74bd0b9dc938fceb5afaea1091bd8f739c7495ec3a09b2ca7537c05c2e99de51f6850bfbbeb89b555803ecc978fa572854fbc9f37bac8c6593f1051df73a094481c0565b9be4ce3089ba7a0457e3563b2667c0392877aec3b576f8afbd5932757641fc8bb9ef315300beb1efd14bffc62259d34243e7c13a7de92d80c920f48042dcf6bbb37bed97636b371e9847e23fde3d35cced16e4601e8e1fca781fcd66ef4d147f1720713673e8971a8b5ea82d17fc62618c8da9438998cb38bf3b93b38a20e05767356ee35cf053cc863bfd94575bf4e9b1afb60cedfff757aa2afe586793aceec4fb8c7ae12b020d676c5bc9a4bcb7e84819ed18843c65c87f8149f326c756e21de669ab8fda82b5ec944fd9965ce89abd1a649fe9ef3379544b41e7154bc28dbcdf2468496c18a6be686bcbac135087a2801c6ffda95133475653aaca835c388896bf09e07404f607852b282581e749505fddab30810ef383da5038618ce52e07f76a62b5bbc7f3de5a3bf0fc5b2d7be24c2f90dbbfa593ffdc1c25b988b7956ec9468387c1101f30858f408ea2da35dce8e756665988807493cdc5827da0dca8fc8ad2a6ce8c013a8f68f475bfae1440e68765ca87554de530daa61acab4ca9964d67c5de71ddd24b337badbbdde3c24a55d1ed271c04ef8790e9cfbe3cadd623ce0d329d12f21f5098536f5c8750075847d02a2a0c003e479a668965eb94b67679f4d4a371d09b318e112d86dd49bdb1bd69a92899696ccfb36dc2daf8642688c52460b257cd217f5b7bfff474d08b30e97a4611e6ed22277f8adfb775f85b2dc8d28272039dc2f81c575c3dd0ed3995da4849154ef7f08a5a2afe5312fb0724d3b28a61a9190a1034dfcacf7692f27bac1df9a8607f68dacbc2285f856ec347da18794c8791e9e56f47121738c3341fb2eea749cef175939da0100d50e661aab296100e05dd063cacee42d42a6c95447b03059af6e496a7d04ef36623b6803723988147c672689d5070cffee0d08b25a9f54658b67e6fe29437a97d26981a8123cb07a19805886dab8dcda21b0b7f4469d0f5139ab9741b27074740a378c20e6cae0fb49cb4b528ca6ce64f8c035d900ab28e6156fdc3556dc6b33b8c54bd139ff339ae6562cc2ba8f8e28229947e22e994036027d170d064e2f539c3612044f7988cf632bc63e7e41ad5ab35f979fafe511648cf8b95d6984fc4d1abf1cb9f2f9246f240adc13488f390cddcbdcdae6ed2507e983f5ebf2fa63486f75260e4c231b4bb33cc65ef9785845e68ff97c40ed9f20f5fbb074e1f1bef47dac14c9f0f51f6e7982e69c8461ff92f81e5ec5e85669f21fd3e1aac3f320711270aec0beba75ec11934ca3a67df14a63de1db423131537ca1066f2a60ab095b7837bc208ee2725759a986c7d79c22d7208467a8f68930a029a04ec54a03b5a7b0e69a47f2943cded4ae616baa6e624122e7862b85c95685087a08c3d32b18929c3699aaf8cf90ff3e2949f7d11b81901f4e9e12e48c1a55b355e95c1578b71f2f00b84d2f1c32155346220923d43e7c89cbb9671422c298f77004fe4e6e80c140ec6ff3efd3f487196abc23e7c5d5a21b68a28908d8bbdf5bad7c74a14ace8831034693d2ce84a84cbabfba3a2e9aa85783824a5f08429aa855f4e579763cf956c32d5f97904cf6ad21b424a67c58bf35135626e8596744df88b9c3f345730c2b890ac01010c8493b084f4f8c0a017da419869928e550bf40820e96fd903f99150029b55aaa7dda0e8aecdf7173c3411eac566f0e352b4049cf3d2368e8aa73be822e1a3f0797357d30dcfab48dd8df14452b164af72e33c36b5631b99ed486f8a21faac307101df770185934a32af962275b43a03f28477dae0cdd2f7a98a8293acfc1ddec2db35a3cc394eae31ad32aaf44221d2530cdcec76149116b15e2f44cda261624d65e4dad99cf6a34bd0cc49d7d7aa57d354b84dcbf2aea9b0161f6d87b427c4287214128d9246d84cdf71db0252f28d52fac79bc8a249c30675e0a78c77ae2ebfe75570b3dd8ff4f2172f2d0be2cb1add91b8143f84c736a4d04b101b386b92e4ba7f1a0bd41b783124fcaf9387892618e618899c77ef5c090f9cf04fe48cadda0838ba672a51b81eea798acc5378e4dbadd9615d90cfa60bb9e026b4c66c1041dc36fb297844362182c58aae1b380de28957398dd1b2dbb9effea015116bda9b948678da5bd11cd441268d3e550dc1783b223679b79043dfea2301f47ea25129681f10476e3795151b92c90e3c64b0d8c5753a9010d989f8acbb9c5f637b65a04047c30320cb873ad38c97b775fef6ca9ded955706dfa83c65a425e48764a367d7375ced490456c2b21b094ea60ce97973b762b85ee9c25a3fdf7d5fd554c5beb82f39cc6aef8dbacf029c3dfdc9ca484f6e65b0a8b468010615f62c4adffa535f2853e67e012490c686c538abc5f750ea7556d145f8c860c4452108c0a471709da1b475402ac9069e87d524e5e510d7748d87f8cec1c587a446bc50c5cc8da4367ff4b3a7f885320f0b2589134c02849fc4c29768ac9b66e43b6626af2c34927649dc2e76a262f384319719a7afb0e68f9ca7624a24d50665a12918840fb59f2913c10460cecc87e1d4f878e561f5153e0502e27decc24c50f3b5bab23cde3430a882fa4b59a707f9f11e4db412ee58dc770d261ecaa8cfaa5dae9263a66008aa14ff1afa410247c29829ea1e8b5727dfb2281ab030bde15545c8056c84dfc4af27739c06fd2b7f8ceac3cf71b7b7c29b94a55e5d7190ebda13c03e9f6017303d1a37f2a74c0048cd5ffdcdd6a2a34f1bacf4569517b14ab0340e89607fee6964fcf2e9282e35a7d29f47840b5e076c48397a66cf03213ee736045cd31495082ce5415578c3c3ecb6d152af1bd0aa2f5c5aaf797adead557d1f165df4b620bd03a9d0a6b2e0ddc05383deedbfd5352aab0fe6440dc2ab629084718ba65579c91f4a03c1c40243cf8ff06d7c9168db53788a7151c416da76681889bee505b3d15c292e8b26b41e4501eba1c0e2c01f678b6a2654bd171397069a162fa99ebe72df455159072b9ef9f6278c0390251eab2ad08ea6bb3e20fc7ad48ca88c7fa4cf46eff986524555d9841e53f46a2d6d9549e9b7947590f5d82b194a374ae757f80a5e97c619e4bc646871cb363d963aa51dc2714ec25f8865ecf33475227a0a7a86688a4d6aebea6355b982b48659f95220c7b541c2ea7875775fff2ce8c10cbf8b71f5d5465cbdf04173740216ad5ce46682a5ea19e0c4da02acfd9d7f1633f957b0411d8aaf6f63dc3257c223ec070b325a8b269f7b41a205849c9f922155d2cc6f85267ed6c949fa65b96760b72cee5") getsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffffff, 0x29, 0x23, &(0x7f0000000100)={{{@in6, @in=@broadcast, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@mcast1}, 0x0, @in6}}, &(0x7f0000000040)=0xe8) ioctl$sock_inet6_SIOCSIFDSTADDR(r0, 0x8918, &(0x7f0000000080)={@empty, 0x7a, r3}) dup3(r0, r1, 0x0) 20:30:26 executing program 5: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$nl_netfilter(r0, &(0x7f0000000080)={&(0x7f0000000100), 0xc, &(0x7f00000000c0)={&(0x7f0000000000)=ANY=[@ANYBLOB="ff808f00003d88c83f00b516ba4ba16826f63e8d3ad9be18ec4e99a1a58f356a5835feddc52a097c864532986263bc920cb7859e53bc3e011f416e90a1f8000000000000"], 0x44}}, 0xfffffffffffffffd) recvmmsg(r0, &(0x7f00000013c0), 0x1ad, 0x0, &(0x7f0000000c40)={0x77359400}) fcntl$getownex(r0, 0x10, &(0x7f0000000140)) 20:30:26 executing program 2: mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x0, 0x8031, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000814000/0x4000)=nil, 0x4000, 0x1000000, 0x1011, 0xffffffffffffffff, 0x5a) clock_gettime(0x0, &(0x7f0000000440)={0x0, 0x0}) r2 = openat$full(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/full\x00', 0x280080, 0x0) ioctl$BLKFRASET(r2, 0x1264, &(0x7f0000000300)=0x4) getsockopt$EBT_SO_GET_INIT_INFO(r2, 0x0, 0x82, &(0x7f0000000340)={'broute\x00'}, &(0x7f00000003c0)=0x78) clock_gettime(0x0, &(0x7f0000000080)={0x0, 0x0}) write$evdev(0xffffffffffffffff, &(0x7f0000000180)=[{{0x77359400}, 0x5, 0x0, 0x8}, {{r0, r1/1000+30000}, 0x12, 0x4e}, {{}, 0x11, 0x4, 0x4326}, {{0x0, 0x7530}, 0x7, 0x8, 0x8}, {{r3, r4/1000+10000}, 0x17, 0x0, 0x7a}, {{0x0, 0x2710}, 0x12, 0x9}, {{}, 0x0, 0x2}, {{}, 0x15, 0x5, 0x8}, {{0x77359400}, 0x0, 0x1, 0x9}, {{0x0, 0x7530}, 0x17, 0x72c, 0x1ffc0000000000}], 0xf0) r5 = socket$inet(0x2, 0x4000000000000001, 0x0) ioctl$sock_inet_SIOCADDRT(r5, 0x890b, &(0x7f0000000100)={0x0, {0x2, 0x0, @rand_addr}, {0x2, 0x0, @dev}, {0x2, 0x0, @broadcast}}) r6 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ppp\x00', 0x40002, 0x0) write$UHID_SET_REPORT_REPLY(r6, &(0x7f0000000280)={0xe, 0x8, 0x7, 0x80000001, 0x51, "7890dc9b230c6fb1368b42dc63a6986db6b83cbf66f34ddc317b5435faf7d4bcc306aae7afa0caf11ba451c5ac9dc5a301c9296cf595a2e4106488e9e110416a5f4647a389ab1eaf46185b3b2501ad1068"}, 0x5d) 20:30:26 executing program 4: r0 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r0, &(0x7f0000000000)={0x2, 0x4e20, @broadcast}, 0x10) sendto$inet(r0, &(0x7f0000000200), 0xfffffffffffffeb4, 0x2000800e, &(0x7f0000db4ff0)={0x2, 0x4e20, @loopback, [0x2, 0x7000028, 0x1800, 0xe00000001000000]}, 0x10) set_tid_address(&(0x7f0000000040)) setsockopt$inet_tcp_TCP_CONGESTION(r0, 0x6, 0xd, &(0x7f0000000680)='reno\x00', 0x5) recvfrom(r0, &(0x7f0000f9cf9b)=""/101, 0x65, 0x0, 0x0, 0x0) 20:30:26 executing program 4: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000000)) r0 = openat$selinux_checkreqprot(0xffffffffffffff9c, &(0x7f00000000c0)='/selinux/checkreqprot\x00', 0x101000, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = socket$netlink(0x10, 0x3, 0xc) r2 = getpgrp(0x0) ptrace$PTRACE_SECCOMP_GET_FILTER(0x420c, r2, 0x3, &(0x7f0000000100)=""/3) bind$netlink(r1, &(0x7f0000000040)={0x10, 0x0, 0x0, 0x2ffffffff}, 0xc) socketpair$inet_icmp_raw(0x2, 0x3, 0x1, &(0x7f0000000080)) 20:30:26 executing program 2: clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000640), 0xffffffffffffffff) r0 = getpid() sched_setscheduler(r0, 0x5, &(0x7f0000000200)) clock_adjtime(0x0, 0xfffffffffffffffd) ptrace$cont(0x38, r0, 0x1, 0x2) openat$smack_thread_current(0xffffffffffffff9c, &(0x7f0000000000)='/proc/thread-self/attr/current\x00', 0x2, 0x0) 20:30:27 executing program 0: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r0, &(0x7f0000000100)={0xa, 0x4e22, 0x0, @empty, 0x4}, 0x1c) writev(0xffffffffffffffff, &(0x7f0000002980), 0x0) r1 = socket$inet6(0x10, 0x3, 0x0) sendmsg(r1, &(0x7f0000002fc8)={&(0x7f0000000000)=@nl, 0x80, &(0x7f0000002000)=[{&(0x7f0000000340)="5500000018007f5300fe01b2a4a280930a06000000a84308910000003900090008000c00010000001900150006000000000000dc1338d54400009b84136ef75afb83de448daa7227c43ab8220000060cec4fab6513", 0x55}], 0x1, &(0x7f0000000400), 0x0, 0x4}, 0x0) ioctl$EXT4_IOC_GROUP_EXTEND(0xffffffffffffffff, 0x40046607, &(0x7f0000000400)) listen(r0, 0x7c) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) mkdirat$cgroup(0xffffffffffffffff, &(0x7f0000000140)='syz1\x00', 0x1ff) r3 = memfd_create(&(0x7f0000000180)="0004003100", 0x0) ioctl$sock_SIOCGPGRP(r3, 0x8904, &(0x7f00000000c0)=0x0) syz_open_procfs(r4, &(0x7f0000000300)='net/ip_tables_names\x00') write$P9_RFSYNC(r3, &(0x7f0000000240)={0x7, 0x33, 0x1}, 0xfffffffffffffe2d) sendto$inet6(r2, &(0x7f0000000380), 0x0, 0x20000004, &(0x7f000031e000)={0xa, 0x4e22, 0x0, @ipv4}, 0x1c) openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000b80)="2e2f6367726f75702f73797a3100b8458a1392623c2acc07743172c163cfc71523709c3289acba6eaf2919f32ebaa4cbe89ed30167d7d56e8e65c0edbb300c9e287f10f513e776522729d5c85c09fed3f33ea055b94d27bb72a2bb9fd56015f25cf4f9ced65ed81253cfba08e9a329935ac0c64d10a5e701cc58fe4af8cb5b679468e8ad39e103e2d5b7d9078c34eb2832a5852b28958b7efeca8ffc69c09a7ca33d82e59f9e27ea25a7cf5e65bc52987952070ddac3929791a23f905fbd72419d1539", 0x200002, 0x0) fchdir(r3) r5 = creat(&(0x7f00000005c0)='./bus\x00', 0x0) open(&(0x7f0000000540)='./bus\x00', 0x141042, 0x0) sigaltstack(&(0x7f0000ffe000/0x1000)=nil, &(0x7f0000000480)) write$selinux_context(r5, &(0x7f0000000680)='system_u:object_r:ssh_agent_exec_t:s0\x00', 0xfffffffffffffed2) r6 = creat(&(0x7f00000003c0)='./bus\x00', 0x2) r7 = openat$null(0xffffffffffffff9c, &(0x7f00000004c0)='/dev/null\x00', 0x2807fd, 0x0) write(r7, &(0x7f0000000380), 0x0) write$cgroup_type(r5, &(0x7f0000000200)='threaded\x00', 0xfffffeb3) select(0x40, &(0x7f0000000040)={0x0, 0x0, 0x0, 0x20000000000}, &(0x7f0000000080), &(0x7f00000001c0)={0x0, 0xfffffffffffffffc}, &(0x7f0000000280)={0x77359400}) getsockopt$IP6T_SO_GET_ENTRIES(r0, 0x29, 0x41, &(0x7f00000006c0)=ANY=[@ANYBLOB="73656375726974796d0000000000000000000000000000000000000000000000c40000004e8b4b1c7fa37c811d43b7dfc1540065e2cf063a33e71b9035030000000000000094c232461f22877f4a6bfa2e09f7f448f8a2ef823ff78d796ab6ab52f030b8fea1243b4a37836d690100843a8998fea04a2bc474078acbb61c426c93824178b70a4bcff2d634050eca0d4f941bfec0542fd99b2bd8823b4175d0c5e455f170e292c18a967fdc58383f9af93bc9c8b8578b5ed8ba7d2084ab94919aea43e1a3acfd6d899d943862ca8d84436629d2159976a615f1279aaf23ce57319edb9be03d5b849777d956c09bcb8bc5eb1d793fe7b7d0c34d4d6cc6d28cb9f66b0a2f31eda0ce948210375abcde9320750390dc04b3af4959443184210eb68c4fe6dced7e44cd2b39f7d25dc53dab0fd596852191868741cecd379b6e87b1c1a8c0dc6b8004595fb61135ed10927f6df243071d53b4757c13f4ceb4480e4a7b9c730be6258db763d9e9e7baeccd140ed2311fd9c570db36e93131c27442990068d315088680ab638288fb05b1676a9ab2fe9aa99539a1cfbb1ae8b35cd18007ba5105ed92f8914bcc2397da080dd1da393ede4f195953f82d03b9a920391ee4f5bd7485d69e1d8bfc93521ea451a20dd056bd3c133aa93c9bef1e254ad7d19379b21be984d93cc7cfcbffc82708aebe5fe4c4aa7af905248de89163041c16cfdaf96ee5b65715c7bb840274ba8ddc979ae077aa20b5ba0e97ecd80abb2d3cdb2d2b6603b3a003871b7220d71909f230fa5e9a7307c10c954a2ff1c6bf5fe3e153c0ebeb4940c365ef1e9cc8588a51bfc9807e866ea6528a77c930c06eb50e3f14ca8abf929570c05ca0615211cdcce3d034946d4fadcc9df5702fca33cb322c27a54fee8cd7901df1066311b737259dfc65048bcff6eca8f566ed7501089d26a0aa853fb4d77548d22f57d7b5d21b58a3c51907ba6d5ef9e04e24febdea1d345b16288065bf64cf9fa3a746185191dc7b2f4520fd2da2f60434395d6121d7063a6455be070f49e04c8c2fa0da58d878d80a1bf9cc58b6926e3c471cb1e79cb85f6ce2ad91ac6c68f955a507ad55f514d131e0a095329227c9888f9fb19bfe6df77dff07ef08544a33e9f10d72e3ca6a0d7060ee0da7607a2238db2aa9c1011d0af4a39786e48004427b8b55fcd1f7ad63a9aa5338475975159310e0e4000000000000000000002c3cc416fa20afcf457f955f6c50f7a7d1efd6df13edad19816b231494aa8acb3f3edc8a63f945d78b0124e0a86d6e176221a31e580953c943256c537a0a56d520865b67bfa8eb5f17577e14e2d6585f9838dda234736df2104ab0e8f28cbd"], &(0x7f00000002c0)=0x1) recvfrom$inet6(r2, &(0x7f0000001840)=""/31, 0xfffffe0e, 0x100, &(0x7f0000001880)={0xa, 0x0, 0xffff}, 0x1c) getsockopt$inet_mreqn(r6, 0x0, 0x23, &(0x7f0000000500)={@multicast1, @multicast1, 0x0}, &(0x7f0000000440)=0xc) setsockopt$inet6_IPV6_PKTINFO(r5, 0x29, 0x32, &(0x7f0000000580)={@remote, r8}, 0x14) r9 = accept4(r0, 0x0, &(0x7f0000000000)=0xfffffffffffffefa, 0x0) sendto$inet6(r9, &(0x7f00000000c0), 0xfffffffffffffe2b, 0x0, 0x0, 0x0) 20:30:27 executing program 2: r0 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000080)='attr/sockcreate\x00') write$selinux_context(r0, &(0x7f00000000c0)='system_u:system_r:kernel_t:s0\x00', 0x1e) r1 = socket$inet(0x2, 0x80001, 0x0) sendfile(r0, r0, 0x0, 0x400) ioctl$RNDZAPENTCNT(r0, 0x5204, &(0x7f0000000100)=0x7) getsockopt$sock_cred(r1, 0x1, 0x11, &(0x7f0000000500), &(0x7f0000000540)=0xc) ioctl$UI_END_FF_UPLOAD(r0, 0x406855c9, &(0x7f0000000000)={0xf, 0x2, {0x56, 0x3, 0x9, {0x6b08, 0x2df8}, {0xd77, 0x4}, @const={0x3ff, {0x2, 0x5, 0xfffffffffffffff8, 0xffffffffffffb721}}}, {0x56, 0x3f, 0x1, {0x0, 0x7}, {0x40, 0x9}, @rumble={0x3, 0x10001}}}) 20:30:27 executing program 3: r0 = socket$inet(0x2, 0x4000000000000001, 0x0) setsockopt$inet_tcp_TCP_CONGESTION(r0, 0x6, 0xd, &(0x7f0000000200)='reno\x00', 0x644e) setsockopt$inet_tcp_int(r0, 0x6, 0x1b, &(0x7f00000001c0)=0x4, 0x4) r1 = syz_open_procfs(0x0, &(0x7f0000000000)='net/netstat\x00') getsockname$packet(0xffffffffffffffff, &(0x7f0000000080)={0x11, 0x0, 0x0}, &(0x7f00000000c0)=0x14) sendmsg$nl_route_sched(r1, &(0x7f0000000140)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x800}, 0xc, &(0x7f0000000100)={&(0x7f00000006c0)=ANY=[@ANYBLOB="700800002d00000028bd7000fedbdf2500000000", @ANYRES32=r2, @ANYBLOB="0f000d00020007000b00ffff0800050008ff00000c000100666c6f77000000002c00020008000400000000800800040002000000080004003f000000080002000000000008000700080000000c0001007463696e64657800000802009c00070098000c0000000c000100766c616e000000001c00020008000300bb0c0000080003008a0000000800040088a8000068000600e6c23950c0c98f9cc595e4afee614302f1b1a50fc768a2912b747c171579927dd3cb6aa87a1192d02f986cf19d61fb4793fc1ae29d44de343333a055b4b51a82ee8f3ee193398e469123c948383f7e768bfac65c6f95a3177dade070e90c26d39a0000000000080406000404020008000000000000000600000001000000700000000500000039bf00003f00000000100000001000000400000000020200090000000800000005000000090000000100010005000000ff7f0000010000800000000000000000ff010000070000000400000020000000050000000000000007000000ff0f00000100000001000000400000006dd9da230100000006000000ff0300000500000001000000040000000000000003000000ffffff7f04000000fd00000000000000bb82000002000000ffff00000000000000000000070000000002000002000000e19f0000800000000400000008000000fdffffff0800000007000000000000000000000000000000a302000008000000b30000000900000008000000000000800700000000000000000100005300000005000000040000000500000037fc000095ff00007f0000000200000005000000020000000100000000000000020000008000000000000000080000000001000002000000000800000b6c0000000000000000000007000000ffffff7f050000000300000002000000080000000300000000000000000000800100000009000000c800000004000000070000000900000005000000000000001f000000ff7f000007000000030000000180000037170000000000000100000000010000060000000900000006000000060000000600000001f8ffff16020000ff0100000000000006000000000000000800000006000000ff0000003f000000110800009a0d00000180000002000000010000800000000000000000040000000600000000000000ff0f00000800000000800000010000000a460000000000008e050000000000000100000002000000ffffff7f04000000ff0100004000000007000000ffffffff0600000002000000da020000050000000100000000000000bb0700000500000000800200010000007900000040000000ff0f00000300000007000000000000000100000007000000000000800900000005000000080000002000000005000000080000004b000000000001008000000000000000030000008d00000070020000040000000900000003000000800000000a000000030000000800000072000000010000000000000007000000000000006dcd0000ffffffff04000000c907000004000000ff7f0000fc000000feffffff0000008004000000ff0000000008000000e0000092935c160800000005000000018000000000000007000000080000000000000000d50000ffff00000001000007000000060000001f0000000800000001ffffff030000001f000000000000000600000001800000ff7f0000ff7f00000100000074000000050000000000000020000000ff7f000000000000b80d053cff7f000002000000610000000000000019000000f30000000800040001000000500107004c01160000000c00010073696d706c6500006400020018000200ff0100000000000000000000ffffffff0400000018000200000001000900000006000000ff0100000600000018000200050000000400000005000000200000000100008018000200000000000300000000000010e500000000000000d4000600d8d2808ebb36a76d9573e2a6572af13b38f38e1350fd8edd255b2aec453ba05106070bd64860c2012e62d9bc077433b9f18084115ea5d43fbec4d14d0d2063ae658b7449d82da2fae7e97aa22f1c8ab68101dfefc979f1e27beb7af9b4a86f1f9ae0d21509c40c8704f3d16c6b55931862f89967221eca8813ffddc0e22acf2f93c67c577148afae7631cf7577eff5908747e66529642044d40f52a8ca08719f5d46c795c7f0992192f5c4e50a15b74b0c30c4174bdcfc00f7465a6ca1f0631ae8dd183a3212be83ae1a008068931b00000008000400010000000800020001000000b0000700ac00150000000800010069707400240002000800020002000000080002000300000008000213040000000800030000ec020078000600abd779130f1fdb1ae7fa542ca1cc13612c344e1425b8cc8ee64052821821c5106b8c6e5b042074f96fa43f166a7471b66748ad8b65604d16b12f8e77a4684280e070f26c7e6320025b43585e5d9404afa044b02fc97588a5c059f76924e08a079e66c9eeebf79748e0d0f752c5a3729d5f0000000000400107003c011a000000080001006e6174002c00020028000100ffffffffff03000007000020ff000000de000000ac1414bbe0000002000000ff00000000000106000634c0631a5a3230b9c3ebdefd66601605db18758ac29b0c8205067f44c1f7b7cbb2ccd1502874ca5955643c031b46a17ebea34a20e3905aa81d9eaa2b703061f6bac37e3b96ddb79fa3a0c7aa75edca6c546b1765559b9622ae89a5cbd0140ad089794903a435f6da15102df78a689fb6939acce86cca0b49830dc7a2f235d1ac37b1a98d543904994e767638a7e0285d9fe3e03fd0a47f894659d21e3b47575ce40006ceaae28fce94f876fc4e9a9f27363014936ad7ec1dc53c582ffdea4b33a1176e9d589bf5a7144721848d1c704958ccae48e6bf94a9697feb315662dd636dedaf8c08d86ced37aec89fcdf8ab9f454a659e42d6d1ab83c6000000"], 0x870}, 0x1, 0x0, 0x0, 0x90}, 0x4) sendto$inet(r0, &(0x7f0000000040), 0xfffffffffffffffd, 0x20000000, &(0x7f0000e68000)={0x2, 0x4e24, @multicast1}, 0xffffffffffffff92) write$UHID_GET_REPORT_REPLY(r1, &(0x7f0000000180)={0xa, 0x9, 0x4, 0x7}, 0xa) 20:30:27 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$FS_IOC_SETVERSION(r0, 0x40087602, &(0x7f00000001c0)) r1 = syz_open_dev$binder(&(0x7f0000000640)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000000)=[@enter_looper], 0x1, 0x0, &(0x7f0000000040)='+'}) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0x0, 0x0, &(0x7f0000000780)}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000500), 0x0, 0x0, &(0x7f0000000400)}) 20:30:27 executing program 4: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000140)) r0 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000180)='memory.swap.current\x00', 0x0, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x0, 0x31, 0xffffffffffffffff, 0x0) r1 = openat$selinux_avc_cache_stats(0xffffffffffffff9c, &(0x7f00000000c0)='/selinux/avc/cache_stats\x00', 0x0, 0x0) ioctl$TCFLSH(r1, 0x540b, 0x7fff) pipe(&(0x7f0000000200)) r2 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000080)='/dev/rtc0\x00', 0x4003, 0x0) ioctl$RTC_VL_CLR(r2, 0x7014) futex(&(0x7f0000000000), 0x400000085, 0x20000000000000, &(0x7f0000000240)={0x0, 0x989680}, &(0x7f00000001c0), 0x3fff7ffd) syz_genetlink_get_family_id$team(&(0x7f0000000100)='team\x00') [ 381.058772] binder: release 16841:16852 transaction 342 out, still active [ 381.066070] binder: send failed reply for transaction 342, target dead 20:30:27 executing program 2: r0 = socket$inet(0x2, 0x4000000000000001, 0x0) setsockopt$inet_tcp_TCP_CONGESTION(r0, 0x6, 0xd, &(0x7f0000000000)='dctcp\x00', 0xfffffdcf) sendto$inet(r0, &(0x7f0000a88f88), 0xfffffffffffffe6e, 0x20000000, &(0x7f0000e68000)={0x2, 0x0, @local}, 0x10) 20:30:27 executing program 3: r0 = socket$inet(0x2, 0x4000000000000001, 0x0) r1 = openat$selinux_mls(0xffffffffffffff9c, &(0x7f0000000480)='/selinux/mls\x00', 0x0, 0x0) write$P9_RSTATFS(r1, &(0x7f0000000040)={0x43, 0x9, 0x1, {0x2, 0x8, 0x24f, 0x6, 0xfffffffffffffc01, 0xede3, 0x2, 0x7, 0x7}}, 0x43) getsockopt$inet_mreqn(r0, 0x0, 0x20, &(0x7f0000000200)={@remote, @multicast1, 0x0}, &(0x7f0000000240)=0xc) sendmsg$nl_route(r1, &(0x7f0000000340)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x100000}, 0xc, &(0x7f0000000300)={&(0x7f0000000280)=@ipv4_newaddr={0x58, 0x14, 0x0, 0x70bd2d, 0x25dfdbfc, {0x2, 0x1f, 0x18, 0xfd, r2}, [@IFA_BROADCAST={0x8, 0x4, @remote}, @IFA_BROADCAST={0x8, 0x4, @multicast1}, @IFA_CACHEINFO={0x14, 0x6, {0x770, 0x488, 0x8, 0x5c}}, @IFA_LOCAL={0x8, 0x2, @remote}, @IFA_LABEL={0x14, 0x3, 'lo\x00'}]}, 0x58}, 0x1, 0x0, 0x0, 0x11}, 0x48080) write$UHID_INPUT(r1, &(0x7f00000006c0)={0x8, "9619f4e4126cc07825b967918436b7f47a882f10ad601e8420381a20993fad37af617a80aae5e47b31e3ed8de7344ef7acfcdc7d2aa6326ed74b86cd72e9ae635106d0182d9ee05dea516072b1a623f69eed6f125ef7a3c740f44a9241c7b9eb11d592cb3e6f4f6d63546728da2ac7f7f9c888409028cd32dabdc9821691934bfa09b6969d60e5da81cbaf6d90fdfb44eb5057b123e22556093449f906e2f3069b210c6b8951f3b4e4bca6720b527f4b22ed12764e16c35f41be13b3f249cc5a5bc93206aaf413376058e27de3745a5a508ce6c4bb8719cb86d8b3e3f258730d00c7255362e79fa5a5bf02f16cf55f47f392c8445660f27fd6c0b71be645323f3ac51097cb0dcb8f7f2def0ff2cabdb39d9c9939a50a238c2af18ab7baf8011049dec4332cf4029d42c4833b042a9a56544e0ca6f1da47da35f5622824c5eced9b4dc486f217719ec24363eb220e7fd012dbab9be842a8b0e7639b6316e79dfd0baf1b679dc696595adac133fe0bd3036f1f9d34bd7440fba515fef47c132e6045703fc0e871512bd1be9e0953bb101c9153dbd4d1e4b742be81d17e17738cc9d9e3c75400be824d8d3948dc63ddce11ccd7793b68749d2655fc2a43cba748275f6a0f97046a870db80e6d5b99b1de75c4dbb4645d0dd276a54d086f86bce14891ff548692b333b910d03d5126c9291f91c7901e4faca77bc10f2ceea6c92d55c221010f1063dd0d20eb532f400584eafdf1815b008700f9f653dfcbbcd4305249a280d86090d10aeba33ab3792b1c7adfd11276ae372f33a3484d33854cdb39d2813f609c6a7b472f3680762aaa3cc51f35b1713b7cbb86184773929c54a716ea06bfbd07a8bacd694ef4209acddb17863bc0c9c7bc4bb79275fb5a72ac438264e99f471aa2ef72df92a2e629cb0bdb5d21ed69671adf2976578b10f2011f6122626b0873b141a2931ff383253a692bb749f6254ba385c241d8cb8aa41cc8e0e75ea3b8aab8e1007bbc24056e929e41efe7ab9fbfd29d62ca829084ec2dfcd87e7b7151c443e7534155ba986c8100cc98e9b07769b80a3ced5aca433419cfc4409d32197043618b376882384126145043d5974f25d4c31fcb339f45790c60e0b330f82c5014be6152d9d1c340172e80de30673c607a5c58e29e862d0bec391d420425745d4eddd4f3a639ba28e594cfcc9bc595c08ee95108e65166bc5dea778a2fcc7d7f070c3bb40756665c5a0845b3833f65c72b35e4bff405af189bde25f54b6eecbdc9598d7b15b0ff840d0297d171909121617d256742bac6ab15b9a72822a8df80d8b9a16cd943ae1f72d2313dcefd544b1b6129052e83096ac23875dbd3b093ece2fce09c020bca95772038ff8492602cebb4861579b1a0199df3e3b12ea8931011fd6f20698be440fc4a8e2c5a4f42357c85a6d412d4d10bf94adab05f3db035eb05987635362d21022a9b9cbad89b8d0d69b68862ac4ddf894d73ba526c9cbaade17c2d388f38f7588124bb67945639228a64ae5a48577f225fbf7f33b6faf093336c2820efacf6340ccae4d323752105ca9fe42094e084563a56f1cdaad6f99e9b093d5c16916c4047e8690c8bcd047f00028e94d3123a8cad51e7345ca0f699362088faa77edb3516bdf607c11d23edfdfdd5c948364c6046d41910d12cfb9ca9ac5be7b8e571e7dad8dcda93e35c3c5fd1e9e06ce002c688bc38fd8c05fd05e9cb77fa4e1dd745d9bfb09b9d774f37998f55975c7e76d8fa84229fcbad021c5e9419b75fda6c257851059f9810adef3b74c7ab797de55f5e6cf19862c3f3771e19c5c796f90c75250223a6858953bbad477042c0da4aeae311f93f7383546f0de473ac681adf7dcb3c5b65f22c6e570facfebebd7b66f430009f2cb9599a2175cbb968f2b5d880eef8a92faa20b2fbcf20c6f26424c6c5f94d6817ec93b8829101076658d60698a67e2b891dd0abbdbe673ddca18f9ecd20fa186139dbe1c3e152db5f581429690c8b814f71bc1a52f118be0f27b26b145258c21c7c1f6c01c1f0a30e84711be030126fdfa691bbe4eeb293ad4e74425c5f6508a95712eb687713d93f47c83a0a0c3c407862543132eaa9c07da967b9b56bce0a1e885a41a9c415a40697e18b7870cbf5b231ed0e8041c5d6d37e0bef25cca073ad7e19e96791a84e0a5a99efb7919c3beeecaede55a0244848d100bb45ea00d6d439716b509b4a497c0c55526a22e3958ca09f6f09f6225e254d81b7d3617c6b04f8023d6bc6301589a2fd78b0825d5aef6feed61fc84ade8e3afeaf235b9e57e6dfe00bb8934556fd208527f061960740b37aa022391964b3b4375f530c61d19725d87d8d39eca0cc1598e71ff2db61acb873fe6b278fac24b7d73688298cbe384961504dbf1a39aebc1de777df362ce5929d2436a0a61038ef08c7563721e01ab6a03056ee2b0ea93fbab48945c87294765b92eb6a06a7ad528255e75bf4709d1958ed675272a367fc849dcf7361d6cc3cac483ea69adeed3ce441d14d89dcc6df2c8ab72c9cad8fb8eff2cafea97a0791da5548387b89baeb5c607874ca99c7f4e9b3c821181e9766a94694049b9c734b89a805dff1e1a6fa822e4cef45826139a3bccd9e0fdabd00b9a62f24671b0314a6f278e08ddc8f07885dd61d74f5bdb26266f5398d1174874773d4267f45dd6f339bb9ff038816d86b6f0a025ad67ac407eaad06acc5ccce94b52a9068c6c4c493308c3938aa5d487b8c181f91081a0552947437e1f89fda8f582480d2bb6958fc5c1f6e860d9dd282e2e1c4474d19784a1fb638a70d680ef5a16ed563aafdea615eeebe2b08af38dd88d5845d2aab6f571e733d4666ffc17ceb6273dd43e15a34abdf801081cb1a6899ef28367e52eba8ad0a2e4aa9625f58c571e4bd6982589a11786abf49fb03fb4c52300652d1197c42cd5b12bad08225676cb5b542fc1c251b9d71e196c8fe1f5fb1630fba24cd8c336c1a84f7798786fb9e17e5f8b44e4823fd9274e358c8f0df73d097149a1cfd0d84212e983629f73fee735862e16b91b8071981d6e375428c5ed5fc537e4edb843703497f946c2ad692ed97e7771a3311e0cf65d2134d866717a7fc6cbfc701fff6bc4fc14d5ac02b0f757a817709db725dbe166f339d89b3b4c3d8b99b4963b5f065c4832e23f9724478cc880093196c58cf9c5bc1a06e49adcfa7fbcfd567ee97da5ef81d4820fd7ab1e50ae21e6ec34503ea6b1dd7f70415ee32158c43aa816afab9bf3ee802df7826541c10f010de4db03f83986a27affc93c4d71f2389f1ffa4786888b6b884911aa29ac92dac67add302bf0d53d80dc36026525c55098d6e101549924c9befd3133adbf6d016cbd906f972345dc9574828f3abd7e0d800509a3f049b48bbbadd1c4a9fa674724546ffaae883928970b4b80c2057cb1e5ad92038183c8dbbd791fa716f9f08f6e16328e5ef7a179a76c5d870f9211ad700aff0a923d2cdf4b58c7ec3008166b97adf8498dfc9d5b79749846b3734da70d0abead08bf67a115ed93308b628cfe51cb4f4edda5b999204759e4e474d087dc67305956829555598d916966bbf6205f428d085bc4099d5381d0cba001034b3e2fa27fc8945ad301c85e7a99c6d89a0c9f0f0075691c0cbe3a4c0746d955b0fc616f4bda7918d0c9584603dc2c1808177af2bac28a1663e8e08ef454e0a204b20a5f4390280893f3a81a0a408ac9000e90d7f92e063fbe58b1709918dc79f7d20fa24af5bd18d223b3c0691760471f2516a0fe33b0796940eebe36f1cb822b73fa158ba7a6ba9f9f62569fb093c7de7bbccbbb600175cec6c3ba0b4963d2c3b63fce8205e770013398eaad02448693ed49324d302ecc2ac678524925d1d7f743d9b0d1dce08c015a60aa1e64da2c59278ea2cc1b40039067034d586870404531d1ffd748247866f25f20d86c66280195e96d8d7a8b6afbd6c40d6835632c161fcb17892d21600c4e5ae978d320aeca610a011962f26cf60e4e05ea045e6d13e902fb474357a8b330f5b71497501aec76896b34f7f4800d6ba652b5b0c98296f19520e23c970c163b83feef9276c79e491238f5f57d9788e5428b4b6314b56126be3c73ed0c966da5eb26c25a27dd77dcad039a747c6f83c1fce01ddb1998d63f1f5e2786cf2c01b26298d7e384a658a6412a318c7cd44b7bc564bbc575f460a55cce104494db34bbf80757bab6653f7156af55a55bc40585c628156a705206a8e6ed2286f4aa77d8984d0c339d28fc4ba3d46f6a1619130ca5f17c13e19c0206c982245fe41bb11976aa5442590fbe5b74604edee99e1fc35fe6206a7e13980c94f40fbaa75ab6549eb03d604bcec3c408149575ba8ce980e691acec20c7bbd52fb719c8da9382d3917e914c914cbeef3841d8fcfcf0c8fa8aeaab8967d7f753b6d2c1b79d49d98b0d0fb971b6f9e1d98e9d8ca636246fa80c4f9ef095c205bdfb81f19a5040a95143cd25024baeb20025beb1ed09094497f1f26dabafd8d9e94bf8ee139d5d28ec07f0bc39f321b05121ca10b19d3304e24156edb8959958530584ca698510c7e385dfb5368e75f2f18d45ec26844333e63c91103424ae473f1391a512ce3de7c9562f3f85a19f772d49e520e3005deb6686df3ed7c5b89cf6513f7c0624a5b8755335a20fdbb007cec274f235c5a2d284c371f3b8151cc5ee19f666365efac1a8adfce874e111f0d14ed2242e76d2212eb6d7e60f383312ad84e9f185f1bbe74a2af506771879ff3a77ebd259cc7afa8610e9e7119cd67e90df1f89fd6563f3281b534701b1697de0b1445d4d229910ad8865351c9dcd19bce107baae064272ca918522bfaf50230fcf04f4f407464ee7573dd1836f5f87c50b7cf21985bc4a3a5f0689bdb69c5f635470f0d2939ac8cf3ecdb185bc8a1355820406b7cdb36e98e130e9548023d27a9bfb8a48011df61a7ec132c9fbff9cb13df132e8bce1f91f0cfeeb4801ac8ae442ae16217251ffe4a963fa592e87ce967b716bf00f02104dff6ec2c37e1e5eee2092bbf8ea60217dea1efb27f43c65648cd2c99710fa6eda8c2b3cba2d548e1c8d6fabc1fa547097c0c35768d6f7bae7ce615918c8feaab96bc30b7338348eb671e45407af04c88d4ba718e8031a80b8bcac3bb6658d847120753c30214b31f2f12dee739b8527430e4bcdb515497602d4c10f04a7d8edaf5dc5d570eb518121c1867d753affc3595c4e6143875b3552c6d8cdcf878a29e055f88a72c02e3ec016d469ff0a5eb6c524fa8fe195bde0064616388e2c7d25c5dee83f788f9e63a1e30eba3cec2d6b7ae880318f1685e1cdfc9d95da88aa6f49d7a3d37e68bdffc26fefee3be1f189eb017a9a9b10eb95c6dd20c1a37eab3e07e5659dfd7aded8f0609c23092313f46194dd27586cd6716472eb0c4109b243a74d9f4589adf73de2ba78f94dea44e09b6bac5f61586493a1be227279ffe22dc6b7004909085e1504ccef546976b4653198aaaac12bd52aeff5fdea78bd578a2bb2fda6e4a81ae9433dbee20169480257f3243d515ce7295bf967643d6e6d2dd53ff6c0aed7162ab4e4f8ef85d6c907a47733c50db3fdff060bc31c6f211249fe5e62b579cd7685ad4e99328a4a82004ada3d0a17494ebf1ddfa0d1df530d86d2286c0c315b039e914a93635b273d1abe3b0404dd35994b44a9adbcc07f5ee80cf01b4fd0ef4995a0c2e1819d20d781c677b92742ddf0730b3f61f963e83c3bd8f19b285127704eea37ce03554e377a6cd5a6eb5", 0x1000}, 0x1006) setsockopt$inet_tcp_TCP_CONGESTION(r0, 0x6, 0xd, &(0x7f0000000680)='@\x00\x00\x00\x00', 0x5) sendto$inet(r0, &(0x7f0000a88f88), 0xfffffffffffffe6e, 0x20000000, &(0x7f0000e68000)={0x2, 0x0, @local}, 0x10) write$apparmor_current(r1, &(0x7f00000000c0)=@hat={'permhat ', 0x3, 0x5e, ['@\x00', 'em0\x00', ')bdev-,/em1cpuset\\\x00']}, 0x34) [ 381.157910] binder: 16918:16921 ioctl 40087602 200001c0 returned -22 20:30:27 executing program 5: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$nl_netfilter(r0, &(0x7f0000000080)={&(0x7f0000000100), 0xc, &(0x7f00000000c0)={&(0x7f0000000340)=ANY=[@ANYBLOB="1400008d9ebfd8e5b2e9745d000301ffff808f00"], 0x14}}, 0x0) recvmmsg(r0, &(0x7f00000013c0), 0x1ad, 0x0, &(0x7f0000000c40)={0x77359400}) r1 = open(&(0x7f0000000000)='./file0\x00', 0x500, 0x80) getsockopt$inet6_tcp_TCP_REPAIR_WINDOW(r1, 0x6, 0x1d, &(0x7f0000000040), &(0x7f0000000140)=0x14) 20:30:27 executing program 4: r0 = socket$inet6_udplite(0xa, 0x2, 0x88) ioctl(r0, 0x20000000008912, &(0x7f0000000080)="0a5c2d0100010000000000") r1 = socket$inet6(0xa, 0x0, 0xf488) getsockopt$sock_cred(r1, 0x1, 0x11, &(0x7f0000000040), &(0x7f00000000c0)=0xc) ioctl$sock_ifreq(r1, 0x89f0, &(0x7f0000000000)={'sit0\x00\x00\x00\t\x00', @ifru_ivalue=0x706000}) r2 = syz_open_dev$mice(&(0x7f00000002c0)='/dev/input/mice\x00', 0x0, 0x100) setsockopt$netlink_NETLINK_DROP_MEMBERSHIP(r2, 0x10e, 0x2, &(0x7f0000000300)=0x10, 0x4) r3 = openat$selinux_status(0xffffffffffffff9c, &(0x7f0000000100)='/selinux/status\x00', 0x0, 0x0) ioctl$EVIOCSFF(r3, 0x40304580, &(0x7f0000000140)={0x57, 0x400, 0xad6, {0x4, 0x40}, {0xfffffffffffffffe, 0x1000}, @const={0x80000000, {0x6b, 0xc7, 0x6, 0x3}}}) fsetxattr$security_selinux(r1, &(0x7f0000000180)='security.selinux\x00', &(0x7f00000001c0)='system_u:object_r:clock_device_t:s0\x00', 0x24, 0x2) gettid() setsockopt$inet6_MCAST_JOIN_GROUP(r3, 0x29, 0x2a, &(0x7f0000000200)={0x100, {{0xa, 0x4e21, 0x8, @mcast1, 0x9}}}, 0x88) 20:30:27 executing program 4: r0 = socket$inet(0x2, 0x0, 0x0) setsockopt$inet_opts(r0, 0x0, 0x0, &(0x7f00000000c0)="8907", 0x2) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) r3 = memfd_create(&(0x7f0000000280)='[\'posix_acl_access\x00', 0x0) pwritev(r3, &(0x7f00000001c0)=[{&(0x7f0000000200)=',', 0x1}], 0x1, 0x4081806) sendfile(r1, r3, &(0x7f00000000c0), 0x20020102000007) pipe(&(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$TIOCEXCL(0xffffffffffffffff, 0x540c) write(r5, &(0x7f00000001c0), 0xfffffef3) vmsplice(r4, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) fstat(r3, &(0x7f0000000b40)) ioctl$TIOCGPGRP(0xffffffffffffffff, 0x540f, &(0x7f0000000cc0)) getsockopt$inet6_IPV6_IPSEC_POLICY(0xffffffffffffffff, 0x29, 0x22, &(0x7f00000010c0)={{{@in6=@mcast2, @in=@remote}}, {{@in6=@local}, 0x0, @in6=@loopback}}, &(0x7f00000011c0)=0xe8) recvfrom$unix(r2, &(0x7f0000000040)=""/4, 0xebc3276d6d4b1cd2, 0x100100, &(0x7f0000000100)=@abs, 0x930000) openat$selinux_avc_cache_stats(0xffffffffffffff9c, &(0x7f0000000240)='/selinux/avc/cache_stats\x00', 0x0, 0x0) 20:30:27 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$FS_IOC_SETVERSION(r0, 0x40087602, &(0x7f00000001c0)) r1 = syz_open_dev$binder(&(0x7f0000000640)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000000)=[@enter_looper], 0x1, 0x0, &(0x7f0000000040)='+'}) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0x0, 0x0, &(0x7f0000000780)}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000380)={0x8, 0x0, &(0x7f0000000500)=[@release], 0x0, 0x0, &(0x7f0000000400)}) 20:30:27 executing program 2: mkdir(&(0x7f0000fd5ff8)='./file0\x00', 0x0) mount(&(0x7f0000018000), &(0x7f0000027000)='./file0\x00', &(0x7f0000018ffa)='ramfs\x00', 0x0, &(0x7f000000a000)) r0 = creat(&(0x7f0000df1000)='./file0/bus\x00', 0x0) ioctl$TUNSETOWNER(r0, 0x400454cc, 0x0) unshare(0x40600) write(r0, &(0x7f0000000000)="b1a9e00d5c133770310c698a3b76537624ce86f3a1057bfd1b7d879155bb4e4457bddd02dddedc767d2a29313caa5362f1ae67c3922317739844844291e1d4bcf506684d9007c63d2488fc0a9e211f2a6e57c2bc7a238049c74a3c7b167b2e2a8421de7dc5efc062006060cc6b881c704898d04d7ea6e5f6e534d27d1a71211a66735a2f7aaca180c1bc18fe2a57c1d41c0d74e1e141d3a3a4153968b1ee5515e675992926d3bf4f07f2c1157644234f364456383f1eb062acec60965a5c686bfa60", 0xc2) lremovexattr(&(0x7f0000000100)='./file0\x00', &(0x7f0000000140)=@known='trusted.overlay.opaque\x00') fsync(r0) [ 381.935440] binder: release 16918:16936 transaction 346 out, still active [ 381.954471] binder: send failed reply for transaction 346, target dead [ 381.967861] binder: 16959:16960 ioctl 40087602 200001c0 returned -22 20:30:28 executing program 0: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r0, &(0x7f0000000100)={0xa, 0x4e22, 0x0, @empty, 0x4}, 0x1c) writev(0xffffffffffffffff, &(0x7f0000002980), 0x0) r1 = socket$inet6(0x10, 0x3, 0x0) sendmsg(r1, &(0x7f0000002fc8)={&(0x7f0000000000)=@nl, 0x80, &(0x7f0000002000)=[{&(0x7f0000000340)="5500000018007f5300fe01b2a4a280930a06000000a84308910000003900090008000c00010000001900150006000000000000dc1338d54400009b84136ef75afb83de448daa7227c43ab8220000060cec4fab6513", 0x55}], 0x1, &(0x7f0000000400), 0x0, 0x4}, 0x0) ioctl$EXT4_IOC_GROUP_EXTEND(0xffffffffffffffff, 0x40046607, &(0x7f0000000400)) listen(r0, 0x7c) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) mkdirat$cgroup(0xffffffffffffffff, &(0x7f0000000140)='syz1\x00', 0x1ff) r3 = memfd_create(&(0x7f0000000180)="0004003100", 0x0) ioctl$sock_SIOCGPGRP(r1, 0x8904, &(0x7f0000000640)=0x0) syz_open_procfs(r4, &(0x7f0000000300)='net/ip_tables_names\x00') write$P9_RFSYNC(r3, &(0x7f0000000240)={0x7, 0x33, 0x1}, 0xfffffffffffffe2d) sendto$inet6(r2, &(0x7f0000000380), 0x0, 0x20000004, &(0x7f000031e000)={0xa, 0x4e22, 0x0, @ipv4}, 0x1c) openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000b80)="2e2f6367726f75702f73797a3100b8458a1392623c2acc07743172c163cfc71523709c3289acba6eaf2919f32ebaa4cbe89ed30167d7d56e8e65c0edbb300c9e287f10f513e776522729d5c85c09fed3f33ea055b94d27bb72a2bb9fd56015f25cf4f9ced65ed81253cfba08e9a329935ac0c64d10a5e701cc58fe4af8cb5b679468e8ad39e103e2d5b7d9078c34eb2832a5852b28958b7efeca8ffc69c09a7ca33d82e59f9e27ea25a7cf5e65bc52987952070ddac3929791a23f905fbd72419d1539", 0x200002, 0x0) fchdir(r0) r5 = creat(&(0x7f00000005c0)='./bus\x00', 0x0) r6 = open(&(0x7f0000000540)='./bus\x00', 0x141042, 0x0) sigaltstack(&(0x7f0000ffe000/0x1000)=nil, &(0x7f0000000480)) write$selinux_context(r6, &(0x7f0000000000)='system_u:object_r:crontab_exec_t:s0\x00', 0xfffffffffffffe84) r7 = creat(&(0x7f00000003c0)='./bus\x00', 0x2) r8 = openat$null(0xffffffffffffff9c, &(0x7f00000004c0)='/dev/null\x00', 0x2807fd, 0x0) write(r8, &(0x7f0000000380), 0x0) write$cgroup_type(r5, &(0x7f0000000200)='threaded\x00', 0xfffffeb3) select(0x40, &(0x7f0000000040), &(0x7f0000000080), &(0x7f00000001c0), &(0x7f0000000280)={0x77359400}) getsockopt$IP6T_SO_GET_ENTRIES(r0, 0x29, 0x41, &(0x7f0000000c80)=ANY=[@ANYBLOB="73656375726974796d0000000000000000000000000000000000000000000000c40000004e8b4b1c7fa37c911d43b7dfc1540065e2cf063a33e71b903574450eb6fcc611bb94c232461f22877f4a6bfa2e09f7f448f8a2ef823ff78d796ab6ab52f030b8fea1243b4a37836d690100843a8998fea04a2bc474078acbb61c426c93824178b70a4bcff2d634050eca0d4f941bfec0542fd99b2bd8823b4175d0b0e455f170e292c18a967fdc58383f9af93bc9c8b8578b5ed8ba7d2084ab94919aea43e1a3acfd6d899d943862ca8d84436629d2159976a615f1279aaf23ce57319edb9be03d5b849777d956c09bcb8bc5eb1d793fe7b7d0c34d4d6cc6d28cb9f66b0a2f31eda0ce948210375abcde9320750390dc04b3af4959443184210eb68c4fe6dced7e44cd2b39f7d25dc53dab0fd596852191868741cecd379b6e87b1c1a8c0dc6b8004595fb61135ed10927d6df243071d53b4757c13f4ceb4480e4a7b9c730be6258db763d9e9e7baeccd140ed2311fd9c570db36e93131c27442990068d315088680ab638288fb05b1676a9ab2fe9aa99539a1cfbb1ae8b35cd18007ba5105ed92f8914bcc2397da080dd1da393ede4f195953f82d03b9a920391ee4f5bd7485d69e1d8bfc93521ea451a20dd056bd3c133aa93c9bef1e254ad7d19379b21be984d93cc7cfcbffc82708aebe5fe4c4aa7af905248de89163041c16cfdaf96ee5b65715c7bb840274ba8ddc979ae077aa20b5ba0e97ecd80abb2d3cdb2d2b6603b3a003871b7220d71909f230fa5e9a7307c10c954a2ff1c6bf5fe3e153c0ebeb4940c365ef1e9cc8588a51bfc9807e866ea6528a77c930c06eb50e3f14ca8abf929570c05ca0615211cdcce3d034946d4fadcc9df5702fca33cb322c27a54fee8cd7901df1066311b737259dfc65048bcff6eca8f566ed75b5d21b58a3c51907ba6d5ef9e04e24febdea1d345b16288065bf64cf9fa3a746185191dc7b2f4520fd2da2f60434395d6121d7063a6455be070f49e04c8c2fa0da58d878d80a1bf9cc58b6926e3c471cb1e79cb85f6ce2ad91ac6c68f955a507ad55f514d131e0a095329227c9888f9fb19bfe6df77dff07ef08544a33e9f10d72e3ca6a0d70bf0d4b3e607a2238db2aa9c1011d0af4a39786e48004427b8b55fcd1f7ad63a9aa5338475975159310e0e40000000000000000000000000000000000000000000000000000"], &(0x7f00000002c0)=0x1) recvfrom$inet6(r2, &(0x7f0000001840)=""/31, 0xfffffe0e, 0x100, &(0x7f0000001880)={0xa, 0x0, 0xffff}, 0x1c) getsockopt$inet_mreqn(r7, 0x0, 0x23, &(0x7f0000000500)={@multicast1, @multicast1, 0x0}, &(0x7f0000000440)=0xc) setsockopt$inet6_IPV6_PKTINFO(r5, 0x29, 0x32, &(0x7f0000000580)={@remote, r9}, 0x14) r10 = accept4(r0, 0x0, &(0x7f0000000000)=0xfffffffffffffefa, 0x0) sendto$inet6(r10, &(0x7f00000000c0), 0xfffffffffffffe2b, 0x0, 0x0, 0x0) 20:30:28 executing program 3: r0 = openat$selinux_mls(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/mls\x00', 0x0, 0x0) r1 = socket$inet(0x2, 0x4000000000000001, 0x0) setsockopt$inet_tcp_TCP_CONGESTION(r1, 0x6, 0xd, &(0x7f0000000680)='reno\x00', 0x60c5) sendto$inet(r1, &(0x7f0000a88f88), 0xfffffffffffffe6e, 0x20000000, &(0x7f0000e68000)={0x2, 0x0, @local}, 0x10) ioctl$EVIOCSMASK(r0, 0x40104593, &(0x7f00000000c0)={0x11, 0x36, &(0x7f0000000080)="99c620063eefe937cc1b10e4abae42740c575039bd9fde52f339f1a181fdc963d32eb192786e06d5859313eea4c1d03c7ee032f7f3e6"}) ioctl$TCSETA(r0, 0x5406, &(0x7f0000000040)={0x322, 0x1f, 0x1ffc00000000, 0x3, 0x8, 0x800, 0xc9, 0x0, 0x4, 0x4800}) 20:30:28 executing program 2: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000100)='/dev/ptmx\x00', 0x2, 0x0) writev(r0, &(0x7f0000003440)=[{&(0x7f0000000680)="681604810bf9fcffe352b28ef7e9f7d4363ee17901a6850e4ae33c2194e48d61da7263f1c233feafbc9f424f80f34c3e59763a766f63f65a8c5ef063370f487fbe302b7a68ad55c34c3afd8e5c0d", 0x4e}], 0x1) syz_emit_ethernet(0x3d, &(0x7f0000000180)={@local, @empty, [], {@arp={0x806, @generic={0x310, 0xfbfb, 0x6, 0xb, 0x0, @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0xf}, "ae8329996a3d8a54e93def", @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x3}, "09cf2b4ca0a93b310f1abd4e74c8d8ae"}}}}, &(0x7f00000001c0)={0x1, 0x3, [0xb89, 0x295, 0x98f, 0x62c]}) ioctl$TCSETS(r0, 0x40045431, &(0x7f00003b9fdc)) r1 = syz_open_pts(r0, 0x0) ioctl$FIONREAD(r0, 0x541b, &(0x7f00000000c0)) r2 = openat$full(0xffffffffffffff9c, &(0x7f0000000080)='/dev/full\x00', 0x80000, 0x0) ioctl$RNDGETENTCNT(r2, 0x80045200, &(0x7f0000000140)) r3 = fcntl$dupfd(r0, 0x406, r1) write$P9_RWRITE(r3, &(0x7f0000000000)={0xb, 0x77, 0x2, 0x10000}, 0xb) openat$ptmx(0xffffffffffffff9c, &(0x7f0000000040)='/dev/ptmx\x00', 0x50040, 0x0) [ 382.037220] binder: 16959:16964 Release 1 refcount change on invalid ref 0 ret -22 20:30:28 executing program 2: r0 = openat$zero(0xffffffffffffff9c, &(0x7f00000005c0)='/dev/zero\x00', 0x8100, 0x0) getsockopt$packet_int(r0, 0x107, 0x0, &(0x7f0000000600), &(0x7f0000000640)=0x4) write$eventfd(r0, &(0x7f00000000c0)=0x890, 0x8) clone(0x0, &(0x7f00000012c0), &(0x7f0000001080), &(0x7f00000022c0), &(0x7f0000000000)) set_thread_area(&(0x7f0000000140)) ioctl$BLKPG(r0, 0x1269, &(0x7f0000000080)={0x9a, 0x200, 0x54, &(0x7f0000000000)="69d77ff827df0e17abe42a7b19a07ce4b0c7d3b20d58e58950b28e75a32dcf60eb20c6d4c094e5890fa69073ad3086bd8addcefc21941234b29549b6032bbe277bca5b961d8a4cd74684671bce678fb87f4a13cb"}) 20:30:28 executing program 2: r0 = openat$selinux_enforce(0xffffffffffffff9c, &(0x7f0000000040)='/selinux/enforce\x00', 0x4000, 0x0) r1 = signalfd(r0, &(0x7f0000000840)={0x3f}, 0xfffffffffffffc9c) write$binfmt_elf64(r0, &(0x7f0000000100)={{0x7f, 0x45, 0x4c, 0x46, 0xfff, 0x0, 0xfff, 0x1, 0x80, 0x2, 0x3, 0x7fff, 0xc9, 0x40, 0x3dd, 0xa7, 0x9, 0x38, 0x1, 0x20, 0x3b03, 0x100000000}, [{0x7, 0x1, 0x4, 0x3, 0x6, 0x0, 0x7, 0x7}, {0x6474e551, 0x99aa, 0xf1, 0x9, 0xffffffff, 0x0, 0xd3, 0x6}], "04cc85624e3bda6bce80bb0c334058a5130c8037bab216d2b30203cb8964d8ead7dee35de7a4ddfe5161fcecd78009ff8fb5fdce1b24c74f40e2f77a79f1669cf224c05f37cb0cdd542e8f9abdb9ff5490214db2006e210a01f3950bd7", [[], [], [], [], [], []]}, 0x70d) fsetxattr$trusted_overlay_opaque(r0, &(0x7f0000000080)='trusted.overlay.opaque\x00', &(0x7f00000000c0)='y\x00', 0x2, 0x2) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r1, &(0x7f0000000880)={0xa, 0x4e22, 0x401, @dev={0xfe, 0x80, [], 0x1a}, 0x200}, 0x1c) sendto$inet6(r2, &(0x7f0000000100), 0xfffffffffffffeeb, 0x20000001, &(0x7f0000000000), 0xffffffffffffff86) 20:30:28 executing program 2: pipe(&(0x7f0000000500)={0xffffffffffffffff, 0xffffffffffffffff}) write(r1, &(0x7f00000001c0), 0xfffffef3) read(r0, &(0x7f0000000200)=""/250, 0x50c7e3e3) getsockopt$inet_pktinfo(r1, 0x0, 0x8, &(0x7f0000000040)={0x0, @multicast1, @remote}, &(0x7f00000003c0)=0x215fb41206d42f30) r2 = socket$inet6(0xa, 0x800, 0xc270) write(r2, &(0x7f0000000080), 0x0) r3 = socket$inet6(0xa, 0x2, 0x0) r4 = socket$inet6(0xa, 0x1000000000002, 0x0) r5 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000540)='cpuacct.usage_user\x00', 0x0, 0x0) write$FUSE_IOCTL(r5, &(0x7f0000001480)={0x20, 0x0, 0x0, {0x0, 0x0, 0x1, 0x7fffffff}}, 0x20) openat$full(0xffffffffffffff9c, &(0x7f00000012c0)='/dev/full\x00', 0x0, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000240)={&(0x7f0000000000), 0xc, &(0x7f0000000200)={&(0x7f0000000400)=ANY=[@ANYBLOB="3052fbabfd12bb9e225158dfde9b6106b515b727a0cb08022415d36f04d23b953874238bc450dabf61df073f1659584daa20920136cd6cd068d0e7a79c22644bd80f981502a110b020f16a6814ff81f86b23a6487b590fbf747852b562e5ca1cc594920218882c31647c444eecf29c5a0b16ce61ce6726792cd18144c7cc64a46eb5cdbf6f1b606e10a8c44093b505393668deb276715823dc83071ccab16624f10e672c8b"], 0x1}, 0x1, 0x0, 0x0, 0x1}, 0x0) setsockopt$netlink_NETLINK_CAP_ACK(r5, 0x10e, 0xa, &(0x7f00000000c0)=0x5, 0x4) setsockopt$SO_BINDTODEVICE(r4, 0x1, 0x19, &(0x7f0000001280)='ip6gretap0\x00', 0x10) renameat(r0, &(0x7f00000004c0)='./file0\x00', r5, &(0x7f0000000580)='./file0\x00') ioctl$BLKPBSZGET(r5, 0x127b, &(0x7f0000000340)) connect$inet6(r3, &(0x7f0000000100)={0xa, 0x0, 0x0, @dev, 0x2}, 0x1c) setsockopt$netlink_NETLINK_TX_RING(r0, 0x10e, 0x7, &(0x7f0000000380)={0x7ff, 0x2c, 0xfff, 0x4}, 0x10) ioctl$sock_ifreq(r1, 0x8956, &(0x7f00000001c0)={'veth0_to_bond\x00', @ifru_addrs=@ax25={0x3, {"ee75b8edf7dee0"}, 0x40}}) getsockopt$IP6T_SO_GET_REVISION_TARGET(r2, 0x29, 0x45, &(0x7f0000000040)={'HL\x00'}, &(0x7f0000000140)=0x1e) connect$inet6(r3, &(0x7f0000000300)={0xa, 0x4e24, 0x0, @ipv4={[], [], @loopback}}, 0x1c) getsockopt$inet6_IPV6_IPSEC_POLICY(r3, 0x29, 0x22, &(0x7f00000005c0)={{{@in=@multicast2, @in=@local}}, {{@in=@local}, 0x0, @in6=@mcast2}}, &(0x7f00000006c0)=0xe8) sync_file_range(0xffffffffffffffff, 0x0, 0x4, 0x5) sendmmsg(r3, &(0x7f00000092c0), 0x4ff, 0x0) read$eventfd(r0, &(0x7f0000000180), 0x8) r6 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r6, &(0x7f0000000180)={&(0x7f0000000000), 0xc, &(0x7f00000000c0)={&(0x7f0000000040)=@ipv4_newaddr={0x58, 0x14, 0x1, 0x0, 0x0, {}, [@IFA_LABEL={0x2c, 0x3, 'veth1\x00'}, @IFA_CACHEINFO={0x14}, @IFA_LOCAL={0x8, 0x2, @loopback}, @IFA_FLAGS={0x8}, @IFA_ADDRESS={0x8, 0x1, @rand_addr}]}, 0x58}}, 0x0) r7 = dup(r6) getsockopt$inet_pktinfo(r7, 0x0, 0x8, &(0x7f0000000100)={0x0, @local, @local}, &(0x7f0000000140)=0xc) 20:30:28 executing program 5: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) r1 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ppp\x00', 0x400b00, 0x0) ioctl$RNDGETENTCNT(r1, 0x80045200, &(0x7f0000000040)) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$nl_netfilter(r2, &(0x7f0000000080)={&(0x7f0000000100), 0xc, &(0x7f00000000c0)={&(0x7f0000000440)=ANY=[@ANYBLOB="140000000000ba00000000000000000000000000292dbe62ec9f15c0348a0346a9604161603b05686981dd502fceb2eabbb2903b6458c61f336c09378bd8c4381c39382456b51e1fbcb6a51b3507afd2200cfc8b19a6688700ca1687585d04f3703bac90544e9725c03897580da0d3614b298928372df32812c949671de9c984d74a4caf0d4dcfe25b4200203e292bea7a644d1d5fe407b7924426370953a50dae5080b6d96c95b0ef5098599fbf66ffe9f6049599e1096ded478571be8f509bcd89716898947c9168b0e6e272182657a756b5c6a103ad5fb0969de950aec4b501fee6d0d88449a60f56b1747a7145691f218abd8e1739f9ae16"], 0x14}}, 0x0) setsockopt$inet_udp_int(r1, 0x11, 0x65, &(0x7f00000001c0)=0x6, 0x4) ioctl$FIDEDUPERANGE(r1, 0xc0189436, &(0x7f0000000140)={0x4, 0xa071, 0x3, 0x0, 0x0, [{r2, 0x0, 0x9}, {r2}, {r0, 0x0, 0xffff}]}) getsockopt$IP_VS_SO_GET_DAEMON(r0, 0x0, 0x487, &(0x7f0000000200), &(0x7f0000000240)=0x30) recvmmsg(r2, &(0x7f00000013c0), 0x1ad, 0x0, &(0x7f0000000c40)={0x77359400}) getpeername$unix(r1, &(0x7f0000000280), &(0x7f0000000300)=0x6e) 20:30:28 executing program 4: r0 = socket$inet(0x2, 0x0, 0x0) setsockopt$inet_opts(r0, 0x0, 0x0, &(0x7f00000000c0)="8907", 0x2) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) r3 = memfd_create(&(0x7f0000000280)='[\'posix_acl_access\x00', 0x0) pwritev(r3, &(0x7f00000001c0)=[{&(0x7f0000000200)=',', 0x1}], 0x1, 0x4081806) sendfile(r1, r3, &(0x7f00000000c0), 0x20020102000007) pipe(&(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$TIOCEXCL(0xffffffffffffffff, 0x540c) write(r5, &(0x7f00000001c0), 0xfffffef3) vmsplice(r4, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) fstat(r3, &(0x7f0000000b40)) ioctl$TIOCGPGRP(0xffffffffffffffff, 0x540f, &(0x7f0000000cc0)) getsockopt$inet6_IPV6_IPSEC_POLICY(0xffffffffffffffff, 0x29, 0x22, &(0x7f00000010c0)={{{@in6=@mcast2, @in=@remote}}, {{@in6=@local}, 0x0, @in6=@loopback}}, &(0x7f00000011c0)=0xe8) recvfrom$unix(r2, &(0x7f0000000040)=""/4, 0xebc3276d6d4b1cd2, 0x100100, &(0x7f0000000100)=@abs, 0x930000) openat$selinux_avc_cache_stats(0xffffffffffffff9c, &(0x7f0000000240)='/selinux/avc/cache_stats\x00', 0x0, 0x0) 20:30:28 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$FS_IOC_SETVERSION(r0, 0x40087602, &(0x7f00000001c0)) r1 = syz_open_dev$binder(&(0x7f0000000640)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000000)=[@enter_looper], 0x1, 0x0, &(0x7f0000000040)='+'}) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0x0, 0x0, &(0x7f0000000780)}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000380)={0x8, 0x0, &(0x7f0000000500)=[@release], 0x0, 0x0, &(0x7f0000000400)}) [ 382.771662] binder: send failed reply for transaction 350 to 16959:16964 [ 382.789308] binder: undelivered TRANSACTION_ERROR: 29189 [ 382.807257] binder: 17014:17015 ioctl 40087602 200001c0 returned -22 20:30:28 executing program 3: r0 = socket$inet(0x2, 0x4000000000000001, 0x0) pipe(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) write$FUSE_INTERRUPT(r1, &(0x7f0000000040)={0x10, 0xffffffffffffffda, 0x6}, 0x10) sendto$inet(r0, &(0x7f0000a88f88), 0xfffffffffffffe6e, 0x20000000, &(0x7f0000e68000)={0x2, 0x0, @local}, 0x10) ioctl$sock_inet_SIOCGIFDSTADDR(r0, 0x8917, &(0x7f00000000c0)={'veth1_to_bridge\x00', {0x2, 0x4e24, @dev={0xac, 0x14, 0x14, 0xf}}}) ioctl$EVIOCSKEYCODE_V2(r1, 0x40284504, &(0x7f0000000080)={0x8, 0x14, 0xe70, 0x7, "6607bb29ec726aaa30a3d998fd66df1c97f7a7d142b55655432caae584598a1f"}) [ 382.877133] binder: 17014:17017 Release 1 refcount change on invalid ref 0 ret -22 20:30:29 executing program 0: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r0, &(0x7f0000000100)={0xa, 0x4e22, 0x0, @empty, 0x4}, 0x1c) writev(0xffffffffffffffff, &(0x7f0000002980), 0x0) r1 = socket$inet6(0x10, 0x3, 0x0) sendmsg(r1, &(0x7f0000002fc8)={&(0x7f0000000000)=@nl, 0x80, &(0x7f0000002000)=[{&(0x7f0000000340)="5500000018007f5300fe01b2a4a280930a06000000a84308910000003900090008000c00010000001900150006000000000000dc1338d54400009b84136ef75afb83de448daa7227c43ab8220000060cec4fab6513", 0x55}], 0x1, &(0x7f0000000400), 0x0, 0x4}, 0x0) ioctl$EXT4_IOC_GROUP_EXTEND(0xffffffffffffffff, 0x40046607, &(0x7f0000000400)) listen(r0, 0x7c) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) mkdirat$cgroup(0xffffffffffffffff, &(0x7f0000000140)='syz1\x00', 0x1ff) r3 = memfd_create(&(0x7f0000000180)="0004003100", 0x0) ioctl$sock_SIOCGPGRP(r3, 0x8904, &(0x7f00000000c0)=0x0) syz_open_procfs(r4, &(0x7f0000000300)='net/ip_tables_names\x00') write$P9_RFSYNC(r3, &(0x7f0000000240)={0x7, 0x33, 0x1}, 0xfffffffffffffe2d) sendto$inet6(r2, &(0x7f0000000380), 0x0, 0x20000004, &(0x7f000031e000)={0xa, 0x4e22, 0x0, @ipv4}, 0x1c) openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000b80)="2e2f6367726f75702f73797a3100b8458a1392623c2acc07743172c163cfc71523709c3289acba6eaf2919f32ebaa4cbe89ed30167d7d56e8e65c0edbb300c9e287f10f513e776522729d5c85c09fed3f33ea055b94d27bb72a2bb9fd56015f25cf4f9ced65ed81253cfba08e9a329935ac0c64d10a5e701cc58fe4af8cb5b679468e8ad39e103e2d5b7d9078c34eb2832a5852b28958b7efeca8ffc69c09a7ca33d82e59f9e27ea25a7cf5e65bc52987952070ddac3929791a23f905fbd72419d1539", 0x200002, 0x0) fchdir(0xffffffffffffffff) r5 = creat(&(0x7f00000005c0)='./bus\x00', 0x0) r6 = open(&(0x7f0000000540)='./bus\x00', 0x141042, 0x0) sigaltstack(&(0x7f0000ffe000/0x1000)=nil, &(0x7f0000000480)) write$selinux_context(r6, &(0x7f0000000000)='system_u:object_r:crontab_exec_t:s0\x00', 0xfffffffffffffe84) r7 = creat(&(0x7f00000003c0)='./bus\x00', 0x2) r8 = openat$null(0xffffffffffffff9c, &(0x7f00000004c0)='/dev/null\x00', 0x2807fd, 0x0) write(r8, &(0x7f0000000380), 0x0) write$cgroup_type(r6, &(0x7f0000000600)='threaded\x00', 0x9) select(0x40, &(0x7f0000000040), &(0x7f0000000080), &(0x7f00000001c0), &(0x7f0000000280)={0x77359400}) getsockopt$IP6T_SO_GET_ENTRIES(r0, 0x29, 0x41, &(0x7f0000000c80)=ANY=[@ANYBLOB="73656375726974796d0000000000000000000000000000000000000000000000c40000004e8b4b1c7fa37c911d43b7dfc1540065e2cf063a33e71b903574450eb6fcc611bb94c232461f22877f4a6bfa2e09f7f448f8a2ef823ff78d796ab6ab52f030b8fea1243b4a37836d690100843a8998fea04a2bc474078acbb61c426c93824178b70a4bcff2d634050eca0d4f941bfec0542fd99b2bd8823b4175d0b0e455f170e292c18a967fdc58383f9af93bc9c8b8578b5ed8ba7d2084ab94919aea43e1a3acfd6d899d943862ca8d84436629d2159976a615f1279aaf23ce57319edb9be03d5b849777d956c09bcb8bc5eb1d793fe7b7d0c34d4d6cc6d28cb9f66b0a2f31eda0ce948210375abcde9320750390dc04b3af4959443184210eb68c4fe6dced7e44cd2b39f7d25dc53dab0fd596852191868741cecd379b6e87b1c1a8c0dc6b8004595fb61135ed10927d6df243071d53b4757c13f4ceb4480e4a7b9c730be6258db763d9e9e7baeccd140ed2311fd9c570db36e93131c27442990068d315088680ab638288fb05b1676a9ab2e39aa99539a1cfbb1ae8b35cd18007ba5105ed92f8914bcc2397da080dd1da393ede4f195953f82d03b9a920391ee4f5bd7485d69e1d8bfc93521ea451a20dd056bd3c133aa93c9bef1e254ad7d19379b21be984d93cc7cfcbffc82708aebe5fe4c4aa7af905248de89163041c16cfdaf96ee5b65715c7bb840274ba8ddc979ae077aa20b5ba0e97ecd80abb2d3cdb2d2b6603b3a003871b7220d71909f230fa5e9a7307c10c954a2ff1c6bf5fe3e153c0ebeb4940c365ef1e9cc8588a51bfc9807e866ea6528a77c930c06eb50e3f14ca8abf929570c05ca0615211cdcce3d034946d4fadcc9df5702fca33cb322c27a54fee8cd7901df1066311b737259dfc65048bcff6eca8f566ed75b5d21b58a3c51907ba6d5ef9e04e24febdea1d345b16288065bf64cf9fa3a746185191dc7b2f4520fd2da2f60434395d6121d7063a6455be070f49e04c8c2fa0da58d878d80a1bf9cc58b6926e3c471cb1e79cb85f6ce2ad91ac6c68f955a507ad55f514d131e0a095329227c9888f9fb19bfe6df77dff07ef08544a33e9f10d72e3ca6a0d70bf0d4b3e607a2238db2aa9c1011d0af4a39786e48004427b8b55fcd1f7ad63a9aa5338475975159310e0e40000000000000000000000000000000000000000000000000000"], &(0x7f00000002c0)=0x1) recvfrom$inet6(r2, &(0x7f0000001840)=""/31, 0xfffffe0e, 0x100, &(0x7f0000001880)={0xa, 0x0, 0xffff}, 0x1c) getsockopt$inet_mreqn(r7, 0x0, 0x23, &(0x7f0000000500)={@multicast1, @multicast1, 0x0}, &(0x7f0000000440)=0xc) setsockopt$inet6_IPV6_PKTINFO(r5, 0x29, 0x32, &(0x7f0000000580)={@remote, r9}, 0x14) r10 = accept4(r0, 0x0, &(0x7f0000000000)=0xfffffffffffffefa, 0x0) sendto$inet6(r10, &(0x7f00000000c0), 0xfffffffffffffe2b, 0x0, 0x0, 0x0) 20:30:29 executing program 5: socketpair$inet_tcp(0x2, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) getsockopt$inet_int(r0, 0x0, 0x2, &(0x7f0000000040), &(0x7f0000000140)=0x4) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$nl_netfilter(r1, &(0x7f0000000080)={&(0x7f0000000100), 0xc, &(0x7f00000000c0)={&(0x7f0000000340)=ANY=[@ANYBLOB="cfff000000000000"], 0x14}}, 0x0) recvmmsg(r1, &(0x7f00000013c0), 0x1ad, 0x0, &(0x7f0000000c40)={0x77359400}) 20:30:29 executing program 4: r0 = socket$inet(0x2, 0x0, 0x0) setsockopt$inet_opts(r0, 0x0, 0x0, &(0x7f00000000c0)="8907", 0x2) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) r3 = memfd_create(&(0x7f0000000280)='[\'posix_acl_access\x00', 0x0) pwritev(r3, &(0x7f00000001c0)=[{&(0x7f0000000200)=',', 0x1}], 0x1, 0x4081806) sendfile(r1, r3, &(0x7f00000000c0), 0x20020102000007) pipe(&(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$TIOCEXCL(0xffffffffffffffff, 0x540c) write(r5, &(0x7f00000001c0), 0xfffffef3) vmsplice(r4, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) fstat(r3, &(0x7f0000000b40)) ioctl$TIOCGPGRP(0xffffffffffffffff, 0x540f, &(0x7f0000000cc0)) getsockopt$inet6_IPV6_IPSEC_POLICY(0xffffffffffffffff, 0x29, 0x22, &(0x7f00000010c0)={{{@in6=@mcast2, @in=@remote}}, {{@in6=@local}, 0x0, @in6=@loopback}}, &(0x7f00000011c0)=0xe8) recvfrom$unix(r2, &(0x7f0000000040)=""/4, 0xebc3276d6d4b1cd2, 0x100100, &(0x7f0000000100)=@abs, 0x930000) openat$selinux_avc_cache_stats(0xffffffffffffff9c, &(0x7f0000000240)='/selinux/avc/cache_stats\x00', 0x0, 0x0) 20:30:29 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$FS_IOC_SETVERSION(r0, 0x40087602, &(0x7f00000001c0)) r1 = syz_open_dev$binder(&(0x7f0000000640)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000000)=[@enter_looper], 0x1, 0x0, &(0x7f0000000040)='+'}) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0x0, 0x0, &(0x7f0000000780)}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000380)={0x8, 0x0, &(0x7f0000000500)=[@release], 0x0, 0x0, &(0x7f0000000400)}) [ 383.617326] binder: send failed reply for transaction 354 to 17014:17017 [ 383.624432] binder: undelivered TRANSACTION_ERROR: 29189 [ 383.640280] binder: 17044:17045 ioctl 40087602 200001c0 returned -22 [ 383.695264] binder: 17044:17047 Release 1 refcount change on invalid ref 0 ret -22 20:30:29 executing program 3: r0 = syz_open_dev$sndtimer(&(0x7f00000001c0)='/dev/snd/timer\x00', 0x0, 0x10480) ioctl$FIGETBSZ(r0, 0x2, &(0x7f0000000200)) r1 = socket$inet(0x2, 0x4000000000000001, 0x0) setsockopt$inet_tcp_TCP_CONGESTION(r1, 0x6, 0xd, &(0x7f0000000680)='reno\x00', 0x60c5) setsockopt$inet_MCAST_MSFILTER(r1, 0x0, 0x30, &(0x7f0000000000)={0x5, {{0x2, 0x4e24}}, 0x1, 0x2, [{{0x2, 0x4e23, @remote}}, {{0x2, 0x4e22, @multicast2}}]}, 0x190) socketpair(0x11, 0x804, 0x3f, &(0x7f0000000240)={0xffffffffffffffff}) setsockopt$inet6_tcp_int(r2, 0x6, 0x10, &(0x7f0000000280)=0x2, 0x4) 20:30:29 executing program 3: r0 = socket$inet(0x2, 0x4000000000000001, 0x0) r1 = gettid() syz_open_procfs(r1, &(0x7f0000000000)='net/netlink\x00') setsockopt$inet_tcp_TCP_CONGESTION(r0, 0x6, 0xd, &(0x7f0000000680)='reno\x00', 0x60c5) sendto$inet(r0, &(0x7f0000a88f88), 0xfffffffffffffe6e, 0x20000000, &(0x7f0000e68000)={0x2, 0x0, @local}, 0x10) 20:30:30 executing program 0: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r0, &(0x7f0000000100)={0xa, 0x4e22, 0x0, @empty, 0x4}, 0x1c) writev(0xffffffffffffffff, &(0x7f0000002980), 0x0) r1 = socket$inet6(0x10, 0x18000e, 0x5) sendmsg(r1, &(0x7f0000002fc8)={&(0x7f0000000000)=@nl, 0x80, &(0x7f0000002000)=[{&(0x7f0000000340)="5500000018007f5300fe01b2a4a280930a06000000a84308910000003900090008000c00010000001900150006000000000000dc1338d54400009b84136ef75afb83de448daa7227c43ab8220000060cec4fab6513", 0x55}], 0x1, &(0x7f0000000400), 0x0, 0x4}, 0x0) ioctl$EXT4_IOC_GROUP_EXTEND(0xffffffffffffffff, 0x40046607, &(0x7f0000000400)) listen(r0, 0x7c) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) mkdirat$cgroup(0xffffffffffffffff, &(0x7f00000003c0)='syz1\x00', 0x1ff) r3 = memfd_create(&(0x7f0000000180)="0004003100", 0x0) ioctl$sock_SIOCGPGRP(r3, 0x8904, &(0x7f00000000c0)=0x0) syz_open_procfs(r4, &(0x7f0000000300)='net/ip_tables_names\x00') write$P9_RFSYNC(r3, &(0x7f0000000240)={0x7, 0x33, 0x1}, 0xfffffffffffffe2d) sendto$inet6(r2, &(0x7f0000000380), 0x0, 0x20000004, &(0x7f000031e000)={0xa, 0x4e22, 0x0, @ipv4}, 0x1c) openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000b80)="2e2f6367726f75702f73797a3100b8458a1392623c2acc07743172c163cfc71523709c3289acba6eaf2919f32ebaa4cbe89ed30167d7d56e8e65c0edbb300c9e287f10f513e776522729d5c85c09fed3f33ea055b94d27bb72a2bb9fd56015f25cf4f9ced65ed81253cfba08e9a329935ac0c64d10a5e701cc58fe4af8cb5b679468e8ad39e103e2d5b7d9078c34eb2832a5852b28958b7efeca8ffc69c09a7ca33d82e59f9e27ea25a7cf5e65bc52987952070ddac3929791a23f905fbd72419d1539", 0x200002, 0x0) fchdir(0xffffffffffffffff) r5 = creat(&(0x7f00000005c0)='./bus\x00', 0x0) r6 = open(&(0x7f0000000540)='./bus\x00', 0x141042, 0x0) sigaltstack(&(0x7f0000ffe000/0x1000)=nil, &(0x7f0000000480)) write$selinux_context(r6, &(0x7f0000000000)='system_u:object_r:crontab_exec_t:s0\x00', 0xfffffffffffffe84) r7 = creat(&(0x7f0000000600)='./bus\x00', 0x1) r8 = openat$null(0xffffffffffffff9c, &(0x7f00000004c0)='/dev/null\x00', 0x2807fd, 0x0) write(r8, &(0x7f0000000380), 0x0) write$cgroup_type(r5, &(0x7f0000000200)='threaded\x00', 0xfffffeb3) select(0x40, &(0x7f0000000040), &(0x7f0000000080), &(0x7f00000001c0), &(0x7f0000000280)={0x77359400}) getsockopt$IP6T_SO_GET_ENTRIES(r0, 0x29, 0x41, &(0x7f0000000c80)=ANY=[@ANYBLOB="73656375726974796d0000000000000000000000000000000000000000000000c40000004e8b4b1c7fa37c911d43b7dfc1540065e2cf063a33e71b903574450eb6fcc611bb94c232461f22877f4a6bfa2e09f7f448f8a2ef823ff78d796ab6ab52f030b8fea1243b4a37836d690100843a8998fea04a2bc474078acbb61c426c93824178b70a4bcff2d634050eca0d4f941bfec0542fd99b2bd8823b4175d0b0e455f170e292c18a967fdc58383f9af93bc9c8b8578b5ed8ba7d2084ab94919aea43e1a3acfd6d899d943862ca8d84436629d2159976a615f1279aaf23ce57319edb9be03d5b849777d956c09bcb8bc5eb1d793fe7b7d0c34d4d6cc6d28cb9f66b0a2f31eda0ce948210375abcde9320750390dc04b3af4959443184210eb68c4fe6dced7e44cd2b39f7d25dc53dab0fd596852191868741cecd379b6e87b1c1a8c0dc6b8004595fb61135ed10927d6df243071d53b4757c13f4ceb4480e4a7b9c730be6258db763d9e9e7baeccd140ed2311fd9c570db36e93131c27442990068d315088680ab638288fb05b1676a9ab2fe9aa99539a1cfbb1ae8b35cd18007ba5105ed92f8914bcc2397da080dd1da393ede4f195953f82d03b9a920391ee4f5bd7485d69e1d8bfc93521ea451a20dd056bd3c133aa93c9bef1e254ad7d19379b21be984d93cc7cfcbffc82708aebe5fe4c4aa7af905248de89163041c16cfdaf96ee5b65715c7bb840274ba8ddc979ae077aa20b5ba0e97ecd80abb2d3cdb2d2b6603b3a003871b7220d71909f230fa5e9a7307c10c954a2ff1c6bf5fe3e153c0ebeb4940c365ef1e9cc8588a51bfc9807e866ea6528a77c930c06eb50e3f14ca8abf929570c05ca0615211cdcce3d034946d4fadcc9df5702fca33cb322c27a54fee8cd7901df1066311b737259dfc65048bcff6eca8f566ed75b5d21b58a3c51907ba6d5ef9e04e24febdea1d345b16288065bf64cf9fa3a746185191dc7b2f4520fd2da2f60434395d6121d7063a6455be070f49e04c8c2fa0da58d878d80a1bf9cc58b6926e3c471cb1e79cb85f6ce2ad91ac6c68f955a507ad55f514d131e0a095329227c9888f9fb19bfe6df77dff07ef08544a33e9f10d72e3ca6a0d70bf0d4b3e607a2238db2aa9c1011d0af4a39786e48004427b8b55fcd1f7ad63a9aa5338475975159310e0e40000000000000000000000000000000000000000000000000000"], &(0x7f00000002c0)=0x1) recvfrom$inet6(r2, &(0x7f0000001840)=""/31, 0xfffffe0e, 0x100, &(0x7f0000001880)={0xa, 0x0, 0xffff}, 0x1c) getsockopt$inet_mreqn(r7, 0x0, 0x23, &(0x7f0000000500)={@multicast1, @multicast1, 0x0}, &(0x7f0000000440)=0xc) setsockopt$inet6_IPV6_PKTINFO(r5, 0x29, 0x32, &(0x7f0000000580)={@remote, r9}, 0x14) r10 = accept4(r0, 0x0, &(0x7f0000000000)=0xfffffffffffffefa, 0x0) sendto$inet6(r10, &(0x7f00000000c0), 0xfffffffffffffe2b, 0x0, 0x0, 0x0) 20:30:30 executing program 2: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r0, &(0x7f0000000100)={0xa, 0x4e22, 0x0, @empty, 0x4}, 0x1c) writev(0xffffffffffffffff, &(0x7f0000002980), 0x0) r1 = socket$inet6(0x10, 0x3, 0x0) sendmsg(r1, &(0x7f0000002fc8)={&(0x7f0000000000)=@nl, 0x80, &(0x7f0000002000)=[{&(0x7f0000000340)="5500000018007f5300fe01b2a4a280930a06000000a84308910000003900090008000c00010000001900150006000000000000dc1338d54400009b84136ef75afb83de448daa7227c43ab8220000060cec4fab6513", 0x55}], 0x1, &(0x7f0000000400), 0x0, 0x4}, 0x0) ioctl$EXT4_IOC_GROUP_EXTEND(0xffffffffffffffff, 0x40046607, &(0x7f0000000400)) listen(r0, 0x7c) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) mkdirat$cgroup(0xffffffffffffffff, &(0x7f0000000140)='syz1\x00', 0x1ff) r3 = memfd_create(&(0x7f0000000180)="0004003100", 0x0) ioctl$sock_SIOCGPGRP(r3, 0x8904, &(0x7f00000000c0)=0x0) syz_open_procfs(r4, &(0x7f0000000300)='net/ip_tables_names\x00') write$P9_RFSYNC(r3, &(0x7f0000000240)={0x7, 0x33, 0x1}, 0xfffffffffffffe2d) sendto$inet6(r2, &(0x7f0000000380), 0x0, 0x20000004, &(0x7f000031e000)={0xa, 0x4e22, 0x0, @ipv4}, 0x1c) openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000b80)="2e2f6367726f75702f73797a3100b8458a1392623c2acc07743172c163cfc71523709c3289acba6eaf2919f32ebaa4cbe89ed30167d7d56e8e65c0edbb300c9e287f10f513e776522729d5c85c09fed3f33ea055b94d27bb72a2bb9fd56015f25cf4f9ced65ed81253cfba08e9a329935ac0c64d10a5e701cc58fe4af8cb5b679468e8ad39e103e2d5b7d9078c34eb2832a5852b28958b7efeca8ffc69c09a7ca33d82e59f9e27ea25a7cf5e65bc52987952070ddac3929791a23f905fbd72419d1539", 0x200002, 0x0) fchdir(0xffffffffffffffff) r5 = creat(&(0x7f00000005c0)='./bus\x00', 0x0) r6 = open(&(0x7f0000000540)='./bus\x00', 0x141042, 0x0) sigaltstack(&(0x7f0000ffe000/0x1000)=nil, &(0x7f0000000480)) write$selinux_context(r6, &(0x7f0000000000)='system_u:object_r:crontab_exec_t:s0\x00', 0xfffffffffffffe84) r7 = creat(&(0x7f00000003c0)='./bus\x00', 0x2) r8 = openat$null(0xffffffffffffff9c, &(0x7f00000004c0)='/dev/null\x00', 0x2807fd, 0x0) write(r8, &(0x7f0000000380), 0x0) write$cgroup_type(r6, &(0x7f0000000600)='threaded\x00', 0x9) select(0x40, &(0x7f0000000040), &(0x7f0000000080), &(0x7f00000001c0), &(0x7f0000000280)={0x77359400}) getsockopt$IP6T_SO_GET_ENTRIES(r0, 0x29, 0x41, &(0x7f0000000c80)=ANY=[@ANYBLOB="73656375726974796d0000000000000000000000000000000000000000000000c40000004e8b4b1c7fa37c911d43b7dfc1540065e2cf063a33e71b903574450eb6fcc611bb94c232461f22877f4a6bfa2e09f7f448f8a2ef823ff78d796ab6ab52f030b8fea1243b4a37836d690100843a8998fea04a2bc474078acbb61c426c93824178b70a4bcff2d634050eca0d4f941bfec0542fd99b2bd8823b4175d0b0e455f170e292c18a967fdc58383f9af93bc9c8b8578b5ed8ba7d2084ab94919aea43e1a3acfd6d899d943862ca8d84436629d2159976a615f1279aaf23ce57319edb9be03d5b849777d956c09bcb8bc5eb1d793fe7b7d0c34d4d6cc6d28cb9f66b0a2f31eda0ce948210375abcde9320750390dc04b3af4959443184210eb68c4fe6dced7e44cd2b39f7d25dc53dab0fd596852191868741cecd379b6e87b1c1a8c0dc6b8004595fb61135ed10927d6df243071d53b4757c13f4ceb4480e4a7b9c730be6258db763d9e9e7baeccd140ed2311fd9c570db36e93131c27442990068d315088680ab638288fb05b1676a9ab2e39aa99539a1cfbb1ae8b35cd18007ba5105ed92f8914bcc2397da080dd1da393ede4f195953f82d03b9a920391ee4f5bd7485d69e1d8bfc93521ea451a20dd056bd3c133aa93c9bef1e254ad7d19379b21be984d93cc7cfcbffc82708aebe5fe4c4aa7af905248de89163041c16cfdaf96ee5b65715c7bb840274ba8ddc979ae077aa20b5ba0e97ecd80abb2d3cdb2d2b6603b3a003871b7220d71909f230fa5e9a7307c10c954a2ff1c6bf5fe3e153c0ebeb4940c365ef1e9cc8588a51bfc9807e866ea6528a77c930c06eb50e3f14ca8abf929570c05ca0615211cdcce3d034946d4fadcc9df5702fca33cb322c27a54fee8cd7901df1066311b737259dfc65048bcff6eca8f566ed75b5d21b58a3c51907ba6d5ef9e04e24febdea1d345b16288065bf64cf9fa3a746185191dc7b2f4520fd2da2f60434395d6121d7063a6455be070f49e04c8c2fa0da58d878d80a1bf9cc58b6926e3c471cb1e79cb85f6ce2ad91ac6c68f955a507ad55f514d131e0a095329227c9888f9fb19bfe6df77dff07ef08544a33e9f10d72e3ca6a0d70bf0d4b3e607a2238db2aa9c1011d0af4a39786e48004427b8b55fcd1f7ad63a9aa5338475975159310e0e40000000000000000000000000000000000000000000000000000"], &(0x7f00000002c0)=0x1) recvfrom$inet6(r2, &(0x7f0000001840)=""/31, 0xfffffe0e, 0x100, &(0x7f0000001880)={0xa, 0x0, 0xffff}, 0x1c) getsockopt$inet_mreqn(r7, 0x0, 0x23, &(0x7f0000000500)={@multicast1, @multicast1, 0x0}, &(0x7f0000000440)=0xc) setsockopt$inet6_IPV6_PKTINFO(r5, 0x29, 0x32, &(0x7f0000000580)={@remote, r9}, 0x14) r10 = accept4(r0, 0x0, &(0x7f0000000000)=0xfffffffffffffefa, 0x0) sendto$inet6(r10, &(0x7f00000000c0), 0xfffffffffffffe2b, 0x0, 0x0, 0x0) 20:30:30 executing program 5: r0 = creat(&(0x7f0000005500)='./file0\x00', 0x101) ioctl$RTC_PIE_ON(r0, 0x7005) clock_gettime(0x0, &(0x7f0000005840)={0x0, 0x0}) rt_sigtimedwait(&(0x7f0000005800)={0x1e}, 0x0, &(0x7f0000005880)={r1, r2+30000000}, 0x8) accept4$inet(r0, &(0x7f0000005740)={0x2, 0x0, @broadcast}, &(0x7f0000005a40)=0x10, 