CREATE_PORT(r0, 0xc0a85320, &(0x7f0000068f50)={{0x80}, 'por\xff\a\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00t\x00\x00\x00\x00\x00\x1f\x00\x00\xff\xff\xff\xff\xff\xff\xff\xef\x00\x00\x03\xff\x00\x00\x00\x00\x00\x00\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x06\x00', 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2}) 03:39:42 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008fd0)={0x8, 0xa000000, &(0x7f00000000c0)=[@release={0x400c630e}], 0x0, 0x0, 0x0}) 03:39:42 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x4c, 0x0, &(0x7f0000000200)=ANY=[@ANYBLOB="05630440000000030e630c4000f200008c01acbcd9297cf4a76e04ea80b60b21d6efb41548e724db19f05bcf6e830123c34234a0c43903464dd4e9c503844e734e52e396711327b0a8d8cf15"], 0x0, 0x0, 0x0}) [ 866.086914][ T5799] binder: 5798:5799 Acquire 1 refcount change on invalid ref 50331648 ret -22 [ 866.109622][ T5799] binder: 5798:5799 unknown command -368808281 [ 866.119251][ T5799] binder: 5798:5799 ioctl c0306201 20000000 returned -22 03:39:43 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f00000000c0)=[@release={0x400c630f}], 0xfdfdffff00000000, 0x6, 0x0}) 03:39:43 executing program 4: perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80000001f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioprio_set$uid(0x3, 0x0, 0x0) r0 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000200)='/dev/rtc0\x00', 0x40, 0x0) getsockopt$inet_sctp_SCTP_DEFAULT_PRINFO(r0, 0x84, 0x72, &(0x7f0000000240)={0x0, 0xc0, 0x30}, &(0x7f0000000340)=0xc) getsockopt$inet_sctp6_SCTP_RECONFIG_SUPPORTED(0xffffffffffffffff, 0x84, 0x75, &(0x7f0000000300)={r1, 0x100000001}, &(0x7f0000000280)=0x6) setsockopt$inet_sctp6_SCTP_ENABLE_STREAM_RESET(r0, 0x84, 0x76, &(0x7f00000002c0)={r2, 0x1}, 0x8) ioctl$sock_kcm_SIOCKCMCLONE(0xffffffffffffff9c, 0x89e2, &(0x7f00000003c0)={r0}) getsockopt$inet_sctp6_SCTP_DEFAULT_SEND_PARAM(0xffffffffffffff9c, 0x84, 0xa, &(0x7f0000000040)={0x8, 0xa4, 0x2, 0x22919b1d80, 0x7, 0xa000000, 0x2, 0x9, 0x0}, &(0x7f0000000080)=0x20) setsockopt$inet_sctp_SCTP_SET_PEER_PRIMARY_ADDR(r3, 0x84, 0x5, &(0x7f00000000c0)={r4, @in6={{0xa, 0x4e21, 0x4, @local, 0x1ff}}}, 0x84) 03:39:43 executing program 1: r0 = socket$inet6(0xa, 0x5, 0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000180)='/dev/net/tun\x00', 0x0, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000100)={'lo\x00', 0x0}) ioctl$sock_SIOCGIFINDEX(r0, 0x8923, &(0x7f0000000380)={'bpq0\x00\v\x00\xfe\x00\x00\x00\x00O\xfa\xff\x00', r2}) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000000)={'bpq0\x00', 0x1212}) getpgid(0xffffffffffffffff) 03:39:43 executing program 5: r0 = syz_open_dev$sndseq(&(0x7f0000000040)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a85320, &(0x7f0000068f50)={{0x80}, 'por\xff\a\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00z\x00\x00\x00\x00\x00\x1f\x00\x00\xff\xff\xff\xff\xff\xff\xff\xef\x00\x00\x03\xff\x00\x00\x00\x00\x00\x00\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x06\x00', 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2}) 03:39:43 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x20000000, &(0x7f00000000c0)=[@release={0x400c630e}], 0x0, 0x0, 0x0}) 03:39:43 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x4c, 0x0, &(0x7f0000000200)=ANY=[@ANYBLOB="05630440000000040e630c4000f200008c01acbcd9297cf4a76e04ea80b60b21d6efb41548e724db19f05bcf6e830123c34234a0c43903464dd4e9c503844e734e52e396711327b0a8d8cf15"], 0x0, 0x0, 0x0}) [ 866.480907][ T3472] binder: undelivered death notification, 0000000000000000 03:39:43 executing program 5: r0 = syz_open_dev$sndseq(&(0x7f0000000040)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a85320, &(0x7f0000068f50)={{0x80}, 'por\xff\a\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xfd\x00\x00\x00\x00\x00\x1f\x00\x00\xff\xff\xff\xff\xff\xff\xff\xef\x00\x00\x03\xff\x00\x00\x00\x00\x00\x00\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x06\x00', 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2}) 03:39:43 executing program 4: perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80000001f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) mount$overlay(0x0, &(0x7f0000000000)='./file0\x00', &(0x7f0000000040)='overlay\x00', 0x20, &(0x7f0000000200)={[{@nfs_export_on='nfs_export=on'}, {@nfs_export_off='nfs_export=off'}, {@index_off='index=off'}, {@upperdir={'upperdir', 0x3d, './file0'}}, {@upperdir={'upperdir', 0x3d, './file0'}}, {@nfs_export_off='nfs_export=off'}, {@nfs_export_off='nfs_export=off'}, {@workdir={'workdir', 0x3d, './file0'}}, {@nfs_export_on='nfs_export=on'}], [{@audit='audit'}, {@obj_role={'obj_role', 0x3d, '[selinux'}}, {@dont_appraise='dont_appraise'}, {@dont_appraise='dont_appraise'}, {@smackfshat={'smackfshat'}}, {@fsuuid={'fsuuid', 0x3d, {[0x3f, 0x66, 0x71, 0x30, 0x39, 0x65, 0x36, 0x34], 0x2d, [0x36, 0x77, 0x0, 0x7e], 0x2d, [0x65, 0x61, 0x35, 0x35], 0x2d, [0x37, 0x0, 0x35, 0x35], 0x2d, [0x35, 0x62, 0x77, 0x61, 0x35, 0x7f, 0x73, 0x75]}}}, {@subj_user={'subj_user', 0x3d, 'vboxnet0/ppp1]vmnet1'}}]}) ioprio_set$uid(0x3, 0x0, 0x0) [ 866.568244][ T5812] binder: 5807:5812 Acquire 1 refcount change on invalid ref 67108864 ret -22 [ 866.600705][ T5812] binder_thread_write: 1 callbacks suppressed [ 866.600732][ T5812] binder: 5807:5812 BC_REQUEST_DEATH_NOTIFICATION invalid ref 61952 03:39:43 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x48000000, &(0x7f00000000c0)=[@release={0x400c630e}], 0x0, 0x0, 0x0}) [ 866.644050][ T5806] : renamed from bpq0 [ 866.690451][ T5812] binder: 5807:5812 unknown command -368808281 [ 866.718167][ T5812] binder: 5807:5812 ioctl c0306201 20000000 returned -22 03:39:43 executing program 5: r0 = syz_open_dev$sndseq(&(0x7f0000000040)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a85320, &(0x7f0000068f50)={{0x80}, 'por\xff\a\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00\x00\x00\x00\x1f\x00\x00\xff\xff\xff\xff\xff\xff\xff\xef\x00\x00\x03\xff\x00\x00\x00\x00\x00\x00\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x06\x00', 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2}) 03:39:43 executing program 1: r0 = socket$inet6(0xa, 0x5, 0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000180)='/dev/net/tun\x00', 0x0, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000100)={'lo\x00', 0x0}) ioctl$sock_SIOCGIFINDEX(r0, 0x8923, &(0x7f0000000380)={'bpq0\x00\v\x00\xfe\x00\x00\x00\x00`\xfa\xff\x00', r2}) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000000)={'bpq0\x00', 0x1212}) getpgid(0xffffffffffffffff) 03:39:43 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x4c000000, &(0x7f00000000c0)=[@release={0x400c630e}], 0x0, 0x0, 0x0}) [ 867.020623][ T5843] : renamed from bpq0 03:39:44 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f00000000c0)=[@release={0x400c630f}], 0xfdfdffff00000000, 0x7, 0x0}) 03:39:44 executing program 4: r0 = perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80000001f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000000)={0x2, 0x70, 0x3, 0x7, 0x6, 0x1, 0x0, 0x8001, 0x44, 0x2, 0x9, 0x10000, 0x0, 0xf6a, 0x10000, 0xffffffffffffff7f, 0x4, 0x8, 0x100000000, 0x10001, 0xfffffffffffffffd, 0x80000001, 0x2, 0x7, 0x3, 0xc71, 0x5, 0x20, 0x4, 0x1, 0x0, 0x9, 0x5d7, 0x80, 0x4e15, 0xffffffffffffffff, 0x7ac, 0x7f, 0x0, 0x800, 0x7, @perf_config_ext={0x10001, 0x3}, 0x2a000, 0x2b9255d, 0x6, 0x5, 0x4, 0x7, 0x4}, 0xffffffffffffffff, 0xa, r0, 0x2) ioprio_set$uid(0x3, 0x0, 0x0) 03:39:44 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x4c, 0x0, &(0x7f0000000200)=ANY=[@ANYBLOB="05630440000000050e630c4000f200008c01acbcd9297cf4a76e04ea80b60b21d6efb41548e724db19f05bcf6e830123c34234a0c43903464dd4e9c503844e734e52e396711327b0a8d8cf15"], 0x0, 0x0, 0x0}) 03:39:44 executing program 5: r0 = syz_open_dev$sndseq(&(0x7f0000000040)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a85320, &(0x7f0000068f50)={{0x80}, 'por\xff\a\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x05\x00\x00\x00\x00\x1f\x00\x00\xff\xff\xff\xff\xff\xff\xff\xef\x00\x00\x03\xff\x00\x00\x00\x00\x00\x00\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x06\x00', 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2}) 03:39:44 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x60000000, &(0x7f00000000c0)=[@release={0x400c630e}], 0x0, 0x0, 0x0}) 03:39:44 executing program 1: r0 = socket$inet6(0xa, 0x5, 0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000180)='/dev/net/tun\x00', 0x0, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000100)={'lo\x00', 0x0}) ioctl$sock_SIOCGIFINDEX(r0, 0x8923, &(0x7f0000000380)={'bpq0\x00\v\x00\xfe\x00\x00\x00\x00h\xfa\xff\x00', r2}) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000000)={'bpq0\x00', 0x1212}) getpgid(0xffffffffffffffff) [ 867.371438][ T3472] binder: undelivered death notification, 0000000000000000 03:39:44 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x68000000, &(0x7f00000000c0)=[@release={0x400c630e}], 0x0, 0x0, 0x0}) [ 867.452327][ T5865] binder: 5860:5865 Acquire 1 refcount change on invalid ref 83886080 ret -22 03:39:44 executing program 4: r0 = openat$qat_adf_ctl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/qat_adf_ctl\x00', 0x40000, 0x0) write$FUSE_WRITE(r0, &(0x7f0000000200)={0x18, 0x0, 0x2, {0x6}}, 0x18) perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80000001f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioprio_set$uid(0x3, 0x0, 0x0) r1 = syz_open_dev$admmidi(&(0x7f0000000000)='/dev/admmidi#\x00', 0x5, 0x404800) mkdirat$cgroup(r1, &(0x7f00000000c0)='syz0\x00', 0x1ff) [ 867.527220][ T5862] : renamed from bpq0 [ 867.532271][ T5865] binder: 5860:5865 BC_REQUEST_DEATH_NOTIFICATION invalid ref 61952 03:39:44 executing program 5: r0 = syz_open_dev$sndseq(&(0x7f0000000040)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a85320, &(0x7f0000068f50)={{0x80}, 'por\xff\a\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x06\x00\x00\x00\x00\x1f\x00\x00\xff\xff\xff\xff\xff\xff\xff\xef\x00\x00\x03\xff\x00\x00\x00\x00\x00\x00\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x06\x00', 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2}) [ 867.586804][ T5865] binder: 5860:5865 unknown command -368808281 [ 867.656513][ T5865] binder: 5860:5865 ioctl c0306201 20000000 returned -22 03:39:44 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x6c000000, &(0x7f00000000c0)=[@release={0x400c630e}], 0x0, 0x0, 0x0}) 03:39:44 executing program 5: r0 = syz_open_dev$sndseq(&(0x7f0000000040)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a85320, &(0x7f0000068f50)={{0x80}, 'por\xff\a\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\a\x00\x00\x00\x00\x1f\x00\x00\xff\xff\xff\xff\xff\xff\xff\xef\x00\x00\x03\xff\x00\x00\x00\x00\x00\x00\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x06\x00', 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2}) 03:39:44 executing program 1: r0 = socket$inet6(0xa, 0x5, 0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000180)='/dev/net/tun\x00', 0x0, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000100)={'lo\x00', 0x0}) ioctl$sock_SIOCGIFINDEX(r0, 0x8923, &(0x7f0000000380)={'bpq0\x00\v\x00\xfe\x00\x00\x00\x00l\xfa\xff\x00', r2}) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000000)={'bpq0\x00', 0x1212}) getpgid(0xffffffffffffffff) [ 867.949095][ T5894] : renamed from bpq0 03:39:45 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f00000000c0)=[@release={0x400c630f}], 0xfdfdffff00000000, 0x48, 0x0}) 03:39:45 executing program 4: getsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffffff, 0x29, 0x23, &(0x7f0000000000)={{{@in=@multicast2, @in=@broadcast, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@mcast1}, 0x0, @in6=@local}}, &(0x7f0000000100)=0xe8) ioprio_set$uid(0xe, r0, 0x3ff) 03:39:45 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x4c, 0x0, &(0x7f0000000200)=ANY=[@ANYBLOB="05630440000000060e630c4000f200008c01acbcd9297cf4a76e04ea80b60b21d6efb41548e724db19f05bcf6e830123c34234a0c43903464dd4e9c503844e734e52e396711327b0a8d8cf15"], 0x0, 0x0, 0x0}) 03:39:45 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x74000000, &(0x7f00000000c0)=[@release={0x400c630e}], 0x0, 0x0, 0x0}) 03:39:45 executing program 5: r0 = syz_open_dev$sndseq(&(0x7f0000000040)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a85320, &(0x7f0000068f50)={{0x80}, 'por\xff\a\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\n\x00\x00\x00\x00\x1f\x00\x00\xff\xff\xff\xff\xff\xff\xff\xef\x00\x00\x03\xff\x00\x00\x00\x00\x00\x00\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x06\x00', 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2}) 03:39:45 executing program 1: r0 = socket$inet6(0xa, 0x5, 0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000180)='/dev/net/tun\x00', 0x0, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000100)={'lo\x00', 0x0}) ioctl$sock_SIOCGIFINDEX(r0, 0x8923, &(0x7f0000000380)={'bpq0\x00\v\x00\xfe\x00\x00\x00\x00t\xfa\xff\x00', r2}) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000000)={'bpq0\x00', 0x1212}) getpgid(0xffffffffffffffff) [ 868.298988][T24007] binder: undelivered death notification, 0000000000000000 03:39:45 executing program 4: perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80000001f, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioprio_set$uid(0x3, 0x0, 0x0) 03:39:45 executing program 5: r0 = syz_open_dev$sndseq(&(0x7f0000000040)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a85320, &(0x7f0000068f50)={{0x80}, 'por\xff\a\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00H\x00\x00\x00\x00\x1f\x00\x00\xff\xff\xff\xff\xff\xff\xff\xef\x00\x00\x03\xff\x00\x00\x00\x00\x00\x00\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x06\x00', 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2}) [ 868.368002][ T5914] binder: 5907:5914 Acquire 1 refcount change on invalid ref 100663296 ret -22 [ 868.407626][ T5914] binder: 5907:5914 BC_REQUEST_DEATH_NOTIFICATION invalid ref 61952 03:39:45 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x7a000000, &(0x7f00000000c0)=[@release={0x400c630e}], 0x0, 0x0, 0x0}) [ 868.456294][ T5913] : renamed from bpq0 [ 868.473263][ T5914] binder: 5907:5914 unknown command -368808281 [ 868.495129][ T5914] binder: 5907:5914 ioctl c0306201 20000000 returned -22 03:39:45 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x4c, 0x0, &(0x7f0000000200)=ANY=[@ANYBLOB="05630440000000070e630c4000f200008c01acbcd9297cf4a76e04ea80b60b21d6efb41548e724db19f05bcf6e830123c34234a0c43903464dd4e9c503844e734e52e396711327b0a8d8cf15"], 0x0, 0x0, 0x0}) 03:39:45 executing program 5: r0 = syz_open_dev$sndseq(&(0x7f0000000040)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a85320, &(0x7f0000068f50)={{0x80}, 'por\xff\a\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00L\x00\x00\x00\x00\x1f\x00\x00\xff\xff\xff\xff\xff\xff\xff\xef\x00\x00\x03\xff\x00\x00\x00\x00\x00\x00\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x06\x00', 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2}) 03:39:45 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008fd0)={0x8, 0xfdfdffff, &(0x7f00000000c0)=[@release={0x400c630e}], 0x0, 0x0, 0x0}) [ 868.714399][ T5936] binder: 5935:5936 Acquire 1 refcount change on invalid ref 117440512 ret -22 [ 868.752275][ T5936] binder: 5935:5936 BC_REQUEST_DEATH_NOTIFICATION invalid ref 61952 [ 868.780370][ T5936] binder: 5935:5936 unknown command -368808281 [ 868.811228][ T5936] binder: 5935:5936 ioctl c0306201 20000000 returned -22 03:39:46 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f00000000c0)=[@release={0x400c630f}], 0xfdfdffff00000000, 0x4c, 0x0}) 03:39:46 executing program 4: perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80000001f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioprio_set$uid(0x3, 0x0, 0x0) r0 = openat$dlm_control(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dlm-control\x00', 0x20000, 0x0) getsockname$tipc(r0, &(0x7f0000000040)=@id, &(0x7f0000000080)=0x10) 03:39:46 executing program 1: r0 = socket$inet6(0xa, 0x5, 0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000180)='/dev/net/tun\x00', 0x0, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000100)={'lo\x00', 0x0}) ioctl$sock_SIOCGIFINDEX(r0, 0x8923, &(0x7f0000000380)={'bpq0\x00\v\x00\xfe\x00\x00\x00\x00z\xfa\xff\x00', r2}) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000000)={'bpq0\x00', 0x1212}) getpgid(0xffffffffffffffff) 03:39:46 executing program 5: r0 = syz_open_dev$sndseq(&(0x7f0000000040)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a85320, &(0x7f0000068f50)={{0x80}, 'por\xff\a\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00h\x00\x00\x00\x00\x1f\x00\x00\xff\xff\xff\xff\xff\xff\xff\xef\x00\x00\x03\xff\x00\x00\x00\x00\x00\x00\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x06\x00', 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2}) 03:39:46 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008fd0)={0x8, 0xfffffdfd, &(0x7f00000000c0)=[@release={0x400c630e}], 0x0, 0x0, 0x0}) 03:39:46 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x4c, 0x0, &(0x7f0000000200)=ANY=[@ANYBLOB="05630440000000480e630c4000f200008c01acbcd9297cf4a76e04ea80b60b21d6efb41548e724db19f05bcf6e830123c34234a0c43903464dd4e9c503844e734e52e396711327b0a8d8cf15"], 0x0, 0x0, 0x0}) [ 869.190622][ T3472] binder: undelivered death notification, 0000000000000000 03:39:46 executing program 5: r0 = syz_open_dev$sndseq(&(0x7f0000000040)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a85320, &(0x7f0000068f50)={{0x80}, 'por\xff\a\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00l\x00\x00\x00\x00\x1f\x00\x00\xff\xff\xff\xff\xff\xff\xff\xef\x00\x00\x03\xff\x00\x00\x00\x00\x00\x00\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x06\x00', 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2}) [ 869.275926][ T5957] binder: 5953:5957 Acquire 1 refcount change on invalid ref 1207959552 ret -22 03:39:46 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x100000000000000, &(0x7f00000000c0)=[@release={0x400c630e}], 0x0, 0x0, 0x0}) [ 869.329429][ T5957] binder: 5953:5957 BC_REQUEST_DEATH_NOTIFICATION invalid ref 61952 03:39:46 executing program 4: perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80000001f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioprio_set$uid(0x3, 0x0, 0x0) r0 = syz_open_dev$swradio(&(0x7f0000000000)='/dev/swradio#\x00', 0x0, 0x2) getsockopt$bt_BT_POWER(r0, 0x112, 0x9, &(0x7f0000000040)=0x1f, &(0x7f0000000080)=0x1) [ 869.371568][ T5955] : renamed from bpq0 [ 869.376114][ T5957] binder: 5953:5957 unknown command -368808281 [ 869.432369][ T5957] binder: 5953:5957 ioctl c0306201 20000000 returned -22 03:39:46 executing program 5: r0 = syz_open_dev$sndseq(&(0x7f0000000040)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a85320, &(0x7f0000068f50)={{0x80}, 'por\xff\a\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00t\x00\x00\x00\x00\x1f\x00\x00\xff\xff\xff\xff\xff\xff\xff\xef\x00\x00\x03\xff\x00\x00\x00\x00\x00\x00\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x06\x00', 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2}) 03:39:46 executing program 1: r0 = socket$inet6(0xa, 0x5, 0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000180)='/dev/net/tun\x00', 0x0, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000100)={'lo\x00', 0x0}) ioctl$sock_SIOCGIFINDEX(r0, 0x8923, &(0x7f0000000380)={'bpq0\x00\v\x00\xfe\x00\x00\x00\x00\xfe\xfa\xff\x00', r2}) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000000)={'bpq0\x00', 0x1212}) getpgid(0xffffffffffffffff) 03:39:46 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x200000000000000, &(0x7f00000000c0)=[@release={0x400c630e}], 0x0, 0x0, 0x0}) [ 869.763390][ T5986] : renamed from bpq0 03:39:47 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f00000000c0)=[@release={0x400c630f}], 0xfdfdffff00000000, 0x60, 0x0}) 03:39:47 executing program 4: perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80000001f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) socket$pptp(0x18, 0x1, 0x2) ioprio_set$uid(0x3, 0x0, 0x0) 03:39:47 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x4c, 0x0, &(0x7f0000000200)=ANY=[@ANYBLOB="056304400000004c0e630c4000f200008c01acbcd9297cf4a76e04ea80b60b21d6efb41548e724db19f05bcf6e830123c34234a0c43903464dd4e9c503844e734e52e396711327b0a8d8cf15"], 0x0, 0x0, 0x0}) 03:39:47 executing program 5: r0 = syz_open_dev$sndseq(&(0x7f0000000040)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a85320, &(0x7f0000068f50)={{0x80}, 'por\xff\a\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00z\x00\x00\x00\x00\x1f\x00\x00\xff\xff\xff\xff\xff\xff\xff\xef\x00\x00\x03\xff\x00\x00\x00\x00\x00\x00\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x06\x00', 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2}) 03:39:47 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x300000000000000, &(0x7f00000000c0)=[@release={0x400c630e}], 0x0, 0x0, 0x0}) 03:39:47 executing program 1: r0 = socket$inet6(0xa, 0x5, 0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000180)='/dev/net/tun\x00', 0x0, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000100)={'lo\x00', 0x0}) ioctl$sock_SIOCGIFINDEX(r0, 0x8923, &(0x7f0000000380)={'bpq0\x00\v\x00\xfe\x00\x00\x00\x00\x00\xfa\xff\x02', r2}) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000000)={'bpq0\x00', 0x1212}) getpgid(0xffffffffffffffff) [ 870.089370][ T3472] binder: undelivered death notification, 0000000000000000 03:39:47 executing program 5: r0 = syz_open_dev$sndseq(&(0x7f0000000040)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a85320, &(0x7f0000068f50)={{0x80}, 'por\xff\a\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xfd\x00\x00\x00\x00\x1f\x00\x00\xff\xff\xff\xff\xff\xff\xff\xef\x00\x00\x03\xff\x00\x00\x00\x00\x00\x00\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x06\x00', 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2}) [ 870.160296][ T6011] binder: 6002:6011 Acquire 1 refcount change on invalid ref 1275068416 ret -22 [ 870.185148][ T6011] binder: 6002:6011 BC_REQUEST_DEATH_NOTIFICATION invalid ref 61952 [ 870.193188][ T6011] binder: 6002:6011 unknown command -368808281 [ 870.193210][ T6011] binder: 6002:6011 ioctl c0306201 20000000 returned -22 03:39:47 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x400000000000000, &(0x7f00000000c0)=[@release={0x400c630e}], 0x0, 0x0, 0x0}) 03:39:47 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x4c, 0x0, &(0x7f0000000200)=ANY=[@ANYBLOB="05630440000000600e630c4000f200008c01acbcd9297cf4a76e04ea80b60b21d6efb41548e724db19f05bcf6e830123c34234a0c43903464dd4e9c503844e734e52e396711327b0a8d8cf15"], 0x0, 0x0, 0x0}) 03:39:47 executing program 4: perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80000001f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioprio_set$uid(0x3, 0x0, 0x0) r0 = syz_open_dev$media(&(0x7f0000000000)='/dev/media#\x00', 0x200, 0x0) ioctl$sock_inet6_tcp_SIOCOUTQNSD(r0, 0x894b, &(0x7f0000000040)) 03:39:47 executing program 5: r0 = syz_open_dev$sndseq(&(0x7f0000000040)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a85320, &(0x7f0000068f50)={{0x80}, 'por\xff\a\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x1f\x00\x00\xff\xff\xff\xff\xff\xff\xff\xef\x00\x00\x03\xff\x00\x00\x00\x00\x00\x00\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x06\x00', 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2}) [ 870.379130][ T6003] : renamed from bpq0 03:39:47 executing program 4: perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e5, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x4000000000000, 0x0, 0x0, 0x80000001f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffff, 0xfffffffffffffffc, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x10001, 0x0, 0x0, 0x800000000}, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioprio_set$uid(0x3, 0x0, 0x0) [ 870.443572][ T6034] binder: 6026:6034 Acquire 1 refcount change on invalid ref 1610612736 ret -22 [ 870.471848][ T6034] binder: 6026:6034 BC_REQUEST_DEATH_NOTIFICATION invalid ref 61952 [ 870.515580][ T6034] binder: 6026:6034 unknown command -368808281 [ 870.539833][ T6034] binder: 6026:6034 ioctl c0306201 20000000 returned -22 03:39:48 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f00000000c0)=[@release={0x400c630f}], 0xfdfdffff00000000, 0x68, 0x0}) 03:39:48 executing program 5: r0 = syz_open_dev$sndseq(&(0x7f0000000040)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a85320, &(0x7f0000068f50)={{0x80}, 'por\xff\a\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02\x00\x00\x1f\x00\x00\xff\xff\xff\xff\xff\xff\xff\xef\x00\x00\x03\xff\x00\x00\x00\x00\x00\x00\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x06\x00', 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2}) 03:39:48 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x500000000000000, &(0x7f00000000c0)=[@release={0x400c630e}], 0x0, 0x0, 0x0}) 03:39:48 executing program 1: r0 = socket$inet6(0xa, 0x5, 0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000180)='/dev/net/tun\x00', 0x0, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000100)={'lo\x00', 0x0}) ioctl$sock_SIOCGIFINDEX(r0, 0x8923, &(0x7f0000000380)={'bpq0\x00\v\x00\xfe\x00\x00\x00\x00\x00\xfa\xff\x03', r2}) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000000)={'bpq0\x00', 0x1212}) getpgid(0xffffffffffffffff) 03:39:48 executing program 4: r0 = perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80000001f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioprio_set$uid(0x3, 0x0, 0x0) ioctl$PERF_EVENT_IOC_ID(r0, 0x80082407, &(0x7f0000000000)) 03:39:48 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x4c, 0x0, &(0x7f0000000200)=ANY=[@ANYBLOB="05630440000000680e630c4000f200008c01acbcd9297cf4a76e04ea80b60b21d6efb41548e724db19f05bcf6e830123c34234a0c43903464dd4e9c503844e734e52e396711327b0a8d8cf15"], 0x0, 0x0, 0x0}) [ 870.976143][T24007] binder: undelivered death notification, 0000000000000000 [ 871.057071][ T6052] binder: 6049:6052 Acquire 1 refcount change on invalid ref 1744830464 ret -22 03:39:48 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x600000000000000, &(0x7f00000000c0)=[@release={0x400c630e}], 0x0, 0x0, 0x0}) 03:39:48 executing program 5: r0 = syz_open_dev$sndseq(&(0x7f0000000040)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a85320, &(0x7f0000068f50)={{0x80}, 'por\xff\a\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00\x00\x1f\x00\x00\xff\xff\xff\xff\xff\xff\xff\xef\x00\x00\x03\xff\x00\x00\x00\x00\x00\x00\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x06\x00', 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2}) 03:39:48 executing program 4: r0 = perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80000001f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000140)='/dev/btrfs-control\x00', 0x80000, 0x0) getsockopt$inet_IP_IPSEC_POLICY(r1, 0x0, 0x10, &(0x7f0000000280)={{{@in6=@ipv4={[], [], @empty}, @in=@local}}, {{@in=@dev}, 0x0, @in=@multicast2}}, &(0x7f0000000100)=0xe8) fstat(r0, &(0x7f0000000200)={0x0, 0x0, 0x0, 0x0, 0x0}) syz_open_dev$vcsn(&(0x7f0000000000)='/dev/vcs#\x00', 0x0, 0x10000) ioprio_set$uid(0x7, r2, 0xfffffffffffffffd) setsockopt$inet6_opts(r1, 0x29, 0x3f, &(0x7f0000000040)=@hopopts={0x73, 0xc, [], [@generic={0x7, 0x64, "7c814d274e9c423c74535faa69fbcd9406b34ef1dd91f9f2db0a27ac9300dd80c17b52c078dcd599afafd898e4464b0feb19f3d8cf15df35bba019a2971328eb24c58e6d34be7ffee5888ee77e6058b7c7760bce6e94621e053bc1e0d04c7fedee1b1878"}]}, 0x70) [ 871.097379][ T6052] binder: 6049:6052 BC_REQUEST_DEATH_NOTIFICATION invalid ref 61952 [ 871.123649][ T6052] binder: 6049:6052 unknown command -368808281 [ 871.134670][ T6052] binder: 6049:6052 ioctl c0306201 20000000 returned -22 [ 871.158412][ T6050] : renamed from bpq0 03:39:48 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x4c, 0x0, &(0x7f0000000200)=ANY=[@ANYBLOB="056304400000006c0e630c4000f200008c01acbcd9297cf4a76e04ea80b60b21d6efb41548e724db19f05bcf6e830123c34234a0c43903464dd4e9c503844e734e52e396711327b0a8d8cf15"], 0x0, 0x0, 0x0}) 03:39:48 executing program 1: r0 = socket$inet6(0xa, 0x5, 0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000180)='/dev/net/tun\x00', 0x0, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000100)={'lo\x00', 0x0}) ioctl$sock_SIOCGIFINDEX(r0, 0x8923, &(0x7f0000000380)={'bpq0\x00\v\x00\xfe\x00\x00\x00\x00\x00\xfa\xff\x04', r2}) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000000)={'bpq0\x00', 0x1212}) getpgid(0xffffffffffffffff) [ 871.323711][ T6079] binder: 6075:6079 Acquire 1 refcount change on invalid ref 1811939328 ret -22 03:39:48 executing program 5: r0 = syz_open_dev$sndseq(&(0x7f0000000040)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a85320, &(0x7f0000068f50)={{0x80}, 'por\xff\a\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x04\x00\x00\x1f\x00\x00\xff\xff\xff\xff\xff\xff\xff\xef\x00\x00\x03\xff\x00\x00\x00\x00\x00\x00\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x06\x00', 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2}) [ 871.375359][ T6079] binder: 6075:6079 BC_REQUEST_DEATH_NOTIFICATION invalid ref 61952 [ 871.429115][ T6079] binder: 6075:6079 unknown command -368808281 [ 871.445995][ T6079] binder: 6075:6079 ioctl c0306201 20000000 returned -22 [ 871.517639][ T6084] : renamed from bpq0 03:39:48 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f00000000c0)=[@release={0x400c630f}], 0xfdfdffff00000000, 0x6c, 0x0}) 03:39:48 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x700000000000000, &(0x7f00000000c0)=[@release={0x400c630e}], 0x0, 0x0, 0x0}) 03:39:48 executing program 4: r0 = perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80000001f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioprio_set$uid(0x3, 0x0, 0x0) r1 = openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000000)='/dev/sequencer2\x00', 0x8000, 0x0) fstat(r0, &(0x7f0000000040)={0x0, 0x0, 0x0, 0x0, 0x0}) r3 = getegid() getsockopt$sock_cred(0xffffffffffffff9c, 0x1, 0x11, &(0x7f00000000c0)={0x0, 0x0}, &(0x7f0000000100)=0xc) write$P9_RSTATu(r1, &(0x7f0000000200)={0x6c, 0x7d, 0x1, {{0x0, 0x4d, 0x1, 0x4, {0x20, 0x1, 0x8}, 0x26000000, 0x956, 0x0, 0x3, 0x6, 'nodev*', 0x0, '', 0x14, '\'cpusetuserwlan1]^/}'}, 0xa, '\'&ppp0eth1', r2, r3, r4}}, 0x6c) 03:39:48 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x4c, 0x0, &(0x7f0000000200)=ANY=[@ANYBLOB="05630440000000740e630c4000f200008c01acbcd9297cf4a76e04ea80b60b21d6efb41548e724db19f05bcf6e830123c34234a0c43903464dd4e9c503844e734e52e396711327b0a8d8cf15"], 0x0, 0x0, 0x0}) 03:39:48 executing program 5: r0 = syz_open_dev$sndseq(&(0x7f0000000040)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a85320, &(0x7f0000068f50)={{0x80}, 'por\xff\a\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x05\x00\x00\x1f\x00\x00\xff\xff\xff\xff\xff\xff\xff\xef\x00\x00\x03\xff\x00\x00\x00\x00\x00\x00\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x06\x00', 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2}) 03:39:48 executing program 1: r0 = socket$inet6(0xa, 0x5, 0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000180)='/dev/net/tun\x00', 0x0, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000100)={'lo\x00', 0x0}) ioctl$sock_SIOCGIFINDEX(r0, 0x8923, &(0x7f0000000380)={'bpq0\x00\v\x00\xfe\x00\x00\x00\x00\x00\xfa\xff\x05', r2}) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000000)={'bpq0\x00', 0x1212}) getpgid(0xffffffffffffffff) [ 871.874077][T24007] binder: undelivered death notification, 0000000000000000 [ 871.936836][ T6102] binder: 6099:6102 Acquire 1 refcount change on invalid ref 1946157056 ret -22 03:39:49 executing program 5: r0 = syz_open_dev$sndseq(&(0x7f0000000040)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a85320, &(0x7f0000068f50)={{0x80}, 'por\xff\a\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x06\x00\x00\x1f\x00\x00\xff\xff\xff\xff\xff\xff\xff\xef\x00\x00\x03\xff\x00\x00\x00\x00\x00\x00\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x06\x00', 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2}) 03:39:49 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008fd0)={0x8, 0xa00000000000000, &(0x7f00000000c0)=[@release={0x400c630e}], 0x0, 0x0, 0x0}) [ 871.982112][ T6102] binder: 6099:6102 BC_REQUEST_DEATH_NOTIFICATION invalid ref 61952 [ 872.004020][ T6102] binder: 6099:6102 unknown command -368808281 [ 872.022863][ T6102] binder: 6099:6102 ioctl c0306201 20000000 returned -22 03:39:49 executing program 4: r0 = openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000000)='/dev/btrfs-control\x00', 0x101200, 0x0) getpeername$netlink(r0, &(0x7f0000000040), &(0x7f0000000080)=0xc) perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80000001f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioprio_set$uid(0x3, 0x0, 0x0) [ 872.080258][ T6107] : renamed from bpq0 03:39:49 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x4c, 0x0, &(0x7f0000000200)=ANY=[@ANYBLOB="056304400000007a0e630c4000f200008c01acbcd9297cf4a76e04ea80b60b21d6efb41548e724db19f05bcf6e830123c34234a0c43903464dd4e9c503844e734e52e396711327b0a8d8cf15"], 0x0, 0x0, 0x0}) 03:39:49 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x2000000000000000, &(0x7f00000000c0)=[@release={0x400c630e}], 0x0, 0x0, 0x0}) 03:39:49 executing program 5: r0 = syz_open_dev$sndseq(&(0x7f0000000040)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a85320, &(0x7f0000068f50)={{0x80}, 'por\xff\a\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\a\x00\x00\x1f\x00\x00\xff\xff\xff\xff\xff\xff\xff\xef\x00\x00\x03\xff\x00\x00\x00\x00\x00\x00\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x06\x00', 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2}) [ 872.228067][ T6127] binder: 6126:6127 Acquire 1 refcount change on invalid ref 2046820352 ret -22 [ 872.275073][ T6127] binder: 6126:6127 BC_REQUEST_DEATH_NOTIFICATION invalid ref 61952 [ 872.299126][ T6127] binder: 6126:6127 unknown command -368808281 [ 872.345034][ T6127] binder: 6126:6127 ioctl c0306201 20000000 returned -22 03:39:49 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f00000000c0)=[@release={0x400c630f}], 0xfdfdffff00000000, 0x74, 0x0}) 03:39:49 executing program 4: perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80000001f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$sndpcmc(&(0x7f00000000c0)='/dev/snd/pcmC#D#c\x00', 0x6, 0x40000) getsockopt$inet_sctp_SCTP_GET_ASSOC_STATS(0xffffffffffffff9c, 0x84, 0x70, &(0x7f0000000200)={0x0, @in6={{0xa, 0x4e22, 0x2, @empty, 0x762}}, [0x4, 0x1, 0x7e00, 0x7, 0x76e, 0x400, 0x6, 0x0, 0x10000, 0x6, 0x4b5, 0x6, 0x0, 0x6, 0x100]}, &(0x7f0000000100)=0x100) getsockopt$inet_sctp_SCTP_GET_PEER_ADDR_INFO(r0, 0x84, 0xf, &(0x7f0000000300)={r1, @in={{0x2, 0x4e24, @loopback}}, 0x200, 0xffffffffffffffff, 0x0, 0x1, 0xff}, &(0x7f0000000140)=0x98) ioprio_set$uid(0x3, 0x0, 0x0) r2 = openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000000)='/dev/sequencer2\x00', 0x52400, 0x0) ioctl$RTC_AIE_ON(r2, 0x7001) ioctl$sock_netrom_SIOCADDRT(r2, 0x890b, &(0x7f0000000040)={0x0, @default, @rose={'rose', 0x0}, 0x6, 'syz0\x00', @null, 0xfff, 0x0, [@netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @default, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x1}, @null, @default, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}]}) 03:39:49 executing program 1: r0 = socket$inet6(0xa, 0x5, 0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000180)='/dev/net/tun\x00', 0x0, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000100)={'lo\x00', 0x0}) ioctl$sock_SIOCGIFINDEX(r0, 0x8923, &(0x7f0000000380)={'bpq0\x00\v\x00\xfe\x00\x00\x00\x00\x00\xfa\xff\x06', r2}) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000000)={'bpq0\x00', 0x1212}) getpgid(0xffffffffffffffff) 03:39:49 executing program 5: r0 = syz_open_dev$sndseq(&(0x7f0000000040)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a85320, &(0x7f0000068f50)={{0x80}, 'por\xff\a\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\n\x00\x00\x1f\x00\x00\xff\xff\xff\xff\xff\xff\xff\xef\x00\x00\x03\xff\x00\x00\x00\x00\x00\x00\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x06\x00', 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2}) 03:39:49 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x4800000000000000, &(0x7f00000000c0)=[@release={0x400c630e}], 0x0, 0x0, 0x0}) 03:39:49 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x4c, 0x0, &(0x7f0000000200)=ANY=[@ANYBLOB="056304400000000012630c4000f200008c01acbcd9297cf4a76e04ea80b60b21d6efb41548e724db19f05bcf6e830123c34234a0c43903464dd4e9c503844e734e52e396711327b0a8d8cf15"], 0x0, 0x0, 0x0}) [ 872.763759][T24007] binder: undelivered death notification, 0000000000000000 03:39:49 executing program 4: perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80000001f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioprio_set$uid(0x3, 0x0, 0x0) r0 = openat$proc_capi20ncci(0xffffffffffffff9c, &(0x7f0000000000)='/proc/capi/capi20ncci\x00', 0x10000, 0x0) ioctl$KDSETMODE(r0, 0x4b3a, 0x8) [ 872.851054][ T6152] binder: 6149:6152 unknown command 1074553618 [ 872.883489][ T6152] binder: 6149:6152 ioctl c0306201 20000000 returned -22 03:39:49 executing program 5: r0 = syz_open_dev$sndseq(&(0x7f0000000040)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a85320, &(0x7f0000068f50)={{0x80}, 'por\xff\a\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00H\x00\x00\x1f\x00\x00\xff\xff\xff\xff\xff\xff\xff\xef\x00\x00\x03\xff\x00\x00\x00\x00\x00\x00\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x06\x00', 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2}) [ 872.925655][ T6153] : renamed from bpq0 03:39:50 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x4c00000000000000, &(0x7f00000000c0)=[@release={0x400c630e}], 0x0, 0x0, 0x0}) 03:39:50 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x4c, 0x0, &(0x7f0000000200)=ANY=[@ANYBLOB="056304400000000046630c4000f200008c01acbcd9297cf4a76e04ea80b60b21d6efb41548e724db19f05bcf6e830123c34234a0c43903464dd4e9c503844e734e52e396711327b0a8d8cf15"], 0x0, 0x0, 0x0}) 03:39:50 executing program 4: openat$cuse(0xffffffffffffff9c, &(0x7f0000000000)='/dev/cuse\x00', 0x2, 0x0) openat$pfkey(0xffffffffffffff9c, &(0x7f00000000c0)='/proc/self/net/pfkey\x00', 0x600040, 0x0) r0 = syz_open_dev$cec(&(0x7f0000000040)='/dev/cec#\x00', 0x0, 0x2) ioctl$VIDIOC_ENUM_FRAMEINTERVALS(r0, 0xc034564b, &(0x7f0000000080)={0x7f, 0x7b373179, 0x3, 0x8, 0x3, @stepwise={{0x4, 0x2}, {0x3, 0x2}, {0x0, 0xf923}}}) ioprio_set$uid(0x3, 0x0, 0x0) 03:39:50 executing program 5: r0 = syz_open_dev$sndseq(&(0x7f0000000040)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a85320, &(0x7f0000068f50)={{0x80}, 'por\xff\a\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00L\x00\x00\x1f\x00\x00\xff\xff\xff\xff\xff\xff\xff\xef\x00\x00\x03\xff\x00\x00\x00\x00\x00\x00\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x06\x00', 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2}) [ 873.164400][ T6175] binder: 6173:6175 unknown command 1074553670 [ 873.247046][ T6175] binder: 6173:6175 ioctl c0306201 20000000 returned -22 03:39:50 executing program 1: r0 = socket$inet6(0xa, 0x5, 0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000180)='/dev/net/tun\x00', 0x0, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000100)={'lo\x00', 0x0}) ioctl$sock_SIOCGIFINDEX(r0, 0x8923, &(0x7f0000000380)={'bpq0\x00\v\x00\xfe\x00\x00\x00\x00\x00\xfa\xff\a', r2}) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000000)={'bpq0\x00', 0x1212}) getpgid(0xffffffffffffffff) 03:39:50 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x6000000000000000, &(0x7f00000000c0)=[@release={0x400c630e}], 0x0, 0x0, 0x0}) 03:39:50 executing program 5: r0 = syz_open_dev$sndseq(&(0x7f0000000040)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a85320, &(0x7f0000068f50)={{0x80}, 'por\xff\a\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00h\x00\x00\x1f\x00\x00\xff\xff\xff\xff\xff\xff\xff\xef\x00\x00\x03\xff\x00\x00\x00\x00\x00\x00\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x06\x00', 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2}) 03:39:50 executing program 4: perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80000001f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioprio_set$uid(0x3, 0x0, 0x0) getsockopt$sock_cred(0xffffffffffffff9c, 0x1, 0x11, &(0x7f0000000000)={0x0, 0x0}, &(0x7f0000000040)=0xc) ioprio_set$uid(0x3, r0, 0x651) 03:39:50 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x4c, 0x0, &(0x7f0000000200)=ANY=[@ANYBLOB="056304400000000050630c4000f200008c01acbcd9297cf4a76e04ea80b60b21d6efb41548e724db19f05bcf6e830123c34234a0c43903464dd4e9c503844e734e52e396711327b0a8d8cf15"], 0x0, 0x0, 0x0}) 03:39:50 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f00000000c0)=[@release={0x400c630f}], 0xfdfdffff00000000, 0x7a, 0x0}) [ 873.665702][T24007] binder: undelivered death notification, 0000000000000000 [ 873.721113][ T6196] binder: 6194:6196 unknown command 1074553680 03:39:50 executing program 5: r0 = syz_open_dev$sndseq(&(0x7f0000000040)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a85320, &(0x7f0000068f50)={{0x80}, 'por\xff\a\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00l\x00\x00\x1f\x00\x00\xff\xff\xff\xff\xff\xff\xff\xef\x00\x00\x03\xff\x00\x00\x00\x00\x00\x00\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x06\x00', 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2}) 03:39:50 executing program 4: perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80000001f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioprio_set$uid(0x3, 0x0, 0x0) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x20, 0x5, 0x8001, 0x101, 0x0, 0x1, 0x8882, 0x1, 0x7, 0x20000000000, 0xfff, 0x1, 0x7, 0xd8dc, 0x80, 0x8001, 0x1f, 0x4, 0x8, 0x9, 0x1, 0x80000000, 0xf1, 0x4, 0x4, 0x3, 0x3ff, 0x7ff, 0x0, 0x6, 0xfffffffffffffff7, 0x1000, 0x4, 0x2, 0x6, 0xffffffff80000001, 0x0, 0x401, 0x4, @perf_bp={&(0x7f0000000000), 0x8}, 0x880, 0x3, 0x0, 0x0, 0x7, 0x9, 0x1f}, 0xffffffffffffffff, 0xd, 0xffffffffffffffff, 0x0) [ 873.773108][ T6196] binder: 6194:6196 ioctl c0306201 20000000 returned -22 [ 873.811597][ T6193] : renamed from bpq0 03:39:50 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x6800000000000000, &(0x7f00000000c0)=[@release={0x400c630e}], 0x0, 0x0, 0x0}) 03:39:50 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x4c, 0x0, &(0x7f0000000200)=ANY=[@ANYBLOB="05630440000000005b630c4000f200008c01acbcd9297cf4a76e04ea80b60b21d6efb41548e724db19f05bcf6e830123c34234a0c43903464dd4e9c503844e734e52e396711327b0a8d8cf15"], 0x0, 0x0, 0x0}) 03:39:51 executing program 5: r0 = syz_open_dev$sndseq(&(0x7f0000000040)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a85320, &(0x7f0000068f50)={{0x80}, 'por\xff\a\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00t\x00\x00\x1f\x00\x00\xff\xff\xff\xff\xff\xff\xff\xef\x00\x00\x03\xff\x00\x00\x00\x00\x00\x00\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x06\x00', 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2}) 03:39:51 executing program 1: r0 = socket$inet6(0xa, 0x5, 0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000180)='/dev/net/tun\x00', 0x0, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000100)={'lo\x00', 0x0}) ioctl$sock_SIOCGIFINDEX(r0, 0x8923, &(0x7f0000000380)={'bpq0\x00\v\x00\xfe\x00\x00\x00\x00\x00\xfa\xff\b', r2}) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000000)={'bpq0\x00', 0x1212}) getpgid(0xffffffffffffffff) 03:39:51 executing program 4: r0 = perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80000001f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) getresuid(&(0x7f0000000000), &(0x7f0000000040), &(0x7f0000000080)) getsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffffff, 0x29, 0x23, &(0x7f0000000200)={{{@in=@multicast2, @in6}}, {{@in=@broadcast}, 0x0, @in6=@remote}}, &(0x7f00000000c0)=0xe8) fstat(r0, &(0x7f0000000100)={0x0, 0x0, 0x0, 0x0, 0x0}) mremap(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x2000, 0x2, &(0x7f0000ffe000/0x2000)=nil) ioprio_set$uid(0x8005, r1, 0xa000000000) r2 = openat$vfio(0xffffffffffffff9c, &(0x7f00000003c0)='/dev/vfio/vfio\x00', 0x0, 0x0) r3 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000440)='IPVS\x00') sendmsg$IPVS_CMD_GET_SERVICE(r2, &(0x7f0000000500)={&(0x7f0000000400)={0x10, 0x0, 0x0, 0x1000000}, 0xc, &(0x7f00000004c0)={&(0x7f0000000480)=ANY=[@ANYBLOB="1800e200", @ANYRES16=r3, @ANYBLOB="00032cbd7000ffdbdf25040000000800050008000000"], 0x1c}, 0x1, 0x0, 0x0, 0x4081}, 0x814) r4 = openat$vsock(0xffffffffffffff9c, &(0x7f0000000300)='/dev/vsock\x00', 0x22400, 0x0) getsockopt$inet_sctp6_SCTP_DISABLE_FRAGMENTS(r4, 0x84, 0x8, &(0x7f0000000340), &(0x7f0000000380)=0x4) [ 874.019786][ T6221] binder: 6219:6221 unknown command 1074553691 [ 874.085664][ T6221] binder: 6219:6221 ioctl c0306201 20000000 returned -22 03:39:51 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x6c00000000000000, &(0x7f00000000c0)=[@release={0x400c630e}], 0x0, 0x0, 0x0}) 03:39:51 executing program 5: r0 = syz_open_dev$sndseq(&(0x7f0000000040)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a85320, &(0x7f0000068f50)={{0x80}, 'por\xff\a\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00z\x00\x00\x1f\x00\x00\xff\xff\xff\xff\xff\xff\xff\xef\x00\x00\x03\xff\x00\x00\x00\x00\x00\x00\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x06\x00', 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2}) 03:39:51 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x4c, 0x0, &(0x7f0000000200)=ANY=[@ANYBLOB="05630440000000000b63000000f200008c01acbcd9297cf4a76e04ea80b60b21d6efb41548e724db19f05bcf6e830123c34234a0c43903464dd4e9c503844e734e52e396711327b0a8d8cf15"], 0x0, 0x0, 0x0}) 03:39:51 executing program 4: perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80000001f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioprio_set$uid(0x3, 0x0, 0x0) [ 874.265887][ T6230] : renamed from bpq0 [ 874.348192][ T6249] binder: 6244:6249 ERROR: BC_REGISTER_LOOPER called without request [ 874.394991][ T6249] binder: 6244:6249 unknown command 61952 [ 874.408289][ T6249] binder: 6244:6249 ioctl c0306201 20000000 returned -22 03:39:51 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f00000000c0)=[@release={0x400c630f}], 0xfdfdffff00000000, 0x300, 0x0}) 03:39:51 executing program 5: r0 = syz_open_dev$sndseq(&(0x7f0000000040)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a85320, &(0x7f0000068f50)={{0x80}, 'por\xff\a\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xfd\x00\x00\x1f\x00\x00\xff\xff\xff\xff\xff\xff\xff\xef\x00\x00\x03\xff\x00\x00\x00\x00\x00\x00\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x06\x00', 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2}) 03:39:51 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x7400000000000000, &(0x7f00000000c0)=[@release={0x400c630e}], 0x0, 0x0, 0x0}) 03:39:51 executing program 4: r0 = perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80000001f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioprio_set$uid(0x3, 0x0, 0x0) getsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffffff, 0x29, 0x23, &(0x7f0000000200)={{{@in6=@local, @in6=@ipv4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in=@empty}, 0x0, @in=@empty}}, &(0x7f00000000c0)=0xe8) fstat(r0, &(0x7f0000000100)={0x0, 0x0, 0x0, 0x0, 0x0}) getsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffff9c, 0x29, 0x23, &(0x7f0000000300)={{{@in6=@initdev, @in=@local, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@local}, 0x0, @in=@local}}, &(0x7f0000000400)=0xe8) mount$9p_unix(&(0x7f0000000000)='./file0\x00', &(0x7f0000000040)='./file0\x00', &(0x7f0000000080)='9p\x00', 0x40, &(0x7f0000000440)={'trans=unix,', {[{@privport='privport'}, {@access_uid={'access', 0x3d, r1}}, {@access_user='access=user'}, {@cache_loose='cache=loose'}, {@privport='privport'}, {@aname={'aname', 0x3d, '$@['}}], [{@euid_gt={'euid>', r2}}, {@uid_lt={'uid<', r3}}, {@obj_user={'obj_user', 0x3d, '^em1keyring%)GPL-ppp0'}}, {@rootcontext={'rootcontext', 0x3d, 'root'}}]}}) 03:39:51 executing program 1: r0 = socket$inet6(0xa, 0x5, 0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000180)='/dev/net/tun\x00', 0x0, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000100)={'lo\x00', 0x0}) ioctl$sock_SIOCGIFINDEX(r0, 0x8923, &(0x7f0000000380)={'bpq0\x00\v\x00\xfe\x00\x00\x00\x00\x00\xfa\xffH', r2}) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000000)={'bpq0\x00', 0x1212}) getpgid(0xffffffffffffffff) 03:39:51 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x4c, 0x0, &(0x7f0000000200)=ANY=[@ANYBLOB="05630440000000000c63000000f200008c01acbcd9297cf4a76e04ea80b60b21d6efb41548e724db19f05bcf6e830123c34234a0c43903464dd4e9c503844e734e52e396711327b0a8d8cf15"], 0x0, 0x0, 0x0}) [ 874.569889][T24007] binder: undelivered death notification, 0000000000000000 03:39:51 executing program 5: r0 = syz_open_dev$sndseq(&(0x7f0000000040)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a85320, &(0x7f0000068f50)={{0x80}, 'por\xff\a\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02\x00\x00\x00\x00\x1f\x00\x00\xff\xff\xff\xff\xff\xff\xff\xef\x00\x00\x03\xff\x00\x00\x00\x00\x00\x00\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x06\x00', 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2}) [ 874.638515][ T6265] binder: 6256:6265 unknown command 61952 [ 874.662319][ T6265] binder: 6256:6265 ioctl c0306201 20000000 returned -22 03:39:51 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x4c, 0x0, &(0x7f0000000200)=ANY=[@ANYBLOB="05630440000000000d63000000f200008c01acbcd9297cf4a76e04ea80b60b21d6efb41548e724db19f05bcf6e830123c34234a0c43903464dd4e9c503844e734e52e396711327b0a8d8cf15"], 0x0, 0x0, 0x0}) 03:39:51 executing program 4: perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80000001f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$radio(&(0x7f0000000000)='/dev/radio#\x00', 0x2, 0x2) getsockopt$TIPC_NODE_RECVQ_DEPTH(r0, 0x10f, 0x83, &(0x7f0000000040), &(0x7f0000000080)=0x4) ioprio_set$uid(0x3, 0x0, 0x0) 03:39:51 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x7a00000000000000, &(0x7f00000000c0)=[@release={0x400c630e}], 0x0, 0x0, 0x0}) [ 874.776226][ T6268] : renamed from bpq0 03:39:51 executing program 5: r0 = syz_open_dev$sndseq(&(0x7f0000000040)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a85320, &(0x7f0000068f50)={{0x80}, 'por\xff\a\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00\x00\x00\x00\x1f\x00\x00\xff\xff\xff\xff\xff\xff\xff\xef\x00\x00\x03\xff\x00\x00\x00\x00\x00\x00\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x06\x00', 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2}) [ 874.863108][ T6268] : renamed from bpq0 03:39:52 executing program 4: r0 = syz_open_dev$usb(&(0x7f0000000000)='/dev/bus/usb/00#/00#\x00', 0x8, 0x210000) getsockopt$inet_sctp6_SCTP_AUTO_ASCONF(r0, 0x84, 0x1e, &(0x7f0000000040), &(0x7f0000000080)=0x4) perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80000001f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) getsockopt$inet_IP_IPSEC_POLICY(r0, 0x0, 0x10, &(0x7f0000000200)={{{@in=@broadcast, @in6=@local}}, {{@in=@multicast1}, 0x0, @in=@initdev}}, &(0x7f00000000c0)=0xe8) ioprio_set$uid(0x3, 0x0, 0x0) [ 874.899512][ T6288] binder: 6279:6288 unknown command 61952 [ 874.912061][ T6288] binder: 6279:6288 ioctl c0306201 20000000 returned -22 03:39:52 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f00000000c0)=[@release={0x400c630f}], 0xfdfdffff00000000, 0x500, 0x0}) 03:39:52 executing program 5: r0 = syz_open_dev$sndseq(&(0x7f0000000040)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a85320, &(0x7f0000068f50)={{0x80}, 'por\xff\a\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x04\x00\x00\x00\x00\x1f\x00\x00\xff\xff\xff\xff\xff\xff\xff\xef\x00\x00\x03\xff\x00\x00\x00\x00\x00\x00\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x06\x00', 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2}) 03:39:52 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008fd0)={0x8, 0xfdfdffff00000000, &(0x7f00000000c0)=[@release={0x400c630e}], 0x0, 0x0, 0x0}) 03:39:52 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x4c, 0x0, &(0x7f0000000200)=ANY=[@ANYBLOB="05630440000000000263044000f200008c01acbcd9297cf4a76e04ea80b60b21d6efb41548e724db19f05bcf6e830123c34234a0c43903464dd4e9c503844e734e52e396711327b0a8d8cf15"], 0x0, 0x0, 0x0}) 03:39:52 executing program 1: r0 = socket$inet6(0xa, 0x5, 0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000180)='/dev/net/tun\x00', 0x0, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000100)={'lo\x00', 0x0}) ioctl$sock_SIOCGIFINDEX(r0, 0x8923, &(0x7f0000000380)={'bpq0\x00\v\x00\xfe\x00\x00\x00\x00\x00\xfa\xffL', r2}) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000000)={'bpq0\x00', 0x1212}) getpgid(0xffffffffffffffff) 03:39:52 executing program 4: perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80000001f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioprio_set$uid(0x1003, 0x0, 0x0) r0 = openat$vicodec0(0xffffffffffffff9c, &(0x7f0000000000)='/dev/video36\x00', 0x2, 0x0) ioctl$VIDIOC_ENUMINPUT(r0, 0xc050561a, &(0x7f0000000040)={0x1, "6b7440ffe9d83ebd01d30b952f2fdbdc88d34cbfd1f7013d995dc5d281b2afa9", 0x2, 0x9, 0x4, 0x80b707, 0x2, 0x31db1dbae2cf3ef1}) [ 875.469003][ T3472] binder: undelivered death notification, 0000000000000000 03:39:52 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f00000000c0)=[@release={0x630b}], 0x0, 0x0, 0x0}) [ 875.542506][ T6314] binder: BC_ACQUIRE_RESULT not supported [ 875.564940][ T6314] binder: 6303:6314 ioctl c0306201 20000000 returned -22 03:39:52 executing program 4: perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80000001f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioprio_set$uid(0x3, 0x0, 0x0) r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ubi_ctrl\x00', 0x2000, 0x0) sendto$rxrpc(r0, &(0x7f0000000040)="2dcca8dbe38656719bf398f68708ae6d88668a9ef60e75127656a369ff19c35b8d20c295f23d418538e25e4652f60799625bda81e07adb9c65b2886a09cec58450407f3833ed1325ce7beb7652c5cc1a8053c1fb9e4c20a0086f81e9bc4c644ad5efd2cea35ddc847d38e10480de7c82150e214d199d90d44890db6ed4ad8a0e71597eeddcc7ac56e1", 0x89, 0x20008080, &(0x7f0000000100)=@in4={0x21, 0x2, 0x2, 0x10, {0x2, 0x4e21, @initdev={0xac, 0x1e, 0x1, 0x0}}}, 0x24) setsockopt$IP_VS_SO_SET_STOPDAEMON(r0, 0x0, 0x48c, &(0x7f0000000140)={0x2, 'veth0_to_bond\x00', 0x1}, 0x18) 03:39:52 executing program 5: r0 = syz_open_dev$sndseq(&(0x7f0000000040)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a85320, &(0x7f0000068f50)={{0x80}, 'por\xff\a\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x05\x00\x00\x00\x00\x1f\x00\x00\xff\xff\xff\xff\xff\xff\xff\xef\x00\x00\x03\xff\x00\x00\x00\x00\x00\x00\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x06\x00', 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2}) [ 875.634133][ T6321] binder: 6318:6321 ERROR: BC_REGISTER_LOOPER called without request [ 875.698684][ T6310] : renamed from bpq0 [ 875.698692][ T6321] binder: 6318:6321 unknown command 0 [ 875.698715][ T6321] binder: 6318:6321 ioctl c0306201 20008fd0 returned -22 03:39:52 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f00000000c0)=[@release={0x630c}], 0x0, 0x0, 0x0}) 03:39:52 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x4c, 0x0, &(0x7f0000000200)=ANY=[@ANYBLOB="05630440000000000463044000f200008c01acbcd9297cf4a76e04ea80b60b21d6efb41548e724db19f05bcf6e830123c34234a0c43903464dd4e9c503844e734e52e396711327b0a8d8cf15"], 0x0, 0x0, 0x0}) 03:39:52 executing program 4: r0 = dup(0xffffffffffffff9c) ioctl$SIOCGSTAMP(r0, 0x8906, &(0x7f0000000000)) r1 = perf_event_open(&(0x7f0000000180)={0x2, 0xffffff6b, 0x3e8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6e, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffc, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioprio_set$uid(0x3, 0x0, 0x0) get_thread_area(&(0x7f0000000040)={0x1f, 0x20001000, 0x0, 0x400, 0xffffffff80000001, 0x2, 0x80, 0x6, 0x6, 0x7}) getsockopt$inet_sctp6_SCTP_DEFAULT_PRINFO(r0, 0x84, 0x72, &(0x7f0000000080)={0x0, 0x8001, 0x30}, &(0x7f00000000c0)=0xc) getsockopt$inet_sctp6_SCTP_GET_LOCAL_ADDRS(r0, 0x84, 0x6d, &(0x7f0000000200)={r2, 0x9d, "01db9585fa823f31b9e38ddb4f5a5c3dba5c3da9b5ed5a4303abbe9bdc40902f70ecb5002a88260cb24e1c2c94cf6bbdd7c62c7f2e423921899451e0701d8576d1a35824c33c2506b3fbe1c4a68873f66bd351c2f2e55cf56a1b250ab48de88c040bb180ff2ec33eba9a32133eff4b12dd408022f9df80cda8ef555dbe51aa083eb796624f1a5ada21fe3e21b0fcfef7e9f3da02b8cf57e9d6105a29f9"}, &(0x7f0000000100)=0xa5) ioctl$PERF_EVENT_IOC_DISABLE(r1, 0x2401, 0x7) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x2400, 0xfff) [ 875.924591][ T6337] binder: 6336:6337 unknown command 0 [ 875.930527][ T6334] binder: 6333:6334 IncRefs 0 refcount change on invalid ref 61952 ret -22 [ 875.941651][ T6337] binder: 6336:6337 ioctl c0306201 20008fd0 returned -22 [ 875.950299][ T6334] binder: 6333:6334 unknown command -1129578100 [ 875.970788][ T6334] binder: 6333:6334 ioctl c0306201 20000000 returned -22 03:39:53 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f00000000c0)=[@release={0x400c630f}], 0xfdfdffff00000000, 0x600, 0x0}) 03:39:53 executing program 1: r0 = socket$inet6(0xa, 0x5, 0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000180)='/dev/net/tun\x00', 0x0, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000100)={'lo\x00', 0x0}) ioctl$sock_SIOCGIFINDEX(r0, 0x8923, &(0x7f0000000380)={'bpq0\x00\v\x00\xfe\x00\x00\x00\x00\x00\xfa\xffO', r2}) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000000)={'bpq0\x00', 0x1212}) getpgid(0xffffffffffffffff) 03:39:53 executing program 5: r0 = syz_open_dev$sndseq(&(0x7f0000000040)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a85320, &(0x7f0000068f50)={{0x80}, 'por\xff\a\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x06\x00\x00\x00\x00\x1f\x00\x00\xff\xff\xff\xff\xff\xff\xff\xef\x00\x00\x03\xff\x00\x00\x00\x00\x00\x00\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x06\x00', 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2}) 03:39:53 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f00000000c0)=[@release={0x630d}], 0x0, 0x0, 0x0}) 03:39:53 executing program 4: r0 = perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80000001f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x66b, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) finit_module(r0, &(0x7f0000000000)='vmnet0\x00', 0x2) ioprio_set$uid(0x3, 0x0, 0x0) r1 = openat$dlm_plock(0xffffffffffffff9c, &(0x7f0000000040)='/dev/dlm_plock\x00', 0x92000, 0x0) ioctl$KVM_X86_SET_MCE(r1, 0x4040ae9e, &(0x7f0000000080)={0x800000000000000, 0xf000, 0x20, 0x8, 0x2}) 03:39:53 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x4c, 0x0, &(0x7f0000000200)=ANY=[@ANYBLOB="05630440000000000763044000f200008c01acbcd9297cf4a76e04ea80b60b21d6efb41548e724db19f05bcf6e830123c34234a0c43903464dd4e9c503844e734e52e396711327b0a8d8cf15"], 0x0, 0x0, 0x0}) [ 876.355740][T24007] binder: undelivered death notification, 0000000000000000 [ 876.417014][ T6353] binder: 6352:6353 unknown command 0 [ 876.424483][ T6356] binder: 6354:6356 DecRefs 0 refcount change on invalid ref 61952 ret -22 [ 876.437249][ T6353] binder: 6352:6353 ioctl c0306201 20008fd0 returned -22 03:39:53 executing program 5: r0 = syz_open_dev$sndseq(&(0x7f0000000040)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a85320, &(0x7f0000068f50)={{0x80}, 'por\xff\a\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\a\x00\x00\x00\x00\x1f\x00\x00\xff\xff\xff\xff\xff\xff\xff\xef\x00\x00\x03\xff\x00\x00\x00\x00\x00\x00\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x06\x00', 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2}) [ 876.466918][ T6356] binder: 6354:6356 unknown command -1129578100 [ 876.473411][ T6348] : renamed from bpq0 [ 876.505201][ T6356] binder: 6354:6356 ioctl c0306201 20000000 returned -22 03:39:53 executing program 4: perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80000001f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vcs\x00', 0x101000, 0x0) getsockopt$inet_sctp_SCTP_PARTIAL_DELIVERY_POINT(0xffffffffffffffff, 0x84, 0x13, &(0x7f0000000040)={0x0, 0x5}, &(0x7f0000000080)=0x8) setsockopt$inet_sctp6_SCTP_SET_PEER_PRIMARY_ADDR(r0, 0x84, 0x5, &(0x7f00000000c0)={r1, @in={{0x2, 0x4e23, @empty}}}, 0x84) 03:39:53 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f00000000c0)=[@release={0x40046302}], 0x0, 0x0, 0x0}) 03:39:53 executing program 5: r0 = syz_open_dev$sndseq(&(0x7f0000000040)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a85320, &(0x7f0000068f50)={{0x80}, 'por\xff\a\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\n\x00\x00\x00\x00\x1f\x00\x00\xff\xff\xff\xff\xff\xff\xff\xef\x00\x00\x03\xff\x00\x00\x00\x00\x00\x00\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x06\x00', 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2}) 03:39:53 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x4c, 0x0, &(0x7f0000000200)=ANY=[@ANYBLOB="05630440000000000363084000f200008c01acbcd9297cf4a76e04ea80b60b21d6efb41548e724db19f05bcf6e830123c34234a0c43903464dd4e9c503844e734e52e396711327b0a8d8cf15"], 0x0, 0x0, 0x0}) [ 876.658889][ T6373] binder: BC_ACQUIRE_RESULT not supported [ 876.695167][ T6373] binder: 6371:6373 ioctl c0306201 20008fd0 returned -22 03:39:53 executing program 1: r0 = socket$inet6(0xa, 0x5, 0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000180)='/dev/net/tun\x00', 0x0, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000100)={'lo\x00', 0x0}) ioctl$sock_SIOCGIFINDEX(r0, 0x8923, &(0x7f0000000380)={'bpq0\x00\v\x00\xfe\x00\x00\x00\x00\x00\xfa\xff`', r2}) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000000)={'bpq0\x00', 0x1212}) getpgid(0xffffffffffffffff) [ 876.751222][ T6380] binder: 6379:6380 BC_FREE_BUFFER ubcac018c0000f200 no match [ 876.775808][ T6380] binder: 6379:6380 unknown command -193189415 [ 876.785094][ T6380] binder: 6379:6380 ioctl c0306201 20000000 returned -22 [ 876.920944][ T6385] : renamed from bpq0 03:39:54 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f00000000c0)=[@release={0x40046304}], 0x0, 0x0, 0x0}) 03:39:54 executing program 5: r0 = syz_open_dev$sndseq(&(0x7f0000000040)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a85320, &(0x7f0000068f50)={{0x80}, 'por\xff\a\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00H\x00\x00\x00\x00\x1f\x00\x00\xff\xff\xff\xff\xff\xff\xff\xef\x00\x00\x03\xff\x00\x00\x00\x00\x00\x00\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x06\x00', 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2}) 03:39:54 executing program 4: perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e8, 0x0, 0x0, 0x0, 0x0, 0x6fec, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80000001f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x100000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x0, 0x7, 0x0, 0x3}, 0x0, 0x0, 0xffffffffffffffff, 0x0) getsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffff9c, 0x29, 0x23, &(0x7f0000000200)={{{@in6=@mcast2, @in6=@remote, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@mcast1}, 0x0, @in6=@mcast1}}, &(0x7f00000000c0)=0xe8) mount$9p_rdma(&(0x7f0000000000)='127.0.0.1\x00', &(0x7f0000000040)='./file0\x00', &(0x7f0000000080)='9p\x00', 0x101014, &(0x7f0000000400)=ANY=[@ANYBLOB="7472616e653d72646d752c706f72743d3092303030303030305687e7f07acadc4e220a533925f8cd30346532342c74696d656f75743d307806000000000000003030308a3688dc5ce82862f75dfb5013b3ec2cfd6290e7722aa2c024dd7394027c68bbe22a1ed069514ea1b8a21aa2ab6c378d2f59", @ANYRESDEC=r0, @ANYBLOB="2c6f626a5f75653e723d2c00846f13573318e57708006119805792c818cdf6f4548283f3b09fd3608ec09982ad853eaa4d999cbe0b6011ba2905057cd0a5140d4ffd5d76e991c3118f5dec"]) ioprio_set$uid(0x3, 0x0, 0x0) 03:39:54 executing program 1: r0 = socket$inet6(0xa, 0x5, 0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000180)='/dev/net/tun\x00', 0x0, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000100)={'lo\x00', 0x0}) ioctl$sock_SIOCGIFINDEX(r0, 0x8923, &(0x7f0000000380)={'bpq0\x00\v\x00\xfe\x00\x00\x00\x00\x00\xfa\xffh', r2}) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000000)={'bpq0\x00', 0x1212}) getpgid(0xffffffffffffffff) 03:39:54 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x4c, 0x0, &(0x7f0000000200)=ANY=[@ANYBLOB="05630440000000000a63084000f200008c01acbcd9297cf4a76e04ea80b60b21d6efb41548e724db19f05bcf6e830123c34234a0c43903464dd4e9c503844e734e52e396711327b0a8d8cf15"], 0x0, 0x0, 0x0}) 03:39:54 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f00000000c0)=[@release={0x400c630f}], 0xfdfdffff00000000, 0x700, 0x0}) [ 877.232083][ T8198] binder: undelivered death notification, 0000000000000000 03:39:54 executing program 5: r0 = syz_open_dev$sndseq(&(0x7f0000000040)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a85320, &(0x7f0000068f50)={{0x80}, 'por\xff\a\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00L\x00\x00\x00\x00\x1f\x00\x00\xff\xff\xff\xff\xff\xff\xff\xef\x00\x00\x03\xff\x00\x00\x00\x00\x00\x00\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x06\x00', 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2}) 03:39:54 executing program 4: perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80000001f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioprio_set$uid(0x3, 0x0, 0x0) r0 = syz_open_dev$amidi(&(0x7f0000000000)='/dev/amidi#\x00', 0x1f, 0x109000) setsockopt$inet_sctp_SCTP_AUTO_ASCONF(r0, 0x84, 0x1e, &(0x7f0000000040)=0x2, 0x4) [ 877.295099][ T6406] binder: BC_ATTEMPT_ACQUIRE not supported [ 877.320015][ T6406] binder: 6404:6406 ioctl c0306201 20000000 returned -22 03:39:54 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f00000000c0)=[@release={0x40046307}], 0x0, 0x0, 0x0}) [ 877.414332][ T6405] : renamed from bpq0 03:39:54 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x4c, 0x0, &(0x7f0000000200)=ANY=[@ANYBLOB="05630440000000001063084000f200008c01acbcd9297cf4a76e04ea80b60b21d6efb41548e724db19f05bcf6e830123c34234a0c43903464dd4e9c503844e734e52e396711327b0a8d8cf15"], 0x0, 0x0, 0x0}) 03:39:54 executing program 5: r0 = syz_open_dev$sndseq(&(0x7f0000000040)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a85320, &(0x7f0000068f50)={{0x80}, 'por\xff\a\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00h\x00\x00\x00\x00\x1f\x00\x00\xff\xff\xff\xff\xff\xff\xff\xef\x00\x00\x03\xff\x00\x00\x00\x00\x00\x00\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x06\x00', 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2}) 03:39:54 executing program 4: r0 = syz_open_dev$amidi(&(0x7f0000000080)='/dev/amidi#\x00', 0x7ff, 0x2) getsockopt$inet_sctp6_SCTP_GET_LOCAL_ADDRS(0xffffffffffffff9c, 0x84, 0x6d, &(0x7f00000000c0)={0x0, 0x7, "f4077c2779305c"}, &(0x7f0000000100)=0xf) getsockopt$inet_sctp_SCTP_GET_PEER_ADDR_INFO(r0, 0x84, 0xf, &(0x7f0000000200)={r1, @in6={{0xa, 0x4e20, 0x5, @initdev={0xfe, 0x88, [], 0x0, 0x0}, 0x4}}, 0x3, 0x7ff, 0x9, 0x8, 0x10001}, &(0x7f0000000140)=0x98) perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80000001f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000000000), &(0x7f0000000040)=0xc) r2 = getuid() ioprio_set$uid(0x3, r2, 0x0) [ 877.524408][ T6425] binder: 6424 invalid dec weak, ref 959 desc 0 s 1 w 0 03:39:54 executing program 1: r0 = socket$inet6(0xa, 0x5, 0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000180)='/dev/net/tun\x00', 0x0, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000100)={'lo\x00', 0x0}) ioctl$sock_SIOCGIFINDEX(r0, 0x8923, &(0x7f0000000380)={'bpq0\x00\v\x00\xfe\x00\x00\x00\x00\x00\xfa\xffl', r2}) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000000)={'bpq0\x00', 0x1212}) getpgid(0xffffffffffffffff) [ 877.614394][ T6430] binder: 6429:6430 BC_DEAD_BINDER_DONE bcac018c0000f200 not found 03:39:54 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f00000000c0)=[@release={0x40086303}], 0x0, 0x0, 0x0}) [ 877.656656][ T6430] binder: 6429:6430 unknown command -193189415 03:39:54 executing program 5: r0 = syz_open_dev$sndseq(&(0x7f0000000040)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a85320, &(0x7f0000068f50)={{0x80}, 'por\xff\a\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00l\x00\x00\x00\x00\x1f\x00\x00\xff\xff\xff\xff\xff\xff\xff\xef\x00\x00\x03\xff\x00\x00\x00\x00\x00\x00\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x06\x00', 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2}) [ 877.717017][ T6430] binder: 6429:6430 ioctl c0306201 20000000 returned -22 [ 877.756455][ T6442] binder: 6441:6442 BC_FREE_BUFFER u0000000000000000 no match [ 877.814518][ T6440] : renamed from bpq0 [ 877.890585][ T6440] : renamed from bpq0 03:39:55 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x4c, 0x0, &(0x7f0000000200)=ANY=[@ANYBLOB="05630440000000000f630c4000f200008c01acbcd9297cf4a76e04ea80b60b21d6efb41548e724db19f05bcf6e830123c34234a0c43903464dd4e9c503844e734e52e396711327b0a8d8cf15"], 0x0, 0x0, 0x0}) 03:39:55 executing program 4: r0 = perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80000001f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = getpgrp(0xffffffffffffffff) perf_event_open(&(0x7f0000000040)={0x7, 0x70, 0x1, 0x100, 0x40, 0x0, 0x0, 0x400, 0x10000, 0xf, 0x1, 0xffffffff, 0x8, 0x3, 0x4, 0x24da, 0x3f, 0x800, 0x9, 0x1ff, 0x0, 0x5, 0x7, 0xffffffffffffff80, 0x6, 0x8, 0x3, 0x2, 0x2, 0x100000000, 0x620, 0x21aa, 0x9, 0x7, 0xbe, 0x9, 0x421c, 0xf1, 0x0, 0x4, 0x2, @perf_bp={&(0x7f0000000000), 0x4}, 0x2, 0xbf74, 0x4e4f, 0x0, 0x4, 0x8001}, r1, 0xf, r0, 0x2) ioprio_set$uid(0x3, 0x0, 0x0) 03:39:55 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f00000000c0)=[@release={0x400c630f}], 0xfdfdffff00000000, 0x2000, 0x0}) 03:39:55 executing program 5: r0 = syz_open_dev$sndseq(&(0x7f0000000040)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a85320, &(0x7f0000068f50)={{0x80}, 'por\xff\a\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00t\x00\x00\x00\x00\x1f\x00\x00\xff\xff\xff\xff\xff\xff\xff\xef\x00\x00\x03\xff\x00\x00\x00\x00\x00\x00\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x06\x00', 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2}) 03:39:55 executing program 1: r0 = socket$inet6(0xa, 0x5, 0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000180)='/dev/net/tun\x00', 0x0, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000100)={'lo\x00', 0x0}) ioctl$sock_SIOCGIFINDEX(r0, 0x8923, &(0x7f0000000380)={'bpq0\x00\v\x00\xfe\x00\x00\x00\x00\x00\xfa\xfft', r2}) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000000)={'bpq0\x00', 0x1212}) getpgid(0xffffffffffffffff) 03:39:55 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f00000000c0)=[@release={0x4008630a}], 0x0, 0x0, 0x0}) [ 878.101858][ T3472] binder: undelivered death notification, 0000000000000000 [ 878.178070][ T6459] binder: BC_ATTEMPT_ACQUIRE not supported [ 878.194037][ T6467] binder: 6461:6467 BC_CLEAR_DEATH_NOTIFICATION invalid ref 61952 [ 878.217760][ T6459] binder: 6457:6459 ioctl c0306201 20008fd0 returned -22 03:39:55 executing program 4: perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x80000001f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioprio_set$uid(0x3, 0x0, 0x0) 03:39:55 executing program 5: r0 = syz_open_dev$sndseq(&(0x7f0000000040)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a85320, &(0x7f0000068f50)={{0x80}, 'por\xff\a\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00z\x00\x00\x00\x00\x1f\x00\x00\xff\xff\xff\xff\xff\xff\xff\xef\x00\x00\x03\xff\x00\x00\x00\x00\x00\x00\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x06\x00', 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2}) [ 878.228086][ T6467] binder: 6461:6467 unknown command -368808281 [ 878.246174][ T6467] binder: 6461:6467 ioctl c0306201 20000000 returned -22 [ 878.300246][ T6465] : renamed from bpq0 03:39:55 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f00000000c0)=[@release={0x40086310}], 0x0, 0x0, 0x0}) 03:39:55 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x4c, 0x0, &(0x7f0000000200)=ANY=[@ANYBLOB="056304400000000012630c4000f200008c01acbcd9297cf4a76e04ea80b60b21d6efb41548e724db19f05bcf6e830123c34234a0c43903464dd4e9c503844e734e52e396711327b0a8d8cf15"], 0x0, 0x0, 0x0}) 03:39:55 executing program 4: perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80000001f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioprio_set$uid(0x3, 0x0, 0x0) r0 = syz_open_dev$vcsn(&(0x7f0000000040)='/dev/vcs#\x00', 0x3, 0xa000) stat(&(0x7f0000000080)='./file0\x00', &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) ioctl$TUNSETGROUP(r0, 0x400454ce, r1) r2 = openat$null(0xffffffffffffff9c, &(0x7f0000000000)='/dev/null\x00', 0x1000000000, 0x0) shutdown(r2, 0x0) ioctl$sock_netdev_private(r0, 0x89f7, &(0x7f0000000200)="04b093e7b50435c5aee99b6282db34f3cf1881f698999a09c6a5d592d3bea31357c3af6201d8232a26a7881d73058510e7917d5e0ef7a19351c28ffe4717949a357b2ea5b380e8cfa4e412aa26e392e178291735326fce06e7acca265ae1e06c5d1bef3a23d85fd2c33804be0606abdb870fae151b6305f6658c726e87d2c8e9a50ec5") 03:39:55 executing program 5: r0 = syz_open_dev$sndseq(&(0x7f0000000040)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a85320, &(0x7f0000068f50)={{0x80}, 'por\xff\a\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xfd\x00\x00\x00\x00\x1f\x00\x00\xff\xff\xff\xff\xff\xff\xff\xef\x00\x00\x03\xff\x00\x00\x00\x00\x00\x00\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x06\x00', 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2}) [ 878.474401][ T6483] binder: 6482:6483 BC_DEAD_BINDER_DONE 0000000000000000 not found [ 878.492720][ T6487] binder: 6484:6487 unknown command 1074553618 03:39:55 executing program 1: r0 = socket$inet6(0xa, 0x5, 0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000180)='/dev/net/tun\x00', 0x0, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000100)={'lo\x00', 0x0}) ioctl$sock_SIOCGIFINDEX(r0, 0x8923, &(0x7f0000000380)={'bpq0\x00\v\x00\xfe\x00\x00\x00\x00\x00\xfa\xffz', r2}) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000000)={'bpq0\x00', 0x1212}) getpgid(0xffffffffffffffff) [ 878.564131][ T6487] binder: 6484:6487 ioctl c0306201 20000000 returned -22 03:39:55 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f00000000c0)=[@release={0x400c630f}], 0x0, 0x0, 0x0}) [ 878.748348][ T6496] : renamed from bpq0 [ 878.823063][ T3472] binder: undelivered death notification, 0000000000000000 03:39:56 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f00000000c0)=[@release={0x400c630f}], 0xfdfdffff00000000, 0x3f00, 0x0}) 03:39:56 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x4c, 0x0, &(0x7f0000000200)=ANY=[@ANYBLOB="056304400000000046630c4000f200008c01acbcd9297cf4a76e04ea80b60b21d6efb41548e724db19f05bcf6e830123c34234a0c43903464dd4e9c503844e734e52e396711327b0a8d8cf15"], 0x0, 0x0, 0x0}) 03:39:56 executing program 4: lstat(&(0x7f0000000000)='./file0\x00', &(0x7f0000000040)={0x0, 0x0, 0x0, 0x0, 0x0}) ioprio_set$uid(0x3, r0, 0x0) 03:39:56 executing program 5: r0 = syz_open_dev$sndseq(&(0x7f0000000040)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a85320, &(0x7f0000068f50)={{0x80}, 'por\xff\a\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00\x00\x00\x1f\x00\x00\xff\xff\xff\xff\xff\xff\xff\xef\x00\x00\x03\xff\x00\x00\x00\x00\x00\x00\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x06\x00', 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2}) 03:39:56 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f00000000c0)=[@release={0x400c6312}], 0x0, 0x0, 0x0}) 03:39:56 executing program 1: r0 = socket$inet6(0xa, 0x5, 0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000180)='/dev/net/tun\x00', 0x0, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000100)={'lo\x00', 0x0}) ioctl$sock_SIOCGIFINDEX(r0, 0x8923, &(0x7f0000000380)={'bpq0\x00\v\x00\xfe\x00\x00\x00\x00\x00\xfa\xff\xfe', r2}) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000000)={'bpq0\x00', 0x1212}) getpgid(0xffffffffffffffff) [ 878.981933][ T3472] binder: undelivered death notification, 0000000000000000 [ 879.046212][ T6522] binder: 6513:6522 unknown command 1074553670 [ 879.060871][ T6523] binder: 6512:6523 unknown command 1074553618 [ 879.073354][ T6522] binder: 6513:6522 ioctl c0306201 20000000 returned -22 03:39:56 executing program 4: perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80000001f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioprio_set$uid(0x3, 0x0, 0x0) r0 = openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000000)='/dev/sequencer2\x00', 0x0, 0x0) setsockopt$l2tp_PPPOL2TP_SO_SENDSEQ(r0, 0x111, 0x3, 0x0, 0x4) [ 879.095119][ T6523] binder: 6512:6523 ioctl c0306201 20008fd0 returned -22 03:39:56 executing program 5: r0 = syz_open_dev$sndseq(&(0x7f0000000040)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a85320, &(0x7f0000068f50)={{0x80}, 'por\xff\a\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x05\x00\x00\x00\x1f\x00\x00\xff\xff\xff\xff\xff\xff\xff\xef\x00\x00\x03\xff\x00\x00\x00\x00\x00\x00\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x06\x00', 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2}) 03:39:56 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x4c, 0x0, &(0x7f0000000200)=ANY=[@ANYBLOB="056304400000000050630c4000f200008c01acbcd9297cf4a76e04ea80b60b21d6efb41548e724db19f05bcf6e830123c34234a0c43903464dd4e9c503844e734e52e396711327b0a8d8cf15"], 0x0, 0x0, 0x0}) [ 879.141358][ T6517] : renamed from bpq0 03:39:56 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f00000000c0)=[@release={0x400c6355}], 0x0, 0x0, 0x0}) [ 879.263994][ T6536] binder: 6534:6536 unknown command 1074553680 [ 879.288162][ T6536] binder: 6534:6536 ioctl c0306201 20000000 returned -22 03:39:56 executing program 4: perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80000001f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioprio_set$uid(0x4, 0x0, 0x0) r0 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000000)='cpuacct.usage_percpu_user\x00', 0x0, 0x0) r1 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000080)='net/xfrm_stat\x00') getsockopt(r0, 0x40, 0x2d, &(0x7f0000000200)=""/4096, &(0x7f0000000100)=0x1000) linkat(r0, &(0x7f0000000040)='./file0\x00', r1, &(0x7f00000000c0)='./file0\x00', 0x1400) 03:39:56 executing program 5: r0 = syz_open_dev$sndseq(&(0x7f0000000040)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a85320, &(0x7f0000068f50)={{0x80}, 'por\xff\a\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x06\x00\x00\x00\x1f\x00\x00\xff\xff\xff\xff\xff\xff\xff\xef\x00\x00\x03\xff\x00\x00\x00\x00\x00\x00\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x06\x00', 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2}) [ 879.378212][ T6543] binder: 6542:6543 unknown command 1074553685 [ 879.403231][ T6543] binder: 6542:6543 ioctl c0306201 20008fd0 returned -22 03:39:56 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f00000000c0)=[@release={0x40106308}], 