0x800) r3 = socket$nl_netfilter(0x10, 0x3, 0xc) setsockopt(r0, 0x879, 0x8000, &(0x7f0000005780)="c3a266cf573c80ac5a7aa647ad837ea3d22c486f6ae9e676849038f22b5b44ca012aaf052f09903c2ff4f81368fd03d10677db4dce90b63ef3db9a6a3edd8b392969aa", 0x43) sendmsg$nl_netfilter(r3, &(0x7f0000000080)={&(0x7f0000000100), 0xc, &(0x7f00000000c0)={&(0x7f00000058c0)=ANY=[@ANYBLOB="f6ff22ed024400e549b9327d7510a4f08f00003d88bf"], 0x14}}, 0x0) dup2(r3, r3) recvmmsg(r3, &(0x7f0000005540)=[{{&(0x7f0000000000), 0x80, &(0x7f0000000180)=[{&(0x7f0000000140)=""/36, 0x24}], 0x1, &(0x7f00000001c0)=""/161, 0xa1, 0x1}, 0x5}, {{&(0x7f0000000280)=@alg, 0x80, &(0x7f0000000300)=[{&(0x7f0000000380)=""/194, 0xc2}, {&(0x7f0000000480)=""/236, 0xec}, {&(0x7f0000000580)=""/225, 0xe1}], 0x3, &(0x7f0000000680)=""/222, 0xde}}, {{&(0x7f0000000780)=@l2, 0x80, &(0x7f0000000900)=[{&(0x7f0000000800)=""/207, 0xcf}], 0x1, &(0x7f0000000940)=""/30, 0x1e, 0xfff}, 0x1}, {{0x0, 0x0, &(0x7f0000001c80)=[{&(0x7f0000000980)=""/48, 0x30}, {&(0x7f0000000c80)=""/4096, 0x1000}, {&(0x7f00000009c0)=""/187, 0xbb}, {&(0x7f0000000a80)=""/143, 0x8f}, {&(0x7f0000000b40)=""/181, 0xb5}], 0x5, &(0x7f0000001d00)=""/81, 0x51, 0x401}, 0x3}, {{&(0x7f0000001d80)=@generic, 0x80, &(0x7f0000000c00)=[{&(0x7f0000001e00)=""/174, 0xae}, {&(0x7f0000001ec0)=""/4096, 0x1000}], 0x2, 0x0, 0x0, 0x1}, 0x9}, {{0x0, 0x0, &(0x7f0000003f80)=[{&(0x7f0000002ec0)=""/88, 0x58}, {&(0x7f0000002f40)=""/4096, 0x1000}, {&(0x7f0000003f40)=""/43, 0x2b}], 0x3, 0x0, 0x0, 0x101}}, {{&(0x7f0000003fc0)=@pppol2tpin6, 0x80, &(0x7f0000005480)=[{&(0x7f0000004040)=""/146, 0x92}, {&(0x7f0000004100)=""/107, 0x6b}, {&(0x7f0000004180)=""/228, 0xe4}, {&(0x7f0000004280)=""/4096, 0x1000}, {&(0x7f0000005280)=""/208, 0xd0}, {&(0x7f0000005380)=""/236, 0xec}], 0x6, &(0x7f0000005700)=""/63, 0x3f, 0x4000000000000000}}], 0x7, 0x0, &(0x7f0000000c40)={0x77359400}) r4 = add_key(&(0x7f0000005a80)='cifs.spnego\x00', &(0x7f0000005ac0)={'syz', 0x1}, 0x0, 0x0, 0x0) r5 = add_key(&(0x7f0000000340)='.request_key_auth\x00', &(0x7f0000005900)={'syz', 0x0}, 0x0, 0x0, r4) r6 = add_key$keyring(&(0x7f00000059c0)='keyring\x00', &(0x7f0000005a00)={'syz', 0x2}, 0x0, 0x0, 0xfffffffffffffffb) keyctl$search(0xa, r5, &(0x7f0000005940)='cifs.spnego\x00', &(0x7f0000005980)={'syz', 0x1}, r6) 20:30:30 executing program 4: r0 = socket$inet(0x2, 0x0, 0x0) setsockopt$inet_opts(r0, 0x0, 0x0, &(0x7f00000000c0)="8907", 0x2) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) r3 = memfd_create(&(0x7f0000000280)='[\'posix_acl_access\x00', 0x0) pwritev(r3, &(0x7f00000001c0)=[{&(0x7f0000000200)=',', 0x1}], 0x1, 0x4081806) sendfile(r1, r3, &(0x7f00000000c0), 0x20020102000007) pipe(&(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$TIOCEXCL(0xffffffffffffffff, 0x540c) write(r5, &(0x7f00000001c0), 0xfffffef3) vmsplice(r4, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) fstat(r3, &(0x7f0000000b40)) ioctl$TIOCGPGRP(0xffffffffffffffff, 0x540f, &(0x7f0000000cc0)) getsockopt$inet6_IPV6_IPSEC_POLICY(0xffffffffffffffff, 0x29, 0x22, &(0x7f00000010c0)={{{@in6=@mcast2, @in=@remote}}, {{@in6=@local}, 0x0, @in6=@loopback}}, &(0x7f00000011c0)=0xe8) recvfrom$unix(r2, &(0x7f0000000040)=""/4, 0xebc3276d6d4b1cd2, 0x100100, &(0x7f0000000100)=@abs, 0x930000) openat$selinux_avc_cache_stats(0xffffffffffffff9c, &(0x7f0000000240)='/selinux/avc/cache_stats\x00', 0x0, 0x0) [ 384.439776] binder: release 17044:17047 transaction 358 out, still active [ 384.453263] binder: send failed reply for transaction 358, target dead 20:30:30 executing program 3: r0 = socket$inet(0x2, 0x2000006, 0x25) getsockopt$inet_buf(r0, 0x0, 0x2b, &(0x7f0000000000)=""/4096, &(0x7f0000001000)=0x1000) finit_module(r0, &(0x7f0000001040)='{\x00', 0x2) sendto$inet(r0, &(0x7f0000a88f88), 0xfffffffffffffe6e, 0x20000000, &(0x7f0000e68000)={0x2, 0x0, @local}, 0x10) getsockopt$inet6_IPV6_IPSEC_POLICY(0xffffffffffffff9c, 0x29, 0x22, &(0x7f0000001500)={{{@in=@loopback, @in6=@dev, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in=@broadcast}, 0x0, @in=@rand_addr}}, &(0x7f0000001600)=0xe8) r2 = geteuid() setsockopt$inet_IP_IPSEC_POLICY(r0, 0x0, 0x10, &(0x7f0000001640)={{{@in6=@mcast2, @in6=@mcast1, 0x4e22, 0x4, 0x4e21, 0x0, 0xa, 0x80, 0x20, 0xaf, r1, r2}, {0x1, 0x101, 0x9, 0xa38a, 0x67, 0x1f, 0x4, 0xab}, {0x6, 0x3ff, 0x4c4}, 0x0, 0x6e6bb0, 0x0, 0x1, 0x1}, {{@in=@local, 0x4d4, 0x3b}, 0x2, @in, 0x3500, 0x3, 0x1, 0xfffffffffffffffa, 0x400, 0x1000, 0x1}}, 0xe8) r3 = accept4(r0, &(0x7f0000001080)=@ax25, &(0x7f0000001100)=0x80, 0x800) setsockopt$inet6_tcp_TLS_TX(r3, 0x6, 0x1, &(0x7f0000001140), 0x4) 20:30:30 executing program 3: r0 = socket$inet(0x2, 0x4000000000000001, 0x0) flock(r0, 0x2004000000000c) r1 = openat$zero(0xffffffffffffff9c, &(0x7f0000000040)='/dev/zero\x00', 0x8002, 0x0) r2 = socket$inet_udp(0x2, 0x2, 0x0) write$uinput_user_dev(r1, &(0x7f0000000080)={'syz1\x00', {0x5, 0x3, 0x4, 0x52c}, 0x33, [0x400, 0x9ea, 0x5c0d, 0x1, 0x0, 0x7fff, 0x8, 0xdf86, 0xf25, 0x81, 0x1, 0x20, 0x4, 0x3, 0x6, 0x0, 0xffffffff, 0x5, 0x5, 0x4, 0x10001, 0x200, 0x8, 0x8, 0xffffffffffff7fff, 0x3, 0x1, 0x4, 0x0, 0x9, 0x1, 0x7, 0x4, 0x101, 0x5, 0x7fffffff, 0xffff, 0x535a, 0x0, 0x1, 0x10001, 0x72f0, 0xea7a, 0x3, 0x7fc000000000, 0x40, 0x800, 0x2, 0x9, 0x2, 0xbf92, 0x5, 0xfe, 0x6, 0x9, 0x8, 0x80000001, 0xf6b9, 0xf9d, 0x3, 0x7fffffff, 0x6, 0x5, 0xa5e], [0x3ff, 0x8, 0x2, 0x800, 0xfffffffffffffff9, 0x8, 0x4, 0xac, 0x7fff, 0x8, 0x1, 0x6, 0x8, 0xe88, 0xbced, 0x6, 0xfff, 0x61, 0x8, 0x1, 0x8001, 0xffffffffffffffff, 0x10001, 0x7d6b, 0x6, 0x7, 0x0, 0x2, 0x5, 0x0, 0x40, 0x1ff, 0x4, 0x81, 0x7, 0x3, 0x1, 0x3, 0x9, 0x200, 0x6, 0x101, 0x6, 0x4cb3, 0x6, 0x81, 0x6, 0x800000, 0x81, 0x2, 0x2, 0xffffffffffff0000, 0x0, 0x1, 0x6, 0x6, 0x80000000, 0x2, 0x8c14, 0xfffffffffffffffc, 0x0, 0x2, 0x7f, 0x5], [0x100, 0x207d, 0x1, 0x7, 0x8001, 0x7fffffff, 0x2, 0x7, 0x8, 0xeeb5, 0x7ff, 0x0, 0x10001, 0x7fff, 0x8, 0x22, 0x3f, 0x7fff, 0x7, 0x400000000000000, 0x9d8, 0xffff, 0x6, 0x1f, 0x8, 0x0, 0x7, 0x3, 0x20000000, 0xfffffffffffffe00, 0x80000001, 0x80000001, 0xa614, 0x6, 0x6, 0x3, 0x4, 0x7, 0x0, 0x2, 0x7, 0x7185e24b, 0x1000, 0x1, 0xeabd, 0x5, 0x8, 0x43, 0x3, 0x0, 0xc3cf, 0x7ff, 0x23e0718d, 0x7fff, 0x7383, 0x0, 0x9, 0x1ff, 0x7fff, 0x2, 0x1, 0xa, 0x1f, 0x4], [0x800, 0x1, 0xfffffffffffffffb, 0x1, 0x67a9, 0x1ff, 0x5, 0x400, 0x7ff, 0x3, 0x5, 0x8, 0x9, 0x80000000, 0xe913, 0x9, 0x2, 0x2, 0x5, 0x0, 0xc6, 0x5, 0x3, 0x79, 0x1, 0x5, 0x401, 0x3, 0x7, 0x2, 0xa7f2, 0x1fe0000000, 0x7f, 0x2, 0x2, 0x93eb, 0x7f, 0x9, 0x9ed, 0x7f, 0x3, 0x5, 0x8, 0x200000, 0x800, 0x1, 0x0, 0x8, 0x3, 0x8, 0x19, 0x3, 0x8001, 0x1, 0x4, 0xffffffffffffff81, 0x3, 0x1, 0x0, 0x5, 0x4, 0x4, 0x5]}, 0x45c) accept$packet(r1, &(0x7f0000000500)={0x11, 0x0, 0x0}, &(0x7f0000000540)=0x14) fstat(r0, &(0x7f0000000580)={0x0, 0x0, 0x0, 0x0, 0x0}) setsockopt$inet_IP_XFRM_POLICY(r2, 0x0, 0x11, &(0x7f00000006c0)={{{@in6=@remote, @in=@dev={0xac, 0x14, 0x14, 0xe}, 0x4e20, 0x5b29, 0x4e23, 0x6, 0xa, 0x0, 0x80, 0x32, r3, r4}, {0x100000000, 0x0, 0x6, 0x6, 0x1, 0x6, 0x9, 0x2}, {0x14, 0x8, 0x6, 0x7}, 0x9, 0x6e6bba, 0x3, 0x1, 0x1, 0x3}, {{@in6=@local, 0x4d4, 0x2b}, 0x2, @in=@multicast1, 0x3506, 0x3, 0x3, 0x9, 0x5, 0x10000, 0x100000000}}, 0xe8) setsockopt$inet_tcp_TCP_CONGESTION(r0, 0x6, 0xd, &(0x7f0000000680)='reno\x00', 0x60c5) setsockopt$SO_TIMESTAMPING(r0, 0x1, 0x25, &(0x7f0000000000)=0x18, 0x4) sendto$inet(r0, &(0x7f0000a88f88), 0xfffffffffffffe6e, 0x20000000, &(0x7f0000e68000)={0x2, 0x0, @local}, 0x10) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x2400, 0x0) 20:30:30 executing program 0: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r0, &(0x7f0000000100)={0xa, 0x4e22, 0x0, @empty, 0x4}, 0x1c) writev(0xffffffffffffffff, &(0x7f0000002980), 0x0) r1 = socket$inet6(0x10, 0x3, 0x0) sendmsg(r1, &(0x7f0000002fc8)={&(0x7f0000000000)=@nl, 0x80, &(0x7f0000002000)=[{&(0x7f0000000340)="5500000018007f5300fe01b2a4a280930a06000000a84308910000003900090008000c00010000001900150006000000000000dc1338d54400009b84136ef75afb83de448daa7227c43ab8220000060cec4fab6513", 0x55}], 0x1, &(0x7f0000000400), 0x0, 0x4}, 0x0) ioctl$EXT4_IOC_GROUP_EXTEND(0xffffffffffffffff, 0x40046607, &(0x7f0000000400)) listen(r0, 0x7c) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) openat$null(0xffffffffffffff9c, &(0x7f0000000600)='/dev/null\x00', 0x400, 0x0) mkdirat$cgroup(r1, &(0x7f0000000640)='syz1\x00', 0x1ff) r3 = memfd_create(&(0x7f0000000180)="0004003100", 0x0) ioctl$sock_SIOCGPGRP(r3, 0x8904, &(0x7f00000000c0)=0x0) syz_open_procfs(r4, &(0x7f0000000300)='net/ip_tables_names\x00') write$P9_RFSYNC(r3, &(0x7f0000000240)={0x7, 0x33, 0x1}, 0xfffffffffffffe2d) sendto$inet6(r2, &(0x7f0000000380), 0x0, 0x20000004, &(0x7f000031e000)={0xa, 0x4e22, 0x0, @ipv4}, 0x1c) openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000b80)="2e2f6367726f75702f73797a3100b8458a1392623c2acc07743172c163cfc71523709c3289acba6eaf2919f32ebaa4cbe89ed30167d7d56e8e65c0edbb300c9e287f10f513e776522729d5c85c09fed3f33ea055b94d27bb72a2bb9fd56015f25cf4f9ced65ed81253cfba08e9a329935ac0c64d10a5e701cc58fe4af8cb5b679468e8ad39e103e2d5b7d9078c34eb2832a5852b28958b7efeca8ffc69c09a7ca33d82e59f9e27ea25a7cf5e65bc52987952070ddac3929791a23f905fbd72419d1539", 0x200002, 0x0) fchdir(0xffffffffffffffff) r5 = creat(&(0x7f00000005c0)='./bus\x00', 0x0) r6 = open(&(0x7f0000000540)='./bus\x00', 0x141042, 0x0) sigaltstack(&(0x7f0000ffe000/0x1000)=nil, &(0x7f0000000480)) write$selinux_context(r6, &(0x7f0000000000)='system_u:object_r:crontab_exec_t:s0\x00', 0xfffffffffffffe84) r7 = creat(&(0x7f00000003c0)='./bus\x00', 0x2) r8 = openat$null(0xffffffffffffff9c, &(0x7f00000004c0)='/dev/null\x00', 0x2807fd, 0x0) write(r8, &(0x7f0000000380), 0x0) write$cgroup_type(r5, &(0x7f0000000200)='threaded\x00', 0xfffffeb3) select(0x40, &(0x7f0000000040), &(0x7f0000000080), &(0x7f00000001c0), &(0x7f0000000280)={0x77359400}) getsockopt$IP6T_SO_GET_ENTRIES(r0, 0x29, 0x41, &(0x7f0000000c80)=ANY=[@ANYBLOB="73656375726974796d0000000000000000000000000000000000000000000000c40000004e8b4b1c7fa37c911d43b7dfc1540065e2cf063a33e71b903574450eb6fcc611bb94c232461f22877f4a6bfa2e09f7f448f8a2ef823ff78d796ab6ab52f030b8fea1243b4a37836d690100843a8998fea04a2bc474078acbb61c426c93824178b70a4bcff2d634050eca0d4f941bfec0542fd99b2bd8823b4175d0b0e455f170e292c18a967fdc58383f9af93bc9c8b8578b5ed8ba7d2084ab94919aea43e1a3acfd6d899d943862ca8d84436629d2159976a615f1279aaf23ce57319edb9be03d5b849777d956c09bcb8bc5eb1d793fe7b7d0c34d4d6cc6d28cb9f66b0a2f31eda0ce948210375abcde9320750390dc04b3af4959443184210eb68c4fe6dced7e44cd2b39f7d25dc53dab0fd596852191868741cecd379b6e87b1c1a8c0dc6b8004595fb61135ed10927d6df243071d53b4757c13f4ceb4480e4a7b9c730be6258db763d9e9e7baeccd140ed2311fd9c570db36e93131c27442990068d315088680ab638288fb05b1676a9ab2fe9aa99539a1cfbb1ae8b35cd18007ba5105ed92f8914bcc2397da080dd1da393ede4f195953f82d03b9a920391ee4f5bd7485d69e1d8bfc93521ea451a20dd056bd3c133aa93c9bef1e254ad7d19379b21be984d93cc7cfcbffc82708aebe5fe4c4aa7af905248de89163041c16cfdaf96ee5b65715c7bb840274ba8ddc979ae077aa20b5ba0e97ecd80abb2d3cdb2d2b6603b3a003871b7220d71909f230fa5e9a7307c10c954a2ff1c6bf5fe3e153c0ebeb4940c365ef1e9cc8588a51bfc9807e866ea6528a77c930c06eb50e3f14ca8abf929570c05ca0615211cdcce3d034946d4fadcc9df5702fca33cb322c27a54fee8cd7901df1066311b737259dfc65048bcff6eca8f566ed75b5d21b58a3c51907ba6d5ef9e04e24febdea1d345b16288065bf64cf9fa3a746185191dc7b2f4520fd2da2f60434395d6121d7063a6455be070f49e04c8c2fa0da58d878d80a1bf9cc58b6926e3c471cb1e79cb85f6ce2ad91ac6c68f955a507ad55f514d131e0a095329227c9888f9fb19bfe6df77dff07ef08544a33e9f10d72e3ca6a0d70bf0d4b3e607a2238db2aa9c1011d0af4a39786e48004427b8b55fcd1f7ad63a9aa5338475975159310e0e40000000000000000000000000000000000000000000000000000"], &(0x7f00000002c0)=0x1) recvfrom$inet6(r2, &(0x7f0000001840)=""/31, 0xfffffe0e, 0x100, &(0x7f0000001880)={0xa, 0x0, 0xffff}, 0x1c) getsockopt$inet_mreqn(r7, 0x0, 0x23, &(0x7f0000000500)={@multicast1, @multicast1, 0x0}, &(0x7f0000000440)=0xc) setsockopt$inet6_IPV6_PKTINFO(r5, 0x29, 0x32, &(0x7f0000000580)={@remote, r9}, 0x14) r10 = accept4(r0, 0x0, &(0x7f0000000000)=0xfffffffffffffefa, 0x0) sendto$inet6(r10, &(0x7f00000000c0), 0xfffffffffffffe2b, 0x0, 0x0, 0x0) 20:30:31 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$FS_IOC_SETVERSION(r0, 0x40087602, &(0x7f00000001c0)) r1 = syz_open_dev$binder(&(0x7f0000000640)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000000)=[@enter_looper], 0x1, 0x0, &(0x7f0000000040)='+'}) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0x0, 0x0, &(0x7f0000000780)}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000380)={0x8, 0x0, &(0x7f0000000500)=[@release], 0x0, 0x0, &(0x7f0000000400)}) 20:30:31 executing program 5: r0 = dup(0xffffffffffffffff) ioctl$EVIOCGKEYCODE(r0, 0x80084504, &(0x7f0000000000)=""/53) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) recvmmsg(r1, &(0x7f00000013c0), 0x1ad, 0x0, &(0x7f0000000c40)={0x77359400}) [ 385.226319] binder: 17110:17111 ioctl 40087602 200001c0 returned -22 20:30:31 executing program 4: r0 = socket$inet(0x2, 0x0, 0x0) setsockopt$inet_opts(r0, 0x0, 0x0, &(0x7f00000000c0)="8907", 0x2) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) r3 = memfd_create(&(0x7f0000000280)='[\'posix_acl_access\x00', 0x0) pwritev(r3, &(0x7f00000001c0)=[{&(0x7f0000000200)=',', 0x1}], 0x1, 0x4081806) sendfile(r1, r3, &(0x7f00000000c0), 0x20020102000007) pipe(&(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$TIOCEXCL(0xffffffffffffffff, 0x540c) write(r5, &(0x7f00000001c0), 0xfffffef3) vmsplice(r4, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) fstat(r3, &(0x7f0000000b40)) ioctl$TIOCGPGRP(0xffffffffffffffff, 0x540f, &(0x7f0000000cc0)) getsockopt$inet6_IPV6_IPSEC_POLICY(0xffffffffffffffff, 0x29, 0x22, &(0x7f00000010c0)={{{@in6=@mcast2, @in=@remote}}, {{@in6=@local}, 0x0, @in6=@loopback}}, &(0x7f00000011c0)=0xe8) recvfrom$unix(r2, &(0x7f0000000040)=""/4, 0xebc3276d6d4b1cd2, 0x100100, &(0x7f0000000100)=@abs, 0x930000) [ 385.290808] binder: 17110:17116 Release 1 refcount change on invalid ref 0 ret -22 20:30:31 executing program 1: r0 = creat(&(0x7f0000005500)='./file0\x00', 0x101) ioctl$RTC_PIE_ON(r0, 0x7005) clock_gettime(0x0, &(0x7f0000005840)={0x0, 0x0}) rt_sigtimedwait(&(0x7f0000005800)={0x1e}, 0x0, &(0x7f0000005880)={r1, r2+30000000}, 0x8) accept4$inet(r0, &(0x7f0000005740)={0x2, 0x0, @broadcast}, &(0x7f0000005a40)=0x10, 0x800) r3 = socket$nl_netfilter(0x10, 0x3, 0xc) setsockopt(r0, 0x879, 0x8000, &(0x7f0000005780)="c3a266cf573c80ac5a7aa647ad837ea3d22c486f6ae9e676849038f22b5b44ca012aaf052f09903c2ff4f81368fd03d10677db4dce90b63ef3db9a6a3edd8b392969aa", 0x43) sendmsg$nl_netfilter(r3, &(0x7f0000000080)={&(0x7f0000000100), 0xc, &(0x7f00000000c0)={&(0x7f00000058c0)=ANY=[@ANYBLOB="f6ff22ed024400e549b9327d7510a4f08f00003d88bf"], 0x14}}, 0x0) dup2(r3, r3) recvmmsg(r3, &(0x7f0000005540)=[{{&(0x7f0000000000), 0x80, &(0x7f0000000180)=[{&(0x7f0000000140)=""/36, 0x24}], 0x1, &(0x7f00000001c0)=""/161, 0xa1, 0x1}, 0x5}, {{&(0x7f0000000280)=@alg, 0x80, &(0x7f0000000300)=[{&(0x7f0000000380)=""/194, 0xc2}, {&(0x7f0000000480)=""/236, 0xec}, {&(0x7f0000000580)=""/225, 0xe1}], 0x3, &(0x7f0000000680)=""/222, 0xde}}, {{&(0x7f0000000780)=@l2, 0x80, &(0x7f0000000900)=[{&(0x7f0000000800)=""/207, 0xcf}], 0x1, &(0x7f0000000940)=""/30, 0x1e, 0xfff}, 0x1}, {{0x0, 0x0, &(0x7f0000001c80)=[{&(0x7f0000000980)=""/48, 0x30}, {&(0x7f0000000c80)=""/4096, 0x1000}, {&(0x7f00000009c0)=""/187, 0xbb}, {&(0x7f0000000a80)=""/143, 0x8f}, {&(0x7f0000000b40)=""/181, 0xb5}], 0x5, &(0x7f0000001d00)=""/81, 0x51, 0x401}, 0x3}, {{&(0x7f0000001d80)=@generic, 0x80, &(0x7f0000000c00)=[{&(0x7f0000001e00)=""/174, 0xae}, {&(0x7f0000001ec0)=""/4096, 0x1000}], 0x2, 0x0, 0x0, 0x1}, 0x9}, {{0x0, 0x0, &(0x7f0000003f80)=[{&(0x7f0000002ec0)=""/88, 0x58}, {&(0x7f0000002f40)=""/4096, 0x1000}, {&(0x7f0000003f40)=""/43, 0x2b}], 0x3, 0x0, 0x0, 0x101}}, {{&(0x7f0000003fc0)=@pppol2tpin6, 0x80, &(0x7f0000005480)=[{&(0x7f0000004040)=""/146, 0x92}, {&(0x7f0000004100)=""/107, 0x6b}, {&(0x7f0000004180)=""/228, 0xe4}, {&(0x7f0000004280)=""/4096, 0x1000}, {&(0x7f0000005280)=""/208, 0xd0}, {&(0x7f0000005380)=""/236, 0xec}], 0x6, &(0x7f0000005700)=""/63, 0x3f, 0x4000000000000000}}], 0x7, 0x0, &(0x7f0000000c40)={0x77359400}) r4 = add_key(&(0x7f0000005a80)='cifs.spnego\x00', &(0x7f0000005ac0)={'syz', 0x1}, 0x0, 0x0, 0x0) r5 = add_key(&(0x7f0000000340)='.request_key_auth\x00', &(0x7f0000005900)={'syz', 0x0}, 0x0, 0x0, r4) r6 = add_key$keyring(&(0x7f00000059c0)='keyring\x00', &(0x7f0000005a00)={'syz', 0x2}, 0x0, 0x0, 0xfffffffffffffffb) keyctl$search(0xa, r5, &(0x7f0000005940)='cifs.spnego\x00', &(0x7f0000005980)={'syz', 0x1}, r6) 20:30:31 executing program 3: r0 = socket$inet(0x2, 0x4000000000000001, 0x0) setsockopt$inet_tcp_TCP_CONGESTION(r0, 0x6, 0xd, &(0x7f0000000040)='leno\x00', 0x5) sendto$inet(r0, &(0x7f0000a88f88), 0xfffffffffffffe6e, 0x20000000, &(0x7f0000e68000)={0x2, 0x0, @local}, 0x10) 20:30:31 executing program 0: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r0, &(0x7f0000000100)={0xa, 0x4e22, 0x0, @empty, 0x4}, 0x1c) writev(0xffffffffffffffff, &(0x7f0000002980), 0x0) r1 = socket$inet6(0x10, 0x3, 0x0) sendmsg(r1, &(0x7f0000002fc8)={&(0x7f0000000000)=@nl, 0x80, &(0x7f0000002000)=[{&(0x7f0000000340)="5500000018007f5300fe01b2a4a280930a06000000a84308910000003900090008000c00010000001900150006000000000000dc1338d54400009b84136ef75afb83de448daa7227c43ab8220000060cec4fab6513", 0x55}], 0x1, &(0x7f0000000400), 0x0, 0x4}, 0x0) ioctl$EXT4_IOC_GROUP_EXTEND(0xffffffffffffffff, 0x40046607, &(0x7f0000000400)) listen(r0, 0x7c) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) mkdirat$cgroup(0xffffffffffffffff, &(0x7f0000000140)='syz1\x00', 0x1ff) r3 = memfd_create(&(0x7f0000000180)="0004003100", 0x0) ioctl$sock_SIOCGPGRP(r3, 0x8904, &(0x7f00000000c0)=0x0) syz_open_procfs(r4, &(0x7f0000000300)='net/ip_tables_names\x00') write$P9_RFSYNC(r3, &(0x7f0000000240)={0x7, 0x33, 0x1}, 0xfffffffffffffe2d) sendto$inet6(r2, &(0x7f0000000380), 0x0, 0x20000004, &(0x7f000031e000)={0xa, 0x4e22, 0x0, @ipv4}, 0x1c) openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000b80)="2e2f6367726f75702f73797a3100b8458a1392623c2acc07743172c163cfc71523709c3289acba6eaf2919f32ebaa4cbe89ed30167d7d56e8e65c0edbb300c9e287f10f513e776522729d5c85c09fed3f33ea055b94d27bb72a2bb9fd56015f25cf4f9ced65ed81253cfba08e9a329935ac0c64d10a5e701cc58fe4af8cb5b679468e8ad39e103e2d5b7d9078c34eb2832a5852b28958b7efeca8ffc69c09a7ca33d82e59f9e27ea25a7cf5e65bc52987952070ddac3929791a23f905fbd72419d1539", 0x200002, 0x0) fchdir(r1) r5 = creat(&(0x7f00000005c0)='./bus\x00', 0x0) r6 = open(&(0x7f0000000540)='./bus\x00', 0x141042, 0x0) sigaltstack(&(0x7f0000ffe000/0x1000)=nil, &(0x7f0000000480)) write$selinux_context(r6, &(0x7f0000000000)='system_u:object_r:crontab_exec_t:s0\x00', 0xfffffffffffffe84) r7 = creat(&(0x7f00000003c0)='./bus\x00', 0x2) r8 = openat$null(0xffffffffffffff9c, &(0x7f00000004c0)='/dev/null\x00', 0x2807fd, 0x0) write(r8, &(0x7f0000000380), 0x0) write$cgroup_type(r5, &(0x7f0000000200)='threaded\x00', 0xfffffeb3) select(0x40, &(0x7f0000000040), &(0x7f0000000080), &(0x7f00000001c0), &(0x7f0000000280)={0x77359400}) getsockopt$IP6T_SO_GET_ENTRIES(r0, 0x29, 0x41, &(0x7f0000000c80)=ANY=[@ANYBLOB="73656375726974796d0000000000000000000000000000000000000000000000c40000004e8b4b1c7fa37c911d43b7dfc1540065e2cf063a33e71b903574450eb6fcc611bb94c232461f22877f4a6bfa2e09f7f448f8a2ef823ff78d796ab6ab52f030b8fea1243b4a37836d690100843a8998fea04a2bc474078acbb61c426c93824178b70a4bcff2d634050eca0d4f941bfec0542fd99b2bd8823b4175d0b0e455f170e292c18a967fdc58383f9af93bc9c8b8578b5ed8ba7d2084ab94919aea43e1a3acfd6d899d943862ca8d84436629d2159976a615f1279aaf23ce57319edb9be03d5b849777d956c09bcb8bc5eb1d793fe7b7d0c34d4d6cc6d28cb9f66b0a2f31eda0ce948210375abcde9320750390dc04b3af4959443184210eb68c4fe6dced7e44cd2b39f7d25dc53dab0fd596852191868741cecd379b6e87b1c1a8c0dc6b8004595fb61135ed10927d6df243071d53b4757c13f4ceb4480e4a7b9c730be6258db763d9e9e7baeccd140ed2311fd9c570db36e93131c27442990068d315088680ab638288fb05b1676a9ab2fe9aa99539a1cfbb1ae8b35cd18007ba5105ed92f8914bcc2397da080dd1da393ede4f195953f82d03b9a920391ee4f5bd7485d69e1d8bfc93521ea451a20dd056bd3c133aa93c9bef1e254ad7d19379b21be984d93cc7cfcbffc82708aebe5fe4c4aa7af905248de89163041c16cfdaf96ee5b65715c7bb840274ba8ddc979ae077aa20b5ba0e97ecd80abb2d3cdb2d2b6603b3a003871b7220d71909f230fa5e9a7307c10c954a2ff1c6bf5fe3e153c0ebeb4940c365ef1e9cc8588a51bfc9807e866ea6528a77c930c06eb50e3f14ca8abf929570c05ca0615211cdcce3d034946d4fadcc9df5702fca33cb322c27a54fee8cd7901df1066311b737259dfc65048bcff6eca8f566ed75b5d21b58a3c51907ba6d5ef9e04e24febdea1d345b16288065bf64cf9fa3a746185191dc7b2f4520fd2da2f60434395d6121d7063a6455be070f49e04c8c2fa0da58d878d80a1bf9cc58b6926e3c471cb1e79cb85f6ce2ad91ac6c68f955a507ad55f514d131e0a095329227c9888f9fb19bfe6df77dff07ef08544a33e9f10d72e3ca6a0d70bf0d4b3e607a2238db2aa9c1011d0af4a39786e48004427b8b55fcd1f7ad63a9aa5338475975159310e0e40000000000000000000000000000000000000000000000000000"], &(0x7f00000002c0)=0x1) recvfrom$inet6(r2, &(0x7f0000001840)=""/31, 0xfffffe0e, 0x100, &(0x7f0000001880)={0xa, 0x0, 0xffff}, 0x1c) getsockopt$inet_mreqn(r7, 0x0, 0x23, &(0x7f0000000500)={@multicast1, @multicast1, 0x0}, &(0x7f0000000440)=0xc) setsockopt$inet6_IPV6_PKTINFO(r5, 0x29, 0x32, &(0x7f0000000580)={@remote, r9}, 0x14) sendto$inet6(0xffffffffffffffff, &(0x7f00000000c0), 0xfffffffffffffe2b, 0x0, 0x0, 0x0) 20:30:31 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$FS_IOC_SETVERSION(r0, 0x40087602, &(0x7f00000001c0)) r1 = syz_open_dev$binder(&(0x7f0000000640)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000000)=[@enter_looper], 0x1, 0x0, &(0x7f0000000040)='+'}) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0x0, 0x0, &(0x7f0000000780)}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000380)={0x8, 0x0, &(0x7f0000000500)=[@release], 0x0, 0x0, &(0x7f0000000400)}) 20:30:31 executing program 5: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) recvmmsg(r0, &(0x7f00000013c0), 0x1ad, 0x0, &(0x7f0000000c40)={0x77359400}) [ 386.026310] binder: release 17110:17116 transaction 362 out, still active [ 386.041600] binder: send failed reply for transaction 362, target dead [ 386.089628] binder: 17142:17145 ioctl 40087602 200001c0 returned -22 20:30:32 executing program 4: r0 = socket$inet(0x2, 0x0, 0x0) setsockopt$inet_opts(r0, 0x0, 0x0, &(0x7f00000000c0)="8907", 0x2) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) r3 = memfd_create(&(0x7f0000000280)='[\'posix_acl_access\x00', 0x0) pwritev(r3, &(0x7f00000001c0)=[{&(0x7f0000000200)=',', 0x1}], 0x1, 0x4081806) sendfile(r1, r3, &(0x7f00000000c0), 0x20020102000007) pipe(&(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$TIOCEXCL(0xffffffffffffffff, 0x540c) write(r5, &(0x7f00000001c0), 0xfffffef3) vmsplice(r4, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) fstat(r3, &(0x7f0000000b40)) ioctl$TIOCGPGRP(0xffffffffffffffff, 0x540f, &(0x7f0000000cc0)) getsockopt$inet6_IPV6_IPSEC_POLICY(0xffffffffffffffff, 0x29, 0x22, &(0x7f00000010c0)={{{@in6=@mcast2, @in=@remote}}, {{@in6=@local}, 0x0, @in6=@loopback}}, &(0x7f00000011c0)=0xe8) recvfrom$unix(r2, &(0x7f0000000040)=""/4, 0xebc3276d6d4b1cd2, 0x100100, &(0x7f0000000100)=@abs, 0x930000) 20:30:32 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$FS_IOC_SETVERSION(r0, 0x40087602, &(0x7f00000001c0)) r1 = syz_open_dev$binder(&(0x7f0000000640)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) r2 = openat$zero(0xffffffffffffff9c, &(0x7f0000000080)='/dev/zero\x00', 0x2, 0x0) write$P9_RWSTAT(r2, &(0x7f00000000c0)={0x7, 0x7f, 0x1}, 0x7) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000000)=[@enter_looper], 0x1, 0x0, &(0x7f0000000040)='+'}) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0x0, 0x0, &(0x7f0000000780)}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000380)={0x8, 0x0, &(0x7f0000000500)=[@release={0x40046306, 0x1}], 0x0, 0x0, &(0x7f0000000400)}) [ 386.175865] binder: 17142:17147 Release 1 refcount change on invalid ref 0 ret -22 [ 386.236374] binder: 17153:17154 ioctl 40087602 200001c0 returned -22 [ 386.290145] binder: BINDER_SET_CONTEXT_MGR already set [ 386.295662] binder: 17153:17156 ioctl 40046207 0 returned -16 [ 386.303205] binder: 17153:17156 Release 1 refcount change on invalid ref 1 ret -22 20:30:32 executing program 3: r0 = openat(0xffffffffffffff9c, &(0x7f00000001c0)='./file0\x00', 0x82, 0x10) setsockopt$inet6_tcp_TCP_CONGESTION(r0, 0x6, 0xd, &(0x7f0000000280)='veno\x00', 0x5) r1 = openat$selinux_avc_cache_stats(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/avc/cache_stats\x00', 0x0, 0x0) getsockopt$inet6_mtu(r1, 0x29, 0x17, &(0x7f00000002c0), &(0x7f0000000300)=0x4) r2 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000080)='IPVS\x00') sendmsg$IPVS_CMD_DEL_SERVICE(r1, &(0x7f0000000240)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x80000000}, 0xc, &(0x7f0000000200)={&(0x7f00000000c0)=ANY=[@ANYBLOB="04010000", @ANYRES16=r2, @ANYBLOB="20002abd7000ffdbdf250300000048000300080007004e220000080001000300000008000300010000001400060000000000000000000000ffffe0000001080007004e24000008000abe9ceef7b4530808000400000054000300080003000100000008000500ac1414bb080003000200000008000500ac1414bb080003000102000008000400010000000800080004000000080007004e200000080008000100000008000500ac1414bb08000400f9de205108000400090007001100000004000000080009004700000014000300000000000000000000fb000000000000080001000a00000008000200ae000000"], 0x104}, 0x1, 0x0, 0x0, 0x8000}, 0x4000) r3 = socket$inet(0x2, 0x4000000000000001, 0x0) setsockopt$inet_tcp_TCP_CONGESTION(r3, 0x6, 0xd, &(0x7f0000000680)='reno\x00', 0x60c5) sendto$inet(r3, &(0x7f0000a88f88), 0xfffffffffffffe6e, 0x20000000, &(0x7f0000e68000)={0x2, 0x0, @local}, 0x10) iopl(0x1) 20:30:32 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$FS_IOC_SETVERSION(r0, 0x40087602, &(0x7f00000001c0)) r1 = syz_open_dev$binder(&(0x7f0000000640)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000000)=[@enter_looper], 0x1, 0x0, &(0x7f0000000040)='+'}) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0x0, 0x0, &(0x7f0000000780)}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000380)={0x8, 0x0, &(0x7f0000000500)=[@release], 0x0, 0x0, &(0x7f0000000400)}) 20:30:32 executing program 0: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r0, &(0x7f0000000100)={0xa, 0x4e22, 0x0, @empty, 0x4}, 0x1c) writev(0xffffffffffffffff, &(0x7f0000002980), 0x0) r1 = socket$inet6(0x10, 0x3, 0x0) sendmsg(r1, &(0x7f0000002fc8)={&(0x7f0000000000)=@nl, 0x80, &(0x7f0000002000)=[{&(0x7f0000000340)="5500000018007f5300fe01b2a4a280930a06000000a84308910000003900090008000c00010000001900150006000000000000dc1338d54400009b84136ef75afb83de448daa7227c43ab8220000060cec4fab6513", 0x55}], 0x1, &(0x7f0000000400), 0x0, 0x4}, 0x0) ioctl$EXT4_IOC_GROUP_EXTEND(0xffffffffffffffff, 0x40046607, &(0x7f0000000400)) listen(r0, 0x7c) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) mkdirat$cgroup(0xffffffffffffffff, &(0x7f0000000140)='syz1\x00', 0x1ff) r3 = memfd_create(&(0x7f0000000180)="0004003100", 0x0) ioctl$sock_SIOCGPGRP(r3, 0x8904, &(0x7f00000000c0)=0x0) syz_open_procfs(r4, &(0x7f0000000300)='net/ip_tables_names\x00') write$P9_RFSYNC(r3, &(0x7f0000000240)={0x7, 0x33, 0x1}, 0xfffffffffffffe2d) sendto$inet6(r2, &(0x7f0000000380), 0x0, 0x20000004, &(0x7f000031e000)={0xa, 0x4e22, 0x0, @ipv4}, 0x1c) openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000b80)="2e2f6367726f75702f73797a3100b8458a1392623c2acc07743172c163cfc71523709c3289acba6eaf2919f32ebaa4cbe89ed30167d7d56e8e65c0edbb300c9e287f10f513e776522729d5c85c09fed3f33ea055b94d27bb72a2bb9fd56015f25cf4f9ced65ed81253cfba08e9a329935ac0c64d10a5e701cc58fe4af8cb5b679468e8ad39e103e2d5b7d9078c34eb2832a5852b28958b7efeca8ffc69c09a7ca33d82e59f9e27ea25a7cf5e65bc52987952070ddac3929791a23f905fbd72419d1539", 0x200002, 0x0) fchdir(0xffffffffffffffff) r5 = creat(&(0x7f00000005c0)='./bus\x00', 0x0) r6 = open(&(0x7f0000000540)='./bus\x00', 0x141042, 0x0) sigaltstack(&(0x7f0000ffe000/0x1000)=nil, &(0x7f0000000480)) write$selinux_context(r6, &(0x7f0000000000)='system_u:object_r:crontab_exec_t:s0\x00', 0xfffffffffffffe84) r7 = creat(&(0x7f00000003c0)='./bus\x00', 0x2) r8 = openat$null(0xffffffffffffff9c, &(0x7f00000004c0)='/dev/null\x00', 0x2807fd, 0x0) write(r8, &(0x7f0000000380), 0x0) write$cgroup_type(r5, &(0x7f0000000200)='threaded\x00', 0xfffffeb3) select(0x40, &(0x7f0000000040), &(0x7f0000000080), &(0x7f00000001c0), &(0x7f0000000280)={0x77359400}) getsockopt$IP6T_SO_GET_ENTRIES(r0, 0x29, 0x41, &(0x7f0000000600)=ANY=[@ANYBLOB="73656375726974796d0000000000000000000000000000000000000000000000c40000004e8b4b1c7fa37c911d43b7dfc1540065e2cf063a33e71b903574450eb6fcc611bb94c232461f22877f4a6bfa2e09f7f448f8a2ef823ff78d796ab6ab52f030b8fea1243b4a37836d690100843a8998fea04a2bc474078acbb61c426c93824178b70a4bcff2d634050eca0d4f941bfec0542fd99b2bd8823b4175d0b0e455f170e292c18a967fdc58383f9af93bc9c8b8578b5ed8ba7d2084ab94919aea43e1a3acfd6d899d943862ca8d84436629d2159976a615f1279aaf23ce57319edb9be03d5b849777d956c09bcb8bc5eb1d793fe7b7d0c34d4d6cc6d28cb9f66b0a2f31eda0ce948210375abcde9320750390dc04b3af4959443184210eb68c4fe6dced7e44cd2b39f7d25dc53dab0fd596852191868741cecd379b6e87b1c1a8c0dc6b8004595fb61135ed10927d6df243071d53b4757c13f4ceb4480e4a7b9c730be6258db763d9e9e7baeccd140ed2311fd9c570db36e93131c27442990068d315088680ab638288fb05b1676a9ab2fe9aa99539a1cfbb1ae8b35cd18007ba5105ed92f8914bcc2397da080dd1da393ede4f195953f82d03b9a920391ee4f5bd7485d69e1d8bfc93521ea451a20dd056bd3c133aa93c9bef1e254ad7d19379b21be984d93cc7cfcbffc82708aebe5fe4c4aa7af905248de89163041c16cfdaf96ee5b65715c7bb840274ba8ddc979ae077aa20b5ba0e97ecd80abb2d3cdb2d2b6603b3a003871b7220d71909f230fa5e9a7307c10c954a2ff1c6bf5fe3e153c0ebeb4940c365ef1e9cc8588a51bfc9807e866ea6528a77c930c06eb50e3f14ca8abf929570c05ca0615211cdcce3d034946d4fadcc9df5702fca33cb322c27a54fee8cd7901df1066311b737259dfc65048bcff6eca8f566ed75b5d21b58a3c51907ba6d5ef9e04e24febdea1d345b16288065bf64cf9fa3a746185191dc7b2f4520fd2da2f60434395d6121d7063a6455be070f49e04c8c2fa0da58d878d80a1bf9cc58b6926e3c471cb1e79cb85f6ce2ad91ac6c68f955a507ad55f514d131e0a09532544a33e9f10d72e3ca6a0d70bf0d4b3e607a2238db2aa9c1011d0af4a39786e48004427b8b55fcd1f7ad63a9aa5338475975159310e0e4000000000000000000000000000000000000000000000000000045a211182c1c87fc8ea9b1a2e2817b54e56da4d3b9"], &(0x7f00000002c0)=0x1) recvfrom$inet6(r2, &(0x7f0000001840)=""/31, 0xfffffe0e, 0x100, &(0x7f0000001880)={0xa, 0x0, 0xffff}, 0x1c) getsockopt$inet_mreqn(r7, 0x0, 0x23, &(0x7f0000000500)={@multicast1, @multicast1, 0x0}, &(0x7f0000000440)=0xc) setsockopt$inet6_IPV6_PKTINFO(r5, 0x29, 0x32, &(0x7f0000000580)={@remote, r9}, 0x14) r10 = accept4(r0, 0x0, &(0x7f0000000000)=0xfffffffffffffefa, 0x0) sendto$inet6(r10, &(0x7f00000000c0), 0xfffffffffffffe2b, 0x0, 0x0, 0x0) 20:30:32 executing program 5: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$nl_netfilter(r0, &(0x7f0000000080)={&(0x7f0000000100), 0xc, &(0x7f00000000c0)={&(0x7f0000000140)=ANY=[@ANYBLOB="141c3d3181dfa4042389a50093381112d511884a63d4c3af54d8cf19bc8edb55977af699f4949505d73692641b4c1164f810d38412315222924343066de101ff1b5eaeb1ea8dc27c11881e81480d1206791bacc2dfbd6414acb34e173a5d386f300231fbf4dfa4a63f64aae63e05f80eb2dde19cc161c1b0016956d43884917fbbe73cfd06410b57bd4f0379"], 0x14}}, 0x0) recvmmsg(r0, &(0x7f00000013c0), 0x1ad, 0x0, &(0x7f0000000c40)={0x77359400}) sendmsg$nl_netfilter(r0, &(0x7f00000002c0)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x400019}, 0xc, &(0x7f0000000040)={&(0x7f0000000200)={0x9c, 0x0, 0x8, 0x2, 0x70bd29, 0x25dfdbfd, {0x7}, [@typed={0x8, 0x6, @ipv4=@remote}, @typed={0x4, 0x3c}, @generic="764820e99b6e286806cfeb9c77e76174ce9c3c5743a09f4e855f432d9710def8c48a73d382a2170daaab35b915259d216f9dbc7262fe05dd23ddeaa49da5a1ffcf7a8e89979c727f8be517d644d471403b4218847b09bfac8ab6fa4a6e9564bc045cad665c456eb673100b8f588da3aafef5c07fe38e965c95dc"]}, 0x9c}, 0x1, 0x0, 0x0, 0x8000}, 0x20000000) [ 386.879652] binder: release 17142:17147 transaction 366 out, still active [ 386.896007] binder: send failed reply for transaction 366, target dead [ 386.909506] binder: send failed reply for transaction 369 to 17153:17156 [ 386.918040] binder: 17169:17170 ioctl 40087602 200001c0 returned -22 [ 387.004915] binder: 17169:17179 Release 1 refcount change on invalid ref 0 ret -22 [ 387.037084] binder: 17153:17156 ioctl 40087602 200001c0 returned -22 [ 387.044264] binder: BINDER_SET_CONTEXT_MGR already set 20:30:32 executing program 4: r0 = socket$inet(0x2, 0x0, 0x0) setsockopt$inet_opts(r0, 0x0, 0x0, &(0x7f00000000c0)="8907", 0x2) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) r3 = memfd_create(&(0x7f0000000280)='[\'posix_acl_access\x00', 0x0) pwritev(r3, &(0x7f00000001c0)=[{&(0x7f0000000200)=',', 0x1}], 0x1, 0x4081806) sendfile(r1, r3, &(0x7f00000000c0), 0x20020102000007) pipe(&(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$TIOCEXCL(0xffffffffffffffff, 0x540c) write(r5, &(0x7f00000001c0), 0xfffffef3) vmsplice(r4, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) fstat(r3, &(0x7f0000000b40)) ioctl$TIOCGPGRP(0xffffffffffffffff, 0x540f, &(0x7f0000000cc0)) getsockopt$inet6_IPV6_IPSEC_POLICY(0xffffffffffffffff, 0x29, 0x22, &(0x7f00000010c0)={{{@in6=@mcast2, @in=@remote}}, {{@in6=@local}, 0x0, @in6=@loopback}}, &(0x7f00000011c0)=0xe8) recvfrom$unix(r2, &(0x7f0000000040)=""/4, 0xebc3276d6d4b1cd2, 0x100100, &(0x7f0000000100)=@abs, 0x930000) [ 387.050543] binder: 17153:17180 ioctl 40046207 0 returned -16 20:30:33 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = openat$selinux_commit_pending_bools(0xffffffffffffff9c, &(0x7f0000000080)='/selinux/commit_pending_bools\x00', 0x1, 0x0) getsockopt$packet_buf(r1, 0x107, 0x5, &(0x7f00000000c0)=""/52, &(0x7f0000000100)=0x34) ioctl$FS_IOC_SETVERSION(r0, 0x40087602, &(0x7f00000001c0)) r2 = syz_open_dev$binder(&(0x7f0000000640)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000000)=[@enter_looper], 0x1, 0x0, &(0x7f0000000040)='+'}) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0x0, 0x0, &(0x7f0000000780)}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000380)={0x8, 0x0, &(0x7f0000000500)=[@release={0x40046306, 0x1}], 0x0, 0x0, &(0x7f0000000400)}) [ 387.089891] binder: 17153:17156 BC_INCREFS_DONE node 377 has no pending increfs request [ 387.098138] binder: 17153:17180 Release 1 refcount change on invalid ref 1 ret -22 [ 387.106612] binder: undelivered TRANSACTION_ERROR: 29189 [ 387.118216] binder: release 17153:17181 transaction 376 out, still active [ 387.132386] binder: 17188:17189 ioctl 40087602 200001c0 returned -22 [ 387.134590] binder: unexpected work type, 4, not freed [ 387.134593] binder: undelivered TRANSACTION_COMPLETE [ 387.199057] binder: BINDER_SET_CONTEXT_MGR already set [ 387.204539] binder: 17188:17192 ioctl 40046207 0 returned -16 [ 387.211934] binder: 17188:17192 Release 1 refcount change on invalid ref 1 ret -22 20:30:33 executing program 3: r0 = socket$inet(0x2, 0x4000000000000001, 0x0) setsockopt$inet_tcp_TCP_CONGESTION(r0, 0x6, 0xd, &(0x7f0000000680)='reno\x00', 0x60c5) io_setup(0x4, &(0x7f0000000040)=0x0) clock_gettime(0xffffffffffffffff, &(0x7f00000001c0)={0x0, 0x0}) io_getevents(r1, 0x2, 0xa, &(0x7f0000000080)=[{}, {}, {}, {}, {}, {}, {}, {}, {}, {}], &(0x7f0000000200)={r2, r3+10000000}) setsockopt$inet_tcp_TLS_TX(r0, 0x6, 0x1, &(0x7f0000000000), 0x4) 20:30:33 executing program 3: r0 = socket$inet(0x2, 0x4000000000000001, 0x0) setsockopt$inet_tcp_TCP_CONGESTION(r0, 0x6, 0xd, &(0x7f0000000680)='reno\x00', 0x60c5) sendto$inet(r0, &(0x7f0000a88f88), 0x0, 0x20000000, &(0x7f0000e68000)={0x2, 0x0, @local}, 0x10) 20:30:33 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$FS_IOC_SETVERSION(r0, 0x40087602, &(0x7f00000001c0)) r1 = syz_open_dev$binder(&(0x7f0000000640)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000000)=[@enter_looper], 0x1, 0x0, &(0x7f0000000040)='+'}) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000380)={0x8, 0x0, &(0x7f0000000500)=[@release], 0x0, 0x0, &(0x7f0000000400)}) [ 387.710834] binder: release 17169:17179 transaction 373 out, still active [ 387.718762] binder: send failed reply for transaction 373, target dead [ 387.725875] binder: send failed reply for transaction 376, target dead [ 387.733295] binder: send failed reply for transaction 379 to 17188:17192 [ 387.743867] binder: 17205:17206 ioctl 40087602 200001c0 returned -22 20:30:33 executing program 5: r0 = dup3(0xffffffffffffff9c, 0xffffffffffffff9c, 0x80000) r1 = creat(&(0x7f0000000040)='./file0\x00', 0x100) renameat2(r0, &(0x7f0000000000)='./file0\x00', r1, &(0x7f0000000140)='./file0\x00', 0x6) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$nl_netfilter(r2, &(0x7f0000000080)={&(0x7f0000000100), 0xc, &(0x7f00000000c0)={&(0x7f0000000180)=ANY=[@ANYBLOB="140000000301ffff808f00003d88c83f8a3b0f7b10712dd9b9d500a70000010048397159b4b2d0ab61f04a3afd602191d15c1af406df2ed57caf2991963bedf872b70081ac90bc626961feb447b06b92c9cf918483dd17ca9ef72072a3bc14760da3201b77d5f07b3448be3446ee3a4955f620f183d7abf65eea516c6ad1d3fa10a6ce887464bb244434393fd9022889df71becc74d82dc70a053f7ae38061613c8210d1d1c082eec1f4ea8c06000216aade3702ba0899433c66398a0839d6612324401227f36826847447cc9764c73b27425f8793b9e53ade980149725c20fa501b70fe99469dde078b0ceb62188e1f0100d44b301fca81c0f686bd16814f439a973d2df2d48958db4b01d41b136eed7ed7500f5a4c7f6e0eb7679c4da8bc57882b7116fff47fe187214dd3e05f886836f14431a9d71de743ede0b1bd5f990eb059fefc18defce3f3930d1b5e5cb466590d2fe479d238f43a7e0e67d1af0a9c8b0181d322712963a2b3957da9dd31f2e88eb0490b57dedac7b20ba70587ce713561c84397613b0b47af358c48f83820a301b344"], 0x14}}, 0x0) recvmmsg(r2, &(0x7f00000013c0), 0x1ad, 0x0, &(0x7f0000000c40)={0x77359400}) [ 387.807986] binder: 17205:17209 Release 1 refcount change on invalid ref 0 ret -22 20:30:33 executing program 0: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r0, &(0x7f0000000100)={0xa, 0x4e22, 0x0, @empty, 0x4}, 0x1c) writev(0xffffffffffffffff, &(0x7f0000002980), 0x0) r1 = socket$inet6(0x10, 0x3, 0x0) sendmsg(r1, &(0x7f0000002fc8)={&(0x7f0000000000)=@nl, 0x80, &(0x7f0000002000)=[{&(0x7f0000000340)="5500000018007f5300fe01b2a4a280930a06000000a84308910000003900090008000c00010000001900150006000000000000dc1338d54400009b84136ef75afb83de448daa7227c43ab8220000060cec4fab6513", 0x55}], 0x1, &(0x7f0000000400), 0x0, 0x4}, 0x0) ioctl$EXT4_IOC_GROUP_EXTEND(0xffffffffffffffff, 0x40046607, &(0x7f0000000400)) listen(r0, 0x7c) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) mkdirat$cgroup(0xffffffffffffffff, &(0x7f0000000140)='syz1\x00', 0x1ff) r3 = memfd_create(&(0x7f0000000180)="0004003100", 0x0) ioctl$sock_SIOCGPGRP(r3, 0x8904, &(0x7f00000000c0)=0x0) syz_open_procfs(r4, &(0x7f0000000300)='net/ip_tables_names\x00') write$P9_RFSYNC(r3, &(0x7f0000000240)={0x7, 0x33, 0x1}, 0xfffffffffffffe2d) sendto$inet6(r2, &(0x7f0000000380), 0x0, 0x20000004, &(0x7f000031e000)={0xa, 0x4e22, 0x0, @ipv4}, 0x1c) openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000b80)="2e2f6367726f75702f73797a3100b8458a1392623c2acc07743172c163cfc71523709c3289acba6eaf2919f32ebaa4cbe89ed30167d7d56e8e65c0edbb300c9e287f10f513e776522729d5c85c09fed3f33ea055b94d27bb72a2bb9fd56015f25cf4f9ced65ed81253cfba08e9a329935ac0c64d10a5e701cc58fe4af8cb5b679468e8ad39e103e2d5b7d9078c34eb2832a5852b28958b7efeca8ffc69c09a7ca33d82e59f9e27ea25a7cf5e65bc52987952070ddac3929791a23f905fbd72419d1539", 0x200002, 0x0) fchdir(0xffffffffffffffff) r5 = creat(&(0x7f00000005c0)='./bus\x00', 0x0) r6 = open(&(0x7f0000000540)='./bus\x00', 0x141042, 0x0) sigaltstack(&(0x7f0000ffe000/0x1000)=nil, &(0x7f0000000480)) write$selinux_context(r6, &(0x7f0000000000)='system_u:object_r:crontab_exec_t:s0\x00', 0xfffffffffffffe84) r7 = creat(&(0x7f00000003c0)='./bus\x00', 0x2) r8 = openat$null(0xffffffffffffff9c, &(0x7f00000004c0)='/dev/null\x00', 0x2807fd, 0x0) write(r8, &(0x7f0000000380), 0x0) write$cgroup_type(r5, &(0x7f0000000200)='threaded\x00', 0xfffffeb3) select(0x40, &(0x7f0000000040), &(0x7f0000000080), &(0x7f00000001c0), &(0x7f0000000280)={0x77359400}) getsockopt$IP6T_SO_GET_ENTRIES(r0, 0x29, 0x41, &(0x7f0000000600)=ANY=[@ANYBLOB="73656375726974796d0000000000000000000000000000000000000000000000c40000004e8b4b1c7fa37c911d43b7dfc1540065e2cf063a33e71b903574450eb6fcc611bb94c232461f22877f4a6bfa2e09f7f448f8a2ef823ff78d796ab6ab52f030b8fea1243b4a37836d690100843a8998fca04a2bc474078acbb61c426c93824578b70a4bcff2d634050eca0d4f941bfec0542fd99b2bd8823b4175d0b0e455f170e292c18a967fdc58383f9af93bc9c8b8578b5ed8ba7d2084ab94919aea43e1a3acfd6d899d943862ca8d84436629d2159976a615f1279aaf23ce57319edb9be03d5b849777d956c09bcb8bc5eb1d793fe7b7d0c34d4d6cc6d28cb9f66b0a2f31eda0ce948210375abcde9320750390dc04b3af4959443184210eb68c4fe6dced7e44cd2b39f7d25dc53dab0fd596852191868741cecd379b6e87b1c1a8c0dc6b8004595fb61135ed10927d6df2a9941d53b4757c13f4ceb4480e4a7b9c730be6258db763d9e9e7baeccd140ed2311fd9c570db36e93131c27442990068d315088680ab638288fb05b1676a9ab2fe9aa99539a1cfbb1ae8b35cd18007ba5105ed92f8914bcc2397da080dd1da393ede4fc4c25d7db300ef8e7b57ce48fa90c049195953f82d03b9a920391ee4f5bd7485d69e1d8bfc93521ea451a20dd056bd3c133aa93c9bef1e254ad7d19379b21be984d93cc7cfcbffc82708aebe5fe4c4aa7af905248de89163041c16cfdaf96ee5b65715c7bb840274ba8ddc979ae077aa20b5ba0e97ecd80abb2d3cdb2d2b6603b3a003871b7220d71909f230fa5e9a7307c10c954a2ff1c6bf5fe3e153c0ebeb4940c365ef1e9cc8588a51bfc9807e866ea6528a77c930c06eb50e3f14ca8abf929570c05ca0615211cdcce3d034946d4fadcc9df5702fca33cb322c27a54fee8cd7901df1066311b737259dfc65048bcff6eca8f566ed75b5d21b58a3c51907ba6d5ef9e04e24febdea1d345b16288065bf64cf9fa3a746185191dc7b2f4520fd2da2f60434395d6121d7063a6455be070f49e04c8c2fa0da58d878d80a1bf9cc58bcbe671e471cb1e79cb85f6ce2ad91ac6c68f955a507ad55f514d131e0a095329227c9888f9fb19bfe6df77dff07ef08544a33e9f10d72e3ca6a0df0bf0d4b3e607a2238db2aa9c1011d0af4a39786e48004427b8b55fcd1f7ad63a9aa5338475975159310e0e40000000000000000000086b7e4dcb4aabe173a173c5293336c52981f31321ce7c4a82eb32a36cc39e6f85fccc0d03333fa09cd65f5236970ed4cf0163659f818b3ee218f217eed1519a91ca3c0aea679eadbeab321c0dc6cdb9c5837cf993ed48c38c5abec46b75bfd44fbea5374d2d6e608a93796d515f4e14dc932a98a49965a79ecfa1122bd94cb5fb98d34322bb2eea95c64368fa537f8f9d347aae6c206fe1ab0d5747228b308a2f45f969115b3e7a6f417bdb27d9395a7b526d201e619062c3e88"], &(0x7f00000002c0)=0x1) recvfrom$inet6(r2, &(0x7f0000001840)=""/31, 0xfffffe0e, 0x100, &(0x7f0000001880)={0xa, 0x0, 0xffff}, 0x1c) getsockopt$inet_mreqn(r7, 0x0, 0x23, &(0x7f0000000500)={@multicast1, @multicast1, 0x0}, &(0x7f0000000440)=0xc) setsockopt$inet6_IPV6_PKTINFO(r5, 0x29, 0x32, &(0x7f0000000580)={@remote, r9}, 0x14) r10 = accept4(r0, 0x0, &(0x7f0000000000)=0xfffffffffffffefa, 0x0) sendto$inet6(r10, &(0x7f00000000c0), 0xfffffffffffffe2b, 0x0, 0x0, 0x0) 20:30:33 executing program 4: r0 = socket$inet(0x2, 0x0, 0x0) setsockopt$inet_opts(r0, 0x0, 0x0, &(0x7f00000000c0)="8907", 0x2) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) r3 = memfd_create(&(0x7f0000000280)='[\'posix_acl_access\x00', 0x0) pwritev(r3, &(0x7f00000001c0)=[{&(0x7f0000000200)=',', 0x1}], 0x1, 0x4081806) sendfile(r1, r3, &(0x7f00000000c0), 0x20020102000007) pipe(&(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$TIOCEXCL(0xffffffffffffffff, 0x540c) write(r5, &(0x7f00000001c0), 0xfffffef3) vmsplice(r4, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) fstat(r3, &(0x7f0000000b40)) ioctl$TIOCGPGRP(0xffffffffffffffff, 0x540f, &(0x7f0000000cc0)) recvfrom$unix(r2, &(0x7f0000000040)=""/4, 0xebc3276d6d4b1cd2, 0x100100, &(0x7f0000000100)=@abs, 0x930000) openat$selinux_avc_cache_stats(0xffffffffffffff9c, &(0x7f0000000240)='/selinux/avc/cache_stats\x00', 0x0, 0x0) [ 387.937934] binder: 17188:17192 ioctl 40087602 200001c0 returned -22 [ 387.946454] binder: BINDER_SET_CONTEXT_MGR already set [ 387.952772] binder: 17188:17218 Release 1 refcount change on invalid ref 1 ret -22 [ 387.969332] binder: 17188:17217 ioctl 40046207 0 returned -16 [ 387.978330] binder: release 17188:17218 transaction 386 out, still active 20:30:33 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$FS_IOC_SETVERSION(r0, 0x40087602, &(0x7f00000001c0)) r1 = syz_open_dev$binder(&(0x7f0000000640)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) r2 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ppp\x00', 0x1, 0x0) setsockopt$packet_fanout_data(r2, 0x107, 0x16, &(0x7f0000000100)={0x1, &(0x7f00000000c0)=[{0xfffffffffffffffe, 0xfffffffffffffffc, 0xea, 0x101}]}, 0x10) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000000)=[@enter_looper], 0x1, 0x0, &(0x7f0000000040)='+'}) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB="02000000", @ANYRES64=0x0, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00'], 0x0, 0x0, &(0x7f0000000780)}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000380)={0x8, 0x0, &(0x7f0000000500)=[@release={0x40046306, 0x1}], 0x0, 0x0, &(0x7f0000000400)}) [ 387.989615] binder: undelivered TRANSACTION_ERROR: 29189 [ 387.997591] binder: 17222:17223 ioctl 40087602 200001c0 returned -22 [ 388.054055] binder: BINDER_SET_CONTEXT_MGR already set [ 388.059595] binder: 17222:17227 ioctl 40046207 0 returned -16 [ 388.066918] binder: 17222:17227 unknown command 2 [ 388.071912] binder: 17222:17227 ioctl c0306201 200002c0 returned -22 [ 388.079308] binder: 17222:17227 Release 1 refcount change on invalid ref 1 ret -22 20:30:34 executing program 3: r0 = socket$inet(0x2, 0x4000000000000001, 0x0) setsockopt$inet_tcp_TCP_CONGESTION(r0, 0x6, 0xd, &(0x7f0000000680)='reno\x00', 0x60c5) r1 = open(&(0x7f00000002c0)='./file0\x00', 0x10402, 0x1b0) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) fsetxattr$security_evm(r2, &(0x7f0000000140)='security.evm\x00', &(0x7f0000000180)=@sha1={0x1, "324f48f3d9c0c16a73d35a17652cba95c81229ce"}, 0x15, 0x2) timerfd_gettime(r1, &(0x7f0000000200)) ioctl$SIOCGIFHWADDR(r1, 0x8927, &(0x7f00000001c0)) getsockopt$inet6_tcp_int(r1, 0x6, 0x2f, &(0x7f00000000c0), &(0x7f0000000100)=0x4) getresuid(&(0x7f0000000240), &(0x7f0000000280)=0x0, &(0x7f0000000480)) setsockopt$inet6_IPV6_XFRM_POLICY(r2, 0x29, 0x23, &(0x7f0000000300)={{{@in=@local, @in6=@loopback, 0x4e21, 0x400, 0x4e23, 0x4, 0xa, 0x20, 0xa0, 0x62, 0x0, r3}, {0x1f, 0x0, 0x1, 0x8c, 0x1, 0x1, 0xffffffff, 0x5}, {0x9, 0x9, 0x3, 0x6}, 0x6, 0x0, 0x2, 0x0, 0x3, 0x3}, {{@in6=@mcast2, 0x4d4, 0x2b}, 0xa, @in=@multicast1, 0x3504, 0x31de77f4fadad7fe, 0x3, 0x8000, 0xcf, 0x8544, 0xffffffff}}, 0xe8) ioctl$sock_inet6_udp_SIOCINQ(r1, 0x541b, &(0x7f0000000080)) sendto$inet(r0, &(0x7f0000a88f88), 0x0, 0x20000000, &(0x7f0000000040)={0x2, 0x0, @multicast1}, 0x10) 20:30:34 executing program 3: r0 = socket$inet(0x2, 0x4000000000000001, 0x0) setsockopt$inet_tcp_TCP_CONGESTION(r0, 0x6, 0xd, &(0x7f0000000680)='reno\x00', 0x60c5) sendto$inet(r0, &(0x7f0000a88f88), 0xfffffffffffffe6e, 0x20000000, &(0x7f0000e68000)={0x2, 0x0, @local}, 0x10) fsync(r0) 20:30:34 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$FS_IOC_SETVERSION(r0, 0x40087602, &(0x7f00000001c0)) r1 = syz_open_dev$binder(&(0x7f0000000640)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000000)=[@enter_looper], 0x1, 0x0, &(0x7f0000000040)='+'}) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000380)={0x8, 0x0, &(0x7f0000000500)=[@release], 0x0, 0x0, &(0x7f0000000400)}) [ 388.544352] binder: release 17205:17209 transaction 383 out, still active [ 388.553556] binder: send failed reply for transaction 383, target dead [ 388.562852] binder: send failed reply for transaction 386, target dead [ 388.572066] binder: send failed reply for transaction 389 to 17222:17227 [ 388.576311] binder: 17244:17245 ioctl 40087602 200001c0 returned -22 20:30:34 executing program 5: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$nl_netfilter(r0, &(0x7f0000000000)={&(0x7f0000000100), 0xc, &(0x7f0000000040)={&(0x7f0000000340)=ANY=[@ANYPTR=&(0x7f0000000140)=ANY=[@ANYPTR]], 0x8}}, 0x0) ioctl$sock_SIOCINQ(r0, 0x541b, &(0x7f00000000c0)) recvmmsg(r0, &(0x7f00000013c0), 0x1ad, 0x0, &(0x7f0000000c40)={0x77359400}) r1 = openat$selinux_status(0xffffffffffffff9c, &(0x7f0000000080)='/selinux/status\x00', 0x0, 0x0) ioctl$EVIOCGKEYCODE_V2(r1, 0x80284504, &(0x7f0000000180)=""/163) [ 388.623367] binder: 17244:17246 Release 1 refcount change on invalid ref 0 ret -22 20:30:34 executing program 0: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r0, &(0x7f0000000100)={0xa, 0x4e22, 0x0, @empty, 0x4}, 0x1c) writev(0xffffffffffffffff, &(0x7f0000002980), 0x0) r1 = socket$inet6(0x10, 0x3, 0x0) sendmsg(r1, &(0x7f0000002fc8)={&(0x7f0000000000)=@nl, 0x80, &(0x7f0000002000)=[{&(0x7f0000000340)="5500000018007f5300fe01b2a4a280930a06000000a84308910000003900090008000c00010000001900150006000000000000dc1338d54400009b84136ef75afb83de448daa7227c43ab8220000060cec4fab6513", 0x55}], 0x1, &(0x7f0000000400), 0x0, 0x4}, 0x0) ioctl$EXT4_IOC_GROUP_EXTEND(0xffffffffffffffff, 0x40046607, &(0x7f0000000400)) listen(r0, 0x7c) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) mkdirat$cgroup(0xffffffffffffffff, &(0x7f0000000140)='syz1\x00', 0x1ff) r3 = memfd_create(&(0x7f0000000180)="0004003100", 0x0) ioctl$sock_SIOCGPGRP(r3, 0x8904, &(0x7f00000000c0)=0x0) syz_open_procfs(r4, &(0x7f0000000300)='net/ip_tables_names\x00') write$P9_RFSYNC(r3, &(0x7f0000000240)={0x7, 0x33, 0x1}, 0xfffffffffffffe2d) sendto$inet6(r2, &(0x7f0000000380), 0x0, 0x20000004, &(0x7f000031e000)={0xa, 0x4e22, 0x0, @ipv4}, 0x1c) openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000b80)="2e2f6367726f75702f73797a3100b8458a1392623c2acc07743172c163cfc71523709c3289acba6eaf2919f32ebaa4cbe89ed30167d7d56e8e65c0edbb300c9e287f10f513e776522729d5c85c09fed3f33ea055b94d27bb72a2bb9fd56015f25cf4f9ced65ed81253cfba08e9a329935ac0c64d10a5e701cc58fe4af8cb5b679468e8ad39e103e2d5b7d9078c34eb2832a5852b28958b7efeca8ffc69c09a7ca33d82e59f9e27ea25a7cf5e65bc52987952070ddac3929791a23f905fbd72419d1539", 0x200002, 0x0) fchdir(0xffffffffffffffff) r5 = creat(&(0x7f00000005c0)='./bus\x00', 0x0) r6 = open(&(0x7f0000000540)='./bus\x00', 0x141042, 0x0) sigaltstack(&(0x7f0000ffe000/0x1000)=nil, &(0x7f0000000480)) write$selinux_context(r6, &(0x7f0000000000)='system_u:object_r:crontab_exec_t:s0\x00', 0xfffffffffffffe84) r7 = creat(&(0x7f00000003c0)='./bus\x00', 0x2) r8 = openat$null(0xffffffffffffff9c, &(0x7f00000004c0)='/dev/null\x00', 0x2807fd, 0x0) write(r8, &(0x7f0000000380), 0x0) write$cgroup_type(r5, &(0x7f0000000200)='threaded\x00', 0xfffffeb3) select(0x40, &(0x7f0000000040), &(0x7f0000000080), &(0x7f00000001c0), &(0x7f0000000280)={0x77359400}) getsockopt$IP6T_SO_GET_ENTRIES(r0, 0x29, 0x41, &(0x7f0000000c80)=ANY=[@ANYBLOB="73656375726974796d0000000000000000000000000000000000000000000000c40000004e8b4b1c7fa37c911d43b7dfc1540065e2cf063a33e71b903574450eb6fcc611bb94c232461f22877f4a6bfa2e09f7f448f8a2ef823ff78d796ab6ab52f030b8fea1243b4a37836d690100843a8998fea04a2bc474078acbb61c426c93824178b70a4bcff2d634050eca0d4f941bfec0542fd99b2bd8823b4175d0b0e455f170e292c18a967fdc58383f9af93bc9c8b8578b5ed8ba7d2084ab94919aea43e1a3acfd6d899d943862ca8d84436629d2159976a615f1279aaf23ce57319edb9be03d5b849777d956c09bcb8bc5eb1d793fe7b7d0c34d4d6cc6d28cb9f66b0a2f31eda0ce948210375abcde9320750390dc04b3af4959443184210eb68c4fe6dced7e44cd2b39f7d25dc53dab0fd596852191868741cecd379b6e87b1c1a8c0dc6b8004595fb61135ed10927d6df243071d53b4757c13f4ceb4480e4a7b9c730be6258db763d9e9e7baeccd140ed2311fd9c570db36e93131c27442990068d315088680ab638288fb05b1676a9ab2fe9aa99539a1cfbb1ae8b35cd18007ba5105ed92f8914bcc2397da080dd1da393ede4f195953f82d03b9a920391ee4f5bd7485d69e1d8bfc93521ea451a20dd056bd3c133aa93c9bef1e254ad7d19379b21be984d93cc7cfcbffc82708aebe5fe4c4aa7af905248de89163041c16cfdaf96ee5b65715c7bb840274ba8ddc979ae077aa20b5ba0e97ecd80abb2d3cdb2d2b6603b3a003871b7220d71909f230fa5e9a7307c10c954a2ff1c6bf5fe3e153c0ebeb4940c365ef1e9cc8588a51bfc9807e866ea6528a77c930c06eb50e3f14ca8abf929570c05ca0615211cdcce3d034946d4fadcc9df5702fca33cb322c27a54fee8cd7901df1066311b737259dfc65048bcff6eca8f566ed75b5d21b58a3c51907ba6d5ef9e04e24febdea1d345b16288065bf64cf9fa3a746185191dc7b2f4520fd2da2f60434395d6121d7063a6455be072f49e04c8c2fa0da58d878d80a1bf9cc58b6926e3c471cb1e79cb85f6ce2ad91ac6c68f955a507ad55f514d131e0a095329227c9888f9fb19bfe6df77dff07ef08544a33e9f10d72e3ca6a0d70bf0d4b3e607a2238db2aa9c1011d0af4a39786e48004427b8b55fcd1f7ad63a9aa5338475975159310e0e40000000000000000000000000000000000000000000000000000d94d9be46c5b6387f2a3f6796e82a0348edb12eb1c1ffaed8af15bc2245346418c068dbf466818f8e2"], &(0x7f00000002c0)=0x1) recvfrom$inet6(r2, &(0x7f0000001840)=""/31, 0xfffffe0e, 0x100, &(0x7f0000001880)={0xa, 0x0, 0xffff}, 0x1c) getsockopt$inet_mreqn(r7, 0x0, 0x23, &(0x7f0000000500)={@multicast1, @multicast1, 0x0}, &(0x7f0000000440)=0xc) setsockopt$inet6_IPV6_PKTINFO(r5, 0x29, 0x32, &(0x7f0000000580)={@remote, r9}, 0x14) r10 = accept4(r0, 0x0, &(0x7f0000000000)=0xfffffffffffffefa, 0x0) sendto$inet6(r10, &(0x7f00000000c0), 0xfffffffffffffe2b, 0x0, 0x0, 0x0) [ 388.798304] binder: 17222:17227 ioctl 40087602 200001c0 returned -22 [ 388.809128] binder: BINDER_SET_CONTEXT_MGR already set [ 388.814710] binder: 17222:17255 ioctl 40046207 0 returned -16 20:30:34 executing program 4: r0 = socket$inet(0x2, 0x0, 0x0) setsockopt$inet_opts(r0, 0x0, 0x0, &(0x7f00000000c0)="8907", 0x2) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) r3 = memfd_create(&(0x7f0000000280)='[\'posix_acl_access\x00', 0x0) pwritev(r3, &(0x7f00000001c0)=[{&(0x7f0000000200)=',', 0x1}], 0x1, 0x4081806) sendfile(r1, r3, &(0x7f00000000c0), 0x20020102000007) pipe(&(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$TIOCEXCL(0xffffffffffffffff, 0x540c) write(r5, &(0x7f00000001c0), 0xfffffef3) vmsplice(r4, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) fstat(r3, &(0x7f0000000b40)) ioctl$TIOCGPGRP(0xffffffffffffffff, 0x540f, &(0x7f0000000cc0)) recvfrom$unix(r2, &(0x7f0000000040)=""/4, 0xebc3276d6d4b1cd2, 0x100100, &(0x7f0000000100)=@abs, 0x930000) openat$selinux_avc_cache_stats(0xffffffffffffff9c, &(0x7f0000000240)='/selinux/avc/cache_stats\x00', 0x0, 0x0) 20:30:34 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$FS_IOC_SETVERSION(r0, 0x40087602, &(0x7f00000001c0)) r1 = syz_open_dev$binder(&(0x7f0000000640)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000000)=[@enter_looper], 0x1, 0x0, &(0x7f0000000040)='+'}) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000018000000000000000800000000000000", @ANYPTR=&(0x7f0000000200)=ANY=[@ANYBLOB="dcff000000000000", @ANYRES64=0x0, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00'], @ANYPTR=&(0x7f0000000240)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00']], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0x0, 0x0, &(0x7f0000000780)}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000380)={0x8, 0x0, &(0x7f0000000500)=[@release={0x40046306, 0x1}], 0x0, 0x0, &(0x7f0000000400)}) [ 388.854896] binder: 17222:17255 Release 1 refcount change on invalid ref 1 ret -22 [ 388.854936] binder: 17222:17227 unknown command 2 [ 388.854943] binder: 17222:17227 ioctl c0306201 200002c0 returned -22 [ 388.884493] binder: undelivered TRANSACTION_ERROR: 29189 [ 388.890265] binder: release 17222:17256 transaction 393 out, still active [ 388.906907] binder: unexpected work type, 4, not freed [ 388.919705] binder: undelivered TRANSACTION_COMPLETE [ 388.933305] binder: 17264:17266 ioctl 40087602 200001c0 returned -22 [ 388.992110] binder: BINDER_SET_CONTEXT_MGR already set [ 388.997600] binder: 17264:17269 ioctl 40046207 0 returned -16 [ 389.004829] binder: 17264:17269 got transaction with invalid offset (0, min 0 max 24) or object. [ 389.014602] binder: 17264:17269 transaction failed 29201/-22, size 24-8 line 3200 [ 389.023313] binder: 17264:17269 BC_INCREFS_DONE u0000000000000000 no match [ 389.030785] binder: 17264:17269 Release 1 refcount change on invalid ref 1 ret -22 20:30:35 executing program 3: r0 = socket$inet(0x2, 0x2, 0x0) setsockopt$inet_tcp_TCP_CONGESTION(r0, 0x6, 0xd, &(0x7f0000000680)='reno\x00', 0x60c5) sendto$inet(r0, &(0x7f0000a88f88), 0xfffffffffffffe6e, 0x20000000, &(0x7f0000e68000)={0x2, 0x0, @local}, 0x10) 20:30:35 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$FS_IOC_SETVERSION(r0, 0x40087602, &(0x7f00000001c0)) r1 = syz_open_dev$binder(&(0x7f0000000640)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000000)=[@enter_looper], 0x1, 0x0, &(0x7f0000000040)='+'}) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000380)={0x8, 0x0, &(0x7f0000000500)=[@release], 0x0, 0x0, &(0x7f0000000400)}) 20:30:35 executing program 3: r0 = socket$inet(0x2, 0x4000000000000001, 0x0) setsockopt$inet_tcp_TCP_CONGESTION(r0, 0x6, 0xd, &(0x7f0000000000)='reno\x00', 0xfffffffffffffe45) sendto$inet(r0, &(0x7f0000a88f88), 0xfffffffffffffe6e, 0x20000000, &(0x7f0000e68000)={0x2, 0x0, @local}, 0x10) getsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x11, &(0x7f0000000040)={{{@in6, @in6=@local}}, {{@in6=@remote}, 0x0, @in6}}, &(0x7f0000000140)=0xe8) [ 389.378067] binder: send failed reply for transaction 393, target dead [ 389.409662] binder: 17283:17284 ioctl 40087602 200001c0 returned -22 20:30:35 executing program 5: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) r1 = openat$full(0xffffffffffffff9c, &(0x7f0000000000)='/dev/full\x00', 0x2402, 0x0) getsockopt$ARPT_SO_GET_ENTRIES(r1, 0x0, 0x61, &(0x7f0000000140)={'filter\x00', 0xab, "e365e594e867e8ef296c0477e680db3e18ed65ce2ecf0d7cdd2c8363eeb9be174af0a6035a83175a16016db72197d232522b783fb0351c2ffa04fae70642e3503cbf4d09cdb2fd532cdfc54399a3e02a230628e5c890243be59dc9e1a6efd6b6eac8e935566cfebb2713380bc05ad6322f62f0819595825915f47c301226dd0b08f821c9b6deefacb7c15630d6b8a27cf1750feead0aff8e262eb7a2513463fb5bd19eb5eb6b9677ba9879"}, &(0x7f0000000040)=0xcf) sendmsg$nl_netfilter(r0, &(0x7f0000000080)={&(0x7f0000000100), 0xc, &(0x7f00000000c0)={&(0x7f0000000340)=ANY=[@ANYBLOB="140000000301ffff808f00003d88c83f00b516ba"], 0x14}}, 0x0) recvmmsg(r0, &(0x7f00000013c0), 0x1ad, 0x0, &(0x7f0000000c40)={0x77359400}) [ 389.463390] binder: 17283:17286 Release 1 refcount change on invalid ref 0 ret -22 20:30:35 executing program 0: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r0, &(0x7f0000000100)={0xa, 0x4e22, 0x0, @empty, 0x4}, 0x1c) writev(0xffffffffffffffff, &(0x7f0000002980), 0x0) r1 = socket$inet6(0x10, 0x3, 0x0) sendmsg(r1, &(0x7f0000002fc8)={&(0x7f0000000000)=@nl, 0x80, &(0x7f0000002000)=[{&(0x7f0000000340)="5500000018007f5300fe01b2a4a280930a06000000a84308910000003900090008000c00010000001900150006000000000000dc1338d54400009b84136ef75afb83de448daa7227c43ab8220000060cec4fab6513", 0x55}], 0x1, &(0x7f0000000400), 0x0, 0x4}, 0x0) ioctl$EXT4_IOC_GROUP_EXTEND(0xffffffffffffffff, 0x40046607, &(0x7f0000000400)) listen(r0, 0x7c) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) mkdirat$cgroup(0xffffffffffffffff, &(0x7f0000000140)='syz1\x00', 0x1ff) r3 = memfd_create(&(0x7f0000000180)="0004003100", 0x0) ioctl$sock_SIOCGPGRP(r3, 0x8904, &(0x7f00000000c0)=0x0) syz_open_procfs(r4, &(0x7f0000000300)='net/ip_tables_names\x00') write$P9_RFSYNC(r3, &(0x7f0000000240)={0x7, 0x33, 0x1}, 0xfffffffffffffe2d) sendto$inet6(r2, &(0x7f0000000380), 0x0, 0x20000004, &(0x7f000031e000)={0xa, 0x4e22, 0x0, @ipv4}, 0x1c) openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000b80)="2e2f6367726f75702f73797a3100b8458a1392623c2acc07743172c163cfc71523709c3289acba6eaf2919f32ebaa4cbe89ed30167d7d56e8e65c0edbb300c9e287f10f513e776522729d5c85c09fed3f33ea055b94d27bb72a2bb9fd56015f25cf4f9ced65ed81253cfba08e9a329935ac0c64d10a5e701cc58fe4af8cb5b679468e8ad39e103e2d5b7d9078c34eb2832a5852b28958b7efeca8ffc69c09a7ca33d82e59f9e27ea25a7cf5e65bc52987952070ddac3929791a23f905fbd72419d1539", 0x200002, 0x0) fchdir(0xffffffffffffffff) r5 = creat(&(0x7f00000005c0)='./bus\x00', 0x0) r6 = open(&(0x7f0000000540)='./bus\x00', 0x141042, 0x0) sigaltstack(&(0x7f0000ffe000/0x1000)=nil, &(0x7f0000000480)) write$selinux_context(r6, &(0x7f0000000000)='system_u:object_r:crontab_exec_t:s0\x00', 0xfffffffffffffe84) r7 = creat(&(0x7f00000003c0)='./bus\x00', 0x2) r8 = openat$null(0xffffffffffffff9c, &(0x7f00000004c0)='/dev/null\x00', 0x2807fd, 0x0) write(r8, &(0x7f0000000380), 0x0) write$cgroup_type(r5, &(0x7f0000000200)='threaded\x00', 0xfffffeb3) select(0x40, &(0x7f0000000040), &(0x7f0000000080), &(0x7f00000001c0), &(0x7f0000000280)={0x77359400}) getsockopt$IP6T_SO_GET_ENTRIES(r0, 0x29, 0x41, &(0x7f0000000600)=ANY=[@ANYBLOB="73656375726974796d0000000000000000000000000000000000000000000000c4ad00004e8b4b1c7fa37c911d43b7dfc1540065e2cf063a33e71b903574450eb6fcc611bb94c232461f22877f4a6bfa2e09f7f448f8a2ef823ff78d796ab6ab52f030b8fea1243b4a37836d690100843a8998fea04a2bc474078acbb61c426c93824178b70a4bcff2d634050eca0d4f941bfec0542fd99b2bd8823b4175d0b0e455f170e292c18a967fdc58383f9af93bc9c8b8578b5ed8ba7d2084ab94919aea43e1a3ac046d899d943862ca8d84436629d2159976a615f1279aaf23ce57319edb9be03d5b849777d956c09bcb8bc5eb1d793fe7b7d0c34d4d6cc6d28cb9f66b0a2f31eda0ce948210375abcde9320750390dc04b3af4959443184210eb68c4fe6dced7e44cd2b39f7d25dc53dab0fd596852191868741cecd379b6e87b1c1a8c0dc6b8004595fb61135ed10927d6df243071d53b4757c13f4ceb4480e4a7b9c730be6258db763d9e9e7baeccd140ed2311fd9c570db36e93131c27442990068d315088680ab638288fb05b1676a9ab2fe9aa99539a1cfbb1ae8b35cd18007ba5105ed92f8914bcc2397da080dd1da393ede4f195953f82d03b9a920391ee4f5bd7485d69e1d8bfc93521ea451a20dd056bd3c8284c9e79bef1e254ad7d19379b21be984d93cc7cfcbffc82708aebe5fe4c4aa7af905248de89163041c16cfdaf96ee5b65715c7bb840274ba8ddc979ae077aa20b5ba0e97ecd80abb2d3cdb2d2b6603b3a003871b7220d71909f230fa5e9a7307c10c954a2ff1c6bf5fe3e153c0ebeb4940c365ef1e9cc9588a51bfc9807e866ea6528a77c930c06eb50e3f14ca8abf929570c05ca0615211cdcce3d034946d4fadcc9df5702fca33cb322c27a54fee8cd7901df1066311b737259dfc65048bcff6eca8f566ed75b5d21b58a3c51907ba6d5ef9e04e24febdea1d345b16288065bf64cf9fa3a746185191dc7b2f4520fd2da2f60434395d6121d7063a6455be070f49e04c8c2fa0da58d878d80a1bf9cc58b6926e3c471cb1e79cb85f6ce2ad91ac6c68f955a507ad55f514d131e0a095329227c9888f9fb19bfe6df77dff07ef08544a33e9f10d72e3ca6a0d70bf0d4b3e607a2238db2aa9c1011d0af4a39786e48004427b8b55fcd1f7ad63a9aa5338475975159310e0e400000000000000000000000000000000000000000000000000002fd92b78e9f48e5a9cb8b2aba9e73af97a8839349db74673014567df92859dbc61384fc23cd74533803c263ff4b749c430675b594e036a72bfbb661713318947cee296674a0fd483a102c8743f68b1e480694fa41eab537c5fb1be31586f8de0594038f6e345b0da6f9c35cec4de533841697896efab116ced4ee97936ae1277c7365fe582d94ec8c480b3ecc0063dced2ebe4f7"], &(0x7f00000002c0)=0x1) recvfrom$inet6(r2, &(0x7f0000001840)=""/31, 0xfffffe0e, 0x100, &(0x7f0000001880)={0xa, 0x0, 0xffff}, 0x1c) getsockopt$inet_mreqn(r7, 0x0, 0x23, &(0x7f0000000500)={@multicast1, @multicast1, 0x0}, &(0x7f0000000440)=0xc) setsockopt$inet6_IPV6_PKTINFO(r5, 0x29, 0x32, &(0x7f0000000580)={@remote, r9}, 0x14) r10 = accept4(r0, 0x0, &(0x7f0000000000)=0xfffffffffffffefa, 0x0) sendto$inet6(r10, &(0x7f00000000c0), 0xfffffffffffffe2b, 0x0, 0x0, 0x0) [ 389.720938] binder: 17264:17269 ioctl 40087602 200001c0 returned -22 [ 389.728598] binder: BINDER_SET_CONTEXT_MGR already set [ 389.728704] binder: 17264:17293 got transaction with invalid offset (0, min 0 max 24) or object. [ 389.728765] binder: 17264:17293 transaction failed 29201/-22, size 24-8 line 3200 [ 389.750689] binder: 17264:17293 BC_INCREFS_DONE u0000000000000000 no match 20:30:35 executing program 4: r0 = socket$inet(0x2, 0x0, 0x0) setsockopt$inet_opts(r0, 0x0, 0x0, &(0x7f00000000c0)="8907", 0x2) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) r3 = memfd_create(&(0x7f0000000280)='[\'posix_acl_access\x00', 0x0) pwritev(r3, &(0x7f00000001c0)=[{&(0x7f0000000200)=',', 0x1}], 0x1, 0x4081806) sendfile(r1, r3, &(0x7f00000000c0), 0x20020102000007) pipe(&(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$TIOCEXCL(0xffffffffffffffff, 0x540c) write(r5, &(0x7f00000001c0), 0xfffffef3) vmsplice(r4, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) fstat(r3, &(0x7f0000000b40)) ioctl$TIOCGPGRP(0xffffffffffffffff, 0x540f, &(0x7f0000000cc0)) recvfrom$unix(r2, &(0x7f0000000040)=""/4, 0xebc3276d6d4b1cd2, 0x100100, &(0x7f0000000100)=@abs, 0x930000) openat$selinux_avc_cache_stats(0xffffffffffffff9c, &(0x7f0000000240)='/selinux/avc/cache_stats\x00', 0x0, 0x0) 20:30:35 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$FS_IOC_SETVERSION(r0, 0x40087602, &(0x7f00000001c0)) r1 = syz_open_dev$binder(&(0x7f0000000640)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000000)=[@enter_looper], 0x1, 0x0, &(0x7f0000000040)='+'}) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$EVIOCGREP(r0, 0x80084503, &(0x7f0000000080)=""/76) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0x0, 0x0, &(0x7f0000000780)}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000380)={0x8, 0x0, &(0x7f0000000500)=[@release={0x40046306, 0x1}], 0x0, 0x0, &(0x7f0000000400)}) [ 389.764914] binder: 17264:17295 Release 1 refcount change on invalid ref 1 ret -22 [ 389.776061] binder: 17264:17269 ioctl 40046207 0 returned -16 [ 389.834417] binder: 17302:17303 ioctl 40087602 200001c0 returned -22 [ 389.889086] binder: BINDER_SET_CONTEXT_MGR already set [ 389.894577] binder: 17302:17307 ioctl 40046207 0 returned -16 [ 389.901491] binder: 17302:17307 ioctl 80084503 20000080 returned -22 [ 389.954300] binder: 17302:17310 BC_INCREFS_DONE node 400 has no pending increfs request [ 389.963354] binder: 17302:17310 Release 1 refcount change on invalid ref 1 ret -22 20:30:36 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$FS_IOC_SETVERSION(r0, 0x40087602, &(0x7f00000001c0)) r1 = syz_open_dev$binder(&(0x7f0000000640)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000000)=[@enter_looper], 0x1, 0x0, &(0x7f0000000040)='+'}) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000380)={0x8, 0x0, &(0x7f0000000500)=[@release], 0x0, 0x0, &(0x7f0000000400)}) 20:30:36 executing program 3: r0 = socket$inet(0x2, 0x4000000000000001, 0x0) setsockopt$inet_tcp_TCP_CONGESTION(r0, 0x6, 0xd, &(0x7f0000000680)='reno\x00', 0x60c5) 20:30:36 executing program 3: r0 = socket$nl_generic(0x10, 0x3, 0x10) getsockname$packet(0xffffffffffffff9c, &(0x7f0000004280)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @random}, &(0x7f00000042c0)=0x14) connect(r0, &(0x7f0000004300)=@hci={0x1f, r1, 0x3}, 0x80) r2 = socket$inet(0x2, 0x4000000000000001, 0x0) r3 = openat$selinux_mls(0xffffffffffffff9c, &(0x7f0000000140)='/selinux/mls\x00', 0x0, 0x0) recvfrom(r0, &(0x7f0000000380)=""/157, 0x9d, 0x2002, 0x0, 0x0) epoll_wait(r3, &(0x7f0000000180), 0x0, 0x3ff) ioctl$sock_inet_SIOCSARP(r3, 