0x0, 0x0, 0x0}) 03:39:56 executing program 1: r0 = socket$inet6(0xa, 0x5, 0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000180)='/dev/net/tun\x00', 0x0, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000100)={'lo\x00', 0x0}) ioctl$sock_SIOCGIFINDEX(r0, 0x8923, &(0x7f0000000380)={'bpq0\x00\v\x00\xfe\x00\x00\x00\x00\x00\xfa\xff\x00', r2}) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000000)={'bpq0\x00', 0x1212}) getpgid(0xffffffffffffffff) 03:39:56 executing program 5: r0 = syz_open_dev$sndseq(&(0x7f0000000040)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a85320, &(0x7f0000068f50)={{0x80}, 'por\xff\a\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\a\x00\x00\x00\x1f\x00\x00\xff\xff\xff\xff\xff\xff\xff\xef\x00\x00\x03\xff\x00\x00\x00\x00\x00\x00\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x06\x00', 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2}) 03:39:56 executing program 4: perf_event_open(&(0x7f0000000040)={0x2, 0x70, 0xf7d, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendmsg$nl_generic(0xffffffffffffffff, 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x0) mount$fuse(0x0, 0x0, 0x0, 0x0, 0x0) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) syz_open_procfs(0x0, 0x0) ioctl$TIOCGETD(0xffffffffffffffff, 0x5424, 0x0) rename(&(0x7f00000003c0)='./file0\x00', &(0x7f0000000340)='./file0/file0\x00') write$FUSE_NOTIFY_STORE(0xffffffffffffffff, 0x0, 0x0) mount(0x0, 0x0, 0x0, 0x0, 0x0) pivot_root(0x0, 0x0) mount(0x0, 0x0, 0x0, 0x0, 0x0) preadv(0xffffffffffffffff, 0x0, 0x0, 0x0) 03:39:56 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x4c, 0x0, &(0x7f0000000200)=ANY=[@ANYBLOB="05630440000000005b630c4000f200008c01acbcd9297cf4a76e04ea80b60b21d6efb41548e724db19f05bcf6e830123c34234a0c43903464dd4e9c503844e734e52e396711327b0a8d8cf15"], 0x0, 0x0, 0x0}) 03:39:56 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f00000000c0)=[@release={0x400c630f}], 0xfdfdffff00000000, 0x4000, 0x0}) [ 879.875091][ T8198] binder: undelivered death notification, 0000000000000000 [ 879.934400][ T6565] binder: 6558:6565 BC_INCREFS_DONE u0000000000000000 no match [ 879.955507][ T6563] binder: 6562:6563 unknown command 1074553691 [ 879.961728][ T6563] binder: 6562:6563 ioctl c0306201 20000000 returned -22 03:39:57 executing program 5: r0 = syz_open_dev$sndseq(&(0x7f0000000040)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a85320, &(0x7f0000068f50)={{0x80}, 'por\xff\a\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\n\x00\x00\x00\x1f\x00\x00\xff\xff\xff\xff\xff\xff\xff\xef\x00\x00\x03\xff\x00\x00\x00\x00\x00\x00\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x06\x00', 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2}) 03:39:57 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f00000000c0)=[@release={0x40106309}], 0x0, 0x0, 0x0}) [ 880.034685][ T6561] : renamed from bpq0 03:39:57 executing program 4: mknod(&(0x7f0000000180)='./file0\x00', 0x8006, 0x16e8) r0 = open(&(0x7f0000000100)='./file0\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x2, 0x10, r0, 0x0) writev(0xffffffffffffffff, &(0x7f0000001840)=[{&(0x7f0000000380)="a087699485ef1c1352320bdbf4401e970797be452f0dd49fc490d4a719059b3b534474f9973213511a31052a0cc4080368b98263e1b9a9aaeeeceba17dd17f4397303f5678f299a52a7adc687fb189f62feaec1ee0e7d3821c6a6f1225fe912b9465950a83e3ff37082ffa275b166d96ab7b9354425e2d0088ceac3d9271affee829348b9e5fedaec930a1ce764bca7b632be26371adab829ccffe08bc03b3334420402af57a2071759b1a9352112b98d1f8999a79f9227c5219d6c09c48f4bc6f401e5859d45d52c3bf3212974b5905537e311660cbf78348b50c24ff5f3b5998684f2ed0ee13d82a7b3bde0a1e54da7edc9a132b62a8a64ab706e599c24dbea5c51e4be9236484e06cde3c074e96578bfbcc176fff7d7aed21ccda0f28f94863f7d54e52b427781f0fbb247fd8ff85351970fbd7f02e6d1c5defbbff8e49d355a2ee6f02d7d51383ad45c921fedbd076c4cb23f013213094f81be72b63371f6e0d47ef6fd9791c12fbdf711633e48bbd376ac9a588c329b7dab102aab51e1e8611131c2cde95048931ba6368e6f38735c0af4ac1e708ca0274e20f962913548d6590a380dca0924dd8756a2722efba49fdbc04f274ab9f5163682f49a4daa82c3c7121e6083dbd003a382b1e47aba4fc5505ca47974457732479319669a3cc7063517a8a4883ade6ace1cf9d4c36ea5cee3fe0377281127d701eff47e37bd3f70041b2a261bb90afc80c5ad5a0d2412d57981c4770e4b58a7e799f8693ac99acf50df14c68563e608fa5fb6e9c41843ab105793bea3897812033522ceb4424f9e349915ed5b98b94c5373cb057923ab3b1b745913547c11b91e90009ec217b57e05951130d2773629fd30f284afa3fb72d5376fc44793dace6a3f976b16f38d0323001fbb8d9dd5bbd04bdc7b2b987d80975f4d6d58884f075d33735e7298ab87416283c5b8d3245dfdc62c02020423e7983708a545ebdfdbceb9b69b94d841fde073fe8f1acb4ce4c8bc446b63b8623c091b4801408c58cad78ca9ccd4594ce30e1a32934460e8814f2f07c60e406f852c6c32836cb1f7ce5b59dd3517f7b0b9d18345a58e3f6ae98037111737b4ccc909abbacc5de0daa8689a8a3c95c41814cb0f1f1a5c2a775bc9110ebe099ff17de0c6dbc44ec9ff36cb4a45aa9f6d9ed8ae0d5684ec26313bcfe3e7180c5c20194f774f4077c04429aabd1fefe1637ffd2fca068f5ba272dfacdf04fa043ac7623f7c850908814952f7ae33822925e368c7ba52b23bc994d670b22d27636a452412d08f22a25f53b4b78044c11860e29c67978ccabe90b31353ef43610b8a04e8498073c5d8b212b60c608c6f83f8e4f8568f34a047070b9dc2d01ce4d440abb89a7adc7ab1b648e7f4f357964d5c19836dcbd92161892f74610e0b08f557b547e7ba38a31ff49826b24881990b5716b88f6479fc9c918f8f150dcbfc20bc879c7a20ba906f7355a17c84c15ec1ba8893eb280c4ea83df48e3b2a7ef4e6e59978616f78935fc35cbeeee28798ead0962695997b540f1d24bd43c51f0919353c82c6a1847e96140d432bc4621ed54bcc243479ad6af982ccd4ef58071d13f448f98ee44104caa44a6a6995484fb3aefa284144431a7cfe8a43a2be88079a6cd103c06b79064bb3eb980ba370d169b30889bd28cddacb5babb7288295cde4b39bfe10b0aae146c049d1a3548e0578c0f80a7d5ab1563d1eec1ff70ef52c137f7bca3fc6438c4411c575cd6a4b33e86153dec8ba265a0887721933d17e732ebadcb0d2bb3931b9b0808ca7e45c8da190df06ba6b7fe176444285fcde5a83ad2f3ebeff9819bfe86c6d4e48db9960d462aa681068afd56bac682e5db0f0351723f691af23295cdaf0f8cc0ad4e7535e33c89792a3f2bcf43844abede6b885e94a55c292d82cd80606eb700710fa26f0d9ff0e161c5702bdf0fd9d7a3ceb99d39204d5dfef360b4bc43b256f7984ace13c0903f8adfe9d3f41f0138b684341dfa51ceaff1d1881e46c25458de869276539357f1126e0552c8cefab7be2bb8d3d99cc48010c69359b1f7556643862772154b0cbc8274ff683c9afe6b0b84e9240402337870253c9d78671e3ce2a811e51f6e8337492888f55d8e84627fa81beae2d8566af47ecc8b96c3c399978a286d4115734486f75e7c27cd3e47beb456807a68928873e2158a398fa4ef6793dde8c9227953e344850b6e40a202e55b06db1702b34d2ecd3619bb4946d21a5473d8120b7645d88549ad5fa6559da05eddcab038ba041cb5702a18c6ef6e46f8fb3ecf002e5370cc4b9698586007dd31d1ad38866693ec0bcb67613926a124b9bad546c35fffdec2dde394042664fee6e7b827aa47a6361315e508bf0ef0603012e1275dbb2746a6117af0929790a9cf1726ca1bc0c2095a5766939c00b7fee0180d909cdf0b1ae6752b867e464be7b55766b7a5e4fa0093c1aaade24098bf90802314a78747bca1cd0b851ca149256322b8b230ab89eed98d4333160f3f9a8dbeb61a6b7328f6d22b814651364bc3f36874a700f67f4f340bcb81c4e8748f9f0ce28ffb0f67348846e779fb8f15deba5515df85c576b81b08c628c69c79a799998df055ef3ff0946ebe90dcdd83e902875f86de19a1f86ca0e4b66871d4e36838f7d8a1a361bc1acdd56f4125bd53ef32ce31baef27d40ccad25d6d3dedc1733e18d7df086d1ee962862ee41f02b0280a2d15afde5131738f8df220c4d4b3731bcbf5b12371e662e3586a537ded5be98ea7878486e8a9132771e8a892099f4c3f25c5bafc2287798536766c74a485b87d522eddf9deff7a9b326e38d53de432846a2747e46edae966b5caae1bf71df4ad7a75e256781945bf14ced97580cfb7da754c0922bdf7f42c55112dcecd6b536098", 0x80e}], 0x1) lstat(&(0x7f0000001640)='./file0\x00', &(0x7f0000000000)) 03:39:57 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x4c, 0x0, &(0x7f0000000200)=ANY=[@ANYBLOB="05630440000000000863104000f200008c01acbcd9297cf4a76e04ea80b60b21d6efb41548e724db19f05bcf6e830123c34234a0c43903464dd4e9c503844e734e52e396711327b0a8d8cf15"], 0x0, 0x0, 0x0}) [ 880.182872][ T6583] binder: 6579:6583 BC_ACQUIRE_DONE u0000000000000000 no match 03:39:57 executing program 1: r0 = socket$inet6(0xa, 0x5, 0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000180)='/dev/net/tun\x00', 0x0, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000100)={'lo\x00', 0x0}) ioctl$sock_SIOCGIFINDEX(r0, 0x8923, &(0x7f0000000380)={'bpq0\x00\v\x00\xfe\x00\x00\x00\x00\x00\xfa\xff\x00', r2}) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000000)={'bpq0\x00', 0x1212}) getpgid(0xffffffffffffffff) 03:39:57 executing program 4: mknod(&(0x7f0000000180)='./file0\x00', 0x8006, 0x16e8) r0 = open(&(0x7f00000000c0)='./file0\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x2, 0x10, r0, 0x0) sendmsg(0xffffffffffffffff, &(0x7f0000002e40)={0x0, 0x0, 0x0, 0x0, &(0x7f0000000b80)=[{0x480, 0x0, 0x0, "b78d9fc5911095107f80aace8d4098678255d6fb368daeb0e6fa9ba5c041d0380cb33696fb219b79321defcf20fde74f3265583b605d510d0c722ccb57eb5995b822d269d81a04322b6048e7b02ac159331ff80853a741a12742734ebdf8463196b65fe3d397a8805761d3f07bd32a574237c529660ba8c3b8f787d2a36124002d621efb9e14e9c13bc3866bfe51c47ed43d24e3a45a288ec903b319f88a8060097da0686bf3b9e7a0984b1f538a7e4a7ed7b4a1e2a2a198ff6b9dd276c8e8e0bf127d0ed8e8fcb82ffc131650dc56d1111f5aa1741eaeb19a7f1b7233af37c415ea40223e28169e09a5d7c4789255d0257d79ece2a6b906581b240f41e70194ed39bf6b9184fc907832c2984ade5f97257869968999d8473a9e9bec1a05d31199cdf306918f875369501d6bfd8a76f80d9abf6c19834435634df6377a4d8746ec672d2c30ab7dd9c5ea72537bef3b20d3ca528c0a2dcb6f03cfe067c789bd6d186e61e8c9bec574e3c6a22efb476fdc684f0b6e8dab63e0873aa662b90b0d832dcbd6f0b3d68e6ec889dd542c61e91362b1acb9d449abfe0c497dddbcdcb8a13e08dcee5a054e8f7042a2f2e69b3e2d651632108b27a4f86a352b21811b13e27b757624bfd07432633c63c175180cbd3660aa6acc45acdf37e71c56287581e91e85f102e421ef15052cca6218d70584c93b9530c6fc30a5ba37bb286e0d6995ae82853a3733540cd023aa13463754a3b5dbd066fd2ae6ae6d3b35883bde1a026cf2a282e4ca767b124eeb5beb04c7bc1e22e6a800cf9ebf231e651a485e880386ea018faafd5d563755f688acbcb05cc4ddd7662bc994013bbfa9bfcafa29f2ad738fe39da03d4befad9d6da75ff03fc2ee699775776fab6e7e6c6270cb807c909ee6068f282596fd7609c75fa05b40e88507374e04e39be0f554354085f6a135341a84d3d87cd75e54312d087e35ebc1361130959ca776d1e39160ea2dccd4e4c5fa05a833a8fc5a3d25a7f4ab73561a419fdd2f67932c29eb0e062399193920545c497fb606e8a2bd521ba7ecf456274369965c0cafb819b945c3ed98380f016aa4012480e4d03e06570eb2ec57e86d632368ddd9cc53786df621dc2f1714b533e9a84efae216aa8051866492b02c22c69316a1927c11fb2dc01f0b22c9dda75e4525d1166da864fbe3dead9e2eae80ffd6e4366404b6725c65376fad519d96844968eb28590c33fe57f39d29914e6a170a197d76e878e98b9ab7737b71890db6f4fb27fdcbd8fc8cea69ede7c48d17500aff8ad35e88e3f3ae8415e6e747a816b238e3ccdea8855248d0247ba6ca6c87c125b19f477fa63fbcf8b7c5eb4d59231fdaee5b118b3d74128ca75a0a3424f03387b10b142f36009fdeb3022ea021f13253b3bed55cb6073f3b670cad7bebcc0e30922bb41331209b0ff75f8e325f0331c49cab9c1ffabbab2c5e2bc69e26347b2f29c9784e066a27d92ac5cfd35ee388e339510b2f90db2f6b3ae9ed4e75609eb6edfad91afdc7d67afbe67cceb214c9783790a8813dc690d9f611a793193d8f0c2101bc28df1f2352ec1734dc30063a0e178a70d5d91c70ac"}], 0x480}, 0x0) lstat(&(0x7f0000000240)='./file0\x00', &(0x7f0000000000)) 03:39:57 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f00000000c0)=[@release={0x40406300}], 0x0, 0x0, 0x0}) [ 880.303346][ T6591] binder: 6589:6591 BC_INCREFS_DONE ubcac018c0000f200 no match 03:39:57 executing program 5: r0 = syz_open_dev$sndseq(&(0x7f0000000040)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a85320, &(0x7f0000068f50)={{0x80}, 'por\xff\a\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00H\x00\x00\x00\x1f\x00\x00\xff\xff\xff\xff\xff\xff\xff\xef\x00\x00\x03\xff\x00\x00\x00\x00\x00\x00\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x06\x00', 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2}) [ 880.355707][ T6591] binder: 6589:6591 unknown command 554415744 [ 880.403948][ T6591] binder: 6589:6591 ioctl c0306201 20000000 returned -22 03:39:57 executing program 4: mknod(&(0x7f0000000180)='./file0\x00', 0x8006, 0x16e8) r0 = open(&(0x7f00000000c0)='./file0\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x2, 0x10, r0, 0x0) sendmsg(0xffffffffffffffff, &(0x7f0000002e40)={0x0, 0x0, 0x0, 0x0, &(0x7f0000000b80)=[{0x478, 0x0, 0x0, "b78d9fc5911095107f80aace8d4098678255d6fb368daeb0e6fa9ba5c041d0380cb33696fb219b79321defcf20fde74f3265583b605d510d0c722ccb57eb5995b822d269d81a04322b6048e7b02ac159331ff80853a741a12742734ebdf8463196b65fe3d397a8805761d3f07bd32a574237c529660ba8c3b8f787d2a36124002d621efb9e14e9c13bc3866bfe51c47ed43d24e3a45a288ec903b319f88a8060097da0686bf3b9e7a0984b1f538a7e4a7ed7b4a1e2a2a198ff6b9dd276c8e8e0bf127d0ed8e8fcb82ffc131650dc56d1111f5aa1741eaeb19a7f1b7233af37c415ea40223e28169e09a5d7c4789255d0257d79ece2a6b906581b240f41e70194ed39bf6b9184fc907832c2984ade5f97257869968999d8473a9e9bec1a05d31199cdf306918f875369501d6bfd8a76f80d9abf6c19834435634df6377a4d8746ec672d2c30ab7dd9c5ea72537bef3b20d3ca528c0a2dcb6f03cfe067c789bd6d186e61e8c9bec574e3c6a22efb476fdc684f0b6e8dab63e0873aa662b90b0d832dcbd6f0b3d68e6ec889dd542c61e91362b1acb9d449abfe0c497dddbcdcb8a13e08dcee5a054e8f7042a2f2e69b3e2d651632108b27a4f86a352b21811b13e27b757624bfd07432633c63c175180cbd3660aa6acc45acdf37e71c56287581e91e85f102e421ef15052cca6218d70584c93b9530c6fc30a5ba37bb286e0d6995ae82853a3733540cd023aa13463754a3b5dbd066fd2ae6ae6d3b35883bde1a026cf2a282e4ca767b124eeb5beb04c7bc1e22e6a800cf9ebf231e651a485e880386ea018faafd5d563755f688acbcb05cc4ddd7662bc994013bbfa9bfcafa29f2ad738fe39da03d4befad9d6da75ff03fc2ee699775776fab6e7e6c6270cb807c909ee6068f282596fd7609c75fa05b40e88507374e04e39be0f554354085f6a135341a84d3d87cd75e54312d087e35ebc1361130959ca776d1e39160ea2dccd4e4c5fa05a833a8fc5a3d25a7f4ab73561a419fdd2f67932c29eb0e062399193920545c497fb606e8a2bd521ba7ecf456274369965c0cafb819b945c3ed98380f016aa4012480e4d03e06570eb2ec57e86d632368ddd9cc53786df621dc2f1714b533e9a84efae216aa8051866492b02c22c69316a1927c11fb2dc01f0b22c9dda75e4525d1166da864fbe3dead9e2eae80ffd6e4366404b6725c65376fad519d96844968eb28590c33fe57f39d29914e6a170a197d76e878e98b9ab7737b71890db6f4fb27fdcbd8fc8cea69ede7c48d17500aff8ad35e88e3f3ae8415e6e747a816b238e3ccdea8855248d0247ba6ca6c87c125b19f477fa63fbcf8b7c5eb4d59231fdaee5b118b3d74128ca75a0a3424f03387b10b142f36009fdeb3022ea021f13253b3bed55cb6073f3b670cad7bebcc0e30922bb41331209b0ff75f8e325f0331c49cab9c1ffabbab2c5e2bc69e26347b2f29c9784e066a27d92ac5cfd35ee388e339510b2f90db2f6b3ae9ed4e75609eb6edfad91afdc7d67afbe67cceb214c9783790a8813dc690d9f611a793193d8f0c2101bc28df1f2352ec1734dc30063a"}], 0x478}, 0x0) lstat(&(0x7f0000000240)='./file0\x00', &(0x7f0000000000)) [ 880.448219][ T6603] binder_alloc: 13678: binder_alloc_buf, no vma [ 880.485179][ T6603] binder: 6598:6603 transaction failed 29189/-3, size 0-0 line 3035 [ 880.485355][ T6594] : renamed from bpq0 03:39:57 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x4c, 0x0, &(0x7f0000000200)=ANY=[@ANYBLOB="05630440000000000963104000f200008c01acbcd9297cf4a76e04ea80b60b21d6efb41548e724db19f05bcf6e830123c34234a0c43903464dd4e9c503844e734e52e396711327b0a8d8cf15"], 0x0, 0x0, 0x0}) 03:39:57 executing program 5: r0 = syz_open_dev$sndseq(&(0x7f0000000040)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a85320, &(0x7f0000068f50)={{0x80}, 'por\xff\a\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00L\x00\x00\x00\x1f\x00\x00\xff\xff\xff\xff\xff\xff\xff\xef\x00\x00\x03\xff\x00\x00\x00\x00\x00\x00\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x06\x00', 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2}) [ 880.603568][ T8198] binder: undelivered TRANSACTION_ERROR: 29189 [ 880.652513][ T6617] binder: 6613:6617 BC_ACQUIRE_DONE ubcac018c0000f200 no match [ 880.691969][ T6617] binder: 6613:6617 unknown command 554415744 [ 880.715285][ T6617] binder: 6613:6617 ioctl c0306201 20000000 returned -22 03:39:57 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f00000000c0)=[@release={0x400c630f}], 0xfdfdffff00000000, 0x4800, 0x0}) 03:39:57 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f00000000c0)=[@release={0x40406301}], 0x0, 0x0, 0x0}) 03:39:57 executing program 1: r0 = socket$inet6(0xa, 0x5, 0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000180)='/dev/net/tun\x00', 0x0, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000100)={'lo\x00', 0x0}) ioctl$sock_SIOCGIFINDEX(r0, 0x8923, &(0x7f0000000380)={'bpq0\x00\v\x00\xfe\x00\x00\x00\x00\x00\xfa\xff\x00', r2}) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000000)={'bpq0\x00', 0x1212}) getpgid(0xffffffffffffffff) 03:39:57 executing program 4: mknod(&(0x7f0000000180)='./file0\x00', 0x8006, 0x16e8) r0 = open(&(0x7f00000019c0)='./file0\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x2, 0x10, r0, 0x0) sendmsg(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000001580)=[{&(0x7f0000000440)="f856415c33d841dd58d6581fd93f846d5ad00f27d5beffe647a5cec45a44fc6837c851f35df21d2d479779cd59a84c48d32291c94fdc12b1463bf6f817a69b53f15f663d69002e7c10aab285b39876d0085fd5d2f4a413783b1b1b1eb07642dc713a131bf5b766b8c8d56cc55bbca56c7abfc96d16ea975bcd21083c09910e69b144454a81363b69368bba1e37cfd04edc3db629b6e720f1a8b00ee5ec4b45346aee7ce5d2ed97770d330d7ef49ba3098e493e6416e6851cc84771243e625b648638111cb42f313039d7720fdf72b9fa6486d3e7332c8bdac36b724236ab45b4eb49a546708108e185b52ec331783551210840842c0642fc9d9c234fff773a865f1da8fad8f6a191ed8243e0808f250f28f0e78e51991174eb5184e4ac9d062ef31ecaf0daabf160832fdcfc30a88fde231166ab50d19ef8c17e6648696f2ecee486b95458734e1d63fdf97db4acf7b3459921bb6bc2fe16bf4a13b78ccc204f79c6141cac41b90b619593fbfce33a2ce49afd6954084041da00d5a9a1517366b800585dcbd44968c0606a62617628283083255d8dc37f4b80697c0bbed68c913d59414152bf6b6f2c15bf44426439fd4aeb74488ff5e8342fb708c482b7351f77e9c17400a73abdf21c56364bb151b2bc1e7324858e2b2b60528b8c8bc8624f3c8a7dbfb58bb9218746e71cffe05b099f2ce36b56a7818167ea6f815d9b88cb514b5564a9c310c2837cdb07d1fe392da2eec308be8ab0ea99265d5cadc0d23400a03e199748d9084daee303c3dc4045a57e8adb3049374db48b589bb16c1d29cddc4bf9566aa4ccb0381545814a6a3fd226835d5c8400585d80a5b6cb6067f00a87f65594aca057ec1769edf610397a2089eee9dbac2701b0305aed3ff94c72f4368e5b5b713587d954cd2e51ed9a47894ac9a739dd8690a3b7598108fcc91a8896c08f5dbc408ff532ef30a435a794f0122c35e66538a78b47346fba8541ab375d066afff6aeb1099b7c63812724afde4156d75f980208dffa5860c8591a02f60269f45bc1f761b71b71c25c5b173f8cf3b433a6d57d62d2962cd3684514c5f81b11b658ee1f8eb47569631c00a4161490af6c4a2fdfd909f5a01a692c62bf66b30a7837efbbeac10b363dcf66bb36bad387724623229c73c0f119af08902b8e4ac4fa5c392abd02e24e8a13e7bd3f310d6178ff98674168d48714bdbcd1ca5d7b215b54fe15eedba0602545f1708fe1f21548efa5218ba971fb168afc3e2c99ea79c895cc0daa308d2c8a96ced76f835be2de2cf969f706409d379d80bc7ecd439e221b87fbea8e9d340e2e00b00fb4aa522b515cd2ffd909e97bfcc485215b042fd877a0719a3c1e433053f4b1254535c65a723f3888b1de441db5f48edcb0369e21aca900c3694a5cbad6f1824b861c5ff6b8da0c77ca33262f98e8ec5499ce3406f31144a97791da6e37a2425eb06c64a1ab41224e46bd3aec1a52201c00d605b01485edd2f5602ceccbbbde1fded9d78f06631b1b3d4d98c10631b5f7c137923cfeff45aae35addf1f90a12305772b61ba2deba92a87264ac259cb20f8b87710b3b105aebbd44db5812f7ea73b82183dfe605e8af1538fd0de61825702f1f0bad90c8ad6f3a8c75bff2ca42e4ab23c5aa12cd1ac1368928def6b4f8a44cce543849d0c51a2f1b", 0x4aa}], 0x1}, 0x0) lstat(&(0x7f0000001640)='./file0\x00', &(0x7f0000000000)) 03:39:57 executing program 5: r0 = syz_open_dev$sndseq(&(0x7f0000000040)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a85320, &(0x7f0000068f50)={{0x80}, 'por\xff\a\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00h\x00\x00\x00\x1f\x00\x00\xff\xff\xff\xff\xff\xff\xff\xef\x00\x00\x03\xff\x00\x00\x00\x00\x00\x00\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x06\x00', 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2}) 03:39:57 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x4c, 0x0, &(0x7f0000000200)=ANY=[@ANYBLOB="05630440000000000063404000f200008c01acbcd9297cf4a76e04ea80b60b21d6efb41548e724db19f05bcf6e830123c34234a0c43903464dd4e9c503844e734e52e396711327b0a8d8cf15"], 0x0, 0x0, 0x0}) [ 880.818720][ T3472] binder: undelivered death notification, 0000000000000000 [ 880.877916][ T6627] binder: 6626:6627 got reply transaction with no transaction stack [ 880.905010][ T6627] binder: 6626:6627 transaction failed 29201/-71, size 0-0 line 2801 [ 880.928623][ T6638] binder: 6634:6638 got transaction to invalid handle [ 880.946120][ T6638] binder: 6634:6638 transaction failed 29201/-22, size -6902818922978770066--4185580950311978556 line 2896 03:39:58 executing program 4: mknod(&(0x7f0000000180)='./file0\x00', 0x8006, 0x16e8) r0 = open(&(0x7f00000019c0)='./file0\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x2, 0x10, r0, 0x0) sendmsg(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000001580)=[{&(0x7f0000000440)="f856415c33d841dd58d6581fd93f846d5ad00f27d5beffe647a5cec45a44fc6837c851f35df21d2d479779cd59a84c48d32291c94fdc12b1463bf6f817a69b53f15f663d69002e7c10aab285b39876d0085fd5d2f4a413783b1b1b1eb07642dc713a131bf5b766b8c8d56cc55bbca56c7abfc96d16ea975bcd21083c09910e69b144454a81363b69368bba1e37cfd04edc3db629b6e720f1a8b00ee5ec4b45346aee7ce5d2ed97770d330d7ef49ba3098e493e6416e6851cc84771243e625b648638111cb42f313039d7720fdf72b9fa6486d3e7332c8bdac36b724236ab45b4eb49a546708108e185b52ec331783551210840842c0642fc9d9c234fff773a865f1da8fad8f6a191ed8243e0808f250f28f0e78e51991174eb5184e4ac9d062ef31ecaf0daabf160832fdcfc30a88fde231166ab50d19ef8c17e6648696f2ecee486b95458734e1d63fdf97db4acf7b3459921bb6bc2fe16bf4a13b78ccc204f79c6141cac41b90b619593fbfce33a2ce49afd6954084041da00d5a9a1517366b800585dcbd44968c0606a62617628283083255d8dc37f4b80697c0bbed68c913d59414152bf6b6f2c15bf44426439fd4aeb74488ff5e8342fb708c482b7351f77e9c17400a73abdf21c56364bb151b2bc1e7324858e2b2b60528b8c8bc8624f3c8a7dbfb58bb9218746e71cffe05b099f2ce36b56a7818167ea6f815d9b88cb514b5564a9c310c2837cdb07d1fe392da2eec308be8ab0ea99265d5cadc0d23400a03e199748d9084daee303c3dc4045a57e8adb3049374db48b589bb16c1d29cddc4bf9566aa4ccb0381545814a6a3fd226835d5c8400585d80a5b6cb6067f00a87f65594aca057ec1769edf610397a2089eee9dbac2701b0305aed3ff94c72f4368e5b5b713587d954cd2e51ed9a47894ac9a739dd8690a3b7598108fcc91a8896c08f5dbc408ff532ef30a435a794f0122c35e66538a78b47346fba8541ab375d066afff6aeb1099b7c63812724afde4156d75f980208dffa5860c8591a02f60269f45bc1f761b71b71c25c5b173f8cf3b433a6d57d62d2962cd3684514c5f81b11b658ee1f8eb47569631c00a4161490af6c4a2fdfd909f5a01a692c62bf66b30a7837efbbeac10b363dcf66bb36bad387724623229c73c0f119af08902b8e4ac4fa5c392abd02e24e8a13e7bd3f310d6178ff98674168d48714bdbcd1ca5d7b215b54fe15eedba0602545f1708fe1f21548efa5218ba971fb168afc3e2c99ea79c895cc0daa308d2c8a96ced76f835be2de2cf969f706409d379d80bc7ecd439e221b87fbea8e9d340e2e00b00fb4aa522b515cd2ffd909e97bfcc485215b042fd877a0719a3c1e433053f4b1254535c65a723f3888b1de441db5f48edcb0369e21aca900c3694a5cbad6f1824b861c5ff6b8da0c77ca33262f98e8ec5499ce3406f31144a97791da6e37a2425eb06c64a1ab41224e46bd3aec1a52201c00d605b01485edd2f5602ceccbbbde1fded9d78f06631b1b3d4d98c10631b5f7c137923cfeff45aae35addf1f90a12305772b61ba2deba92a87264ac259cb20f8b87710b3b105aebbd44db5812f7ea73b82183dfe605e8af1538fd0de61825702f1f0bad90c8ad6f3a8c75bff2ca42e4ab23c5aa12cd1ac1368928def6b4f8a44cce543849d0c51a2f1b851f8208", 0x4ae}], 0x1}, 0x0) lstat(&(0x7f0000001640)='./file0\x00', &(0x7f0000000000)) 03:39:58 executing program 5: r0 = syz_open_dev$sndseq(&(0x7f0000000040)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a85320, &(0x7f0000068f50)={{0x80}, 'por\xff\a\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00l\x00\x00\x00\x1f\x00\x00\xff\xff\xff\xff\xff\xff\xff\xef\x00\x00\x03\xff\x00\x00\x00\x00\x00\x00\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x06\x00', 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2}) [ 880.990006][ T6630] : renamed from bpq0 03:39:58 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f00000000c0)=[@release={0x40486311}], 0x0, 0x0, 0x0}) [ 881.038429][ T8198] binder: undelivered TRANSACTION_ERROR: 29201 03:39:58 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x4c, 0x0, &(0x7f0000000200)=ANY=[@ANYBLOB="05630440000000000163404000f200008c01acbcd9297cf4a76e04ea80b60b21d6efb41548e724db19f05bcf6e830123c34234a0c43903464dd4e9c503844e734e52e396711327b0a8d8cf15"], 0x0, 0x0, 0x0}) [ 881.121997][ T8198] binder: undelivered TRANSACTION_ERROR: 29201 [ 881.145635][ T6652] binder_alloc: 13678: binder_alloc_buf, no vma 03:39:58 executing program 1: r0 = socket$inet6(0xa, 0x5, 0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000180)='/dev/net/tun\x00', 0x0, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000100)={'lo\x00', 0x0}) ioctl$sock_SIOCGIFINDEX(r0, 0x8923, &(0x7f0000000380)={'bpq0\x00\v\x00\xfe\x00\x00\x00\x00\x00\xfa\xff\x00', r2}) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000000)={'bpq0\x00', 0x1212}) getpgid(0xffffffffffffffff) 03:39:58 executing program 5: r0 = syz_open_dev$sndseq(&(0x7f0000000040)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a85320, &(0x7f0000068f50)={{0x80}, 'por\xff\a\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00t\x00\x00\x00\x1f\x00\x00\xff\xff\xff\xff\xff\xff\xff\xef\x00\x00\x03\xff\x00\x00\x00\x00\x00\x00\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x06\x00', 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2}) [ 881.191659][ T6655] binder: 6654:6655 got reply transaction with no transaction stack [ 881.195853][ T6652] binder: 6648:6652 transaction failed 29189/-3, size 0-0 line 3035 [ 881.200040][ T6655] binder: 6654:6655 transaction failed 29201/-71, size -6902818922978770066--4185580950311978556 line 2801 [ 881.301182][ T8198] binder: undelivered TRANSACTION_ERROR: 29201 [ 881.366984][ T8198] binder: undelivered TRANSACTION_ERROR: 29189 [ 881.465578][ T6661] : renamed from bpq0 03:39:58 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f00000000c0)=[@release={0x400c630f}], 0xfdfdffff00000000, 0x4c00, 0x0}) 03:39:58 executing program 4: mknod(&(0x7f0000000180)='./file0\x00', 0x8006, 0x16e8) r0 = open(&(0x7f00000000c0)='./file0\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x2, 0x10, r0, 0x0) sendmsg(0xffffffffffffffff, &(0x7f0000002e40)={0x0, 0x0, 0x0, 0x0, &(0x7f0000000b80)=[{0x470, 0x0, 0x0, "b78d9fc5911095107f80aace8d4098678255d6fb368daeb0e6fa9ba5c041d0380cb33696fb219b79321defcf20fde74f3265583b605d510d0c722ccb57eb5995b822d269d81a04322b6048e7b02ac159331ff80853a741a12742734ebdf8463196b65fe3d397a8805761d3f07bd32a574237c529660ba8c3b8f787d2a36124002d621efb9e14e9c13bc3866bfe51c47ed43d24e3a45a288ec903b319f88a8060097da0686bf3b9e7a0984b1f538a7e4a7ed7b4a1e2a2a198ff6b9dd276c8e8e0bf127d0ed8e8fcb82ffc131650dc56d1111f5aa1741eaeb19a7f1b7233af37c415ea40223e28169e09a5d7c4789255d0257d79ece2a6b906581b240f41e70194ed39bf6b9184fc907832c2984ade5f97257869968999d8473a9e9bec1a05d31199cdf306918f875369501d6bfd8a76f80d9abf6c19834435634df6377a4d8746ec672d2c30ab7dd9c5ea72537bef3b20d3ca528c0a2dcb6f03cfe067c789bd6d186e61e8c9bec574e3c6a22efb476fdc684f0b6e8dab63e0873aa662b90b0d832dcbd6f0b3d68e6ec889dd542c61e91362b1acb9d449abfe0c497dddbcdcb8a13e08dcee5a054e8f7042a2f2e69b3e2d651632108b27a4f86a352b21811b13e27b757624bfd07432633c63c175180cbd3660aa6acc45acdf37e71c56287581e91e85f102e421ef15052cca6218d70584c93b9530c6fc30a5ba37bb286e0d6995ae82853a3733540cd023aa13463754a3b5dbd066fd2ae6ae6d3b35883bde1a026cf2a282e4ca767b124eeb5beb04c7bc1e22e6a800cf9ebf231e651a485e880386ea018faafd5d563755f688acbcb05cc4ddd7662bc994013bbfa9bfcafa29f2ad738fe39da03d4befad9d6da75ff03fc2ee699775776fab6e7e6c6270cb807c909ee6068f282596fd7609c75fa05b40e88507374e04e39be0f554354085f6a135341a84d3d87cd75e54312d087e35ebc1361130959ca776d1e39160ea2dccd4e4c5fa05a833a8fc5a3d25a7f4ab73561a419fdd2f67932c29eb0e062399193920545c497fb606e8a2bd521ba7ecf456274369965c0cafb819b945c3ed98380f016aa4012480e4d03e06570eb2ec57e86d632368ddd9cc53786df621dc2f1714b533e9a84efae216aa8051866492b02c22c69316a1927c11fb2dc01f0b22c9dda75e4525d1166da864fbe3dead9e2eae80ffd6e4366404b6725c65376fad519d96844968eb28590c33fe57f39d29914e6a170a197d76e878e98b9ab7737b71890db6f4fb27fdcbd8fc8cea69ede7c48d17500aff8ad35e88e3f3ae8415e6e747a816b238e3ccdea8855248d0247ba6ca6c87c125b19f477fa63fbcf8b7c5eb4d59231fdaee5b118b3d74128ca75a0a3424f03387b10b142f36009fdeb3022ea021f13253b3bed55cb6073f3b670cad7bebcc0e30922bb41331209b0ff75f8e325f0331c49cab9c1ffabbab2c5e2bc69e26347b2f29c9784e066a27d92ac5cfd35ee388e339510b2f90db2f6b3ae9ed4e75609eb6edfad91afdc7d67afbe67cceb214c9783790a8813dc690d9f611a793193d8f0c2101bc28df1f23"}], 0x470}, 0x0) lstat(&(0x7f0000000240)='./file0\x00', &(0x7f0000000000)) 03:39:58 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x4c, 0x0, &(0x7f0000000200)=ANY=[@ANYBLOB="05630440000000001163484000f200008c01acbcd9297cf4a76e04ea80b60b21d6efb41548e724db19f05bcf6e830123c34234a0c43903464dd4e9c503844e734e52e396711327b0a8d8cf15"], 0x0, 0x0, 0x0}) 03:39:58 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f00000000c0)=[@release={0x40486312}], 0x0, 0x0, 0x0}) 03:39:58 executing program 5: r0 = syz_open_dev$sndseq(&(0x7f0000000040)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a85320, &(0x7f0000068f50)={{0x80}, 'por\xff\a\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00z\x00\x00\x00\x1f\x00\x00\xff\xff\xff\xff\xff\xff\xff\xef\x00\x00\x03\xff\x00\x00\x00\x00\x00\x00\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x06\x00', 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2}) 03:39:58 executing program 1: r0 = socket$inet6(0xa, 0x5, 0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000180)='/dev/net/tun\x00', 0x0, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000100)={'lo\x00', 0x0}) ioctl$sock_SIOCGIFINDEX(r0, 0x8923, &(0x7f0000000380)={'bpq0\x00\v\x00\xfe\x00\x00\x00\x00\x00\xfa\xff\x1a', r2}) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000000)={'bpq0\x00', 0x1212}) getpgid(0xffffffffffffffff) [ 881.764637][ T3472] binder: undelivered death notification, 0000000000000000 [ 881.821756][ T6678] binder: 6676:6678 got transaction to invalid handle [ 881.836951][ T6680] binder: 6679:6680 got reply transaction with no transaction stack 03:39:58 executing program 5: r0 = syz_open_dev$sndseq(&(0x7f0000000040)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a85320, &(0x7f0000068f50)={{0x80}, 'por\xff\a\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xfd\x00\x00\x00\x1f\x00\x00\xff\xff\xff\xff\xff\xff\xff\xef\x00\x00\x03\xff\x00\x00\x00\x00\x00\x00\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x06\x00', 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2}) 03:39:58 executing program 4: preadv(0xffffffffffffffff, &(0x7f0000001380)=[{&(0x7f0000001200)=""/148, 0x94}], 0x1, 0x0) r0 = perf_event_open(&(0x7f000001d000)={0x800000000001, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$KVM_GET_CPUID2(r0, 0xc008ae91, 0x0) r1 = syz_open_procfs(0x0, &(0x7f0000000280)='net/unix\x00') preadv(r1, &(0x7f0000000480), 0x1000000000000177, 0x0) [ 881.874052][ T6678] binder: 6676:6678 transaction failed 29201/-22, size -6902818922978770066--4185580950311978556 line 2896 [ 881.891291][ T6680] binder: 6679:6680 transaction failed 29201/-71, size 0-0 line 2801 [ 881.909456][ T6681] : renamed from bpq0 03:39:59 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f00000000c0)=[@release={0x400c630e, 0x2}], 0x0, 0x0, 0x0}) 03:39:59 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x4c, 0x0, &(0x7f0000000200)=ANY=[@ANYBLOB="05630440000000001263484000f200008c01acbcd9297cf4a76e04ea80b60b21d6efb41548e724db19f05bcf6e830123c34234a0c43903464dd4e9c503844e734e52e396711327b0a8d8cf15"], 0x0, 0x0, 0x0}) 03:39:59 executing program 5: r0 = syz_open_dev$sndseq(&(0x7f0000000040)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a85320, &(0x7f0000068f50)={{0x80}, 'por\xff\a\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x1f\x00\x00\xff\xff\xff\xff\xff\xff\xff\xef\x00\x00\x03\xff\x00\x00\x00\x00\x00\x00\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x06\x00', 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2}) [ 882.021250][ T8198] binder: undelivered TRANSACTION_ERROR: 29201 [ 882.050637][ T8198] binder: undelivered TRANSACTION_ERROR: 29201 03:39:59 executing program 1: r0 = socket$inet6(0xa, 0x5, 0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000180)='/dev/net/tun\x00', 0x0, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000100)={'lo\x00', 0x0}) ioctl$sock_SIOCGIFINDEX(r0, 0x8923, &(0x7f0000000380)={'bpq0\x00\v\x00\xfe\x00\x00\x00\x00\x00\xfa\xff\x0f', r2}) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000000)={'bpq0\x00', 0x1212}) getpgid(0xffffffffffffffff) [ 882.170804][ T6709] binder: 6703:6709 got reply transaction with no transaction stack [ 882.205210][ T6709] binder: 6703:6709 transaction failed 29201/-71, size -6902818922978770066--4185580950311978556 line 2801 [ 882.233233][ T6710] binder: 6706:6710 BC_REQUEST_DEATH_NOTIFICATION invalid ref 2 [ 882.334929][ T3472] binder: undelivered TRANSACTION_ERROR: 29201 [ 882.352593][ T6713] : renamed from bpq0 03:39:59 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f00000000c0)=[@release={0x400c630f}], 0xfdfdffff00000000, 0x6000, 0x0}) 03:39:59 executing program 4: r0 = syz_open_dev$video(&(0x7f00000000c0)='/dev/video#\x00', 0x3, 0x0) ioctl$VIDIOC_S_SELECTION(r0, 0xc040565f, &(0x7f0000000140)={0x80000000000009, 0x100, 0x0, {0x0, 0x0, 0x0, 0x300}}) 03:39:59 executing program 5: r0 = syz_open_dev$sndseq(&(0x7f0000000040)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a85320, &(0x7f0000068f50)={{0x80}, 'por\xff\a\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02\x00\x1f\x00\x00\xff\xff\xff\xff\xff\xff\xff\xef\x00\x00\x03\xff\x00\x00\x00\x00\x00\x00\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x06\x00', 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2}) 03:39:59 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x4c, 0x0, &(0x7f0000000200)=ANY=[@ANYBLOB="05630440000000000e0a0c4000f200008c01acbcd9297cf4a76e04ea80b60b21d6efb41548e724db19f05bcf6e830123c34234a0c43903464dd4e9c503844e734e52e396711327b0a8d8cf15"], 0x0, 0x0, 0x0}) 03:39:59 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f00000000c0)=[@release={0x400c630e, 0x3}], 0x0, 0x0, 0x0}) 03:39:59 executing program 1: r0 = socket$inet6(0xa, 0x5, 0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000180)='/dev/net/tun\x00', 0x0, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000100)={'lo\x00', 0x0}) ioctl$sock_SIOCGIFINDEX(r0, 0x8923, &(0x7f0000000380)={'bpq0\x00\v\x00\xfe\x00\x00\x00\x00\x00\xfa\xff\x00', r2}) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000000)={'bpq0\x00', 0x1212}) getpgid(0xffffffffffffffff) [ 882.709576][ T8198] binder: undelivered death notification, 0000000000000000 03:39:59 executing program 4: mknod(&(0x7f0000000180)='./file0\x00', 0x8006, 0x16e8) r0 = open(&(0x7f00000000c0)='./file0\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x2, 0x10, r0, 0x0) sendmsg(0xffffffffffffffff, &(0x7f0000002e40)={0x0, 0x0, 0x0, 0x0, &(0x7f0000000b80)=[{0x798, 0x0, 0x0, "b78d9fc5911095107f80aace8d4098678255d6fb368daeb0e6fa9ba5c041d0380cb33696fb219b79321defcf20fde74f3265583b605d510d0c722ccb57eb5995b822d269d81a04322b6048e7b02ac159331ff80853a741a12742734ebdf8463196b65fe3d397a8805761d3f07bd32a574237c529660ba8c3b8f787d2a36124002d621efb9e14e9c13bc3866bfe51c47ed43d24e3a45a288ec903b319f88a8060097da0686bf3b9e7a0984b1f538a7e4a7ed7b4a1e2a2a198ff6b9dd276c8e8e0bf127d0ed8e8fcb82ffc131650dc56d1111f5aa1741eaeb19a7f1b7233af37c415ea40223e28169e09a5d7c4789255d0257d79ece2a6b906581b240f41e70194ed39bf6b9184fc907832c2984ade5f97257869968999d8473a9e9bec1a05d31199cdf306918f875369501d6bfd8a76f80d9abf6c19834435634df6377a4d8746ec672d2c30ab7dd9c5ea72537bef3b20d3ca528c0a2dcb6f03cfe067c789bd6d186e61e8c9bec574e3c6a22efb476fdc684f0b6e8dab63e0873aa662b90b0d832dcbd6f0b3d68e6ec889dd542c61e91362b1acb9d449abfe0c497dddbcdcb8a13e08dcee5a054e8f7042a2f2e69b3e2d651632108b27a4f86a352b21811b13e27b757624bfd07432633c63c175180cbd3660aa6acc45acdf37e71c56287581e91e85f102e421ef15052cca6218d70584c93b9530c6fc30a5ba37bb286e0d6995ae82853a3733540cd023aa13463754a3b5dbd066fd2ae6ae6d3b35883bde1a026cf2a282e4ca767b124eeb5beb04c7bc1e22e6a800cf9ebf231e651a485e880386ea018faafd5d563755f688acbcb05cc4ddd7662bc994013bbfa9bfcafa29f2ad738fe39da03d4befad9d6da75ff03fc2ee699775776fab6e7e6c6270cb807c909ee6068f282596fd7609c75fa05b40e88507374e04e39be0f554354085f6a135341a84d3d87cd75e54312d087e35ebc1361130959ca776d1e39160ea2dccd4e4c5fa05a833a8fc5a3d25a7f4ab73561a419fdd2f67932c29eb0e062399193920545c497fb606e8a2bd521ba7ecf456274369965c0cafb819b945c3ed98380f016aa4012480e4d03e06570eb2ec57e86d632368ddd9cc53786df621dc2f1714b533e9a84efae216aa8051866492b02c22c69316a1927c11fb2dc01f0b22c9dda75e4525d1166da864fbe3dead9e2eae80ffd6e4366404b6725c65376fad519d96844968eb28590c33fe57f39d29914e6a170a197d76e878e98b9ab7737b71890db6f4fb27fdcbd8fc8cea69ede7c48d17500aff8ad35e88e3f3ae8415e6e747a816b238e3ccdea8855248d0247ba6ca6c87c125b19f477fa63fbcf8b7c5eb4d59231fdaee5b118b3d74128ca75a0a3424f03387b10b142f36009fdeb3022ea021f13253b3bed55cb6073f3b670cad7bebcc0e30922bb41331209b0ff75f8e325f0331c49cab9c1ffabbab2c5e2bc69e26347b2f29c9784e066a27d92ac5cfd35ee388e339510b2f90db2f6b3ae9ed4e75609eb6edfad91afdc7d67afbe67cceb214c9783790a8813dc690d9f611a793193d8f0c2101bc28df1f2352ec1734dc30063a0e178a70d5d91c70ac6ec350067866ea4692d2d7c648698793d1b82cfe410c99eee3f3f2fbc6d4e785bc3a3790acf35ef4cac6bceff761a733c775ea4a7819dfb5fde72a96ded97b5a40c543ac247f7dde0177cd1a672e1213ca4e6e543dfc6b5fc6efea372d44ac6358a705ae3cc3bb94525d078009a9d7835827d79ad30bf6c3b0d6a111a540c7ff7f0e431726292880579759b6520b3d80c15eaee2af0650e2080e021268624ea38d2d4b50697033c76043216d038c1b96592a00aa6320392363d1c5d28b2b111b849e1ce914fdc1b84bcd7e351a9ee2520553230da2d1a91d6cf4e27cd750e27e67f03ca3111baa2684e748c13b83897d722f20a8fdbd3eb38c05d2fb2e372ed63f43ffa140546f17e7e3dee843d03e4ddb86d8063a620f394175e8824799efeb2582e44fc5d4233b805f05ed2887f4f2a88518dfeef218300b386e21eada3f54d1f5246b4a4efd1619029e9cf34311ea079162d9316de768075a830118bf21b03c5b9cd86b4715e8d5ae67d4c2c8fb20deca31126430bee2921e35030cf412c46a1cb4eeeade0b81960f5f850554c4dce56655eb2ed9610b4c363fdf099bdb62fc67281b6a712c02814f8ea952245b0568797ba473884a222371cf5ee21619c3f1635e259a97a8eb2f7701fcd22b0ac41eb33f3dda475074762029343d59da4a5fb2ce0fdab1013c482007149c7360dadef6229ba743df46d12107437de6afe7a939cd46dc79ec687c0553d8655510589c0e175d85c837a869f3126ec4733b7836c8d44d66d819fc341a8fe6491e14ebd2a15096638e4d5bcb29e142b4b960eb034f18311c7dfe3a31c8614e410e2d2b6b05d25472845d14a18ad778b963f07fae5898db401cb47a3ade21cb6a9f52f368695adde50535f8dcc7a92ea9aa4db85b165add06c32589a94f0d2c65b327da3a55672d07ca930969c1a53d5f81ae04a229137a6aabb762821950a70d1baea5b06abb6617d6d0f3f26c87bcedff87b4ac6e27b8672e1d9d7f2af1d808b99971eac8fd3130915a58c1d189a73c9a2a89d361cb656603c7a80bd0d77c407bda9ba80e957e152b930a4b4b336f77ea16ed0829478b0cdb0b3f8af38e0bd0997d0811a9e33067"}], 0x798}, 0x0) lstat(&(0x7f0000000240)='./file0\x00', &(0x7f0000000000)) [ 882.787634][ T6730] binder: 6729:6730 unknown command 1074530830 [ 882.795997][ T6734] binder: 6732:6734 BC_REQUEST_DEATH_NOTIFICATION invalid ref 3 [ 882.803731][ T6730] binder: 6729:6730 ioctl c0306201 20000000 returned -22 03:39:59 executing program 5: r0 = syz_open_dev$sndseq(&(0x7f0000000040)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a85320, &(0x7f0000068f50)={{0x80}, 'por\xff\a\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00\x1f\x00\x00\xff\xff\xff\xff\xff\xff\xff\xef\x00\x00\x03\xff\x00\x00\x00\x00\x00\x00\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x06\x00', 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2}) [ 882.893232][ T6735] : renamed from bpq0 03:39:59 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x4c, 0x0, &(0x7f0000000200)=ANY=[@ANYBLOB="05630440000000000e230c4000f200008c01acbcd9297cf4a76e04ea80b60b21d6efb41548e724db19f05bcf6e830123c34234a0c43903464dd4e9c503844e734e52e396711327b0a8d8cf15"], 0x0, 0x0, 0x0}) 03:39:59 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f00000000c0)=[@release={0x400c630e, 0x4}], 0x0, 0x0, 0x0}) 03:40:00 executing program 4: mknod(&(0x7f0000000180)='./file0\x00', 0x8006, 0x16e8) r0 = open(&(0x7f0000000100)='./file0\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x2, 0x10, r0, 0x0) writev(0xffffffffffffffff, &(0x7f0000001840)=[{&(0x7f0000000380)="a087699485ef1c1352320bdbf4401e970797be452f0dd49fc490d4a719059b3b534474f9973213511a31052a0cc4080368b98263e1b9a9aaeeeceba17dd17f4397303f5678f299a52a7adc687fb189f62feaec1ee0e7d3821c6a6f1225fe912b9465950a83e3ff37082ffa275b166d96ab7b9354425e2d0088ceac3d9271affee829348b9e5fedaec930a1ce764bca7b632be26371adab829ccffe08bc03b3334420402af57a2071759b1a9352112b98d1f8999a79f9227c5219d6c09c48f4bc6f401e5859d45d52c3bf3212974b5905537e311660cbf78348b50c24ff5f3b5998684f2ed0ee13d82a7b3bde0a1e54da7edc9a132b62a8a64ab706e599c24dbea5c51e4be9236484e06cde3c074e96578bfbcc176fff7d7aed21ccda0f28f94863f7d54e52b427781f0fbb247fd8ff85351970fbd7f02e6d1c5defbbff8e49d355a2ee6f02d7d51383ad45c921fedbd076c4cb23f013213094f81be72b63371f6e0d47ef6fd9791c12fbdf711633e48bbd376ac9a588c329b7dab102aab51e1e8611131c2cde95048931ba6368e6f38735c0af4ac1e708ca0274e20f962913548d6590a380dca0924dd8756a2722efba49fdbc04f274ab9f5163682f49a4daa82c3c7121e6083dbd003a382b1e47aba4fc5505ca47974457732479319669a3cc7063517a8a4883ade6ace1cf9d4c36ea5cee3fe0377281127d701eff47e37bd3f70041b2a261bb90afc80c5ad5a0d2412d57981c4770e4b58a7e799f8693ac99acf50df14c68563e608fa5fb6e9c41843ab105793bea3897812033522ceb4424f9e349915ed5b98b94c5373cb057923ab3b1b745913547c11b91e90009ec217b57e05951130d2773629fd30f284afa3fb72d5376fc44793dace6a3f976b16f38d0323001fbb8d9dd5bbd04bdc7b2b987d80975f4d6d58884f075d33735e7298ab87416283c5b8d3245dfdc62c02020423e7983708a545ebdfdbceb9b69b94d841fde073fe8f1acb4ce4c8bc446b63b8623c091b4801408c58cad78ca9ccd4594ce30e1a32934460e8814f2f07c60e406f852c6c32836cb1f7ce5b59dd3517f7b0b9d18345a58e3f6ae98037111737b4ccc909abbacc5de0daa8689a8a3c95c41814cb0f1f1a5c2a775bc9110ebe099ff17de0c6dbc44ec9ff36cb4a45aa9f6d9ed8ae0d5684ec26313bcfe3e7180c5c20194f774f4077c04429aabd1fefe1637ffd2fca068f5ba272dfacdf04fa043ac7623f7c850908814952f7ae33822925e368c7ba52b23bc994d670b22d27636a452412d08f22a25f53b4b78044c11860e29c67978ccabe90b31353ef43610b8a04e8498073c5d8b212b60c608c6f83f8e4f8568f34a047070b9dc2d01ce4d440abb89a7adc7ab1b648e7f4f357964d5c19836dcbd92161892f74610e0b08f557b547e7ba38a31ff49826b24881990b5716b88f6479fc9c918f8f150dcbfc20bc879c7a20ba906f7355a17c84c15ec1ba8893eb280c4ea83df48e3b2a7ef4e6e59978616f78935fc35cbeeee28798ead0962695997b540f1d24bd43c51f0919353c82c6a1847e96140d432bc4621ed54bcc243479ad6af982ccd4ef58071d13f448f98ee44104caa44a6a6995484fb3aefa284144431a7cfe8a43a2be88079a6cd103c06b79064bb3eb980ba370d169b30889bd28cddacb5babb7288295cde4b39bfe10b0aae146c049d1a3548e0578c0f80a7d5ab1563d1eec1ff70ef52c137f7bca3fc6438c4411c575cd6a4b33e86153dec8ba265a0887721933d17e732ebadcb0d2bb3931b9b0808ca7e45c8da190df06ba6b7fe176444285fcde5a83ad2f3ebeff9819bfe86c6d4e48db9960d462aa681068afd56bac682e5db0f0351723f691af23295cdaf0f8cc0ad4e7535e33c89792a3f2bcf43844abede6b885e94a55c292d82cd80606eb700710fa26f0d9ff0e161c5702bdf0fd9d7a3ceb99d39204d5dfef360b4bc43b256f7984ace13c0903f8adfe9d3f41f0138b684341dfa51ceaff1d1881e46c25458de869276539357f1126e0552c8cefab7be2bb8d3d99cc48010c69359b1f7556643862772154b0cbc8274ff683c9afe6b0b84e9240402337870253c9d78671e3ce2a811e51f6e8337492888f55d8e84627fa81beae2d8566af47ecc8b96c3c399978a286d4115734486f75e7c27cd3e47beb456807a68928873e2158a398fa4ef6793dde8c9227953e344850b6e40a202e55b06db1702b34d2ecd3619bb4946d21a5473d8120b7645d88549ad5fa6559da05eddcab038ba041cb5702a18c6ef6e46f8fb3ecf002e5370cc4b9698586007dd31d1ad38866693ec0bcb67613926a124b9bad546c35fffdec2dde394042664fee6e7b827aa47a6361315e508bf0ef0603012e1275dbb2746a6117af0929790a9cf1726ca1bc0c2095a5766939c00b7fee0180d909cdf0b1ae6752b867e464be7b55766b7a5e4fa0093c1aaade24098bf90802314a78747bca1cd0b851ca149256322b8b230ab89eed98d4333160f3f9a8dbeb61a6b7328f6d22b814651364bc3f36874a700f67f4f340bcb81c4e8748f9f0ce28ffb0f67348846e779fb8f15deba5515df85c576b81b08c628c69c79a799998df055ef3ff0946ebe90dcdd83e902875f86de19a1f86ca0e4b66871d4e36838f7d8a1a361bc1acdd56f4125bd53ef32ce31baef27d40ccad25d6d3dedc1733e18d7df086d1ee962862ee41f02b0280a2d15afde5131738f8df220c4d4b3731bcbf5b12371e662e3586a537ded5be98ea7878486e8a9132771e8a892099f4c3f25c5bafc2287798536766c74a485b87d522eddf9deff7a9b326e38d53de432846a2747e46edae966b5caae1bf71df4ad7a75e256781945bf14ced97580cfb7da754c0922bdf7f42c55112dcecd6b53609853dfeb83ef8a", 0x814}], 0x1) lstat(&(0x7f0000001640)='./file0\x00', &(0x7f0000000000)) 03:40:00 executing program 5: r0 = syz_open_dev$sndseq(&(0x7f0000000040)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a85320, &(0x7f0000068f50)={{0x80}, 'por\xff\a\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x04\x00\x1f\x00\x00\xff\xff\xff\xff\xff\xff\xff\xef\x00\x00\x03\xff\x00\x00\x00\x00\x00\x00\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x06\x00', 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2}) [ 883.055119][ T6755] binder: 6751:6755 unknown command 1074537230 [ 883.075570][ T6754] binder: 6753:6754 BC_REQUEST_DEATH_NOTIFICATION invalid ref 4 [ 883.083394][ T6755] binder: 6751:6755 ioctl c0306201 20000000 returned -22 03:40:00 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f00000000c0)=[@release={0x400c630f}], 0xfdfdffff00000000, 0x60ff, 0x0}) 03:40:00 executing program 1: r0 = socket$inet6(0xa, 0x5, 0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000180)='/dev/net/tun\x00', 0x0, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000100)={'lo\x00', 0x0}) ioctl$sock_SIOCGIFINDEX(r0, 0x8923, &(0x7f0000000380)={'bpq0\x00\v\x00\xfe\x00\x00\x00\x00\x00\xfa\xff\x00', r2}) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000000)={'bpq0\x00', 0x1212}) getpgid(0xffffffffffffffff) 03:40:00 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x4c, 0x0, &(0x7f0000000200)=ANY=[@ANYBLOB="05630440000000000e250c4000f200008c01acbcd9297cf4a76e04ea80b60b21d6efb41548e724db19f05bcf6e830123c34234a0c43903464dd4e9c503844e734e52e396711327b0a8d8cf15"], 0x0, 0x0, 0x0}) 03:40:00 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f00000000c0)=[@release={0x400c630e, 0x5}], 0x0, 0x0, 0x0}) 03:40:00 executing program 4: mknod(&(0x7f0000000180)='./file0\x00', 0x8006, 0x16e8) r0 = open(&(0x7f0000000100)='./file0\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x2, 0x10, r0, 0x0) writev(0xffffffffffffffff, &(0x7f0000001840)=[{&(0x7f0000000380)="a087699485ef1c1352320bdbf4401e970797be452f0dd49fc490d4a719059b3b534474f9973213511a31052a0cc4080368b98263e1b9a9aaeeeceba17dd17f4397303f5678f299a52a7adc687fb189f62feaec1ee0e7d3821c6a6f1225fe912b9465950a83e3ff37082ffa275b166d96ab7b9354425e2d0088ceac3d9271affee829348b9e5fedaec930a1ce764bca7b632be26371adab829ccffe08bc03b3334420402af57a2071759b1a9352112b98d1f8999a79f9227c5219d6c09c48f4bc6f401e5859d45d52c3bf3212974b5905537e311660cbf78348b50c24ff5f3b5998684f2ed0ee13d82a7b3bde0a1e54da7edc9a132b62a8a64ab706e599c24dbea5c51e4be9236484e06cde3c074e96578bfbcc176fff7d7aed21ccda0f28f94863f7d54e52b427781f0fbb247fd8ff85351970fbd7f02e6d1c5defbbff8e49d355a2ee6f02d7d51383ad45c921fedbd076c4cb23f013213094f81be72b63371f6e0d47ef6fd9791c12fbdf711633e48bbd376ac9a588c329b7dab102aab51e1e8611131c2cde95048931ba6368e6f38735c0af4ac1e708ca0274e20f962913548d6590a380dca0924dd8756a2722efba49fdbc04f274ab9f5163682f49a4daa82c3c7121e6083dbd003a382b1e47aba4fc5505ca47974457732479319669a3cc7063517a8a4883ade6ace1cf9d4c36ea5cee3fe0377281127d701eff47e37bd3f70041b2a261bb90afc80c5ad5a0d2412d57981c4770e4b58a7e799f8693ac99acf50df14c68563e608fa5fb6e9c41843ab105793bea3897812033522ceb4424f9e349915ed5b98b94c5373cb057923ab3b1b745913547c11b91e90009ec217b57e05951130d2773629fd30f284afa3fb72d5376fc44793dace6a3f976b16f38d0323001fbb8d9dd5bbd04bdc7b2b987d80975f4d6d58884f075d33735e7298ab87416283c5b8d3245dfdc62c02020423e7983708a545ebdfdbceb9b69b94d841fde073fe8f1acb4ce4c8bc446b63b8623c091b4801408c58cad78ca9ccd4594ce30e1a32934460e8814f2f07c60e406f852c6c32836cb1f7ce5b59dd3517f7b0b9d18345a58e3f6ae98037111737b4ccc909abbacc5de0daa8689a8a3c95c41814cb0f1f1a5c2a775bc9110ebe099ff17de0c6dbc44ec9ff36cb4a45aa9f6d9ed8ae0d5684ec26313bcfe3e7180c5c20194f774f4077c04429aabd1fefe1637ffd2fca068f5ba272dfacdf04fa043ac7623f7c850908814952f7ae33822925e368c7ba52b23bc994d670b22d27636a452412d08f22a25f53b4b78044c11860e29c67978ccabe90b31353ef43610b8a04e8498073c5d8b212b60c608c6f83f8e4f8568f34a047070b9dc2d01ce4d440abb89a7adc7ab1b648e7f4f357964d5c19836dcbd92161892f74610e0b08f557b547e7ba38a31ff49826b24881990b5716b88f6479fc9c918f8f150dcbfc20bc879c7a20ba906f7355a17c84c15ec1ba8893eb280c4ea83df48e3b2a7ef4e6e59978616f78935fc35cbeeee28798ead0962695997b540f1d24bd43c51f0919353c82c6a1847e96140d432bc4621ed54bcc243479ad6af982ccd4ef58071d13f448f98ee44104caa44a6a6995484fb3aefa284144431a7cfe8a43a2be88079a6cd103c06b79064bb3eb980ba370d169b30889bd28cddacb5babb7288295cde4b39bfe10b0aae146c049d1a3548e0578c0f80a7d5ab1563d1eec1ff70ef52c137f7bca3fc6438c4411c575cd6a4b33e86153dec8ba265a0887721933d17e732ebadcb0d2bb3931b9b0808ca7e45c8da190df06ba6b7fe176444285fcde5a83ad2f3ebeff9819bfe86c6d4e48db9960d462aa681068afd56bac682e5db0f0351723f691af23295cdaf0f8cc0ad4e7535e33c89792a3f2bcf43844abede6b885e94a55c292d82cd80606eb700710fa26f0d9ff0e161c5702bdf0fd9d7a3ceb99d39204d5dfef360b4bc43b256f7984ace13c0903f8adfe9d3f41f0138b684341dfa51ceaff1d1881e46c25458de869276539357f1126e0552c8cefab7be2bb8d3d99cc48010c69359b1f7556643862772154b0cbc8274ff683c9afe6b0b84e9240402337870253c9d78671e3ce2a811e51f6e8337492888f55d8e84627fa81beae2d8566af47ecc8b96c3c399978a286d4115734486f75e7c27cd3e47beb456807a68928873e2158a398fa4ef6793dde8c9227953e344850b6e40a202e55b06db1702b34d2ecd3619bb4946d21a5473d8120b7645d88549ad5fa6559da05eddcab038ba041cb5702a18c6ef6e46f8fb3ecf002e5370cc4b9698586007dd31d1ad38866693ec0bcb67613926a124b9bad546c35fffdec2dde394042664fee6e7b827aa47a6361315e508bf0ef0603012e1275dbb2746a6117af0929790a9cf1726ca1bc0c2095a5766939c00b7fee0180d909cdf0b1ae6752b867e464be7b55766b7a5e4fa0093c1aaade24098bf90802314a78747bca1cd0b851ca149256322b8b230ab89eed98d4333160f3f9a8dbeb61a6b7328f6d22b814651364bc3f36874a700f67f4f340bcb81c4e8748f9f0ce28ffb0f67348846e779fb8f15deba5515df85c576b81b08c628c69c79a799998df055ef3ff0946ebe90dcdd83e902875f86de19a1f86ca0e4b66871d4e36838f7d8a1a361bc1acdd56f4125bd53ef32ce31baef27d40ccad25d6d3dedc1733e18d7df086d1ee962862ee41f02b0280a2d15afde5131738f8df220c4d4b3731bcbf5b12371e662e3586a537ded5be98ea7878486e8a9132771e8a892099f4c3f25c5bafc2287798536766c74a485b87d522eddf9deff7a9b326e38d53de432846a2747e46edae966b5caae1bf71df4ad7a75e256781945bf14ced97580cfb7da754c0922bdf7f42c55112dcecd6b53609853dfeb83", 0x812}], 0x1) lstat(&(0x7f0000001640)='./file0\x00', &(0x7f0000000000)) 03:40:00 executing program 5: r0 = syz_open_dev$sndseq(&(0x7f0000000040)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a85320, &(0x7f0000068f50)={{0x80}, 'por\xff\a\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x05\x00\x1f\x00\x00\xff\xff\xff\xff\xff\xff\xff\xef\x00\x00\x03\xff\x00\x00\x00\x00\x00\x00\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x06\x00', 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2}) [ 883.633864][ T8198] binder: undelivered death notification, 0000000000000000 03:40:00 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x4c, 0x0, &(0x7f0000000200)=ANY=[@ANYBLOB="05630440000000000e2a0c4000f200008c01acbcd9297cf4a76e04ea80b60b21d6efb41548e724db19f05bcf6e830123c34234a0c43903464dd4e9c503844e734e52e396711327b0a8d8cf15"], 0x0, 0x0, 0x0}) 03:40:00 executing program 5: r0 = syz_open_dev$sndseq(&(0x7f0000000040)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a85320, &(0x7f0000068f50)={{0x80}, 'por\xff\a\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x06\x00\x1f\x00\x00\xff\xff\xff\xff\xff\xff\xff\xef\x00\x00\x03\xff\x00\x00\x00\x00\x00\x00\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x06\x00', 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2}) [ 883.694554][ T6775] binder: 6769:6775 unknown command 1074537742 [ 883.713072][ T6778] binder: 6776:6778 BC_REQUEST_DEATH_NOTIFICATION invalid ref 5 [ 883.724141][ T6775] binder: 6769:6775 ioctl c0306201 20000000 returned -22 03:40:00 executing program 4: mknod(&(0x7f0000000180)='./file0\x00', 0x8006, 0x16e8) r0 = open(&(0x7f00000000c0)='./file0\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x2, 0x10, r0, 0x0) sendmsg(0xffffffffffffffff, &(0x7f0000002e40)={0x0, 0x0, 0x0, 0x0, &(0x7f0000000b80)=[{0x7c0, 0x0, 0x0, "b78d9fc5911095107f80aace8d4098678255d6fb368daeb0e6fa9ba5c041d0380cb33696fb219b79321defcf20fde74f3265583b605d510d0c722ccb57eb5995b822d269d81a04322b6048e7b02ac159331ff80853a741a12742734ebdf8463196b65fe3d397a8805761d3f07bd32a574237c529660ba8c3b8f787d2a36124002d621efb9e14e9c13bc3866bfe51c47ed43d24e3a45a288ec903b319f88a8060097da0686bf3b9e7a0984b1f538a7e4a7ed7b4a1e2a2a198ff6b9dd276c8e8e0bf127d0ed8e8fcb82ffc131650dc56d1111f5aa1741eaeb19a7f1b7233af37c415ea40223e28169e09a5d7c4789255d0257d79ece2a6b906581b240f41e70194ed39bf6b9184fc907832c2984ade5f97257869968999d8473a9e9bec1a05d31199cdf306918f875369501d6bfd8a76f80d9abf6c19834435634df6377a4d8746ec672d2c30ab7dd9c5ea72537bef3b20d3ca528c0a2dcb6f03cfe067c789bd6d186e61e8c9bec574e3c6a22efb476fdc684f0b6e8dab63e0873aa662b90b0d832dcbd6f0b3d68e6ec889dd542c61e91362b1acb9d449abfe0c497dddbcdcb8a13e08dcee5a054e8f7042a2f2e69b3e2d651632108b27a4f86a352b21811b13e27b757624bfd07432633c63c175180cbd3660aa6acc45acdf37e71c56287581e91e85f102e421ef15052cca6218d70584c93b9530c6fc30a5ba37bb286e0d6995ae82853a3733540cd023aa13463754a3b5dbd066fd2ae6ae6d3b35883bde1a026cf2a282e4ca767b124eeb5beb04c7bc1e22e6a800cf9ebf231e651a485e880386ea018faafd5d563755f688acbcb05cc4ddd7662bc994013bbfa9bfcafa29f2ad738fe39da03d4befad9d6da75ff03fc2ee699775776fab6e7e6c6270cb807c909ee6068f282596fd7609c75fa05b40e88507374e04e39be0f554354085f6a135341a84d3d87cd75e54312d087e35ebc1361130959ca776d1e39160ea2dccd4e4c5fa05a833a8fc5a3d25a7f4ab73561a419fdd2f67932c29eb0e062399193920545c497fb606e8a2bd521ba7ecf456274369965c0cafb819b945c3ed98380f016aa4012480e4d03e06570eb2ec57e86d632368ddd9cc53786df621dc2f1714b533e9a84efae216aa8051866492b02c22c69316a1927c11fb2dc01f0b22c9dda75e4525d1166da864fbe3dead9e2eae80ffd6e4366404b6725c65376fad519d96844968eb28590c33fe57f39d29914e6a170a197d76e878e98b9ab7737b71890db6f4fb27fdcbd8fc8cea69ede7c48d17500aff8ad35e88e3f3ae8415e6e747a816b238e3ccdea8855248d0247ba6ca6c87c125b19f477fa63fbcf8b7c5eb4d59231fdaee5b118b3d74128ca75a0a3424f03387b10b142f36009fdeb3022ea021f13253b3bed55cb6073f3b670cad7bebcc0e30922bb41331209b0ff75f8e325f0331c49cab9c1ffabbab2c5e2bc69e26347b2f29c9784e066a27d92ac5cfd35ee388e339510b2f90db2f6b3ae9ed4e75609eb6edfad91afdc7d67afbe67cceb214c9783790a8813dc690d9f611a793193d8f0c2101bc28df1f2352ec1734dc30063a0e178a70d5d91c70ac6ec350067866ea4692d2d7c648698793d1b82cfe410c99eee3f3f2fbc6d4e785bc3a3790acf35ef4cac6bceff761a733c775ea4a7819dfb5fde72a96ded97b5a40c543ac247f7dde0177cd1a672e1213ca4e6e543dfc6b5fc6efea372d44ac6358a705ae3cc3bb94525d078009a9d7835827d79ad30bf6c3b0d6a111a540c7ff7f0e431726292880579759b6520b3d80c15eaee2af0650e2080e021268624ea38d2d4b50697033c76043216d038c1b96592a00aa6320392363d1c5d28b2b111b849e1ce914fdc1b84bcd7e351a9ee2520553230da2d1a91d6cf4e27cd750e27e67f03ca3111baa2684e748c13b83897d722f20a8fdbd3eb38c05d2fb2e372ed63f43ffa140546f17e7e3dee843d03e4ddb86d8063a620f394175e8824799efeb2582e44fc5d4233b805f05ed2887f4f2a88518dfeef218300b386e21eada3f54d1f5246b4a4efd1619029e9cf34311ea079162d9316de768075a830118bf21b03c5b9cd86b4715e8d5ae67d4c2c8fb20deca31126430bee2921e35030cf412c46a1cb4eeeade0b81960f5f850554c4dce56655eb2ed9610b4c363fdf099bdb62fc67281b6a712c02814f8ea952245b0568797ba473884a222371cf5ee21619c3f1635e259a97a8eb2f7701fcd22b0ac41eb33f3dda475074762029343d59da4a5fb2ce0fdab1013c482007149c7360dadef6229ba743df46d12107437de6afe7a939cd46dc79ec687c0553d8655510589c0e175d85c837a869f3126ec4733b7836c8d44d66d819fc341a8fe6491e14ebd2a15096638e4d5bcb29e142b4b960eb034f18311c7dfe3a31c8614e410e2d2b6b05d25472845d14a18ad778b963f07fae5898db401cb47a3ade21cb6a9f52f368695adde50535f8dcc7a92ea9aa4db85b165add06c32589a94f0d2c65b327da3a55672d07ca930969c1a53d5f81ae04a229137a6aabb762821950a70d1baea5b06abb6617d6d0f3f26c87bcedff87b4ac6e27b8672e1d9d7f2af1d808b99971eac8fd3130915a58c1d189a73c9a2a89d361cb656603c7a80bd0d77c407bda9ba80e957e152b930a4b4b336f77ea16ed0829478b0cdb0b3f8af38e0bd0997d0811a9e33067169d503942d7df04777195f7b8f82c5b46808275e8292c0da6c541cb59d5771f10f585f1179767362c9c7cdb"}], 0x7c0}, 0x0) lstat(&(0x7f0000000240)='./file0\x00', &(0x7f0000000000)) [ 883.817169][ T6780] : renamed from bpq0 03:40:00 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f00000000c0)=[@release={0x400c630e, 0x6}], 0x0, 0x0, 0x0}) [ 883.889049][ T6793] binder: 6788:6793 unknown command 1074539022 [ 883.934204][ T6793] binder: 6788:6793 ioctl c0306201 20000000 returned -22 03:40:01 executing program 1: r0 = socket$inet6(0xa, 0x5, 0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000180)='/dev/net/tun\x00', 0x0, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000100)={'lo\x00', 0x0}) ioctl$sock_SIOCGIFINDEX(r0, 0x8923, &(0x7f0000000380)={'bpq0\x00\v\x00\xfe\x00\x00\x00\x00\x00\xfa\xff\x00', r2}) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000000)={'bpq0\x00', 0x1212}) getpgid(0xffffffffffffffff) 03:40:01 executing program 5: r0 = syz_open_dev$sndseq(&(0x7f0000000040)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a85320, &(0x7f0000068f50)={{0x80}, 'por\xff\a\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\a\x00\x1f\x00\x00\xff\xff\xff\xff\xff\xff\xff\xef\x00\x00\x03\xff\x00\x00\x00\x00\x00\x00\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x06\x00', 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2}) [ 883.974874][ T6799] binder: 6797:6799 BC_REQUEST_DEATH_NOTIFICATION invalid ref 6 [ 884.201666][ T6805] : renamed from bpq0 03:40:01 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f00000000c0)=[@release={0x400c630f}], 0xfdfdffff00000000, 0x6800, 0x0}) 03:40:01 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x4c, 0x0, &(0x7f0000000200)=ANY=[@ANYBLOB="05630440000000000e2b0c4000f200008c01acbcd9297cf4a76e04ea80b60b21d6efb41548e724db19f05bcf6e830123c34234a0c43903464dd4e9c503844e734e52e396711327b0a8d8cf15"], 0x0, 0x0, 0x0}) 03:40:01 executing program 4: 03:40:01 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f00000000c0)=[@release={0x400c630e, 0x7}], 0x0, 0x0, 0x0}) 03:40:01 executing program 5: r0 = syz_open_dev$sndseq(&(0x7f0000000040)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a85320, &(0x7f0000068f50)={{0x80}, 'por\xff\a\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\n\x00\x1f\x00\x00\xff\xff\xff\xff\xff\xff\xff\xef\x00\x00\x03\xff\x00\x00\x00\x00\x00\x00\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x06\x00', 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2}) 03:40:01 executing program 1: r0 = socket$inet6(0xa, 0x5, 0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000180)='/dev/net/tun\x00', 0x0, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000100)={'lo\x00', 0x0}) ioctl$sock_SIOCGIFINDEX(r0, 0x8923, &(0x7f0000000380)={'bpq0\x00\v\x00\xfe\x00\x00\x00\x00\x00\xfa\xff\x00', r2}) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000000)={'bpq0\x00', 0x1212}) getpgid(0xffffffffffffffff) [ 884.532904][ T3472] binder: undelivered death notification, 0000000000000000 [ 884.571625][ T6826] binder: 6820:6826 BC_REQUEST_DEATH_NOTIFICATION invalid ref 7 03:40:01 executing program 5: r0 = syz_open_dev$sndseq(&(0x7f0000000040)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a85320, &(0x7f0000068f50)={{0x80}, 'por\xff\a\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00H\x00\x1f\x00\x00\xff\xff\xff\xff\xff\xff\xff\xef\x00\x00\x03\xff\x00\x00\x00\x00\x00\x00\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x06\x00', 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2}) [ 884.621562][ T6827] binder: 6825:6827 unknown command 1074539278 03:40:01 executing program 4: 03:40:01 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f00000000c0)=[@release={0x400c630e, 0xa}], 0x0, 0x0, 0x0}) [ 884.665074][ T6827] binder: 6825:6827 ioctl c0306201 20000000 returned -22 03:40:01 executing program 5: r0 = syz_open_dev$sndseq(&(0x7f0000000040)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a85320, &(0x7f0000068f50)={{0x80}, 'por\xff\a\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00L\x00\x1f\x00\x00\xff\xff\xff\xff\xff\xff\xff\xef\x00\x00\x03\xff\x00\x00\x00\x00\x00\x00\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x06\x00', 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2}) 03:40:01 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x4c, 0x0, &(0x7f0000000200)=ANY=[@ANYBLOB="05630440000000000e2d0c4000f200008c01acbcd9297cf4a76e04ea80b60b21d6efb41548e724db19f05bcf6e830123c34234a0c43903464dd4e9c503844e734e52e396711327b0a8d8cf15"], 0x0, 0x0, 0x0}) [ 884.789912][ T6831] : renamed from bpq0 03:40:01 executing program 4: [ 884.853036][ T6842] binder: 6841:6842 BC_REQUEST_DEATH_NOTIFICATION invalid ref 10 [ 884.906618][ T6849] binder: 6847:6849 unknown command 1074539790 [ 884.943694][ T6849] binder: 6847:6849 ioctl c0306201 20000000 returned -22 03:40:02 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f00000000c0)=[@release={0x400c630f}], 0xfdfdffff00000000, 0x6c00, 0x0}) 03:40:02 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f00000000c0)=[@release={0x400c630e, 0x48}], 0x0, 0x0, 0x0}) 03:40:02 executing program 1: r0 = socket$inet6(0xa, 0x5, 0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000180)='/dev/net/tun\x00', 0x0, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000100)={'lo\x00', 0x0}) ioctl$sock_SIOCGIFINDEX(r0, 0x8923, &(0x7f0000000380)={'bpq0\x00\v\x00\xfe\x00\x00\x00\x00\x00\xfa\xff\x00', r2}) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000000)={'bpq0\x00', 0x1212}) getpgid(0xffffffffffffffff) 03:40:02 executing program 5: r0 = syz_open_dev$sndseq(&(0x7f0000000040)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a85320, &(0x7f0000068f50)={{0x80}, 'por\xff\a\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00h\x00\x1f\x00\x00\xff\xff\xff\xff\xff\xff\xff\xef\x00\x00\x03\xff\x00\x00\x00\x00\x00\x00\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x06\x00', 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2}) 03:40:02 executing program 4: 03:40:02 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x4c, 0x0, &(0x7f0000000200)=ANY=[@ANYBLOB="05630440000000000e2e0c4000f200008c01acbcd9297cf4a76e04ea80b60b21d6efb41548e724db19f05bcf6e830123c34234a0c43903464dd4e9c503844e734e52e396711327b0a8d8cf15"], 0x0, 0x0, 0x0}) [ 885.409100][ T3472] binder: undelivered death notification, 0000000000000000 [ 885.480505][ T6870] binder: 6864:6870 unknown command 1074540046 [ 885.488851][ T6869] binder: 6867:6869 BC_REQUEST_DEATH_NOTIFICATION invalid ref 72 03:40:02 executing program 4: 03:40:02 executing program 5: r0 = syz_open_dev$sndseq(&(0x7f0000000040)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a85320, &(0x7f0000068f50)={{0x80}, 'por\xff\a\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00l\x00\x1f\x00\x00\xff\xff\xff\xff\xff\xff\xff\xef\x00\x00\x03\xff\x00\x00\x00\x00\x00\x00\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x06\x00', 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2}) 03:40:02 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f00000000c0)=[@release={0x400c630e, 0x4c}], 0x0, 0x0, 0x0}) [ 885.531629][ T6870] binder: 6864:6870 ioctl c0306201 20000000 returned -22 [ 885.559708][ T6862] : renamed from bpq0 03:40:02 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x4c, 0x0, &(0x7f0000000200)=ANY=[@ANYBLOB="05630440000000000e300c4000f200008c01acbcd9297cf4a76e04ea80b60b21d6efb41548e724db19f05bcf6e830123c34234a0c43903464dd4e9c503844e734e52e396711327b0a8d8cf15"], 0x0, 0x0, 0x0}) 03:40:02 executing program 1: r0 = socket$inet6(0xa, 0x5, 0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000180)='/dev/net/tun\x00', 0x0, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000100)={'lo\x00', 0x0}) ioctl$sock_SIOCGIFINDEX(r0, 0x8923, &(0x7f0000000380)={'bpq0\x00\v\x00\xfe\x00\x00\x00\x00\x00\xfa\xff\x00', r2}) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000000)={'bpq0\x00', 0x1212}) getpgid(0xffffffffffffffff) 03:40:02 executing program 4: [ 885.718441][ T6886] binder: 6882:6886 BC_REQUEST_DEATH_NOTIFICATION invalid ref 76 [ 885.816735][ T6891] binder: 6888:6891 unknown command 1074540558 [ 885.854171][ T6891] binder: 6888:6891 ioctl c0306201 20000000 returned -22 [ 885.934546][ T6893] : renamed from bpq0 03:40:03 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f00000000c0)=[@release={0x400c630e, 0x60}], 0x0, 0x0, 0x0}) 03:40:03 executing program 5: r0 = syz_open_dev$sndseq(&(0x7f0000000040)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a85320, &(0x7f0000068f50)={{0x80}, 'por\xff\a\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00t\x00\x1f\x00\x00\xff\xff\xff\xff\xff\xff\xff\xef\x00\x00\x03\xff\x00\x00\x00\x00\x00\x00\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x06\x00', 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2}) 03:40:03 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f00000000c0)=[@release={0x400c630f}], 0xfdfdffff00000000, 0x7400, 0x0}) 03:40:03 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x4c, 0x0, &(0x7f0000000200)=ANY=[@ANYBLOB="05630440000000000e580c4000f200008c01acbcd9297cf4a76e04ea80b60b21d6efb41548e724db19f05bcf6e830123c34234a0c43903464dd4e9c503844e734e52e396711327b0a8d8cf15"], 0x0, 0x0, 0x0}) 03:40:03 executing program 4: 03:40:03 executing program 1: r0 = socket$inet6(0xa, 0x5, 0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000180)='/dev/net/tun\x00', 0x0, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000100)={'lo\x00', 0x0}) ioctl$sock_SIOCGIFINDEX(r0, 0x8923, &(0x7f0000000380)={'bpq0\x00\v\x00\xfe\x00\x00\x00\x00\x00\xfa\xff\x00', r2}) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000000)={'bpq0\x00', 0x1212}) getpgid(0xffffffffffffffff) [ 886.300644][ T3472] binder: undelivered death notification, 0000000000000000 03:40:03 executing program 4: [ 886.369417][ T6917] binder: 6910:6917 BC_REQUEST_DEATH_NOTIFICATION invalid ref 96 [ 886.383002][ T6915] binder: 6912:6915 unknown command 1074550798 03:40:03 executing program 5: r0 = syz_open_dev$sndseq(&(0x7f0000000040)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a85320, &(0x7f0000068f50)={{0x80}, 'por\xff\a\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00z\x00\x1f\x00\x00\xff\xff\xff\xff\xff\xff\xff\xef\x00\x00\x03\xff\x00\x00\x00\x00\x00\x00\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x06\x00', 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2}) 03:40:03 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f00000000c0)=[@release={0x400c630e, 0x68}], 0x0, 0x0, 0x0}) [ 886.423331][ T6915] binder: 6912:6915 ioctl c0306201 20000000 returned -22 [ 886.440445][ T6913] : renamed from bpq0 03:40:03 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x4c, 0x0, &(0x7f0000000200)=ANY=[@ANYBLOB="05630440000000000e640c4000f200008c01acbcd9297cf4a76e04ea80b60b21d6efb41548e724db19f05bcf6e830123c34234a0c43903464dd4e9c503844e734e52e396711327b0a8d8cf15"], 0x0, 0x0, 0x0}) 03:40:03 executing program 4: [ 886.617729][ T6929] binder: 6926:6929 BC_REQUEST_DEATH_NOTIFICATION invalid ref 104 03:40:03 executing program 5: r0 = syz_open_dev$sndseq(&(0x7f0000000040)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a85320, &(0x7f0000068f50)={{0x80}, 'por\xff\a\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xfd\x00\x1f\x00\x00\xff\xff\xff\xff\xff\xff\xff\xef\x00\x00\x03\xff\x00\x00\x00\x00\x00\x00\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x06\x00', 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2}) 03:40:03 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f00000000c0)=[@release={0x400c630e, 0x6c}], 0x0, 0x0, 0x0}) 03:40:03 executing program 1: r0 = socket$inet6(0xa, 0x5, 0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000180)='/dev/net/tun\x00', 0x0, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000100)={'lo\x00', 0x0}) ioctl$sock_SIOCGIFINDEX(r0, 0x8923, &(0x7f0000000380)={'bpq0\x00\v\x00\xfe\x00\x00\x00\x00\x00\xfa\xff\x00', r2}) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000000)={'bpq0\x00', 0x1212}) getpgid(0xffffffffffffffff) [ 886.686677][ T6935] binder: 6933:6935 unknown command 1074553870 [ 886.718804][ T6935] binder: 6933:6935 ioctl c0306201 20000000 returned -22 [ 886.868894][ T6945] binder: 6940:6945 BC_REQUEST_DEATH_NOTIFICATION invalid ref 108 [ 886.972294][ T6944] : renamed from bpq0 03:40:04 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f00000000c0)=[@release={0x400c630f}], 0xfdfdffff00000000, 0x7a00, 0x0}) 03:40:04 executing program 4: 03:40:04 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x4c, 0x0, &(0x7f0000000200)=ANY=[@ANYBLOB="05630440000000000e690c4000f200008c01acbcd9297cf4a76e04ea80b60b21d6efb41548e724db19f05bcf6e830123c34234a0c43903464dd4e9c503844e734e52e396711327b0a8d8cf15"], 0x0, 0x0, 0x0}) 03:40:04 executing program 5: r0 = syz_open_dev$sndseq(&(0x7f0000000040)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a85320, &(0x7f0000068f50)={{0x80}, 'por\xff\a\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02\x00\x00\x00\x1f\x00\x00\xff\xff\xff\xff\xff\xff\xff\xef\x00\x00\x03\xff\x00\x00\x00\x00\x00\x00\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x06\x00', 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2}) 03:40:04 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f00000000c0)=[@release={0x400c630e, 0x74}], 0x0, 0x0, 0x0}) 03:40:04 executing program 1: r0 = socket$inet6(0xa, 0x5, 0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000180)='/dev/net/tun\x00', 0x0, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000100)={'lo\x00', 0x0}) ioctl$sock_SIOCGIFINDEX(r0, 0x8923, &(0x7f0000000380)={'bpq0\x00\v\x00\xfe\x00\x00\x00\x00\x00\xfa\xff\x00', r2}) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000000)={'bpq0\x00', 0x1212}) getpgid(0xffffffffffffffff) [ 887.186627][ T8198] binder: undelivered death notification, 0000000000000000 03:40:04 executing program 5: r0 = syz_open_dev$sndseq(&(0x7f0000000040)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a85320, &(0x7f0000068f50)={{0x80}, 'por\xff\a\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00\x00\x00\x1f\x00\x00\xff\xff\xff\xff\xff\xff\xff\xef\x00\x00\x03\xff\x00\x00\x00\x00\x00\x00\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x06\x00', 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2}) 03:40:04 executing program 4: [ 887.259146][ T6964] binder: 6960:6964 unknown command 1074555150 [ 887.277704][ T6967] binder: 6962:6967 BC_REQUEST_DEATH_NOTIFICATION invalid ref 116 [ 887.293584][ T6964] binder: 6960:6964 ioctl c0306201 20000000 returned -22 [ 887.344594][ T6956] : renamed from bpq0 03:40:04 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x4c, 0x0, &(0x7f0000000200)=ANY=[@ANYBLOB="05630440000000000e6c0c4000f200008c01acbcd9297cf4a76e04ea80b60b21d6efb41548e724db19f05bcf6e830123c34234a0c43903464dd4e9c503844e734e52e396711327b0a8d8cf15"], 0x0, 0x0, 0x0}) 03:40:04 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f00000000c0)=[@release={0x400c630e, 0x7a}], 0x0, 0x0, 0x0}) 03:40:04 executing program 5: r0 = syz_open_dev$sndseq(&(0x7f0000000040)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a85320, &(0x7f0000068f50)={{0x80}, 'por\xff\a\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x04\x00\x00\x00\x1f\x00\x00\xff\xff\xff\xff\xff\xff\xff\xef\x00\x00\x03\xff\x00\x00\x00\x00\x00\x00\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x06\x00', 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2}) 03:40:04 executing program 1: r0 = socket$inet6(0xa, 0x5, 0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000180)='/dev/net/tun\x00', 0x0, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000100)={'lo\x00', 0x0}) ioctl$sock_SIOCGIFINDEX(r0, 0x8923, &(0x7f0000000380)={'bpq0\x00\v\x00\xfe\x00\x00\x00\x00\x00\xfa\xff\x00', r2}) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000000)={'bpq0\x00', 0x1212}) getpgid(0xffffffffffffffff) [ 887.534198][ T6983] binder: 6979:6983 unknown command 1074555918 [ 887.564901][ T6983] binder: 6979:6983 ioctl c0306201 20000000 returned -22 [ 887.728681][ T6989] : renamed from bpq0 [ 887.791699][ T6989] : renamed from bpq0 03:40:05 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f00000000c0)=[@release={0x400c630f}], 0xfdfdffff00000000, 0x9400, 0x0}) 03:40:05 executing program 4: 03:40:05 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f00000000c0)=[@release={0x400c630e, 0x300}], 0x0, 0x0, 0x0}) 03:40:05 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x4c, 0x0, &(0x7f0000000200)=ANY=[@ANYBLOB="05630440000000000e6f0c4000f200008c01acbcd9297cf4a76e04ea80b60b21d6efb41548e724db19f05bcf6e830123c34234a0c43903464dd4e9c503844e734e52e396711327b0a8d8cf15"], 0x0, 0x0, 0x0}) 03:40:05 executing program 5: r0 = syz_open_dev$sndseq(&(0x7f0000000040)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a85320, &(0x7f0000068f50)={{0x80}, 'por\xff\a\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x05\x00\x00\x00\x1f\x00\x00\xff\xff\xff\xff\xff\xff\xff\xef\x00\x00\x03\xff\x00\x00\x00\x00\x00\x00\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x06\x00', 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2}) 03:40:05 executing program 1: r0 = socket$inet6(0xa, 0x5, 0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000180)='/dev/net/tun\x00', 0x0, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000100)={'lo\x00', 0x0}) ioctl$sock_SIOCGIFINDEX(r0, 0x8923, &(0x7f0000000380)={'bpq0\x00\v\x00\xfe\x00\x00\x00\x00\x00\xfa\xff\x00', r2}) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000000)={'bpq0\x00', 0x1212}) getpgid(0xffffffffffffffff) [ 888.057448][ T8198] binder: undelivered death notification, 0000000000000000 03:40:05 executing program 4: [ 888.121887][ T7005] binder: 7001:7005 unknown command 1074556686 [ 888.159007][ T7005] binder: 7001:7005 ioctl c0306201 20000000 returned -22 03:40:05 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f00000000c0)=[@release={0x400c630e, 0x500}], 0x0, 0x0, 0x0}) 03:40:05 executing program 5: r0 = syz_open_dev$sndseq(&(0x7f0000000040)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a85320, &(0x7f0000068f50)={{0x80}, 'por\xff\a\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x06\x00\x00\x00\x1f\x00\x00\xff\xff\xff\xff\xff\xff\xff\xef\x00\x00\x03\xff\x00\x00\x00\x00\x00\x00\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x06\x00', 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2}) [ 888.231654][ T7006] : renamed from bpq0 03:40:05 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x4c, 0x0, &(0x7f0000000200)=ANY=[@ANYBLOB="05630440000000000e700c4000f200008c01acbcd9297cf4a76e04ea80b60b21d6efb41548e724db19f05bcf6e830123c34234a0c43903464dd4e9c503844e734e52e396711327b0a8d8cf15"], 0x0, 0x0, 0x0}) [ 888.320701][ T7006] : renamed from bpq0 03:40:05 executing program 4: [ 888.380996][ T7026] binder: 7023:7026 unknown command 1074556942 03:40:05 executing program 5: r0 = syz_open_dev$sndseq(&(0x7f0000000040)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a85320, &(0x7f0000068f50)={{0x80}, 'por\xff\a\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\a\x00\x00\x00\x1f\x00\x00\xff\xff\xff\xff\xff\xff\xff\xef\x00\x00\x03\xff\x00\x00\x00\x00\x00\x00\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x06\x00', 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2}) [ 888.425400][ T7026] binder: 7023:7026 ioctl c0306201 20000000 returned -22 03:40:06 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f00000000c0)=[@release={0x400c630f}], 0xfdfdffff00000000, 0x207100, 0x0}) 03:40:06 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f00000000c0)=[@release={0x400c630e, 0x600}], 0x0, 0x0, 0x0}) 03:40:06 executing program 4: 03:40:06 executing program 1: r0 = socket$inet6(0xa, 0x5, 0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000180)='/dev/net/tun\x00', 0x0, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000100)={'lo\x00', 0x0}) ioctl$sock_SIOCGIFINDEX(r0, 0x8923, &(0x7f0000000380)={'bpq0\x00\v\x00\xfe\x00\x00\x00\x00\x00\xfa\xff\x00', r2}) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000000)={'bpq0\x00', 0x1212}) getpgid(0xffffffffffffffff) 03:40:06 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x4c, 0x0, &(0x7f0000000200)=ANY=[@ANYBLOB="05630440000000000e730c4000f200008c01acbcd9297cf4a76e04ea80b60b21d6efb41548e724db19f05bcf6e830123c34234a0c43903464dd4e9c503844e734e52e396711327b0a8d8cf15"], 0x0, 0x0, 0x0}) 03:40:06 executing program 5: r0 = syz_open_dev$sndseq(&(0x7f0000000040)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a85320, &(0x7f0000068f50)={{0x80}, 'por\xff\a\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\n\x00\x00\x00\x1f\x00\x00\xff\xff\xff\xff\xff\xff\xff\xef\x00\x00\x03\xff\x00\x00\x00\x00\x00\x00\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x06\x00', 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2}) [ 888.989174][ T8198] binder: undelivered death notification, 0000000000000000 03:40:06 executing program 4: [ 889.036652][ T7047] binder: 7040:7047 unknown command 1074557710 [ 889.044653][ T7045] binder_thread_write: 3 callbacks suppressed [ 889.044665][ T7045] binder: 7038:7045 BC_REQUEST_DEATH_NOTIFICATION invalid ref 1536 [ 889.065554][ T7047] binder: 7040:7047 ioctl c0306201 20000000 returned -22 03:40:06 executing program 5: r0 = syz_open_dev$sndseq(&(0x7f0000000040)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a85320, &(0x7f0000068f50)={{0x80}, 'por\xff\a\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00H\x00\x00\x00\x1f\x00\x00\xff\xff\xff\xff\xff\xff\xff\xef\x00\x00\x03\xff\x00\x00\x00\x00\x00\x00\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x06\x00', 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2}) 03:40:06 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f00000000c0)=[@release={0x400c630e, 0x700}], 0x0, 0x0, 0x0}) 03:40:06 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x4c, 0x0, &(0x7f0000000200)=ANY=[@ANYBLOB="05630440000000000e750c4000f200008c01acbcd9297cf4a76e04ea80b60b21d6efb41548e724db19f05bcf6e830123c34234a0c43903464dd4e9c503844e734e52e396711327b0a8d8cf15"], 0x0, 0x0, 0x0}) [ 889.186781][ T7046] : renamed from bpq0 03:40:06 executing program 4: 03:40:06 executing program 5: r0 = syz_open_dev$sndseq(&(0x7f0000000040)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a85320, &(0x7f0000068f50)={{0x80}, 'por\xff\a\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00L\x00\x00\x00\x1f\x00\x00\xff\xff\xff\xff\xff\xff\xff\xef\x00\x00\x03\xff\x00\x00\x00\x00\x00\x00\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x06\x00', 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2}) [ 889.296468][ T7060] binder: 7059:7060 BC_REQUEST_DEATH_NOTIFICATION invalid ref 1792 [ 889.305229][ T7064] binder: 7061:7064 unknown command 1074558222 [ 889.319008][ T7064] binder: 7061:7064 ioctl c0306201 20000000 returned -22 03:40:06 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f00000000c0)=[@release={0x400c630f}], 0xfdfdffff00000000, 0x400000, 0x0}) 03:40:06 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x4c, 0x0, &(0x7f0000000200)=ANY=[@ANYBLOB="05630440000000000e780c4000f200008c01acbcd9297cf4a76e04ea80b60b21d6efb41548e724db19f05bcf6e830123c34234a0c43903464dd4e9c503844e734e52e396711327b0a8d8cf15"], 