0x8955, &(0x7f0000000440)={{0x2, 0x4e21, @remote}, {0x1, @dev={[], 0x1c}}, 0x7e, {0x2, 0x4e21}, 'veth1_to_bond\x00'}) fsetxattr$trusted_overlay_origin(r2, &(0x7f0000000180)='trusted.overlay.origin\x00', &(0x7f00000002c0)='y\x00', 0x2, 0x1) setsockopt$inet_tcp_TCP_CONGESTION(r2, 0x6, 0xd, &(0x7f0000000680)='reno\x00', 0x60c5) ioctl$sock_inet6_tcp_SIOCATMARK(r3, 0x8905, &(0x7f0000000240)) sendto$inet(r2, &(0x7f0000a88f88), 0xfffffffffffffe6e, 0x20000000, &(0x7f0000e68000)={0x2, 0x0, @local}, 0x10) epoll_create1(0x80000) ioctl$sock_inet_SIOCDELRT(r3, 0x890c, &(0x7f0000000300)={0xcd, {0x2, 0x4e24, @multicast1}, {0x2, 0x4e20, @rand_addr=0x8000}, {0x2, 0x4e24, @loopback}, 0x4a, 0xffffffffffffffc1, 0x7597066a, 0x4, 0x7, &(0x7f00000001c0)='nr0\x00', 0x9, 0x7000000000000, 0x52d8}) r4 = dup2(r2, r0) sendto$unix(r4, &(0x7f0000000000)="cf22bb20e6a2b4cda4e3f77d3c0988029dd08dc8387b448d78d05cea456d9f78ecb8062b5130616fb1827b55830e6a2bd1e8a0088a06c73df4ad0e6c0f1b1e487e7b4537712db65207a83adea1fababcc51b22e05614db66deda91e3c05655053290c59e4c040a035d1be76758eebbd9b288234dfc82f27170a5e5680321dfef11fae065bbab510175b5a66842e653aadb0d84", 0x93, 0x4000000, &(0x7f00000000c0)=@abs={0x1, 0x0, 0x4e24}, 0x6e) ioctl$sock_inet6_tcp_SIOCATMARK(r2, 0x8905, &(0x7f0000000200)) [ 390.212481] binder: send failed reply for transaction 399 to 17302:17307 [ 390.232354] binder: 17316:17317 ioctl 40087602 200001c0 returned -22 20:30:36 executing program 5: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$nl_netfilter(r0, &(0x7f0000000080)={&(0x7f0000000100), 0xc, &(0x7f00000000c0)={&(0x7f0000000340)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00'], 0x14}}, 0x0) recvmmsg(r0, &(0x7f00000013c0), 0x1ad, 0x0, &(0x7f0000000c40)={0x77359400}) iopl(0x41) [ 390.289082] binder: 17316:17321 Release 1 refcount change on invalid ref 0 ret -22 [ 390.293382] audit: type=1400 audit(1542313836.200:60): avc: denied { connect } for pid=17322 comm="syz-executor3" scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tclass=netlink_generic_socket permissive=1 20:30:36 executing program 4: r0 = socket$inet(0x2, 0x0, 0x0) setsockopt$inet_opts(r0, 0x0, 0x0, &(0x7f00000000c0)="8907", 0x2) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) r3 = memfd_create(&(0x7f0000000280)='[\'posix_acl_access\x00', 0x0) pwritev(r3, &(0x7f00000001c0)=[{&(0x7f0000000200)=',', 0x1}], 0x1, 0x4081806) sendfile(r1, r3, &(0x7f00000000c0), 0x20020102000007) pipe(&(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$TIOCEXCL(0xffffffffffffffff, 0x540c) write(r5, &(0x7f00000001c0), 0xfffffef3) vmsplice(r4, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) fstat(r3, &(0x7f0000000b40)) getsockopt$inet6_IPV6_IPSEC_POLICY(0xffffffffffffffff, 0x29, 0x22, &(0x7f00000010c0)={{{@in6=@mcast2, @in=@remote}}, {{@in6=@local}, 0x0, @in6=@loopback}}, &(0x7f00000011c0)=0xe8) recvfrom$unix(r2, &(0x7f0000000040)=""/4, 0xebc3276d6d4b1cd2, 0x100100, &(0x7f0000000100)=@abs, 0x930000) openat$selinux_avc_cache_stats(0xffffffffffffff9c, &(0x7f0000000240)='/selinux/avc/cache_stats\x00', 0x0, 0x0) [ 390.635450] binder: 17302:17307 ioctl 40087602 200001c0 returned -22 [ 390.644854] binder: 17302:17310 ioctl 80084503 20000080 returned -22 [ 390.651992] binder: BINDER_SET_CONTEXT_MGR already set [ 390.657564] binder: 17302:17333 BC_INCREFS_DONE u0000000000000000 no match [ 390.669631] binder: 17302:17307 ioctl 40046207 0 returned -16 [ 390.677600] binder: 17302:17333 Release 1 refcount change on invalid ref 1 ret -22 20:30:36 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$FS_IOC_SETVERSION(r0, 0x40087602, &(0x7f00000001c0)=0x3) r1 = syz_open_dev$binder(&(0x7f0000000640)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000000)=[@enter_looper], 0x1, 0x0, &(0x7f0000000040)='+'}) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0x0, 0x0, &(0x7f0000000780)}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000380)={0x8, 0x0, &(0x7f0000000500)=[@release={0x40046306, 0x1}], 0x38, 0x0, &(0x7f0000000400)}) [ 390.686290] binder: release 17302:17310 transaction 403 out, still active [ 390.693414] binder: unexpected work type, 4, not freed [ 390.703417] binder: undelivered TRANSACTION_COMPLETE 20:30:36 executing program 0: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r0, &(0x7f0000000100)={0xa, 0x4e22, 0x0, @empty, 0x4}, 0x1c) writev(0xffffffffffffffff, &(0x7f0000002980), 0x0) r1 = socket$inet6(0x10, 0x3, 0x0) sendmsg(r1, &(0x7f0000002fc8)={&(0x7f0000000000)=@nl, 0x80, &(0x7f0000002000)=[{&(0x7f0000000340)="5500000018007f5300fe01b2a4a280930a06000000a84308910000003900090008000c00010000001900150006000000000000dc1338d54400009b84136ef75afb83de448daa7227c43ab8220000060cec4fab6513", 0x55}], 0x1, &(0x7f0000000400), 0x0, 0x4}, 0x0) ioctl$EXT4_IOC_GROUP_EXTEND(0xffffffffffffffff, 0x40046607, &(0x7f0000000600)) listen(r0, 0x7c) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) mkdirat$cgroup(0xffffffffffffffff, &(0x7f0000000140)='syz1\x00', 0x1ff) r3 = memfd_create(&(0x7f0000000180)="0004003100", 0x0) ioctl$sock_SIOCGPGRP(r3, 0x8904, &(0x7f00000000c0)=0x0) syz_open_procfs(r4, &(0x7f0000000300)='net/ip_tables_names\x00') write$P9_RFSYNC(r3, &(0x7f0000000240)={0x7, 0x33, 0x1}, 0xfffffffffffffe2d) sendto$inet6(r2, &(0x7f0000000380), 0x0, 0x20000004, &(0x7f000031e000)={0xa, 0x4e22, 0x0, @ipv4}, 0x1c) openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000b80)="2e2f6367726f75702f73797a3100b8458a1392623c2acc07743172c163cfc71523709c3289acba6eaf2919f32ebaa4cbe89ed30167d7d56e8e65c0edbb300c9e287f10f513e776522729d5c85c09fed3f33ea055b94d27bb72a2bb9fd56015f25cf4f9ced65ed81253cfba08e9a329935ac0c64d10a5e701cc58fe4af8cb5b679468e8ad39e103e2d5b7d9078c34eb2832a5852b28958b7efeca8ffc69c09a7ca33d82e59f9e27ea25a7cf5e65bc52987952070ddac3929791a23f905fbd72419d1539", 0x200002, 0x0) fchdir(0xffffffffffffffff) r5 = creat(&(0x7f00000005c0)='./bus\x00', 0x8000) r6 = open(&(0x7f0000000540)='./bus\x00', 0x141042, 0x0) sigaltstack(&(0x7f0000ffe000/0x1000)=nil, &(0x7f0000000480)) write$selinux_context(r6, &(0x7f0000000000)='system_u:object_r:crontab_exec_t:s0\x00', 0xfffffffffffffe84) r7 = creat(&(0x7f00000003c0)='./bus\x00', 0x2) r8 = openat$null(0xffffffffffffff9c, &(0x7f00000004c0)='/dev/null\x00', 0x2807fd, 0x0) write(r8, &(0x7f0000000380), 0x0) write$cgroup_type(r5, &(0x7f0000000200)='threaded\x00', 0xfffffeb3) select(0x40, &(0x7f0000000040), &(0x7f0000000080), &(0x7f00000001c0), &(0x7f0000000280)={0x77359400}) getsockopt$IP6T_SO_GET_ENTRIES(r0, 0x29, 0x41, &(0x7f0000000c80)=ANY=[@ANYBLOB="73656375726974796d0000000000000000000000000000000000000000000000c40000004e8b4b1c7fa37c911d43b7dfc1540065e2cf063a33e71b903574450eb6fcc611bb94c232461f22877f4a6bfa2e09f7f448f8a2ef823ff78d796ab6ab52f030b8fea1243b4a37836d690100843a8998fea04a2bc474078acbb61c426c93824178b70a4bcff2d634050eca0d4f941bfec0542fd99b2bd8823b4175d0b0e455f170e292c18a967fdc58383f9af93bc9c8b8578b5ed8ba7d2084ab94919aea43e1a3acfd6d899d943862ca8d84436629d2159976a615f1279aaf23ce57319edb9be03d5b849777d956c09bcb8bc5eb1d793fe7b7d0c34d4d6cc6d28cb9f66b0a2f31eda0ce948210375abcde9320750390dc04b3af4959443184210eb68c4fe6dced7e44cd2b39f7d25dc53dab0fd596852191868741cecd379b6e87b1c1a8c0dc6b8004595fb61135ed10927d6df243071d53b4757c13f4ceb4480e4a7b9c730be6258db763d9e9e7baeccd140ed2311fd9c570db36e93131c27442990068d315088680ab638288fb05b1676a9ab2fe9aa99539a1cfbb1ae8b35cd18007ba5105ed92f8914bcc2397da080dd1da393ede4f195953f82d03b9a920391ee4f5bd7485d69e1d8bfc93521ea451a20dd056bd3c133aa93c9bef1e254ad7d19379b21be984d93cc7cfcbffc82708aebe5fe4c4aa7af905248de89163041c16cfdaf96ee5b65715c7bb840274ba8ddc979ae077aa20b5ba0e97ecd80abb2d3cdb2d2b6603b3a003871b7220d71909f230fa5e9a7307c10c954a2ff1c6bf5fe3e153c0ebeb4940c365ef1e9cc8588a51bfc9807e866ea6528a77c930c06eb50e3f14ca8abf929570c05ca0615211cdcce3d034946d4fadcc9df5702fca33cb322c27a54fee8cd7901df1066311b737259dfc65048bcff6eca8f566ed75b5d21b58a3c51907ba6d5ef9e04e24febdea1d345b16288065bf64cf9fa3a746185191dc7b2f4520fd2da2f60434395d6121d7063a6455be070f49e04c8c2fa0da58d878d80a1bf9cc58b6926e3c471cb1e79cb85f6ce2ad91ac6c68f955a507ad55f514d131e0a095329227c9888f9fb19bfe6df77dff07ef08544a33e9f10d72e3ca6a0d70bf0d4b3e607a2238db2aa9c1011d0af4a39786e48004427b8b55fcd1f7ad63a9aa5338475975159310e0e40000000000000000000000000000000000000000000000000000"], &(0x7f00000002c0)=0x1) recvfrom$inet6(r2, &(0x7f0000001840)=""/31, 0xfffffe0e, 0x100, &(0x7f0000001880)={0xa, 0x0, 0xffff}, 0x1c) getsockopt$inet_mreqn(r7, 0x0, 0x23, &(0x7f0000000500)={@multicast1, @multicast1, 0x0}, &(0x7f0000000440)=0xc) setsockopt$inet6_IPV6_PKTINFO(r5, 0x29, 0x32, &(0x7f0000000580)={@remote, r9}, 0x14) r10 = accept4(r0, 0x0, &(0x7f0000000000)=0xfffffffffffffefa, 0x0) sendto$inet6(r10, &(0x7f00000000c0), 0xfffffffffffffe2b, 0x0, 0x0, 0x0) [ 390.746314] binder: 17341:17342 ioctl 40087602 200001c0 returned -22 [ 390.814985] binder: BINDER_SET_CONTEXT_MGR already set [ 390.820307] binder: 17341:17348 ioctl 40046207 0 returned -16 [ 390.835049] binder: 17341:17348 Release 1 refcount change on invalid ref 1 ret -22 20:30:36 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$FS_IOC_SETVERSION(r0, 0x40087602, &(0x7f00000001c0)) r1 = syz_open_dev$binder(&(0x7f0000000640)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000000)=[@enter_looper], 0x1, 0x0, &(0x7f0000000040)='+'}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000380)={0x8, 0x0, &(0x7f0000000500)=[@release], 0x0, 0x0, &(0x7f0000000400)}) 20:30:37 executing program 3: r0 = socket$inet(0x2, 0x4000000000000001, 0x0) setsockopt$inet_tcp_TCP_CONGESTION(r0, 0x6, 0xd, &(0x7f0000000680)='reno\x00', 0x60c5) ioctl$BLKPBSZGET(0xffffffffffffffff, 0x127b, &(0x7f0000000080)) sendto$inet(r0, &(0x7f0000a88f88), 0x0, 0x20000000, &(0x7f0000000000)={0x2, 0x0, @local}, 0xffffffffffffff9c) [ 391.035675] binder: send failed reply for transaction 403, target dead [ 391.053616] binder: send failed reply for transaction 406 to 17341:17348 [ 391.069755] binder: 17355:17356 ioctl 40087602 200001c0 returned -22 20:30:37 executing program 3: r0 = socket$inet(0x2, 0x4000000000000001, 0x0) setsockopt$inet_tcp_TCP_CONGESTION(r0, 0x6, 0xd, &(0x7f0000000680)='reno\x00', 0x60c5) sendto$inet(r0, &(0x7f0000a88f88), 0x125, 0x84, &(0x7f0000e68000)={0x2, 0x0, @local}, 0x10) 20:30:37 executing program 3: r0 = socket$inet(0x2, 0x4000000000000001, 0x0) setsockopt$inet_tcp_TCP_CONGESTION(r0, 0x6, 0xd, &(0x7f0000000680)='reno\x00', 0x60c5) ftruncate(r0, 0xe33c) sendto$inet(r0, &(0x7f0000a88f88), 0xfffffffffffffe6e, 0x20000000, &(0x7f0000e68000)={0x2, 0x0, @local}, 0x10) read(r0, &(0x7f0000000000)=""/241, 0xf1) [ 391.129671] binder: 17355:17363 transaction failed 29189/-22, size 24-8 line 3014 [ 391.142766] binder: 17355:17363 Release 1 refcount change on invalid ref 0 ret -22 20:30:37 executing program 5: socket$nl_xfrm(0x10, 0x3, 0x6) r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$nl_netfilter(r0, &(0x7f0000000080)={&(0x7f0000000100), 0xc, &(0x7f00000000c0)={&(0x7f0000000340)=ANY=[@ANYBLOB="140000000301ffff808f00003d5d06df26b516ba"], 0x14}}, 0x0) clock_gettime(0x0, &(0x7f0000000040)={0x0, 0x0}) recvmmsg(r0, &(0x7f0000000140), 0x0, 0x10000, &(0x7f0000000000)={r1, r2+10000000}) socket$nl_netfilter(0x10, 0x3, 0xc) 20:30:37 executing program 5: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$nl_netfilter(r0, &(0x7f0000000080)={&(0x7f0000000100), 0xc, &(0x7f00000000c0)={&(0x7f0000000340)=ANY=[@ANYBLOB="1400000008000000000000003d88c83f00b516ba"], 0x14}}, 0x0) recvmmsg(r0, &(0x7f00000013c0), 0x1ad, 0x0, &(0x7f0000000c40)={0x77359400}) 20:30:37 executing program 4: r0 = socket$inet(0x2, 0x0, 0x0) setsockopt$inet_opts(r0, 0x0, 0x0, &(0x7f00000000c0)="8907", 0x2) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) r3 = memfd_create(&(0x7f0000000280)='[\'posix_acl_access\x00', 0x0) pwritev(r3, &(0x7f00000001c0)=[{&(0x7f0000000200)=',', 0x1}], 0x1, 0x4081806) sendfile(r1, r3, &(0x7f00000000c0), 0x20020102000007) pipe(&(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$TIOCEXCL(0xffffffffffffffff, 0x540c) write(r5, &(0x7f00000001c0), 0xfffffef3) vmsplice(r4, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) fstat(r3, &(0x7f0000000b40)) getsockopt$inet6_IPV6_IPSEC_POLICY(0xffffffffffffffff, 0x29, 0x22, &(0x7f00000010c0)={{{@in6=@mcast2, @in=@remote}}, {{@in6=@local}, 0x0, @in6=@loopback}}, &(0x7f00000011c0)=0xe8) recvfrom$unix(r2, &(0x7f0000000040)=""/4, 0xebc3276d6d4b1cd2, 0x100100, &(0x7f0000000100)=@abs, 0x930000) openat$selinux_avc_cache_stats(0xffffffffffffff9c, &(0x7f0000000240)='/selinux/avc/cache_stats\x00', 0x0, 0x0) [ 391.535619] binder: 17341:17384 ioctl 40087602 200001c0 returned -22 20:30:37 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$FS_IOC_SETVERSION(r0, 0x40087602, &(0x7f00000001c0)) r1 = syz_open_dev$binder(&(0x7f0000000640)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000000)=[@enter_looper], 0x1, 0x0, &(0x7f0000000040)='+'}) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000018000000000000000800000000000000", @ANYPTR=&(0x7f0000000200)=ANY=[@ANYBLOB="852a627300000000", @ANYRES64=0x0, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00'], @ANYPTR=&(0x7f0000000080)=ANY=[@ANYBLOB="15754f9c8847727117bf8ab9913985a84620caa377a79e29392d10311e84790c2ee55d970d3af70007b4252dfd534e3b4db6b9e4e15a0e2fcb7cf353ab15664e12552cc72b2c3f244fc503118b69a1cb9039666b25a84ee3bb768a81fbe5b077e0a3a4a415aeb5f57c264e3cedfcff08b53029729982462c03c4e563e9f4591c11daf584d4279b"]], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0x0, 0x0, &(0x7f0000000780)}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000380)={0x8, 0x0, &(0x7f0000000500)=[@release={0x40046306, 0x1}], 0x0, 0x0, &(0x7f0000000400)}) [ 391.591931] binder: release 17341:17386 transaction 411 out, still active [ 391.608856] binder: send failed reply for transaction 411, target dead [ 391.625275] binder: 17389:17390 ioctl 40087602 200001c0 returned -22 [ 391.625340] binder: undelivered TRANSACTION_ERROR: 29189 20:30:37 executing program 0: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r0, &(0x7f0000000100)={0xa, 0x4e22, 0x0, @empty, 0x4}, 0x1c) writev(0xffffffffffffffff, &(0x7f0000002980), 0x0) r1 = socket$inet6(0x10, 0x3, 0x0) sendmsg(r1, &(0x7f0000002fc8)={&(0x7f0000000000)=@nl, 0x80, &(0x7f0000002000)=[{&(0x7f0000000340)="5500000018007f5300fe01b2a4a280930a06000000a84308910000003900090008000c00010000001900150006000000000000dc1338d54400009b84136ef75afb83de448daa7227c43ab8220000060cec4fab6513", 0x55}], 0x1, &(0x7f0000000400), 0x0, 0x4}, 0x0) ioctl$EXT4_IOC_GROUP_EXTEND(0xffffffffffffffff, 0x40046607, &(0x7f0000000400)) listen(r0, 0x7c) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) mkdirat$cgroup(0xffffffffffffffff, &(0x7f0000000140)='syz1\x00', 0x1ff) r3 = memfd_create(&(0x7f0000000180)="0004003100", 0x0) ioctl$sock_SIOCGPGRP(r3, 0x8904, &(0x7f00000000c0)=0x0) syz_open_procfs(r4, &(0x7f0000000300)='net/ip_tables_names\x00') write$P9_RFSYNC(r3, &(0x7f0000000240)={0x7, 0x33, 0x1}, 0xfffffffffffffe2d) sendto$inet6(r2, &(0x7f0000000380), 0x0, 0x20000004, &(0x7f000031e000)={0xa, 0x4e22, 0x0, @ipv4}, 0x1c) openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000b80)="2e2f6367726f75702f73797a3100b8458a1392623c2acc07743172c163cfc71523709c3289acba6eaf2919f32ebaa4cbe89ed30167d7d56e8e65c0edbb300c9e287f10f513e776522729d5c85c09fed3f33ea055b94d27bb72a2bb9fd56015f25cf4f9ced65ed81253cfba08e9a329935ac0c64d10a5e701cc58fe4af8cb5b679468e8ad39e103e2d5b7d9078c34eb2832a5852b28958b7efeca8ffc69c09a7ca33d82e59f9e27ea25a7cf5e65bc52987952070ddac3929791a23f905fbd72419d1539", 0x200002, 0x0) fchdir(0xffffffffffffffff) r5 = creat(&(0x7f00000005c0)='./bus\x00', 0x0) r6 = open(&(0x7f0000000540)='./bus\x00', 0x141042, 0x0) sigaltstack(&(0x7f0000ffe000/0x1000)=nil, &(0x7f0000000480)) write$selinux_context(r6, &(0x7f0000000000)='system_u:object_r:crontab_exec_t:s0\x00', 0xfffffffffffffe84) r7 = creat(&(0x7f00000003c0)='./bus\x00', 0x2) r8 = openat$null(0xffffffffffffff9c, &(0x7f00000004c0)='/dev/null\x00', 0x80000, 0x0) write(r8, &(0x7f0000000380), 0x0) write$cgroup_type(r5, &(0x7f0000000200)='threaded\x00', 0xfffffeb3) select(0x40, &(0x7f0000000040), &(0x7f0000000080), &(0x7f00000001c0), &(0x7f0000000280)={0x77359400}) getsockopt$IP6T_SO_GET_ENTRIES(r0, 0x29, 0x41, &(0x7f0000000600)=ANY=[@ANYBLOB="73656375726974796d0000000000000000000000000000000000000000000000c40000004e8b4b1c7fa37c911d43b7dfc1540065e2cf063a33e71b903574450eb6fcc611bb94c232461f22877f4a6bfa2e09f7f448f8a2ef823ff78d796ab6ab52f030b8fea1243b4a37836d690100843a8998fea04a2bc474078acbb61c426c93824178b70a4bcff2d634050eca0d4f941bfec0542fd99b2bd8823b4175d0b0e455f170e292c18a346a02c3d1db9e8eb933105282efa911967fdc58383f9af93bc9c8b8578b5ed8ba7d2084ab94919aea43e1a3acfd6d899d943862ca8d84436629d2159976a615f1279aaf23ce57319edb9be03d5b849777d956c09bcb8bc5eb1d793fe7b7d0c34d4d6cc6d28cb9f66b0a2f31eda0ce948210375abcde9320750390dc04b3af4959443184210eb68c4fe6dced7e44cd2b39f7d25dc53dab0fd596852191868741cecd379b6e87b1c1a8c0dc6b8004595fb61135ed10927d6df243071d53b4757c13f4ceb4480e4a7b9c730be6258db763d9e9e7baeccd140ed2311fd9c570db36e93131c27442990068d315088680ab63a288fb05b1676a9ab2fe9aa99539a1cfbb1ae8b35cd18007ba5105ed92f8914bcc2397da080dd1da393ede4f195953f82d03b9a920391ee4f5bd7485d69e1d8bfc93521ea451a20dd056bd3c133aa93c9bef1e254ad7d19379b21be984d93cbecfcbffc82708aebe5fe4c4aa7af905248de89163041c16cfdaf96ee5b65715c7bb840274ba8ddc979ae077aa20b5ba0e97ecd80abb2d3cdb2d2b6603b3a003871b7220d71909f230fa5e9a7307c10c954a2ff1c6bf5fe3e153c0ebeb4940c365ef1e9cc8588a51bfc9807e866ea6528a77c930c06eb50e3f14ca8abf929570c05ca0615211cdcce3d034946d4fadcc9df5702fca33cb322c27a54fee8cd7901df1066311b737259dfc65048bcff6eca8f566ed75b5d21b58a3c51907ba6d5ef9e04e24febdea1d345b16288065bf64cf9fa3a746185191dc7b2f4520fd2da2f60434395d6121d7063a6455be070f49e04c8c2fa0da58d878d80a1bf9cc58b6926e3c471ca1e79cb85f6ce2ad91ac6c68f955a507ad55f514d131e0a095329227c9888f9fb19bfe6df77dff07ef08544a33e9f10d72e3ca6a0d70bf0d4b3e607a2238db2aa9c1011d0af4a39786e48004427b8b55fcd1f7ad63a9aa5338475975159310e0e40000000000000000000000000000000000000000000000000000"], &(0x7f00000002c0)=0x1) recvfrom$inet6(r0, &(0x7f0000001840)=""/31, 0x1f, 0x103, &(0x7f0000001880)={0xa, 0x0, 0xffff}, 0x1c) getsockopt$inet_mreqn(r7, 0x0, 0x23, &(0x7f0000000500)={@multicast1, @multicast1, 0x0}, &(0x7f0000000440)=0xc) setsockopt$inet6_IPV6_PKTINFO(r5, 0x29, 0x32, &(0x7f0000000580)={@remote, r9}, 0x14) r10 = accept4(r0, 0x0, &(0x7f0000000000)=0xfffffffffffffefa, 0x0) sendto$inet6(r10, &(0x7f00000000c0), 0xfffffffffffffe2b, 0x0, 0x0, 0x0) [ 391.689163] binder: 17389:17393 got transaction with invalid offset (8174674925694448917, min 0 max 24) or object. [ 391.703493] binder: 17389:17393 transaction failed 29201/-22, size 24-8 line 3200 [ 391.743014] binder: 17389:17395 BC_INCREFS_DONE u0000000000000000 no match [ 391.780565] binder: 17389:17393 Release 1 refcount change on invalid ref 1 ret -22 20:30:37 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$FS_IOC_SETVERSION(r0, 0x40087602, &(0x7f00000001c0)) r1 = syz_open_dev$binder(&(0x7f0000000640)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000000)=[@enter_looper], 0x1, 0x0, &(0x7f0000000040)='+'}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000380)={0x8, 0x0, &(0x7f0000000500)=[@release], 0x0, 0x0, &(0x7f0000000400)}) [ 391.895598] binder: 17400:17403 ioctl 40087602 200001c0 returned -22 [ 391.965012] binder: 17400:17404 Release 1 refcount change on invalid ref 0 ret -22 20:30:37 executing program 3: r0 = perf_event_open$cgroup(&(0x7f00000056c0)={0x0, 0x70, 0x7, 0xcc6, 0x5, 0x12, 0x0, 0xfffffffffffff000, 0x2000, 0x4, 0x2, 0x7, 0x2, 0x7, 0x2, 0x3ff, 0x6d93, 0x1, 0x0, 0x9, 0x53, 0x7fff, 0x7, 0xff, 0x7f, 0x7, 0x195f, 0x8, 0x2, 0x5, 0x5, 0x1, 0x3, 0x20, 0x8001, 0xa18e, 0x87fb, 0x8, 0x0, 0x9, 0x2, @perf_config_ext={0x8}, 0x800, 0xfffffffffffffff8, 0x5, 0x3, 0x6, 0x0, 0x30000000}, 0xffffffffffffffff, 0xf, 0xffffffffffffffff, 0x1) r1 = dup(r0) ioctl$RNDGETENTCNT(r1, 0x80045200, &(0x7f0000000000)) setsockopt$inet_mreq(r1, 0x0, 0x24, &(0x7f0000000240)={@loopback, @loopback}, 0x8) r2 = socket$inet(0x2, 0x4000000000000001, 0x0) getsockopt$inet_IP_IPSEC_POLICY(r2, 0x0, 0x10, &(0x7f00000003c0)={{{@in=@broadcast, @in6}}, {{@in6=@dev}, 0x0, @in=@multicast2}}, &(0x7f0000000200)=0xe8) sendto$inet(r2, &(0x7f0000a88f88), 0xfffffffffffffe6e, 0x20000000, &(0x7f0000e68000)={0x2, 0x0, @local}, 0x10) getsockopt$inet_mreqn(r1, 0x0, 0x20, &(0x7f0000000040)={@multicast1, @broadcast}, &(0x7f0000000080)=0xc) setsockopt$IP_VS_SO_SET_STARTDAEMON(r1, 0x0, 0x48b, &(0x7f00000000c0)={0x0, 'veth1_to_team\x00', 0x1}, 0x18) getsockopt$inet_IP_IPSEC_POLICY(r2, 0x0, 0x10, &(0x7f0000000280)={{{@in6=@mcast2}}, {{@in6=@mcast2}, 0x0, @in6=@remote}}, &(0x7f0000000380)=0xe8) 20:30:38 executing program 5: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) getsockopt$sock_cred(r0, 0x1, 0x11, &(0x7f0000000000)={0x0}, &(0x7f0000000040)=0xc) sched_getscheduler(r1) sendmsg$nl_netfilter(r0, &(0x7f0000000080)={&(0x7f0000000100), 0xc, &(0x7f00000000c0)={&(0x7f0000000340)=ANY=[@ANYBLOB="140000000301ffff808f00003d88c83f00b516ba"], 0x14}}, 0x0) recvmmsg(r0, &(0x7f00000013c0), 0x1ad, 0x0, &(0x7f0000000c40)={0x77359400}) 20:30:38 executing program 4: r0 = socket$inet(0x2, 0x0, 0x0) setsockopt$inet_opts(r0, 0x0, 0x0, &(0x7f00000000c0)="8907", 0x2) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) r3 = memfd_create(&(0x7f0000000280)='[\'posix_acl_access\x00', 0x0) pwritev(r3, &(0x7f00000001c0)=[{&(0x7f0000000200)=',', 0x1}], 0x1, 0x4081806) sendfile(r1, r3, &(0x7f00000000c0), 0x20020102000007) pipe(&(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$TIOCEXCL(0xffffffffffffffff, 0x540c) write(r5, &(0x7f00000001c0), 0xfffffef3) vmsplice(r4, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) fstat(r3, &(0x7f0000000b40)) getsockopt$inet6_IPV6_IPSEC_POLICY(0xffffffffffffffff, 0x29, 0x22, &(0x7f00000010c0)={{{@in6=@mcast2, @in=@remote}}, {{@in6=@local}, 0x0, @in6=@loopback}}, &(0x7f00000011c0)=0xe8) recvfrom$unix(r2, &(0x7f0000000040)=""/4, 0xebc3276d6d4b1cd2, 0x100100, &(0x7f0000000100)=@abs, 0x930000) openat$selinux_avc_cache_stats(0xffffffffffffff9c, &(0x7f0000000240)='/selinux/avc/cache_stats\x00', 0x0, 0x0) [ 392.417122] binder: 17389:17393 ioctl 40087602 200001c0 returned -22 [ 392.424219] binder: BINDER_SET_CONTEXT_MGR already set [ 392.429912] binder: 17389:17393 ioctl 40046207 0 returned -16 [ 392.436469] binder_alloc: 17389: binder_alloc_buf, no vma [ 392.442227] binder: 17389:17395 transaction failed 29189/-3, size 24-8 line 3137 [ 392.450180] binder: 17389:17393 BC_INCREFS_DONE u0000000000000000 no match [ 392.454991] binder: 17389:17395 Release 1 refcount change on invalid ref 1 ret -22 20:30:38 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000640)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000000)=[@enter_looper], 0x1, 0x0, &(0x7f0000000040)='+'}) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) r2 = openat$selinux_avc_cache_threshold(0xffffffffffffff9c, &(0x7f0000000080)='/selinux/avc/cache_threshold\x00', 0x2, 0x0) ioctl$RNDADDENTROPY(r2, 0x40085203, &(0x7f0000000680)={0xfffffffffffffffb, 0xf9, "2345acf72b5aac0a9724e16f3ad3831413e9be6d6f90b1fbe43ba0db4843f786a9bbdfef3f41af5b7fa4b63c2fb5b5093e1c0eac57a6527234490aa448627d0baf7adee104bb98fffd002546426257a8bbff3253dff3c49e71e6f181a4bcec3b70610474b2c28429efa9a98cd4d60d57eb3917bb207c6b15806c3c26fc482a41f51c199498a8d680743be5fb4a294cd4e06e2b51a6b713a3d09a7debaedcf9c3207ae4c676c8ac0fd48bf1e24737588a825f2fc7496ce393e89207e510de81bc71f2eede58ea1e0148a8e12775f07b50d9bc2de7afff50cbc06f973ece2d0247ac7f158ca4370ec7443c6df02994f89b0f251ada1c63afff5d"}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0x0, 0x0, &(0x7f0000000780)}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000380)={0x8, 0x0, &(0x7f0000000500)=[@release={0x40046306, 0x1}], 0x0, 0x0, &(0x7f0000000400)}) [ 392.465006] binder: send failed reply for transaction 416 to 17400:17404 [ 392.540091] binder: 17425:17428 BC_INCREFS_DONE node 422 has no pending increfs request 20:30:38 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$FS_IOC_SETVERSION(r0, 0x40087602, &(0x7f00000001c0)) r1 = syz_open_dev$binder(&(0x7f0000000640)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000000)=[@enter_looper], 0x1, 0x0, &(0x7f0000000040)='+'}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000380)={0x8, 0x0, &(0x7f0000000500)=[@release], 0x0, 0x0, &(0x7f0000000400)}) 20:30:38 executing program 0: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r0, &(0x7f0000000100)={0xa, 0x4e22, 0x0, @empty, 0x4}, 0x1c) writev(0xffffffffffffffff, &(0x7f0000002980), 0x0) r1 = socket$inet6(0x10, 0x3, 0x0) sendmsg(r1, &(0x7f0000002fc8)={&(0x7f0000000000)=@nl, 0x80, &(0x7f0000002000)=[{&(0x7f0000000340)="5500000018007f5300fe01b2a4a280930a06000000a84308910000003900090008000c00010000001900150006000000000000dc1338d54400009b84136ef75afb83de448daa7227c43ab8220000060cec4fab6513", 0x55}], 0x1, &(0x7f0000000400), 0x0, 0x4}, 0x0) ioctl$EXT4_IOC_GROUP_EXTEND(0xffffffffffffffff, 0x40046607, &(0x7f0000000400)) listen(r0, 0x7c) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) mkdirat$cgroup(0xffffffffffffffff, &(0x7f0000000140)='syz1\x00', 0x1ff) r3 = memfd_create(&(0x7f0000000180)="0004003100", 0x0) ioctl$sock_SIOCGPGRP(r3, 0x8904, &(0x7f00000000c0)=0x0) syz_open_procfs(r4, &(0x7f0000000300)='net/ip_tables_names\x00') write$P9_RFSYNC(r3, &(0x7f0000000240)={0x7, 0x33, 0x1}, 0xfffffffffffffe2d) sendto$inet6(r2, &(0x7f0000000380), 0x0, 0x20000004, &(0x7f000031e000)={0xa, 0x4e22, 0x0, @ipv4}, 0x1c) openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000b80)="2e2f6367726f75702f73797a3100b8458a1392623c2acc07743172c163cfc71523709c3289acba6eaf2919f32ebaa4cbe89ed30167d7d56e8e65c0edbb300c9e287f10f513e776522729d5c85c09fed3f33ea055b94d27bb72a2bb9fd56015f25cf4f9ced65ed81253cfba08e9a329935ac0c64d10a5e701cc58fe4af8cb5b679468e8ad39e103e2d5b7d9078c34eb2832a5852b28958b7efeca8ffc69c09a7ca33d82e59f9e27ea25a7cf5e65bc52987952070ddac3929791a23f905fbd72419d1539", 0x200002, 0x0) fchdir(0xffffffffffffffff) r5 = creat(&(0x7f00000005c0)='./bus\x00', 0x0) r6 = open(&(0x7f0000000540)='./bus\x00', 0x141042, 0x0) sigaltstack(&(0x7f0000ffe000/0x1000)=nil, &(0x7f0000000480)) write$selinux_context(r6, &(0x7f0000000000)='system_u:object_r:crontab_exec_t:s0\x00', 0xfffffffffffffe84) r7 = creat(&(0x7f0000000680)='./bus\x00', 0x1) r8 = openat$null(0xffffffffffffff9c, &(0x7f00000004c0)='/dev/null\x00', 0x2807fd, 0x0) write(r8, &(0x7f0000000380), 0x0) write$cgroup_type(r5, &(0x7f0000000200)='threaded\x00', 0xfffffeb3) select(0x40, &(0x7f0000000040), &(0x7f0000000080), &(0x7f00000001c0), &(0x7f0000000280)={0x77359400}) getsockopt$IP6T_SO_GET_ENTRIES(r0, 0x29, 0x41, &(0x7f0000000c80)=ANY=[@ANYBLOB="736563757e0300006d0000000000000000000000000000000000000000000000c40000004e8b4b1c7fa37c911d43b7dfc1540065e2cf063a33e71b903574450eb6fcc611bb94c232461f22877f4a6bfa2e09f7f448f8a2ef823ff78d796ab6ab52f030b8fea1243b4a37836d690100843a8998fea04a2bc474078acbb61c426c93824178b70a4bcff2d634050eca0d4f941bfec0542fd99b2bd8823b4175d0b0e455f170e292c18a967fdc58383f9af93bc9c8b8578b5ed8ba7d2084ab94919aea43e1a3acfd6d899d943862ca8d84436629d215c06121c05f3f584a9976a615f1279aaf23ce57319edb9be03d5b849777d956c09bcb8bc5eb1d793fe7b7d0c34d4d6cc6d28cb9f66b0a2f31eda0ce948210375abcde9320750390dc04b3af4959443184210eb68c4fe6dced7e44cd2b39f7d25dc53dab0fd596852191868741cecd37a4d1a10fec436f8147b8e0019b6e87b1c1a8c0dc6b8004595fb61135ed10927d6df243071d53b4757c13f4ceb4480e4a7b9c730be6258db763d9e9e7baeccd140ed2311fd9c570db36e93131c27442990068d315088680ab638288fb05b1676a9ab2bc287fb539a1cfbb1ae8b35cd18007ba5105ed92f8914bcc2397da080dd1da393ede4f195953f82d03b9a920391ee4f5bd7485d69e1d8bfc93521ea451a20dd056bd3c133aa93c9bef1e254ad7d19379b21be984d93cc7cfcbffc82708aebe5fe4c4aa7af905248de89163041c16cfdaf96ee5b65715c7bb8402745b263b924cc2a322e2ba8ddc979ae077aa20b5ba0e97ecd80abb2d3cdb2d2b6603b3a003871b7220d71909f230fa5e9a7307c10c954a2ff1c6bf5fe3e153c0ebeb4940c365ef1e9cc8588a51bfc9807e866ea6528a77c930c06eb50e6314ca8abf929570c05ca0615211cdcce3d034946d4fadcc9df5702fca33cb322c27a54fee8cd7901df1066311b737259dfc65048bcff6eca8f566ed75b5d21b58a3c51907ba6d5ef9e04e24febdea1d345b16288065bf64cf9fa3a746185191dc7b2f4520fd2da2f60434395d6121d7063a6455be070f49e04c8c2fa0da58d878d80a1bf9cc58b6926e3c471cb1e79cb85f6ce2ad91ac6c68f955a507ad55f514d131e0a095329227c9888f9fb19bfe6df77dff07ef08544a33e9f10d72e3ca6a0d70bf0d4b3e607a2238db2aa9c1011d0af4a39786e48004427b8b55fcd1f7ad63a9aa5338475975159310e0e4000000000000000000000000000000000000c7cfa381714fca4a473af237e0f4a978c31b15e230f61fd977545982a2c6a6ff6c60342440caa3574af480f8b2517517f761e327f9ab60192ee318c6b842361e3e4c215b7fe0c4"], &(0x7f00000002c0)=0x1) recvfrom$inet6(r2, &(0x7f0000001840)=""/31, 0x1f, 0xff, &(0x7f0000001880)={0xa, 0x4e20, 0xffff}, 0x1c) getsockopt$inet_mreqn(r7, 0x0, 0x23, &(0x7f0000000500)={@multicast1, @multicast1, 0x0}, &(0x7f0000000440)=0xc) setsockopt$inet6_IPV6_PKTINFO(r5, 0x29, 0x32, &(0x7f0000000580)={@remote, r9}, 0x14) r10 = accept4(r0, 0x0, &(0x7f0000000000)=0xfffffffffffffefa, 0x0) sendto$inet6(r10, &(0x7f00000000c0), 0xfffffffffffffe2b, 0x0, 0x0, 0x0) [ 392.692076] binder: undelivered TRANSACTION_ERROR: 29189 [ 392.722266] binder: 17435:17436 ioctl 40087602 200001c0 returned -22 [ 392.786403] binder: 17435:17439 Release 1 refcount change on invalid ref 0 ret -22 20:30:38 executing program 3: r0 = socket$inet(0x2, 0x4000000000000003, 0xfffbffffffffffbe) setsockopt$inet_tcp_TCP_CONGESTION(r0, 0x6, 0xd, &(0x7f0000000680)='reno\x00', 0xffffffffffffff61) sendto$inet(r0, &(0x7f0000a88f88), 0x0, 0x20000000, &(0x7f0000e68000)={0x2, 0x0, @remote}, 0x10) 20:30:38 executing program 3: r0 = socket$inet(0x2, 0x4000000000000001, 0x0) execveat(r0, &(0x7f0000000000)='./file0\x00', &(0x7f0000000200)=[&(0x7f0000000040)='\'mime_type\x00', &(0x7f0000000080)='reno\x00', &(0x7f00000000c0)='reno\x00', &(0x7f0000000100)='reno\x00', &(0x7f0000000140)='*wlan0\x00', &(0x7f0000000180)=']\x00', &(0x7f00000001c0)='\x00'], &(0x7f0000000340)=[&(0x7f0000000240)='\x00', &(0x7f0000000280)='reno\x00', &(0x7f00000002c0)='reno\x00', &(0x7f0000000300)='cgroup\x00'], 0x0) getuid() setsockopt$inet_tcp_TCP_CONGESTION(r0, 0x6, 0xd, &(0x7f0000000680)='reno\x00', 0x60c5) sendto$inet(r0, &(0x7f0000000400), 0x0, 0x20000000, &(0x7f0000000440)={0x2, 0x0, @multicast2}, 0x10) setsockopt$sock_timeval(r0, 0x1, 0x15, &(0x7f0000000380)={0x0, 0x7530}, 0x10) 20:30:38 executing program 3: r0 = socket$inet(0x2, 0x3fffffffffffffff, 0xffffffffffffffff) setsockopt$inet_tcp_TCP_CONGESTION(r0, 0x6, 0xd, &(0x7f0000000680)='reno\x00', 0x60c5) ioctl$TIOCGSID(0xffffffffffffff9c, 0x5429, &(0x7f0000000040)=0x0) getsockopt$inet6_IPV6_IPSEC_POLICY(r0, 0x29, 0x22, &(0x7f0000000080)={{{@in=@loopback, @in=@local, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{}, 0x0, @in=@loopback}}, &(0x7f0000000180)=0xe8) lstat(&(0x7f00000001c0)='./file0\x00', &(0x7f0000000200)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) setsockopt$sock_cred(r0, 0x1, 0x11, &(0x7f0000000280)={r1, r2, r3}, 0xc) ioctl$FS_IOC_GET_ENCRYPTION_PWSALT(r0, 0x40106614, &(0x7f0000000000)) sendto$inet(r0, &(0x7f0000a88f88), 0xfffffffffffffe6e, 0x20000000, &(0x7f0000e68000)={0x2, 0x0, @local}, 0x10) 20:30:38 executing program 3: r0 = openat$null(0xffffffffffffff9c, &(0x7f0000000000)='/dev/null\x00', 0xa040, 0x0) ioctl$sock_inet_SIOCRTMSG(r0, 0x890d, &(0x7f0000000080)={0x8000, {0x2, 0x4e22, @multicast2}, {0x2, 0x4e23, @rand_addr=0x80000001}, {0x2, 0x4e23, @multicast2}, 0x4, 0x4, 0x4e, 0x8, 0x6, &(0x7f0000000040)='gretap0\x00', 0x6, 0x4, 0x80}) r1 = socket$inet(0x2, 0x4000000000000101, 0x8) setsockopt$inet_tcp_TCP_CONGESTION(r1, 0x6, 0xd, &(0x7f0000000680)='reno\x00', 0x60c5) sendto$inet(r1, &(0x7f0000a88f88), 0xfffffffffffffe6e, 0x20000000, &(0x7f0000e68000)={0x2, 0x0, @local}, 0x10) 20:30:38 executing program 5: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$nl_netfilter(r0, &(0x7f0000000080)={&(0x7f0000000100), 0xc, &(0x7f00000000c0)={&(0x7f0000000340)=ANY=[@ANYBLOB="140000000301ffff808f00003d88c83f00b516ba"], 0x14}}, 0x0) recvmmsg(r0, &(0x7f00000013c0), 0x1ad, 0x0, &(0x7f0000000c40)={0x77359400}) 20:30:39 executing program 3: r0 = socket$inet(0x2, 0x4000000000000001, 0x0) getsockopt$inet_pktinfo(r0, 0x0, 0x8, &(0x7f0000000000)={0x0, @broadcast, @multicast2}, &(0x7f0000000040)=0xc) getsockopt$sock_cred(r0, 0x1, 0x11, &(0x7f0000000080)={0x0, 0x0}, &(0x7f00000000c0)=0xc) setsockopt$inet_IP_IPSEC_POLICY(r0, 0x0, 0x10, &(0x7f0000000100)={{{@in6=@mcast2, @in=@multicast1, 0x4e21, 0x401, 0x4e20, 0x0, 0xa, 0xa0, 0xa0, 0x2f, r1, r3}, {0x8787, 0x5, 0xfff, 0x9, 0x8000, 0x80000001, 0x1, 0x5}, {0x58, 0x2, 0x2}, 0xc30, 0x0, 0x0, 0x1, 0x0, 0x3}, {{@in=@loopback, 0x4d3, 0x32}, 0x2, @in6, 0x3501, 0x1, 0x0, 0x4, 0x1c77, 0x81, 0x81}}, 0xe8) setsockopt$inet_tcp_TCP_CONGESTION(r0, 0x6, 0xd, &(0x7f0000000680)='reno\x00', 0x60c5) fcntl$setownex(r0, 0xf, &(0x7f0000000200)={0x1, r2}) sendto$inet(r0, &(0x7f0000a88f88), 0xfffffffffffffe6e, 0x20000000, &(0x7f0000e68000)={0x2, 0x0, @local}, 0x10) 20:30:39 executing program 4: r0 = socket$inet(0x2, 0x0, 0x0) setsockopt$inet_opts(r0, 0x0, 0x0, &(0x7f00000000c0)="8907", 0x2) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) r3 = memfd_create(&(0x7f0000000280)='[\'posix_acl_access\x00', 0x0) pwritev(r3, &(0x7f00000001c0)=[{&(0x7f0000000200)=',', 0x1}], 0x1, 0x4081806) sendfile(r1, r3, &(0x7f00000000c0), 0x20020102000007) pipe(&(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$TIOCEXCL(0xffffffffffffffff, 0x540c) write(r5, &(0x7f00000001c0), 0xfffffef3) vmsplice(r4, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) ioctl$TIOCGPGRP(0xffffffffffffffff, 0x540f, &(0x7f0000000cc0)) getsockopt$inet6_IPV6_IPSEC_POLICY(0xffffffffffffffff, 0x29, 0x22, &(0x7f00000010c0)={{{@in6=@mcast2, @in=@remote}}, {{@in6=@local}, 0x0, @in6=@loopback}}, &(0x7f00000011c0)=0xe8) recvfrom$unix(r2, &(0x7f0000000040)=""/4, 0xebc3276d6d4b1cd2, 0x100100, &(0x7f0000000100)=@abs, 0x930000) openat$selinux_avc_cache_stats(0xffffffffffffff9c, &(0x7f0000000240)='/selinux/avc/cache_stats\x00', 0x0, 0x0) [ 393.288074] binder_alloc: binder_alloc_mmap_handler: 17425 20001000-20004000 already mapped failed -16 [ 393.297998] binder: BINDER_SET_CONTEXT_MGR already set [ 393.303431] binder: 17425:17475 ioctl 40046207 0 returned -16 [ 393.310041] binder_alloc: 17425: binder_alloc_buf, no vma [ 393.315763] binder: 17425:17428 transaction failed 29189/-3, size 24-8 line 3137 [ 393.323377] binder: 17425:17475 BC_INCREFS_DONE u0000000000000000 no match 20:30:39 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$FS_IOC_SETVERSION(r0, 0x40087602, &(0x7f00000001c0)) r1 = syz_open_dev$binder(&(0x7f0000000640)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000000)=[@enter_looper], 0x1, 0x0, &(0x7f0000000040)='+'}) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) r2 = openat$selinux_enforce(0xffffffffffffff9c, &(0x7f0000000080)='/selinux/enforce\x00', 0x40000, 0x0) futimesat(r2, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000100)={{0x0, 0x7530}, {0x0, 0x2710}}) setsockopt$inet6_tcp_TCP_REPAIR_OPTIONS(r2, 0x6, 0x16, &(0x7f0000000180)=[{0x4, 0x80}, {0x4, 0x7}, {0x8, 0x6}], 0x3) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000680)=ANY=[@ANYBLOB="45b34c34874b3d6354346cae5b5d0733820ec127a79cd0ba275cda40f5fb0a309eecf5083a46e72dac39bafcbc012ad1558c5068757ca6e33fa5be79b2f7e16ab0983b3ecdc803ce1fb1358d0d7cffa08e825bfadfb9f1fc94f913d523a9ec2948b189a0efdbd87931de1d912357974786d42674cd6e3b4e05db82f9640f1c280c691c3d86c1b50f0dd387898ad0bd349bd42d4d1f0eabe4f58811e4a1bbafe008978ab9dcab8a8045565b24c74e496a9f1f743a69ff0385bbe8c5aa67eb4a5f2847482bb46da1d15fa5d58df1b6e67f0069fa79f31caae01813ca6717361ae1e8d0cce223b16e3bd0e9dde57956a41be98657eabaa75675d69b359b5a907c3a638186bc45be8ebef3dd29f83f1fd44210a137d7497f971acb76c43309a563487818fd1fe283fcd5eb4a714d4892acf18217e36143f919caad8177a8ff84b28021ee45bdb06df490d8e6264998393ff20f45307759f18c40cfdf935220cde01d9eecccda794a9868ad503e3608cb3a12b8c3f2eaa7e10a953796301c77157da4b4d0e2ea91796bbdff3859a767f7b62263ecae77fee79cf959c1ef4b325f85", @ANYRES64=0x0, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00'], 0x0, 0x0, &(0x7f0000000780)}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000380)={0x8, 0x0, &(0x7f0000000500)=[@release={0x40046306, 0x1}], 0x0, 0x0, &(0x7f0000000400)}) [ 393.330843] binder: 17425:17475 Release 1 refcount change on invalid ref 1 ret -22 [ 393.331426] binder: send failed reply for transaction 421 to 17425:17426 [ 393.331445] binder: send failed reply for transaction 424 to 17435:17439 [ 393.339025] binder: undelivered TRANSACTION_COMPLETE [ 393.339041] binder: undelivered TRANSACTION_ERROR: 29189 [ 393.374949] binder: 17477:17478 ioctl 40087602 200001c0 returned -22 [ 393.442673] binder: 17477:17481 unknown command 877441861 [ 393.461654] binder: 17477:17481 ioctl c0306201 200002c0 returned -22 20:30:39 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$FS_IOC_SETVERSION(r0, 0x40087602, &(0x7f00000001c0)) r1 = syz_open_dev$binder(&(0x7f0000000640)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000380)={0x8, 0x0, &(0x7f0000000500)=[@release], 0x0, 0x0, &(0x7f0000000400)}) [ 393.520524] binder: undelivered TRANSACTION_ERROR: 29189 [ 393.541500] binder: 17482:17484 ioctl 40087602 200001c0 returned -22 [ 393.561343] binder: BINDER_SET_CONTEXT_MGR already set [ 393.572977] binder: 17482:17484 ioctl 40046207 0 returned -16 [ 393.633182] binder: 17482:17486 Release 1 refcount change on invalid ref 0 ret -22 20:30:39 executing program 0: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) mkdir(&(0x7f00000002c0)='./file0\x00', 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) mount(&(0x7f0000000000), &(0x7f00000000c0)='./file0\x00', &(0x7f0000000280)='proc\x00', 0x0, &(0x7f00000001c0)) r2 = open$dir(&(0x7f0000000040)='./file0\x00', 0x0, 0x0) getdents64(r2, &(0x7f0000000440)=""/186, 0x5f5) getdents(r2, &(0x7f0000000140)=""/2, 0x450) fcntl$notify(r2, 0x402, 0x1) exit(0x0) getdents64(r2, &(0x7f0000009540)=""/57, 0x39) bind$inet6(r0, &(0x7f0000000100)={0xa, 0x4e22, 0x0, @empty, 0x4}, 0x1c) writev(0xffffffffffffffff, &(0x7f0000002980), 0x0) r3 = socket$inet6(0x10, 0x3, 0x0) sendmsg(r3, &(0x7f0000002fc8)={&(0x7f0000000000)=@nl, 0x80, &(0x7f0000002000)=[{&(0x7f0000000340)="5500000018007f5300fe01b2a4a280930a06000000a84308910000003900090008000c00010000001900150006000000000000dc1338d54400009b84136ef75afb83de448daa7227c43ab8220000060cec4fab6513", 0x55}], 0x1, &(0x7f0000000400), 0x0, 0x4}, 0x0) ioctl$EXT4_IOC_GROUP_EXTEND(0xffffffffffffffff, 0x40046607, &(0x7f0000000400)) listen(r0, 0x7c) r4 = socket$inet6_tcp(0xa, 0x1, 0x0) mkdirat$cgroup(0xffffffffffffffff, &(0x7f0000000140)='syz1\x00', 0x1ff) r5 = memfd_create(&(0x7f0000000180)="0004003100", 0x0) ioctl$sock_SIOCGPGRP(r5, 0x8904, &(0x7f00000000c0)=0x0) syz_open_procfs(r6, &(0x7f0000000300)='net/ip_tables_names\x00') write$P9_RFSYNC(r5, &(0x7f0000000240)={0x7, 0x33, 0x1}, 0xfffffffffffffe2d) sendto$inet6(r4, &(0x7f0000000380), 0x0, 0x20000004, &(0x7f000031e000)={0xa, 0x4e22, 0x0, @ipv4}, 0x1c) openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000b80)="2e2f6367726f75702f73797a3100b8458a1392623c2acc07743172c163cfc71523709c3289acba6eaf2919f32ebaa4cbe89ed30167d7d56e8e65c0edbb300c9e287f10f513e776522729d5c85c09fed3f33ea055b94d27bb72a2bb9fd56015f25cf4f9ced65ed81253cfba08e9a329935ac0c64d10a5e701cc58fe4af8cb5b679468e8ad39e103e2d5b7d9078c34eb2832a5852b28958b7efeca8ffc69c09a7ca33d82e59f9e27ea25a7cf5e65bc52987952070ddac3929791a23f905fbd72419d1539", 0x200002, 0x0) fchdir(0xffffffffffffffff) creat(&(0x7f00000005c0)='./bus\x00', 0x0) r7 = open(&(0x7f0000000540)='./bus\x00', 0x141042, 0x0) sigaltstack(&(0x7f0000ffe000/0x1000)=nil, &(0x7f0000000480)) write$selinux_context(r7, &(0x7f0000000000)='system_u:object_r:crontab_exec_t:s0\x00', 0xfffffffffffffe84) 20:30:39 executing program 5: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$nl_netfilter(r0, &(0x7f0000000080)={&(0x7f0000000100), 0xc, &(0x7f00000000c0)={&(0x7f0000000340)=ANY=[@ANYBLOB="1400010003011200818f00003d88c85d4bbfbc61"], 0x14}}, 0x0) recvmmsg(r0, &(0x7f00000013c0), 0x1ad, 0x0, &(0x7f0000000c40)={0x77359400}) r1 = openat$keychord(0xffffffffffffff9c, &(0x7f0000000000)='/dev/keychord\x00', 0x400800, 0x0) write$P9_RSETATTR(r1, &(0x7f0000000040)={0x7, 0x1b, 0x1}, 0x7) 20:30:39 executing program 3: r0 = socket$inet(0x2, 0x4000000000000001, 0x0) setsockopt$inet_tcp_TCP_CONGESTION(r0, 0x6, 0xd, &(0x7f0000000680)='reno\x00', 0x60c5) sendto$inet(r0, &(0x7f0000a88f88), 0xfffffffffffffe6e, 0x20000000, &(0x7f0000e68000)={0x2, 0x0, @local}, 0x10) pread64(0xffffffffffffffff, &(0x7f0000000000)=""/107, 0x6b, 0x0) 20:30:39 executing program 4: r0 = socket$inet(0x2, 0x0, 0x0) setsockopt$inet_opts(r0, 0x0, 0x0, &(0x7f00000000c0)="8907", 0x2) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) r3 = memfd_create(&(0x7f0000000280)='[\'posix_acl_access\x00', 0x0) pwritev(r3, &(0x7f00000001c0)=[{&(0x7f0000000200)=',', 0x1}], 0x1, 0x4081806) sendfile(r1, r3, &(0x7f00000000c0), 0x20020102000007) pipe(&(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$TIOCEXCL(0xffffffffffffffff, 0x540c) write(r5, &(0x7f00000001c0), 0xfffffef3) vmsplice(r4, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) ioctl$TIOCGPGRP(0xffffffffffffffff, 0x540f, &(0x7f0000000cc0)) getsockopt$inet6_IPV6_IPSEC_POLICY(0xffffffffffffffff, 0x29, 0x22, &(0x7f00000010c0)={{{@in6=@mcast2, @in=@remote}}, {{@in6=@local}, 0x0, @in6=@loopback}}, &(0x7f00000011c0)=0xe8) recvfrom$unix(r2, &(0x7f0000000040)=""/4, 0xebc3276d6d4b1cd2, 0x100100, &(0x7f0000000100)=@abs, 0x930000) openat$selinux_avc_cache_stats(0xffffffffffffff9c, &(0x7f0000000240)='/selinux/avc/cache_stats\x00', 0x0, 0x0) [ 394.176313] binder: 17477:17481 ioctl 40087602 200001c0 returned -22 [ 394.184477] binder: BINDER_SET_CONTEXT_MGR already set [ 394.190159] binder_alloc: 17477: binder_alloc_buf, no vma [ 394.196238] binder: 17477:17513 ioctl 40046207 0 returned -16 [ 394.202469] binder: 17477:17514 transaction failed 29189/-3, size 24-8 line 3137 [ 394.210767] binder: 17477:17513 unknown command 877441861 [ 394.216912] binder: 17477:17513 ioctl c0306201 200002c0 returned -22 20:30:40 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$FS_IOC_SETVERSION(r0, 0x40087602, &(0x7f00000001c0)=0x422) r1 = syz_open_dev$binder(&(0x7f0000000640)='/dev/binder#\x00', 0x0, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_THREAD_EXIT(r0, 0x40046208, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000000)=[@enter_looper], 0x1, 0x0, &(0x7f0000000040)='+'}) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) fsetxattr$security_smack_entry(r1, &(0x7f0000000080)='security.SMACK64\x00', &(0x7f0000000540)="2f6465762f62696e64657223005a59d202fe423901934ffd9ec342bd750f4279af91970d9bb4ef5dc1ff2afaf9046c396d753eb5e0bd6261f88d3e6b710e719d77ce1d69da4770936b8b1aa81870e90f695f7ef9be0fa452430f47e66de006c169a65f251badf9fadaa655637a9d25b54e937452ed5579c869b08a63f293c12b804158bc8be1d415bf32c614e70b3bf209f50b6844145b602488eed4dc54a9cf6ef7e8544d0c21b7597c3addb16ee6b4e4f756b0e647a956b8d9998e53d5c56fdb4bafcad73256953a1d47bfb0d53004351a3e9c67fdf781cc08bfeaf0e6360a46b97e", 0xe3, 0x3) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) r2 = openat$full(0xffffffffffffff9c, &(0x7f0000000100)='/dev/full\x00', 0x0, 0x0) setsockopt$netlink_NETLINK_PKTINFO(r2, 0x10e, 0x3, &(0x7f00000003c0)=0x7, 0xfffffffffffffde2) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0x0, 0x0, &(0x7f0000000780)}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000380)={0x8, 0x0, &(0x7f0000000480)=ANY=[@ANYBLOB="0663040001000000bca911e7ef2bed4c3a54fdcfe1f3d3f0b42635e4c19404c0be4c5d6a814abe036b4095a2624a9d342f96119876952ee27a6ce0420dc46c847088572786aca0851267c90f554ef4"], 0x0, 0x0, &(0x7f0000000400)}) 20:30:40 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$FS_IOC_SETVERSION(r0, 0x40087602, &(0x7f00000001c0)) r1 = syz_open_dev$binder(&(0x7f0000000640)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000380)={0x8, 0x0, &(0x7f0000000500)=[@release], 0x0, 0x0, &(0x7f0000000400)}) [ 394.223866] binder: send failed reply for transaction 429 to 17477:17481 [ 394.235807] binder: send failed reply for transaction 432 to 17482:17484 [ 394.279431] binder: undelivered TRANSACTION_ERROR: 29189 [ 394.288171] binder: 17517:17520 ioctl 40087602 200001c0 returned -22 [ 394.300221] binder: 17518:17521 ioctl 40087602 200001c0 returned -22 [ 394.360431] binder: 17517:17522 Release 1 refcount change on invalid ref 0 ret -22 [ 394.368941] binder: 17518:17523 BC_INCREFS_DONE node 442 has no pending increfs request [ 394.377647] binder: 17518:17523 unknown command 287494 [ 394.383097] binder: 17518:17523 ioctl c0306201 20000380 returned -22 20:30:40 executing program 0: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r0, &(0x7f0000000100)={0xa, 0x4e22, 0x0, @empty, 0x4}, 0x1c) writev(0xffffffffffffffff, &(0x7f0000002980), 0x0) r1 = socket$inet6(0x10, 0x3, 0x0) sendmsg(r1, &(0x7f0000002fc8)={&(0x7f0000000000)=@nl, 0x80, &(0x7f0000002000)=[{&(0x7f0000000340)="5500000018007f5300fe01b2a4a280930a06000000a84308910000003900090008000c00010000001900150006000000000000dc1338d54400009b84136ef75afb83de448daa7227c43ab8220000060cec4fab6513", 0x55}], 0x1, &(0x7f0000000400), 0x0, 0x4}, 0x0) ioctl$EXT4_IOC_GROUP_EXTEND(0xffffffffffffffff, 0x40046607, &(0x7f0000000400)) listen(r0, 0x7c) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) mkdirat$cgroup(0xffffffffffffffff, &(0x7f0000000140)='syz1\x00', 0x1ff) r3 = memfd_create(&(0x7f0000000180)="0004003100", 0x0) ioctl$sock_SIOCGPGRP(r3, 0x8904, &(0x7f00000000c0)=0x0) syz_open_procfs(r4, &(0x7f0000000300)='net/ip_tables_names\x00') write$P9_RFSYNC(r3, &(0x7f0000000240)={0x7, 0x33, 0x1}, 0xfffffffffffffe2d) sendto$inet6(r2, &(0x7f0000000380), 0x0, 0x20000004, &(0x7f000031e000)={0xa, 0x4e22, 0x0, @ipv4}, 0x1c) openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000b80)="2e2f6367726f75702f73797a3100b8458a1392623c2acc07743172c163cfc71523709c3289acba6eaf2919f32ebaa4cbe89ed30167d7d56e8e65c0edbb300c9e287f10f513e776522729d5c85c09fed3f33ea055b94d27bb72a2bb9fd56015f25cf4f9ced65ed81253cfba08e9a329935ac0c64d10a5e701cc58fe4af8cb5b679468e8ad39e103e2d5b7d9078c34eb2832a5852b28958b7efeca8ffc69c09a7ca33d82e59f9e27ea25a7cf5e65bc52987952070ddac3929791a23f905fbd72419d1539", 0x200002, 0x0) fchdir(0xffffffffffffffff) r5 = creat(&(0x7f00000005c0)='./bus\x00', 0x0) r6 = open(&(0x7f0000000540)='./bus\x00', 0x141042, 0x0) sigaltstack(&(0x7f0000ffe000/0x1000)=nil, &(0x7f0000000480)) write$selinux_context(r6, &(0x7f0000000000)='system_u:object_r:crontab_exec_t:s0\x00', 0xfffffffffffffe84) r7 = creat(&(0x7f00000003c0)='./bus\x00', 0x2) r8 = openat$null(0xffffffffffffff9c, &(0x7f00000004c0)='/dev/null\x00', 0x2807fd, 0x0) write(r8, &(0x7f0000000380), 0x0) write$cgroup_type(r5, &(0x7f0000000200)='threaded\x00', 0xfffffeb3) select(0x40, &(0x7f0000000040), &(0x7f0000000080), &(0x7f00000001c0), &(0x7f0000000280)={0x77359400}) getsockopt$IP6T_SO_GET_ENTRIES(r0, 0x29, 0x41, &(0x7f0000000600)=ANY=[@ANYBLOB="73656375726974796d0009000000000000000000000000000000000000000000c40000004e8b4b1c7fa37c911d43b7dfc1540065e2cf063a33e71b903574450eb6fcc611bb94c232461f22877f4a6bfa2e09f7f448f8a2ef823ff78d796ab6ab52f030b8fea1243b4a37836d690100843a8998fea04a2bc474078acbb61c426c93824178b70a4bcff2d634050eca0d4f941bfed8823b4175d0b0e455f170e292c18a967fdc58383f9af93bc9c8b8578b5ed8ba7d2084ab94919aea43e1a3acfd6d899d943862ca8d84436629d2159976a615f1279aaf23ce57319edb9be03d5b849777d956c09bcb8bc5eb1d793fe7b7d0c34d4d6cc6d28cb9f66b0a2f31eda0ce948210375abcde9320750390dc04b3af4959443184210eb68c4fe6dced7e44cd2b39f7d25dc53dab0fd596852191868741cecd379b6e87b1c1a8c0dc6b8004595fb61135ed10927d6df243071d53b4757c13f4ceb4480e4a7b9c730be6258db763d9e9e7baeccd140ed2311fd9c570db36e93131c27442990068d315088680ab638288fb05b1676a9ab2fe9aa99539a1cfbb5105ed92f8914bcc2397da080dd1da393ede4f195953f82d03b9a920391ee4f5bd7485d69e1d8bfc93521ea451a20dd056bd3c133aa93c9bef1e254ad7d19379b21be984d93cc7cfcbffc82708aebe5fe4c4aa7af905248de89163041c16cfdaf96ee5b65715c7bb840274ba8ddc979ae077aa20b5ba0e97ecd80abb2d3cdb2d2b6603b3a003871b7220d71909f230fa5e9a7307c10c954a2ff1c6bf5fe3e153c0ebeb4940c365ef1e9cc8588a51bfc9807e866ea6528a77c930c06eb50e3f14ca8abf929570c05ca0615211cdcce3d034946d4fadcc9df5702fca33cb322c27a54fee8cd7901df1066311b737259dfc65048bcff6eca8f566ed75b5d21b58a3c51907ba6d5ef9e04e24febdea1d345b16288065bf64cf9fa3a7461851912e5ec63720fd2da2f60434395d6121d7063a6455be070f49e04c8c2fa0da58d878d80a1bf9cc58b6926e3c471cb1e79cb85f6ce2ad91ac6c68f955a507ad55f514d131e0a095329227c9888f9fb19bfe6df77dff07ef08544a33e9f10d72e3ca6a0d70bf0d4b3e607a2238db2aa9c1011d0af4a39786e48004427b8b55fcd1f7ad63a9aa5338475975159310e0e40000000000000000000000000000000000000000000000000000939f8a9f33d7a30886b927461c3db3a2676b7aa2c92f4a3f8324de87479a12123ad90abaa11318ff02bd576b434a01bb6b1aa8bfc28f2990393282b28458765e1a74f4798dc23d3f5c988aca6218116435ef98f46213267934f1e886272ca40497649b5244833ac309b3f81f73a13098c72417977593ef2877"], &(0x7f00000002c0)=0x1) recvfrom$inet6(r2, &(0x7f0000001840)=""/31, 0xfffffe0e, 0x100, &(0x7f0000001880)={0xa, 0x0, 0xffff}, 0x1c) getsockopt$inet_mreqn(r7, 0x0, 0x23, &(0x7f0000000500)={@multicast1, @multicast1, 0x0}, &(0x7f0000000440)=0xc) setsockopt$inet6_IPV6_PKTINFO(r5, 0x29, 0x32, &(0x7f0000000580)={@remote, r9}, 0x14) r10 = accept4(r0, 0x0, &(0x7f0000000000)=0xfffffffffffffefa, 0x0) sendto$inet6(r10, &(0x7f00000000c0), 0xfffffffffffffe2b, 0x0, 0x0, 0x0) [ 394.556807] proc: unrecognized mount option "Æ" or missing value 20:30:40 executing program 5: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$nl_netfilter(r0, &(0x7f0000000080)={&(0x7f0000000100), 0xc, &(0x7f00000000c0)={&(0x7f0000000340)=ANY=[@ANYBLOB="14000000031dffff068f00003d88c83f00b516ba"], 0x14}}, 0x0) recvmmsg(r0, &(0x7f00000013c0), 0x1ad, 0x0, &(0x7f0000000c40)={0x77359400}) 20:30:40 executing program 3: r0 = socket$inet(0x2, 0x4000000000000001, 0x0) setsockopt$inet_tcp_TCP_CONGESTION(r0, 0x6, 0xd, &(0x7f0000000680)='reno\x00', 0x60c5) sendto$inet(r0, &(0x7f0000a88f88), 0x0, 0x20000000, &(0x7f0000000040)={0x2, 0x100000000, @local}, 0x10) 20:30:40 executing program 4: r0 = socket$inet(0x2, 0x0, 0x0) setsockopt$inet_opts(r0, 0x0, 0x0, &(0x7f00000000c0)="8907", 0x2) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) r3 = memfd_create(&(0x7f0000000280)='[\'posix_acl_access\x00', 0x0) pwritev(r3, &(0x7f00000001c0)=[{&(0x7f0000000200)=',', 0x1}], 0x1, 0x4081806) sendfile(r1, r3, &(0x7f00000000c0), 0x20020102000007) pipe(&(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$TIOCEXCL(0xffffffffffffffff, 0x540c) write(r5, &(0x7f00000001c0), 0xfffffef3) vmsplice(r4, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) ioctl$TIOCGPGRP(0xffffffffffffffff, 0x540f, &(0x7f0000000cc0)) getsockopt$inet6_IPV6_IPSEC_POLICY(0xffffffffffffffff, 0x29, 0x22, &(0x7f00000010c0)={{{@in6=@mcast2, @in=@remote}}, {{@in6=@local}, 0x0, @in6=@loopback}}, &(0x7f00000011c0)=0xe8) recvfrom$unix(r2, &(0x7f0000000040)=""/4, 0xebc3276d6d4b1cd2, 0x100100, &(0x7f0000000100)=@abs, 0x930000) openat$selinux_avc_cache_stats(0xffffffffffffff9c, &(0x7f0000000240)='/selinux/avc/cache_stats\x00', 0x0, 0x0) 20:30:41 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$FS_IOC_SETVERSION(r0, 0x40087602, &(0x7f00000001c0)) r1 = syz_open_dev$binder(&(0x7f0000000640)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000380)={0x8, 0x0, &(0x7f0000000500)=[@release], 0x0, 0x0, &(0x7f0000000400)}) [ 395.080753] binder: release 17517:17520 transaction 437 out, still active [ 395.088403] binder: 17518:17523 ioctl 40087602 200001c0 returned -22 [ 395.089805] binder: unexpected work type, 4, not freed [ 395.089808] binder: undelivered TRANSACTION_COMPLETE [ 395.117406] binder: BINDER_SET_CONTEXT_MGR already set [ 395.122867] binder: send failed reply for transaction 437, target dead [ 395.140454] binder: send failed reply for transaction 441 to 17518:17521 [ 395.155424] binder: 17518:17552 ioctl 40046207 0 returned -16 [ 395.163207] binder: 17518:17523 transaction failed 29189/-22, size 24-8 line 3014 [ 395.174622] binder: 17554:17555 ioctl 40087602 200001c0 returned -22 [ 395.182421] binder_alloc: 17554: binder_alloc_buf, no vma 20:30:41 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = socket$inet_tcp(0x2, 0x1, 0x0) ioctl$sock_inet_SIOCGARP(r1, 0x8954, &(0x7f0000000080)={{0x2, 0x4e22, @local}, {0x7, @random="84881e5acdcd"}, 0x12, {0x2, 0x4e20, @multicast2}, 'veth1\x00'}) poll(&(0x7f0000000480), 0x0, 0x0) ioctl$FS_IOC_SETVERSION(r0, 0x40087602, &(0x7f00000001c0)) r2 = syz_open_dev$binder(&(0x7f0000000640)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000000)=[@enter_looper], 0x1, 0x0, &(0x7f0000000040)='+'}) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) r3 = openat$selinux_status(0xffffffffffffff9c, &(0x7f0000000180)='/selinux/status\x00', 0x0, 0x0) r4 = syz_genetlink_get_family_id$team(&(0x7f0000000400)='team\x00') getsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffff9c, 0x29, 0x23, &(0x7f0000000540)={{{@in=@broadcast, @in6=@mcast2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in=@broadcast}, 0x0, @in6=@remote}}, &(0x7f0000000680)=0xe8) getsockopt$inet6_IPV6_IPSEC_POLICY(0xffffffffffffffff, 0x29, 0x22, &(0x7f0000000740)={{{@in6=@loopback, @in=@remote, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@remote}, 0x0, @in=@remote}}, &(0x7f0000000840)=0xe8) getsockopt$inet_IP_IPSEC_POLICY(r1, 0x0, 0x10, &(0x7f0000000880)={{{@in=@loopback, @in6=@local, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in=@loopback}, 0x0, @in6=@remote}}, &(0x7f0000000980)=0xe8) getsockopt$inet6_mreq(0xffffffffffffffff, 0x29, 0x1f, &(0x7f00000009c0)={@mcast2, 0x0}, &(0x7f0000000a00)=0x14) getsockopt$inet6_mreq(0xffffffffffffffff, 0x29, 0x1f, &(0x7f0000000b00)={@mcast2, 0x0}, &(0x7f0000000b40)=0x14) ioctl$ifreq_SIOCGIFINDEX_team(r1, 0x8933, &(0x7f0000000d80)={'team0\x00', 0x0}) getsockopt$inet_IP_IPSEC_POLICY(r1, 0x0, 0x10, &(0x7f0000000f40)={{{@in=@multicast1, @in=@multicast1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@mcast2}, 0x0, @in6=@loopback}}, &(0x7f0000001040)=0xe8) sendmsg$TEAM_CMD_NOOP(r3, &(0x7f00000012c0)={&(0x7f00000003c0), 0xc, &(0x7f0000001280)={&(0x7f0000001080)={0x1f8, r4, 0x28, 0x70bd26, 0x25dfdbfe, {}, [{{0x8, 0x1, r5}, {0x3c, 0x2, [{0x38, 0x1, @notify_peers_count={{0x24, 0x1, 'notify_peers_count\x00'}, {0x8}, {0x8, 0x4, 0x14}}}]}}, {{0x8, 0x1, r6}, {0x84, 0x2, [{0x40, 0x1, @queue_id={{{0x24, 0x1, 'queue_id\x00'}, {0x8}, {0x8, 0x4, 0x1}}, {0x8, 0x6, r7}}}, {0x40, 0x1, @priority={{{0x24, 0x1, 'priority\x00'}, {0x8}, {0x8, 0x4, 0x100000001}}, {0x8, 0x6, r8}}}]}}, {{0x8, 0x1, r9}, {0x48, 0x2, [{0x44, 0x1, @name={{0x24, 0x1, 'mode\x00'}, {0x8}, {0x14, 0x4, 'activebackup\x00'}}}]}}, {{0x8, 0x1, r10}, {0xbc, 0x2, [{0x38, 0x1, @mcast_rejoin_count={{0x24, 0x1, 'mcast_rejoin_count\x00'}, {0x8}, {0x8, 0x4, 0x28d2}}}, {0x40, 0x1, @lb_hash_stats={{{0x24, 0x1, 'lb_hash_stats\x00'}, {0x8}, {0x8, 0x4, 0x10001}}, {0x8}}}, {0x40, 0x1, @queue_id={{{0x24, 0x1, 'queue_id\x00'}, {0x8}, {0x8, 0x4, 0x1}}, {0x8, 0x6, r11}}}]}}]}, 0x1f8}, 0x1, 0x0, 0x0, 0x855}, 0xc004) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0x0, 0x0, &(0x7f0000000780)}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000380)={0x8, 0x0, &(0x7f0000000500)=[@release={0x40046306, 0x1}], 0x0, 0x0, &(0x7f0000000400)}) ioctl$TIOCGSID(0xffffffffffffff9c, 0x5429, &(0x7f0000000100)=0x0) prctl$setptracer(0x59616d61, r12) [ 395.188350] binder: 17554:17555 transaction failed 29189/-3, size 24-8 line 3137 [ 395.189382] binder: 17518:17521 BC_INCREFS_DONE u0000000000000000 no match [ 395.189428] binder: 17518:17523 unknown command 287494 [ 395.189436] binder: 17518:17523 ioctl c0306201 20000380 returned -22 20:30:41 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$FS_IOC_SETVERSION(r0, 0x40087602, &(0x7f00000001c0)) r1 = syz_open_dev$binder(&(0x7f0000000640)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000380)={0x8, 0x0, &(0x7f0000000500)=[@release], 0x0, 0x0, &(0x7f0000000400)}) [ 395.233573] binder: 17554:17556 Release 1 refcount change on invalid ref 0 ret -22 [ 395.234689] binder: 17557:17558 ioctl 40087602 200001c0 returned -22 [ 395.275145] binder: 17560:17561 ioctl 40087602 200001c0 returned -22 [ 395.290314] binder_alloc: 17560: binder_alloc_buf, no vma [ 395.291390] binder: BINDER_SET_CONTEXT_MGR already set [ 395.291400] binder: 17557:17562 ioctl 40046207 0 returned -16 [ 395.313579] binder_alloc: 17560: binder_alloc_buf, no vma 20:30:41 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$FS_IOC_SETVERSION(r0, 0x40087602, &(0x7f00000001c0)) r1 = syz_open_dev$binder(&(0x7f0000000640)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000380)={0x8, 0x0, &(0x7f0000000500)=[@release], 0x0, 0x0, &(0x7f0000000400)}) [ 395.313613] binder: 17560:17561 transaction failed 29189/-3, size 24-8 line 3137 [ 395.314403] binder: 17560:17561 Release 1 refcount change on invalid ref 0 ret -22 [ 395.354684] binder: 17557:17562 transaction failed 29189/-3, size 24-8 line 3137 [ 395.365411] binder: 17565:17567 ioctl 40087602 200001c0 returned -22 20:30:41 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$FS_IOC_SETVERSION(r0, 0x40087602, &(0x7f00000001c0)) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000380)={0x8, 0x0, &(0x7f0000000500)=[@release], 0x0, 0x0, &(0x7f0000000400)}) [ 395.373402] binder: 17557:17564 BC_INCREFS_DONE u0000000000000000 no match [ 395.383023] binder: 17557:17562 Release 1 refcount change on invalid ref 1 ret -22 [ 395.383813] binder_alloc: 17565: binder_alloc_buf, no vma [ 395.383855] binder: 17565:17567 transaction failed 29189/-3, size 24-8 line 3137 [ 395.383952] binder: 17565:17567 Release 1 refcount change on invalid ref 0 ret -22 20:30:41 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$FS_IOC_SETVERSION(r0, 0x40087602, &(0x7f00000001c0)) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000380)={0x8, 0x0, &(0x7f0000000500)=[@release], 0x0, 0x0, &(0x7f0000000400)}) [ 395.432755] binder: 17569:17572 ioctl 40087602 200001c0 returned -22 [ 395.449173] binder: 17569:17572 transaction failed 29189/-22, size 24-8 line 3014 20:30:41 executing program 0: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00003e0000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r0, 0x40045431, &(0x7f00003b9fdc)) r1 = syz_open_pts(r0, 0x0) syz_execute_func(&(0x7f0000000040)="3666440f50f564ff0941c3c4e2c9975842c4c27d794e0066420fe2e33e0f1110c442019dccd3196f") r2 = dup2(r1, r0) ioctl$BLKRAGET(r2, 0x1263, &(0x7f0000000080)) 20:30:41 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$FS_IOC_SETVERSION(r0, 0x40087602, &(0x7f00000001c0)) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000380)={0x8, 0x0, &(0x7f0000000500)=[@release], 0x0, 0x0, &(0x7f0000000400)}) [ 395.526778] binder: 17574:17575 ioctl 40087602 200001c0 returned -22 [ 395.548257] binder: 17574:17575 transaction failed 29189/-22, size 24-8 line 3014 20:30:41 executing program 5: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$nl_netfilter(r0, &(0x7f0000000080)={&(0x7f0000000100), 0xc, &(0x7f00000000c0)={&(0x7f0000000340)=ANY=[@ANYBLOB="140000000301ffff808f00003d88c83f00b516ba"], 0x14}}, 0x0) uname(&(0x7f0000000240)=""/96) r1 = accept(r0, 0x0, &(0x7f0000000000)) getsockopt$inet6_opts(r1, 0x29, 0x36, &(0x7f0000000140)=""/214, &(0x7f0000000040)=0xd6) recvmmsg(r0, &(0x7f00000013c0), 0x1ad, 0x0, &(0x7f0000000c40)={0x77359400}) 20:30:41 executing program 0: [ 395.626063] binder: 17578:17583 ioctl 40087602 200001c0 returned -22 [ 395.647120] binder: 17578:17583 transaction failed 29189/-22, size 24-8 line 3014 20:30:41 executing program 3: r0 = openat$cgroup(0xffffffffffffffff, &(0x7f0000000000)='syz1\x00', 0x200002, 0x0) openat$cgroup_ro(r0, &(0x7f0000000040)='cpu.stat\x00', 0x0, 0x0) r1 = socket$inet(0x2, 0x4000000000000001, 0x0) setsockopt$inet_tcp_TCP_CONGESTION(r1, 0x6, 0xd, &(0x7f0000000680)='reno\x00', 0x60c5) sendto$inet(r1, &(0x7f0000a88f88), 0xfffffffffffffe6e, 0x20000000, &(0x7f0000e68000)={0x2, 0x0, @local}, 0x10) 20:30:41 executing program 4: r0 = socket$inet(0x2, 0x0, 0x0) setsockopt$inet_opts(r0, 0x0, 0x0, &(0x7f00000000c0)="8907", 0x2) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) r3 = memfd_create(&(0x7f0000000280)='[\'posix_acl_access\x00', 0x0) pwritev(r3, &(0x7f00000001c0)=[{&(0x7f0000000200)=',', 0x1}], 0x1, 0x4081806) sendfile(r1, r3, &(0x7f00000000c0), 0x20020102000007) pipe(&(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$TIOCEXCL(0xffffffffffffffff, 0x540c) write(r4, &(0x7f00000001c0), 0xfffffef3) fstat(r3, &(0x7f0000000b40)) ioctl$TIOCGPGRP(0xffffffffffffffff, 0x540f, &(0x7f0000000cc0)) getsockopt$inet6_IPV6_IPSEC_POLICY(0xffffffffffffffff, 0x29, 0x22, &(0x7f00000010c0)={{{@in6=@mcast2, @in=@remote}}, {{@in6=@local}, 0x0, @in6=@loopback}}, &(0x7f00000011c0)=0xe8) recvfrom$unix(r2, &(0x7f0000000040)=""/4, 0xebc3276d6d4b1cd2, 0x100100, &(0x7f0000000100)=@abs, 0x930000) openat$selinux_avc_cache_stats(0xffffffffffffff9c, &(0x7f0000000240)='/selinux/avc/cache_stats\x00', 0x0, 0x0) 20:30:41 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000640)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000380)={0x8, 0x0, &(0x7f0000000500)=[@release], 0x0, 0x0, &(0x7f0000000400)}) [ 395.768318] audit: type=1400 audit(1542313841.670:61): avc: denied { accept } for pid=17590 comm="syz-executor5" scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tclass=netlink_netfilter_socket permissive=1 [ 395.819155] binder: 17598:17599 Release 1 refcount change on invalid ref 0 ret -22 [ 395.846312] binder: release 17598:17599 transaction 456 out, still active [ 395.854550] binder: send failed reply for transaction 456, target dead [ 396.035211] binder: 17557:17609 ioctl 40087602 200001c0 returned -22 [ 396.042340] binder_alloc: binder_alloc_mmap_handler: 17557 20001000-20004000 already mapped failed -16 [ 396.052435] binder_alloc: 17557: binder_alloc_buf, no vma [ 396.058335] binder: 17557:17562 transaction failed 29189/-3, size 24-8 line 3137 [ 396.072079] binder: 17557:17609 BC_INCREFS_DONE u0000000000000000 no match 20:30:42 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$FS_IOC_SETVERSION(r0, 0x40087602, &(0x7f00000001c0)) r1 = syz_open_dev$binder(&(0x7f0000000640)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000000)=[@enter_looper], 0x1, 0x0, &(0x7f0000000040)='+'}) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0x0, 0x0, &(0x7f0000000780)}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000380)={0x8, 0x0, &(0x7f0000000500)=[@release={0x40046306, 0x1}], 0x0, 0x0, &(0x7f0000000400)}) 20:30:42 executing program 0: 20:30:42 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000640)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000380)={0x8, 0x0, &(0x7f0000000500)=[@release], 0x0, 0x0, &(0x7f0000000400)}) [ 396.082041] binder: 17557:17609 Release 1 refcount change on invalid ref 1 ret -22 20:30:42 executing program 0: r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) clone(0x200100, 0x0, 0xfffffffffffffffe, &(0x7f0000000400), 0xffffffffffffffff) readv(r0, &(0x7f0000000380)=[{&(0x7f0000000200)=""/148, 0x94}], 0x1) ioctl$sock_SIOCBRDELBR(r0, 0x89a1, &(0x7f0000000180)='dummy0\x00') timer_create(0x0, &(0x7f0000000140)={0x0, 0x37}, &(0x7f0000000040)) timer_settime(0x0, 0x1, &(0x7f0000000080)={{0x0, 0x1c9c380}, {0x0, 0x1c9c380}}, 0x0) fsetxattr$security_selinux(0xffffffffffffffff, &(0x7f00000000c0)='security.selinux\x00', &(0x7f0000000100)='system_u:object_r:watchdog_device_t:s0\x00', 0x27, 0x0) 20:30:42 executing program 0: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00003e0000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r0, 0x40045431, &(0x7f00003b9fdc)) r1 = syz_open_pts(r0, 0x0) syz_execute_func(&(0x7f0000000140)="3666440f50f564ff0941c3c4e2c9975842c4c27d794e0066420fe2e3213e0f11101042019dccd3196f") r2 = dup2(r1, r0) ioctl$sock_inet_SIOCSIFNETMASK(r2, 0x891c, &(0x7f0000000040)={'ip6gretap0\x00', {0x2, 0x0, @dev}}) 20:30:42 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000640)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000380)={0x8, 0x0, &(0x7f0000000500)=[@release], 0x0, 0x0, &(0x7f0000000400)}) 20:30:42 executing program 0: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00003e0000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r0, 0x40045431, &(0x7f00003b9fdc)) r1 = syz_open_pts(r0, 0x0) syz_execute_func(&(0x7f0000000140)="3666440f50f564ff0941c3c4e2c9975842c4c27d794e0066420fe2e3213e0f11101042019dccd3196f") r2 = dup2(r1, r0) ioctl$sock_inet_SIOCSIFDSTADDR(r2, 0x8918, &(0x7f0000000180)={'syzkaller1\x00', {0x2, 0x0, @multicast1}}) [ 396.110233] binder: 17613:17615 ioctl 40087602 200001c0 returned -22 [ 396.138638] binder: 17614:17617 Release 1 refcount change on invalid ref 0 ret -22 [ 396.199305] binder: BINDER_SET_CONTEXT_MGR already set [ 396.205080] binder: 17630:17631 ioctl 40046207 0 returned -16 [ 396.211765] binder: 17630:17631 Release 1 refcount change on invalid ref 0 ret -22 20:30:42 executing program 5: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) r1 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ppp\x00', 0x2000, 0x0) getsockopt$EBT_SO_GET_INFO(r1, 0x0, 0x80, &(0x7f0000000140)={'nat\x00'}, &(0x7f0000000040)=0x78) sendmsg$nl_netfilter(r0, &(0x7f0000000080)={&(0x7f0000000100), 0xc, &(0x7f00000000c0)={&(0x7f0000000340)=ANY=[@ANYBLOB="140000000301ffff808f00003d88c83f00b516ba"], 0x14}}, 0x0) recvmmsg(r0, &(0x7f00000013c0), 0x1ad, 0x0, &(0x7f0000000c40)={0x77359400}) 20:30:42 executing program 0: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00003e0000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r0, 0x40045431, &(0x7f00003b9fdc)) r1 = syz_open_pts(r0, 0x0) syz_execute_func(&(0x7f0000000040)="3666440f50f564ff0941c3c4e2c9975842c4c27d794e0066420fe2e33e0f1110c442019dccd3196f") r2 = dup2(r1, r0) ioctl$BLKROTATIONAL(r2, 0x127e, &(0x7f0000000000)) 20:30:42 executing program 3: r0 = epoll_create(0x3ff) r1 = socket$inet(0x2, 0x4000000000000001, 0x0) setsockopt$inet_tcp_TCP_CONGESTION(r1, 0x6, 0xd, &(0x7f0000000680)='reno\x00', 0x60c5) socket$unix(0x1, 0x0, 0x0) sendto$inet(r1, &(0x7f0000000080), 