0x0, 0x0, 0x0}) 03:40:06 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f00000000c0)=[@release={0x400c630e, 0xa00}], 0x0, 0x0, 0x0}) 03:40:06 executing program 1: r0 = socket$inet6(0xa, 0x5, 0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000180)='/dev/net/tun\x00', 0x0, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000100)={'lo\x00', 0x0}) ioctl$sock_SIOCGIFINDEX(r0, 0x8923, &(0x7f0000000380)={'bpq0\x00\v\x00\xfe\x00\x00\x00\x00\x00\xfa\xff\x00', r2}) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000000)={'bpq0\x00', 0x1212}) getpgid(0xffffffffffffffff) 03:40:06 executing program 4: 03:40:06 executing program 5: r0 = syz_open_dev$sndseq(&(0x7f0000000040)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a85320, &(0x7f0000068f50)={{0x80}, 'por\xff\a\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00h\x00\x00\x00\x1f\x00\x00\xff\xff\xff\xff\xff\xff\xff\xef\x00\x00\x03\xff\x00\x00\x00\x00\x00\x00\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x06\x00', 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2}) [ 889.884791][ T8198] binder: undelivered death notification, 0000000000000000 03:40:07 executing program 4: perf_event_open(&(0x7f0000000040)={0x2, 0x70, 0xf7d, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000300)={&(0x7f00000002c0)=@newlink={0x20, 0x10, 0xc362e63b3f31ba5f}, 0x20}}, 0x0) [ 889.962397][ T7088] binder: 7079:7088 unknown command 1074558990 [ 889.972394][ T7086] binder: 7078:7086 BC_REQUEST_DEATH_NOTIFICATION invalid ref 2560 03:40:07 executing program 5: r0 = syz_open_dev$sndseq(&(0x7f0000000040)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a85320, &(0x7f0000068f50)={{0x80}, 'por\xff\a\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00l\x00\x00\x00\x1f\x00\x00\xff\xff\xff\xff\xff\xff\xff\xef\x00\x00\x03\xff\x00\x00\x00\x00\x00\x00\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x06\x00', 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2}) [ 890.025464][ T7088] binder: 7079:7088 ioctl c0306201 20000000 returned -22 [ 890.036213][ T7085] : renamed from bpq0 03:40:07 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f00000000c0)=[@release={0x400c630e, 0x2000}], 0x0, 0x0, 0x0}) 03:40:07 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x4c, 0x0, &(0x7f0000000200)=ANY=[@ANYBLOB="05630440000000000e63464000f200008c01acbcd9297cf4a76e04ea80b60b21d6efb41548e724db19f05bcf6e830123c34234a0c43903464dd4e9c503844e734e52e396711327b0a8d8cf15"], 0x0, 0x0, 0x0}) 03:40:07 executing program 4: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080)='/dev/kvm\x00', 0x0, 0x0) ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) mkdir(&(0x7f0000000700)='./file1\x00', 0x100) creat(&(0x7f0000000140)='./file1/file0\x00', 0x0) r1 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1000000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r2 = getpid() sched_setscheduler(r2, 0x5, &(0x7f0000000040)) ioctl$SNDRV_CTL_IOCTL_ELEM_REPLACE(0xffffffffffffffff, 0xc1105518, 0x0) mkdir(&(0x7f0000000180)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./file0\x00', &(0x7f00000000c0)='overlay\x00', 0x0, &(0x7f0000000c40)=ANY=[@ANYBLOB="75707065726469723d2e2f66696c65302c6c6f7765726469723d2e2f66696c65312c776f726b6469723d2e2f66696c653100d5d9097e"]) stat(&(0x7f00000001c0)='./file1/file0\x00', 0x0) setxattr$system_posix_acl(&(0x7f0000000080)='./file1/file0\x00', &(0x7f0000000380)='system.posix_acl_access\x00', &(0x7f0000000cc0)={{}, {}, [{}, {}, {0x2, 0x2}, {0x2, 0x2}], {}, [{0x8, 0x2}, {0x8, 0x4}], {}, {0x20, 0x4}}, 0x54, 0x0) chdir(&(0x7f0000000280)='./file0\x00') openat$dir(0xffffffffffffff9c, &(0x7f0000000200)='./file0\x00', 0x526, 0x0) ioctl$BLKRESETZONE(r1, 0x40101283, &(0x7f0000000100)={0x7fff}) 03:40:07 executing program 1: r0 = socket$inet6(0xa, 0x5, 0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000180)='/dev/net/tun\x00', 0x0, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000100)={'lo\x00', 0x0}) ioctl$sock_SIOCGIFINDEX(r0, 0x8923, &(0x7f0000000380)={'bpq0\x00\v\x00\xfe\x00\x00\x00\x00\x00\xfa\xff\xff', r2}) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000000)={'bpq0\x00', 0x1212}) getpgid(0xffffffffffffffff) [ 890.243916][ T7108] binder: 7105:7108 unknown command 1078354702 [ 890.253263][ T7108] binder: 7105:7108 ioctl c0306201 20000000 returned -22 [ 890.278397][ T7107] binder: 7106:7107 BC_REQUEST_DEATH_NOTIFICATION invalid ref 8192 [ 890.447398][ T7114] : renamed from bpq0 [ 890.571511][ T7115] overlayfs: failed to resolve './file1': -2 03:40:07 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f00000000c0)=[@release={0x400c630f}], 0xfdfdffff00000000, 0x50a000, 0x0}) 03:40:07 executing program 5: r0 = syz_open_dev$sndseq(&(0x7f0000000040)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a85320, &(0x7f0000068f50)={{0x80}, 'por\xff\a\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00t\x00\x00\x00\x1f\x00\x00\xff\xff\xff\xff\xff\xff\xff\xef\x00\x00\x03\xff\x00\x00\x00\x00\x00\x00\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x06\x00', 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2}) 03:40:07 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x4c, 0x0, &(0x7f0000000200)=ANY=[@ANYBLOB="05630440000000000e63504000f200008c01acbcd9297cf4a76e04ea80b60b21d6efb41548e724db19f05bcf6e830123c34234a0c43903464dd4e9c503844e734e52e396711327b0a8d8cf15"], 0x0, 0x0, 0x0}) 03:40:07 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f00000000c0)=[@release={0x400c630e, 0x4800}], 0x0, 0x0, 0x0}) 03:40:07 executing program 1: r0 = socket$inet6(0xa, 0x5, 0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000180)='/dev/net/tun\x00', 0x0, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000100)={'lo\x00', 0x0}) ioctl$sock_SIOCGIFINDEX(r0, 0x8923, &(0x7f0000000380)={'bpq0\x00\v\x00\xfe\x00\x00\x00\x00\x00\xfa\xff\x00', r2}) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000000)={'bpq0\x00', 0x1212}) getpgid(0xffffffffffffffff) [ 890.835419][ T3472] binder: undelivered death notification, 0000000000000000 03:40:07 executing program 4: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000380)='net/ip6_tables_targets\x00') sync_file_range(r1, 0x0, 0x2, 0x0) [ 890.925218][ T7129] binder: 7128:7129 BC_REQUEST_DEATH_NOTIFICATION invalid ref 18432 [ 890.963347][ T7135] binder: 7133:7135 unknown command 1079010062 03:40:08 executing program 5: r0 = syz_open_dev$sndseq(&(0x7f0000000040)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a85320, &(0x7f0000068f50)={{0x80}, 'por\xff\a\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00z\x00\x00\x00\x1f\x00\x00\xff\xff\xff\xff\xff\xff\xff\xef\x00\x00\x03\xff\x00\x00\x00\x00\x00\x00\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x06\x00', 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2}) 03:40:08 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f00000000c0)=[@release={0x400c630e, 0x4c00}], 0x0, 0x0, 0x0}) [ 891.014379][ T7135] binder: 7133:7135 ioctl c0306201 20000000 returned -22 03:40:08 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x4c, 0x0, &(0x7f0000000200)=ANY=[@ANYBLOB="05630440000000000e635b4000f200008c01acbcd9297cf4a76e04ea80b60b21d6efb41548e724db19f05bcf6e830123c34234a0c43903464dd4e9c503844e734e52e396711327b0a8d8cf15"], 0x0, 0x0, 0x0}) [ 891.097540][ T7134] : renamed from bpq0 03:40:08 executing program 4: socketpair$unix(0x1, 0x80000000000005, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) perf_event_open(&(0x7f0000000000)={0x0, 0x70, 0x800000000000012, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = openat$ptmx(0xffffffffffffff9c, &(0x7f000088cff6)='/dev/ptmx\x00', 0x1000000000001, 0x0) ioctl$TCSETS(r1, 0x40045431, &(0x7f00003b3fdc)) write(r1, &(0x7f000054bfba)="4f7ad0c9edb302486f1748144523c0c253773e00d49ba39063e2432e8de58f5930fd07000000dcf50bbc54b70c0ea17b4728dde5f9eedfc811ff1f75642558334444c9fe3d13", 0x46) r2 = syz_open_pts(r1, 0x2) writev(r2, &(0x7f0000000040)=[{&(0x7f0000000180)="10", 0x1}], 0x1) ioctl$TCSETSW(r1, 0x5403, &(0x7f00000003c0)) 03:40:08 executing program 5: r0 = syz_open_dev$sndseq(&(0x7f0000000040)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a85320, &(0x7f0000068f50)={{0x80}, 'por\xff\a\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xfd\x00\x00\x00\x1f\x00\x00\xff\xff\xff\xff\xff\xff\xff\xef\x00\x00\x03\xff\x00\x00\x00\x00\x00\x00\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x06\x00', 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2}) [ 891.180248][ T7152] binder: 7151:7152 unknown command 1079730958 [ 891.195917][ T7155] binder: 7149:7155 BC_REQUEST_DEATH_NOTIFICATION invalid ref 19456 [ 891.215198][ T7152] binder: 7151:7152 ioctl c0306201 20000000 returned -22 03:40:08 executing program 1: r0 = socket$inet6(0xa, 0x5, 0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000180)='/dev/net/tun\x00', 0x0, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000100)={'lo\x00', 0x0}) ioctl$sock_SIOCGIFINDEX(r0, 0x8923, &(0x7f0000000380)={'bpq0\x00\v\x00\xfe\x00\x00\x00\x00\x00\xfa\xff\x00', r2}) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000000)={'bpq0\x00', 0x1212}) getpgid(0xffffffffffffffff) [ 891.497266][ T7168] : renamed from bpq0 03:40:08 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f00000000c0)=[@release={0x400c630f}], 0xfdfdffff00000000, 0x709000, 0x0}) 03:40:08 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x4c, 0x0, &(0x7f0000000200)=ANY=[@ANYBLOB="05630440000000000e630c4600f200008c01acbcd9297cf4a76e04ea80b60b21d6efb41548e724db19f05bcf6e830123c34234a0c43903464dd4e9c503844e734e52e396711327b0a8d8cf15"], 0x0, 0x0, 0x0}) 03:40:08 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f00000000c0)=[@release={0x400c630e, 0x6000}], 0x0, 0x0, 0x0}) 03:40:08 executing program 5: r0 = syz_open_dev$sndseq(&(0x7f0000000040)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a85320, &(0x7f0000068f50)={{0x80}, 'por\xff\a\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00\x00\x1f\x00\x00\xff\xff\xff\xff\xff\xff\xff\xef\x00\x00\x03\xff\x00\x00\x00\x00\x00\x00\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x06\x00', 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2}) 03:40:08 executing program 4: perf_event_open(&(0x7f0000000040)={0x2, 0x70, 0xf7d, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) msgctl$MSG_INFO(0x0, 0xc, &(0x7f0000000140)=""/133) 03:40:08 executing program 1: r0 = socket$inet6(0xa, 0x5, 0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000180)='/dev/net/tun\x00', 0x0, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000100)={'lo\x00', 0x0}) ioctl$sock_SIOCGIFINDEX(r0, 0x8923, &(0x7f0000000380)={'bpq0\x00\v\x00\xfe\x00\x00\x00\x00\x00\xfa\xff\x00', r2}) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000000)={'bpq0\x00', 0x1212}) getpgid(0xffffffffffffffff) [ 891.738233][ T3472] binder: undelivered death notification, 0000000000000000 [ 891.806261][ T7188] binder: 7179:7188 BC_REQUEST_DEATH_NOTIFICATION invalid ref 24576 [ 891.809849][ T7190] binder: 7180:7190 unknown command 1175216910 [ 891.842426][ T7190] binder: 7180:7190 ioctl c0306201 20000000 returned -22 03:40:08 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f00000000c0)=[@release={0x400c630e, 0x6800}], 0x0, 0x0, 0x0}) 03:40:08 executing program 5: r0 = syz_open_dev$sndseq(&(0x7f0000000040)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a85320, &(0x7f0000068f50)={{0x80}, 'por\xff\a\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x05\x00\x00\x1f\x00\x00\xff\xff\xff\xff\xff\xff\xff\xef\x00\x00\x03\xff\x00\x00\x00\x00\x00\x00\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x06\x00', 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2}) 03:40:08 executing program 4: r0 = socket$inet6(0xa, 0x5, 0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000180)='/dev/net/tun\x00', 0x0, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000100)={'lo\x00', 0x0}) ioctl$sock_SIOCGIFINDEX(r0, 0x8923, &(0x7f0000000380)={'bpq0\x00\v\x00\xfe\x00\x00\x00`\x00\xfa\xff\x00', r2}) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000000)={'bpq0\x00', 0x1212}) getpgid(0xffffffffffffffff) 03:40:09 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x4c, 0x0, &(0x7f0000000200)=ANY=[@ANYBLOB="05630440000000000e630c5000f200008c01acbcd9297cf4a76e04ea80b60b21d6efb41548e724db19f05bcf6e830123c34234a0c43903464dd4e9c503844e734e52e396711327b0a8d8cf15"], 0x0, 0x0, 0x0}) [ 891.953616][ T7186] : renamed from bpq0 [ 892.027704][ T7200] binder: 7198:7200 BC_REQUEST_DEATH_NOTIFICATION invalid ref 26624 03:40:09 executing program 1: r0 = socket$inet6(0xa, 0x5, 0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000180)='/dev/net/tun\x00', 0x0, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000100)={'lo\x00', 0x0}) ioctl$sock_SIOCGIFINDEX(r0, 0x8923, &(0x7f0000000380)={'bpq0\x00\v\x00\xfe\x00\x00\x00\x00\x00\xfa\xff\x00', r2}) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000000)={'bpq0\x00', 0x1212}) getpgid(0xffffffffffffffff) 03:40:09 executing program 5: r0 = syz_open_dev$sndseq(&(0x7f0000000040)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a85320, &(0x7f0000068f50)={{0x80}, 'por\xff\a\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x06\x00\x00\x1f\x00\x00\xff\xff\xff\xff\xff\xff\xff\xef\x00\x00\x03\xff\x00\x00\x00\x00\x00\x00\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x06\x00', 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2}) [ 892.075888][ T7208] binder: 7207:7208 unknown command 1342989070 [ 892.097080][ T7208] binder: 7207:7208 ioctl c0306201 20000000 returned -22 [ 892.312745][ T7217] : renamed from bpq0 03:40:09 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f00000000c0)=[@release={0x400c630f}], 0xfdfdffff00000000, 0x712000, 0x0}) 03:40:09 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f00000000c0)=[@release={0x400c630e, 0x6c00}], 0x0, 0x0, 0x0}) 03:40:09 executing program 4: r0 = socket$inet6(0xa, 0x5, 0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000180)='/dev/net/tun\x00', 0x0, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000100)={'lo\x00', 0x0}) ioctl$sock_SIOCGIFINDEX(r0, 0x8923, &(0x7f0000000380)={'bpq0\x00\v\x00\xfe\x00\x00\x00`\x00\xfa\xff\x00', r2}) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000000)={'bpq0\x00', 0x1212}) getpgid(0xffffffffffffffff) 03:40:09 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x4c, 0x0, &(0x7f0000000200)=ANY=[@ANYBLOB="05630440000000000e630c5b00f200008c01acbcd9297cf4a76e04ea80b60b21d6efb41548e724db19f05bcf6e830123c34234a0c43903464dd4e9c503844e734e52e396711327b0a8d8cf15"], 0x0, 0x0, 0x0}) 03:40:09 executing program 5: r0 = syz_open_dev$sndseq(&(0x7f0000000040)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a85320, &(0x7f0000068f50)={{0x80}, 'por\xff\a\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\a\x00\x00\x1f\x00\x00\xff\xff\xff\xff\xff\xff\xff\xef\x00\x00\x03\xff\x00\x00\x00\x00\x00\x00\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x06\x00', 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2}) 03:40:09 executing program 1: r0 = socket$inet6(0xa, 0x5, 0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000180)='/dev/net/tun\x00', 0x0, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000100)={'lo\x00', 0x0}) ioctl$sock_SIOCGIFINDEX(r0, 0x8923, &(0x7f0000000380)={'bpq0\x00\v\x00\xfe\x00\x00\x00\x00\x00\xfa\xff\x00', r2}) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000000)={'bpq0\x00', 0x1212}) getpgid(0xffffffffffffffff) [ 892.645434][ T3472] binder: undelivered death notification, 0000000000000000 [ 892.725856][ T7241] binder: 7234:7241 BC_REQUEST_DEATH_NOTIFICATION invalid ref 27648 [ 892.749005][ T7239] binder: 7238:7239 unknown command 1527538446 03:40:09 executing program 5: r0 = syz_open_dev$sndseq(&(0x7f0000000040)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a85320, &(0x7f0000068f50)={{0x80}, 'por\xff\a\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\n\x00\x00\x1f\x00\x00\xff\xff\xff\xff\xff\xff\xff\xef\x00\x00\x03\xff\x00\x00\x00\x00\x00\x00\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x06\x00', 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2}) [ 892.775908][ T7239] binder: 7238:7239 ioctl c0306201 20000000 returned -22 [ 892.860484][ T7236] : renamed from bpq0 03:40:09 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f00000000c0)=[@release={0x400c630e, 0x7400}], 0x0, 0x0, 0x0}) 03:40:10 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x4c, 0x0, &(0x7f0000000200)=ANY=[@ANYBLOB="05630440000000000e630c400a0000008c01acbcd9297cf4a76e04ea80b60b21d6efb41548e724db19f05bcf6e830123c34234a0c43903464dd4e9c503844e734e52e396711327b0a8d8cf15"], 0x0, 0x0, 0x0}) [ 892.931929][ T7235] : renamed from bpq0 03:40:10 executing program 5: r0 = syz_open_dev$sndseq(&(0x7f0000000040)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a85320, &(0x7f0000068f50)={{0x80}, 'por\xff\a\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00H\x00\x00\x1f\x00\x00\xff\xff\xff\xff\xff\xff\xff\xef\x00\x00\x03\xff\x00\x00\x00\x00\x00\x00\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x06\x00', 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2}) [ 893.044576][ T7259] binder: 7258:7259 BC_REQUEST_DEATH_NOTIFICATION invalid ref 10 03:40:10 executing program 1: r0 = socket$inet6(0xa, 0x5, 0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000180)='/dev/net/tun\x00', 0x0, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000100)={'lo\x00', 0x0}) ioctl$sock_SIOCGIFINDEX(r0, 0x8923, &(0x7f0000000380)={'bpq0\x00\v\x00\xfe\x00\x00\x00\x00\x00\xfa\xff\x00', r2}) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000000)={'bpq0\x00', 0x1212}) getpgid(0xffffffffffffffff) 03:40:10 executing program 4 (fault-call:4 fault-nth:0): r0 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) [ 893.097741][ T7259] binder: 7258:7259 unknown command -368808281 [ 893.180887][ T7259] binder: 7258:7259 ioctl c0306201 20000000 returned -22 [ 893.260301][ T7270] FAULT_INJECTION: forcing a failure. [ 893.260301][ T7270] name failslab, interval 1, probability 0, space 0, times 0 [ 893.339113][ T7270] CPU: 1 PID: 7270 Comm: syz-executor4 Not tainted 5.0.0-rc1-next-20190109 #8 [ 893.348015][ T7270] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 893.358087][ T7270] Call Trace: [ 893.360610][ T7269] : renamed from bpq0 [ 893.361408][ T7270] dump_stack+0x1db/0x2d0 [ 893.369797][ T7270] ? dump_stack_print_info.cold+0x20/0x20 [ 893.375558][ T7270] should_fail.cold+0xa/0x14 [ 893.375583][ T7270] ? fault_create_debugfs_attr+0x1e0/0x1e0 [ 893.375626][ T7270] ? ___might_sleep+0x1e7/0x310 [ 893.375652][ T7270] ? arch_local_save_flags+0x50/0x50 [ 893.386062][ T7270] __should_failslab+0x121/0x190 [ 893.386099][ T7270] should_failslab+0x9/0x14 [ 893.386123][ T7270] kmem_cache_alloc_trace+0x2d1/0x760 [ 893.401702][ T7270] ? _raw_spin_unlock+0x2d/0x50 [ 893.401732][ T7270] binder_inc_ref_for_node+0x24d/0xc40 [ 893.401750][ T7270] ? lock_release+0xc40/0xc40 [ 893.401774][ T7270] ? binder_poll+0x3d0/0x3d0 [ 893.431203][ T7270] binder_thread_write+0x15a2/0x2a70 [ 893.436503][ T7270] ? perf_trace_lock+0x12f/0x750 [ 893.441441][ T7270] ? perf_trace_lock_acquire+0x138/0x7d0 [ 893.447120][ T7270] ? binder_transaction+0x78d0/0x78d0 [ 893.452508][ T7270] ? __might_fault+0x12b/0x1e0 [ 893.457284][ T7270] ? find_held_lock+0x35/0x120 [ 893.462051][ T7270] ? __might_fault+0x12b/0x1e0 [ 893.466828][ T7270] ? lock_acquire+0x1db/0x570 [ 893.471525][ T7270] ? lock_downgrade+0xbe0/0xbe0 [ 893.476385][ T7270] ? lock_release+0xc40/0xc40 [ 893.481067][ T7270] ? find_held_lock+0x35/0x120 [ 893.485856][ T7270] ? __sanitizer_cov_trace_const_cmp8+0x18/0x20 [ 893.492108][ T7270] ? _copy_from_user+0xdd/0x150 [ 893.497436][ T7270] binder_ioctl_write_read.isra.0+0x303/0xb60 [ 893.503541][ T7270] ? binder_thread_write+0x2a70/0x2a70 [ 893.509041][ T7270] ? _raw_spin_unlock+0x2d/0x50 [ 893.513935][ T7270] ? binder_get_thread+0x1f3/0x980 [ 893.519068][ T7270] ? binder_thread_release+0x680/0x680 [ 893.524544][ T7270] ? rcu_lockdep_current_cpu_online+0x1aa/0x220 [ 893.530790][ T7270] ? rcu_pm_notify+0xd0/0xd0 [ 893.535429][ T7270] ? __might_sleep+0x95/0x190 [ 893.540136][ T7270] binder_ioctl+0x424/0x1917 [ 893.544738][ T7270] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 893.551008][ T7270] ? binder_ioctl_write_read.isra.0+0xb60/0xb60 [ 893.557260][ T7270] ? find_held_lock+0x35/0x120 [ 893.562037][ T7270] ? __fget+0x473/0x710 [ 893.566204][ T7270] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 893.572459][ T7270] ? lock_downgrade+0xbe0/0xbe0 [ 893.577329][ T7270] ? kasan_check_read+0x11/0x20 [ 893.582193][ T7270] ? rcu_dynticks_curr_cpu_in_eqs+0xa2/0x170 [ 893.588190][ T7270] ? rcu_read_unlock_special+0x380/0x380 [ 893.593866][ T7270] ? ksys_dup3+0x660/0x660 [ 893.598555][ T7270] ? binder_ioctl_write_read.isra.0+0xb60/0xb60 [ 893.604805][ T7270] do_vfs_ioctl+0x107b/0x17d0 [ 893.609496][ T7270] ? wait_for_completion+0x810/0x810 [ 893.614792][ T7270] ? ioctl_preallocate+0x2f0/0x2f0 [ 893.619916][ T7270] ? __fget_light+0x2db/0x420 [ 893.624607][ T7270] ? fget_raw+0x20/0x20 [ 893.629290][ T7270] ? __sanitizer_cov_trace_const_cmp1+0x1a/0x20 [ 893.635571][ T7270] ? fput+0x128/0x1a0 [ 893.639568][ T7270] ? do_syscall_64+0x8c/0x800 [ 893.644254][ T7270] ? do_syscall_64+0x8c/0x800 [ 893.644273][ T7270] ? lockdep_hardirqs_on+0x415/0x5d0 [ 893.644300][ T7270] ? security_file_ioctl+0x93/0xc0 [ 893.659365][ T7270] ksys_ioctl+0xab/0xd0 [ 893.659390][ T7270] __x64_sys_ioctl+0x73/0xb0 [ 893.668230][ T7270] do_syscall_64+0x1a3/0x800 [ 893.672828][ T7270] ? syscall_return_slowpath+0x5f0/0x5f0 [ 893.678603][ T7270] ? prepare_exit_to_usermode+0x232/0x3b0 [ 893.684340][ T7270] ? trace_hardirqs_off_thunk+0x1a/0x1c [ 893.689924][ T7270] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 893.696277][ T7270] RIP: 0033:0x457ec9 [ 893.700173][ T7270] Code: 6d b7 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 3b b7 fb ff c3 66 2e 0f 1f 84 00 00 00 00 [ 893.719784][ T7270] RSP: 002b:00007faea663bc78 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 893.728207][ T7270] RAX: ffffffffffffffda RBX: 00007faea663bc90 RCX: 0000000000457ec9 03:40:10 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f00000000c0)=[@release={0x400c630f}], 0xfdfdffff00000000, 0x740000, 0x0}) 03:40:10 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x4c, 0x0, &(0x7f0000000200)=ANY=[@ANYBLOB="05630440000000000e630c40630000008c01acbcd9297cf4a76e04ea80b60b21d6efb41548e724db19f05bcf6e830123c34234a0c43903464dd4e9c503844e734e52e396711327b0a8d8cf15"], 0x0, 0x0, 0x0}) 03:40:10 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f00000000c0)=[@release={0x400c630e, 0x7a00}], 0x0, 0x0, 0x0}) 03:40:10 executing program 5: r0 = syz_open_dev$sndseq(&(0x7f0000000040)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a85320, &(0x7f0000068f50)={{0x80}, 'por\xff\a\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00L\x00\x00\x1f\x00\x00\xff\xff\xff\xff\xff\xff\xff\xef\x00\x00\x03\xff\x00\x00\x00\x00\x00\x00\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x06\x00', 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2}) [ 893.736181][ T7270] RDX: 0000000020000000 RSI: 00000000c0306201 RDI: 0000000000000003 [ 893.744157][ T7270] RBP: 000000000073bf00 R08: 0000000000000000 R09: 0000000000000000 [ 893.752129][ T7270] R10: 0000000000000000 R11: 0000000000000246 R12: 00007faea663c6d4 [ 893.760111][ T7270] R13: 00000000004bf216 R14: 00000000004d0808 R15: 0000000000000006 [ 893.905656][ T7270] binder: 7266:7270 Acquire 1 refcount change on invalid ref 0 ret -22 [ 893.905836][ T3472] binder: undelivered death notification, 0000000000000000 [ 893.914308][ T7283] binder: 7279:7283 unknown command -368808281 03:40:11 executing program 5: r0 = syz_open_dev$sndseq(&(0x7f0000000040)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a85320, &(0x7f0000068f50)={{0x80}, 'por\xff\a\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00h\x00\x00\x1f\x00\x00\xff\xff\xff\xff\xff\xff\xff\xef\x00\x00\x03\xff\x00\x00\x00\x00\x00\x00\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x06\x00', 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2}) 03:40:11 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f00000000c0)=[@release={0x400c630e, 0x1000000}], 0x0, 0x0, 0x0}) 03:40:11 executing program 1: r0 = socket$inet6(0xa, 0x5, 0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000180)='/dev/net/tun\x00', 0x0, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000100)={'lo\x00', 0x0}) ioctl$sock_SIOCGIFINDEX(r0, 0x8923, &(0x7f0000000380)={'bpq0\x00\v\x00\xfe\x00\x00\x00\x00\x00\xfa\xff\x00', r2}) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000000)={'bpq0\x00', 0x1212}) getpgid(0xffffffffffffffff) [ 893.989409][ T7283] binder: 7279:7283 ioctl c0306201 20000000 returned -22 03:40:11 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f00000000c0)=[@release={0x400c630f}], 0xfdfdffff00000000, 0x907000, 0x0}) [ 894.121289][ T7299] binder_thread_write: 5 callbacks suppressed [ 894.121303][ T7299] binder: 7296:7299 BC_REQUEST_DEATH_NOTIFICATION invalid ref 16777216 03:40:11 executing program 5: r0 = syz_open_dev$sndseq(&(0x7f0000000040)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a85320, &(0x7f0000068f50)={{0x80}, 'por\xff\a\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00l\x00\x00\x1f\x00\x00\xff\xff\xff\xff\xff\xff\xff\xef\x00\x00\x03\xff\x00\x00\x00\x00\x00\x00\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x06\x00', 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2}) 03:40:11 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x4c, 0x0, &(0x7f0000000200)=ANY=[@ANYBLOB="05630440000000000e630c4002f200008c01acbcd9297cf4a76e04ea80b60b21d6efb41548e724db19f05bcf6e830123c34234a0c43903464dd4e9c503844e734e52e396711327b0a8d8cf15"], 0x0, 0x0, 0x0}) 03:40:11 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f00000000c0)=[@release={0x400c630e, 0x2000000}], 0x0, 0x0, 0x0}) [ 894.261005][ T7300] : renamed from bpq0 [ 894.330288][ T7309] binder: 7308:7309 BC_REQUEST_DEATH_NOTIFICATION invalid ref 61954 [ 894.370302][ T7316] binder: 7315:7316 BC_REQUEST_DEATH_NOTIFICATION invalid ref 33554432 [ 894.396677][ T7309] binder: 7308:7309 unknown command -368808281 [ 894.416225][ T7309] binder: 7308:7309 ioctl c0306201 20000000 returned -22 03:40:11 executing program 4 (fault-call:4 fault-nth:1): r0 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) 03:40:11 executing program 5: r0 = syz_open_dev$sndseq(&(0x7f0000000040)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a85320, &(0x7f0000068f50)={{0x80}, 'por\xff\a\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00t\x00\x00\x1f\x00\x00\xff\xff\xff\xff\xff\xff\xff\xef\x00\x00\x03\xff\x00\x00\x00\x00\x00\x00\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x06\x00', 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2}) 03:40:11 executing program 1: r0 = socket$inet6(0xa, 0x5, 0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000180)='/dev/net/tun\x00', 0x0, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000100)={'lo\x00', 0x0}) ioctl$sock_SIOCGIFINDEX(r0, 0x8923, &(0x7f0000000380)={'bpq0\x00\v\x00\xfe\x00\x00\x00\x00\x00\xfa\xff\x00', r2}) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000000)={'bpq0\x00', 0x1212}) getpgid(0xffffffffffffffff) 03:40:11 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f00000000c0)=[@release={0x400c630e, 0x3000000}], 0x0, 0x0, 0x0}) 03:40:11 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x4c, 0x0, &(0x7f0000000200)=ANY=[@ANYBLOB="05630440000000000e630c4003f200008c01acbcd9297cf4a76e04ea80b60b21d6efb41548e724db19f05bcf6e830123c34234a0c43903464dd4e9c503844e734e52e396711327b0a8d8cf15"], 0x0, 0x0, 0x0}) [ 894.682752][ T7328] binder: 7325:7328 BC_REQUEST_DEATH_NOTIFICATION invalid ref 50331648 03:40:11 executing program 5: r0 = syz_open_dev$sndseq(&(0x7f0000000040)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a85320, &(0x7f0000068f50)={{0x80}, 'por\xff\a\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00z\x00\x00\x1f\x00\x00\xff\xff\xff\xff\xff\xff\xff\xef\x00\x00\x03\xff\x00\x00\x00\x00\x00\x00\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x06\x00', 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2}) 03:40:11 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f00000000c0)=[@release={0x400c630e, 0x4000000}], 0x0, 0x0, 0x0}) [ 894.746367][ T7332] FAULT_INJECTION: forcing a failure. [ 894.746367][ T7332] name failslab, interval 1, probability 0, space 0, times 0 [ 894.773743][ T7323] : renamed from bpq0 [ 894.783164][ T7332] CPU: 0 PID: 7332 Comm: syz-executor4 Not tainted 5.0.0-rc1-next-20190109 #8 [ 894.792051][ T7332] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 894.802120][ T7332] Call Trace: [ 894.805460][ T7332] dump_stack+0x1db/0x2d0 [ 894.809831][ T7332] ? dump_stack_print_info.cold+0x20/0x20 [ 894.815579][ T7332] should_fail.cold+0xa/0x14 [ 894.820182][ T7332] ? fault_create_debugfs_attr+0x1e0/0x1e0 [ 894.826028][ T7332] ? ___might_sleep+0x1e7/0x310 [ 894.830892][ T7332] ? arch_local_save_flags+0x50/0x50 [ 894.836204][ T7332] __should_failslab+0x121/0x190 [ 894.841159][ T7332] should_failslab+0x9/0x14 [ 894.845675][ T7332] kmem_cache_alloc_trace+0x2d1/0x760 [ 894.851074][ T7332] binder_thread_write+0x1b10/0x2a70 [ 894.856366][ T7332] ? perf_trace_lock+0x12f/0x750 [ 894.861322][ T7332] ? perf_trace_lock_acquire+0x138/0x7d0 [ 894.867004][ T7332] ? binder_transaction+0x78d0/0x78d0 [ 894.872399][ T7332] ? __might_fault+0x12b/0x1e0 [ 894.877171][ T7332] ? find_held_lock+0x35/0x120 [ 894.881941][ T7332] ? __might_fault+0x12b/0x1e0 [ 894.886732][ T7332] ? lock_acquire+0x1db/0x570 [ 894.891424][ T7332] ? lock_downgrade+0xbe0/0xbe0 03:40:11 executing program 5: r0 = syz_open_dev$sndseq(&(0x7f0000000040)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a85320, &(0x7f0000068f50)={{0x80}, 'por\xff\a\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xfd\x00\x00\x1f\x00\x00\xff\xff\xff\xff\xff\xff\xff\xef\x00\x00\x03\xff\x00\x00\x00\x00\x00\x00\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x06\x00', 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2}) [ 894.896287][ T7332] ? lock_release+0xc40/0xc40 [ 894.900986][ T7332] ? find_held_lock+0x35/0x120 [ 894.905773][ T7332] ? __sanitizer_cov_trace_const_cmp8+0x18/0x20 [ 894.905791][ T7332] ? _copy_from_user+0xdd/0x150 [ 894.905817][ T7332] binder_ioctl_write_read.isra.0+0x303/0xb60 [ 894.905844][ T7332] ? binder_thread_write+0x2a70/0x2a70 [ 894.905864][ T7332] ? _raw_spin_unlock+0x2d/0x50 [ 894.905887][ T7332] ? binder_get_thread+0x1f3/0x980 [ 894.905913][ T7332] ? binder_thread_release+0x680/0x680 [ 894.905936][ T7332] ? rcu_lockdep_current_cpu_online+0x1aa/0x220 [ 894.905980][ T7332] ? rcu_pm_notify+0xd0/0xd0 [ 894.906007][ T7332] ? __might_sleep+0x95/0x190 [ 894.917107][ T7332] binder_ioctl+0x424/0x1917 [ 894.917126][ T7332] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 894.917154][ T7332] ? binder_ioctl_write_read.isra.0+0xb60/0xb60 [ 894.917172][ T7332] ? find_held_lock+0x35/0x120 [ 894.917189][ T7332] ? __fget+0x473/0x710 [ 894.917208][ T7332] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 894.917229][ T7332] ? lock_downgrade+0xbe0/0xbe0 [ 894.917245][ T7332] ? kasan_check_read+0x11/0x20 [ 894.917264][ T7332] ? rcu_dynticks_curr_cpu_in_eqs+0xa2/0x170 [ 894.917283][ T7332] ? rcu_read_unlock_special+0x380/0x380 [ 894.917326][ T7332] ? ksys_dup3+0x660/0x660 [ 894.938762][ T7332] ? binder_ioctl_write_read.isra.0+0xb60/0xb60 [ 894.938784][ T7332] do_vfs_ioctl+0x107b/0x17d0 [ 894.938802][ T7332] ? wait_for_completion+0x810/0x810 [ 894.938822][ T7332] ? ioctl_preallocate+0x2f0/0x2f0 [ 894.938843][ T7332] ? __fget_light+0x2db/0x420 [ 894.938861][ T7332] ? fget_raw+0x20/0x20 [ 894.938882][ T7332] ? __sanitizer_cov_trace_const_cmp1+0x1a/0x20 [ 894.938903][ T7332] ? fput+0x128/0x1a0 [ 894.955201][ T7332] ? do_syscall_64+0x8c/0x800 [ 894.955219][ T7332] ? do_syscall_64+0x8c/0x800 [ 894.955238][ T7332] ? lockdep_hardirqs_on+0x415/0x5d0 [ 894.955259][ T7332] ? security_file_ioctl+0x93/0xc0 [ 894.955283][ T7332] ksys_ioctl+0xab/0xd0 [ 894.955305][ T7332] __x64_sys_ioctl+0x73/0xb0 [ 894.955326][ T7332] do_syscall_64+0x1a3/0x800 [ 894.970841][ T7332] ? syscall_return_slowpath+0x5f0/0x5f0 [ 894.970863][ T7332] ? prepare_exit_to_usermode+0x232/0x3b0 [ 894.970888][ T7332] ? trace_hardirqs_off_thunk+0x1a/0x1c [ 894.970918][ T7332] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 894.997087][ T7332] RIP: 0033:0x457ec9 [ 894.997098][ T7332] Code: 6d b7 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 3b b7 fb ff c3 66 2e 0f 1f 84 00 00 00 00 [ 894.997103][ T7332] RSP: 002b:00007faea663bc78 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 894.997161][ T7332] RAX: ffffffffffffffda RBX: 00007faea663bc90 RCX: 0000000000457ec9 [ 894.997179][ T7332] RDX: 0000000020000000 RSI: 00000000c0306201 RDI: 0000000000000003 [ 894.997196][ T7332] RBP: 000000000073bf00 R08: 0000000000000000 R09: 0000000000000000 [ 894.997223][ T7332] R10: 0000000000000000 R11: 0000000000000246 R12: 00007faea663c6d4 [ 894.997240][ T7332] R13: 00000000004bf216 R14: 00000000004d0808 R15: 0000000000000006 [ 895.013031][ T7343] binder: 7334:7343 BC_REQUEST_DEATH_NOTIFICATION invalid ref 61955 03:40:12 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f00000000c0)=[@release={0x400c630f}], 0xfdfdffff00000000, 0x940000, 0x0}) 03:40:12 executing program 5: r0 = syz_open_dev$sndseq(&(0x7f0000000040)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a85320, &(0x7f0000068f50)={{0x80}, 'por\xff\a\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x1f\x00\x00\xff\xff\xff\xff\xff\xff\xff\xef\x00\x00\x03\xff\x00\x00\x00\x00\x00\x00\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x06\x00', 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2}) [ 895.037402][ T7332] binder: 7330:7332 BC_REQUEST_DEATH_NOTIFICATION failed [ 895.059954][ T7343] binder: 7334:7343 unknown command -368808281 [ 895.112445][ T7346] binder: 7336:7346 BC_REQUEST_DEATH_NOTIFICATION invalid ref 67108864 [ 895.283405][ T7343] binder: 7334:7343 ioctl c0306201 20000000 returned -22 [ 895.293934][ T7288] binder: undelivered death notification, 0000000000000000 [ 895.294531][ T7323] : renamed from bpq0 [ 895.332666][ T8198] binder: undelivered TRANSACTION_ERROR: 2147774976 03:40:12 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f00000000c0)=[@release={0x400c630e, 0x5000000}], 0x0, 0x0, 0x0}) 03:40:12 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x4c, 0x0, &(0x7f0000000200)=ANY=[@ANYBLOB="05630440000000000e630c4004f200008c01acbcd9297cf4a76e04ea80b60b21d6efb41548e724db19f05bcf6e830123c34234a0c43903464dd4e9c503844e734e52e396711327b0a8d8cf15"], 0x0, 0x0, 0x0}) 03:40:12 executing program 4 (fault-call:4 fault-nth:2): r0 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) 03:40:12 executing program 5: r0 = syz_open_dev$sndseq(&(0x7f0000000040)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a85320, &(0x7f0000068f50)={{0x80}, 'por\xff\a\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02\x1f\x00\x00\xff\xff\xff\xff\xff\xff\xff\xef\x00\x00\x03\xff\x00\x00\x00\x00\x00\x00\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x06\x00', 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2}) [ 895.511746][ T7362] binder: 7361:7362 BC_REQUEST_DEATH_NOTIFICATION invalid ref 61956 03:40:12 executing program 1: r0 = socket$inet6(0xa, 0x5, 0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000180)='/dev/net/tun\x00', 0x0, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000100)={'lo\x00', 0x0}) ioctl$sock_SIOCGIFINDEX(r0, 0x8923, &(0x7f0000000380)={'bpq0\x00\v\x00\xfe\x00\x00\x00\x00\x00\xfa\xff\x00', r2}) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000000)={'bpq0\x00', 0x1212}) getpgid(0xffffffffffffffff) [ 895.563815][ T7362] binder: 7361:7362 unknown command -368808281 [ 895.569129][ T7367] binder: 7360:7367 BC_REQUEST_DEATH_NOTIFICATION invalid ref 83886080 [ 895.592887][ T7362] binder: 7361:7362 ioctl c0306201 20000000 returned -22 03:40:12 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) 03:40:12 executing program 5: r0 = syz_open_dev$sndseq(&(0x7f0000000040)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a85320, &(0x7f0000068f50)={{0x80}, 'por\xff\a\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x03\x1f\x00\x00\xff\xff\xff\xff\xff\xff\xff\xef\x00\x00\x03\xff\x00\x00\x00\x00\x00\x00\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x06\x00', 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2}) 03:40:12 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f00000000c0)=[@release={0x400c630e, 0x6000000}], 0x0, 0x0, 0x0}) 03:40:12 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x4c, 0x0, &(0x7f0000000200)=ANY=[@ANYBLOB="05630440000000000e630c4005f200008c01acbcd9297cf4a76e04ea80b60b21d6efb41548e724db19f05bcf6e830123c34234a0c43903464dd4e9c503844e734e52e396711327b0a8d8cf15"], 0x0, 0x0, 0x0}) 03:40:12 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0x2, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) [ 895.774544][ T7381] binder: 7378:7381 BC_REQUEST_DEATH_NOTIFICATION invalid ref 100663296 [ 895.799351][ T7371] : renamed from bpq0 [ 895.878424][ T7371] : renamed from bpq0 [ 895.927314][ T7387] binder: 7385:7387 BC_REQUEST_DEATH_NOTIFICATION invalid ref 61957 [ 895.945540][ T7387] binder: 7385:7387 unknown command -368808281 [ 895.951758][ T7387] binder: 7385:7387 ioctl c0306201 20000000 returned -22 03:40:13 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f00000000c0)=[@release={0x400c630f}], 0xfdfdffff00000000, 0xa05000, 0x0}) 03:40:13 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f00000000c0)=[@release={0x400c630e, 0x7000000}], 0x0, 0x0, 0x0}) 03:40:13 executing program 5: r0 = syz_open_dev$sndseq(&(0x7f0000000040)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a85320, &(0x7f0000068f50)={{0x80}, 'por\xff\a\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x04\x1f\x00\x00\xff\xff\xff\xff\xff\xff\xff\xef\x00\x00\x03\xff\x00\x00\x00\x00\x00\x00\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x06\x00', 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2}) 03:40:13 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0x5421, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) 03:40:13 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x4c, 0x0, &(0x7f0000000200)=ANY=[@ANYBLOB="05630440000000000e630c4006f200008c01acbcd9297cf4a76e04ea80b60b21d6efb41548e724db19f05bcf6e830123c34234a0c43903464dd4e9c503844e734e52e396711327b0a8d8cf15"], 0x0, 0x0, 0x0}) 03:40:13 executing program 1: r0 = socket$inet6(0xa, 0x5, 0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000180)='/dev/net/tun\x00', 0x0, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000100)={'lo\x00', 0x0}) ioctl$sock_SIOCGIFINDEX(r0, 0x8923, &(0x7f0000000380)={'bpq0\x00\v\x00\xfe\x00\x00\x00\x00\x00\xfa\xff\x00', r2}) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000000)={'bpq0\x00', 0x1212}) getpgid(0xffffffffffffffff) [ 896.150742][ T8198] binder: undelivered death notification, 0000000000000000 03:40:13 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f00000000c0)=[@release={0x400c630e, 0xa000000}], 0x0, 0x0, 0x0}) 03:40:13 executing program 5: r0 = syz_open_dev$sndseq(&(0x7f0000000040)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a85320, &(0x7f0000068f50)={{0x80}, 'por\xff\a\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x05\x1f\x00\x00\xff\xff\xff\xff\xff\xff\xff\xef\x00\x00\x03\xff\x00\x00\x00\x00\x00\x00\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x06\x00', 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2}) [ 896.219053][ T7406] binder: 7401:7406 unknown command -368808281 [ 896.257013][ T7406] binder: 7401:7406 ioctl c0306201 20000000 returned -22 03:40:13 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0x5450, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) [ 896.299865][ T7403] : renamed from bpq0 03:40:13 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x4c, 0x0, &(0x7f0000000200)=ANY=[@ANYBLOB="05630440000000000e630c4007f200008c01acbcd9297cf4a76e04ea80b60b21d6efb41548e724db19f05bcf6e830123c34234a0c43903464dd4e9c503844e734e52e396711327b0a8d8cf15"], 0x0, 0x0, 0x0}) 03:40:13 executing program 1: r0 = socket$inet6(0xa, 0x5, 0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000180)='/dev/net/tun\x00', 0x0, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000100)={'lo\x00', 0x0}) ioctl$sock_SIOCGIFINDEX(r0, 0x8923, &(0x7f0000000380)={'bpq0\x00\v\x00\xfe\x00\x00\x00\x00\x00\xfa\xff\x00', r2}) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000000)={'bpq0\x00', 0x1212}) getpgid(0xffffffffffffffff) 03:40:13 executing program 5: r0 = syz_open_dev$sndseq(&(0x7f0000000040)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a85320, &(0x7f0000068f50)={{0x80}, 'por\xff\a\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x06\x1f\x00\x00\xff\xff\xff\xff\xff\xff\xff\xef\x00\x00\x03\xff\x00\x00\x00\x00\x00\x00\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x06\x00', 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2}) [ 896.544687][ T7430] binder: 7426:7430 unknown command -368808281 [ 896.598767][ T7430] binder: 7426:7430 ioctl c0306201 20000000 returned -22 [ 896.662366][ T7431] : renamed from bpq0 [ 896.755407][ T7431] : renamed from bpq0 03:40:14 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f00000000c0)=[@release={0x400c630f}], 0xfdfdffff00000000, 0x1000000, 0x0}) 03:40:14 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f00000000c0)=[@release={0x400c630e, 0x20000000}], 0x0, 0x0, 0x0}) 03:40:14 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0x5451, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) 03:40:14 executing program 5: r0 = syz_open_dev$sndseq(&(0x7f0000000040)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a85320, &(0x7f0000068f50)={{0x80}, 'por\xff\a\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\a\x1f\x00\x00\xff\xff\xff\xff\xff\xff\xff\xef\x00\x00\x03\xff\x00\x00\x00\x00\x00\x00\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x06\x00', 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2}) 03:40:14 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x4c, 0x0, &(0x7f0000000200)=ANY=[@ANYBLOB="05630440000000000e630c4048f200008c01acbcd9297cf4a76e04ea80b60b21d6efb41548e724db19f05bcf6e830123c34234a0c43903464dd4e9c503844e734e52e396711327b0a8d8cf15"], 0x0, 0x0, 0x0}) 03:40:14 executing program 1: r0 = socket$inet6(0xa, 0x5, 0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000180)='/dev/net/tun\x00', 0x0, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000100)={'lo\x00', 0x0}) ioctl$sock_SIOCGIFINDEX(r0, 0x8923, &(0x7f0000000380)={'bpq0\x00\v\x00\xfe\x00\x00\x00\x00\x00\xfa\xff\x00', r2}) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000000)={'bpq0\x00', 0x1212}) getpgid(0xffffffffffffffff) [ 897.024706][ T8198] binder: undelivered death notification, 0000000000000000 03:40:14 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f00000000c0)=[@release={0x400c630e, 0x48000000}], 0x0, 0x0, 0x0}) [ 897.105428][ T7454] binder: 7448:7454 unknown command -368808281 [ 897.111639][ T7454] binder: 7448:7454 ioctl c0306201 20000000 returned -22 03:40:14 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0x5452, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) 03:40:14 executing program 5: r0 = syz_open_dev$sndseq(&(0x7f0000000040)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a85320, &(0x7f0000068f50)={{0x80}, 'por\xff\a\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\n\x1f\x00\x00\xff\xff\xff\xff\xff\xff\xff\xef\x00\x00\x03\xff\x00\x00\x00\x00\x00\x00\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x06\x00', 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2}) [ 897.253002][ T7453] : renamed from bpq0 03:40:14 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x4c, 0x0, &(0x7f0000000200)=ANY=[@ANYBLOB="05630440000000000e630c404cf200008c01acbcd9297cf4a76e04ea80b60b21d6efb41548e724db19f05bcf6e830123c34234a0c43903464dd4e9c503844e734e52e396711327b0a8d8cf15"], 0x0, 0x0, 0x0}) 03:40:14 executing program 5: r0 = syz_open_dev$sndseq(&(0x7f0000000040)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a85320, &(0x7f0000068f50)={{0x80}, 'por\xff\a\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00H\x1f\x00\x00\xff\xff\xff\xff\xff\xff\xff\xef\x00\x00\x03\xff\x00\x00\x00\x00\x00\x00\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x06\x00', 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2}) 03:40:14 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0x5460, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) [ 897.474531][ T7476] binder: 7472:7476 unknown command -368808281 [ 897.518578][ T7476] binder: 7472:7476 ioctl c0306201 20000000 returned -22 03:40:15 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f00000000c0)=[@release={0x400c630f}], 0xfdfdffff00000000, 0x2000000, 0x0}) 03:40:15 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f00000000c0)=[@release={0x400c630e, 0x4c000000}], 0x0, 0x0, 0x0}) 03:40:15 executing program 5: r0 = syz_open_dev$sndseq(&(0x7f0000000040)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a85320, &(0x7f0000068f50)={{0x80}, 'por\xff\a\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00L\x1f\x00\x00\xff\xff\xff\xff\xff\xff\xff\xef\x00\x00\x03\xff\x00\x00\x00\x00\x00\x00\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x06\x00', 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2}) 03:40:15 executing program 1: r0 = socket$inet6(0xa, 0x5, 0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000180)='/dev/net/tun\x00', 0x0, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000100)={'lo\x00', 0x0}) ioctl$sock_SIOCGIFINDEX(r0, 0x8923, &(0x7f0000000380)={'bpq0\x00\v\x00\xfe\x00\x00\x00\x00\x00\xfa\xff\x00', r2}) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000000)={'bpq0\x00', 0x1212}) getpgid(0xffffffffffffffff) 03:40:15 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0x40046205, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) 03:40:15 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x4c, 0x0, &(0x7f0000000200)=ANY=[@ANYBLOB="05630440000000000e630c4060f200008c01acbcd9297cf4a76e04ea80b60b21d6efb41548e724db19f05bcf6e830123c34234a0c43903464dd4e9c503844e734e52e396711327b0a8d8cf15"], 0x0, 0x0, 0x0}) [ 897.944923][ T8164] binder: undelivered death notification, 0000000000000000 03:40:15 executing program 5: r0 = syz_open_dev$sndseq(&(0x7f0000000040)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a85320, &(0x7f0000068f50)={{0x80}, 'por\xff\a\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00h\x1f\x00\x00\xff\xff\xff\xff\xff\xff\xff\xef\x00\x00\x03\xff\x00\x00\x00\x00\x00\x00\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x06\x00', 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2}) 03:40:15 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0x40046207, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) [ 898.029833][ T7493] binder: 7490:7493 unknown command -368808281 [ 898.057253][ T7493] binder: 7490:7493 ioctl c0306201 20000000 returned -22 03:40:15 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f00000000c0)=[@release={0x400c630e, 0x60000000}], 0x0, 0x0, 0x0}) 03:40:15 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x4c, 0x0, &(0x7f0000000200)=ANY=[@ANYBLOB="05630440000000000e630c4068f200008c01acbcd9297cf4a76e04ea80b60b21d6efb41548e724db19f05bcf6e830123c34234a0c43903464dd4e9c503844e734e52e396711327b0a8d8cf15"], 0x0, 0x0, 0x0}) [ 898.183062][ T7489] : renamed from bpq0 03:40:15 executing program 5: r0 = syz_open_dev$sndseq(&(0x7f0000000040)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a85320, &(0x7f0000068f50)={{0x80}, 'por\xff\a\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00l\x1f\x00\x00\xff\xff\xff\xff\xff\xff\xff\xef\x00\x00\x03\xff\x00\x00\x00\x00\x00\x00\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x06\x00', 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2}) [ 898.258984][ T7511] binder: BINDER_SET_CONTEXT_MGR already set [ 898.269018][ T7511] binder: 7508:7511 ioctl 40046207 20000000 returned -16 03:40:15 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f00000000c0)=[@release={0x400c630e, 0x68000000}], 0x0, 0x0, 0x0}) [ 898.302146][ T7515] binder: 7514:7515 unknown command -368808281 [ 898.323306][ T7515] binder: 7514:7515 ioctl c0306201 20000000 returned -22 03:40:15 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f00000000c0)=[@release={0x400c630f}], 0xfdfdffff00000000, 0x3000000, 0x0}) 03:40:15 executing program 1: r0 = socket$inet6(0xa, 0x5, 0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000180)='/dev/net/tun\x00', 0x0, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000100)={'lo\x00', 0x0}) ioctl$sock_SIOCGIFINDEX(r0, 0x8923, &(0x7f0000000380)={'bpq0\x00\v\x00\xfe\x00\x00\x00\x00\x00\xfa\xff\x00', r2}) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000000)={'bpq0\x00', 0x1212}) getpgid(0xffffffffffffffff) 03:40:15 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0x40046208, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) 03:40:15 executing program 5: r0 = syz_open_dev$sndseq(&(0x7f0000000040)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a85320, &(0x7f0000068f50)={{0x80}, 'por\xff\a\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00t\x1f\x00\x00\xff\xff\xff\xff\xff\xff\xff\xef\x00\x00\x03\xff\x00\x00\x00\x00\x00\x00\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x06\x00', 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2}) 03:40:15 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x4c, 0x0, &(0x7f0000000200)=ANY=[@ANYBLOB="05630440000000000e630c406cf200008c01acbcd9297cf4a76e04ea80b60b21d6efb41548e724db19f05bcf6e830123c34234a0c43903464dd4e9c503844e734e52e396711327b0a8d8cf15"], 0x0, 0x0, 0x0}) 03:40:15 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f00000000c0)=[@release={0x400c630e, 0x6c000000}], 0x0, 0x0, 0x0}) [ 898.878712][ T8198] binder: undelivered death notification, 0000000000000000 [ 898.934270][ T7535] binder: 7534:7535 unknown command -368808281 03:40:16 executing program 5: r0 = syz_open_dev$sndseq(&(0x7f0000000040)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a85320, &(0x7f0000068f50)={{0x80}, 'por\xff\a\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00z\x1f\x00\x00\xff\xff\xff\xff\xff\xff\xff\xef\x00\x00\x03\xff\x00\x00\x00\x00\x00\x00\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x06\x00', 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2}) [ 898.979499][ T7535] binder: 7534:7535 ioctl c0306201 20000000 returned -22 03:40:16 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0x40049409, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) [ 899.028124][ T7531] : renamed from bpq0 03:40:16 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f00000000c0)=[@release={0x400c630e, 0x74000000}], 0x0, 0x0, 0x0}) 03:40:16 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x4c, 0x0, &(0x7f0000000200)=ANY=[@ANYBLOB="05630440000000000e630c4074f200008c01acbcd9297cf4a76e04ea80b60b21d6efb41548e724db19f05bcf6e830123c34234a0c43903464dd4e9c503844e734e52e396711327b0a8d8cf15"], 0x0, 0x0, 0x0}) 03:40:16 executing program 5: r0 = syz_open_dev$sndseq(&(0x7f0000000040)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a85320, &(0x7f0000068f50)={{0x80}, 'por\xff\a\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xfd\x1f\x00\x00\xff\xff\xff\xff\xff\xff\xff\xef\x00\x00\x03\xff\x00\x00\x00\x00\x00\x00\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x06\x00', 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2}) 03:40:16 executing program 1: r0 = socket$inet6(0xa, 0x5, 0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000180)='/dev/net/tun\x00', 0x0, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000100)={'lo\x00', 0x0}) ioctl$sock_SIOCGIFINDEX(r0, 0x8923, &(0x7f0000000380)={'bpq0\x00\v\x00\xfe\x00\x00\x00\x00\x00\xfa\xff\x00', r2}) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000000)={'bpq0\x00', 0x1212}) getpgid(0xffffffffffffffff) [ 899.214354][ T7557] binder_thread_write: 15 callbacks suppressed [ 899.214368][ T7557] binder: 7556:7557 BC_REQUEST_DEATH_NOTIFICATION invalid ref 1946157056 [ 899.285683][ T7560] binder: 7558:7560 BC_REQUEST_DEATH_NOTIFICATION invalid ref 62068 [ 899.305362][ T7560] binder: 7558:7560 unknown command -368808281 [ 899.355012][ T7560] binder: 7558:7560 ioctl c0306201 20000000 returned -22 [ 899.421682][ T7564] : renamed from bpq0 03:40:16 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f00000000c0)=[@release={0x400c630f}], 0xfdfdffff00000000, 0x4000000, 0x0}) 03:40:16 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0x4020940d, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) 03:40:16 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f00000000c0)=[@release={0x400c630e, 0x7a000000}], 0x0, 0x0, 0x0}) 03:40:16 executing program 5: r0 = syz_open_dev$sndseq(&(0x7f0000000040)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a85320, &(0x7f0000068f50)={{0x80}, 'por\xff\a\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02\x00\x00\x1f\x00\x00\xff\xff\xff\xff\xff\xff\xff\xef\x00\x00\x03\xff\x00\x00\x00\x00\x00\x00\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x06\x00', 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2}) 03:40:16 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x4c, 0x0, &(0x7f0000000200)=ANY=[@ANYBLOB="05630440000000000e630c407af200008c01acbcd9297cf4a76e04ea80b60b21d6efb41548e724db19f05bcf6e830123c34234a0c43903464dd4e9c503844e734e52e396711327b0a8d8cf15"], 0x0, 0x0, 0x0}) 03:40:16 executing program 1: r0 = socket$inet6(0xa, 0x5, 0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000180)='/dev/net/tun\x00', 0x0, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000100)={'lo\x00', 0x0}) ioctl$sock_SIOCGIFINDEX(r0, 0x8923, &(0x7f0000000380)={'bpq0\x00\v\x00\xfe\x00\x00\x00\x00\x00\xfa\xff\x00', r2}) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000000)={'bpq0\x00', 0x1212}) getpgid(0xffffffffffffffff) [ 899.790507][ T8164] binder: undelivered death notification, 0000000000000000 [ 899.854366][ T7586] binder: 7580:7586 BC_REQUEST_DEATH_NOTIFICATION invalid ref 62074 [ 899.882502][ T7586] binder: 7580:7586 unknown command -368808281 [ 899.892306][ T7586] binder: 7580:7586 ioctl c0306201 20000000 returned -22 03:40:16 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x4c, 0x0, &(0x7f0000000200)=ANY=[@ANYBLOB="05630440000000000e630c40ffe0f5058c01acbcd9297cf4a76e04ea80b60b21d6efb41548e724db19f05bcf6e830123c34234a0c43903464dd4e9c503844e734e52e396711327b0a8d8cf15"], 0x0, 0x0, 0x0}) [ 899.904314][ T7589] binder: 7583:7589 BC_REQUEST_DEATH_NOTIFICATION invalid ref 2046820352 03:40:17 executing program 5: r0 = syz_open_dev$sndseq(&(0x7f0000000040)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a85320, &(0x7f0000068f50)={{0x80}, 'por\xff\a\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00\x00\x1f\x00\x00\xff\xff\xff\xff\xff\xff\xff\xef\x00\x00\x03\xff\x00\x00\x00\x00\x00\x00\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x06\x00', 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2}) 03:40:17 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0045878, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) [ 899.977571][ T7587] : renamed from bpq0 03:40:17 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f00000000c0)=[@release={0x400c630e, 0xfdfdffff}], 0x0, 0x0, 0x0}) [ 900.080438][ T7587] : renamed from bpq0 [ 900.087530][ T7603] binder: 7597:7603 BC_REQUEST_DEATH_NOTIFICATION invalid ref 99999999 [ 900.105009][ T7603] binder: 7597:7603 unknown command -368808281 [ 900.111826][ T7603] binder: 7597:7603 ioctl c0306201 20000000 returned -22 03:40:17 executing program 5: r0 = syz_open_dev$sndseq(&(0x7f0000000040)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a85320, &(0x7f0000068f50)={{0x80}, 'por\xff\a\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x04\x00\x00\x1f\x00\x00\xff\xff\xff\xff\xff\xff\xff\xef\x00\x00\x03\xff\x00\x00\x00\x00\x00\x00\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x06\x00', 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2}) 03:40:17 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x4c, 0x0, &(0x7f0000000200)=ANY=[@ANYBLOB="05630440000000000e630c4000000a008c01acbcd9297cf4a76e04ea80b60b21d6efb41548e724db19f05bcf6e830123c34234a0c43903464dd4e9c503844e734e52e396711327b0a8d8cf15"], 0x0, 0x0, 0x0}) [ 900.146533][ T7606] binder: 7601:7606 BC_REQUEST_DEATH_NOTIFICATION invalid ref -33685505 [ 900.327495][ T7615] binder: 7612:7615 BC_REQUEST_DEATH_NOTIFICATION invalid ref 655360 [ 900.352641][ T7615] binder: 7612:7615 unknown command -368808281 [ 900.362351][ T7615] binder: 7612:7615 ioctl c0306201 20000000 returned -22 03:40:17 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f00000000c0)=[@release={0x400c630f}], 0xfdfdffff00000000, 0x5000000, 0x0}) 03:40:17 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f00000000c0)=[@release={0x400c630e, 0xfffffdfd}], 0x0, 0x0, 0x0}) 03:40:17 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0045878, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) 03:40:17 executing program 1: r0 = socket$inet6(0xa, 0x5, 0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000180)='/dev/net/tun\x00', 0x0, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000100)={'lo\x00', 0x0}) ioctl$sock_SIOCGIFINDEX(r0, 0x8923, &(0x7f0000000380)={'bpq0\x00\v\x00\xfe\x00\x00\x00\x00\x00\xfa\xff\x00', r2}) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000000)={'bpq0\x00', 0x1212}) getpgid(0xffffffffffffffff) 03:40:17 executing program 5: r0 = syz_open_dev$sndseq(&(0x7f0000000040)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a85320, &(0x7f0000068f50)={{0x80}, 'por\xff\a\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x05\x00\x00\x1f\x00\x00\xff\xff\xff\xff\xff\xff\xff\xef\x00\x00\x03\xff\x00\x00\x00\x00\x00\x00\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x06\x00', 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2}) 03:40:17 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x4c, 0x0, &(0x7f0000000200)=ANY=[@ANYBLOB="05630440000000000e630c40000063008c01acbcd9297cf4a76e04ea80b60b21d6efb41548e724db19f05bcf6e830123c34234a0c43903464dd4e9c503844e734e52e396711327b0a8d8cf15"], 0x0, 0x0, 0x0}) [ 900.689509][ T8164] binder: undelivered death notification, 0000000000000000 [ 900.768281][ T7630] binder: 7624:7630 BC_REQUEST_DEATH_NOTIFICATION invalid ref 6488064 [ 900.771327][ T7628] binder: 7623:7628 BC_REQUEST_DEATH_NOTIFICATION invalid ref -515 03:40:17 executing program 5: r0 = syz_open_dev$sndseq(&(0x7f0000000040)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a85320, &(0x7f0000068f50)={{0x80}, 'por\xff\a\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x06\x00\x00\x1f\x00\x00\xff\xff\xff\xff\xff\xff\xff\xef\x00\x00\x03\xff\x00\x00\x00\x00\x00\x00\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x06\x00', 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2}) 03:40:17 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0046209, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) [ 900.830559][ T7630] binder: 7624:7630 unknown command -368808281 03:40:17 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f00000000c0)=[@release={0x400c630e, 0x100000000000000}], 0x0, 0x0, 0x0}) [ 900.884956][ T7630] binder: 7624:7630 ioctl c0306201 20000000 returned -22 [ 900.903621][ T7627] : renamed from bpq0 03:40:18 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x4c, 0x0, &(0x7f0000000200)=ANY=[@ANYBLOB="05630440000000000e630c4000f202008c01acbcd9297cf4a76e04ea80b60b21d6efb41548e724db19f05bcf6e830123c34234a0c43903464dd4e9c503844e734e52e396711327b0a8d8cf15"], 0x0, 0x0, 0x0}) 03:40:18 executing program 5: r0 = syz_open_dev$sndseq(&(0x7f0000000040)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a85320, &(0x7f0000068f50)={{0x80}, 'por\xff\a\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\a\x00\x00\x1f\x00\x00\xff\xff\xff\xff\xff\xff\xff\xef\x00\x00\x03\xff\x00\x00\x00\x00\x00\x00\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x06\x00', 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2}) [ 901.009940][ T7645] binder: 7643:7645 BC_REQUEST_DEATH_NOTIFICATION death notification already set 03:40:18 executing program 1: r0 = socket$inet6(0xa, 0x5, 0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000180)='/dev/net/tun\x00', 0x0, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000100)={'lo\x00', 0x0}) ioctl$sock_SIOCGIFINDEX(r0, 0x8923, &(0x7f0000000380)={'bpq0\x00\v\x00\xfe\x00\x00\x00\x00\x00\xfa\xff\x00', r2}) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000000)={'bpq0\x00', 0x1212}) getpgid(0xffffffffffffffff) [ 901.140045][ T7653] binder: 7649:7653 BC_REQUEST_DEATH_NOTIFICATION invalid ref 193024 [ 901.184926][ T7653] binder: 7649:7653 unknown command -368808281 [ 901.204517][ T7653] binder: 7649:7653 ioctl c0306201 20000000 returned -22 [ 901.271095][ T7658] : renamed from bpq0 [ 901.353506][ T7658] : renamed from bpq0 03:40:18 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f00000000c0)=[@release={0x400c630f}], 0xfdfdffff00000000, 0x6000000, 0x0}) 03:40:18 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc018620b, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) 03:40:18 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f00000000c0)=[@release={0x400c630e, 0x200000000000000}], 0x0, 0x0, 0x0}) 03:40:18 executing program 5: r0 = syz_open_dev$sndseq(&(0x7f0000000040)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a85320, &(0x7f0000068f50)={{0x80}, 'por\xff\a\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\n\x00\x00\x1f\x00\x00\xff\xff\xff\xff\xff\xff\xff\xef\x00\x00\x03\xff\x00\x00\x00\x00\x00\x00\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x06\x00', 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2}) 03:40:18 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x4c, 0x0, &(0x7f0000000200)=ANY=[@ANYBLOB="05630440000000000e630c4000f203008c01acbcd9297cf4a76e04ea80b60b21d6efb41548e724db19f05bcf6e830123c34234a0c43903464dd4e9c503844e734e52e396711327b0a8d8cf15"], 0x0, 0x0, 0x0}) 03:40:18 executing program 1: r0 = socket$inet6(0xa, 0x5, 0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000180)='/dev/net/tun\x00', 0x0, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000100)={'lo\x00', 0x0}) ioctl$sock_SIOCGIFINDEX(r0, 0x8923, &(0x7f0000000380)={'bpq0\x00\v\x00\xfe\x00\x00\x00\x00\x00\xfa\xff\x00', r2}) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000000)={'bpq0\x00', 0x1212}) getpgid(0xffffffffffffffff) [ 901.579563][ T8164] binder: undelivered death notification, 0000000000000000 03:40:18 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc018620c, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) [ 901.678670][ T7675] binder: 7673:7675 unknown command -368808281 [ 901.679869][ T7680] binder: 7671:7680 BC_REQUEST_DEATH_NOTIFICATION death notification already set [ 901.700425][ T7675] binder: 7673:7675 ioctl c0306201 20000000 returned -22 03:40:18 executing program 5: r0 = syz_open_dev$sndseq(&(0x7f0000000040)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a85320, &(0x7f0000068f50)={{0x80}, 'por\xff\a\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00H\x00\x00\x1f\x00\x00\xff\xff\xff\xff\xff\xff\xff\xef\x00\x00\x03\xff\x00\x00\x00\x00\x00\x00\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x06\x00', 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2}) 03:40:18 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f00000000c0)=[@release={0x400c630e, 0x300000000000000}], 0x0, 0x0, 0x0}) [ 901.769844][ T7677] : renamed from bpq0 03:40:18 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x4c, 0x0, &(0x7f0000000200)=ANY=[@ANYBLOB="05630440000000000e630c4000f204008c01acbcd9297cf4a76e04ea80b60b21d6efb41548e724db19f05bcf6e830123c34234a0c43903464dd4e9c503844e734e52e396711327b0a8d8cf15"], 0x0, 0x0, 0x0}) [ 901.893900][ T7693] binder: 7689 BINDER_GET_NODE_INFO_FOR_REF: only handle may be non-zero. [ 901.893914][ T7693] binder: 7689:7693 ioctl c018620c 20000000 returned -22 03:40:19 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0189436, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) 03:40:19 executing program 5: r0 = syz_open_dev$sndseq(&(0x7f0000000040)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a85320, &(0x7f0000068f50)={{0x80}, 'por\xff\a\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00L\x00\x00\x1f\x00\x00\xff\xff\xff\xff\xff\xff\xff\xef\x00\x00\x03\xff\x00\x00\x00\x00\x00\x00\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x06\x00', 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2}) [ 901.944149][ T7696] binder: 7691:7696 BC_REQUEST_DEATH_NOTIFICATION death notification already set [ 901.953656][ T7698] binder: 7697:7698 unknown command -368808281 [ 901.976314][ T7698] binder: 7697:7698 ioctl c0306201 20000000 returned -22 03:40:19 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f00000000c0)=[@release={0x400c630f}], 0xfdfdffff00000000, 0x7000000, 0x0}) 03:40:19 executing program 1: r0 = socket$inet6(0xa, 0x5, 0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000180)='/dev/net/tun\x00', 0x0, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000100)={'lo\x00', 0x0}) ioctl$sock_SIOCGIFINDEX(r0, 0x8923, &(0x7f0000000380)={'bpq0\x00\v\x00\xfe\x00\x00\x00\x00\x00\xfa\xff\x00', r2}) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000000)={'bpq0\x00', 0x1212}) getpgid(0xffffffffffffffff) 03:40:19 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f00000000c0)=[@release={0x400c630e, 0x400000000000000}], 0x0, 0x0, 0x0}) 03:40:19 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x4c, 0x0, &(0x7f0000000200)=ANY=[@ANYBLOB="05630440000000000e630c4000f205008c01acbcd9297cf4a76e04ea80b60b21d6efb41548e724db19f05bcf6e830123c34234a0c43903464dd4e9c503844e734e52e396711327b0a8d8cf15"], 0x0, 0x0, 0x0}) 03:40:19 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc020660b, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) 03:40:19 executing program 5: r0 = syz_open_dev$sndseq(&(0x7f0000000040)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a85320, &(0x7f0000068f50)={{0x80}, 'por\xff\a\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00h\x00\x00\x1f\x00\x00\xff\xff\xff\xff\xff\xff\xff\xef\x00\x00\x03\xff\x00\x00\x00\x00\x00\x00\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x06\x00', 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2}) [ 902.470700][ T8164] binder: undelivered death notification, 0000000000000000 [ 902.535175][ T7712] binder: 7711:7712 BC_REQUEST_DEATH_NOTIFICATION death notification already set [ 902.544619][ T7719] binder: 7718:7719 unknown command -368808281 [ 902.575452][ T7719] binder: 7718:7719 ioctl c0306201 20000000 returned -22 03:40:19 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306203, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) 03:40:19 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f00000000c0)=[@release={0x400c630e, 0x500000000000000}], 0x0, 0x0, 0x0}) 03:40:19 executing program 5: r0 = syz_open_dev$sndseq(&(0x7f0000000040)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a85320, &(0x7f0000068f50)={{0x80}, 'por\xff\a\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00l\x00\x00\x1f\x00\x00\xff\xff\xff\xff\xff\xff\xff\xef\x00\x00\x03\xff\x00\x00\x00\x00\x00\x00\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x06\x00', 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2}) [ 902.616962][ T7722] : renamed from bpq0 03:40:19 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x4c, 0x0, &(0x7f0000000200)=ANY=[@ANYBLOB="05630440000000000e630c4000f206008c01acbcd9297cf4a76e04ea80b60b21d6efb41548e724db19f05bcf6e830123c34234a0c43903464dd4e9c503844e734e52e396711327b0a8d8cf15"], 0x0, 0x0, 0x0}) [ 902.786671][ T7737] binder: 7733:7737 ioctl c0306203 20000000 returned -22 [ 902.814896][ T7738] binder: 7731:7738 BC_REQUEST_DEATH_NOTIFICATION death notification already set 03:40:19 executing program 5: r0 = syz_open_dev$sndseq(&(0x7f0000000040)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a85320, &(0x7f0000068f50)={{0x80}, 'por\xff\a\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00t\x00\x00\x1f\x00\x00\xff\xff\xff\xff\xff\xff\xff\xef\x00\x00\x03\xff\x00\x00\x00\x00\x00\x00\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x06\x00', 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2}) 03:40:19 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x223, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) [ 902.839237][ T7740] binder: 7739:7740 unknown command -368808281 [ 902.881151][ T7740] binder: 7739:7740 ioctl c0306201 20000000 returned -22 [ 902.958605][ T7747] binder: 7745:7747 unknown command 0 [ 902.985447][ T7747] binder: 7745:7747 ioctl c0306201 20000000 returned -22 03:40:20 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f00000000c0)=[@release={0x400c630e, 0x600000000000000}], 0x0, 0x0, 0x0}) 03:40:20 executing program 1: r0 = socket$inet6(0xa, 0x5, 0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000180)='/dev/net/tun\x00', 0x0, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000100)={'lo\x00', 0x0}) ioctl$sock_SIOCGIFINDEX(r0, 0x8923, &(0x7f0000000380)={'bpq0\x00\v\x00\xfe\x00\x00\x00\x00\x00\xfa\xff\x00', r2}) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000000)={'bpq0\x00', 0x1212}) getpgid(0xffffffffffffffff) 03:40:20 executing program 5: r0 = syz_open_dev$sndseq(&(0x7f0000000040)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a85320, &(0x7f0000068f50)={{0x80}, 'por\xff\a\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00z\x00\x00\x1f\x00\x00\xff\xff\xff\xff\xff\xff\xff\xef\x00\x00\x03\xff\x00\x00\x00\x00\x00\x00\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x06\x00', 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2}) 03:40:20 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x4c, 0x0, &(0x7f0000000200)=ANY=[@ANYBLOB="05630440000000000e630c4000f207008c01acbcd9297cf4a76e04ea80b60b21d6efb41548e724db19f05bcf6e830123c34234a0c43903464dd4e9c503844e734e52e396711327b0a8d8cf15"], 0x0, 0x0, 0x0}) 03:40:20 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x1000000, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) 03:40:20 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f00000000c0)=[@release={0x400c630f}], 0xfdfdffff00000000, 0x20000000, 0x0}) [ 903.364937][ T8164] binder: undelivered death notification, 0000000000000000 [ 903.440168][ T7761] binder: 7756:7761 unknown command -368808281 [ 903.474095][ T7761] binder: 7756:7761 ioctl c0306201 20000000 returned -22 [ 903.474381][ T7766] binder: 7753:7766 BC_REQUEST_DEATH_NOTIFICATION death notification already set 03:40:20 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0xfdfdffff, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) 03:40:20 executing program 5: r0 = syz_open_dev$sndseq(&(0x7f0000000040)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a85320, &(0x7f0000068f50)={{0x80}, 'por\xff\a\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xfd\x00\x00\x1f\x00\x00\xff\xff\xff\xff\xff\xff\xff\xef\x00\x00\x03\xff\x00\x00\x00\x00\x00\x00\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x06\x00', 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2}) 03:40:20 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x4c, 0x0, &(0x7f0000000200)=ANY=[@ANYBLOB="05630440000000000e630c4000f248008c01acbcd9297cf4a76e04ea80b60b21d6efb41548e724db19f05bcf6e830123c34234a0c43903464dd4e9c503844e734e52e396711327b0a8d8cf15"], 0x0, 0x0, 0x0}) [ 903.593935][ T7759] : renamed from bpq0 03:40:20 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f00000000c0)=[@release={0x400c630e, 0x700000000000000}], 0x0, 0x0, 0x0}) 03:40:20 executing program 5: r0 = syz_open_dev$sndseq(&(0x7f0000000040)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a85320, &(0x7f0000068f50)={{0x80}, 'por\xff\a\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00\x1f\x00\x00\xff\xff\xff\xff\xff\xff\xff\xef\x00\x00\x03\xff\x00\x00\x00\x00\x00\x00\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x06\x00', 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2}) 03:40:20 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0xfffffdfd, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) [ 903.730597][ T7780] binder: 7778:7780 unknown command -368808281 [ 903.747598][ T7780] binder: 7778:7780 ioctl c0306201 20000000 returned -22 03:40:20 executing program 1: r0 = socket$inet6(0xa, 0x5, 0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000180)='/dev/net/tun\x00', 0x0, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000100)={'lo\x00', 0x0}) ioctl$sock_SIOCGIFINDEX(r0, 0x8923, &(0x7f0000000380)={'bpq0\x00\v\x00\xfe\x00\x00\x00\x00\x00\xfa\xff\x00', r2}) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000000)={'bpq0\x00', 0x1212}) getpgid(0xffffffffffffffff) [ 903.810501][ T7784] binder: 7781:7784 BC_REQUEST_DEATH_NOTIFICATION death notification already set 03:40:20 executing program 5: r0 = syz_open_dev$sndseq(&(0x7f0000000040)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a85320, &(0x7f0000068f50)={{0x80}, 'por\xff\a\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x05\x00\x1f\x00\x00\xff\xff\xff\xff\xff\xff\xff\xef\x00\x00\x03\xff\x00\x00\x00\x00\x00\x00\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x06\x00', 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2}) 03:40:20 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x4c, 0x0, &(0x7f0000000200)=ANY=[@ANYBLOB="05630440000000000e630c4000f24c008c01acbcd9297cf4a76e04ea80b60b21d6efb41548e724db19f05bcf6e830123c34234a0c43903464dd4e9c503844e734e52e396711327b0a8d8cf15"], 0x0, 0x0, 0x0}) 03:40:21 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f00000000c0)=[@release={0x400c630e, 0xa00000000000000}], 0x0, 0x0, 0x0}) 03:40:21 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x100000000000000, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) [ 903.984639][ T7795] binder: 7793:7795 unknown command -368808281 [ 904.016660][ T7795] binder: 7793:7795 ioctl c0306201 20000000 returned -22 [ 904.085135][ T7803] binder: 7800:7803 BC_REQUEST_DEATH_NOTIFICATION death notification already set [ 904.158396][ T7799] : renamed from bpq0 03:40:21 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f00000000c0)=[@release={0x400c630f}], 0xfdfdffff00000000, 0x3f000000, 0x0}) 03:40:21 executing program 5: r0 = syz_open_dev$sndseq(&(0x7f0000000040)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a85320, &(0x7f0000068f50)={{0x80}, 'por\xff\a\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x06\x00\x1f\x00\x00\xff\xff\xff\xff\xff\xff\xff\xef\x00\x00\x03\xff\x00\x00\x00\x00\x00\x00\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x06\x00', 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2}) 03:40:21 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x4c, 0x0, &(0x7f0000000200)=ANY=[@ANYBLOB="05630440000000000e630c4000f260008c01acbcd9297cf4a76e04ea80b60b21d6efb41548e724db19f05bcf6e830123c34234a0c43903464dd4e9c503844e734e52e396711327b0a8d8cf15"], 0x0, 0x0, 0x0}) 03:40:21 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0xfdfdffff00000000, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) 03:40:21 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f00000000c0)=[@release={0x400c630e, 0x2000000000000000}], 0x0, 0x0, 0x0}) 03:40:21 executing program 1: r0 = socket$inet6(0xa, 0x5, 0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000180)='/dev/net/tun\x00', 0x0, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000100)={'lo\x00', 0x0}) ioctl$sock_SIOCGIFINDEX(r0, 0x8923, &(0x7f0000000380)={'bpq0\x00\v\x00\xfe\x00\x00\x00\x00\x00\xfa\xff\xff', r2}) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000000)={'bpq0\x00', 0x1212}) getpgid(0xffffffffffffffff) [ 904.276566][ T8198] binder: undelivered death notification, 0000000000000000 03:40:21 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire={0x630b}, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) 03:40:21 executing program 5: r0 = syz_open_dev$sndseq(&(0x7f0000000040)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a85320, &(0x7f0000068f50)={{0x80}, 'por\xff\a\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\a\x00\x1f\x00\x00\xff\xff\xff\xff\xff\xff\xff\xef\x00\x00\x03\xff\x00\x00\x00\x00\x00\x00\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x06\x00', 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2}) [ 904.372835][ T7825] binder: 7816:7825 BC_REQUEST_DEATH_NOTIFICATION death notification already set [ 904.385364][ T7827] binder_thread_write: 7 callbacks suppressed [ 904.385377][ T7827] binder: 7821:7827 BC_REQUEST_DEATH_NOTIFICATION invalid ref 6353408 [ 904.414961][ T7827] binder: 7821:7827 unknown command -368808281 [ 904.452879][ T7827] binder: 7821:7827 ioctl c0306201 20000000 returned -22 [ 904.496757][ T7828] : renamed from bpq0 03:40:21 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f00000000c0)=[@release={0x400c630e, 0x4800000000000000}], 0x0, 0x0, 0x0}) 03:40:21 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x4c, 0x0, &(0x7f0000000200)=ANY=[@ANYBLOB="05630440000000000e630c4000f268008c01acbcd9297cf4a76e04ea80b60b21d6efb41548e724db19f05bcf6e830123c34234a0c43903464dd4e9c503844e734e52e396711327b0a8d8cf15"], 0x0, 0x0, 0x0}) [ 904.580538][ T7836] binder: 7835:7836 ERROR: BC_REGISTER_LOOPER called without request 03:40:21 executing program 5: r0 = syz_open_dev$sndseq(&(0x7f0000000040)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a85320, &(0x7f0000068f50)={{0x80}, 'por\xff\a\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\n\x00\x1f\x00\x00\xff\xff\xff\xff\xff\xff\xff\xef\x00\x00\x03\xff\x00\x00\x00\x00\x00\x00\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x06\x00', 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2}) [ 904.629428][ T7836] binder: 7835:7836 unknown command 0 03:40:21 executing program 1: r0 = socket$inet6(0xa, 0x5, 0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000180)='/dev/net/tun\x00', 0x0, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000100)={'lo\x00', 0x0}) ioctl$sock_SIOCGIFINDEX(r0, 0x8923, &(0x7f0000000380)={'bpq0\x00\v\x00\xfe\x00\x00\x00\x00\x00\xfa\xff\xff', r2}) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000000)={'bpq0\x00', 0x1212}) getpgid(0xffffffffffffffff) [ 904.666577][ T7836] binder: 7835:7836 ioctl c0306201 20000000 returned -22 [ 904.675354][ T7846] binder: 7842:7846 BC_REQUEST_DEATH_NOTIFICATION death notification already set [ 904.695881][ T7847] binder: 7845:7847 BC_REQUEST_DEATH_NOTIFICATION invalid ref 6877696 [ 904.740225][ T7847] binder: 7845:7847 unknown command -368808281 [ 904.769294][ T7847] binder: 7845:7847 ioctl c0306201 20000000 returned -22 [ 904.861129][ T7852] : renamed from bpq0 03:40:22 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f00000000c0)=[@release={0x400c630f}], 0xfdfdffff00000000, 0x48000000, 0x0}) 03:40:22 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire={0x630c}, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) 03:40:22 executing program 5: r0 = syz_open_dev$sndseq(&(0x7f0000000040)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a85320, &(0x7f0000068f50)={{0x80}, 'por\xff\a\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00H\x00\x1f\x00\x00\xff\xff\xff\xff\xff\xff\xff\xef\x00\x00\x03\xff\x00\x00\x00\x00\x00\x00\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x06\x00', 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2}) 03:40:22 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f00000000c0)=[@release={0x400c630e, 0x4c00000000000000}], 0x0, 0x0, 0x0}) 03:40:22 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x4c, 0x0, &(0x7f0000000200)=ANY=[@ANYBLOB="05630440000000000e630c4000f26c008c01acbcd9297cf4a76e04ea80b60b21d6efb41548e724db19f05bcf6e830123c34234a0c43903464dd4e9c503844e734e52e396711327b0a8d8cf15"], 0x0, 0x0, 0x0}) 03:40:22 executing program 1: r0 = socket$inet6(0xa, 0x5, 0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000180)='/dev/net/tun\x00', 0x0, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000100)={'lo\x00', 0x0}) ioctl$sock_SIOCGIFINDEX(r0, 0x8923, &(0x7f0000000380)={'bpq0\x00\v\x00\xfe\x00\x00\x00\x00\x00\xfa\xff\x00', r2}) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000000)={'bpq0\x00', 0x1212}) getpgid(0xffffffffffffffff) [ 905.164919][ T8164] binder: undelivered death notification, 0000000000000000 [ 905.226324][ T7868] binder: 7867:7868 unknown command 0 [ 905.231759][ T7868] binder: 7867:7868 ioctl c0306201 20000000 returned -22 [ 905.247947][ T7874] binder: 7871:7874 BC_REQUEST_DEATH_NOTIFICATION invalid ref 7139840 03:40:22 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f00000000c0)=[@release={0x400c630e, 0x6000000000000000}], 0x0, 0x0, 0x0}) 03:40:22 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire={0x630d}, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) 03:40:22 executing program 5: r0 = syz_open_dev$sndseq(&(0x7f0000000040)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a85320, &(0x7f0000068f50)={{0x80}, 'por\xff\a\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00L\x00\x1f\x00\x00\xff\xff\xff\xff\xff\xff\xff\xef\x00\x00\x03\xff\x00\x00\x00\x00\x00\x00\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x06\x00', 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2}) [ 905.295954][ T7874] binder: 7871:7874 unknown command -368808281 [ 905.320877][ T7874] binder: 7871:7874 ioctl c0306201 20000000 returned -22 [ 905.365611][ T7876] : renamed from bpq0 03:40:22 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x4c, 0x0, &(0x7f0000000200)=ANY=[@ANYBLOB="05630440000000000e630c4000f274008c01acbcd9297cf4a76e04ea80b60b21d6efb41548e724db19f05bcf6e830123c34234a0c43903464dd4e9c503844e734e52e396711327b0a8d8cf15"], 0x0, 0x0, 0x0}) [ 905.436547][ T7889] binder: 7884:7889 unknown command 0 [ 905.480291][ T7889] binder: 7884:7889 ioctl c0306201 20000000 returned -22 03:40:22 executing program 1: r0 = socket$inet6(0xa, 0x5, 0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000180)='/dev/net/tun\x00', 0x0, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000100)={'lo\x00', 0x0}) ioctl$sock_SIOCGIFINDEX(r0, 0x8923, &(0x7f0000000380)={'bpq0\x00\v\x00\xfe\x00\x00\x00\x00\x00\xfa\xff\x00', r2}) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000000)={'bpq0\x00', 0x1212}) getpgid(0xffffffffffffffff) 03:40:22 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f00000000c0)=[@release={0x400c630e, 0x6800000000000000}], 0x0, 0x0, 0x0}) [ 905.602802][ T7896] binder: 7895:7896 BC_REQUEST_DEATH_NOTIFICATION invalid ref 7664128 [ 905.675221][ T7896] binder: 7895:7896 unknown command -368808281 [ 905.684983][ T7896] binder: 7895:7896 ioctl c0306201 20000000 returned -22 [ 905.718082][ T7902] : renamed from bpq0 03:40:23 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f00000000c0)=[@release={0x400c630f}], 0xfdfdffff00000000, 0x4c000000, 0x0}) 03:40:23 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire={0x40046302}, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) 03:40:23 executing program 5: r0 = syz_open_dev$sndseq(&(0x7f0000000040)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a85320, &(0x7f0000068f50)={{0x80}, 'por\xff\a\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00h\x00\x1f\x00\x00\xff\xff\xff\xff\xff\xff\xff\xef\x00\x00\x03\xff\x00\x00\x00\x00\x00\x00\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x06\x00', 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2}) 03:40:23 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f00000000c0)=[@release={0x400c630e, 0x6c00000000000000}], 0x0, 0x0, 0x0}) 03:40:23 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x4c, 0x0, &(0x7f0000000200)=ANY=[@ANYBLOB="05630440000000000e630c4000f27a008c01acbcd9297cf4a76e04ea80b60b21d6efb41548e724db19f05bcf6e830123c34234a0c43903464dd4e9c503844e734e52e396711327b0a8d8cf15"], 0x0, 0x0, 0x0}) 03:40:23 executing program 1: r0 = socket$inet6(0xa, 0x5, 0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000180)='/dev/net/tun\x00', 0x0, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000100)={'lo\x00', 0x0}) ioctl$sock_SIOCGIFINDEX(r0, 0x8923, &(0x7f0000000380)={'bpq0\x00\v\x00\xfe\x00\x00\x00\x00\x00\xfa\xff\xfd', r2}) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000000)={'bpq0\x00', 0x1212}) getpgid(0xffffffffffffffff) [ 906.085498][ T8198] binder: undelivered death notification, 0000000000000000 [ 906.140406][ T7924] binder: BC_ACQUIRE_RESULT not supported [ 906.145639][ T7921] binder_thread_write: 3 callbacks suppressed [ 906.145650][ T7921] binder: 7920:7921 BC_REQUEST_DEATH_NOTIFICATION death notification already set [ 906.164705][ T7926] binder: 7915:7926 BC_REQUEST_DEATH_NOTIFICATION invalid ref 8057344 [ 906.178075][ T7924] binder: 7922:7924 ioctl c0306201 20000000 returned -22 03:40:23 executing program 5: r0 = syz_open_dev$sndseq(&(0x7f0000000040)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a85320, &(0x7f0000068f50)={{0x80}, 'por\xff\a\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00l\x00\x1f\x00\x00\xff\xff\xff\xff\xff\xff\xff\xef\x00\x00\x03\xff\x00\x00\x00\x00\x00\x00\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x06\x00', 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2}) [ 906.190299][ T7926] binder: 7915:7926 unknown command -368808281 [ 906.208553][ T7926] binder: 7915:7926 ioctl c0306201 20000000 returned -22 03:40:23 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire={0x40046304}, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) [ 906.263435][ T7919] : renamed from bpq0 03:40:23 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f00000000c0)=[@release={0x400c630e, 0x7400000000000000}], 0x0, 0x0, 0x0}) 03:40:23 executing program 5: r0 = syz_open_dev$sndseq(&(0x7f0000000040)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a85320, &(0x7f0000068f50)={{0x80}, 'por\xff\a\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00t\x00\x1f\x00\x00\xff\xff\xff\xff\xff\xff\xff\xef\x00\x00\x03\xff\x00\x00\x00\x00\x00\x00\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x06\x00', 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2}) 03:40:23 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x4c, 0x0, &(0x7f0000000200)=ANY=[@ANYBLOB="05630440000000000e630c4000f2f2008c01acbcd9297cf4a76e04ea80b60b21d6efb41548e724db19f05bcf6e830123c34234a0c43903464dd4e9c503844e734e52e396711327b0a8d8cf15"], 0x0, 0x0, 0x0}) [ 906.410248][ T7940] binder: 7938:7940 BC_REQUEST_DEATH_NOTIFICATION death notification already set [ 906.446321][ T7943] binder: 7941:7943 BC_REQUEST_DEATH_NOTIFICATION invalid ref 15921664 03:40:23 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire={0x40046307}, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) [ 906.482306][ T7943] binder: 7941:7943 unknown command -368808281 [ 906.503598][ T7943] binder: 7941:7943 ioctl c0306201 20000000 returned -22 [ 906.606297][ T7950] binder: 7949:7950 DecRefs 0 refcount change on invalid ref 0 ret -22 [ 906.646705][ T7950] binder: 7949:7950 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 03:40:24 executing program 5: r0 = syz_open_dev$sndseq(&(0x7f0000000040)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a85320, &(0x7f0000068f50)={{0x80}, 'por\xff\a\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00z\x00\x1f\x00\x00\xff\xff\xff\xff\xff\xff\xff\xef\x00\x00\x03\xff\x00\x00\x00\x00\x00\x00\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x06\x00', 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2}) 03:40:24 executing program 1: r0 = socket$inet6(0xa, 0x5, 0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000180)='/dev/net/tun\x00', 0x0, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000100)={'lo\x00', 0x0}) ioctl$sock_SIOCGIFINDEX(r0, 0x8923, &(0x7f0000000380)={'bpq0\x00\v\x00\xfe\x00\x00\x00\x00\x00\xfa\xff\xc3', r2}) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000000)={'bpq0\x00', 0x1212}) getpgid(0xffffffffffffffff) 03:40:24 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f00000000c0)=[@release={0x400c630e, 0x7a00000000000000}], 0x0, 0x0, 0x0}) 03:40:24 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f00000000c0)=[@release={0x400c630f}], 0xfdfdffff00000000, 0x60000000, 0x0}) 03:40:24 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x4c, 0x0, &(0x7f0000000200)=ANY=[@ANYBLOB="05630440000000000e630c4000f200038c01acbcd9297cf4a76e04ea80b60b21d6efb41548e724db19f05bcf6e830123c34234a0c43903464dd4e9c503844e734e52e396711327b0a8d8cf15"], 0x0, 0x0, 0x0}) 03:40:24 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire={0x40046312}, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) [ 907.018833][ T8164] binder: undelivered death notification, 0000000000000000 [ 907.072099][ T7960] binder: 7959:7960 BC_REQUEST_DEATH_NOTIFICATION death notification already set [ 907.083021][ T7963] binder: 7961:7963 BC_REQUEST_DEATH_NOTIFICATION invalid ref 50393600 [ 907.118669][ T7963] binder: 7961:7963 unknown command -368808281 [ 907.118891][ T7966] binder: 7964:7966 unknown command 1074029330 [ 907.125318][ T7963] binder: 7961:7963 ioctl c0306201 20000000 returned -22 [ 907.155126][ T7966] binder: 7964:7966 ioctl c0306201 20000000 returned -22 [ 907.164908][ T7958] : renamed from bpq0 03:40:24 executing program 5: r0 = syz_open_dev$sndseq(&(0x7f0000000040)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a85320, &(0x7f0000068f50)={{0x80}, 'por\xff\a\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xfd\x00\x1f\x00\x00\xff\xff\xff\xff\xff\xff\xff\xef\x00\x00\x03\xff\x00\x00\x00\x00\x00\x00\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x06\x00', 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2}) 03:40:24 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f00000000c0)=[@release={0x400c630e, 0xfdfdffff00000000}], 0x0, 0x0, 0x0}) 03:40:24 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire={0x40086303}, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) 03:40:24 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x4c, 0x0, &(0x7f0000000200)=ANY=[@ANYBLOB="05630440000000000e630c4000f200058c01acbcd9297cf4a76e04ea80b60b21d6efb41548e724db19f05bcf6e830123c34234a0c43903464dd4e9c503844e734e52e396711327b0a8d8cf15"], 0x0, 0x0, 0x0}) 03:40:24 executing program 5: r0 = syz_open_dev$sndseq(&(0x7f0000000040)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a85320, &(0x7f0000068f50)={{0x80}, 'por\xff\a\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02\x00\x1f\x00\x00\xff\xff\xff\xff\xff\xff\xff\xef\x00\x00\x03\xff\x00\x00\x00\x00\x00\x00\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x06\x00', 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2}) 03:40:24 executing program 1: r0 = socket$inet6(0xa, 0x5, 0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000180)='/dev/net/tun\x00', 0x0, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000100)={'lo\x00', 0x0}) ioctl$sock_SIOCGIFINDEX(r0, 0x8923, &(0x7f0000000380)={'bpq0\x00\v\x00\xfe\x00\x00\x00\x00\x00\xfa\xff\x00', r2}) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000000)={'bpq0\x00', 0x1212}) getpgid(0xffffffffffffffff) [ 907.355109][ T7982] binder: 7978:7982 BC_REQUEST_DEATH_NOTIFICATION death notification already set [ 907.387935][ T7984] binder: 7983:7984 BC_FREE_BUFFER u400c630e00000000 no match [ 907.423632][ T7988] binder: 7986:7988 BC_REQUEST_DEATH_NOTIFICATION invalid ref 83948032 [ 907.442560][ T7984] binder: 7983:7984 unknown command 0 03:40:24 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f00000000c0)=[@release={0x400c630e}], 0x2, 0x0, 0x0}) [ 907.466424][ T7984] binder: 7983:7984 ioctl c0306201 20000000 returned -22 [ 907.482992][ T7988] binder: 7986:7988 unknown command -368808281 03:40:24 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire={0x4008630a}, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) 03:40:24 executing program 5: r0 = syz_open_dev$sndseq(&(0x7f0000000040)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a85320, &(0x7f0000068f50)={{0x80}, 'por\xff\a\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00\x1f\x00\x00\xff\xff\xff\xff\xff\xff\xff\xef\x00\x00\x03\xff\x00\x00\x00\x00\x00\x00\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x06\x00', 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2}) [ 907.512914][ T7988] binder: 7986:7988 ioctl c0306201 20000000 returned -22 [ 907.612596][ T8000] binder: 7999:8000 BC_REQUEST_DEATH_NOTIFICATION death notification already set [ 907.647691][ T7992] : renamed from bpq0 [ 907.665478][ T8000] binder: 7999:8000 ioctl c0306201 20008fd0 returned -14 [ 907.699147][ T8008] binder: BC_ATTEMPT_ACQUIRE not supported [ 907.715296][ T8008] binder: 8004:8008 ioctl c0306201 20000000 returned -22 03:40:24 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f00000000c0)=[@release={0x400c630f}], 0xfdfdffff00000000, 0x68000000, 0x0}) 03:40:24 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x4c, 0x0, &(0x7f0000000200)=ANY=[@ANYBLOB="05630440000000000e630c4000f200068c01acbcd9297cf4a76e04ea80b60b21d6efb41548e724db19f05bcf6e830123c34234a0c43903464dd4e9c503844e734e52e396711327b0a8d8cf15"], 0x0, 0x0, 0x0}) 03:40:24 executing program 5: r0 = syz_open_dev$sndseq(&(0x7f0000000040)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a85320, &(0x7f0000068f50)={{0x80}, 'por\xff\a\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x04\x00\x1f\x00\x00\xff\xff\xff\xff\xff\xff\xff\xef\x00\x00\x03\xff\x00\x00\x00\x00\x00\x00\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x06\x00', 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2}) 03:40:24 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f00000000c0)=[@release={0x400c630e}], 0x3, 0x0, 0x0}) 03:40:24 executing program 1: r0 = socket$inet6(0xa, 0x5, 0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000180)='/dev/net/tun\x00', 0x0, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000100)={'lo\x00', 0x0}) ioctl$sock_SIOCGIFINDEX(r0, 0x8923, &(0x7f0000000380)={'bpq0\x00\v\x00\xfe\x00\x00\x00\x00\x00\xfa\xff\x00', r2}) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000000)={'bpq0\x00', 0x1212}) getpgid(0xffffffffffffffff) 03:40:24 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire={0x40086310}, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) [ 907.881678][T24007] binder: undelivered death notification, 0000000000000000 [ 907.908133][ T8017] binder: 8016:8017 BC_REQUEST_DEATH_NOTIFICATION invalid ref 100725248 [ 907.933473][ T8020] binder: 8015:8020 BC_REQUEST_DEATH_NOTIFICATION death notification already set [ 907.958101][ T8017] binder: 8016:8017 unknown command -368808281 03:40:25 executing program 5: r0 = syz_open_dev$sndseq(&(0x7f0000000040)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a85320, &(0x7f0000068f50)={{0x80}, 'por\xff\a\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x05\x00\x1f\x00\x00\xff\xff\xff\xff\xff\xff\xff\xef\x00\x00\x03\xff\x00\x00\x00\x00\x00\x00\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x06\x00', 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2}) [ 907.979049][ T8017] binder: 8016:8017 ioctl c0306201 20000000 returned -22 [ 907.979058][ T8030] binder: 8023:8030 BC_DEAD_BINDER_DONE 400c630e00000000 not found [ 907.979075][ T8030] binder: 8023:8030 unknown command 0 [ 907.992084][ T8020] binder: 8015:8020 ioctl c0306201 20008fd0 returned -14 [ 908.014718][ T8030] binder: 8023:8030 ioctl c0306201 20000000 returned -22 03:40:25 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x4c, 0x0, &(0x7f0000000200)=ANY=[@ANYBLOB="05630440000000000e630c4000f200078c01acbcd9297cf4a76e04ea80b60b21d6efb41548e724db19f05bcf6e830123c34234a0c43903464dd4e9c503844e734e52e396711327b0a8d8cf15"], 0x0, 0x0, 0x0}) [ 908.075562][ T8019] : renamed from bpq0 03:40:25 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire={0x400c630e}, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) 03:40:25 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f00000000c0)=[@release={0x400c630e}], 0x4, 0x0, 0x0}) 03:40:25 executing program 5: r0 = syz_open_dev$sndseq(&(0x7f0000000040)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a85320, &(0x7f0000068f50)={{0x80}, 'por\xff\a\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x06\x00\x1f\x00\x00\xff\xff\xff\xff\xff\xff\xff\xef\x00\x00\x03\xff\x00\x00\x00\x00\x00\x00\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x06\x00', 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2}) 03:40:25 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire={0x400c630f}, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) [ 908.266393][ T8049] binder: 8047:8049 unknown command -368808281 [ 908.288884][ T8051] binder: 8048:8051 BC_REQUEST_DEATH_NOTIFICATION death notification already set [ 908.299388][ T8049] binder: 8047:8049 ioctl c0306201 20000000 returned -22 [ 908.348031][ T8051] binder: 8048:8051 ioctl c0306201 20008fd0 returned -14 03:40:25 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f00000000c0)=[@release={0x400c630f}], 0xfdfdffff00000000, 0x6c000000, 0x0}) 03:40:25 executing program 1: r0 = socket$inet6(0xa, 0x5, 0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000180)='/dev/net/tun\x00', 0x0, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000100)={'lo\x00', 0x0}) ioctl$sock_SIOCGIFINDEX(r0, 0x8923, &(0x7f0000000380)={'bpq0\x00\v\x00\xfe\x00\x00\x00\x00\x00\xfa\xff\x00', r2}) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000000)={'bpq0\x00', 0x1212}) getpgid(0xffffffffffffffff) 03:40:25 executing program 5: r0 = syz_open_dev$sndseq(&(0x7f0000000040)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a85320, &(0x7f0000068f50)={{0x80}, 'por\xff\a\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\a\x00\x1f\x00\x00\xff\xff\xff\xff\xff\xff\xff\xef\x00\x00\x03\xff\x00\x00\x00\x00\x00\x00\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x06\x00', 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2}) 03:40:25 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire={0x40106308}, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) 03:40:25 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x4c, 0x0, &(0x7f0000000200)=ANY=[@ANYBLOB="05630440000000000e630c4000f200208c01acbcd9297cf4a76e04ea80b60b21d6efb41548e724db19f05bcf6e830123c34234a0c43903464dd4e9c503844e734e52e396711327b0a8d8cf15"], 0x0, 0x0, 0x0}) 03:40:25 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f00000000c0)=[@release={0x400c630e}], 0x5, 0x0, 0x0}) [ 908.771357][T24007] binder: undelivered death notification, 0000000000000000 [ 908.816842][ T8069] binder: 8067:8069 BC_REQUEST_DEATH_NOTIFICATION death notification already set [ 908.835675][ T8071] binder: 8070:8071 unknown command -368808281 [ 908.841897][ T8071] binder: 8070:8071 ioctl c0306201 20000000 returned -22 03:40:25 executing program 5: r0 = syz_open_dev$sndseq(&(0x7f0000000040)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a85320, &(0x7f0000068f50)={{0x80}, 'por\xff\a\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\n\x00\x1f\x00\x00\xff\xff\xff\xff\xff\xff\xff\xef\x00\x00\x03\xff\x00\x00\x00\x00\x00\x00\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x06\x00', 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2}) [ 908.862291][ T8066] binder: 8063:8066 BC_INCREFS_DONE u400c630e00000000 no match [ 908.884947][ T8069] binder: 8067:8069 ioctl c0306201 20008fd0 returned -14 [ 908.896546][ T8072] : renamed from bpq0 03:40:26 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f00000000c0)=[@release={0x400c630e}], 0x6, 0x0, 0x0}) 03:40:26 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire={0x40106309}, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) 03:40:26 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x4c, 0x0, &(0x7f0000000200)=ANY=[@ANYBLOB="05630440000000000e630c4000f2003f8c01acbcd9297cf4a76e04ea80b60b21d6efb41548e724db19f05bcf6e830123c34234a0c43903464dd4e9c503844e734e52e396711327b0a8d8cf15"], 0x0, 0x0, 0x0}) 03:40:26 executing program 5: r0 = syz_open_dev$sndseq(&(0x7f0000000040)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a85320, &(0x7f0000068f50)={{0x80}, 'por\xff\a\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00H\x00\x1f\x00\x00\xff\xff\xff\xff\xff\xff\xff\xef\x00\x00\x03\xff\x00\x00\x00\x00\x00\x00\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x06\x00', 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2}) 03:40:26 executing program 1: r0 = socket$inet6(0xa, 0x5, 0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000180)='/dev/net/tun\x00', 0x0, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000100)={'lo\x00', 0x0}) ioctl$sock_SIOCGIFINDEX(r0, 0x8923, &(0x7f0000000380)={'bpq0\x00\v\x00\xfe\x00\x00\x00\x00\x00\xfa\xff\x00', r2}) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000000)={'bpq0\x00', 0x1212}) getpgid(0xffffffffffffffff) [ 909.132580][ T8093] binder: 8089:8093 unknown command -368808281 [ 909.145946][ T8092] binder: 8085:8092 BC_ACQUIRE_DONE u400c630e00000000 no match [ 909.151611][ T8095] binder: 8090:8095 BC_REQUEST_DEATH_NOTIFICATION death notification already set [ 909.176825][ T8093] binder: 8089:8093 ioctl c0306201 20000000 returned -22 [ 909.200799][ T8095] binder: 8090:8095 ioctl c0306201 20008fd0 returned -14 [ 909.336277][ T8100] : renamed from bpq0 03:40:26 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f00000000c0)=[@release={0x400c630f}], 0xfdfdffff00000000, 0x74000000, 0x0}) 03:40:26 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire={0x40406300}, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) 03:40:26 executing program 5: r0 = syz_open_dev$sndseq(&(0x7f0000000040)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a85320, &(0x7f0000068f50)={{0x80}, 'por\xff\a\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00L\x00\x1f\x00\x00\xff\xff\xff\xff\xff\xff\xff\xef\x00\x00\x03\xff\x00\x00\x00\x00\x00\x00\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x06\x00', 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2}) 03:40:26 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x4c, 0x0, &(0x7f0000000200)=ANY=[@ANYBLOB="05630440000000000e630c4000f200488c01acbcd9297cf4a76e04ea80b60b21d6efb41548e724db19f05bcf6e830123c34234a0c43903464dd4e9c503844e734e52e396711327b0a8d8cf15"], 0x0, 0x0, 0x0}) 03:40:26 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f00000000c0)=[@release={0x400c630e}], 0x7, 0x0, 0x0}) 03:40:26 executing program 1: r0 = socket$inet6(0xa, 0x5, 0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000180)='/dev/net/tun\x00', 0x0, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000100)={'lo\x00', 0x0}) ioctl$sock_SIOCGIFINDEX(r0, 0x8923, &(0x7f0000000380)={'bpq0\x00\v\x00\xfe\x00\x00\x00\x00\x00\xfa\xff\x00', r2}) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000000)={'bpq0\x00', 0x1212}) getpgid(0xffffffffffffffff) [ 909.663602][T24007] binder: undelivered death notification, 0000000000000000 [ 909.713956][ T8115] binder_alloc: 13678: binder_alloc_buf, no vma [ 909.739051][ T8127] binder_thread_write: 5 callbacks suppressed [ 909.739064][ T8127] binder: 8116:8127 BC_REQUEST_DEATH_NOTIFICATION invalid ref 1208021504 03:40:26 executing program 5: r0 = syz_open_dev$sndseq(&(0x7f0000000040)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a85320, &(0x7f0000068f50)={{0x80}, 'por\xff\a\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00h\x00\x1f\x00\x00\xff\xff\xff\xff\xff\xff\xff\xef\x00\x00\x03\xff\x00\x00\x00\x00\x00\x00\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x06\x00', 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2}) [ 909.772784][ T8127] binder: 8116:8127 unknown command -368808281 [ 909.779293][ T8115] binder: 8114:8115 transaction failed 29189/-3, size 0-0 line 3035 [ 909.779774][ T8130] binder: 8128:8130 BC_REQUEST_DEATH_NOTIFICATION death notification already set [ 909.795523][ T8127] binder: 8116:8127 ioctl c0306201 20000000 returned -22 03:40:26 executing program 5: r0 = syz_open_dev$sndseq(&(0x7f0000000040)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a85320, &(0x7f0000068f50)={{0x80}, 'por\xff\a\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00l\x00\x1f\x00\x00\xff\xff\xff\xff\xff\xff\xff\xef\x00\x00\x03\xff\x00\x00\x00\x00\x00\x00\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x06\x00', 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2}) [ 909.851176][ T8130] binder: 8128:8130 ioctl c0306201 20008fd0 returned -14 [ 909.874859][ T8126] : renamed from bpq0 03:40:26 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x4c, 0x0, &(0x7f0000000200)=ANY=[@ANYBLOB="05630440000000000e630c4000f2004c8c01acbcd9297cf4a76e04ea80b60b21d6efb41548e724db19f05bcf6e830123c34234a0c43903464dd4e9c503844e734e52e396711327b0a8d8cf15"], 0x0, 0x0, 0x0}) 03:40:27 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire={0x40406301}, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) [ 909.913749][ T8164] binder: undelivered TRANSACTION_ERROR: 29189 03:40:27 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f00000000c0)=[@release={0x400c630e}], 0xa, 0x0, 0x0}) [ 910.052175][ T8165] binder: 8152:8165 BC_REQUEST_DEATH_NOTIFICATION invalid ref 1275130368 [ 910.082468][ T8169] binder: 8168:8169 got reply transaction with no transaction stack [ 910.084393][ T8126] : renamed from bpq0 03:40:27 executing program 5: r0 = syz_open_dev$sndseq(&(0x7f0000000040)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a85320, &(0x7f0000068f50)={{0x80}, 'por\xff\a\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00t\x00\x1f\x00\x00\xff\xff\xff\xff\xff\xff\xff\xef\x00\x00\x03\xff\x00\x00\x00\x00\x00\x00\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x06\x00', 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2}) [ 910.104909][ T8169] binder: 8168:8169 transaction failed 29201/-71, size 0-0 line 2801 [ 910.108988][ T8165] binder: 8152:8165 unknown command -368808281 [ 910.125917][ T8165] binder: 8152:8165 ioctl c0306201 20000000 returned -22 [ 910.153720][ T8174] binder: 8171:8174 ioctl c0306201 20008fd0 returned -14 [ 910.193510][ T8164] binder: undelivered TRANSACTION_ERROR: 29201 03:40:27 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f00000000c0)=[@release={0x400c630f}], 0xfdfdffff00000000, 0x7a000000, 0x0}) 03:40:27 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire={0x40486311}, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) 03:40:27 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x4c, 0x0, &(0x7f0000000200)=ANY=[@ANYBLOB="05630440000000000e630c4000f200608c01acbcd9297cf4a76e04ea80b60b21d6efb41548e724db19f05bcf6e830123c34234a0c43903464dd4e9c503844e734e52e396711327b0a8d8cf15"], 0x0, 0x0, 0x0}) 03:40:27 executing program 5: r0 = syz_open_dev$sndseq(&(0x7f0000000040)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a85320, &(0x7f0000068f50)={{0x80}, 'por\xff\a\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00z\x00\x1f\x00\x00\xff\xff\xff\xff\xff\xff\xff\xef\x00\x00\x03\xff\x00\x00\x00\x00\x00\x00\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x06\x00', 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2}) 03:40:27 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f00000000c0)=[@release={0x400c630e}], 0x48, 0x0, 0x0}) 03:40:27 executing program 1: r0 = socket$inet6(0xa, 0x5, 0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000180)='/dev/net/tun\x00', 0x0, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000100)={'lo\x00', 0x0}) ioctl$sock_SIOCGIFINDEX(r0, 0x8923, &(0x7f0000000380)={'bpq0\x00\v\x00\xfe\x00\x00\x00\x00\x00\xfa\xff\x00', r2}) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000000)={'bpq0\x00', 0x1212}) getpgid(0xffffffffffffffff) [ 910.557517][T24007] binder: undelivered death notification, 0000000000000000 [ 910.610115][ T8190] binder: 8189:8190 ioctl c0306201 20008fd0 returned -14 [ 910.616243][ T8187] binder_alloc: 13678: binder_alloc_buf, no vma [ 910.637169][ T8195] binder: 8185:8195 BC_REQUEST_DEATH_NOTIFICATION invalid ref 1610674688 [ 910.660153][ T8187] binder: 8183:8187 transaction failed 29189/-3, size 0-0 line 3035 [ 910.683859][ T8195] binder: 8185:8195 unknown command -368808281 [ 910.698524][ T8191] : renamed from bpq0 03:40:27 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f00000000c0)=[@release={0x400c630e}], 0x4c, 0x0, 0x0}) 03:40:27 executing program 5: r0 = syz_open_dev$sndseq(&(0x7f0000000040)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a85320, &(0x7f0000068f50)={{0x80}, 'por\xff\a\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xfd\x00\x1f\x00\x00\xff\xff\xff\xff\xff\xff\xff\xef\x00\x00\x03\xff\x00\x00\x00\x00\x00\x00\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x06\x00', 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2}) [ 910.706175][ T8195] binder: 8185:8195 ioctl c0306201 20000000 returned -22 03:40:27 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire={0x40486312}, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) [ 910.771763][T24007] binder: undelivered TRANSACTION_ERROR: 29189 [ 910.783319][ T8205] binder: 8201:8205 ioctl c0306201 20008fd0 returned -14 03:40:27 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x4c, 0x0, &(0x7f0000000200)=ANY=[@ANYBLOB="05630440000000000e630c4000f200688c01acbcd9297cf4a76e04ea80b60b21d6efb41548e724db19f05bcf6e830123c34234a0c43903464dd4e9c503844e734e52e396711327b0a8d8cf15"], 0x0, 0x0, 0x0}) 03:40:27 executing program 1: r0 = socket$inet6(0xa, 0x5, 0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000180)='/dev/net/tun\x00', 0x0, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000100)={'lo\x00', 0x0}) ioctl$sock_SIOCGIFINDEX(r0, 0x8923, &(0x7f0000000380)={'bpq0\x00\v\x00\xfe\x00\x00\x00\x00\x00\xfa\xff\x00', r2}) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000000)={'bpq0\x00', 0x1212}) getpgid(0xffffffffffffffff) 03:40:27 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f00000000c0)=[@release={0x400c630e}], 0x60, 0x0, 0x0}) [ 910.914196][ T8211] binder: 8210:8211 got reply transaction with no transaction stack [ 910.945041][ T8211] binder: 8210:8211 transaction failed 29201/-71, size 0-0 line 2801 [ 910.994227][ T8220] binder: 8217:8220 BC_REQUEST_DEATH_NOTIFICATION invalid ref 1744892416 [ 911.035408][ T8220] binder: 8217:8220 unknown command -368808281 [ 911.047235][ T8223] binder: 8221:8223 ioctl c0306201 20008fd0 returned -14 [ 911.055293][ T8220] binder: 8217:8220 ioctl c0306201 20000000 returned -22 [ 911.081886][T24007] binder: undelivered TRANSACTION_ERROR: 29201 [ 911.114412][ T8216] : renamed from bpq0 03:40:28 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f00000000c0)=[@release={0x400c630f}], 0xfdfdffff00000000, 0xff600000, 0x0}) 03:40:28 executing program 5: r0 = syz_open_dev$sndseq(&(0x7f0000000040)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a85320, &(0x7f0000068f50)={{0x80}, 'por\xff\a\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x03\x1f\x00\x00\xff\xff\xff\xff\xff\xff\xff\xef\x00\x00\x03\xff\x00\x00\x00\x00\x00\x00\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x06\x00', 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2}) 03:40:28 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire={0x40046305, 0x1000000}, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) 03:40:28 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f00000000c0)=[@release={0x400c630e}], 0x68, 0x0, 0x0}) 03:40:28 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x4c, 0x0, &(0x7f0000000200)=ANY=[@ANYBLOB="05630440000000000e630c4000f2006c8c01acbcd9297cf4a76e04ea80b60b21d6efb41548e724db19f05bcf6e830123c34234a0c43903464dd4e9c503844e734e52e396711327b0a8d8cf15"], 0x0, 0x0, 0x0}) 03:40:28 executing program 1: r0 = socket$inet6(0xa, 0x5, 0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000180)='/dev/net/tun\x00', 0x0, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000100)={'lo\x00', 0x0}) ioctl$sock_SIOCGIFINDEX(r0, 0x8923, &(0x7f0000000380)={'bpq0\x00\v\x00\xfe\x00\x00\x00\x00\x00\xfa\xff\x00', r2}) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000000)={'bpq0\x00', 0x1212}) getpgid(0xffffffffffffffff) [ 911.470855][ T8164] binder: undelivered death notification, 0000000000000000 03:40:28 executing program 5: r0 = syz_open_dev$sndseq(&(0x7f0000000040)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a85320, &(0x7f0000068f50)={{0x80}, 'por\xff\a\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x05\x1f\x00\x00\xff\xff\xff\xff\xff\xff\xff\xef\x00\x00\x03\xff\x00\x00\x00\x00\x00\x00\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x06\x00', 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2}) [ 911.525819][ T8243] binder_thread_write: 4 callbacks suppressed [ 911.525830][ T8243] binder: 8235:8243 BC_REQUEST_DEATH_NOTIFICATION death notification already set [ 911.527855][ T8240] binder: 8238:8240 Acquire 1 refcount change on invalid ref 16777216 ret -22 [ 911.531960][ T8243] binder: 8235:8243 ioctl c0306201 20008fd0 returned -14 [ 911.565008][ T8242] binder: 8241:8242 BC_REQUEST_DEATH_NOTIFICATION invalid ref 1812001280 [ 911.591282][ T8242] binder: 8241:8242 unknown command -368808281 [ 911.614622][ T8242] binder: 8241:8242 ioctl c0306201 20000000 returned -22 03:40:28 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f00000000c0)=[@release={0x400c630e}], 0x6c, 0x0, 0x0}) [ 911.648517][ T8240] binder: 8238:8240 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 911.685063][ T8239] : renamed from bpq0 03:40:28 executing program 5: r0 = syz_open_dev$sndseq(&(0x7f0000000040)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a85320, &(0x7f0000068f50)={{0x80}, 'por\xff\a\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x06\x1f\x00\x00\xff\xff\xff\xff\xff\xff\xff\xef\x00\x00\x03\xff\x00\x00\x00\x00\x00\x00\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x06\x00', 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2}) 03:40:28 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x4c, 0x0, &(0x7f0000000200)=ANY=[@ANYBLOB="05630440000000000e630c4000f200748c01acbcd9297cf4a76e04ea80b60b21d6efb41548e724db19f05bcf6e830123c34234a0c43903464dd4e9c503844e734e52e396711327b0a8d8cf15"], 0x0, 0x0, 0x0}) 03:40:28 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire={0x40046305, 0xfdfdffff}, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) [ 911.752252][ T8254] binder: 8253:8254 BC_REQUEST_DEATH_NOTIFICATION death notification already set [ 911.808621][ T8254] binder: 8253:8254 ioctl c0306201 20008fd0 returned -14 [ 911.836399][ T8265] binder: 8262:8265 BC_REQUEST_DEATH_NOTIFICATION invalid ref 1946219008 03:40:28 executing program 1: r0 = socket$inet6(0xa, 0x5, 0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000180)='/dev/net/tun\x00', 0x0, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000100)={'lo\x00', 0x0}) ioctl$sock_SIOCGIFINDEX(r0, 0x8923, &(0x7f0000000380)={'bpq0\x00\v\x00\xfe\x00\x00\x00\x00\x00\xfa\xff\x00', r2}) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000000)={'bpq0\x00', 0x1212}) getpgid(0xffffffffffffffff) [ 911.866919][ T8266] binder: 8264:8266 Acquire 1 refcount change on invalid ref -33685505 ret -22 [ 911.883946][ T8265] binder: 8262:8265 unknown command -368808281 [ 911.893332][ T8266] binder: 8264:8266 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 911.901789][ T8265] binder: 8262:8265 ioctl c0306201 20000000 returned -22 [ 912.073824][ T8270] : renamed from bpq0 03:40:29 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f00000000c0)=[@release={0x400c630f}], 0xfdfdffff00000000, 0x2000000000, 0x0}) 03:40:29 executing program 5: r0 = syz_open_dev$sndseq(&(0x7f0000000040)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a85320, &(0x7f0000068f50)={{0x80}, 'por\xff\a\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\a\x1f\x00\x00\xff\xff\xff\xff\xff\xff\xff\xef\x00\x00\x03\xff\x00\x00\x00\x00\x00\x00\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x06\x00', 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2}) 03:40:29 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f00000000c0)=[@release={0x400c630e}], 0x74, 0x0, 0x0}) 03:40:29 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire={0x40046305, 0xfffffdfd}, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) 03:40:29 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x4c, 0x0, &(0x7f0000000200)=ANY=[@ANYBLOB="05630440000000000e630c4000f2007a8c01acbcd9297cf4a76e04ea80b60b21d6efb41548e724db19f05bcf6e830123c34234a0c43903464dd4e9c503844e734e52e396711327b0a8d8cf15"], 0x0, 0x0, 0x0}) 03:40:29 executing program 1: r0 = socket$inet6(0xa, 0x5, 0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000180)='/dev/net/tun\x00', 0x0, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000100)={'lo\x00', 0x0}) ioctl$sock_SIOCGIFINDEX(r0, 0x8923, &(0x7f0000000380)={'bpq0\x00\v\x00\xfe\x00\x00\x00\x00\x00\xfa\xff\x00', r2}) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000000)={'bpq0\x00', 0x1212}) getpgid(0xffffffffffffffff) [ 912.392494][ T8164] binder: undelivered death notification, 0000000000000000 [ 912.446670][ T8285] binder: 8282:8285 Acquire 1 refcount change on invalid ref -515 ret -22 [ 912.457527][ T8290] binder: 8288:8290 BC_REQUEST_DEATH_NOTIFICATION invalid ref 2046882304 [ 912.480737][ T8290] binder: 8288:8290 unknown command -368808281 03:40:29 executing program 5: r0 = syz_open_dev$sndseq(&(0x7f0000000040)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a85320, &(0x7f0000068f50)={{0x80}, 'por\xff\a\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\n\x1f\x00\x00\xff\xff\xff\xff\xff\xff\xff\xef\x00\x00\x03\xff\x00\x00\x00\x00\x00\x00\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x06\x00', 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2}) [ 912.488701][ T8293] binder: 8287:8293 BC_REQUEST_DEATH_NOTIFICATION death notification already set [ 912.498375][ T8285] binder: 8282:8285 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 912.501583][ T8290] binder: 8288:8290 ioctl c0306201 20000000 returned -22 [ 912.524891][ T8293] binder: 8287:8293 ioctl c0306201 20008fd0 returned -14 [ 912.532129][ T8291] : renamed from bpq0 03:40:29 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire={0x40046305, 0x100000000000000}, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) 03:40:29 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x4c, 0x0, &(0x7f0000000200)=ANY=[@ANYBLOB="05630440000000000e630c4000f200f28c01acbcd9297cf4a76e04ea80b60b21d6efb41548e724db19f05bcf6e830123c34234a0c43903464dd4e9c503844e734e52e396711327b0a8d8cf15"], 0x0, 0x0, 0x0}) 03:40:29 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f00000000c0)=[@release={0x400c630e}], 0x7a, 0x0, 0x0}) 03:40:29 executing program 5: r0 = syz_open_dev$sndseq(&(0x7f0000000040)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a85320, &(0x7f0000068f50)={{0x80}, 'por\xff\a\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00H\x1f\x00\x00\xff\xff\xff\xff\xff\xff\xff\xef\x00\x00\x03\xff\x00\x00\x00\x00\x00\x00\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x06\x00', 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2}) 03:40:29 executing program 1: r0 = socket$inet6(0xa, 0x5, 0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000180)='/dev/net/tun\x00', 0x0, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000100)={'lo\x00', 0x0}) ioctl$sock_SIOCGIFINDEX(r0, 0x8923, &(0x7f0000000380)={'bpq0\x00\v\x00\xfe\x00\x00\x00\x00\x00\xfa\xff\x00', r2}) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000000)={'bpq0\x00', 0x1212}) getpgid(0xffffffffffffffff) [ 912.783374][ T8311] binder: 8309:8311 unknown command -368808281 [ 912.793429][ T8312] binder: 8310:8312 BC_REQUEST_DEATH_NOTIFICATION death notification already set [ 912.857507][ T8311] binder: 8309:8311 ioctl c0306201 20000000 returned -22 [ 912.865272][ T8312] binder: 8310:8312 ioctl c0306201 20008fd0 returned -14 [ 912.982913][ T8319] : renamed from bpq0 03:40:30 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f00000000c0)=[@release={0x400c630f}], 0xfdfdffff00000000, 0x400000000000, 0x0}) 03:40:30 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire={0x40046305, 0xfdfdffff00000000}, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) 03:40:30 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f00000000c0)=[@release={0x400c630e}], 0x300, 0x0, 0x0}) 03:40:30 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x4c, 0x0, &(0x7f0000000200)=ANY=[@ANYBLOB="05630440000000000e630c4000f200028c01acbcd9297cf4a76e04ea80b60b21d6efb41548e724db19f05bcf6e830123c34234a0c43903464dd4e9c503844e734e52e396711327b0a8d8cf15"], 0x0, 0x0, 0x0}) 03:40:30 executing program 5: r0 = syz_open_dev$sndseq(&(0x7f0000000040)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a85320, &(0x7f0000068f50)={{0x80}, 'por\xff\a\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00L\x1f\x00\x00\xff\xff\xff\xff\xff\xff\xff\xef\x00\x00\x03\xff\x00\x00\x00\x00\x00\x00\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x06\x00', 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2}) 03:40:30 executing program 1: r0 = socket$inet6(0xa, 0x5, 0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000180)='/dev/net/tun\x00', 0x0, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000100)={'lo\x00', 0x0}) ioctl$sock_SIOCGIFINDEX(r0, 0x8923, &(0x7f0000000380)={'bpq0\x00\v\x00\xfe\x00\x00\x00\x00\x00\xfa\xff\x00', r2}) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000000)={'bpq0\x00', 0x1212}) getpgid(0xffffffffffffffff) [ 913.292626][T24007] binder: undelivered death notification, 0000000000000000 [ 913.370345][ T8341] binder: 8336:8341 BC_REQUEST_DEATH_NOTIFICATION death notification already set [ 913.391806][ T8343] binder: 8337:8343 unknown command -368808281 03:40:30 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x630b}], 0x0, 0x0, 0x0}) 03:40:30 executing program 5: r0 = syz_open_dev$sndseq(&(0x7f0000000040)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a85320, &(0x7f0000068f50)={{0x80}, 'por\xff\a\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00h\x1f\x00\x00\xff\xff\xff\xff\xff\xff\xff\xef\x00\x00\x03\xff\x00\x00\x00\x00\x00\x00\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x06\x00', 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2}) [ 913.416269][ T8341] binder: 8336:8341 ioctl c0306201 20008fd0 returned -14 [ 913.425172][ T8343] binder: 8337:8343 ioctl c0306201 20000000 returned -22 03:40:30 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f00000000c0)=[@release={0x400c630e}], 0x500, 0x0, 0x0}) [ 913.473378][ T8338] : renamed from bpq0 03:40:30 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x4c, 0x0, &(0x7f0000000200)=ANY=[@ANYBLOB="05630440000000000e630c4000f200038c01acbcd9297cf4a76e04ea80b60b21d6efb41548e724db19f05bcf6e830123c34234a0c43903464dd4e9c503844e734e52e396711327b0a8d8cf15"], 0x0, 0x0, 0x0}) [ 913.526549][ T8352] binder: 8350:8352 ERROR: BC_REGISTER_LOOPER called without request [ 913.553085][ T8352] binder: 8350:8352 unknown command 0 [ 913.599691][ T8352] binder: 8350:8352 ioctl c0306201 20000000 returned -22 [ 913.615807][ T8359] binder: 8358:8359 BC_REQUEST_DEATH_NOTIFICATION death notification already set [ 913.646968][ T8359] binder: 8358:8359 ioctl c0306201 20008fd0 returned -14 03:40:30 executing program 1: r0 = socket$inet6(0xa, 0x5, 0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000180)='/dev/net/tun\x00', 0x0, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000100)={'lo\x00', 0x0}) ioctl$sock_SIOCGIFINDEX(r0, 0x8923, &(0x7f0000000380)={'bpq0\x00\v\x00\xfe\x00\x00\x00\x00\x00\xfa\xff\x00', r2}) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000000)={'bpq0\x00', 0x1212}) getpgid(0xffffffffffffffff) 03:40:30 executing program 5: r0 = syz_open_dev$sndseq(&(0x7f0000000040)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a85320, &(0x7f0000068f50)={{0x80}, 'por\xff\a\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00l\x1f\x00\x00\xff\xff\xff\xff\xff\xff\xff\xef\x00\x00\x03\xff\x00\x00\x00\x00\x00\x00\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x06\x00', 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2}) [ 913.696815][ T8364] binder: 8363:8364 unknown command -368808281 [ 913.739504][ T8364] binder: 8363:8364 ioctl c0306201 20000000 returned -22 [ 913.924839][ T8371] : renamed from bpq0 03:40:31 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f00000000c0)=[@release={0x400c630f}], 0xfdfdffff00000000, 0x60ffffffffff, 0x0}) 03:40:31 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x630c}], 0x0, 0x0, 0x0}) 03:40:31 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f00000000c0)=[@release={0x400c630e}], 0x600, 0x0, 0x0}) 03:40:31 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x4c, 0x0, &(0x7f0000000200)=ANY=[@ANYBLOB="05630440000000000e630c4000f200048c01acbcd9297cf4a76e04ea80b60b21d6efb41548e724db19f05bcf6e830123c34234a0c43903464dd4e9c503844e734e52e396711327b0a8d8cf15"], 0x0, 0x0, 0x0}) 03:40:31 executing program 5: r0 = syz_open_dev$sndseq(&(0x7f0000000040)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a85320, &(0x7f0000068f50)={{0x80}, 'por\xff\a\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00t\x1f\x00\x00\xff\xff\xff\xff\xff\xff\xff\xef\x00\x00\x03\xff\x00\x00\x00\x00\x00\x00\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x06\x00', 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2}) 03:40:31 executing program 1: r0 = socket$inet6(0xa, 0x5, 0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000180)='/dev/net/tun\x00', 0x0, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000100)={'lo\x00', 0x0}) ioctl$sock_SIOCGIFINDEX(r0, 0x8923, &(0x7f0000000380)={'bpq0\x00\v\x00\xfe\x00\x00\x00\x00\x00\xfa\xff\x00', r2}) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000000)={'bpq0\x00', 0x1212}) getpgid(0xffffffffffffffff) [ 914.203552][ T8164] binder: undelivered death notification, 0000000000000000 [ 914.272543][ T8391] binder: 8383:8391 unknown command -368808281 [ 914.273783][ T8393] binder: 8387:8393 unknown command 0 [ 914.295252][ T8391] binder: 8383:8391 ioctl c0306201 20000000 returned -22 [ 914.302008][ T8393] binder: 8387:8393 ioctl c0306201 20000000 returned -22 [ 914.310964][ T8395] binder: 8386:8395 BC_REQUEST_DEATH_NOTIFICATION death notification already set 03:40:31 executing program 5: r0 = syz_open_dev$sndseq(&(0x7f0000000040)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a85320, &(0x7f0000068f50)={{0x80}, 'por\xff\a\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00z\x1f\x00\x00\xff\xff\xff\xff\xff\xff\xff\xef\x00\x00\x03\xff\x00\x00\x00\x00\x00\x00\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x06\x00', 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2}) 03:40:31 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x4c, 0x0, &(0x7f0000000200)=ANY=[@ANYBLOB="05630440000000000e630c4000f200058c01acbcd9297cf4a76e04ea80b60b21d6efb41548e724db19f05bcf6e830123c34234a0c43903464dd4e9c503844e734e52e396711327b0a8d8cf15"], 0x0, 0x0, 0x0}) 03:40:31 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x630d}], 0x0, 0x0, 0x0}) [ 914.339620][ T8395] binder: 8386:8395 ioctl c0306201 20008fd0 returned -14 [ 914.366328][ T8392] : renamed from bpq0 03:40:31 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f00000000c0)=[@release={0x400c630e}], 0x700, 0x0, 0x0}) 03:40:31 executing program 1: r0 = socket$inet6(0xa, 0x5, 0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000180)='/dev/net/tun\x00', 0x0, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000100)={'lo\x00', 0x0}) ioctl$sock_SIOCGIFINDEX(r0, 0x8923, &(0x7f0000000380)={'bpq0\x00\v\x00\xfe\x00\x00\x00\x00\x00\xfa\xff\x00', r2}) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000000)={'bpq0\x00', 0x1212}) getpgid(0xffffffffffffffff) [ 914.509452][ T8409] binder: 8408:8409 unknown command -368808281 [ 914.525050][ T8409] binder: 8408:8409 ioctl c0306201 20000000 returned -22 [ 914.528938][ T8410] binder: 8407:8410 unknown command 0 03:40:31 executing program 5: r0 = syz_open_dev$sndseq(&(0x7f0000000040)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a85320, &(0x7f0000068f50)={{0x80}, 'por\xff\a\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xfd\x1f\x00\x00\xff\xff\xff\xff\xff\xff\xff\xef\x00\x00\x03\xff\x00\x00\x00\x00\x00\x00\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x06\x00', 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2}) [ 914.542133][ T8410] binder: 8407:8410 ioctl c0306201 20000000 returned -22 [ 914.670312][ T8419] binder: 8414:8419 BC_REQUEST_DEATH_NOTIFICATION death notification already set [ 914.757191][ T8417] : renamed from bpq0 [ 914.757205][ T8419] binder: 8414:8419 ioctl c0306201 20008fd0 returned -14 03:40:32 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f00000000c0)=[@release={0x400c630f}], 0xfdfdffff00000000, 0x740000000000, 0x0}) 03:40:32 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x4c, 0x0, &(0x7f0000000200)=ANY=[@ANYBLOB="05630440000000000e630c4000f200068c01acbcd9297cf4a76e04ea80b60b21d6efb41548e724db19f05bcf6e830123c34234a0c43903464dd4e9c503844e734e52e396711327b0a8d8cf15"], 0x0, 0x0, 0x0}) 03:40:32 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x40046302}], 0x0, 0x0, 0x0}) 03:40:32 executing program 5: r0 = syz_open_dev$sndseq(&(0x7f0000000040)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a85320, &(0x7f0000068f50)={{0x80}, 'por\xff\a\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02\x1f\x00\x00\xff\xff\xff\xff\xff\xff\xff\xef\x00\x00\x03\xff\x00\x00\x00\x00\x00\x00\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x06\x00', 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2}) 03:40:32 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f00000000c0)=[@release={0x400c630e}], 0xa00, 0x0, 0x0}) 03:40:32 executing program 1: r0 = socket$inet6(0xa, 0x5, 0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000180)='/dev/net/tun\x00', 0x0, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000100)={'lo\x00', 0x0}) ioctl$sock_SIOCGIFINDEX(r0, 0x8923, &(0x7f0000000380)={'bpq0\x00\v\x00\xfe\x00\x00\x00\x00\x00\xfa\xff\x00', r2}) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000000)={'bpq0\x00', 0x1212}) getpgid(0xffffffffffffffff) [ 915.083261][ T8164] binder: undelivered death notification, 0000000000000000 [ 915.145663][ T8434] binder: BC_ACQUIRE_RESULT not supported [ 915.151460][ T8434] binder: 8432:8434 ioctl c0306201 20000000 returned -22 [ 915.175839][ T8441] binder: 8436:8441 BC_REQUEST_DEATH_NOTIFICATION death notification already set [ 915.185900][ T8442] binder_thread_write: 5 callbacks suppressed 03:40:32 executing program 5: r0 = syz_open_dev$sndseq(&(0x7f0000000040)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a85320, &(0x7f0000068f50)={{0x80}, 'por\xff\a\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x03\x1f\x00\x00\xff\xff\xff\xff\xff\xff\xff\xef\x00\x00\x03\xff\x00\x00\x00\x00\x00\x00\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x06\x00', 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2}) [ 915.185913][ T8442] binder: 8435:8442 BC_REQUEST_DEATH_NOTIFICATION invalid ref 100725248 [ 915.196995][ T8441] binder: 8436:8441 ioctl c0306201 20008fd0 returned -14 [ 915.217093][ T8442] binder: 8435:8442 unknown command -368808281 03:40:32 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x40046304}], 0x0, 0x0, 0x0}) 03:40:32 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f00000000c0)=[@release={0x400c630e}], 0x2000, 0x0, 0x0}) [ 915.244905][ T8442] binder: 8435:8442 ioctl c0306201 20000000 returned -22 [ 915.283259][ T8439] : renamed from bpq0 03:40:32 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x4c, 0x0, &(0x7f0000000200)=ANY=[@ANYBLOB="05630440000000000e630c4000f200078c01acbcd9297cf4a76e04ea80b60b21d6efb41548e724db19f05bcf6e830123c34234a0c43903464dd4e9c503844e734e52e396711327b0a8d8cf15"], 0x0, 0x0, 0x0}) 03:40:32 executing program 5: r0 = syz_open_dev$sndseq(&(0x7f0000000040)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a85320, &(0x7f0000068f50)={{0x80}, 'por\xff\a\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x04\x1f\x00\x00\xff\xff\xff\xff\xff\xff\xff\xef\x00\x00\x03\xff\x00\x00\x00\x00\x00\x00\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x06\x00', 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2}) 03:40:32 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x40046307}], 0x0, 0x0, 0x0}) [ 915.485030][ T8460] binder: 8457:8460 BC_REQUEST_DEATH_NOTIFICATION death notification already set [ 915.566214][ T8465] binder: 8462:8465 BC_REQUEST_DEATH_NOTIFICATION invalid ref 117502464 [ 915.569253][ T8460] binder: 8457:8460 ioctl c0306201 20008fd0 returned -14 [ 915.588107][ T8465] binder: 8462:8465 unknown command -368808281 [ 915.601811][ T8465] binder: 8462:8465 ioctl c0306201 20000000 returned -22 [ 915.631630][ T8469] binder: 8468 invalid dec weak, ref 1207 desc 0 s 1 w 0 03:40:33 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f00000000c0)=[@release={0x400c630f}], 0xfdfdffff00000000, 0x7fffffffefff, 0x0}) 03:40:33 executing program 1: r0 = socket$inet6(0xa, 0x5, 0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000180)='/dev/net/tun\x00', 0x0, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000100)={'lo\x00', 0x0}) ioctl$sock_SIOCGIFINDEX(r0, 0x8923, &(0x7f0000000380)={'bpq0\x00\v\x00\xfe\x00\x00\x00\x00\x00\xfa\xff\x00', r2}) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000000)={'bpq0\x00', 0x1212}) getpgid(0xffffffffffffffff) 03:40:33 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f00000000c0)=[@release={0x400c630e}], 0x4800, 0x0, 0x0}) 03:40:33 executing program 5: r0 = syz_open_dev$sndseq(&(0x7f0000000040)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a85320, &(0x7f0000068f50)={{0x80}, 'por\xff\a\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x05\x1f\x00\x00\xff\xff\xff\xff\xff\xff\xff\xef\x00\x00\x03\xff\x00\x00\x00\x00\x00\x00\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x06\x00', 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2}) 03:40:33 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x40086303}], 0x0, 0x0, 0x0}) 03:40:33 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x4c, 0x0, &(0x7f0000000200)=ANY=[@ANYBLOB="05630440000000000e630c4000f200488c01acbcd9297cf4a76e04ea80b60b21d6efb41548e724db19f05bcf6e830123c34234a0c43903464dd4e9c503844e734e52e396711327b0a8d8cf15"], 0x0, 0x0, 0x0}) [ 915.982048][ T8164] binder: undelivered death notification, 0000000000000000 [ 916.061008][ T8482] binder: 8480:8482 BC_FREE_BUFFER u0000000000000000 no match [ 916.063165][ T8481] binder: 8479:8481 BC_REQUEST_DEATH_NOTIFICATION invalid ref 1208021504 [ 916.077992][ T8485] binder: 8477:8485 ioctl c0306201 20008fd0 returned -14 03:40:33 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x4008630a}], 0x0, 0x0, 0x0}) 03:40:33 executing program 5: r0 = syz_open_dev$sndseq(&(0x7f0000000040)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a85320, &(0x7f0000068f50)={{0x80}, 'por\xff\a\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x06\x1f\x00\x00\xff\xff\xff\xff\xff\xff\xff\xef\x00\x00\x03\xff\x00\x00\x00\x00\x00\x00\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x06\x00', 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2}) [ 916.124901][ T8481] binder: 8479:8481 unknown command -368808281 [ 916.153673][ T8481] binder: 8479:8481 ioctl c0306201 20000000 returned -22 03:40:33 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f00000000c0)=[@release={0x400c630e}], 0x4c00, 0x0, 0x0}) [ 916.171590][ T8483] : renamed from bpq0 03:40:33 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x4c, 0x0, &(0x7f0000000200)=ANY=[@ANYBLOB="05630440000000000e630c4000f2004c8c01acbcd9297cf4a76e04ea80b60b21d6efb41548e724db19f05bcf6e830123c34234a0c43903464dd4e9c503844e734e52e396711327b0a8d8cf15"], 0x0, 0x0, 0x0}) 03:40:33 executing program 5: r0 = syz_open_dev$sndseq(&(0x7f0000000040)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a85320, &(0x7f0000068f50)={{0x80}, 'por\xff\a\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\a\x1f\x00\x00\xff\xff\xff\xff\xff\xff\xff\xef\x00\x00\x03\xff\x00\x00\x00\x00\x00\x00\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x06\x00', 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2}) [ 916.269842][ T8499] binder: BC_ATTEMPT_ACQUIRE not supported [ 916.296605][ T8499] binder: 8498:8499 ioctl c0306201 20000000 returned -22 03:40:33 executing program 1: r0 = socket$inet6(0xa, 0x5, 0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000180)='/dev/net/tun\x00', 0x0, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000100)={'lo\x00', 0x0}) ioctl$sock_SIOCGIFINDEX(r0, 0x8923, &(0x7f0000000380)={'bpq0\x00\v\x00\xfe\x00\x00\x00\x00\x00\xfa\xff\x00', r2}) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000000)={'bpq0\x00', 0x1212}) getpgid(0xffffffffffffffff) [ 916.317270][ T8502] binder: 8501:8502 ioctl c0306201 20008fd0 returned -14 [ 916.479779][ T8513] binder: 8510:8513 BC_REQUEST_DEATH_NOTIFICATION invalid ref 1275130368 [ 916.505146][ T8513] binder: 8510:8513 unknown command -368808281 [ 916.526864][ T8513] binder: 8510:8513 ioctl c0306201 20000000 returned -22 [ 916.569165][ T8508] : renamed from bpq0 03:40:33 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f00000000c0)=[@release={0x400c630f}], 0xfdfdffff00000000, 0x940000000000, 0x0}) 03:40:33 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x40086310}], 0x0, 0x0, 0x0}) 03:40:33 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f00000000c0)=[@release={0x400c630e}], 0x6000, 0x0, 0x0}) 03:40:33 executing program 5: r0 = syz_open_dev$sndseq(&(0x7f0000000040)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a85320, &(0x7f0000068f50)={{0x80}, 'por\xff\a\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\n\x1f\x00\x00\xff\xff\xff\xff\xff\xff\xff\xef\x00\x00\x03\xff\x00\x00\x00\x00\x00\x00\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x06\x00', 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2}) 03:40:33 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x4c, 0x0, &(0x7f0000000200)=ANY=[@ANYBLOB="05630440000000000e630c4000f200608c01acbcd9297cf4a76e04ea80b60b21d6efb41548e724db19f05bcf6e830123c34234a0c43903464dd4e9c503844e734e52e396711327b0a8d8cf15"], 0x0, 0x0, 0x0}) 03:40:33 executing program 1: r0 = socket$inet6(0xa, 0x5, 0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000180)='/dev/net/tun\x00', 0x0, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000100)={'lo\x00', 0x0}) ioctl$sock_SIOCGIFINDEX(r0, 0x8923, &(0x7f0000000380)={'bpq0\x00\v\x00\xfe\x00\x00\x00\x00\x00\xfa\xff\x00', r2}) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000000)={'bpq0\x00', 0x1212}) getpgid(0xffffffffffffffff) [ 916.878698][ T8164] binder: undelivered death notification, 0000000000000000 03:40:34 executing program 5: r0 = syz_open_dev$sndseq(&(0x7f0000000040)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a85320, &(0x7f0000068f50)={{0x80}, 'por\xff\a\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00H\x1f\x00\x00\xff\xff\xff\xff\xff\xff\xff\xef\x00\x00\x03\xff\x00\x00\x00\x00\x00\x00\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x06\x00', 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2}) [ 916.947803][ T8531] binder_thread_write: 2 callbacks suppressed [ 916.947814][ T8531] binder: 8525:8531 BC_REQUEST_DEATH_NOTIFICATION death notification already set [ 916.976610][ T8532] binder: 8530:8532 BC_REQUEST_DEATH_NOTIFICATION invalid ref 1610674688 [ 916.987797][ T8534] binder: 8524:8534 BC_DEAD_BINDER_DONE 0000000000000000 not found [ 916.993667][ T8531] binder: 8525:8531 ioctl c0306201 20008fd0 returned -14 03:40:34 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f00000000c0)=[@release={0x400c630e}], 0x6800, 0x0, 0x0}) [ 917.048782][ T8532] binder: 8530:8532 unknown command -368808281 03:40:34 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630f}], 0x0, 0x0, 0x0}) 03:40:34 executing program 5: r0 = syz_open_dev$sndseq(&(0x7f0000000040)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a85320, &(0x7f0000068f50)={{0x80}, 'por\xff\a\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00L\x1f\x00\x00\xff\xff\xff\xff\xff\xff\xff\xef\x00\x00\x03\xff\x00\x00\x00\x00\x00\x00\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x06\x00', 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2}) [ 917.099055][ T8528] : renamed from bpq0 [ 917.130586][ T8532] binder: 8530:8532 ioctl c0306201 20000000 returned -22 [ 917.196204][ T8548] binder: 8544:8548 BC_REQUEST_DEATH_NOTIFICATION death notification already set [ 917.225164][ T8550] binder: 8549:8550 BC_CLEAR_DEATH_NOTIFICATION death notification not active 03:40:34 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x4c, 0x0, &(0x7f0000000200)=ANY=[@ANYBLOB="05630440000000000e630c4000f200688c01acbcd9297cf4a76e04ea80b60b21d6efb41548e724db19f05bcf6e830123c34234a0c43903464dd4e9c503844e734e52e396711327b0a8d8cf15"], 0x0, 0x0, 0x0}) [ 917.249902][ T8548] binder: 8544:8548 ioctl c0306201 20008fd0 returned -14 03:40:34 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c6312}], 0x0, 0x0, 0x0}) [ 917.408226][ T8559] binder: 8556:8559 unknown command 1074553618 [ 917.416719][ T8560] binder: 8557:8560 BC_REQUEST_DEATH_NOTIFICATION invalid ref 1744892416 [ 917.440147][ T8559] binder: 8556:8559 ioctl c0306201 20000000 returned -22 [ 917.447552][ T8560] binder: 8557:8560 unknown command -368808281 [ 917.468511][ T8560] binder: 8557:8560 ioctl c0306201 20000000 returned -22 03:40:34 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f00000000c0)=[@release={0x400c630f}], 0xfdfdffff00000000, 0x20710000000000, 0x0}) 03:40:34 executing program 5: r0 = syz_open_dev$sndseq(&(0x7f0000000040)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a85320, &(0x7f0000068f50)={{0x80}, 'por\xff\a\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00h\x1f\x00\x00\xff\xff\xff\xff\xff\xff\xff\xef\x00\x00\x03\xff\x00\x00\x00\x00\x00\x00\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x06\x00', 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2}) 03:40:34 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f00000000c0)=[@release={0x400c630e}], 0x6c00, 0x0, 0x0}) 03:40:34 executing program 1: r0 = socket$inet6(0xa, 0x5, 0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000180)='/dev/net/tun\x00', 0x0, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000100)={'lo\x00', 0x0}) ioctl$sock_SIOCGIFINDEX(r0, 0x8923, &(0x7f0000000380)={'bpq0\x00\v\x00\xfe\x00\x00\x00\x00\x00\xfa\xff\x00', r2}) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000000)={'bpq0\x00', 0x1212}) getpgid(0xffffffffffffffff) 03:40:34 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x40106308}], 0x0, 0x0, 0x0}) 03:40:34 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x4c, 0x0, &(0x7f0000000200)=ANY=[@ANYBLOB="05630440000000000e630c4000f2006c8c01acbcd9297cf4a76e04ea80b60b21d6efb41548e724db19f05bcf6e830123c34234a0c43903464dd4e9c503844e734e52e396711327b0a8d8cf15"], 0x0, 0x0, 0x0}) [ 917.780954][ T8164] binder: undelivered death notification, 0000000000000000 [ 917.837087][ T8571] binder: 8570:8571 BC_INCREFS_DONE u0000000000000000 no match [ 917.852019][ T8576] binder: 8567:8576 BC_REQUEST_DEATH_NOTIFICATION death notification already set [ 917.862093][ T8574] binder: 8573:8574 BC_REQUEST_DEATH_NOTIFICATION invalid ref 1812001280 03:40:34 executing program 5: r0 = syz_open_dev$sndseq(&(0x7f0000000040)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a85320, &(0x7f0000068f50)={{0x80}, 'por\xff\a\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00l\x1f\x00\x00\xff\xff\xff\xff\xff\xff\xff\xef\x00\x00\x03\xff\x00\x00\x00\x00\x00\x00\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x06\x00', 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2}) [ 917.883597][ T8576] binder: 8567:8576 ioctl c0306201 20008fd0 returned -14 [ 917.895397][ T8574] binder: 8573:8574 unknown command -368808281 03:40:35 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x40106309}], 0x0, 0x0, 0x0}) 03:40:35 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f00000000c0)=[@release={0x400c630e}], 0x7400, 0x0, 0x0}) [ 917.948499][ T8569] : renamed from bpq0 [ 917.948875][ T8574] binder: 8573:8574 ioctl c0306201 20000000 returned -22 [ 918.069835][ T8591] binder: 8589:8591 BC_REQUEST_DEATH_NOTIFICATION death notification already set [ 918.092014][ T8591] binder: 8589:8591 ioctl c0306201 20008fd0 returned -14 03:40:35 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x4c, 0x0, &(0x7f0000000200)=ANY=[@ANYBLOB="05630440000000000e630c4000f200748c01acbcd9297cf4a76e04ea80b60b21d6efb41548e724db19f05bcf6e830123c34234a0c43903464dd4e9c503844e734e52e396711327b0a8d8cf15"], 0x0, 0x0, 0x0}) 03:40:35 executing program 5: r0 = syz_open_dev$sndseq(&(0x7f0000000040)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a85320, &(0x7f0000068f50)={{0x80}, 'por\xff\a\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00t\x1f\x00\x00\xff\xff\xff\xff\xff\xff\xff\xef\x00\x00\x03\xff\x00\x00\x00\x00\x00\x00\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x06\x00', 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2}) [ 918.130440][ T8594] binder: 8593:8594 BC_ACQUIRE_DONE u0000000000000000 no match 03:40:35 executing program 1: r0 = socket$inet6(0xa, 0x5, 0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000180)='/dev/net/tun\x00', 0x0, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000100)={'lo\x00', 0x0}) ioctl$sock_SIOCGIFINDEX(r0, 0x8923, &(0x7f0000000380)={'bpq0\x00\v\x00\xfe\x00\x00\x00\x00\x00\xfa\xff\x00', r2}) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000000)={'bpq0\x00', 0x1212}) getpgid(0xffffffffffffffff) [ 918.213771][ T8598] binder: 8596:8598 BC_REQUEST_DEATH_NOTIFICATION invalid ref 1946219008 [ 918.289054][ T8598] binder: 8596:8598 unknown command -368808281 [ 918.311289][ T8598] binder: 8596:8598 ioctl c0306201 20000000 returned -22 [ 918.381640][ T8601] : renamed from bpq0 [ 918.450336][ T8601] : renamed from bpq0 03:40:35 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f00000000c0)=[@release={0x400c630f}], 0xfdfdffff00000000, 0x90700000000000, 0x0}) 03:40:35 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f00000000c0)=[@release={0x400c630e}], 0x7a00, 0x0, 0x0}) 03:40:35 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x40406300}], 0x0, 0x0, 0x0}) 03:40:35 executing program 5: r0 = syz_open_dev$sndseq(&(0x7f0000000040)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a85320, &(0x7f0000068f50)={{0x80}, 'por\xff\a\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00z\x1f\x00\x00\xff\xff\xff\xff\xff\xff\xff\xef\x00\x00\x03\xff\x00\x00\x00\x00\x00\x00\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x06\x00', 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2}) 03:40:35 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x4c, 0x0, &(0x7f0000000200)=ANY=[@ANYBLOB="05630440000000000e630c4000f2007a8c01acbcd9297cf4a76e04ea80b60b21d6efb41548e724db19f05bcf6e830123c34234a0c43903464dd4e9c503844e734e52e396711327b0a8d8cf15"], 0x0, 0x0, 0x0}) 03:40:35 executing program 1: r0 = socket$inet6(0xa, 0x5, 0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000180)='/dev/net/tun\x00', 0x0, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000100)={'lo\x00', 0x0}) ioctl$sock_SIOCGIFINDEX(r0, 0x8923, &(0x7f0000000380)={'bpq0\x00\v\x00\xfe\x00\x00\x00\x00\x00\xfa\xff\x00', r2}) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000000)={'bpq0\x00', 0x1212}) getpgid(0xffffffffffffffff) [ 918.684566][T24007] binder: undelivered death notification, 0000000000000000 [ 918.731368][ T8620] binder: 8617:8620 BC_REQUEST_DEATH_NOTIFICATION invalid ref 2046882304 [ 918.745924][ T8619] binder: 8615:8619 BC_REQUEST_DEATH_NOTIFICATION death notification already set [ 918.768257][ T8626] binder_alloc: 13678: binder_alloc_buf, no vma [ 918.779256][ T8620] binder: 8617:8620 unknown command -368808281 [ 918.788304][ T8626] binder: 8616:8626 transaction failed 29189/-3, size 0-0 line 3035 [ 918.803966][ T8619] binder: 8615:8619 ioctl c0306201 20008fd0 returned -14 [ 918.811248][ T8620] binder: 8617:8620 ioctl c0306201 20000000 returned -22 03:40:35 executing program 5: r0 = syz_open_dev$sndseq(&(0x7f0000000040)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a85320, &(0x7f0000068f50)={{0x80}, 'por\xff\a\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xfd\x1f\x00\x00\xff\xff\xff\xff\xff\xff\xff\xef\x00\x00\x03\xff\x00\x00\x00\x00\x00\x00\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x06\x00', 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2}) 03:40:35 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x40406301}], 0x0, 0x0, 0x0}) 03:40:35 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f00000000c0)=[@release={0x400c630e}], 0x1000000, 0x0, 0x0}) [ 918.861797][ T8623] : renamed from bpq0 [ 918.875454][T24007] binder: undelivered TRANSACTION_ERROR: 29189 03:40:36 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x4c, 0x0, &(0x7f0000000200)=ANY=[@ANYBLOB="05630440000000000e630c4000f200008c02acbcd9297cf4a76e04ea80b60b21d6efb41548e724db19f05bcf6e830123c34234a0c43903464dd4e9c503844e734e52e396711327b0a8d8cf15"], 0x0, 0x0, 0x0}) 03:40:36 executing program 1: r0 = socket$inet6(0xa, 0x5, 0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000180)='/dev/net/tun\x00', 0x0, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000100)={'lo\x00', 0x0}) ioctl$sock_SIOCGIFINDEX(r0, 0x8923, &(0x7f0000000380)={'bpq0\x00\v\x00\xfe\x00\x00\x00\x00\x00\xfa\xff\x00', r2}) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000000)={'bpq0\x00', 0x1212}) getpgid(0xffffffffffffffff) [ 919.039323][ T8640] binder: 8636:8640 got reply transaction with no transaction stack [ 919.061034][ T8644] binder: 8642:8644 BC_REQUEST_DEATH_NOTIFICATION death notification already set 03:40:36 executing program 5: r0 = syz_open_dev$sndseq(&(0x7f0000000040)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a85320, &(0x7f0000068f50)={{0x80}, 'por\xff\a\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x1f\x02\x00\xff\xff\xff\xff\xff\xff\xff\xef\x00\x00\x03\xff\x00\x00\x00\x00\x00\x00\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x06\x00', 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2}) [ 919.089208][ T8640] binder: 8636:8640 transaction failed 29201/-71, size 0-0 line 2801 [ 919.094281][ T8647] binder: 8645:8647 BC_REQUEST_DEATH_NOTIFICATION invalid ref 61952 [ 919.107545][ T8644] binder: 8642:8644 ioctl c0306201 20008fd0 returned -14 [ 919.135044][ T8647] binder: 8645:8647 unknown command -368808281 [ 919.147050][ T8647] binder: 8645:8647 ioctl c0306201 20000000 returned -22 [ 919.180900][T24007] binder: undelivered TRANSACTION_ERROR: 29201 [ 919.294023][ T8650] : renamed from bpq0 03:40:36 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f00000000c0)=[@release={0x400c630e}], 0x2000000, 0x0, 0x0}) 03:40:36 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x40486311}], 0x0, 0x0, 0x0}) 03:40:36 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x4c, 0x0, &(0x7f0000000200)=ANY=[@ANYBLOB="05630440000000000e630c4000f200008c03acbcd9297cf4a76e04ea80b60b21d6efb41548e724db19f05bcf6e830123c34234a0c43903464dd4e9c503844e734e52e396711327b0a8d8cf15"], 0x0, 0x0, 0x0}) 03:40:36 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f00000000c0)=[@release={0x400c630f}], 0xfdfdffff00000000, 0xa0500000000000, 0x0}) 03:40:36 executing program 5: r0 = syz_open_dev$sndseq(&(0x7f0000000040)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a85320, &(0x7f0000068f50)={{0x80}, 'por\xff\a\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x1f\x03\x00\xff\xff\xff\xff\xff\xff\xff\xef\x00\x00\x03\xff\x00\x00\x00\x00\x00\x00\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x06\x00', 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2}) 03:40:36 executing program 1: r0 = socket$inet6(0xa, 0x5, 0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000180)='/dev/net/tun\x00', 0x0, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000100)={'lo\x00', 0x0}) ioctl$sock_SIOCGIFINDEX(r0, 0x8923, &(0x7f0000000380)={'bpq0\x00\v\x00\xfe\x00\x00\x00\x00\x00\xfa\xff\x00', r2}) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000000)={'bpq0\x00', 0x1212}) getpgid(0xffffffffffffffff) [ 919.581315][ T8164] binder: undelivered death notification, 0000000000000000 [ 919.646105][ T8672] binder_alloc: 13678: binder_alloc_buf, no vma [ 919.647471][ T8671] binder: 8670:8671 BC_REQUEST_DEATH_NOTIFICATION death notification already set [ 919.679371][ T8677] binder: 8668:8677 unknown command -368808281 [ 919.685598][ T8671] binder: 8670:8671 ioctl c0306201 20008fd0 returned -14 03:40:36 executing program 5: r0 = syz_open_dev$sndseq(&(0x7f0000000040)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a85320, &(0x7f0000068f50)={{0x80}, 'por\xff\a\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x1f\x04\x00\xff\xff\xff\xff\xff\xff\xff\xef\x00\x00\x03\xff\x00\x00\x00\x00\x00\x00\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x06\x00', 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2}) 03:40:36 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f00000000c0)=[@release={0x400c630e}], 0x3000000, 0x0, 0x0}) [ 919.715729][ T8672] binder: 8665:8672 transaction failed 29189/-3, size 0-0 line 3035 [ 919.728684][ T8677] binder: 8668:8677 ioctl c0306201 20000000 returned -22 [ 919.767306][ T8674] : renamed from bpq0 03:40:36 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x40486312}], 0x0, 0x0, 0x0}) 03:40:36 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x4c, 0x0, &(0x7f0000000200)=ANY=[@ANYBLOB="05630440000000000e630c4000f200008c25acbcd9297cf4a76e04ea80b60b21d6efb41548e724db19f05bcf6e830123c34234a0c43903464dd4e9c503844e734e52e396711327b0a8d8cf15"], 0x0, 0x0, 0x0}) [ 919.826256][ T7288] binder: undelivered TRANSACTION_ERROR: 29189 [ 919.890067][ T8690] binder: 8687:8690 BC_REQUEST_DEATH_NOTIFICATION death notification already set [ 919.922956][ T8690] binder: 8687:8690 ioctl c0306201 20008fd0 returned -14 03:40:37 executing program 5: r0 = syz_open_dev$sndseq(&(0x7f0000000040)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a85320, &(0x7f0000068f50)={{0x80}, 'por\xff\a\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x1f\x05\x00\xff\xff\xff\xff\xff\xff\xff\xef\x00\x00\x03\xff\x00\x00\x00\x00\x00\x00\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x06\x00', 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2}) 03:40:37 executing program 1: r0 = socket$inet6(0xa, 0x5, 0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000180)='/dev/net/tun\x00', 0x0, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000100)={'lo\x00', 0x0}) ioctl$sock_SIOCGIFINDEX(r0, 0x8923, &(0x7f0000000380)={'bpq0\x00\v\x00\xfe\x00\x00\x00\x00\x00\xfa\xff\x00', r2}) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000000)={'bpq0\x00', 0x1212}) getpgid(0xffffffffffffffff) [ 919.951080][ T8693] binder: 8692:8693 got reply transaction with no transaction stack [ 919.980920][ T8696] binder: 8694:8696 unknown command -368808281 [ 919.989174][ T8693] binder: 8692:8693 transaction failed 29201/-71, size 0-0 line 2801 03:40:37 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f00000000c0)=[@release={0x400c630e}], 0x4000000, 0x0, 0x0}) [ 920.027888][ T8696] binder: 8694:8696 ioctl c0306201 20000000 returned -22 03:40:37 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e, 0x1000000}], 0x0, 0x0, 0x0}) [ 920.091958][ T7288] binder: undelivered TRANSACTION_ERROR: 29201 03:40:37 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x4c, 0x0, &(0x7f0000000200)=ANY=[@ANYBLOB="05630440000000000e630c4000f200008c46acbcd9297cf4a76e04ea80b60b21d6efb41548e724db19f05bcf6e830123c34234a0c43903464dd4e9c503844e734e52e396711327b0a8d8cf15"], 0x0, 0x0, 0x0}) [ 920.176828][ T8707] binder: 8704:8707 BC_REQUEST_DEATH_NOTIFICATION death notification already set [ 920.223663][ T8714] binder_thread_write: 2 callbacks suppressed [ 920.223677][ T8714] binder: 8710:8714 BC_REQUEST_DEATH_NOTIFICATION invalid ref 16777216 [ 920.239127][ T8703] : renamed from bpq0 [ 920.245237][ T8707] binder: 8704:8707 ioctl c0306201 20008fd0 returned -14 [ 920.288050][ T8715] binder: 8711:8715 BC_REQUEST_DEATH_NOTIFICATION invalid ref 61952 [ 920.312081][ T8715] binder: 8711:8715 unknown command -368808281 [ 920.321569][ T8715] binder: 8711:8715 ioctl c0306201 20000000 returned -22 03:40:37 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f00000000c0)=[@release={0x400c630f}], 0xfdfdffff00000000, 0x100000000000000, 0x0}) 03:40:37 executing program 5: r0 = syz_open_dev$sndseq(&(0x7f0000000040)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a85320, &(0x7f0000068f50)={{0x80}, 'por\xff\a\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x1f\x06\x00\xff\xff\xff\xff\xff\xff\xff\xef\x00\x00\x03\xff\x00\x00\x00\x00\x00\x00\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x06\x00', 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2}) 03:40:37 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e, 0xfdfdffff}], 0x0, 0x0, 0x0}) 03:40:37 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f00000000c0)=[@release={0x400c630e}], 0x5000000, 0x0, 0x0}) 03:40:37 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x4c, 0x0, &(0x7f0000000200)=ANY=[@ANYBLOB="05630440000000000e630c4000f200008c50acbcd9297cf4a76e04ea80b60b21d6efb41548e724db19f05bcf6e830123c34234a0c43903464dd4e9c503844e734e52e396711327b0a8d8cf15"], 0x0, 0x0, 0x0}) 03:40:37 executing program 1: r0 = socket$inet6(0xa, 0x5, 