0x0, 0x20000000, &(0x7f0000e68000)={0x2, 0x0, @local}, 0x10) write$FUSE_LSEEK(r0, &(0x7f0000000040)={0x18, 0xfffffffffffffff5, 0x6, {0x5}}, 0x18) setsockopt$IP_VS_SO_SET_EDIT(r1, 0x0, 0x483, &(0x7f0000000080)={0x77, @empty, 0x4e23, 0x2, 'sed\x00', 0x28, 0x9, 0x66}, 0x2c) epoll_ctl$EPOLL_CTL_ADD(r0, 0x1, r1, &(0x7f0000000000)={0x4}) r2 = openat$zero(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/zero\x00', 0x20000, 0x0) ioctl$PERF_EVENT_IOC_SET_OUTPUT(r2, 0x2405, r2) setsockopt$netlink_NETLINK_LISTEN_ALL_NSID(r2, 0x10e, 0x8, &(0x7f0000000200)=0x225, 0x4) getsockopt$inet6_buf(r2, 0x29, 0xfa, &(0x7f0000000100)=""/172, &(0x7f00000001c0)=0xac) 20:30:42 executing program 4: r0 = socket$inet(0x2, 0x0, 0x0) setsockopt$inet_opts(r0, 0x0, 0x0, &(0x7f00000000c0)="8907", 0x2) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) r3 = memfd_create(&(0x7f0000000280)='[\'posix_acl_access\x00', 0x0) pwritev(r3, &(0x7f00000001c0)=[{&(0x7f0000000200)=',', 0x1}], 0x1, 0x4081806) sendfile(r1, r3, &(0x7f00000000c0), 0x20020102000007) pipe(&(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$TIOCEXCL(0xffffffffffffffff, 0x540c) write(r4, &(0x7f00000001c0), 0xfffffef3) fstat(r3, &(0x7f0000000b40)) ioctl$TIOCGPGRP(0xffffffffffffffff, 0x540f, &(0x7f0000000cc0)) getsockopt$inet6_IPV6_IPSEC_POLICY(0xffffffffffffffff, 0x29, 0x22, &(0x7f00000010c0)={{{@in6=@mcast2, @in=@remote}}, {{@in6=@local}, 0x0, @in6=@loopback}}, &(0x7f00000011c0)=0xe8) recvfrom$unix(r2, &(0x7f0000000040)=""/4, 0xebc3276d6d4b1cd2, 0x100100, &(0x7f0000000100)=@abs, 0x930000) openat$selinux_avc_cache_stats(0xffffffffffffff9c, &(0x7f0000000240)='/selinux/avc/cache_stats\x00', 0x0, 0x0) 20:30:42 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000640)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000380)={0x8, 0x0, &(0x7f0000000500)=[@release], 0x0, 0x0, &(0x7f0000000400)}) [ 396.664009] binder: BINDER_SET_CONTEXT_MGR already set [ 396.669462] binder: 17648:17650 ioctl 40046207 0 returned -16 [ 396.679458] binder: 17648:17650 Release 1 refcount change on invalid ref 0 ret -22 [ 396.911733] binder: 17613:17625 ioctl 40087602 200001c0 returned -22 [ 396.919107] binder: BINDER_SET_CONTEXT_MGR already set [ 396.924741] binder_alloc: 17613: binder_alloc_buf, no vma [ 396.930508] binder: 17613:17660 ioctl 40046207 0 returned -16 [ 396.936647] binder: 17613:17661 transaction failed 29189/-3, size 24-8 line 3137 [ 396.945924] binder: 17613:17625 BC_INCREFS_DONE u0000000000000000 no match [ 396.953072] binder: 17613:17660 Release 1 refcount change on invalid ref 1 ret -22 20:30:42 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$FS_IOC_SETVERSION(r0, 0x40087602, &(0x7f00000001c0)) r1 = syz_open_dev$binder(&(0x7f0000000640)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) pipe2$9p(&(0x7f00000003c0), 0x84800) r2 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000400)='memory.stat\x00', 0x0, 0x0) ioctl$BLKRRPART(r2, 0x125f, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000000)=[@enter_looper], 0x1, 0x0, &(0x7f0000000040)='+'}) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0x0, 0x0, &(0x7f0000000780)}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000380)={0x8, 0x0, &(0x7f0000000500)=[@release={0x40046306, 0x1}], 0x0, 0x0, &(0x7f0000000400)}) r3 = openat$full(0xffffffffffffff9c, &(0x7f0000000080)='/dev/full\x00', 0x402940, 0x0) getpeername$unix(r3, &(0x7f00000000c0)=@abs, &(0x7f0000000180)=0x6e) 20:30:42 executing program 0: clone(0x200, &(0x7f0000000440), &(0x7f0000000300), &(0x7f0000000100), &(0x7f0000000480)) mknod(&(0x7f00000005c0)='./file0\x00', 0x1040, 0x0) execve(&(0x7f0000000000)='./file0\x00', &(0x7f0000000500), &(0x7f00000007c0)) r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000400)='/dev/ptmx\x00', 0x0, 0x0) read(r0, &(0x7f00000002c0)=""/11, 0x221) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000200)) syz_execute_func(&(0x7f0000000240)="3666440f50f564ff0941c3c4e2c9975842c4c27d794e00c42221b888010000003e0f1110c442019dccd3196f") clone(0x3102001ffb, 0x0, 0xfffffffffffffffe, &(0x7f00000000c0), 0xffffffffffffffff) execve(&(0x7f0000000180)='./file1\x00', &(0x7f0000000380), &(0x7f0000000800)) ioctl$EVIOCGBITSND(r1, 0x80404532, &(0x7f00000001c0)=""/60) mknod(&(0x7f0000000140)='./file1\x00', 0x29c, 0x0) creat(&(0x7f0000000080)='./file0\x00', 0x0) 20:30:42 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000640)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x10, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000380)={0x8, 0x0, &(0x7f0000000500)=[@release], 0x0, 0x0, &(0x7f0000000400)}) [ 396.961215] binder: send failed reply for transaction 463 to 17613:17625 [ 396.968464] binder: undelivered TRANSACTION_ERROR: 29189 [ 396.988460] binder: 17662:17663 ioctl 40087602 200001c0 returned -22 [ 396.996388] binder_alloc: 17666: binder_alloc_buf, no vma [ 397.002116] binder: 17666:17667 transaction failed 29189/-3, size 24-8 line 3137 20:30:42 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000640)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x10, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000380)={0x8, 0x0, &(0x7f0000000500)=[@release], 0x0, 0x0, &(0x7f0000000400)}) [ 397.011551] binder: 17666:17667 Release 1 refcount change on invalid ref 0 ret -22 [ 397.040653] binder_alloc: 17670: binder_alloc_buf, no vma [ 397.048875] binder: 17670:17671 transaction failed 29189/-3, size 24-8 line 3137 [ 397.057141] binder: BINDER_SET_CONTEXT_MGR already set 20:30:43 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000640)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x10, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000380)={0x8, 0x0, &(0x7f0000000500)=[@release], 0x0, 0x0, &(0x7f0000000400)}) [ 397.063198] binder: 17670:17671 Release 1 refcount change on invalid ref 0 ret -22 [ 397.063265] binder: 17662:17673 ioctl 40046207 0 returned -16 [ 397.067460] binder_alloc: 17670: binder_alloc_buf, no vma [ 397.067498] binder: 17662:17673 transaction failed 29189/-3, size 24-8 line 3137 [ 397.067579] binder: 17662:17673 BC_INCREFS_DONE u0000000000000000 no match [ 397.067675] binder: 17662:17673 Release 1 refcount change on invalid ref 1 ret -22 20:30:43 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000640)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000380)={0x8, 0x0, &(0x7f0000000500)=[@release], 0x0, 0x0, &(0x7f0000000400)}) [ 397.124272] binder_alloc: 17676: binder_alloc_buf, no vma [ 397.130684] binder: 17676:17677 transaction failed 29189/-3, size 24-8 line 3137 [ 397.139231] binder: 17676:17677 Release 1 refcount change on invalid ref 0 ret -22 20:30:43 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000640)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000380)={0x8, 0x0, &(0x7f0000000500)=[@release], 0x0, 0x0, &(0x7f0000000400)}) [ 397.167004] binder_alloc: 17681: binder_alloc_buf, no vma [ 397.172962] binder: 17681:17682 transaction failed 29189/-3, size 24-8 line 3137 [ 397.181532] binder: 17681:17682 Release 1 refcount change on invalid ref 0 ret -22 [ 397.204986] binder_alloc: 17684: binder_alloc_buf, no vma [ 397.223864] binder: 17684:17685 transaction failed 29189/-3, size 24-8 line 3137 [ 397.236660] binder: 17684:17685 Release 1 refcount change on invalid ref 0 ret -22 20:30:43 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000640)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000380)={0x8, 0x0, &(0x7f0000000500)=[@release], 0x0, 0x0, &(0x7f0000000400)}) 20:30:43 executing program 5: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) r1 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000002b00)='/dev/vga_arbiter\x00', 0x103042, 0x0) getsockname$packet(r1, &(0x7f0000002b40)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @local}, &(0x7f0000002b80)=0x14) sendmsg$nl_netfilter(r0, &(0x7f0000000080)={&(0x7f0000000100), 0xc, &(0x7f00000000c0)={&(0x7f0000000340)=ANY=[@ANYBLOB="142000000301ffffc8f87eb516ba000000000000"], 0x14}}, 0x0) recvmmsg(r0, &(0x7f0000000c40)=[{{0x0, 0x89, &(0x7f0000000580)=[{&(0x7f0000000040)=""/23}, {&(0x7f0000000140)=""/195}, {&(0x7f0000000240)=""/138}, {&(0x7f0000000300)=""/39}, {&(0x7f0000000380)=""/103, 0xff42}, {&(0x7f0000000400)=""/108}, {&(0x7f0000000480)=""/71}, {&(0x7f0000000500)=""/92}], 0x0, &(0x7f0000000600)=""/10, 0x0, 0x1}, 0x2}, {{&(0x7f0000000640)=@nfc, 0x0, &(0x7f0000000ac0)=[{&(0x7f00000006c0)=""/24}, {&(0x7f0000000700)=""/14}, {&(0x7f0000000740)=""/237}, {&(0x7f0000000840)=""/106}, {&(0x7f00000008c0)=""/128}, {&(0x7f0000000940)=""/47}, {&(0x7f0000000980)=""/103}, {&(0x7f0000000a00)=""/136}], 0x0, &(0x7f0000000b40)=""/203, 0x0, 0x3}, 0x100000000}], 0x46, 0x0, &(0x7f0000000000)={0x0, 0x1c9c380}) getsockopt$sock_cred(r0, 0x1, 0x11, &(0x7f0000000d00)={0x0, 0x0}, &(0x7f0000000d40)=0xc) sendmsg$nl_netfilter(r0, &(0x7f0000002300)={&(0x7f0000000cc0)={0x10, 0x0, 0x0, 0x2000}, 0xc, &(0x7f00000022c0)={&(0x7f0000000d80)=ANY=[@ANYBLOB="30150000140b08002dbd7000fddbdf2500000001b728be0ce3c857a85e867cb85ce4f05b765d9426c146fdf3689b8602d036c599ba4d8684f4d2240fb4903a76f6f6221699ab8bd13024ac6aad5bc6cb3acb37302783069329bd8bb4d7250006cc22bb7c9c879affef90e5c40daee7ffa52fa425b7c4f60d65c4df3f74bfe23790764622d156e09dccd2d19e6a88276dbd390c7d215446bcc99069dd95618e9fc874622ff8cd5e4c80931474e9db78764d5c83d5277212eb5a19e9370ed87baafe416fce0d71fb4507db840c0c006d000200000000000000e401230027090d09abc01b6436bd6fbb7b823c1d20eb977d719c60d22d2be7fe06dda6fd85796042836fa596a6fcf2d023f20e237b019b9b853ede3cf22278585dcf9a08002a00", @ANYRES32=r2, @ANYBLOB="912c59be7f7184b7f708e32b8cf32815bca5feeea3ef91c11c9fd3a43368d56ce0783db0ac12e81493b337720f9e151879963f1a73f7481d9989ea93923eabae9685ef3ee067dad3537af1a33fe33953b0020d692015a52d9ccc0cab91f8b3efc5d4503a8c2cdc2c20af9b5eb52f577a395221bf38cc88337804421955b5c2d74a0e1e56020744541c27a78a34c29805d41f7844550546813b5fb2a889c891cac647973f5fca4336fcbd698335e21da4686c3a9d84ee371bd3d2194584a68337ef752b39407c53637eaeb46f6f638bc4edfd8f5f8f650e9285f58e7e8d69518fe2dfd5b5b6f26e0d1586c67e786b0c09760d4456e2ee14002f00ff01000000000000000000000000000153e3be466eb22c6aa9d98929561bb211aadc4c905d0bb80655b0046c8c907c581c8ba7254021c576a6a33674ebcf7b5019ac1e28bccc4bdbf57ef3676cc1d71dbcd2cfdb397810e77eb95485a9a2fe217641b09ea06c0dc8772833b65d63649248df160cc8443577987cc21c5f5a72301706c6f7145c4832a1f2deece32f107821c504ee44b0148cdc194546a8000004003400881022000c00910079060000000000008682fdcec93c4c639a4acca07792043a98abd951a4af8ed9d638a620c65bc97c74fbfbd50b098da77d6093678ac49444d69b4680791773876b552c6f1a552a481b55c0562834fefe98271b44793a67c877f0c3c8f289a02e02e9346988cac420a6c8b712e3d807348f63e95e03db2964af100400690010700e598c0cce9781199be6ebea5a94314a2e74ac2b810ed24908ea76eca44a16d5fbbca1e8c56895a85039556a514872036153363770d8286718daaa00512efdd89723dd29efdb8bc793ba423f07f7667a6f2aeb180e2288ce9ba81e1bc5f4dc2d8c969d6e317a8a626b762b81d0ed367a53b2ff7021131959b0b8478bf8456038b96b5beb894825ff4f7bc7de977aabd9a3bd0695c580db9e8de5f62d55dc84a6ca3053acf3e2f6fee0305589f4cf519373402a11500fe3dc133bf052565f0b1d3385df435ba98328beafa5fc72ceb088905ddb176b19d26b4060c820bd9fb8ed1cfc086edd04acb09ea4d8ec56890ea35717a249e69aba85f267ec6d2db8478fe5b5d8e23195af7c2b934c052fae481eb4643c7b1fe6c81a54ae43a658a097ded881586a71efc0feb4b1c4ff15fb65c9e6a699ee7922744eafa6e959d7ded9ef5b7ddede5cb1faeeddbf7de1753cfe7828b1cffc52aba7d6a3893935a673b93d972bfdbbf4489a99b5196272a06e96da4f03d74e0cd1e7982be29f5e382e509b0d9b92167cea574fd148340aa7589fd369d17222e29da56d31f06da5cb7ba9bc52c4820b840a31f02a69fe3c73fd79dc63d186fbe3db5cc9ea7ec8ef106b159b72cfbc108edeb2f092a78046eeb9c83cecf232fb48ab5da1396eefa46ff850ae56599a287a05649e0bb8f3cd5a554b913ec0ab9748b43c53d16500a269ca85097963212ff164fb4ded7c2c80b103548d0f5ecc4c699cebdbeb45e8764e4a030875dd993a79b70de35ecee9ab6ecf905aa6ca0bf89973d9f5673d7c8920bcc31ddcca7fa12208865dadb28113bd86eed8124a40667752150ec277e123b386ac0cd1b4bd9e93d3c543bc8e7393c9d8bee7b244577fc9c691a2832b0607bcb7449197f1eb9db7a27a38d2804df0a7ab31b1ee43d303eea55170297c498538a53037f746fa61fd6e643928742f759d31f519e73edd912d0cd8cc984985c4304f2b05720140b7766e3ec740160098dc47e6684d713fde23a73762a8da32798c4ff282a848ddbc446daaad1d004d871e1bd2f36c5def60a956a4f18302e548a9defc15c2926c9e793eb21d8326eef472ba5ef94aa474713ed4410e88ddcf82e0bc208813eea227f5edc4aa8b90425a44ffd3936650f504544c234d4427eea64b27bcac56af39e8fd4524779a4029d2122e601b347e13653bdd8e78c5991faecc0415d48dea2c72fc27ce41a10e7d10d1fca461710e30dc855ced1af20034cb3360b796690baec86e8ac54654482b1c0222802b3830df64bf2bf029debcd924ce809b8d2fcc2130b4e9932f2fa75ebfc2361d59e8c7424c0da54408c261a9d6e9566f8d45e5f9d2d9c8a58de6fabb2633c62a7a094a504c895d0769aadf7538c72ce2f304e087bcc87bf709abdce5dad22c235b531a6ac059eadbdc9d8ba61903c8d724b8ee68736ada47cf5b823e594523ba60e7488e507ad6089d9c4c15ff608755d1c806b5024ff1c4d4b50924be3ca8f90d7a46eaebd3538efe187b35b15395ae2aed0179700ab8ea2e0638f549fc96b9fb6d0247819d3a98f5dd9ae3929c9738da7e56ae04ca362a7bf5f11ad1b1209224335a36960fe703b9868984cb5bd504193f0a48aa94923f4ce8dbaca39bc4bb5e607404473c487f2d83d1d14cd8c6405df5b7d1026d45889ddc5fcf97aabd59add870329983caf756a711ca11456e43ef0ea566d620d3e9019635f473afa73d22d19c64c2996a6b29b9ec0178dd7758c16cf5e707ef0395d9eaf7d01ce4f9ded136d8e3766119ec2085f5621d7f03631ba14e7b682ebe230350cd00434bf9e2bf629680968042a7df18e0476ea971282d62270004bfb99e48b39ce5f24746efa34207e4d8aa87546cafe883b00d2e2aa15557022e587d00acff660354cc26891a87dc6122c7afa96e31ec809f27f9ac7b8ddaa1c0bf4f571c1ccb8e554dfb90827ef3c7edd80b45b259c474fa8ed2a8a513d6822c83d4918f4ac8e4c9cb2f696b69340f9cf6b7e08474d782f7ca5771120e995d018d61c0196eaca3e47b38e174db081d0ddffcbe4d37fb0e9b9cc091e79805e22fc1510b996424229c0ee9d0b4fd3e82eb320deddb02ca0128d4673da62d8065d34c5eb1bf71e508049b5ea390f24b5aa732e02c7495c31b9f9c7f860d9d5709985ff5491bc8e3b424549d5c4ce2e49b890e73c6e664faa4e99abb8727a45b68595e26d08edad3067a34d3eb3277b2748962c623482829d5ac1e2a39f483cac3ac54a290ff4894c355dd318a7dbbc0175b19345a9e37a67f061da44a4109f050cbfd0e7e04f16f45c6c2e25993c41b2b1c97c8edf36932cbeedda2cc588933f517de9cdffbbc7d83b1a288e022ebfdc1558012d2aa0a807a385f7959566ce3a41955e0e6e7bc69207f8d8353de14551afb3b26579db4513f407bb41360cb8a0de7440a78b33f51cdc0bc2ee4c441cf9bf116c40b9223e9f07e7112030fbe46e8177e7159d5b6ae6e9cec8fc69d1b31c8a21bcc8c34904331e1cadbbb9848c44ec8edbb7d08d4655ac65cf62c5e7ed0f18c62574bf02d92f5fa92978c6af249babb5cf8745c1c596d5390d8dd59c3081e01c4c9508a7adb4ce4f28d9557275fba638df8a00d3ff945b9a5fdfb6fcc664125c640c316f5aab24359404c2ccc372945193c37ab6b37eaca00ff64add88986d00ea5ed96e538deee37eb0fbbbbc420ead53510a1904e251235cd460f606e0ca09f33088ee4402e90e0cd29367aed2c19d281bfd2100ed4475ee893e033cd056cc8fe4f17d33d0847783afee0b9b616da4a9343736943a78c3b0c3791539277e5f38abdd178b34b5c9365d4f79ac3fb1fc6a753555b07b2bbadda7e6d44cde3dfce5ff6cdac39a638f45da1d43779325603dbe6fae13427ad1aab5096a166d12ec4ac08b504e200f786edddc56360ffb2dd6ef0b0144f2f03e4634b8aa87534ecc949d377271d8241bbce7f0bd929db6b607589c16f83dfe742951d87a38207ec44b96c36d05b98e2392c0a99c7d5fea01b105c8bf9a9ce06e0b58d2f1067c038b8e0239ca50f2184858726080940e3e4f7de33c76aecb212c2231d876e2f4e82b1f87d39ca65fb443c6ec1c9d9241b614230325123a7950bc26a4ae5f79149454d2d1ff6788f15f1eca82a9cd18399027a470340871803cb2ad1cdc2fce4d2ada23886aca63431842f0865c0c549aa5681d385794ffb64eee47388c0f55b187c3298525ed6d54011340731ea50e9e738c0b546b237cdb834bb473cb62a52746e7c5a799a4c2075a2612d0c1b20ae4e16383c5f4706d2a2bd256bb21e94ff521676e800149905cea016e7730ad0918cb35e221f8a2596ba6fd1816b9a3da2cbf738ecaa1a04a165aac2fd2d664cf24af4a7c2c2409b2b22f4d8668a886ab96161f86700891eefa3619e6c1f7f78ca221d302d3d3ff61363b15c63e0ea112842a8ae4769aea3b6d0a49f577b45e72893db7a5106bd320f1fa04137de8e301a49e2a2054627fbd5eaef4c0e96161d20d6638285d98a2e625a15f1505602255754a8a867dde97865073bb6398d88871ccfa7e3b3d916facb4767527517c62ed1e94a898a626ab97d8c44bb0ea902ae2175ebfdf16b626caa1c9efac7e864b85555b0370fcd19f04014306eba28f66c412dbf01c0cee2ddf3acb0af98bf5fae989441a0f50ed8fb522e3523fa634de28f1e18beca3e5b1c4cc07b7b9454b8d7b3715b1254f0ccc4ccceaecd7256a31470f8ced31ee78b4e2b4e7f551294cfcc1e200ea0b077c7229c22a8e2b52beee9696b3ed0e81715d94df287c4e9f7c8f4adb7eb6704a4645c78551e7fdb6eba14ed93a31e3709d831839e133abddf1fc8ee14d795e687d619caf258cd4cd1a6632fbb65f2fe9140d1cadbcaa4d93da67edd598f43a5227f9a4fe6e09c17595f43093c4c87db2f48d52b78c95ed4c1fbb8d69e80a061eca47cf50f83d5133ef1ea49332c7abcdb85114f884eaf06f3a093f767c3191ce7e3f2819c09472464b9e85158cff73a4f5432f30b3e023b7d24da3eeed0f8886c75170f78dbb9155884a858ee1514266f5dd45f4012a9abba58a9fa0b51b1102814315c5ef483ad7ea4a1bfec3110580728997c008af5092880f589de75294cb933abc3ceafad612db57d1a34594b00f87d99c559481495d4bfed3c80e227d0fcb11aa7ee096f38f4c75a8160150e868fcafb16e7269feb76ac5cdfe4cc90c8520e7a972d601168242b1112e3bc99582723023bbfcabe57d43b5fc590b4ccf288af2f752b7937c459b671a1fb8abd80e41892fd0043437d026a8786b1ea93f089d3ffa6d01821da1aa9234bb118d2a61e1fb49b9650bbb3a26f0c342bd532c0e3d75afb3ed55d451d10c16a5be949f2a715464d968d599d278a103dfa0037d523c8ba3a2fc1788fc40441a9e6d183d19f67405e76ca50d0db875692a277a0769028da61a4fc2152ae697a1fe609421c7295bf4efa58bc6b1237faf76f2340de72f768aeac6e441dff95c12249e035f82f972657747e486cc1db4d115cd44e59d9f3d0c7fb7c4377e3b64f0c553ead652c19feda236a9dc3f0cc7bcbdc7369ff535396c9c5b498f58e8b1c55aeb7eb7753a03ac8178373a537f0493221846d101f49bf25e4a280e946bea5cb04609ce40862fd22fdf0632e8d4d63288d628e62e54190e71b801fb23716571b29cf229dc8bb569db90ad600f9e297382347ff5a7d38e9a6f4639d8c5a059ec7991ed3c400b5a136c6e3ae9bec9bee1bfa9e8f6b7141642d2d33a5b3fd6a934d8981dc671df9f433038e963a8b7cdadf2a863270751b5d50e24cde8fc1c5d189bf1c337bfca17863b0530214f34261e2e3ff25290065165c57427d2024fa8853c7665d9033a5eb74edafa9c242dad3b0f24168a26d46a79f332d93a1f169343c2770fabdb6ae5311daa428fed08cb05a5d074ed67a5d755ccfa6171c68918b67fdedcc7128edd09654babec1768414fbcad704a4aafe640978c4e5a15bb50b7d8b6d85658eb80f186ef93754a934fb25ae2b319995220aec2b6c2858f6e7cec43d9be81e2de058780dbb6c965e94f63be8ba9774ab425284fecb72fa2b0bf47bf5bc9f267d7f74a971b3bb72c8b9cb2f7b65115c732f2accb0fea707515d3ce9a5b71e7483033e657071b0a81d85f144381d71653a1d9fc44b2568b0e3aec88cf8fd2c518f29b7f3a19e0080fecdf9fd5ef1dd1752569db7380e991f25b5adbccc2cf1cd3f46b2adeab0dfa4aa35378254fe3c8158eddf1a36663e6ec68384b98276120709aea51e6a83fe6e2848fcd7b4c8e78ae69110f70dfbf7d7674bac97649f23c16b3aab6fb58b1129536389fb8a3dcb3e68909b7c0598d8be5638a65edb00d0333cd156d987c031a67da9c76752dac65f595e800b95b1711b0bf84050635b915eb293fd2d56c92f182472b3ab37a79b3c72c3a91d2da6b1fb217be9a4f3d331eb15e50b69087271aaeb743d16ff63cdbe703ca5594bf29d01306d85cf8f184919be715128bc142c3455b486c94c341903b614eb5ae68f23e8be75a11b145aba3a2191ba59cf212561937be7ebd4f857aa8a79d0ac573e2a5a869c95921b32b5ddcdf48d649ae7a985bb13d0a75a5b98630ea473dfe08f64dd0f3d82c1033066597b4c20e3a8cca1c9eba163af40b5e7882366ff876a4913bf34fad1bbf4e744e42c5ff4c04b1010eb19c82d8f9689c92426819603b132ac3624dcb65062e8cdfee35305892cae5b1a992ae8999f43a33d7ae3718a071b61220000e8012100beaf41a7bc539e58b2310cbb28f0cdd46ee598aaafd9b0980319c429425afdd8eb67287f3676b47cf778dcea7aef832eed13cc5ff6f2c88385c85b7780551352834746352c9233fbc1b2df3cc85d7d94e56c231c2479c465355247e40e8df9165226827cb4b189d5abcf657d7316b924421c506c88f6dda8731ed429fe22415f12b0f31452cb11f82c8f290df8c03d6242effae2f8fd755f79d01b674d0ae450913781620082bade7595a0761a116c8478b32e5cac6d0776b2da5aa0256bc9118d2df730add1ff973aca162dcee43035a0c684fabb8856096ad82e80b491d7566b5c5f0b4e9e6a26ecc26e3bef6a1d219d1de46b10b24baceb1f02db0d05898a6a0c8899b7c0d87f0f1da37e56a795178d5353b73e7b739c466797a558e69839fb33ab64ee64428155c5bf5fbe60269451b54c2bb4ad405376445f949076275e44a34ae422baf78bebc5c39e523e767df68e8d1f65733af6b446c4fe9095cfd0b06c0171c50a8e2cba9fc74d47fd6559a45d0697e54b88dd1e2b95ec07c5aa9ef64075328e11cf576d33fc14e16099215b2a42464d9b5f207d518e7745af69c149aa797d863052a8f0747479f6f7041b961598afb6323174e08e2d721000609f0254031791ef8287b1df50c550ae22c0136362afcc8b08009100", @ANYRES32=r0, @ANYBLOB="0400ff000000"], 0x1530}, 0x1, 0x0, 0x0, 0x20000050}, 0x40000) write$binfmt_elf64(r0, &(0x7f0000002340)={{0x7f, 0x45, 0x4c, 0x46, 0xd08, 0x0, 0x6, 0x2ee949b2, 0x10000, 0x3, 0x3, 0xcaa1, 0x12a, 0x40, 0x25f, 0x0, 0x9, 0x38, 0x2, 0x10000, 0x3ff, 0x9}, [{0x1, 0x9fad, 0xffff, 0x8, 0x800, 0x9, 0x7f}, {0x7, 0xd5f700000000, 0x9, 0x81, 0xc1, 0x100000000, 0xffff000, 0x9}], "fe2c2a48ea9922aa7edf98f73d477672d8419012c4e6c39043daa27934b840f28cbdc44b0590f303724ce447e6cd58266f52b2b8c209a04899d1e716a9fbd8d1556e00847aae278415adbcf15c7991276eec496d8bccd8ee3252eb7c6c754e8192dfcef531add3bf9c327664b59f7198110a724c5e1edbb05b881975bdd2abb7e24fe844953e562c136860ccb4d0e5e00575c59afad8601b2febb1cbf5cef769bad70f72a9a9e23e8d9299614953511b5ce142250960b1bb6558dcebd36ecdf6071b60c6c522b54fc550f311c5ce22c88990c2b3b1506a9fced8735bfb166c602b8ba19a52", [[], [], [], [], []]}, 0x695) r3 = dup3(r0, r0, 0x80000) write$FUSE_OPEN(r3, &(0x7f0000002ac0)={0x20, 0x0, 0x4, {0x0, 0x2}}, 0x20) r4 = openat$selinux_avc_cache_stats(0xffffffffffffff9c, &(0x7f0000002a00)='/selinux/avc/cache_stats\x00', 0x0, 0x0) getsockopt$inet_tcp_int(r4, 0x6, 0x3f, &(0x7f0000002a40), &(0x7f0000002a80)=0x4) [ 397.418675] binder_alloc: 17693: binder_alloc_buf, no vma [ 397.424472] binder: 17693:17694 transaction failed 29189/-3, size 24-8 line 3137 [ 397.435209] binder: 17693:17694 Release 1 refcount change on invalid ref 0 ret -22 20:30:43 executing program 3: r0 = socket$inet(0x2, 0x4000000000000001, 0x0) setsockopt$inet_tcp_TCP_CONGESTION(r0, 0x6, 0xd, &(0x7f0000000680)='reno\x00', 0x60c5) setsockopt$inet_tcp_TCP_CONGESTION(r0, 0x6, 0xd, &(0x7f0000000000)='veno\x00', 0x5) sendto$inet(r0, &(0x7f0000a88f88), 0xfffffffffffffe6e, 0x20000000, &(0x7f0000e68000)={0x2, 0x0, @local}, 0x10) r1 = openat$selinux_status(0xffffffffffffff9c, &(0x7f0000000040)='/selinux/status\x00', 0x0, 0x0) ppoll(&(0x7f0000000080)=[{r0, 0x86a1}, {r0, 0xa000}, {r1, 0x2000}], 0x3, &(0x7f00000000c0)={0x77359400}, &(0x7f0000000100)={0x4}, 0x8) 20:30:43 executing program 4: r0 = socket$inet(0x2, 0x0, 0x0) setsockopt$inet_opts(r0, 0x0, 0x0, &(0x7f00000000c0)="8907", 0x2) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) r3 = memfd_create(&(0x7f0000000280)='[\'posix_acl_access\x00', 0x0) pwritev(r3, &(0x7f00000001c0)=[{&(0x7f0000000200)=',', 0x1}], 0x1, 0x4081806) sendfile(r1, r3, &(0x7f00000000c0), 0x20020102000007) pipe(&(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$TIOCEXCL(0xffffffffffffffff, 0x540c) write(r4, &(0x7f00000001c0), 0xfffffef3) fstat(r3, &(0x7f0000000b40)) ioctl$TIOCGPGRP(0xffffffffffffffff, 0x540f, &(0x7f0000000cc0)) getsockopt$inet6_IPV6_IPSEC_POLICY(0xffffffffffffffff, 0x29, 0x22, &(0x7f00000010c0)={{{@in6=@mcast2, @in=@remote}}, {{@in6=@local}, 0x0, @in6=@loopback}}, &(0x7f00000011c0)=0xe8) recvfrom$unix(r2, &(0x7f0000000040)=""/4, 0xebc3276d6d4b1cd2, 0x100100, &(0x7f0000000100)=@abs, 0x930000) openat$selinux_avc_cache_stats(0xffffffffffffff9c, &(0x7f0000000240)='/selinux/avc/cache_stats\x00', 0x0, 0x0) 20:30:43 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000640)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000380)={0x8, 0x0, &(0x7f0000000500)=[@release], 0x0, 0x0, &(0x7f0000000400)}) [ 397.540640] binder: 17707:17709 transaction failed 29189/-22, size 24-8 line 3014 [ 397.550262] binder: 17707:17709 Release 1 refcount change on invalid ref 0 ret -22 20:30:43 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$FS_IOC_SETVERSION(r0, 0x40087602, &(0x7f00000001c0)) r1 = syz_open_dev$binder(&(0x7f0000000640)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000000)=[@enter_looper], 0x1, 0x0, &(0x7f0000000040)='+'}) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000080)=ANY=[@ANYBLOB="020400001040", @ANYRES64=0x0, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00'], 0x0, 0x0, &(0x7f0000000780)}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000380)={0x8, 0x0, &(0x7f0000000500)=ANY=[@ANYBLOB="0646044001000000"], 0x0, 0x0, &(0x7f0000000400)}) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) [ 397.785736] binder: 17662:17673 ioctl 40087602 200001c0 returned -22 [ 397.799726] binder: 17662:17719 BC_INCREFS_DONE u0000000000000000 no match [ 397.814983] binder: send failed reply for transaction 482 to 17662:17717 [ 397.827222] binder: 17720:17721 ioctl 40087602 200001c0 returned -22 [ 397.835816] binder: undelivered TRANSACTION_ERROR: 29189 20:30:43 executing program 0: clone(0x200, &(0x7f0000000440), &(0x7f0000000300), &(0x7f0000000100), &(0x7f0000000480)) mknod(&(0x7f00000005c0)='./file0\x00', 0x1040, 0x0) execve(&(0x7f0000000000)='./file0\x00', &(0x7f0000000500), &(0x7f00000007c0)) r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000400)='/dev/ptmx\x00', 0x0, 0x0) read(r0, &(0x7f00000002c0)=""/11, 0x221) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000200)) syz_execute_func(&(0x7f0000000240)="3666440f50f564ff0941c3c4e2c9975842c4c27d794e00c42221b888010000003e0f1110c442019dccd3196f") clone(0x3102001ffb, 0x0, 0xfffffffffffffffe, &(0x7f00000000c0), 0xffffffffffffffff) execve(&(0x7f0000000180)='./file1\x00', &(0x7f0000000380), &(0x7f0000000800)) ioctl$EVIOCGBITSND(r1, 0x80404532, &(0x7f00000001c0)=""/60) mknod(&(0x7f0000000140)='./file1\x00', 0x29c, 0x0) creat(&(0x7f0000000080)='./file0\x00', 0x0) 20:30:43 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000640)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000380)={0x8, 0x0, &(0x7f0000000500)=[@release], 0x0, 0x0, &(0x7f0000000400)}) [ 397.880756] binder: 17720:17727 unknown command 1026 [ 397.886465] binder: 17720:17727 ioctl c0306201 200002c0 returned -22 [ 397.898339] binder: 17720:17727 unknown command 1074021894 [ 397.904168] binder: 17720:17727 ioctl c0306201 20000380 returned -22 [ 397.913165] binder: BINDER_SET_CONTEXT_MGR already set [ 397.918801] binder: 17720:17727 ioctl 40046207 0 returned -16 20:30:43 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000640)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000380)={0x8, 0x0, &(0x7f0000000500)=[@release], 0x0, 0x0, &(0x7f0000000400)}) 20:30:43 executing program 2: syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f0000000640)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000380)={0x8, 0x0, &(0x7f0000000500)=[@release], 0x0, 0x0, &(0x7f0000000400)}) [ 397.926802] binder: 17728:17729 Release 1 refcount change on invalid ref 0 ret -22 [ 397.936681] binder: release 17728:17729 transaction 489 out, still active [ 397.955908] binder: 17734:17735 Release 1 refcount change on invalid ref 0 ret -22 20:30:43 executing program 2: syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f0000000640)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000380)={0x8, 0x0, &(0x7f0000000500)=[@release], 0x0, 0x0, &(0x7f0000000400)}) [ 397.975076] binder: release 17734:17735 transaction 492 out, still active [ 397.997508] binder: BINDER_SET_CONTEXT_MGR already set [ 398.003013] binder: 17737:17738 ioctl 40046207 0 returned -16 [ 398.010232] binder: 17737:17738 Release 1 refcount change on invalid ref 0 ret -22 20:30:43 executing program 2: syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f0000000640)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000380)={0x8, 0x0, &(0x7f0000000500)=[@release], 0x0, 0x0, &(0x7f0000000400)}) [ 398.044988] binder: BINDER_SET_CONTEXT_MGR already set [ 398.050436] binder: 17740:17742 ioctl 40046207 0 returned -16 [ 398.058472] binder: 17740:17742 Release 1 refcount change on invalid ref 0 ret -22 20:30:44 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000640)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x0, 0x0, &(0x7f0000000300), 0x0, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000380)={0x8, 0x0, &(0x7f0000000500)=[@release], 0x0, 0x0, &(0x7f0000000400)}) [ 398.092617] binder: BINDER_SET_CONTEXT_MGR already set [ 398.098502] binder: 17744:17746 ioctl 40046207 0 returned -16 [ 398.105795] binder: 17744:17746 Release 1 refcount change on invalid ref 0 ret -22 [ 398.132792] binder: BINDER_SET_CONTEXT_MGR already set [ 398.143919] binder: 17747:17748 ioctl 40046207 0 returned -16 [ 398.155138] binder: 17747:17748 Release 1 refcount change on invalid ref 0 ret -22 20:30:44 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000640)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x0, 0x0, &(0x7f0000000300), 0x0, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000380)={0x8, 0x0, &(0x7f0000000500)=[@release], 0x0, 0x0, &(0x7f0000000400)}) 20:30:44 executing program 3: r0 = socket$inet(0x2, 0x4000000000000001, 0x0) r1 = add_key(&(0x7f0000000100)='blacklist\x00', &(0x7f0000000140)={'syz', 0x1}, &(0x7f0000000180)="88a2abb4df926dc71f74c0e6df3ed7373878f8ce5f19c0a59ff993c500e3d7b49dbc10c840b7a3ccc5b4d74bf11daf569f2c2f9d1ff4da7d180f55a6dd46d566b3aa016457e70ea3f0d0a87301970b8a9d6489d10387dfce7211ad21b459a3380f42daa54eb42b7a9002b12e71d52ce6cd0167a634067d81d4f5e63910da7009a366d7aa50398a7661ad3d72890e7d5e3870361a19c688f7340188dc842eb1e010fc0f8423d8874b1d", 0xa9, 0xfffffffffffffffe) r2 = openat$selinux_avc_cache_stats(0xffffffffffffff9c, &(0x7f0000000240)='/selinux/avc/cache_stats\x00', 0x0, 0x0) ioctl$KDGKBENT(r2, 0x4b46, &(0x7f0000000280)={0x1229, 0x4, 0x3}) add_key(&(0x7f0000000000)='user\x00', &(0x7f0000000040)={'syz', 0x0}, &(0x7f0000000080)="460cf081cdd491fd1e588dd04550e4eb270befe3ede1bcdcc58a51de799aa825a358fc5463c6337a9072408eb1b8e5da036ce45e932a7e09a66a8a1edd8ec3f321c02be9a24d4d047debd534525882d389c2773cf1727e700524b246cb753d4fb30f30edc933cb9c0982bce4d82be538d0", 0x71, r1) setsockopt$inet_tcp_TCP_CONGESTION(r0, 0x6, 0xd, &(0x7f0000000680)='reno\x00', 0x60c5) sendto$inet(r0, &(0x7f0000a88f88), 0xfffffffffffffe6e, 0x20000000, &(0x7f0000e68000)={0x2, 0x0, @local}, 0x10) [ 398.290647] binder: BINDER_SET_CONTEXT_MGR already set [ 398.299453] binder: 17759:17760 ioctl 40046207 0 returned -16 [ 398.313495] binder: 17759:17760 Release 1 refcount change on invalid ref 0 ret -22 20:30:44 executing program 4: r0 = socket$inet(0x2, 0x0, 0x0) setsockopt$inet_opts(r0, 0x0, 0x0, &(0x7f00000000c0)="8907", 0x2) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) r3 = memfd_create(&(0x7f0000000280)='[\'posix_acl_access\x00', 0x0) pwritev(r3, &(0x7f00000001c0)=[{&(0x7f0000000200)=',', 0x1}], 0x1, 0x4081806) sendfile(r1, r3, &(0x7f00000000c0), 0x20020102000007) pipe(&(0x7f0000000180)={0xffffffffffffffff}) ioctl$TIOCEXCL(0xffffffffffffffff, 0x540c) vmsplice(r4, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) fstat(r3, &(0x7f0000000b40)) ioctl$TIOCGPGRP(0xffffffffffffffff, 0x540f, &(0x7f0000000cc0)) getsockopt$inet6_IPV6_IPSEC_POLICY(0xffffffffffffffff, 0x29, 0x22, &(0x7f00000010c0)={{{@in6=@mcast2, @in=@remote}}, {{@in6=@local}, 0x0, @in6=@loopback}}, &(0x7f00000011c0)=0xe8) recvfrom$unix(r2, &(0x7f0000000040)=""/4, 0xebc3276d6d4b1cd2, 0x100100, &(0x7f0000000100)=@abs, 0x930000) openat$selinux_avc_cache_stats(0xffffffffffffff9c, &(0x7f0000000240)='/selinux/avc/cache_stats\x00', 0x0, 0x0) 20:30:44 executing program 5: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$nl_netfilter(r0, &(0x7f0000000080)={&(0x7f0000000100), 0xc, &(0x7f00000000c0)={&(0x7f0000000140)=ANY=[@ANYBLOB="140000000301ffff808f00003d88c83f00b516babcd3c80a4e18606c071ffa25d9b428794877c99b6e98dbee61370f74ee6d4e7d4b8b5cf1b57abead6fe165cd787b0b60f8212a301bdd75afb2d4148092ad9ab3455a27ac6d21af8d0e43f6eb4411348a928d513452f9b6f3d5fb1e72d4db14d660921c4517d0f8c4d8d04ed5098eb6e4a38c1fee8bc9307bc61df2765e5e6875daeac0db5afafd5869868d531051f49170722622809741e1f23b1c095720f8992c14d1feb249e3cd0f8e073641ecd0750fe93963f4"], 0x14}}, 0x0) recvmmsg(r0, &(0x7f00000013c0), 0x1ad, 0x0, &(0x7f0000000c40)={0x77359400}) [ 398.628090] binder: 17720:17727 ioctl 40087602 200001c0 returned -22 [ 398.635781] binder: BINDER_SET_CONTEXT_MGR already set [ 398.641378] binder_alloc: 17720: binder_alloc_buf, no vma [ 398.647319] binder: 17720:17778 ioctl 40046207 0 returned -16 [ 398.653434] binder: 17720:17779 transaction failed 29189/-3, size 24-8 line 3137 [ 398.661501] binder: 17720:17727 unknown command 1026 [ 398.666801] binder: 17720:17778 unknown command 1074021894 20:30:44 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) syz_open_dev$sndtimer(&(0x7f0000000080)='/dev/snd/timer\x00', 0x0, 0x282042) ioctl$FS_IOC_SETVERSION(r0, 0x40087602, &(0x7f00000001c0)) r1 = syz_open_dev$binder(&(0x7f0000000640)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="00000080"], 0x1, 0x0, &(0x7f0000000040)='+'}) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0x0, 0x0, &(0x7f0000000780)}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000380)={0x8, 0x0, &(0x7f0000000500)=[@release={0x40046306, 0x1}], 0x0, 0x0, &(0x7f0000000400)}) 20:30:44 executing program 0: r0 = socket$inet(0x2, 0x0, 0x0) setsockopt$inet_opts(r0, 0x0, 0x0, &(0x7f00000000c0)="8907", 0x2) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) r3 = memfd_create(&(0x7f0000000280)='[\'posix_acl_access\x00', 0x0) pwritev(r3, &(0x7f00000001c0)=[{&(0x7f0000000200)=',', 0x1}], 0x1, 0x4081806) sendfile(r1, r3, &(0x7f00000000c0), 0x20020102000007) pipe(&(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$TIOCEXCL(0xffffffffffffffff, 0x540c) write(r5, &(0x7f00000001c0), 0xfffffef3) vmsplice(r4, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) ioctl$TIOCGPGRP(0xffffffffffffffff, 0x540f, &(0x7f0000000cc0)) getsockopt$inet6_IPV6_IPSEC_POLICY(0xffffffffffffffff, 0x29, 0x22, &(0x7f00000010c0)={{{@in6=@mcast2, @in=@remote}}, {{@in6=@local}, 0x0, @in6=@loopback}}, &(0x7f00000011c0)=0xe8) recvfrom$unix(r2, &(0x7f0000000040)=""/4, 0xebc3276d6d4b1cd2, 0x100100, &(0x7f0000000100)=@abs, 0x930000) openat$selinux_avc_cache_stats(0xffffffffffffff9c, &(0x7f0000000240)='/selinux/avc/cache_stats\x00', 0x0, 0x0) 20:30:44 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000640)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x0, 0x0, &(0x7f0000000300), 0x0, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000380)={0x8, 0x0, &(0x7f0000000500)=[@release], 0x0, 0x0, &(0x7f0000000400)}) [ 398.673957] binder: 17720:17727 ioctl c0306201 200002c0 returned -22 [ 398.680759] binder: 17720:17778 ioctl c0306201 20000380 returned -22 [ 398.687470] binder: BINDER_SET_CONTEXT_MGR already set [ 398.692999] binder: 17720:17727 ioctl 40046207 0 returned -16 [ 398.693193] binder: send failed reply for transaction 486 to 17720:17727 [ 398.693211] binder: send failed reply for transaction 489, target dead [ 398.693226] binder: send failed reply for transaction 492, target dead [ 398.699205] binder: undelivered TRANSACTION_ERROR: 29189 20:30:44 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000640)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, &(0x7f0000000200), &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000380)={0x8, 0x0, &(0x7f0000000500)=[@release], 0x0, 0x0, &(0x7f0000000400)}) [ 398.750490] binder: 17781:17782 Release 1 refcount change on invalid ref 0 ret -22 [ 398.767764] binder: 17783:17785 ioctl 40087602 200001c0 returned -22 [ 398.787235] binder: 17783:17785 unknown command -2147483648 [ 398.794685] binder: 17788:17790 got transaction with invalid offset (0, min 0 max 0) or object. [ 398.803988] binder: 17783:17785 ioctl c0306201 20000140 returned -22 [ 398.811363] binder: BINDER_SET_CONTEXT_MGR already set [ 398.817241] binder: 17788:17790 transaction failed 29201/-22, size 0-8 line 3200 [ 398.825746] binder: 17783:17785 ioctl 40046207 0 returned -16 [ 398.833004] binder: 17788:17790 Release 1 refcount change on invalid ref 0 ret -22 [ 398.841426] binder: undelivered TRANSACTION_ERROR: 29201 20:30:44 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000640)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000380)={0x8, 0x0, &(0x7f0000000500)=[@release], 0x0, 0x0, &(0x7f0000000400)}) [ 398.849601] binder: send failed reply for transaction 499 to 17783:17785 [ 398.864771] binder: 17783:17785 BC_INCREFS_DONE u0000000000000000 no match [ 398.872275] binder: 17793:17795 Release 1 refcount change on invalid ref 0 ret -22 [ 398.874909] binder: 17783:17785 Release 1 refcount change on invalid ref 1 ret -22 [ 398.887528] binder: 17783:17796 ioctl 40087602 200001c0 returned -22 [ 398.887772] binder_alloc: binder_alloc_mmap_handler: 17783 20001000-20004000 already mapped failed -16 [ 398.887867] binder: 17783:17785 unknown command -2147483648 [ 398.887874] binder: 17783:17785 ioctl c0306201 20000140 returned -22 [ 398.887928] binder: BINDER_SET_CONTEXT_MGR already set [ 398.887934] binder: 17783:17796 ioctl 40046207 0 returned -16 [ 398.888688] binder: 17783:17796 BC_INCREFS_DONE node 505 has no pending increfs request [ 398.894226] binder: release 17783:17785 transaction 504 out, still active [ 398.894230] binder: unexpected work type, 4, not freed 20:30:44 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$FS_IOC_SETVERSION(r0, 0x40087602, &(0x7f00000001c0)) r1 = syz_open_dev$binder(&(0x7f0000000640)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) stat(&(0x7f0000000080)='./file0\x00', &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) setfsgid(r2) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000000)=[@enter_looper], 0x1, 0x0, &(0x7f0000000040)='+'}) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0x0, 0x0, &(0x7f0000000780)}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000380)={0x8, 0x0, &(0x7f0000000500)=[@release={0x40046306, 0x1}], 0x0, 0x0, &(0x7f0000000400)}) [ 398.894233] binder: undelivered TRANSACTION_COMPLETE [ 398.913412] binder: 17797:17798 ioctl 40087602 200001c0 returned -22 [ 398.960790] binder: BINDER_SET_CONTEXT_MGR already set [ 398.971607] binder: 17797:17800 ioctl 40046207 0 returned -16 [ 398.974946] binder: release 17793:17795 transaction 503 out, still active [ 398.974950] binder: undelivered TRANSACTION_COMPLETE [ 398.975049] binder: send failed reply for transaction 503, target dead 20:30:44 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000640)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000380)={0x8, 0x0, &(0x7f0000000500)=[@release], 0x0, 0x0, &(0x7f0000000400)}) [ 398.975063] binder: send failed reply for transaction 504, target dead [ 399.011849] binder: 17797:17803 transaction failed 29189/-22, size 24-8 line 3014 [ 399.021961] binder: 17797:17803 BC_INCREFS_DONE u0000000000000000 no match [ 399.029488] binder: 17797:17803 Release 1 refcount change on invalid ref 1 ret -22 [ 399.041558] binder: 17804:17805 Release 1 refcount change on invalid ref 0 ret -22 20:30:45 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000640)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000380)={0x8, 0x0, &(0x7f0000000500)=[@release], 0x0, 0x0, &(0x7f0000000400)}) [ 399.067312] binder: release 17804:17805 transaction 509 out, still active [ 399.076439] binder: undelivered TRANSACTION_COMPLETE [ 399.090122] binder: send failed reply for transaction 509, target dead 20:30:45 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000640)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, &(0x7f0000000200), &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000380)={0x8, 0x0, &(0x7f0000000500)=[@release], 0x0, 0x0, &(0x7f0000000400)}) [ 399.136225] binder: 17808:17809 Release 1 refcount change on invalid ref 0 ret -22 [ 399.154232] binder: release 17808:17809 transaction 511 out, still active [ 399.163811] binder: undelivered TRANSACTION_COMPLETE [ 399.178061] binder: send failed reply for transaction 511, target dead 20:30:45 executing program 3: r0 = socket$inet(0x2, 0x6000000000000001, 0x0) setsockopt$inet_tcp_TCP_CONGESTION(r0, 0x6, 0xd, &(0x7f0000000680)='reno\x00', 0x60c5) accept$inet(r0, &(0x7f0000000000)={0x2, 0x0, @remote}, &(0x7f0000000040)=0x10) sendto$inet(r0, &(0x7f0000a88f88), 0xfffffffffffffe6e, 0x20000000, &(0x7f0000e68000)={0x2, 0x0, @local}, 0x10) [ 399.234349] binder: 17814:17816 got transaction with invalid offset (0, min 0 max 0) or object. 20:30:45 executing program 4: r0 = socket$inet(0x2, 0x0, 0x0) setsockopt$inet_opts(r0, 0x0, 0x0, &(0x7f00000000c0)="8907", 0x2) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) r3 = memfd_create(&(0x7f0000000280)='[\'posix_acl_access\x00', 0x0) pwritev(r3, &(0x7f00000001c0)=[{&(0x7f0000000200)=',', 0x1}], 0x1, 0x4081806) sendfile(r1, r3, &(0x7f00000000c0), 0x20020102000007) pipe(&(0x7f0000000180)={0xffffffffffffffff}) ioctl$TIOCEXCL(0xffffffffffffffff, 0x540c) vmsplice(r4, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) fstat(r3, &(0x7f0000000b40)) ioctl$TIOCGPGRP(0xffffffffffffffff, 0x540f, &(0x7f0000000cc0)) getsockopt$inet6_IPV6_IPSEC_POLICY(0xffffffffffffffff, 0x29, 0x22, &(0x7f00000010c0)={{{@in6=@mcast2, @in=@remote}}, {{@in6=@local}, 0x0, @in6=@loopback}}, &(0x7f00000011c0)=0xe8) recvfrom$unix(r2, &(0x7f0000000040)=""/4, 0xebc3276d6d4b1cd2, 0x100100, &(0x7f0000000100)=@abs, 0x930000) openat$selinux_avc_cache_stats(0xffffffffffffff9c, &(0x7f0000000240)='/selinux/avc/cache_stats\x00', 0x0, 0x0) 20:30:45 executing program 5: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$nl_netfilter(r0, &(0x7f0000000080)={&(0x7f0000000100), 0xc, &(0x7f00000000c0)={&(0x7f0000000340)=ANY=[@ANYBLOB="140000000301ffff808f00003d88c83f00b516ba"], 0x14}}, 0x0) recvmmsg(r0, &(0x7f00000013c0), 0x1ad, 0x0, &(0x7f0000000c40)={0x77359400}) setxattr$trusted_overlay_nlink(&(0x7f0000000000)='./file0\x00', &(0x7f0000000040)='trusted.overlay.nlink\x00', &(0x7f0000000140)={'L+', 0x3}, 0x28, 0x2) 20:30:45 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000640)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, &(0x7f0000000200), &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000500), 0x0, 0x0, &(0x7f0000000400)}) [ 399.287426] binder: 17814:17816 transaction failed 29201/-22, size 0-8 line 3200 [ 399.319790] binder: undelivered TRANSACTION_ERROR: 29201 [ 399.390207] binder: 17825:17828 got transaction with invalid offset (0, min 0 max 0) or object. [ 399.415334] binder: 17825:17828 transaction failed 29201/-22, size 0-8 line 3200 [ 399.444360] binder: undelivered TRANSACTION_ERROR: 29201 20:30:45 executing program 0: r0 = socket$inet(0x2, 0x0, 0x0) setsockopt$inet_opts(r0, 0x0, 0x0, &(0x7f00000000c0)="8907", 0x2) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) r3 = memfd_create(&(0x7f0000000280)='[\'posix_acl_access\x00', 0x0) pwritev(r3, &(0x7f00000001c0)=[{&(0x7f0000000200)=',', 0x1}], 0x1, 0x4081806) sendfile(r1, r3, &(0x7f00000000c0), 0x20020102000007) pipe(&(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$TIOCEXCL(0xffffffffffffffff, 0x540c) write(r5, &(0x7f00000001c0), 0xfffffef3) vmsplice(r4, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) ioctl$TIOCGPGRP(0xffffffffffffffff, 0x540f, &(0x7f0000000cc0)) getsockopt$inet6_IPV6_IPSEC_POLICY(0xffffffffffffffff, 0x29, 0x22, &(0x7f00000010c0)={{{@in6=@mcast2, @in=@remote}}, {{@in6=@local}, 0x0, @in6=@loopback}}, &(0x7f00000011c0)=0xe8) recvfrom$unix(r2, &(0x7f0000000040)=""/4, 0xebc3276d6d4b1cd2, 0x100100, &(0x7f0000000100)=@abs, 0x930000) openat$selinux_avc_cache_stats(0xffffffffffffff9c, &(0x7f0000000240)='/selinux/avc/cache_stats\x00', 0x0, 0x0) 20:30:45 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000640)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, &(0x7f0000000200), &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000500), 0x0, 0x0, &(0x7f0000000400)}) 20:30:45 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000640)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, &(0x7f0000000200), &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000500), 0x0, 0x0, &(0x7f0000000400)}) [ 399.657274] binder: 17840:17843 got transaction with invalid offset (0, min 0 max 0) or object. [ 399.667238] binder: 17840:17843 transaction failed 29201/-22, size 0-8 line 3200 [ 399.678269] binder: undelivered TRANSACTION_ERROR: 29201 [ 399.696229] binder: 17845:17847 got transaction with invalid offset (0, min 0 max 0) or object. [ 399.714017] binder: 17797:17800 ioctl 40087602 200001c0 returned -22 [ 399.717653] binder: 17845:17847 transaction failed 29201/-22, size 0-8 line 3200 [ 399.720065] binder: BINDER_SET_CONTEXT_MGR already set [ 399.720073] binder: 17797:17803 ioctl 40046207 0 returned -16 [ 399.725726] binder: send failed reply for transaction 520 to 17797:17849 [ 399.728895] binder: undelivered TRANSACTION_ERROR: 29201 [ 399.729053] binder: 17797:17803 BC_INCREFS_DONE u0000000000000000 no match 20:30:45 executing program 2: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r0, &(0x7f0000000100)={0xa, 0x4e22, 0x0, @empty, 0x4}, 0x1c) writev(0xffffffffffffffff, &(0x7f0000002980), 0x0) r1 = socket$inet6(0x10, 0x3, 0x0) sendmsg(r1, &(0x7f0000002fc8)={&(0x7f0000000000)=@nl, 0x80, &(0x7f0000002000)=[{&(0x7f0000000340)="5500000018007f5300fe01b2a4a280930a06000000a84308910000003900090008000c00010000001900150006000000000000dc1338d54400009b84136ef75afb83de448daa7227c43ab8220000060cec4fab6513", 0x55}], 0x1, &(0x7f0000000400), 0x0, 0x4}, 0x0) ioctl$EXT4_IOC_GROUP_EXTEND(0xffffffffffffffff, 0x40046607, &(0x7f0000000400)) listen(r0, 0x7c) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) mkdirat$cgroup(0xffffffffffffffff, &(0x7f0000000140)='syz1\x00', 0x1ff) r3 = memfd_create(&(0x7f0000000180)="0004003100", 0x0) ioctl$sock_SIOCGPGRP(r3, 0x8904, &(0x7f00000000c0)=0x0) syz_open_procfs(r4, &(0x7f0000000300)='net/ip_tables_names\x00') write$P9_RFSYNC(r3, &(0x7f0000000240)={0x7, 0x33, 0x1}, 0xfffffffffffffe2d) sendto$inet6(r2, &(0x7f0000000380), 0x0, 0x20000004, &(0x7f000031e000)={0xa, 0x4e22, 0x0, @ipv4}, 0x1c) openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000b80)="2e2f6367726f75702f73797a3100b8458a1392623c2acc07743172c163cfc71523709c3289acba6eaf2919f32ebaa4cbe89ed30167d7d56e8e65c0edbb300c9e287f10f513e776522729d5c85c09fed3f33ea055b94d27bb72a2bb9fd56015f25cf4f9ced65ed81253cfba08e9a329935ac0c64d10a5e701cc58fe4af8cb5b679468e8ad39e103e2d5b7d9078c34eb2832a5852b28958b7efeca8ffc69c09a7ca33d82e59f9e27ea25a7cf5e65bc52987952070ddac3929791a23f905fbd72419d1539", 0x200002, 0x0) fchdir(0xffffffffffffffff) r5 = creat(&(0x7f00000005c0)='./bus\x00', 0x0) r6 = open(&(0x7f0000000540)='./bus\x00', 0x141042, 0x0) sigaltstack(&(0x7f0000ffe000/0x1000)=nil, &(0x7f0000000480)) write$selinux_context(r6, &(0x7f0000000000)='system_u:object_r:crontab_exec_t:s0\x00', 0xfffffffffffffe84) r7 = creat(&(0x7f00000003c0)='./bus\x00', 0x2) r8 = openat$null(0xffffffffffffff9c, &(0x7f00000004c0)='/dev/null\x00', 0x80000, 0x0) write(r8, &(0x7f0000000380), 0x0) write$cgroup_type(r5, &(0x7f0000000200)='threaded\x00', 0xfffffeb3) select(0x40, &(0x7f0000000040), &(0x7f0000000080), &(0x7f00000001c0), &(0x7f0000000280)={0x77359400}) getsockopt$IP6T_SO_GET_ENTRIES(r0, 0x29, 0x41, &(0x7f0000000600)=ANY=[@ANYBLOB="73656375726974796d0000000000000000000000000000000000000000000000c40000004e8b4b1c7fa37c911d43b7dfc1540065e2cf063a33e71b903574450eb6fcc611bb94c232461f22877f4a6bfa2e09f7f448f8a2ef823ff78d796ab6ab52f030b8fea1243b4a37836d690100843a8998fea04a2bc474078acbb61c426c93824178b70a4bcff2d634050eca0d4f941bfec0542fd99b2bd8823b4175d0b0e455f170e292c18a346a02c3d1db9e8eb933105282efa911967fdc58383f9af93bc9c8b8578b5ed8ba7d2084ab94919aea43e1a3acfd6d899d943862ca8d84436629d2159976a615f1279aaf23ce57319edb9be03d5b849777d956c09bcb8bc5eb1d793fe7b7d0c34d4d6cc6d28cb9f66b0a2f31eda0ce948210375abcde9320750390dc04b3af4959443184210eb68c4fe6dced7e44cd2b39f7d25dc53dab0fd596852191868741cecd379b6e87b1c1a8c0dc6b8004595fb61135ed10927d6df243071d53b4757c13f4ceb4480e4a7b9c730be6258db763d9e9e7baeccd140ed2311fd9c570db36e93131c27442990068d315088680ab63a288fb05b1676a9ab2fe9aa99539a1cfbb1ae8b35cd18007ba5105ed92f8914bcc2397da080dd1da393ede4f195953f82d03b9a920391ee4f5bd7485d69e1d8bfc93521ea451a20dd056bd3c133aa93c9bef1e254ad7d19379b21be984d93cbecfcbffc82708aebe5fe4c4aa7af905248de89163041c16cfdaf96ee5b65715c7bb840274ba8ddc979ae077aa20b5ba0e97ecd80abb2d3cdb2d2b6603b3a003871b7220d71909f230fa5e9a7307c10c954a2ff1c6bf5fe3e153c0ebeb4940c365ef1e9cc8588a51bfc9807e866ea6528a77c930c06eb50e3f14ca8abf929570c05ca0615211cdcce3d034946d4fadcc9df5702fca33cb322c27a54fee8cd7901df1066311b737259dfc65048bcff6eca8f566ed75b5d21b58a3c51907ba6d5ef9e04e24febdea1d345b16288065bf64cf9fa3a746185191dc7b2f4520fd2da2f60434395d6121d7063a6455be070f49e04c8c2fa0da58d878d80a1bf9cc58b6926e3c471ca1e79cb85f6ce2ad91ac6c68f955a507ad55f514d131e0a095329227c9888f9fb19bfe6df77dff07ef08544a33e9f10d72e3ca6a0d70bf0d4b3e607a2238db2aa9c1011d0af4a39786e48004427b8b55fcd1f7ad63a9aa5338475975159310e0e40000000000000000000000000000000000000000000000000000"], &(0x7f00000002c0)=0x1) recvfrom$inet6(r0, &(0x7f0000001840)=""/31, 0x1f, 0x103, &(0x7f0000001880)={0xa, 0x0, 0xffff}, 0x1c) getsockopt$inet_mreqn(r7, 0x0, 0x23, &(0x7f0000000500)={@multicast1, @multicast1, 0x0}, &(0x7f0000000440)=0xc) setsockopt$inet6_IPV6_PKTINFO(r5, 0x29, 0x32, &(0x7f0000000580)={@remote, r9}, 0x14) r10 = accept4(r0, 0x0, &(0x7f0000000000)=0xfffffffffffffefa, 0x0) sendto$inet6(r10, &(0x7f00000000c0), 0xfffffffffffffe2b, 0x0, 0x0, 0x0) [ 399.729102] binder: 17797:17849 Release 1 refcount change on invalid ref 1 ret -22 20:30:45 executing program 1: lseek(0xffffffffffffffff, 0x0, 0x7) socketpair(0x1b, 0x5, 0x5, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = mmap$binder(&(0x7f0000003000/0x4000)=nil, 0x4000, 0x1, 0x50, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0x18, 0x0, &(0x7f00000000c0)=[@register_looper, @acquire_done={0x40106309, r1, 0x1}], 0xe4, 0x0, &(0x7f0000000540)="ee79e80ef1dd9a0b693462bae324a5747f9c16c1d5c3e4f022c0ce3769c63c504553af15c735b6aa69c230f173684947fe6ac1c56767ba263a790e73af5d11c89a8c06825d08e09c06594151dca05afb5474545583205ace377cc48b5c8987e0c63b7f9980061edf5eccd335e7bb72e992f53038678a993cf63b2a0053e6f1e884970c183283ef901eaeffae6b9f98fb9874142dc52fad3fd1cda98b19d3192fcb3ab095faf19880b98e161542d3509c6178f28c16ba3bbdc261f899a7fa7e193b7580c14255867be7bc055b5ba54fedb9d426195612ad31c2317f374143df0948810dff"}) r2 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$FS_IOC_SETVERSION(r2, 0x40087602, &(0x7f00000001c0)) r3 = syz_open_dev$binder(&(0x7f0000000640)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r3, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="48138cf7"], 0x1, 0x0, &(0x7f0000000040)='+'}) ioctl$BINDER_SET_CONTEXT_MGR(r3, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0x0, 0x0, &(0x7f0000000780)}) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000000380)={0x8, 0x0, &(0x7f0000000500)=[@release={0x40046306, 0x1}], 0x0, 0x0, &(0x7f0000000400)}) [ 399.818959] binder: 17854:17855 ioctl 40087602 200001c0 returned -22 [ 399.826588] binder: 17854:17855 unknown command -141814968 [ 399.832532] binder: 17854:17855 ioctl c0306201 20000140 returned -22 [ 399.889893] binder: 17854:17859 BC_INCREFS_DONE node 525 has no pending increfs request 20:30:46 executing program 3: r0 = socket$inet(0x2, 0x4000000000000001, 0x0) setsockopt$inet_tcp_TCP_CONGESTION(r0, 0x6, 0xd, &(0x7f0000000680)='reno\x00', 0x60c5) r1 = accept$inet6(0xffffffffffffffff, 0x0, &(0x7f0000000000)) ioctl$sock_inet6_udp_SIOCOUTQ(r1, 0x5411, &(0x7f0000000040)) sendto$inet(r0, &(0x7f0000a88f88), 0xfffffffffffffe6e, 0x20000000, &(0x7f0000e68000)={0x2, 0x0, @local}, 0x10) 20:30:46 executing program 5: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) inotify_init() sendmsg$nl_netfilter(r0, &(0x7f0000000080)={&(0x7f0000000100), 0xc, &(0x7f00000000c0)={&(0x7f0000000340)=ANY=[@ANYBLOB="140000000301ffff808f00003d88c83f00b516ba"], 0x14}}, 0x0) recvmmsg(r0, &(0x7f00000013c0), 0x0, 0x20, &(0x7f0000000040)={0x0, 0x1c9c380}) flock(r0, 0x3) 20:30:46 executing program 4: r0 = socket$inet(0x2, 0x0, 0x0) setsockopt$inet_opts(r0, 0x0, 0x0, &(0x7f00000000c0)="8907", 0x2) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) r3 = memfd_create(&(0x7f0000000280)='[\'posix_acl_access\x00', 0x0) pwritev(r3, &(0x7f00000001c0)=[{&(0x7f0000000200)=',', 0x1}], 0x1, 0x4081806) sendfile(r1, r3, &(0x7f00000000c0), 0x20020102000007) pipe(&(0x7f0000000180)={0xffffffffffffffff}) ioctl$TIOCEXCL(0xffffffffffffffff, 0x540c) vmsplice(r4, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) fstat(r3, &(0x7f0000000b40)) ioctl$TIOCGPGRP(0xffffffffffffffff, 0x540f, &(0x7f0000000cc0)) getsockopt$inet6_IPV6_IPSEC_POLICY(0xffffffffffffffff, 0x29, 0x22, &(0x7f00000010c0)={{{@in6=@mcast2, @in=@remote}}, {{@in6=@local}, 0x0, @in6=@loopback}}, &(0x7f00000011c0)=0xe8) recvfrom$unix(r2, &(0x7f0000000040)=""/4, 0xebc3276d6d4b1cd2, 0x100100, &(0x7f0000000100)=@abs, 0x930000) openat$selinux_avc_cache_stats(0xffffffffffffff9c, &(0x7f0000000240)='/selinux/avc/cache_stats\x00', 0x0, 0x0) 20:30:46 executing program 5: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$nl_netfilter(r0, &(0x7f0000000080)={&(0x7f0000000100), 0xc, &(0x7f00000000c0)={&(0x7f0000000340)=ANY=[@ANYBLOB="143ac4000301ffff008f00003d88c83f00b516ba"], 0x14}}, 0x0) creat(&(0x7f0000000000)='./file0\x00', 0x122) recvmmsg(r0, &(0x7f00000013c0), 0x1ad, 0x0, &(0x7f0000000c40)={0x77359400}) 20:30:46 executing program 0: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r0, &(0x7f0000000100)={0xa, 0x4e22, 0x0, @empty, 0x4}, 0x1c) writev(0xffffffffffffffff, &(0x7f0000002980), 0x0) r1 = socket$inet6(0x10, 0x3, 0x0) sendmsg(r1, &(0x7f0000002fc8)={&(0x7f0000000000)=@nl, 0x80, &(0x7f0000002000)=[{&(0x7f0000000340)="5500000018007f5300fe01b2a4a280930a06000000a84308910000003900090008000c00010000001900150006000000000000dc1338d54400009b84136ef75afb83de448daa7227c43ab8220000060cec4fab6513", 0x55}], 0x1, &(0x7f0000000400), 0x0, 0x4}, 0x0) ioctl$EXT4_IOC_GROUP_EXTEND(0xffffffffffffffff, 0x40046607, &(0x7f0000000600)) listen(r0, 0x7c) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) mkdirat$cgroup(0xffffffffffffffff, &(0x7f0000000140)='syz1\x00', 0x1ff) r3 = memfd_create(&(0x7f0000000180)="0004003100", 0x0) ioctl$sock_SIOCGPGRP(r3, 0x8904, &(0x7f00000000c0)=0x0) syz_open_procfs(r4, &(0x7f0000000300)='net/ip_tables_names\x00') write$P9_RFSYNC(r3, &(0x7f0000000240)={0x7, 0x33, 0x1}, 0xfffffffffffffe2d) sendto$inet6(r2, &(0x7f0000000380), 0x0, 0x20000004, &(0x7f000031e000)={0xa, 0x4e22, 0x0, @ipv4}, 0x1c) openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000b80)="2e2f6367726f75702f73797a3100b8458a1392623c2acc07743172c163cfc71523709c3289acba6eaf2919f32ebaa4cbe89ed30167d7d56e8e65c0edbb300c9e287f10f513e776522729d5c85c09fed3f33ea055b94d27bb72a2bb9fd56015f25cf4f9ced65ed81253cfba08e9a329935ac0c64d10a5e701cc58fe4af8cb5b679468e8ad39e103e2d5b7d9078c34eb2832a5852b28958b7efeca8ffc69c09a7ca33d82e59f9e27ea25a7cf5e65bc52987952070ddac3929791a23f905fbd72419d1539", 0x200002, 0x0) fchdir(0xffffffffffffffff) r5 = creat(&(0x7f00000005c0)='./bus\x00', 0x8000) r6 = open(&(0x7f0000000540)='./bus\x00', 0x141042, 0x0) sigaltstack(&(0x7f0000ffe000/0x1000)=nil, &(0x7f0000000480)) write$selinux_context(r6, &(0x7f0000000000)='system_u:object_r:crontab_exec_t:s0\x00', 0xfffffffffffffe84) r7 = creat(&(0x7f00000003c0)='./bus\x00', 0x2) r8 = openat$null(0xffffffffffffff9c, &(0x7f00000004c0)='/dev/null\x00', 0x2807fd, 0x0) write(r8, &(0x7f0000000380), 0x0) write$cgroup_type(r5, &(0x7f0000000200)='threaded\x00', 0xfffffeb3) select(0x40, &(0x7f0000000040), &(0x7f0000000080), &(0x7f00000001c0), &(0x7f0000000280)={0x77359400}) getsockopt$IP6T_SO_GET_ENTRIES(r0, 0x29, 0x41, &(0x7f0000000c80)=ANY=[@ANYBLOB="73656375726974796d0000000000000000000000000000000000000000000000c40000004e8b4b1c7fa37c911d43b7dfc1540065e2cf063a33e71b903574450eb6fcc611bb94c232461f22877f4a6bfa2e09f7f448f8a2ef823ff78d796ab6ab52f030b8fea1243b4a37836d690100843a8998fea04a2bc474078acbb61c426c93824178b70a4bcff2d634050eca0d4f941bfec0542fd99b2bd8823b4175d0b0e455f170e292c18a967fdc58383f9af93bc9c8b8578b5ed8ba7d2084ab94919aea43e1a3acfd6d899d943862ca8d84436629d2159976a615f1279aaf23ce57319edb9be03d5b849777d956c09bcb8bc5eb1d793fe7b7d0c34d4d6cc6d28cb9f66b0a2f31eda0ce948210375abcde9320750390dc04b3af4959443184210eb68c4fe6dced7e44cd2b39f7d25dc53dab0fd596852191868741cecd379b6e87b1c1a8c0dc6b8004595fb61135ed10927d6df243071d53b4757c13f4ceb4480e4a7b9c730be6258db763d9e9e7baeccd140ed2311fd9c570db36e93131c27442990068d315088680ab638288fb05b1676a9ab2fe9aa99539a1cfbb1ae8b35cd18007ba5105ed92f8914bcc2397da080dd1da393ede4f195953f82d03b9a920391ee4f5bd7485d69e1d8bfc93521ea451a20dd056bd3c133aa93c9bef1e254ad7d19379b21be984d93cc7cfcbffc82708aebe5fe4c4aa7af905248de89163041c16cfdaf96ee5b65715c7bb840274ba8ddc979ae077aa20b5ba0e97ecd80abb2d3cdb2d2b6603b3a003871b7220d71909f230fa5e9a7307c10c954a2ff1c6bf5fe3e153c0ebeb4940c365ef1e9cc8588a51bfc9807e866ea6528a77c930c06eb50e3f14ca8abf929570c05ca0615211cdcce3d034946d4fadcc9df5702fca33cb322c27a54fee8cd7901df1066311b737259dfc65048bcff6eca8f566ed75b5d21b58a3c51907ba6d5ef9e04e24febdea1d345b16288065bf64cf9fa3a746185191dc7b2f4520fd2da2f60434395d6121d7063a6455be070f49e04c8c2fa0da58d878d80a1bf9cc58b6926e3c471cb1e79cb85f6ce2ad91ac6c68f955a507ad55f514d131e0a095329227c9888f9fb19bfe6df77dff07ef08544a33e9f10d72e3ca6a0d70bf0d4b3e607a2238db2aa9c1011d0af4a39786e48004427b8b55fcd1f7ad63a9aa5338475975159310e0e40000000000000000000000000000000000000000000000000000"], &(0x7f00000002c0)=0x1) recvfrom$inet6(r2, &(0x7f0000001840)=""/31, 0xfffffe0e, 0x100, &(0x7f0000001880)={0xa, 0x0, 0xffff}, 0x1c) getsockopt$inet_mreqn(r7, 0x0, 0x23, &(0x7f0000000500)={@multicast1, @multicast1, 0x0}, &(0x7f0000000440)=0xc) setsockopt$inet6_IPV6_PKTINFO(r5, 0x29, 0x32, &(0x7f0000000580)={@remote, r9}, 0x14) r10 = accept4(r0, 0x0, &(0x7f0000000000)=0xfffffffffffffefa, 0x0) sendto$inet6(r10, &(0x7f00000000c0), 0xfffffffffffffe2b, 0x0, 0x0, 0x0) 20:30:46 executing program 2: r0 = socket$inet(0x2, 0x0, 0x0) setsockopt$inet_opts(r0, 0x0, 0x0, &(0x7f00000000c0)="8907", 0x2) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) r3 = memfd_create(&(0x7f0000000280)='[\'posix_acl_access\x00', 0x0) pwritev(r3, &(0x7f00000001c0)=[{&(0x7f0000000200)=',', 0x1}], 0x1, 0x4081806) sendfile(r1, r3, &(0x7f00000000c0), 0x20020102000007) pipe(&(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$TIOCEXCL(0xffffffffffffffff, 0x540c) write(r5, &(0x7f00000001c0), 0xfffffef3) vmsplice(r4, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) fstat(r3, &(0x7f0000000b40)) getsockopt$inet6_IPV6_IPSEC_POLICY(0xffffffffffffffff, 0x29, 0x22, &(0x7f00000010c0)={{{@in6=@mcast2, @in=@remote}}, {{@in6=@local}, 0x0, @in6=@loopback}}, &(0x7f00000011c0)=0xe8) recvfrom$unix(r2, &(0x7f0000000040)=""/4, 0xebc3276d6d4b1cd2, 0x100100, &(0x7f0000000100)=@abs, 0x930000) openat$selinux_avc_cache_stats(0xffffffffffffff9c, &(0x7f0000000240)='/selinux/avc/cache_stats\x00', 0x0, 0x0) [ 400.626250] binder: 17854:17889 ioctl 40087602 200001c0 returned -22 [ 400.642632] binder: 17854:17893 unknown command -141814968 [ 400.667589] binder: 17854:17893 ioctl c0306201 20000140 returned -22 [ 400.678932] binder: BINDER_SET_CONTEXT_MGR already set [ 400.695245] binder_alloc: 17854: binder_alloc_buf, no vma [ 400.700961] binder: 17854:17859 ioctl 40046207 0 returned -16 [ 400.704997] binder: 17854:17889 transaction failed 29189/-3, size 24-8 line 3137 20:30:46 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$FS_IOC_SETVERSION(r0, 0x40087602, &(0x7f00000001c0)) r1 = syz_open_dev$binder(&(0x7f0000000640)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000000)=[@enter_looper], 0x1, 0x0, &(0x7f0000000040)='+'}) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) syz_open_dev$binder(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x802) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0x0, 0x0, &(0x7f0000000780)}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000380)={0x8, 0x0, &(0x7f0000000500)=[@release={0x40046306, 0x1}], 0x0, 0x0, &(0x7f0000000400)}) [ 400.705095] binder: 17854:17889 BC_INCREFS_DONE u0000000000000000 no match [ 400.721430] binder: 17854:17891 Release 1 refcount change on invalid ref 1 ret -22 [ 400.737576] binder: send failed reply for transaction 524 to 17854:17855 [ 400.747935] binder: undelivered TRANSACTION_COMPLETE [ 400.759977] binder: undelivered TRANSACTION_ERROR: 29189 [ 400.782251] binder: 17900:17901 ioctl 40087602 200001c0 returned -22 20:30:47 executing program 4: r0 = socket$inet(0x2, 0x0, 0x0) setsockopt$inet_opts(r0, 0x0, 0x0, &(0x7f00000000c0)="8907", 0x2) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) r3 = memfd_create(&(0x7f0000000280)='[\'posix_acl_access\x00', 0x0) pwritev(r3, &(0x7f00000001c0)=[{&(0x7f0000000200)=',', 0x1}], 0x1, 0x4081806) sendfile(r1, r3, &(0x7f00000000c0), 0x20020102000007) pipe(&(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) write(r5, &(0x7f00000001c0), 0xfffffef3) vmsplice(r4, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) fstat(r3, &(0x7f0000000b40)) ioctl$TIOCGPGRP(0xffffffffffffffff, 0x540f, &(0x7f0000000cc0)) getsockopt$inet6_IPV6_IPSEC_POLICY(0xffffffffffffffff, 0x29, 0x22, &(0x7f00000010c0)={{{@in6=@mcast2, @in=@remote}}, {{@in6=@local}, 0x0, @in6=@loopback}}, &(0x7f00000011c0)=0xe8) recvfrom$unix(r2, &(0x7f0000000040)=""/4, 0xebc3276d6d4b1cd2, 0x100100, &(0x7f0000000100)=@abs, 0x930000) openat$selinux_avc_cache_stats(0xffffffffffffff9c, &(0x7f0000000240)='/selinux/avc/cache_stats\x00', 0x0, 0x0) 20:30:47 executing program 3: r0 = socket$inet(0x2, 0x4000000000000001, 0x0) setsockopt$inet_tcp_TCP_CONGESTION(r0, 0x6, 0xd, &(0x7f0000000680)='reno\x00', 0x60c5) sendto$inet(r0, &(0x7f0000a88f88), 0xfffffffffffffe6e, 0x20000000, &(0x7f0000e68000)={0x2, 0x0, @local}, 0x10) ioctl$sock_FIOGETOWN(r0, 0x8903, &(0x7f0000000000)=0x0) fcntl$setown(r0, 0x8, r1) 20:30:47 executing program 5: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$nl_netfilter(r0, &(0x7f0000000080)={&(0x7f0000000100), 0xc, &(0x7f00000000c0)={&(0x7f0000000340)=ANY=[@ANYBLOB="140000000301ffff808f00003d88c83f00b516ba"], 0x14}}, 0x0) bind(r0, &(0x7f0000000000)=@pppol2tpv3={0x18, 0x1, {0x0, r0, {0x2, 0x4e24, @dev={0xac, 0x14, 0x14, 0xd}}, 0x4, 0x1, 0x0, 0x2}}, 0x80) recvmmsg(r0, &(0x7f00000013c0), 0x1ad, 0x0, &(0x7f0000000c40)={0x77359400}) 20:30:47 executing program 0: r0 = socket$nl_generic(0x10, 0x3, 0x10) getsockname$packet(0xffffffffffffff9c, &(0x7f0000004280)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @random}, &(0x7f00000042c0)=0x14) connect(r0, &(0x7f0000004300)=@hci={0x1f, r1, 0x3}, 0x80) r2 = socket$inet(0x2, 0x4000000000000001, 0x0) r3 = openat$selinux_mls(0xffffffffffffff9c, &(0x7f0000000140)='/selinux/mls\x00', 0x0, 0x0) recvfrom(r0, &(0x7f0000000380)=""/157, 0x9d, 0x2002, 0x0, 0x0) epoll_wait(r3, &(0x7f0000000180), 0x0, 0x3ff) ioctl$sock_inet_SIOCSARP(r3, 0x8955, &(0x7f0000000440)={{0x2, 0x4e21, @remote}, {0x1, @dev={[], 0x1c}}, 0x7e, {0x2, 0x4e21}, 'veth1_to_bond\x00'}) fsetxattr$trusted_overlay_origin(r2, &(0x7f0000000180)='trusted.overlay.origin\x00', &(0x7f00000002c0)='y\x00', 0x2, 0x1) setsockopt$inet_tcp_TCP_CONGESTION(r2, 0x6, 0xd, &(0x7f0000000680)='reno\x00', 0x60c5) ioctl$sock_inet6_tcp_SIOCATMARK(r3, 0x8905, &(0x7f0000000240)) sendto$inet(r2, &(0x7f0000a88f88), 0xfffffffffffffe6e, 0x20000000, &(0x7f0000e68000)={0x2, 0x0, @local}, 0x10) epoll_create1(0x80000) ioctl$sock_inet_SIOCDELRT(r3, 0x890c, &(0x7f0000000300)={0xcd, {0x2, 0x4e24, @multicast1}, {0x2, 0x4e20, @rand_addr=0x8000}, {0x2, 0x4e24, @loopback}, 0x4a, 0xffffffffffffffc1, 0x7597066a, 0x4, 0x7, &(0x7f00000001c0)='nr0\x00', 0x9, 0x7000000000000, 0x52d8}) r4 = dup2(r2, r0) sendto$unix(r4, &(0x7f0000000000)="cf22bb20e6a2b4cda4e3f77d3c0988029dd08dc8387b448d78d05cea456d9f78ecb8062b5130616fb1827b55830e6a2bd1e8a0088a06c73df4ad0e6c0f1b1e487e7b4537712db65207a83adea1fababcc51b22e05614db66deda91e3c05655053290c59e4c040a035d1be76758eebbd9b288234dfc82f27170a5e5680321dfef11fae065bbab510175b5a66842e653aadb0d84", 0x93, 0x4000000, &(0x7f00000000c0)=@abs={0x1, 0x0, 0x4e24}, 0x6e) ioctl$sock_inet6_tcp_SIOCATMARK(r2, 0x8905, &(0x7f0000000200)) 20:30:47 executing program 0: r0 = socket$inet(0x2, 0x0, 0x0) setsockopt$inet_opts(r0, 0x0, 0x0, &(0x7f00000000c0)="8907", 0x2) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) r3 = memfd_create(&(0x7f0000000280)='[\'posix_acl_access\x00', 0x0) pwritev(r3, &(0x7f00000001c0)=[{&(0x7f0000000200)=',', 0x1}], 0x1, 0x4081806) sendfile(r1, r3, &(0x7f00000000c0), 0x20020102000007) pipe(&(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$TIOCEXCL(0xffffffffffffffff, 0x540c) write(r5, &(0x7f00000001c0), 0xfffffef3) vmsplice(r4, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) fstat(r3, &(0x7f0000000b40)) ioctl$TIOCGPGRP(0xffffffffffffffff, 0x540f, &(0x7f0000000cc0)) recvfrom$unix(r2, &(0x7f0000000040)=""/4, 0xebc3276d6d4b1cd2, 0x100100, &(0x7f0000000100)=@abs, 0x930000) openat$selinux_avc_cache_stats(0xffffffffffffff9c, &(0x7f0000000240)='/selinux/avc/cache_stats\x00', 0x0, 0x0) 20:30:47 executing program 2: r0 = socket$inet(0x2, 0x0, 0x0) setsockopt$inet_opts(r0, 0x0, 0x0, &(0x7f00000000c0)="8907", 0x2) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) r3 = memfd_create(&(0x7f0000000280)='[\'posix_acl_access\x00', 0x0) pwritev(r3, &(0x7f00000001c0)=[{&(0x7f0000000200)=',', 0x1}], 0x1, 0x4081806) sendfile(r1, r3, &(0x7f00000000c0), 0x20020102000007) pipe(&(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$TIOCEXCL(0xffffffffffffffff, 0x540c) write(r5, &(0x7f00000001c0), 0xfffffef3) vmsplice(r4, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) fstat(r3, &(0x7f0000000b40)) getsockopt$inet6_IPV6_IPSEC_POLICY(0xffffffffffffffff, 0x29, 0x22, &(0x7f00000010c0)={{{@in6=@mcast2, @in=@remote}}, {{@in6=@local}, 0x0, @in6=@loopback}}, &(0x7f00000011c0)=0xe8) recvfrom$unix(r2, &(0x7f0000000040)=""/4, 0xebc3276d6d4b1cd2, 0x100100, &(0x7f0000000100)=@abs, 0x930000) openat$selinux_avc_cache_stats(0xffffffffffffff9c, &(0x7f0000000240)='/selinux/avc/cache_stats\x00', 0x0, 0x0) [ 401.582337] binder: 17900:17902 ioctl 40087602 200001c0 returned -22 [ 401.599990] binder: BINDER_SET_CONTEXT_MGR already set [ 401.607603] binder: 17900:17943 BC_INCREFS_DONE u0000000000000000 no match [ 401.613954] binder_alloc: 17900: binder_alloc_buf, no vma [ 401.613997] binder: 17900:17938 transaction failed 29189/-3, size 24-8 line 3137 [ 401.614036] binder: 17900:17902 ioctl 40046207 0 returned -16 [ 401.651233] binder: send failed reply for transaction 529 to 17900:17902 [ 401.660129] binder: undelivered TRANSACTION_ERROR: 29189 20:30:47 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0x0, 0x0) ioctl$FS_IOC_SETVERSION(r0, 0x40087602, &(0x7f00000001c0)) r1 = syz_open_dev$binder(&(0x7f0000000640)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000000)=[@enter_looper], 0x1, 0x0, &(0x7f0000000040)='+'}) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0x0, 0x0, &(0x7f0000000780)}) syz_open_dev$evdev(&(0x7f0000000080)='/dev/input/event#\x00', 0x0, 0x200040) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000380)={0xfffffe98, 0x0, &(0x7f0000000500)=[@release={0x40046306, 0x1}], 0x0, 0x0, &(0x7f0000000400)}) [ 401.733414] binder: 17949:17950 ioctl 40087602 200001c0 returned -22 [ 401.813780] binder: 17949:17953 got transaction to context manager from process owning it [ 401.868936] binder: 17949:17955 BC_INCREFS_DONE node 533 has no pending increfs request [ 401.880599] binder: 17949:17953 transaction failed 29201/-22, size 24-8 line 3005 [ 401.909862] binder: 17949:17956 Release 1 refcount change on invalid ref 1 ret -22 [ 401.952937] binder: 17949:17956 unknown command 0 [ 401.981773] binder: 17949:17956 ioctl c0306201 20000380 returned -22 20:30:48 executing program 3: r0 = socket$inet(0x2, 0x4000000000000001, 0x9) setsockopt$inet_tcp_TCP_CONGESTION(r0, 0x6, 0xd, &(0x7f0000000680)='reno\x00', 0x60c5) sendto$inet(r0, &(0x7f0000a88f88), 0xfffffffffffffe6e, 0x20000000, &(0x7f0000e68000)={0x2, 0x0, @local}, 0x10) 20:30:48 executing program 4: r0 = socket$inet(0x2, 0x0, 0x0) setsockopt$inet_opts(r0, 0x0, 0x0, &(0x7f00000000c0)="8907", 0x2) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) r3 = memfd_create(&(0x7f0000000280)='[\'posix_acl_access\x00', 0x0) pwritev(r3, &(0x7f00000001c0)=[{&(0x7f0000000200)=',', 0x1}], 0x1, 0x4081806) sendfile(r1, r3, &(0x7f00000000c0), 0x20020102000007) ioctl$TIOCEXCL(0xffffffffffffffff, 0x540c) write(0xffffffffffffffff, &(0x7f00000001c0), 0xfffffef3) vmsplice(0xffffffffffffffff, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) fstat(r3, &(0x7f0000000b40)) ioctl$TIOCGPGRP(0xffffffffffffffff, 0x540f, &(0x7f0000000cc0)) getsockopt$inet6_IPV6_IPSEC_POLICY(0xffffffffffffffff, 0x29, 0x22, &(0x7f00000010c0)={{{@in6=@mcast2, @in=@remote}}, {{@in6=@local}, 0x0, @in6=@loopback}}, &(0x7f00000011c0)=0xe8) recvfrom$unix(r2, &(0x7f0000000040)=""/4, 0xebc3276d6d4b1cd2, 0x100100, &(0x7f0000000100)=@abs, 0x930000) openat$selinux_avc_cache_stats(0xffffffffffffff9c, &(0x7f0000000240)='/selinux/avc/cache_stats\x00', 0x0, 0x0) 20:30:48 executing program 3: r0 = socket$inet(0x2, 0x4000000000000001, 0x0) setsockopt$inet_tcp_TCP_CONGESTION(r0, 0x6, 0xd, &(0x7f0000000680)='reno\x00', 0x380) sendto$inet(r0, &(0x7f0000a88f88), 0xfffffffffffffe6e, 0x20000000, &(0x7f0000e68000)={0x2, 0x0, @local}, 0x10) 20:30:48 executing program 5: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) r1 = openat$selinux_commit_pending_bools(0xffffffffffffff9c, &(0x7f0000000240)='/selinux/commit_pending_bools\x00', 0x1, 0x0) ioctl$TIOCMSET(r1, 0x5418, &(0x7f0000000040)) sendmsg$nl_netfilter(r0, &(0x7f0000000080)={&(0x7f0000000100), 0xc, &(0x7f00000000c0)={&(0x7f0000000340)=ANY=[@ANYBLOB="140000000301ffff808f00003d88c83f00b516ba"], 0x14}}, 0x0) setsockopt$inet_mtu(r1, 0x0, 0xa, &(0x7f0000000000)=0x2, 0x4) ioctl$FS_IOC_SETVERSION(r1, 0x40087602, &(0x7f0000000140)=0x100000001) recvmmsg(r0, &(0x7f00000013c0), 0x0, 0x0, &(0x7f0000000c40)={0x77359400}) 20:30:48 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = openat$selinux_commit_pending_bools(0xffffffffffffff9c, &(0x7f0000000080)='/selinux/commit_pending_bools\x00', 0x1, 0x0) getsockopt$packet_buf(r1, 0x107, 0x5, &(0x7f00000000c0)=""/52, &(0x7f0000000100)=0x34) ioctl$FS_IOC_SETVERSION(r0, 0x40087602, &(0x7f00000001c0)) r2 = syz_open_dev$binder(&(0x7f0000000640)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000000)=[@enter_looper], 0x1, 0x0, &(0x7f0000000040)='+'}) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0x0, 0x0, &(0x7f0000000780)}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000380)={0x8, 0x0, &(0x7f0000000500)=[@release={0x40046306, 0x1}], 0x0, 0x0, &(0x7f0000000400)}) 20:30:48 executing program 5: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$nl_netfilter(r0, &(0x7f0000000080)={&(0x7f0000000100), 0xc, &(0x7f00000000c0)={&(0x7f0000000340)=ANY=[@ANYBLOB="140000000301ffff808f00003d88c83f00b516ba"], 0x14}}, 0x0) recvmmsg(r0, &(0x7f0000000000), 0x3fffffffffffdd2, 0x0, &(0x7f0000000c40)={0x77359400}) [ 402.537894] binder: BINDER_SET_CONTEXT_MGR already set [ 402.543846] binder: 17949:17953 ioctl 40087602 200001c0 returned -22 [ 402.551343] binder_alloc: 17949: binder_alloc_buf, no vma [ 402.557136] binder: 17949:17956 ioctl 40046207 0 returned -16 [ 402.571809] binder: 17949:17988 transaction failed 29189/-3, size 24-8 line 3137 [ 402.584254] binder: 17949:17955 BC_INCREFS_DONE u0000000000000000 no match 20:30:48 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$FS_IOC_SETVERSION(r0, 0x40087602, &(0x7f00000001c0)) r1 = syz_open_dev$binder(&(0x7f0000000640)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = openat$pfkey(0xffffffffffffff9c, &(0x7f0000000080)='/proc/self/net/pfkey\x00', 0x20000, 0x0) write$binfmt_aout(r0, &(0x7f0000000680)={{0x10f, 0x4, 0x0, 0x7d, 0x168, 0x0, 0x306, 0x4}, "90870712cfc5c3979b3747ba518398bae48b97d29ef0873e13e02de1951cda6dc1f6d5ee922fe18087fa8e50c85cac0f3590f9dec70fe053190804c732e133ef688ff17bd078a5626988c14d88748ec6217042086dc5da9dcc91e28e7c0cf495246c48dca9f42f06795a4d8768bfbf357b0afd9f521c6edcad6856c66a6cd08404092dfcd2495fe64f5dc980af8fc54fba06e71924df2bf510ee276c2316d75830bc1bc5fe069b12a23e5890a66e7444b9f7df", [[], [], [], [], [], []]}, 0x6d3) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000000)=[@enter_looper], 0x1, 0x0, &(0x7f0000000040)='+'}) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$sock_SIOCGPGRP(r2, 0x8904, &(0x7f00000000c0)=0x0) ptrace$peek(0x1, r3, &(0x7f0000000100)) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) chdir(&(0x7f0000000180)='./file0\x00') ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0x0, 0x0, &(0x7f0000000780)}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000380)={0x8, 0x0, &(0x7f0000000500)=[@release={0x40046306, 0x1}], 0x0, 0x0, &(0x7f0000000400)}) 20:30:48 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$FS_IOC_SETVERSION(r0, 0x40087602, &(0x7f00000001c0)) r1 = syz_open_dev$binder(&(0x7f0000000640)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) r2 = openat$zero(0xffffffffffffff9c, &(0x7f0000000080)='/dev/zero\x00', 0x2, 0x0) write$P9_RWSTAT(r2, &(0x7f00000000c0)={0x7, 0x7f, 0x1}, 0x7) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000000)=[@enter_looper], 0x1, 0x0, &(0x7f0000000040)='+'}) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0x0, 0x0, &(0x7f0000000780)}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000380)={0x8, 0x0, &(0x7f0000000500)=[@release={0x40046306, 0x1}], 0x0, 0x0, &(0x7f0000000400)}) 20:30:48 executing program 2: r0 = socket$inet(0x2, 0x0, 0x0) setsockopt$inet_opts(r0, 0x0, 0x0, &(0x7f00000000c0)="8907", 0x2) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) r3 = memfd_create(&(0x7f0000000280)='[\'posix_acl_access\x00', 0x0) pwritev(r3, &(0x7f00000001c0)=[{&(0x7f0000000200)=',', 0x1}], 0x1, 0x4081806) sendfile(r1, r3, &(0x7f00000000c0), 0x20020102000007) pipe(&(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$TIOCEXCL(0xffffffffffffffff, 0x540c) write(r5, &(0x7f00000001c0), 0xfffffef3) vmsplice(r4, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) fstat(r3, &(0x7f0000000b40)) getsockopt$inet6_IPV6_IPSEC_POLICY(0xffffffffffffffff, 0x29, 0x22, &(0x7f00000010c0)={{{@in6=@mcast2, @in=@remote}}, {{@in6=@local}, 0x0, @in6=@loopback}}, &(0x7f00000011c0)=0xe8) recvfrom$unix(r2, &(0x7f0000000040)=""/4, 0xebc3276d6d4b1cd2, 0x100100, &(0x7f0000000100)=@abs, 0x930000) openat$selinux_avc_cache_stats(0xffffffffffffff9c, &(0x7f0000000240)='/selinux/avc/cache_stats\x00', 0x0, 0x0) [ 402.620019] binder: release 17985:17986 transaction 537 out, still active [ 402.641904] binder: send failed reply for transaction 537, target dead [ 402.645720] binder: 17994:17995 ioctl 40087602 200001c0 returned -22 [ 402.696722] binder: 17999:18002 ioctl 40087602 200001c0 returned -22 [ 402.753311] binder: BINDER_SET_CONTEXT_MGR already set [ 402.760498] binder: 17999:18005 ioctl 40046207 0 returned -16 [ 402.770896] binder: 17999:18005 Release 1 refcount change on invalid ref 1 ret -22 20:30:48 executing program 4: r0 = socket$inet(0x2, 0x0, 0x0) setsockopt$inet_opts(r0, 0x0, 0x0, &(0x7f00000000c0)="8907", 0x2) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) r3 = memfd_create(&(0x7f0000000280)='[\'posix_acl_access\x00', 0x0) pwritev(r3, &(0x7f00000001c0)=[{&(0x7f0000000200)=',', 0x1}], 0x1, 0x4081806) sendfile(r1, r3, &(0x7f00000000c0), 0x20020102000007) ioctl$TIOCEXCL(0xffffffffffffffff, 0x540c) write(0xffffffffffffffff, &(0x7f00000001c0), 0xfffffef3) vmsplice(0xffffffffffffffff, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) fstat(r3, &(0x7f0000000b40)) ioctl$TIOCGPGRP(0xffffffffffffffff, 0x540f, &(0x7f0000000cc0)) getsockopt$inet6_IPV6_IPSEC_POLICY(0xffffffffffffffff, 0x29, 0x22, &(0x7f00000010c0)={{{@in6=@mcast2, @in=@remote}}, {{@in6=@local}, 0x0, @in6=@loopback}}, &(0x7f00000011c0)=0xe8) recvfrom$unix(r2, &(0x7f0000000040)=""/4, 0xebc3276d6d4b1cd2, 0x100100, &(0x7f0000000100)=@abs, 0x930000) openat$selinux_avc_cache_stats(0xffffffffffffff9c, &(0x7f0000000240)='/selinux/avc/cache_stats\x00', 0x0, 0x0) 20:30:49 executing program 3: r0 = socket$inet(0x2, 0x4000000000000001, 0x0) setsockopt$inet_tcp_TCP_CONGESTION(r0, 0x6, 0xd, &(0x7f0000000680)='reno\x00', 0x60c5) sendto$inet(r0, &(0x7f0000a88f88), 0xfffffffffffffe6e, 0x20000000, &(0x7f0000e68000)={0x2, 0x0, @local}, 0x10) r1 = openat$full(0xffffffffffffff9c, &(0x7f0000000000)='/dev/full\x00', 0x0, 0x0) setsockopt$inet6_group_source_req(r1, 0x29, 0x2f, &(0x7f0000000040)={0x19, {{0xa, 0x4e20, 0x1f, @local, 0x1000}}, {{0xa, 0x4e23, 0x42e5, @mcast1, 0x20000}}}, 0x108) 20:30:49 executing program 5: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$nl_netfilter(r0, &(0x7f0000000080)={&(0x7f0000000100), 0xc, &(0x7f00000000c0)={&(0x7f0000000340)=ANY=[@ANYBLOB="140000000301ffff808f00003d88c83f00b516ba"], 0x14}}, 0x0) r1 = syz_open_dev$mice(&(0x7f0000000000)='/dev/input/mice\x00', 0x0, 0x40) execveat(r1, &(0x7f0000000040)='./file0\x00', &(0x7f00000001c0)=[&(0x7f0000000140)='\x00', &(0x7f0000000180)='{vboxnet1%+\x00'], &(0x7f00000002c0)=[&(0x7f0000000200)='-\\user%]nodev\x00', &(0x7f0000000240)='ppp0.\x00', &(0x7f0000000280)='\x00'], 0x500) restart_syscall() ioctl$BLKDISCARD(r1, 0x1277, &(0x7f0000000300)=0x24) recvmmsg(r0, &(0x7f00000013c0), 0x1ad, 0x0, &(0x7f0000000c40)={0x77359400}) 20:30:49 executing program 0: r0 = socket$inet(0x2, 0x0, 0x0) setsockopt$inet_opts(r0, 0x0, 0x0, &(0x7f00000000c0)="8907", 0x2) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) r3 = memfd_create(&(0x7f0000000280)='[\'posix_acl_access\x00', 0x0) pwritev(r3, &(0x7f00000001c0)=[{&(0x7f0000000200)=',', 0x1}], 0x1, 0x4081806) sendfile(r1, r3, &(0x7f00000000c0), 0x20020102000007) pipe(&(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$TIOCEXCL(0xffffffffffffffff, 0x540c) write(r5, &(0x7f00000001c0), 0xfffffef3) vmsplice(r4, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) fstat(r3, &(0x7f0000000b40)) ioctl$TIOCGPGRP(0xffffffffffffffff, 0x540f, &(0x7f0000000cc0)) getsockopt$inet6_IPV6_IPSEC_POLICY(0xffffffffffffffff, 0x29, 0x22, &(0x7f00000010c0)={{{@in6=@mcast2, @in=@remote}}, {{@in6=@local}, 0x0, @in6=@loopback}}, &(0x7f00000011c0)=0xe8) recvfrom$unix(r2, &(0x7f0000000040)=""/4, 0xebc3276d6d4b1cd2, 0x100100, &(0x7f0000000100)=@abs, 0x930000) [ 403.451659] binder: 17994:18001 ioctl 40087602 200001c0 returned -22 [ 403.460299] binder: BINDER_SET_CONTEXT_MGR already set [ 403.466296] binder: 17994:18001 ioctl 40046207 0 returned -16 [ 403.472741] binder_alloc: 17994: binder_alloc_buf, no vma [ 403.479198] binder: 17994:18029 transaction failed 29189/-3, size 24-8 line 3137 [ 403.487275] binder: 17994:18028 BC_INCREFS_DONE u0000000000000000 no match [ 403.494430] binder: release 17999:18005 transaction 544 out, still active 20:30:49 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$FS_IOC_SETVERSION(r0, 0x40087602, &(0x7f00000001c0)) r1 = syz_open_dev$binder(&(0x7f0000000640)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000480)={0xfffffffffffffc9e, 0x0, &(0x7f00000003c0)=[@transaction_sg={0x40486311, {{0x2, 0x0, 0x3, 0x0, 0x10, 0x0, 0x0, 0x50, 0x28, &(0x7f00000000c0)=[@fd={0x66642a85, 0x0, r0, 0x0, 0x4}, @fd={0x66642a85, 0x0, r1, 0x0, 0x3}, @fda={0x66646185, 0xa, 0x3, 0xa}], &(0x7f0000000180)=[0x38, 0x38, 0x48, 0x28, 0x28]}, 0x6d}}], 0x1, 0x0, &(0x7f0000000040)='+'}) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0x0, 0x0, &(0x7f0000000780)}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000380)={0x8, 0x0, &(0x7f0000000500)=[@release={0x40046306, 0x1}], 0x0, 0x0, &(0x7f0000000400)}) [ 403.515804] binder: 17994:18001 Release 1 refcount change on invalid ref 1 ret -22 [ 403.516396] binder: send failed reply for transaction 541 to 17994:18001 [ 403.516413] binder: send failed reply for transaction 544, target dead [ 403.537373] binder: undelivered TRANSACTION_ERROR: 29189 20:30:49 executing program 2: r0 = socket$inet(0x2, 0x0, 0x0) setsockopt$inet_opts(r0, 0x0, 0x0, &(0x7f00000000c0)="8907", 0x2) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) r3 = memfd_create(&(0x7f0000000280)='[\'posix_acl_access\x00', 0x0) pwritev(r3, &(0x7f00000001c0)=[{&(0x7f0000000200)=',', 0x1}], 0x1, 0x4081806) sendfile(r1, r3, &(0x7f00000000c0), 0x20020102000007) pipe(&(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$TIOCEXCL(0xffffffffffffffff, 0x540c) write(r5, &(0x7f00000001c0), 0xfffffef3) vmsplice(r4, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) fstat(r3, &(0x7f0000000b40)) getsockopt$inet6_IPV6_IPSEC_POLICY(0xffffffffffffffff, 0x29, 0x22, &(0x7f00000010c0)={{{@in6=@mcast2, @in=@remote}}, {{@in6=@local}, 0x0, @in6=@loopback}}, &(0x7f00000011c0)=0xe8) recvfrom$unix(r2, &(0x7f0000000040)=""/4, 0xebc3276d6d4b1cd2, 0x100100, &(0x7f0000000100)=@abs, 0x930000) [ 403.591272] binder: 18035:18036 ioctl 40087602 200001c0 returned -22 [ 403.600290] binder: 18035:18036 got transaction to context manager from process owning it [ 403.628148] binder: 18035:18036 transaction failed 29201/-22, size 24-8 line 3005 [ 403.636416] binder: 18035:18036 BC_INCREFS_DONE node 548 has no pending increfs request [ 403.645349] binder: 18035:18036 Release 1 refcount change on invalid ref 1 ret -22 [ 403.654049] binder: 18035:18036 ioctl 40087602 200001c0 returned -22 [ 403.661278] binder: BINDER_SET_CONTEXT_MGR already set [ 403.668533] binder: 18035:18036 ioctl 40046207 0 returned -16 [ 403.674782] binder_alloc: 18035: binder_alloc_buf, no vma [ 403.681010] binder: 18035:18044 transaction failed 29189/-3, size 24-8 line 3137 20:30:49 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$FS_IOC_SETVERSION(r0, 0x40087602, &(0x7f00000001c0)) r1 = syz_open_dev$binder(&(0x7f0000000640)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=ANY=[@ANYBLOB="0c6300006034bc68e050be22f43527991e55124bd8099539c8da03b269ce46e910548081125754a68f75c5d676a08a1b8be2a7296d4a3820238ea5a16d4b97690f28287233fe80aad5992520f1254f6f1bc126a5b5889901283c8cf11aa9cc3c461612702c09cf98089582da382605ae"], 0x1, 0x0, &(0x7f0000000040)='+'}) r2 = memfd_create(&(0x7f0000000100)='/dev/binder#\x00', 0x4) ioctl$BLKGETSIZE64(r2, 0x80081272, &(0x7f0000000180)) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) r3 = openat$selinux_avc_hash_stats(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/avc/hash_stats\x00', 0x0, 0x0) ioctl$UI_SET_EVBIT(r3, 0x40045564, 0x7) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0x0, 0x0, &(0x7f0000000780)}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000380)={0x8, 0x0, &(0x7f0000000500)=[@release={0x40046306, 0x1}], 0x0, 0x0, &(0x7f0000000400)}) [ 403.689146] binder: 18035:18036 BC_INCREFS_DONE u0000000000000000 no match [ 403.689194] binder: 18035:18043 Release 1 refcount change on invalid ref 1 ret -22 [ 403.754306] binder: 18049:18050 ioctl 40087602 200001c0 returned -22 20:30:49 executing program 4: r0 = socket$inet(0x2, 0x0, 0x0) setsockopt$inet_opts(r0, 0x0, 0x0, &(0x7f00000000c0)="8907", 0x2) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) r3 = memfd_create(&(0x7f0000000280)='[\'posix_acl_access\x00', 0x0) pwritev(r3, &(0x7f00000001c0)=[{&(0x7f0000000200)=',', 0x1}], 0x1, 0x4081806) sendfile(r1, r3, &(0x7f00000000c0), 0x20020102000007) ioctl$TIOCEXCL(0xffffffffffffffff, 0x540c) write(0xffffffffffffffff, &(0x7f00000001c0), 0xfffffef3) vmsplice(0xffffffffffffffff, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) fstat(r3, &(0x7f0000000b40)) ioctl$TIOCGPGRP(0xffffffffffffffff, 0x540f, &(0x7f0000000cc0)) getsockopt$inet6_IPV6_IPSEC_POLICY(0xffffffffffffffff, 0x29, 0x22, &(0x7f00000010c0)={{{@in6=@mcast2, @in=@remote}}, {{@in6=@local}, 0x0, @in6=@loopback}}, &(0x7f00000011c0)=0xe8) recvfrom$unix(r2, &(0x7f0000000040)=""/4, 0xebc3276d6d4b1cd2, 0x100100, &(0x7f0000000100)=@abs, 0x930000) openat$selinux_avc_cache_stats(0xffffffffffffff9c, &(0x7f0000000240)='/selinux/avc/cache_stats\x00', 0x0, 0x0) 20:30:49 executing program 3: r0 = socket$inet(0x2, 0x4000000000000001, 0x0) ioctl$ifreq_SIOCGIFINDEX_team(r0, 0x8933, &(0x7f0000000000)={'team0\x00', 0x0}) setsockopt$inet_pktinfo(r0, 0x0, 0x8, &(0x7f0000000040)={r1, @rand_addr=0x8, @multicast1}, 0xc) setsockopt$inet_tcp_TCP_CONGESTION(r0, 0x6, 0xd, &(0x7f0000000680)='reno\x00', 0x60c5) sendto$inet(r0, &(0x7f0000a88f88), 0xfffffffffffffe6e, 0x20000000, &(0x7f0000e68000)={0x2, 0x0, @local}, 0x10) fcntl$getownex(r0, 0x10, &(0x7f0000000080)={0x0, 0x0}) ptrace$PTRACE_SECCOMP_GET_FILTER(0x420c, r2, 0x7fd, &(0x7f00000000c0)=""/101) 20:30:50 executing program 5: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$nl_netfilter(r0, &(0x7f0000000080)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x1000000000}, 0xc, &(0x7f00000000c0)={&(0x7f0000000340)=ANY=[], 0x2e0}}, 0x0) r1 = fcntl$getown(r0, 0x9) r2 = fcntl$getown(0xffffffffffffff9c, 0x9) setpgid(r1, r2) recvmmsg(r0, &(0x7f0000000000), 0x0, 0x0, &(0x7f0000000c40)={0x77359400}) 20:30:50 executing program 5: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$nl_netfilter(r0, &(0x7f0000000080)={&(0x7f0000000100), 0xc, &(0x7f00000000c0)={&(0x7f0000000140)=ANY=[@ANYBLOB="14b516bae797f1d04690af9ce58b1a03a1caf2ce15dc10d1e0c8710fc72298622bceabf4cef2159701bd644eed673691efc35f9dc0dded9c2e8722447b605badd1915f167d0445032103cda901a71f6046250eb02826df9b5576a1835aef06373b22c5927397e40790ef299a7a17ff03b01d8851b7f62d6898d48f282c515ae4cdc6cf9c59f931bfd5fbb04071cad1a58f872042d4b1a7b5ecfb7b8d9858153db3d1fec9a1cb25c917c8ef2081591fcb6dd8a2d68d0dfc0b945fbb9b7f9fa132f4ec028e5908460cf39e8bba03d3b1754cac9520097917848b20a32489884bcadbe500000000"], 0x14}}, 0x0) recvmmsg(r0, &(0x7f00000013c0), 0x1ad, 0x0, &(0x7f0000000c40)={0x77359400}) 20:30:50 executing program 0: r0 = socket$inet(0x2, 0x0, 0x0) setsockopt$inet_opts(r0, 0x0, 0x0, &(0x7f00000000c0)="8907", 0x2) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) r3 = memfd_create(&(0x7f0000000280)='[\'posix_acl_access\x00', 0x0) pwritev(r3, &(0x7f00000001c0)=[{&(0x7f0000000200)=',', 0x1}], 0x1, 0x4081806) sendfile(r1, r3, &(0x7f00000000c0), 0x20020102000007) pipe(&(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$TIOCEXCL(0xffffffffffffffff, 0x540c) write(r5, &(0x7f00000001c0), 0xfffffef3) vmsplice(r4, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) fstat(r3, &(0x7f0000000b40)) ioctl$TIOCGPGRP(0xffffffffffffffff, 0x540f, &(0x7f0000000cc0)) getsockopt$inet6_IPV6_IPSEC_POLICY(0xffffffffffffffff, 0x29, 0x22, &(0x7f00000010c0)={{{@in6=@mcast2, @in=@remote}}, {{@in6=@local}, 0x0, @in6=@loopback}}, &(0x7f00000011c0)=0xe8) recvfrom$unix(r2, &(0x7f0000000040)=""/4, 0xebc3276d6d4b1cd2, 0x100100, &(0x7f0000000100)=@abs, 0x930000) 20:30:50 executing program 2: r0 = socket$inet(0x2, 0x0, 0x0) setsockopt$inet_opts(r0, 0x0, 0x0, &(0x7f00000000c0)="8907", 0x2) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) r3 = memfd_create(&(0x7f0000000280)='[\'posix_acl_access\x00', 0x0) pwritev(r3, &(0x7f00000001c0)=[{&(0x7f0000000200)=',', 0x1}], 0x1, 0x4081806) sendfile(r1, r3, &(0x7f00000000c0), 0x20020102000007) pipe(&(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$TIOCEXCL(0xffffffffffffffff, 0x540c) write(r5, &(0x7f00000001c0), 0xfffffef3) vmsplice(r4, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) fstat(r3, &(0x7f0000000b40)) recvfrom$unix(r2, &(0x7f0000000040)=""/4, 0xebc3276d6d4b1cd2, 0x100100, &(0x7f0000000100)=@abs, 0x930000) openat$selinux_avc_cache_stats(0xffffffffffffff9c, &(0x7f0000000240)='/selinux/avc/cache_stats\x00', 0x0, 0x0) [ 404.545473] binder: 18049:18052 ioctl 40087602 200001c0 returned -22 [ 404.568002] binder: BINDER_SET_CONTEXT_MGR already set [ 404.580924] binder_alloc: 18049: binder_alloc_buf, no vma [ 404.586932] binder: 18049:18079 ioctl 40046207 0 returned -16 20:30:50 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$FS_IOC_SETVERSION(r0, 0x40087602, &(0x7f00000001c0)) r1 = syz_open_dev$binder(&(0x7f0000000640)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000000)=[@enter_looper], 0x1, 0x0, &(0x7f0000000040)='+'}) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0x0, 0x0, &(0x7f0000000780)}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f0000000500)=[@release={0x40046306, 0x1}], 0x0, 0x0, &(0x7f0000000400)}) [ 404.597751] binder: 18049:18080 transaction failed 29189/-3, size 24-8 line 3137 [ 404.613080] binder: 18049:18052 BC_INCREFS_DONE u0000000000000000 no match [ 404.620931] binder: 18049:18079 Release 1 refcount change on invalid ref 1 ret -22 [ 404.629264] binder: send failed reply for transaction 552 to 18049:18052 [ 404.639808] binder: undelivered TRANSACTION_ERROR: 29189 [ 404.668741] binder: 18090:18091 ioctl 40087602 200001c0 returned -22 [ 404.733742] binder: 18090:18093 Release 1 refcount change on invalid ref 1 ret -22 20:30:50 executing program 4: r0 = socket$inet(0x2, 0x0, 0x0) setsockopt$inet_opts(r0, 0x0, 0x0, &(0x7f00000000c0)="8907", 0x2) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = memfd_create(&(0x7f0000000280)='[\'posix_acl_access\x00', 0x0) pwritev(r2, &(0x7f00000001c0)=[{&(0x7f0000000200)=',', 0x1}], 0x1, 0x4081806) pipe(&(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$TIOCEXCL(0xffffffffffffffff, 0x540c) write(r4, &(0x7f00000001c0), 0xfffffef3) vmsplice(r3, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) fstat(r2, &(0x7f0000000b40)) ioctl$TIOCGPGRP(0xffffffffffffffff, 0x540f, &(0x7f0000000cc0)) getsockopt$inet6_IPV6_IPSEC_POLICY(0xffffffffffffffff, 0x29, 0x22, &(0x7f00000010c0)={{{@in6=@mcast2, @in=@remote}}, {{@in6=@local}, 0x0, @in6=@loopback}}, &(0x7f00000011c0)=0xe8) recvfrom$unix(r1, &(0x7f0000000040)=""/4, 0xebc3276d6d4b1cd2, 0x100100, &(0x7f0000000100)=@abs, 0x930000) openat$selinux_avc_cache_stats(0xffffffffffffff9c, &(0x7f0000000240)='/selinux/avc/cache_stats\x00', 0x0, 0x0) 20:30:50 executing program 3: r0 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f00000003c0)='./cgroup\x00', 0x200002, 0x0) pipe(&(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) write(r2, &(0x7f00000001c0), 0xfffffef3) vmsplice(r1, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) write$P9_RSTAT(r1, &(0x7f0000000540)=ANY=[@ANYBLOB="710000007d010000006a000100c93b00000121000000bfbae4191b02c34b000000010400000003000000c600000000000000000009002e2f6367726f75700011002f73656cd16e75782f636f6e74657874001d002f73656c696e75782f6176632f63616368655f7468726573686f6c6400"], 0x71) fchdir(r0) ioctl$VT_SETMODE(r1, 0x5602, &(0x7f00000001c0)={0xfffffffffffffff7, 0x8, 0x0, 0x4, 0x6}) r3 = creat(&(0x7f00000004c0)='./bus\x00', 0x0) socketpair$inet(0x2, 0x3, 0x3, &(0x7f0000000500)) write$selinux_load(r0, &(0x7f0000000640)={0xf97cff8c, 0x8, 'SE Linux', "f06ac7392156f7e35b921616600e5df1aeeadc1713e3db82bf5c7c"}, 0x2b) r4 = creat(&(0x7f00000000c0)='./bus\x00', 0x0) openat$selinux_context(0xffffffffffffff9c, &(0x7f0000000040)='/selinux/context\x00', 0x2, 0x0) write$P9_RFLUSH(r4, &(0x7f0000000180)={0x19d}, 0x1a6db1e6) listxattr(&(0x7f00000005c0)='./bus\x00', &(0x7f0000000600)=""/5, 0x5) write$P9_RREADDIR(r3, &(0x7f0000000400)=ANY=[], 0x0) fsync(r4) ioctl$PIO_FONT(r1, 0x4b61, &(0x7f0000000400)="40347b55b44b684a88d0f1ac7a376bf26ee9f74b26c15eacf1037b413b87b57aeedaf52fb6e8f8aaaa9bd9ff30281bfb345222224cfc743475a0e8537b1e287d2125b5db60549b7b636c118d0fb788b12513fcb09cb4e97303e288edc456f973862c68508cae6fbbaa1f52cb43d825dd72b2fa8f071a9b90df61ab9eb8b8") ioctl$PERF_EVENT_IOC_ID(r2, 0x80082407, &(0x7f0000000100)) ioctl$TIOCGSID(r3, 0x5429, &(0x7f0000000300)=0x0) sched_getparam(r5, &(0x7f0000000380)) ioctl$VT_DISALLOCATE(0xffffffffffffffff, 0x5608) ioctl$EXT4_IOC_MIGRATE(r2, 0x6609) getsockopt$inet_tcp_TCP_ZEROCOPY_RECEIVE(r1, 0x6, 0x23, &(0x7f0000000140)={&(0x7f0000ffe000/0x2000)=nil, 0x2000}, &(0x7f0000000340)=0x10) fcntl$setflags(0xffffffffffffffff, 0x2, 0x1) ioctl$TIOCSETD(r3, 0x5423, &(0x7f0000000080)=0x6) openat$selinux_avc_cache_threshold(0xffffffffffffff9c, &(0x7f0000000880)='/selinux/avc/cache_threshold\x00', 0x2, 0x0) ioctl$sock_inet_SIOCGIFDSTADDR(r4, 0x8917, &(0x7f0000000240)={'bcsh0\x00', {0x2, 0x4e21, @broadcast}}) ioctl$EXT4_IOC_ALLOC_DA_BLKS(0xffffffffffffffff, 0x660c) msync(&(0x7f0000d5b000/0x4000)=nil, 0x4000, 0x2000000) setsockopt$inet_tcp_TCP_CONGESTION(0xffffffffffffffff, 0x6, 0xd, &(0x7f0000000680)='reno\x00', 0x60c5) 20:30:51 executing program 5: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$nl_netfilter(r0, &(0x7f0000000080)={&(0x7f0000000100), 0xc, &(0x7f00000000c0)={&(0x7f0000000340)=ANY=[@ANYBLOB="140000000301ffff808f00003d88c83f00b516ba"], 0x14}}, 0x0) recvmmsg(r0, &(0x7f00000013c0), 0x0, 0x0, &(0x7f0000000000)={0x77359400}) ioctl$FIDEDUPERANGE(r0, 0xc0189436, &(0x7f0000000200)=ANY=[@ANYBLOB="010000000100000009000000000000000400000000000000", @ANYRES32=r0, @ANYBLOB="00000000040000000000000000000000000000000000000000000000", @ANYRES32=r0, @ANYBLOB='\x00\x00\x00\x00!\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00', @ANYRES32=r0, @ANYBLOB='\x00\x00\x00\x00\b\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00', @ANYRES32=r0, @ANYBLOB="00000000000000000000000000075ce1358dc25edd69c0f91ecc1450c32c27bf7beca3ed79966632269ef9cefa0000000000"]) 20:30:51 executing program 2: r0 = socket$inet(0x2, 0x0, 0x0) setsockopt$inet_opts(r0, 0x0, 0x0, &(0x7f00000000c0)="8907", 0x2) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) r3 = memfd_create(&(0x7f0000000280)='[\'posix_acl_access\x00', 0x0) pwritev(r3, &(0x7f00000001c0)=[{&(0x7f0000000200)=',', 0x1}], 0x1, 0x4081806) sendfile(r1, r3, &(0x7f00000000c0), 0x20020102000007) pipe(&(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$TIOCEXCL(0xffffffffffffffff, 0x540c) write(r5, &(0x7f00000001c0), 0xfffffef3) vmsplice(r4, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) getsockopt$inet6_IPV6_IPSEC_POLICY(0xffffffffffffffff, 0x29, 0x22, &(0x7f00000010c0)={{{@in6=@mcast2, @in=@remote}}, {{@in6=@local}, 0x0, @in6=@loopback}}, &(0x7f00000011c0)=0xe8) recvfrom$unix(r2, &(0x7f0000000040)=""/4, 0xebc3276d6d4b1cd2, 0x100100, &(0x7f0000000100)=@abs, 0x930000) openat$selinux_avc_cache_stats(0xffffffffffffff9c, &(0x7f0000000240)='/selinux/avc/cache_stats\x00', 0x0, 0x0) 20:30:51 executing program 5: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$nl_netfilter(r0, &(0x7f0000000080)={&(0x7f0000000100), 0xfffffffffffffd4a, &(0x7f00000000c0)={&(0x7f0000000000)=ANY=[@ANYBLOB="1400002968ccc3b5e0fe71aed0d41b211e9d0200000000"], 0x425b53f312a3e49b}}, 0x0) recvmmsg(r0, &(0x7f00000013c0), 0x1ad, 0x0, &(0x7f0000000c40)={0x77359400}) [ 405.468848] binder: 18090:18093 ioctl 40087602 200001c0 returned -22 [ 405.499491] binder: BINDER_SET_CONTEXT_MGR already set [ 405.505344] binder: 18090:18122 ioctl 40046207 0 returned -16 [ 405.511542] binder_alloc: 18090: binder_alloc_buf, no vma 20:30:51 executing program 0: r0 = socket$inet(0x2, 0x4000000000000001, 0x0) setsockopt$inet_tcp_TCP_CONGESTION(r0, 0x6, 0xd, &(0x7f0000000680)='reno\x00', 0x60c5) sendto$inet(r0, &(0x7f0000a88f88), 0xfffffffffffffe6e, 0x20000000, &(0x7f0000e68000)={0x2, 0x0, @local}, 0x10) r1 = openat$full(0xffffffffffffff9c, &(0x7f0000000000)='/dev/full\x00', 0x0, 0x0) setsockopt$inet6_group_source_req(r1, 0x29, 0x2f, &(0x7f0000000040)={0x19, {{0xa, 0x4e20, 0x1f, @local, 0x1000}}, {{0xa, 0x4e23, 0x42e5, @mcast1, 0x20000}}}, 0x108) 20:30:51 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$FS_IOC_SETVERSION(r0, 0x40087602, &(0x7f00000001c0)) r1 = syz_open_dev$binder(&(0x7f0000000640)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000000)=[@enter_looper], 0x1, 0x0, &(0x7f0000000040)='+'}) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0x0, 0x0, &(0x7f0000000780)}) ioctl$EXT4_IOC_SWAP_BOOT(r0, 0x6611) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000380)={0x8, 0x0, &(0x7f0000000500)=[@release={0x40046306, 0x1}], 0x0, 0x0, &(0x7f0000000400)}) [ 405.538301] binder: 18090:18124 transaction failed 29189/-3, size 24-8 line 3137 [ 405.546102] binder: 18090:18093 BC_INCREFS_DONE u0000000000000000 no match [ 405.546212] binder: 18090:18122 Release 1 refcount change on invalid ref 1 ret -22 [ 405.546439] binder: send failed reply for transaction 557 to 18090:18093 [ 405.558815] binder: undelivered TRANSACTION_ERROR: 29189 20:30:51 executing program 0: r0 = socket$inet(0x2, 0x0, 0x0) setsockopt$inet_opts(r0, 0x0, 0x0, &(0x7f00000000c0)="8907", 0x2) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) r3 = memfd_create(&(0x7f0000000280)='[\'posix_acl_access\x00', 0x0) pwritev(r3, &(0x7f00000001c0)=[{&(0x7f0000000200)=',', 0x1}], 0x1, 0x4081806) sendfile(r1, r3, &(0x7f00000000c0), 0x20020102000007) ioctl$TIOCEXCL(0xffffffffffffffff, 0x540c) write(0xffffffffffffffff, &(0x7f00000001c0), 0xfffffef3) vmsplice(0xffffffffffffffff, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) fstat(r3, &(0x7f0000000b40)) ioctl$TIOCGPGRP(0xffffffffffffffff, 0x540f, &(0x7f0000000cc0)) getsockopt$inet6_IPV6_IPSEC_POLICY(0xffffffffffffffff, 0x29, 0x22, &(0x7f00000010c0)={{{@in6=@mcast2, @in=@remote}}, {{@in6=@local}, 0x0, @in6=@loopback}}, &(0x7f00000011c0)=0xe8) recvfrom$unix(r2, &(0x7f0000000040)=""/4, 0xebc3276d6d4b1cd2, 0x100100, &(0x7f0000000100)=@abs, 0x930000) openat$selinux_avc_cache_stats(0xffffffffffffff9c, &(0x7f0000000240)='/selinux/avc/cache_stats\x00', 0x0, 0x0) [ 405.621711] binder: 18136:18137 ioctl 40087602 200001c0 returned -22 [ 405.693746] binder: BINDER_SET_CONTEXT_MGR already set [ 405.711375] binder: 18136:18144 ioctl 40046207 0 returned -16 20:30:51 executing program 4: r0 = socket$inet(0x2, 0x0, 0x0) setsockopt$inet_opts(r0, 0x0, 0x0, &(0x7f00000000c0)="8907", 0x2) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) r3 = memfd_create(&(0x7f0000000280)='[\'posix_acl_access\x00', 0x0) sendfile(r1, r3, &(0x7f00000000c0), 0x20020102000007) pipe(&(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$TIOCEXCL(0xffffffffffffffff, 0x540c) write(r5, &(0x7f00000001c0), 0xfffffef3) vmsplice(r4, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) fstat(r3, &(0x7f0000000b40)) ioctl$TIOCGPGRP(0xffffffffffffffff, 0x540f, &(0x7f0000000cc0)) getsockopt$inet6_IPV6_IPSEC_POLICY(0xffffffffffffffff, 0x29, 0x22, &(0x7f00000010c0)={{{@in6=@mcast2, @in=@remote}}, {{@in6=@local}, 0x0, @in6=@loopback}}, &(0x7f00000011c0)=0xe8) recvfrom$unix(r2, &(0x7f0000000040)=""/4, 0xebc3276d6d4b1cd2, 0x100100, &(0x7f0000000100)=@abs, 0x930000) openat$selinux_avc_cache_stats(0xffffffffffffff9c, &(0x7f0000000240)='/selinux/avc/cache_stats\x00', 0x0, 0x0) [ 405.753817] binder: 18136:18147 ioctl 6611 0 returned -22 20:30:52 executing program 3: r0 = socket$inet(0x2, 0x4000000000000001, 0x0) setsockopt$inet_tcp_TCP_CONGESTION(r0, 0x6, 0xd, &(0x7f0000000040)='htcp\x00', 0xffffffffffffff2a) sendto$inet(r0, &(0x7f0000a88f88), 0xfffffffffffffe6e, 0x20000000, &(0x7f0000e68000)={0x2, 0x0, @local}, 0x10) r1 = syz_open_dev$loop(&(0x7f00000000c0)='/dev/loop#\x00', 0x100000000000000, 0x80000000804) ioctl$BLKIOOPT(r1, 0x1279, &(0x7f0000000080)) 20:30:52 executing program 2: r0 = socket$inet(0x2, 0x0, 0x0) setsockopt$inet_opts(r0, 0x0, 0x0, &(0x7f00000000c0)="8907", 0x2) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) r3 = memfd_create(&(0x7f0000000280)='[\'posix_acl_access\x00', 0x0) pwritev(r3, &(0x7f00000001c0)=[{&(0x7f0000000200)=',', 0x1}], 0x1, 0x4081806) sendfile(r1, r3, &(0x7f00000000c0), 0x20020102000007) pipe(&(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$TIOCEXCL(0xffffffffffffffff, 0x540c) write(r4, &(0x7f00000001c0), 0xfffffef3) fstat(r3, &(0x7f0000000b40)) getsockopt$inet6_IPV6_IPSEC_POLICY(0xffffffffffffffff, 0x29, 0x22, &(0x7f00000010c0)={{{@in6=@mcast2, @in=@remote}}, {{@in6=@local}, 0x0, @in6=@loopback}}, &(0x7f00000011c0)=0xe8) recvfrom$unix(r2, &(0x7f0000000040)=""/4, 0xebc3276d6d4b1cd2, 0x100100, &(0x7f0000000100)=@abs, 0x930000) openat$selinux_avc_cache_stats(0xffffffffffffff9c, &(0x7f0000000240)='/selinux/avc/cache_stats\x00', 0x0, 0x0) 20:30:52 executing program 5: r0 = accept$packet(0xffffffffffffff9c, &(0x7f0000000000)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @random}, &(0x7f0000000080)=0x14) setsockopt$sock_linger(r0, 0x1, 0xd, &(0x7f0000000100)={0x1, 0x6307}, 0x8) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$nl_netfilter(r1, &(0x7f0000000180)={&(0x7f0000000040), 0xc, &(0x7f00000000c0)={&(0x7f0000000140)=ANY=[]}, 0x1, 0x0, 0x0, 0x800}, 0x0) recvmmsg(r1, &(0x7f00000013c0), 0x1ad, 0x0, &(0x7f0000000c40)={0x77359400}) [ 406.423014] binder: 18136:18144 ioctl 40087602 200001c0 returned -22 [ 406.425592] binder: BINDER_SET_CONTEXT_MGR already set [ 406.425600] binder: 18136:18147 ioctl 40046207 0 returned -16 [ 406.425621] binder: BINDER_SET_CONTEXT_MGR already set [ 406.425627] binder: 18136:18173 ioctl 40046207 0 returned -16 [ 406.425775] binder_alloc: 18136: binder_alloc_buf, no vma [ 406.425815] binder: 18136:18147 transaction failed 29189/-3, size 24-8 line 3137 [ 406.425852] binder: 18136:18173 BC_INCREFS_DONE u0000000000000000 no match 20:30:52 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$FS_IOC_SETVERSION(r0, 0x40087602, &(0x7f00000001c0)) r1 = syz_open_dev$binder(&(0x7f0000000640)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000000)=[@enter_looper], 0x1, 0x0, &(0x7f0000000040)='+'}) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0x0, 0x0, &(0x7f0000000780)}) fgetxattr(r0, &(0x7f0000000080)=@random={'btrfs.', '.securitybdev\\\x00'}, &(0x7f0000000540)=""/173, 0xad) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000380)={0x8, 0x0, &(0x7f0000000500)=[@release={0x40046306, 0x1}], 0x0, 0x0, &(0x7f0000000400)}) [ 406.425925] binder: 18136:18147 ioctl 6611 0 returned -22 [ 406.425971] binder: 18136:18173 Release 1 refcount change on invalid ref 1 ret -22 [ 406.445302] binder: send failed reply for transaction 562 to 18136:18147 [ 406.446118] binder: undelivered TRANSACTION_ERROR: 29189 20:30:52 executing program 0: r0 = socket$inet(0x2, 0x0, 0x0) setsockopt$inet_opts(r0, 0x0, 0x0, &(0x7f00000000c0)="8907", 0x2) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) r3 = memfd_create(&(0x7f0000000280)='[\'posix_acl_access\x00', 0x0) pwritev(r3, &(0x7f00000001c0)=[{&(0x7f0000000200)=',', 0x1}], 0x1, 0x4081806) sendfile(r1, r3, &(0x7f00000000c0), 0x20020102000007) ioctl$TIOCEXCL(0xffffffffffffffff, 0x540c) write(0xffffffffffffffff, &(0x7f00000001c0), 0xfffffef3) vmsplice(0xffffffffffffffff, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) fstat(r3, &(0x7f0000000b40)) ioctl$TIOCGPGRP(0xffffffffffffffff, 0x540f, &(0x7f0000000cc0)) getsockopt$inet6_IPV6_IPSEC_POLICY(0xffffffffffffffff, 0x29, 0x22, &(0x7f00000010c0)={{{@in6=@mcast2, @in=@remote}}, {{@in6=@local}, 0x0, @in6=@loopback}}, &(0x7f00000011c0)=0xe8) recvfrom$unix(r2, &(0x7f0000000040)=""/4, 0xebc3276d6d4b1cd2, 0x100100, &(0x7f0000000100)=@abs, 0x930000) openat$selinux_avc_cache_stats(0xffffffffffffff9c, &(0x7f0000000240)='/selinux/avc/cache_stats\x00', 0x0, 0x0) [ 406.520246] binder: 18177:18178 ioctl 40087602 200001c0 returned -22 20:30:52 executing program 4: r0 = socket$inet(0x2, 0x0, 0x0) setsockopt$inet_opts(r0, 0x0, 0x0, &(0x7f00000000c0)="8907", 0x2) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) pwritev(0xffffffffffffffff, &(0x7f00000001c0)=[{&(0x7f0000000200)=',', 0x1}], 0x1, 0x4081806) sendfile(r1, 0xffffffffffffffff, &(0x7f00000000c0), 0x20020102000007) pipe(&(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$TIOCEXCL(0xffffffffffffffff, 0x540c) write(r4, &(0x7f00000001c0), 0xfffffef3) vmsplice(r3, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) fstat(0xffffffffffffffff, &(0x7f0000000b40)) ioctl$TIOCGPGRP(0xffffffffffffffff, 0x540f, &(0x7f0000000cc0)) getsockopt$inet6_IPV6_IPSEC_POLICY(0xffffffffffffffff, 0x29, 0x22, &(0x7f00000010c0)={{{@in6=@mcast2, @in=@remote}}, {{@in6=@local}, 0x0, @in6=@loopback}}, &(0x7f00000011c0)=0xe8) recvfrom$unix(r2, &(0x7f0000000040)=""/4, 0xebc3276d6d4b1cd2, 0x100100, &(0x7f0000000100)=@abs, 0x930000) openat$selinux_avc_cache_stats(0xffffffffffffff9c, &(0x7f0000000240)='/selinux/avc/cache_stats\x00', 0x0, 0x0) 20:30:53 executing program 3: r0 = socket$inet(0x2, 0x4000000000000001, 0x0) setsockopt$inet_tcp_TCP_CONGESTION(r0, 0x6, 0xd, &(0x7f0000000680)='reno\x00', 0x60c5) sendto$inet(r0, &(0x7f0000a88f88), 0xfffffffffffffe6e, 0x20000000, &(0x7f0000e68000)={0x2, 0x0, @local}, 0x10) ioctl$sock_SIOCBRDELBR(r0, 0x89a1, &(0x7f0000000000)='gretap0\x00') 20:30:53 executing program 2: r0 = socket$inet(0x2, 0x0, 0x0) setsockopt$inet_opts(r0, 0x0, 0x0, &(0x7f00000000c0)="8907", 0x2) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) r3 = memfd_create(&(0x7f0000000280)='[\'posix_acl_access\x00', 0x0) pwritev(r3, &(0x7f00000001c0)=[{&(0x7f0000000200)=',', 0x1}], 0x1, 0x4081806) sendfile(r1, r3, &(0x7f00000000c0), 0x20020102000007) pipe(&(0x7f0000000180)={0xffffffffffffffff}) ioctl$TIOCEXCL(0xffffffffffffffff, 0x540c) vmsplice(r4, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) fstat(r3, &(0x7f0000000b40)) getsockopt$inet6_IPV6_IPSEC_POLICY(0xffffffffffffffff, 0x29, 0x22, &(0x7f00000010c0)={{{@in6=@mcast2, @in=@remote}}, {{@in6=@local}, 0x0, @in6=@loopback}}, &(0x7f00000011c0)=0xe8) recvfrom$unix(r2, &(0x7f0000000040)=""/4, 0xebc3276d6d4b1cd2, 0x100100, &(0x7f0000000100)=@abs, 0x930000) openat$selinux_avc_cache_stats(0xffffffffffffff9c, &(0x7f0000000240)='/selinux/avc/cache_stats\x00', 0x0, 0x0) 20:30:53 executing program 5: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$nl_netfilter(r0, &(0x7f0000000080)={&(0x7f0000000100), 0xc, &(0x7f00000000c0)={&(0x7f0000000340)=ANY=[@ANYBLOB="140000000301ffff808f00003d88c83f00b516ba"], 0x14}}, 0x0) recvmmsg(r0, &(0x7f00000013c0), 0x1ad, 0x0, &(0x7f0000000c40)={0x77359400}) r1 = openat$selinux_mls(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/mls\x00', 0x0, 0x0) epoll_ctl$EPOLL_CTL_MOD(r1, 0x3, r0, &(0x7f0000000040)={0x8}) [ 407.326725] binder: 18177:18180 ioctl 40087602 200001c0 returned -22 [ 407.335511] binder_alloc: 18177: binder_alloc_buf, no vma [ 407.336757] binder: BINDER_SET_CONTEXT_MGR already set [ 407.336764] binder: 18177:18180 ioctl 40046207 0 returned -16 [ 407.352362] binder: 18177:18213 transaction failed 29189/-3, size 24-8 line 3137 [ 407.360676] binder: 18177:18180 BC_INCREFS_DONE u0000000000000000 no match [ 407.367836] binder: 18177:18213 Release 1 refcount change on invalid ref 1 ret -22 20:30:53 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$FS_IOC_SETVERSION(r0, 0x40087602, &(0x7f00000001c0)) r1 = syz_open_dev$binder(&(0x7f0000000640)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$EXT4_IOC_PRECACHE_EXTENTS(r0, 0x6612) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0xfffffffffffffffa, 0x20011, r1, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000000)=[@enter_looper], 0x1, 0x0, &(0x7f0000000040)='+'}) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0x0, 0x0, &(0x7f0000000780)}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000380)={0x8, 0x0, &(0x7f0000000500)=[@release={0x40046306, 0x1}], 0x0, 0x0, &(0x7f0000000400)}) 20:30:53 executing program 0: r0 = socket$inet(0x2, 0x0, 0x0) setsockopt$inet_opts(r0, 0x0, 0x0, &(0x7f00000000c0)="8907", 0x2) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) r3 = memfd_create(&(0x7f0000000280)='[\'posix_acl_access\x00', 0x0) pwritev(r3, &(0x7f00000001c0)=[{&(0x7f0000000200)=',', 0x1}], 0x1, 0x4081806) sendfile(r1, r3, &(0x7f00000000c0), 0x20020102000007) pipe(&(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$TIOCEXCL(0xffffffffffffffff, 0x540c) write(r4, &(0x7f00000001c0), 0xfffffef3) fstat(r3, &(0x7f0000000b40)) getsockopt$inet6_IPV6_IPSEC_POLICY(0xffffffffffffffff, 0x29, 0x22, &(0x7f00000010c0)={{{@in6=@mcast2, @in=@remote}}, {{@in6=@local}, 0x0, @in6=@loopback}}, &(0x7f00000011c0)=0xe8) recvfrom$unix(r2, &(0x7f0000000040)=""/4, 0xebc3276d6d4b1cd2, 0x100100, &(0x7f0000000100)=@abs, 0x930000) openat$selinux_avc_cache_stats(0xffffffffffffff9c, &(0x7f0000000240)='/selinux/avc/cache_stats\x00', 0x0, 0x0) 20:30:53 executing program 4: r0 = socket$inet(0x2, 0x0, 0x0) setsockopt$inet_opts(r0, 0x0, 0x0, &(0x7f00000000c0)="8907", 0x2) r1 = memfd_create(&(0x7f0000000280)='[\'posix_acl_access\x00', 0x0) pwritev(r1, &(0x7f00000001c0)=[{&(0x7f0000000200)=',', 0x1}], 0x1, 0x4081806) sendfile(0xffffffffffffffff, r1, &(0x7f00000000c0), 0x20020102000007) pipe(&(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$TIOCEXCL(0xffffffffffffffff, 0x540c) write(r3, &(0x7f00000001c0), 0xfffffef3) vmsplice(r2, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) fstat(r1, &(0x7f0000000b40)) ioctl$TIOCGPGRP(0xffffffffffffffff, 0x540f, &(0x7f0000000cc0)) getsockopt$inet6_IPV6_IPSEC_POLICY(0xffffffffffffffff, 0x29, 0x22, &(0x7f00000010c0)={{{@in6=@mcast2, @in=@remote}}, {{@in6=@local}, 0x0, @in6=@loopback}}, &(0x7f00000011c0)=0xe8) recvfrom$unix(0xffffffffffffffff, &(0x7f0000000040)=""/4, 0xebc3276d6d4b1cd2, 0x100100, &(0x7f0000000100)=@abs, 0x930000) openat$selinux_avc_cache_stats(0xffffffffffffff9c, &(0x7f0000000240)='/selinux/avc/cache_stats\x00', 0x0, 0x0) [ 407.368259] binder: send failed reply for transaction 567 to 18177:18180 [ 407.386589] binder: undelivered TRANSACTION_ERROR: 29189 [ 407.408135] binder: 18217:18218 ioctl 40087602 200001c0 returned -22 [ 407.415485] binder: 18217:18218 ioctl 6612 0 returned -22 [ 407.474248] binder_alloc: 18217: binder_alloc_buf, no vma [ 407.490397] binder: 18217:18222 transaction failed 29189/-3, size 24-8 line 3137 [ 407.505807] binder: 18217:18222 BC_INCREFS_DONE u0000000000000000 no match [ 407.523117] binder: 18217:18222 Release 1 refcount change on invalid ref 1 ret -22 20:30:53 executing program 4: socket$inet(0x2, 0x0, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = memfd_create(&(0x7f0000000280)='[\'posix_acl_access\x00', 0x0) pwritev(r2, &(0x7f00000001c0)=[{&(0x7f0000000200)=',', 0x1}], 0x1, 0x4081806) sendfile(r0, r2, &(0x7f00000000c0), 0x20020102000007) pipe(&(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$TIOCEXCL(0xffffffffffffffff, 0x540c) write(r4, &(0x7f00000001c0), 0xfffffef3) vmsplice(r3, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) fstat(r2, &(0x7f0000000b40)) ioctl$TIOCGPGRP(0xffffffffffffffff, 0x540f, &(0x7f0000000cc0)) getsockopt$inet6_IPV6_IPSEC_POLICY(0xffffffffffffffff, 0x29, 0x22, &(0x7f00000010c0)={{{@in6=@mcast2, @in=@remote}}, {{@in6=@local}, 0x0, @in6=@loopback}}, &(0x7f00000011c0)=0xe8) recvfrom$unix(r1, &(0x7f0000000040)=""/4, 0xebc3276d6d4b1cd2, 0x100100, &(0x7f0000000100)=@abs, 0x930000) openat$selinux_avc_cache_stats(0xffffffffffffff9c, &(0x7f0000000240)='/selinux/avc/cache_stats\x00', 0x0, 0x0) 20:30:53 executing program 3: r0 = socket$inet(0x2, 0x4000000000000001, 0x0) recvmsg(r0, &(0x7f0000000280)={&(0x7f0000000000)=@vsock={0x28, 0x0, 0x0, @hyper}, 0x80, &(0x7f0000000240)=[{&(0x7f0000000080)=""/209, 0xd1}, {&(0x7f0000000180)=""/144, 0x90}], 0x2, 0x0, 0x0, 0x4}, 0x0) setsockopt$inet_tcp_TCP_CONGESTION(r0, 0x6, 0xd, &(0x7f0000000680)='reno\x00', 0x60c5) mlock2(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x1) r1 = openat$selinux_mls(0xffffffffffffff9c, &(0x7f0000000340)='/selinux/mls\x00', 0x0, 0x0) ioctl$EVIOCGABS2F(r1, 0x8018456f, &(0x7f00000006c0)=""/4096) sendto$inet(r0, &(0x7f0000a88f88), 0xfffffffffffffe6e, 0x20000000, &(0x7f0000e68000)={0x2, 0x0, @local}, 0x10) bind(r0, &(0x7f00000002c0)=@pppol2tpv3={0x18, 0x1, {0x0, r0, {0x2, 0x4e20, @loopback}, 0x1, 0x4, 0x4}}, 0x80) 20:30:54 executing program 2: r0 = socket$inet(0x2, 0x0, 0x0) setsockopt$inet_opts(r0, 0x0, 0x0, &(0x7f00000000c0)="8907", 0x2) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) r3 = memfd_create(&(0x7f0000000280)='[\'posix_acl_access\x00', 0x0) pwritev(r3, &(0x7f00000001c0)=[{&(0x7f0000000200)=',', 0x1}], 0x1, 0x4081806) sendfile(r1, r3, &(0x7f00000000c0), 0x20020102000007) pipe(&(0x7f0000000180)={0xffffffffffffffff}) ioctl$TIOCEXCL(0xffffffffffffffff, 0x540c) vmsplice(r4, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) fstat(r3, &(0x7f0000000b40)) getsockopt$inet6_IPV6_IPSEC_POLICY(0xffffffffffffffff, 0x29, 0x22, &(0x7f00000010c0)={{{@in6=@mcast2, @in=@remote}}, {{@in6=@local}, 0x0, @in6=@loopback}}, &(0x7f00000011c0)=0xe8) recvfrom$unix(r2, &(0x7f0000000040)=""/4, 0xebc3276d6d4b1cd2, 0x100100, &(0x7f0000000100)=@abs, 0x930000) openat$selinux_avc_cache_stats(0xffffffffffffff9c, &(0x7f0000000240)='/selinux/avc/cache_stats\x00', 0x0, 0x0) 20:30:54 executing program 5: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$nl_netfilter(r0, &(0x7f0000000080)={&(0x7f0000000100), 0xc, &(0x7f00000000c0)={&(0x7f0000000340)=ANY=[@ANYBLOB="140000000301ffff808f00003d88c83f00b516ba"], 0x14}}, 0x0) recvmmsg(r0, &(0x7f00000013c0), 0x1ad, 0x0, &(0x7f0000000c40)={0x77359400}) r1 = openat$selinux_avc_hash_stats(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/avc/hash_stats\x00', 0x0, 0x0) getsockopt$ARPT_SO_GET_INFO(r1, 0x0, 0x60, &(0x7f0000000140)={'filter\x00'}, &(0x7f0000000040)=0x44) [ 408.207263] binder: 18217:18222 ioctl 40087602 200001c0 returned -22 [ 408.222903] binder: 18217:18222 ioctl 6612 0 returned -22 [ 408.233800] binder: BINDER_SET_CONTEXT_MGR already set 20:30:54 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$FS_IOC_SETVERSION(r0, 0x40087602, &(0x7f00000001c0)) r1 = syz_open_dev$binder(&(0x7f0000000640)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) fcntl$setflags(r1, 0x2, 0x1) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000000)=[@enter_looper], 0x1, 0x0, &(0x7f0000000040)='+'}) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000018000000000000000800000000000000", @ANYPTR=&(0x7f0000000080)=ANY=[@ANYBLOB="682a6273000000b727b8f1ee0017394b9e17629dd1753faaefc378627b01218069027301d8ba56cb72d30e1cf18630e9a149d077071b273ffe62d8a300706e4ae61c1dbd969f465c54c9e82b994b72d7d8db815c21c085385345ab690800ff93a7b3e687753637cb6a52f4682996ef865d117f7e694e7c93bd08f9c9c10a45c485410347", @ANYRES64=0x0, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00'], @ANYPTR=&(0x7f0000000240)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00']], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0x0, 0x0, &(0x7f0000000780)}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000380)={0x8, 0x0, &(0x7f0000000500)=[@release={0x40046306, 0x1}], 0x0, 0x0, &(0x7f0000000400)}) [ 408.255092] binder: 18217:18262 ioctl 40046207 0 returned -16 [ 408.270358] binder_alloc: 18217: binder_alloc_buf, no vma [ 408.275974] binder: 18217:18260 BC_INCREFS_DONE u0000000000000000 no match [ 408.283378] binder: 18217:18222 transaction failed 29189/-3, size 24-8 line 3137 20:30:54 executing program 0: r0 = socket$inet(0x2, 0x0, 0x0) setsockopt$inet_opts(r0, 0x0, 0x0, &(0x7f00000000c0)="8907", 0x2) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) r3 = memfd_create(&(0x7f0000000280)='[\'posix_acl_access\x00', 0x0) pwritev(r3, &(0x7f00000001c0)=[{&(0x7f0000000200)=',', 0x1}], 0x1, 0x4081806) sendfile(r1, r3, &(0x7f00000000c0), 0x20020102000007) pipe(&(0x7f0000000180)={0xffffffffffffffff}) ioctl$TIOCEXCL(0xffffffffffffffff, 0x540c) vmsplice(r4, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) fstat(r3, &(0x7f0000000b40)) getsockopt$inet6_IPV6_IPSEC_POLICY(0xffffffffffffffff, 0x29, 0x22, &(0x7f00000010c0)={{{@in6=@mcast2, @in=@remote}}, {{@in6=@local}, 0x0, @in6=@loopback}}, &(0x7f00000011c0)=0xe8) recvfrom$unix(r2, &(0x7f0000000040)=""/4, 0xebc3276d6d4b1cd2, 0x100100, &(0x7f0000000100)=@abs, 0x930000) openat$selinux_avc_cache_stats(0xffffffffffffff9c, &(0x7f0000000240)='/selinux/avc/cache_stats\x00', 0x0, 0x0) [ 408.345515] binder: 18266:18267 ioctl 40087602 200001c0 returned -22 [ 408.418858] binder: 18266:18274 got transaction with invalid offset (0, min 0 max 24) or object. [ 408.453632] binder: 18266:18274 transaction failed 29201/-22, size 24-8 line 3200 [ 408.471238] binder: 18266:18277 BC_INCREFS_DONE u0000000000000000 no match [ 408.492751] binder: 18266:18274 Release 1 refcount change on invalid ref 1 ret -22 20:30:54 executing program 4: setsockopt$inet_opts(0xffffffffffffffff, 0x0, 0x0, &(0x7f00000000c0)="8907", 0x2) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = memfd_create(&(0x7f0000000280)='[\'posix_acl_access\x00', 0x0) pwritev(r2, &(0x7f00000001c0)=[{&(0x7f0000000200)=',', 0x1}], 0x1, 0x4081806) sendfile(r0, r2, &(0x7f00000000c0), 0x20020102000007) pipe(&(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$TIOCEXCL(0xffffffffffffffff, 0x540c) write(r4, &(0x7f00000001c0), 0xfffffef3) vmsplice(r3, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) fstat(r2, &(0x7f0000000b40)) ioctl$TIOCGPGRP(0xffffffffffffffff, 0x540f, &(0x7f0000000cc0)) getsockopt$inet6_IPV6_IPSEC_POLICY(0xffffffffffffffff, 0x29, 0x22, &(0x7f00000010c0)={{{@in6=@mcast2, @in=@remote}}, {{@in6=@local}, 0x0, @in6=@loopback}}, &(0x7f00000011c0)=0xe8) recvfrom$unix(r1, &(0x7f0000000040)=""/4, 0xebc3276d6d4b1cd2, 0x100100, &(0x7f0000000100)=@abs, 0x930000) openat$selinux_avc_cache_stats(0xffffffffffffff9c, &(0x7f0000000240)='/selinux/avc/cache_stats\x00', 0x0, 0x0) 20:30:54 executing program 3: r0 = socket$inet(0x2, 0x4000000000000001, 0x0) setsockopt$inet_tcp_TCP_CONGESTION(r0, 0x6, 0xd, &(0x7f0000000680)='reno\x00', 0x60c5) sendto$inet(r0, &(0x7f0000a88f88), 0xfffffffffffffe6e, 0x20000000, &(0x7f0000e68000)={0x2, 0x0, @local}, 0x10) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000000)="64756d6d933000", 0xe6) 20:30:55 executing program 2: r0 = socket$inet(0x2, 0x0, 0x0) setsockopt$inet_opts(r0, 0x0, 0x0, &(0x7f00000000c0)="8907", 0x2) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) r3 = memfd_create(&(0x7f0000000280)='[\'posix_acl_access\x00', 0x0) pwritev(r3, &(0x7f00000001c0)=[{&(0x7f0000000200)=',', 0x1}], 0x1, 0x4081806) sendfile(r1, r3, &(0x7f00000000c0), 0x20020102000007) pipe(&(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) write(r5, &(0x7f00000001c0), 0xfffffef3) vmsplice(r4, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) fstat(r3, &(0x7f0000000b40)) getsockopt$inet6_IPV6_IPSEC_POLICY(0xffffffffffffffff, 0x29, 0x22, &(0x7f00000010c0)={{{@in6=@mcast2, @in=@remote}}, {{@in6=@local}, 0x0, @in6=@loopback}}, &(0x7f00000011c0)=0xe8) recvfrom$unix(r2, &(0x7f0000000040)=""/4, 0xebc3276d6d4b1cd2, 0x100100, &(0x7f0000000100)=@abs, 0x930000) openat$selinux_avc_cache_stats(0xffffffffffffff9c, &(0x7f0000000240)='/selinux/avc/cache_stats\x00', 0x0, 0x0) [ 409.136085] binder: 18266:18274 ioctl 40087602 200001c0 returned -22 [ 409.139777] binder: BINDER_SET_CONTEXT_MGR already set [ 409.139785] binder: 18266:18296 ioctl 40046207 0 returned -16 [ 409.139920] binder_alloc: 18266: binder_alloc_buf, no vma [ 409.139960] binder: 18266:18277 transaction failed 29189/-3, size 24-8 line 3137 [ 409.140254] binder: 18266:18296 BC_INCREFS_DONE u0000000000000000 no match 20:30:55 executing program 5: r0 = openat$null(0xffffffffffffff9c, &(0x7f0000000140)='/dev/null\x00', 0x100, 0x0) ioctl$TCSETAW(r0, 0x5407, &(0x7f0000000180)={0x9, 0x255c, 0x10, 0x0, 0x0, 0x131d, 0x1ff, 0x1, 0x80, 0x81}) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$nl_netfilter(r1, &(0x7f0000000080)={&(0x7f0000000100), 0xc, &(0x7f00000000c0)={&(0x7f0000000340)=ANY=[@ANYBLOB="140000000301ffff808f00003d88c83f00b516ba"], 0x14}}, 0x0) recvmmsg(r1, &(0x7f00000013c0), 0x0, 0x0, &(0x7f00000001c0)={0x77359400}) r2 = openat$selinux_status(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/status\x00', 0x0, 0x0) ioctl$BLKIOMIN(r2, 0x1278, &(0x7f0000000040)) 20:30:55 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) openat$uhid(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/uhid\x00', 0x802, 0x0) ioctl$FS_IOC_SETVERSION(r0, 0x40087602, &(0x7f00000001c0)) r1 = syz_open_dev$binder(&(0x7f0000000640)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$int_in(r1, 0x5452, &(0x7f0000000080)=0x3) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000000)=[@enter_looper], 0x1, 0x0, &(0x7f0000000040)='+'}) mremap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x4000, 0x2, &(0x7f0000ffa000/0x4000)=nil) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$FS_IOC_GETFSMAP(r0, 0xc0c0583b, &(0x7f00000007c0)={0x0, 0x0, 0x4, 0x0, [], [{0x95da, 0x80000000, 0x8, 0x2, 0x137, 0xffffffffffffffff}, {0x1, 0x14000, 0x7, 0x6, 0x8001, 0x171}], [[], [], [], []]}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000002c0)={0x2b, 0x0, &(0x7f0000000280)=[@increfs_done], 0x0, 0x0, &(0x7f0000000680)="6311b838b5975b8860ccab282e4945e6ac3d36bef77ec9e509d99b9a4a26b58a2e60eea1b05ad68272b969d9d45f98a1a2b5f0763269854fc275439b2a0cffe58283d78e89cef79849330ee09497e08cb88945ef630bba3ed9c28d48811bb0035a36a12208a21bc31bcc4078b8281342c31b615676521b5d3753e006c776642a202d6363d77df2530726ac12ecbd61c1e5912cea265a65b6f94e1356f71437e56c10e72734f8eec9ddc64030286b08b4b17b68053aecc8a16f9f2262aa6614597454edadb43645ae57f87083cc5f736933baf27bbc6f244f60617ca20649eca69d5459786d54d4b170785abe3f320e65331df71a22317097b88e2931c2730452bee11439ebf69b6e7ba292822460ee10b81ca6d8384bd4a1cd4371a2e487a39bd6f4"}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000004c0)={0x8, 0x0, &(0x7f0000000500)=[@release={0x40046306, 0x1}], 0x0, 0x0, &(0x7f0000000400)}) fsetxattr$security_evm(r1, &(0x7f0000000400)='security.evm\x00', &(0x7f0000000480)=@sha1={0x1, "2e0ba7c3682afb26ceadc2860bf388016f981e9a"}, 0x15, 0x2) r2 = accept$inet(r1, &(0x7f0000000100)={0x2, 0x0, @remote}, &(0x7f0000000180)=0x10) ioctl$sock_ifreq(r2, 0x8995, &(0x7f00000003c0)={'syz_tun\x00', @ifru_flags=0x1200}) openat$selinux_user(0xffffffffffffff9c, &(0x7f0000000380)='/selinux/user\x00', 0x2, 0x0) [ 409.305612] binder: 18303:18306 ioctl 40087602 200001c0 returned -22 [ 409.380613] binder: 18303:18309 ioctl c0c0583b 200007c0 returned -22 20:30:55 executing program 0: r0 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f00000003c0)='./cgroup\x00', 0x200002, 0x0) pipe(&(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) write(r2, &(0x7f00000001c0), 0xfffffef3) vmsplice(r1, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) write$P9_RSTAT(r1, &(0x7f0000000540)=ANY=[@ANYBLOB="710000007d010000006a000100c93b00000121000000bfbae4191b02c34b000000010400000003000000c600000000000000000009002e2f6367726f75700011002f73656cd16e75782f636f6e74657874001d002f73656c696e75782f6176632f63616368655f7468726573686f6c6400"], 0x71) fchdir(r0) ioctl$VT_SETMODE(r1, 0x5602, &(0x7f00000001c0)={0xfffffffffffffff7, 0x8, 0x0, 0x4, 0x6}) r3 = creat(&(0x7f00000004c0)='./bus\x00', 0x0) socketpair$inet(0x2, 0x3, 0x3, &(0x7f0000000500)) write$selinux_load(r0, &(0x7f0000000640)={0xf97cff8c, 0x8, 'SE Linux', "f06ac7392156f7e35b921616600e5df1aeeadc1713e3db82bf5c7c"}, 0x2b) r4 = creat(&(0x7f00000000c0)='./bus\x00', 0x0) openat$selinux_context(0xffffffffffffff9c, &(0x7f0000000040)='/selinux/context\x00', 0x2, 0x0) write$P9_RFLUSH(r4, &(0x7f0000000180)={0x19d}, 0x1a6db1e6) listxattr(&(0x7f00000005c0)='./bus\x00', &(0x7f0000000600)=""/5, 0x5) write$P9_RREADDIR(r3, &(0x7f0000000400)=ANY=[], 0x0) fsync(r4) ioctl$PIO_FONT(r1, 0x4b61, &(0x7f0000000400)="40347b55b44b684a88d0f1ac7a376bf26ee9f74b26c15eacf1037b413b87b57aeedaf52fb6e8f8aaaa9bd9ff30281bfb345222224cfc743475a0e8537b1e287d2125b5db60549b7b636c118d0fb788b12513fcb09cb4e97303e288edc456f973862c68508cae6fbbaa1f52cb43d825dd72b2fa8f071a9b90df61ab9eb8b8") ioctl$PERF_EVENT_IOC_ID(r2, 0x80082407, &(0x7f0000000100)) ioctl$TIOCGSID(r3, 0x5429, &(0x7f0000000300)=0x0) sched_getparam(r5, &(0x7f0000000380)) ioctl$VT_DISALLOCATE(0xffffffffffffffff, 0x5608) ioctl$EXT4_IOC_MIGRATE(r2, 0x6609) getsockopt$inet_tcp_TCP_ZEROCOPY_RECEIVE(r1, 0x6, 0x23, &(0x7f0000000140)={&(0x7f0000ffe000/0x2000)=nil, 0x2000}, &(0x7f0000000340)=0x10) fcntl$setflags(0xffffffffffffffff, 0x2, 0x1) ioctl$TIOCSETD(r3, 0x5423, &(0x7f0000000080)=0x6) openat$selinux_avc_cache_threshold(0xffffffffffffff9c, &(0x7f0000000880)='/selinux/avc/cache_threshold\x00', 0x2, 0x0) ioctl$sock_inet_SIOCGIFDSTADDR(r4, 0x8917, &(0x7f0000000240)={'bcsh0\x00', {0x2, 0x4e21, @broadcast}}) ioctl$EXT4_IOC_ALLOC_DA_BLKS(0xffffffffffffffff, 0x660c) msync(&(0x7f0000d5b000/0x4000)=nil, 0x4000, 0x2000000) setsockopt$inet_tcp_TCP_CONGESTION(0xffffffffffffffff, 0x6, 0xd, &(0x7f0000000680)='reno\x00', 0x60c5) 20:30:55 executing program 5: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$nl_netfilter(r0, &(0x7f0000000080)={&(0x7f0000000100), 0xc, &(0x7f00000000c0)={&(0x7f0000000340)=ANY=[@ANYBLOB="14ff000003030e95393600003d88c83f00b516ba"], 0x14}}, 0x0) recvmmsg(r0, &(0x7f00000013c0), 0x1ad, 0x0, &(0x7f0000000c40)={0x77359400}) r1 = dup3(r0, r0, 0x80000) ioctl$FS_IOC_GETFSLABEL(r0, 0x81009431, &(0x7f0000000140)) ioctl$BLKBSZGET(r1, 0x80081270, &(0x7f0000000000)) ioctl$sock_SIOCBRADDBR(r1, 0x89a0, &(0x7f0000000040)='dummy0\x00') ioctl$KDSETLED(r1, 0x4b32, 0x100000000) [ 409.466255] binder: 18303:18314 BC_INCREFS_DONE node 577 has no pending increfs request [ 409.506605] binder: 18303:18314 unknown command 0 [ 409.520423] binder: 18303:18314 ioctl c0306201 200002c0 returned -22 20:30:55 executing program 4: socket$inet(0x2, 0x0, 0x0) setsockopt$inet_opts(0xffffffffffffffff, 0x0, 0x0, &(0x7f00000000c0)="8907", 0x2) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = memfd_create(&(0x7f0000000280)='[\'posix_acl_access\x00', 0x0) pwritev(r2, &(0x7f00000001c0)=[{&(0x7f0000000200)=',', 0x1}], 0x1, 0x4081806) sendfile(r0, r2, &(0x7f00000000c0), 0x20020102000007) pipe(&(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$TIOCEXCL(0xffffffffffffffff, 0x540c) write(r4, &(0x7f00000001c0), 0xfffffef3) vmsplice(r3, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) fstat(r2, &(0x7f0000000b40)) ioctl$TIOCGPGRP(0xffffffffffffffff, 0x540f, &(0x7f0000000cc0)) getsockopt$inet6_IPV6_IPSEC_POLICY(0xffffffffffffffff, 0x29, 0x22, &(0x7f00000010c0)={{{@in6=@mcast2, @in=@remote}}, {{@in6=@local}, 0x0, @in6=@loopback}}, &(0x7f00000011c0)=0xe8) recvfrom$unix(r1, &(0x7f0000000040)=""/4, 0xebc3276d6d4b1cd2, 0x100100, &(0x7f0000000100)=@abs, 0x930000) openat$selinux_avc_cache_stats(0xffffffffffffff9c, &(0x7f0000000240)='/selinux/avc/cache_stats\x00', 0x0, 0x0) 20:30:55 executing program 3: r0 = socket$inet(0x2, 0x403ffffffffffffe, 0xfff) setsockopt$inet_tcp_TCP_CONGESTION(r0, 0x6, 0xd, &(0x7f0000000680)='reno\x00', 0x60c5) ioctl$BLKROSET(r0, 0x125d, &(0x7f0000000000)=0x9) sendto$inet(r0, &(0x7f0000a88f88), 0xfffffffffffffe6e, 0x20000000, &(0x7f0000e68000)={0x2, 0x0, @local}, 0x10) r1 = open(&(0x7f00000000c0)='./file0\x00', 0x4200, 0x3) getsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffff9c, 0x29, 0x23, &(0x7f0000000100)={{{@in=@multicast2, @in=@rand_addr, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@ipv4}, 0x0, @in=@remote}}, &(0x7f0000000200)=0xe8) getsockopt$sock_cred(r0, 0x1, 0x11, &(0x7f0000000240)={0x0, 0x0, 0x0}, &(0x7f0000000280)=0xc) mount$fuse(0x0, &(0x7f0000000040)='./file0\x00', &(0x7f0000000080)='fuse\x00', 0x60800, &(0x7f00000002c0)={{'fd', 0x3d, r1}, 0x2c, {'rootmode', 0x3d, 0x2000}, 0x2c, {'user_id', 0x3d, r2}, 0x2c, {'group_id', 0x3d, r3}, 0x2c, {[{@allow_other='allow_other'}, {@default_permissions='default_permissions'}, {@default_permissions='default_permissions'}, {@max_read={'max_read', 0x3d, 0x8}}, {@blksize={'blksize', 0x3d, 0x800}}, {@allow_other='allow_other'}, {@default_permissions='default_permissions'}, {@blksize={'blksize', 0x3d, 0x200}}], [{@fsuuid={'fsuuid', 0x3d, {[0x7e, 0x35, 0x0, 0x37, 0x77, 0x32, 0x7e, 0x77], 0x2d, [0x32, 0x0, 0x37, 0x31], 0x2d, [0x7f, 0x38, 0x79, 0x77], 0x2d, [0x39, 0x61, 0x64, 0x7e], 0x2d, [0x34, 0x66, 0x64, 0x65, 0x62, 0x39, 0x7f, 0x31]}}}]}}) 20:30:55 executing program 3: r0 = socket$inet(0x2, 0x4000000000000001, 0x0) getsockopt$inet_mreqn(r0, 0x0, 0x24, &(0x7f0000000000)={@broadcast}, &(0x7f0000000040)=0xc) setsockopt$inet_tcp_TCP_CONGESTION(r0, 0x6, 0xd, &(0x7f0000000680)='reno\x00', 0x60c5) sendto$inet(r0, &(0x7f0000a88f88), 0xfffffffffffffe6e, 0x20000000, &(0x7f0000e68000)={0x2, 0x0, @local}, 0x10) 20:30:55 executing program 2: r0 = socket$inet(0x2, 0x0, 0x0) setsockopt$inet_opts(r0, 0x0, 0x0, &(0x7f00000000c0)="8907", 0x2) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) r3 = memfd_create(&(0x7f0000000280)='[\'posix_acl_access\x00', 0x0) pwritev(r3, &(0x7f00000001c0)=[{&(0x7f0000000200)=',', 0x1}], 0x1, 0x4081806) sendfile(r1, r3, &(0x7f00000000c0), 0x20020102000007) ioctl$TIOCEXCL(0xffffffffffffffff, 0x540c) write(0xffffffffffffffff, &(0x7f00000001c0), 0xfffffef3) vmsplice(0xffffffffffffffff, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) fstat(r3, &(0x7f0000000b40)) getsockopt$inet6_IPV6_IPSEC_POLICY(0xffffffffffffffff, 0x29, 0x22, &(0x7f00000010c0)={{{@in6=@mcast2, @in=@remote}}, {{@in6=@local}, 0x0, @in6=@loopback}}, &(0x7f00000011c0)=0xe8) recvfrom$unix(r2, &(0x7f0000000040)=""/4, 0xebc3276d6d4b1cd2, 0x100100, &(0x7f0000000100)=@abs, 0x930000) openat$selinux_avc_cache_stats(0xffffffffffffff9c, &(0x7f0000000240)='/selinux/avc/cache_stats\x00', 0x0, 0x0) [ 410.072299] binder: 18303:18319 ioctl 40087602 200001c0 returned -22 [ 410.083705] binder_alloc: binder_alloc_mmap_handler: 18303 20001000-20004000 already mapped failed -16 [ 410.138080] binder: BINDER_SET_CONTEXT_MGR already set [ 410.146583] binder: 18303:18319 ioctl 40046207 0 returned -16 [ 410.162104] binder: 18303:18314 ioctl c0c0583b 200007c0 returned -22 [ 410.168749] binder_alloc: 18303: binder_alloc_buf, no vma [ 410.183722] binder: 18303:18319 transaction failed 29189/-3, size 24-8 line 3137 [ 410.204082] binder: 18303:18314 BC_INCREFS_DONE u0000000000000000 no match [ 410.212125] binder: 18303:18319 Release 1 refcount change on invalid ref 1 ret -22 [ 410.222599] binder: 18303:18314 unknown command 0 20:30:56 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$FS_IOC_SETVERSION(r0, 0x40087602, &(0x7f00000001c0)) r1 = syz_open_dev$binder(&(0x7f0000000640)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000000)=[@enter_looper], 0x1, 0x0, &(0x7f0000000040)='+'}) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) openat$ion(0xffffffffffffff9c, &(0x7f0000000400)='/dev/ion\x00', 0x630802, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0x0, 0x0, &(0x7f0000000780)}) r2 = accept$unix(0xffffffffffffffff, &(0x7f0000000080), &(0x7f0000000100)=0x6e) fcntl$getownex(r1, 0x10, &(0x7f0000000180)={0x0, 0x0}) ioctl$sock_SIOCSPGRP(r2, 0x8902, &(0x7f00000003c0)=r3) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000380)={0x8, 0x0, &(0x7f0000000500)=[@release={0x40046306, 0x1}], 0x0, 0x0, &(0x7f0000000400)}) [ 410.235711] binder: 18303:18314 ioctl c0306201 200002c0 returned -22 [ 410.250108] binder: send failed reply for transaction 578 to 18303:18309 [ 410.260654] binder: undelivered TRANSACTION_COMPLETE [ 410.279719] binder: undelivered TRANSACTION_ERROR: 29189 20:30:56 executing program 5: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) getsockopt$SO_TIMESTAMPING(r0, 0x1, 0x25, &(0x7f00000000c0), &(0x7f0000000100)=0x4) recvmmsg(r0, &(0x7f00000013c0), 0x0, 0x0, &(0x7f0000000140)={0x77359400}) clock_gettime(0x0, &(0x7f0000000000)={0x0, 0x0}) clock_nanosleep(0x6, 0x1, &(0x7f0000000040)={r1, r2+30000000}, &(0x7f0000000080)) [ 410.316733] binder: 18353:18354 ioctl 40087602 200001c0 returned -22 20:30:56 executing program 0: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r0, &(0x7f0000000100)={0xa, 0x4e22, 0x0, @empty, 0x4}, 0x1c) writev(0xffffffffffffffff, &(0x7f0000002980), 0x0) r1 = socket$inet6(0x10, 0x3, 0x0) sendmsg(r1, &(0x7f0000002fc8)={&(0x7f0000000000)=@nl, 0x80, &(0x7f0000002000)=[{&(0x7f0000000340)="5500000018007f5300fe01b2a4a280930a06000000a84308910000003900090008000c00010000001900150006000000000000dc1338d54400009b84136ef75afb83de448daa7227c43ab8220000060cec4fab6513", 0x55}], 0x1, &(0x7f0000000400), 0x0, 0x4}, 0x0) ioctl$EXT4_IOC_GROUP_EXTEND(0xffffffffffffffff, 0x40046607, &(0x7f0000000400)) listen(r0, 0x7c) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) mkdirat$cgroup(0xffffffffffffffff, &(0x7f0000000140)='syz1\x00', 0x1ff) r3 = memfd_create(&(0x7f0000000180)="0004003100", 0x0) ioctl$sock_SIOCGPGRP(r3, 0x8904, &(0x7f00000000c0)=0x0) syz_open_procfs(r4, &(0x7f0000000300)='net/ip_tables_names\x00') write$P9_RFSYNC(r3, &(0x7f0000000240)={0x7, 0x33, 0x1}, 0xfffffffffffffe2d) sendto$inet6(r2, &(0x7f0000000380), 0x0, 0x20000004, &(0x7f000031e000)={0xa, 0x4e22, 0x0, @ipv4}, 0x1c) openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000b80)="2e2f6367726f75702f73797a3100b8458a1392623c2acc07743172c163cfc71523709c3289acba6eaf2919f32ebaa4cbe89ed30167d7d56e8e65c0edbb300c9e287f10f513e776522729d5c85c09fed3f33ea055b94d27bb72a2bb9fd56015f25cf4f9ced65ed81253cfba08e9a329935ac0c64d10a5e701cc58fe4af8cb5b679468e8ad39e103e2d5b7d9078c34eb2832a5852b28958b7efeca8ffc69c09a7ca33d82e59f9e27ea25a7cf5e65bc52987952070ddac3929791a23f905fbd72419d1539", 0x200002, 0x0) fchdir(r1) r5 = creat(&(0x7f00000005c0)='./bus\x00', 0x0) r6 = open(&(0x7f0000000540)='./bus\x00', 0x141042, 0x0) sigaltstack(&(0x7f0000ffe000/0x1000)=nil, &(0x7f0000000480)) write$selinux_context(r6, &(0x7f0000000000)='system_u:object_r:crontab_exec_t:s0\x00', 0xfffffffffffffe84) r7 = creat(&(0x7f00000003c0)='./bus\x00', 0x2) r8 = openat$null(0xffffffffffffff9c, &(0x7f00000004c0)='/dev/null\x00', 0x2807fd, 0x0) write(r8, &(0x7f0000000380), 0x0) write$cgroup_type(r5, &(0x7f0000000200)='threaded\x00', 