0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000180)='/dev/net/tun\x00', 0x0, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000100)={'lo\x00', 0x0}) ioctl$sock_SIOCGIFINDEX(r0, 0x8923, &(0x7f0000000380)={'bpq0\x00\v\x00\xfe\x00\x00\x00\x00\x00\xfa\xff\x00', r2}) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000000)={'bpq0\x00', 0x1212}) getpgid(0xffffffffffffffff) [ 920.487396][T24007] binder: undelivered death notification, 0000000000000000 [ 920.560706][ T8731] binder: 8730:8731 BC_REQUEST_DEATH_NOTIFICATION invalid ref 61952 [ 920.571033][ T8734] binder: 8724:8734 BC_REQUEST_DEATH_NOTIFICATION invalid ref -33685505 [ 920.579313][ T8735] binder: 8725:8735 BC_REQUEST_DEATH_NOTIFICATION death notification already set 03:40:37 executing program 5: r0 = syz_open_dev$sndseq(&(0x7f0000000040)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a85320, &(0x7f0000068f50)={{0x80}, 'por\xff\a\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x1f\a\x00\xff\xff\xff\xff\xff\xff\xff\xef\x00\x00\x03\xff\x00\x00\x00\x00\x00\x00\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x06\x00', 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2}) [ 920.608856][ T8731] binder: 8730:8731 unknown command -368808281 [ 920.622185][ T8735] binder: 8725:8735 ioctl c0306201 20008fd0 returned -14 [ 920.631053][ T8731] binder: 8730:8731 ioctl c0306201 20000000 returned -22 [ 920.654818][ T8729] : renamed from bpq0 03:40:37 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e, 0xfffffdfd}], 0x0, 0x0, 0x0}) 03:40:37 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f00000000c0)=[@release={0x400c630e}], 0x6000000, 0x0, 0x0}) 03:40:37 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x4c, 0x0, &(0x7f0000000200)=ANY=[@ANYBLOB="05630440000000000e630c4000f200008c5bacbcd9297cf4a76e04ea80b60b21d6efb41548e724db19f05bcf6e830123c34234a0c43903464dd4e9c503844e734e52e396711327b0a8d8cf15"], 0x0, 0x0, 0x0}) 03:40:37 executing program 1: r0 = socket$inet6(0xa, 0x5, 0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000180)='/dev/net/tun\x00', 0x0, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000100)={'lo\x00', 0x0}) ioctl$sock_SIOCGIFINDEX(r0, 0x8923, &(0x7f0000000380)={'bpq0\x00\v\x00\xfe\x00\x00\x00\x00\x00\xfa\xff\x00', r2}) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000000)={'bpq0\x00', 0x1212}) getpgid(0xffffffffffffffff) 03:40:37 executing program 5: r0 = syz_open_dev$sndseq(&(0x7f0000000040)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a85320, &(0x7f0000068f50)={{0x80}, 'por\xff\a\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x1f\n\x00\xff\xff\xff\xff\xff\xff\xff\xef\x00\x00\x03\xff\x00\x00\x00\x00\x00\x00\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x06\x00', 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2}) [ 920.842665][ T8751] binder: 8747:8751 BC_REQUEST_DEATH_NOTIFICATION invalid ref -515 [ 920.853744][ T8752] binder: 8749:8752 ioctl c0306201 20008fd0 returned -14 [ 920.906569][ T8756] binder: 8753:8756 BC_REQUEST_DEATH_NOTIFICATION invalid ref 61952 [ 920.965438][ T8756] binder: 8753:8756 unknown command -368808281 [ 920.973449][ T8756] binder: 8753:8756 ioctl c0306201 20000000 returned -22 [ 921.093035][ T8758] : renamed from bpq0 03:40:38 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f00000000c0)=[@release={0x400c630f}], 0xfdfdffff00000000, 0x200000000000000, 0x0}) 03:40:38 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f00000000c0)=[@release={0x400c630e}], 0x7000000, 0x0, 0x0}) 03:40:38 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e, 0x100000000000000}], 0x0, 0x0, 0x0}) 03:40:38 executing program 5: r0 = syz_open_dev$sndseq(&(0x7f0000000040)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a85320, &(0x7f0000068f50)={{0x80}, 'por\xff\a\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x1fH\x00\xff\xff\xff\xff\xff\xff\xff\xef\x00\x00\x03\xff\x00\x00\x00\x00\x00\x00\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x06\x00', 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2}) 03:40:38 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x4c, 0x0, &(0x7f0000000200)=ANY=[@ANYBLOB="05630440000000000e630c4000f200008c01acbcd9467cf4a76e04ea80b60b21d6efb41548e724db19f05bcf6e830123c34234a0c43903464dd4e9c503844e734e52e396711327b0a8d8cf15"], 0x0, 0x0, 0x0}) 03:40:38 executing program 1: r0 = socket$inet6(0xa, 0x5, 0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000180)='/dev/net/tun\x00', 0x0, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000100)={'lo\x00', 0x0}) ioctl$sock_SIOCGIFINDEX(r0, 0x8923, &(0x7f0000000380)={'bpq0\x00\v\x00\xfe\x00\x00\x00\x00\x00\xfa\xff\x00', r2}) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000000)={'bpq0\x00', 0x1212}) getpgid(0xffffffffffffffff) [ 921.402399][T24007] binder: undelivered death notification, 0000000000000000 [ 921.463910][ T8781] binder: 8776:8781 BC_REQUEST_DEATH_NOTIFICATION invalid ref 61952 [ 921.496643][ T8784] binder: 8777:8784 ioctl c0306201 20008fd0 returned -14 03:40:38 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e, 0xfdfdffff00000000}], 0x0, 0x0, 0x0}) [ 921.509191][ T8781] binder: 8776:8781 unknown command -368808281 03:40:38 executing program 5: r0 = syz_open_dev$sndseq(&(0x7f0000000040)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a85320, &(0x7f0000068f50)={{0x80}, 'por\xff\a\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x1fL\x00\xff\xff\xff\xff\xff\xff\xff\xef\x00\x00\x03\xff\x00\x00\x00\x00\x00\x00\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x06\x00', 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2}) 03:40:38 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f00000000c0)=[@release={0x400c630e}], 0xa000000, 0x0, 0x0}) [ 921.549846][ T8781] binder: 8776:8781 ioctl c0306201 20000000 returned -22 [ 921.572152][ T8779] : renamed from bpq0 03:40:38 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x4c, 0x0, &(0x7f0000000200)=ANY=[@ANYBLOB="05630440000000000e630c4000f200008c01acbcd9507cf4a76e04ea80b60b21d6efb41548e724db19f05bcf6e830123c34234a0c43903464dd4e9c503844e734e52e396711327b0a8d8cf15"], 0x0, 0x0, 0x0}) 03:40:38 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x1000000, 0x0, 0x0}) [ 921.701501][ T8801] binder: 8798:8801 ioctl c0306201 20008fd0 returned -14 03:40:38 executing program 5: r0 = syz_open_dev$sndseq(&(0x7f0000000040)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a85320, &(0x7f0000068f50)={{0x80}, 'por\xff\a\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x1fh\x00\xff\xff\xff\xff\xff\xff\xff\xef\x00\x00\x03\xff\x00\x00\x00\x00\x00\x00\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x06\x00', 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2}) [ 921.830073][ T8808] binder: 8804:8808 BC_REQUEST_DEATH_NOTIFICATION invalid ref 61952 [ 921.849272][ T8809] binder: 8806:8809 ioctl c0306201 20000000 returned -14 [ 921.885222][ T8808] binder: 8804:8808 unknown command -368808281 [ 921.902482][ T8808] binder: 8804:8808 ioctl c0306201 20000000 returned -22 03:40:39 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f00000000c0)=[@release={0x400c630f}], 0xfdfdffff00000000, 0x300000000000000, 0x0}) 03:40:39 executing program 1: r0 = socket$inet6(0xa, 0x5, 0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000180)='/dev/net/tun\x00', 0x0, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000100)={'lo\x00', 0x0}) ioctl$sock_SIOCGIFINDEX(r0, 0x8923, &(0x7f0000000380)={'bpq0\x00\v\x00\xfe\x00\x00\x00\x00\x00\xfa\xff\x00', r2}) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000000)={'bpq0\x00', 0x1212}) getpgid(0xffffffffffffffff) 03:40:39 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f00000000c0)=[@release={0x400c630e}], 0x20000000, 0x0, 0x0}) 03:40:39 executing program 5: r0 = syz_open_dev$sndseq(&(0x7f0000000040)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a85320, &(0x7f0000068f50)={{0x80}, 'por\xff\a\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x1fl\x00\xff\xff\xff\xff\xff\xff\xff\xef\x00\x00\x03\xff\x00\x00\x00\x00\x00\x00\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x06\x00', 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2}) 03:40:39 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0xfdfdffff, 0x0, 0x0}) 03:40:39 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x4c, 0x0, &(0x7f0000000200)=ANY=[@ANYBLOB="05630440000000000e630c4000f200008c01acbcd95b7cf4a76e04ea80b60b21d6efb41548e724db19f05bcf6e830123c34234a0c43903464dd4e9c503844e734e52e396711327b0a8d8cf15"], 0x0, 0x0, 0x0}) [ 922.292837][T24007] binder: undelivered death notification, 0000000000000000 [ 922.357472][ T8825] binder_thread_write: 3 callbacks suppressed [ 922.357483][ T8825] binder: 8818:8825 BC_REQUEST_DEATH_NOTIFICATION death notification already set [ 922.382600][ T8827] binder: 8822:8827 BC_REQUEST_DEATH_NOTIFICATION invalid ref 61952 03:40:39 executing program 5: r0 = syz_open_dev$sndseq(&(0x7f0000000040)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a85320, &(0x7f0000068f50)={{0x80}, 'por\xff\a\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x1ft\x00\xff\xff\xff\xff\xff\xff\xff\xef\x00\x00\x03\xff\x00\x00\x00\x00\x00\x00\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x06\x00', 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2}) [ 922.409411][ T8825] binder: 8818:8825 ioctl c0306201 20008fd0 returned -14 [ 922.413207][ T8827] binder: 8822:8827 unknown command -368808281 [ 922.423121][ T8827] binder: 8822:8827 ioctl c0306201 20000000 returned -22 [ 922.439562][ T8824] binder: 8820:8824 ioctl c0306201 20000000 returned -14 [ 922.448652][ T8826] : renamed from bpq0 03:40:39 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f00000000c0)=[@release={0x400c630e}], 0x48000000, 0x0, 0x0}) 03:40:39 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x4c, 0x0, &(0x7f0000000200)=ANY=[@ANYBLOB="05630440000000000e630c4000f200008c01acbcd92958f4a76e04ea80b60b21d6efb41548e724db19f05bcf6e830123c34234a0c43903464dd4e9c503844e734e52e396711327b0a8d8cf15"], 0x0, 0x0, 0x0}) 03:40:39 executing program 5: r0 = syz_open_dev$sndseq(&(0x7f0000000040)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a85320, &(0x7f0000068f50)={{0x80}, 'por\xff\a\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x1fz\x00\xff\xff\xff\xff\xff\xff\xff\xef\x00\x00\x03\xff\x00\x00\x00\x00\x00\x00\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x06\x00', 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2}) 03:40:39 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0xfffffdfd, 0x0, 0x0}) 03:40:39 executing program 1: r0 = socket$inet6(0xa, 0x5, 0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000180)='/dev/net/tun\x00', 0x0, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000100)={'lo\x00', 0x0}) ioctl$sock_SIOCGIFINDEX(r0, 0x8923, &(0x7f0000000380)={'bpq0\x00\v\x00\xfe\x00\x00\x00\x00\x00\xfa\xff\x00', r2}) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000000)={'bpq0\x00', 0x1212}) getpgid(0xffffffffffffffff) [ 922.673767][ T8845] binder: 8842:8845 BC_REQUEST_DEATH_NOTIFICATION death notification already set [ 922.719331][ T8849] binder: 8844:8849 BC_REQUEST_DEATH_NOTIFICATION invalid ref 61952 [ 922.722459][ T8845] binder: 8842:8845 ioctl c0306201 20008fd0 returned -14 [ 922.746649][ T8851] binder: 8847:8851 ioctl c0306201 20000000 returned -14 [ 922.763567][ T8849] binder: 8844:8849 unknown command -368808281 [ 922.779599][ T8849] binder: 8844:8849 ioctl c0306201 20000000 returned -22 [ 922.938624][ T8853] : renamed from bpq0 03:40:40 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f00000000c0)=[@release={0x400c630f}], 0xfdfdffff00000000, 0x400000000000000, 0x0}) 03:40:40 executing program 5: r0 = syz_open_dev$sndseq(&(0x7f0000000040)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a85320, &(0x7f0000068f50)={{0x80}, 'por\xff\a\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x1f\xfd\x00\xff\xff\xff\xff\xff\xff\xff\xef\x00\x00\x03\xff\x00\x00\x00\x00\x00\x00\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x06\x00', 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2}) 03:40:40 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f00000000c0)=[@release={0x400c630e}], 0x4c000000, 0x0, 0x0}) 03:40:40 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x100000000000000, 0x0, 0x0}) 03:40:40 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x4c, 0x0, &(0x7f0000000200)=ANY=[@ANYBLOB="05630440000000000e630c4000f200008c01acbcd9297cf40b63000080b60b21d6efb41548e724db19f05bcf6e830123c34234a0c43903464dd4e9c503844e734e52e396711327b0a8d8cf15"], 0x0, 0x0, 0x0}) 03:40:40 executing program 1: r0 = socket$inet6(0xa, 0x5, 0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000180)='/dev/net/tun\x00', 0x0, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000100)={'lo\x00', 0x0}) ioctl$sock_SIOCGIFINDEX(r0, 0x8923, &(0x7f0000000380)={'bpq0\x00\v\x00\xfe\x00\x00\x00\x00\x00\xfa\xff\x00', r2}) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000000)={'bpq0\x00', 0x1212}) getpgid(0xffffffffffffffff) [ 923.204339][ T7288] binder: undelivered death notification, 0000000000000000 [ 923.278974][ T8869] binder: 8868:8869 ioctl c0306201 20000000 returned -14 [ 923.289236][ T8877] binder: 8867:8877 BC_REQUEST_DEATH_NOTIFICATION death notification already set [ 923.304641][ T8878] binder: 8871:8878 ERROR: BC_REGISTER_LOOPER called without request [ 923.313940][ T8877] binder: 8867:8877 ioctl c0306201 20008fd0 returned -14 03:40:40 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f00000000c0)=[@release={0x400c630e}], 0x60000000, 0x0, 0x0}) 03:40:40 executing program 5: r0 = syz_open_dev$sndseq(&(0x7f0000000040)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a85320, &(0x7f0000068f50)={{0x80}, 'por\xff\a\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x1f\x00\x03\xff\xff\xff\xff\xff\xff\xff\xef\x00\x00\x03\xff\x00\x00\x00\x00\x00\x00\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x06\x00', 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2}) [ 923.335184][ T8878] binder: 8871:8878 unknown command 554415744 [ 923.344556][ T8878] binder: 8871:8878 ioctl c0306201 20000000 returned -22 03:40:40 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x4c, 0x0, &(0x7f0000000200)=ANY=[@ANYBLOB="05630440000000000e630c4000f200008c01acbcd9297cf40c63000080b60b21d6efb41548e724db19f05bcf6e830123c34234a0c43903464dd4e9c503844e734e52e396711327b0a8d8cf15"], 0x0, 0x0, 0x0}) [ 923.420578][ T8874] : renamed from bpq0 03:40:40 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0xfdfdffff00000000, 0x0, 0x0}) [ 923.508145][ T8887] binder: 8885:8887 BC_REQUEST_DEATH_NOTIFICATION death notification already set 03:40:40 executing program 5: r0 = syz_open_dev$sndseq(&(0x7f0000000040)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a85320, &(0x7f0000068f50)={{0x80}, 'por\xff\a\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x1f\x00\x05\xff\xff\xff\xff\xff\xff\xff\xef\x00\x00\x03\xff\x00\x00\x00\x00\x00\x00\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x06\x00', 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2}) [ 923.564071][ T8894] binder: 8893:8894 unknown command 554415744 [ 923.568529][ T8887] binder: 8885:8887 ioctl c0306201 20008fd0 returned -14 [ 923.576095][ T8894] binder: 8893:8894 ioctl c0306201 20000000 returned -22 03:40:40 executing program 1: r0 = socket$inet6(0xa, 0x5, 0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000180)='/dev/net/tun\x00', 0x0, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000100)={'lo\x00', 0x0}) ioctl$sock_SIOCGIFINDEX(r0, 0x8923, &(0x7f0000000380)={'bpq0\x00\v\x00\xfe\x00\x00\x00\x00\x00\xfa\xff\x00', r2}) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000000)={'bpq0\x00', 0x1212}) getpgid(0xffffffffffffffff) [ 923.657166][ T8897] binder: 8895:8897 ioctl c0306201 20000000 returned -14 [ 923.845099][ T8905] : renamed from bpq0 03:40:41 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f00000000c0)=[@release={0x400c630f}], 0xfdfdffff00000000, 0x500000000000000, 0x0}) 03:40:41 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f00000000c0)=[@release={0x400c630e}], 0x68000000, 0x0, 0x0}) 03:40:41 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x4c, 0x0, &(0x7f0000000200)=ANY=[@ANYBLOB="05630440000000000e630c4000f200008c01acbcd9297cf40d63000080b60b21d6efb41548e724db19f05bcf6e830123c34234a0c43903464dd4e9c503844e734e52e396711327b0a8d8cf15"], 0x0, 0x0, 0x0}) 03:40:41 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x1000000, 0x0}) 03:40:41 executing program 5: r0 = syz_open_dev$sndseq(&(0x7f0000000040)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a85320, &(0x7f0000068f50)={{0x80}, 'por\xff\a\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x1f\x00\x06\xff\xff\xff\xff\xff\xff\xff\xef\x00\x00\x03\xff\x00\x00\x00\x00\x00\x00\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x06\x00', 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2}) 03:40:41 executing program 1: r0 = socket$inet6(0xa, 0x5, 0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000180)='/dev/net/tun\x00', 0x0, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000100)={'lo\x00', 0x0}) ioctl$sock_SIOCGIFINDEX(r0, 0x8923, &(0x7f0000000380)={'bpq0\x00\v\x00\xfe\x00\x00\x00\x00\x00\xfa\xff\x00', r2}) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000000)={'bpq0\x00', 0x1212}) getpgid(0xffffffffffffffff) [ 924.120757][T24007] binder: undelivered death notification, 0000000000000000 [ 924.210427][ T8925] binder: 8921:8925 BC_REQUEST_DEATH_NOTIFICATION death notification already set [ 924.222599][ T8928] binder: 8916:8928 unknown command 554415744 [ 924.247622][ T8925] binder: 8921:8925 ioctl c0306201 20008fd0 returned -14 03:40:41 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0xfdfdffff, 0x0}) 03:40:41 executing program 5: r0 = syz_open_dev$sndseq(&(0x7f0000000040)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a85320, &(0x7f0000068f50)={{0x80}, 'por\xff\a\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x1f\x00\a\xff\xff\xff\xff\xff\xff\xff\xef\x00\x00\x03\xff\x00\x00\x00\x00\x00\x00\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x06\x00', 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2}) [ 924.265529][ T8928] binder: 8916:8928 ioctl c0306201 20000000 returned -22 [ 924.285647][ T8923] : renamed from bpq0 03:40:41 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f00000000c0)=[@release={0x400c630e}], 0x6c000000, 0x0, 0x0}) 03:40:41 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x4c, 0x0, &(0x7f0000000200)=ANY=[@ANYBLOB="05630440000000000e630c4000f200008c01acbcd9297cf40263044080b60b21d6efb41548e724db19f05bcf6e830123c34234a0c43903464dd4e9c503844e734e52e396711327b0a8d8cf15"], 0x0, 0x0, 0x0}) 03:40:41 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0xfffffdfd, 0x0}) 03:40:41 executing program 1: r0 = socket$inet6(0xa, 0x5, 0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000180)='/dev/net/tun\x00', 0x0, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000100)={'lo\x00', 0x0}) ioctl$sock_SIOCGIFINDEX(r0, 0x8923, &(0x7f0000000380)={'bpq0\x00\v\x00\xfe\x00\x00\x00\x00\x00\xfa\xff\x00', r2}) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000000)={'bpq0\x00', 0x1212}) getpgid(0xffffffffffffffff) [ 924.512565][ T8945] binder: 8942:8945 BC_REQUEST_DEATH_NOTIFICATION death notification already set [ 924.540078][ T8949] binder: BC_ACQUIRE_RESULT not supported [ 924.565720][ T8945] binder: 8942:8945 ioctl c0306201 20008fd0 returned -14 [ 924.572890][ T8949] binder: 8943:8949 ioctl c0306201 20000000 returned -22 [ 924.706309][ T8953] : renamed from bpq0 [ 924.800890][ T8953] : renamed from bpq0 03:40:42 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f00000000c0)=[@release={0x400c630f}], 0xfdfdffff00000000, 0x600000000000000, 0x0}) 03:40:42 executing program 5: r0 = syz_open_dev$sndseq(&(0x7f0000000040)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a85320, &(0x7f0000068f50)={{0x80}, 'por\xff\a\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x1f\x00\n\xff\xff\xff\xff\xff\xff\xff\xef\x00\x00\x03\xff\x00\x00\x00\x00\x00\x00\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x06\x00', 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2}) 03:40:42 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f00000000c0)=[@release={0x400c630e}], 0x74000000, 0x0, 0x0}) 03:40:42 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x4c, 0x0, &(0x7f0000000200)=ANY=[@ANYBLOB="05630440000000000e630c4000f200008c01acbcd9297cf40463044080b60b21d6efb41548e724db19f05bcf6e830123c34234a0c43903464dd4e9c503844e734e52e396711327b0a8d8cf15"], 0x0, 0x0, 0x0}) 03:40:42 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x100000000000000, 0x0}) 03:40:42 executing program 1: r0 = socket$inet6(0xa, 0x5, 0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000180)='/dev/net/tun\x00', 0x0, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000100)={'lo\x00', 0x0}) ioctl$sock_SIOCGIFINDEX(r0, 0x8923, &(0x7f0000000380)={'bpq0\x00\v\x00\xfe\x00\x00\x00\x00\x00\xfa\xff\x00', r2}) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000000)={'bpq0\x00', 0x1212}) getpgid(0xffffffffffffffff) [ 925.032923][ T7288] binder: undelivered death notification, 0000000000000000 [ 925.111655][ T8975] binder: 8965:8975 BC_REQUEST_DEATH_NOTIFICATION death notification already set [ 925.130104][ T8972] binder: 8966:8972 IncRefs 0 refcount change on invalid ref 554415744 ret -22 [ 925.154627][ T8975] binder: 8965:8975 ioctl c0306201 20008fd0 returned -14 03:40:42 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0xfdfdffff00000000, 0x0}) 03:40:42 executing program 5: r0 = syz_open_dev$sndseq(&(0x7f0000000040)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a85320, &(0x7f0000068f50)={{0x80}, 'por\xff\a\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x1f\x00H\xff\xff\xff\xff\xff\xff\xff\xef\x00\x00\x03\xff\x00\x00\x00\x00\x00\x00\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x06\x00', 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2}) [ 925.166875][ T8972] binder: 8966:8972 unknown command 364179414 [ 925.183591][ T8971] : renamed from bpq0 [ 925.194136][ T8972] binder: 8966:8972 ioctl c0306201 20000000 returned -22 03:40:42 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f00000000c0)=[@release={0x400c630e}], 0x7a000000, 0x0, 0x0}) 03:40:42 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x4c, 0x0, &(0x7f0000000200)=ANY=[@ANYBLOB="05630440000000000e630c4000f200008c01acbcd9297cf40763044080b60b21d6efb41548e724db19f05bcf6e830123c34234a0c43903464dd4e9c503844e734e52e396711327b0a8d8cf15"], 0x0, 0x0, 0x0}) [ 925.300791][ T8971] : renamed from bpq0 03:40:42 executing program 5: r0 = syz_open_dev$sndseq(&(0x7f0000000040)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a85320, &(0x7f0000068f50)={{0x80}, 'por\xff\a\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x1f\x00L\xff\xff\xff\xff\xff\xff\xff\xef\x00\x00\x03\xff\x00\x00\x00\x00\x00\x00\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x06\x00', 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2}) [ 925.380373][ T8991] binder: 8989:8991 BC_REQUEST_DEATH_NOTIFICATION death notification already set [ 925.403025][ T8992] binder_thread_write: 5 callbacks suppressed [ 925.403039][ T8992] binder: 8990:8992 BC_REQUEST_DEATH_NOTIFICATION invalid ref 61952 [ 925.415329][ T8991] binder: 8989:8991 ioctl c0306201 20008fd0 returned -14 03:40:42 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0xfffffffffffffc62, 0x0, &(0x7f0000000040)=[@request_death={0x400c630e, 0x0, 0x3}, @decrefs={0x40046307, 0x3}], 0xffffffffffffffe7, 0x0, 0x0}) [ 925.434616][ T8992] binder: 8990:8992 DecRefs 0 refcount change on invalid ref 554415744 ret -22 [ 925.444731][ T8992] binder: 8990:8992 unknown command 364179414 [ 925.498060][ T8992] binder: 8990:8992 ioctl c0306201 20000000 returned -22 [ 925.536570][ T8998] binder: 8994:8998 ioctl c0306201 20000000 returned -14 03:40:42 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f00000000c0)=[@release={0x400c630f}], 0xfdfdffff00000000, 0x700000000000000, 0x0}) 03:40:42 executing program 1: r0 = socket$inet6(0xa, 0x5, 0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000180)='/dev/net/tun\x00', 0x0, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000100)={'lo\x00', 0x0}) ioctl$sock_SIOCGIFINDEX(r0, 0x8923, &(0x7f0000000380)={'bpq0\x00\v\x00\xfe\x00\x00\x00\x00\x00\xfa\xff\x00', r2}) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000000)={'bpq0\x00', 0x1212}) getpgid(0xffffffffffffffff) 03:40:42 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f00000000c0)=[@release={0x400c630e}], 0xfdfdffff, 0x0, 0x0}) 03:40:42 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000000040)='/dev/dlm-monitor\x00', 0x0, 0x0) getsockopt$inet_sctp6_SCTP_GET_PEER_ADDR_INFO(0xffffffffffffffff, 0x84, 0xf, &(0x7f0000000080)={0x0, @in6={{0xa, 0x4e23, 0x7, @initdev={0xfe, 0x88, [], 0x0, 0x0}, 0x81}}, 0xcf49, 0x2, 0x7, 0x1}, &(0x7f0000000180)=0x98) getsockopt$inet_sctp6_SCTP_RESET_STREAMS(r2, 0x84, 0x77, &(0x7f0000000200)={r3, 0x9, 0x3, [0x3f, 0xa6, 0xffffffffffffffff]}, &(0x7f0000000240)=0xe) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) 03:40:42 executing program 5: r0 = syz_open_dev$sndseq(&(0x7f0000000040)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a85320, &(0x7f0000068f50)={{0x80}, 'por\xff\a\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x1f\x00h\xff\xff\xff\xff\xff\xff\xff\xef\x00\x00\x03\xff\x00\x00\x00\x00\x00\x00\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x06\x00', 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2}) 03:40:42 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x4c, 0x0, &(0x7f0000000200)=ANY=[@ANYBLOB="05630440000000000e630c4000f200008c01acbcd9297cf40363084080b60b21d6efb41548e724db19f05bcf6e830123c34234a0c43903464dd4e9c503844e734e52e396711327b0a8d8cf15"], 0x0, 0x0, 0x0}) [ 925.927530][ T7288] binder: undelivered death notification, 0000000000000000 [ 926.007362][ T9014] binder: 9010:9014 BC_REQUEST_DEATH_NOTIFICATION invalid ref 61952 [ 926.038896][ T9017] binder: 9012:9017 BC_REQUEST_DEATH_NOTIFICATION death notification already set 03:40:43 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) socketpair(0x12, 0x4, 0x0, &(0x7f00000000c0)={0xffffffffffffffff}) setsockopt$IP_VS_SO_SET_DEL(r2, 0x0, 0x484, &(0x7f0000000180)={0x2b, @loopback, 0x4e21, 0x1, 'lblc\x00', 0x20, 0x83, 0x6e}, 0x2c) r3 = openat$null(0xffffffffffffff9c, &(0x7f0000000040)='/dev/null\x00', 0xdc200, 0x0) ioctl$EVIOCGNAME(r3, 0x80404506, &(0x7f0000000080)=""/9) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r4 = mmap$binder(&(0x7f0000ffc000/0x2000)=nil, 0x2000, 0x100000b, 0x10, r3, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0xffce, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="056304400000000009631040", @ANYRES64=r4, @ANYBLOB="0f30c804000000000000000000"], 0x0, 0x0, 0x0}) 03:40:43 executing program 5: r0 = syz_open_dev$sndseq(&(0x7f0000000040)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a85320, &(0x7f0000068f50)={{0x80}, 'por\xff\a\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x1f\x00l\xff\xff\xff\xff\xff\xff\xff\xef\x00\x00\x03\xff\x00\x00\x00\x00\x00\x00\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x06\x00', 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2}) [ 926.062208][ T9014] binder: 9010:9014 BC_FREE_BUFFER u15b4efd6210bb680 no match [ 926.075002][ T9017] binder: 9012:9017 ioctl c0306201 20008fd0 returned -14 [ 926.113208][ T9014] binder: 9010:9014 unknown command -618338488 [ 926.143513][ T9014] binder: 9010:9014 ioctl c0306201 20000000 returned -22 [ 926.153733][ T9013] : renamed from bpq0 03:40:43 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f00000000c0)=[@release={0x400c630e}], 0xfffffdfd, 0x0, 0x0}) 03:40:43 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x4c, 0x0, &(0x7f0000000200)=ANY=[@ANYBLOB="05630440000000000e630c4000f200008c01acbcd9297cf40a63084080b60b21d6efb41548e724db19f05bcf6e830123c34234a0c43903464dd4e9c503844e734e52e396711327b0a8d8cf15"], 0x0, 0x0, 0x0}) [ 926.218456][ T9029] binder: 9023:9029 BC_ACQUIRE_DONE uffffffffffffffff no match [ 926.236754][ T9029] binder: 9023:9029 unknown command 0 [ 926.242366][ T9029] binder: 9023:9029 ioctl c0306201 20000100 returned -22 03:40:43 executing program 5: r0 = syz_open_dev$sndseq(&(0x7f0000000040)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a85320, &(0x7f0000068f50)={{0x80}, 'por\xff\a\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x1f\x00t\xff\xff\xff\xff\xff\xff\xff\xef\x00\x00\x03\xff\x00\x00\x00\x00\x00\x00\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x06\x00', 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2}) 03:40:43 executing program 1: r0 = socket$inet6(0xa, 0x5, 0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000180)='/dev/net/tun\x00', 0x0, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000100)={'lo\x00', 0x0}) ioctl$sock_SIOCGIFINDEX(r0, 0x8923, &(0x7f0000000380)={'bpq0\x00\v\x00\xfe\x00\x00\x00\x00\x00\xfa\xff\x00', r2}) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000000)={'bpq0\x00', 0x1212}) getpgid(0xffffffffffffffff) [ 926.373668][ T9036] binder: 9033:9036 BC_REQUEST_DEATH_NOTIFICATION death notification already set [ 926.410285][ T9040] binder: 9037:9040 BC_REQUEST_DEATH_NOTIFICATION invalid ref 61952 [ 926.422722][ T9036] binder: 9033:9036 ioctl c0306201 20008fd0 returned -14 [ 926.446642][ T9040] binder: BC_ATTEMPT_ACQUIRE not supported [ 926.468487][ T9040] binder: 9037:9040 ioctl c0306201 20000000 returned -22 [ 926.542187][ T9043] : renamed from bpq0 [ 926.615595][ T9043] : renamed from bpq0 03:40:43 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f00000000c0)=[@release={0x400c630f}], 0xfdfdffff00000000, 0x2000000000000000, 0x0}) 03:40:43 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0x0, 0x802) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) pipe2(&(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}, 0x84800) connect$pptp(r2, &(0x7f0000000080)={0x18, 0x2, {0x3, @multicast2}}, 0x1e) 03:40:43 executing program 5: r0 = syz_open_dev$sndseq(&(0x7f0000000040)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a85320, &(0x7f0000068f50)={{0x80}, 'por\xff\a\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x1f\x00z\xff\xff\xff\xff\xff\xff\xff\xef\x00\x00\x03\xff\x00\x00\x00\x00\x00\x00\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x06\x00', 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2}) 03:40:43 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f00000000c0)=[@release={0x400c630e}], 0x100000000000000, 0x0, 0x0}) 03:40:43 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x4c, 0x0, &(0x7f0000000200)=ANY=[@ANYBLOB="05630440000000000e630c4000f200008c01acbcd9297cf41063084080b60b21d6efb41548e724db19f05bcf6e830123c34234a0c43903464dd4e9c503844e734e52e396711327b0a8d8cf15"], 0x0, 0x0, 0x0}) 03:40:43 executing program 1: r0 = socket$inet6(0xa, 0x5, 0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000180)='/dev/net/tun\x00', 0x0, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000100)={'lo\x00', 0x0}) ioctl$sock_SIOCGIFINDEX(r0, 0x8923, &(0x7f0000000380)={'bpq0\x00\v\x00\xfe\x00\x00\x00\x00\x00\xfa\xff\x00', r2}) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000000)={'bpq0\x00', 0x1212}) getpgid(0xffffffffffffffff) [ 926.842116][T24007] binder: undelivered death notification, 0000000000000000 03:40:44 executing program 5: r0 = syz_open_dev$sndseq(&(0x7f0000000040)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a85320, &(0x7f0000068f50)={{0x80}, 'por\xff\a\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x1f\x00\xfd\xff\xff\xff\xff\xff\xff\xff\xef\x00\x00\x03\xff\x00\x00\x00\x00\x00\x00\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x06\x00', 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2}) [ 926.910460][ T9055] binder: 9054:9055 ioctl c0306201 20008fd0 returned -14 [ 926.944354][ T9064] binder: 9061:9064 BC_REQUEST_DEATH_NOTIFICATION invalid ref 61952 [ 926.969257][ T9064] binder: 9061:9064 BC_DEAD_BINDER_DONE 15b4efd6210bb680 not found [ 926.998832][ T9064] binder: 9061:9064 unknown command -618338488 [ 927.017376][ T9064] binder: 9061:9064 ioctl c0306201 20000000 returned -22 03:40:44 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000000080)=ANY=[@ANYBLOB="056004400000000ad1000e630c4000000000"], 0x0, 0x0, 0x0}) 03:40:44 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f00000000c0)=[@release={0x400c630e}], 0x200000000000000, 0x0, 0x0}) [ 927.072065][ T9065] : renamed from bpq0 03:40:44 executing program 5: r0 = syz_open_dev$sndseq(&(0x7f0000000040)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a85320, &(0x7f0000068f50)={{0x80}, 'por\xff\a\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x1f\x00\x02\xff\xff\xff\xff\xff\xff\xff\xef\x00\x00\x03\xff\x00\x00\x00\x00\x00\x00\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x06\x00', 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2}) 03:40:44 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x4c, 0x0, &(0x7f0000000200)=ANY=[@ANYBLOB="05630440000000000e630c4000f200008c01acbcd9297cf40e630c4080b60b21d6efb41548e724db19f05bcf6e830123c34234a0c43903464dd4e9c503844e734e52e396711327b0a8d8cf15"], 0x0, 0x0, 0x0}) 03:40:44 executing program 1: r0 = socket$inet6(0xa, 0x5, 0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000180)='/dev/net/tun\x00', 0x0, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000100)={'lo\x00', 0x0}) ioctl$sock_SIOCGIFINDEX(r0, 0x8923, &(0x7f0000000380)={'bpq0\x00\v\x00\xfe\x00\x00\x00\x00\x00\xfa\xff\x00', r2}) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000000)={'bpq0\x00', 0x1212}) getpgid(0xffffffffffffffff) [ 927.250170][ T9081] binder: 9080:9081 unknown command 1074028549 [ 927.266967][ T9081] binder: 9080:9081 ioctl c0306201 20000000 returned -22 [ 927.292374][ T9088] binder: 9082:9088 ioctl c0306201 20008fd0 returned -14 [ 927.324244][ T9091] binder: 9086:9091 BC_REQUEST_DEATH_NOTIFICATION invalid ref 61952 [ 927.359358][ T9091] binder: 9086:9091 BC_REQUEST_DEATH_NOTIFICATION invalid ref 554415744 [ 927.398041][ T9091] binder: 9086:9091 unknown command -816058343 [ 927.425171][ T9091] binder: 9086:9091 ioctl c0306201 20000000 returned -22 [ 927.499107][ T9093] : renamed from bpq0 [ 927.561737][ T9093] : renamed from bpq0 03:40:44 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f00000000c0)=[@release={0x400c630f}], 0xfdfdffff00000000, 0x3f00000000000000, 0x0}) 03:40:44 executing program 5: r0 = syz_open_dev$sndseq(&(0x7f0000000040)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a85320, &(0x7f0000068f50)={{0x80}, 'por\xff\a\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x1f\x00\x03\xff\xff\xff\xff\xff\xff\xff\xef\x00\x00\x03\xff\x00\x00\x00\x00\x00\x00\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x06\x00', 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2}) 03:40:44 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000000c0)={0x10, 0x0, &(0x7f0000000040)=[@clear_death={0x400c630f, 0x3, 0x1}], 0x0, 0x0, &(0x7f0000000080)}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) 03:40:44 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f00000000c0)=[@release={0x400c630e}], 0x300000000000000, 0x0, 0x0}) 03:40:44 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x4c, 0x0, &(0x7f0000000200)=ANY=[@ANYBLOB="05630440000000000e630c4000f200008c01acbcd9297cf40f630c4080b60b21d6efb41548e724db19f05bcf6e830123c34234a0c43903464dd4e9c503844e734e52e396711327b0a8d8cf15"], 0x0, 0x0, 0x0}) 03:40:44 executing program 1: r0 = socket$inet6(0xa, 0x5, 0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000180)='/dev/net/tun\x00', 0x0, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000100)={'lo\x00', 0x0}) ioctl$sock_SIOCGIFINDEX(r0, 0x8923, &(0x7f0000000380)={'bpq0\x00\v\x00\xfe\x00\x00\x00\x00\x00\xfa\xff\x00', r2}) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000000)={'bpq0\x00', 0x1212}) getpgid(0xffffffffffffffff) [ 927.728175][ T7288] binder: undelivered death notification, 0000000000000000 [ 927.786489][ T9105] binder: 9104:9105 BC_REQUEST_DEATH_NOTIFICATION invalid ref 61952 [ 927.815427][ T9115] binder_thread_write: 2 callbacks suppressed [ 927.815438][ T9115] binder: 9107:9115 BC_REQUEST_DEATH_NOTIFICATION death notification already set 03:40:44 executing program 5: r0 = syz_open_dev$sndseq(&(0x7f0000000040)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a85320, &(0x7f0000068f50)={{0x80}, 'por\xff\a\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x1f\x00\x04\xff\xff\xff\xff\xff\xff\xff\xef\x00\x00\x03\xff\x00\x00\x00\x00\x00\x00\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x06\x00', 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2}) [ 927.821192][ T9105] binder: 9104:9105 BC_CLEAR_DEATH_NOTIFICATION invalid ref 554415744 [ 927.841686][ T9117] binder: 9111:9117 BC_CLEAR_DEATH_NOTIFICATION invalid ref 3 [ 927.851574][ T9115] binder: 9107:9115 ioctl c0306201 20008fd0 returned -14 03:40:45 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0xfffffffffffffeea, 0x0, 0x0}) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x8eb) r2 = syz_open_dev$amidi(&(0x7f0000000480)='/dev/amidi#\x00', 0xffffffff00000001, 0x2) ioctl$LOOP_SET_STATUS64(r2, 0x4c04, &(0x7f00000004c0)={0x0, 0x0, 0x0, 0x8431, 0xee9, 0x0, 0xb, 0x1, 0x11, "04e16bf56a0700032721b01fa64ce8f1df910ae9640991d02db2427cb9a80ef9320f9d8c6ba33b5b98d09307dfe0b1f0d222154b6efe6d739d2aa049eb3facae", "77c159fe55fd1974752328bb6608a047b09c9d224f0bb1ca0e74c7ba79c63925e6e64d4966a882122e4d82a58f943e2d4739d157ed27189be01c2f8090e19740", "679bd5ddf42e42534d58f2feff8304dc3982315d03f13fd30a22b41ce28f1886", [0x8, 0x7f]}) r3 = syz_open_dev$rtc(&(0x7f0000000340)='/dev/rtc#\x00', 0x9, 0x0) ioctl$RTC_EPOCH_SET(r3, 0x4008700e, 0x7) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="05635c474ca26ad907e809d78c00762c9274a5a44821ec33c235dc0000"], 0x0, 0x0, 0x0}) r4 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x4000, 0x0) ioctl(r0, 0xa4d7, &(0x7f0000000380)="3b0c118036e635fc5a3d74b1b6c9b7ee028863f0644bd9808528facd955a17627e8771865a8b447348091323282836543344baefc607f6515f6b3e248a8422f0ada3d85135d11b87dc067db9e653a308d1a3155044dd0261b3a1685533653d34c0c0acde20e3382b952fc9fca034d309fde355919570760b2fffab9f362598f3205221ce193405b990731e2c40308ea5db56cddf81288db5d86a025de42036366e55f0eb1a6ee467a3ba234ad5c01cf4bb31717d992fc200c8e81f593b5a85828afe45fe4b1f02170129c12059bc505caf361930544ff3a0c81f61714b2057e3cf8f4b34716f151731f959") ioctl$DRM_IOCTL_MAP_BUFS(r4, 0xc0186419, &(0x7f0000000300)={0x2, &(0x7f0000000180)=""/122, &(0x7f00000002c0)=[{0x4, 0x15, 0x101, &(0x7f0000000100)=""/21}, {0x9, 0x91, 0x790, &(0x7f0000000200)=""/145}]}) r5 = syz_open_dev$vcsa(&(0x7f00000005c0)='/dev/vcsa#\x00', 0x5, 0x80000) ioctl$SNDRV_TIMER_IOCTL_STATUS(r5, 0x80605414, &(0x7f0000000600)=""/179) 03:40:45 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f00000000c0)=[@release={0x400c630e}], 0x400000000000000, 0x0, 0x0}) [ 927.898547][ T9105] binder: 9104:9105 unknown command -816058343 [ 927.909064][ T9112] : renamed from bpq0 [ 927.920157][ T9105] binder: 9104:9105 ioctl c0306201 20000000 returned -22 03:40:45 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x4c, 0x0, &(0x7f0000000200)=ANY=[@ANYBLOB="05630440000000000e630c4000f200008c01acbcd9297cf40863104080b60b21d6efb41548e724db19f05bcf6e830123c34234a0c43903464dd4e9c503844e734e52e396711327b0a8d8cf15"], 0x0, 0x0, 0x0}) 03:40:45 executing program 5: r0 = syz_open_dev$sndseq(&(0x7f0000000040)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a85320, &(0x7f0000068f50)={{0x80}, 'por\xff\a\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x1f\x00\x05\xff\xff\xff\xff\xff\xff\xff\xef\x00\x00\x03\xff\x00\x00\x00\x00\x00\x00\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x06\x00', 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2}) [ 928.114441][ T9131] binder: 9127:9131 ioctl c0306201 200000c0 returned -14 [ 928.126940][ T9130] binder: 9128:9130 BC_REQUEST_DEATH_NOTIFICATION death notification already set 03:40:45 executing program 1: r0 = socket$inet6(0xa, 0x5, 0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000180)='/dev/net/tun\x00', 0x0, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000100)={'lo\x00', 0x0}) ioctl$sock_SIOCGIFINDEX(r0, 0x8923, &(0x7f0000000380)={'bpq0\x00\v\x00\xfe\x00\x00\x00\x00\x00\xfa\xff\x00', r2}) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000000)={'bpq0\x00', 0x1212}) getpgid(0xffffffffffffffff) [ 928.160283][ T9131] binder: 9127:9131 unknown command 1197236997 [ 928.168025][ T9130] binder: 9128:9130 ioctl c0306201 20008fd0 returned -14 [ 928.185880][ T9135] binder: 9133:9135 BC_REQUEST_DEATH_NOTIFICATION invalid ref 61952 [ 928.195277][ T9131] binder: 9127:9131 ioctl c0306201 20000000 returned -22 [ 928.223813][ T9131] binder: 9127:9131 ioctl a4d7 20000380 returned -22 [ 928.238749][ T9135] binder: 9133:9135 BC_INCREFS_DONE u15b4efd6210bb680 no match [ 928.279553][ T9135] binder: 9133:9135 unknown command 587301742 [ 928.297322][ T9131] binder: 9127:9131 ioctl c0306201 200000c0 returned -14 [ 928.318087][ T9135] binder: 9133:9135 ioctl c0306201 20000000 returned -22 [ 928.395864][ T9140] : renamed from bpq0 03:40:45 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f00000000c0)=[@release={0x400c630f}], 0xfdfdffff00000000, 0x4800000000000000, 0x0}) 03:40:45 executing program 5: r0 = syz_open_dev$sndseq(&(0x7f0000000040)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a85320, &(0x7f0000068f50)={{0x80}, 'por\xff\a\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x1f\x00\x06\xff\xff\xff\xff\xff\xff\xff\xef\x00\x00\x03\xff\x00\x00\x00\x00\x00\x00\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x06\x00', 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2}) 03:40:45 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f00000000c0)=[@release={0x400c630e}], 0x500000000000000, 0x0, 0x0}) 03:40:45 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x4c, 0x0, &(0x7f0000000200)=ANY=[@ANYBLOB="05630440000000000e630c4000f200008c01acbcd9297cf40963104080b60b21d6efb41548e724db19f05bcf6e830123c34234a0c43903464dd4e9c503844e734e52e396711327b0a8d8cf15"], 0x0, 0x0, 0x0}) 03:40:45 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) r1 = syz_open_dev$cec(&(0x7f0000000040)='/dev/cec#\x00', 0x3, 0x2) ioctl$EVIOCGABS2F(r1, 0x8018456f, &(0x7f0000000080)=""/65) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000000200)=ANY=[@ANYBLOB="05630440000000000e630c4000000000bcdbfdc44a75bb8077bf282790971efb71a99891d4ab05006ab7b96c10106d34d5c509ba2c8d9d226b8e68ca10d2e70384e2cfc4a240498e4bce7d98824009de65a3669cc456782f4c453294bdd3019742218a880f72c79d59024cd27377ed7739c15a7414a1879306de862902c8a5bee456de486d18067a3ddb3bef6584d8df025d01f6d68e8eec236cc4d5a81389588e24d885c7847300ba9770c57a2bc96fe7f0d0670afa77d104812725b8ebc4a909d7fbb8e33cd55eab0d4e2481ea42a3fa03775c79e27de222f836caa5a09b262848b3fdd7666de87c21ee9f34560ed91cd8c2f374674b030acd545208270ca6abbe4f358acf4e8b651ea6084ec2bf3b25b83774968efaf0a2578a150ba3de12f2fa9fcf7a64540bd3e026d285666976b1e83cc2565398e6e39102d4ec592d4709afb5048c12286f5e97e663767cea4d5885bebc1a0473b023e6531be4fa23191e9603ef0797583ad7bfe7e47cde138ca8e68a1c813ddd481213a72738bf1a35826a92fc4a80561d44563332a00437a5547078cb1092e9a8dc37abe2039ee7683c82e8a11e664592c9b6"], 0x0, 0x0, 0x0}) write$eventfd(r1, &(0x7f0000000100)=0x1ff, 0x8) 03:40:45 executing program 1: r0 = socket$inet6(0xa, 0x5, 0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000180)='/dev/net/tun\x00', 0x0, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000100)={'lo\x00', 0x0}) ioctl$sock_SIOCGIFINDEX(r0, 0x8923, &(0x7f0000000380)={'bpq0\x00\v\x00\xfe\x00\x00\x00\x00\x00\xfa\xff\x00', r2}) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000000)={'bpq0\x00', 0x1212}) getpgid(0xffffffffffffffff) [ 928.609698][ T7288] binder: undelivered death notification, 0000000000000000 [ 928.658076][ T9161] binder: 9155:9161 BC_REQUEST_DEATH_NOTIFICATION death notification already set [ 928.693554][ T9164] binder: 9158:9164 BC_ACQUIRE_DONE u15b4efd6210bb680 no match [ 928.706144][ T9161] binder: 9155:9161 ioctl c0306201 20008fd0 returned -14 [ 928.722950][ T9164] binder: 9158:9164 unknown command 587301742 03:40:45 executing program 5: r0 = syz_open_dev$sndseq(&(0x7f0000000040)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a85320, &(0x7f0000068f50)={{0x80}, 'por\xff\a\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x1f\x00\a\xff\xff\xff\xff\xff\xff\xff\xef\x00\x00\x03\xff\x00\x00\x00\x00\x00\x00\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x06\x00', 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2}) 03:40:45 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) fcntl$getownex(r0, 0x10, &(0x7f0000000040)={0x0, 0x0}) migrate_pages(r2, 0xfff, &(0x7f0000000080)=0x3f, &(0x7f00000000c0)=0x7fffffff) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) 03:40:45 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f00000000c0)=[@release={0x400c630e}], 0x600000000000000, 0x0, 0x0}) [ 928.750335][ T9164] binder: 9158:9164 ioctl c0306201 20000000 returned -22 [ 928.834734][ T9160] : renamed from bpq0 03:40:45 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x4c, 0x0, &(0x7f0000000200)=ANY=[@ANYBLOB="05630440000000000e630c4000f200008c01acbcd9297cf40063404080b60b21d6efb41548e724db19f05bcf6e830123c34234a0c43903464dd4e9c503844e734e52e396711327b0a8d8cf15"], 0x0, 0x0, 0x0}) 03:40:45 executing program 5: r0 = syz_open_dev$sndseq(&(0x7f0000000040)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a85320, &(0x7f0000068f50)={{0x80}, 'por\xff\a\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x1f\x00\n\xff\xff\xff\xff\xff\xff\xff\xef\x00\x00\x03\xff\x00\x00\x00\x00\x00\x00\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x06\x00', 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2}) 03:40:46 executing program 1: r0 = socket$inet6(0xa, 0x5, 0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000180)='/dev/net/tun\x00', 0x0, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000100)={'lo\x00', 0x0}) ioctl$sock_SIOCGIFINDEX(r0, 0x8923, &(0x7f0000000380)={'bpq0\x00\v\x00\xfe\x00\x00\x00\x00\x00\xfa\xff\x00', r2}) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000000)={'bpq0\x00', 0x1212}) getpgid(0xffffffffffffffff) [ 929.021148][ T9185] binder: 9183:9185 BC_REQUEST_DEATH_NOTIFICATION death notification already set [ 929.030755][ T9187] binder: 9184:9187 got transaction to invalid handle [ 929.064668][ T9187] binder: 9184:9187 transaction failed 29201/-22, size -7574119651411590141-1571713013997048689 line 2896 [ 929.065332][ T9185] binder: 9183:9185 ioctl c0306201 20008fd0 returned -14 [ 929.166053][ T7288] binder: undelivered TRANSACTION_ERROR: 29201 [ 929.231685][ T9191] : renamed from bpq0 03:40:46 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f00000000c0)=[@release={0x400c630f}], 0xfdfdffff00000000, 0x4c00000000000000, 0x0}) 03:40:46 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = openat$cachefiles(0xffffffffffffff9c, &(0x7f0000000380)='/dev/cachefiles\x00', 0x401ffe, 0x0) ioctl$sock_inet_tcp_SIOCOUTQNSD(r2, 0x894b, &(0x7f0000000280)) ioctl$KVM_S390_INTERRUPT_CPU(r2, 0x4010ae94, &(0x7f0000000340)={0x8, 0xd539, 0x3f}) openat$ion(0xffffffffffffff9c, &(0x7f0000000180)='/dev/ion\x00', 0x8582, 0x0) r3 = openat$vfio(0xffffffffffffff9c, &(0x7f0000000200)='/dev/vfio/vfio\x00', 0x101, 0x0) r4 = getuid() ioctl$SIOCAX25GETUID(r3, 0x89e0, &(0x7f00000002c0)={0x3, @default, r4}) fstatfs(r1, &(0x7f0000000300)=""/39) r5 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000240)='/dev/rtc0\x00', 0x20000, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r5, 0x8912, 0x4b) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="05630440000000000e630c5f00000000dfa9d7619feca80fec2d02295dba9bff7491ec72b2cac825057f99870428e926b5197cd64ad5a44bf3bf02323cc9dd54d0c1c389972ccc080083db6fb0151601000000385e8a4bd10d1bb39f384ff1aaa47bd2f5ca85ed3cd7a20cb7b52ce24d105fc03e27a333bc3b899df8966d8bacfb4d224c2c3237b91b6be227fc4eeed3edd49fa0e07e0f013cc323da145c862b8da0acc44d3e72ffe92ab5a6029cef804e8ccfb291e3b47d64d43c9f4e3cb0d824b8a8b5bee3b870e74e1ce6d8852ca2e068df4574d62f63477db508"], 0x0, 0x0, 0x0}) 03:40:46 executing program 5: r0 = syz_open_dev$sndseq(&(0x7f0000000040)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a85320, &(0x7f0000068f50)={{0x80}, 'por\xff\a\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x1f\x00H\xff\xff\xff\xff\xff\xff\xff\xef\x00\x00\x03\xff\x00\x00\x00\x00\x00\x00\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x06\x00', 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2}) 03:40:46 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f00000000c0)=[@release={0x400c630e}], 0x700000000000000, 0x0, 0x0}) 03:40:46 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x4c, 0x0, &(0x7f0000000200)=ANY=[@ANYBLOB="05630440000000000e630c4000f200008c01acbcd9297cf40163404080b60b21d6efb41548e724db19f05bcf6e830123c34234a0c43903464dd4e9c503844e734e52e396711327b0a8d8cf15"], 0x0, 0x0, 0x0}) 03:40:46 executing program 1: r0 = socket$inet6(0xa, 0x5, 0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000180)='/dev/net/tun\x00', 0x0, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000100)={'lo\x00', 0x0}) ioctl$sock_SIOCGIFINDEX(r0, 0x8923, &(0x7f0000000380)={'bpq0\x00\v\x00\xfe\x00\x00\x00\x00\x00\xfa\xff\x00', r2}) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000000)={'bpq0\x00', 0x1212}) getpgid(0xffffffffffffffff) [ 929.538675][T24007] binder: undelivered death notification, 0000000000000000 [ 929.591881][ T9208] binder: 9206:9208 got reply transaction with no transaction stack [ 929.603616][ T9205] binder: 9203:9205 BC_REQUEST_DEATH_NOTIFICATION death notification already set [ 929.624216][ T9205] binder: 9203:9205 ioctl c0306201 20008fd0 returned -14 03:40:46 executing program 5: r0 = syz_open_dev$sndseq(&(0x7f0000000040)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a85320, &(0x7f0000068f50)={{0x80}, 'por\xff\a\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x1f\x00L\xff\xff\xff\xff\xff\xff\xff\xef\x00\x00\x03\xff\x00\x00\x00\x00\x00\x00\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x06\x00', 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2}) [ 929.636455][ T9212] binder: 9207:9212 unknown command 1594647310 [ 929.643660][ T9208] binder: 9206:9208 transaction failed 29201/-71, size -7574119651411590141-1571713013997048689 line 2801 [ 929.668762][ T9212] binder: 9207:9212 ioctl c0306201 20000000 returned -22 03:40:46 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f00000000c0)=[@release={0x400c630e}], 0xa00000000000000, 0x0, 0x0}) [ 929.728407][ T9211] : renamed from bpq0 03:40:46 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x4c, 0x0, &(0x7f0000000200)=ANY=[@ANYBLOB="05630440000000000e630c4000f200008c01acbcd9297cf41163484080b60b21d6efb41548e724db19f05bcf6e830123c34234a0c43903464dd4e9c503844e734e52e396711327b0a8d8cf15"], 0x0, 0x0, 0x0}) 03:40:46 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = syz_open_dev$usbmon(&(0x7f0000000040)='/dev/usbmon#\x00', 0x0, 0x0) getsockopt$inet_mreqn(0xffffffffffffff9c, 0x0, 0x23, &(0x7f0000000080)={@multicast2, @remote, 0x0}, &(0x7f00000000c0)=0xc) ioctl$sock_inet6_SIOCSIFADDR(r2, 0x8916, &(0x7f0000000100)={@mcast1, 0x39, r3}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) [ 929.797506][ T7288] binder: undelivered TRANSACTION_ERROR: 29201 03:40:46 executing program 1: r0 = socket$inet6(0xa, 0x5, 0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000180)='/dev/net/tun\x00', 0x0, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000100)={'lo\x00', 0x0}) ioctl$sock_SIOCGIFINDEX(r0, 0x8923, &(0x7f0000000380)={'bpq0\x00\v\x00\xfe\x00\x00\x00\x00\x00\xfa\xff\x00', r2}) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000000)={'bpq0\x00', 0x1212}) getpgid(0xffffffffffffffff) 03:40:46 executing program 5: r0 = syz_open_dev$sndseq(&(0x7f0000000040)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a85320, &(0x7f0000068f50)={{0x80}, 'por\xff\a\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x1f\x00h\xff\xff\xff\xff\xff\xff\xff\xef\x00\x00\x03\xff\x00\x00\x00\x00\x00\x00\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x06\x00', 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2}) [ 929.889665][ T9231] binder: 9228:9231 BC_REQUEST_DEATH_NOTIFICATION death notification already set [ 929.950734][ T9237] binder: 9232:9237 got transaction to invalid handle [ 929.965245][ T9231] binder: 9228:9231 ioctl c0306201 20008fd0 returned -14 [ 929.985438][ T9237] binder: 9232:9237 transaction failed 29201/-22, size -7574119651411590141-1571713013997048689 line 2896 [ 930.120100][T24007] binder: undelivered TRANSACTION_ERROR: 29201 [ 930.148542][ T9241] : renamed from bpq0 03:40:47 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f00000000c0)=[@release={0x400c630f}], 0xfdfdffff00000000, 0x6000000000000000, 0x0}) 03:40:47 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f00000000c0)=[@release={0x400c630e}], 0x2000000000000000, 0x0, 0x0}) 03:40:47 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) write$UHID_GET_REPORT_REPLY(r0, &(0x7f0000000280)={0xa, 0x8, 0x3, 0x1}, 0xa) r2 = syz_open_dev$usbmon(&(0x7f0000000040)='/dev/usbmon#\x00', 0x6, 0x181242) openat$uinput(0xffffffffffffff9c, &(0x7f00000002c0)='/dev/uinput\x00', 0x2, 0x0) openat$ion(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ion\x00', 0x2, 0x0) getsockopt$inet_sctp_SCTP_DEFAULT_SNDINFO(r2, 0x84, 0x22, &(0x7f00000003c0)={0x3f, 0x0, 0xfffffffffffffe00, 0x80000001, 0x0}, &(0x7f0000000400)=0x10) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r2, 0x84, 0x6f, &(0x7f0000000380)={r3, 0x7e4fa0bef93a21f7, &(0x7f0000000300)}, &(0x7f0000000340)=0xfffffffffffffe19) setsockopt$inet_sctp_SCTP_AUTH_DELETE_KEY(r2, 0x84, 0x19, &(0x7f0000000240)={r4, 0x8}, 0x8) ioctl$NBD_SET_FLAGS(r2, 0xab0a, 0xb30) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) 03:40:47 executing program 5: r0 = syz_open_dev$sndseq(&(0x7f0000000040)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a85320, &(0x7f0000068f50)={{0x80}, 'por\xff\a\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x1f\x00l\xff\xff\xff\xff\xff\xff\xff\xef\x00\x00\x03\xff\x00\x00\x00\x00\x00\x00\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x06\x00', 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2}) 03:40:47 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x4c, 0x0, &(0x7f0000000200)=ANY=[@ANYBLOB="05630440000000000e630c4000f200008c01acbcd9297cf41263484080b60b21d6efb41548e724db19f05bcf6e830123c34234a0c43903464dd4e9c503844e734e52e396711327b0a8d8cf15"], 0x0, 0x0, 0x0}) 03:40:47 executing program 1: r0 = socket$inet6(0xa, 0x5, 0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000180)='/dev/net/tun\x00', 0x0, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000100)={'lo\x00', 0x0}) ioctl$sock_SIOCGIFINDEX(r0, 0x8923, &(0x7f0000000380)={'bpq0\x00\v\x00\xfe\x00\x00\x00\x00\x00\xfa\xff\x00', r2}) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000000)={'bpq0\x00', 0x1212}) getpgid(0xffffffffffffffff) [ 930.441380][ T7288] binder: undelivered death notification, 0000000000000000 [ 930.519698][ T9262] binder_thread_write: 4 callbacks suppressed [ 930.519713][ T9262] binder: 9261:9262 BC_REQUEST_DEATH_NOTIFICATION invalid ref 61952 [ 930.535091][ T9260] binder: 9257:9260 BC_REQUEST_DEATH_NOTIFICATION death notification already set 03:40:47 executing program 5: r0 = syz_open_dev$sndseq(&(0x7f0000000040)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a85320, &(0x7f0000068f50)={{0x80}, 'por\xff\a\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x1f\x00t\xff\xff\xff\xff\xff\xff\xff\xef\x00\x00\x03\xff\x00\x00\x00\x00\x00\x00\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x06\x00', 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2}) [ 930.560358][ T9260] binder: 9257:9260 ioctl c0306201 20008fd0 returned -14 [ 930.569550][ T9262] binder: 9261:9262 got reply transaction with no transaction stack 03:40:47 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0x0, 0xfffffffffffffffe) openat$udambuf(0xffffffffffffff9c, &(0x7f0000000080)='/dev/udmabuf\x00', 0x2) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) openat$autofs(0xffffffffffffff9c, &(0x7f0000000000)='/dev/autofs\x00', 0x100, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x10, 0x0, &(0x7f0000005fd4)=ANY=[@ANYPTR64=&(0x7f0000000200)=ANY=[@ANYPTR64=&(0x7f0000000300)=ANY=[@ANYRES64, @ANYPTR64, @ANYRESHEX=r1, @ANYRES64=r1, @ANYBLOB="66f86f4b8f16a70c46d5bff5c1af5924b4d292bfdd0000c4d9442831c144c15f50b48e3027762fe9874ffc6c015c1880ca1e0ee38e5b573e998a4075f1e65be2d126515085e177ff8b5d27794428dc86f6a9b436b7a936d1021dca59ff4d8a435449d04d9f20812947b3dbe843a7357fde3201e72311a328395739fce6ee2c248000000000000000000000000000"], @ANYRESHEX=r2, @ANYBLOB="b10c53cc1fec3eb128a28a4e3a46bbdda8dc4909f5557a77bf19ed1cf3b0fa4930e7f87e73f347600fc72854625646ccfc8bbd7963d8ed02f8df0aa2a3fdef861e56a8d0c0a92fad832deb3fefea28347798cad886b3ae3310079e1a5fe513a1c6844814e0f177ce60aac57ddcfe8d5c01f6afe00a3bfaa568d08671abb3336a338a3030361dd99fb352e243ee00ddf55e009fc1b5445f4d77488ac3aed972743e8e87901a9d16611edf0e43bc2c8ffc189538", @ANYRES16=r0, @ANYRES32=0x0]], 0xfffffffffffffe02, 0x0, 0x0}) [ 930.599843][ T9262] binder: 9261:9262 transaction failed 29201/-71, size -7574119651411590141-1571713013997048689 line 2801 03:40:47 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f00000000c0)=[@release={0x400c630e}], 0x4800000000000000, 0x0, 0x0}) [ 930.660644][ T9265] : renamed from bpq0 03:40:47 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x4c, 0x0, &(0x7f0000000200)=ANY=[@ANYBLOB="05630440000000000e630c4000f200008c01acbcd9297cf4126e04ea80b60b21d6efb41548e724db19f05bcf6e830123c34234a0c43903464dd4e9c503844e734e52e396711327b0a8d8cf15"], 0x0, 0x0, 0x0}) 03:40:47 executing program 5: r0 = syz_open_dev$sndseq(&(0x7f0000000040)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a85320, &(0x7f0000068f50)={{0x80}, 'por\xff\a\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x1f\x00z\xff\xff\xff\xff\xff\xff\xff\xef\x00\x00\x03\xff\x00\x00\x00\x00\x00\x00\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x06\x00', 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2}) [ 930.733654][ T7288] binder: undelivered TRANSACTION_ERROR: 29201 03:40:47 executing program 4: getresuid(&(0x7f0000000040), &(0x7f0000000080), &(0x7f00000000c0)=0x0) getsockopt$inet_IP_IPSEC_POLICY(0xffffffffffffffff, 0x0, 0x10, &(0x7f0000000200)={{{@in6=@loopback, @in6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@initdev}, 0x0, @in=@initdev}}, &(0x7f0000000100)=0xe8) setreuid(r0, r1) r2 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000001c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) socketpair$unix(0x1, 0x7, 0x0, &(0x7f0000000340)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) [ 930.814483][ T9283] binder: 9281:9283 BC_REQUEST_DEATH_NOTIFICATION death notification already set [ 930.848583][ T9283] binder: 9281:9283 ioctl c0306201 20008fd0 returned -14 [ 930.922338][ T9287] binder: 9286:9287 BC_REQUEST_DEATH_NOTIFICATION invalid ref 61952 [ 930.963857][ T9287] binder: 9286:9287 unknown command -368808430 [ 930.995919][ T9287] binder: 9286:9287 ioctl c0306201 20000000 returned -22 03:40:48 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f00000000c0)=[@release={0x400c630f}], 0xfdfdffff00000000, 0x6800000000000000, 0x0}) 03:40:48 executing program 1: r0 = socket$inet6(0xa, 0x5, 0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000180)='/dev/net/tun\x00', 0x0, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000100)={'lo\x00', 0x0}) ioctl$sock_SIOCGIFINDEX(r0, 0x8923, &(0x7f0000000380)={'bpq0\x00\v\x00\xfe\x00\x00\x00\x00\x00\xfa\xff\x00', r2}) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000000)={'bpq0\x00', 0x1212}) getpgid(0xffffffffffffffff) 03:40:48 executing program 5: r0 = syz_open_dev$sndseq(&(0x7f0000000040)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a85320, &(0x7f0000068f50)={{0x80}, 'por\xff\a\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x1f\x00\xfd\xff\xff\xff\xff\xff\xff\xff\xef\x00\x00\x03\xff\x00\x00\x00\x00\x00\x00\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x06\x00', 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2}) 03:40:48 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f00000000c0)=[@release={0x400c630e}], 0x4c00000000000000, 0x0, 0x0}) 03:40:48 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)) syz_open_dev$usb(&(0x7f0000000080)='/dev/bus/usb/00#/00#\x00', 0x0, 0x40) r1 = openat$sequencer2(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/sequencer2\x00', 0x10b240, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="05630440000000000e630c165ffa896b74163cd1049772cd8500"], 0x0, 0x0, 0x0}) 03:40:48 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x4c, 0x0, &(0x7f0000000200)=ANY=[@ANYBLOB="05630440000000000e630c4000f200008c01acbcd9297cf4a70a04ea80b60b21d6efb41548e724db19f05bcf6e830123c34234a0c43903464dd4e9c503844e734e52e396711327b0a8d8cf15"], 0x0, 0x0, 0x0}) [ 931.363822][T24007] binder: undelivered death notification, 0000000000000000 [ 931.424280][ T9305] binder: 9298:9305 unknown command 369910542 [ 931.440184][ T9307] binder: 9299:9307 BC_REQUEST_DEATH_NOTIFICATION invalid ref 61952 03:40:48 executing program 5: r0 = syz_open_dev$sndseq(&(0x7f0000000040)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a85320, &(0x7f0000068f50)={{0x80}, 'por\xff\a\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x1f\x00\x00\xff\xff\xff\xff\xff\xff\xff\xef\x02\x00\x03\xff\x00\x00\x00\x00\x00\x00\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x06\x00', 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2}) [ 931.468775][ T9305] binder: 9298:9305 ioctl c0306201 20000000 returned -22 [ 931.476846][ T9310] binder: 9303:9310 BC_REQUEST_DEATH_NOTIFICATION death notification already set [ 931.483425][ T9307] binder: 9299:9307 unknown command -368833881 [ 931.505656][ T9307] binder: 9299:9307 ioctl c0306201 20000000 returned -22 03:40:48 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x4c, 0x0, &(0x7f0000000200)=ANY=[@ANYBLOB="05630440000000000e630c4000f200008c01acbcd9297cf4a72504ea80b60b21d6efb41548e724db19f05bcf6e830123c34234a0c43903464dd4e9c503844e734e52e396711327b0a8d8cf15"], 0x0, 0x0, 0x0}) [ 931.521765][ T9315] binder: 9298:9315 unknown command 369910542 [ 931.542847][ T9310] binder: 9303:9310 ioctl c0306201 20008fd0 returned -14 [ 931.552959][ T9306] : renamed from bpq0 [ 931.563121][ T9315] binder: 9298:9315 ioctl c0306201 20000000 returned -22 03:40:48 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) socketpair$unix(0x1, 0x0, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = syz_open_dev$amidi(&(0x7f0000000180)='/dev/amidi#\x00', 0x8, 0x10000) ioctl$ASHMEM_GET_PIN_STATUS(r2, 0x7709, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="0563db0b0000000100000c00e2ea5d4d762e55afd0238adf23cf2701ae38b08a5efaacd0cc5ef17b73f7f9206afbeede06f161f3376e9e0f82300ecf04b49a85dbcf48f859303a2be5afa991985efd1f48fd280e70bbf14ab92bd96f3d85fa1381d222373eb206f701ce5b72fd3fb04575efd582f3d9e8d5a14e7f96ac23bfa7362a38eb5195bfe8a283761c064f2d06e4b3129a816e9b2e3ac76509367fbcb240e7bfa0d18498fe8f4f11197e0fba1c94850eb41a78ea338325a375d4939236d23f2ec21de6fd7b3444f5fb71fbdb1bb2d265d4b9c7934f8ddf3965ce378590fc2c0f295e1b18dfd1d1e526cc8f30cff3d978"], 0x0, 0x0, 0x0}) 03:40:48 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f00000000c0)=[@release={0x400c630e}], 0x6000000000000000, 0x0, 0x0}) 03:40:48 executing program 5: r0 = syz_open_dev$sndseq(&(0x7f0000000040)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a85320, &(0x7f0000068f50)={{0x80}, 'por\xff\a\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x1f\x00\x00\xff\xff\xff\xff\xff\xff\xff\xef\x03\x00\x03\xff\x00\x00\x00\x00\x00\x00\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x06\x00', 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2}) [ 931.746954][ T9328] binder: 9323:9328 BC_REQUEST_DEATH_NOTIFICATION invalid ref 61952 [ 931.770512][ T9329] binder: 9325:9329 unknown command 198927109 [ 931.782016][ T9330] binder: 9324:9330 BC_REQUEST_DEATH_NOTIFICATION death notification already set 03:40:48 executing program 1: r0 = socket$inet6(0xa, 0x5, 0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000180)='/dev/net/tun\x00', 0x0, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000100)={'lo\x00', 0x0}) ioctl$sock_SIOCGIFINDEX(r0, 0x8923, &(0x7f0000000380)={'bpq0\x00\v\x00\xfe\x00\x00\x00\x00\x00\xfa\xff\x00', r2}) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000000)={'bpq0\x00', 0x1212}) getpgid(0xffffffffffffffff) [ 931.797930][ T9328] binder: 9323:9328 unknown command -368826969 [ 931.808757][ T9329] binder: 9325:9329 ioctl c0306201 20000000 returned -22 [ 931.815791][ T9328] binder: 9323:9328 ioctl c0306201 20000000 returned -22 [ 931.838494][ T9330] binder: 9324:9330 ioctl c0306201 20008fd0 returned -14 [ 931.862249][ T9335] binder: 9325:9335 unknown command 198927109 [ 931.874899][ T9335] binder: 9325:9335 ioctl c0306201 20000000 returned -22 [ 932.020178][ T9336] : renamed from bpq0 03:40:49 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f00000000c0)=[@release={0x400c630f}], 0xfdfdffff00000000, 0x6c00000000000000, 0x0}) 03:40:49 executing program 5: r0 = syz_open_dev$sndseq(&(0x7f0000000040)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a85320, &(0x7f0000068f50)={{0x80}, 'por\xff\a\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x1f\x00\x00\xff\xff\xff\xff\xff\xff\xff\xef\x04\x00\x03\xff\x00\x00\x00\x00\x00\x00\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x06\x00', 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2}) 03:40:49 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f00000000c0)=[@release={0x400c630e}], 0x6800000000000000, 0x0, 0x0}) 03:40:49 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x4c, 0x0, &(0x7f0000000200)=ANY=[@ANYBLOB="05630440000000000e630c4000f200008c01acbcd9297cf4a76e02ea80b60b21d6efb41548e724db19f05bcf6e830123c34234a0c43903464dd4e9c503844e734e52e396711327b0a8d8cf15"], 0x0, 0x0, 0x0}) 03:40:49 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = openat$dlm_plock(0xffffffffffffff9c, &(0x7f0000000080)='/dev/dlm_plock\x00', 0x20000, 0x0) ioctl$KVM_CHECK_EXTENSION_VM(r2, 0xae03, 0x5) ioctl$FS_IOC_SETVERSION(r1, 0x40087602, &(0x7f0000000100)=0xf67) ioctl$TCSETAW(r2, 0x5407, &(0x7f00000000c0)={0x93ed, 0x400, 0x4, 0x6, 0xf, 0x53, 0x4, 0xfe, 0xffffffff80000000, 0x7}) socket$nl_xfrm(0x10, 0x3, 0x6) syz_genetlink_get_family_id$fou(&(0x7f0000000040)='fou\x00') ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=ANY=[@ANYBLOB="05630480ff0700000000004000000000"], 0x0, 0x0, 0x0}) 03:40:49 executing program 1: r0 = socket$inet6(0xa, 0x5, 0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000180)='/dev/net/tun\x00', 0x0, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000100)={'lo\x00', 0x0}) ioctl$sock_SIOCGIFINDEX(r0, 0x8923, &(0x7f0000000380)={'bpq0\x00\v\x00\xfe\x00\x00\x00\x00\x00\xfa\xff\x00', r2}) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000000)={'bpq0\x00', 0x1212}) getpgid(0xffffffffffffffff) [ 932.299791][T24007] binder: undelivered death notification, 0000000000000000 03:40:49 executing program 5: r0 = syz_open_dev$sndseq(&(0x7f0000000040)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a85320, &(0x7f0000068f50)={{0x80}, 'por\xff\a\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x1f\x00\x00\xff\xff\xff\xff\xff\xff\xff\xef\x05\x00\x03\xff\x00\x00\x00\x00\x00\x00\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x06\x00', 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2}) [ 932.382307][ T9358] binder: 9350:9358 ioctl c0306201 20008fd0 returned -14 [ 932.392957][ T9356] binder: 9354:9356 unknown command -2147196155 [ 932.404912][ T9356] binder: 9354:9356 ioctl c0306201 20000000 returned -22 [ 932.405287][ T9362] binder: 9352:9362 BC_REQUEST_DEATH_NOTIFICATION invalid ref 61952 03:40:49 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) r3 = openat$qat_adf_ctl(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/qat_adf_ctl\x00', 0x2, 0x0) getresuid(&(0x7f0000000100), &(0x7f0000000180), &(0x7f0000000200)=0x0) r5 = getgid() getsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x11, &(0x7f0000000240)={{{@in6=@mcast2, @in6=@ipv4={[], [], @local}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@local}, 0x0, @in6=@loopback}}, &(0x7f0000000340)=0xe8) stat(&(0x7f0000000380)='./file0\x00', &(0x7f00000003c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) getsockopt$inet_IP_XFRM_POLICY(0xffffffffffffffff, 0x0, 0x11, &(0x7f0000000440)={{{@in=@broadcast, @in=@initdev, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in=@empty}, 0x0, @in=@multicast1}}, &(0x7f0000000540)=0xe8) getgroups(0x8, &(0x7f0000000580)=[0xee01, 0xee01, 0xee00, 0xee00, 0x0, 0x0, 0xee01, 0xee01]) getsockopt$sock_cred(r1, 0x1, 0x11, &(0x7f00000005c0)={0x0, 0x0}, &(0x7f0000000600)=0xc) getsockopt$sock_cred(r2, 0x1, 0x11, &(0x7f0000000640)={0x0, 0x0, 0x0}, &(0x7f0000000680)=0xc) getsockopt$inet_IP_IPSEC_POLICY(0xffffffffffffffff, 0x0, 0x10, &(0x7f00000006c0)={{{@in6=@dev, @in6=@mcast1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in=@dev}, 0x0, @in=@initdev}}, &(0x7f00000007c0)=0xe8) r13 = getegid() write$FUSE_DIRENTPLUS(r3, &(0x7f0000000800)={0x358, 0xfffffffffffffffe, 0x1, [{{0x0, 0x3, 0x7, 0xa17, 0x109b, 0x10000, {0x1, 0x6, 0x1, 0xfffffffffffffffa, 0x400, 0x5, 0x7, 0x1, 0x8, 0x94, 0x3f, r4, r5, 0x2, 0xfffffffffffffff8}}, {0x4, 0x4, 0xc, 0x1, '/dev/media#\x00'}}, {{0x1, 0x2, 0x6, 0x1f, 0x7ff, 0x818f, {0x1, 0x80, 0x8000, 0xb6, 0xc5, 0x7, 0x0, 0x4, 0x2, 0x80000001, 0x7, r6, r7, 0x9, 0x4}}, {0x5, 0x800, 0x1, 0xfff, '@'}}, {{0x4, 0x3, 0xffff, 0x9, 0x7fffffff, 0x7, {0x0, 0x5, 0x7, 0x1, 0x6, 0x240000000000, 0xffff, 0x100000000, 0x2, 0xffffffffdb909af4, 0x2ac, r8, r9, 0x4000000000000000, 0x80000001}}, {0x2, 0x3, 0x15, 0x6, 'selinuxvmnet0%-cgroup'}}, {{0x2, 0x1, 0x4, 0x8, 0x4, 0x36, {0x6, 0x3, 0x8, 0x1000, 0x0, 0x7ff, 0x400, 0xfffffffffffffff8, 0x10001, 0x2, 0x100000001, r10, r11, 0xca78, 0x2e46b899}}, {0x6, 0x0, 0xc, 0xe83, '/dev/media#\x00'}}, {{0x4, 0x0, 0x1ff, 0x3, 0x0, 0x3, {0x1, 0x401, 0xfffffffffffffaad, 0x100, 0x2, 0x10001, 0x9, 0x2, 0x1, 0x1ff, 0x1c0000000, r12, r13, 0x0, 0x3}}, {0x1, 0x240000000, 0xd, 0x45, '/dev/binder#\x00'}}]}, 0x358) r14 = syz_open_dev$media(&(0x7f0000000040)='/dev/media#\x00', 0x8dd, 0x4242) ioctl$PERF_EVENT_IOC_ENABLE(r14, 0x8912, 0x2000000000400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000000080)=ANY=[@ANYBLOB="054087e2f67d289b2ed07df363000000630c40080000000000"], 0x0, 0x0, 0x0}) [ 932.451877][ T9362] binder: 9352:9362 unknown command -368939353 [ 932.475003][ T9362] binder: 9352:9362 ioctl c0306201 20000000 returned -22 [ 932.485723][ T9357] : renamed from bpq0 03:40:49 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f00000000c0)=[@release={0x400c630e}], 0x6c00000000000000, 0x0, 0x0}) 03:40:49 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x4c, 0x0, &(0x7f0000000200)=ANY=[@ANYBLOB="05630440000000000e630c4000f200008c01acbcd9297cf4a76e03ea80b60b21d6efb41548e724db19f05bcf6e830123c34234a0c43903464dd4e9c503844e734e52e396711327b0a8d8cf15"], 0x0, 0x0, 0x0}) [ 932.627809][ T9375] binder: 9373:9375 unknown command -494452731 03:40:49 executing program 5: r0 = syz_open_dev$sndseq(&(0x7f0000000040)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a85320, &(0x7f0000068f50)={{0x80}, 'por\xff\a\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x1f\x00\x00\xff\xff\xff\xff\xff\xff\xff\xef\x06\x00\x03\xff\x00\x00\x00\x00\x00\x00\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x06\x00', 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2}) 03:40:49 executing program 1: r0 = socket$inet6(0xa, 0x5, 0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000180)='/dev/net/tun\x00', 0x0, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000100)={'lo\x00', 0x0}) ioctl$sock_SIOCGIFINDEX(r0, 0x8923, &(0x7f0000000380)={'bpq0\x00\v\x00\xfe\x00\x00\x00\x00\x00\xfa\xff\x00', r2}) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000000)={'bpq0\x00', 0x1212}) getpgid(0xffffffffffffffff) [ 932.669158][ T9375] binder: 9373:9375 ioctl c0306201 20000000 returned -22 [ 932.684323][ T9378] binder: 9377:9378 ioctl c0306201 20008fd0 returned -14 [ 932.756886][ T9383] binder: 9379:9383 BC_REQUEST_DEATH_NOTIFICATION invalid ref 61952 [ 932.796879][ T9383] binder: 9379:9383 unknown command -368873817 [ 932.826320][ T9383] binder: 9379:9383 ioctl c0306201 20000000 returned -22 [ 932.936714][ T9388] : renamed from bpq0 03:40:50 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x18d, 0x0, &(0x7f0000005fd4), 0xffffffffffffff6b, 0x0, 0x0}) 03:40:50 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f00000000c0)=[@release={0x400c630e}], 0x7400000000000000, 0x0, 0x0}) 03:40:50 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x4c, 0x0, &(0x7f0000000200)=ANY=[@ANYBLOB="05630440000000000e630c4000f200008c01acbcd9297cf4a76e05ea80b60b21d6efb41548e724db19f05bcf6e830123c34234a0c43903464dd4e9c503844e734e52e396711327b0a8d8cf15"], 0x0, 0x0, 0x0}) 03:40:50 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f00000000c0)=[@release={0x400c630f}], 0xfdfdffff00000000, 0x7400000000000000, 0x0}) 03:40:50 executing program 5: r0 = syz_open_dev$sndseq(&(0x7f0000000040)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a85320, &(0x7f0000068f50)={{0x80}, 'por\xff\a\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x1f\x00\x00\xff\xff\xff\xff\xff\xff\xff\xef\a\x00\x03\xff\x00\x00\x00\x00\x00\x00\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x06\x00', 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2}) 03:40:50 executing program 1: r0 = socket$inet6(0xa, 0x5, 0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000180)='/dev/net/tun\x00', 0x0, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000100)={'lo\x00', 0x0}) ioctl$sock_SIOCGIFINDEX(r0, 0x8923, &(0x7f0000000380)={'bpq0\x00\v\x00\xfe\x00\x00\x00\x00\x00\xfa\xff\x00', r2}) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000000)={'bpq0\x00', 0x1212}) getpgid(0xffffffffffffffff) [ 933.184017][T24007] binder: undelivered death notification, 0000000000000000 [ 933.248205][ T9409] binder: 9399:9409 unknown command 0 [ 933.257563][ T9407] binder: 9404:9407 BC_REQUEST_DEATH_NOTIFICATION invalid ref 61952 [ 933.270081][ T9411] binder_thread_write: 2 callbacks suppressed [ 933.270092][ T9411] binder: 9400:9411 BC_REQUEST_DEATH_NOTIFICATION death notification already set [ 933.287776][ T9409] binder: 9399:9409 ioctl c0306201 20000000 returned -22 03:40:50 executing program 5: r0 = syz_open_dev$sndseq(&(0x7f0000000040)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a85320, &(0x7f0000068f50)={{0x80}, 'por\xff\a\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x1f\x00\x00\xff\xff\xff\xff\xff\xff\xff\xef\n\x00\x03\xff\x00\x00\x00\x00\x00\x00\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x06\x00', 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2}) 03:40:50 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = open(&(0x7f0000000040)='./file0\x00', 0x20a201, 0x4) ioctl$UI_SET_PROPBIT(r1, 0x4004556e, 0x1b) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$ASHMEM_GET_SIZE(r1, 0x7704, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000000080)=ANY=[@ANYBLOB="05630440000000000e630c4000000000b3a11e3e0a5fa557a8fdfa"], 0x0, 0x0, 0x0}) [ 933.315169][ T9407] binder: 9404:9407 unknown command -368742745 [ 933.327906][ T9411] binder: 9400:9411 ioctl c0306201 20008fd0 returned -14 [ 933.333573][ T9407] binder: 9404:9407 ioctl c0306201 20000000 returned -22 [ 933.348746][ T9406] : renamed from bpq0 03:40:50 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f00000000c0)=[@release={0x400c630e}], 0x7a00000000000000, 0x0, 0x0}) 03:40:50 executing program 5: r0 = syz_open_dev$sndseq(&(0x7f0000000040)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a85320, &(0x7f0000068f50)={{0x80}, 'por\xff\a\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x1f\x00\x00\xff\xff\xff\xff\xff\xff\xff\xefH\x00\x03\xff\x00\x00\x00\x00\x00\x00\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x06\x00', 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2}) 03:40:50 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x4c, 0x0, &(0x7f0000000200)=ANY=[@ANYBLOB="05630440000000000e630c4000f200008c01acbcd9297cf4a76e06ea80b60b21d6efb41548e724db19f05bcf6e830123c34234a0c43903464dd4e9c503844e734e52e396711327b0a8d8cf15"], 0x0, 0x0, 0x0}) 03:40:50 executing program 1: r0 = socket$inet6(0xa, 0x5, 0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000180)='/dev/net/tun\x00', 0x0, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000100)={'lo\x00', 0x0}) ioctl$sock_SIOCGIFINDEX(r0, 0x8923, &(0x7f0000000380)={'bpq0\x00\v\x00\xfe\x00\x00\x00\x00\x00\xfa\xff\x00', r2}) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000000)={'bpq0\x00', 0x1212}) getpgid(0xffffffffffffffff) 03:40:50 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="b089e207a3c2e65fbbff056314409abc501500630720ee7406b46255d32f3822d07d4e59781652731e8825bb5c483bdd6080744d66b1d564a39b28641468647ef5ba03dc694a81ea70baeaa1"], 0x0, 0x0, 0x0}) [ 933.595256][ T9431] binder: 9427:9431 BC_REQUEST_DEATH_NOTIFICATION death notification already set 03:40:50 executing program 5: r0 = syz_open_dev$sndseq(&(0x7f0000000040)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a85320, &(0x7f0000068f50)={{0x80}, 'por\xff\a\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x1f\x00\x00\xff\xff\xff\xff\xff\xff\xff\xefL\x00\x03\xff\x00\x00\x00\x00\x00\x00\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x06\x00', 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2}) [ 933.647392][ T9434] binder: 9430:9434 BC_REQUEST_DEATH_NOTIFICATION invalid ref 61952 [ 933.671294][ T9431] binder: 9427:9431 ioctl c0306201 20008fd0 returned -14 [ 933.695458][ T9434] binder: 9430:9434 unknown command -368677209 [ 933.703022][ T9434] binder: 9430:9434 ioctl c0306201 20000000 returned -22 03:40:50 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f00000000c0)=[@release={0x400c630e}], 0xfdfdffff00000000, 0x0, 0x0}) [ 933.761388][ T9437] : renamed from bpq0 [ 933.797553][ T9444] binder: 9442:9444 unknown command 132286896 [ 933.805508][ T9444] binder: 9442:9444 ioctl c0306201 20000000 returned -22 [ 933.923866][ T9453] binder: 9450:9453 BC_REQUEST_DEATH_NOTIFICATION death notification already set [ 933.961007][ T9453] binder: 9450:9453 ioctl c0306201 20008fd0 returned -14 03:40:51 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f00000000c0)=[@release={0x400c630f}], 0xfdfdffff00000000, 0x7a00000000000000, 0x0}) 03:40:51 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x4c, 