0xfffffeb3) select(0x40, &(0x7f0000000040), &(0x7f0000000080), &(0x7f00000001c0), &(0x7f0000000280)={0x77359400}) getsockopt$IP6T_SO_GET_ENTRIES(r0, 0x29, 0x41, &(0x7f0000000c80)=ANY=[@ANYBLOB="73656375726974796d0000000000000000000000000000000000000000000000c40000004e8b4b1c7fa37c911d43b7dfc1540065e2cf063a33e71b903574450eb6fcc611bb94c232461f22877f4a6bfa2e09f7f448f8a2ef823ff78d796ab6ab52f030b8fea1243b4a37836d690100843a8998fea04a2bc474078acbb61c426c93824178b70a4bcff2d634050eca0d4f941bfec0542fd99b2bd8823b4175d0b0e455f170e292c18a967fdc58383f9af93bc9c8b8578b5ed8ba7d2084ab94919aea43e1a3acfd6d899d943862ca8d84436629d2159976a615f1279aaf23ce57319edb9be03d5b849777d956c09bcb8bc5eb1d793fe7b7d0c34d4d6cc6d28cb9f66b0a2f31eda0ce948210375abcde9320750390dc04b3af4959443184210eb68c4fe6dced7e44cd2b39f7d25dc53dab0fd596852191868741cecd379b6e87b1c1a8c0dc6b8004595fb61135ed10927d6df243071d53b4757c13f4ceb4480e4a7b9c730be6258db763d9e9e7baeccd140ed2311fd9c570db36e93131c27442990068d315088680ab638288fb05b1676a9ab2fe9aa99539a1cfbb1ae8b35cd18007ba5105ed92f8914bcc2397da080dd1da393ede4f195953f82d03b9a920391ee4f5bd7485d69e1d8bfc93521ea451a20dd056bd3c133aa93c9bef1e254ad7d19379b21be984d93cc7cfcbffc82708aebe5fe4c4aa7af905248de89163041c16cfdaf96ee5b65715c7bb840274ba8ddc979ae077aa20b5ba0e97ecd80abb2d3cdb2d2b6603b3a003871b7220d71909f230fa5e9a7307c10c954a2ff1c6bf5fe3e153c0ebeb4940c365ef1e9cc8588a51bfc9807e866ea6528a77c930c06eb50e3f14ca8abf929570c05ca0615211cdcce3d034946d4fadcc9df5702fca33cb322c27a54fee8cd7901df1066311b737259dfc65048bcff6eca8f566ed75b5d21b58a3c51907ba6d5ef9e04e24febdea1d345b16288065bf64cf9fa3a746185191dc7b2f4520fd2da2f60434395d6121d7063a6455be070f49e04c8c2fa0da58d878d80a1bf9cc58b6926e3c471cb1e79cb85f6ce2ad91ac6c68f955a507ad55f514d131e0a095329227c9888f9fb19bfe6df77dff07ef08544a33e9f10d72e3ca6a0d70bf0d4b3e607a2238db2aa9c1011d0af4a39786e48004427b8b55fcd1f7ad63a9aa5338475975159310e0e40000000000000000000000000000000000000000000000000000"], &(0x7f00000002c0)=0x1) recvfrom$inet6(r2, &(0x7f0000001840)=""/31, 0xfffffe0e, 0x100, &(0x7f0000001880)={0xa, 0x0, 0xffff}, 0x1c) getsockopt$inet_mreqn(r7, 0x0, 0x23, &(0x7f0000000500)={@multicast1, @multicast1, 0x0}, &(0x7f0000000440)=0xc) setsockopt$inet6_IPV6_PKTINFO(r5, 0x29, 0x32, &(0x7f0000000580)={@remote, r9}, 0x14) sendto$inet6(0xffffffffffffffff, &(0x7f00000000c0), 0xfffffffffffffe2b, 0x0, 0x0, 0x0) 20:30:56 executing program 5: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) ioctl$FS_IOC_FIEMAP(r0, 0xc020660b, &(0x7f00000003c0)={0x6, 0x3, 0x1, 0x843a, 0x7, [{0x7, 0x3, 0x800, 0x0, 0x0, 0x200}, {0x5, 0x101, 0x7fffffff, 0x0, 0x0, 0x900}, {0x2, 0x7, 0x3, 0x0, 0x0, 0x80}, {0xc1, 0x2, 0x1b, 0x0, 0x0, 0x1000}, {0x5, 0x6, 0x10000, 0x0, 0x0, 0x208}, {0x8000, 0x6f, 0xf1fe, 0x0, 0x0, 0x205}, {0x3, 0x100, 0xfffffffffffffffc, 0x0, 0x0, 0x2100}]}) r1 = openat$selinux_policy(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/policy\x00', 0x0, 0x0) sendfile(r0, r1, &(0x7f0000000580), 0x3) getsockopt$inet6_IPV6_IPSEC_POLICY(r1, 0x29, 0x22, &(0x7f00000002c0)={{{@in=@broadcast, @in6=@loopback}}, {{@in6=@local}, 0x0, @in6=@ipv4={[], [], @broadcast}}}, &(0x7f0000000040)=0xe8) sendmsg$nl_netfilter(r0, &(0x7f0000000080)={&(0x7f0000000100), 0xc, &(0x7f00000000c0)={&(0x7f0000000140)=ANY=[@ANYBLOB="1400003d88d13f00b516bacb0000000000000000fabbef75f6615c9ccee68bea81c7c207cb99adb0ac7352415c81f4b7e136588164c24673a003d6c146c307feced0c1d0af348978b796f463955bb70d5eccfe34c3dad9e765102e36b28993a64302d8818fb7b057e1e2a678dd6f0ca9dc6d47e1e68865608540a73df8641995ca97600c89c76283f6efe4f49e04734055fea7a61fac9d1e6f4faea4f9afeeea2245070c615c3ed5a3f9239c3474408ff65f130c131ba5c928e4c7d2c6fe4bdd8e82a13609e29c6f1a321c1b33cbbf3ba743f3ba7b82ba962cddcb56ca6b5df01a7ef8ab8998f97bdfd04241e64ead5bae27685a877756656a8a4c8a3e7ee08fbe7252a2a1844322561671548791bdab8b2adf188da95f6917c08f4791048689d5a56aab027e371e9006a3336afe6d96a7cefefeae3178a13446c64019ddc2dd030f"], 0x14}}, 0x0) recvmmsg(r0, &(0x7f00000013c0), 0x9e, 0x0, &(0x7f0000000c40)={0x77359400}) 20:30:56 executing program 4: r0 = socket$inet(0x2, 0x0, 0x0) setsockopt$inet_opts(r0, 0x0, 0x0, &(0x7f00000000c0), 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) r3 = memfd_create(&(0x7f0000000280)='[\'posix_acl_access\x00', 0x0) pwritev(r3, &(0x7f00000001c0)=[{&(0x7f0000000200)=',', 0x1}], 0x1, 0x4081806) sendfile(r1, r3, &(0x7f00000000c0), 0x20020102000007) pipe(&(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$TIOCEXCL(0xffffffffffffffff, 0x540c) write(r5, &(0x7f00000001c0), 0xfffffef3) vmsplice(r4, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) fstat(r3, &(0x7f0000000b40)) ioctl$TIOCGPGRP(0xffffffffffffffff, 0x540f, &(0x7f0000000cc0)) getsockopt$inet6_IPV6_IPSEC_POLICY(0xffffffffffffffff, 0x29, 0x22, &(0x7f00000010c0)={{{@in6=@mcast2, @in=@remote}}, {{@in6=@local}, 0x0, @in6=@loopback}}, &(0x7f00000011c0)=0xe8) recvfrom$unix(r2, &(0x7f0000000040)=""/4, 0xebc3276d6d4b1cd2, 0x100100, &(0x7f0000000100)=@abs, 0x930000) openat$selinux_avc_cache_stats(0xffffffffffffff9c, &(0x7f0000000240)='/selinux/avc/cache_stats\x00', 0x0, 0x0) 20:30:56 executing program 3: r0 = socket$inet(0x2, 0x4000000000000001, 0x0) setsockopt$inet_tcp_TCP_CONGESTION(r0, 0x6, 0xd, &(0x7f0000000040)='illinois\x00', 0x1c) sendto$inet(r0, &(0x7f0000a88f88), 0xfffffffffffffe6e, 0x20000000, &(0x7f0000e68000)={0x2, 0x0, @local}, 0x10) setsockopt$inet_opts(r0, 0x0, 0x4, &(0x7f0000000080)="9d7f44de5b2496e0ae6dd70d2e512579156d629356d95741925104fd72ba5a957b82ef5d278ac573118ff344bc119966168452626505aecaa1aa2e92b2fc013fac4e97791c7eadbc56c32875b610375dfe403b4cd234d47680edc2dbc780fc1a364b047a74a78f2d592ded790462782b3c2e6e6d3b9ccac47615b0847491da190f0b7f5f73b6da7abad86c", 0x8b) r1 = getpgrp(0x0) r2 = openat$selinux_avc_cache_threshold(0xffffffffffffff9c, &(0x7f0000000140)='/selinux/avc/cache_threshold\x00', 0x2, 0x0) write$FUSE_NOTIFY_DELETE(r2, &(0x7f0000000180)={0x32, 0x6, 0x0, {0x3, 0x0, 0x9, 0x0, 'illinois\x00'}}, 0x32) ptrace$getregs(0xffffffffffffffff, r1, 0xffff, &(0x7f0000000000)=""/15) 20:30:56 executing program 2: r0 = socket$inet(0x2, 0x0, 0x0) setsockopt$inet_opts(r0, 0x0, 0x0, &(0x7f00000000c0)="8907", 0x2) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) r3 = memfd_create(&(0x7f0000000280)='[\'posix_acl_access\x00', 0x0) pwritev(r3, &(0x7f00000001c0)=[{&(0x7f0000000200)=',', 0x1}], 0x1, 0x4081806) sendfile(r1, r3, &(0x7f00000000c0), 0x20020102000007) ioctl$TIOCEXCL(0xffffffffffffffff, 0x540c) write(0xffffffffffffffff, &(0x7f00000001c0), 0xfffffef3) vmsplice(0xffffffffffffffff, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) fstat(r3, &(0x7f0000000b40)) getsockopt$inet6_IPV6_IPSEC_POLICY(0xffffffffffffffff, 0x29, 0x22, &(0x7f00000010c0)={{{@in6=@mcast2, @in=@remote}}, {{@in6=@local}, 0x0, @in6=@loopback}}, &(0x7f00000011c0)=0xe8) recvfrom$unix(r2, &(0x7f0000000040)=""/4, 0xebc3276d6d4b1cd2, 0x100100, &(0x7f0000000100)=@abs, 0x930000) openat$selinux_avc_cache_stats(0xffffffffffffff9c, &(0x7f0000000240)='/selinux/avc/cache_stats\x00', 0x0, 0x0) [ 411.106879] binder: 18353:18358 ioctl 40087602 200001c0 returned -22 [ 411.115193] binder_alloc: 18353: binder_alloc_buf, no vma [ 411.117101] binder: BINDER_SET_CONTEXT_MGR already set [ 411.117108] binder: 18353:18358 ioctl 40046207 0 returned -16 [ 411.132250] binder: 18353:18392 transaction failed 29189/-3, size 24-8 line 3137 [ 411.140377] binder: 18353:18392 BC_INCREFS_DONE u0000000000000000 no match [ 411.147975] binder: 18353:18392 Release 1 refcount change on invalid ref 1 ret -22 20:30:57 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$FS_IOC_SETVERSION(r0, 0x40087602, &(0x7f00000001c0)) r1 = syz_open_dev$binder(&(0x7f0000000640)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = accept4$inet6(0xffffffffffffffff, &(0x7f0000000080)={0xa, 0x0, 0x0, @mcast1}, &(0x7f00000000c0)=0x1c, 0x80000) setsockopt$inet6_udp_encap(r2, 0x11, 0x64, &(0x7f0000000100), 0x4) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000000)=[@enter_looper], 0x1, 0x0, &(0x7f0000000040)='+'}) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0x0, 0x0, &(0x7f0000000780)}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000380)={0x8, 0x0, &(0x7f0000000500)=[@release={0x40046306, 0x1}], 0x0, 0x0, &(0x7f0000000400)}) 20:30:57 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000640)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000002000/0x2000)=nil, 0x2000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, &(0x7f0000000200), &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000000)={0x8, 0x0, &(0x7f0000000500)=[@release], 0x0, 0x0, &(0x7f0000000400)}) creat(&(0x7f0000000040)='./file0\x00', 0x80) [ 411.157595] binder: send failed reply for transaction 583 to 18353:18358 [ 411.166816] binder: undelivered TRANSACTION_ERROR: 29189 [ 411.183520] binder: 18394:18395 ioctl 40087602 200001c0 returned -22 [ 411.259621] binder: BINDER_SET_CONTEXT_MGR already set [ 411.265999] binder: 18398:18399 ioctl 40046207 0 returned -16 [ 411.272783] binder: 18398:18399 got transaction with invalid offset (0, min 0 max 0) or object. [ 411.282146] binder: 18398:18399 transaction failed 29201/-22, size 0-8 line 3200 [ 411.291477] binder: 18398:18399 Release 1 refcount change on invalid ref 0 ret -22 20:30:57 executing program 5: sendmsg$nl_netfilter(0xffffffffffffffff, &(0x7f0000000080)={&(0x7f0000000100), 0xc, &(0x7f00000000c0)={&(0x7f0000000240)=ANY=[@ANYBLOB="8d1589868cc1bdc627048304a83414"], 0x14}}, 0x0) r0 = openat$keychord(0xffffffffffffff9c, &(0x7f0000000000)='/dev/keychord\x00', 0x282000, 0x0) getgroups(0x9, &(0x7f0000000180)=[0x0, 0xee01, 0xffffffffffffffff, 0xffffffffffffffff, 0xee00, 0xee00, 0xee01, 0xee00, 0xee01]) setgid(r1) ioctl$EVIOCGUNIQ(r0, 0x80404508, &(0x7f0000000140)=""/20) getsockopt$inet6_mreq(r0, 0x29, 0x15, &(0x7f00000001c0)={@mcast1}, &(0x7f0000000200)=0x14) setsockopt$inet_tcp_TCP_REPAIR_OPTIONS(r0, 0x6, 0x16, &(0x7f0000000040)=[{0x2}, {0x7, 0x1d53}, {0xe}], 0x3) recvmmsg(0xffffffffffffffff, &(0x7f00000013c0), 0x1ad, 0x0, &(0x7f0000000c40)={0x77359400}) [ 411.300989] binder_alloc: binder_alloc_mmap_handler: 18398 20002000-20004000 already mapped failed -16 [ 411.310789] binder: BINDER_SET_CONTEXT_MGR already set [ 411.316387] binder: 18398:18399 ioctl 40046207 0 returned -16 [ 411.322550] binder: 18398:18402 got transaction with invalid offset (0, min 0 max 0) or object. [ 411.331691] binder: 18398:18402 transaction failed 29201/-22, size 0-8 line 3200 [ 411.339453] binder: 18398:18399 Release 1 refcount change on invalid ref 0 ret -22 [ 411.349470] binder: undelivered TRANSACTION_ERROR: 29201 20:30:57 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000640)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000003540)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$TIOCGPGRP(0xffffffffffffff9c, 0x540f, &(0x7f0000003580)=0x0) ioctl$sock_FIOSETOWN(r2, 0x8901, &(0x7f00000035c0)=r4) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) recvmmsg(0xffffffffffffff9c, &(0x7f0000003140)=[{{&(0x7f0000000000)=@hci, 0x80, &(0x7f00000003c0)=[{&(0x7f0000000080)=""/93, 0x5d}, {&(0x7f0000000100)=""/195, 0xc3}, {&(0x7f0000000540)=""/239, 0xef}, {&(0x7f0000000200)=""/53, 0x35}, {&(0x7f0000000680)=""/208, 0xd0}, {&(0x7f0000000280)=""/7, 0x7}, {&(0x7f0000000780)=""/243, 0xf3}, {&(0x7f0000000880)=""/4096, 0x1000}], 0x8, &(0x7f0000001880)=""/227, 0xe3, 0xff}, 0x1f}, {{&(0x7f0000000480)=@ll, 0x80, &(0x7f0000001d40)=[{&(0x7f00000002c0)=""/31, 0x1f}, {&(0x7f0000001980)=""/219, 0xdb}, {&(0x7f0000001a80)=""/21, 0x15}, {&(0x7f0000001ac0)=""/74, 0x4a}, {&(0x7f0000001b40)=""/5, 0x5}, {&(0x7f0000001b80)=""/46, 0x2e}, {&(0x7f0000001bc0)=""/214, 0xd6}, {&(0x7f0000001cc0)=""/83, 0x53}], 0x8, &(0x7f0000001dc0)=""/54, 0x36, 0x2}, 0x4}, {{&(0x7f0000001e00)=@pppol2tp={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @local}}}, 0x80, &(0x7f0000003040)=[{&(0x7f0000001e80)=""/46, 0x2e}, {&(0x7f0000001ec0)=""/4096, 0x1000}, {&(0x7f0000002ec0)=""/189, 0xbd}, {&(0x7f0000002f80)=""/156, 0x9c}], 0x4, &(0x7f0000003080)=""/132, 0x84, 0xda}, 0xffffffffffffff46}], 0x3, 0x2020, &(0x7f0000003200)={0x77359400}) r6 = syz_genetlink_get_family_id$ipvs(&(0x7f0000003280)='IPVS\x00') fcntl$F_SET_FILE_RW_HINT(r3, 0x40e, &(0x7f0000003480)=0x7) sendmsg$IPVS_CMD_NEW_DEST(r5, &(0x7f0000003440)={&(0x7f0000003240)={0x10, 0x0, 0x0, 0x40}, 0xc, &(0x7f0000003400)={&(0x7f00000032c0)={0x118, r6, 0x200, 0x70bd2a, 0x25dfdbfd, {}, [@IPVS_CMD_ATTR_DAEMON={0x4c, 0x3, [@IPVS_DAEMON_ATTR_SYNC_ID={0x8, 0x3, 0x1}, @IPVS_DAEMON_ATTR_SYNC_ID={0x8}, @IPVS_DAEMON_ATTR_SYNC_ID={0x8}, @IPVS_DAEMON_ATTR_SYNC_ID={0x8}, @IPVS_DAEMON_ATTR_MCAST_PORT={0x8, 0x7, 0x4e20}, @IPVS_DAEMON_ATTR_MCAST_TTL={0x8, 0x8, 0x826}, @IPVS_DAEMON_ATTR_MCAST_TTL={0x8, 0x8, 0x40}, @IPVS_DAEMON_ATTR_MCAST_GROUP={0x8, 0x5, @loopback}, @IPVS_DAEMON_ATTR_SYNC_MAXLEN={0x8, 0x4, 0xfae9}]}, @IPVS_CMD_ATTR_DEST={0x48, 0x2, [@IPVS_DEST_ATTR_L_THRESH={0x8, 0x6, 0x80}, @IPVS_DEST_ATTR_ADDR_FAMILY={0x8, 0xb, 0xa}, @IPVS_DEST_ATTR_ADDR={0x14, 0x1, @ipv4=@remote}, @IPVS_DEST_ATTR_ACTIVE_CONNS={0x8, 0x7, 0x9}, @IPVS_DEST_ATTR_ADDR_FAMILY={0x8}, @IPVS_DEST_ATTR_FWD_METHOD={0x8, 0x3, 0x4}, @IPVS_DEST_ATTR_ADDR_FAMILY={0x8, 0xb, 0xa}]}, @IPVS_CMD_ATTR_TIMEOUT_TCP_FIN={0x8, 0x5, 0x4}, @IPVS_CMD_ATTR_SERVICE={0x38, 0x1, [@IPVS_SVC_ATTR_FWMARK={0x8, 0x5, 0x4}, @IPVS_SVC_ATTR_PE_NAME={0x8, 0xb, 'sip\x00'}, @IPVS_SVC_ATTR_ADDR={0x14, 0x3, @ipv4=@broadcast}, @IPVS_SVC_ATTR_NETMASK={0x8, 0x9, 0x7c}, @IPVS_SVC_ATTR_AF={0x8, 0x1, 0x2}]}, @IPVS_CMD_ATTR_TIMEOUT_UDP={0x8}, @IPVS_CMD_ATTR_DAEMON={0x18, 0x3, [@IPVS_DAEMON_ATTR_MCAST_IFN={0x14, 0x2, 'bridge_slave_1\x00'}]}, @IPVS_CMD_ATTR_TIMEOUT_UDP={0x8, 0x6, 0x7}, @IPVS_CMD_ATTR_TIMEOUT_TCP_FIN={0x8, 0x5, 0x2}]}, 0x118}, 0x1, 0x0, 0x0, 0x1}, 0x8040) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, &(0x7f0000000200), &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000380)={0x8, 0x0, &(0x7f0000000500)=ANY=[@ANYBLOB="8b2fb0527882e0dd"], 0x0, 0x0, &(0x7f0000000400)}) [ 411.357784] binder: undelivered TRANSACTION_ERROR: 29201 20:30:57 executing program 5: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) r1 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ppp\x00', 0x0, 0x0) getsockopt$inet_mreq(r1, 0x0, 0x23, &(0x7f0000000040)={@broadcast, @multicast1}, &(0x7f0000000140)=0x8) sendmsg$nl_netfilter(r0, &(0x7f0000000080)={&(0x7f0000000100), 0xc, &(0x7f00000000c0)={&(0x7f0000000340)=ANY=[@ANYBLOB="140000000301ffff808f00003d88c83f00b516ba"], 0x14}}, 0x0) recvmmsg(r0, &(0x7f00000013c0), 0x0, 0x61, &(0x7f0000000180)={0x77359400}) [ 411.411251] binder: BINDER_SET_CONTEXT_MGR already set [ 411.425720] binder: 18404:18407 ioctl 40046207 0 returned -16 20:30:57 executing program 4: r0 = socket$inet(0x2, 0x0, 0x0) setsockopt$inet_opts(r0, 0x0, 0x0, &(0x7f00000000c0), 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) r3 = memfd_create(&(0x7f0000000280)='[\'posix_acl_access\x00', 0x0) pwritev(r3, &(0x7f00000001c0)=[{&(0x7f0000000200)=',', 0x1}], 0x1, 0x4081806) sendfile(r1, r3, &(0x7f00000000c0), 0x20020102000007) pipe(&(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$TIOCEXCL(0xffffffffffffffff, 0x540c) write(r5, &(0x7f00000001c0), 0xfffffef3) vmsplice(r4, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) fstat(r3, &(0x7f0000000b40)) ioctl$TIOCGPGRP(0xffffffffffffffff, 0x540f, &(0x7f0000000cc0)) getsockopt$inet6_IPV6_IPSEC_POLICY(0xffffffffffffffff, 0x29, 0x22, &(0x7f00000010c0)={{{@in6=@mcast2, @in=@remote}}, {{@in6=@local}, 0x0, @in6=@loopback}}, &(0x7f00000011c0)=0xe8) recvfrom$unix(r2, &(0x7f0000000040)=""/4, 0xebc3276d6d4b1cd2, 0x100100, &(0x7f0000000100)=@abs, 0x930000) openat$selinux_avc_cache_stats(0xffffffffffffff9c, &(0x7f0000000240)='/selinux/avc/cache_stats\x00', 0x0, 0x0) 20:30:57 executing program 5: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$nl_netfilter(r0, &(0x7f0000000080)={&(0x7f0000000100), 0xc, &(0x7f00000000c0)={&(0x7f0000000340)=ANY=[@ANYBLOB="140000000301ffff808f00003d88c83f00b516ba"], 0x14}}, 0x0) recvmmsg(r0, &(0x7f00000013c0), 0x1ad, 0x0, &(0x7f0000000c40)={0x77359400}) pipe(&(0x7f0000000000)={0xffffffffffffffff}) epoll_pwait(r1, &(0x7f0000000040)=[{}, {}, {}, {}], 0x4, 0x20, &(0x7f0000000140)={0x8}, 0x8) [ 411.470229] binder: 18404:18407 got transaction with invalid offset (0, min 0 max 0) or object. [ 411.479919] binder: 18404:18407 transaction failed 29201/-22, size 0-8 line 3200 [ 411.496629] binder: 18404:18407 unknown command 1387278219 [ 411.516739] binder: 18404:18407 ioctl c0306201 20000380 returned -22 [ 411.558713] binder: BINDER_SET_CONTEXT_MGR already set [ 411.564014] binder: 18404:18425 ioctl 40046207 0 returned -16 [ 411.582105] binder: 18404:18407 got transaction with invalid offset (0, min 0 max 0) or object. [ 411.591017] binder: 18404:18422 unknown command 1387278219 [ 411.597289] binder: 18404:18422 ioctl c0306201 20000380 returned -22 20:30:57 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000640)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, &(0x7f0000000200), &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, &(0x7f00000003c0)}) r2 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000000)='cpu.stat\x00', 0x0, 0x0) getsockopt$EBT_SO_GET_ENTRIES(r2, 0x0, 0x81, &(0x7f0000000100)={'filter\x00', 0x0, 0x3, 0x7a, [], 0x2, &(0x7f0000000040)=[{}, {}], &(0x7f0000000080)=""/122}, &(0x7f0000000180)=0x78) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000380)={0x8, 0x0, &(0x7f0000000500)=[@release], 0x0, 0x0, &(0x7f0000000400)}) 20:30:57 executing program 3: r0 = socket$inet(0x2, 0x4000000000000001, 0x0) setsockopt$inet_tcp_TCP_CONGESTION(r0, 0x6, 0xd, &(0x7f0000000680)='reno\x00', 0x60c5) sendto$inet(r0, &(0x7f0000a88f88), 0xfffffffffffffe6e, 0x20000000, &(0x7f0000e68000)={0x2, 0x0, @local}, 0x10) add_key$user(&(0x7f0000000140)='user\x00', &(0x7f0000000180)={'syz', 0x1}, &(0x7f00000006c0)="e0c3a3f5a6edf198c27fa9572328face1f138daadff8ddd4cd82a920dd45f1a590fca76052a2e7bd93f97e666c25d3e32b1e35e466ab34871d5aa7af9033dcfb437ed35fdfdaf7147091f6641631acb0edaf71b45396430a70bd7c6f61c4a4045e6c496e0499e2336b22855fdc5a66f303d83a95b49f48935b4a4f6be79c6e59a97ff2662d9d978c6827c485d205485c671b44a7f6bc4fcce19321511a5dd0e2d4892e37ed2ff61f8d9e539ee3d69a9ccb09fe43527d6cc99fc9ae2b07e99bd1564ebd10b9bc1cec4c6b0fa8e75251dd4155a192ce62b6a8d15855a9913f4928da8d2db0a4e7190e971cf7b8630db1496fdd1b398a42118b4cfdfe2b12a25858ad3db252c79f3061e2f45a24460e418bd6d02fe5b3a67871634fad154023ccfbbc17665c60420717450685bfeeeba96fed888bd45cc0e48f1b4442840264d88183cf4daf9350d7ed8b8d854f325178ec0df8dfeeb453259e38f6a08b08e0356f056e028097d8e952ff511b76d9a2e63a1c1d2b4ae78b9a160591472de8279ae6de8e75bada93fb6d293cf8bd42f4cabf7e239460c9c1f471e3aab9168acf7803b6fd96c79653e4d99254a4b0455f1ae27c3a9fb3895095fbce5840fecd7589979e0ab64cdacb99ea775c2072547ca0ac09b44dfe4b068f51c0c3ebfc6ac31ad2da5c8ced9648d65d37ffb283960b44aba105c95b1e1122b6d95b920c68e881422489ec26b8e9b6c766c6b7d7987fa1a079df7e3ae59b6251c734be124e0ffc2f692dcce97457f340961e488ec63c7fa70e2ad8626d105f539d2870d9345258c68cee3497640468ba163191af187425f3c8ebe4e0ca18a357f85c454220d6d659b0b1ed86dca6ece81de24dc3b303af54839219e17975acb7d4a971f9bbca487636c37e7dedcf482d1083f7b353bc0bc6041373db650f1a18c7d0eb89f11ff00e3e5283743ac1d56403da0ecf47367f66b328b2ea5eda5d54970ec40574ea63784fc5a8a44c6c83001e53b71d5833688c6fd9a06aec225ff535c7c8070ec3d64a2bfb1b7b9ce393f8788549be02b31f81ed1f0482a9e615b7f05851cde167ed1834d03cb78b1431b0542cfa76e303854d4b22cd3ea425b3569114f2bfc13350f7ee37f037f70287afbdd7dca6659fec3e850bbf9b4b2affc499ecc7d9ce0f6459353cda7d4a861ff76f94e0d3e7e59cc8a3a828beda758fb4b7155ca45170cdd3307b3eac7ffa7a864b52818b516262ad2ae097a12c54174f37caf78de680ff6b6ce9ef7924808cf1bd5a685fe5653a36ffc297da3ed25e63725307fa182c3e8f9551c2072c3dfca6a54c201eda6a0cfd061d4138c8605f0d5ba36617b07ca685d4b5a949c2472c5da5b2849da85a247f957a0f8f2fe68388926680a045f319471be4937bfde89088312e850bfcd983556dc05ce53c905577a2329bd38d7ab6d67e84e69bd68ebfa70c9509962cfb496a52d483c6072110ff08952bc7ec6c9a2358016fa70a3e102bb2b187463c62df59ac3c353c3e87534873a8d447697f72c79a11f856e3218837c44c705ee413bb055ffe98f98f6c3cf85202a149bc6927c0528fcfe1a8903df67b6fedf423f21047b3aeb52348e24b41ba0965cf9a4d92ccdaf7c90bf82095ae6d7f59bec966280d96454c5c8a84d4291a2e349cb23d2bc724335afbdea68c759503021f6f3d1f067a7a328c20d094f402eb8f40f5b1c4bdaff3a31ddeb4487df0a866191a5fd12917ee9722be6eff010617ab4068f0d15b4313f8fc5f7714940b8a19d45c50b91e5a8ec0f88a180057591db7772aece7c1a8f13596a612f55852b102e20a0de069ff306e457534e256b5d19b7d808f73992ffa79cf338a222e52bfb283fa55f90afdf86c5bca6a3345f27bb9960a13ac0b55c7b7d11fd180cccdbd66d6fa89015fe69e93a23cf9d97990151951c5d22bf0d59cb6230dc01c91254c79844d41b673e31fce73065ce6ce0b6d2fae2873eaff7ea3e6ad25cf92091997afca6f878c17d899921536f8e52f9b355928ce2ebf5d4a71c396e2a97b44befa011b824e05cf6f4df234716e5b448af1a754903d104f81b826b1879a56df478376e0a3575eee9e4695d071f6038048e7354d9919cb3e130667bba34a60bc5c6f7790a5a226d01ddaee37cebddb86e7138432009be04f6f1c96ec3687bea6a4793b92e237eaeddfe929fdf7052050fbb8c8b25fb193b51ea879308da19188093a6e43d8a40f08143e8aa8b5b613b494d35ff776149c14ef91736a435af265737886b56f8d691acbb1acf462754922fe6890f451b05f7fe3cc396a30fba0e60f9aab464c0f3d7ec55963be451dc02526501465f1e7650e7552c6d9b11687998092b46c1108cd973cb4df2435791705b1edde1949e14e2629d1ef7636be30a97c0b933e3b89341f5ce26a52031ea1cd475f44bd84a90f575f3e2e9bc5ae64d7b377e6ca47a184c3fd37dc6e94d3dc11e8ac53102e352438e568518df007a47100a2a6ffb4c12761835f62f13f77747aea900c2acdd06a4b0478d6cdde5b32708aea33f36f20a25bc9a1a9b6bdca7cc19133ba3043a6f599e1830607b23f8310f962d1e21130dbaaa3b5cb389f8ca398a0b47ad734aaff521c0c3be920ca4b1f3eaea7bc473032f6a3af8afe8344b24b822aefb1a2574f120b0148520657ce9bd3004a9b02311a5eb05212ae9e135255b7aa172bd6bfa86c793e289649674c13e4d8d30fbbeaf16206e1ae9143e45b7a143928bf7fbd13235ef485fff6b545e4c218c3d9a24b4034c4bd732c6f1037c0be965c591167790abb1206771320b0c61ac0e491ff3a1df2762eb234f7ab7d6f44e3260f3e31a10367e4e5023e26dcf6a99877c298ba4dfcd2787d8786d53640a659ca742d741e71d246f6459ababc3275ecab8e78d3a0d999f6ad483b3a9fbd61323ec3317f6f2414f053315113a9c34507135e88a19593df775478fdb5bfcbf82eb06afcdc6eeeb10b716e830048ff0717451f7a5b7a1d2d0a440aa7fb503332c3e0a858287fa2133a9cc08542eb56c5bebdd2e88c452ffb34fe3f5827a8c9539bb2a94c95e739072a829f502f9c5b8f25eef0d0e6c8bdab03e7de4d5c1ce0e644cf4a2357ffe0f37a4cf2ec3649cff39aef984ce9d7dfd50be8e7753fd7444d530d148a02ca2401fd27a4280ff6465a69dca9684ee53f631fd14b95d345d6172f26d579644992453d07634a7f45fd02f94f37170cc8ddb746081a7b562c8ee387b1c1a3e6e076cdc1eeb446b67eb24b399806fd61937a543c98f9643c880392b9aa3038882bff18c79172f7a011523448fd8564b5436d5cf05fe8042e25927098184293acd97afb3105457fa227bf6e9e2e642c233df24e13fdb0e6f77a338f134113f0e4a77f9604d82265da6bda1d65b64fc8fa834944bcf0598a01047c8a7fef0078dd2627b2023cb07fdc37a12c257ec4da27408aefd262222bf3c83c100afd239ad038e4c9e7ed07a8987b5a8e8e01177a564da2907d78cf379e82ccfae34b91ef9cfbe2e01e5def3f43dbab4497ee1046a4617b7613acc5b87a65adf17295b36811bb5e7d8bb51ab3e1e62aafeb3ee1c06bc74f74f3cf4b48a6fa59372bb8cff52b3027d13d46ffcfc13befa7a761540ce41aa53341ed5dc47e773d48a893aa6e776c4f8d5ab4ac191403a2c4764ba96b557aa22dcafb891e740f56365b573cb705b9aa5141f29e0ee124ce2be75bb0fce1a8abf278b98b1ab6e2cd1939125cd84b9510384559976aa22af0203ba2bae690be4075434c135c0497cd0d5c29e8cf371e973998ee426d34c549849ddd77a10d71059e067a3a663ea72fd0dd8f7aa04816f1966040e52274f3d0545529777e15ee66ef0df19502f8cbae1d6f365940f9f960dc2c3efe1122f5478bb7b5341e34cbf717df5db616e70d2e47f7413ba62ddd68a5f9b2fdf555d6f5d3e063669931cf6662646a0376cfc2cd6f7f356238bf4cbacac0e6bb829275edf426c305b8cc0b0532ba25bb3fa7058842b5bbeb56d6091ba35be5166cbbc4d2a62551fcf953b6cf6e5ea5497f5feb1ad2ea4cc50eb4e8bfdf352e46086372114f85936f4880e371f15a5c6ef43a6f0756dda9fe97dd58766de12cff4299692e07b23f10bd6cc5e94dd13ebdd4f2a6bdaaca6cda42128fd70707b543b36d57cc150ae28d9d12a57a889980f27092c635e29ddf71247b886c37a34bfadc8efe15cefe41bc9ede3b6505931027dd9ca783e49668195c2695846ac730576f6dd3e913d4bfff54c3433d1dcd86c8ff159f7fc77ab72d12445c7ef95390dd924e883953c6bb1c63e6b8cc3a081bddf1bd92e6ffd003fe36d116984e506b129bf229505c7096b0b98662dc38428f1d5a045f70d140b7b3a1b4afeb2390aa64fe1a53492031c50290b7527f2f4f209e90d168b6443cd8ba0eb4b2335b2478592b66899a0610cb0c30d5035cb3af8076ed03bda93c0855889a78a8b5ae37592b2f302a17aeb731b5e3b1828bb75b3ef17db9d7b2d69b5cad8729bb5344017d58d2d8956a33f574d72fbdb4bca20390d4b8c3c38d276d469a9357bdf6bc7a378fd49561f11d3d4edc53cd277be5f02f66b1bf5c184fe05a1a0734ef74ab5e2a7bca088dc8be86514faa1a660bc7b6db8c5c063be0463dbc8e37725b7cd60b10f3fcc45f231da5f2593b834afa85748ef71c3a7d5917e3415c657ad74e2d7bed3d51e48ee73c28488213253805a63fe56d0b67a047c093cad6aab2e73f097740a140504cea278675d6e86dabc7cb8147c04c0b499b40616c6b306e20f779e14c16f367c63c96a7a272ebdd1b1498c527ef28ed34f8193b7304cb7c90ce1c9a6a020963f1b2cf000d0d55a57dda6fd3f298d334b86dcc6aa3888ceccd25e79d71aaac428b7dd8279756013ef92ab2ea4bfdb7bdf3685480ba838b177d94f2d04a99372bd51313bbdc8e1a76c8ae5018e92cca439cb8cec63ce5b9ab43955c11f071001bed63ca8ef01886cd1d3c45e91cff6e70c537932b60936139f16e127dfa8ffab3d251eb29ca5aa1dcede31556fe8086c3fa42c1fd1617d4c4f0819ed16f6a851a504b5758a0df3aa0dfdde13da3cbdaf967727da542a4a9a8a9a2cdd79754dbdf51b41c7f921e9aedf0040d8f3f40b7dfcf1365deb4871a44eba41b5b5ed90ed5459d61fc7ed051e93b5aff94bf3ed3864ec50d9aa5d8440176696504d8c3e2523e9069b0eb2c8b2d59c910acb8c50768d3c2f287b3afc10591a16b1938f1b3267ed89e916d343fde6bfc74073b027c15f9d0b9b0e1a50ab472544f2b4377644158f978208ceb588f7431437247379df5d5121b68437707c22c76e6aa43185cf45a4b70007b1f973b37faf19a026d2ad7cdc4ff273c78424221623ec342eed704daf82c0702905115f69372a351b353be41fabe31c35eb15fd3a95e4ce5d216e8b4187f0fd969e4fc3fd571cd38202ae1329f2cb173a71429148a3b0cb96dd367c126f8cef4edbe0fb47159a964f35b17c098f1d90ec991f569c6101d833c051702edb95838ef0b643e7019a9537a148c2e5c81a258e34a293868d6edd21022626d8aee551db9fe7c071ca94a71e42a8299fe24338796de726d6340514ef8155452fa48675e9b1c6dcc5d22b2da85fdfcc2bf3a0bfd9ea25fd5e4ddc11d2f6942518f785b22cd8226c80a1a761a6b6498397234eb255868e85d90cbae75509a8ea7a5122976991c859d9c4ad943174d146127b61488080c64601e986245afb0b555a5eb967d3eb73b6dd34c8ac1faacca6c2f79e78b8ea8cea9e8", 0x1000, 0x0) r1 = socket$inet6(0xa, 0x6, 0x0) clock_gettime(0x0, &(0x7f00000001c0)={0x0, 0x0}) setsockopt$sock_timeval(r1, 0x1, 0x14, &(0x7f0000000200)={r2, r3/1000+30000}, 0x10) getsockopt$inet6_opts(r1, 0x29, 0x3f, &(0x7f0000000000)=""/193, &(0x7f0000000100)=0xc1) [ 411.603866] binder: 18404:18407 transaction failed 29201/-22, size 0-8 line 3200 [ 411.604220] binder: undelivered TRANSACTION_ERROR: 29201 [ 411.617905] binder: undelivered TRANSACTION_ERROR: 29201 [ 411.651119] binder: BINDER_SET_CONTEXT_MGR already set [ 411.665033] binder: 18431:18433 ioctl 40046207 0 returned -16 [ 411.676391] binder: 18431:18433 got transaction with invalid offset (0, min 0 max 0) or object. [ 411.686133] binder: 18431:18433 transaction failed 29201/-22, size 0-8 line 3200 [ 411.694761] binder: 18431:18433 Release 1 refcount change on invalid ref 0 ret -22 [ 411.708321] binder_alloc: binder_alloc_mmap_handler: 18431 20001000-20004000 already mapped failed -16 [ 411.749913] binder: BINDER_SET_CONTEXT_MGR already set [ 411.755493] binder: 18431:18433 ioctl 40046207 0 returned -16 [ 411.773942] binder: 18431:18443 got transaction with invalid offset (0, min 0 max 0) or object. 20:30:57 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000640)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) openat$selinux_avc_hash_stats(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/avc/hash_stats\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, &(0x7f0000000200), &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000380)={0x8, 0x0, &(0x7f0000000500)=ANY=[@ANYBLOB="0663044002000000"], 0x0, 0x0, &(0x7f0000000400)}) 20:30:57 executing program 2: r0 = socket$inet(0x2, 0x0, 0x0) setsockopt$inet_opts(r0, 0x0, 0x0, &(0x7f00000000c0)="8907", 0x2) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) r3 = memfd_create(&(0x7f0000000280)='[\'posix_acl_access\x00', 0x0) pwritev(r3, &(0x7f00000001c0)=[{&(0x7f0000000200)=',', 0x1}], 0x1, 0x4081806) sendfile(r1, r3, &(0x7f00000000c0), 0x20020102000007) ioctl$TIOCEXCL(0xffffffffffffffff, 0x540c) write(0xffffffffffffffff, &(0x7f00000001c0), 0xfffffef3) vmsplice(0xffffffffffffffff, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) fstat(r3, &(0x7f0000000b40)) getsockopt$inet6_IPV6_IPSEC_POLICY(0xffffffffffffffff, 0x29, 0x22, &(0x7f00000010c0)={{{@in6=@mcast2, @in=@remote}}, {{@in6=@local}, 0x0, @in6=@loopback}}, &(0x7f00000011c0)=0xe8) recvfrom$unix(r2, &(0x7f0000000040)=""/4, 0xebc3276d6d4b1cd2, 0x100100, &(0x7f0000000100)=@abs, 0x930000) openat$selinux_avc_cache_stats(0xffffffffffffff9c, &(0x7f0000000240)='/selinux/avc/cache_stats\x00', 0x0, 0x0) [ 411.801784] binder: 18431:18443 transaction failed 29201/-22, size 0-8 line 3200 [ 411.813346] binder: undelivered TRANSACTION_ERROR: 29201 [ 411.826465] binder: undelivered TRANSACTION_ERROR: 29201 [ 411.883665] binder: BINDER_SET_CONTEXT_MGR already set [ 411.904600] binder: 18446:18447 ioctl 40046207 0 returned -16 [ 411.925748] binder: 18446:18447 got transaction with invalid offset (0, min 0 max 0) or object. [ 411.949741] binder: 18446:18447 transaction failed 29201/-22, size 0-8 line 3200 [ 411.958738] binder: 18446:18447 Release 1 refcount change on invalid ref 2 ret -22 [ 411.968133] binder_alloc: binder_alloc_mmap_handler: 18446 20001000-20004000 already mapped failed -16 [ 411.977862] binder: BINDER_SET_CONTEXT_MGR already set [ 411.983480] binder: 18446:18447 ioctl 40046207 0 returned -16 [ 411.983781] binder: 18394:18396 ioctl 40087602 200001c0 returned -22 [ 411.989323] binder: BINDER_SET_CONTEXT_MGR already set [ 411.989331] binder: 18394:18396 ioctl 40046207 0 returned -16 [ 411.989784] binder_alloc: 18394: binder_alloc_buf, no vma [ 411.989822] binder: 18394:18455 transaction failed 29189/-3, size 24-8 line 3137 [ 411.989906] binder: 18394:18396 BC_INCREFS_DONE u0000000000000000 no match [ 411.989952] binder: 18394:18455 Release 1 refcount change on invalid ref 1 ret -22 [ 411.990352] binder: send failed reply for transaction 588 to 18394:18396 [ 412.042152] binder: undelivered TRANSACTION_ERROR: 29189 [ 412.046915] binder: 18446:18458 Release 1 refcount change on invalid ref 2 ret -22 20:30:57 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0xfffffffffffffffc) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, &(0x7f0000000200), &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000380)={0x8, 0x0, &(0x7f0000000500)=[@release], 0x0, 0x0, &(0x7f0000000400)}) 20:30:57 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = socket(0x3, 0x2, 0x3) connect$unix(r1, &(0x7f0000000080)=@file={0x1, './file0\x00'}, 0x6e) ioctl$FS_IOC_SETVERSION(r0, 0x40087602, &(0x7f00000001c0)) r2 = syz_open_dev$binder(&(0x7f0000000640)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0) r3 = dup2(r0, r1) ioctl$UI_SET_LEDBIT(r3, 0x40045569, 0x7) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000000)=[@enter_looper], 0x1, 0x0, &(0x7f0000000040)='+'}) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$FS_IOC_GET_ENCRYPTION_POLICY(r1, 0x400c6615, &(0x7f0000000100)) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0x0, 0x0, &(0x7f0000000780)}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000380)={0x8, 0x0, &(0x7f0000000500)=[@release={0x40046306, 0x1}], 0x0, 0x0, &(0x7f0000000400)}) [ 412.074991] binder: 18459:18463 transaction failed 29189/-22, size 0-8 line 3014 [ 412.094072] binder: 18460:18461 ioctl 40087602 200001c0 returned -22 [ 412.098666] binder: undelivered TRANSACTION_ERROR: 29201 [ 412.117451] binder: 18459:18465 transaction failed 29189/-22, size 0-8 line 3014 20:30:58 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000640)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f00000000c0)=ANY=[@ANYBLOB="006340400000000000000000000000000000000000000000000000000000ea000000000000000000e3ffffff070000000000000065c5deabedfc2236aff15cebd7a09eb8acf355cba8aaf3135cb73daaef5a28ff8d86fffe0b562e82d2f7236e7bcb7ff5c1a7ce", @ANYPTR=&(0x7f0000000200)=ANY=[], @ANYPTR=&(0x7f0000000240)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00']], 0x0, 0x0, &(0x7f00000003c0)}) fsetxattr$security_evm(r1, &(0x7f0000000040)='security.evm\x00', &(0x7f0000000080)=@md5={0x1, "90b9a9cbe1fa25875738baae64ebe248"}, 0x11, 0x2) fchdir(r1) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000380)={0x8, 0x0, &(0x7f0000000500)=ANY=[@ANYBLOB="0000000000ff0000"], 0x0, 0x0, &(0x7f0000000400)}) syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x800) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) [ 412.140190] binder: undelivered TRANSACTION_ERROR: 29189 [ 412.145995] binder: undelivered TRANSACTION_ERROR: 29189 [ 412.212044] binder: BINDER_SET_CONTEXT_MGR already set [ 412.228046] binder: 18468:18469 ioctl 40046207 0 returned -16 [ 412.246836] binder_alloc: 18460: binder_alloc_buf size -124554051576 failed, no address space [ 412.272816] binder_alloc: allocated: 32 (num: 1 largest: 32), free: 12256 (num: 1 largest: 12256) [ 412.298381] binder: 18468:18470 unknown command 0 [ 412.300284] binder: 18468:18469 transaction failed 29201/-28, size -124554051584-7 line 3137 20:30:58 executing program 4: r0 = socket$inet(0x2, 0x0, 0x0) setsockopt$inet_opts(r0, 0x0, 0x0, &(0x7f00000000c0)="89", 0x1) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) r3 = memfd_create(&(0x7f0000000280)='[\'posix_acl_access\x00', 0x0) pwritev(r3, &(0x7f00000001c0)=[{&(0x7f0000000200)=',', 0x1}], 0x1, 0x4081806) sendfile(r1, r3, &(0x7f00000000c0), 0x20020102000007) pipe(&(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$TIOCEXCL(0xffffffffffffffff, 0x540c) write(r5, &(0x7f00000001c0), 0xfffffef3) vmsplice(r4, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) fstat(r3, &(0x7f0000000b40)) ioctl$TIOCGPGRP(0xffffffffffffffff, 0x540f, &(0x7f0000000cc0)) getsockopt$inet6_IPV6_IPSEC_POLICY(0xffffffffffffffff, 0x29, 0x22, &(0x7f00000010c0)={{{@in6=@mcast2, @in=@remote}}, {{@in6=@local}, 0x0, @in6=@loopback}}, &(0x7f00000011c0)=0xe8) recvfrom$unix(r2, &(0x7f0000000040)=""/4, 0xebc3276d6d4b1cd2, 0x100100, &(0x7f0000000100)=@abs, 0x930000) openat$selinux_avc_cache_stats(0xffffffffffffff9c, &(0x7f0000000240)='/selinux/avc/cache_stats\x00', 0x0, 0x0) 20:30:58 executing program 5: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$nl_netfilter(r0, &(0x7f0000000080)={&(0x7f0000000100), 0xc, &(0x7f00000000c0)={&(0x7f0000000340)=ANY=[@ANYBLOB="140000000301ffff808f00003d88c83f00b516ba"], 0x14}}, 0x0) recvmmsg(r0, &(0x7f00000013c0), 0x1ad, 0x0, &(0x7f0000000c40)={0x77359400}) readahead(r0, 0xe6a5, 0x5d) openat$selinux_avc_cache_threshold(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/avc/cache_threshold\x00', 0x2, 0x0) [ 412.348283] binder: 18468:18470 ioctl c0306201 20000380 returned -22 [ 412.360206] binder: BINDER_SET_CONTEXT_MGR already set [ 412.376168] binder: 18468:18469 ioctl 40046207 0 returned -16 [ 412.418469] binder_alloc: binder_alloc_mmap_handler: 18468 20001000-20004000 already mapped failed -16 [ 412.440143] binder: BINDER_SET_CONTEXT_MGR already set [ 412.450026] binder: 18468:18469 ioctl 40046207 0 returned -16 [ 412.450281] binder_alloc: 18460: binder_alloc_buf size -124554051576 failed, no address space 20:30:58 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000640)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, &(0x7f0000000200), &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000380)={0x8, 0x0, &(0x7f0000000500)=ANY=[@ANYBLOB='\x00'], 0x0, 0x0, &(0x7f0000000400)}) [ 412.489280] binder_alloc: allocated: 32 (num: 1 largest: 32), free: 12256 (num: 1 largest: 12256) [ 412.498714] binder: undelivered TRANSACTION_ERROR: 29201 [ 412.505832] binder: 18468:18470 transaction failed 29201/-28, size -124554051584-7 line 3137 [ 412.515359] binder: undelivered TRANSACTION_ERROR: 29201 20:30:58 executing program 3: r0 = socket$inet(0x2, 0x4000000000000001, 0x0) setsockopt$inet_tcp_TCP_CONGESTION(r0, 0x6, 0xd, &(0x7f0000000680)='reno\x00', 0x60c5) pipe2(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}, 0x4000) ioctl$ASHMEM_GET_SIZE(r1, 0x7704, 0x0) sendto$inet(r0, &(0x7f0000a88f88), 0xfffffffffffffe6e, 0x20000000, &(0x7f0000e68000)={0x2, 0x0, @local}, 0x10) [ 412.554691] binder: BINDER_SET_CONTEXT_MGR already set [ 412.567056] binder: 18488:18490 ioctl 40046207 0 returned -16 [ 412.579966] binder: 18488:18490 got transaction with invalid offset (0, min 0 max 0) or object. [ 412.589287] binder: 18488:18490 transaction failed 29201/-22, size 0-8 line 3200 [ 412.610910] binder: 18488:18490 unknown command 0 [ 412.616069] binder: 18488:18490 ioctl c0306201 20000380 returned -22 [ 412.624239] binder_alloc: binder_alloc_mmap_handler: 18488 20001000-20004000 already mapped failed -16 [ 412.634846] binder: BINDER_SET_CONTEXT_MGR already set [ 412.640494] binder: 18488:18490 ioctl 40046207 0 returned -16 [ 412.647858] binder: 18488:18495 got transaction with invalid offset (0, min 0 max 0) or object. 20:30:58 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = fcntl$dupfd(r0, 0x406, r0) write$P9_RUNLINKAT(r1, &(0x7f0000000000)={0x7, 0x4d, 0x2}, 0x7) r2 = syz_open_dev$binder(&(0x7f0000000640)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) lstat(&(0x7f0000000040)='./file0\x00', &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x0}) setfsuid(r3) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB='\x00c@@\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\b\x00\x00\x00\x00\x00\x00\x00', @ANYPTR=&(0x7f0000000200)=ANY=[], @ANYPTR=&(0x7f0000000240)=ANY=[@ANYBLOB="0000000001008000"]], 0x0, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000380)={0x8, 0x0, &(0x7f0000000500)=[@release], 0x0, 0x0, &(0x7f0000000400)}) [ 412.659624] binder: 18488:18495 transaction failed 29201/-22, size 0-8 line 3200 [ 412.680427] binder: undelivered TRANSACTION_ERROR: 29201 [ 412.693380] binder: undelivered TRANSACTION_ERROR: 29201 20:30:58 executing program 2: r0 = socket$inet(0x2, 0x0, 0x0) setsockopt$inet_opts(r0, 0x0, 0x0, &(0x7f00000000c0)="8907", 0x2) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = memfd_create(&(0x7f0000000280)='[\'posix_acl_access\x00', 0x0) pwritev(r2, &(0x7f00000001c0)=[{&(0x7f0000000200)=',', 0x1}], 0x1, 0x4081806) pipe(&(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$TIOCEXCL(0xffffffffffffffff, 0x540c) write(r4, &(0x7f00000001c0), 0xfffffef3) vmsplice(r3, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) fstat(r2, &(0x7f0000000b40)) getsockopt$inet6_IPV6_IPSEC_POLICY(0xffffffffffffffff, 0x29, 0x22, &(0x7f00000010c0)={{{@in6=@mcast2, @in=@remote}}, {{@in6=@local}, 0x0, @in6=@loopback}}, &(0x7f00000011c0)=0xe8) recvfrom$unix(r1, &(0x7f0000000040)=""/4, 0xebc3276d6d4b1cd2, 0x100100, &(0x7f0000000100)=@abs, 0x930000) openat$selinux_avc_cache_stats(0xffffffffffffff9c, &(0x7f0000000240)='/selinux/avc/cache_stats\x00', 0x0, 0x0) [ 412.764166] binder: BINDER_SET_CONTEXT_MGR already set [ 412.779743] binder: 18500:18501 ioctl 40046207 0 returned -16 [ 412.817750] binder: 18500:18501 got transaction with invalid offset (36028801313931264, min 0 max 0) or object. [ 412.852778] binder: 18500:18501 transaction failed 29201/-22, size 0-8 line 3200 [ 412.862922] binder: 18500:18503 Release 1 refcount change on invalid ref 0 ret -22 [ 412.872492] binder: 18460:18508 ioctl 40087602 200001c0 returned -22 [ 412.884106] binder_alloc: binder_alloc_mmap_handler: 18500 20001000-20004000 already mapped failed -16 [ 412.885793] binder: BINDER_SET_CONTEXT_MGR already set [ 412.885801] binder: 18460:18510 ioctl 40046207 0 returned -16 [ 412.886329] binder_alloc: 18460: binder_alloc_buf, no vma [ 412.886368] binder: 18460:18510 transaction failed 29189/-3, size 24-8 line 3137 20:30:58 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$FS_IOC_SETVERSION(r0, 0x40087602, &(0x7f00000001c0)) r1 = syz_open_dev$binder(&(0x7f0000000640)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000000)=[@enter_looper], 0x1, 0x0, &(0x7f0000000040)='+'}) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0x0, 0x0, &(0x7f0000000780)}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000380)={0x8, 0x0, &(0x7f0000000500)=[@release={0x40046306, 0x1}], 0x0, 0x0, &(0x7f0000000400)}) r2 = openat$null(0xffffffffffffff9c, &(0x7f0000000080)='/dev/null\x00', 0x8000, 0x0) ioctl$RTC_PLL_GET(r2, 0x80207011, &(0x7f00000000c0)) [ 412.886406] binder: 18460:18511 BC_INCREFS_DONE u0000000000000000 no match [ 412.886718] binder: send failed reply for transaction 602 to 18460:18466 [ 412.932285] binder: undelivered TRANSACTION_ERROR: 29189 [ 412.951433] binder_alloc: 18500: binder_alloc_buf, no vma [ 412.960371] binder: 18500:18503 transaction failed 29189/-3, size 0-8 line 3137 [ 412.970597] binder: 18500:18501 Release 1 refcount change on invalid ref 0 ret -22 [ 412.970765] binder: undelivered TRANSACTION_ERROR: 29189 [ 412.970876] binder: undelivered TRANSACTION_ERROR: 29201 [ 412.971109] binder: 18514:18515 ioctl 40087602 200001c0 returned -22 20:30:58 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = accept(0xffffffffffffff9c, &(0x7f0000000080)=@vsock={0x28, 0x0, 0x0, @hyper}, &(0x7f0000000100)=0x80) getsockopt$inet_IP_XFRM_POLICY(0xffffffffffffff9c, 0x0, 0x11, &(0x7f0000000540)={{{@in=@loopback, @in=@multicast2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@ipv4={[], [], @local}}}}, &(0x7f0000000180)=0xe8) getsockopt$inet_IP_XFRM_POLICY(0xffffffffffffff9c, 0x0, 0x11, &(0x7f0000000680)={{{@in6=@dev, @in6=@mcast2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in=@rand_addr}, 0x0, @in=@remote}}, &(0x7f00000001c0)=0xe8) sendmsg$nl_route(r1, &(0x7f00000003c0)={&(0x7f0000000140)={0x10, 0x0, 0x0, 0x10001}, 0xc, &(0x7f0000000200)={&(0x7f0000000280)=@mpls_delroute={0x44, 0x19, 0x820, 0x70bd2c, 0x25dfdbfe, {0x1c, 0x14, 0x80, 0x8, 0xff, 0x2, 0xfd, 0x5}, [@RTA_DST={0x18, 0x1, [{0x4, 0x2f9, 0x6, 0x3}, {0x1, 0x7fffffff}, {0x4, 0xa5, 0x20, 0x10000}, {0x2, 0x40, 0x4, 0x1}, {0x0, 0x7f, 0xf04, 0x1f}]}, @RTA_OIF={0x8, 0x4, r2}, @RTA_OIF={0x8, 0x4, r3}]}, 0x44}, 0x1, 0x0, 0x0, 0x20000010}, 0x20000000) signalfd4(0xffffffffffffffff, &(0x7f0000000000)={0x5}, 0x52, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$EXT4_IOC_RESIZE_FS(0xffffffffffffffff, 0x40086610, &(0x7f0000000040)=0x8c) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, &(0x7f0000000200), &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000380)={0x8, 0x0, &(0x7f0000000500)=ANY=[@ANYBLOB], 0x0, 0x0, &(0x7f0000000400)}) [ 413.022018] binder: BINDER_SET_CONTEXT_MGR already set [ 413.038126] binder: 18514:18517 ioctl 40046207 0 returned -16 20:30:59 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x2000000000800) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, &(0x7f0000000200), &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000380)={0x8, 0x0, &(0x7f0000000500)=ANY=[@ANYBLOB="11630435a29b7700"], 0x0, 0x0, &(0x7f0000000400)}) r2 = openat$selinux_checkreqprot(0xffffffffffffff9c, &(0x7f0000000040)='/selinux/checkreqprot\x00', 0x800, 0x0) openat$cgroup(r2, &(0x7f0000000080)='syz0\x00', 0x200002, 0x0) [ 413.069122] binder: 18514:18517 transaction failed 29189/-22, size 24-8 line 3014 [ 413.089460] binder: 18520:18521 transaction failed 29189/-22, size 0-8 line 3014 [ 413.098706] binder: 18514:18517 BC_INCREFS_DONE u0000000000000000 no match [ 413.099029] binder: 18520:18521 transaction failed 29189/-22, size 0-8 line 3014 [ 413.099247] binder: undelivered TRANSACTION_ERROR: 29189 [ 413.099280] binder: undelivered TRANSACTION_ERROR: 29189 [ 413.144732] binder: 18523:18524 got transaction with invalid offset (0, min 0 max 0) or object. [ 413.148020] binder: 18514:18525 Release 1 refcount change on invalid ref 1 ret -22 [ 413.161986] binder: 18523:18524 transaction failed 29201/-22, size 0-8 line 3200 [ 413.172190] binder: 18523:18524 unknown command 889479953 [ 413.178166] binder: 18523:18524 ioctl c0306201 20000380 returned -22 [ 413.188877] binder_alloc: binder_alloc_mmap_handler: 18523 20001000-20004000 already mapped failed -16 [ 413.198591] binder: BINDER_SET_CONTEXT_MGR already set [ 413.204306] binder: 18523:18524 ioctl 40046207 0 returned -16 [ 413.208408] binder_alloc: 18523: binder_alloc_buf, no vma [ 413.208442] binder: 18523:18526 transaction failed 29189/-3, size 0-8 line 3137 [ 413.223308] binder: 18523:18526 unknown command 889479953 [ 413.229063] binder: 18523:18526 ioctl c0306201 20000380 returned -22 [ 413.235658] binder: undelivered TRANSACTION_ERROR: 29189 20:30:59 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000640)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x802) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) r2 = open(&(0x7f0000000040)='./file0\x00', 0x400000, 0x0) r3 = syz_genetlink_get_family_id$fou(&(0x7f0000000100)='fou\x00') sendmsg$FOU_CMD_ADD(r2, &(0x7f00000001c0)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x80000}, 0xc, &(0x7f0000000180)={&(0x7f0000000140)={0x24, r3, 0x1, 0x70bd25, 0x25dfdbff, {}, [@FOU_ATTR_AF={0x8, 0x2, 0x2}, @FOU_ATTR_IPPROTO={0x8, 0x3, 0x3f}]}, 0x24}, 0x1, 0x0, 0x0, 0x40}, 0x10) inotify_add_watch(r2, &(0x7f0000000080)='./file0\x00', 0x4000000) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB='\x00c@@\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\b\x00\x00\x00\x00\x00\x00\x00', @ANYPTR=&(0x7f0000000200)=ANY=[], @ANYPTR=&(0x7f0000000240)=ANY=[@ANYBLOB="fdffffff14cc4beb"]], 0x0, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000380)={0x8, 0x0, &(0x7f0000000500)=[@release]}) [ 413.246955] binder: undelivered TRANSACTION_ERROR: 29201 20:30:59 executing program 4: r0 = socket$inet(0x2, 0x0, 0x0) setsockopt$inet_opts(r0, 0x0, 0x0, &(0x7f00000000c0)="8907", 0x2) socketpair$unix(0x1, 0x0, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) r3 = memfd_create(&(0x7f0000000280)='[\'posix_acl_access\x00', 0x0) pwritev(r3, &(0x7f00000001c0)=[{&(0x7f0000000200)=',', 0x1}], 0x1, 0x4081806) sendfile(r1, r3, &(0x7f00000000c0), 0x20020102000007) pipe(&(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$TIOCEXCL(0xffffffffffffffff, 0x540c) write(r5, &(0x7f00000001c0), 0xfffffef3) vmsplice(r4, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) fstat(r3, &(0x7f0000000b40)) ioctl$TIOCGPGRP(0xffffffffffffffff, 0x540f, &(0x7f0000000cc0)) getsockopt$inet6_IPV6_IPSEC_POLICY(0xffffffffffffffff, 0x29, 0x22, &(0x7f00000010c0)={{{@in6=@mcast2, @in=@remote}}, {{@in6=@local}, 0x0, @in6=@loopback}}, &(0x7f00000011c0)=0xe8) recvfrom$unix(r2, &(0x7f0000000040)=""/4, 0xebc3276d6d4b1cd2, 0x100100, &(0x7f0000000100)=@abs, 0x930000) openat$selinux_avc_cache_stats(0xffffffffffffff9c, &(0x7f0000000240)='/selinux/avc/cache_stats\x00', 0x0, 0x0) 20:30:59 executing program 5: sendmsg$nl_netfilter(0xffffffffffffffff, &(0x7f0000000080)={&(0x7f0000000100), 0xc, &(0x7f00000000c0)={&(0x7f0000000140)=ANY=[@ANYBLOB="140000000301ff00b516ba0fc100000000000000c53cfdbd6f20dc9d083c14f43bbbf112d2b1ba12f7d7907ecdb8f8fab6174325e6b86fa4b556759191f2f650261d075afaa9584f2b17a71d9f3a313b81286f4fa2890978294995ca447c984bdff445b0a0f282be9e341f4c43087fb1146350e90ebd70751599842ddb00c12b3ab316b54a921e56e57f308743968d7f42f96a130e73b3d8aa43d4f59260d2c218a5ef21c6b4ec"], 0x14}}, 0x0) r0 = accept4$packet(0xffffffffffffff9c, &(0x7f0000000000)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @remote}, &(0x7f0000000040)=0x14, 0x80000) getpeername$packet(r0, &(0x7f0000000200), &(0x7f0000000240)=0x14) recvmmsg(0xffffffffffffffff, &(0x7f00000013c0), 0x1ad, 0x0, &(0x7f0000000c40)={0x77359400}) [ 413.310907] binder: 18529:18532 got transaction with invalid offset (-1491874460976807939, min 0 max 0) or object. [ 413.333355] binder: 18529:18532 transaction failed 29201/-22, size 0-8 line 3200 [ 413.350196] binder: 18529:18532 Release 1 refcount change on invalid ref 0 ret -22 20:30:59 executing program 5: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$nl_netfilter(r0, &(0x7f0000000080)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x1}, 0xc, &(0x7f00000000c0)={&(0x7f0000000340)=ANY=[@ANYRES16=r0], 0xfffffffffffffe5b}}, 0x0) recvmmsg(r0, &(0x7f0000000600)=[{{&(0x7f0000000000)=@ethernet={0x0, @broadcast}, 0x80, &(0x7f0000000200)=[{&(0x7f0000000140)=""/67, 0x43}, {&(0x7f00000001c0)=""/41, 0x29}], 0x2, &(0x7f0000000c80)=""/4096, 0x1000, 0x62d}, 0x4}, {{0x0, 0x0, &(0x7f0000000580)=[{&(0x7f0000000240)}, {&(0x7f0000000280)=""/179, 0xb3}, {&(0x7f0000000380)=""/79, 0x4f}, {&(0x7f0000000400)=""/102, 0x66}, {&(0x7f0000000480)=""/196, 0xffffffffffffff4d}], 0x5, 0x0, 0x0, 0x9}, 0x800}], 0x2, 0x0, &(0x7f0000000c40)={0x77359400}) getsockopt$inet_IP_XFRM_POLICY(0xffffffffffffff9c, 0x0, 0x11, &(0x7f0000000680)={{{@in=@dev, @in6=@mcast1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in=@remote}, 0x0, @in=@dev}}, &(0x7f0000000240)=0xe8) r2 = request_key(&(0x7f0000000780)='.dead\x00', &(0x7f00000007c0)={'syz', 0x3}, &(0x7f0000000800)='2#\x00', 0xffffffffffffffff) keyctl$get_persistent(0x16, r1, r2) r3 = openat$pfkey(0xffffffffffffff9c, &(0x7f0000000840)='/proc/self/net/pfkey\x00', 0x2000, 0x0) ioctl$EVIOCGPHYS(r3, 0x80404507, &(0x7f0000000880)=""/192) [ 413.367832] binder_alloc: binder_alloc_mmap_handler: 18529 20001000-20004000 already mapped failed -16 [ 413.382759] binder: BINDER_SET_CONTEXT_MGR already set [ 413.389265] binder: 18529:18542 ioctl 40046207 0 returned -16 [ 413.410134] binder_alloc: 18529: binder_alloc_buf, no vma 20:30:59 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000640)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, &(0x7f0000000200), &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000380)={0x1, 0x0, &(0x7f0000000000)=[@release], 0x0, 0x0, &(0x7f0000000400)}) [ 413.416063] binder: 18529:18542 Release 1 refcount change on invalid ref 0 ret -22 [ 413.424071] binder: undelivered TRANSACTION_ERROR: 29201 [ 413.430196] binder: 18529:18532 transaction failed 29189/-3, size 0-8 line 3137 [ 413.438786] binder: undelivered TRANSACTION_ERROR: 29189 [ 413.458510] binder: 18551:18552 got transaction to context manager from process owning it 20:30:59 executing program 3: r0 = socket$inet(0x2, 0xa, 0x0) setsockopt$inet_tcp_TCP_CONGESTION(r0, 0x6, 0xd, &(0x7f0000000680)='reno\x00', 0x60c5) r1 = socket$netlink(0x10, 0x3, 0x1e) r2 = syz_genetlink_get_family_id$team(&(0x7f0000000040)='team\x00') getsockopt$inet_IP_IPSEC_POLICY(r0, 0x0, 0x10, &(0x7f0000000080)={{{@in=@broadcast, @in6=@local, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in=@multicast2}, 0x0, @in=@local}}, &(0x7f0000000180)=0xe8) getsockopt$inet6_mreq(0xffffffffffffff9c, 0x29, 0x1f, &(0x7f0000000580)={@mcast1, 0x0}, &(0x7f00000005c0)=0x14) getsockopt$inet_mreqn(r0, 0x0, 0x27, &(0x7f0000003e00)={@multicast1, @remote, 0x0}, &(0x7f0000003e40)=0xc) getpeername$packet(0xffffffffffffff9c, &(0x7f0000004280)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @random}, &(0x7f00000042c0)=0x14) getsockopt$inet_pktinfo(r0, 0x0, 0x8, &(0x7f0000004300)={0x0, @broadcast, @dev}, &(0x7f0000004340)=0xc) getsockopt$inet6_mreq(0xffffffffffffffff, 0x29, 0x15, &(0x7f0000004380)={@local, 0x0}, &(0x7f00000043c0)=0x14) accept$packet(r0, &(0x7f0000004400)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @local}, &(0x7f0000004440)=0x14) accept$packet(0xffffffffffffff9c, &(0x7f0000004480)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @remote}, &(0x7f00000044c0)=0x14) getsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffffff, 0x29, 0x23, &(0x7f0000004500)={{{@in6=@dev, @in6=@local, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in=@dev}, 0x0, @in=@multicast1}}, &(0x7f0000004600)=0xe8) accept$packet(r0, &(0x7f0000004640)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000004680)=0x14) getpeername$packet(0xffffffffffffffff, &(0x7f00000046c0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @remote}, &(0x7f0000004700)=0x14) ioctl$ifreq_SIOCGIFINDEX_team(r0, 0x8933, &(0x7f0000004740)={'team0\x00', 0x0}) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000004800)={'ifb0\x00', 0x0}) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000004880)={'ifb0\x00', 0x0}) getsockopt$inet_pktinfo(r0, 0x0, 0x8, &(0x7f0000004980)={0x0, @loopback, @remote}, &(0x7f00000049c0)=0xc) accept$packet(0xffffffffffffffff, &(0x7f0000004a00)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @random}, &(0x7f0000004a40)=0x14) getsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x11, &(0x7f0000005ec0)={{{@in6=@remote, @in6=@loopback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@mcast1}}}, &(0x7f0000005fc0)=0xe8) getsockopt$inet_IP_IPSEC_POLICY(r0, 0x0, 0x10, &(0x7f0000006000)={{{@in=@broadcast, @in=@rand_addr, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in=@rand_addr}, 0x0, @in6=@dev}}, &(0x7f0000006100)=0xe8) sendmsg$TEAM_CMD_OPTIONS_GET(r1, &(0x7f0000006740)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x10804}, 0xc, &(0x7f0000006700)={&(0x7f0000006140)={0x58c, r2, 0x704, 0x70bd28, 0x25dfdbfc, {}, [{{0x8, 0x1, r3}, {0x134, 0x2, [{0x40, 0x1, @lb_port_stats={{{0x24, 0x1, 'lb_port_stats\x00'}, {0x8}, {0x8}}, {0x8, 0x6, r4}}}, {0x40, 0x1, @lb_tx_hash_to_port_mapping={{{0x24, 0x1, 'lb_tx_hash_to_port_mapping\x00'}, {0x8}, {0x8, 0x4, r5}}, {0x8}}}, {0x38, 0x1, @lb_stats_refresh_interval={{0x24, 0x1, 'lb_stats_refresh_interval\x00'}, {0x8}, {0x8, 0x4, 0x90000000000}}}, {0x38, 0x1, @activeport={{0x24, 0x1, 'activeport\x00'}, {0x8}, {0x8, 0x4, r6}}}, {0x40, 0x1, @name={{0x24, 0x1, 'mode\x00'}, {0x8}, {0x10, 0x4, 'roundrobin\x00'}}}]}}, {{0x8, 0x1, r7}, {0x80, 0x2, [{0x3c, 0x1, @user_linkup={{{0x24, 0x1, 'user_linkup\x00'}, {0x8}, {0x4}}, {0x8, 0x6, r8}}}, {0x40, 0x1, @priority={{{0x24, 0x1, 'priority\x00'}, {0x8}, {0x8, 0x4, 0x9}}, {0x8, 0x6, r9}}}]}}, {{0x8, 0x1, r10}, {0x1c8, 0x2, [{0x38, 0x1, @mcast_rejoin_count={{0x24, 0x1, 'mcast_rejoin_count\x00'}, {0x8}, {0x8, 0x4, 0x7f4a}}}, {0x5c, 0x1, @bpf_hash_func={{0x24, 0x1, 'bpf_hash_func\x00'}, {0x8}, {0x2c, 0x4, [{0xffffffffffffff81, 0x1b0a, 0x2, 0x9}, {0xffffffffffffe70d, 0xffffffff, 0x1, 0x9}, {0xfff, 0x1, 0x400, 0xffffffffffffffff}, {0xbd, 0x4, 0x4, 0x7f376b33}, {0x438e, 0xffff, 0x8b4, 0x3ff}]}}}, {0x40, 0x1, @priority={{{0x24, 0x1, 'priority\x00'}, {0x8}, {0x8, 0x4, 0x539}}, {0x8, 0x6, r11}}}, {0x38, 0x1, @activeport={{0x24, 0x1, 'activeport\x00'}, {0x8}, {0x8, 0x4, r12}}}, {0x40, 0x1, @lb_tx_hash_to_port_mapping={{{0x24, 0x1, 'lb_tx_hash_to_port_mapping\x00'}, {0x8}, {0x8, 0x4, r13}}, {0x8}}}, {0x38, 0x1, @notify_peers_interval={{0x24, 0x1, 'notify_peers_interval\x00'}, {0x8}, {0x8, 0x4, 0x7fff}}}, {0x40, 0x1, @lb_port_stats={{{0x24, 0x1, 'lb_port_stats\x00'}, {0x8}, {0x8, 0x4, 0xff}}, {0x8, 0x6, r14}}}]}}, {{0x8, 0x1, r15}, {0xc4, 0x2, [{0x40, 0x1, @priority={{{0x24, 0x1, 'priority\x00'}, {0x8}, {0x8, 0x4, 0x7}}, {0x8, 0x6, r16}}}, {0x40, 0x1, @lb_port_stats={{{0x24, 0x1, 'lb_port_stats\x00'}, {0x8}, {0x8, 0x4, 0x2}}, {0x8, 0x6, r17}}}, {0x40, 0x1, @lb_hash_stats={{{0x24, 0x1, 'lb_hash_stats\x00'}, {0x8}, {0x8, 0x4, 0x10000}}, {0x8}}}]}}, {{0x8, 0x1, r18}, {0xb8, 0x2, [{0x3c, 0x1, @user_linkup={{{0x24, 0x1, 'user_linkup\x00'}, {0x8}, {0x4}}, {0x8, 0x6, r19}}}, {0x38, 0x1, @mcast_rejoin_count={{0x24, 0x1, 'mcast_rejoin_count\x00'}, {0x8}, {0x8, 0x4, 0x5}}}, {0x40, 0x1, @lb_hash_stats={{{0x24, 0x1, 'lb_hash_stats\x00'}, {0x8}, {0x8}}, {0x8}}}]}}, {{0x8, 0x1, r20}, {0x50, 0x2, [{0x4c, 0x1, @lb_tx_method={{0x24, 0x1, 'lb_tx_method\x00'}, {0x8}, {0x1c, 0x4, 'hash_to_port_mapping\x00'}}}]}}]}, 0x58c}, 0x1, 0x0, 0x0, 0x40}, 0x0) sendto$inet(r0, &(0x7f0000a88f88), 0xfffffffffffffe6e, 0x20000000, &(0x7f0000e68000)={0x2, 0x0, @local}, 0x10) [ 413.468554] binder: 18551:18552 transaction failed 29201/-22, size 0-8 line 3005 [ 413.478775] binder_alloc: binder_alloc_mmap_handler: 18551 20001000-20004000 already mapped failed -16 [ 413.488548] binder: BINDER_SET_CONTEXT_MGR already set 20:30:59 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000640)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x4000)=nil, 0x4000, 0x2, 0x10, r1, 0x1) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000680)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000800000000000000dbb8ac4f7d5d3e8d8d8e29e6f0241bf9380d0acbb27da0bca131bb61163ca169aae88d15d92ee0554e78f72fc8e98b1d14a19f87316881d08f8d96a0b0c61764625e3f5142c074e4c69e2640931acae4066c54128674007d04c66d39ca0deed6257ad68f26054757cdc1b9ead82d35903e3df599e87b62a0c7b89cafeaa29692144c5d7e9fef6891971b5a0be3c687a3e0fcbec4ea0af8e96aef21c24c9b079e97ec6e8c251ad15a06c1742e2f9a8274488960021d9f5f3c222924b5d597361eea274ebbfe4dbf500adcff640b1442563db1d216cf125d0417af141e85699f51bf1b05f0d0f8beff0ea39435a81953d34c9b72214ec383fc0abaecdacc5648dba910f04332be4b396ef71584d9f5076fc9faf53a6466ad6b0b41ba9a90e22667d09113801fd552f5f8e23516b70f7f6485e4716cd5d22d861d30b51e10c682c90374e592cdb91992b8259590b4e16d08777c1f7c95ed", @ANYPTR=&(0x7f0000000200)=ANY=[], @ANYPTR=&(0x7f0000000240)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00']], 0x0, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000380)={0x8, 0x0, &(0x7f0000000500)=[@release], 0x0, 0x0, &(0x7f0000000400)}) [ 413.511498] binder: 18551:18552 ioctl 40046207 0 returned -16 [ 413.518913] binder_alloc: 18551: binder_alloc_buf, no vma [ 413.527625] binder: 18551:18556 transaction failed 29189/-3, size 0-8 line 3137 [ 413.536930] binder: undelivered TRANSACTION_ERROR: 29201 [ 413.543596] binder: undelivered TRANSACTION_ERROR: 29189 [ 413.579059] binder: 18561:18562 transaction failed 29189/-22, size 4493885784339307264-1955953009515990413 line 3014 [ 413.595381] binder: 18561:18562 Release 1 refcount change on invalid ref 0 ret -22 [ 413.610323] binder: 18561:18562 transaction failed 29189/-22, size 4493885784339307264-1955953009515990413 line 3014 [ 413.621264] binder: 18561:18567 Release 1 refcount change on invalid ref 0 ret -22 20:30:59 executing program 0: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000640)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000040)='/dev/rtc0\x00', 0x1, 0x0) getsockopt$SO_COOKIE(r2, 0x1, 0x39, &(0x7f0000000080), &(0x7f0000000100)=0x8) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, &(0x7f0000000200), &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, &(0x7f00000003c0)}) ioctl$SNDRV_TIMER_IOCTL_START(r2, 0x54a0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000380)={0x8, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="01bd00000000000000000000"], 0x0, 0x0, &(0x7f0000000400)}) r3 = geteuid() ioctl$TUNSETOWNER(r2, 0x400454cc, r3) [ 413.630489] binder: undelivered TRANSACTION_ERROR: 29189 [ 413.636614] binder: undelivered TRANSACTION_ERROR: 29189 20:30:59 executing program 2: r0 = socket$inet(0x2, 0x0, 0x0) setsockopt$inet_opts(r0, 0x0, 0x0, &(0x7f00000000c0)="8907", 0x2) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) r3 = memfd_create(&(0x7f0000000280)='[\'posix_acl_access\x00', 0x0) sendfile(r1, r3, &(0x7f00000000c0), 0x20020102000007) pipe(&(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$TIOCEXCL(0xffffffffffffffff, 0x540c) write(r5, &(0x7f00000001c0), 0xfffffef3) vmsplice(r4, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) fstat(r3, &(0x7f0000000b40)) getsockopt$inet6_IPV6_IPSEC_POLICY(0xffffffffffffffff, 0x29, 0x22, &(0x7f00000010c0)={{{@in6=@mcast2, @in=@remote}}, {{@in6=@local}, 0x0, @in6=@loopback}}, &(0x7f00000011c0)=0xe8) recvfrom$unix(r2, &(0x7f0000000040)=""/4, 0xebc3276d6d4b1cd2, 0x100100, &(0x7f0000000100)=@abs, 0x930000) openat$selinux_avc_cache_stats(0xffffffffffffff9c, &(0x7f0000000240)='/selinux/avc/cache_stats\x00', 0x0, 0x0) [ 413.689388] binder: 18571:18572 got transaction with invalid offset (0, min 0 max 0) or object. [ 413.717459] binder: 18571:18572 transaction failed 29201/-22, size 0-8 line 3200 [ 413.731998] binder: 18571:18572 unknown command 48385 [ 413.743341] binder: 18571:18572 ioctl c0306201 20000380 returned -22 [ 413.758354] binder: BINDER_SET_CONTEXT_MGR already set [ 413.758417] binder_alloc: 18571: binder_alloc_buf, no vma [ 413.758457] binder: 18571:18579 transaction failed 29189/-3, size 0-8 line 3137 [ 413.771275] binder: 18514:18517 ioctl 40087602 200001c0 returned -22 [ 413.790514] binder: 18571:18582 unknown command 48385 [ 413.794361] binder: 18571:18572 ioctl 40046207 0 returned -16 [ 413.795550] binder_alloc: 18571: binder_alloc_buf, no vma [ 413.795603] binder: 18514:18525 transaction failed 29189/-3, size 24-8 line 3137 [ 413.795646] binder: BINDER_SET_CONTEXT_MGR already set [ 413.795661] binder: 18514:18517 ioctl 40046207 0 returned -16 [ 413.825974] binder: 18514:18517 BC_INCREFS_DONE u0000000000000000 no match [ 413.826252] binder: 18571:18582 ioctl c0306201 20000380 returned -22 20:30:59 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$FS_IOC_SETVERSION(r0, 0x40087602, &(0x7f00000001c0)) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, &(0x7f0000000140)={0x0}) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, &(0x7f0000000500)={0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000005c0)={0x50, 0x0, &(0x7f0000000540)=[@dead_binder_done={0x40086310, 0x4}, @free_buffer={0x40086303, r1}, @increfs_done={0x40106308, r2, 0x4}, @dead_binder_done, @clear_death={0x400c630f, 0x1, 0x1}, @increfs={0x40046304, 0x1}], 0x1000, 0x0, &(0x7f0000000800)="7117704c63187cba515970b5040121121966a9c05d88aeef3127d7ccd70006067a5104f00d625b27ea1fb9eca1471541930f3b22e33a2d39572bb54181de16ff26bc7a21ddb0241a44f0e7fefd9e4f0a37d1418293caa98334b4c1a9779b8bf9d0efb90a88f195a3341c25cf3b720c6663a5ab38afc86f6cc7b543e2842a19a5eca4701c99169df653768305f2d03caf013e01339e77c6c4515f88a6abb9d63d25be40cc05ff9e9cf6d1615609f84ad3352a56d95f5df320ce0e3c5b3f30151418d03f4fe8cd54e161f36b15fde3c417ba8f60e6c9ec7d4f57c201402013656989600458ea977dfaeda25e7a39c8ff68b3b1a20f83a70eb231d4e71c26d9a875b8e9177db3b150b15bca221f8bd7037684aca2d053e421a18ec26cb4b9d4451ee44aae9089c3a1ef8d8cee7c7faea2d69c25201dab124ea37523ed7b88d86ae92d53f89716bf977589b99ea30bce1d8271d3d6bc2422a1946af725581e8d23fd4623df4c2eead0ce0d66b67046cf02eab3b35d7eb285d97425df551b7700ffb2b7eb1f37df717d7cb02fbe27c294b5af88e75e383fc5739527d60d9761744db66df1b7b08d412089d350cf45bf34c6d9080b167d98e6285204bbad190564c09324d1f935b2bae0052e4fba4b17c8079be7ca80a1de0c6515949f0ec8eba3d83e6e6f57b670eaea9aa0d4919f3f2234cf154d882c44290afa13770fd8041aff38926b752ae7a51b00eeff9bb0059b82b6e2b7d44640a8a7773092930093bdc34cd4c2a17c081d5c9ca2cdaadd3bb5be5f4878ad3e7e727319e2356a355d5fc08002b6d647a9a6feade1d4a403e225b7976e5e702fa9d3b2860855753d019a1d8e99e21f3ad4a0ddf3eddaac295a409f3d63f0e43cd4ddda01f5e4328e714cd57c3bb7a36be00eadc394dfcbf7628c4293c2f20e02720daad5a766703f06d994dc6c03083ce964e0b8850fd50b35b07e8487ae734a7a37c5543d94f946e04a2e97c8c1169f6e2d895c6e2a8ae88b11ca2338d009a8fe2126a8bb72313e76316df34058e619b87b02b98b18a500992753d97c70a2f52e37af3cfa287a3d58155f5a8e551a8e2ce2c500cc74cd18d14eee3463e844d587dbc6ea0e2a5bdae11aaf9b872206bd14948a096b9ba890e458d47edb35a86a69856cb35fa30dcaf0a11e47bf4cd198d5fc6d60bc40b0a4fe5cc87332a4c65aeeb7592f81c9f0cbdd8b9b708186db23e1f9850d512b7501140511a13b3cb2731ef6426bb5598f66fea05e848712816d0076cc688ee461b13d132272a25bd54f7d2fb122e7815a54cfcd766fe6ba8924c20982338f46097c0e235b05b042c02c5e8bf84ab0aa67f39958adc5a867fba2354b05d2bbf4053f15e335e14a2640c92448a2af3bc44502e98bc4810f5807e91a7b9dd6d77999f3d32ce1f6db9e9026df2c102a9099af0675e6dec1ca34212f374ec0828cc96e3a721fee6766a4d3b2745535cabc798ed37d91e112065d1df79067e1f439c87673a2e9b6976508c3e4c97aa91ea879649334bc9743ed33ec195553200c87f1424cec25703495487916c2e0f680d7cb19b4befd945adfa8cfaeff0ab8472f1c7af6665f427d2755cc1bcb8971b5a0e42b09bed851e563dcb8bb917a92e4385f37ca1bbcffa7fc3550ffe0738fae9df919be11fd93242878a37ef57bdd93f78b853d7a8765e4cd57ea33f875908b8904840b162bb2f5e7d07c95cd3b7ee6245cd4c233389511b68ca3d07f104dfbb6ee82768cea607098ee9120d7d20c368e07bba78f2b1e86741e5b79f6c451453d48b99fcc67094dfae3db7a8abfe4963a65a4e5b7f36b65703e7e9c66fca3fd16850f4f84a0b6b7297c4341e0fdb2a4f446621ae448b51ae20f061c18b7109d676a07eda40fddf7ef4b227c60cb3335364d7afdbb889513b48f291a5004901b35022e9a624c7fff8ab0d6a5f888e0c3f5a5e4ea02ad31f842237d568ac6f4c6728af65c1116faca9f2d12e1af5692dc5149740f6193562d1b0c472140fd2df287462a276c3a04bff3cdce26fc4ed34bef4d9d181ad970c6c9efd292364eaa5e5ce75763c816f7e66aa97acc2d7e82e1b6ff06991027ccee319a439a8b0fa63340b3c3d26292bd1d2437faa4464b78dbdf189fbf8aae5c02cc6e3d0e5088f5f3b8e85c8b75059a0541fd431d8379f8e08c47c4c7c3286cb98fba103905830a9440a2593d3d65b914cc6be0b4e76ccf5ef11cc52532b98201dd6945688982acee6939494ba6a8cac473eaf92098b68ee717015eda198506b896807201a871f6c4cee554efe49a496048d5bf606910861ce4a33ca1ba51b4e6a45d634afb2e529c3d8479627be4c03855601b0ebe6bbb2e8fe8fe9845c8ad5fd26312db5b59743b56b5dda9cbf8d7436008259c75610ab5e3ca92174cdd6e9a076de39006f3cfab1708025c16af334f6e989ed29cee95da7ad7debec30b931e3c37c446559e3323c5e108c571620d30cae955d4151ef4df93777ede8f613aba527537db17d6fa15d4f9d6b1bc1ed3857b6fed338a2d1cec7f3e26d712dae9685c2c313b92130481e51052daf2751d54890c4fdd75836a2ef115648d76d3766fa1703b5fc43467864c7493520f932a1af06e8a1c3a95b93bf524e1d876c42f3ee3ce64f0e5e9fccb2fd0a02b4123d2009b71fafdc18d07302972cb0be350ffb99fc672265d0c0d9da2f4f3c1417108de62e79f4348add246e39f9f5daa30ffa3475c7c33c5cf09229997d6a2a822bf9dabf4df72a78f8eab89d0b29931610c8bd2892375a0067c3fb71265f563ccdcf94bde12dc18e7b6c551fcf3050948a77673ecef289891b508647133efd4bdd5334c4f18749ce87b856d3af16a58c78f293c110b96d243107c25be9fea1994202e87209b3329eb22ea637111f08a2ce49d754d012381358c78d4d6a1eeed09c15412d7f85eb915f5ba80eba96302bf634eefcda7dbed1cb7abe2b5e7c62033f19ba79c1482ab3c10479eec331d006c95f7892d7ddba53089722352b056dd11c9703c26ece76addc98812f4986453aedc62bbacab0081cb2248d282b008709d64cc257f7b59922d6affb96819257bc372e648a85028c6f59b3c7f2cea450674f5738d417c14ea53b62023f872ef28afda551d1ef688e39d535c91ddc096337ac2546192ea8c85272261e3f4b31f4618b38056ae290e0b6a83f349ca5e6eeaca80fdd68efaae9453bf45f0630a78b7821da7975e2b74ce1123d13a4ae3bc62300aef3162ae81f8ddf8f446b8d5ecc7872e289b6bb1a226f8973af365ce279fbe7c523613209e12170f0750b29464f98128fe8cd61d4efced39ba9c89b01ac50fef2e3844a2bcf9e1fb4b22609377285aed4310de772c59a652e440749df03cd4f1116676600809c11c08b04a29c231c77a269d6d627ffb6e5faf9865ce8ada7102666f0b8a2084ebfa145d361026dce70d063c61df3f8efab3b7734cba29b9a5de6255d3c48bbe803091606004610a36b3d942f13261fee61fe6f0c423b312fbaf76c6181cb815ebce7dcf5ce8a3e63234611bd3b8489893c4c556d6b5f5904ef61568f5f171bbdeb16792e928099fe96dc85953c2c07d9d7659ddc705b39a7620c99c77d1d3035cbcaca2ece3151e6fbbdd7954d74e87741cb006acad38b9a3817907ae48c989ddbde837e66ad7704735ef3f253cb830c81f747883a16922ceb5744da44bba367872a7f48df309e254382c4044db75ff0a5e2109c24bac0b49887564ac12a1177c90b5565265281d2071665e689ae23d953af0df523817ccf21c8cfd95cb1c95f029e09b41c8d04a3dbff13316e6773c3b97dcc945fd305acd82b4a251e48b7c9f4152a3a76abb954f9c6890d2ae6abb48f254e410b7e273d4a6efff2fd99c3fc86e31da88287762ef5d6b2271189d833733a100806559404bff59e0962c4b7503937e2d70fc30b903353ebeb91eb867571a30947d2e2f7d955dfa09d668ac1434be99514fb72e6275cb3de893ffb57157b94e8962831790e0c41c7064e15d75aad600a4baccf4516c24d72830bc54340dd007b3955554a2f0450c7e39d4d00cf00e10d783fb59ec40764cd2791919cb594aadf1d84a5639ed446a8eeec5d352f8fea4dadeae12343a7124e1154e3899aeb6841b257a05e79973a87a7e07adfa4d9c8aa374b73298f4f0a8631ae3c809cfabc6694c5c8de03a6cf736d6d3e0593886b93d5cbc258b48119392197d3e31ce8481c74197a68f876003def1dab72cd850a29e0ed3e8a9eefa435c61aed50b9e770796a91302e96555cc76ac929c897e4b90d810a741404d513cbbc0d6bb4529ba07cae799b5d698668a118244dd3897e97b9198df3965306e9fec3b376693331aae5d7403ca2912eb9256044b14a03fd489aa72066a4ac442e0ef28ac7af13a6f2dd75aaf5c4347828ccd19a27832e57563f0dc9ef43e0fb89e5f40f9516e8249ebd7dd3696cf0c0a13c3a34c1c768805ec99d5ed68c6f5cbbebe663d4d486fa80551881767b6b5b479d229dfd8155797ee6a86fdea4c1c89b2cdb73737751ac1150d45deda014d693e4dafd519407c76a0535d553ee21866ac3b124bd2eab75a907b8809c86e13bd763fa4bb95bac284dad32c69b4c701eebe6c78d4184d66c930f5d725a0dbc57af7d9277d44c6357e12495e7a5e40a85789e35d24ced8205a14d6d540010fc302f38d9f4b525a867b5eae35a22f047300f65cc0ed00252aeccd8c487a520d0b1f6ecec6d8772e0164f53786ec65b9877d0e046fa2cf4cd3e0d40910cc46b5491e23761c73217d84b89c9dd38b696078864045ecd209d04c1609e11f0b1c8a9b0ac175c8ec0d862c1b9a3b8f0c990c9b4af3a6c358bd7430d68f4f1dec7d498a113b22a0c3b2f71f6f4dbf1d7c68d3da8ddca98e7d14e6e65f4b83bfda9fda922907eca2884327842a9998099eca1b789a3bb866c9a0738a2968789db48f2c2782f59a01e69dcbe95c346f2a9b3d02e0379f8c8ddd544471479f004d32514e3ba9683d7325ce66e9f16ca4ac0abd94cc6dde12bdf0871371fbe85ea5ec5a98aca08d60b63d7e075fda987192fbcb492156950d0bdd7d20de07439f46db32b66477dee8377719d876cd8adb5f312440074f7ccf7d9be315a609fb9e4b88d5ca0f54f4bb960b2b4d9864b8e5b0510d940685d9e34dd8b84b388b838437896201c60297c38ac90aa1b9c7a7a2c058704df83bf6fdad2e7f41a0db790f3e5935abf72ea0f7f1d7f9fd48b98102558736428b6a0163ce1ab5ed664c47a86f7abfb055665af64c07b0f95c4a4f2722b419ae92318948e6f4f6c570700277cfa06ed7258b5ddf048340297977c33d66067a84f7e5415bd74e2e0c74eeaebc869151f3b6590ac96b66f3acdc5fb125fd377f6ed7ed771f74ab9be827ffffb282870c0bfd0abb8ee7d731048a124f45b4e4cf73fe59dca0ab89283661ef56217a5a69df0797953ac8a09840a5b9db7009fba333a423e357bc50c480a2a6c36201ff0ceabbff29a44dc1621894b9525a18a9c97e21993751df65e44ca8ac3a8e26b261d096fa12792f9f323fc7963ab827668ed501bd5f58b08aef358d8754f01d13657c6d660abcd5245d81a59513fffca312bc2906320f99c024cdde1dc391ce9c3c8060afe11dd7f09839a503ea1a33d8da383696ac46c855d7fd0f652c6f323f3eb5b854a65134f47a23e10bab918368ac092218312038c2f770ff09c6e12ae45004963207e21f8a454e7cc1adcb39ef652c8092039847804dda0b27e370009c121197dfda"}) r3 