0x0, &(0x7f0000000200)=ANY=[@ANYBLOB="05630440000000000e630c4000f200008c01acbcd9297cf4a76e07ea80b60b21d6efb41548e724db19f05bcf6e830123c34234a0c43903464dd4e9c503844e734e52e396711327b0a8d8cf15"], 0x0, 0x0, 0x0}) 03:40:51 executing program 5: r0 = syz_open_dev$sndseq(&(0x7f0000000040)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a85320, &(0x7f0000068f50)={{0x80}, 'por\xff\a\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x1f\x00\x00\xff\xff\xff\xff\xff\xff\xff\xefh\x00\x03\xff\x00\x00\x00\x00\x00\x00\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x06\x00', 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2}) 03:40:51 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = getpgrp(0x0) ioprio_get$pid(0x0, r2) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ptrace$setopts(0x4200, r2, 0x80000001, 0x3a) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000000c0), 0x0, 0x0, 0x0}) 03:40:51 executing program 1: r0 = socket$inet6(0xa, 0x5, 0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000180)='/dev/net/tun\x00', 0x0, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000100)={'lo\x00', 0x0}) ioctl$sock_SIOCGIFINDEX(r0, 0x8923, &(0x7f0000000380)={'bpq0\x00\v\x00\xfe\x00\x00\x00\x00\x00\xfa\xff\x00', r2}) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000000)={'bpq0\x00', 0x1212}) getpgid(0xffffffffffffffff) 03:40:51 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f00000000c0)=[@release={0x400c630e}], 0x0, 0x2, 0x0}) [ 934.122996][ T7288] binder: undelivered death notification, 0000000000000000 [ 934.184149][ T9461] binder: 9457:9461 BC_REQUEST_DEATH_NOTIFICATION death notification already set [ 934.196077][ T9463] binder: 9460:9463 BC_REQUEST_DEATH_NOTIFICATION invalid ref 61952 03:40:51 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f00000000c0)=[@release={0x400c630e}], 0x0, 0x3, 0x0}) [ 934.236658][ T9463] binder: 9460:9463 unknown command -368611673 [ 934.255194][ T9463] binder: 9460:9463 ioctl c0306201 20000000 returned -22 03:40:51 executing program 5: r0 = syz_open_dev$sndseq(&(0x7f0000000040)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a85320, &(0x7f0000068f50)={{0x80}, 'por\xff\a\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x1f\x00\x00\xff\xff\xff\xff\xff\xff\xff\xefl\x00\x03\xff\x00\x00\x00\x00\x00\x00\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x06\x00', 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2}) [ 934.310122][ T9465] : renamed from bpq0 03:40:51 executing program 4: ioctl$sock_kcm_SIOCKCMCLONE(0xffffffffffffffff, 0x89e2, &(0x7f0000000080)={0xffffffffffffffff}) r1 = syz_open_dev$swradio(&(0x7f0000000200)='/dev/swradio#\x00', 0x1, 0x2) r2 = syz_genetlink_get_family_id$tipc2(&(0x7f0000000280)='TIPCv2\x00') sendmsg$TIPC_NL_NAME_TABLE_GET(r1, &(0x7f0000000580)={&(0x7f0000000240)={0x10, 0x0, 0x0, 0x80000}, 0xc, &(0x7f0000000540)={&(0x7f00000002c0)={0x244, r2, 0x20, 0x70bd2a, 0x25dfdbff, {}, [@TIPC_NLA_NODE={0x40, 0x6, [@TIPC_NLA_NODE_ADDR={0x8, 0x1, 0x6}, @TIPC_NLA_NODE_ADDR={0x8, 0x1, 0x100}, @TIPC_NLA_NODE_ADDR={0x8, 0x1, 0x4}, @TIPC_NLA_NODE_ADDR={0x8, 0x1, 0xffffffff7fffffff}, @TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_ADDR={0x8, 0x1, 0x8}, @TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_ADDR={0x8, 0x1, 0x1f}]}, @TIPC_NLA_BEARER={0xc0, 0x1, [@TIPC_NLA_BEARER_PROP={0x2c, 0x2, [@TIPC_NLA_PROP_WIN={0x8, 0x3, 0x1}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x7}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0xf}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x4}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x1}]}, @TIPC_NLA_BEARER_UDP_OPTS={0x2c, 0x4, {{0x14, 0x1, @in={0x2, 0x4e21, @broadcast}}, {0x14, 0x2, @in={0x2, 0x4e21, @empty}}}}, @TIPC_NLA_BEARER_NAME={0x10, 0x1, @l2={'eth', 0x3a, 'rose0\x00'}}, @TIPC_NLA_BEARER_DOMAIN={0x8, 0x3, 0x7}, @TIPC_NLA_BEARER_UDP_OPTS={0x44, 0x4, {{0x20, 0x1, @in6={0xa, 0x4e23, 0x8, @empty, 0x85}}, {0x20, 0x2, @in6={0xa, 0x4e23, 0x52cf, @empty, 0x1}}}}, @TIPC_NLA_BEARER_DOMAIN={0x8, 0x3, 0x9000000000000000}]}, @TIPC_NLA_NET={0x34, 0x7, [@TIPC_NLA_NET_ID={0x8, 0x1, 0xffff}, @TIPC_NLA_NET_ID={0x8, 0x1, 0xffffffffffffffe1}, @TIPC_NLA_NET_ADDR={0x8, 0x2, 0x7d}, @TIPC_NLA_NET_NODEID_W1={0xc, 0x4, 0x7d5}, @TIPC_NLA_NET_NODEID={0xc, 0x3, 0x5}]}, @TIPC_NLA_MEDIA={0x80, 0x5, [@TIPC_NLA_MEDIA_PROP={0x44, 0x2, [@TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x1e}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x13}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x3}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x400}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0xeb0}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0xc}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x5}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x101}]}, @TIPC_NLA_MEDIA_PROP={0x1c, 0x2, [@TIPC_NLA_PROP_WIN={0x8, 0x3, 0x100}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x8}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x1}]}, @TIPC_NLA_MEDIA_PROP={0x1c, 0x2, [@TIPC_NLA_PROP_TOL={0x8, 0x2, 0x8000}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x3}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x4b}]}]}, @TIPC_NLA_MEDIA={0x7c, 0x5, [@TIPC_NLA_MEDIA_NAME={0x8, 0x1, 'udp\x00'}, @TIPC_NLA_MEDIA_NAME={0x8, 0x1, 'eth\x00'}, @TIPC_NLA_MEDIA_PROP={0x24, 0x2, [@TIPC_NLA_PROP_TOL={0x8, 0x2, 0x8bde}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x3ff}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x20}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x9}]}, @TIPC_NLA_MEDIA_NAME={0x8, 0x1, 'eth\x00'}, @TIPC_NLA_MEDIA_PROP={0x2c, 0x2, [@TIPC_NLA_PROP_TOL={0x8}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0xf}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x7}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x27}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0xa}]}, @TIPC_NLA_MEDIA_NAME={0x8, 0x1, 'ib\x00'}, @TIPC_NLA_MEDIA_NAME={0x8, 0x1, 'ib\x00'}]}]}, 0x244}}, 0x0) ioctl$int_out(r0, 0x5460, &(0x7f00000000c0)) r3 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000000040)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ID(r0, 0x80082407, &(0x7f0000000100)) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) getsockopt$netrom_NETROM_T4(r0, 0x103, 0x6, &(0x7f0000000180)=0x7, &(0x7f00000001c0)=0x4) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f00000005c0)=ANY=[@ANYBLOB="056304448a0000000e630c4000000000e0e5d628d3"], 0x0, 0x0, 0x0}) 03:40:51 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x4c, 0x0, &(0x7f0000000200)=ANY=[@ANYBLOB="05630440000000000e630c4000f200008c01acbcd9297cf4a76e12ea80b60b21d6efb41548e724db19f05bcf6e830123c34234a0c43903464dd4e9c503844e734e52e396711327b0a8d8cf15"], 0x0, 0x0, 0x0}) [ 934.403391][ T9478] binder: 9474:9478 BC_REQUEST_DEATH_NOTIFICATION death notification already set 03:40:51 executing program 5: r0 = syz_open_dev$sndseq(&(0x7f0000000040)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a85320, &(0x7f0000068f50)={{0x80}, 'por\xff\a\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x1f\x00\x00\xff\xff\xff\xff\xff\xff\xff\xeft\x00\x03\xff\x00\x00\x00\x00\x00\x00\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x06\x00', 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2}) 03:40:51 executing program 1: r0 = socket$inet6(0xa, 0x5, 0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000180)='/dev/net/tun\x00', 0x0, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000100)={'lo\x00', 0x0}) ioctl$sock_SIOCGIFINDEX(r0, 0x8923, &(0x7f0000000380)={'bpq0\x00\v\x00\xfe\x00\x00\x00\x00\x00\xfa\xff\x00', r2}) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000000)={'bpq0\x00', 0x1212}) getpgid(0xffffffffffffffff) [ 934.491896][ T9485] binder: 9482:9485 unknown command 1141138181 [ 934.499475][ T9485] binder: 9482:9485 ioctl c0306201 20000000 returned -22 [ 934.592301][ T9490] binder: 9487:9490 BC_REQUEST_DEATH_NOTIFICATION invalid ref 61952 [ 934.644893][ T9490] binder: 9487:9490 unknown command -367890777 [ 934.663828][ T9490] binder: 9487:9490 ioctl c0306201 20000000 returned -22 [ 934.750828][ T9496] : renamed from bpq0 03:40:52 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f00000000c0)=[@release={0x400c630f}], 0xfdfdffff00000000, 0xffefffffff7f0000, 0x0}) 03:40:52 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f00000000c0)=[@release={0x400c630e}], 0x0, 0x4, 0x0}) 03:40:52 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) 03:40:52 executing program 5: r0 = syz_open_dev$sndseq(&(0x7f0000000040)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a85320, &(0x7f0000068f50)={{0x80}, 'por\xff\a\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x1f\x00\x00\xff\xff\xff\xff\xff\xff\xff\xefz\x00\x03\xff\x00\x00\x00\x00\x00\x00\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x06\x00', 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2}) 03:40:52 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x4c, 0x0, &(0x7f0000000200)=ANY=[@ANYBLOB="05630440000000000e630c4000f200008c01acbcd9297cf4a76e46ea80b60b21d6efb41548e724db19f05bcf6e830123c34234a0c43903464dd4e9c503844e734e52e396711327b0a8d8cf15"], 0x0, 0x0, 0x0}) 03:40:52 executing program 1: r0 = socket$inet6(0xa, 0x5, 0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000180)='/dev/net/tun\x00', 0x0, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000100)={'lo\x00', 0x0}) ioctl$sock_SIOCGIFINDEX(r0, 0x8923, &(0x7f0000000380)={'bpq0\x00\v\x00\xfe\x00\x00\x00\x00\x00\xfa\xff\x00', r2}) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000000)={'bpq0\x00', 0x1212}) getpgid(0xffffffffffffffff) [ 935.032619][T24007] binder: undelivered death notification, 0000000000000000 03:40:52 executing program 5: r0 = syz_open_dev$sndseq(&(0x7f0000000040)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a85320, &(0x7f0000068f50)={{0x80}, 'por\xff\a\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x1f\x00\x00\xff\xff\xff\xff\xff\xff\xff\xef\xfd\x00\x03\xff\x00\x00\x00\x00\x00\x00\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x06\x00', 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2}) [ 935.097751][ T9507] binder: 9505:9507 unknown command -364482905 [ 935.128623][ T9517] binder: 9512:9517 BC_REQUEST_DEATH_NOTIFICATION death notification already set [ 935.134192][ T9507] binder: 9505:9507 ioctl c0306201 20000000 returned -22 03:40:52 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) membarrier(0x1, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)) syz_open_dev$sndpcmp(&(0x7f0000000040)='/dev/snd/pcmC#D#p\x00', 0xfff, 0x210000) r1 = syz_open_dev$admmidi(&(0x7f0000000080)='/dev/admmidi#\x00', 0x8001, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x200c) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) 03:40:52 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x4c, 0x0, &(0x7f0000000200)=ANY=[@ANYBLOB="05630440000000000e630c4000f200008c01acbcd9297cf4a76e50ea80b60b21d6efb41548e724db19f05bcf6e830123c34234a0c43903464dd4e9c503844e734e52e396711327b0a8d8cf15"], 0x0, 0x0, 0x0}) [ 935.248011][ T9515] : renamed from bpq0 03:40:52 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f00000000c0)=[@release={0x400c630e}], 0x0, 0x5, 0x0}) 03:40:52 executing program 5: r0 = syz_open_dev$sndseq(&(0x7f0000000040)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a85320, &(0x7f0000068f50)={{0x80}, 'por\xff\a\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x1f\x00\x00\xff\xff\xff\xff\xff\xff\xff\xef\x00\x03\x03\xff\x00\x00\x00\x00\x00\x00\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x06\x00', 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2}) 03:40:52 executing program 1: r0 = socket$inet6(0xa, 0x5, 0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000180)='/dev/net/tun\x00', 0x0, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000100)={'lo\x00', 0x0}) ioctl$sock_SIOCGIFINDEX(r0, 0x8923, &(0x7f0000000380)={'bpq0\x00\v\x00\xfe\x00\x00\x00\x00\x00\xfa\xff\x00', r2}) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000000)={'bpq0\x00', 0x1212}) getpgid(0xffffffffffffffff) [ 935.404065][ T9536] binder: 9532:9536 unknown command -363827545 [ 935.411084][ T9536] binder: 9532:9536 ioctl c0306201 20000000 returned -22 [ 935.465632][ T9538] binder: 9537:9538 BC_REQUEST_DEATH_NOTIFICATION death notification already set [ 935.642713][ T9545] : renamed from bpq0 [ 935.721682][ T9545] : renamed from bpq0 03:40:52 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x4c, 0x0, &(0x7f0000000200)=ANY=[@ANYBLOB="05630440000000000e630c4000f200008c01acbcd9297cf4a76e5bea80b60b21d6efb41548e724db19f05bcf6e830123c34234a0c43903464dd4e9c503844e734e52e396711327b0a8d8cf15"], 0x0, 0x0, 0x0}) 03:40:52 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x88080, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) 03:40:52 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f00000000c0)=[@release={0x400c630e}], 0x0, 0x6, 0x0}) 03:40:52 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f00000000c0)=[@release={0x400c630f}], 0xfdfdffff00000000, 0xffffffffff600000, 0x0}) 03:40:52 executing program 5: r0 = syz_open_dev$sndseq(&(0x7f0000000040)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a85320, &(0x7f0000068f50)={{0x80}, 'por\xff\a\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x1f\x00\x00\xff\xff\xff\xff\xff\xff\xff\xef\x00\x05\x03\xff\x00\x00\x00\x00\x00\x00\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x06\x00', 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2}) 03:40:52 executing program 1: r0 = socket$inet6(0xa, 0x5, 0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000180)='/dev/net/tun\x00', 0x0, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000100)={'lo\x00', 0x0}) ioctl$sock_SIOCGIFINDEX(r0, 0x8923, &(0x7f0000000380)={'bpq0\x00\v\x00\xfe\x00\x00\x00\x00\x00\xfa\xff\x00', r2}) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000000)={'bpq0\x00', 0x1212}) getpgid(0xffffffffffffffff) [ 935.930230][ T7288] binder: undelivered death notification, 0000000000000000 [ 935.998350][ T9559] binder_thread_write: 2 callbacks suppressed [ 935.998364][ T9559] binder: 9557:9559 BC_REQUEST_DEATH_NOTIFICATION invalid ref 61952 [ 936.013436][ T9565] binder: 9561:9565 BC_REQUEST_DEATH_NOTIFICATION death notification already set 03:40:53 executing program 5: r0 = syz_open_dev$sndseq(&(0x7f0000000040)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a85320, &(0x7f0000068f50)={{0x80}, 'por\xff\a\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x1f\x00\x00\xff\xff\xff\xff\xff\xff\xff\xef\x00\x06\x03\xff\x00\x00\x00\x00\x00\x00\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x06\x00', 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2}) [ 936.068757][ T9559] binder: 9557:9559 unknown command -363106649 [ 936.094976][ T9559] binder: 9557:9559 ioctl c0306201 20000000 returned -22 03:40:53 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f00000000c0)=[@release={0x400c630e}], 0x0, 0x7, 0x0}) 03:40:53 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$nfc_llcp(r1, &(0x7f0000000380)={&(0x7f00000000c0)={0x27, 0x1, 0x1, 0x0, 0x9, 0x3, "e52b1f9e8f85733737cc290ca37b49b84f2ea8626f3a35ea4af8793a43e89a7686a56c7b520d04d6692dcdc6a91b4c73909d72640072f98933fdf3c9c21fa5", 0x3c}, 0x60, &(0x7f0000000180)=[{&(0x7f0000000200)="7bdcd4946f2728b75fa95a2884287dd2b0d0f18d3cfe8942e72283da2c359ad6a186133949e797be4c23165d6ed3e82ef6a6392c41d2bfdc28604235124033f7302015606ccb9a2fc17c8bb96f792dfb1b8ece203e3fda001bd74549d985c566", 0x60}], 0x1, &(0x7f0000000280)={0x100, 0x3a, 0x1c, "d0a10306427dd8882de90049836598d3cc0857bc9dc4066d0a8afbaaeda78b53acc25a419e7e5f47f25acdc46839f2a9485159d4d3da05c05bcd591fbb6d5a3ed8782d5e94b728fe44a5296e40fa1891f1c0ef9b97c5294a06cfb5cdccfd4958c6d1a1b7dc0087d1a1b5ead3f32704947fdb384d8f59e8e9d99963235d79aa84b6f31fd62089c5aec172c8c113038088c575ad71cca384f40209115e00ef3c7e459d83c1bf0c9ba79edd6d8f3bd3feaf1ef880886cb98ff07daf95fe75c8b30869caa09dc9f47c76c67c75d316841386a7e9fb32a57d4aa8a263dfd33e36af21402794de6000fa37959e12c0"}, 0x100, 0x800}, 0x20040001) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) r3 = getpgid(0xffffffffffffffff) getsockopt$sock_cred(r2, 0x1, 0x11, &(0x7f0000000040)={0x0}, &(0x7f0000000080)=0xc) kcmp(r3, r4, 0x0, r2, r2) [ 936.117182][ T9563] : renamed from bpq0 03:40:53 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x4c, 0x0, &(0x7f0000000200)=ANY=[@ANYBLOB="05630440000000000e630c4000f200008c01acbcd9297cf4a76e04ea80b61221d6efb41548e724db19f05bcf6e830123c34234a0c43903464dd4e9c503844e734e52e396711327b0a8d8cf15"], 0x0, 0x0, 0x0}) 03:40:53 executing program 1: r0 = socket$inet6(0xa, 0x5, 0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000180)='/dev/net/tun\x00', 0x0, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000100)={'lo\x00', 0x0}) ioctl$sock_SIOCGIFINDEX(r0, 0x8923, &(0x7f0000000380)={'bpq0\x00\v\x00\xfe\x00\x00\x00\x00\x00\xfa\xff\x00', r2}) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000000)={'bpq0\x00', 0x1212}) getpgid(0xffffffffffffffff) [ 936.284145][ T9582] binder: 9577:9582 BC_REQUEST_DEATH_NOTIFICATION death notification already set 03:40:53 executing program 5: r0 = syz_open_dev$sndseq(&(0x7f0000000040)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a85320, &(0x7f0000068f50)={{0x80}, 'por\xff\a\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x1f\x00\x00\xff\xff\xff\xff\xff\xff\xff\xef\x00\a\x03\xff\x00\x00\x00\x00\x00\x00\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x06\x00', 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2}) [ 936.332429][ T9585] binder: 9584:9585 BC_REQUEST_DEATH_NOTIFICATION invalid ref 61952 03:40:53 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000000040)='/dev/dlm-monitor\x00', 0x400000, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) 03:40:53 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f00000000c0)=[@release={0x400c630e}], 0x0, 0xa, 0x0}) [ 936.398411][ T9585] binder: 9584:9585 unknown command -368808281 [ 936.425882][ T9585] binder: 9584:9585 ioctl c0306201 20000000 returned -22 03:40:53 executing program 5: r0 = syz_open_dev$sndseq(&(0x7f0000000040)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a85320, &(0x7f0000068f50)={{0x80}, 'por\xff\a\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x1f\x00\x00\xff\xff\xff\xff\xff\xff\xff\xef\x00\n\x03\xff\x00\x00\x00\x00\x00\x00\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x06\x00', 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2}) [ 936.513395][ T9599] binder: 9595:9599 BC_REQUEST_DEATH_NOTIFICATION death notification already set [ 936.577879][ T9589] : renamed from bpq0 [ 936.703589][ T9589] : renamed from bpq0 03:40:53 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000000180)=ANY=[@ANYBLOB="0563044100000000deb5f2c674fd8d565d565ac0b75cd56f4efa4c0527cfafcbd6c2179b1412746a94f16e587a1f2a86fdca56af6c6e237d5f6c35b745d4eaaca182e3b1ff3e269db179b6ffad11ad67ffd5a04c04900e54a3bc73d51472b96ed52e7dbc18c7cd9d6ed938a99147aa9cb1a2fb2224f9f99b4e28418c43702e2c3842fcbe1f61b0287e20e19c1d"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f00000000c0)=[@release={0x400c630f}], 0xfdfdffff00000000, 0x0, 0x0}) 03:40:53 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x4c, 0x0, &(0x7f0000000200)=ANY=[@ANYBLOB="05630440000000000e630c4000f200008c01acbcd9297cf4a76e04ea80b64621d6efb41548e724db19f05bcf6e830123c34234a0c43903464dd4e9c503844e734e52e396711327b0a8d8cf15"], 0x0, 0x0, 0x0}) 03:40:53 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=ANY=[@ANYBLOB="456363f34000000000"], 0x0, 0x0, 0x0}) 03:40:53 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f00000000c0)=[@release={0x400c630e}], 0x0, 0x48, 0x0}) 03:40:53 executing program 5: r0 = syz_open_dev$sndseq(&(0x7f0000000040)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a85320, &(0x7f0000068f50)={{0x80}, 'por\xff\a\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x1f\x00\x00\xff\xff\xff\xff\xff\xff\xff\xef\x00H\x03\xff\x00\x00\x00\x00\x00\x00\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x06\x00', 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2}) 03:40:53 executing program 1: r0 = socket$inet6(0xa, 0x5, 0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000180)='/dev/net/tun\x00', 0x0, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000100)={'lo\x00', 0x0}) ioctl$sock_SIOCGIFINDEX(r0, 0x8923, &(0x7f0000000380)={'bpq0\x00\v\x00\xfe\x00\x00\x00\x00\x00\xfa\xff\x00', r2}) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000000)={'bpq0\x00', 0x1212}) getpgid(0xffffffffffffffff) [ 936.850891][ T7288] binder: undelivered death notification, 0000000000000000 [ 936.908515][ T9621] binder: 9612:9621 unknown command -211590331 [ 936.908928][ T9620] binder: 9614:9620 BC_REQUEST_DEATH_NOTIFICATION invalid ref 61952 [ 936.923889][ T9621] binder: 9612:9621 ioctl c0306201 20000000 returned -22 [ 936.933320][ T9620] binder: 9614:9620 unknown command -368808281 03:40:54 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f00000000c0)=[@release={0x400c630e}], 0x0, 0x4c, 0x0}) [ 936.955395][ T9620] binder: 9614:9620 ioctl c0306201 20000000 returned -22 [ 936.970211][ T9625] binder: 9622:9625 unknown command 1090806533 03:40:54 executing program 5: r0 = syz_open_dev$sndseq(&(0x7f0000000040)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a85320, &(0x7f0000068f50)={{0x80}, 'por\xff\a\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x1f\x00\x00\xff\xff\xff\xff\xff\xff\xff\xef\x00L\x03\xff\x00\x00\x00\x00\x00\x00\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x06\x00', 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2}) 03:40:54 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_genetlink_get_family_id$fou(&(0x7f0000000080)='fou\x00') ioctl$FS_IOC_FSSETXATTR(r0, 0x401c5820, &(0x7f0000000000)={0xfffffffffffffaba, 0xfffffffffffffeff, 0x7, 0x8e, 0x6}) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$BINDER_SET_MAX_THREADS(r0, 0x40046205, 0x7) r2 = openat$vfio(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/vfio/vfio\x00', 0x3, 0x0) ioctl$PERF_EVENT_IOC_SET_FILTER(r2, 0x40082406, &(0x7f0000000100)='/dev/binder#\x00') ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x10, 0x0, &(0x7f0000005fd4)=ANY=[@ANYBLOB="05abd2000d000000000000000000001c"], 0xffffff53, 0x0, 0x0}) [ 937.013489][ T9625] binder: 9622:9625 ioctl c0306201 20000000 returned -22 [ 937.071870][ T9623] : renamed from bpq0 03:40:54 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x4c, 0x0, &(0x7f0000000200)=ANY=[@ANYBLOB="05630440000000000e630c4000f200008c01acbcd9297cf4a76e04ea80b65021d6efb41548e724db19f05bcf6e830123c34234a0c43903464dd4e9c503844e734e52e396711327b0a8d8cf15"], 0x0, 0x0, 0x0}) [ 937.111107][ T9629] binder: 9622:9629 BC_CLEAR_DEATH_NOTIFICATION invalid ref 0 [ 937.115630][ T9635] binder: 9633:9635 ioctl 401c5820 20000000 returned -22 03:40:54 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f00000000c0)=[@release={0x400c630e}], 0x0, 0x60, 0x0}) [ 937.155178][ T9629] binder: 9622:9629 ioctl c0306201 20008fd0 returned -14 [ 937.221592][ T9635] binder: 9633:9635 ioctl 40046205 7 returned -22 [ 937.244457][ T9623] : renamed from bpq0 [ 937.249344][ T9643] binder: 9641:9643 BC_REQUEST_DEATH_NOTIFICATION invalid ref 61952 03:40:54 executing program 5: r0 = syz_open_dev$sndseq(&(0x7f0000000040)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a85320, &(0x7f0000068f50)={{0x80}, 'por\xff\a\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x1f\x00\x00\xff\xff\xff\xff\xff\xff\xff\xef\x00h\x03\xff\x00\x00\x00\x00\x00\x00\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x06\x00', 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2}) 03:40:54 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_genetlink_get_family_id$tipc2(&(0x7f0000000280)='TIPCv2\x00') sendmsg$TIPC_NL_NODE_GET(r0, &(0x7f00000004c0)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x40000008}, 0xc, &(0x7f0000000480)={&(0x7f00000002c0)=ANY=[@ANYBLOB="bc0100be", @ANYRES16=r1, @ANYBLOB="00072abd7000fbdbdf250d000000280006000800010005000000080001000080000004000200080001007f000000080001000200000028000600080001000600000004000200040002000800010000800000040002000800010050070000f00001003c00020008000200f7ffffff080002000300000008000200d3090000080001001000000008000200afdf0000080001000b000000080003008100000024000200080003000200000008000400a10d00000800040000080000080002000080000044000400200001000a004e2200000100fe8000000000000000000000000000aa09000000200002000a004e2400000000fe880000000000000000000000000001070000000c0002000800030002000000100001006574683a726f7365300000002c0004001400010002004e207f00000100000000000000001400020002004e2400000003000000000000000038000200080001000400000008000100ff0300000800010007000000080001000300000008000100ff0f000004000400080001001f0000001c0006000800010006000000080001000800000008000100070000001400020008000200090000000800020081ffffff"], 0x1bc}, 0x1, 0x0, 0x0, 0x40000}, 0xc0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=ANY=[@ANYBLOB="054e0440000000000e630c4000000008"], 0x0, 0x0, 0x0}) r3 = mmap$binder(&(0x7f0000e00000/0x200000)=nil, 0x200000, 0x1, 0x10, r0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0x68, 0x0, &(0x7f0000000180)=[@transaction={0x40406300, {0x2, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x10, &(0x7f0000000040), &(0x7f0000000080)=[0x28, 0x68]}}, @clear_death, @release={0x40046306, 0x4}, @free_buffer={0x40086303, r3}], 0x58, 0x0, &(0x7f0000000200)="2892d0b344a5852ecbef2d329e8420b889fb36e099eb1c6d4430eefbab16550ce8a83b5daac5e3b5fce14ff40501098501a37df0240dcfb6827faf8d99b940f61c0881ed86718acb108270a25cdf00d17dd55e92852ec2ce"}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008fd0)={0xfffffffffffffe81, 0x0, &(0x7f00000000c0)=ANY=[], 0x0, 0x0, 0x0}) [ 937.265979][ T9643] binder: 9641:9643 unknown command -368808281 [ 937.282074][ T9643] binder: 9641:9643 ioctl c0306201 20000000 returned -22 [ 937.304590][ T9642] binder: 9633:9642 unknown command 13806341 03:40:54 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x4c, 0x0, &(0x7f0000000200)=ANY=[@ANYBLOB="05630440000000000e630c4000f200008c01acbcd9297cf4a76e04ea80b65b21d6efb41548e724db19f05bcf6e830123c34234a0c43903464dd4e9c503844e734e52e396711327b0a8d8cf15"], 0x0, 0x0, 0x0}) [ 937.373006][ T9642] binder: 9633:9642 ioctl c0306201 20000040 returned -22 03:40:54 executing program 1: r0 = socket$inet6(0xa, 0x5, 0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000180)='/dev/net/tun\x00', 0x0, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000100)={'lo\x00', 0x0}) ioctl$sock_SIOCGIFINDEX(r0, 0x8923, &(0x7f0000000380)={'bpq0\x00\v\x00\xfe\x00\x00\x00\x00\x00\xfa\xff\x00', r2}) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000000)={'bpq0\x00', 0x1212}) getpgid(0xffffffffffffffff) 03:40:54 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f00000000c0)=[@release={0x400c630e}], 0x0, 0x68, 0x0}) 03:40:54 executing program 5: r0 = syz_open_dev$sndseq(&(0x7f0000000040)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a85320, &(0x7f0000068f50)={{0x80}, 'por\xff\a\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x1f\x00\x00\xff\xff\xff\xff\xff\xff\xff\xef\x00l\x03\xff\x00\x00\x00\x00\x00\x00\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x06\x00', 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2}) [ 937.456911][ T9655] binder: 9654:9655 unknown command 1074023941 [ 937.492217][ T9662] binder: 9657:9662 BC_REQUEST_DEATH_NOTIFICATION invalid ref 61952 [ 937.527166][ T9655] binder: 9654:9655 ioctl c0306201 20000000 returned -22 [ 937.565155][ T9664] binder: 9654:9664 got transaction to invalid handle 03:40:54 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="05635f0440000000000e630c4000000000"], 0x0, 0x0, 0x0}) [ 937.568265][ T9662] binder: 9657:9662 unknown command -368808281 03:40:54 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f00000000c0)=[@release={0x400c630e}], 0x0, 0x6c, 0x0}) 03:40:54 executing program 5: r0 = syz_open_dev$sndseq(&(0x7f0000000040)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a85320, &(0x7f0000068f50)={{0x80}, 'por\xff\a\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x1f\x00\x00\xff\xff\xff\xff\xff\xff\xff\xef\x00t\x03\xff\x00\x00\x00\x00\x00\x00\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x06\x00', 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2}) [ 937.622977][ T9662] binder: 9657:9662 ioctl c0306201 20000000 returned -22 [ 937.630070][ T9664] binder: 9654:9664 transaction failed 29201/-22, size 0-16 line 2896 [ 937.660799][ T9674] binder: 9673:9674 unknown command 73360133 [ 937.702158][ T9674] binder: 9673:9674 ioctl c0306201 20000000 returned -22 [ 937.720385][ T9667] : renamed from bpq0 03:40:54 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x4c, 0x0, &(0x7f0000000200)=ANY=[@ANYBLOB="05630440000000000e630c4000f200008c01acbcd9297cf4a76e04ea80b60b46d6efb41548e724db19f05bcf6e830123c34234a0c43903464dd4e9c503844e734e52e396711327b0a8d8cf15"], 0x0, 0x0, 0x0}) 03:40:54 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = openat$proc_capi20(0xffffffffffffff9c, &(0x7f0000000040)='/proc/capi/capi20\x00', 0x2000, 0x0) ioctl$KVM_ASSIGN_SET_MSIX_NR(r2, 0x4008ae73, &(0x7f0000000080)={0x6, 0x3}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB="c15d42a373c57af3ff7f000000000000"], 0xfdfdffff00000000, 0x0, 0x0}) 03:40:54 executing program 5: r0 = syz_open_dev$sndseq(&(0x7f0000000040)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a85320, &(0x7f0000068f50)={{0x80}, 'por\xff\a\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x1f\x00\x00\xff\xff\xff\xff\xff\xff\xff\xef\x00z\x03\xff\x00\x00\x00\x00\x00\x00\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x06\x00', 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2}) 03:40:54 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) socketpair$unix(0x1, 0x7, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) 03:40:54 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f00000000c0)=[@release={0x400c630e}], 0x0, 0x74, 0x0}) [ 937.916685][ T9693] binder: 9691:9693 unknown command -1555931711 [ 937.945762][ T9695] binder: 9690:9695 BC_REQUEST_DEATH_NOTIFICATION invalid ref 61952 [ 937.953828][ T9695] binder: 9690:9695 unknown command -368808281 03:40:55 executing program 1: r0 = socket$inet6(0xa, 0x5, 0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000180)='/dev/net/tun\x00', 0x0, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000100)={'lo\x00', 0x0}) ioctl$sock_SIOCGIFINDEX(r0, 0x8923, &(0x7f0000000380)={'bpq0\x00\v\x00\xfe\x00\x00\x00\x00\x00\xfa\xff\x00', r2}) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000000)={'bpq0\x00', 0x1212}) getpgid(0xffffffffffffffff) [ 937.964108][ T9693] binder: 9691:9693 ioctl c0306201 20008fd0 returned -22 03:40:55 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$amidi(&(0x7f00000000c0)='/dev/amidi#\x00', 0x5, 0x100) ioctl$TUNSETVNETLE(r1, 0x400454dc, &(0x7f0000000100)) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) setsockopt$l2tp_PPPOL2TP_SO_REORDERTO(r1, 0x111, 0x5, 0xffffffff, 0x4) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) r3 = syz_open_dev$dspn(&(0x7f0000000040)='/dev/dsp#\x00', 0x80, 0x82) ioctl$VIDIOC_ENUM_FRAMESIZES(r3, 0xc02c564a, &(0x7f0000000080)={0x4, 0x33424752, 0x3, @discrete={0x20, 0x2}}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=ANY=[@ANYBLOB="05630407000000000e630c4000000000"], 0x0, 0x0, 0x0}) ioctl$TUNSETNOCSUM(r3, 0x400454c8, 0x0) 03:40:55 executing program 5: r0 = syz_open_dev$sndseq(&(0x7f0000000040)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a85320, &(0x7f0000068f50)={{0x80}, 'por\xff\a\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x1f\x00\x00\xff\xff\xff\xff\xff\xff\xff\xef\x00\xfd\x03\xff\x00\x00\x00\x00\x00\x00\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x06\x00', 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2}) [ 938.025062][ T9695] binder: 9690:9695 ioctl c0306201 20000000 returned -22 03:40:55 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f00000000c0)=[@release={0x400c630e}], 0x0, 0x7a, 0x0}) 03:40:55 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = dup(r0) ioctl$UI_DEV_DESTROY(r1, 0x5502) ioctl$BLKIOMIN(r1, 0x1278, &(0x7f0000000100)) ioctl$DRM_IOCTL_GET_CAP(r1, 0xc010640c, &(0x7f0000000040)={0x1, 0x6e37}) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) syz_open_dev$rtc(&(0x7f0000000500)='/dev/rtc#\x00', 0x1, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f00000000c0)=[@release={0x400c630f}], 0xfdfdffff00000000, 0x0, 0x0}) accept(r0, &(0x7f0000000200)=@xdp={0x2c, 0x0, 0x0}, &(0x7f0000000280)=0x80) getsockopt$inet6_IPV6_IPSEC_POLICY(r1, 0x29, 0x22, &(0x7f00000002c0)={{{@in=@multicast1, @in=@empty, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{}, 0x0, @in6=@remote}}, &(0x7f00000003c0)=0xe8) setsockopt$inet_IP_XFRM_POLICY(r1, 0x0, 0x11, &(0x7f0000000400)={{{@in=@rand_addr=0x3, @in6=@mcast1, 0x4e22, 0xdaa4, 0x4e23, 0x3, 0x2, 0x0, 0x80, 0x29, r3, r4}, {0xf710, 0x3bb, 0x2, 0x1, 0x7, 0x6, 0xfffffffffffffff8, 0xfff}, {0xc8d0, 0x6e9a4518, 0x8, 0x77}, 0x2, 0x6e6bb2, 0x1, 0x0, 0x1, 0x3}, {{@in6=@mcast1, 0x4d3, 0x32}, 0xa, @in=@broadcast, 0x3505, 0x3, 0x0, 0x80, 0x3, 0x5, 0x1}}, 0xe8) getpeername$unix(r1, &(0x7f0000000180), &(0x7f0000000080)=0xfffffffffffffeab) 03:40:55 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x4c, 0x0, &(0x7f0000000200)=ANY=[@ANYBLOB="05630440000000000e630c4000f200008c01acbcd9297cf4a76e04ea80b60b50d6efb41548e724db19f05bcf6e830123c34234a0c43903464dd4e9c503844e734e52e396711327b0a8d8cf15"], 0x0, 0x0, 0x0}) 03:40:55 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) r1 = socket(0xa, 0x1, 0x6da5) setsockopt$bt_hci_HCI_DATA_DIR(r1, 0x0, 0x1, &(0x7f0000000040)=0x1, 0x4) r2 = syz_open_dev$swradio(&(0x7f0000001b80)='/dev/swradio#\x00', 0x0, 0x2) ioctl$LOOP_SET_STATUS64(r2, 0x4c04, &(0x7f0000001bc0)={0x0, 0x0, 0x0, 0x1, 0x8000, 0x0, 0x4, 0x1b, 0x9, "1c92f94091e0f48125c29cb84861f35946ab52cb3e93a053d79b8350dc605d2d4b4f692169ba92831bfe1b69d173fffae74e06591f09db758722c9d019169cca", "46f7d6e34c1a9bc01485f0147c41144bd66e546e3162647f42856cb2ca3cf0cdd04865cfed56b8d761a40561a2e0218e2b50927e0eb5898912a8dba033b74a87", "efdcd0c8ff9d452382724322753fa84b5549f3c09aca554adad41bca4c4458b0", [0x4, 0x6]}) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) fsetxattr$security_capability(r3, &(0x7f0000001b00)='security.capability\x00', &(0x7f0000001b40)=@v2={0x2000000, [{0x48, 0x10001}, {0x8001, 0x8}]}, 0x14, 0x1) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) r5 = geteuid() getsockopt$inet_IP_IPSEC_POLICY(r1, 0x0, 0x10, &(0x7f0000000200)={{{@in=@multicast2, @in6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@ipv4={[], [], @dev}}, 0x0, @in6=@remote}}, &(0x7f0000000100)=0xe8) getsockopt$sock_cred(r4, 0x1, 0x11, &(0x7f0000000180)={0x0}, &(0x7f0000000300)=0xc) getsockopt$inet_sctp_SCTP_GET_LOCAL_ADDRS(r2, 0x84, 0x6d, &(0x7f0000001cc0)={0x0, 0x1000, "5baf0754621d979889af0b9eab0c6ae0959a88ca80a2f2b94f6c173391006cf80aa091cec0eafc9113a40b1f1f2ef16786471b9bb2b4b80b0a311a469a3523b5ea8a415052611fa1f59b971630f6c62b7e3e06924fa7ca8542307cc5806e6605f774a92599fc1aaa9cd5f75d5d7dcc7329ff2326968511dde5abb2f20c491ed66f571a46240b748089b9f70fa9a3c6842c4084aa78028491ccd487a3a91b2d282049fa53844954e69a798db13689fd017f2d76a4ba63f1d5938359eaa0933d47a718dff1ef4e3f9de4a0fd571ca6290c7f7b79439d75e34a96f3ac06e2a7c3ed70bb0c28de734afb3afe4ec7dc75c9f3e46d6b0ab3dafd8c814309377e23b2fa7aaf8d3a47d0f1d05d7f7da3725d34c4ca5308faa5eafd5dba591de2dedc039d9ac86fd9f4508ba71a353cd1959bfb0a2123b43568b24a7c15ea64f47b4e5cb345ab352b94b329be38c8f6f82570d060c6c3695e5c5dddb8ba3bad784f30bc3c89766f47b55b4918a262ca6ec0556c01402b5a11f563b523c72fce38ee3e714e98eb9cdc6ef8786b2390fd7e30a0ea72ae0adb6b238468a2ccd923197864364aa02a5cee7bec017f791adbe0c2b2f7a2b04312cb6d9ae61ef77254d4a80d6d491c1aed8a2aaa776d17a8ce2f58f5026faa0c9722765c000ad9d46dcea0817516623852dbe8a2d6852ab881d7577426d1a3f9441fd1ba137eb28586c6a59065a5c4ad6d084fd65c6fd0a3b949dfc979fbed3a4a589092abc5ec27cbc2fb23a70301b3fc662c868a32ee13846fbd57c00800e9cf14b7d9b986b87fdaa57a409828e3cd26136f8c4493433344d893b746c71c92cdca1c684e0e1544d74ed1896d2b0fce18cb7bf3f56768c6d95884ba1151d61141f0eaa7159885ba955b6e2c4e77a2d2f91bfcf2f5c8c8d24fee66e0a5f896b4864e902703839d3dd798b35455d4fcef5b2dcc42265d3d63ef53103f8fb488a6bdab95467244b0f5df5c4f28b8ee175968acc7874583f4efd0b15175809649404084103b875c18ca9adb7977cb71c7c553bb2eebdc8ac3d1e416726705a157e7e3cbdd6c34a35ab15b2bf2859d461b9d4dc86825a0aef84036bc50a391e4d33a51276c41acf0f32a8e59dc1d112013cd2b39a6d0308f66ea7fe868242f277e7bf699db0fd021259a1a6616814530c30d12ae8702d5f4840646b61b43337d964ed8daed6c18c5d74c6ac3fc45b1c077aacc149b0d39ab8d92e84aac064d377e17c8beb57951afc086a9b8348758ac1a45ea3640764f30cdc18b2bf76a366f9a570762cd466e0bb22cc6cb3cc393eaa3ccdf1a02bae63c4b9336fc0883b41c98654db78aa9fbe099eadc3f83cc7b182bf8ee7207de5f15a67a63a0b1bc2af91a716a5e107dab0cb2c227bff0c2c41981e51caf7d88a6aaed1648cb7c63ea7a7ba2307640968da963e6eb5c7ba8b1a6ccb4d65eb8deecadbd36921ddde9274d8a2d68ba624f4497214c14dec9bdecadffc1c57bd1e4aec498c259e74fde8cbb2caaefa295a7da0a64d3b82069de3b925fd156de3cb295fbd9a67172da3c53e82a072ce4689b8088790acdec4680e9f82b035728b149dce96990964a8d75409ffbc1025ca746d325d35954e36d53094fea7b7df4443fab3fc344f5670ff4905896e959a20ffafc07afa767066b90931a3dc16a77ee11dab13ef7045a82828bb07c7096fb8351c8fb8023e2078575aec3eab031c9ab801163a6734360fa951e52296ce8d91a1d76e4cf3bd6d2cd0033cdcb148c6650054673de02b18d9f95bb5acd0834add7810c44e8c4aefb20d237e769d7cffcb966f4cb0d5339fb9c0a5c3a4c895f6ba52a229ca39d92e24695d83fa7f3da3042a8d23886f1fe65534a5436ed4046d5b75841c68e339dd35f1b5054807f651d8d72329ddc48ea2a876f80937a429d334b7055f0ad35d263f777836e8678d09509094978c8afc71e8fd865bc337c2ac3695d3acf13f8ea72679e95536c26fba92dd8d6390f5341bd089d7a88cae11459041560d0d9deab0be855255366a997e1a5e5ee810ef65e82499f0d2968169b58e307d7b2fea9bb019f3443025a49853209bcfc558e686d8f0ed2ad2ddbb26ee742fc30d2e94f2b77e85241389814a2294f694d44a65a67cd3d046fcd24d3765aadbf10f9a0a4cded5133805e26ad223667bdbd58d81ec0b67fd4eecf4db68f59a6b5468eb6e993bdc8182288323bfc674a053fc817073d449e718ff3b01251ebaeedb485fbaeb0ee281763d61c0af0c35e5e022eddd6fe1a364995ccf6b1f6a5b41b1c9584c7a565d339154c4750a15512381e13263f53af4d1fc50d9cef3232e44ea06ac5dd8e90dc7c86657ef9f8fba71722d2916ddf3a51f45ac2fe5cc9915007e23a0dc773aa9b442fd95921bf500c99103a774a5085483c3d505b938d007c266d688cdbe2a5033298382cc03e4ca1c0f0404394f44876e0d43fc35da62d78dce1d0aee34cdbe2172297a859a7b327ed3bf317dfb73b6c79abd822f2b7b2234b71fdec0d60d25dd01ead8f8f4a656b88714ff1a5fe4f70dce4fdcfbda8a5872fb83d7bba26452c2d98d8807e7f3adab819ed01f9498e53e66b4cf41b141784c0e90f04edda0a44d13e5a073d79a2f1f4619287ac3c5084e37231de50b7c7446aa2ebf38bd21eec6e30fea3c5aeb00ca9e629e9bec3416f2f7362d6a7bb468034d4c1b0b9229a45265e6c00771f75dbb787275cc343e2da30b274a5c4ceb053e9deb0062f403e55a148db42637a560382a5be83f7f2fb191bd8a91bf6550bc06289bd7049ae47fdcbabc4c82b289709c69e361753fa727e69efcbb55683a7aadb9004392e075be60c344166be06d3054f16f023efa055785c9fed78bdb3abc888be15d1c2eba09092cc1281b9d45c9712cd7ff34a90aa726bfa86c32be72e6c433b70f9aca69e84b4df3e4655efb262848447a6e8493418da5a748aee65c2370a8a033d2d7132e0951f036197446381d1058f6a6bbb170eb49f632d7e97266101ed023754998d83044299de00871e8401c27a09b44251f3da3d7db5321f546553379c127d7c8c5992b8a59dd30e054cc0fdecc8eefec10cd41a0f7f5262ce638f3c83d50db26cfa3e06ce7e96872d0e5618bb87044a7787ea6d3f8c39092f711f182986285cc5342e681ffabd4c6743df75b0fdc4f9fc66c3d948b3fa5e0de6aa316413a6e4d6ee04ce6dc4ae522bbfccae21711868585041ce329d2f4f56dbe88a23b8979a3b9aa736f90e380dbf45d9c3355f214833dccee228a50eb95082057a595bd6ef93dc0aa42746017789ee5d847e05edf41c7f58f3a29ced82688f4355332af2c42c4b3b7103cd31a28caf72fda1e2f469ddab8c6d41f6184968aff2cef19dca3e19e82c622ff278e403afd351dea736a40a6a6801125787a60f4d3d3f3e352ffa6f7e8cb2bdfc356cf90c7f4039965c0bcf72c5dfacc1b2eb92c635cf01daa2f942934a2f214cf8f453c2c522c42f125d36506c6fe41f355dcc98b0410b47592336e5b8e910043ae915d8584902e84a6accf5a7913fc6b503cc9c18a026691f5e3f22c430d9bfd27039c46dd28d275788bf06a1797431935ea5149d7db451b257bdf9991c1096188653d980a70d1aab92b457725152f06443ce22cf96337f0e6946fe8892aa54cda5c317213c92ac55486dfcccd65a7dcaa922657e61bdac0c49db29b3995961a2c188b8a5347923cb483c89eb28eac081dc6a156d88ce63cd94fa6f789eeefbca75e17a7c72c23b2d75b084e2b3265adaa65147ea434a8a4ed429be49a7486747390893d284e5277f631249d9013dac61f7a40397827e67078eec6492c8404405156c64cbc5396d95ba08f732ae5da0e41f5655afc75919c99fe13b92064ee5a754e1cd5b2a4abf89ab171122359e43248f4f6910f45b7f64d6c45fad4d2e12d5bb508c9a04691567e16a133cd3af2c22a0d3c901f0a89bdac382fd0d70f70ab9c16dfc2c5904b99b29dea767d8a94aa048f773f2aa2e367770c7e2bf914b0f3ccc87ad987f94f7780acf09d7d046a4b2db8b6d48854f38912b3772cb399b09d0f668ef13a0d3d514659a1cf7e53788b1f99c7042c8ed10bd07e2e3bfe53723ce412244d8a3e7f0ac0071c851a043fcb41bf8e7f4d6cd982bc152ba2909fa28d26394aecb6948377f6b5382b1ec4335eab0c84ce905afd7ebabaf4ebbddcf6e4feea61701386473d0e43a78d1d3bf598d6dc55f33bc6304abaea2355a61a0d585e7ce29a68e6f8fbed3094a3da55ed58bb6a11f0c99607ab9f82aa4c3e031d4b01d9cceaa4a8bb78b3349893e5a0ee0fd6882855b9cdf0c0eaa74b5435e20a721756398ebc620baf91013ef6df28f2d6885591d3e38a05eddd20e979178dde433b6214fbdf49278a044666f73fe5801130969a04ebee8b356b82d943ab1901915ec9ff93fd6ada7c15032d8eb406b2e68760b066cc8f1852cd25f3339087c500e05d21c1750e398a3715e543511d69b679c63f1da0b22f559f2fffa5bfbf411a278321a23878323e199be1e918487c5d1f4c81310881555815a94071b0b4de5f672686d8062287a1f27349b76a69e504bba03149fd09c3108ca54b217bfce89cf6fe842d1f5f890795c3384e980bc7b7bd62fb96cf119bd64e79253f1850ca50e934a74a3f2c0dfddcc4104a5018d93cb5421335028b192467897db527e9e14f66acc4d4b940974c617a2a663a0ff04c777cb136044dfe959db4ca6f6bbd736814952b54888f82a09f5e331cd2fbb0174831f31441874f64e65a313bda2112ebc639503a4b7d45095c1cc6a68e9ddb2bae8b5a1e9e872876a444d3f48e34a24f0d572385f70828dae0b7ac60ce3521c980679c4c645875b096a541ee580211368ee4afb706e039b0029fcd7caa2a0a7ec2de57ba073bf144f180b89582c8d57bb39e4dcb3e45e2aba1b778bed5393ffde93e2ab366e72e681020bf480adc96c916efedbb786c048327a93a5535abb83a4c857dc189f8e2352cb175d8ee3a88ede1085fa22b5299828b86a433f34bbf755d7df337952caac8a8d1afde1746fdc82726b226bb59c817781f068af11d82c82bcc9000aae98b523684cfc08047584ec95a172a1cfd49ebd6325894b549062ed23685f4ea903b222339aa712ff046b1f1052c97ccfd0ff2a98eee16ecc830f963ee8f1a084c3e3fa09770fc98891ff281d81a1670aa26b987d34ba31d811b2a94af3b07000cf6060bda30b3eeac886d2b95636b959be289f6fdac81d3e82341cd18e98ba59225a532dbd36885abbb5948c2725514d1a816481f1f7c9c35bf5cdc73f50a5a56a8bfc194eb19469a3a205b1affafc1a061657e056400656493009f45fd8e7da7c1a3a3174efa1486c5efbd7e27b639cc26fbd10eaa8e116a97a83a7239683380aaaf3bdc0854f8d1ab269be456095a2cdead3be2891a380c5bb9686870af208e7a44bcb3308287e9aa79c6afe9af5033f121256ed357dc57ff15b1b4f0e63bb8c398650b7160f58fa9ff637970c510f88e17f643740a89f93cfbf4043a3f12d621777c27440600ce07a79638c3486a9f88afa9cb0dbb0c88d5876f330e1e547f4fc46e4232a75090f92fcfcff3c39692ad85543ee703afaeb3c09f1eb9b4f2d500c8d4383976a2f6c3f97b2d533508ea9b71c1f972520660d759e4a2d100dc3d584c5b1c13adb14e74bcb40ff9fc12833199776e05b94e6853ca97e76763f83761081abff3cc12769b21f54f0cf47eb767d4336083e9141f0588ce15283ee23b01188c99942d46e6d"}, &(0x7f0000002d00)=0x1008) getsockopt$inet_sctp6_SCTP_PARTIAL_DELIVERY_POINT(r2, 0x84, 0x13, &(0x7f0000002d40)={r8, 0xfffffffffffffffc}, &(0x7f0000002d80)=0x8) sendmsg$netlink(r1, &(0x7f0000001ac0)={&(0x7f0000000080)=@proc={0x10, 0x0, 0x25dfdbfe, 0x108c04}, 0xc, &(0x7f0000001a00)=[{&(0x7f00000000c0)=ANY=[@ANYBLOB="1c000000270000082bbd7000fddbdf2508006402", @ANYRES32=r3, @ANYBLOB="04000100"], 0x1c}, {&(0x7f0000000340)={0x1ec, 0x2c, 0x800, 0x70bd2b, 0x25dfdbfe, "", [@typed={0x8, 0x2c, @uid=r5}, @typed={0x8, 0x74, @uid=r6}, @generic="fe2aabf6458f8ba155534e74632389260d3c4a55b23f4eafd81e23190e5cadc5240113c75948f4ef2e38e9727ab0a9cd721c36d5083295ab0f6e1c67d0db7b15830b", @nested={0x188, 0x2, [@generic=' T', @generic="489b013dbf2d6eeda26e26adf8d94ef801513dd2", @generic="0a49e87a4ab710ad4062004093527ec94fdd5e2883983eebc79ed2a193db859bdbb09702ea14aee8fac8fc7660b7f57fd2dc63e74e2ea151239df30a22201a0fc690a07f0ecfb24fefee8d5d36a77387aa60af21b817cd7fd49d5ba2afec0f320b35f3b8d247cc3e54ab67cde0416af8a2a3f0e58ef5a16037f40617d72a971104a1d1051224f9e14ed8276d808dfa9ff0e1f3f1edd28a39253b2b27443fcd3354d733893284d5b974e32681c3616264f2e99ed9cd326f8bac2af556adbbb0e7d6fce800bc53a52af307be46e9498e8b5a642a9cffdf1351803143a9475b37af356d96cd2b310d832e", @generic="fd3d3f51d22bc9a6518ff387f8ca4e7e1b96717770ef0a2ac981cccac4ac4af5133bdd1afd0822e56073c5a5b995669dd6234e747787bb886eda62e27cb3", @typed={0x24, 0x65, @binary="c71d77b0fcaf0629163bfd6f09cee4e665df9b5a423031f66cf1451bed1aa1e4"}, @typed={0x8, 0x61, @pid=r7}, @typed={0x8, 0x93, @ipv4=@dev={0xac, 0x14, 0x14, 0x21}}, @typed={0x8, 0x16, @fd=r4}, @typed={0x8, 0x7a, @ipv4=@remote}]}]}, 0x1ec}, {&(0x7f0000000540)={0xdc, 0x42, 0x408, 0x70bd28, 0x25dfdbfe, "", [@generic="38bb31c347cafdd54f81f7870a17ebe408ed593227992e548b6fcbbf9d144001fc21f08235ee804676b0d9f74fa8eaec6f51a1b14a49d7b8de4e7e357335105399c2551712516f975d6e2f382e25f165c99e9292a0478fed2f789c30d24d7d8ecdcb6f8f9a8afd66d78ea6cede8b0692ea026a16036f82d38f2de6e2db8e9e98328233bd90df579604845e6efbeafaea0223b2e94c3ce2da7483c58cf998b143e944a9eb1277f492df3f2e945c936d042f0adb5064d594ec9ba12326beb8a93b05301858a7e187b1cfd600"]}, 0xdc}, {&(0x7f0000000640)={0x12b4, 0x2c, 0x320, 0x70bd25, 0x25dfdbfb, "", [@generic="1de22fd46604cd8feb0c11d9be3c73fc846a6cbe597a80e97bc9d07f493bb848ee3cf83a83d01d1cbf4c3372e5cb2672e6fcd6177fbc4a2dcf02b3a42c182b9433f42407f3926a6f9127cf76156a796af191923e3bc48a6987a4709e5d", @generic="f5a9ee46daa11c3227a41b55a6b5c62c03857b3e205c1f9e04495bc8a42a497db2458b838bb9ba7db899d59cd2efdc798ec47a2e0c81b2a27f67131f38e5f46a32692b26ac82c811088d1bd128f7274174851415e2346a680bbd564817cdda5abb1ada1ca1bd13ac0af240a689803f0c24d95987bbf5606147ddbc2455805f54a490e06369f58c32b97cf57a996d42c227aa85b47aef2c7c53e51e0f0d5131b00cd76584d94cad51eb0b252afdc92329790afdd1b8f77ab2eba375b88c708c7dc707c999f4f28ffa1878eb0ae9ebb78191b0611e2b77d0925ca610c86d8c19e93575fb569e6e341b88e253c3677026483267db1a04cf2e8892de88d6429f673a76ffc954a757c07e9cab4afb6a9510c42a3d74ec1c292314ba32bc063aaea3205e2a1fa993accbea5ea15e9cc9a04c3a00e8330cca016994750842c08942417d2ad80e52e6ebcf31d8f29c2372d1a8498145ba9abe09f0f84a37b20d37f296bad315cca30212ac0798dd0bd4d6e59849ea56a4d783794cba7ae87d47387383a9222849db5a4b224643226c5abd88039211356f37fa6e7aeaa0b466ef649c90f4ab74e7678fee72f2094d7dcf52f695db9b1e4f5a16b88bdbe5479f922e2dd3fe7adee091bd54989ed8a95b1ef392a1a4d66ee8504ac3c88f3ce748afd73014cf278b0a892e2f1ab80265894cbe1f29e780d568e22454fffd1081eab0f54bce432b623c421ed15e1a94a3b84613b69ceca5e2bd22cf27403b486d2a943622ddff012377f7bd3945e260eda4a1d26021891c35419e66ddda9bec11458bb4f535802e24f0279f3470fbbc447f582b02ac320ebc164916715556d64891fa7806389df3708b943cda3c189d658c59c2fd1e99404f53ed0022b1b050f4a5afff20624b8f76da2f913ef705534f854f3614ec116e9d56555d0deea2ad5742a440b1f235fb3c5b1cbac37f8378bb868fe78bdd0579c08aca9bf9567db06095959c2c5151f6753bf1182a6595cd26ed29136e39f8d8d3659c861eb5df7c95ceb09e52e64635b6d25246d7f5810c3161e21d1af23c79ac3f84785bac6e9d2074969df0d035bfe559422ed1a5ea0936ace8791975474d2833f53999844abd095c44b79f3363f36e7cb2145f2159b433771480eda36fb06241a26f8dcca28971b6122eeb4a57ff178be00d9af9637e40d5adfcda3d68e80a3ef4f7cebc03d9441bc2f7933c2331d711bda1d6eff1022044fb8f89ca63db675da7be5feef74b596cc708651e7dc45ff9e699cc0c0f52af906e504b5a6333c382a431fad26c0d96100e91789217ea7def3d412d3fc6944a7bb576e8fa747ab5d71926aabbcaba2bc8bd817d45b11b45648cdd4700ef5bbb346c7a35763ba79b4dbf6a64e4df7e4b6d269d96185c2021aec0e7a965f902e8ef8b39a2e5f87ba5edcdc0c1c296367220c57ead0e9eb06113ce73eb4db5bb1bf0c78d33cb6b540e4070fbbaac8b32a9c8da154d18ef262ebaf149d2385df3182850d7584409d2dbbfc775ddef5e40fde34f4494bdcafabbec6fd28a46ce0712bd743257d3ca2c68f9af350c980ae468f0caf9ca1e69ca244c5dc656e851a7918b2f78937fe106effae1e5e112385f2cb57a1d6d89cb86535f1ae104424fe4f0fa3e2729ef3ab206fe5fc47467f921983a446485cc898823ea22d8a1f68eb18cee3b103eaaa0d400c605ae9684150e2645f4bbaf86eee5054a13f462c3583047848bbba01785016e3364af8ef851e3006b338cdd8005b181cbdefd6269382e039ba43a8aa886f977770cced54c1250458d303c2bd7e034d7c1a89040443a51bc0208515cb3875e3a2baec7ca69fd1551b08df4de84c1e18fff589b604f7ab11fd2dc484e45f0c38bca410ffeb2b5f2c2c9c7a3bd9f79c0a42d059e6b5ffb8fa1df006937d03677394065cb7ef8e4ef7ca95b64028d92b086aa2881daf7a14090506ae46e126c91fd1985f74ba0a55a03d642ceacf7735082a10e40073ac76cd6413568c1dc3a2ec8f6cfa8ada6cbc09a02282a7280ef523ee70bf9bdd7e539f745361fa2edb493c618e1f095a4d0d3cc4ee5ce4d62dc77e5be67dc9e8886365221d47d8612625642ad0972e35a0eb19c0e8cf1d91ddce5fa55cd30bc9e4b00736fbb7fe740b3c83425fcd9cfce77ce3e112d1ccda19204e8b4b8390d9ce15dcbfb031937a051960cf1e7534b0afe651a7a8386960ececdc3c708f6c8b9c4b94abd2ac26a1a2c5c2e4e6abd7f3fcec61f45707360aa6611724cb1ea74f8b49ee24d026988b51a1ead72eec66001966eb0675eae77d580978a08b3501834b3ffdf43378e306de1a0f1f7a5e22e66294b096b65b7fc5e389a4bef635830a894be8353ad9a13b5c94e0f4917ec2f657bc44f2585c9258cd7f51a38c859ef7baede7d0f3580fd3dad574ced1c1891c8bc4e2ac23f013d0bb7d9df24df37d8e64b625efbc7794e2e68cb71c7a349efd6e7b3ebcd3f42075199b5b55d8e0db5323effacdb36b6e014d0e2e359194198b5c0e33bb8d3404c70c8d7b356fe9dd05e7f04bc7a226bc76d7592cbee634ebd22ab07a2bfb7b2a0258557e11fe54a16a43a45eaa535249d1c0f3d01277697ef199dc4247d4a074270cbae270d4bcc27b86ed161c480fa1be7a4dd887e1a87378748fa2b128a2e4069eaf2e055022e0b9a535270b8b8bb61ff34bbc339cf7db9164a05b06d371613f24f709f49920532a817491ee5b4b4fdec21c4648cfe620ae59a56874af76b398c756e7c14e7824b2bf51ca44f8ebc9a5c0311367f034751d36a2b88d974370d90ee3301756ff70f33094d9e95a6ad14a99db5f3651b2ad87e414f39a0ca7370c17fea6d8007aa84b642bdf42036011f417f61ab85053bb480f2d901d505a836cf660ec9ee52d7187defb72972d7752e00048ff094469342a0324c53a2496fcda3e55b5133cb01d64459fe29773d3dc4027bc705ea92c9a42556d75477960e4279020992ce5833353a1a1133dffd3248f638ffd424e61b9b9e86ade28ee04d9badeb8c9241b8282418e514f52e2cc2ce9200f6e4c8a84e3809006eccf43e4ec930cdf782cb2f98377dd094c2da30a230404e7dbe09061245006e378f8e58155f64fe93101677735abf837ca48ab47f2054ab23e06adb4884e29aa68402fd06921af48e19e9cf1c7c05d24a6ec067a4a5ee30df2ba6579d5d397f12b8044da20c4d43e8a456bd4cd36c3cc4a3e63bdd293a108e34856c3710ff7b91e379ea5c8ef6379a9973dff4b7635f70e9375503e6e426b3fce506e4a0d4cb1a7968731481e6d9e4b3d0cc1f798e0390481a1b979e366f5722f57cbad7bef744cc69ba458e5db7312593f847fbe32402b28a2d7722125ce562ac0ff0e9f51d55ca072049a310ceeb56d3c1b67a1ba2432705faa8bb1140b67bf590764bcf1f88d4ace1cce853eae116ca12bff2734feb140218dc6bd96ece1ff9621eb1d541f4120de27312fcee768a0ad62dcab3d2d0fb0f8874fd034287122b9eaefaa2b9af8f2eb9f5e90b478c79e298e6e3d8340a5e3cbd5f06c6d5b7c7e9678933c60b82b7a6d67b96f45fd028bdac8a4675829df86db94a8f2d11a875a3b8c8316ec2c40f9a52756a9fa88ca21c08b863051c1fe1723685b992076e1a9cbb31c8218ee7495e6e6393d41828286cdc1618a9226aaf1f1587be1e9bcc4acffaa49dbbdd3c31128e8c581d20ddd72aa000711a7beb65026ad9870ebf62b72acfadc8edbd26d7b8336447892125d4b584286ed8ad46c7a17d4f4aa7a0be809c660457ac67f6e57074c84ba06c91ea46f666baa4ce48ff11eaa6ce641bf0cca993b7e5484aa362ab105a566ee2019d772c9858cce675d40f3f2a694bfcc39a712571cc5160b55edc5d2421e890d4c8ca53c2c6e0b7afddbcf18788e9022b542231d1f0e34601ff9d8b8790d3be5882f7819f06035acd5de74907bbe5721eda2fd0f18ab5ac122b518218af8ec122beed161287b5ea664fc31a73ca16c388f77e648c9afdaba022de79c99fad202157eab837369a6bfda7b1021451c4b343ce80093a5097bbda6ffcc222d501074023081cce10da7f81236cf0b7c669ab54624462b000ecac5f65505ff8d0bfa958d6961f8610275ea75d2dbc19486e3d1e0bdb9a24fd3af326ae3bb6fe35248c548e4dbbe0925a3daf10010812febbf78f876600ce24b2e99ab1ba57790386954083c4f08e9b0a4bfd2e8f22336db25345aeac68158e7621b07df559e23b383752965c27a08c6f9487ba59851835619f0bca58409f91e6688b5cbe88d9db72ca19f567e223443fcf5b04177af660fea2dd51e516337448f86cdb3f5b5b04aa5cfd28b05d9aa55d85a821b4c57f1cf115d34e5c9b11b540647a9508b8037e11a23c6b90654765cf080adce03d7f8f7564e80abf73ecfd421d23a47e2d9909b194dc017b0a4fafd334b4482847524fe6aa7ce4dbd04e3cd39f8e1c75e25b566ff54e706afdc5b61c0b8dd19cd5188bd82dc3f492c7e7a79f0ea805cc9050ed6096668ae8f2b2ce1fa4a346c4c3751dd1f1d62489f1589b70966ec29f8d61301e98cfba276772e9a09e4e9d1c93de87c3e84d6b5371b87c583123b561f36abd8ed828fb32d5d6ee3bbce952fa44a38adcf6b7eefd607e4cf36579f82e21d0b9a2f38952c1bffb43602e689d4664573ef76296c2881ec76c8fe331061572d06543ff3f557d7d6fff5bbecd7b1a6ac4a7006df76e4e2129eb0512e4857fd8e668adc5de9da21e62f16cef4237878f40ec813df75f9c61552bacd107a86767ce534ecee7df8c5e79f0580f7b0bed85e87f7bcf6f0bd16d95055be56005ca41f6e01109686afaed57032739ee5236e8ac7119f8eccdd5f798c362bd2d6b4a6575c5abf985adadcafe82139db65908e1e214a1a365e69422424a89fa139f09e69877241214df405702331bf1b9dbb35654cadb73fa141dd8675e95ff039ffc15639d301bbfe38bd982e0daff8e50727b3cd8fbade3049657d210e1626b2509f97ac717308505aadef3d889a3767a00411f8bb0317af0538fe4ad2cfae022f4bf68ddd338e65bb217bad1b78c11c12849df83b889aeecbe930be5210b3bc2d5fda6fcde52045496eead98808dcc3d0a970d4808b99037de41b0485af74b01bf606bb3b79a325e41c0a695fa07d51e225ec8ccf52c1fcdf6bfd2c1e8c4ebbb66498993dc79f71f686c12f28a040614ca4a5ee7f5e457c5050ca29868a2cff60b3a67be1456637c321c5c68cb6d990da9caf5eb2a940444209ac840a036413487a1ea93a97da4e0f0e4d1157f3e423ce75b367f21a1f6efaf8e93d5d2aa0d2ebe0eadc3bf2ae46411e38f846a22d1a07514a03ccbf41051aa738122ee83055be1c2689c6e6137ccf64825f1b584a930e87e174bb9ed540ef70379636ff866150862713e2480eca258c579854b7b97fdb6d3472bc620a33acd6b931203da4272b592076e5be184e0c1948147a20a5e3607798882f3964101b5153ba1fdf986fb5fdb51af3c920b51f6d9851077c2959266179e62164e5cbb7d092c36782c0dea90f3c30ccc35819d4a65bf2d7fb64005262af08a01d4e84640925718046f8a86ecb1b30badd482f9e468fe0f88abd956864c27e8fb0bb500de88480839d2150175771d44b9127390a2998a20501c412fba6f2166631889764e85e92dfadf430d7ddd3b4888890bf1dc0792bb0fc0fd44176a7fc7bbacf7b95baaa6f141988e1c06eada4c3550a1be1ba8f695bfa5dd0d3cc4d70a40d348ccee3893afebc924b21781f53b5ecd", @typed={0x4, 0x6e}, @nested={0x240, 0x5a, [@typed={0x78, 0x20, @binary="774785042f134f4b6e12912bb4edf16a021b3fe51b3893a563a90e30672f81419fb2789bebdfa8eec5457474873c7f6601e1b6825ee1db86b20b58e58951cff4729afdaa0fd237dbe4c289ed353370767c957a213f30564be039bb781503cc27cedd05287e35ee2ad7a6d1ac941efafabb"}, @generic, @typed={0x4, 0x90}, @generic="c1851d420f0ff137603e441370d9df6a50755b72e43bd7a8784403fddf5a37f2e26178733201f40e57dbc5312ce04f11fd7f9ffa5ddeb7087e7e29931e1f292ad6b812715fdba638e6fcd605e03a94c158e3e897cc01da64af26588088e5b439b0c04d12ed2d050c0e4d0016dd54bc7c23facf083f625792271920ec789683a6ec09448e3156ef90a8b3563c6c57d7aea395713af118ed0d77568ed964530bdb645e845ae8533e18e546cdfa8d078792ef590b5dbeac897ce9aebd8b82ce59da235a60d22ea2569b5d98fabb933e37777a654adebf05fca2c83bded25e1a5be3d4b29deeeb98f1808e8c4e1b641e07dd94709028d12ccc", @typed={0x14, 0x81, @ipv6=@ipv4={[], [], @local}}, @generic="5654162ddfe9e701eebb956e1dfa822a244a1149f2762acf0fa3db292541fed368ce04d1c7a178843a797ce2bc87e1c00ae77306afda337afb8e27a536353e55a567249fd42008b21ec04c4474dc1cb004408f1754ca375be20439b30d3095d4d08dbb99115b02bf99ee48f2313a82ea4a9689a0e9459983b5b5dfc93ca66efda7e1db987050df5193fb8526c072f67a83008b8c0d15f357992b31dfce252ad14e61cfacac1ffa14f70d70230d055699", @typed={0x4, 0x15}]}]}, 0x12b4}, {&(0x7f0000001900)={0xcc, 0x30, 0x302, 0x70bd2b, 0x25dfdbfe, "", [@generic="ea94333df911433594767a1547fc1bff2102cf2b0194000ae6858236d59c45b3098ad6708becd02e71ddc172b0810025b8e1a5c9ef14d7eebb1edcd37e1f5c532ef2a1a0e08c6b32a7811bf0dc96a13b44cafa37ab0afa46d667ae111f4d8f50a5dbbac6abb2111015c82b5495fc52cfec305584ea5209cbe28dcf61d05c36ac3c5af417b069f7be1badb755e8748bb6a9d9d7ce6c16d1033d63370d2049e73f925eaf7bc369effa431923af12be814524ed263b00fbc29a2697"]}, 0xcc}], 0x5, &(0x7f0000001a80)=[@rights={0x20, 0x1, 0x1, [r1, r1, r0]}], 0x20, 0x20044000}, 0x8000) [ 938.223274][ T9705] : renamed from bpq0 [ 938.231932][ T9722] binder: 9719:9722 ioctl 5502 0 returned -22 03:40:55 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f00000000c0)=[@release={0x400c630e}], 0x0, 0x300, 0x0}) [ 938.280156][ T9722] binder: 9719:9722 ioctl 1278 20000100 returned -22 [ 938.301855][ T9725] binder: 9720:9725 BC_REQUEST_DEATH_NOTIFICATION invalid ref 61952 03:40:55 executing program 5: r0 = syz_open_dev$sndseq(&(0x7f0000000040)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a85320, &(0x7f0000068f50)={{0x80}, 'por\xff\a\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x1f\x00\x00\xff\xff\xff\xff\xff\xff\xff\xef\x00\x02\x03\xff\x00\x00\x00\x00\x00\x00\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x06\x00', 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2}) [ 938.328738][ T9728] binder: 9719:9728 ioctl c010640c 20000040 returned -22 [ 938.385431][ T9725] binder: 9720:9725 unknown command -368808281 [ 938.391657][ T9725] binder: 9720:9725 ioctl c0306201 20000000 returned -22 [ 938.423787][ T9735] binder_thread_write: 7 callbacks suppressed 03:40:55 executing program 1: r0 = socket$inet6(0xa, 0x5, 0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000180)='/dev/net/tun\x00', 0x0, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000100)={'lo\x00', 0x0}) ioctl$sock_SIOCGIFINDEX(r0, 0x8923, &(0x7f0000000380)={'bpq0\x00\v\x00\xfe\x00\x00\x00\x00\x00\xfa\xff\x00', r2}) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000000)={'bpq0\x00', 0x1212}) getpgid(0xffffffffffffffff) [ 938.423798][ T9735] binder: 9732:9735 BC_REQUEST_DEATH_NOTIFICATION death notification already set 03:40:55 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = creat(&(0x7f0000001200)='./file1\x00', 0x100) ioctl$DRM_IOCTL_ADD_CTX(r1, 0xc0086420, &(0x7f0000001240)) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200) openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000001300)='/dev/ubi_ctrl\x00', 0x40, 0x0) r2 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000100)='net/ip6_tables_targets\x00') getsockopt$ARPT_SO_GET_ENTRIES(r2, 0x0, 0x61, &(0x7f0000001340)={'filter\x00', 0x1000, "692a5b58941dde8311cd6af8593cc3316da802aec29614aff3d24258153d140572d35625889a8c2028c154c43ea4725c2fcbb3d40c32a0b5b725e9f555b501c8a6cc255e1e6203fb95cd7fde0fb6268ebdd02f141ab36bae47778191cd3c89104502b020fa157c3cd22b5b60ba13daf96b44c944bd68d706355c9d1d5ee6f6be9d24046e63d27cc1cde1ec4db0c570788406146a06c18cf9cde6aa6cd094b30f2ed595bbe62db67ea6611d3d08e3fe5a4d01a3309653b0702681917d637a448386ad2feff9c3c1fb0bdef0ffe6804772fe4b0847ef74ef5405a33d215b2640b64fd1bde4991fe049c724056aaa287251cbc4e73ed86e6e8a2544889d2be485780ea4b275097c8588282a3f93bedefbc745484ea838c152535cb3de165f12ec66eee82516cbe4331b18ac36b7941691780b1076d52a6279f4aca6ef71d896e28372f88311626950edfc7ec40455b8e263b61e048c9c276347e8ea3cf5e860c2c5ab7989a9b80a8bcd8a8f7330e13ea2e0930067bb536c895ce4f328a3dfc2c39f94a3e6a24c621d28bedd9a2dcc611ffc86bc339308ef77a0f3210644de58a7e2e1661a6b963b411407301c18461c17b8d7a1dd6e7f0dba59500d8dc9afee6a630772895d68f134eb08977a69a572c83ca08db14f31b766b7c8deadcec09da80ce4f58d4ee05ffdc1f868a5b900d9187423f93efc80f01dced806ad6a1155840edf6cd612dfd35048f33d27414e761cbaf170f977871e082c5e6999c6405f8943f63c9f3e8255c0ce606424c3ead5a0b0c03448ed1b2bbb65cd9e6b212c6b54239badc63ccb20a312da3a131d00def18c185c412274e96bfd6fb07b1d8727d44b8e117798aa7baa741553e39532ac922f6ead274b3fccba7fa0cce7896ef54314b4e926ef56df8cb11d38b86748511ff26b4778f2d4ed17d54ea7d2f0e3cd29c5c9ac1b52f50ceb0d6e720016fb04e664b3117a341f01ea898b89c2ea55d02d5dba88c2d784fc498c85ab6d48dd89e7d5a8d1b747c63ff86947a5b4d9509b306560a5fc1521ae783499b52b5d9331152c13f86094106c59cba8a2d5754eb3e8474ab9b52429376ec330f644b54d10b0d10f839c6c65904376c984ba8bbc93f9a368215ff23a481a140b4f68804788d2888ffe838eb271a9c5719e867fea2b8cef817e19e20cfb75828ad309164a9fbc20e782eb9faa39abc85663d83f018656ff30cbd14b9ffa719428ae4339fc82ee1a93dcbab05afccf0628f36942a81e12801893c4f33072e8d22bd6837c9fff6e4f242abf5052cfd438580da990fd2ad592ebee59db5c24da135312ac28a8c531dfe4cd39b8795953d4f7aa68e976bdca92dd3cba333faacf7418ffb9a328f7b1c15d224315430d582e7fad4f4d0aa0297c798e7303a9e468b747e2d3813a6f98b72294390505994f6b56a0f909b63a14f7922d64f7cf528060fbc4bb1b92656cbfe827283432e490bed0bebff3a4b074b84499e1045e997b4b0d44ee60fe84cf9a311a7091a9a100e3f2b81d291eef94b67e1d4d63edb033a12e17578659039fb0e9bf7a9ad22aca4d89373d1b6bcead9c8cbe94cb72fa829e067ea426b51e4048702942586aa827d0fec274849985c6e556321b3c051acb306a4db7531848cfd3b56081df1febd8b57197f8b0e7f32209fdeb668a70f5e1af736b2aaa6fefb6eeee2c10cec4c82249c3cf2f344f7c11bff15b65e33323cd6828da409a9608ec38400587fafffa296f41008827996c0c65ab831299f4cfbf76673715979f299394c4f18147f0c0bab65f19d2b64f643462633ee62e11f0a6bede57b6f40e9c9fc7080d6283f8badb0ceabdaf10ecbfc22647abffad307c70156a3e069d7d8b8d1c89fbe0a8445703c2f1c11d3efc2eea30402e2f913f22d699981d16b15a331ca7afdfb15ed0467bdb44048ca539414ae9699fe4a4d140edfb44cded8b2b1ca0bd1f282bf95bb6704c23c00a60b9afc2a969cf1c7da084bc321f6642bc0c6c0e56e3dac1ceaeafe03dcef1cda27ea4385152ce438ddb946e62887aad4350a4130a8be88a11c41cbd38124baa2b31c6eee7b9bf78b0c8365d4bf807092bb63e96a59cac0bbfe00329f65c911de8b9a98905cc04f9b86de7cc5546c57d272707bc318f6ad46469c908178311c812c274bc7e821dccde6ccad40dc80b417a7c8044182f9df75f8865c59d6847412cb1d92e7c03c340a12ec72ef40ba361d8089d8120498bc042ba89abf0c3b98c103da60806abfcff898cac0e4aa4c54358ad95e60dc47933342b8e8d2d399227ccec6e2baed513d681b050a7769fff1f1e0ba500331192d3178961ffbeb904c19143a0d4e556012d8992d7017e90122108e4894af3c3da61c51ea068aeea3d9061aba1228c73313dae7ee1500e54257726a51e542110cd6915b7a6e2f799c6951912fd409fc81fb4fd0b46bac4b7b672604a720e5f10fb18e258ef065b0d6c8ba3b17d23edd7b8e811d9ab33944314e53531897d3e654de418a3459c3dec3f75641b4910b91cf6f444594a787b82adbc37017962aaaa93eb91a68f1497ddf73f91f78d40367495802b8255ceed78a9e2d7359e126f828bbe3f9b583770f494cbfa4414022ca45b24b5127aff1228d8512b3ad13accf82d44f04a46626e64767b92bde2f74a4baaa84525d14c6c84f08736698b3534bb3797ce3b8b5d91344f100cdecdcc48de103f0494f97769fdbfa13e1dd1bc5de036a972e1969af340ad511d37cfb98a22f26ba1e7f53a01cb01eeea94c749d16b248f0ef5f9bc9412e1cbb167f007bec1f5713a56a5a126c58651c135b3ba60c8f31910b37c92de84c1162b0f0c1b782f2c78b867152226c25029970fbfd307c7988697c0bae8018610b664da69dacf0da9dac0ac12a825b89a82c6092f539ca1a707b86017838ac72dd9edfdf0601c6a2244b4c703da0c9fe623f6d08e32dde27f54612eac4c2a7e95929c81bea3de737b432c2768ad7e3571bcf2010146929678c08d7e1a918323f1eb139ff74fbdeac50bb1bb1e542b79a5f1f71302fb26e7420930aaea6fb5b4c51d390f970739f8fbd9c6966a806835952718a95fee16d39f53fa8e3fea3a2389d0dfe425d8685ae0c0361eefe03eb88306ffb21ddc7d045527963075227493f3cdda59c0761ee541a53f5e9d705c943200d65768231951940dfa9c56635a2a871795610a981161f67dace7b5fa22f0a6cafbb55a00de5290f29759cfc30d6352b1d539314b46390547047811c83d27fe365b822f8beb9c76bf92668f0a41eb4eb395c349ce1cbc56a513ff1bdb3b40398e235f0c50711782059da4ce5ee8792a89d474f47b0a95cb912e0c61408f3e64cac325fefd092b5893e772c4a59abdabd6d73b11ba62888abd19d8f7961431e028ed8c02a1fa51d557b140cfb63223b937e88554386fbc676d8c8678d7e75f969d52d821078ac5b63b751eceda74fc008f6c2dac8b9272f85565748e52131374b40bb01ff1d0959ed00a7d815d44b53416c3e1a9672728ad9a4c687ce2a6641b2936658ef532567d10e0cbbc2ea5aba43fdea424b002299199a1f413c0611accc535661e6779480b685e4281a93ad042c301ca6ee422d1be31da8c94d08f0e513c469d8203b66bc8133dfe34a6db1ef2af9e4b8aee4ce00eb1153708b6d0c83c10e9487ea99710d566588f91fa60fd57659e307a857f9e903a6cb2c6f42038a2c2999347fc42a31b6251e8f562c7a0f5c8a42dffcd0bb2061840fa1ae95e344071df068fad5c0a8f431e315c815e420acd26dded1e0b1d958a1eb51bdc551946b00776b8311bee11c89b38d2a3567cf1321e117b007a0508e363ddcb4c0fe6b9f2906d733e220b3285d48006117604fe885402ffdddb96a04f8b29d1acd7eaa62c29c6dcd04e6a32dd4537d732966c825439ce6dc8ed2d2f43a74b4b24643ad3bde93e923a83a27c8b27e1df4ee3eaeaabaa5a3e86c1590841874e23c061bed741751fa6ece978f8556150af086482db2c950713a1e8f8110872da6f903a0e1ec807066fa33fe1ee094d6c9b63e057e0d272f3e18f0b8e8d814e0e8ab4eb06c7521af83158d80f9028943b75d35773ea78fbcadf8e3547eb20da62b13289c5d7504ad4b8ea6a8271987fd0045cd5ace7d53528d5ab69b2afa242390c97c197d02e2c332e5e368d22332eec1403557fa31b24fbf1c2c6e77f3fd5fd7962e1ba47b5571c0f852bd299f05528836609babc902ea228d6c6adc84b5ecb161a42562deb1556a3fa2eb1ed518f5adf04cf91218fb17efe4b8db6d8be64be0ebf922c0ad42c5bd5f78da469a5617525c02164ca40eb95ca25ac7bf8e200b634f261589ff55bc94c0f1b602913be08ac677596d49b221f86ce15961344bede32566d7fac129124fc45f76608f2d42e09143bdf4efd6d2bb672ccd07b90fe602cfc7dad1c1538905b5ad716f6ecc4d0b7c5852dcac91c89dd542997416bb4280c05e2a8af30157dce96fafd5a281e0f08cb0300000000000005cb783387d08786d42511bcd11db3d26cbc3f190832d4346d9418fd6f5fa7b9adfcc6c88fe5f5e1353cf8413caf6cf73365e249d128cb5f4003d683ece257ea1b3831ebdaea6f11e29a492c9b96bd5084e156f0e67cba4d745c4d2354c90275af17c43b0c06ab37341d1541290569af193a9e7f74f73761653b845f28e6a85b50fc9587cd822dc135a6da565bad5ed3ec30de01cd6206c7aaf760e0f3f75ba627a5bcafb43c90b583511cc2fe61fff0d4394774587c9611c8c2efd3e6e0feece97326a9af3d20526d4f0f9d373b00663a14495ca372deae0fe76758c67077171db3e0577e3ae79019835c6e3fe8c375c6cc22eda3bb63317088bdd44538291fb78e0b06cc028e9f439c6f447c7c0c7801e7b98280f36cea672b05e32fc4fe43ddfb49c16816bd891f735b6b1867900092bd8dee5ccb5bc838a826703d068efa2d7a50022434dafee805da27cec09b41549da9ca6aaaeecbe78e821e61c46c69ba3691f9332089510e0c2d7c5087f761ab3c3af769f81bae8cb4c0316525f72c7601bade5571709a42208339b745f52d87239686dcf50693cbf0626b84fed6359a99f92a609979200a00244cf64a9b56d5d9920d3f0f1c94841473ab747c5f4b7d8b1106d8168a55a3f5ccc40041b6f6798dddcc0a2562e074d2194f88cc062512b60d2b5c59a6d01068865db48fbc86337dddf41687e64f06af58f7915f6e918a5ce067ab82edb99eef35d06669346e161d97fddafa0ca2db23ea6cb1a7327e45d2624a80e120696714481b1cbf20581bf4f1368538cd820e4c3d2588a144e42929fef9a385d760abe1575786bbd524f52ad57921333d684f647a50c4a382a10dcdd0319bf131c3f0f94b533c1597d925f950992c0754f6e6270a9cdcf841a55e7204c9dc5fda50ea85f6fce0d11d2b92584a8c0620d1b19d19a36f1c0e301065b90e70704c07e82e151cfe02424e5a16f18adfa71be6ed7d58247815f8bf4a6d99149f14ea4751b19a559db1de2b79861b0a86fd1078f0912754f5aaa89d07f30f15aa4e38e697874f2875fde7a0f356f1b8da8d622150c8704879541036e42cef2d9231a63c6aa123715658915043cbd2d038e34193b67c8dc31bb165561de23dc6473afa4d7af1eac021a8b10d6d938e2e05bc5e902f50cf6d0e8b93d73d0cfc4c70706cc9e6066aba7d0d4b170bb14c16a2b407b648e869b69d8fafda8cb30031a17cafd38004bea8f6ccd11b8488c74f512508db98eef6dd7a183a5874d46fbb1014610b3ba0d5242a8996f19f55ccb287eabaad73d31c3b8c4f1c187307832b50ecbc3fc4ef660bbdbffd6ca24d3ac17f14cfe6d2b8dccdcedcd9a94f6e9637ab4951c35c675bd0abbf09d16c9ddbc24c0b3948edaed72024a0ba8a5f622fa097d72c229e471a0abaeaf062f757bcd0965e62"}, &(0x7f0000000140)=0xcca) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000100), 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f00000000c0)=ANY=[@ANYBLOB="0f630c4016000000"], 0xfdfdffff00000000, 0x0, 0x0}) r3 = open(&(0x7f0000000040)='./file0\x00', 0x20000, 0x80) write$P9_RREADLINK(r3, &(0x7f0000000080)={0x10, 0x17, 0x1, {0x7, './file0'}}, 0x10) getrandom(&(0x7f0000001280)=""/65, 0x41, 0x0) 03:40:55 executing program 5: r0 = syz_open_dev$sndseq(&(0x7f0000000040)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a85320, &(0x7f0000068f50)={{0x80}, 'por\xff\a\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x1f\x00\x00\xff\xff\xff\xff\xff\xff\xff\xef\x00\x03\x03\xff\x00\x00\x00\x00\x00\x00\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x06\x00', 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2}) 03:40:55 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) 03:40:55 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x4c, 0x0, &(0x7f0000000200)=ANY=[@ANYBLOB="05630440000000000e630c4000f200008c01acbcd9297cf4a76e04ea80b60b5bd6efb41548e724db19f05bcf6e830123c34234a0c43903464dd4e9c503844e734e52e396711327b0a8d8cf15"], 0x0, 0x0, 0x0}) 03:40:55 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f00000000c0)=[@release={0x400c630e}], 0x0, 0x500, 0x0}) [ 938.639137][ T9750] binder: 9749:9750 BC_REQUEST_DEATH_NOTIFICATION invalid ref 61952 [ 938.691535][ T9741] : renamed from bpq0 [ 938.705278][ T9750] binder: 9749:9750 unknown command -368808281 [ 938.707526][ T9757] binder: 9751:9757 BC_CLEAR_DEATH_NOTIFICATION invalid ref 22 [ 938.712326][ T9750] binder: 9749:9750 ioctl c0306201 20000000 returned -22 03:40:55 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) openat$cuse(0xffffffffffffff9c, &(0x7f0000000080)='/dev/cuse\x00', 0x2, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)) r1 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000040)='/dev/ubi_ctrl\x00', 0x200140, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) 03:40:55 executing program 5: r0 = syz_open_dev$sndseq(&(0x7f0000000040)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a85320, &(0x7f0000068f50)={{0x80}, 'por\xff\a\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x1f\x00\x00\xff\xff\xff\xff\xff\xff\xff\xef\x00\x04\x03\xff\x00\x00\x00\x00\x00\x00\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x06\x00', 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2}) [ 938.751810][ T9759] binder: 9758:9759 BC_REQUEST_DEATH_NOTIFICATION death notification already set [ 938.763208][ T9757] binder: 9751:9757 ioctl c0306201 20008fd0 returned -14 03:40:55 executing program 1: r0 = socket$inet6(0xa, 0x5, 0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000180)='/dev/net/tun\x00', 0x0, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000100)={'lo\x00', 0x0}) ioctl$sock_SIOCGIFINDEX(r0, 0x8923, &(0x7f0000000380)={'bpq0\x00\v\x00\xfe\x00\x00\x00\x00\x00\xfa\xff\x00', r2}) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000000)={'bpq0\x00', 0x1212}) getpgid(0xffffffffffffffff) [ 938.834390][ T9767] binder: 9751:9767 ioctl c0306201 20008fd0 returned -14 03:40:55 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x4c, 0x0, &(0x7f0000000200)=ANY=[@ANYBLOB="05630440000000000e630c4000f200008c01acbcd9297cf4a76e04ea80b60b21d6efb44648e724db19f05bcf6e830123c34234a0c43903464dd4e9c503844e734e52e396711327b0a8d8cf15"], 0x0, 0x0, 0x0}) 03:40:55 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f00000000c0)=[@release={0x400c630e}], 0x0, 0x600, 0x0}) 03:40:56 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$media(&(0x7f0000000100)='/dev/media#\x00', 0x0, 0x20000) bind$bt_sco(r1, &(0x7f0000000180)={0x1f, {0x7fffffff, 0x0, 0x200, 0x5, 0x5d, 0x44b}}, 0x8) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) ioctl$KVM_DEASSIGN_DEV_IRQ(r1, 0x4040ae75, &(0x7f0000000340)={0xfffffffffffffffa, 0x7, 0x8, 0x406}) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000000080)=ANY=[@ANYBLOB="2f6d02f96cf313ecc79095be056304553a811e455c6c58f500b530d0fdac167f5b731c7a435b8683aeecaa296a45c9aa016d91994cf784e5b307a4d009a5149379c063082ee1de2cf3b82a7ce46d5fde141cdd167c8592aaf5466696d51edf2f421fb900889df64b896d49180ecd000000"], 0x0, 0x0, 0x0}) r3 = getpgid(0xffffffffffffffff) ioctl$SNDRV_CTL_IOCTL_ELEM_REPLACE(r2, 0xc1105518, &(0x7f0000000200)={{0x2, 0x4, 0x8, 0xdce, 'syz1\x00', 0x1}, 0x4, 0x10000203, 0x8, r3, 0x2, 0x3, 'syz1\x00', &(0x7f0000000040)=['#vboxnet1^lomime_type\\,\x00', '/dev/binder#\x00'], 0x25, [], [0x8, 0x7, 0x435e1277, 0x1]}) 03:40:56 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4), 0xfffffefe, 0x0, 0x0}) r3 = openat$ipvs(0xffffffffffffff9c, &(0x7f0000000080)='/proc/sys/net/ipv4/vs/conn_reuse_mode\x00', 0x2, 0x0) ioctl$EVIOCGABS3F(r3, 0x8018457f, &(0x7f0000000100)=""/62) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f00000000c0)=[@release={0x400c630f}], 0xfdfdffff00000000, 0x0, 0x0}) pwrite64(r1, &(0x7f0000000180)="7469c6a540f07e6c9fc0a7671bc3495122fd61e504e76b98d3f350697ceed893c1757b5c7ca3fd496e1e30c80614b2585e527f4120694c2209e7c30470935a47d102e14116c55427531c0448b16d41b2b7dc8b716edd72808459fb6eac8ddfd39cfac5cd0080c91f48d4b4837d1a6bb13bdd38fa063ea73efac7a4e8bdefc22d332c172fc33359f400847564d237833ad4a5d2", 0x93, 0x0) syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0x0, 0x0) [ 939.021450][ T9774] : renamed from bpq0 03:40:56 executing program 5: r0 = syz_open_dev$sndseq(&(0x7f0000000040)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a85320, &(0x7f0000068f50)={{0x80}, 'por\xff\a\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x1f\x00\x00\xff\xff\xff\xff\xff\xff\xff\xef\x00\x05\x03\xff\x00\x00\x00\x00\x00\x00\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x06\x00', 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2}) [ 939.077836][ T9786] binder: 9785:9786 unknown command -368808281 [ 939.119020][ T9781] binder: 9780:9781 BC_REQUEST_DEATH_NOTIFICATION death notification already set [ 939.122379][ T9786] binder: 9785:9786 ioctl c0306201 20000000 returned -22 [ 939.144940][ T9789] binder: 9783:9789 unknown command -117281489 [ 939.153096][ T9795] binder: 9794:9795 unknown command 0 03:40:56 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) syz_open_dev$mice(&(0x7f0000000180)='/dev/input/mice\x00', 0x0, 0x480000) r2 = syz_open_dev$vcsa(&(0x7f0000000040)='/dev/vcsa#\x00', 0x40, 0x8000) accept4$rose(r2, &(0x7f0000000080)=@full={0xb, @dev, @remote, 0x0, [@null, @remote, @bcast, @netrom, @remote, @rose]}, &(0x7f00000000c0)=0x40, 0x800) timer_create(0x3, &(0x7f0000000300)={0x0, 0x3a, 0x0, @tid=0xffffffffffffffff}, &(0x7f0000000340)=0x0) timer_getoverrun(r3) getsockopt$inet6_IPV6_XFRM_POLICY(r2, 0x29, 0x23, &(0x7f0000000200)={{{@in=@empty, @in=@dev}}, {{@in6=@local}}}, &(0x7f0000000100)=0xe8) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) [ 939.169045][ T9789] binder: 9783:9789 ioctl c0306201 20000000 returned -22 [ 939.178031][ T9795] binder: 9794:9795 ioctl c0306201 20000000 returned -22 [ 939.188355][ T9799] binder: 9780:9799 BC_REQUEST_DEATH_NOTIFICATION death notification already set [ 939.202163][ T9795] binder: 9794:9795 ioctl c0306201 20008fd0 returned -14 03:40:56 executing program 1: r0 = socket$inet6(0xa, 0x5, 0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000180)='/dev/net/tun\x00', 0x0, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000100)={'lo\x00', 0x0}) ioctl$sock_SIOCGIFINDEX(r0, 0x8923, &(0x7f0000000380)={'bpq0\x00\v\x00\xfe\x00\x00\x00\x00\x00\xfa\xff\x00', r2}) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000000)={'bpq0\x00', 0x1212}) getpgid(0xffffffffffffffff) 03:40:56 executing program 5: r0 = syz_open_dev$sndseq(&(0x7f0000000040)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a85320, &(0x7f0000068f50)={{0x80}, 'por\xff\a\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x1f\x00\x00\xff\xff\xff\xff\xff\xff\xff\xef\x00\x06\x03\xff\x00\x00\x00\x00\x00\x00\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x06\x00', 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2}) 03:40:56 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f00000000c0)=[@release={0x400c630e}], 0x0, 0x700, 0x0}) 03:40:56 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x4c, 0x0, &(0x7f0000000200)=ANY=[@ANYBLOB="05630440000000000e630c4000f200008c01acbcd9297cf4a76e04ea80b60b21d6efb45048e724db19f05bcf6e830123c34234a0c43903464dd4e9c503844e734e52e396711327b0a8d8cf15"], 0x0, 0x0, 0x0}) 03:40:56 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) openat$qat_adf_ctl(0xffffffffffffff9c, &(0x7f0000000040)='/dev/qat_adf_ctl\x00', 0x80, 0x0) getsockopt$inet_sctp_SCTP_GET_ASSOC_ID_LIST(0xffffffffffffffff, 0x84, 0x1d, &(0x7f0000000080)={0x2, [0x0, 0x0]}, &(0x7f0000000100)=0xc) accept4(r1, &(0x7f0000000200)=@caif=@dbg, &(0x7f0000000280)=0x80, 0x800) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) syz_open_dev$usbmon(&(0x7f00000002c0)='/dev/usbmon#\x00', 0xaf9, 0x800) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f00000000c0)=[@release={0x400c630f}], 0xfdfdffff00000000, 0x0, 0x0}) 03:40:56 executing program 5: r0 = syz_open_dev$sndseq(&(0x7f0000000040)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a85320, &(0x7f0000068f50)={{0x80}, 'por\xff\a\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x1f\x00\x00\xff\xff\xff\xff\xff\xff\xff\xef\x00\a\x03\xff\x00\x00\x00\x00\x00\x00\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x06\x00', 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2}) 03:40:56 executing program 4: socketpair$tipc(0x1e, 0x2, 0x0, &(0x7f0000000040)) r0 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) [ 939.478748][ T9818] binder: 9816:9818 unknown command -368808281 [ 939.505417][ T9818] binder: 9816:9818 ioctl c0306201 20000000 returned -22 [ 939.508849][ T9820] binder: 9817:9820 BC_REQUEST_DEATH_NOTIFICATION death notification already set [ 939.538843][ T9806] : renamed from bpq0 03:40:56 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x4, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f00000000c0)=[@release={0x400c630f}], 0xfdfdffff00000000, 0x0, 0x0}) 03:40:56 executing program 5: r0 = syz_open_dev$sndseq(&(0x7f0000000040)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a85320, &(0x7f0000068f50)={{0x80}, 'por\xff\a\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x1f\x00\x00\xff\xff\xff\xff\xff\xff\xff\xef\x00\n\x03\xff\x00\x00\x00\x00\x00\x00\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x06\x00', 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2}) 03:40:56 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x4c, 0x0, &(0x7f0000000200)=ANY=[@ANYBLOB="05630440000000000e630c4000f200008c01acbcd9297cf4a76e04ea80b60b21d6efb45b48e724db19f05bcf6e830123c34234a0c43903464dd4e9c503844e734e52e396711327b0a8d8cf15"], 0x0, 0x0, 0x0}) 03:40:56 executing program 1: r0 = socket$inet6(0xa, 0x5, 0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000180)='/dev/net/tun\x00', 0x0, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000100)={'lo\x00', 0x0}) ioctl$sock_SIOCGIFINDEX(r0, 0x8923, &(0x7f0000000380)={'bpq0\x00\v\x00\xfe\x00\x00\x00\x00\x00\xfa\xff\x00', r2}) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000000)={'bpq0\x00', 0x1212}) getpgid(0xffffffffffffffff) 03:40:56 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f00000000c0)=[@release={0x400c630e}], 0x0, 0xa00, 0x0}) 03:40:56 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) accept4(r1, &(0x7f0000000040)=@pppol2tpv3in6={0x18, 0x1, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, {0xa, 0x0, 0x0, @mcast2}}}, &(0x7f00000000c0)=0x80, 0x800) getsockopt$inet_sctp6_SCTP_RTOINFO(0xffffffffffffff9c, 0x84, 0x0, &(0x7f0000000100)={0x0, 0x3, 0x7fff, 0xffffffff}, &(0x7f0000000180)=0x10) setsockopt$inet_sctp6_SCTP_RTOINFO(r2, 0x84, 0x0, &(0x7f0000000200)={r3, 0xa9b, 0x80bc, 0xa}, 0x10) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) [ 939.664540][ T9833] binder: 9831:9833 BC_CLEAR_DEATH_NOTIFICATION death notification not active [ 939.695620][ T9833] binder: 9831:9833 ioctl c0306201 20008fd0 returned -14 [ 939.761095][ T9840] binder: 9836:9840 unknown command -368808281 03:40:56 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = openat$qat_adf_ctl(0xffffffffffffff9c, &(0x7f0000000040)='/dev/qat_adf_ctl\x00', 0x200, 0x0) write$P9_RFLUSH(r1, &(0x7f0000000080)={0x7, 0x6d, 0x1}, 0x7) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f00000000c0)=[@release={0x400c630f}], 0xfdfdffff00000000, 0x0, 0x0}) 03:40:56 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = openat$qat_adf_ctl(0xffffffffffffff9c, &(0x7f0000000100)='/dev/qat_adf_ctl\x00', 0x4000, 0x0) setsockopt$inet6_MCAST_JOIN_GROUP(r1, 0x29, 0x2a, &(0x7f0000000200)={0x8, {{0xa, 