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r3, 0x0) fsync(r3) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000380)={0x148, 0x0, &(0x7f0000000680)=ANY=[@ANYBLOB="0c6300000dd3bbb5d1c6d7724b090cc3aa7fd5213da353413729dc1bd73b04559408ddd7b25d835448cc9c8c78682c9f6fc2d350fd9e91ec6accecde350650e5ce4602a8d5124585df47ff0039a2df6d9e47dac587238e113d2b6bd25b811e88a2d475f5d28082b84575a9bda5c340d9d9bc924c967a3ef368dc9053cf38a5e7fdd23048e6c96619409d5bc6a5b3d6a1cf96aace19bb04ec484d39cec19c3723d3ecc0e95cf3dc5c48506173edc94c3e6b71ac1a410244f0704fb234701f8f84ad3cec0e0bac570624893202af9c58675eb9e26ec4a8fce8df82ab39f5a8c58da650887a8ba7c2b40c446708e3e00f8b96e3fbbac8232c5cf7318296135b827d79bdef79ae59a3a8c20efe6fbd18880d03cae6573dcbe028b467c5dbb8ae5bc749509ccedfd85a83120e81ac0fbc88d686d3b1b0618f2397c0b20000000000000000000000000000"], 0x1, 0x0, &(0x7f0000000040)='+'}) ioctl$BINDER_SET_CONTEXT_MGR(r3, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0x0, 0x0, &(0x7f0000000780)}) pipe(&(0x7f0000000600)={0xffffffffffffffff, 0xffffffffffffffff}) getsockname(r4, &(0x7f0000001800)=@rc, &(0x7f0000000640)=0x80) r5 = mmap$binder(&(0x7f0000003000/0x3000)=nil, 0x3000, 0xd, 0x5010, r3, 0x0) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000000080)={0x70, 0x0, &(0x7f0000000480)=[@reply_sg={0x40486312, {{0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x40, 0x18, &(0x7f00000003c0)=[@flat={0x77622a85, 0xa, r5}, @ptr={0x70742a85, 0x1, &(0x7f0000000180), 0x1, 0x4, 0x28}], &(0x7f0000000400)=[0x20, 0x28, 0x68]}, 0x800}}, @exit_looper, @increfs, @acquire, @free_buffer={0x40086303, r5}, @exit_looper], 0x61, 0x0, &(0x7f00000000c0)="f610e7c123e5106e5a34d34e71f771ee2972e58153e14bebd8cb9c879efec87f8a3e25e04d26b76aee064c410eb686b41aa016ef12e24ff3708389511f2bcfe5ce93242e9c765e7ce98aceec4c2062b3a3e5fb0258d8c2f771dd6b755d41f81ad52cc13247071f495eb20a82813a2d3a3c5c830658"}) 20:30:59 executing program 4: r0 = socket$inet(0x2, 0x0, 0x0) setsockopt$inet_opts(r0, 0x0, 0x0, &(0x7f00000000c0)="8907", 0x2) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) r3 = memfd_create(&(0x7f0000000280)='[\'posix_acl_access\x00', 0x0) pwritev(0xffffffffffffffff, &(0x7f00000001c0)=[{&(0x7f0000000200)=',', 0x1}], 0x1, 0x4081806) sendfile(r1, r3, &(0x7f00000000c0), 0x20020102000007) pipe(&(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$TIOCEXCL(0xffffffffffffffff, 0x540c) write(r5, &(0x7f00000001c0), 0xfffffef3) vmsplice(r4, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) fstat(r3, &(0x7f0000000b40)) ioctl$TIOCGPGRP(0xffffffffffffffff, 0x540f, &(0x7f0000000cc0)) getsockopt$inet6_IPV6_IPSEC_POLICY(0xffffffffffffffff, 0x29, 0x22, &(0x7f00000010c0)={{{@in6=@mcast2, @in=@remote}}, {{@in6=@local}, 0x0, @in6=@loopback}}, &(0x7f00000011c0)=0xe8) recvfrom$unix(r2, &(0x7f0000000040)=""/4, 0xebc3276d6d4b1cd2, 0x100100, &(0x7f0000000100)=@abs, 0x930000) openat$selinux_avc_cache_stats(0xffffffffffffff9c, &(0x7f0000000240)='/selinux/avc/cache_stats\x00', 0x0, 0x0) 20:30:59 executing program 3: r0 = socket$inet(0x2, 0x4000000000000001, 0x0) setsockopt$inet_tcp_TCP_CONGESTION(r0, 0x6, 0xd, &(0x7f0000000680)='reno\x00', 0x60c5) sendto$inet(r0, &(0x7f0000a88f88), 0x0, 0x20000000, &(0x7f0000000040)={0x2, 0x20000000000, @multicast1}, 0x10) ioctl$sock_SIOCDELDLCI(r0, 0x8981, &(0x7f00000000c0)={'syzkaller0\x00', 0x6}) 20:30:59 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0x0, 0x2) r1 = syz_open_dev$binder(&(0x7f0000000640)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, &(0x7f0000000200), &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000380)={0x8, 0x0, &(0x7f0000000500)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00'], 0x0, 0x0, &(0x7f0000000400)}) [ 413.839552] binder: 18514:18525 Release 1 refcount change on invalid ref 1 ret -22 [ 413.845258] binder: undelivered TRANSACTION_ERROR: 29189 [ 413.847285] binder: undelivered TRANSACTION_ERROR: 29201 [ 413.901880] binder: 18588:18591 got transaction with invalid offset (0, min 0 max 0) or object. [ 413.915551] binder: 18587:18593 ioctl 40087602 200001c0 returned -22 [ 413.929432] binder: 18588:18591 transaction failed 29201/-22, size 0-8 line 3200 [ 413.939453] binder: 18587:18593 BC_DEAD_BINDER_DONE 0000000000000004 not found [ 413.945347] binder: 18588:18591 unknown command 0 [ 413.945354] binder: 18588:18591 ioctl c0306201 20000380 returned -22 [ 413.945941] binder_alloc: binder_alloc_mmap_handler: 18588 20001000-20004000 already mapped failed -16 [ 413.946030] binder: BINDER_SET_CONTEXT_MGR already set [ 413.946036] binder: 18588:18591 ioctl 40046207 0 returned -16 [ 413.946174] binder_alloc: 18588: binder_alloc_buf, no vma [ 413.946211] binder: 18588:18598 transaction failed 29189/-3, size 0-8 line 3137 [ 413.946585] binder: undelivered TRANSACTION_ERROR: 29189 20:30:59 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000640)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) r2 = openat$selinux_avc_hash_stats(0xffffffffffffff9c, &(0x7f0000000180)='/selinux/avc/hash_stats\x00', 0x0, 0x0) symlinkat(&(0x7f0000000000)='./file0\x00', r2, &(0x7f0000000080)='./file0\x00') ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, &(0x7f0000000200), &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000380)={0x8, 0x0, &(0x7f0000000500)=[@release], 0x0, 0x0, &(0x7f0000000400)}) 20:30:59 executing program 3: r0 = socket$inet(0x2, 0x4000000000000001, 0x0) setsockopt$inet_tcp_TCP_CONGESTION(r0, 0x6, 0xd, &(0x7f0000000680)='reno\x00', 0x60c5) r1 = dup2(r0, r0) ioctl$IOC_PR_PREEMPT(r1, 0x401870cb, &(0x7f0000000000)={0x5, 0x7, 0x401, 0x9}) setsockopt$ARPT_SO_SET_ADD_COUNTERS(r1, 0x0, 0x61, &(0x7f0000000040)={'filter\x00', 0x4}, 0x68) accept4$packet(r1, &(0x7f0000000140)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @local}, &(0x7f0000000180)=0x14, 0x80800) recvfrom$packet(r1, &(0x7f00000000c0)=""/86, 0x56, 0x10000, &(0x7f00000001c0)={0x11, 0x1b, r2, 0x1, 0x5, 0x6, @broadcast}, 0x14) sendto$inet(r0, &(0x7f0000000000), 0x0, 0x4, &(0x7f0000e68000)={0x2, 0x4e24, @loopback}, 0xffffff3f) [ 413.946949] binder: undelivered TRANSACTION_ERROR: 29201 [ 414.010423] binder: 18587:18593 BC_FREE_BUFFER u0000000000000000 no match [ 414.018330] binder: 18587:18593 BC_INCREFS_DONE u0000000000000000 no match [ 414.034997] binder: 18587:18593 BC_DEAD_BINDER_DONE 0000000000000000 not found [ 414.042364] binder: 18587:18593 BC_CLEAR_DEATH_NOTIFICATION invalid ref 1 [ 414.050645] binder: 18587:18600 unknown command -1245981939 [ 414.051114] binder: 18603:18604 got transaction with invalid offset (0, min 0 max 0) or object. [ 414.051181] binder: 18603:18604 transaction failed 29201/-22, size 0-8 line 3200 [ 414.051280] binder: 18603:18604 Release 1 refcount change on invalid ref 0 ret -22 [ 414.051907] binder_alloc: binder_alloc_mmap_handler: 18603 20001000-20004000 already mapped failed -16 [ 414.052002] binder: BINDER_SET_CONTEXT_MGR already set [ 414.052009] binder: 18603:18604 ioctl 40046207 0 returned -16 [ 414.052286] binder_alloc: 18603: binder_alloc_buf, no vma [ 414.052338] binder: 18603:18606 transaction failed 29189/-3, size 0-8 line 3137 [ 414.056261] binder: 18587:18593 IncRefs 0 refcount change on invalid ref 1 ret -22 [ 414.087564] binder_alloc: 18603: binder_alloc_buf, no vma [ 414.087606] binder: 18587:18608 transaction failed 29189/-3, size 24-8 line 3137 [ 414.087693] binder: 18587:18608 BC_INCREFS_DONE u0000000000000000 no match [ 414.087989] binder: 18587:18608 got reply transaction with no transaction stack [ 414.087997] binder: 18587:18608 transaction failed 29201/-71, size 64-24 line 2922 [ 414.088637] binder: undelivered TRANSACTION_ERROR: 29189 [ 414.088668] binder: undelivered TRANSACTION_ERROR: 29201 [ 414.177626] binder: 18587:18600 ioctl c0306201 20000380 returned -22 20:31:00 executing program 5: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$nl_netfilter(r0, &(0x7f0000000080)={&(0x7f0000000100), 0xc, &(0x7f00000000c0)={&(0x7f0000000340)=ANY=[@ANYBLOB="140000000301ffff808f00003d88c83f00b516ba"], 0x14}}, 0x0) r1 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000000)='net/ip6_tables_matches\x00') ioctl$TIOCEXCL(r1, 0x540c) recvmmsg(r0, &(0x7f00000013c0), 0x1ad, 0x0, &(0x7f0000000c40)={0x77359400}) 20:31:00 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) openat$zero(0xffffffffffffff9c, &(0x7f0000000000)='/dev/zero\x00', 0x490100, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000640)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, &(0x7f0000000200), &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000380)={0x8, 0x0, &(0x7f0000000500)=ANY=[@ANYBLOB='\b\x00\x00\x00\x00\x00\x00\x00'], 0x0, 0x0, &(0x7f0000000400)}) 20:31:00 executing program 3: r0 = socket$inet(0x2, 0x4000000000000001, 0x0) setsockopt$inet_tcp_TCP_CONGESTION(r0, 0x6, 0xd, &(0x7f0000000680)='reno\x00', 0x60c5) sendto$inet(r0, &(0x7f0000000000)="44e300103b004fcac660eba96ed4930bb83a10e88125cbff4c54", 0xfffffffffffffe6e, 0x20000000, &(0x7f0000e68000)={0x2, 0x0, @local}, 0xe0) fsetxattr$security_evm(r0, &(0x7f0000000040)='security.evm\x00', &(0x7f0000000080)=@ng={0x4, 0xc, "09a4e3453ae1fd071d075986a5eab1"}, 0x11, 0x2) 20:31:00 executing program 3: r0 = socket$inet(0x2, 0x4000000000000004, 0x3) setsockopt$inet_tcp_TCP_CONGESTION(r0, 0x6, 0xd, &(0x7f0000000680)='reno\x00', 0x60c5) r1 = creat(&(0x7f0000000000)='./file0\x00', 0x8) ioctl$EVIOCREVOKE(r1, 0x40044591, &(0x7f0000000040)=0x5) sendto$inet(r0, &(0x7f0000a88f88), 0xfffffffffffffe6e, 0x20000000, &(0x7f0000e68000)={0x2, 0x0, @local}, 0x10) [ 414.281580] binder: 18616:18622 got transaction with invalid offset (0, min 0 max 0) or object. [ 414.302729] binder: 18616:18622 transaction failed 29201/-22, size 0-8 line 3200 [ 414.340915] binder: 18616:18628 unknown command 8 [ 414.356878] binder: 18616:18628 ioctl c0306201 20000380 returned -22 [ 414.369324] binder: BINDER_SET_CONTEXT_MGR already set [ 414.379501] binder: 18616:18628 ioctl 40046207 0 returned -16 [ 414.385851] binder_alloc: 18616: binder_alloc_buf, no vma 20:31:00 executing program 3: r0 = socket$inet(0x2, 0x4000000000000001, 0x7fffffe) setsockopt$inet_tcp_TCP_CONGESTION(r0, 0x6, 0xd, &(0x7f0000000080)='scalable\x00', 0xfffffffffffffe13) sendto$inet(r0, &(0x7f0000a88f88), 0xfffffffffffffe6e, 0x20000000, &(0x7f0000e68000)={0x2, 0x0, @local}, 0x10) setsockopt$inet_mtu(r0, 0x0, 0xa, &(0x7f0000000000)=0x3, 0x4) [ 414.394305] binder: 18616:18628 unknown command 8 [ 414.399473] binder: 18616:18622 transaction failed 29189/-3, size 0-8 line 3137 [ 414.407359] binder: 18616:18628 ioctl c0306201 20000380 returned -22 [ 414.416540] binder: undelivered TRANSACTION_ERROR: 29189 [ 414.422550] binder: undelivered TRANSACTION_ERROR: 29201 20:31:00 executing program 2: r0 = socket$inet(0x2, 0x0, 0x0) setsockopt$inet_opts(r0, 0x0, 0x0, &(0x7f00000000c0)="8907", 0x2) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) pwritev(0xffffffffffffffff, &(0x7f00000001c0)=[{&(0x7f0000000200)=',', 0x1}], 0x1, 0x4081806) sendfile(r1, 0xffffffffffffffff, &(0x7f00000000c0), 0x20020102000007) pipe(&(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$TIOCEXCL(0xffffffffffffffff, 0x540c) write(r4, &(0x7f00000001c0), 0xfffffef3) vmsplice(r3, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) fstat(0xffffffffffffffff, &(0x7f0000000b40)) getsockopt$inet6_IPV6_IPSEC_POLICY(0xffffffffffffffff, 0x29, 0x22, &(0x7f00000010c0)={{{@in6=@mcast2, @in=@remote}}, {{@in6=@local}, 0x0, @in6=@loopback}}, &(0x7f00000011c0)=0xe8) recvfrom$unix(r2, &(0x7f0000000040)=""/4, 0xebc3276d6d4b1cd2, 0x100100, &(0x7f0000000100)=@abs, 0x930000) openat$selinux_avc_cache_stats(0xffffffffffffff9c, &(0x7f0000000240)='/selinux/avc/cache_stats\x00', 0x0, 0x0) [ 414.716349] binder: 18587:18600 ioctl 40087602 200001c0 returned -22 [ 414.723089] binder: 18587:18608 BC_DEAD_BINDER_DONE 0000000000000004 not found [ 414.731134] binder: 18587:18608 BC_FREE_BUFFER u0000000000000000 no match [ 414.738232] binder: 18587:18608 BC_INCREFS_DONE u0000000000000000 no match [ 414.745897] binder: 18587:18608 BC_DEAD_BINDER_DONE 0000000000000000 not found [ 414.753379] binder: 18587:18608 BC_CLEAR_DEATH_NOTIFICATION invalid ref 1 [ 414.760362] binder: 18587:18608 IncRefs 0 refcount change on invalid ref 1 ret -22 [ 414.769239] binder_alloc: binder_alloc_mmap_handler: 18587 20001000-20004000 already mapped failed -16 [ 414.779047] binder: 18587:18648 unknown command -1245981939 [ 414.784817] binder: 18587:18648 ioctl c0306201 20000380 returned -22 [ 414.791419] binder: BINDER_SET_CONTEXT_MGR already set [ 414.796731] binder: 18587:18600 ioctl 40046207 0 returned -16 [ 414.802644] binder: 18587:18648 transaction failed 29189/-22, size 24-8 line 3014 20:31:00 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$FS_IOC_SETVERSION(r0, 0x40087602, &(0x7f00000001c0)) r1 = syz_open_dev$binder(&(0x7f0000000640)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000000)=[@enter_looper], 0x1, 0x0, &(0x7f0000000040)='+'}) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0x0, 0x0, &(0x7f0000000780)}) r2 = mmap$binder(&(0x7f0000000000/0x12000)=nil, 0x12000, 0x5, 0x1010, r0, 0x0) r3 = mmap$binder(&(0x7f000000c000/0x4000)=nil, 0x4000, 0x2000004, 0x10, r0, 0x0) r4 = mmap$binder(&(0x7f0000001000/0x1000)=nil, 0x1000, 0x2000000, 0x84110, r1, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0xb0, 0x0, &(0x7f0000000540)=[@clear_death={0x400c630f, 0x1, 0x1}, @acquire_done={0x40106309, r2, 0x2}, @acquire_done={0x40106309, r3, 0x3}, @request_death={0x400c630e, 0x2, 0x2}, @increfs_done={0x40106308, r4, 0x3}, @transaction={0x40406300, {0x3, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x28, 0x30, &(0x7f00000000c0)=[@ptr={0x70742a85, 0x0, &(0x7f0000000080), 0x1, 0x0, 0x3c}], &(0x7f0000000100)=[0x40, 0x38, 0x30, 0x38, 0x38, 0x28]}}, @request_death={0x400c630e, 0x0, 0x1}], 0xd, 0x0, &(0x7f0000000180)="9e7e4490163867a9be25c81003"}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000380)={0x8, 0x0, &(0x7f0000000500)=[@release={0x40046306, 0x1}], 0x0, 0x0, &(0x7f0000000400)}) 20:31:00 executing program 0: r0 = openat$selinux_enforce(0xffffffffffffff9c, &(0x7f0000000080)='/selinux/enforce\x00', 0x1, 0x0) signalfd(r0, &(0x7f00000000c0)={0x40}, 0x8) r1 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) pipe2(&(0x7f0000000100), 0x80000) r2 = syz_open_dev$binder(&(0x7f0000000640)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, &(0x7f0000000200), &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000380)={0x8, 0x0, &(0x7f0000000500)=[@release], 0x0, 0x0, &(0x7f0000000400)}) r3 = openat$keychord(0xffffffffffffff9c, &(0x7f0000000000)='/dev/keychord\x00', 0x0, 0x0) write$FUSE_NOTIFY_STORE(r3, &(0x7f0000000040)={0x29, 0x4, 0x0, {0x1, 0xffffffff, 0x1, 0x0, [0x0]}}, 0x29) 20:31:00 executing program 3: r0 = dup2(0xffffffffffffff9c, 0xffffffffffffff9c) getsockopt$inet_int(r0, 0x0, 0x15, &(0x7f0000000000), &(0x7f0000000040)=0x4) r1 = socket$inet(0x2, 0x4000000000000001, 0x0) setsockopt$inet_tcp_TCP_CONGESTION(r1, 0x6, 0xd, &(0x7f0000000680)='reno\x00', 0x60c5) sendto$inet(r1, &(0x7f0000a88f88), 0xfffffffffffffe6e, 0x20000000, &(0x7f00000000c0), 0x3) pipe2(&(0x7f0000000080), 0x84800) 20:31:00 executing program 4: r0 = socket$inet(0x2, 0x0, 0x0) setsockopt$inet_opts(r0, 0x0, 0x0, &(0x7f00000000c0)="8907", 0x2) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) r3 = memfd_create(&(0x7f0000000280)='[\'posix_acl_access\x00', 0x0) pwritev(r3, &(0x7f00000001c0), 0x0, 0x4081806) sendfile(r1, r3, &(0x7f00000000c0), 0x20020102000007) pipe(&(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$TIOCEXCL(0xffffffffffffffff, 0x540c) write(r5, &(0x7f00000001c0), 0xfffffef3) vmsplice(r4, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) fstat(r3, &(0x7f0000000b40)) ioctl$TIOCGPGRP(0xffffffffffffffff, 0x540f, &(0x7f0000000cc0)) getsockopt$inet6_IPV6_IPSEC_POLICY(0xffffffffffffffff, 0x29, 0x22, &(0x7f00000010c0)={{{@in6=@mcast2, @in=@remote}}, {{@in6=@local}, 0x0, @in6=@loopback}}, &(0x7f00000011c0)=0xe8) recvfrom$unix(r2, &(0x7f0000000040)=""/4, 0xebc3276d6d4b1cd2, 0x100100, &(0x7f0000000100)=@abs, 0x930000) openat$selinux_avc_cache_stats(0xffffffffffffff9c, &(0x7f0000000240)='/selinux/avc/cache_stats\x00', 0x0, 0x0) 20:31:00 executing program 3: r0 = socket$inet(0x2, 0x4000000000000001, 0x0) setsockopt$inet_tcp_TCP_CONGESTION(r0, 0x6, 0xd, &(0x7f0000000680)='reno\x00', 0x60c5) r1 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000040)='/dev/vga_arbiter\x00', 0x8342, 0x0) setns(r1, 0x40000000) fcntl$getownex(r0, 0x10, &(0x7f0000000000)) sendto$inet(r0, &(0x7f0000a88f88), 0xfffffffffffffe6e, 0x20000000, &(0x7f0000e68000)={0x2, 0x0, @local}, 0x10) [ 414.810568] binder: 18587:18600 BC_INCREFS_DONE u0000000000000000 no match [ 414.817835] binder: 18587:18600 got reply transaction with no transaction stack [ 414.825582] binder: 18587:18600 transaction failed 29201/-71, size 64-24 line 2922 [ 414.848531] binder: 18650:18652 got transaction with invalid offset (0, min 0 max 0) or object. [ 414.860437] binder: 18653:18658 ioctl 40087602 200001c0 returned -22 [ 414.879691] binder: 18650:18652 transaction failed 29201/-22, size 0-8 line 3200 [ 414.889091] binder: 18650:18652 Release 1 refcount change on invalid ref 0 ret -22 [ 414.901936] binder: BINDER_SET_CONTEXT_MGR already set [ 414.908080] binder: 18650:18663 ioctl 40046207 0 returned -16 [ 414.914333] binder_alloc: 18650: binder_alloc_buf, no vma [ 414.914879] binder: 18650:18663 Release 1 refcount change on invalid ref 0 ret -22 [ 414.928554] binder: 18650:18652 transaction failed 29189/-3, size 0-8 line 3137 [ 414.937257] binder: 18653:18666 BC_CLEAR_DEATH_NOTIFICATION invalid ref 1 [ 414.938922] binder: undelivered TRANSACTION_ERROR: 29201 [ 414.950117] binder: undelivered TRANSACTION_ERROR: 29189 [ 414.954876] binder: 18653:18666 BC_ACQUIRE_DONE u0000000000000000 node 650 cookie mismatch 0000000000000002 != 0000000000000000 [ 414.954900] binder: 18653:18666 BC_ACQUIRE_DONE u0000000000000000 node 650 cookie mismatch 0000000000000003 != 0000000000000000 20:31:00 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000640)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB='\x00c@@\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\b\x00\x00\x00\x00\x00\x00\x00', @ANYPTR=&(0x7f0000000200)=ANY=[], @ANYPTR=&(0x7f0000000240)=ANY=[@ANYBLOB="1000000000000000"]], 0x0, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000380)={0x8, 0x0, &(0x7f0000000500)=[@release], 0x0, 0x0, &(0x7f0000000400)}) [ 414.954934] binder: 18653:18666 BC_REQUEST_DEATH_NOTIFICATION invalid ref 2 [ 414.954957] binder: 18653:18666 BC_INCREFS_DONE u0000000000000000 node 650 cookie mismatch 0000000000000003 != 0000000000000000 [ 414.954965] binder: 18653:18666 got transaction to invalid handle [ 414.954973] binder: 18653:18666 transaction failed 29201/-22, size 40-48 line 3014 [ 415.033353] binder: BINDER_SET_CONTEXT_MGR already set [ 415.038887] binder: 18669:18670 ioctl 40046207 0 returned -16 [ 415.045826] binder: 18669:18670 got transaction with invalid offset (16, min 0 max 0) or object. [ 415.055123] binder: 18669:18670 transaction failed 29201/-22, size 0-8 line 3200 [ 415.064261] binder: 18669:18670 Release 1 refcount change on invalid ref 0 ret -22 [ 415.074444] binder_alloc: binder_alloc_mmap_handler: 18669 20001000-20004000 already mapped failed -16 20:31:01 executing program 5: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$nl_netfilter(r0, &(0x7f0000000080)={&(0x7f0000000100), 0xc, &(0x7f0000000000)={&(0x7f0000000340)=ANY=[@ANYBLOB="140000000301ffff808f00003d88c83f00b516ba"], 0x14}}, 0x0) recvmmsg(r0, &(0x7f00000013c0), 0x1ad, 0x0, &(0x7f0000000c40)={0x77359400}) 20:31:01 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) r1 = dup3(r0, r0, 0x80000) ioctl$RTC_SET_TIME(r1, 0x4024700a, &(0x7f0000000140)={0x6, 0x3, 0xd, 0x8, 0x6, 0x0, 0x6, 0x79, 0x1}) r2 = openat$selinux_policy(0xffffffffffffff9c, &(0x7f0000000100)='/selinux/policy\x00', 0x0, 0x0) r3 = getpid() fstat(r0, &(0x7f0000000480)={0x0, 0x0, 0x0, 0x0, 0x0}) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000000900)={0x0, 0x0, 0x0}, &(0x7f0000000940)=0xc) r6 = gettid() getsockopt$inet_IP_XFRM_POLICY(0xffffffffffffffff, 0x0, 0x11, &(0x7f0000000980)={{{@in6=@remote, @in=@remote, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{}, 0x0, @in6=@mcast2}}, &(0x7f0000000a80)=0xe8) fstat(r0, &(0x7f0000000ac0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) sendmsg$unix(r2, &(0x7f0000000bc0)={&(0x7f00000001c0)=@abs={0x1, 0x0, 0x4e24}, 0x6e, &(0x7f00000003c0)=[{&(0x7f0000000540)="cd9cbe3dedd4beed6a07f5525a8d02bb1c9fe80f35bee276ac4781d3a0b96e4ecdf5c194a9d125e1cd3a72a9549bff6025f2941d6b247820894d861907ef7441558bfa2d6145aa5659a3d859115d66ae396611b5b74b198501c7cb4e2d27dfe7b226769ec8081e2bf3d083480d88efb527816bdfe1e69da398c69b6ca33ea2985f4000b410089b4337d26c5203a425af59d3eab16c827d57756906392819fb44bdb59f2fe91dfb00c54cf95ff4a551956273c1e0591a5b6941c13bef82e712f25a4d49fcd93583be260d6842a3ca757ed4dab7082f", 0xd5}, {&(0x7f0000000680)="009d035f1f08a6eb9c2dabb0070ce1c067ce43a60caf2d9a431a937db26e571e3048bf9d4d728fb5efa3f923b3b439fd0cf45e1a2bb71768c0bb079634f6813d564e78fb0db0c35ddfa8ca08e04d0bb31a510a315b84702d585c8f040e58503beb5f6bf67da74a29b2fb1bda01214db449a317c9c7b8073b685bb1a868bdcb066005ad5b7fcd15fa81064591e55be291f577636d0d68d64f3ea77e88a8a4e588a4de2610a5d8793831f087ee5b0aa70920d0c8c81ea4da32d0d387c20c7425a158f441", 0xc3}, {&(0x7f0000000780)="4698057a978ff7a5e8d30175d3ab1c061234e08e275f726b01db40db9b35143bd4bd7b685ea00d33b82cc948ffcc26100598587e7c2b304cdc43aa593aba725b411352ce36ba2102df495e64f3f0d44694a76cbb5046e1045e4927fa09cf65e9ec0bca6f9240d0a432f9dd8bdd105b412a7fae45a029984cbf7d757c210233970579e24e3e", 0x85}, {&(0x7f0000000280)="5dac5baf9b35ea34a7059bcabc970aae241c6fc8eeb64cd18ae939fdf3c8df74755a770fc3f681136e26839f54ba696f38770e121c1e2e9f8ed4d826989f7c27ab360d555707e88288329a69167a4fc7d28ed8774b04277bb7a344003c275acd85b3c216877baca5399f2bc60df213d42a3156a7e9cfb793", 0x78}, {&(0x7f0000000840)="cb01e808b7cb7f45314e5325903480ff162f4eda102be99acdc301d3fbedc55a562cef689097f4abc324a8be04f1fb3fe7474086aad650f265b5a20ac9a865d859328d33cb8f131617ab3d5f980a9be63d80a33d9f5a54b2659d1c0acf8a525d0cea3a63dd0524952059fd75b77e4f7f8c50eb5b2c0d73bb187b60f86d3484cdf741795f1b0be68addbfc5cda815da5399566e51d33c5e4a5e0fba3e91204432467ac3a4eb6e8cebb36efb667a6ccd04cc7ba6363693a5a237ac106810c9", 0xbe}], 0x5, &(0x7f0000000b40)=[@cred={0x20, 0x1, 0x2, r3, r4, r5}, @cred={0x20, 0x1, 0x2, r6, r7, r8}, @rights={0x30, 0x1, 0x1, [r0, r0, r0, r0, r0, r0, r0]}], 0x70, 0x20000000}, 0x801) r9 = syz_open_dev$binder(&(0x7f0000000640)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) openat$apparmor_thread_current(0xffffffffffffff9c, &(0x7f00000000c0)='/proc/thread-self/attr/current\x00', 0x2, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r9, 0x0) r10 = accept4(0xffffffffffffff9c, 0x0, &(0x7f0000000000), 0x80000) setsockopt$inet6_tcp_TCP_REPAIR_OPTIONS(r10, 0x6, 0x16, &(0x7f0000000040)=[{0xc, 0x4}], 0x1) ioctl$BINDER_SET_CONTEXT_MGR(r9, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, &(0x7f0000000200), &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r9, 0xc0306201, &(0x7f0000000380)={0x8, 0x0, &(0x7f0000000500)=ANY=[@ANYBLOB="ff3cfffffffffffb"], 0x0, 0x0, &(0x7f0000000400)}) [ 415.084585] binder: BINDER_SET_CONTEXT_MGR already set [ 415.090406] binder: 18669:18672 got transaction with invalid offset (16, min 0 max 0) or object. [ 415.099612] binder: 18669:18670 ioctl 40046207 0 returned -16 [ 415.106584] binder: 18669:18672 transaction failed 29201/-22, size 0-8 line 3200 [ 415.114837] binder: undelivered TRANSACTION_ERROR: 29201 [ 415.120903] binder: undelivered TRANSACTION_ERROR: 29201 [ 415.204983] binder: BINDER_SET_CONTEXT_MGR already set [ 415.210448] binder: 18677:18678 ioctl 40046207 0 returned -16 [ 415.217883] binder: 18677:18678 got transaction with invalid offset (0, min 0 max 0) or object. [ 415.227321] binder: 18677:18678 transaction failed 29201/-22, size 0-8 line 3200 [ 415.235876] binder: 18677:18678 unknown command -49921 [ 415.241247] binder: 18677:18678 ioctl c0306201 20000380 returned -22 20:31:01 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000640)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, &(0x7f0000000200), &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, &(0x7f00000003c0)}) r2 = openat$pfkey(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/net/pfkey\x00', 0x800, 0x0) write$P9_RSTAT(r2, &(0x7f0000000040)={0x7e, 0x7d, 0x1, {0x0, 0x77, 0x8000, 0xfffffffffffff001, {0x8, 0x1, 0x3}, 0x20000000, 0x1, 0x4, 0x7, 0x2f, 'trustedsecurityGPLposix_acl_access!cpusetvmnet1', 0x0, "", 0xd, '/dev/binder#\x00', 0x8, ':selinux'}}, 0x7e) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000380)={0x8, 0x0, &(0x7f0000000500)=ANY=[@ANYBLOB="066304400f000000"], 0x0, 0x0, &(0x7f0000000400)}) [ 415.250537] binder: BINDER_SET_CONTEXT_MGR already set [ 415.255915] binder: 18677:18682 ioctl 40046207 0 returned -16 [ 415.262008] binder: 18677:18678 got transaction with invalid offset (0, min 0 max 0) or object. [ 415.270906] binder: 18677:18682 unknown command -49921 [ 415.276355] binder: 18677:18678 transaction failed 29201/-22, size 0-8 line 3200 [ 415.283914] binder: 18677:18682 ioctl c0306201 20000380 returned -22 [ 415.290682] binder: undelivered TRANSACTION_ERROR: 29201 [ 415.299329] binder: undelivered TRANSACTION_ERROR: 29201 20:31:01 executing program 2: r0 = socket$inet(0x2, 0x0, 0x0) setsockopt$inet_opts(r0, 0x0, 0x0, &(0x7f00000000c0)="8907", 0x2) r1 = memfd_create(&(0x7f0000000280)='[\'posix_acl_access\x00', 0x0) pwritev(r1, &(0x7f00000001c0)=[{&(0x7f0000000200)=',', 0x1}], 0x1, 0x4081806) sendfile(0xffffffffffffffff, r1, &(0x7f00000000c0), 0x20020102000007) pipe(&(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$TIOCEXCL(0xffffffffffffffff, 0x540c) write(r3, &(0x7f00000001c0), 0xfffffef3) vmsplice(r2, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) fstat(r1, &(0x7f0000000b40)) getsockopt$inet6_IPV6_IPSEC_POLICY(0xffffffffffffffff, 0x29, 0x22, &(0x7f00000010c0)={{{@in6=@mcast2, @in=@remote}}, {{@in6=@local}, 0x0, @in6=@loopback}}, &(0x7f00000011c0)=0xe8) recvfrom$unix(0xffffffffffffffff, &(0x7f0000000040)=""/4, 0xebc3276d6d4b1cd2, 0x100100, &(0x7f0000000100)=@abs, 0x930000) openat$selinux_avc_cache_stats(0xffffffffffffff9c, &(0x7f0000000240)='/selinux/avc/cache_stats\x00', 0x0, 0x0) [ 415.325131] binder: BINDER_SET_CONTEXT_MGR already set [ 415.331014] binder: 18684:18685 ioctl 40046207 0 returned -16 [ 415.340483] binder: 18684:18685 got transaction with invalid offset (0, min 0 max 0) or object. [ 415.350483] binder: 18684:18685 transaction failed 29201/-22, size 0-8 line 3200 [ 415.373502] binder: 18684:18685 Release 1 refcount change on invalid ref 15 ret -22 [ 415.387857] binder_alloc: binder_alloc_mmap_handler: 18684 20001000-20004000 already mapped failed -16 [ 415.397588] binder: BINDER_SET_CONTEXT_MGR already set [ 415.403014] binder: 18684:18685 ioctl 40046207 0 returned -16 [ 415.403220] binder: 18684:18691 got transaction with invalid offset (0, min 0 max 0) or object. [ 415.403448] binder: 18684:18691 transaction failed 29201/-22, size 0-8 line 3200 20:31:01 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000640)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB='\x00c@@\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\b\x00\x00\x00\x00\x00\x00\x00', @ANYPTR=&(0x7f0000000200)=ANY=[], @ANYPTR=&(0x7f0000000000)=ANY=[@ANYBLOB="0000000000000000261f9cbff8db7b4b7a97ac02624c204d8f2ca90039a31901db525a4d806ebad668e9fab9e877755f0b9e0a8ae6662d14b944394824f7cdd8b31956aa0566f7262f2745cca789730f0c288d87e3b610e25ec10d74d4ed3c59640924da14722b45b4e1ff1eb209f5644b3d715cef6b1862dee635d6573e554f75cdeb02f8ca2aaaa2a62a2d9117ca85cfff605a59b28b259599eabdf139cd27cbb6e0f2f78b64a205"]], 0x0, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000380)={0x8, 0x0, &(0x7f0000000500)=[@release], 0x0, 0x0, &(0x7f0000000400)}) [ 415.426463] binder: undelivered TRANSACTION_ERROR: 29201 [ 415.438933] binder: undelivered TRANSACTION_ERROR: 29201 [ 415.458637] binder: BINDER_SET_CONTEXT_MGR already set [ 415.464110] binder: 18695:18696 ioctl 40046207 0 returned -16 [ 415.471623] binder: 18695:18696 got transaction with invalid offset (0, min 0 max 0) or object. [ 415.481267] binder: 18695:18696 transaction failed 29201/-22, size 0-8 line 3200 [ 415.491812] binder: 18695:18696 Release 1 refcount change on invalid ref 0 ret -22 [ 415.501018] binder_alloc: binder_alloc_mmap_handler: 18695 20001000-20004000 already mapped failed -16 [ 415.511189] binder: BINDER_SET_CONTEXT_MGR already set [ 415.516712] binder: 18695:18696 ioctl 40046207 0 returned -16 20:31:01 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000640)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, &(0x7f0000000200), &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000380)={0x8, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="066389abe0417686523d09f4b60983f43d34138151f51ebfdaf9cdbaa4e3c2a85ba168137a"], 0x0, 0x0, &(0x7f0000000400)}) [ 415.522956] binder: 18695:18698 got transaction with invalid offset (0, min 0 max 0) or object. [ 415.532418] binder: 18695:18698 transaction failed 29201/-22, size 0-8 line 3200 [ 415.540434] binder: undelivered TRANSACTION_ERROR: 29201 [ 415.554045] binder: undelivered TRANSACTION_ERROR: 29201 [ 415.566123] binder: BINDER_SET_CONTEXT_MGR already set [ 415.582292] binder: 18699:18701 ioctl 40046207 0 returned -16 [ 415.589528] binder: 18699:18701 got transaction with invalid offset (0, min 0 max 0) or object. [ 415.601061] binder: 18699:18701 transaction failed 29201/-22, size 0-8 line 3200 [ 415.615570] binder: 18699:18701 unknown command -1417059578 [ 415.621303] binder: 18699:18701 ioctl c0306201 20000380 returned -22 [ 415.629863] binder_alloc: binder_alloc_mmap_handler: 18699 20001000-20004000 already mapped failed -16 [ 415.639589] binder: BINDER_SET_CONTEXT_MGR already set [ 415.644999] binder: 18699:18701 ioctl 40046207 0 returned -16 [ 415.645204] binder: 18699:18703 got transaction with invalid offset (0, min 0 max 0) or object. [ 415.645260] binder: 18699:18703 transaction failed 29201/-22, size 0-8 line 3200 [ 415.660597] binder: 18653:18666 ioctl 40087602 200001c0 returned -22 [ 415.661580] binder: BINDER_SET_CONTEXT_MGR already set [ 415.661588] binder: 18653:18666 ioctl 40046207 0 returned -16 [ 415.661997] binder_alloc: 18653: binder_alloc_buf, no vma [ 415.662038] binder: 18653:18704 transaction failed 29189/-3, size 24-8 line 3137 [ 415.662117] binder: 18653:18666 BC_INCREFS_DONE u0000000000000000 no match [ 415.662273] binder: 18653:18666 BC_CLEAR_DEATH_NOTIFICATION invalid ref 1 [ 415.662281] binder: 18653:18666 BC_ACQUIRE_DONE u0000000000000000 no match [ 415.662289] binder: 18653:18666 BC_ACQUIRE_DONE u0000000000000000 no match [ 415.662319] binder: 18653:18666 BC_REQUEST_DEATH_NOTIFICATION invalid ref 2 [ 415.662364] binder: 18653:18666 BC_INCREFS_DONE u0000000000000000 no match [ 415.662370] binder: 18653:18666 got transaction to invalid handle [ 415.662378] binder: 18653:18666 transaction failed 29201/-22, size 40-48 line 3014 [ 415.662460] binder: 18653:18704 Release 1 refcount change on invalid ref 1 ret -22 [ 415.662759] binder: undelivered TRANSACTION_ERROR: 29201 [ 415.662865] binder: send failed reply for transaction 649 to 18653:18666 [ 415.668008] binder: undelivered TRANSACTION_ERROR: 29201 20:31:01 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$FS_IOC_SETVERSION(r0, 0x40087602, &(0x7f00000001c0)) r1 = syz_open_dev$binder(&(0x7f0000000640)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0xfffffffffffffe5b, 0x0, &(0x7f0000000200)=ANY=[@ANYBLOB="168111b6dbb09d5ded12dab8a5e1878b50b56dc7940e1e0200000010003cd9e17360f6bda0513f0251a577f4890e51cb824563ce03fce8725cb588c25f4f3ba8bcd055c847e1a04579088108527050bc10ed0cdc35c2dad6eecbc9286392fd1e51853de8aa3de07defa3f874aa854b1d"], 0x29, 0x0, &(0x7f0000000100)="592dd5031874dead70c1cef779ca92e31328f9bdc5da60e563c2ccdc16e641cefc4fa477b794ce337c"}) r2 = openat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x0, 0x1) ioctl$VT_RELDISP(r2, 0x5605) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000180)={0xfffffffffffffd77, 0x0, &(0x7f00000003c0)=[@register_looper], 0x7caea5380f51429d, 0x0, &(0x7f0000000040)="4d08515090bb4870a12d0011b6696c24282644ac"}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='\x00\x00\x00\x00', @ANYRES64=0x0, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00'], 0x0, 0x0, &(0x7f0000000780)}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000380)={0x8, 0x0, &(0x7f0000000500)=ANY=[@ANYBLOB="0000000001000000"], 0x0, 0x0, &(0x7f0000000400)}) r3 = openat$full(0xffffffffffffff9c, &(0x7f0000000080)='/dev/full\x00', 0x228800, 0x0) ioctl$KDSKBMETA(r3, 0x4b63, &(0x7f00000000c0)=0x2) recvmsg(r2, &(0x7f0000000600)={&(0x7f0000000300)=@pppol2tp={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @remote}}}, 0x80, &(0x7f0000000880)=[{&(0x7f0000000400)=""/130, 0x82}, {&(0x7f0000000540)=""/178, 0xb2}, {&(0x7f0000000680)=""/124, 0x7c}, {&(0x7f0000000700)=""/226, 0xe2}, {&(0x7f00000004c0)=""/32, 0x20}, {&(0x7f0000000800)=""/108, 0x6c}], 0x6, &(0x7f0000000900)=""/4096, 0x1000}, 0x100) 20:31:01 executing program 2: socket$inet(0x2, 0x0, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = memfd_create(&(0x7f0000000280)='[\'posix_acl_access\x00', 0x0) pwritev(r2, &(0x7f00000001c0)=[{&(0x7f0000000200)=',', 0x1}], 0x1, 0x4081806) sendfile(r0, r2, &(0x7f00000000c0), 0x20020102000007) pipe(&(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$TIOCEXCL(0xffffffffffffffff, 0x540c) write(r4, &(0x7f00000001c0), 0xfffffef3) vmsplice(r3, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) fstat(r2, &(0x7f0000000b40)) getsockopt$inet6_IPV6_IPSEC_POLICY(0xffffffffffffffff, 0x29, 0x22, &(0x7f00000010c0)={{{@in6=@mcast2, @in=@remote}}, {{@in6=@local}, 0x0, @in6=@loopback}}, &(0x7f00000011c0)=0xe8) recvfrom$unix(r1, &(0x7f0000000040)=""/4, 0xebc3276d6d4b1cd2, 0x100100, &(0x7f0000000100)=@abs, 0x930000) openat$selinux_avc_cache_stats(0xffffffffffffff9c, &(0x7f0000000240)='/selinux/avc/cache_stats\x00', 0x0, 0x0) 20:31:01 executing program 3: r0 = socket$inet(0x2, 0x4000000000000004, 0xff7fffffffffffff) setsockopt$inet_tcp_TCP_CONGESTION(r0, 0x6, 0xd, &(0x7f0000000040)='hybla\x00', 0x6) sendto$inet(r0, &(0x7f0000000000)="a18bc52da72fb97abd25f330fe054ac90ee7b54b47b35bf96d9cf41a52abce7f4f2d4c15133168a85e078af02f53eeb5f7ee93256b561372", 0x38, 0x0, 0x0, 0x0) sendto$inet(r0, &(0x7f0000a88f88), 0xfffffffffffffe6e, 0x20000000, &(0x7f0000e68000)={0x2, 0x0, @local}, 0xffffffffffffff8a) 20:31:01 executing program 4: r0 = socket$inet(0x2, 0x0, 0x0) setsockopt$inet_opts(r0, 0x0, 0x0, &(0x7f00000000c0)="8907", 0x2) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) r3 = memfd_create(&(0x7f0000000280)='[\'posix_acl_access\x00', 0x0) pwritev(r3, &(0x7f00000001c0)=[{&(0x7f0000000200)}], 0x1, 0x4081806) sendfile(r1, r3, &(0x7f00000000c0), 0x20020102000007) pipe(&(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$TIOCEXCL(0xffffffffffffffff, 0x540c) write(r5, &(0x7f00000001c0), 0xfffffef3) vmsplice(r4, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) fstat(r3, &(0x7f0000000b40)) ioctl$TIOCGPGRP(0xffffffffffffffff, 0x540f, &(0x7f0000000cc0)) getsockopt$inet6_IPV6_IPSEC_POLICY(0xffffffffffffffff, 0x29, 0x22, &(0x7f00000010c0)={{{@in6=@mcast2, @in=@remote}}, {{@in6=@local}, 0x0, @in6=@loopback}}, &(0x7f00000011c0)=0xe8) recvfrom$unix(r2, &(0x7f0000000040)=""/4, 0xebc3276d6d4b1cd2, 0x100100, &(0x7f0000000100)=@abs, 0x930000) openat$selinux_avc_cache_stats(0xffffffffffffff9c, &(0x7f0000000240)='/selinux/avc/cache_stats\x00', 0x0, 0x0) 20:31:01 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0x0, 0x8000000000) r1 = syz_open_dev$binder(&(0x7f0000000640)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, &(0x7f0000000200), &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000380)={0x8, 0x0, &(0x7f0000000500)=[@release], 0x0, 0x0, &(0x7f0000000400)}) 20:31:01 executing program 3: r0 = socket$inet(0x2, 0x4000000000000001, 0x0) getsockopt$IPT_SO_GET_REVISION_MATCH(r0, 0x0, 0x42, &(0x7f0000000000)={'NETMAP\x00'}, &(0x7f0000000040)=0x1e) sendto$inet(r0, &(0x7f0000a88f88), 0xfffffffffffffe6e, 0x20000000, &(0x7f0000e68000)={0x2, 0x0, @local}, 0x10) fcntl$getownex(r0, 0x10, &(0x7f0000000200)={0x0, 0x0}) eventfd(0x2) ptrace$getregset(0x4204, r1, 0x3, &(0x7f0000000180)={&(0x7f0000000100)=""/124, 0x7c}) r2 = memfd_create(&(0x7f0000000080)='\x00', 0x1) ioctl$UI_DEV_DESTROY(r2, 0x5502) [ 415.668011] binder: undelivered TRANSACTION_ERROR: 29189 [ 415.749293] binder: undelivered TRANSACTION_ERROR: 29201 [ 415.749451] binder: undelivered TRANSACTION_ERROR: 29201 [ 415.791524] binder: 18710:18712 ioctl 40087602 200001c0 returned -22 [ 415.850162] binder: 18710:18724 unknown command 0 [ 415.856380] binder: BINDER_SET_CONTEXT_MGR already set [ 415.866670] binder: 18710:18724 ioctl c0306201 200002c0 returned -22 [ 415.874011] binder: 18710:18724 unknown command 0 [ 415.878010] binder: 18721:18723 ioctl 40046207 0 returned -16 [ 415.878442] binder: 18721:18723 got transaction with invalid offset (0, min 0 max 0) or object. [ 415.878501] binder: 18721:18723 transaction failed 29201/-22, size 0-8 line 3200 [ 415.878612] binder: 18721:18723 Release 1 refcount change on invalid ref 0 ret -22 [ 415.885321] binder_alloc: binder_alloc_mmap_handler: 18721 20001000-20004000 already mapped failed -16 [ 415.885410] binder: BINDER_SET_CONTEXT_MGR already set [ 415.885417] binder: 18721:18723 ioctl 40046207 0 returned -16 [ 415.885550] binder: 18721:18731 got transaction with invalid offset (0, min 0 max 0) or object. [ 415.885603] binder: 18721:18731 transaction failed 29201/-22, size 0-8 line 3200 [ 415.885843] binder: undelivered TRANSACTION_ERROR: 29201 [ 415.885947] binder: undelivered TRANSACTION_ERROR: 29201 [ 415.957391] binder: 18710:18724 ioctl c0306201 20000380 returned -22 20:31:02 executing program 5: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) r1 = gettid() fcntl$lock(r0, 0x26, &(0x7f0000000000)={0x1, 0x2, 0x7ff, 0x5, r1}) sendmsg$nl_netfilter(r0, &(0x7f0000000080)={&(0x7f0000000100), 0xc, &(0x7f00000000c0)={&(0x7f0000000180)=ANY=[@ANYBLOB="140000000301ffff808f00003d88c83f00b516bad6f27a2715c227a4f5bf5d675f06b555c795a454cc9eb51f497008db0d52ce9ff0b9e9e62daa89d5f2367470165ebbd546b403524b276841ace53a0145d64c88a7c689bb00098311da04a82863d8daf56e4eb84533c29e96935dd5f21d7e43ecdd32b8ba7a0afc7d4d1c3e3002a1239935e1e7ff0adce69b8ed1d5c5eb9abb2de881684c09e5cc"], 0x14}}, 0x0) recvmmsg(r0, &(0x7f00000013c0), 0x1ad, 0x0, &(0x7f0000000c40)={0x77359400}) r2 = openat$selinux_mls(0xffffffffffffff9c, &(0x7f0000000040)='/selinux/mls\x00', 0x0, 0x0) setsockopt$inet_msfilter(r2, 0x0, 0x29, &(0x7f0000000140)={@rand_addr=0xffff, @dev={0xac, 0x14, 0x14, 0x17}, 0x1, 0x5, [@remote, @broadcast, @empty, @rand_addr=0x9, @dev={0xac, 0x14, 0x14, 0x17}]}, 0x24) 20:31:02 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000640)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="006340400000000000000000000000000000000000000000000000000000000000040000000000000000000019000000000041b432f1a4ee", @ANYPTR=&(0x7f0000000200)=ANY=[], @ANYPTR=&(0x7f0000000240)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00']], 0x0, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000380)={0x8, 0x0, &(0x7f0000000500)=[@release], 0x0, 0x0, &(0x7f0000000400)}) [ 416.128772] binder: BINDER_SET_CONTEXT_MGR already set [ 416.139827] audit: type=1400 audit(1542313862.050:62): avc: denied { lock } for pid=18745 comm="syz-executor5" path="socket:[62691]" dev="sockfs" ino=62691 scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tclass=netlink_netfilter_socket permissive=1 [ 416.160616] binder: 18743:18744 ioctl 40046207 0 returned -16 [ 416.174045] binder_alloc: 18710: binder_alloc_buf size -5458081273396330464 failed, no address space [ 416.209993] binder_alloc: allocated: 0 (num: 0 largest: 0), free: 12288 (num: 1 largest: 12288) [ 416.225826] binder: 18743:18748 Release 1 refcount change on invalid ref 0 ret -22 [ 416.246720] binder: 18743:18744 transaction failed 29201/-28, size 0--5458081273396330471 line 3137 [ 416.271471] binder_alloc: binder_alloc_mmap_handler: 18743 20001000-20004000 already mapped failed -16 [ 416.281691] binder: BINDER_SET_CONTEXT_MGR already set [ 416.287646] binder: 18743:18744 ioctl 40046207 0 returned -16 [ 416.294054] binder_alloc: 18710: binder_alloc_buf size -5458081273396330464 failed, no address space [ 416.304009] binder_alloc: allocated: 0 (num: 0 largest: 0), free: 12288 (num: 1 largest: 12288) 20:31:02 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000640)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="0063404004304c6331f480e3ac8a140a000000000000000000000000000000003a66641b0a646218dd0000000000200000000000bc12a5357ca029b8a4eef8b5f85da7a624cb40f1adad74cf5975642a94710b645ef18d013d50379fe3082105782c36ddee5b4baf4e327ab7a368e0bdec85066b45a4d466929b3e0274d8b1ab3d57cdadc1c69efb3bc02073b6f6061a05476356f21327fc0c4e2c41015e5ae3efeca07dd12f9aa56e4d503f7c1318a69357a942d617547158b3724cc55d5f9ed86cae65301c13326da3dbcc0547a4664f0923a49da900581ff8b052f61b1e1cbcd4e33c49c2cc270135381e2f59925274aa4d9ececc54d274151740a64202", @ANYPTR=&(0x7f0000000200)=ANY=[], @ANYPTR=&(0x7f0000000240)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00']], 0x0, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000380)={0x84034fff559c7e95, 0x0, &(0x7f0000000180)=[@decrefs={0x40046307, 0x3}], 0xffffffffffffffb0, 0x0, &(0x7f00000001c0)}) [ 416.313352] binder: 18743:18748 transaction failed 29201/-28, size 0--5458081273396330471 line 3137 [ 416.323578] binder: undelivered TRANSACTION_ERROR: 29201 [ 416.329645] binder: undelivered TRANSACTION_ERROR: 29201 [ 416.345358] audit: type=1400 audit(1542313862.260:63): avc: denied { search } for pid=469 comm="udevd" name="/" dev="sysfs" ino=1 scontext=system_u:system_r:kernel_t:s0 tcontext=system_u:object_r:vhost_device_t:s0 tclass=dir permissive=1 [ 416.391858] audit: type=1400 audit(1542313862.300:64): avc: denied { search } for pid=469 comm="udevd" name="/" dev="sysfs" ino=1 scontext=system_u:system_r:kernel_t:s0 tcontext=system_u:object_r:vhost_device_t:s0 tclass=dir permissive=1 [ 416.402295] binder: BINDER_SET_CONTEXT_MGR already set [ 416.402302] binder: 18750:18751 ioctl 40046207 0 returned -16 [ 416.404312] binder: 18750:18751 got transaction to invalid handle [ 416.404321] binder: 18750:18751 transaction failed 29201/-22, size 949596873738-2097152 line 3014 [ 416.406171] binder: 18750:18751 DecRefs 0 refcount change on invalid ref 3 ret -22 [ 416.406177] binder: 18750:18751 unknown command 0 [ 416.406184] binder: 18750:18751 ioctl c0306201 20000380 returned -22 [ 416.420877] binder_alloc: binder_alloc_mmap_handler: 18750 20001000-20004000 already mapped failed -16 [ 416.422257] binder: BINDER_SET_CONTEXT_MGR already set [ 416.422264] binder: 18750:18751 ioctl 40046207 0 returned -16 [ 416.422823] binder: 18750:18752 got transaction to invalid handle 20:31:02 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000640)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000003000/0x3000)=nil, 0x3000, 0x0, 0x4001b071, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) recvmmsg(r2, &(0x7f0000001f4c), 0x4000000000001b9, 0x0, 0x0) sendto(r3, &(0x7f0000018000)="f8", 0x1, 0x0, 0x0, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, &(0x7f0000000200), &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000380)={0x8, 0x0, &(0x7f0000000500)=ANY=[@ANYBLOB="066b045040000000"], 0x0, 0x0, &(0x7f0000000400)}) [ 416.422831] binder: 18750:18752 transaction failed 29201/-22, size 949596873738-2097152 line 3014 [ 416.423167] binder: undelivered TRANSACTION_ERROR: 29201 [ 416.423338] binder: undelivered TRANSACTION_ERROR: 29201 [ 416.512487] audit: type=1400 audit(1542313862.420:65): avc: denied { search } for pid=580 comm="udevd" name="/" dev="sysfs" ino=1 scontext=system_u:system_r:kernel_t:s0 tcontext=system_u:object_r:vhost_device_t:s0 tclass=dir permissive=1 [ 416.538275] audit: type=1400 audit(1542313862.450:66): avc: denied { search } for pid=469 comm="udevd" name="/" dev="sysfs" ino=1 scontext=system_u:system_r:kernel_t:s0 tcontext=system_u:object_r:vhost_device_t:s0 tclass=dir permissive=1 [ 416.564465] audit: type=1400 audit(1542313862.470:67): avc: denied { search } for pid=580 comm="udevd" name="/" dev="sysfs" ino=1 scontext=system_u:system_r:kernel_t:s0 tcontext=system_u:object_r:vhost_device_t:s0 tclass=dir permissive=1 [ 416.590262] binder: 18710:18724 ioctl 40087602 200001c0 returned -22 [ 416.595426] audit: type=1400 audit(1542313862.500:68): avc: denied { search } for pid=469 comm="udevd" name="/" dev="sysfs" ino=1 scontext=system_u:system_r:kernel_t:s0 tcontext=system_u:object_r:vhost_device_t:s0 tclass=dir permissive=1 [ 416.598762] audit: type=1400 audit(1542313862.510:69): avc: denied { search } for pid=469 comm="udevd" name="/" dev="sysfs" ino=1 scontext=system_u:system_r:kernel_t:s0 tcontext=system_u:object_r:vhost_device_t:s0 tclass=dir permissive=1 [ 416.605862] audit: type=1400 audit(1542313862.510:70): avc: denied { search } for pid=580 comm="udevd" name="/" dev="sysfs" ino=1 scontext=system_u:system_r:kernel_t:s0 tcontext=system_u:object_r:vhost_device_t:s0 tclass=dir permissive=1 [ 416.677766] binder: BINDER_SET_CONTEXT_MGR already set 20:31:02 executing program 4: r0 = socket$inet(0x2, 0x0, 0x0) setsockopt$inet_opts(r0, 0x0, 0x0, &(0x7f00000000c0)="8907", 0x2) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) r3 = memfd_create(&(0x7f0000000280)='[\'posix_acl_access\x00', 0x0) pwritev(r3, &(0x7f00000001c0)=[{&(0x7f0000000200)=',', 0x1}], 0x1, 0x0) sendfile(r1, r3, &(0x7f00000000c0), 0x20020102000007) pipe(&(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$TIOCEXCL(0xffffffffffffffff, 0x540c) write(r5, &(0x7f00000001c0), 0xfffffef3) vmsplice(r4, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) fstat(r3, &(0x7f0000000b40)) ioctl$TIOCGPGRP(0xffffffffffffffff, 0x540f, &(0x7f0000000cc0)) getsockopt$inet6_IPV6_IPSEC_POLICY(0xffffffffffffffff, 0x29, 0x22, &(0x7f00000010c0)={{{@in6=@mcast2, @in=@remote}}, {{@in6=@local}, 0x0, @in6=@loopback}}, &(0x7f00000011c0)=0xe8) recvfrom$unix(r2, &(0x7f0000000040)=""/4, 0xebc3276d6d4b1cd2, 0x100100, &(0x7f0000000100)=@abs, 0x930000) openat$selinux_avc_cache_stats(0xffffffffffffff9c, &(0x7f0000000240)='/selinux/avc/cache_stats\x00', 0x0, 0x0) [ 416.689019] binder: 18710:18735 ioctl 40046207 0 returned -16 20:31:02 executing program 3: r0 = socket$inet(0x2, 0x4000000000000001, 0x0) setsockopt$inet_tcp_TCP_CONGESTION(r0, 0x6, 0xd, &(0x7f0000000680)='reno\x00', 0x60c5) sendto$inet(r0, &(0x7f0000a88f88), 0xfffffffffffffe6e, 0x20000000, &(0x7f0000e68000)={0x2, 0x0, @local}, 0x10) ioctl$TIOCGPGRP(0xffffffffffffff9c, 0x540f, &(0x7f0000000000)=0x0) sched_setscheduler(r1, 0x5087ee41052b5a94, &(0x7f0000000040)=0x4) [ 416.723789] binder: 18710:18735 unknown command 0 [ 416.725048] binder: 18710:18760 unknown command 0 [ 416.725058] binder: 18710:18760 ioctl c0306201 20000380 returned -22 [ 416.826270] binder: 18710:18735 ioctl c0306201 200002c0 returned -22 20:31:02 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$FS_IOC_SETVERSION(r0, 0x40087602, &(0x7f00000001c0)) r1 = syz_open_dev$binder(&(0x7f0000000640)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="6fcc5901"], 0x1, 0x0, &(0x7f0000000040)='+'}) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='\x00\x00\x00\x00', @ANYRES64=0x0, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00'], 0x0, 0x0, &(0x7f0000000780)}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000380)={0x8, 0x0, &(0x7f0000000500)=[@release={0x40046306, 0x1}], 0x0, 0x0, &(0x7f0000000400)}) 20:31:02 executing program 2: setsockopt$inet_opts(0xffffffffffffffff, 0x0, 0x0, &(0x7f00000000c0)="8907", 0x2) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = memfd_create(&(0x7f0000000280)='[\'posix_acl_access\x00', 0x0) pwritev(r2, &(0x7f00000001c0)=[{&(0x7f0000000200)=',', 0x1}], 0x1, 0x4081806) sendfile(r0, r2, &(0x7f00000000c0), 0x20020102000007) pipe(&(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$TIOCEXCL(0xffffffffffffffff, 0x540c) write(r4, &(0x7f00000001c0), 0xfffffef3) vmsplice(r3, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) fstat(r2, &(0x7f0000000b40)) getsockopt$inet6_IPV6_IPSEC_POLICY(0xffffffffffffffff, 0x29, 0x22, &(0x7f00000010c0)={{{@in6=@mcast2, @in=@remote}}, {{@in6=@local}, 0x0, @in6=@loopback}}, &(0x7f00000011c0)=0xe8) recvfrom$unix(r1, &(0x7f0000000040)=""/4, 0xebc3276d6d4b1cd2, 0x100100, &(0x7f0000000100)=@abs, 0x930000) openat$selinux_avc_cache_stats(0xffffffffffffff9c, &(0x7f0000000240)='/selinux/avc/cache_stats\x00', 0x0, 0x0) [ 416.987786] binder: 18759:18762 got transaction with invalid offset (0, min 0 max 0) or object. [ 417.024376] binder: 18759:18764 unknown command 1342466822 [ 417.033441] binder: 18759:18764 ioctl c0306201 20000380 returned -22 [ 417.066010] binder: 18759:18762 transaction failed 29201/-22, size 0-8 line 3200 20:31:03 executing program 5: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$nl_netfilter(r0, &(0x7f0000000080)={&(0x7f0000000100), 0xc, &(0x7f00000000c0)={&(0x7f0000000340)=ANY=[@ANYBLOB="140000000301ffff808f00003d88c83f00b516ba"], 0x14}}, 0x0) r1 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000000)='/dev/rtc0\x00', 0x841, 0x0) r2 = fcntl$getown(r0, 0x9) stat(&(0x7f0000000300)='./file0\x00', &(0x7f0000000380)={0x0, 0x0, 0x0, 0x0, 0x0}) getresgid(&(0x7f0000000400), &(0x7f0000000440), &(0x7f0000000480)=0x0) ioctl$sock_FIOGETOWN(r0, 0x8903, &(0x7f00000004c0)=0x0) stat(&(0x7f0000000500)='./file0\x00', &(0x7f0000000540)={0x0, 0x0, 0x0, 0x0, 0x0}) getgroups(0x3, &(0x7f00000005c0)=[0xee01, 0xee01, 0xffffffffffffffff]) ioctl$sock_SIOCGPGRP(r0, 0x8904, &(0x7f0000000ac0)=0x0) r9 = geteuid() r10 = getegid() ioctl$sock_FIOGETOWN(r0, 0x8903, &(0x7f00000020c0)=0x0) stat(&(0x7f0000002100)='./file0\x00', &(0x7f0000002140)={0x0, 0x0, 0x0, 0x0, 0x0}) lstat(&(0x7f00000021c0)='./file0\x00', &(0x7f0000002200)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) r14 = getpid() r15 = geteuid() getsockopt$sock_cred(r0, 0x1, 0x11, &(0x7f0000002280)={0x0, 0x0, 0x0}, &(0x7f00000022c0)=0xc) getsockopt$sock_cred(r0, 0x1, 0x11, &(0x7f0000003680)={0x0}, &(0x7f00000036c0)=0xc) getsockopt$inet_IP_XFRM_POLICY(0xffffffffffffff9c, 0x0, 0x11, &(0x7f0000003700)={{{@in6=@mcast1, @in=@multicast2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@dev}, 0x0, @in=@multicast1}}, &(0x7f0000003800)=0xe8) getgroups(0x2, &(0x7f0000003840)=[0xee01, 0xffffffffffffffff]) ioctl$TIOCGPGRP(0xffffffffffffffff, 0x540f, &(0x7f0000003880)=0x0) getsockopt$inet6_IPV6_IPSEC_POLICY(0xffffffffffffffff, 0x29, 0x22, &(0x7f00000038c0)={{{@in=@multicast1, @in6=@remote, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in=@local}, 0x0, @in6=@dev}}, &(0x7f00000039c0)=0xe8) getsockopt$sock_cred(r0, 0x1, 0x11, &(0x7f0000003a00)={0x0, 0x0, 0x0}, &(0x7f0000003a40)=0xc) r23 = getpgrp(0x0) getsockopt$sock_cred(r0, 0x1, 0x11, &(0x7f0000003c00)={0x0, 0x0}, &(0x7f0000003c40)=0xc) r25 = getegid() r26 = getpgid(0x0) stat(&(0x7f0000003c80)='./file0\x00', &(0x7f0000003cc0)={0x0, 0x0, 0x0, 0x0, 0x0}) r28 = getgid() ioctl$sock_FIOGETOWN(r0, 0x8903, &(0x7f0000003d40)=0x0) r30 = geteuid() r31 = getegid() r32 = getpid() getsockopt$sock_cred(r0, 0x1, 0x11, &(0x7f0000003d80)={0x0, 0x0}, &(0x7f0000003dc0)=0xc) lstat(&(0x7f0000003e00)='./file0\x00', &(0x7f0000003e40)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) r35 = getpid() r36 = geteuid() lstat(&(0x7f0000003ec0)='./file0\x00', &(0x7f0000003f00)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) r38 = getpgrp(0xffffffffffffffff) getsockopt$inet6_IPV6_XFRM_POLICY(r0, 0x29, 0x23, &(0x7f0000003f80)={{{@in6=@local, @in6=@mcast1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in=@broadcast}, 0x0, @in6=@mcast1}}, &(0x7f0000004080)=0xe8) r40 = getegid() ioctl$sock_FIOGETOWN(r0, 0x8903, &(0x7f0000004440)=0x0) getsockopt$sock_cred(r0, 0x1, 0x11, &(0x7f0000004480)={0x0, 0x0}, &(0x7f00000044c0)=0xc) getresgid(&(0x7f0000004500)=0x0, &(0x7f0000004540), &(0x7f0000004580)) r44 = getpid() getsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x11, &(0x7f00000045c0)={{{@in6=@mcast2, @in6=@mcast1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in=@rand_addr}, 0x0, @in6=@mcast1}}, &(0x7f00000046c0)=0xe8) getgroups(0x2, &(0x7f0000004700)=[0x0, 0xee01]) r47 = gettid() getsockopt$inet6_IPV6_IPSEC_POLICY(0xffffffffffffff9c, 0x29, 0x22, &(0x7f0000004740)={{{@in, @in=@dev, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in=@rand_addr}, 0x0, @in=@loopback}}, &(0x7f0000004840)=0xe8) fstat(r0, &(0x7f0000004880)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) fcntl$getownex(r0, 0x10, &(0x7f0000004cc0)={0x0, 0x0}) r51 = geteuid() r52 = getgid() r53 = fcntl$getown(r0, 0x9) getsockopt$inet_IP_IPSEC_POLICY(0xffffffffffffffff, 0x0, 0x10, &(0x7f0000004d00)={{{@in=@broadcast, @in=@remote, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6}, 0x0, @in6=@loopback}}, &(0x7f0000004e00)=0xe8) getresgid(&(0x7f0000004e40)=0x0, &(0x7f0000004e80), &(0x7f0000004ec0)) ioctl$sock_SIOCGPGRP(r0, 0x8904, &(0x7f0000004f00)=0x0) r57 = geteuid() stat(&(0x7f0000004f40)='./file0\x00', &(0x7f0000004f80)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) r59 = gettid() stat(&(0x7f0000005000)='./file0\x00', &(0x7f0000005040)={0x0, 0x0, 0x0, 0x0, 0x0}) stat(&(0x7f00000050c0)='./file0\x00', &(0x7f0000005100)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) r62 = gettid() getsockopt$inet_IP_XFRM_POLICY(0xffffffffffffffff, 0x0, 0x11, &(0x7f0000005180)={{{@in6=@ipv4={[], [], @local}, @in6=@remote, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@mcast1}, 0x0, @in6=@ipv4={[], [], @multicast1}}}, &(0x7f0000005280)=0xe8) lstat(&(0x7f00000052c0)='./file0\x00', &(0x7f0000005300)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) getsockopt$sock_cred(r0, 0x1, 0x11, &(0x7f0000005380)={0x0}, &(0x7f00000053c0)=0xc) getsockopt$inet_IP_IPSEC_POLICY(0xffffffffffffffff, 0x0, 0x10, &(0x7f0000005400)={{{@in=@rand_addr, @in6=@mcast1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@loopback}, 0x0, @in=@local}}, &(0x7f0000005500)=0xe8) r67 = getegid() r68 = gettid() stat(&(0x7f0000005dc0)='./file0\x00', &(0x7f0000005e00)={0x0, 0x0, 0x0, 0x0, 0x0}) r70 = getegid() r71 = fcntl$getown(r0, 0x9) getsockopt$inet_IP_XFRM_POLICY(0xffffffffffffff9c, 0x0, 0x11, &(0x7f0000005e80)={{{@in=@remote, @in=@dev, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@mcast1}}}, &(0x7f0000005f80)=0xe8) r73 = getegid() sendmmsg$unix(r1, &(0x7f0000006040)=[{&(0x7f0000000140)=@abs={0x1, 0x0, 0x4e23}, 0x6e, &(0x7f00000002c0)=[{&(0x7f0000000040)="d8ad8ff2c59a58bb13c6efd40fd781f8a0faf1", 0x13}, {&(0x7f00000001c0)="4a14fba9fe2004099db50b2f21f813176eb3935b4e8573f514a0a2ee9160eff1f26d89c0a3b0e29a711c059d485793bb540b237885565c1b6f567637e4a82d4fe467cfce2830c7caed258669a544748d3130b799954e7652ecf10383b5181ea359abd443af15c5a4a1021e4b9fa8d519eb3ecd4579f7229826a2dce6cf77214124b07a3c0aed4dfeb128386fe558c36e6e7e2febbb53", 0x96}, {&(0x7f0000000280)="6c146318a5e114255bffe40d1472eae0476d20cf40514a7d6d2cc04857b9f85775ddcf77325eb1f25a12574fcc", 0x2d}], 0x3, &(0x7f0000000600)=[@rights={0x18, 0x1, 0x1, [r0]}, @rights={0x20, 0x1, 0x1, [r0, r0, r0]}, @cred={0x20, 0x1, 0x2, r2, r3, r4}, @rights={0x20, 0x1, 0x1, [r0, r0, r0]}, @rights={0x20, 0x1, 0x1, [r0, r0, r0]}, @rights={0x28, 0x1, 0x1, [r0, r0, r0, r0, r0]}, @rights={0x18, 0x1, 0x1, [r0]}, @cred={0x20, 0x1, 0x2, r5, r6, r7}], 0xf8, 0x4048080}, {&(0x7f0000000700)=@file={0x1, './file0\x00'}, 0x6e, &(0x7f0000000a40)=[{&(0x7f0000000c80)="c956cab4dcbe21fe4a5e6f201d6a2dec0e890e06a719a4f3b17e7ce251b0ff3f90f0451bc08c5ba5d6b8f6a6088d779731d6c205b1b80c47d16351df7cc189ee97d3989459e1f7339ed790f15fb5e2a306f5d72504a23476498b81ba5b43e348139abfeded98178995715e9fe35a26ed3293948910ed36857eb3030dd0fe80821276e653890d625a1abeea32443a9eba2fe637403a7ba8d0ff4efebbe6d64acf619d89075d8ac08a4d6e0290a705deac0e5eadfe66f75cfb966b2f1fc55f8a7661cca274bcb1433f829dc8e9516fe8dcd1e639cf8078f7dbc49948c49b785f135f5794ad5a3073ce3c8ce44887fe00b7337af74d86a68bbfc83c888b9eea879afc2ab0e1b053be75189d6d344b556507acc347a0ef720836faf45c90252707e2f83eab0619be8858870ccc025547c5a0e27e81a50ab17ec92f965ba689a2fe949dcf1e19986c0c176a4ae9a73b9731e065cfb841c1a8c55e026c00c0b92aa20829709b1c9a91d3642ee321d030ae30d44c974fd70b90f2c35ed921736588fc290b7d323d5f2ad97552c42cfb2f6924235ef9465d74ca3112d557c8d87f42ecc7f39ecb9004a9ea2600eb0a51e44503b6e3c5b52fe972b01b8a317b160391e5251a2f2eee4fb074ca2757b386d9beb600533044d5d26da39d52daec943954599a52738b221a7a86285b3d9341dbb22081926b37d150a64ddf2ea99ab4454c0d54884a4560d7ac770b542cd4ff94acff4a58a300196cc51334990c2f7eb5c820af4886f7809b336013085e193d430fc90e2b9d3079115020bcab7a565fb6672e0f172d10070f0e7fc6a6a12761ae10c67bb58cb9d77f5271e395ca86668b4aa2fb372f839400e3a710bc728d1e2be616b192377642363e8585e3aac5728030edc0c591b20f646636c87b54802900dd1f2dffce83e4f56b71abd9a4a3a8bcb957bcf6f78d9f3f6bfdcfea6548278e62e5f3bdcbc3d032382033b281a56595c88e1751a3b2a3c700fc458de9d15f71297e18b9afb83fdc8536f27d2b6484845940c8773a83cde234c8be5b3d0c31cfd70f88818ab4c69dc24b85765af879182581821e1b73955c11319a4d313a41b923f81bb23648ac5734a70d76844c9a5e1f226116fa18bdcaaf0595d261f581ed9da5f296815577f9920e25ac5122b5b6a3222865c04a8ba9851e5c4890c3dd5eb61f628a0f7a97ad9ace48022f2cc64b35abc2a5666d6a2b3dc8898002fed1bbf0524ebe7ecf73070919a2051902b24532c90fef3d3e9001be970d91b0ad1bb945d1cf3e4736bdc1e32f655ed7fb09ccff71bcfc1ee71c500282dcf5c24cde3fee9abc8bae384e4805c9003ceb260151316a0f6358e75d62059d4e17d451d613c59ddbafa07abd34b9c45a1faf5c37e76d528a96ecec1769b5fb89b6a92694eda97c9ec2bd98f89714479d1623158c73bb9f02274c1ab96f88e94b7180acddbf1cdc6548d44a5c070c2cbcccc9473dd29f49124ae125985dcbffcf652a0a2558142075925bd0ea2b6e4d576fbff62ed54638f86621a370f27fbb6a624093fe68d624b4939d919b32f6644d06e24408296c0aa8add06f524324a62374d72ec1734b7f0365a680d92f3e726195af81b39adca09ad5b6ff6ba6681c22001e5646c20e41f4ac20b650e0217a4388e8106383e855e8fd4f4e45cb41a9d6068639a919927a2748b6f6676fc2e517a67b28d728e2e9d1ec0f433932ef168672c90951e868e2fc47da9b1d9ce88a80f9dd46d2070186626c61b0df246a8140af9fd95d14079a525819d0e283db61d42d5a52e34d456673964f5dd76395e332035e4ba4ef59af5ccdeb1d4cf18fbc9ccd16e641a54e342d08fa77125d0452baa59e28b86751b802c10320011e93be7cfac9af8f7f98dd97b01628b21ff32da9947cf0c606e4cfb9821ae741333d0531c55bbaac24ea5943d00732eead6391b17e4123fe2c2288bddff67cc687ea321ca7c1718de195ac96fd7e634a8935d445c38b306f5140ce371c2b2df9feb58dc97323d40de9e437a7b4f7ab60d5ff7ec3d34cc66e1aa24adff778e6fce09a89ac05334d85dec454208eb62122a4374b651aa54de4c87b31a850bc824a424b911b9f747c4e84b177d13a866b9cdb34f51c30a6f80017d8d1c4a9a31f71c253d0e017aaa9a55c86c49771403621e405b75696793892d1e802f121ce9ea5dd2d95201d29609cd5596912b4b5497f528fddd3701fedfa074229e3cd83b8accb215e726902d51026badb4eeeae1b8ab7191c7526205d9d39fc37a055480ec0c6679143ccaa096481a6e7f7069dd457c91d8976b271397ac80050a1181b633afbd9205e7ac67ef69e7535d29f048eda9286ba9747b2e6c9a2010b3ef1cd688eb8d68c4304bab906b689383458bf9b2079b91ff00a07213de30e99cb444693dd57394d85a61755f0da254bf8b067ca292187bdfe8334f5c0d05ec7bac60e9051601799e1159b59e8c06815075e4f2729b25f6e913af6bb3e5dc6a524f1f1d64cbe56777d0541097be86dc1cf13f8e8ebb26b29d6665154c238d7ad0d4e68a7a5e3ca1d5ed2bf506174bbb9ee016508d094f3b308e9277b4804b756b0ec50d2e667dd10d6b0b6f1f5fb8ea596457e62dc164d610e12425fea18c10d3468be909e6518ee49cf7803abe29f6fcdefb2207155aa9a94a1174ef8be3002b5e223eac5e686b9568d99b2dfc8fd2d599c8f2dc03e4e94c6fca37fe6475677f7d6bf06ac6d5002b461f64166628098bb5419808881e58020c0f580c0eb8543bb4f4001cf5d7eeae44cc4b345273d516ad276354041e8eaccc6ca16811262e32aee2d2d521453a464bff4c2d6557df4c53829581986355c5c6c450aaa288f9f31328c4825de4029e1b50f03a423956d5a1c9c51ab4b3d1a4ac9cbaf241e334cb947faf4c9853c172f0ab4d632878cf83cc36f8a4cdd2e2f370320a418dca6630aaa83af4a1c260e537d657600f97c88903657edae1a5df9417da9b709cdcd524f3964ef2530e62d78b8bbe8bc71dc587e749edf75a41c6f85c3070bd593e491919c8e57fd9eebcab8bd02b423522743b76a2ca23c55c45929757b93ba21f2e1fbdd543bf9e19dc1fdc8d2b3a5a023a466a5f24abec68ac629d5bf937b629a20ed0362da47f012294ccbc95a0266d37c49582397cbece6f59d56853e7c4678de6a8635b1311a6147659345c0b4f64735822f7c07c0d8ceebeb16a6be64d760bce593a1b711f012796117264cc03461c3f8f1ceacc1defe3033e8d74ce7b2bd60b1a1af79a9e599c3c0621ebb8a49692bfd2012241550433a9b64ff75a7904f47be4a53c0eb63760f44d35d086481f2adc159d2ad62a98ab8494a38a4d3c69fa079820ca3ab0492dbfe828724a0768f9c66472250a29059bd94ca0c7e20941fe9a7e71c43c23fc17a4244146980904dd392f6a45febf052f3b4df394ab9daa8d830073d120a19659b0ae067708f48c78826793f31524642abd34028bdcc67ad570c253690afd7b4d495a2d96a761bd26810a024d42ff18aa6ca6419c2183368885f6c43e97e51a53d82360864077974d17af9b3f6f07fae284408122b070a6e3e0c4236297511db834de2580c21e5701c10ff132a39f77033395797e63746771d1338f39d0940c9e37df79c1c742504273328d7f0ba92cf658a8a78a0cded2d941a2a4e643969f4a7fa8f26d5ca24851480e8a26d4620c0d37c8ade0731f42124e04da2f88ba2d36c6d584dddc76933fabd15d4b8efe91fdda4ca31ab43d3c348e3613cebd5dfa889c849a13f05ad8c5bad16716821f16ff97e62e82c4526f4577d16a6ef7b11ffa570195539443563390e88f4eb2d6713a618b397703e5c9b16c18b6965613974bb648e28e42ea8bf2cccab05ab34cb4739979dadaefe5aac64049ef721731abc4364cd183d14407620f38b0f7f3f43abceb3fdcac386fa5b70aecf35add88e40acf017bbb8cc2aafd4e4fe8cf5efffd704580c75d46fbb055d2073d95a1a4c20bdff03b1994c0ac3c17637d0bf89f035673902361863ec036ead69d9080a1cd934f8cf4a2d961523afc496310e3d0755e0bea04e8bac2be16aa721a0b45d599921eaa2d69f3c93b71915aefa64d689d3065544a4358f84cae49b6c8f7d9d89addf3fc385bcf5adffc068f685523c191944edc7be48d054f54ba500d75ccb9701b3cddb6b4dae37d4b6b14fc3099905c948efa8bd29ffe3d6dcbb1b2ca0f0bf4212299fd737e7cdf9025ee3db0cf5bbf70886710d49794d926713e8efc8ebf646897eab062d3f4c2d3f5aa9fde312c50e70229d17d118bc18a628319e1a99a4deb5ae1a6e590c4d8281eaee0088f41b3914ec19d4871f7a82bcfa1a8f3bcca3d46da73176ebef422315fe4448094ca5f3eb2118c5c9ccb593232eb9204f112e2eb89d42673d92d7be7e68615fca88b9441d3d0bfb523705542ff2fbbfa61f188ba2c217ad6f701c47f26aba4bdaabce8dd27881880ee6b4b1cb52094b04a4a06d50fef161185a94acfd0d725d4a0f6dee376ab86453a9224119eab75abebc31c014d4149d886d55697533486e1e7c8c6a7d3eabe39d41cf5bb40454474fab6c7237a03d85859232dd93f290d41b8a0f9ce7dc5b4b1a0baa15dd639bcfb1eb9e44bf5227b112f605a8407d855010b95aefc5ec66d84c5433a4ab56019979f5126b7e8a78d65b077bf6262e1c1dcb81ad4bf768468bacb6a864440d535362c268d69ea314fe0330dfa64e67ffc5c40713dc6b0a54e075469ba628b4f566bb2409e857b83a56da0942d587ae3d395f92bcfde1b66706ed37ed476c4d9e0f3758c9653535f8c4c77de7da382e7ef0afa5f71de3af38eb1d2b767a686644156626cb8b8cd62a1ad518a975270222c8d5f4da07a6533409c4055e035a66e77b6867e9a2e706b5e5fa69ccd206b01cc597c611117fb5229f4ab44ec01096d4fccb7716ae551f154b2031f9e87162feb81ed97f72c77b4573150a5c177900810d71a437efdcab621740c70a6b7ed3e9ed0cca05e23287106f8267eb514e4155e21ca7bb0ebca058b4868428ea55fb1a0a327fbf5b5b2748a2d53fdd57b2425bbd0e8ac4bf7497407d7279afaac328e960491dba715d10b05e7750c346ba3756c7b1ba4e9d5a1711821fc174db01d2b2d9798132790af5cf0c6e9622e9fdb84d57d2047172acfb24c1123bba6f315b4e27035292dd514e0980e441ffa4d452bdbabc527a64c4152624da5f4f8c79acae4e620b19b7ada59bf4e78aabcca3e12371da032393a5e8ba729c9bc3dc6cbcc6b10321ab06dff302071d00bdfcc40170c2e5b051b4d49762921067fc402bcbe2aea89a05e926d6a82331d4e2c43a7bae025dbf46d071b8dc5ecdaab75a24ec5dcc1ddf936e59950fb5c163092456352ea7a93e8b19b6462499ddd8d1608596af735fa912384c6884f5f656e0ddeea94369b69ff1f6fb98adce35081d714a421676471e27ac9cd0e25b891d8f8c0e5ef89b4ce86279c384c1c3547df903c4408866810baa1389c1f05ed653651f32026b2bce8bedb10483cb2b13e98d48181ad518d9805068daf287d077baa0fe7c85afb0e96c293080664d0db1c3e84e0bd41881c1d02fe56f19f59b6a760578406e126a726bf3716fe7fb76fd2a60327be11a83049601044a0deea7aa89e2302a0bcbfe09cc86e13bd8b8c98505daf62a42f21f68ddcd35630c8380be86e164a66fe148d4742691bf51f17d3cda4a09c75d4483f737c7ec23a5c2a0632bae11c10b67c53306817b750e7b0a1e8e3510d572", 