0x4e23, 0x3, @ipv4={[], [], @empty}, 0x7b}}}, 0x88) setsockopt$bt_hci_HCI_DATA_DIR(r1, 0x0, 0x1, &(0x7f0000000180)=0x7fffffff, 0x4) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) ioctl$FICLONE(r1, 0x40049409, r1) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) ioctl$UI_SET_PHYS(r2, 0x4008556c, &(0x7f00000000c0)='syz1\x00') r4 = openat$zero(0xffffffffffffff9c, &(0x7f0000000040)='/dev/zero\x00', 0x40000, 0x0) syncfs(r4) ioctl$SIOCX25SDTEFACILITIES(r4, 0x89eb, &(0x7f0000000080)={0x7fffffff, 0x100000001, 0x6, 0x8000, 0x5, 0x1b, 0x14, "a05ed1c919808c34135be4ab1c185150ae40573a", "0d673d0dbd36a7a0fac9a2974a7fcc91b2da2a4e"}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) [ 939.824167][ T9840] binder: 9836:9840 ioctl c0306201 20000000 returned -22 [ 939.853629][ T9848] binder: 9845:9848 BC_REQUEST_DEATH_NOTIFICATION death notification already set 03:40:56 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f00000000c0)=[@release={0x400c630e}], 0x0, 0x2000, 0x0}) 03:40:57 executing program 5: r0 = syz_open_dev$sndseq(&(0x7f0000000040)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a85320, &(0x7f0000068f50)={{0x80}, 'por\xff\a\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x1f\x00\x00\xff\xff\xff\xff\xff\xff\xff\xef\x00H\x03\xff\x00\x00\x00\x00\x00\x00\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x06\x00', 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2}) 03:40:57 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x4c, 0x0, &(0x7f0000000200)=ANY=[@ANYBLOB="05630440000000000e630c4000f200008c01acbcd9297cf4a76e04ea80b60b21d6efb41509e724db19f05bcf6e830123c34234a0c43903464dd4e9c503844e734e52e396711327b0a8d8cf15"], 0x0, 0x0, 0x0}) [ 939.962942][ T9856] binder: 9855:9856 BC_REQUEST_DEATH_NOTIFICATION death notification already set [ 939.990360][ T9847] : renamed from bpq0 [ 940.029902][ T9860] binder: 9857:9860 ioctl c0306201 20008fd0 returned -14 03:40:57 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f00000000c0)=[@release={0x400c630e}], 0x0, 0x4800, 0x0}) 03:40:57 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000040)='/dev/ubi_ctrl\x00', 0x103000, 0x0) ioctl$SCSI_IOCTL_GET_BUS_NUMBER(r1, 0x5386, &(0x7f0000000080)) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=ANY=[@ANYBLOB="f162074000f700000e630c4000000000"], 0x0, 0x0, 0x0}) [ 940.131242][ T9869] binder: 9867:9869 unknown command -368808281 [ 940.149234][ T7288] binder: undelivered death notification, 0000000000000000 03:40:57 executing program 1: r0 = socket$inet6(0xa, 0x5, 0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000180)='/dev/net/tun\x00', 0x0, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000100)={'lo\x00', 0x0}) ioctl$sock_SIOCGIFINDEX(r0, 0x8923, &(0x7f0000000380)={'bpq0\x00\v\x00\xfe\x00\x00\x00\x00\x00\xfa\xff\x00', r2}) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000000)={'bpq0\x00', 0x1212}) getpgid(0xffffffffffffffff) 03:40:57 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="36e125a2d06628450f630c4000000000"], 0xfdfdffff00000000, 0x0, 0x0}) 03:40:57 executing program 5: r0 = syz_open_dev$sndseq(&(0x7f0000000040)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a85320, &(0x7f0000068f50)={{0x80}, 'por\xff\a\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x1f\x00\x00\xff\xff\xff\xff\xff\xff\xff\xef\x00L\x03\xff\x00\x00\x00\x00\x00\x00\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x06\x00', 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2}) [ 940.175028][ T9869] binder: 9867:9869 ioctl c0306201 20000000 returned -22 [ 940.246607][ T9876] binder: 9872:9876 BC_REQUEST_DEATH_NOTIFICATION death notification already set [ 940.286826][ T9882] binder: 9874:9882 unknown command 1074225905 [ 940.292297][ T9880] binder: 9879:9880 unknown command -1574575818 [ 940.313531][ T9882] binder: 9874:9882 ioctl c0306201 20000000 returned -22 03:40:57 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f00000000c0)=[@release={0x400c630e}], 0x0, 0x4c00, 0x0}) [ 940.349011][ T9880] binder: 9879:9880 ioctl c0306201 20008fd0 returned -22 03:40:57 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x4c, 0x0, &(0x7f0000000200)=ANY=[@ANYBLOB="05630440000000000e630c4000f200008c01acbcd9297cf4a76e04ea80b60b21d6efb4150ae724db19f05bcf6e830123c34234a0c43903464dd4e9c503844e734e52e396711327b0a8d8cf15"], 0x0, 0x0, 0x0}) 03:40:57 executing program 5: r0 = syz_open_dev$sndseq(&(0x7f0000000040)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a85320, &(0x7f0000068f50)={{0x80}, 'por\xff\a\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x1f\x00\x00\xff\xff\xff\xff\xff\xff\xff\xef\x00h\x03\xff\x00\x00\x00\x00\x00\x00\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x06\x00', 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2}) 03:40:57 executing program 4: r0 = socket$inet6(0xa, 0x100000002, 0x0) connect$inet6(r0, &(0x7f0000000100)={0xa, 0x0, 0x0, @local, 0x3}, 0x1c) sendto$inet6(r0, 0x0, 0x0, 0x400806e, &(0x7f00000000c0)={0xa, 0x4e23, 0x0, @ipv4={[], [], @multicast2}}, 0x1c) sendto$inet6(r0, 0x0, 0x0, 0x0, 0x0, 0x0) r1 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000001c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x9) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) [ 940.406181][ T9881] : renamed from bpq0 [ 940.487317][ T9895] binder: 9894:9895 BC_REQUEST_DEATH_NOTIFICATION death notification already set 03:40:57 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = getpid() migrate_pages(r2, 0x3f, &(0x7f0000000080)=0x6, &(0x7f00000000c0)=0x7) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008fd0)={0x4, 0x0, &(0x7f0000000040)=[@enter_looper], 0x0, 0x0, 0x0}) 03:40:57 executing program 1: r0 = socket$inet6(0xa, 0x5, 0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000180)='/dev/net/tun\x00', 0x0, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000100)={'lo\x00', 0x0}) ioctl$sock_SIOCGIFINDEX(r0, 0x8923, &(0x7f0000000380)={'bpq0\x00\v\x00\xfe\x00\x00\x00\x00\x00\xfa\xff\x00', r2}) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000000)={'bpq0\x00', 0x1212}) getpgid(0xffffffffffffffff) 03:40:57 executing program 5: r0 = syz_open_dev$sndseq(&(0x7f0000000040)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a85320, &(0x7f0000068f50)={{0x80}, 'por\xff\a\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x1f\x00\x00\xff\xff\xff\xff\xff\xff\xff\xef\x00l\x03\xff\x00\x00\x00\x00\x00\x00\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x06\x00', 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2}) [ 940.576674][ T9900] binder: 9899:9900 unknown command -368808281 [ 940.612040][ T9900] binder: 9899:9900 ioctl c0306201 20000000 returned -22 03:40:57 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f00000000c0)=[@release={0x400c630e}], 0x0, 0x6000, 0x0}) 03:40:57 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0xc, 0x0, &(0x7f0000005fd4)=[@acquire, @register_looper], 0x0, 0x0, 0x0}) 03:40:57 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x4c, 0x0, &(0x7f0000000200)=ANY=[@ANYBLOB="05630440000000000e630c4000f200008c01acbcd9297cf4a76e04ea80b60b21d6efb41550e724db19f05bcf6e830123c34234a0c43903464dd4e9c503844e734e52e396711327b0a8d8cf15"], 0x0, 0x0, 0x0}) 03:40:57 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000005fd4), 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f00000000c0)=[@release={0x400c630f}], 0xfdfdffff00000000, 0x0, 0x0}) ioctl$EXT4_IOC_GROUP_ADD(r1, 0x40286608, &(0x7f0000000040)={0xb7e, 0x7, 0x80000001, 0x6, 0x6, 0xfffffffffffffffa}) [ 940.774128][ T9920] binder: 9914:9920 BC_REQUEST_DEATH_NOTIFICATION death notification already set [ 940.806863][ T9919] binder: 9917:9919 ERROR: BC_REGISTER_LOOPER called without request 03:40:57 executing program 5: r0 = syz_open_dev$sndseq(&(0x7f0000000040)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a85320, &(0x7f0000068f50)={{0x80}, 'por\xff\a\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x1f\x00\x00\xff\xff\xff\xff\xff\xff\xff\xef\x00t\x03\xff\x00\x00\x00\x00\x00\x00\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x06\x00', 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2}) 03:40:57 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f00000000c0)=[@release={0x400c630e}], 0x0, 0x6800, 0x0}) [ 940.889289][ T9910] : renamed from bpq0 03:40:57 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socket$inet6_icmp_raw(0xa, 0x3, 0x3a) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x408200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) [ 940.927443][ T9928] binder: 9926:9928 ioctl c0306201 20008fd0 returned -14 [ 940.942844][ T9925] binder: 9924:9925 unknown command -368808281 [ 940.985463][ T9925] binder: 9924:9925 ioctl c0306201 20000000 returned -22 03:40:58 executing program 3: r0 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) r1 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000040)='cpuacct.usage_percpu_user\x00', 0x0, 0x0) sendfile(r0, r1, &(0x7f00000001c0), 0x8000) r2 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) ioctl$VHOST_VSOCK_SET_RUNNING(r1, 0x4004af61, &(0x7f0000000100)) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=ANY=[@ANYBLOB="0563040101da23f7c30000"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f00000000c0)=[@release={0x400c630f}], 0xfdfdffff00000000, 0x0, 0x0}) syz_init_net_socket$netrom(0x6, 0x5, 0x0) syz_open_dev$dmmidi(&(0x7f0000000180)='/dev/dmmidi#\x00', 0xc45, 0x0) prctl$PR_SET_TSC(0x1a, 0x3) 03:40:58 executing program 1: r0 = socket$inet6(0xa, 0x5, 0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000180)='/dev/net/tun\x00', 0x0, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000100)={'lo\x00', 0x0}) ioctl$sock_SIOCGIFINDEX(r0, 0x8923, &(0x7f0000000380)={'bpq0\x00\v\x00\xfe\x00\x00\x00\x00\x00\xfa\xff\x00', r2}) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000000)={'bpq0\x00', 0x1212}) getpgid(0xffffffffffffffff) 03:40:58 executing program 5: r0 = syz_open_dev$sndseq(&(0x7f0000000040)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a85320, &(0x7f0000068f50)={{0x80}, 'por\xff\a\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x1f\x00\x00\xff\xff\xff\xff\xff\xff\xff\xef\x00z\x03\xff\x00\x00\x00\x00\x00\x00\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x06\x00', 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2}) 03:40:58 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0xffffffcb, 0x0, 0x0, 0x0, 0x0, 0x0}) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BLKALIGNOFF(r1, 0x127a, &(0x7f0000000040)) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) prctl$PR_GET_PDEATHSIG(0x2, &(0x7f0000000080)) 03:40:58 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x4c, 0x0, &(0x7f0000000200)=ANY=[@ANYBLOB="05630440000000000e630c4000f200008c01acbcd9297cf4a76e04ea80b60b21d6efb4155be724db19f05bcf6e830123c34234a0c43903464dd4e9c503844e734e52e396711327b0a8d8cf15"], 0x0, 0x0, 0x0}) 03:40:58 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f00000000c0)=[@release={0x400c630e}], 0x0, 0x6c00, 0x0}) [ 941.189038][ T9946] binder: 9945:9946 unknown command 17064709 03:40:58 executing program 5: r0 = syz_open_dev$sndseq(&(0x7f0000000040)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a85320, &(0x7f0000068f50)={{0x80}, 'por\xff\a\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x1f\x00\x00\xff\xff\xff\xff\xff\xff\xff\xef\x00\xfd\x03\xff\x00\x00\x00\x00\x00\x00\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x06\x00', 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2}) [ 941.254635][ T9946] binder: 9945:9946 ioctl c0306201 20000000 returned -22 [ 941.284919][ T9954] binder: 9952:9954 ioctl c0306201 20000100 returned -14 [ 941.319212][ T9956] binder_thread_write: 9 callbacks suppressed [ 941.319225][ T9956] binder: 9945:9956 BC_CLEAR_DEATH_NOTIFICATION invalid ref 0 [ 941.355569][ T9959] binder: 9958:9959 BC_REQUEST_DEATH_NOTIFICATION invalid ref 61952 03:40:58 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f00000000c0)=[@release={0x400c630e}], 0x0, 0x7400, 0x0}) 03:40:58 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$radio(&(0x7f0000000180)='/dev/radio#\x00', 0x0, 0x2) ioctl$KVM_SET_CLOCK(r1, 0x4030ae7b, &(0x7f00000001c0)={0x7, 0x7}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000080)={0xffffffffffffffb2, 0x0, 0x0, 0xffffffffffffff61, 0x0, 0x0}) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) syz_open_dev$sndtimer(&(0x7f0000000040)='/dev/snd/timer\x00', 0x0, 0x2) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=ANY=[@ANYBLOB="0563044000000000000000eeec000000"], 0x0, 0x0, 0x0}) ioctl$sock_FIOGETOWN(r2, 0x8903, &(0x7f0000000340)=0x0) timer_create(0x8005, &(0x7f0000000380)={0x0, 0x3d, 0x2, @tid=r4}, &(0x7f00000002c0)=0x0) timer_gettime(r5, &(0x7f0000000300)) ioctl$PPPIOCSDEBUG(0xffffffffffffffff, 0x40047440, &(0x7f0000000100)=0x2) ioctl$sock_proto_private(r2, 0x89e5, &(0x7f00000000c0)="d8c97102f39c3641510b2907ee4bef15b85464f8cd0f493a0417b88c85ee720d65b6881544e906030ba6e89775fc73") r6 = msgget(0x3, 0x40) msgsnd(r6, &(0x7f00000003c0)={0x1, "51d36824f7a413a8bd98f64b05edf74322e39396a2be8713f46d2567920a482504cea4c363f920bd1f0c233173a83a41bd3e2f4dfe59d1c4664c3fc0817697f16a30021f3622f3074180b2ea767b39aec05960c6c7bafbe6785f36b9ac153dea7bcd5e55f3f78427611a640f7a4aedd05e987371a35463a6498b795fbdc88bc91783f9da9e8430c5241a19a9034bf5b8a64969d007f6fc51e2e1621eb4cd0dd534b5dc83793454ea1e4576f1d8505b4d133419c53cca88825a995a880b6ebc9309ed9c844219ad031b333647c476462bbce2307c8db383bc8e3b89c70587"}, 0xe6, 0x0) [ 941.363679][ T9959] binder: 9958:9959 unknown command -368808281 [ 941.370541][ T9956] binder: 9945:9956 ioctl c0306201 20008fd0 returned -14 [ 941.375443][ T9951] : renamed from bpq0 [ 941.404332][ T9959] binder: 9958:9959 ioctl c0306201 20000000 returned -22 03:40:58 executing program 3: r0 = syz_open_dev$swradio(&(0x7f0000000100)='/dev/swradio#\x00', 0xffffffffffffffff, 0x2) ioctl$VIDIOC_G_CTRL(r0, 0xc008561b, &(0x7f0000000000)={0xf0f027}) r1 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) r3 = mmap$binder(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x2000000, 0x10, r1, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r1, 0xc018620b, &(0x7f0000000040)={0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000100)={0x54, 0x0, &(0x7f0000000200)=[@acquire, @reply_sg={0x40486312, {{0x0, 0x0, 0x3, 0x0, 0x10, 0x0, 0x0, 0x48, 0x20, &(0x7f0000000180)=[@flat={0x776a2a85, 0x1, r3, 0x2}, @fd={0x66642a85, 0x0, r2, 0x0, 0x3}, @flat={0x73682a85, 0x100, r4, 0x1}], &(0x7f0000000080)=[0x68, 0x38, 0x0, 0x38]}, 0xfffffffffffffff9}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f00000000c0)=[@release={0x400c630f}], 0xfdfdffff00000000, 0x0, 0x0}) r5 = syz_genetlink_get_family_id$tipc2(&(0x7f00000002c0)='TIPCv2\x00') sendmsg$TIPC_NL_LINK_RESET_STATS(r0, &(0x7f00000003c0)={&(0x7f0000000280), 0xc, &(0x7f0000000380)={&(0x7f0000000300)={0x44, r5, 0x205, 0x70bd2a, 0x25dfdbfc, {}, [@TIPC_NLA_SOCK={0x30, 0x2, [@TIPC_NLA_SOCK_HAS_PUBL={0x4}, @TIPC_NLA_SOCK_HAS_PUBL={0x4}, @TIPC_NLA_SOCK_HAS_PUBL={0x4}, @TIPC_NLA_SOCK_HAS_PUBL={0x4}, @TIPC_NLA_SOCK_ADDR={0x8, 0x1, 0xd25}, @TIPC_NLA_SOCK_ADDR={0x8, 0x1, 0x6}, @TIPC_NLA_SOCK_HAS_PUBL={0x4}, @TIPC_NLA_SOCK_ADDR={0x8, 0x1, 0x1a}]}]}, 0x44}, 0x1, 0x0, 0x0, 0x4}, 0x4040) 03:40:58 executing program 5: r0 = syz_open_dev$sndseq(&(0x7f0000000040)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a85320, &(0x7f0000068f50)={{0x80}, 'por\xff\a\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x1f\x00\x00\xff\xff\xff\xff\xff\xff\xff\xef\x00\x00\x03\xff\x02\x00\x00\x00\x00\x00\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x06\x00', 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2}) [ 941.566292][ T9973] binder: 9972:9973 ioctl c0306201 20000080 returned -14 03:40:58 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x4c, 0x0, &(0x7f0000000200)=ANY=[@ANYBLOB="05630440000000000e630c4000f200008c01acbcd9297cf4a76e04ea80b60b21d6efb41548e746db19f05bcf6e830123c34234a0c43903464dd4e9c503844e734e52e396711327b0a8d8cf15"], 0x0, 0x0, 0x0}) 03:40:58 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f00000000c0)=[@release={0x400c630e}], 0x0, 0x7a00, 0x0}) [ 941.618612][ T9979] binder: 9978:9979 got reply transaction with no transaction stack 03:40:58 executing program 1: r0 = socket$inet6(0xa, 0x5, 0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000180)='/dev/net/tun\x00', 0x0, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000100)={'lo\x00', 0x0}) ioctl$sock_SIOCGIFINDEX(r0, 0x8923, &(0x7f0000000380)={'bpq0\x00\v\x00\xfe\x00\x00\x00\x00\x00\xfa\xff\x00', r2}) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000000)={'bpq0\x00', 0x1212}) getpgid(0xffffffffffffffff) [ 941.675879][ T9979] binder: 9978:9979 transaction failed 29201/-71, size 72-32 line 2801 03:40:58 executing program 5: r0 = syz_open_dev$sndseq(&(0x7f0000000040)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a85320, &(0x7f0000068f50)={{0x80}, 'por\xff\a\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x1f\x00\x00\xff\xff\xff\xff\xff\xff\xff\xef\x00\x00\x03\xff\x03\x00\x00\x00\x00\x00\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x06\x00', 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2}) 03:40:58 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) r2 = openat$vfio(0xffffffffffffff9c, &(0x7f0000000040)='/dev/vfio/vfio\x00', 0x100, 0x0) ioctl$NBD_SET_SIZE(r2, 0xab02, 0x95) [ 941.724660][ T9984] binder: 9978:9984 BC_CLEAR_DEATH_NOTIFICATION death notification not active [ 941.756870][ T9984] binder: 9978:9984 ioctl c0306201 20008fd0 returned -14 [ 941.823280][ T9995] binder: 9986:9995 BC_REQUEST_DEATH_NOTIFICATION invalid ref 61952 03:40:58 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f00000000c0)=[@release={0x400c630e}], 0x0, 0x1000000, 0x0}) 03:40:58 executing program 5: r0 = syz_open_dev$sndseq(&(0x7f0000000040)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a85320, &(0x7f0000068f50)={{0x80}, 'por\xff\a\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x1f\x00\x00\xff\xff\xff\xff\xff\xff\xff\xef\x00\x00\x03\xff\x04\x00\x00\x00\x00\x00\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x06\x00', 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2}) 03:40:58 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)) r1 = syz_open_dev$midi(&(0x7f0000000040)='/dev/midi#\x00', 0x0, 0x101000) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x401) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) r2 = syz_open_dev$vcsa(&(0x7f0000000100)='/dev/vcsa#\x00', 0x23, 0x1fe) ioctl$RTC_IRQP_READ(r2, 0x8008700b, &(0x7f0000000080)) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f00000000c0)=[@release={0x400c630f}], 0xfdfdffff00000000, 0x0, 0x0}) [ 941.880038][ T9995] binder: 9986:9995 unknown command -368808281 [ 941.914417][ T7288] binder: undelivered TRANSACTION_ERROR: 29201 [ 941.921073][ T9992] : renamed from bpq0 [ 941.955193][ T9995] binder: 9986:9995 ioctl c0306201 20000000 returned -22 03:40:59 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x0, 0x0, 0x0, 0xfffffffffffffeb0, 0x0, 0x0}) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0x18e3, 0x0, &(0x7f00000000c0)=ANY=[@ANYBLOB="4506044000000000c73a0000ff010000000000009986a708ca0c71f57a1068f6d6112f91ed423fe3f319f69bec7d8171fe8a063c"], 0x4a, 0x0, 0x0}) symlink(&(0x7f0000000000)='./file0\x00', &(0x7f0000000080)='./file0\x00') r2 = syz_open_dev$sndpcmc(&(0x7f00000001c0)='/dev/snd/pcmC#D#c\x00', 0x9, 0x2000) r3 = syz_genetlink_get_family_id$tipc(&(0x7f0000000240)='TIPC\x00') sendmsg$TIPC_CMD_SHOW_NAME_TABLE(r2, &(0x7f0000000300)={&(0x7f0000000200)={0x10, 0x0, 0x0, 0x20008}, 0xc, &(0x7f00000002c0)={&(0x7f0000000280)={0x30, r3, 0x310, 0x70bd29, 0x25dfdbfe, {{}, 0x0, 0x5, 0x0, {0x14, 0x19, {0x2, 0x10001, 0x1, 0xd5}}}, ["", ""]}, 0x30}, 0x1, 0x0, 0x0, 0x44810}, 0x10) ioctl$KDSETKEYCODE(r2, 0x4b4d, &(0x7f0000000180)={0x100000000, 0x6}) 03:40:59 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x4c, 0x0, &(0x7f0000000200)=ANY=[@ANYBLOB="05630440000000000e630c4000f200008c01acbcd9297cf4a76e04ea80b60b21d6efb41548e750db19f05bcf6e830123c34234a0c43903464dd4e9c503844e734e52e396711327b0a8d8cf15"], 0x0, 0x0, 0x0}) [ 942.052138][T10011] binder: 10008:10011 ioctl c0306201 20008fd0 returned -14 03:40:59 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f00000000c0)=[@release={0x400c630e}], 0x0, 0x2000000, 0x0}) 03:40:59 executing program 5: r0 = syz_open_dev$sndseq(&(0x7f0000000040)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a85320, &(0x7f0000068f50)={{0x80}, 'por\xff\a\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x1f\x00\x00\xff\xff\xff\xff\xff\xff\xff\xef\x00\x00\x03\xff\x05\x00\x00\x00\x00\x00\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x06\x00', 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2}) [ 942.133184][ T7288] binder: undelivered death notification, 0000000000000000 03:40:59 executing program 1: r0 = socket$inet6(0xa, 0x5, 0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000180)='/dev/net/tun\x00', 0x0, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000100)={'lo\x00', 0x0}) ioctl$sock_SIOCGIFINDEX(r0, 0x8923, &(0x7f0000000380)={'bpq0\x00\v\x00\xfe\x00\x00\x00\x00\x00\xfa\xff\x00', r2}) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000000)={'bpq0\x00', 0x1212}) getpgid(0xffffffffffffffff) 03:40:59 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = syz_open_dev$sndpcmc(&(0x7f0000000040)='/dev/snd/pcmC#D#c\x00', 0x4, 0x80) ioctl$KVM_ARM_SET_DEVICE_ADDR(r2, 0x4010aeab, &(0x7f0000000080)={0x5, 0x1}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x18, 0x0, &(0x7f0000000100)=[@acquire, @request_death={0x400c630e, 0x4, 0x4}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f00000000c0)=[@release={0x400c630f}], 0xfdfdffff00000000, 0x0, 0x0}) [ 942.206145][T10025] binder: 10016:10025 ioctl c0306201 20000040 returned -14 [ 942.253639][T10024] binder: 10021:10024 BC_REQUEST_DEATH_NOTIFICATION invalid ref 61952 [ 942.284163][T10025] binder: 10016:10025 unknown command 1074005573 [ 942.296126][T10024] binder: 10021:10024 unknown command -368808281 03:40:59 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f00000000c0)=[@release={0x400c630e}], 0x0, 0x3000000, 0x0}) 03:40:59 executing program 5: r0 = syz_open_dev$sndseq(&(0x7f0000000040)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a85320, &(0x7f0000068f50)={{0x80}, 'por\xff\a\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x1f\x00\x00\xff\xff\xff\xff\xff\xff\xff\xef\x00\x00\x03\xff\x06\x00\x00\x00\x00\x00\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x06\x00', 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2}) [ 942.316683][T10024] binder: 10021:10024 ioctl c0306201 20000000 returned -22 [ 942.338105][T10025] binder: 10016:10025 ioctl c0306201 20000100 returned -22 03:40:59 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x4c, 0x0, &(0x7f0000000200)=ANY=[@ANYBLOB="05630440000000000e630c4000f200008c01acbcd9297cf4a76e04ea80b60b21d6efb41548e75bdb19f05bcf6e830123c34234a0c43903464dd4e9c503844e734e52e396711327b0a8d8cf15"], 0x0, 0x0, 0x0}) 03:40:59 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0xffffffffffffffa5, 0x0, 0x0, 0x0, 0x0, 0x0}) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) 03:40:59 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=ANY=[@ANYBLOB="05630c40e6fffddd0010000000000000"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f00000000c0)=[@release={0x400c630f}], 0xfdfdffff00000000, 0x0, 0x0}) [ 942.450029][T10032] : renamed from bpq0 [ 942.568186][T10049] binder: 10048:10049 BC_REQUEST_DEATH_NOTIFICATION invalid ref 61952 [ 942.597732][T10051] binder: 10050:10051 ioctl c0306201 20000040 returned -14 03:40:59 executing program 5: r0 = syz_open_dev$sndseq(&(0x7f0000000040)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a85320, &(0x7f0000068f50)={{0x80}, 'por\xff\a\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x1f\x00\x00\xff\xff\xff\xff\xff\xff\xff\xef\x00\x00\x03\xff\a\x00\x00\x00\x00\x00\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x06\x00', 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2}) 03:40:59 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f00000000c0)=[@release={0x400c630e}], 0x0, 0x4000000, 0x0}) [ 942.613828][T10054] binder: 10053:10054 unknown command 1074553605 [ 942.620602][T10049] binder: 10048:10049 unknown command -368808281 [ 942.638568][T10054] binder: 10053:10054 ioctl c0306201 20000000 returned -22 03:40:59 executing program 1: r0 = socket$inet6(0xa, 0x5, 0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000180)='/dev/net/tun\x00', 0x0, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000100)={'lo\x00', 0x0}) ioctl$sock_SIOCGIFINDEX(r0, 0x8923, &(0x7f0000000380)={'bpq0\x00\v\x00\xfe\x00\x00\x00\x00\x00\xfa\xff\x00', r2}) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000000)={'bpq0\x00', 0x1212}) getpgid(0xffffffffffffffff) 03:40:59 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000000500)='/dev/binder#\x00', 0x0, 0x0) r1 = openat$rfkill(0xffffffffffffff9c, &(0x7f0000000080)='/dev/rfkill\x00', 0x4800, 0x0) ioctl$VIDIOC_QUERYMENU(r1, 0xc02c5625, &(0x7f00000000c0)={0x100, 0x6, @value=0x747}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) pipe2(&(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) setsockopt$inet_sctp6_SCTP_HMAC_IDENT(r2, 0x84, 0x16, &(0x7f0000000180)={0x2, [0x123, 0x7]}, 0x8) r3 = syz_genetlink_get_family_id$tipc2(&(0x7f0000000240)='TIPCv2\x00') sendmsg$TIPC_NL_BEARER_GET(r1, &(0x7f00000004c0)={&(0x7f0000000200)={0x10, 0x0, 0x0, 0x40000000}, 0xc, &(0x7f0000000480)={&(0x7f0000000280)={0x1cc, r3, 0x800, 0x70bd26, 0x25dfdbfe, {}, [@TIPC_NLA_SOCK={0x3c, 0x2, [@TIPC_NLA_SOCK_REF={0x8, 0x2, 0x20}, @TIPC_NLA_SOCK_ADDR={0x8, 0x1, 0x100000001}, @TIPC_NLA_SOCK_REF={0x8, 0x2, 0xfffffffffffffffc}, @TIPC_NLA_SOCK_REF={0x8, 0x2, 0x7}, @TIPC_NLA_SOCK_ADDR={0x8, 0x1, 0xffffffff00000}, @TIPC_NLA_SOCK_REF={0x8, 0x2, 0x1}, @TIPC_NLA_SOCK_REF={0x8, 0x2, 0x80000000}]}, @TIPC_NLA_MEDIA={0x58, 0x5, [@TIPC_NLA_MEDIA_PROP={0x54, 0x2, [@TIPC_NLA_PROP_TOL={0x8, 0x2, 0x3fff80}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x5c5}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x6}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x1000}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0xfffffffffffffffa}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x4}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0xff}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x1}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0xffff}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x9}]}]}, @TIPC_NLA_LINK={0x48, 0x4, [@TIPC_NLA_LINK_PROP={0x2c, 0x7, [@TIPC_NLA_PROP_WIN={0x8, 0x3, 0x4}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x9}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0xf}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0xfffffffffffffff8}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x208}]}, @TIPC_NLA_LINK_PROP={0xc, 0x7, [@TIPC_NLA_PROP_MTU={0x8}]}, @TIPC_NLA_LINK_NAME={0xc, 0x1, 'syz1\x00'}]}, @TIPC_NLA_MON={0x24, 0x9, [@TIPC_NLA_MON_REF={0x8, 0x2, 0x5}, @TIPC_NLA_MON_ACTIVATION_THRESHOLD={0x8, 0x1, 0xb41}, @TIPC_NLA_MON_REF={0x8, 0x2, 0x9}, @TIPC_NLA_MON_REF={0x8, 0x2, 0x6}]}, @TIPC_NLA_LINK={0x98, 0x4, [@TIPC_NLA_LINK_PROP={0x2c, 0x7, [@TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x8}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x400}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x50}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x658}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0xffff}]}, @TIPC_NLA_LINK_NAME={0x14, 0x1, 'broadcast-link\x00'}, @TIPC_NLA_LINK_NAME={0xc, 0x1, 'syz1\x00'}, @TIPC_NLA_LINK_PROP={0x1c, 0x7, [@TIPC_NLA_PROP_WIN={0x8, 0x3, 0x4}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x3}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x1}]}, @TIPC_NLA_LINK_NAME={0xc, 0x1, 'syz1\x00'}, @TIPC_NLA_LINK_NAME={0xc, 0x1, 'syz0\x00'}, @TIPC_NLA_LINK_PROP={0x14, 0x7, [@TIPC_NLA_PROP_WIN={0x8, 0x3, 0x44c}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x20}]}]}, @TIPC_NLA_SOCK={0x8, 0x2, [@TIPC_NLA_SOCK_HAS_PUBL={0x4}]}, @TIPC_NLA_NET={0x18, 0x7, [@TIPC_NLA_NET_NODEID={0xc, 0x3, 0x40}, @TIPC_NLA_NET_ADDR={0x8, 0x2, 0x3f}]}]}, 0x1cc}, 0x1, 0x0, 0x0, 0x1}, 0x4000081) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) [ 942.685213][T10049] binder: 10048:10049 ioctl c0306201 20000000 returned -22 [ 942.703980][T10061] binder: 10053:10061 BC_CLEAR_DEATH_NOTIFICATION invalid ref 0 03:40:59 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f00000000c0)=[@release={0x400c630e}], 0x0, 0x5000000, 0x0}) 03:40:59 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x4c, 0x0, &(0x7f0000000200)=ANY=[@ANYBLOB="05630440000000000e630c4000f200008c01acbcd9297cf4a76e04ea80b60b21d6efb41548e724db46f05bcf6e830123c34234a0c43903464dd4e9c503844e734e52e396711327b0a8d8cf15"], 0x0, 0x0, 0x0}) [ 942.801251][T10061] binder: 10053:10061 ioctl c0306201 20008fd0 returned -14 03:40:59 executing program 5: r0 = syz_open_dev$sndseq(&(0x7f0000000040)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a85320, &(0x7f0000068f50)={{0x80}, 'por\xff\a\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x1f\x00\x00\xff\xff\xff\xff\xff\xff\xff\xef\x00\x00\x03\xff\n\x00\x00\x00\x00\x00\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x06\x00', 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2}) 03:41:00 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff}) openat(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x4000, 0x1ce) dup(r1) openat$proc_capi20ncci(0xffffffffffffff9c, &(0x7f0000000080)='/proc/capi/capi20ncci\x00', 0x109000, 0x0) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000180)={0x0, 0xffffffffffffffff, 0x0, 0xd, &(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff}, 0x30) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x20) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f00000000c0)=[@release={0x400c630f}], 0xfdfdffff00000000, 0x0, 0x0}) [ 942.902574][T10076] binder: 10072:10076 BC_REQUEST_DEATH_NOTIFICATION invalid ref 61952 [ 942.921972][T10075] binder: 10071:10075 Acquire 1 refcount change on invalid ref 0 ret -22 [ 942.967533][T10067] : renamed from bpq0 [ 942.967542][T10076] binder: 10072:10076 unknown command -368808281 [ 942.967564][T10076] binder: 10072:10076 ioctl c0306201 20000000 returned -22 [ 942.984304][T10075] binder: 10071:10075 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 03:41:00 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="05f967d2824343adb00d67bd43c64289cb9568587e25d7f0593cec2bc976b1694cc8983761ffd8189999e36598dc0fbf4772fe867c410039acd59cf76c80552893435c9ce587126b2bee78c78c6d19f33c2fd56dcd88bb97498a737be3569342e6154e3aeb1a7c3f823cecc402f9d9b9"], 0x0, 0x0, 0x0}) [ 943.056505][T10085] binder: 10082:10085 ioctl c0306201 20008fd0 returned -14 03:41:00 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x4c, 0x0, &(0x7f0000000200)=ANY=[@ANYBLOB="05630440000000000e630c4000f200008c01acbcd9297cf4a76e04ea80b60b21d6efb41548e724db50f05bcf6e830123c34234a0c43903464dd4e9c503844e734e52e396711327b0a8d8cf15"], 0x0, 0x0, 0x0}) 03:41:00 executing program 5: r0 = syz_open_dev$sndseq(&(0x7f0000000040)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a85320, &(0x7f0000068f50)={{0x80}, 'por\xff\a\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x1f\x00\x00\xff\xff\xff\xff\xff\xff\xff\xef\x00\x00\x03\xffH\x00\x00\x00\x00\x00\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x06\x00', 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2}) [ 943.124541][T10089] binder: 10082:10089 ioctl c0306201 20008fd0 returned -14 03:41:00 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f00000000c0)=[@release={0x400c630e}], 0x0, 0x6000000, 0x0}) [ 943.172593][T10090] binder: 10088:10090 unknown command -764937979 [ 943.186319][T24007] binder: undelivered death notification, 0000000000000000 [ 943.206673][T24007] binder: undelivered death notification, 0000000000000000 03:41:00 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) getsockopt$inet6_IPV6_IPSEC_POLICY(0xffffffffffffff9c, 0x29, 0x22, &(0x7f0000000280)={{{@in6=@loopback, @in6=@mcast1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{}, 0x0, @in=@multicast1}}, &(0x7f0000000380)=0xe8) r3 = add_key$keyring(&(0x7f00000003c0)='keyring\x00', &(0x7f0000000400)={'syz', 0x3}, 0x0, 0x0, 0xfffffffffffffffe) keyctl$get_persistent(0x16, r2, r3) r4 = openat$qat_adf_ctl(0xffffffffffffff9c, &(0x7f0000000040)='/dev/qat_adf_ctl\x00', 0x1, 0x0) getsockopt$inet_sctp_SCTP_I_WANT_MAPPED_V4_ADDR(r4, 0x84, 0xc, &(0x7f0000000080), &(0x7f0000000100)=0x4) ioctl$PPPIOCATTCHAN(r4, 0x40047438, &(0x7f0000000180)=0x3) getrusage(0x1, &(0x7f00000001c0)) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$VIDIOC_ENUM_FREQ_BANDS(r4, 0xc0405665, &(0x7f0000000440)={0xffffffff80000000, 0x0, 0x2, 0x381, 0x558f, 0x3, 0x8}) syz_extract_tcp_res$synack(&(0x7f0000000480), 0x1, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f00000000c0)=[@release={0x400c630f}], 0xfdfdffff00000000, 0x0, 0x0}) setsockopt$inet_tcp_TCP_QUEUE_SEQ(r4, 0x6, 0x15, &(0x7f00000004c0)=0x6, 0x4) [ 943.244738][T10090] binder: 10088:10090 ioctl c0306201 20000000 returned -22 [ 943.281391][T10097] binder: 10096:10097 BC_REQUEST_DEATH_NOTIFICATION invalid ref 61952 03:41:00 executing program 1: r0 = socket$inet6(0xa, 0x5, 0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000180)='/dev/net/tun\x00', 0x0, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000100)={'lo\x00', 0x0}) ioctl$sock_SIOCGIFINDEX(r0, 0x8923, &(0x7f0000000380)={'bpq0\x00\v\x00\xfe\x00\x00\x00\x00\x00\xfa\xff\x00', r2}) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000000)={'bpq0\x00', 0x1212}) getpgid(0xffffffffffffffff) 03:41:00 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) r3 = openat$full(0xffffffffffffff9c, &(0x7f0000000040)='/dev/full\x00', 0x440, 0x0) epoll_ctl$EPOLL_CTL_DEL(r3, 0x2, r1) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000000200)=ANY=[@ANYBLOB="05630440000000000e630c400000000075249649b92244768cfbfe05ab753db3d7b5fb74633c88592e0cebbdbf6d54ec904bd2af2cc6bfc3a04070366a360d8718834336074dec33f006589ac6d46d9a63fe1f03c12611a939a09256ddb974a8e43c29dde6a59c6ef730d49f2b0f4d6ce42e942b80000000914c3eb6e405bbdc350e09099469e6a74063bdc86722b054d95ece7aa13bbdfd81ff58b88e42f00691708edb615e749dbb6bf020edea78fdbd5e3d658e3b555783f2acec739c6e9dda2f42d058f7078df1b2c423742ba8a416b4b546793509ec40e425b5e2abd7f172bcbdc44b67248dbbcbc5ef9f09ac19508f90ae7d3810ec62c9a2b189e573f62c9391cf40440ab9e9369d2c7934aa7d83071ee86f812d6521a9368611ae"], 0x0, 0x0, 0x0}) 03:41:00 executing program 5: r0 = syz_open_dev$sndseq(&(0x7f0000000040)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a85320, &(0x7f0000068f50)={{0x80}, 'por\xff\a\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x1f\x00\x00\xff\xff\xff\xff\xff\xff\xff\xef\x00\x00\x03\xffL\x00\x00\x00\x00\x00\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x06\x00', 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2}) [ 943.328333][T10097] binder: 10096:10097 unknown command -368808281 [ 943.376493][T10097] binder: 10096:10097 ioctl c0306201 20000000 returned -22 03:41:00 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f00000000c0)=[@release={0x400c630e}], 0x0, 0x7000000, 0x0}) [ 943.475937][T10106] QAT: Invalid ioctl [ 943.493041][T10106] QAT: Invalid ioctl 03:41:00 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x4c, 0x0, &(0x7f0000000200)=ANY=[@ANYBLOB="05630440000000000e630c4000f200008c01acbcd9297cf4a76e04ea80b60b21d6efb41548e724db5bf05bcf6e830123c34234a0c43903464dd4e9c503844e734e52e396711327b0a8d8cf15"], 0x0, 0x0, 0x0}) [ 943.518233][T10106] binder: 10105:10106 ioctl c0306201 20008fd0 returned -14 [ 943.545427][T10118] binder_thread_write: 10 callbacks suppressed [ 943.545438][T10118] binder: 10115:10118 BC_REQUEST_DEATH_NOTIFICATION death notification already set 03:41:00 executing program 5: r0 = syz_open_dev$sndseq(&(0x7f0000000040)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a85320, &(0x7f0000068f50)={{0x80}, 'por\xff\a\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x1f\x00\x00\xff\xff\xff\xff\xff\xff\xff\xef\x00\x00\x03\xffh\x00\x00\x00\x00\x00\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x06\x00', 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2}) 03:41:00 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) shmat(0x0, &(0x7f0000ffc000/0x4000)=nil, 0x7000) r2 = openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000000080)='/dev/dlm-monitor\x00', 0x1, 0x0) sendto$isdn(r2, &(0x7f0000000300)=ANY=[@ANYBLOB="6d0000000900000041dc7158c7a0942b79fa9eb6693bbbdf7ab5716d90aaf81effec6ceba7d1bd63a6da00cdb101566b3fc36cefdcaa1fee356d97f6eddecdfdc36dc9fc320bc919211ed017d48bcdaace7c060ef132a5ff7f9ea930ee4d1a0dd7ca8b5557a7b0ff019d7a1238ee2585ee198a3c664b74a590418b5ce60e26cafa0897be804807d077d3dd373c02e60233381a51a85beb6484f8648f4cd54c99115f8823804eb698aec211a5c6564f1540a011244c5f907c2e9e98b102257607351ce739b3d3bccbadda283927b8c456bafb0fc4e3adec762a03fcb791169f40292ba423a2ce122d35fdd563799707f4b8f604d85578c639559b6ff7"], 0xf6, 0x10, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0xfffffcd7, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="05630440000000000e630c4000000000033290a921e934075e7e18d5252cc5c37b3cfd8bef23062440988a9ab829076450e07c88ea33ed379804a61d7a7e2c"], 0x0, 0x0, 0x0}) [ 943.576718][T10108] : renamed from bpq0 03:41:00 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f00000000c0)=[@release={0x400c630e}], 0x0, 0xa000000, 0x0}) 03:41:00 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f00000000c0)=[@release={0x400c630f}], 0xfdfdffff00000000, 0x0, 0x0}) r2 = syz_open_procfs(0x0, &(0x7f0000000040)='setgroups\x00') openat$cgroup_ro(r2, &(0x7f0000000080)='hugetlb.2MB.usage_in_bytes\x00', 0x0, 0x0) [ 943.711472][ T8164] binder: undelivered death notification, 0000000000000000 [ 943.745952][T10130] binder: 10124:10130 unknown command -719815074 [ 943.756685][T10133] binder: 10126:10133 BC_REQUEST_DEATH_NOTIFICATION invalid ref 61952 [ 943.779019][T10134] binder: 10132:10134 ioctl c0306201 20008fd0 returned -14 03:41:00 executing program 1: r0 = socket$inet6(0xa, 0x5, 0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000180)='/dev/net/tun\x00', 0x0, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000100)={'lo\x00', 0x0}) ioctl$sock_SIOCGIFINDEX(r0, 0x8923, &(0x7f0000000380)={'bpq0\x00\v\x00\xfe\x00\x00\x00\x00\x00\xfa\xff\x00', r2}) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000000)={'bpq0\x00', 0x1212}) getpgid(0xffffffffffffffff) [ 943.804950][T10130] binder: 10124:10130 ioctl c0306201 20000000 returned -22 [ 943.805647][T10133] binder: 10126:10133 unknown command -368808281 03:41:00 executing program 5: r0 = syz_open_dev$sndseq(&(0x7f0000000040)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a85320, &(0x7f0000068f50)={{0x80}, 'por\xff\a\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x1f\x00\x00\xff\xff\xff\xff\xff\xff\xff\xef\x00\x00\x03\xffl\x00\x00\x00\x00\x00\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x06\x00', 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2}) 03:41:00 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000040)='/dev/btrfs-control\x00', 0x80000, 0x0) ioctl$UI_BEGIN_FF_ERASE(r1, 0xc00c55ca, &(0x7f0000000080)={0xa, 0xfffffffffffffeff, 0x7}) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) r3 = syz_open_dev$sndpcmp(&(0x7f00000014c0)='/dev/snd/pcmC#D#p\x00', 0x8, 0x900) ioctl$sock_inet6_udp_SIOCINQ(r3, 0x541b, &(0x7f0000001500)) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f00000000c0)=[@release={0x400c630f}], 0xfdfdffff00000000, 0x0, 0x0}) [ 943.852327][T10136] binder: 10135:10136 BC_REQUEST_DEATH_NOTIFICATION death notification already set [ 943.864524][T10133] binder: 10126:10133 ioctl c0306201 20000000 returned -22 [ 943.882243][ T7288] binder: undelivered death notification, 0000000000000000 03:41:01 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) open(&(0x7f0000000080)='./file0\x00', 0x4000, 0x80) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400000400202) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="05630440000000000e630c400000000052c981123d05a87b6fedbe53ec00ffffffffffed00a6fc73574b536bb82f5eeaea1d83c6d7805b36"], 0x0, 0x0, 0x0}) socket$inet6_udp(0xa, 0x2, 0x0) 03:41:01 executing program 5: r0 = syz_open_dev$sndseq(&(0x7f0000000040)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a85320, &(0x7f0000068f50)={{0x80}, 'por\xff\a\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x1f\x00\x00\xff\xff\xff\xff\xff\xff\xff\xef\x00\x00\x03\xfft\x00\x00\x00\x00\x00\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x06\x00', 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2}) [ 944.015569][T10146] binder: 10144:10146 ioctl c0306201 20008fd0 returned -14 03:41:01 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x4c, 0x0, &(0x7f0000000200)=ANY=[@ANYBLOB="05630440000000000e630c4000f200008c01acbcd9297cf4a76e04ea80b60b21d6efb41548e724db19f002cf6e830123c34234a0c43903464dd4e9c503844e734e52e396711327b0a8d8cf15"], 0x0, 0x0, 0x0}) 03:41:01 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f00000000c0)=[@release={0x400c630e}], 0x0, 0x20000000, 0x0}) [ 944.108630][T10142] : renamed from bpq0 03:41:01 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = openat$snapshot(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/snapshot\x00', 0x400000, 0x0) accept4$packet(r2, &(0x7f0000000200)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f0000000040)=0x14, 0x80000) ioctl$sock_inet6_SIOCSIFADDR(r0, 0x8916, &(0x7f0000000180)={@empty, 0x1f, r3}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=ANY=[@ANYBLOB="05630440000000000000000000000000"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f00000000c0)=[@release={0x400c630f}], 0xfdfdffff00000000, 0x0, 0x0}) 03:41:01 executing program 5: r0 = syz_open_dev$sndseq(&(0x7f0000000040)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a85320, &(0x7f0000068f50)={{0x80}, 'por\xff\a\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x1f\x00\x00\xff\xff\xff\xff\xff\xff\xff\xef\x00\x00\x03\xffz\x00\x00\x00\x00\x00\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x06\x00', 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2}) [ 944.251714][T10163] binder: 10159:10163 BC_REQUEST_DEATH_NOTIFICATION death notification already set [ 944.276777][T10164] binder: 10161:10164 unknown command -368808281 [ 944.289570][T10167] binder: 10162:10167 ioctl 8916 20000180 returned -22 03:41:01 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000000040)='/dev/dlm-monitor\x00', 0x50001, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(0xffffffffffffff9c, &(0x7f00000000c0)={0x0, 0x18, 0xfa00, {0x1, &(0x7f0000000080)={0xffffffffffffffff}, 0x13f, 0x100f}}, 0x20) write$RDMA_USER_CM_CMD_REJECT(r2, &(0x7f0000000200)={0x9, 0x108, 0xfa00, {r3, 0x38, "64db52", "83c93f0d828aca6f061539841d86d0f27bd4cbfc9a3aabee2c1f1e31e5485e3ea027e225a1b6de3aa2031af713118c404b6fd22fca266cbc268758bd573edad3c17d1be4f16fabfed15a418c711641fb0895c2c2814b9cf34d33fe5d79902f95feea935d50041b63849fbb00d9cbd694fbb1ecb9bb7c07d2703b920bc4a348d823d7393b5a1ecb77922f3d6d1bf84b1c7125811f3f946b75368e260728e68e5a13ffba84e2fc36a5d4c7059709bb7a72ac5328a952bdb04361469370c402e9dbe78bb4a379071ff5df9270dde5764e980c668b058408972374f420e675e1cf8cc0ef6a55f183f00b960a162bffbe6b54275961b29375cc882eff82c855499256"}}, 0x110) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) [ 944.295173][T10164] binder: 10161:10164 ioctl c0306201 20000000 returned -22 03:41:01 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f00000000c0)=[@release={0x400c630e}], 0x0, 0x48000000, 0x0}) 03:41:01 executing program 1: r0 = socket$inet6(0xa, 0x5, 0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000180)='/dev/net/tun\x00', 0x0, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000100)={'lo\x00', 0x0}) ioctl$sock_SIOCGIFINDEX(r0, 0x8923, &(0x7f0000000380)={'bpq0\x00\v\x00\xfe\x00\x00\x00\x00\x00\xfa\xff\x00', r2}) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000000)={'bpq0\x00', 0x1212}) getpgid(0xffffffffffffffff) [ 944.368197][T10171] binder: 10162:10171 unknown command 0 [ 944.414349][T10167] binder: 10162:10167 BC_CLEAR_DEATH_NOTIFICATION death notification not active [ 944.419348][T10171] binder: 10162:10171 ioctl c0306201 20000000 returned -22 03:41:01 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x4c, 0x0, &(0x7f0000000200)=ANY=[@ANYBLOB="05630440000000000e630c4000f200008c01acbcd9297cf4a76e04ea80b60b21d6efb41548e724db19f003cf6e830123c34234a0c43903464dd4e9c503844e734e52e396711327b0a8d8cf15"], 0x0, 0x0, 0x0}) 03:41:01 executing program 5: r0 = syz_open_dev$sndseq(&(0x7f0000000040)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a85320, &(0x7f0000068f50)={{0x80}, 'por\xff\a\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x1f\x00\x00\xff\xff\xff\xff\xff\xff\xff\xef\x00\x00\x03\xff\xfd\x00\x00\x00\x00\x00\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x06\x00', 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2}) 03:41:01 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=ANY=[@ANYBLOB="05630440000000bf981f884000000000"], 0x0, 0x0, 0x0}) [ 944.534036][T10167] binder: 10162:10167 ioctl c0306201 20008fd0 returned -14 [ 944.569234][T10184] binder: 10177:10184 BC_REQUEST_DEATH_NOTIFICATION death notification already set [ 944.613255][T10189] binder: 10188:10189 Acquire 1 refcount change on invalid ref -1090519040 ret -22 [ 944.632691][T10178] : renamed from bpq0 03:41:01 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f00000000c0)=[@release={0x400c630e}], 0x0, 0x4c000000, 0x0}) 03:41:01 executing program 5: r0 = syz_open_dev$sndseq(&(0x7f0000000040)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a85320, &(0x7f0000068f50)={{0x80}, 'por\xff\a\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x1f\x00\x00\xff\xff\xff\xff\xff\xff\xff\xef\x00\x00\x03\xff\x00\x03\x00\x00\x00\x00\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x06\x00', 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2}) [ 944.664319][T10189] binder: 10188:10189 unknown command 1082662808 [ 944.677588][T10190] binder: 10185:10190 unknown command -368808281 [ 944.678582][T10189] binder: 10188:10189 ioctl c0306201 20000000 returned -22 [ 944.747838][T10190] binder: 10185:10190 ioctl c0306201 20000000 returned -22 03:41:01 executing program 4: r0 = openat$vfio(0xffffffffffffff9c, &(0x7f0000000040)='/dev/vfio/vfio\x00', 0x440400, 0x0) ioctl$KVM_REGISTER_COALESCED_MMIO(r0, 0x4010ae67, &(0x7f0000000080)={0x5000, 0x1000}) r1 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000001c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) 03:41:01 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=ANY=[@ANYBLOB="05630440000e630c4000000000000000"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f00000000c0)=[@release={0x400c630f}], 0xfdfdffff00000000, 0x0, 0x0}) [ 944.792534][T10200] binder: 10195:10200 BC_REQUEST_DEATH_NOTIFICATION death notification already set 03:41:01 executing program 1: r0 = socket$inet6(0xa, 0x5, 0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000180)='/dev/net/tun\x00', 0x0, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000100)={'lo\x00', 0x0}) ioctl$sock_SIOCGIFINDEX(r0, 0x8923, &(0x7f0000000380)={'bpq0\x00\v\x00\xfe\x00\x00\x00\x00\x00\xfa\xff\x00', r2}) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000000)={'bpq0\x00', 0x1212}) getpgid(0xffffffffffffffff) 03:41:01 executing program 5: r0 = syz_open_dev$sndseq(&(0x7f0000000040)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a85320, &(0x7f0000068f50)={{0x80}, 'por\xff\a\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x1f\x00\x00\xff\xff\xff\xff\xff\xff\xff\xef\x00\x00\x03\xff\x00\x05\x00\x00\x00\x00\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x06\x00', 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2}) 03:41:02 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x4c, 0x0, &(0x7f0000000200)=ANY=[@ANYBLOB="05630440000000000e630c4000f200008c01acbcd9297cf4a76e04ea80b60b21d6efb41548e724db19f004cf6e830123c34234a0c43903464dd4e9c503844e734e52e396711327b0a8d8cf15"], 0x0, 0x0, 0x0}) 03:41:02 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f00000000c0)=[@release={0x400c630e}], 0x0, 0x60000000, 0x0}) [ 944.935656][T10207] binder: 10206:10207 Acquire 1 refcount change on invalid ref 207818240 ret -22 [ 945.029458][T10207] binder: 10206:10207 unknown command 64 [ 945.029527][T10223] binder: 10206:10223 ioctl c0306201 20008fd0 returned -14 03:41:02 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) getsockopt$sock_cred(r2, 0x1, 0x11, &(0x7f0000000040)={0x0}, &(0x7f0000000080)=0xc) ioctl$sock_FIOSETOWN(r1, 0x8901, &(0x7f00000000c0)=r3) [ 945.079765][T10214] : renamed from bpq0 [ 945.080854][T10207] binder: 10206:10207 ioctl c0306201 20000000 returned -22 03:41:02 executing program 5: r0 = syz_open_dev$sndseq(&(0x7f0000000040)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a85320, &(0x7f0000068f50)={{0x80}, 'por\xff\a\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x1f\x00\x00\xff\xff\xff\xff\xff\xff\xff\xef\x00\x00\x03\xff\x00\x06\x00\x00\x00\x00\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x06\x00', 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2}) [ 945.130917][T10230] binder: 10222:10230 BC_REQUEST_DEATH_NOTIFICATION death notification already set [ 945.145133][T10226] binder: 10224:10226 unknown command -368808281 [ 945.151517][T10226] binder: 10224:10226 ioctl c0306201 20000000 returned -22 [ 945.213771][T10214] : renamed from bpq0 03:41:02 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)) syz_open_dev$midi(&(0x7f0000000040)='/dev/midi#\x00', 0x7, 0x20900) openat$cachefiles(0xffffffffffffff9c, &(0x7f0000000080)='/dev/cachefiles\x00', 0x0, 0x0) r1 = openat$cachefiles(0xffffffffffffff9c, &(0x7f0000000100)='/dev/cachefiles\x00', 0x80043, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400000000040) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f00000000c0)=[@release={0x400c630f}], 0xfdfdffff00000000, 0x0, 0x0}) 03:41:02 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f00000000c0)=[@release={0x400c630e}], 0x0, 0x68000000, 0x0}) 03:41:02 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x4c, 0x0, &(0x7f0000000200)=ANY=[@ANYBLOB="05630440000000000e630c4000f200008c01acbcd9297cf4a76e04ea80b60b21d6efb41548e724db19f005cf6e830123c34234a0c43903464dd4e9c503844e734e52e396711327b0a8d8cf15"], 0x0, 0x0, 0x0}) 03:41:02 executing program 5: r0 = syz_open_dev$sndseq(&(0x7f0000000040)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a85320, &(0x7f0000068f50)={{0x80}, 'por\xff\a\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x1f\x00\x00\xff\xff\xff\xff\xff\xff\xff\xef\x00\x00\x03\xff\x00\a\x00\x00\x00\x00\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x06\x00', 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2}) 03:41:02 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=ANY=[@ANYBLOB="0d630440000000000e630c4000000000"], 0x0, 0x0, 0x0}) 03:41:02 executing program 1: r0 = socket$inet6(0xa, 0x5, 0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000180)='/dev/net/tun\x00', 0x0, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000100)={'lo\x00', 0x0}) ioctl$sock_SIOCGIFINDEX(r0, 0x8923, &(0x7f0000000380)={'bpq0\x00\v\x00\xfe\x00\x00\x00\x00\x00\xfa\xff\x00', r2}) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000000)={'bpq0\x00', 0x1212}) getpgid(0xffffffffffffffff) [ 945.382067][T10242] binder: 10239:10242 BC_REQUEST_DEATH_NOTIFICATION death notification already set [ 945.418913][T10244] binder: 10243:10244 unknown command -368808281 [ 945.449861][T10246] binder: 10240:10246 ioctl c0306201 20008fd0 returned -14 [ 945.475179][T10244] binder: 10243:10244 ioctl c0306201 20000000 returned -22 03:41:02 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f00000000c0)=[@release={0x400c630e}], 0x0, 0x6c000000, 0x0}) 03:41:02 executing program 5: r0 = syz_open_dev$sndseq(&(0x7f0000000040)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a85320, &(0x7f0000068f50)={{0x80}, 'por\xff\a\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x1f\x00\x00\xff\xff\xff\xff\xff\xff\xff\xef\x00\x00\x03\xff\x00\n\x00\x00\x00\x00\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x06\x00', 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2}) 03:41:02 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=ANY=[@ANYBLOB="056304400001040000ec179e75000000"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f00000000c0)=[@release={0x400c630f}], 0xfdfdffff00000000, 0x0, 0x0}) [ 945.495859][T24007] binder: undelivered death notification, 0000000000000000 [ 945.507230][T10248] binder: 10247:10248 unknown command 1074029325 [ 945.540129][T10248] binder: 10247:10248 ioctl c0306201 20000000 returned -22 03:41:02 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x4c, 0x0, &(0x7f0000000200)=ANY=[@ANYBLOB="05630440000000000e630c4000f200008c01acbcd9297cf4a76e04ea80b60b21d6efb41548e724db19f006cf6e830123c34234a0c43903464dd4e9c503844e734e52e396711327b0a8d8cf15"], 0x0, 0x0, 0x0}) [ 945.664689][T10265] binder: 10263:10265 BC_REQUEST_DEATH_NOTIFICATION death notification already set [ 945.686419][T10269] binder: 10266:10269 Acquire 1 refcount change on invalid ref 262400 ret -22 [ 945.698947][T10255] : renamed from bpq0 03:41:02 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000000040)='/dev/dlm-monitor\x00', 0x2000, 0x0) getsockopt$IPT_SO_GET_REVISION_TARGET(r2, 0x0, 0x43, &(0x7f0000000340)={'ipvs\x00'}, &(0x7f0000000380)=0x1e) r3 = syz_genetlink_get_family_id$tipc2(&(0x7f00000000c0)='TIPCv2\x00') sendmsg$TIPC_NL_BEARER_DISABLE(r2, &(0x7f0000000180)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x4000}, 0xc, &(0x7f0000000100)={&(0x7f0000000200)={0x124, r3, 0x300, 0x70bd26, 0x25dfdbfd, {}, [@TIPC_NLA_SOCK={0x24, 0x2, [@TIPC_NLA_SOCK_ADDR={0x8, 0x1, 0x8}, @TIPC_NLA_SOCK_ADDR={0x8}, @TIPC_NLA_SOCK_ADDR={0x8, 0x1, 0x6}, @TIPC_NLA_SOCK_HAS_PUBL={0x4}, @TIPC_NLA_SOCK_HAS_PUBL={0x4}]}, @TIPC_NLA_LINK={0x98, 0x4, [@TIPC_NLA_LINK_PROP={0x44, 0x7, [@TIPC_NLA_PROP_MTU={0x8, 0x4, 0xd4}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x4}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0xb}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x16}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x80000001}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x7}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0xffffffff}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0xe4}]}, @TIPC_NLA_LINK_PROP={0x44, 0x7, [@TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x10}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x2}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x5}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x3ba3}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x2}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x8}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x1d}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x6}]}, @TIPC_NLA_LINK_NAME={0xc, 0x1, 'syz1\x00'}]}, @TIPC_NLA_BEARER={0x54, 0x1, [@TIPC_NLA_BEARER_PROP={0x14, 0x2, [@TIPC_NLA_PROP_WIN={0x8, 0x3, 0x3}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x1}]}, @TIPC_NLA_BEARER_UDP_OPTS={0x2c, 0x4, {{0x14, 0x1, @in={0x2, 0x4e24, @multicast1}}, {0x14, 0x2, @in={0x2, 0x4e22, @multicast1}}}}, @TIPC_NLA_BEARER_NAME={0x10, 0x1, @l2={'ib', 0x3a, 'bridge0\x00'}}]}]}, 0x124}, 0x1, 0x0, 0x0, 0x4000}, 0x40000) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) [ 945.728469][T10269] binder: 10266:10269 unknown command -1642599424 [ 945.765042][T10272] binder: 10268:10272 unknown command -368808281 [ 945.768085][T10269] binder: 10266:10269 ioctl c0306201 20000000 returned -22 03:41:02 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f00000000c0)=[@release={0x400c630e}], 0x0, 0x74000000, 0x0}) 03:41:02 executing program 5: r0 = syz_open_dev$sndseq(&(0x7f0000000040)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a85320, &(0x7f0000068f50)={{0x80}, 'por\xff\a\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x1f\x00\x00\xff\xff\xff\xff\xff\xff\xff\xef\x00\x00\x03\xff\x00H\x00\x00\x00\x00\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x06\x00', 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2}) [ 945.771425][T10272] binder: 10268:10272 ioctl c0306201 20000000 returned -22 [ 945.863533][T10280] binder: 10279:10280 BC_REQUEST_DEATH_NOTIFICATION death notification already set [ 945.875091][T10273] binder: 10266:10273 ioctl c0306201 20008fd0 returned -14 03:41:02 executing program 1: r0 = socket$inet6(0xa, 0x5, 0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000180)='/dev/net/tun\x00', 0x0, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000100)={'lo\x00', 0x0}) ioctl$sock_SIOCGIFINDEX(r0, 0x8923, &(0x7f0000000380)={'bpq0\x00\v\x00\xfe\x00\x00\x00\x00\x00\xfa\xff\x00', r2}) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000000)={'bpq0\x00', 0x1212}) getpgid(0xffffffffffffffff) 03:41:03 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = syz_open_dev$swradio(&(0x7f0000000040)='/dev/swradio#\x00', 0x0, 0x2) setsockopt$inet_sctp_SCTP_SOCKOPT_BINDX_ADD(r2, 0x84, 0x64, &(0x7f0000000080)=[@in6={0xa, 0x4e24, 0x1, @mcast2, 0x7ff}, @in={0x2, 0x4e21, @dev={0xac, 0x14, 0x14, 0xa}}, @in={0x2, 0x4e22, @multicast1}], 0x3c) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=ANY=[@ANYBLOB="05780440000000000e630c4000000000"], 0x0, 0x0, 0x0}) ioctl$VT_SETMODE(r2, 0x5602, &(0x7f00000000c0)={0x7, 0x0, 0x0, 0xe765, 0x1f}) ioctl$EVIOCSREP(r2, 0x40084503, &(0x7f0000000100)=[0x6, 0x800]) 03:41:03 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x4c, 0x0, &(0x7f0000000200)=ANY=[@ANYBLOB="05630440000000000e630c4000f200008c01acbcd9297cf4a76e04ea80b60b21d6efb41548e724db19f007cf6e830123c34234a0c43903464dd4e9c503844e734e52e396711327b0a8d8cf15"], 0x0, 0x0, 0x0}) 03:41:03 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0xfffffffffffffcfb, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) prctl$PR_GET_ENDIAN(0x13, &(0x7f0000000040)) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f00000000c0)=[@release={0x400c630f}], 0xfdfdffff00000000, 0x0, 0x0}) 03:41:03 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f00000000c0)=[@release={0x400c630e}], 0x0, 0x7a000000, 0x0}) 03:41:03 executing program 5: r0 = syz_open_dev$sndseq(&(0x7f0000000040)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a85320, &(0x7f0000068f50)={{0x80}, 'por\xff\a\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x1f\x00\x00\xff\xff\xff\xff\xff\xff\xff\xef\x00\x00\x03\xff\x00L\x00\x00\x00\x00\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x06\x00', 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2}) [ 946.104648][T10293] binder: 10291:10293 unknown command 1074034693 [ 946.140464][T10293] binder: 10291:10293 ioctl c0306201 20000000 returned -22 [ 946.173812][T10302] binder: 10297:10302 unknown command -368808281 [ 946.186147][T10298] binder: 10296:10298 ioctl c0306201 20008fd0 returned -14 [ 946.186300][T10300] binder: 10299:10300 BC_REQUEST_DEATH_NOTIFICATION death notification already set [ 946.204978][T10302] binder: 10297:10302 ioctl c0306201 20000000 returned -22 [ 946.220586][T10290] : renamed from bpq0 03:41:03 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000300)='cpuacct.stat\x00', 0x0, 0x0) ioctl$SCSI_IOCTL_GET_PCI(r1, 0x5387, &(0x7f0000000340)) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) openat$uinput(0xffffffffffffff9c, &(0x7f0000000180)='/dev/uinput\x00', 0x802, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000100)) r2 = syz_open_dev$swradio(&(0x7f0000000040)='/dev/swradio#\x00', 0x0, 0x2) ioctl$UI_DEV_DESTROY(r2, 0x5502) ioctl$BLKPG(r2, 0x1269, &(0x7f0000000080)={0x1, 0xffffffffffff7fff, 0xc3, &(0x7f0000000200)="42b4dc4faa02b0c8eda22ce4c76f84cee3b2219f14025b56ccaa5e739e554c4fd5f6d8e82087ee2934d77d3b6e4a1e044fe6f56668c9f4431ef1e17c2d967349e84d7e9d6dbd60767b60848a5b7c0f73547dbd3ef1f539288724dec7113718011586ecfaebe6aceb85addaf381ebac9a5414aeaa7e2ddeaae61422fcf1f8bda28084ce0f12631f1b16707c0381f8c57d70afac566b8c081a399d20d9713cf6a107450457096ec2f095eab4f9cab4feaa606367428eeb1afeeaae64b91c4bbcb15cf3c9"}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x402) fsetxattr$security_selinux(r0, &(0x7f00000000c0)='security.selinux\x00', &(0x7f0000000140)='system_u:object_r:inetd_exec_t:s0\x00', 0x22, 0x6d8fa8c467c9cf5a) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=ANY=[@ANYBLOB="05130440000000000e630c66cda30c04"], 0x0, 0x0, 0x0}) 03:41:03 executing program 5: r0 = syz_open_dev$sndseq(&(0x7f0000000040)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a85320, &(0x7f0000068f50)={{0x80}, 'por\xff\a\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x1f\x00\x00\xff\xff\xff\xff\xff\xff\xff\xef\x00\x00\x03\xff\x00h\x00\x00\x00\x00\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x06\x00', 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2}) 03:41:03 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f00000000c0)=[@release={0x400c630e}], 0x0, 0xfdfdffff, 0x0}) 03:41:03 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0x0, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f00000000c0)=[@release={0x400c630f}], 0xfdfdffff00000000, 0x0, 0x0}) 03:41:03 executing program 1: r0 = socket$inet6(0xa, 0x5, 0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000180)='/dev/net/tun\x00', 0x0, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000100)={'lo\x00', 0x0}) ioctl$sock_SIOCGIFINDEX(r0, 0x8923, &(0x7f0000000380)={'bpq0\x00\v\x00\xfe\x00\x00\x00\x00\x00\xfa\xff\x00', r2}) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000000)={'bpq0\x00', 0x1212}) getpgid(0xffffffffffffffff) 03:41:03 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x4c, 0x0, &(0x7f0000000200)=ANY=[@ANYBLOB="05630440000000000e630c4000f200008c01acbcd9297cf4a76e04ea80b60b21d6efb41548e724db19f008cf6e830123c34234a0c43903464dd4e9c503844e734e52e396711327b0a8d8cf15"], 0x0, 0x0, 0x0}) [ 946.483563][T10316] binder: 10315:10316 unknown command 1074008837 [ 946.526560][T10316] binder: 10315:10316 ioctl c0306201 20000000 returned -22 [ 946.527874][T10326] binder: 10322:10326 Acquire 1 refcount change on invalid ref 0 ret -22 03:41:03 executing program 5: r0 = syz_open_dev$sndseq(&(0x7f0000000040)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a85320, &(0x7f0000068f50)={{0x80}, 'por\xff\a\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x1f\x00\x00\xff\xff\xff\xff\xff\xff\xff\xef\x00\x00\x03\xff\x00l\x00\x00\x00\x00\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x06\x00', 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2}) 03:41:03 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f00000000c0)=[@release={0x400c630e}], 0x0, 0xfffffdfd, 0x0}) [ 946.577520][T10330] binder: 10315:10330 unknown command 1074008837 [ 946.615398][T10331] binder_thread_write: 10 callbacks suppressed [ 946.615410][T10331] binder: 10327:10331 BC_REQUEST_DEATH_NOTIFICATION invalid ref 61952 [ 946.635236][T10330] binder: 10315:10330 ioctl c0306201 20000000 returned -22 [ 946.653424][T10326] binder: 10322:10326 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 946.692549][T10328] : renamed from bpq0 [ 946.701981][T10337] binder: 10322:10337 BC_CLEAR_DEATH_NOTIFICATION invalid ref 0 03:41:03 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) fcntl$getownex(r0, 0x10, &(0x7f0000000080)={0x0, 0x0}) ptrace$setopts(0x4206, r1, 0x6, 0x8) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) open(&(0x7f0000000040)='./file0\x00', 0x20200, 0x1c8) 03:41:03 executing program 5: r0 = syz_open_dev$sndseq(&(0x7f0000000040)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a85320, &(0x7f0000068f50)={{0x80}, 'por\xff\a\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x1f\x00\x00\xff\xff\xff\xff\xff\xff\xff\xef\x00\x00\x03\xff\x00t\x00\x00\x00\x00\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x06\x00', 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2}) [ 946.738089][T10337] binder: 10322:10337 ioctl c0306201 20008fd0 returned -14 [ 946.746674][T10331] binder: 10327:10331 unknown command -368808281 03:41:03 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000080)='/dev/sequencer2\x00', 0x202, 0x0) accept$alg(r1, 0x0, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) r3 = openat$sequencer(0xffffffffffffff9c, &(0x7f0000000100)='/dev/sequencer\x00', 0x800000020809, 0x0) setsockopt$ALG_SET_KEY(r3, 0x117, 0x1, &(0x7f0000000240)="677be715d5e10dcf7f857a826fff363aff7369cacc03766ff3df5d1282567182a8089d257de6f981e7c0222c53fa2d156f4e131aeccb35b25d23f2dc79b7f22beeb7e768085c17c48e7ca5d6e2552bdc9ac3a51ca59670116ae07248cb0332dae73aa786712d147e73a312a90bf8c454023f3d29d1a53559f2243befc14144c978e3755842097afac90d5b1d1efb13ba29759d", 0x93) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=ANY=[@ANYBLOB="d17663040000000000000e2c00000000"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f00000000c0)=[@release={0x400c630f}], 0xfdfdffff00000000, 0x0, 0x0}) r4 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000040)='/dev/hwrng\x00', 0x8000, 0x0) ioctl$VIDIOC_DV_TIMINGS_CAP(r4, 0xc0905664, &(0x7f0000000180)={0x0, 0x0, [], @raw_data=[0x95c, 0x8000, 0x5, 0x7, 0x6d, 0xffffffff, 0x4195bfd8, 0x7, 0x7, 0x1f, 0xfffffffffffffff9, 0x3, 0x0, 0x0, 0x3, 0x3, 0x3ff, 0x2, 0xffffffffffffff9a, 0x9, 0x9, 0x3, 0x7, 0xfffffffffffffe00, 0x3f, 0xffffffffffffff11, 0x9, 0xffff, 0x800, 0xff, 0x7, 0xfffffffffffffeff]}) [ 946.839823][T10331] binder: 10327:10331 ioctl c0306201 20000000 returned -22 03:41:03 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f00000000c0)=[@release={0x400c630e}], 0x0, 0x100000000000000, 0x0}) 03:41:03 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$admmidi(&(0x7f0000000180)='/dev/admmidi#\x00', 0x8, 0x400000) accept$alg(r1, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) setsockopt$inet_mreq(r1, 0x0, 0x20, &(0x7f0000000200)={@loopback, @broadcast}, 0x8) r2 = syz_open_dev$swradio(&(0x7f00000000c0)='/dev/swradio#\x00', 0x1, 0x2) ioctl$SIOCX25SDTEFACILITIES(r2, 0x89eb, &(0x7f0000000100)={0x5, 0x1ff, 0x3, 0x1, 0xffffffffffff0000, 0x14, 0x23, "f422dea410931ed4487a14579aec73b7e2693fe2", "88d11638254847fa9862a8c5e576a56cd34b4d45"}) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$EVIOCGBITSND(r3, 0x80404532, &(0x7f0000000040)=""/97) 03:41:04 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x4c, 0x0, &(0x7f0000000200)=ANY=[@ANYBLOB="05630440000000000e630c4000f200008c01acbcd9297cf4a76e04ea80b60b21d6efb41548e724db19f009cf6e830123c34234a0c43903464dd4e9c503844e734e52e396711327b0a8d8cf15"], 0x0, 0x0, 0x0}) 03:41:04 executing program 1: r0 = socket$inet6(0xa, 0x5, 0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000180)='/dev/net/tun\x00', 0x0, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000100)={'lo\x00', 0x0}) ioctl$sock_SIOCGIFINDEX(r0, 0x8923, &(0x7f0000000380)={'bpq0\x00\v\x00\xfe\x00\x00\x00\x00\x00\xfa\xff\x00', r2}) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000000)={'bpq0\x00', 0x1212}) getpgid(0xffffffffffffffff) 03:41:04 executing program 5: r0 = syz_open_dev$sndseq(&(0x7f0000000040)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a85320, &(0x7f0000068f50)={{0x80}, 'por\xff\a\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x1f\x00\x00\xff\xff\xff\xff\xff\xff\xff\xef\x00\x00\x03\xff\x00z\x00\x00\x00\x00\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x06\x00', 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2}) [ 946.979268][T10353] binder: 10352:10353 unknown command 73627345 [ 947.019158][T10353] binder: 10352:10353 ioctl c0306201 20000000 returned -22 03:41:04 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) getsockopt$IP_VS_SO_GET_SERVICES(r2, 0x0, 0x482, &(0x7f0000000200)=""/210, &(0x7f0000000180)=0xd2) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) clock_gettime(0x0, &(0x7f0000000040)={0x0, 0x0}) clock_gettime(0x0, &(0x7f0000000080)={0x0, 0x0}) timerfd_settime(r2, 0x1, &(0x7f00000000c0)={{r3, r4+10000000}, {r5, r6+10000000}}, &(0x7f0000000100)) getsockopt$sock_buf(r1, 0x1, 0x37, &(0x7f0000000300)=""/78, &(0x7f0000000380)=0x4e) bpf$BPF_GET_MAP_INFO(0xf, &(0x7f0000000400)={0xffffffffffffffff, 0x28, &(0x7f00000003c0)={0x0, 0x0}}, 0x10) bpf$BPF_MAP_GET_FD_BY_ID(0xe, &(0x7f0000000440)={r7, 0x200, 0x18}, 0xc) [ 947.080458][T10353] binder: 10352:10353 BC_CLEAR_DEATH_NOTIFICATION invalid ref 0 [ 947.112511][T10361] binder: 10359:10361 BC_REQUEST_DEATH_NOTIFICATION invalid ref 61952 03:41:04 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f00000000c0)=[@release={0x400c630e}], 0x0, 0x200000000000000, 0x0}) [ 947.168211][T10353] binder: 10352:10353 ioctl c0306201 20008fd0 returned -14 [ 947.180074][T10361] binder: 10359:10361 unknown command -368808281 03:41:04 executing program 5: r0 = syz_open_dev$sndseq(&(0x7f0000000040)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a85320, &(0x7f0000068f50)={{0x80}, 'por\xff\a\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x1f\x00\x00\xff\xff\xff\xff\xff\xff\xff\xef\x00\x00\x03\xff\x00\xfd\x00\x00\x00\x00\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x06\x00', 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2}) [ 947.262912][T10361] binder: 10359:10361 ioctl c0306201 20000000 returned -22 [ 947.298115][T10366] : renamed from bpq0 03:41:04 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f00000000c0)=[@release={0x400c630e}], 0x0, 0x300000000000000, 0x0}) 03:41:04 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='cpuset.memory_pressure\x00', 0x0, 0x0) name_to_handle_at(r2, &(0x7f0000000080)='./file0\x00', &(0x7f0000000180)={0xaa, 0x1, "c6f201e67022afe90d230bac2f4a40ea35c2a7f35e18a743a8272d46b0bdeae158a9eef9aa7bde85d978dd7d072132ded2690c124588a2644120482add9bed36bc18dd3a51b4573bc6c56403909f0585a24fd2a95dfa98bfa3ddae86b44ee0001f752c3f2c08de996d07dd0327515ca4eda3c32a033e72ec24325ec52ad1fbf1e67caa60b373ab3bb4bcaf21e1f3ccccb9795da9160d7c936536873af8db8883a426"}, &(0x7f0000000100), 0x0) setsockopt$RXRPC_SECURITY_KEYRING(r2, 0x110, 0x2, &(0x7f0000000240)='/dev/binder#\x00', 0xd) ioctl$PERF_EVENT_IOC_PAUSE_OUTPUT(r2, 0x40042409, 0x1) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f00000000c0)=[@release={0x400c630f}], 0xfdfdffff00000000, 0x0, 0x0}) 03:41:04 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) r1 = openat$ipvs(0xffffffffffffff9c, &(0x7f0000000040)='/proc/sys/net/ipv4/vs/sync_sock_size\x00', 0x2, 0x0) fgetxattr(r1, &(0x7f0000001300)=ANY=[@ANYBLOB="757365722e21776c616e317b6c6f73656c665c00c5c8b83f6a4c9f040725985bd02a9f368749f7a633d524b81c2927631f4ddb9e07187858d4baa8726b6837955915d4920e44c93e22d9a3094e8ca7831f"], &(0x7f0000001200)=""/235, 0xeb) open(&(0x7f00000000c0)='./file0\x00', 0x0, 0x28) recvfrom$llc(r1, &(0x7f0000000200)=""/4096, 0x1000, 0x20, &(0x7f0000000080)={0x1a, 0x305, 0xfc4, 0x81, 0x80, 0x2, @remote}, 0x10) 03:41:04 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x4c, 0x0, &(0x7f0000000200)=ANY=[@ANYBLOB="05630440000000000e630c4000f200008c01acbcd9297cf4a76e04ea80b60b21d6efb41548e724db19f00acf6e830123c34234a0c43903464dd4e9c503844e734e52e396711327b0a8d8cf15"], 0x0, 0x0, 0x0}) 03:41:04 executing program 1: r0 = socket$inet6(0xa, 0x5, 0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000180)='/dev/net/tun\x00', 0x0, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000100)={'lo\x00', 0x0}) ioctl$sock_SIOCGIFINDEX(r0, 0x8923, &(0x7f0000000380)={'bpq0\x00\v\x00\xfe\x00\x00\x00\x00\x00\xfa\xff\x00', r2}) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000000)={'bpq0\x00', 0x1212}) getpgid(0xffffffffffffffff) 03:41:04 executing program 5: r0 = syz_open_dev$sndseq(&(0x7f0000000040)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a85320, &(0x7f0000068f50)={{0x80}, 'por\xff\a\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x1f\x00\x00\xff\xff\xff\xff\xff\xff\xff\xef\x00\x00\x03\xff\x00\x00\x00\x01\x00\x00\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x06\x00', 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2}) [ 947.528091][T10390] binder: 10388:10390 ioctl c0306201 20008fd0 returned -14 [ 947.611444][T10396] binder: 10389:10396 BC_REQUEST_DEATH_NOTIFICATION invalid ref 61952 03:41:04 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f00000000c0)=[@release={0x400c630e}], 0x0, 0x400000000000000, 0x0}) 03:41:04 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)) openat$mixer(0xffffffffffffff9c, &(0x7f0000000040)='/dev/mixer\x00', 0x4000, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x10000000003f) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=ANY=[@ANYBLOB="0563040300000000a100005fa2"], 0x0, 0x0, 0x0}) 03:41:04 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f00000000c0)=[@release={0x400c630f}], 0xfdfdffff00000000, 0x0, 0x0}) ioctl$DRM_IOCTL_GEM_FLINK(0xffffffffffffff9c, 0xc008640a, &(0x7f0000000040)={0x0}) ioctl$DRM_IOCTL_GEM_OPEN(r0, 0xc010640b, &(0x7f0000000080)={0x0, r2, 0x6}) 03:41:04 executing program 5: r0 = syz_open_dev$sndseq(&(0x7f0000000040)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a85320, &(0x7f0000068f50)={{0x80}, 'por\xff\a\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x1f\x00\x00\xff\xff\xff\xff\xff\xff\xff\xef\x00\x00\x03\xff\x00\x00\x00\x02\x00\x00\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x06\x00', 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2}) [ 947.664304][T10396] binder: 10389:10396 unknown command -368808281 [ 947.695138][T10396] binder: 10389:10396 ioctl c0306201 20000000 returned -22 [ 947.705908][ T8164] binder: undelivered death notification, 0000000000000000 [ 947.797055][T10414] binder: 10412:10414 ioctl 8912 10000000003f returned -22 [ 947.813510][T10401] : renamed from bpq0 03:41:04 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x4c, 0x0, &(0x7f0000000200)=ANY=[@ANYBLOB="05630440000000000e630c4000f200008c01acbcd9297cf4a76e04ea80b60b21d6efb41548e724db19f00bcf6e830123c34234a0c43903464dd4e9c503844e734e52e396711327b0a8d8cf15"], 0x0, 0x0, 0x0}) 03:41:04 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f00000000c0)=[@release={0x400c630e}], 0x0, 0x500000000000000, 0x0}) [ 947.847576][T10417] binder: 10412:10417 unknown command 50619141 [ 947.884174][T10415] binder: 10411:10415 ioctl c0306201 20008fd0 returned -14 03:41:05 executing program 5: r0 = syz_open_dev$sndseq(&(0x7f0000000040)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a85320, &(0x7f0000068f50)={{0x80}, 'por\xff\a\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x1f\x00\x00\xff\xff\xff\xff\xff\xff\xff\xef\x00\x00\x03\xff\x00\x00\x00\x03\x00\x00\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x06\x00', 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2}) [ 947.916960][T10401] : renamed from bpq0 [ 947.917137][T10417] binder: 10412:10417 ioctl c0306201 20000000 returned -22 [ 947.935438][T10415] binder: 10411:10415 ioctl c010640b 20000080 returned -22 [ 947.989884][T10417] binder: 10412:10417 ioctl 8912 10000000003f returned -22 [ 947.999434][T10424] binder: 10420:10424 BC_REQUEST_DEATH_NOTIFICATION invalid ref 61952 [ 948.018860][T10424] binder: 10420:10424 unknown command -368808281 [ 948.032146][T10414] binder: 10412:10414 unknown command 50619141 03:41:05 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) setsockopt$inet_opts(r0, 0x0, 0xd, &(0x7f0000000180)="15d3f1913e00fc9eac2a2dfc6b8fedb973163a67f3321cf036f71480312786fcd39087acaf6a577b71f3595eed3b0ed4d43feb3bf6fb488c6cc51afb606b71cd70085765d088f95b5d8471119fcda45f0bec6df71750a41b805ab135b94461a3215bf724f8da4783787fb824c46ea8e1a2db2e34e47a5247f5a9cf206400f604cb149618917b126b47cf03e9c0da6b01b4501dc3166e06d01842acc5268f942abecffe94609751", 0xa7) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f00000000c0)=[@release={0x400c630f}], 0xfdfdffff00000000, 0x0, 0x0}) 03:41:05 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f00000000c0)=[@release={0x400c630e}], 0x0, 0x600000000000000, 0x0}) [ 948.035851][T24007] binder: undelivered death notification, 0000000000000000 [ 948.049343][T10424] binder: 10420:10424 ioctl c0306201 20000000 returned -22 [ 948.071406][T10414] binder: 10412:10414 ioctl c0306201 20000000 returned -22 03:41:05 executing program 1: r0 = socket$inet6(0xa, 0x5, 0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000180)='/dev/net/tun\x00', 0x0, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000100)={'lo\x00', 0x0}) ioctl$sock_SIOCGIFINDEX(r0, 0x8923, &(0x7f0000000380)={'bpq0\x00\v\x00\xfe\x00\x00\x00\x00\x00\xfa\xff\x00', r2}) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000000)={'bpq0\x00', 0x1212}) getpgid(0xffffffffffffffff) 03:41:05 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) fsetxattr$security_evm(r0, &(0x7f0000000040)='security.evm\x00', &(0x7f0000000080)=@md5={0x1, "d77c1dc6dad75a51e9f708ae82b97816"}, 0x11, 0x2) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000005fd4), 0x0, 0x0, 0x0}) 03:41:05 executing program 5: r0 = syz_open_dev$sndseq(&(0x7f0000000040)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a85320, &(0x7f0000068f50)={{0x80}, 'por\xff\a\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x1f\x00\x00\xff\xff\xff\xff\xff\xff\xff\xef\x00\x00\x03\xff\x00\x00\x00\x04\x00\x00\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x06\x00', 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2}) 03:41:05 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x4c, 0x0, &(0x7f0000000200)=ANY=[@ANYBLOB="05630440000000000e630c4000f200008c01acbcd9297cf4a76e04ea80b60b21d6efb41548e724db19f00ccf6e830123c34234a0c43903464dd4e9c503844e734e52e396711327b0a8d8cf15"], 0x0, 0x0, 0x0}) [ 948.202047][T10435] binder: 10434:10435 ioctl c0306201 20008fd0 returned -14 03:41:05 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f00000000c0)=[@release={0x400c630e}], 0x0, 0x700000000000000, 0x0}) 03:41:05 executing program 5: r0 = syz_open_dev$sndseq(&(0x7f0000000040)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a85320, &(0x7f0000068f50)={{0x80}, 'por\xff\a\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x1f\x00\x00\xff\xff\xff\xff\xff\xff\xff\xef\x00\x00\x03\xff\x00\x00\x00\x05\x00\x00\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x06\x00', 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2}) [ 948.375931][T10451] binder: 10445:10451 BC_REQUEST_DEATH_NOTIFICATION invalid ref 61952 [ 948.402208][T10451] binder: 10445:10451 unknown command -368808281 [ 948.405566][T24007] binder: undelivered death notification, 0000000000000000 [ 948.414423][T10451] binder: 10445:10451 ioctl c0306201 20000000 returned -22 03:41:05 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000000180)=ANY=[@ANYBLOB="7392c2008c13fb9074cde9dca4a4068ef7467e9ef15ddc84e52de05578180902f51c7d7f59b4448c6a9e76ed9d95d0f7411c137bf238c15e9ee56cc4273b7db18592a5bf4942edd03ca6429c9b756180a26b26b71d5e9aaf5460deb190b952a8d4a29963dd02d2df"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f00000000c0)=[@release={0x400c630f}], 