0x1000}, {&(0x7f0000000780)="bb4f0bced9e66e4d2c98e1f759927beb7557675862b3a426ef3e523fec6261433612b872410cc3d8911f9672cc4f881b7f0d0458ffe7232394890d60f74b046551ca9401d3f4432b40ce47441a22a50e3c1967b3e17577e2ff3dbb1b4c0d9eaa8de648d94d25a16af1413f8b73", 0x6d}, {&(0x7f0000000800)="9e3fc4001b70fa4a2765632765e5f8cda4dd864130c4c45d740aa385629cc93b0f6d89fd809b155cdf52074bf3488beba5e5fe663ff4690c1f135debc839ed877508ad006ecf01e364f8148c7832ce509baad83045599c0b84a9ae48e7fcaf72e241914a89305ee00e135b1155be4353ee2bd3365b45d907e8a7eeeaeacf1e871acb6dd5dd185e3c27081acd87bc6ae7df0c606f7716980adc8af9114534e176bf6f24", 0xa3}, {&(0x7f00000008c0)="f6d64a6cc4add9073b15f05e7e3e0085e57908b479cdeeefbf21890683714f9fd96e8fec4482d0986c67afed669967b5a9872db8df438e9ff542f16b81db266cd11cfca154def38d814e217566cf37d76bcdc2dc2c655eb6c43e9c84e2e1861b5aaa87628b81a2ea1f02cb", 0x6b}, {&(0x7f0000000940)="e377fa18d9b373c11f0131e0301da10b02f419425778cfe30ec91dd5e622f74bedde7268c2ff840ab71e1617d857e981326a07529a682c78c1e1136dd8dee3a0873f46bb836375993b291c3a7acc2a3f7d520a60f3d3b5826169be7fa1c8b1ab3f259bd5e58654c923bf30ae465f9abb32d14303671b23d0056ed3b4881e157bc485c2e71f5832269985c6366ec1483927409b9de4", 0x95}, {&(0x7f0000000a00)="03659cbe44f4d33026b2297db8af13348e21dcaf3b811dcf307dc2c0c3127cd71171e6f6e8762a2933ef03051ca1ad50ea95cb72e92b63751571d437", 0x3c}], 0x6, &(0x7f0000000b00)=[@cred={0x20, 0x1, 0x2, r8, r9, r10}, @rights={0x20, 0x1, 0x1, [r0, r0, r0, r0]}, @rights={0x20, 0x1, 0x1, [r0, r0, r0]}, @rights={0x28, 0x1, 0x1, [r0, r0, r0, r0, r0, r0]}, @rights={0x20, 0x1, 0x1, [r0, r0, r0, r0]}], 0xa8, 0x54}, {&(0x7f0000000bc0)=@abs={0x0, 0x0, 0x4e22}, 0x6e, &(0x7f0000002040)=[{&(0x7f0000001c80)="4dd6d8c165c171a67e1ad01756c9a4fe213036a6d4d5f894d9f4a050a584b2ad9ddeff1081896d20e68bdb7f34f7c018010d5b0342b07f6a9659181e2ba4ceed2bc5324655827b27edd14712afabd69344c6d9af9bde6317c506ec09f2f649bd361f834ac56827e033e5ab5968d661e146f18e92c34b2047931b9c39b2d77f00d63f5d618492389013c069f2d175cada0fb879140984aa67b2fd66a72ff900c1564b0841912c2b0e376f340d547dab7f499ada8bad7cb0c1b64fd38620cbcc1fb6a06cc6b86b056a798b72b5ac84685524c8cd4e6855061085e20a0886e18301d3c546c3c7b883d80fa1a5ef3d92", 0xee}, {&(0x7f0000001d80)="690a91258ec747812aa20a026658ee2c9f45e1d1621bfb657db1778702f9d0551d0eaf2d32844dd2e37887dc946529e102b751007e5d5b1f5b968a6fa74ffd8932c1760a99622194a8aadcb01527deb90d104f1d8408f83a7a67e13c008af1e476b311b8bd447aabf7896628c6842d7dc6f844b7ee78", 0x76}, {&(0x7f0000001e00)="c7cd1d5fce27a1d6a6c39181eb8b55cc20d475a3512d0b856fe19d233ff3fc157d05f8327847b2817f82fd5a78bee4dce4282380bc2974cbea4a570dec", 0x3d}, {&(0x7f0000001e40)="02d57ae4811fd6d1108d03794b84415d08bad38beb6cc883c11b274b618377f2533823df0fc1f3e7c61ef03523b47ead1994915bc0ea73f3f94a102819198c5df47bee7dc9f92cfcf936c7ccd524855f8b3bbbb07be1f0eb7e7c655d4a05d5d369f617b2f955298761da9cce17f99512ee20f07ea8839d1ea1ebad883e9969ebab38", 0x82}, {&(0x7f0000001f00)="ba2005ef0145ed497c30762cc1910eb61fa066aec911993b4935ffb5ce4234c0ebfe2e0c576f7795a7b5247f1bba97efd8c8bd3719d22964c2947c0fdf2fcdc5a55eb46ccd19af8252c0e48d6c51cf0c6b06a1e7284cffa2d216304c55cb36bb523a6789b1921c8ed54c1434a8aac620a30de4c7d404788165902cef93d4f91300f04e7b8628bb24b2cc778cf4cbc4a2b83e5a1bd5f52a5a7e69ecb77090356c315d571584674792f49e132c060fa2e0e50051494bb028c63675e79feb0a5b35d0a2ec0802cfbb90cb17f3042475ef3f1f44343e8b62f2db0d93ba6de0b86730c57bca77", 0xe4}, {&(0x7f0000002000)="1f0154a85989c2e3d2b0f5954d1945a239918408c7", 0x15}], 0x6, &(0x7f0000002300)=[@cred={0x20, 0x1, 0x2, r11, r12, r13}, @rights={0x28, 0x1, 0x1, [r0, r0, r0, r0, r0]}, @cred={0x20, 0x1, 0x2, r14, r15, r16}, @rights={0x20, 0x1, 0x1, [r0, r0, r0]}, @rights={0x28, 0x1, 0x1, [r0, r0, r0, r0, r0, r0]}], 0xb0, 0x44015}, {&(0x7f00000023c0)=@file={0x1, './file0\x00'}, 0x6e, &(0x7f0000003600)=[{&(0x7f0000002440)="6af315755f4ab7a6359a15c850b4f671a935b70419c1f5809249f32c5c1992175a592791c7e8923274a18769ef9344a95399ec448ee51dad57e1b5af4b8ac12c14e26278b7cd38b2a8a63a8f0a1b19243887ea92677fd446a528e6ab135910c36cc685aa9b8c366010bc811b4e19c87f09f60e16f154c14104ad761c6b9b74406ca3d3f8483de69e775a9896f4a8e17d69d1a5c697bcb43d4e6956b73e9e9c59f6664346c044b67d325ace242170efe2afe3fd05b5799c908390ec4bb8a911221bd0288b1807285c31a2deb58fdccd206b2ff04c74ec1eadacd183080d14878b85c637056296c11bed8af0e123514585c3574f16ab98174b5a95f33c", 0xfc}, {&(0x7f0000002540)="000ccac06efc4c91298bfdf85535308f4f312bde13a46ca1261ecb42caeccfd0b008990d80c251dac8aaf60c87a96bf9c2e51fff864533b6ace2f7f3484d7d0096796005f2e5760d6aacf9b3cce097df8d63d0359ddf407ecacf367c87a33fc4c4ea592bf7762e54d8be278d77d702ede4bd7fc776f816125f1b356e4d93da0e9343acaf4d710d2ab76c5e2ce009220c0575d8d531505ec24de60a4f37a920aef02049b7a517e0086565159fcc9ede8aa7b52b36e532c8478639c326e517269564d1ee03423af304fe835f9d80062589c9894b95a4569033217250a3335ee9668f043ddfe6e2c105644fe5630810d5af2ce459928270cfa002cf864f6c5517835f899d10cf7d744fd21320ee10127e446d48a8f64919f320e8026cb96b2c3ee8c5ea54186a57b54a5bb092c5683188d7ee656fde03562fb6251f212eb295ad576c57dbc5a79b4ba10223ed99a19fbc7b133846f6a2bbfd68cf19cd302e8cec944980794595e897e7b465e4fecc3c9ab06ef9a25d45b96cafe622b154ea91691a473de4118e5e8b488701a29e5ee0d884622d2ff03d328eba8199220e786acb4e20e7d8518dfe88106af421995953c344e7780bdb1e25eb27ae8d4cc0b225aea1f66d3bd5d27269285742badf74ffe0a59e5be005f497fc3508acfa7b081b7b66f56d5c44dee13c2fab7c0be697db3f66cf61a90477a397ff54cda69ca1a6ad2ea592279f53c7264dd25c9eab71dd45fa324287a3c5481904d262006ba6ba23a0603e71330f50424f528ae0214947fa5f53f4dba18c567662f62d349ad37cb8145cb49c754199184ba4b010035203db321ac4a7f2713fb396fb98162ab17bb9bd87def8b4f2ee4c26f4cd1123655e1c3cc5745f8cea0189bd067fa7afeb9c0c4bb80807222096933559dd2e39fd568a2bff673c6a56c215372b7ef5eaebdce16ffdc23222d6b340f9677b4deeee0f4958b2f11d7630ce7c53dfa071a93c9817882f40a302524d7ac4e5d51bc397b512935f7635b1cee985c9448db107724f0d73e94a0a2e7601c1b3a167d8da852a2880dbce428d943ca48a15b5cb4290b78a2f8719194f1b57abfc64696d723b803154e4d1c90dd21b0eac86958383c39772a9cc2145c9ddb84c178832ff8071cb44ed29abd4158a9f8464c2a32e137f32ae8a6391d3c2834e5cdab2db903caba82ce4f8b5471fe5113a1b1a2bff7d5869863abcb8d47770e58e86aa1c86273d30c0270530d441cee50f352860877c50a447e1271a8dc9e49f4be56e984510e07474fab028e60a79504db9557b0be0cfabadf783db2de406a163175b1817968aa858f5a743b8d4ded41c101234ab7b7bdba493d82b36b25ec8b530b9c49f3ee5d7488681d29ee8bbbffc60e69729055501cf5ad14387c3105a320dcae72b10e84ad36fa1193b486004bb434dc476504550794968b41fcf8c1d4d0e7f364f249554fc71a892f53775077f5a89b1292098e92227c21fa79b803c4466ef4174f882a33c1105ac263961d9ed55c482ae079cec313a5a86f0b2f7c7cf2fe0cd89c5efbe997dec0c964b651b4db0a8587732e359d7d17720559ae60b5e0c78b9d6705b9d64b87c445b9ac089ea61e8ab872de161d120657664e491103561c00981d0c44b039bd503bb19205a014113a333188c9888d0af4c9d28a4929bf169657e5de4aadec8bb2bce9e24ba385fb07243c9124366e0d39ff8abc32bfb10dd235711da9817690838b821b3e785bcb061738bdbf222018e89f4be7f4ff5563d15d1275cdf2dcec10eaedd8525925d8cbfd117edc9bad032d33b12fca0fe22bf9ab364608ea82b3a852a509d09712caff1df8cbdaddc2bb24b954885efcb652fa575c0d5ab7d819ef7d17585060588f4a048e7479017255b10da9c3a238d8fbd9c5d3331c46d0d089d1484ef9b52e4e5ac101a7d79ee2197055bb1a21117b11a15cbb2b214aebca3402e27b6f5b8e5a2fb3c9a07ce4730dac10e38530da17293e72cf9f8264efbcc398cee841675f805ef1d010373d5662da9c53e677d35b41da3e0dfc1b87d8086f76b8239deadb61c68e3d7c76ae49a8090a33e84b240e27b369a80f9d36a6b10a8e1c691d360247064a0a8b522793e8395029dc0ffcdf454f57153ff50edd22a75936e0ecd084ad148f5a0d209d7b0aaeef2b57fe93ded76a3565cc045be6114eba81ae718b010576a162f3f042281577138881853392af14e30c56306345efd50345107814fb2fc59abcac1a4054ec525bbe1cfb713d06f20b130321bffb83e97593ba1f667da5433eda283aa0dd6c2286ca0a23caad21b34d1a66f79eb96b38c3dd0b9226ba1634336639cd53c71db4adcae64fa5ca72617f3bf3e44df4ddd00fb6f12406265f542efc8e62a60a881bcec84b5534555c58fb40cbf9df1c272c3f42b5ab52ddd0c94d6c338998af4a1dc91528e98eb256ff3d83e752b2361dfdc2b63c76e14288e03637ce1caf3d0e2748c72d7c634212ef23565f3b9be4f413faf22f7c241e097880efdec87219c1ec79d3700a9be71af50a6d94bb0d293dc788d166fb749ed60b96d68a0262591000c966b45e2298e34af7cf1c7566e2bba0f92eb709e10ea8b64d90cb78507c3e7f20fb4a0fcd78cc7ce8007aaee73c75c7303410762159f8f41389efaeceb328b7aa955dc9f19267507974d312cd6485cec780aaa146959c3fbc08e534ba59de248d4c2bf85879b46d8040b0e1a56da68adc061b4698350486fff3a4f556a3b5db89c36929fd020025275218d543868469641db2008382b01d5a93286aebe88c8ce75973c716748f3d84789d8e7552d34cf044847467d8d20ab8de00cbc5bfd23ed147e7068e1a810bafd5ca230c5c0096f6211894cbe3a104bf338d9c91febf9077d179f2d775e847767cfb66908a7948a4ad616ad5fdbda93276d44304b52237fb611c9b09ac524fa3a663c0b923539e1d2273ea50799f2d55731134095f2c1bcac53eb3e9264dffcb7d95ca55732387a601e81a847a9d5bd6f5211819f1db54e28832a444f8b43e69df8e3b84d001d3394916e8db070918b36d75253ae2db99475915ee43e5aa8f4c1239588a9a2ed179adc440f3783f4f2a2c6b014681b00248e9019c839f270f99f31564f0ea8d2b7f33e2df97a2554eff4f9cb9b2afa90b337e317cada545fd27b18ac71447114059e2eb9a812ca8b293ce45e15583178117e6842a4eea4a5136acb24eb0938fe1e5c27bfd3ced7ea0082e48702d9477cf5f31865cea284c9c558b3d5ca8b92aeee32d7cccd0a83f35b3ba069415daa8326dcd96e01d2cfcfb2d19c9868912a2e4fe37e7fded828c888761b3130db75a9c654aaee73c7358b283b4aead190d63171dfa4162c1f2aededfaa3607d4276f9d5b260c8401af7f97c96ba03e3147c964365983a7432af45b04f3e1f084a4e0cb39fd973971be4200d7cfd2ec17f683d4b80e62f6ececabe820079a89d4b9095fdcb3ad81b9bff5274f94cb524dbc58f036595f22f67c934a8979a1e42819a237c0cd0dd4620ef2ceb3d2625a2e386e709bee1f781249e4f2061cf64510f27bae8c85eb3404359a290354bfeb5f0c1de387333d1c5f43613a44eba218e2667f19a55eec78ff4d02960210f38bf6a1fddbdd113219df9a45a72f7df619452536024856f493415fe5c3be41488bf6e9279876e2420ec8ff37a5d93de59f466b41743cd54e76186e9e2c6e4184cf7f0e4e40cd7ddf6acadd7807e6114130abd89deaf887fd18d8ba3a255bdb10d6825d60044acc80e271cf48a21e9dbeb4f3538fc4c542e48d53956aa7f178b49b23d842fdfdade7f7b310eba773f8f3ec3b34024e99f6b24c2d3adc7765b5d1e00cf830bf51b4ce31fc471bcc1c70ace55429114b88790da42baaab0d2a17b536b429eceb80d7b5d8db7b17a63c39079d4cf9c1b5c9b1cc536dbcc921143f6580df4fd3e54c40c6debc4384b4556e65f67d0f0e56dc88dfb0bb86530b3d6a5092f37f91ee5d882e841b448c01e59edaa63b9fbd215a1e9defbf15977d68ba450a6056659ff523f175cfea128981f4329e0f1e7a4f8f0b1c90e903407e529b7c9632d64d3736b8c27b53871ea65aa6b1a253f6cdad8253cac9831769dd93237de9f9c6c771087554ddc117effdef526f26a12a9fcdd1d1bc9e1f7eba75bbd82437c796487e0cad40c21fe01df209b49bb2427e74b8489c85147b0bc36f5c12961ce9ae5b1048eb59843edc19ac21abbda6076c859be56e38dfd17beee537ccbede2d2d8d47950c1040cf2005bff10c1839db94e516d9281137872d7bef761f151f83c0ce89b42cb8b93019a4e938aec93a39e89fa098f9d2809ea17ad45910c0a3a2c60f44a03bbbc62d5ec0ec84df4e78aca5b752bb5b6c90830e134fe447e8f8eeaa00590f6986a03994179d8a6eff55fcdc04f215d06805bb5a1315de41ef81aa2d01f172bc276bd45a4d9559f4a46f0ca1eff2962321c1b8662d10b75e22b85441d2aacec46daa63c8be995b893cb31f3fd90fd7fd08a63da6db9e3f27de661fd8c316a023e0758d471483a3a1777a93191a85434b135930be0c8c339e740ab090cf422627f75ff1e313b970ad5341e5878943a835f4224e78f1658732724ff37760d0687650ba9f2a1dfd72e681a231bce2428a899973d639c80728a5974c122e92e2c4b12fc44872c4ffe87a0b4043961f68707668e5f40c910aaf0a8ec6227aa7e155672bdec7ba6d9755060614ccc41187bdaddfd770d85beb043a0602928981383a7124481b9ab45f78ebe525f2a05fda1adbbcf46cf2b52bdcffefdea5d0c14142ecaf1459301e688434386c80a873de8a427cd2f237558b0faa87a7eeae903d8ab4b73d16447802bf92045e4811632cb95ca42ccffb4627439093ad1984cfce33d962c88040306d9261c5ed748a185211bcb4c988ddb5771f2037aa40e050513e05c676e05f546722f530c8018e4e41a5f0e18a776bc0a6ecee974d08ad0881c90d03b54a2e66d0c7e669237a933542b215046029499fd9d5a72e49488a2aeeffdb5bb953f42bd1cbc457e9ca96d6eb7f59d59ac01bd221127e86e4ee9eb65843da0aa7b20db8b2b66cb09632b8168d5f9e370d4ab69f956403e423324a0bb693ddeeaef776985cf71c73e1a787a05a605ba8bb65978a2a6e8e0b78f6c12a13f6c384fd0e01ebfdda963a19b735715a3b256d3db5c414778944e7eb228ffd241a3618aa31c323da6a5e23344d95f15b88e7553a4b29846c5aa88ae2f8587a7286300cddb0d788c08642f690791e86e5ae9bef2e2293661eaf71e3600a767b8b1e39289923d6731f7bc39f445c30d2e6845fd78eed0d701bb555ad9519d4290d1613ab455335f51c3019a1a68ce1bce08ec1a3316c15cca608a65c78fc4da9e566928a91a74ddd437b4d11c162630f7e3a13249c6760706f603fdf187a89e90d0376b9c78de3d552de65b07c7c77e25e8e47fc4910b3634ff538acb40da3987f03a048c62758a4128be5b625e0249c96303d51c4e8cf7db0f28e5896003a6a751b801fe12e3a87729469de5f0f0629aa8a6fa979099f1c8af8596c6c846f26d6c1670434f8236b697d8f69a4af4417aad1fa0d89729dbe28147050b5bdcede3bdcbd3f60d4ff88fd584fde8d835822854e433469d0760355c066119c613a6fc9c24da0386e40fbfa52e7de74188e5505dd8b1c2ac0795172ca036b7de2fc6e5dab3b9cedc355102fadb9a3f5a67cf0d259ca306b30995d48acc3b6bb2b4cafe0b9f19a3381ac835f17de83c0f3049", 0x1000}, {&(0x7f0000003540)="b5c137f6cc4fc73b2e762a1b2b44d83f08a14fbbbc793649107d096b8db8efde50", 0x21}, {&(0x7f0000003580)="e8ab24165b2c9298509ab6b920d367787942b365e5c274742e64a841800621fc73279b9ba3f0ea01b139c619be6a5b9149139755", 0x34}, {&(0x7f00000035c0)="ce715e9cef11ae00d006b99e12b5eccedc56e7d7495075b76c251d2e7a8ffaf249afc8664f8644eeb87b8cf7d61b29bfebaf", 0x32}], 0x5, &(0x7f0000003a80)=[@cred={0x20, 0x1, 0x2, r17, r18, r19}, @cred={0x20, 0x1, 0x2, r20, r21, r22}], 0x40, 0x40000}, {&(0x7f0000003ac0)=@file={0x0, './file0\x00'}, 0x6e, &(0x7f0000003bc0)=[{&(0x7f0000003b40)="7f142c969d38ba3543fd9a2324e7ca91fccc6e7bb22d10b4e9e477e9fade4caa48fe9e27c30b002f74393849948ad5b7f77126bc78ce9123611a4cfc5e192a92a5467285abacbf30c3faad665887d0ec3695c342d9cc182c74864e1284cdd1ea9b7bfed0aadc6db7b917", 0x6a}], 0x1, &(0x7f00000040c0)=[@rights={0x18, 0x1, 0x1, [r0]}, @cred={0x20, 0x1, 0x2, r23, r24, r25}, @cred={0x20, 0x1, 0x2, r26, r27, r28}, @rights={0x18, 0x1, 0x1, [r0, r0]}, @cred={0x20, 0x1, 0x2, r29, r30, r31}, @cred={0x20, 0x1, 0x2, r32, r33, r34}, @cred={0x20, 0x1, 0x2, r35, r36, r37}, @cred={0x20, 0x1, 0x2, r38, r39, r40}, @rights={0x38, 0x1, 0x1, [r0, r0, r0, r0, r0, r0, r0, r0, r0]}], 0x128, 0x20000000}, {&(0x7f0000004200)=@abs={0x0, 0x0, 0x4e24}, 0x6e, &(0x7f0000004400)=[{&(0x7f0000004280)="0e565093b6536342b70da3001d244744a3932cc329b75369d07dc9ea5921fabd3046afdb461078e82ae278c5ab72f7a17324515df93357b5553ca5d049cca583922291474d97e50be4e2d44360d1d3e39ab1409ddccd892812509ab8894e20e61b9ebd75e84b49fc27ab1503e7b7f8eb2b745af930538a557bba44028f79e08371fde42da1953fed43237adc427b2b", 0x8f}, {&(0x7f0000004340)="e9655b", 0x3}, {&(0x7f0000004380)="bc03b494891a235d98763a74b29c2f9b006908d39e5dc8b904db30c335b3f0537078baf248f1e5e6632500b42375997b734de3d4fc73934f24e7fa2d63150e08e19d053a120a79a1d1969aa0187b06d636c04ed6099eef11a892c44db241b24b97611980ed46b342792fdf0c6481138edc0836cbf1bb0635e4ec", 0x7a}], 0x3, &(0x7f0000004900)=[@rights={0x18, 0x1, 0x1, [r0, r0]}, @rights={0x28, 0x1, 0x1, [r0, r0, r0, r0, r0, r0]}, @cred={0x20, 0x1, 0x2, r41, r42, r43}, @rights={0x18, 0x1, 0x1, [r0]}, @cred={0x20, 0x1, 0x2, r44, r45, r46}, @cred={0x20, 0x1, 0x2, r47, r48, r49}], 0xb8, 0x40000}, {&(0x7f00000049c0)=@abs={0x0, 0x0, 0x4e23}, 0x6e, &(0x7f0000004c80)=[{&(0x7f0000004a40)="a473095ba9e7d413d62023afe725b361a753974919b4b60a1369b4d59b85c9d1e8a56d362344a38b914a5bc2cf1e9ef9586dc8d2f49f5798e7aa003ba7402fd7ec364fe0ef04c8836e5ef4f00b3e8e98bdfd90a102b477d455712d13d546ab49c376b738bcdbe1a4164d65e98ab1c65ccfc3cba186015af1d2364f9d2f63a6f6", 0x80}, {&(0x7f0000004ac0)="7b6615c66deacad9ba634f9d0cfa7480a53f34dc693bbf70b36cc2b9d5381d199faa83cb145c34550aa07e1cc1ecf1d23b010f03", 0x34}, {&(0x7f0000004b00)="b827a71b24760c6e9b4f22231e38431f2f4a1e07cf01b469152f2a5417f6b81260a9fa3b3c5754997d345c39e804ed5210fc09731e31d02bb2c0f46fd352222de0ddecaf344a4dbe89e7d97b9d9f4444000e403177434e2d9b1bab449f5e61f7063e4ea49b9cacf14fbef52eb79ec10b55df4af67ffa2473fbe9f16746330571cdcdc0b44c3f8e975b0bf56e7c99131316f83f90a68a4b00b10be4a49952", 0x9e}, {&(0x7f0000004bc0)="8d6646b34034ec99910b0b8815311d2b32ef060ae1fdb4c928b077cd2995fc34c80f8a65e9d1683f3fef69d65764658673852990090b6b5a15196c4fd878646caa50fdf0b687014bb6668d0be5082bd11946300f6c17ea69b100c303b85a0f76ce397f8a8043007faf4437dbf536dcd39c14dcb1f4e96ea559976e0b9ecab76dd16f26b0a9d7ef464ac5892dfac100779cee6d80b6d71f47a95cd9d5d2972adbae3c9d3f2e59133651faa8fe9e7b3b7dac6ead683fa4e4d20806f3", 0xbb}], 0x4, &(0x7f0000005540)=[@cred={0x20, 0x1, 0x2, r50, r51, r52}, @cred={0x20, 0x1, 0x2, r53, r54, r55}, @rights={0x18, 0x1, 0x1, [r0, r0]}, @cred={0x20, 0x1, 0x2, r56, r57, r58}, @cred={0x20, 0x1, 0x2, r59, r60, r61}, @rights={0x18, 0x1, 0x1, [r0]}, @rights={0x20, 0x1, 0x1, [r0, r0, r0]}, @cred={0x20, 0x1, 0x2, r62, r63, r64}, @rights={0x30, 0x1, 0x1, [r0, r0, r0, r0, r0, r0, r0, r0]}, @cred={0x20, 0x1, 0x2, r65, r66, r67}], 0x140, 0x40000}, {&(0x7f0000005680)=@abs={0x0, 0x0, 0x4e21}, 0x6e, &(0x7f0000005bc0)=[{&(0x7f0000005700)="bef12d27ee3107ed347c2c595e2c202b4e3760fe23d43c336224c8932474ad4034f52c242cdd94b936eee3ea1ae3f604dd047a603e94c96183a4cedcb73c56afebc749c95398661d46f9ebbfb4627eaa511f35bf4de0fb702e299cee07b7e2467a687e04d42631b797e13848e960789971079f92171967790090474eb6544ce38a2be1fd5fd7a6d3c63ebd37b3fb668254dc53b38708d042bf7fb833ec1255b2a530a25ae016d0195de0bf5a3e4c7df2662feeb3358e51f2fabcbe9c1fca994da9ae59f2f2937e82682dac6ad37687acf7d49d5a0bfe173b88088be6e8aec2834e926f87f68c13b2f9ff2c90c4df79a0", 0xf0}, {&(0x7f0000005800)="be37555bd44ec1cf11c3baac690efb128a87fc938b4bfa146e1459a33ca2bfb530e048407ebc6efcb7daa22c9fdb926e3bf35ab00fd0760179870de35399cb6438c2f694028ba5159493f1d33c4ea38da75a009440fd72114e938e5b9e5948a11e9cebc242cb83972aee0d76b4fb4bc7335dc81b781d9cd7", 0x78}, {&(0x7f0000005880)="9bb54f805c18795f120193b2fa68d5d80e52beba4f7b4918f4110ca0f02f0be80bb7f46b798b116c21964b66c14f8aaa8c914840d6118117590d2e793d2257a9a5e4b50c658447979e71202f86d0a53ca2d94d59e8a623a84f9395aed666f7b396cf00ef6f6e8e7179724920e6845d5ae172986328a0b97ff0d63f6fb50fa44048feb72cd87244f9f1b4e0aeb32d0e053ac4ea4ee6687d6ec2b04c389f65be77d24fb779d874ebde32d231ab", 0xac}, {&(0x7f0000005940)="f729c7622fa11e4be6083a7f3d6ed8111fb1cfa58c3196e91fe12a12d031d487ce2bcd5f082a412e2b9a06d3acb3483fb14968c2cd45810f143248235c1a540766", 0x41}, {&(0x7f00000059c0)="8670904fa3d8f7bef7dcf6570e39c5ec5c4aeb089afc7e9de530fb7adbecd0ab7ba488f60d1948ef779c144cccdcec56391a8e0f127a77b6da7da76b6297f77f3d35cc23778a6890362675b20955ddb07dff23f17c888736cb6845d93aef1f4d33103aab794e3553597770311dd513e1eceb00bf8a215024dcfd8dbb439720fae1edcf4534453fb006589980c3dd35", 0x8f}, {&(0x7f0000005a80)="b0a98ac1af56f8a2a222faf2ee2e5986b98814124f95", 0x16}, {&(0x7f0000005ac0)="7a8cf7a0f4d9011bf6ce61bd6c0bd4be2f58c57cfd106bca076a619b00de15bf04c9a3209b0089ac1d622190420b235787d4a2ff6115132823fcd2db2a3e61f5b4006e5fd0d8c6629689ffe8c7a2bd7702ec1a5763d558cc7ea3a07e4338ca2faeaba321d845b750d990219566baafb69884ad15585b973d46b9a9cdf49e5eb8095d2e859b0fb3677e8b0fa4ee040b2f061f082b8fe4e0748ea45277e9c8291035c700f03f215cd1b7e6ba55eb2761148329be502877b15dec0cf4a5240dd096f175f03e9fa94c8a9abd7ae2e74dc14d483f7094cd31673519b39c2df0140c0875c6fb8b8b746dfe3c67cb90a67156e2440c", 0xf2}], 0x7, &(0x7f0000005c40)=[@rights={0x30, 0x1, 0x1, [r0, r0, r0, r0, r0, r0, r0]}], 0x30, 0x10}, {&(0x7f0000005c80)=@file={0x0, './file0\x00'}, 0x6e, &(0x7f0000005d80)=[{&(0x7f0000005d00)="fadd7f25c34661f66b4271cc72c528c56c6d7ffa3c80dcaabce663721ae63c3c83c3a0432c0d396100f81bc797d0d25a2b3a87582115b1b289dd6c70faeec459adb74143", 0x44}], 0x1, &(0x7f0000005fc0)=[@rights={0x28, 0x1, 0x1, [r0, r0, r0, r0, r0]}, @cred={0x20, 0x1, 0x2, r68, r69, r70}, @cred={0x20, 0x1, 0x2, r71, r72, r73}], 0x68, 0x1}], 0x9, 0x8014) recvmmsg(r0, &(0x7f00000013c0), 0x1ad, 0x0, &(0x7f0000000c40)={0x77359400}) [ 417.228835] binder_alloc: 18759: binder_alloc_buf, no vma [ 417.234467] binder: 18759:18764 transaction failed 29189/-3, size 0-8 line 3137 [ 417.235420] binder: BINDER_SET_CONTEXT_MGR already set [ 417.235428] binder: 18759:18762 ioctl 40046207 0 returned -16 [ 417.273768] binder: 18759:18762 unknown command 1342466822 [ 417.279845] binder: undelivered TRANSACTION_ERROR: 29201 [ 417.297040] binder: 18759:18762 ioctl c0306201 20000380 returned -22 20:31:03 executing program 0: syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f0000000640)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r0, 0x0) r1 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000200)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r1, 0x40045431, &(0x7f00003b9fdc)) read(r1, &(0x7f0000000040)=""/11, 0xb) ioctl$TIOCSETD(r1, 0x5423, &(0x7f0000000140)) r2 = epoll_create1(0x0) epoll_ctl$EPOLL_CTL_ADD(r2, 0x1, r1, &(0x7f00000002c0)) epoll_ctl$EPOLL_CTL_MOD(r2, 0x3, r1, &(0x7f0000000180)) syz_open_pts(r1, 0x4000) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000380)={0x8, 0x0, &(0x7f0000000500)=[@release], 0x0, 0x0, &(0x7f0000000400)}) [ 417.423713] binder: undelivered TRANSACTION_ERROR: 29189 [ 417.625616] binder: 18781:18787 unknown command 22662255 [ 417.681036] binder: 18781:18788 unknown command 0 [ 417.724369] binder: 18781:18787 ioctl c0306201 20000140 returned -22 [ 417.778146] binder: 18781:18788 ioctl c0306201 200002c0 returned -22 [ 417.892025] binder: 18781:18787 ioctl 40087602 200001c0 returned -22 [ 417.902141] binder: 18781:18791 unknown command 22662255 [ 417.911671] binder: 18781:18791 ioctl c0306201 20000140 returned -22 [ 417.955874] binder: BINDER_SET_CONTEXT_MGR already set [ 418.000691] binder: 18781:18791 Release 1 refcount change on invalid ref 1 ret -22 [ 418.009977] binder: 18781:18787 unknown command 0 [ 418.033142] binder_alloc: 18781: binder_alloc_buf, no vma [ 418.041546] binder: 18781:18788 ioctl 40046207 0 returned -16 [ 418.049832] binder: send failed reply for transaction 676 to 18781:18788 [ 418.063525] binder: 18781:18787 ioctl c0306201 200002c0 returned -22 20:31:04 executing program 4: r0 = socket$inet(0x2, 0x0, 0x0) setsockopt$inet_opts(r0, 0x0, 0x0, &(0x7f00000000c0)="8907", 0x2) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = memfd_create(&(0x7f0000000280)='[\'posix_acl_access\x00', 0x0) pwritev(r2, &(0x7f00000001c0)=[{&(0x7f0000000200)=',', 0x1}], 0x1, 0x4081806) sendfile(0xffffffffffffffff, r2, &(0x7f00000000c0), 0x20020102000007) pipe(&(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$TIOCEXCL(0xffffffffffffffff, 0x540c) write(r4, &(0x7f00000001c0), 0xfffffef3) vmsplice(r3, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) fstat(r2, &(0x7f0000000b40)) ioctl$TIOCGPGRP(0xffffffffffffffff, 0x540f, &(0x7f0000000cc0)) getsockopt$inet6_IPV6_IPSEC_POLICY(0xffffffffffffffff, 0x29, 0x22, &(0x7f00000010c0)={{{@in6=@mcast2, @in=@remote}}, {{@in6=@local}, 0x0, @in6=@loopback}}, &(0x7f00000011c0)=0xe8) recvfrom$unix(r1, &(0x7f0000000040)=""/4, 0xebc3276d6d4b1cd2, 0x100100, &(0x7f0000000100)=@abs, 0x930000) openat$selinux_avc_cache_stats(0xffffffffffffff9c, &(0x7f0000000240)='/selinux/avc/cache_stats\x00', 0x0, 0x0) 20:31:04 executing program 2: socket$inet(0x2, 0x0, 0x0) setsockopt$inet_opts(0xffffffffffffffff, 0x0, 0x0, &(0x7f00000000c0)="8907", 0x2) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = memfd_create(&(0x7f0000000280)='[\'posix_acl_access\x00', 0x0) pwritev(r2, &(0x7f00000001c0)=[{&(0x7f0000000200)=',', 0x1}], 0x1, 0x4081806) sendfile(r0, r2, &(0x7f00000000c0), 0x20020102000007) pipe(&(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$TIOCEXCL(0xffffffffffffffff, 0x540c) write(r4, &(0x7f00000001c0), 0xfffffef3) vmsplice(r3, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) fstat(r2, &(0x7f0000000b40)) getsockopt$inet6_IPV6_IPSEC_POLICY(0xffffffffffffffff, 0x29, 0x22, &(0x7f00000010c0)={{{@in6=@mcast2, @in=@remote}}, {{@in6=@local}, 0x0, @in6=@loopback}}, &(0x7f00000011c0)=0xe8) recvfrom$unix(r1, &(0x7f0000000040)=""/4, 0xebc3276d6d4b1cd2, 0x100100, &(0x7f0000000100)=@abs, 0x930000) openat$selinux_avc_cache_stats(0xffffffffffffff9c, &(0x7f0000000240)='/selinux/avc/cache_stats\x00', 0x0, 0x0) [ 418.091918] binder: undelivered TRANSACTION_ERROR: 29189 [ 418.103020] binder: 18781:18796 transaction failed 29189/-3, size 24-8 line 3137 20:31:04 executing program 3: r0 = socket$inet(0x2, 0x4000000000000001, 0x0) setsockopt$inet_tcp_TCP_CONGESTION(r0, 0x6, 0xd, &(0x7f0000000680)='reno\x00', 0x60c5) r1 = socket(0x11, 0xe, 0x0) accept4$unix(r1, &(0x7f0000000000), &(0x7f0000000080)=0x6e, 0x80800) sendto$inet(r0, &(0x7f0000a88f88), 0xfffffffffffffe6e, 0x20000000, &(0x7f0000e68000)={0x2, 0x0, @local}, 0x10) 20:31:04 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$FS_IOC_SETVERSION(r0, 0x40087602, &(0x7f00000001c0)) r1 = syz_open_dev$binder(&(0x7f0000000640)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000000)=[@enter_looper], 0x1, 0x0, &(0x7f0000000040)='+'}) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) socket$inet_udp(0x2, 0x2, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0x0, 0x0, &(0x7f0000000780)}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000380)={0x8, 0x0, &(0x7f0000000500)=[@release={0x40046306, 0x1}], 0x0, 0x0, &(0x7f0000000400)}) 20:31:04 executing program 5: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$nl_netfilter(r0, &(0x7f0000000080)={&(0x7f0000000100), 0xc, &(0x7f00000000c0)={&(0x7f0000000340)=ANY=[@ANYBLOB="140000000301ffff808f00003d88c83f00b516ba"], 0x14}}, 0x0) recvmmsg(r0, &(0x7f00000013c0), 0x1ad, 0x0, &(0x7f0000000c40)={0x77359400}) sendmsg$nl_netfilter(r0, &(0x7f0000000200)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x800000}, 0xc, &(0x7f00000001c0)={&(0x7f0000000380)={0x26c, 0x3, 0x7, 0x800, 0x70bd2d, 0x25dfdbff, {0x7, 0x0, 0x2}, [@generic="e904a3764aee145189cebb91d8f5353ae72bdb0bcf89489f5bd98bf68ca1cc03304731e6dd3eb0e59686d368d02c1009e623a75a3cc42e81c08db11480e335f71c8b289a7449cdeebd8f59a29b3dc18abf01b4b2f30f6c3364475292cfe6fcf28fb932afd337113216a658f52637d4b45239e33c0650ae0d4c76b03fefcbd5caf70d06da26816558720dadf62b1b947849b568b5b2157e2f02", @generic="1b27e6f594fb675428e76b920159850e194f37fba7ea9f51a1e494293f30ae9e33cbdc1ad6b9d52e008a3d96264433fc7eb63cd0d3460544b0a873a1b67f30e90c12a7a063e1ab6cacb0cea858f56f64b3682c2251baaaad5c4e1c9a0b151a317df13f6bfdfd9b2692f878301bba8327e06b32aae9117b54d436fa09f7addb8c27c96a257986d527966947c38143274d44d5e13c98fd79991bf6f24c12869bdf7145f30b9471971558782bf91166ff07f7c4ef8a1d92b125323c4c64dfe623749de605a032ba9692814436f366e364c341fe0362368996b1d4967e732881e9cac298fcfd7abfa6623742d18bb7085d14b10ab111067bd1a61d538f9fb97206", @typed={0x8, 0x21, @str='\x00'}, @typed={0x8, 0x92, @ipv4=@multicast1}, @generic="98f940a5df22c08d8a072572ce7826e9954d950afb696074ab5aa34f2027333931366c0838f918c7bc5400902375d0f7c50dcf585d54a5a4cf9347d22ff1a8fc4e3fc9608ba997bcaf94b7b4ec4a8f109ee6100910df193763f4a620fb74ad4dd2078856a96881a1e0022920559684de0fcb20859b8202e4d799a7b0c132cb066b2e1d4e2ddac78a5b5dfb0c0265e5391163891e9f1bf45757dc52b1865d32d7a6cf3ffa55d832e7", @typed={0x8, 0x7, @ipv4=@remote}]}, 0x26c}, 0x1, 0x0, 0x0, 0x4000000}, 0x40000) getresgid(&(0x7f0000000000), &(0x7f0000000040), &(0x7f0000000140)=0x0) setfsgid(r1) [ 418.678309] binder: 18801:18804 Release 1 refcount change on invalid ref 0 ret -22 [ 418.752120] binder_alloc: binder_alloc_mmap_handler: 18801 20001000-20004000 already mapped failed -16 [ 418.862599] binder: BINDER_SET_CONTEXT_MGR already set [ 418.868674] binder: 18801:18805 Release 1 refcount change on invalid ref 0 ret -22 [ 418.885640] binder: 18801:18804 ioctl 40046207 0 returned -16 20:31:04 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000640)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, &(0x7f0000000200), &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, &(0x7f00000003c0)}) r2 = memfd_create(&(0x7f0000000040)="5e2c1a63707573657400", 0x6787a2d213269fd2) getsockname(r2, &(0x7f0000000080)=@nfc_llcp, &(0x7f0000000100)=0x80) signalfd4(r1, &(0x7f0000000000)={0x2}, 0x8, 0x800) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000380)={0x8, 0x0, &(0x7f0000000500)=[@release], 0x0, 0x0, &(0x7f0000000400)}) [ 419.077417] binder: 18818:18827 ioctl 40087602 200001c0 returned -22 [ 419.238586] binder_alloc: 18818: binder_alloc_buf, no vma [ 419.293939] binder: 18818:18835 BC_INCREFS_DONE u0000000000000000 no match [ 419.316432] binder: 18818:18833 transaction failed 29189/-3, size 24-8 line 3137 [ 419.349978] binder: 18818:18837 Release 1 refcount change on invalid ref 1 ret -22 20:31:05 executing program 4: r0 = socket$inet(0x2, 0x0, 0x0) setsockopt$inet_opts(r0, 0x0, 0x0, &(0x7f00000000c0)="8907", 0x2) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) r3 = memfd_create(&(0x7f0000000280)='[\'posix_acl_access\x00', 0x0) pwritev(r3, &(0x7f00000001c0)=[{&(0x7f0000000200)=',', 0x1}], 0x1, 0x4081806) sendfile(r1, 0xffffffffffffffff, &(0x7f00000000c0), 0x20020102000007) pipe(&(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$TIOCEXCL(0xffffffffffffffff, 0x540c) write(r5, &(0x7f00000001c0), 0xfffffef3) vmsplice(r4, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) fstat(r3, &(0x7f0000000b40)) ioctl$TIOCGPGRP(0xffffffffffffffff, 0x540f, &(0x7f0000000cc0)) getsockopt$inet6_IPV6_IPSEC_POLICY(0xffffffffffffffff, 0x29, 0x22, &(0x7f00000010c0)={{{@in6=@mcast2, @in=@remote}}, {{@in6=@local}, 0x0, @in6=@loopback}}, &(0x7f00000011c0)=0xe8) recvfrom$unix(r2, &(0x7f0000000040)=""/4, 0xebc3276d6d4b1cd2, 0x100100, &(0x7f0000000100)=@abs, 0x930000) openat$selinux_avc_cache_stats(0xffffffffffffff9c, &(0x7f0000000240)='/selinux/avc/cache_stats\x00', 0x0, 0x0) [ 419.797556] binder: BINDER_SET_CONTEXT_MGR already set [ 419.803601] binder: 18818:18833 ioctl 40087602 200001c0 returned -22 [ 419.821114] binder: 18818:18837 ioctl 40046207 0 returned -16 20:31:05 executing program 3: r0 = socket$inet(0x2, 0x4000000000000001, 0x0) setsockopt$inet_tcp_TCP_CONGESTION(r0, 0x6, 0xd, &(0x7f0000000680)='reno\x00', 0x60c5) setsockopt$inet_tcp_TCP_REPAIR_OPTIONS(r0, 0x6, 0x16, &(0x7f0000000000)=[{0xb, 0x5e947222}, {0x2, 0x4}, {0x0, 0x1}, {0x2, 0xfffffffffffffff7}, {0x2, 0x9}, {0x8, 0x2}, {0x3, 0xff}, {0xb, 0x2}, {0xa}], 0x9) r1 = openat(0xffffffffffffffff, &(0x7f0000000080)='./file0\x00', 0x301000, 0x110) accept$packet(r1, &(0x7f00000001c0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @local}, &(0x7f0000000200)=0x14) getsockopt$inet6_IPV6_XFRM_POLICY(r1, 0x29, 0x23, &(0x7f0000000240)={{{@in6=@local, @in6=@mcast1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in=@remote}, 0x0, @in=@local}}, &(0x7f0000000340)=0xe8) setsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x11, &(0x7f0000000380)={{{@in6=@ipv4={[], [], @loopback}, @in6=@mcast1, 0x4e22, 0x411, 0x4e21, 0x2, 0x2, 0x20, 0xa0, 0x0, r2, r3}, {0x5, 0x6e1, 0x1f, 0x8001, 0x7, 0x3, 0xffffffff, 0x10000}, {0x9, 0xebc, 0xfa9f, 0x3f}, 0xff, 0x6e6bb6, 0x1, 0x1, 0x2}, {{@in6=@ipv4={[], [], @dev={0xac, 0x14, 0x14, 0xd}}, 0x4d2, 0x2b}, 0x0, @in, 0x0, 0x3, 0x0, 0x17e, 0x5, 0x40, 0x1f}}, 0xe8) ioctl$SNDRV_TIMER_IOCTL_PVERSION(r1, 0x80045400, &(0x7f0000000100)) ioctl$EVIOCGEFFECTS(r1, 0x80044584, &(0x7f00000006c0)=""/4096) setsockopt$IP_VS_SO_SET_STARTDAEMON(r0, 0x0, 0x48b, &(0x7f00000000c0)={0x3, 'veth1_to_bridge\x00'}, 0x18) sendto$inet(r0, &(0x7f0000a88f88), 0xffffffffffffff12, 0x20000000, &(0x7f0000e68000)={0x2, 0x0, @local}, 0x10) [ 419.842571] binder_alloc: 18818: binder_alloc_buf, no vma 20:31:05 executing program 2: r0 = socket$inet(0x2, 0x0, 0x0) setsockopt$inet_opts(r0, 0x0, 0x0, &(0x7f00000000c0), 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) r3 = memfd_create(&(0x7f0000000280)='[\'posix_acl_access\x00', 0x0) pwritev(r3, &(0x7f00000001c0)=[{&(0x7f0000000200)=',', 0x1}], 0x1, 0x4081806) sendfile(r1, r3, &(0x7f00000000c0), 0x20020102000007) pipe(&(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$TIOCEXCL(0xffffffffffffffff, 0x540c) write(r5, &(0x7f00000001c0), 0xfffffef3) vmsplice(r4, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) fstat(r3, &(0x7f0000000b40)) getsockopt$inet6_IPV6_IPSEC_POLICY(0xffffffffffffffff, 0x29, 0x22, &(0x7f00000010c0)={{{@in6=@mcast2, @in=@remote}}, {{@in6=@local}, 0x0, @in6=@loopback}}, &(0x7f00000011c0)=0xe8) recvfrom$unix(r2, &(0x7f0000000040)=""/4, 0xebc3276d6d4b1cd2, 0x100100, &(0x7f0000000100)=@abs, 0x930000) openat$selinux_avc_cache_stats(0xffffffffffffff9c, &(0x7f0000000240)='/selinux/avc/cache_stats\x00', 0x0, 0x0) [ 419.868540] binder: 18818:18849 BC_INCREFS_DONE u0000000000000000 no match [ 419.873267] binder: 18818:18835 transaction failed 29189/-3, size 24-8 line 3137 [ 419.897285] binder: 18844:18850 transaction failed 29189/-22, size 0-8 line 3014 20:31:05 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x8000000000000) r1 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000100)='cpuacct.usage_percpu_sys\x00', 0x0, 0x0) write$selinux_attr(r1, &(0x7f0000000180)='system_u:object_r:modules_dep_t:s0\x00', 0x23) r2 = syz_open_dev$binder(&(0x7f0000000640)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r3 = syz_open_dev$binder(&(0x7f00000001c0)='/dev/binder#\x00', 0x0, 0x802) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0) r4 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000540)='IPVS\x00') ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB="0d630000102cfd99e00a1bcd6a88ba6561ad133cac3f61e7e2befb4d8ccc627cf02cd6262e61eedae896d37899e3347f73490ea1b258a78c956c8f59adb7946877b4591f63a1ec26e1905918f5fa5cf5063788dbfdaf95653be9f167188a1e2a71d317df80f5916508e072"], 0xffffffffffffffdc, 0x0, &(0x7f0000000040)='+'}) ioctl$BINDER_SET_CONTEXT_MGR(r3, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) ioctl$RTC_UIE_ON(r1, 0x7003) sendmsg$IPVS_CMD_SET_DEST(r1, &(0x7f0000000480)={&(0x7f0000000000), 0xc, &(0x7f0000000400)={&(0x7f00000003c0)={0x1c, r4, 0x414, 0x70bd2c, 0x25dfdbfc, {}, [@IPVS_CMD_ATTR_TIMEOUT_TCP_FIN={0x8, 0x5, 0x401}]}, 0x1c}}, 0x10) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000380)={0x8, 0x0, &(0x7f0000000500)=[@release={0x40046306, 0x1}], 0x0, 0x0, &(0x7f0000000400)}) [ 419.982507] binder: 18844:18851 got transaction with invalid offset (0, min 0 max 0) or object. [ 420.009997] binder: 18844:18852 Release 1 refcount change on invalid ref 0 ret -22 [ 420.054048] binder: undelivered TRANSACTION_ERROR: 29189 [ 420.097817] binder: 18844:18851 transaction failed 29201/-22, size 0-8 line 3200 20:31:06 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000640)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) r2 = dup2(r1, r1) ioctl$UI_SET_MSCBIT(r2, 0x40045568, 0xc) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, &(0x7f0000000200), &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000380)={0x8, 0x0, &(0x7f0000000500)=[@release], 0x0, 0x0, &(0x7f0000000400)}) getsockopt$packet_buf(r1, 0x107, 0x5, &(0x7f0000000000)=""/33, &(0x7f0000000040)=0x21) [ 420.166353] binder: undelivered TRANSACTION_ERROR: 29201 20:31:06 executing program 5: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$nl_netfilter(r0, &(0x7f0000000080)={&(0x7f0000000100), 0xc, &(0x7f00000000c0)={&(0x7f0000000140)=ANY=[@ANYBLOB="140000000301ffff808f27afce4bc83b00b516ba92ccf2daf1650d0233aa687074f0847b14f9fbeab9f7d2a1e3202119e32765c49119681cdef7e701cd9d2e1545f0ea414c2f1215a1067f4daa678728e3007a089077341ebb4e6c08a56481f185e0aa2c564b3718e6c45fbb78acb1b52d39445ae181aca86f3f81259a5d26015a07008fde16e5ef44e251cd49468c2a830d433cd2665854c1ccb581dbcd9645d1e4b9d1cbb910b7b00ce6"], 0x14}}, 0x0) recvmmsg(r0, &(0x7f00000013c0), 0x1ad, 0x0, &(0x7f0000000c40)={0x77359400}) [ 420.814432] binder_alloc: 18866: binder_alloc_buf, no vma [ 420.843004] binder: 18866:18881 Release 1 refcount change on invalid ref 1 ret -22 [ 420.884906] binder: 18866:18879 transaction failed 29189/-3, size 24-8 line 3137 [ 420.969761] binder: 18876:18883 ioctl 40045568 c returned -22 [ 421.017626] binder: 18876:18884 got transaction with invalid offset (0, min 0 max 0) or object. [ 421.067695] binder: 18876:18883 Release 1 refcount change on invalid ref 0 ret -22 [ 421.113107] binder: 18876:18884 transaction failed 29201/-22, size 0-8 line 3200 [ 421.154672] binder: BINDER_SET_CONTEXT_MGR already set [ 421.170811] audit_printk_skb: 942 callbacks suppressed [ 421.181799] binder: 18866:18879 ioctl 40046207 0 returned -16 [ 421.188687] audit: type=1400 audit(1542313867.100:386): avc: denied { search } for pid=580 comm="udevd" name="/" dev="sysfs" ino=1 scontext=system_u:system_r:kernel_t:s0 tcontext=system_u:object_r:vhost_device_t:s0 tclass=dir permissive=1 [ 421.210791] binder_alloc: binder_alloc_mmap_handler: 18876 20001000-20004000 already mapped failed -16 [ 421.213908] audit: type=1400 audit(1542313867.120:387): avc: denied { call } for pid=18866 comm="syz-executor1" scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tclass=binder permissive=1 [ 421.214576] binder_alloc: 18866: binder_alloc_buf, no vma 20:31:07 executing program 4: r0 = socket$inet(0x2, 0x0, 0x0) setsockopt$inet_opts(r0, 0x0, 0x0, &(0x7f00000000c0)="8907", 0x2) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) r3 = memfd_create(&(0x7f0000000280)='[\'posix_acl_access\x00', 0x0) pwritev(r3, &(0x7f00000001c0)=[{&(0x7f0000000200)=',', 0x1}], 0x1, 0x4081806) sendfile(r1, r3, &(0x7f00000000c0), 0x0) pipe(&(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$TIOCEXCL(0xffffffffffffffff, 0x540c) write(r5, &(0x7f00000001c0), 0xfffffef3) vmsplice(r4, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) fstat(r3, &(0x7f0000000b40)) ioctl$TIOCGPGRP(0xffffffffffffffff, 0x540f, &(0x7f0000000cc0)) getsockopt$inet6_IPV6_IPSEC_POLICY(0xffffffffffffffff, 0x29, 0x22, &(0x7f00000010c0)={{{@in6=@mcast2, @in=@remote}}, {{@in6=@local}, 0x0, @in6=@loopback}}, &(0x7f00000011c0)=0xe8) recvfrom$unix(r2, &(0x7f0000000040)=""/4, 0xebc3276d6d4b1cd2, 0x100100, &(0x7f0000000100)=@abs, 0x930000) openat$selinux_avc_cache_stats(0xffffffffffffff9c, &(0x7f0000000240)='/selinux/avc/cache_stats\x00', 0x0, 0x0) [ 421.214621] binder: 18866:18871 transaction failed 29189/-3, size 24-8 line 3137 [ 421.262638] binder: BINDER_SET_CONTEXT_MGR already set [ 421.266522] binder: 18866:18888 Release 1 refcount change on invalid ref 1 ret -22 [ 421.266626] audit: type=1400 audit(1542313867.080:385): avc: denied { search } for pid=469 comm="udevd" name="/" dev="sysfs" ino=1 scontext=system_u:system_r:kernel_t:s0 tcontext=system_u:object_r:vhost_device_t:s0 tclass=dir permissive=1 [ 421.286645] audit: type=1400 audit(1542313867.190:388): avc: denied { search } for pid=469 comm="udevd" name="/" dev="sysfs" ino=1 scontext=system_u:system_r:kernel_t:s0 tcontext=system_u:object_r:vhost_device_t:s0 tclass=dir permissive=1 20:31:07 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$FS_IOC_SETVERSION(r0, 0x40087602, &(0x7f00000001c0)) r1 = syz_open_dev$binder(&(0x7f0000000640)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = openat$selinux_commit_pending_bools(0xffffffffffffff9c, &(0x7f00000000c0)='/selinux/commit_pending_bools\x00', 0x1, 0x0) epoll_ctl$EPOLL_CTL_ADD(r2, 0x1, r1, &(0x7f0000000100)={0x6}) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="0c179d00"], 0x1, 0x0, &(0x7f0000000040)='+'}) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x42) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0xfffffffffffffec7, 0x0, &(0x7f0000000280)=[@increfs_done], 0x0, 0x0, &(0x7f0000000780)}) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000380)={0x8, 0x0, &(0x7f0000000500)=[@release={0x40046306, 0x1}], 0x0, 0x0, &(0x7f0000000400)}) 20:31:07 executing program 2: r0 = socket$inet(0x2, 0x0, 0x0) setsockopt$inet_opts(r0, 0x0, 0x0, &(0x7f00000000c0)="89", 0x1) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) r3 = memfd_create(&(0x7f0000000280)='[\'posix_acl_access\x00', 0x0) pwritev(r3, &(0x7f00000001c0)=[{&(0x7f0000000200)=',', 0x1}], 0x1, 0x4081806) sendfile(r1, r3, &(0x7f00000000c0), 0x20020102000007) pipe(&(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$TIOCEXCL(0xffffffffffffffff, 0x540c) write(r5, &(0x7f00000001c0), 0xfffffef3) vmsplice(r4, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) fstat(r3, &(0x7f0000000b40)) getsockopt$inet6_IPV6_IPSEC_POLICY(0xffffffffffffffff, 0x29, 0x22, &(0x7f00000010c0)={{{@in6=@mcast2, @in=@remote}}, {{@in6=@local}, 0x0, @in6=@loopback}}, &(0x7f00000011c0)=0xe8) recvfrom$unix(r2, &(0x7f0000000040)=""/4, 0xebc3276d6d4b1cd2, 0x100100, &(0x7f0000000100)=@abs, 0x930000) openat$selinux_avc_cache_stats(0xffffffffffffff9c, &(0x7f0000000240)='/selinux/avc/cache_stats\x00', 0x0, 0x0) [ 421.342230] audit: type=1400 audit(1542313867.250:389): avc: denied { search } for pid=469 comm="udevd" name="/" dev="sysfs" ino=1 scontext=system_u:system_r:kernel_t:s0 tcontext=system_u:object_r:vhost_device_t:s0 tclass=dir permissive=1 [ 421.379349] audit: type=1400 audit(1542313867.290:390): avc: denied { search } for pid=580 comm="udevd" name="/" dev="sysfs" ino=1 scontext=system_u:system_r:kernel_t:s0 tcontext=system_u:object_r:vhost_device_t:s0 tclass=dir permissive=1 20:31:07 executing program 3: r0 = socket$inet(0x2, 0x6, 0x40) getsockopt$inet_IP_IPSEC_POLICY(r0, 0x0, 0x10, &(0x7f0000000140)={{{@in=@multicast2, @in=@loopback}}, {{@in6=@ipv4={[], [], @loopback}}, 0x0, @in6=@ipv4={[], [], @dev}}}, &(0x7f0000000240)=0xe8) r1 = socket$inet(0x2, 0x4000000000000001, 0x0) setsockopt$ARPT_SO_SET_ADD_COUNTERS(r1, 0x0, 0x61, &(0x7f0000000080)={'filter\x00', 0x4}, 0x68) removexattr(&(0x7f0000000000)='./file0\x00', &(0x7f0000000040)=@known='trusted.overlay.origin\x00') setsockopt$inet_tcp_TLS_TX(r1, 0x6, 0x1, &(0x7f0000000100), 0x4) setsockopt$inet_tcp_TCP_CONGESTION(r1, 0x6, 0xd, &(0x7f0000000680)='reno\x00', 0x60c5) sendto$inet(r1, &(0x7f0000a88f88), 0xfffffffffffffe6e, 0x20000000, &(0x7f0000e68000)={0x2, 0x0, @local}, 0x10) [ 421.454221] audit: type=1400 audit(1542313867.360:391): avc: denied { create } for pid=18889 comm="syz-executor5" scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tclass=netlink_netfilter_socket permissive=1 [ 421.513302] audit: type=1400 audit(1542313867.420:392): avc: denied { search } for pid=469 comm="udevd" name="/" dev="sysfs" ino=1 scontext=system_u:system_r:kernel_t:s0 tcontext=system_u:object_r:vhost_device_t:s0 tclass=dir permissive=1 [ 421.540554] audit: type=1400 audit(1542313867.450:393): avc: denied { search } for pid=580 comm="udevd" name="/" dev="sysfs" ino=1 scontext=system_u:system_r:kernel_t:s0 tcontext=system_u:object_r:vhost_device_t:s0 tclass=dir permissive=1 [ 421.601879] audit: type=1400 audit(1542313867.510:394): avc: denied { create } for pid=18889 comm="syz-executor5" scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tclass=netlink_netfilter_socket permissive=1 [ 421.618237] binder: 18876:18883 ioctl 40045568 c returned -22 [ 421.632241] INFO: task syz-executor5:7258 blocked for more than 140 seconds. [ 421.669507] binder: 18876:18885 ioctl 40046207 0 returned -16 [ 421.680285] binder: 18876:18883 Release 1 refcount change on invalid ref 0 ret -22 [ 421.689837] binder_alloc: 18876: binder_alloc_buf, no vma [ 421.697775] binder: undelivered TRANSACTION_ERROR: 29201 [ 421.715854] binder: 18876:18884 transaction failed 29189/-3, size 0-8 line 3137 [ 421.754504] Not tainted 4.4.163+ #122 20:31:07 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000640)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, &(0x7f0000000200), &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000380)={0x8, 0x0, &(0x7f0000000500)=ANY=[@ANYBLOB="1c6304025eb969a1"], 0x0, 0x0, &(0x7f0000000400)}) [ 421.789574] binder: undelivered TRANSACTION_ERROR: 29189 [ 421.810211] "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. [ 421.847804] syz-executor5 D [ 421.860423] binder: 18896:18902 ioctl 40087602 200001c0 returned -22 [ 421.897623] ffff8801c0a4f8e0 [ 421.906452] binder: 18896:18902 unknown command 10295052 20:31:07 executing program 5: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$nl_netfilter(r0, &(0x7f0000000080)={&(0x7f0000000100), 0xc, &(0x7f00000000c0)={&(0x7f0000000340)=ANY=[@ANYBLOB="14000000fa040000000000000088c83fbef89a31"], 0x14}}, 0x0) getsockopt$IP_VS_SO_GET_INFO(r0, 0x0, 0x481, &(0x7f0000000000), &(0x7f0000000040)=0xc) recvmmsg(r0, &(0x7f00000013c0), 0x1ad, 0x0, &(0x7f0000000c40)={0x77359400}) [ 421.946801] 29712 7258 7257 0x00000000 [ 421.977496] ffff8801c0a4f8e0 ffff8801c0a4f8c0 ffff8801cfeea0c8 ffffffff83acf190 [ 421.985610] ffff8801cfeea000 ffff8801db71f180 ffff8801db71f1a8 ffff8801db71e898 [ 421.993674] ffff8801db71e880 ffff8801da6897c0 ffff8801cfee97c0 0000000000000000 [ 422.017051] binder: 18896:18902 ioctl c0306201 20000140 returned -22 [ 422.029059] binder: BINDER_SET_CONTEXT_MGR already set [ 422.034346] binder: 18896:18911 ioctl 40046207 0 returned -16 [ 422.168817] binder: 18896:18902 ioctl 40087602 200001c0 returned -22 [ 422.176328] binder: 18896:18911 unknown command 10295052 [ 422.191003] [ 422.193456] Call Trace: [ 422.222531] binder: BINDER_SET_CONTEXT_MGR already set [ 422.249833] [] ? down_read_failed+0x287/0x580 [ 422.256029] [] schedule+0x7a/0x1b0 [ 422.260732] binder: 18896:18924 Release 1 refcount change on invalid ref 1 ret -22 [ 422.269077] [] schedule_timeout+0x481/0x7b0 [ 422.275063] [] ? usleep_range+0x140/0x140 [ 422.280864] [] ? preempt_schedule_common+0x22/0x60 [ 422.287478] [] ? debug_lockdep_rcu_enabled+0x77/0x90 [ 422.294228] [] ? mark_held_locks+0xc7/0x130 [ 422.300212] [] ? down_read_failed+0xa6/0x580 [ 422.306293] [] ? _raw_spin_unlock_irq+0x27/0x50 [ 422.312606] [] ? down_read_failed+0x287/0x580 [ 422.316574] binder_alloc: 18896: binder_alloc_buf, no vma [ 422.316654] binder: 18896:18902 transaction failed 29189/-3, size 24-8 line 3137 [ 422.316958] binder: 18896:18904 ioctl 40046207 0 returned -16 [ 422.337732] [] ? trace_hardirqs_on_caller+0x38b/0x590 [ 422.344590] [] ? down_read_failed+0x287/0x580 [ 422.350747] [] down_read_failed+0x294/0x580 [ 422.356728] [] ? down_write_failed+0x4f0/0x4f0 [ 422.362952] [] ldsem_down_read+0x94/0xc0 [ 422.368715] [] ? tty_ldisc_ref_wait+0x2b/0xb0 [ 422.374872] [] tty_ldisc_ref_wait+0x2b/0xb0 [ 422.380854] [] tty_ioctl+0x3a7/0x2090 [ 422.386317] [] ? avc_ss_reset+0x110/0x110 [ 422.392109] [] ? no_tty+0xa0/0xa0 [ 422.397225] [] ? __lock_acquire+0xa85/0x5f10 [ 422.403287] [] ? trace_hardirqs_on+0x10/0x10 [ 422.409376] [] ? trace_hardirqs_on+0x10/0x10 [ 422.415463] [] ? check_preemption_disabled+0x3b/0x200 [ 422.422316] [] ? debug_lockdep_rcu_enabled+0x77/0x90 [ 422.429084] [] ? no_tty+0xa0/0xa0 [ 422.434630] [] do_vfs_ioctl+0x63f/0xf40 [ 422.440288] [] ? check_preemption_disabled+0x3b/0x200 [ 422.447172] [] ? ioctl_preallocate+0x1f0/0x1f0 [ 422.453415] [] ? __fget+0x156/0x3d0 [ 422.458723] [] ? __fget+0x47/0x3d0 [ 422.463924] [] ? security_file_ioctl+0x8f/0xc0 [ 422.470184] [] SyS_ioctl+0x8f/0xc0 [ 422.475396] [] entry_SYSCALL_64_fastpath+0x1e/0x9a [ 422.484713] binder: 18896:18911 ioctl c0306201 20000140 returned -22 [ 422.492009] binder: BINDER_SET_CONTEXT_MGR already set [ 422.514236] binder: 18896:18922 ioctl 40046207 0 returned -16 [ 422.514285] binder: send failed reply for transaction 694 to 18896:18904 [ 422.520199] binder: undelivered TRANSACTION_ERROR: 29189 20:31:08 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$FS_IOC_SETVERSION(r0, 0x40087602, &(0x7f00000001c0)) r1 = syz_open_dev$binder(&(0x7f0000000700)='/dev/binder#\x00', 0xffffffffffffffff, 0x80000802) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) r2 = openat$selinux_commit_pending_bools(0xffffffffffffff9c, &(0x7f0000000100)='/selinux/commit_pending_bools\x00', 0x1, 0x0) getsockopt$EBT_SO_GET_ENTRIES(r2, 0x0, 0x81, &(0x7f0000000480)={'filter\x00', 0x0, 0x3, 0xb4, [], 0x8, &(0x7f00000003c0)=[{}, {}, {}, {}, {}, {}, {}, {}], &(0x7f0000000540)=""/180}, &(0x7f0000000180)=0x78) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="0c6304c5"], 0x1, 0x0, &(0x7f0000000040)='+'}) r3 = syz_open_dev$mice(&(0x7f0000000080)='/dev/input/mice\x00', 0x0, 0x400) ioctl$TCSETAW(r3, 0x5407, &(0x7f00000000c0)={0x3, 0x8e, 0xba, 0x1, 0x5, 0x2, 0x5, 0x80b9, 0xfffffffffffff001, 0x401}) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0x0, 0x0, &(0x7f0000000780)}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000380)={0x8, 0x0, &(0x7f0000000500)=[@release={0x40046306, 0x1}], 0x0, 0x0, &(0x7f0000000400)}) 20:31:08 executing program 4: r0 = socket$inet(0x2, 0x0, 0x0) setsockopt$inet_opts(r0, 0x0, 0x0, &(0x7f00000000c0)="8907", 0x2) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) r3 = memfd_create(&(0x7f0000000280)='[\'posix_acl_access\x00', 0x0) pwritev(r3, &(0x7f00000001c0)=[{&(0x7f0000000200)=',', 0x1}], 0x1, 0x4081806) sendfile(r1, r3, &(0x7f00000000c0), 0x20020102000007) pipe(&(0x7f0000000180)={0xffffffffffffffff}) ioctl$TIOCEXCL(0xffffffffffffffff, 0x540c) write(0xffffffffffffffff, &(0x7f00000001c0), 0xfffffef3) vmsplice(r4, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) fstat(r3, &(0x7f0000000b40)) ioctl$TIOCGPGRP(0xffffffffffffffff, 0x540f, &(0x7f0000000cc0)) getsockopt$inet6_IPV6_IPSEC_POLICY(0xffffffffffffffff, 0x29, 0x22, &(0x7f00000010c0)={{{@in6=@mcast2, @in=@remote}}, {{@in6=@local}, 0x0, @in6=@loopback}}, &(0x7f00000011c0)=0xe8) recvfrom$unix(r2, &(0x7f0000000040)=""/4, 0xebc3276d6d4b1cd2, 0x100100, &(0x7f0000000100)=@abs, 0x930000) openat$selinux_avc_cache_stats(0xffffffffffffff9c, &(0x7f0000000240)='/selinux/avc/cache_stats\x00', 0x0, 0x0) [ 422.858969] binder: 18928:18931 got transaction with invalid offset (0, min 0 max 0) or object. [ 422.894382] binder: 18928:18936 unknown command 33841948 20:31:08 executing program 2: r0 = socket$inet(0x2, 0x0, 0x0) setsockopt$inet_opts(r0, 0x0, 0x0, &(0x7f00000000c0)="8907", 0x2) socketpair$unix(0x1, 0x0, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) r3 = memfd_create(&(0x7f0000000280)='[\'posix_acl_access\x00', 0x0) pwritev(r3, &(0x7f00000001c0)=[{&(0x7f0000000200)=',', 0x1}], 0x1, 0x4081806) sendfile(r1, r3, &(0x7f00000000c0), 0x20020102000007) pipe(&(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$TIOCEXCL(0xffffffffffffffff, 0x540c) write(r5, &(0x7f00000001c0), 0xfffffef3) vmsplice(r4, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) fstat(r3, &(0x7f0000000b40)) getsockopt$inet6_IPV6_IPSEC_POLICY(0xffffffffffffffff, 0x29, 0x22, &(0x7f00000010c0)={{{@in6=@mcast2, @in=@remote}}, {{@in6=@local}, 0x0, @in6=@loopback}}, &(0x7f00000011c0)=0xe8) recvfrom$unix(r2, &(0x7f0000000040)=""/4, 0xebc3276d6d4b1cd2, 0x100100, &(0x7f0000000100)=@abs, 0x930000) openat$selinux_avc_cache_stats(0xffffffffffffff9c, &(0x7f0000000240)='/selinux/avc/cache_stats\x00', 0x0, 0x0) 20:31:08 executing program 3: r0 = socket$inet(0x2, 0x4000000000000001, 0x0) setsockopt$inet_tcp_TCP_CONGESTION(r0, 0x6, 0xd, &(0x7f0000000680)='reno\x00', 0x60c5) sendto$inet(r0, &(0x7f0000000000)="44d9585fc48d356948e7cd1163e17873374133f266ddf1901de65275accc16695161244de80f2b68637a283a1ed7ab2b62fa4a6062", 0x35, 0x4080, &(0x7f0000000040)={0x2, 0x0, @local}, 0x10) [ 422.958460] binder: 18928:18931 transaction failed 29201/-22, size 0-8 line 3200 [ 422.995636] binder: 18928:18936 ioctl c0306201 20000380 returned -22 [ 423.063395] binder_alloc: binder_alloc_mmap_handler: 18928 20001000-20004000 already mapped failed -16 [ 423.108582] binder: BINDER_SET_CONTEXT_MGR already set [ 423.118208] binder: 18928:18931 ioctl 40046207 0 returned -16 [ 423.171884] binder_alloc: 18928: binder_alloc_buf, no vma [ 423.212318] binder: undelivered TRANSACTION_ERROR: 29201 [ 423.235767] binder: 18928:18941 transaction failed 29189/-3, size 0-8 line 3137 [ 423.251044] binder: undelivered TRANSACTION_ERROR: 29189 20:31:09 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000640)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) socketpair$inet_icmp_raw(0x2, 0x3, 0x1, &(0x7f0000000040)={0xffffffffffffffff}) setsockopt$IP_VS_SO_SET_EDITDEST(r2, 0x0, 0x489, &(0x7f0000000080)={{0xb6, @broadcast, 0x4e21, 0x2, 'rr\x00', 0x2, 0x3, 0x12}, {@dev={0xac, 0x14, 0x14, 0x1b}, 0x4e21, 0x12003, 0x1fffffffe000, 0x8, 0x5}}, 0x44) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, &(0x7f0000000200), &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, &(0x7f00000003c0)}) openat$selinux_enforce(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/enforce\x00', 0x400042, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000500), 0x0, 0x0, &(0x7f0000000400)}) [ 423.375510] binder: 18943:18944 ioctl 40087602 200001c0 returned -22 [ 423.438006] binder: 18943:18944 unknown command -989568244 [ 423.443644] binder: 18943:18944 ioctl c0306201 20000140 returned -22 [ 423.568375] binder: 18943:18954 BC_INCREFS_DONE node 703 has no pending increfs request 20:31:09 executing program 5: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) accept4(r0, &(0x7f0000000000)=@xdp, &(0x7f0000000140)=0x80, 0x80000) sendmsg$nl_netfilter(r0, &(0x7f0000000080)={&(0x7f0000000100), 0xc, &(0x7f00000000c0)={&(0x7f0000000340)=ANY=[@ANYBLOB="140000000301ffff808f00003d88c83f00b516ba"], 0x14}}, 0x0) recvmmsg(r0, &(0x7f00000013c0), 0x1ad, 0x0, &(0x7f0000000c40)={0x77359400}) 20:31:09 executing program 3: r0 = socket$inet(0x2, 0x4000000000000001, 0x0) r1 = syz_open_dev$mice(&(0x7f0000000040)='/dev/input/mice\x00', 0x0, 0x800) ioctl$TUNSETLINK(r1, 0x400454cd, 0x30f) ioctl$TCXONC(r1, 0x540a, 0xffff) openat$cgroup_ro(r1, &(0x7f0000000000)='io.stat\x00', 0x0, 0x0) fcntl$F_GET_FILE_RW_HINT(r1, 0x40d, &(0x7f0000000100)) setsockopt$inet_tcp_TCP_REPAIR_OPTIONS(r0, 0x6, 0x16, &(0x7f0000000080)=[{0x7, 0x4}, {0x8, 0x9}, {0x8, 0x9}, {0x7, 0x1ff}, {0x3, 0x3}, {0xa, 0x8b92}], 0x4ec) setsockopt$inet_tcp_TCP_CONGESTION(r0, 0x6, 0xd, &(0x7f0000000680)='reno\x00', 0x60c5) ioctl$TIOCGWINSZ(r1, 0x5413, &(0x7f0000000600)) readv(r0, &(0x7f0000000580)=[{&(0x7f0000000140)=""/25, 0x19}, {&(0x7f0000000180)=""/97, 0x61}, {&(0x7f0000000200)=""/144, 0x90}, {&(0x7f00000002c0)=""/10, 0xa}, {&(0x7f0000000300)=""/184, 0xb8}, {&(0x7f00000003c0)=""/212, 0xd4}, {&(0x7f00000004c0)=""/183, 0xb7}], 0x7) sendto$inet(r0, &(0x7f0000a88f88), 0xfffffffffffffe6e, 0x20000000, &(0x7f0000e68000)={0x2, 0x0, @local}, 0x10) [ 423.925697] binder: BINDER_SET_CONTEXT_MGR already set [ 423.947715] binder: 18963:18965 ioctl 40046207 0 returned -16 [ 423.973533] binder: 18963:18966 got transaction with invalid offset (0, min 0 max 0) or object. [ 424.003634] binder: 18963:18966 transaction failed 29201/-22, size 0-8 line 3200 [ 424.065883] binder_alloc: binder_alloc_mmap_handler: 18963 20001000-20004000 already mapped failed -16 20:31:10 executing program 2: r0 = socket$inet(0x2, 0x0, 0x0) setsockopt$inet_opts(r0, 0x0, 0x0, &(0x7f00000000c0)="8907", 0x2) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) r3 = memfd_create(&(0x7f0000000280)='[\'posix_acl_access\x00', 0x0) pwritev(0xffffffffffffffff, &(0x7f00000001c0)=[{&(0x7f0000000200)=',', 0x1}], 0x1, 0x4081806) sendfile(r1, r3, &(0x7f00000000c0), 0x20020102000007) pipe(&(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$TIOCEXCL(0xffffffffffffffff, 0x540c) write(r5, &(0x7f00000001c0), 0xfffffef3) vmsplice(r4, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) fstat(r3, &(0x7f0000000b40)) getsockopt$inet6_IPV6_IPSEC_POLICY(0xffffffffffffffff, 0x29, 0x22, &(0x7f00000010c0)={{{@in6=@mcast2, @in=@remote}}, {{@in6=@local}, 0x0, @in6=@loopback}}, &(0x7f00000011c0)=0xe8) recvfrom$unix(r2, &(0x7f0000000040)=""/4, 0xebc3276d6d4b1cd2, 0x100100, &(0x7f0000000100)=@abs, 0x930000) openat$selinux_avc_cache_stats(0xffffffffffffff9c, &(0x7f0000000240)='/selinux/avc/cache_stats\x00', 0x0, 0x0) [ 424.134997] binder: BINDER_SET_CONTEXT_MGR already set [ 424.140318] binder: 18963:18965 ioctl 40046207 0 returned -16 [ 424.141574] binder: 18943:18954 ioctl 40087602 200001c0 returned -22 [ 424.156607] binder: 18963:18966 got transaction with invalid offset (0, min 0 max 0) or object. [ 424.181083] binder_alloc: binder_alloc_mmap_handler: 18943 20001000-20004000 already mapped failed -16 [ 424.191425] binder: undelivered TRANSACTION_ERROR: 29201 [ 424.201091] binder: 18943:18971 unknown command -989568244 [ 424.207627] binder: 18963:18966 transaction failed 29201/-22, size 0-8 line 3200 [ 424.224479] binder: 18943:18971 ioctl c0306201 20000140 returned -22 20:31:10 executing program 4: r0 = socket$inet(0x2, 0x0, 0x0) setsockopt$inet_opts(r0, 0x0, 0x0, &(0x7f00000000c0)="8907", 0x2) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) r3 = memfd_create(&(0x7f0000000280)='[\'posix_acl_access\x00', 0x0) pwritev(r3, &(0x7f00000001c0)=[{&(0x7f0000000200)=',', 0x1}], 0x1, 0x4081806) sendfile(r1, r3, &(0x7f00000000c0), 0x20020102000007) pipe(&(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$TIOCEXCL(0xffffffffffffffff, 0x540c) write(r4, &(0x7f00000001c0), 0xfffffef3) vmsplice(0xffffffffffffffff, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) fstat(r3, &(0x7f0000000b40)) ioctl$TIOCGPGRP(0xffffffffffffffff, 0x540f, &(0x7f0000000cc0)) getsockopt$inet6_IPV6_IPSEC_POLICY(0xffffffffffffffff, 0x29, 0x22, &(0x7f00000010c0)={{{@in6=@mcast2, @in=@remote}}, {{@in6=@local}, 0x0, @in6=@loopback}}, &(0x7f00000011c0)=0xe8) recvfrom$unix(r2, &(0x7f0000000040)=""/4, 0xebc3276d6d4b1cd2, 0x100100, &(0x7f0000000100)=@abs, 0x930000) openat$selinux_avc_cache_stats(0xffffffffffffff9c, &(0x7f0000000240)='/selinux/avc/cache_stats\x00', 0x0, 0x0) [ 424.237413] binder: BINDER_SET_CONTEXT_MGR already set [ 424.249493] binder: 18943:18970 ioctl 40046207 0 returned -16 [ 424.262324] binder: undelivered TRANSACTION_ERROR: 29201 [ 424.271915] binder_alloc: 18943: binder_alloc_buf, no vma 20:31:10 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000640)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) init_module(&(0x7f0000000000)='/}\x00', 0x3, &(0x7f0000000040)='eth1{bdevself\x00') ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, &(0x7f0000000200), &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000380)={0x8, 0x0, &(0x7f0000000500)=[@release], 0x0, 0x0, &(0x7f0000000400)}) [ 424.282591] binder: 18943:18971 Release 1 refcount change on invalid ref 1 ret -22 [ 424.293462] binder: 18943:18954 BC_INCREFS_DONE u0000000000000000 no match [ 424.321834] binder: send failed reply for transaction 702 to 18943:18944 [ 424.354988] binder: 18943:18975 transaction failed 29189/-3, size 24-8 line 3137 [ 424.360646] 1 lock held by syz-executor5/7258: [ 424.360675] #0: (&tty->ldisc_sem){++++++}, at: [] tty_ldisc_ref_wait+0x2b/0xb0 [ 424.360679] Sending NMI to all CPUs: [ 424.361941] NMI backtrace for cpu 0 [ 424.361945] CPU: 0 PID: 18975 Comm: syz-executor1 Not tainted 4.4.163+ #122 [ 424.361948] task: ffff8801c0e04740 task.stack: ffff8800b6a48000 [ 424.361951] RIP: 0010:[] [] io_serial_in+0x6b/0x90 [ 424.361954] RSP: 0018:ffff8800b6a4f2f0 EFLAGS: 00000002 [ 424.361957] RAX: dffffc0000000000 RBX: 00000000000003fd RCX: 0000000000000000 [ 424.361960] RDX: 00000000000003fd RSI: ffffffff81cbb7a1 RDI: ffffffff84966558 [ 424.361963] RBP: ffff8800b6a4f300 R08: 0000000000000001 R09: 0000000000000000 [ 424.361967] R10: 0000000000000001 R11: ffffffff83fd7192 R12: ffffffff84966520 [ 424.361970] R13: 0000000000000020 R14: fffffbfff092cceb R15: fffffbfff092ccad [ 424.361973] FS: 00007efc85d60700(0000) GS:ffff8801db600000(0000) knlGS:0000000000000000 [ 424.361976] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 424.361979] CR2: 00007f4806552db8 CR3: 00000000b8b3b000 CR4: 00000000001606b0 [ 424.361982] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 424.361985] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 424.361987] Stack: [ 424.361990] ffffffff84966520 0000000000002708 ffff8800b6a4f350 ffffffff81cbd89f [ 424.361993] ffffffff81acdd15 ffffffff84966568 ffffffff8496675a ffffffff84966520 [ 424.361997] 0000000000000069 ffffffff81cbd9f0 dffffc0000000000 0000000000000069 [ 424.361998] Call Trace: [ 424.362001] [] wait_for_xmitr+0x8f/0x1e0 [ 424.362004] [] ? vsnprintf+0x1a5/0x18e0 [ 424.362007] [] ? wait_for_xmitr+0x1e0/0x1e0 [ 424.362009] [] serial8250_console_putchar+0x1f/0x60 [ 424.362012] [] uart_console_write+0x59/0xf0 [ 424.362015] [] serial8250_console_write+0x539/0x830 [ 424.362018] [] ? serial8250_release_port+0x20/0x20 [ 424.362021] [] ? scnprintf+0x110/0x110 [ 424.362024] [] ? simple_strtoul+0x30/0x30 [ 424.362026] [] ? univ8250_console_setup+0xf0/0xf0 [ 424.362029] [] univ8250_console_write+0x5f/0x70 [ 424.362033] [] call_console_drivers.constprop.16+0x1ef/0x3f0 [ 424.362035] [] console_unlock+0x605/0xa10 [ 424.362038] [] vprintk_emit+0x3f5/0x830 [ 424.362041] [] vprintk+0x28/0x30 [ 424.362043] [] vprintk_default+0x1d/0x30 [ 424.362046] [] printk+0xaf/0xd7 [ 424.362049] [] ? log_wakeup_reason.cold.1+0x13f/0x13f [ 424.362051] [] ? _raw_spin_unlock+0x2c/0x50 [ 424.362054] [] ? _binder_node_inner_unlock+0x6a/0x80 [ 424.362057] [] binder_transaction.cold.55+0xc8c/0x190f [ 424.362060] [] ? __module_text_address+0x13/0x140 [ 424.362063] [] ? __module_text_address+0x13/0x140 [ 424.362066] [] ? is_module_text_address+0x2a/0x50 [ 424.362069] [] ? binder_poll+0x220/0x220 [ 424.362072] [] ? debug_lockdep_rcu_enabled+0x77/0x90 [ 424.362075] [] ? __might_fault+0x114/0x1d0 [ 424.362078] [] binder_thread_write+0x66a/0x22c0 [ 424.362080] [] ? trace_hardirqs_on+0x10/0x10 [ 424.362083] [] ? binder_transaction+0x6060/0x6060 [ 424.362086] [] ? debug_lockdep_rcu_enabled+0x77/0x90 [ 424.362089] [] ? __might_fault+0x114/0x1d0 [ 424.362092] [] binder_ioctl+0x1111/0x1c50 [ 424.362095] [] ? binder_thread_write+0x22c0/0x22c0 [ 424.362098] [] ? trace_hardirqs_on+0x10/0x10 [ 424.362101] [] ? trace_hardirqs_on+0x10/0x10 [ 424.362104] [] ? debug_lockdep_rcu_enabled+0x77/0x90 [ 424.362107] [] ? _raw_spin_unlock+0x2c/0x50 [ 424.362110] [] ? binder_thread_write+0x22c0/0x22c0 [ 424.362112] [] do_vfs_ioctl+0x63f/0xf40 [ 424.362115] [] ? check_preemption_disabled+0x3b/0x200 [ 424.362118] [] ? ioctl_preallocate+0x1f0/0x1f0 [ 424.362122] [] ? __fget+0x156/0x3d0 [ 424.362124] [] ? __fget+0x47/0x3d0 [ 424.362127] [] ? security_file_ioctl+0x8f/0xc0 [ 424.362129] [] SyS_ioctl+0x8f/0xc0 [ 424.362132] [] entry_SYSCALL_64_fastpath+0x1e/0x9a [ 424.362139] Code: 24 c1 00 00 00 49 8d 7c 24 38 48 b8 00 00 00 00 00 fc ff df 48 89 fa 48 c1 ea 03 d3 e3 80 3c 02 00 75 17 41 03 5c 24 38 89 da ec <5b> 0f b6 c0 41 5c 5d c3 e8 a8 40 7c ff eb c2 e8 01 41 7c ff eb [ 424.362142] NMI backtrace for cpu 1 [ 424.362145] CPU: 1 PID: 20 Comm: khungtaskd Not tainted 4.4.163+ #122 [ 424.362147] task: ffff8801da6f2f80 task.stack: ffff8801d9ed0000 [ 424.362151] RIP: 0010:[] [] flat_send_IPI_mask+0xf6/0x1a0 [ 424.362153] RSP: 0018:ffff8801d9ed7cc8 EFLAGS: 00000046 [ 424.362156] RAX: 0000000000000000 RBX: 0000000000000c00 RCX: 0000000000000000 [ 424.362160] RDX: 0000000000000c00 RSI: 0000000000000000 RDI: ffffffffff5fc300 [ 424.362163] RBP: ffff8801d9ed7cf0 R08: 0000000000000001 R09: 0000000000000000 [ 424.362166] R10: 0000000000000001 R11: 0000000000000001 R12: 0000000000000246 [ 424.362169] R13: 0000000003000000 R14: ffffffff82e5f3a0 R15: 0000000000000002 [ 424.362172] FS: 0000000000000000(0000) GS:ffff8801db700000(0000) knlGS:0000000000000000 [ 424.362175] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 424.362178] CR2: 00007feaacf03848 CR3: 00000001d7dca000 CR4: 00000000001606b0 [ 424.362182] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 424.362185] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 424.362187] Stack: [ 424.362190] ffffffff82e5f3a0 ffffffff831a4760 0000000000000007 fffffbfff06347cc [ 424.362193] 0000000000000008 ffff8801d9ed7d10 ffffffff81093701 ffffffff829220a0 [ 424.362196] 0000000000000003 ffff8801d9ed7d68 ffffffff81ab041e ffffffff813a7cfd [ 424.362198] Call Trace: [ 424.362201] [] nmi_raise_cpu_backtrace+0x61/0x80 [ 424.362204] [] nmi_trigger_all_cpu_backtrace.cold.0+0x70/0xae [ 424.362206] [] ? print_lock+0xa9/0xac [ 424.362210] [] ? irq_force_complete_move+0x350/0x350 [ 424.362213] [] arch_trigger_all_cpu_backtrace+0x14/0x20 [ 424.362215] [] watchdog.cold.0+0xd3/0xee [ 424.362218] [] ? watchdog+0xb0/0x9a0 [ 424.362220] [] kthread+0x268/0x300 [ 424.362223] [] ? reset_hung_task_detector+0x20/0x20 [ 424.362227] [] ? kthread_create_on_node+0x4d0/0x4d0 [ 424.362230] [] ? __schedule+0x7ad/0x1e40 [ 424.362233] [] ? kthread_create_on_node+0x4d0/0x4d0 [ 424.362235] [] ret_from_fork+0x55/0x80 [ 424.362238] [] ? kthread_create_on_node+0x4d0/0x4d0 [ 424.362245] Code: 00 c3 5f ff 80 e6 10 75 e1 41 c1 e5 18 44 89 2c 25 10 c3 5f ff 44 89 fa 09 da 80 cf 04 41 83 ff 02 0f 44 d3 89 14 25 00 c3 5f ff <41> f7 c4 00 02 00 00 75 1a 4c 89 e7 57 9d 0f 1f 44 00 00 e8 c2 [ 424.362400] Kernel panic - not syncing: hung_task: blocked tasks [ 424.362407] CPU: 1 PID: 20 Comm: khungtaskd Not tainted 4.4.163+ #122 [ 424.362417] 0000000000000000 81fb3f2d90104f82 ffff8801d9ed7cb8 ffffffff81aa556d [ 424.362425] ffffffff82870c20 00000000003fff53 7fffffffffffffff 0000000000000004 [ 424.362433] dffffc0000000000 ffff8801d9ed7d78 ffffffff813a1544 0000000041b58ab3 [ 424.362435] Call Trace: [ 424.362444] [] dump_stack+0xc1/0x124 [ 424.362453] [] panic+0x19e/0x359 [ 424.362460] [] ? add_taint.cold.4+0x16/0x16 [ 424.362468] [] ? nmi_trigger_all_cpu_backtrace+0x3df/0x490 [ 424.362476] [] ? nmi_trigger_all_cpu_backtrace+0x3a8/0x490 [ 424.362485] [] ? nmi_trigger_all_cpu_backtrace+0x3a8/0x490 [ 424.362492] [] watchdog.cold.0+0xe4/0xee [ 424.362498] [] ? watchdog+0xb0/0x9a0 [ 424.362506] [] kthread+0x268/0x300 [ 424.362512] [] ? reset_hung_task_detector+0x20/0x20 [ 424.362520] [] ? kthread_create_on_node+0x4d0/0x4d0 [ 424.362528] [] ? __schedule+0x7ad/0x1e40 [ 424.362536] [] ? kthread_create_on_node+0x4d0/0x4d0 [ 424.362542] [] ret_from_fork+0x55/0x80 [ 424.362549] [] ? kthread_create_on_node+0x4d0/0x4d0 [ 424.363333] Kernel Offset: disabled [ 425.192746] Rebooting in 86400 seconds..