0xfdfdffff00000000, 0x0, 0x0}) fsetxattr(r0, &(0x7f0000000080)=@known='system.posix_acl_access\x00', &(0x7f0000000100)='vboxnet1vboxnet0@\'{@selinux)\x00', 0x1d, 0x1) [ 948.423040][T10439] : renamed from bpq0 03:41:05 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) close(r0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = openat$rfkill(0xffffffffffffff9c, &(0x7f0000000040)='/dev/rfkill\x00', 0x200000, 0x0) write$P9_RREMOVE(r2, &(0x7f0000000080)={0x7, 0x7b, 0x2}, 0x7) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) 03:41:05 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f00000000c0)=[@release={0x400c630e}], 0x0, 0xa00000000000000, 0x0}) 03:41:05 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x4c, 0x0, &(0x7f0000000200)=ANY=[@ANYBLOB="05630440000000000e630c4000f200008c01acbcd9297cf4a76e04ea80b60b21d6efb41548e724db19f00dcf6e830123c34234a0c43903464dd4e9c503844e734e52e396711327b0a8d8cf15"], 0x0, 0x0, 0x0}) [ 948.536896][T10458] binder: 10457:10458 unknown command 12751475 [ 948.564901][T10458] binder: 10457:10458 ioctl c0306201 20000000 returned -22 [ 948.610614][T10458] binder: 10457:10458 BC_CLEAR_DEATH_NOTIFICATION invalid ref 0 [ 948.646944][T10458] binder: 10457:10458 ioctl c0306201 20008fd0 returned -14 03:41:05 executing program 5: r0 = syz_open_dev$sndseq(&(0x7f0000000040)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a85320, &(0x7f0000068f50)={{0x80}, 'por\xff\a\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x1f\x00\x00\xff\xff\xff\xff\xff\xff\xff\xef\x00\x00\x03\xff\x00\x00\x00\x06\x00\x00\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x06\x00', 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2}) 03:41:05 executing program 1: r0 = socket$inet6(0xa, 0x5, 0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000180)='/dev/net/tun\x00', 0x0, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000100)={'lo\x00', 0x0}) ioctl$sock_SIOCGIFINDEX(r0, 0x8923, &(0x7f0000000380)={'bpq0\x00\v\x00\xfe\x00\x00\x00\x00\x00\xfa\xff\x00', r2}) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000000)={'bpq0\x00', 0x1212}) getpgid(0xffffffffffffffff) [ 948.667803][T10467] binder_thread_write: 9 callbacks suppressed [ 948.667857][T10467] binder: 10466:10467 BC_REQUEST_DEATH_NOTIFICATION death notification already set 03:41:05 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) r1 = openat$ipvs(0xffffffffffffff9c, &(0x7f0000000040)='/proc/sys/net/ipv4/vs/expire_nodest_conn\x00', 0x2, 0x0) ioctl$SIOCAX25OPTRT(r1, 0x89e7, &(0x7f0000000080)={@rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @default, 0x2, 0x44}) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) [ 948.732108][T10471] binder: 10465:10471 BC_REQUEST_DEATH_NOTIFICATION invalid ref 61952 [ 948.764972][T10471] binder: 10465:10471 unknown command -368808281 [ 948.771522][T10471] binder: 10465:10471 ioctl c0306201 20000000 returned -22 03:41:05 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f0000000180)=ANY=[@ANYBLOB="8f06352bd2000000a28d571e9f1856f2eee921009000002c93c2fa841c2e8ff531cdcf22ac9e6b2228e39d7da32a6050d8a6683d4b562abcd703b4d088f04b139d7659387169fafe67235d0cdf0810c9b62f99af611fd13dbe92ea5c2187556b5e792ea206f6753856d91f1bb9e0e89874e9fa559ba245d0a0866f19a503d9155bcd20ea7d9ed9dc01073c9486e046c8e9da5a26216ac1787f0b75435f6fe11933c5d378604be2321e615173de78acd4d55a3f4080cdccf04f2bed555c7d5dbae64f13638f52d6f33c39d3a1fa79a94b1a0eaee468e462321404cd096fd264e2207f9422794901d3ad367a17761c62f6e7ef8b9dcfc9ead944e88e79b4cb83180f3992303a024d2c2432613842999019b8fd8245a568814ba283a3b7bd15c1542b5a51f5a78617"], 0xfdfdffff00000000, 0x0, 0x0}) 03:41:06 executing program 5: r0 = syz_open_dev$sndseq(&(0x7f0000000040)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a85320, &(0x7f0000068f50)={{0x80}, 'por\xff\a\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x1f\x00\x00\xff\xff\xff\xff\xff\xff\xff\xef\x00\x00\x03\xff\x00\x00\x00\a\x00\x00\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x06\x00', 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2}) 03:41:06 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = openat$mixer(0xffffffffffffff9c, &(0x7f0000000040)='/dev/mixer\x00', 0x20000, 0x0) ioctl$KDMKTONE(r2, 0x4b30, 0x7) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000000200)=ANY=[@ANYBLOB="5ce91c0d229c642a969185728d6ffa804fcfdfa12679462952b63f1f7059b4decc1164786c5874775cffa4c6f7b004b003fe2f23457100c2d0febbea8bf9a552c09238371e84ab5a756c4585454239579f16f12f286024751a1fabf2ea7cbb27e6efca94424194b2578b3c70af7a53c63ae651700b8d87131866786c5f47b9066520d1f1225dc9be98ca84e7c736ee050000003cf7de291c459f5cd266eb2fe10a79d352af4cafb413e4a6a2090abe2a"], 0x0, 0x0, 0x0}) 03:41:06 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x4c, 0x0, &(0x7f0000000200)=ANY=[@ANYBLOB="05630440000000000e630c4000f200008c01acbcd9297cf4a76e04ea80b60b21d6efb41548e724db19f00ecf6e830123c34234a0c43903464dd4e9c503844e734e52e396711327b0a8d8cf15"], 0x0, 0x0, 0x0}) [ 948.936075][T10478] : renamed from bpq0 03:41:06 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f00000000c0)=[@release={0x400c630e}], 0x0, 0x2000000000000000, 0x0}) [ 948.979336][T10487] binder: 10483:10487 unknown command 724895375 [ 949.005092][T10487] binder: 10483:10487 ioctl c0306201 20008fd0 returned -22 [ 949.048328][T10497] binder: 10496:10497 unknown command -368808281 [ 949.055264][T10495] binder: 10494:10495 unknown command 219998556 [ 949.073850][T10497] binder: 10496:10497 ioctl c0306201 20000000 returned -22 03:41:06 executing program 1: r0 = socket$inet6(0xa, 0x5, 0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000180)='/dev/net/tun\x00', 0x0, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000100)={'lo\x00', 0x0}) ioctl$sock_SIOCGIFINDEX(r0, 0x8923, &(0x7f0000000380)={'bpq0\x00\v\x00\xfe\x00\x00\x00\x00\x00\xfa\xff\x00', r2}) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000000)={'bpq0\x00', 0x1212}) getpgid(0xffffffffffffffff) [ 949.098914][T10495] binder: 10494:10495 ioctl c0306201 20000000 returned -22 [ 949.120662][T10501] binder: 10499:10501 BC_REQUEST_DEATH_NOTIFICATION death notification already set 03:41:06 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0x0, 0x0) r1 = request_key(&(0x7f0000000040)='cifs.idmap\x00', &(0x7f0000000080)={'syz', 0x1}, &(0x7f0000000100)=']0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f00000000c0)=ANY=[@ANYBLOB="0f630c48ee738000"], 0xfdfdffff00000000, 0x0, 0x0}) 03:41:06 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x371, 0x0, 0x0, 0x27a, 0x0, 0x0}) setxattr(&(0x7f00000014c0)='./file0\x00', &(0x7f0000001500)=@known='system.posix_acl_default\x00', &(0x7f0000001540)='/dev/input/mice\x00', 0x10, 0x2) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)) r1 = openat$proc_capi20ncci(0xffffffffffffff9c, &(0x7f00000001c0)='/proc/capi/capi20ncci\x00', 0x2, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x4) r2 = syz_open_dev$mice(&(0x7f0000000080)='/dev/input/mice\x00', 0x0, 0x220900) syz_mount_image$ntfs(&(0x7f0000000200)='ntfs\x00', &(0x7f0000000240)='./file0\x00', 0x100, 0x4, &(0x7f0000001400)=[{&(0x7f0000000280)="2f39d8bd64fba7d6b0cd1d9fe01ba2339cfe10c783aaa7a6c6611026441a6dba124f33c58f7430d92bc4502b43a5cac1f50fff86d29f3cc8de7354d757b9ad680a6b3baacfcc128a8c6e35909a12b940e4b71848a0f7077d2395491ea2ef5c6ce8abdc422c", 0x65, 0x5}, {&(0x7f0000000300)="b3b0025f610553080af0dc72512e41a293dfd5fa5dd3404b4dc9c9c41e19acff7573a98eb9ad50f9c24637db5c51666ac5b326401e1f8e9a4b1570a0d874a7c05e17286198691cf1dd3a712a89f76e57228bc0b2e5403ba9741afb585061a7efa0ea597508b6f5ef839cf9a64c73effdad62d37a129433977611222eeceffc9451d7be0bbdbcab70921254e96bb77e3e4741fb07014c4e0e7328c2f19d7b461f7bc0abed83b3e53232d0402d1bf206743ef60dd15cfc2305e1a3569991421d381534e401fd54e4e51d1bb1a088a51716662af73acd8296139f3918a927262d5b3d778b9e8b6734f9439951fa51035cf224cbfef638c2e0358d3f54dae30ec52b281b42cb86220a2f5601a3585bcdb7ebdd7e875d884abb8cee2f94a26a0133f2a6b9bbe7cb3026ef97fd7ddda8c5bcb60a339ee89017a508ef8ecd4bad2faf9de2a736d457b3caec82c5d1ce0af6dfe5fc90c1b425860e54309cc1b0190abd2a3a2b230ba94c0f3c028a7b33d12f15284d209b2cb42a8bb4063ac7fe4ef01f5c7283d3ca8101048b890aba7c94d082c5ea0f3c77d7e89b28742bc0c4fcf7011a536469528e660b296f4b40f634fd2f94e3a7bc1bbafb4d651eb5814ff1820de2d52b99a684a4a35586ea16ff6cd4ddb5d7af98edcea0d492c29b2ff5a76aed5ae34ae5d2881925c01aa64b9a4bf5e25acff3ddbad8632499f4eb7001c86ea33d0ec7fe9af4488964e035e61a3bf4350a4595d6551bb9e899a486dace1cacf9fb90a7407c6c87d08e2b2bf77316bfd98aac5321c55306dbf5bcaa870a4bde5557c9c474829fa95f4600f70bf1e1f74d528c3f141f7f34f5f78f3522954bc6ee9296feef23b9788f18440c0e13df5bac50090f2681dfe9985c05cc4f9a4d7e2f8a9cf7af54d904234dfa3e162450b45be51099c4f2e90f9b50a0faab92f13c91e0dd1370d5e1f3d97963e55649bc6b4e23a614174e92c90f7f446aa39058dcedcf7e3d1dc5d2afead001185ccec3e080bb44a9a6ac3bb73c1967a81802ef69682e8d96bb56a97a1066a417859bad25a9359cde52e71ed72799e9dd97e81591145e1a7be1616ebd96566a35188bf3cee3e1331b985a96184e6b0736ce785d592c4a3f2997d3a9009e05b45627627334c35f2587e20eff039b6fc744d51f99441a170238f1ad2c88ff1f8f0ea4d90da7d17a22c7baac4480dfed8654d2ef00a622756ece0a9a4189634cf8328d7d6203b1cc111d5c776d74047e48d9af7915134d5209c4f6f1b205d92f5a83a9f75f09353abe3bdf406c7f0d13dcc88ac35300513d8d466d1ba5b4fb1e1572c8b689d0228d709ec8955cef480a1524966f547a95884fca20c09ba106120ac09d75c06d053bf01969d1ef5d64f10bc917aabfe33df23f187327ad3f43c5242125add2712f533dca0d923e44a2859264dc8192ae40fd990530e04e2a0196e529d3cbe64526f805d7969b5cbc23b50ceb850a0e01b1b80dcdc21dfe396ed4551d363b4c3a0e03fad71665747e9361a0e34bcecd618fa6aa0b5a6b2724c4b51513de20147c9eea0ae0f3ca115121f40aff0f6c47b0e5df412062aff5cde5bf226c6f0ee335b0670b452326532a2208d2d300aa295bfe4274519ac9ff3d0230a9404dc638ee9dfaa62b894af78efa96dae18df4d6b560fffe33bd7fe9ccc50d0be8b96bbaa053dd7ca166ed4f9bab8b533707147c7863b88c5fc1810deb088d16243875ca01ca9f98754bffaa33fe0bde595bebf4eff8a1329f6e43d613aa5f2f21ed685e1ac84e8c030a5d374990e4c0cfb416ea63520c66ae9fef8517bd056ae8ae98ede0d2e611b054c3aa5da9450189ba2ca8d415a435239c684b468d25ce69ba48eb8fbdf662b47afdd43a53d67d6e2026a5b5689b9ab52ec0df85e43778267ef8f477972b85fdf278434ebeae93adfcf4b229dab965ec416188a7a88b29238b033b2b9219fbda7bf8c84338ecf6f1e5cc67107fef91a218cd27f230d75ff93674dfecbb24c9566099cc9aadca747f60e60a5206a03297d9b6d2f7ad8aa47fba9b9ca72f83c7b9df0100c9ba4c62ddd7b912dd16c1ac873ba776b3e7a4bde1b569172d4474d6e8d72ff612695166c69d4d881853d4638f66fd048463588f8751baf42a29b6dc12e0dac3e4278727bae54068af585695f91eaf113267a55689863ee70cf1c2ab2e43fbdfce21d32a01580212836922b03171ef64b070b3069fff7a99ad0f05be9ff48bc6b03798eee513792c2981fc0ed5dc273d180077f8a21cf297d408a665a7476c05820a769c54a710a735753131b6dd40a344e5a3d76779e239d822e090fb879d1dab5db477ae2d9a05ede4a0e7bef77a3236178e0a2c2c310675147ac7a8088d4bba53d1baaac803d66e92652f23c287be9150c3dd539f7462a93c11802562eb08f3ecb889b3eb024c818771a42969d4cfe588dcb9d1ebbbeec3442106cfae8fd299bcba77be8bdec4156fb9c670b1d76df9431391b48cd53c2612fa00edd95e8cff1a3d391c7c2770552a27e99a92c9a789f1336fe125a0e1bb8dd5f7fbe76e4bbdbdbadd5d9d02b64ac57d226db051e7e75b38f762762203dd220197fc311c2362bc4e0d618af46a914f42a52ce3cb9f710f67b9dc4d7294f5770eff19321371cdfcc147acb90656e9e16f550597cd84c388755f4bed95f17a1c86e28579889e4c8ae62c929321b64e7d58032d64d3e3aad02b1d32f71829c2e4465561bbccb5850d94fc2a53d1e66f11ae2ff568e8122ff2ccf739a3bd7b6d991862229c05d67c3fe470d947519e3d63a2fdc187ea93b07f15db15b7272dde9a824b1f22311708d17fce9e9d52cb6eb3d5c41f9cd58102711bb4ae336acb7f393910260a7e721ac3b892f19a962842c74592daa3ab563989bebcf4b819cf9fd8f2e1c99c929361d55410479b387df77d395d33a35e2232627b9b92c6b52ffbbf9b66fa9ca6645039c2fe94afff3b57b28590fefa36a086ba4bd65e1c7e1e93482c548507a6afc6f837219e1db622ec4b0d081ec94446d873524acdeaa11347ac8c9e9900769ba696b376b74d00185a9ccdb85374dd380f0090852c0d2ccec6543bf7f8b82a831a43bf1031ac2341abbef31b3189f9e4b6fc0537181ceba6ef16775677626d6b1da68e219f4a4bf2f09ecace4063404abb20174beabc8129c01df49d855ea596f065f6c409afbd15117f8141439a55682f97dbabfad0a4c8e0e87a7dcdade890d5d32bc67cb109d85ee5695dd2aec90fc3dea10b3266fd406553476af4c5ab9e42f21372a8f6049b57107c1b4a9d6c771b3e8e25fc028afbc11984090cc275f8deedda3a27708bca9fb4860c17d109a0a864cb768a6aec264e51b272695c8635bac4f46853868cd449bb32c6e64fae30a1f96719473efe72afc24208ef8c1401039350afe7cfa1ecd8c5cef94eeae85ef6df8e15edda51de3a5b34c9e9709840f45d0ef2102077be1d08f968dbc3579b9381fc9b5ea34018b9b9be0c4e45fac7e17743b2f11f73d5875e6b7ced44e731f39205d90e343bc60e77815047c8018cd4a24da9de0b73cfa619202102584150661b8328bb21d87ff957d4e3fc0f4fda75c49306ffccb713d98e1870e6b5c01782a1ca656a392d777276478bfad884464ea74f7b5383053aa3075109f2de585c1e57ce2829d024e335da5c9c3e7bb574499b0c2dc24fcef8ae97dda4a5e2447869faa1886d923c0b04d9c4ad179643246360f7bd1121922eed93e38d1614b2c0bf7880e8206c562cad3b9cfb6279e21005f50aaeb47fbbf6f0e91f76ac4dae47647f2fe2769cff9cac742bc896f54f3997b9dd23c5ed15a890c0eb32c41f101efa3f346d0e8f3e0b06495c7f6f82731e93caa39ab815c62d63c6c1dcd5928bd23a33c1119d9232bb8114fd057d64df8dc7a609bd270f4c9662db2fd5c42500108d652879b70bda3924e21018da2cdc5c93252cb4d4df63843eec73066cf6f406d77afcac23ea72a62a50e48fd35420ddbe11c269afb52b1e163d4488ef3a22406665f33938d4acc65797a5d667977448c1141cd7d8e6e53562b71b9f3694e3e50c254607fd6717aee12915aa518e72194c95c01d3a776b9af06e36975ce1a50702056c29230f61f88234fed852c2b3f4b2d2ea29df2407ad3c2957e799cef0fe4e941b07b13e7a7d0f74f22b3822458d343eb9565301679e513380439aa095f79d622f688db11363fa4333558e4a55cae2eea788f49b6388c7381043cf1eb21517fbe4ead8b78775efa6cfb068ea948f668ae3a9e03e7e0a80500e4bf065c2d66d56bcf79878ed86f296a519455d65f46e9c5738992ec9f8411e4aecdc31c86fde8fc08b5815f81c3dfcf9c14b66bdd57d1b2cedcb96bffa0596ccd2d3ba851470c4ebd19eeb7b3a95978e8c50f1c7f6e3b30fd245aba453df78b8a72fa9e8db64443dd8f8b166df8d379b18af866f59a99f2b46d3b47bf13df99afc6011a5f4ba17fa2a5767eedd1038fa316fe027f3ae5181bfac294904ffd33df0b6aa1ed14c81fb14f903073d8798c696624f433a995bc1de567f372814ed18980d7d9aae87d5c627e88f0d6c7815e098d9dec4f958941f408a20e000f7ddd04969410b144363d7c8f44ac710c3643473bcb12eb80b22a9986994ad775f0f1c7bfe1731f80e956c5946dfda2b7eac18a4413f9e5a8f4a7982e4ad217e46dec96939557b5f34a30966c8d83ad0429e9db96e50505c3a812a79a01e425ce2ffd9ce54d739f7093f2cc980fd51400f029b4a36b3484dbb798112e0ea81de15c56c52b15102555c0c2cc6dd20e4c835f09092d40c067b0191f912b75b35a4cb003d070ea38c46d3a54c4e30465aa54121886d5081ee64067d80a9e08385041b55c1e96b91218e59a28bb99459efa19ca4aaa5882bf3e0e66858d4fbdf396af5a238fd2a46344f5fe062be456e2e18522a9869268096e74447f3009e5329fedbaead3d797ee5c6ffc4bd434feb186335f5b5230c1d36bee72e8cb6ecfcf8043a1a4bcd41adb07d4c26295ad6e411bdec513b559e44a46636c8ecbf5bae7e2b5effefb344d7373bbcbfb30634f7111bc1793357b48e205e4edc2bfd012b60010852e26cd8206568571e6c033028943202b1b041b8e866a082ece90d07ff08d2901d4e8baff88ab5a37771198bcd717475bbdfb1af164671f1b445c6f5a71826e77fdc6cc49c7be40bc21c5228b07873a1c4c2896ecb790a62009317e5ef415f3c0ef45c28d6955e28f14e1f955bbd1b9ba9e111da338804426874d06439adcf1a554cd94f700757242440518661bec6a190bae783999fddef8b263573c0606b12ec26f87acc7551fe3e724b688d313a36d5df1c1ea072941880846a6d99f0183773e66ccd2bee823fe34286b9f43a7f9d01b1ae1c85e74ad80e0480da0d0c26aa04ea49d339f32b3bfdefd54f691af6413f97c89109d18fd0dcff3d2715f809f992c39d99bfa364c125a42048c93c24653dc59e1e06d8718a01b7d597dea0f3421f2dae59eae17536ee462fede22a877ea9c290cb4e521a001cfa55c7ac4bb8523e2418072b767a14fb1a0d9e2f775ac484394abd15f8b666353bbd706a0c5a727a931760a8c382498fc9131537305062d7582a0f712350d8a9042e09173ad3e008fc9363dc88e4116f2e51f04902e3bfaae820e555ec08e91e36f8adbb068ac7de98c98a10e073833bd9577ccd66a28d9a5a777969307bce7fe852ceee914d90f8bf4bae3f2fcb36a33918c35c3b8cbde1196f98c10bd5eb97b73d65f35e2f22d5fe", 0x1000, 0x6}, {&(0x7f0000001300)="cd4aef09265f50426e10c96a2037732ffd8e297867f6a5ee7c104676d0d0538e204f2940782effafb5d0bacf7e8a934edc901d40cd773fb00a074c", 0x3b, 0x2}, {&(0x7f0000001340)="b9a89b8d457d75cbf2fd50173e22aea1dd6b0e88866d5c0767028a0fd9b4232e4dd9c80d328696d8a72789c45640f81c38fe3180ada6f1116b227d50d5d2386ce6059d0f0c22bc4cffc649456e329cd1121d09c06db06308229a27c6c849c38ffc7b8bb08ebfb9aca9a94d7a99563524f8096fe9629c17acbd613af7ca05705ea8252fa84f8a670794041a4273", 0x8d, 0x4}], 0x80000, &(0x7f0000001480)={[{@errors_remount='errors=remount-ro'}, {@errors_recover='errors=recover'}], [{@func={'func', 0x3d, 'FILE_MMAP'}}]}) getsockopt$inet6_udp_int(r2, 0x11, 0xa, &(0x7f00000000c0), &(0x7f0000000100)=0x4) ioctl$PERF_EVENT_IOC_SET_FILTER(r2, 0x40082406, &(0x7f0000000180)='}/cgroup\x00') ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=ANY=[@ANYBLOB="05631a750a498bc0a45b17ad347b0000"], 0x0, 0x0, 0x0}) 03:41:06 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f00000000c0)=[@release={0x400c630e}], 0x0, 0x4800000000000000, 0x0}) 03:41:06 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x4c, 0x0, &(0x7f0000000200)=ANY=[@ANYBLOB="05630440000000000e630c4000f200008c01acbcd9297cf4a76e04ea80b60b21d6efb41548e724db19f00fcf6e830123c34234a0c43903464dd4e9c503844e734e52e396711327b0a8d8cf15"], 0x0, 0x0, 0x0}) 03:41:06 executing program 5: r0 = syz_open_dev$sndseq(&(0x7f0000000040)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a85320, &(0x7f0000068f50)={{0x80}, 'por\xff\a\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x1f\x00\x00\xff\xff\xff\xff\xff\xff\xff\xef\x00\x00\x03\xff\x00\x00\x00\n\x00\x00\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x06\x00', 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2}) [ 949.379547][T10507] : renamed from bpq0 [ 949.392493][T10517] binder: 10510:10517 ioctl c0306201 20000040 returned -14 [ 949.428432][T10517] binder: 10510:10517 unknown command 1964663557 [ 949.447969][T10517] binder: 10510:10517 ioctl c0306201 20000000 returned -22 [ 949.448153][T10525] binder: 10509:10525 Acquire 1 refcount change on invalid ref 0 ret -22 [ 949.469691][T10526] binder: 10518:10526 unknown command -368808281 03:41:06 executing program 5: r0 = syz_open_dev$sndseq(&(0x7f0000000040)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a85320, &(0x7f0000068f50)={{0x80}, 'por\xff\a\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x1f\x00\x00\xff\xff\xff\xff\xff\xff\xff\xef\x00\x00\x03\xff\x00\x00\x00H\x00\x00\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x06\x00', 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2}) [ 949.476479][T10527] binder: 10519:10527 BC_REQUEST_DEATH_NOTIFICATION death notification already set [ 949.495121][T10516] binder: 10509:10516 unknown command 1208771343 [ 949.502961][T10517] binder: 10510:10517 ioctl c0306201 20000040 returned -14 [ 949.514089][T10516] binder: 10509:10516 ioctl c0306201 20008fd0 returned -22 [ 949.526934][T10507] : renamed from bpq0 [ 949.541779][T10526] binder: 10518:10526 ioctl c0306201 20000000 returned -22 [ 949.563397][T10528] binder: 10510:10528 unknown command 1964663557 03:41:06 executing program 5: r0 = syz_open_dev$sndseq(&(0x7f0000000040)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a85320, &(0x7f0000068f50)={{0x80}, 'por\xff\a\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x1f\x00\x00\xff\xff\xff\xff\xff\xff\xff\xef\x00\x00\x03\xff\x00\x00\x00L\x00\x00\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x06\x00', 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2}) [ 949.587543][T10528] binder: 10510:10528 ioctl c0306201 20000000 returned -22 03:41:06 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f00000000c0)=[@release={0x400c630e}], 0x0, 0x4c00000000000000, 0x0}) 03:41:06 executing program 1: r0 = socket$inet6(0xa, 0x5, 0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000180)='/dev/net/tun\x00', 0x0, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000100)={'lo\x00', 0x0}) ioctl$sock_SIOCGIFINDEX(r0, 0x8923, &(0x7f0000000380)={'bpq0\x00\v\x00\xfe\x00\x00\x00\x00\x00\xfa\xff\x00', r2}) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000000)={'bpq0\x00', 0x1212}) getpgid(0xffffffffffffffff) 03:41:06 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) sendfile(r0, r0, &(0x7f00000000c0), 0xff) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = syz_open_dev$vcsn(&(0x7f0000000040)='/dev/vcs#\x00', 0x3, 0x8000) write$UHID_INPUT2(r2, &(0x7f0000000380)=ANY=[@ANYBLOB="0c00000044009307518ca8d04a87f9e02e39d11536e13c7f34b46289b4023da5886a30412e5675b428e3c29f8b3c4833ddefb398c0d81f236275b463d3537064346e9ce6d4c2b618a02d06"], 0xfffffffffffffe54) ioctl$PIO_UNISCRNMAP(r2, 0x4b6a, &(0x7f0000000080)="c5d25170400a4f74384b773ae8dc3fbb1e76e57a651b5bb39ecb850b9ab1b90ae950d7f88de81958b0a1e51c83fba9") getsockopt$inet_IP_IPSEC_POLICY(r2, 0x0, 0x10, &(0x7f0000000200)={{{@in=@empty, @in6=@ipv4={[], [], @multicast2}}}, {{@in6=@local}, 0x0, @in=@local}}, &(0x7f0000000100)=0xe8) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00'], 0x0, 0x0, 0x0}) futimesat(r2, &(0x7f0000000180)='./file0\x00', &(0x7f0000000300)={{}, {0x0, 0x2710}}) 03:41:06 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x4c, 0x0, &(0x7f0000000200)=ANY=[@ANYBLOB="05630440000000000e630c4000f200008c01acbcd9297cf4a76e04ea80b60b21d6efb41548e724db19f010cf6e830123c34234a0c43903464dd4e9c503844e734e52e396711327b0a8d8cf15"], 0x0, 0x0, 0x0}) 03:41:06 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$FS_IOC_SETVERSION(r1, 0x40087602, &(0x7f0000000040)=0x12000000) setsockopt$ax25_int(r2, 0x101, 0x7, &(0x7f0000000080)=0x2, 0x4) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f00000000c0)=[@release={0x400c630f}], 0xfdfdffff00000000, 0x0, 0x0}) [ 949.786046][T10541] binder: 10535:10541 BC_REQUEST_DEATH_NOTIFICATION death notification already set 03:41:06 executing program 5: r0 = syz_open_dev$sndseq(&(0x7f0000000040)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a85320, &(0x7f0000068f50)={{0x80}, 'por\xff\a\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x1f\x00\x00\xff\xff\xff\xff\xff\xff\xff\xef\x00\x00\x03\xff\x00\x00\x00h\x00\x00\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x06\x00', 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2}) [ 949.890426][T10548] binder: 10544:10548 unknown command -368808281 [ 949.902241][T10550] binder: 10547:10550 ioctl c0306201 20008fd0 returned -14 [ 949.927451][T10548] binder: 10544:10548 ioctl c0306201 20000000 returned -22 03:41:07 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = syz_genetlink_get_family_id$ipvs(&(0x7f00000005c0)='IPVS\x00') sendmsg$IPVS_CMD_GET_DEST(0xffffffffffffffff, &(0x7f00000006c0)={&(0x7f0000000580)={0x10, 0x0, 0x0, 0x80000000}, 0xc, &(0x7f0000000680)={&(0x7f0000000600)={0x80, r2, 0x0, 0x70bd26, 0x25dfdbfb, {}, [@IPVS_CMD_ATTR_TIMEOUT_TCP={0x8, 0x4, 0x2c}, @IPVS_CMD_ATTR_DEST={0x5c, 0x2, [@IPVS_DEST_ATTR_U_THRESH={0x8, 0x5, 0x4}, @IPVS_DEST_ATTR_ADDR={0x14, 0x1, @ipv4=@multicast2}, @IPVS_DEST_ATTR_ADDR={0x14, 0x1, @ipv4=@broadcast}, @IPVS_DEST_ATTR_FWD_METHOD={0x8}, @IPVS_DEST_ATTR_WEIGHT={0x8, 0x4, 0x9}, @IPVS_DEST_ATTR_WEIGHT={0x8, 0x4, 0x16}, @IPVS_DEST_ATTR_PERSIST_CONNS={0x8, 0x9, 0x1}, @IPVS_DEST_ATTR_L_THRESH={0x8, 0x6, 0x7ff}]}, @IPVS_CMD_ATTR_TIMEOUT_UDP={0x8, 0x6, 0x8}]}, 0x80}}, 0x40000) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) r3 = openat$zero(0xffffffffffffff9c, &(0x7f0000000080)='/dev/zero\x00', 0x400000, 0x0) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000000c0)={&(0x7f0000000040)='eth1-lovmnet1:\xee[em1\x00', r3}, 0x10) 03:41:07 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f00000000c0)=[@release={0x400c630e}], 0x0, 0x6000000000000000, 0x0}) [ 950.028682][T10546] : renamed from bpq0 03:41:07 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x4c, 0x0, &(0x7f0000000200)=ANY=[@ANYBLOB="05630440000000000e630c4000f200008c01acbcd9297cf4a76e04ea80b60b21d6efb41548e724db19f011cf6e830123c34234a0c43903464dd4e9c503844e734e52e396711327b0a8d8cf15"], 0x0, 0x0, 0x0}) 03:41:07 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x0, 0x0, &(0x7f00000001c0)) r1 = openat$rfkill(0xffffffffffffff9c, &(0x7f0000000040)='/dev/rfkill\x00', 0x460100, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x4001fd) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f00000000c0)=[@release={0x400c630f}], 0xfdfdffff00000000, 0x0, 0x0}) 03:41:07 executing program 5: r0 = syz_open_dev$sndseq(&(0x7f0000000040)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a85320, &(0x7f0000068f50)={{0x80}, 'por\xff\a\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x1f\x00\x00\xff\xff\xff\xff\xff\xff\xff\xef\x00\x00\x03\xff\x00\x00\x00l\x00\x00\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x06\x00', 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2}) [ 950.075958][ T8198] binder: undelivered death notification, 0000000000000000 [ 950.099033][T10546] : renamed from bpq0 03:41:07 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x0, 0x0, 0x0, 0x371, 0x0, 0x0}) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) getsockopt$IP_VS_SO_GET_DESTS(r1, 0x0, 0x484, &(0x7f0000000040)=""/245, &(0x7f0000000180)=0xffffffffffffff68) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000005fd4), 0xffffffffffffffa3, 0x0, 0x0}) [ 950.176543][T10565] binder: 10564:10565 BC_REQUEST_DEATH_NOTIFICATION death notification already set 03:41:07 executing program 1: r0 = socket$inet6(0xa, 0x5, 0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000180)='/dev/net/tun\x00', 0x0, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000100)={'lo\x00', 0x0}) ioctl$sock_SIOCGIFINDEX(r0, 0x8923, &(0x7f0000000380)={'bpq0\x00\v\x00\xfe\x00\x00\x00\x00\x00\xfa\xff\x00', r2}) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000000)={'bpq0\x00', 0x1212}) getpgid(0xffffffffffffffff) [ 950.240113][T10572] binder: 10569:10572 ioctl c0306201 20008fd0 returned -14 [ 950.268100][T10567] binder: 10566:10567 unknown command -368808281 [ 950.293421][T10567] binder: 10566:10567 ioctl c0306201 20000000 returned -22 [ 950.323361][T10576] binder: 10573:10576 ioctl c0306201 200001c0 returned -14 [ 950.335193][T24007] binder: undelivered death notification, 0000000000000000 03:41:07 executing program 5: r0 = syz_open_dev$sndseq(&(0x7f0000000040)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a85320, &(0x7f0000068f50)={{0x80}, 'por\xff\a\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x1f\x00\x00\xff\xff\xff\xff\xff\xff\xff\xef\x00\x00\x03\xff\x00\x00\x00t\x00\x00\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x06\x00', 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2}) 03:41:07 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f00000000c0)=[@release={0x400c630e}], 0x0, 0x6800000000000000, 0x0}) [ 950.369794][T10579] binder: 10573:10579 ioctl c0306201 20000200 returned -14 [ 950.464292][T10578] : renamed from bpq0 03:41:07 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$audion(&(0x7f0000000240)='/dev/audio#\x00', 0x26, 0x0) getsockopt$bt_l2cap_L2CAP_OPTIONS(r1, 0x6, 0x1, &(0x7f0000000280), &(0x7f00000002c0)=0xc) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x1b74) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) r3 = openat$audio(0xffffffffffffff9c, &(0x7f0000000040)='/dev/audio\x00', 0x8000, 0x0) r4 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000100)='IPVS\x00') sendmsg$IPVS_CMD_SET_CONFIG(r3, &(0x7f0000000200)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x800000}, 0xc, &(0x7f00000001c0)={&(0x7f0000000180)={0x20, r4, 0x31e, 0x70bd2b, 0x25dfdbff, {}, [@IPVS_CMD_ATTR_DEST={0xc, 0x2, [@IPVS_DEST_ATTR_WEIGHT={0x8, 0x4, 0x8}]}]}, 0x20}, 0x1, 0x0, 0x0, 0x4000005}, 0x8001) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f00000000c0)=[@release={0x400c630f}], 0xfdfdffff00000000, 0x0, 0x0}) 03:41:07 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x4c, 0x0, &(0x7f0000000200)=ANY=[@ANYBLOB="05630440000000000e630c4000f200008c01acbcd9297cf4a76e04ea80b60b21d6efb41548e724db19f012cf6e830123c34234a0c43903464dd4e9c503844e734e52e396711327b0a8d8cf15"], 0x0, 0x0, 0x0}) 03:41:07 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0x0, 0x80) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) 03:41:07 executing program 5: r0 = syz_open_dev$sndseq(&(0x7f0000000040)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a85320, &(0x7f0000068f50)={{0x80}, 'por\xff\a\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x1f\x00\x00\xff\xff\xff\xff\xff\xff\xff\xef\x00\x00\x03\xff\x00\x00\x00z\x00\x00\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x06\x00', 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2}) 03:41:07 executing program 1: r0 = socket$inet6(0xa, 0x5, 0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000180)='/dev/net/tun\x00', 0x0, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000100)={'lo\x00', 0x0}) ioctl$sock_SIOCGIFINDEX(r0, 0x8923, &(0x7f0000000380)={'bpq0\x00\v\x00\xfe\x00\x00\x00\x00\x00\xfa\xff\x00', r2}) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000000)={'bpq0\x00', 0x1212}) getpgid(0xffffffffffffffff) [ 950.627192][T10598] binder: 10593:10598 Acquire 1 refcount change on invalid ref 0 ret -22 [ 950.641613][T10597] binder: 10595:10597 BC_REQUEST_DEATH_NOTIFICATION death notification already set [ 950.661504][T10594] binder: 10592:10594 ioctl c0306201 20008fd0 returned -14 03:41:07 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x0, 0x0, 0x0, 0x2e3, 0x0, 0x0}) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) [ 950.745122][T24007] binder: undelivered death notification, 0000000000000000 03:41:07 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0x0, 0x20) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f00000000c0)=[@release={0x400c630f}], 0xfdfdffff00000000, 0x0, 0x0}) 03:41:07 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f00000000c0)=[@release={0x400c630e}], 0x0, 0x6c00000000000000, 0x0}) 03:41:08 executing program 5: r0 = syz_open_dev$sndseq(&(0x7f0000000040)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a85320, &(0x7f0000068f50)={{0x80}, 'por\xff\a\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x1f\x00\x00\xff\xff\xff\xff\xff\xff\xff\xef\x00\x00\x03\xff\x00\x00\x00\xfd\x00\x00\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x06\x00', 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2}) [ 950.926943][T10614] binder: 10613:10614 Acquire 1 refcount change on invalid ref 0 ret -22 [ 950.939612][T10610] binder: 10609:10610 ioctl c0306201 200001c0 returned -14 [ 950.956210][T10617] binder: 10612:10617 unknown command -368808281 [ 950.983051][T10617] binder: 10612:10617 ioctl c0306201 20000000 returned -22 [ 951.003652][T10614] binder: 10613:10614 ioctl c0306201 20008fd0 returned -14 [ 951.012359][T10620] binder: 10616:10620 BC_REQUEST_DEATH_NOTIFICATION death notification already set 03:41:08 executing program 3: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000080)='/dev/btrfs-control\x00', 0x400001, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000000040)=[@acquire, @acquire={0x400c630e}], 0x226, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f00000000c0)=[@release={0x400c630f}], 0xfdfdffff00000000, 0x0, 0x0}) 03:41:08 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x4c, 0x0, &(0x7f0000000200)=ANY=[@ANYBLOB="05630440000000000e630c4000f200008c01acbcd9297cf4a76e04ea80b60b21d6efb41548e724db19f013cf6e830123c34234a0c43903464dd4e9c503844e734e52e396711327b0a8d8cf15"], 0x0, 0x0, 0x0}) [ 951.051710][T10615] : renamed from bpq0 03:41:08 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) r1 = syz_open_dev$media(&(0x7f0000000300)='/dev/media#\x00', 0x80, 0x20000) setsockopt$inet6_tcp_int(r1, 0x6, 0x7, &(0x7f0000000340)=0xffffffff, 0x4) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) r3 = syz_open_dev$dspn(&(0x7f0000000280)='/dev/dsp#\x00', 0xffffffffffff7fff, 0x8000) ioctl$GIO_UNISCRNMAP(r3, 0x4b69, &(0x7f00000002c0)) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) vmsplice(r0, &(0x7f00000036c0)=[{&(0x7f0000000380)="a6e5f55c245cdb1dfb", 0x9}, {&(0x7f00000003c0)="3f91a0ae1423794e67b4a6afb69f2dc8d9cf2065bc58d4286050d178aa1929e9a9247f8de8dcf1a52a364c2365b53b9f94479400813069fd56637600b2516301", 0x40}, {&(0x7f0000000400)="957dafa4451fa597ca5a08ec7b461ab60139ee8540578069e4293e4acae21f21dd76b640e5bd620f2d0299dbb2b4c96539aaba6056e3670c01c1e378a30a0b57ec7487c046c79050104f9c0a31c7a6d9c83243629e350d6bbfff7138e24ca62e993b07926823f1013669235fd8c21f47a3ddd467d6398a91c92ff3d8c4706747385a8f86a609d10802a18f362d6d257e642fa18d75063b983fc03b5590b2a11cce9f542961c723476aadf6d712749c580bf2cc9cad62174cf351977b0280f668ccbc0429d9a4e558d45de410938dd69ae29f87d774bffe788fcc870e705b5b05993e3a82e5e3ee9bb058e188f44366061a9e1dc05dbaf2c425e6ed0610e389b4f11256738662a80a6608784b5d9f7ef4e84ca6f6d0eb8ecb84d204440089efb59863724698cea1ad1e2c0a01853c48ed7312a8fe06dc1aeac552cc0e898129cc14f0bbaf7b0469887dc8576ebffb85268da9a56808388c264575d1688204719fd18bac6fec40e18e782844c77bfd383180d6cb5e91f0c474b1b0385d86cf2a2e307e43a6f3828df87d02cc0f71b5e932e791dcca5117ea7f16133461469726193bc6965a5903b36c695b6b5f11f84b9400406e8871725cde540604034b449085be1b8a4e9f27b55f3bd45295db8a29843c2a150fee9b464b9c5ef3d66bbd8616913301ec8f42d682efcbf61207504d158466c460f08c294ca069199c394b2615a59fd2f8b85b8a0e0643b0f5943a4c925bd707b398e33dc506cf74b88bef3f2c080cc5f45e84923d822400cc1dcfaa5572f0379ba7e89f19573856f4aaaabbd6d650034e293d283d507a8e6ca2d0162a4e4559b805df7b693bce2c5925c3001ba43c4deb88aed056804d624daf9dba72d9c011edc66caac5b8b6720fa99b1f15a83716b11cf3fff2764a8beb114f3464d9eade9a8a5a8e8eb9617a701a7d0dd5a76f522291e167facfb31d6628ed71ee4b7f29348f676e726cdb944eabb827e4d007d2d6ac637492487866ddc56b8b34639282608829b87e8f2fad160642d161deccb0bc19c0a348ed2b952043913cea4632c176f3cadb15432b2186c4a86d1cb5d890262814d494fa96402b11d6a33207713c805bcfa77d609ebeb3758aa3194f5f00e0577d3c1123eadf0845618a22cc90e33ab45cfc21090932702878d44494ac731d7e9584507238c14a3711b0d574f31060091b014d233d819e4f2c85073ca5b8e01aaeeae172b31a89f8a3b7e8684a331dd617795429859162d79e5352d54c06a9bb6719c9f2c2b7f84bf289922750361d8d36dec5444359156c3b1c4954949a5a9ff3e30c5711d03a6b9fa49b7f4dd85a5b1e08ad70a11b9f6a9a8d4379f8ee157570f5e69ab1a20f4ce3e9a7ba9b6664c770d7254381d6ecacf099bbb2a73975e2152136815b3e1eccef75b9f3bb9602d40440b95b218ddcb869aa77b1dc8c1b79a6374471ae8b327e103d6d5c2361019884f3299aff998b6fa15b624d91c0dba7102fe351b233993e9e0fe044656fee7b9dc8d87016c04bc5cc781b56cd7c727c8adfeced001c39c1768e59aa580d64aaa8e224b98bd5fa955e27557546ecc9bc932a0890d43315d99cbee0de435850c35873f0b0e66ca57938d0c0f52e3e92a26854fc782a52af3281f4c6430de7ae925b81710149b762a206c85fe32a9f5f5ab5742e3fd2affbe583656b8eae4da03a1a5d1edb836af5fd6bbb48d7cd3860092b7588fad3eeca3d240c67038ae5b5811f36ae9d0dc04cab6bf991dfd14d8358c7624e70ce6ce83ce15572a69141c3d071a4db98fccb599bd9c51c2945dd28e43cfe0f6c7888b5ca2a58f6f7da111b82e819a32006fd36eba5f40e752ff90d650d173ba201dc5ff7fad5bff4d0f14805608fbe12fec939db0f00edacf52189af1ee6b504063704dc01b7bf4d17446f3d57a022180e86e0e22e9343323a7e35797e3cddbbfab6e6d139902ec7b2c7479964118aa64f87a8a07db60e40df23afcd006a97db90efb107035b9c50d968f2ee9f8a5e06ab9a7a2807c68872b62a664416abf3a9c293ee7453dc3d53f38ba87a5b03986cc171ff276b8ba110478f684e24fbcfd2f50d6399b45424920beb0e7783809f0e8c36c5699177e2b30a33a11c9ae9287055050b3f34fd20e215eedab9368ca791c9e4d923592aa90741ebe0b7b37dfbed683637f93f74456901a03847ece96fb18718f250586dd1efe6f0878b77cfb354c215491ad44dafaadc94c17e3d325abc78ee894f90b688662e45d45d2796101a511d952950c9f3a842f7f68defd841d791e2f06e8779689cda32be16759c12d0a34105f0209bf067943c17ba6ca8d7dc558625882d9bdec0888d6e57c848623cdae8c546af5dfb73b0cd9f4d96d8daad9cdcb47d801eb169cd4be57dcd8c775f22e45bf1b66070e0801bd40e263b657f7fbd294c9ba951843fbc473ba463936c9fd64b9be64b6ae5689753c0c214acb63e9b869c69754952d19d8e77cc7ff9c9603b68475d57baf09bb8c5fc9e0bea7127b7a7120793e14a817449902d64cc7940c5ca5c89c5b85855e125fa14d1597f585e34a2b4874c12a161a964bc75e3429f5255175cbf705cd59b71a7c2266cc1140fc0b414662c80f75fec88e18ba32929602a6aa5035d19a7f1154501022f0ce6aab86fef6df239866bdc328bff44b96047ad1ac67e7143adf5b4a62f18bc18ceda2cabe52e112061a2a124d2a84ad8b9b47d205dec90aeb2d193cee6875b610614c4d5469d09f095397cbe344bdde0e5a0b9b635406cc9ad3d893d1eefa586e603c78a84fa93aa5fb694534a04f65f35658e62ddca70034b8655ab4c2f0ae2f44776c852f48c49091865532a59ef3da5efa389f705c622bbc48c2e022b85a463db64700de6c9711a01fddca892b5ad05162cfaee45e7d4d529efa493c5d08deb40ec35e72bd500e7bd2f4af6e4a34f8cbbf8e9f7d81a58fdb0d92de55b83707965bce68f3f727b9076b80c90ea96c1c6204ef4b23448426fd1182214881d6c0e028384944e0b9f0588a8c8c3fdf098431da3f8e434d6f3dabfb2c81bfbb0ccd252970587986d573335812c76e36d7f2e17f501f994d8edb42220de572d65c2c642040ed7e552bef3862fba65f7a1ac7e9b3e159e3a454ce78bc66c9675236fc3d50e41309ddc46fb6b54feda30c049c7ebf4e825746127e6777101fb22e14be55bedbbfebb8bf991b9de1ef3af6be5cbb98e25264d683c17a866fb2c05078b195a6d24a8a96f936ea04259ba7a8aa889bfcc1ad17ec74a8cef0f23170e11346a2e62c7a33fc927911d65940827326f6336dcd28151103e973a7ef25ea39be1eb1358615e402becf68c28a5acde25e3abe2ad1a3e492f0e34567357187a5cbe796e325688937fcab6b8624686e1015e31d85e0c494da760802b83bd9a1d7c48f677c058803147785484236f3eff3e501f286af4c4f8f442f3a5dc4352e2a4828eefcc09672515d04ca0aa016afa578e22f1ada91235fffab009cc31bc95048857370b2d829074ccb8c3bd526bdb2f83b770efd4bfa2e18a3bb012831796498f23f397d9163794c2c9889b43a945fa9a00637c4ba88e693dcb2488c5a54e1171f9908fd4c22f3dfe7593679a4709e5ec2cd311a26414721cd1f8dd6049600070ab504950146428260021425a280d6d469af9914092144314ade7c8b2c3130a26b7dafe2ec70d9a1956fc8ea94b4ee040d18f9c50672463e6b082ba2ad0328289be0f52bb0008bb4a0f31321ce9ce2861d4a569209b706854f4a65df50c576eec9e1e0d46371f4d8f1eb07579a13e6c0903ef60b7319a8a45292db108cbc16fb7b5db0ff934377385b8acb26c2ee9a46ba2dde47f3eb06885a165c2bf8987676590a67642f81dd4048259d2902fac2d47a5fb2ff06259834e8b6a8cd94d1ca701d64f75766c2cfa15bfbddc8867841678a619f4916eef2448e4e966f2700e07c1dd04715331fb4d5dc4fadeeebc47fb8f0d38a52d0f087c258a3b00fd0f6a79a8c13a144240415b6e8825f7b79109a9c85c9f386fc5758b0f9d71223e7c095953a288b58ffb1d0ed4cd8c06bc622ff8d5e04500247c3049b1c2bcf7baae53daf99b3fb345f9d6b8d286f2dc74a55bda0b488b2a2339c75248391f544a2afa039290376d0d606497fa715a3b661c3fc7d2237af18e98485de5ca9ca2d31c3c20571c5c50bff85c8680d151d35ee7f0a51b9963f54d436345a7db2c03cbe78aa81ed9d5336c12bd7a1e3d04ac49a08be5993defb3bf90a07e552f05166caeacf524bf6653af22aad2d8d2afd9cbd88c6cc7294143396e616eedbb9b002f6b0c07a56773235cb784bf71e88febd0edc79c2ab38bae838930f5fd66912b9b83c0cf52c6196628be83d534e9488e6cd83fee3019b00ed3e422cb971e9ba90e4edb98cdbbf4794fa65938559739b5cb8377a459b61ed35d1e645bd9f85651ac0b73a1f2656f1ac354ba2fbe4529563fc4943f06cdade2185a6cf38aca645225d5a5cb855c92db3f8762ee53697c797c5797419e8c2178ff21a37844e23a0cfe7926657eac21a9b99b3262b3e25845ee22fd7df1e7b9acb7e35c4237038b7ca3906979642beb1ff655ffad54d80e48ec9a0feb7dc442f5cedd7b126fc59af9b9a10f7884b74a36ebdede2f9c05a47fb7ab1ab5f813201e854aacf0fb0683b8a58c484322a2383b7871e1e627996d082e181077a9824bf2610c1f0961d6ab4e7558552c2dd029cda7a15d34785738225a48b008754ef60ac98242d1609f7621dc888040c57f8e267b00de378a54fb23119364533fe6b085e83fcba21c3ffe2c26da8b39815e277204586bc120d4d7440ef30602af2b0b9d29cbd1e0b9fa462766aa3d3d0040e1f02359b5db7cafc11ce42f7e6d27259402a1b513728cc58bbaf686b1ebe42641b1731d307746d1e9f76f2e72fc45c4ad4625e9e5e42570d912f441fcf719319afea68d9b2ec929df0021fe6b74c2ef550e58bda747e7742d5872e79da27cb5314f5633747684c9000116f868e19bfea9d9ce333cc3f938a8789cf4cb72d25563df17e1d12dc14dd9e19f953263dd8598857edcb688c2549c39efb9c12e507fb6b8051e873d476582f5ef003eee6a1d83e85d471fb2647e6da5d1063dd5c8dba2a62c73541ba40f7941fa68f4486a06c3c895dc6fccf226552b8f1d9a0abab3090c3c6cfe3c8bab2acf1aee76b6ec0c0cabfb344e6928b2ff72c7cfc359c9c991335cada006ca0189b200a5986d56b14fb5d445244cf91759d06bbfc84b291b9ee4a9faed6809c67b573e6d2a0aa102f99fd0d87909709c229502e2cf6562b5de709be019a42a4ec719d7888002c4c613b359128125f92e7c04d6c7caf1d055ca9596bbacfbb063edaab00a283b2e9d2d3171f9abb858bed6ff7a3d5de78ebda762750095efa5527e979b9971bd598c011bc2732408304dc97d72080f968ec8a48eda7e890b61d19c89d3ffa53ef2937484958030f603e25f3c96fe79c2a6b5536ec73b76bbb809fe2550ebbc36e8e8f927f0d963502127c81ece42ab16eba3413b3977c39765602e83449f94448c06a56a195b76601336fa9f276f1ba48715dab34c5869c7c061d55abb78d738a8c0d35ab69e7e01a64022653a81e65dede4d8cab5b37dafa0f53b6b63cf120831daa08723749d09a708f2a131caa6ab68c974fef83b9a99dd48e0308809e57f906d53083b6dc0d29f70762ec314c58143a5b6370d0eeefdd5ba4a60345435f21665576b4aa92d39c03c1ee33062f50c62704fa04fa271f1", 0x1000}, {&(0x7f0000001400)="452ded3aa3ab3b04cd4c5ae5bb607f6573d897908aeef48ba8a95ea2ee32104eeb7cdd7dd185e4d7fd4c82c5717f8e290e7070a121f324e3cbb709f7b4c004e37634ffdf15c14f8e21a203ff70f461819a191c5e8f8b4cc71108c207259dfb0967b400a5889c8329c017f00085eb02991d3c05cee5c442bfaa89a199bdc6962be9a0665d85c10afd37fb6b0bce452e06a661f84d9f144a6600ce0ab922111f821dcd2ec95164b0ad6da725806fd5f620ca88fed9cdbb", 0xb6}, {&(0x7f00000014c0)}, {&(0x7f0000001500)="28b5d2d70c90a88092b87574703246a5c24cddbaa8ff4b63af4821a1afb5dc748bd3282276d45b821c32925b8b7c325be7142f8ab520fc9f5e0eb54a0066371237ff3b935c515a6c960f5b0f1f78c8ace28eacd6b828fd529c598aaba0ad65ff0f0a27983cfb599a545102a8e4bb2a849b1caf1524b247ce4e2650796db8f97d75d56d38da1998acd0be205555c463c24f7397045eb491e66ed268b1032238f3a5c373f81c348bd9b81b8d688a852dcb38", 0xb1}, {&(0x7f00000015c0)="7c70c39734514012043ea1fc6156878b6d1de243c17838c7542bb9989c9f25d2c2e71a29033a1479c5737227c4d7435357921e2e36880d7157da325adb4ad93e515f7945b4f4a5ece7e46abce5d00379646a1d4366d360a600386982c45faf71ff7cab4c08a89229c1c89c0d662321387620d7840b6f1c7c57", 0x79}, {&(0x7f0000001640)="1acbf68e5df8bab96f010b5d113ff9e1fcdd4f9aee853204d138af3c6d750441b93ff2ddc527f706d5608459075b12628a2a6edd5fc20e7ce30aac92e70d6e379e7f80555c50c1dbddfa0839b5f2a9275a5666104979e739e5b47ebcc417e6323eb2f350683c0ea50e400ec1a4f736554c9129dc314bee3592a9d735fe5e07f3532428e6d0b4c416c7aca63511e9271bfd48c151f659ed951c18293e5e8603137cef8096fbdebe0336e55c047f5e226e58a1829c06c1c72fea53c9361cc973e21b2559de6d73f0adba82501f7a19e157f8d65441f2520402e1381d6504d7e4f0a7e86a21b669390207a9920b2fa1d127485b8b981265d9310e12a5ca242dd46a53942ac79a6e6d779855d51c4a620856ef3a4e135b8cc20c1d20ae780436bf69b7f2fd1a23ed5fffbf0d208c3090262cf78b16ff6d6ea88abe4bd5f48c4d01d5ae67e516ddab25bdc504ab5c47c481f90bc6a2f729b7d3de0e705593b5e74d903c8ae11c30451946489bfe7e23fc291e32794650a2c2a9a5b56a4f2d396da318e3f968e2052f9d8b8e1c5577e3645d17fd7abd64e12a4e1967c9548bf03c6ec337ad5ee6033d283cbc6d9296f7580479e8e9275baf948a8ec2563bb1c8e32172e1efa5e05098a835025205cd5854bc18a58e1d7612f94ca8c947ebdaa4a7e51acb5e50d0b1b6e93954224a21a4a5d346472e73d73e98acfa7b4070e736e93a6ec66e2d4d802c8edd6b238c6b3e9654984297e88259b89da400a6c62df77dbde3a1c9789f72d5d17601c30c955d6ff2a539ba6b61854031c6d320b320c49a12eb8ca6fd157b18bab032517497bd295b67f9d0a05b37b52f302de18103ab7ba29cc50154ffefe47142df19cd67d2afc84a6d8c25cfa2624aeb7ef7d76cf3273de35d24570b779ac87f0539c456884cd02d4251d7c8a413ac81953bae3c85519bfc967dd019b5a3052c147003097d9964c9199ebda75feb770ef03a2956aedd8a432bdb3a9098bd3a99cfd017e0a8ff386e040bccd72c3fcd3adfd988032b60470f3dce75ee2ad60f1455707dfcc4ccc2e2628db0462a9f4b06517d60a9a8a7b85035c7c46fb5fd9ce3dfd744f0465957920f490a340f475c78303559a834b17970be9b7556f64a66582650c54046d8d4b5baf50a6bf177d8b2af1e29106d4260998da4dc22cbbe42386f662be3c295c15b46173f107b5549c9c3d81c99c49193affc24973acaa42dc88602fecc66b3d192d61315b08bb2f08f628d92d29d9218803c6ba648bd016209f89e8307fc1a54346e7424c4791f2587cadb2d50a489227e952868b474c9d072854198f500074ba7c33975fad18881139c6a03b9f1cb2aa053fabaeded7831bfa9eeb94c52d8fbbcbd712bdc534163ef031efe514d4b171b686dedd106caca5c5734516b678977458afb32571979f077dea9fb6d39328ffa90c173b48452db0773e3145701ad21a1395d237404408c5e391b880dd368cc3982b42a5bccb77c5ecb3602b2fdf0ca1fffdb11874f42f22fa0112a69e82bf3a0140bc6bb21dbb02dd4f940cdb64188a7c8017b1abb77b8be79e04d62ccfc0388ca7465bf3c0933b5ed4f445a30192ad546e5a6f1f368482d6e4c30f5492497735b4fb388865d28f2536f23ef429037523aa8cd2b89eec7352aacbf48a10f06e0db6c8a9fdc34cf57d93f72ea7900f11b4f35839f69a4fafe5307454371a3a310a8183965de43cb602d69d1d668ba15982d79ca5c503863b0b6805bad7390bb59e1147da3761bc06828c875869e1d785a6d3f3591e5b34b5f970670d7bd03850ec35a14e7fa1ea504e7e1b379079dfba8984d68d39ffb60cb429c3ac2358cf04c7c73eebb323ed95b2e51fb310c0bd7d0444e8b569a9af25b3853392e12440007ed75ca3c5e5f57479f1d0eee36aa0e562dc452f05a6de102aa35a3e9756f91be6f8d713117575a9895bdd094bc248f13d2d5a87406998264ea47f8780caa8ae871bb3b9c3b59c06f7d338d77ce1ed9526865baa5ff5f0fd8107c7f9132a22ac5f616ca98eacc26379c558f82de636b4cf81b7c05f526fe9330f5d8367c0dafed3fe7704e44966c800152d3abf742357924bec8c417cfd32deebf3c6e68813a5203d3c2875eb3415c4e3a8857c7c8c42acd05d8f7c29ba38b4456181a10c09c0d82d5f4a95bb625d0a12ffb71de09aa48473854e6707c32416eeb9aa544313e4fa3533b564cd0ba09bafce88c9b3149adbea85041fd952edd792ca3487c24273f3d3220922064f7498f8abfa1b78a898a0320cce3b54ed735f19a8a4821c5a49f17a178d643367554e6bf8ca4969610ca1c92017571a3b694b31ecba4fc885e11c7fc30752c83f84e9aedf9f569d7c98ac482438bdf2e896081a89d75a3c1beee5e2e21dc80b08ce4d2514936d2bb49f2c772318610a38aa017e9b85c7fe2eb35c15ddab90f28dcebe274500950a6e3f6d3e6d863b68dc4dacc31471cd08eb591c9d8464f2140c1269d12af7efea0d375fad0ff4b7526e96c080e822a66cea9a09657a5b52c92f37ccab640921a02dceb4306755d4d55b479d8e6736d1582195360809d332a3bdd60ab3fc1025f5ac96bc86db08c8eaf80718a15a95c1c568a2ac13c4bc65dbefe57a5efb34266f57e947f73c305466bc48e4f00617da53d984de51708c6025b53be16a51392e61d6e3dec807418d2a302b7f02082c23086e38d3e0a4d33b44bffe5e6ae50d8b0d458a2605253cb101edf30a2d41b0c3a69dfb7ff8fbfa2ea3676287e9097d420b117ebb3b01f7c4961b3371a753abfa56479b87f38a349de6b3b205ee87e74800ef5bd0a6ad2e152928cc732dbed5db3da8f54b20e8314bd76fd410e5aa8163aaae11ef7837d46af3118d2a21ca3e2202865ca8cc569e9179c5e85c19891608dd21ba1bb135d9bdc2a252472a3edbca0caf01cd2b354baf4b9d5b5cbab926aaf4afc3e112945b503fd69cc1fe7ae2a8399adcd3f8af50e3fd00bcfac136d7125e180583099330e62004942adbe09c4030303016a731c1ebb6b3c65be4b7240865086e0853afe7842359dc1aab14a58c3256c119028d6c0e98dadbcb3d9ac1df37934a2368e4b4bc9e22878118af7ccfcd71396d580e5732f07686fbb6176d296c4f4e2d7cb7375f1c16c68c309d8b899c5512e8d2c8662b2beb599f6a719d155b62e964a81ae14ed94ffef3f298d7bfcde20bcba3be0fe654ae026b42cd156347d6554d7f599624347d77fe9acd04bd8f8983f4d185ffdf63b16ea23ec52769d691b2d3cbd4c798ca23c756f7af410427907dcff96cc6cc3b8150899c2ac3d6383c0c302ab170a47b994a2e613c762f965dcc516577967f5c42306decf65adca570fa79e3fd66a35283c14de2e3dd43fce8117b0d64f60a1557d14f8ee5123c6dfee4607dfd16a746fe5144b31b887c2a0a3e661236e28b4209548006cb3aab38d91357e40b465706afe38d25d36c9737ea4f5de8255a909c739ce67c5cc5ec27a6c920998862bdff496b76f1cdf1b102f11dafadf9275d04480820dd79bbfd507023eae01445806b476a5b978694a5839436da098b5635fec79e69e8f013d4f5581800f0d06f01d447b82fbcf380bc0133464e397988499b970550f8080f0fdefe44bef6c95a85ea973305f5eabf8da16229b66df072ae4c8c29a5eedee741f38371247d2771ffe4f8048e486206018f2d872d285c0d58145faa3fc8e2a020cda84d348939d28980d97c62382b186d630219b6c0729ed0793adfeac6f8fcba65a6f3d2a0d712b8ac77aefb8e6aaf1eeb6fcc1fa5b99c6244925b1c0dd9c68d2bedeb510a6d871251decb530af963744605ad0c0734ff3357c3aaa4b3fce5baaf4d6d58f1291b7a95309e78d7089cf61c57bd60525b741971c595403e25d656b960f9714f858d4ab6d062a33582f5ee44218926685c22de5b3712a7f66965dc38cdb79fbece47e4588658b71965cfd1563eb5601f48136f885b337e471a2cfcfb5f60c30560c8a450521335ee83919b54e1e727776ce486713436ad8792f01ae09ac6d1d14f3f4bfe4b801c4ec69ea533ff4f24e27d0dc6ade763474b5dd55dd7e46b0686be8031c58c4e44fccda02fba41ad1eca8909464aff8bbb276f94ef0f15d5d59b981b58f44091c78a080d245ad376fd3f77934e3a0d013b264240e75ae7aff6d1266e17fb8eb0bc4884095ceae83f50c8a0dce364924cb85965c618e5308f91096de841b729018d988130e292c0b86abde72320d276702d5de9450af500c83b6d7902cb17c31a586bb691f050e7d70ba83200cf441b60797e702e3eb757797d31aea3397e4eb4487b52f09db6882bafb5095ed467f56cc513df41e7881f5f4ef871f602a8e3c2353c38cb2ffe18ff0ecc2ccdccec6882f0af9a70e21b78ccd74bcced4fdddb9fde241c3883bf1774d06d27753e038cb5691c62ab840d5c003ff5418ed21e6617104adc09d6812e22a4700f081bd8cadd364d0bdd7f2e0f00a3e8151ef3ed8e057195e6ed465128dc43c60e3667e52df680a66159f0a7dc07e414a17778463e8b499d2c53d004d204c852de8e726795ce89aef8a4c705282cc89aab2a6dccd0f474d371c3292afee75013983e618c9703c886954b968996936931d09fdfa87161fe880cf8207ac1207df509db475d62df18322243bdee4c38d1793f44629e1f7e6b62d1f46434646370a220e20afd28f36835610dafdb23d12cd8c083f414f67e43ddb0d56e4f458fb1aa7c8b67c84e33f05b029f7490e78a4e84496774ad5f1bb873a578c51394af25336e9b4886e083863789e8714176b7239ea51bddb46c43cecedc33f1c2b2bc1f8808b1072d51d46e2a77d90525f1e1280538a3687dfc00bbc9ee97225115267800dc9b8038142b8d149601cde1280aad83054a24a3653a354735169dfff6f0ea512278256fb985d6a7627a2bb47fe89b86d31053feb5dabb574f185f18a246e75193e1756d488c1bd47850c24f00d472e82ef132a21e5e9dd083b99679f083c2e0d51ed9dcb9ac8840d8e443181ab7f1a45321c6d61e1f279c3b8f2ea61d9d01725612a8f4eac7c7c128fad994b3f56cde9a6299240ea68bf976439060938e9f140bf1566a9523cc2d22bbda7f1770ed3aad37a33ad296afb6fd02e06c67f332709508bb801dc88a38a1e4301c8d11d0d3d69819874b28fee938279ef97d167c3cfd8973d32131579e10b3cc112201b4817e1b69faff971096f5a7c72e24f0ad44c3059fc0f0ecb0564ac0b2ab2dec6234fe2c696bc7e24fa94d29b0e5560867d508335db158ce56a7e2c913e9f026f63bd004868b86d9d0b2b1490b59d714589a8efee92edbec27b724be365e19463f0c6097def362ca2202b1beb1fb1b449a711e86d650a89f04ff3a74616281d4a874585d6518680339b4a4a8f9251cd30ad022c5895c94a7ce1030f28456c2e637bcacb3df79e95fab39945215d88c0408f51cfbff3037d72d21351ccd36f40cc06fb3dba9c7cc83bbc92553369b9f8565f705f4950609fac8d20abae13ca5396c71b507a6dafe792b6c2d0618a48ffdc3f1b5d195328ab36e5fe6d802c2ca99ff3cb0e19e7a41650f08738f030190e3ac211ce5e3a82effe223267a38beb86384f6bc37b2eeecb96065df0fd4575a531fc0d046b359ff5e29d981be6b37ac79970cf0e5e7b9f5279d22dbe48bd6a60fbefeece721e86fe4f4588bc67efd3b0f29914de76cd52f87b6065e571f4b8481570ba7f0cfe31effdec8148f9fe9f5c8d79fcb433a3b9aede64a15c86458536c3", 0x1000}, {&(0x7f0000002640)="dbd2eae4eaaac3ed05d790db859ede076c43f375fff0d28900b26adaa37cbae222128060524139a569126acfeec37e64fae0d9ec5a7b0eacb86cdcac6eda58e8db8536454d484bd786b41439139c918ccdab3253186f45129510ed9b6bbb2945dfc8192c64a546706aadca9fcdc5e645f0593e906acd4938738a64159ae0b3e174c23ae1d8231c44dfe1a828e1e5968b010c64edeb6ef2616d690b1ead419ff77c7c0b766e2024a0f2c61692b26f668f9ddfe82ee37520120b7d84e18b6948674c908eb5cc5bde6a7f5bdd85a812d1a46d2217f707bf9f052e493ede853ec96eda86db1efedf0d710f23d37e6c65538016c87d56e991be1d574e5e25d9defc328f49309e185c90339b2648f499815cf830943f88ef15bf53a2a348d6652d8dcc9a5902b6f1723bb6efe147cdca6a8637d2593e22817e5d25c51bc6b47700acecca046ac93b4d2354c3e08a2634b35f2e3a62056ae19792da69d88244e715c9ea2297f5ae341c7f6d58013f50163687673d7e5e13dffdea67cdf26e0b2f1e95a538f3d6b1637d1e160ce3ca311c951e6d7df18b759e6b784fad99daff875145dfdc62ab107a0b19a17438bda1e6c9921a642b649e2d31f1862b3bc6f2d2cecd80e2c58a1e14e2e2a03e372724d55777614ef0a6dfa55393ce9b99691848bae12fdfef1116193a2643911acf772df102449dc95172245bd00bb684c9057b7969beb6b5be60f482ada5d0d116f895a8ec5bae2f9baa71461bd9f0058643e4884fcf16b6928fcd78d2264376543b6f7a0c049aec527e175757adaba72a5d3e84e9923604483c0f02c756236477532e74b4df9083b2482dddaaa99a48174d83e47b3b012546ef15a48498b1fab307e3c51d352d160cf59f07a58020c2dce3cdd018aa79bddfb15519a3547938c25dceae838f8612df302c712ad782e890380c747ef9f2b437d8bde942ff03c2d2ed9b19de128a0eb6c380bf1eaeb261d4295d0f0e71e37e58c84373a15b34f5da93b7b914bdd92156f5ec5e1b562aa34dc1048838ec2488d17f03c29773af43c24afede45e33c43dcfc840c9b94ac9c397db8cde87fc1a940bf9249fcc2d2cc177c74e208069e9ee4a2d51595b82355b2a261de1038eb3ce467064fb09a34ce8b2f56b62dbcf12dad9a4e6d7e00708255d97a39e8e68a750b505e24c866d17e2596c29105005bb45b32cdcd1f1ea5818a50312aa64428c022cba5be1045cfe23db1cfe0dcabcf40ad3505d5f8273bfad018357192b78e30ccfe67dbbe95626790a74d5307eb03b8e06030b23e696f40ec3a5d7b9a4d94f1db1b7e4fc5edb80d0fc5ec6ba3b85bf71f197050c4abd78606b903640300aa7fbdeae0002c76b0f1b1ea5fe5764cf0419137c62edb6f4ea20009b24d5f4db0afd2b9730b752739f4d5695722f5b6ddaffe70ea7b11450c8943499b44bd2146e75457089dae10cc6a3e1f464ae74dab25476df183cf27fd98beea4a4162ebcc28bdf984b8b5d3f04a7987f9d8405f29921c8aba991d4b349de6d3e938e60cac0343c7d474b00f1b40f982ca7d7d86b0dce72fab2e307eeb9a83a0102c50bcb519144fb47b73efefbc7920f91e865473c46b9311c097014b562621391eaff36162d07aaed7fc3b9d8f353f9241752ca4e0afe355be88693c8cc5cf2c37e53eef4cf4ef63f70961cde6931aae125a2ad1473a09f829f96036cf5b92a968a7a4dda1e735bdf5e976a68a8dea7f209a3117b6755cf285804d398cd47eba788fef09d0f2e6516a8355a71000cfb835dce65f8fe0ff2a9de2f70fc92de1ded51ce86b1588bc592c7b1507de76de6379574830fcabd416264c6071a0939c2e55bccacb03ee8ae192df031cd82b75a35ffe3b0d221eaa57a00ee0773e0c7e0f32c464e8fb111f4c520ccd8ff6e8e5b22f1b22508900c7d470095cab54bdb250b3fc3f2ff09c7a78a7f1024a0317f8821932ee5b9abce96449339644a15edafe09577191582b71e2c15bcccfd6867cd866dba1200ffc1fe82cd86cbef269b0797b2800a2af310d081e2559e861238860323740f24a7ec2bd8315afe35837c545545683ebf312dfc7096fc94273812a73861376e58bd7ec0ab61c247176a3c35b12d82961e3b5dc37b11ae2b5ca3322d1c26393a8e93122998fd3f295944b5e4a528371d73aaa5f4ff08b9b051f8f194d818d77e08b2ef80c1ed8529b0e987943667a01c7eee78bd5439dfc51238bf381a4a1ad0c5d3bb4b9bd012da61de2dec203acaeebdfdc91b5ccc747d54ca763a105e9a213e66bfb9b5d981856d24083296f506109a4e008658281d5c7ea7304fc3700a764765d8dfe48cfef9a08ed6139e505fe17199340a11a1d23e0be2958b33e698004ade2e60a000d8f6ab6aa6fb5be7387a564d7d193983bf3acb775342df701d8dc8adfdc3b399c11f46c0234b4b1eeed5a069a333d3073056b5d7831e4cba9ca47568724a05f0aba206995ba48237975d9b50685c407f1bab4a7b63605d03f7d0911c70b9bc01b576f7a995f59b70053df9cd89419a2f1a1d929aff970a47d54b91144a3884850c26b60b13882f4256b19c7c0eceef5957edd29f8189ade9791b83c4bd9115590d78826a2466c1194ab7dfe438c1f3c12a93ea6ec9a139fe90b3eccdf062f98c4d711022e8538bded54b89ba2c5281673a0f7cdb1a3fd80b7815eb579f62fb1e3f3765a86a15ab902ccab52013f1fdd4becc7c67e90c13820132135c3eae1affa9561ec3c388a78a2517b15cd2e3917cd9c86529b5c9ed0e0c410a52bab429cf4e7476a69c5e7293630c8780558842d3be7140b64854ee7a0498716efff7d70c6b7a7c938763b3b3d3a2273c76ae5fc2cd991a6e66e2124c49985d5d4eeb29c73b0ad1e572fb12dd1e22d3b1ed029c11a03b89302fa9291f8f39d5d5e95182f51d5f911eff54ec7286848ccf10cacf8129336ec8a25be956b0af7f1b4cba20b1a06f580ec532b7307f9756d19838b2b3845a1bc487408d0a43c94af21dd1cf32fa83d890436ec9611c046e82b2ef6ba33c9f6a01c7b07c635cde0e694afe300690eae9047f40978817f6f45404e3acdad3516014e0846fb670f29e607bafc210af209a9a441946de70cf2fdc678b7a9f7cfe20950de3e741ab637e711698cd130246ec6d6c5ccef32ea68f1ae912ec372bbd2bb6f66fde8d19aa7260503a0531cd6f0016d9e6a53e6b7631a5791199a94a776d022ebb5a4bb41e8045ad26af28c96903b159b2c95ab6afd5ca76886ee8f206722528426b206ad6d0c175a09c5d20e70bbc7b6ab807e52f938919cc58b34bd327242d3c1f79170bfcff0916bb6b232fccba7d348380b44c0fd7778d294c5cfadacb7f1246af0110a3d78b443a683a8bf3b1ca22b092384d96d433b7f0d9508d2ed8275db6aebcad18a8cb477477d9f2aa8d99e6f2c324f95a0d383a5787f4637a7a9e2d2a10a39bcbb1f51a4caa4365bb947ba1adba6e40d6d7327f70fcb4898f644b8e17d7925d8d204f5117c8008d2108f889b2cc9d352daac397fff7128f21f69d3468470919fe2e7de4211b6e916595dc92000b47ceca86525e0ec3fe49c6e922ed78b6607ec26053841142ff694b308ad6357f53757b63393ea388f12e82c98b46c0d59bc102908e9057bd6d78bd1e839ae5de3cf2672649c8745ade61ad541169d4bca0669e9370e0d8c43db866ae87d0efe32b3e38739d58d989044d8e239c8f70dd1901995eb2914464472ed05db681ff64d1d4c280ea1765daa3c3bc235ae3324fcc1e237035c6bd1e38f1ac1e2d13d04d33396c39738ac89dab38bb4cd9834da372940496c758ebf7f74c723fbd455d99a80a7d63eaa7ddd1046f2a42d508abf183b932f4a8f1a26b709d19d2c314ff23ebf0e0400fbb0444577a9ee8c964fd1f9a9b9e689903ae90d20b93a14734cc804e0d6e03022abf047cdeb6461a3c4870fdd63f4636247ebde498e41b0269cbe985905b39fbce138e41100e49147217e0e2d1f681fbf651b5dfdd8bef165a49ff7c2adbfbb36ac7837a892fa38e5217ff78bf52c7605f0a41b9de88873ac6983032d20c07a51a8a133b9aca9559e21ca401ab83e5aa4c81a2e2080ee7d665ea377cfedc0fe7117a466ac953f89021b26a3ba2a64821767486c1af70379e12eb276f6f973d4c9e7a08e15015c94a3c8ce749202865403ef5fbcd67e328815d03f1ef826b8c13e0a538f2c207e15203f46eaa4be208b81510085d0810e47595aad43f1a9d76aca9daf2f89f65413089b3abd104a9ab977422de4701f828dfbc381208f498d692e08ba2f45c7621ce7145602c09bf532d5ec4f27a386331e7c7f6b6c1d4bd61b5b711233773fd2f991a415e4702c09a9b0396241b6228f6d2c73ea516007cba29fbfd743501d429238e9153097a4959dfd4863614d01efc358e6d6fce4345b5157f23089b70c7bb74b38d08bf05426f9bc65d898c76cb456b9f6170297d0ebd144dd582c174d18a3ea73b75f87f9f5a903edee7cf17e7d79375ffff5ca2d8e000a5c142f87ef3919162df9b8dfdf3081e1552a7c1580eadaa3a2fb82581a3c5ce29b7fa394b9b8fb7f22a1d0388d12e2d6844ec67c31fce635168d6337cdccc101dffb3cc192b7bd7a7d576e2529ac34d59b803f4a4bd825500c6e6d54d3e1d365011ce06f24ed1ac1d6faaa61d8b602f8ee882ef768c33772c0aed6a997d9a0b0b2fc951947b384a93b97a7004c95653582281b05156c034884e2d5f3752c0459f57fd9eba4ae26bcfe6d930a47915bdd88cdf7fd8a31b5df00edf50678d5b748ee8f304cb2639388e0f5b45fd898be9942d17917f8bca25309d02a90a3f3e3daf549ea98acfefc783704442100f0ab365f3a5504d63f7d47896b790d46b42b567c24960fecb6629bb6578aebf6a494f1af77b2180f63e5839a3027d9a05a81298289e328bed688fc6de3153a9674e025fccaa02383371e59239a71bdf98b84fa7aebfb5bbcbbff025cb9488d9b50e4294a4b1534c40b98ec2df34d6898fd751b75299540a6df7cee1f810170db28e4c2c5bdf35fa2ac03ea00f5f3d11999f40d4c7db54f757ee376b8ab5394c9225bf1b037cd17288f0cde567f8950d8b75f02e5b2b2115928749f8242f21f8e2ea44687d9eff96e31a9e93e1efcdd98b0bf6497b812bf5fa718c93502ae91fcaaaaa4981532b67fd1df13f44c13ff36f4f32fab7549b9eaf24e4669ee4157994ca31c3d36000c28192b6f6288644ceda38f6b0ea38b73466977675cb9021ea2e4b274b9dd7197feb00f4871b33bbf4748fb8621382fbe93c7ae1d5426207bff9916e7021b5050dd158f7e13707be62668b9bd7e28e1ee3c2621921183226ab2a38f71e8f7dd79d835f25f015184751c9c5b403e79d3056dde22c6e5e5d32d981adecb45f13e162a80831fe9a1d91bac380a80426852ad189e2c268cd12d80e3fc70795b12fae74c5cb4f9031ce221618b233aecedf95fcee5098936c5a5b3fc0c8dfb8224fcfdea7f79810df096c5016193a563684813e689f380e4e980d4949ba9aeecc6af7b829619d9780cac456b9c5a5da12d2f7a69037a1bab9b4d60959b297558c77b5e25ed3ad3283ee1b6839ea6989b1622a5ba4ed629dcf693abdd4980183805a016a4fc48775452c07bf35a2ca103e92a24fb9238ef3e2512145705e13d589a4f287a351ab8ed7fb7c46ee2740c31ecb3fd4ed98dc68257917bd6d19f19f8d32db82db96eaafd8b90691fdef90b957e06c9303bd0a9b68c3d7a1ab18d0ab8f091e3695361bdf70cbe74", 0x1000}, {&(0x7f0000003640)="61542919fdecb37cf102ffdc70908c5e074ae38cd5e437f74fc0fe8e260c67f6ea64576db6a24b5f10b34baa7e7145b56d860222bd6b67d2377d842d3eb07227032418", 0x43}], 0xa, 0x0) ioctl$sock_SIOCETHTOOL(r2, 0x8946, &(0x7f0000000180)={'bond_slave_0\x00', &(0x7f0000000040)=@ethtool_rxnfc={0x3b, 0xf, 0x6, {0xa4b38c5d93ed0cb7, @sctp_ip6_spec={@mcast2, @initdev={0xfe, 0x88, [], 0x1, 0x0}, 0x4e23, 0x4e23, 0x80000000}, {0x0, @random="10bb8d4adedf", 0x7, 0xb78, [0x97, 0x3]}, @tcp_ip6_spec={@local, @remote, 0x4e23, 0x4e20, 0x8}, {0x0, @local, 0x40, 0x100, [0x680, 0x5]}, 0x100000000, 0xfffffffffffff801}, 0x9, [0x1ff, 0x10001, 0x80, 0x6, 0x1b1c84df, 0xc38, 0x100000001, 0x2000000000000000, 0x0]}}) openat$capi20(0xffffffffffffff9c, &(0x7f00000002c0)='/dev/capi20\x00', 0x60003, 0x0) r4 = socket$inet_dccp(0x2, 0x6, 0x0) getsockopt$inet_dccp_buf(r4, 0x21, 0x80, &(0x7f0000000200)=""/35, &(0x7f0000000240)=0x23) fcntl$dupfd(r0, 0x406, r2) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=ANY=[@ANYBLOB="05630440000000000e480c4000000000"], 0x0, 0x0, 0x0}) 03:41:08 executing program 5: r0 = syz_open_dev$sndseq(&(0x7f0000000040)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a85320, &(0x7f0000068f50)={{0x80}, 'por\xff\a\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x1f\x00\x00\xff\xff\xff\xff\xff\xff\xff\xef\x00\x00\x03\xff\x00\x02\x00\x00\x00\x00\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x06\x00', 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2}) 03:41:08 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f00000000c0)=[@release={0x400c630e}], 0x0, 0x7400000000000000, 0x0}) [ 951.236179][T10637] binder: 10631:10637 unknown command -368808281 03:41:08 executing program 1: r0 = socket$inet6(0xa, 0x5, 0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000180)='/dev/net/tun\x00', 0x0, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000100)={'lo\x00', 0x0}) ioctl$sock_SIOCGIFINDEX(r0, 0x8923, &(0x7f0000000380)={'bpq0\x00\v\x00\xfe\x00\x00\x00\x00\x00\xfa\xff\x00', r2}) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000000)={'bpq0\x00', 0x1212}) getpgid(0xffffffffffffffff) [ 951.284990][T10637] binder: 10631:10637 ioctl c0306201 20000000 returned -22 [ 951.301487][T10639] binder: 10634:10639 unknown command 1074546702 03:41:08 executing program 3: r0 = dup2(0xffffffffffffffff, 0xffffffffffffff9c) ioctl$KVM_XEN_HVM_CONFIG(r0, 0x4038ae7a, &(0x7f0000000100)={0x7, 0x182, &(0x7f0000000040)="4d780f6f2977f680723ef7392fbcc50723bc3b5f2ad560f8549c824c2c20d39c2e06f649a9aeb041a7671e7284c4f5a950f55ebb365fe6661eb6cab7789c1de758cde4bf", &(0x7f0000000180)="d303f47acb7c52893b8df7b541826842a340e35f5f8e4500fbade0500e40035628aca41d2b0af27bb04c0804df8747b351696faf87e89de79654d8bc843e5d0c2e382f06282ab2993ba6dffd8a6271f34176495c1161cd05794f6ced753994bcae5f0e18546e55aeb7c6cb27b7b654", 0x44, 0x6f}) rt_sigaction(0x2a, &(0x7f0000000280)={&(0x7f0000000200)="c441f828e8c481c25f6f0a67429cc4e16972e600477200c401fee693000000208f08208515940000001b3e0fdb9000080000c4410973d303c42179c5da03", {0x3c530000000000}, 0x80000000, &(0x7f0000000240)="64dcfef20ff021c423fd09580ea545d9ebc441b37c09f265400f4ebd043d00006540a6f08375b6563e676745d9f30f14448fe2"}, 0x0, 0x8, &(0x7f00000002c0)) r1 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f00000000c0)=[@release={0x400c630f}], 0xfdfdffff00000000, 0x0, 0x0}) [ 951.333745][T10639] binder: 10634:10639 ioctl c0306201 20000000 returned -22 03:41:08 executing program 5: r0 = syz_open_dev$sndseq(&(0x7f0000000040)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a85320, &(0x7f0000068f50)={{0x80}, 'por\xff\a\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x1f\x00\x00\xff\xff\xff\xff\xff\xff\xff\xef\x00\x00\x03\xff\x00\x03\x00\x00\x00\x00\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x06\x00', 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2}) [ 951.374372][T10645] binder: 10643:10645 BC_REQUEST_DEATH_NOTIFICATION death notification already set 03:41:08 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x4c, 0x0, &(0x7f0000000200)=ANY=[@ANYBLOB="05630440000000000e630c4000f200008c01acbcd9297cf4a76e04ea80b60b21d6efb41548e724db19f014cf6e830123c34234a0c43903464dd4e9c503844e734e52e396711327b0a8d8cf15"], 0x0, 0x0, 0x0}) 03:41:08 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) r1 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000040)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r1, 0x40045431, &(0x7f0000000000)) r2 = syz_open_pts(r1, 0x20201) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) fcntl$setstatus(r2, 0x4, 0x2800) ioctl$TCXONC(r2, 0x540a, 0x0) write(r2, &(0x7f0000000380)='\n', 0x1) close(r1) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) [ 951.477084][T10654] binder: 10650:10654 ioctl c0306201 20008fd0 returned -14 [ 951.535188][T10651] : renamed from bpq0 03:41:08 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f00000000c0)=[@release={0x400c630e}], 0x0, 0x7a00000000000000, 0x0}) 03:41:08 executing program 5: r0 = syz_open_dev$sndseq(&(0x7f0000000040)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a85320, &(0x7f0000068f50)={{0x80}, 'por\xff\a\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x1f\x00\x00\xff\xff\xff\xff\xff\xff\xff\xef\x00\x00\x03\xff\x00\x04\x00\x00\x00\x00\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x06\x00', 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2}) 03:41:08 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000280)='/dev/binder#\x00', 0x0, 0xffffffffffffffff) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) r2 = accept$inet6(0xffffffffffffffff, &(0x7f0000000040)={0xa, 0x0, 0x0, @mcast1}, &(0x7f0000000080)=0x1c) getsockopt$inet_sctp_SCTP_ASSOCINFO(0xffffffffffffff9c, 0x84, 0x1, &(0x7f0000000100)={0x0, 0x5, 0x4, 0x4, 0x4ecf, 0x9}, &(0x7f0000000180)=0x14) getsockopt$inet_sctp6_SCTP_SOCKOPT_PEELOFF(r2, 0x84, 0x66, &(0x7f00000001c0)={r3, 0x227}, &(0x7f0000000200)=0x8) r4 = openat$md(0xffffffffffffff9c, &(0x7f0000000240)='/dev/md0\x00', 0x4000, 0x0) ioctl$LOOP_GET_STATUS(r4, 0x4c03, &(0x7f00000002c0)) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f00000000c0)=[@release={0x400c630f}], 0xfdfdffff00000000, 0x0, 0x0}) [ 951.622904][ T7288] binder: undelivered death notification, 0000000000000000 [ 951.650924][T10651] : renamed from bpq0 [ 951.651718][T10673] binder_thread_write: 10 callbacks suppressed [ 951.651734][T10673] binder: 10664:10673 BC_REQUEST_DEATH_NOTIFICATION invalid ref 61952 03:41:08 executing program 5: r0 = syz_open_dev$sndseq(&(0x7f0000000040)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a85320, &(0x7f0000068f50)={{0x80}, 'por\xff\a\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x1f\x00\x00\xff\xff\xff\xff\xff\xff\xff\xef\x00\x00\x03\xff\x00\x05\x00\x00\x00\x00\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x06\x00', 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2}) [ 951.682941][T10673] binder: 10664:10673 unknown command -368808281 [ 951.695710][T10678] binder: 10669:10678 BC_REQUEST_DEATH_NOTIFICATION death notification already set [ 951.706860][T10673] binder: 10664:10673 ioctl c0306201 20000000 returned -22 03:41:08 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f00000000c0)=[@release={0x400c630e}], 0x0, 0xfdfdffff00000000, 0x0}) 03:41:08 executing program 4: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) ioctl$sock_bt_hci(r0, 0x400448e3, &(0x7f0000000280)) r1 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000001c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) 03:41:08 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x4c, 0x0, &(0x7f0000000200)=ANY=[@ANYBLOB="05630440000000000e630c4000f200008c01acbcd9297cf4a76e04ea80b60b21d6efb41548e724db19f015cf6e830123c34234a0c43903464dd4e9c503844e734e52e396711327b0a8d8cf15"], 0x0, 0x0, 0x0}) 03:41:08 executing program 1: r0 = socket$inet6(0xa, 0x5, 0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000180)='/dev/net/tun\x00', 0x0, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000100)={'lo\x00', 0x0}) ioctl$sock_SIOCGIFINDEX(r0, 0x8923, &(0x7f0000000380)={'bpq0\x00\v\x00\xfe\x00\x00\x00\x00\x00\xfa\xff\x00', r2}) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000000)={'bpq0\x00', 0x1212}) getpgid(0xffffffffffffffff) 03:41:08 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)) r1 = openat$vsock(0xffffffffffffff9c, &(0x7f0000000040)='/dev/vsock\x00', 0x8001, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x480200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=ANY=[@ANYBLOB="0563044000000000144d4909d138f857"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f00000000c0)=[@release={0x400c630f}], 0xfdfdffff00000000, 0x0, 0x0}) 03:41:09 executing program 5: r0 = syz_open_dev$sndseq(&(0x7f0000000040)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a85320, &(0x7f0000068f50)={{0x80}, 'por\xff\a\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x1f\x00\x00\xff\xff\xff\xff\xff\xff\xff\xef\x00\x00\x03\xff\x00\x06\x00\x00\x00\x00\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x06\x00', 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2}) [ 951.959414][T10693] binder: 10690:10693 BC_REQUEST_DEATH_NOTIFICATION death notification already set [ 952.014519][T10700] Unknown ioctl 35090 [ 952.045727][T10700] binder: 10698:10700 unknown command 155798804 [ 952.068527][T10700] binder: 10698:10700 ioctl c0306201 20000000 returned -22 [ 952.075113][T10703] binder: 10694:10703 BC_REQUEST_DEATH_NOTIFICATION invalid ref 61952 [ 952.089181][T10703] binder: 10694:10703 unknown command -368808281 03:41:09 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) writev(r1, &(0x7f0000001400)=[{&(0x7f0000000040)="860c6c9cb5078a2d796bb45891ca7029515c8aad8106cf4d93c82e9c39ce112795f3deb5882dd4422264a3797495ae2c29c2b5988ee051192050ee45d6423c095ad9f2f6c33f15d7564a6625b4dd46b8b31c5d4940914deee6616a11dee5375937f8f896a73b961c0a", 0x69}, {&(0x7f0000000180)="d3076a115f2a2ca7ef59f807231b16be3b2e4dd3043424be396bf02710c84767e160f29914b9f4d9749a6ec2e23a0850a28b52ee0303c6afc0deb50c87b4a50b906acc57ed9f4be6f6e94df3ea5f8bb21193c4c08df6554204c541c0e7777290fd9511", 0x63}, {&(0x7f0000000200)="6fda47111ae63428f02c717f6b00d8583886e93b8a587d2e0f7584ac4026c39c004fbafd2ff00aa7328a452d47f24ea258255dec1fe903be4615378f81a644237bf6a40e27be7fd52befa0e52e4098833723c8486b648e728407982b096b5cbcca0c8fc1f36734fcdb93e33f0bdd93fdcb2bc60a0f0719cd8582b1307be28943e0e7b18e6cd08d35fe759e52764b7f3009a09c3da111af88b6340825bf5bbffb5c203c2ad3b011a2ec2c5b6a62242ccf922ee5d8200a7bcec5229b4860a9dfaab64435719e46d08dc3a163faeddb7ec29a30d25c87d7999c81fc801c2b195bef469f35684a3fd9b178f137c11ac177f119f35bc5", 0xf4}, {&(0x7f0000000300)="59389a6455cc7d024357fc6a9bd4d79f3e60beb2b26b572d4f64e3667b2394a1013ff49244cb0f3bc74b1edce264f24a8f175b8d2337c7e5c54f773beaa0cb448fc1e2d12a7e55ac465026e9e6b6c5af94d4fea18afa4f8584ae2423d0b891ea9aaab68e03d3be0127461fdd78a46bc95c765386bd226756935197cd82a6d8cfb93ff1beb4531e845f426835f5580913a5deb9b3d79a01eef6e095ef3bbce53c418d8f3f0e7bc7a809dd8aa76c8b34d9dd24ef03194d544f9db1e44e106cf614b41b60c20a968be6e268210e37f2415b6a149b64d851bb83d1a07a834a48f49136b3777eaab3a0f7db0cdac2204b6e3804ad60e1b77562115485eddacc8554365b144cf8a1d27aeba398084d53cc811b771773c9b229d1b1270191685bc2e59fe6a6421ea44b7f102128d87dd53e06cfaa51e180e433cf1201770bfc91efeca6f09aa7c6597a246631ab466189de8b2bd042d27695eb0b4c028955eb2ba79e3c2124d194b3625e43f55ff6353db6ecb9dac61c36fa03ac1739ad2f5b68d12299d8d1fa00c7e4e50457e30b95fd72b07f0243851f05a7a1c0dd859f5554df5cc759ba1549357dde2469ec85a417f93bbb68312e756d4f144bdf2ca5d313d119a65de5bc1a0d85aa111aaa40a64178a1f2f048fe9fcee72a89b20d2e2c1e3e0b0ee0ecc6ccdfbadbff63b95208f01bd52a8fac51caf4f532d0017ba9186331faf6ee39b585a013355e6e75c217ad7c96f7228870b75bc5ff4a7ed27ee16d5e484fe099b2bc2a5c087b686b360206a192726287093d0b80c942ab51fa3504add8a251a6d2feabfe8fbe58a0ad7447d1c99d1fe2d169e01af2158024060cbf893fe4636ba7284313ee4fa3fef3f0c00346dc9de0d683000a8faea8d8c57159d258edf9cf596101093e7462578912bf5a1cb1b0335e1e378fcaab53ce1ff635c8b74041e414af9d5a53e811036f850c1a8ef09b585ca043850362d38e0f555ca8e3d5651fc032492b503b91ff0a1e777e9a761db16c7a3c74dc3e62b178c24c1a475a32e206b3f2ec6b8acb1b4224852751b1ec9aa09d66e0a9d1dff9a88dc5d55817b81feb5f46bc9e3bae8b2315a4980bd81bde3ccfd3f462d30f52c3d284a3914b13824b7b4ee7ace1b2a0e1b5d4afb9b2647cfd8a0ee6dfda1ce3ef814bfb33c925da06b3f0ac78a54f86131a8073e6dc50b18889740e10e344467b7af99b0725b26cda733b5b0695ad89725ad840a4b6fcd735595214c5155134674eb2a5a32d82dffe7bcf801bb1d680569bb05fa1023fdb4f3e95d01b40eb6e541a02ac010d4c58f9b8995bf5fb579930a8d5c0f48882145baa9ba9a6567167ee9a2dab57b0146ced0f02a2c9f8c1c9c34d0b4962be9c8255ba35f6428ae9c15b72f09918724717b2335f227833226d467535fc9a4a9eb8020c5a93ad480f6a719703e1eeab6c02e3d61b440513be649dc0870090c049e69559af5a077d68535f36e6be3f68bed7f849547d057c7d50f9054a269682941122196278705eefe1ccfff4e0bd9a9f2a48dc45e9e542936eebdf9c2125c27576a4fba9227d7921f89e774c7b69d4150637289ca96c7e59065e29f6909329ad222336383aa584682b6ae0b92190854fae9360b55a8f2d8187376ef0451705b58c1c0afb99c3c602d1b55b488801f2a911d9fb3d248f74e198e29bebcc4921ef1ec1dad38b7176205ea6ef3214a557f3293d9ebe89f84a546457af9d7388f490ebf0ee19925071d1873b1d2063365c8df6e357c4746aa4e272d41bcd0d4bc9a5a636e9c229cdcc0241647c3eec3cdc2eb3689f67ae7bbf4c7ef07db292d18a04c8a2275b1ea6d9a1cebafa686bd6f6e00918df840096987d7372d6b480345c1a2a5235be30bb682ef51245209280c9659bc51506ce033c7a320652264691a93440c8aebdefbbc53b3cfcb0b5f438dde261d6eab7475e2b05440e420f575484b352d50a1dff7c7cd11cd9e3cc88dca6acf89e711de41c582549e13e8f72d4f4014d39a2469434ac1071098269230e3ce0bb3f0cb7733f124c16ec36ce2e6552a4319b4d094e08d3bb5c12dc37f3f1fb8dc991fd35da211eff92b97e2fd6cba12f29828fb3839e497fbcb30a5440a10ad38f66c06e354327f12722ec7cc1667637dd357828dfb55613368dd6c7ce1a98219f5fcf45b825256632ea393d3274bff18a5d03490e04ec263b191d280942e6f6f1d7a5ca241668a2651bc543cb29737936c44ed5c78b7f5ad9e56370ccf37b74cc5eb1583763ddd6756a4842badc1f8167a71fa8b31712a6ebc9093315f2fdac1816e3f3c302792ad8fc83b146b582c477ba8544bec5c77f647af4004ec0125cac9c2987237bf9cccb222409630b70b8cf1200ea8e430b39f149d61e4c0c731f49297f8c2cd6c81afc51a5a48ee684b284b7e82f34ec600beb8d38b137037b58db5a38f676cd61da1985096cca1d9e1eb100ca37db5f8a4a6a7272a0c05b1a50c38938ea42b120d1b72aa34f6b465697ef9a625a31fc46f9a7826b757eb40f8810d8739db85496eff5d279a210ef09b6e37a335bb72e45830c221c4ee28a68e82e281b8c425859517deab791b0fdd3d1e7e0f1371b96e8efde823b297a27b76a5d8e88c3406c6df22ef4b270bc959822aab620db2503661f3af1a9347e960bd2e9070ece2472639197687c9c059ff6c54e407201999ca347e4d365ee883d958bdd563f86db57423af23b2f7534abda3caee15b5a438ba9efdf1042b68a2d700c7de418cfedcabd3d3f436f1cb0f641b3e7f8e76e47f1120416ad069adc6cc8e6896e6e2f8d60f2a4192e9d9006bcb6ce2de6773773f29f7db3fc52924970c997bc221daf533384d32ca802e474b55c678a65d0cc1feec291da3993c75ea82612d6fb51d59944495ce5dd5099dad05841235ee2c1a58c0ff202d20a6c940c7dd348e0b00d7cd62ed83c8b52f31983ba916bbddb9f2b8cd81604883ef833bbd06238a84e277b43870f11cafffd8ff05e949fd5b66878967fa47f04bc818b55b7388179fcd9004b699809742edba93e879530ec501cd211999eaab59185dfec96e89df40b9618013f0963aa163118fbb6cc4f2b2c07115bb11c2055abfb68b01fa79a603a92be20611e592753fc93a9afd7b39d8dcbe6ff70a9074977840eaea259cacaebab71c01cea01995f4d4f5e3040a10eb32df555df561e0d2fec501818626a576e9ab36dbe6a9fd705b69dba2899a9bd0cabf25f6d751c02c74ef1e8d4a69109f1fca3e709bfe380dd22ade35aabc9bf2b86c2f94f34ea1e8f879d5628349b5c55588e066629780b3ed489332a2ed312188b6c0720984bae2b124e34d37d1ba4a71e514b5e8f40a8d7aa3e8a52c0fd9a028023c13c2e917c3f7db19f796f6c13736ebc0e857577f8a7cd70940c9bb2b5d5b30846ce75bb26c211661127b6be4c7993752c62178961474283b2be7dc88e2b262d00f11e8c9fd39058cf66135ad8ef6c737e4ddf10d3c6689101d3c95ebb3c609524409b10025bd1939f7b98dec26bb23e4a91081283e67c240573f1993ccc8447150800be6688e78ae5ea0e97e1958f84378fd1914d8364972b54c744c5b1b1265d5c9d7be18e8fe30ec6a67dc18dfa75b09cacb98c1e7745329cbc9e797839eeb5ec1f6dea1aba8f76c9e41938efb9e6b49e686388ae95435324561a1394c84b2e841a25ca9e884553cae750f1c16cbff0da4c404d93a0c7ab9c5ee3eb70c70d13dd39c9d4703652659c29bc4e709cc56c1e220ce2161a4e09e09dcd4ed418facc01874781653cd9ee67547c63c25289361e0a010d19db9520a393739aeba41f4e42679fc7597afd5415f62617b5a76ab40f02e98b9c6281b76305e911406702f323cde4cd5451bd493a55435a943dabffbd49103fde04101b35ab852fdf3ec3d7e93bbda308c568baed11e5a4d3e486871e6cabd498a1e340b23a3ac3e8a6ea3554b0273d49eb15b6d3ef287e586fd2877cb6c5cede223992e679430a8d74fae65aa3f630112d25e78c66878924e9fa0aa0eeb9cc376a19c0b66bf2cd65e40ec60abc769274ffad5cb68ead88ae48350a9823f12b803c426eec73a45d9db4cb2c66f74f089c85899b512e67d5e813ae16d3c0b9a7f71e19ad1166e8e7d5329514a109409b69b370773d7cf923a7631e61f579938656ee6f041c3b6794ee2e59aace69b92c1f680f699dbf371bb93def7ddd831077729805501413912998d968a6e3a17f29094e01fb27d0195c80fd7688689ac68c9ac5e5c9e4ec0a180e9d8379757870d250451637d1f4f8fec3546a26ee729d05e58b782638b6a011cb00e577a5aa0b7e65f07049540c1229305b2438156483eda6dbede88031aa64deed9312238cb820a071c2b42bc43caebdccbe8bef6c26dcad353299d925a2530e6cfe020b5e5542b4c15004ce4e4c885ce91c9e989c0af9f60b2b0223fa545e3ad4a591a8130580bb644a081469353257126568d91f836d80e1b72558efa7e00ed7c89b3640aad4628694e3912a9ed7a0bbe6337d0591ef30ad0795cd588f8eebf391a37b1b44310e9b4239eb6c2c2901ae1f33f70fb64dcde614acc781aba7e2c650cdb6a65780adc5fea179d06101c55d4687c9ef8396435758e298f51fed757aca770faf1b2bc874b34d1e6050cc6a97d3a18476858aaee565baca458fe3a3e2a3ad8e8d3af780e3e08e1d5ece55b836b5f57a8f36a8e0e7a8d44f3d1d5290334f4805f932d83f6324273dc48b3fa189ed505c33cc9725b08cf760b1f41bec80a3a8c6ad0f2fa216ef20abbfca753894f31c6fb632ede39702023e0811342e461f704ebfd954e50bc2fef14b79accd0c5b21476de2e3a3f4f630825774c3a651f9bf0bd050959ba6c9438bdf78cbc908e26889f00ce23e7b464b4f84f804bbaf82f1f0f39705efde0abe247ae03dd621fd2ac66d46c56d510a2ead90cac9ddcddb852b461852d2568265da2e5693bb91dd238e704e4e9ec7720f0862b837335a72e790098bed4ab4ce965f9218c75193dcc0f1a236711a3778cf8985f53efbc442a20a3da3a5f2bd4e037901604821936080309e05ac8f8534f4a1ae87672f21dd9896fab83ff6e2e2cfa4689a9d5006bbb7e2cc86cc9d252d081447dc99dc240362c8cc061cdc3ce75deb58b0b77057a7921a64b2f5bb1a3d27d74bd096761d0c99c77a3598dd54e1570f50314290537f35d5d2ad7f2fd2f4432f9bb0589a611e7fae008e825565a922f5bf06318f64dde82b32acfecace3fa2692e338638c80bedc7de32c0a48f7f14999b0c54eed74d1a8dfbed8e111ae02eb978d81a117bb3a53eccee0229b8591e98e3c322dc4235b4a5afb49834897bdb55810e646b842c13643944b0d433ab043aa73959f21a8eefec22f9bc9b52499ceeee2004bae33757db35d4440d5d71643cb6aef6ed1af839b1c18a708c066a168424a9430e71601727871eb2728e26aec503b04cc475a8a6881a90fc974fc57ac5c3560f181a7eca67fef74e4051734c6964144731afc687d84e56b40242f6b2a27a3c539a13043520555b32d99ba85a86a6a189cd2b128728fd23157f862830942da3c275df9b842f07aaede354fa3107bbda51e187b17bb37a98b432e15d09d3eadaf3b2320ca3953b624e14b9efea6234a46b1b2be57aa4f9cb1558a791be1cabd03b9b0e489bda6750d39ad418d17a3225a6276d9dfa1220b091f620e8dc760da66973d6024084f644503efdcd07bbce4dd86c4dedb603701b832c1b7efa8933abf508750c7fe28428e89aa5106e16", 0x1000}, {&(0x7f0000001300)="25b70efdc422fb4195178b1ef5077f8cc3c8a02380ca135cc60f6c4444dbb865d5ec95ee8775d6bc7ae49e2f107e3ae4a7375c39b01407dab166e5240cdd8aa7a3f5da6f6d9d6f1285b921fcd25ea30f0c7451d0c57bf34971514570b403c35de6fa9434d42502ebb70d904a090d0dd0abaac3a981e13d19f86155cc992fcaf3c930977d51b5d34812115d0e79e455b676e4ea7a48b99774f01a3f496283a14b4a5ac5270848301d6951e1c63633cb1a8928c5acf4d991a96a39fea10e4eee608e1a431d6d87e780a58f17486d2a8ac00746ed4cfba1a305f79f42dd9b7c3f35cd50bf2d7331f40e1e7ea03735ee5585a0773bb49435", 0xf6}, {&(0x7f0000000100)="ac2f1896968799cd558f9a7bd0133a037bd4", 0x12}], 0x6) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f00000000c0)=[@release={0x400c630e}], 0x0, 0x0, 0x0}) 03:41:09 executing program 5: r0 = syz_open_dev$sndseq(&(0x7f0000000040)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a85320, &(0x7f0000068f50)={{0x80}, 'por\xff\a\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x1f\x00\x00\xff\xff\xff\xff\xff\xff\xff\xef\x00\x00\x03\xff\x00\a\x00\x00\x00\x00\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x06\x00', 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2}) [ 952.103824][T10707] binder: 10698:10707 BC_CLEAR_DEATH_NOTIFICATION death notification not active [ 952.114311][T10703] binder: 10694:10703 ioctl c0306201 20000000 returned -22 03:41:09 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = syz_open_dev$admmidi(&(0x7f0000000040)='/dev/admmidi#\x00', 0x4, 0x0) setsockopt$SO_VM_SOCKETS_BUFFER_MIN_SIZE(r2, 0x28, 0x1, &(0x7f0000000080)=0x4, 0x8) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) [ 952.167535][T10707] binder: 10698:10707 ioctl c0306201 20008fd0 returned -14 03:41:09 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x4c, 0x0, &(0x7f0000000200)=ANY=[@ANYBLOB="05630440000000000e630c4000f200008c01acbcd9297cf4a76e04ea80b60b21d6efb41548e724db19f016cf6e830123c34234a0c43903464dd4e9c503844e734e52e396711327b0a8d8cf15"], 0x0, 0x0, 0x0}) [ 952.231081][T10700] Unknown ioctl 35090 [ 952.240308][T10705] : renamed from bpq0 [ 952.266697][T10707] binder: 10698:10707 unknown command 155798804 [ 952.295388][T10700] binder: 10698:10700 BC_CLEAR_DEATH_NOTIFICATION death notification not active 03:41:09 executing program 5: r0 = syz_open_dev$sndseq(&(0x7f0000000040)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a85320, &(0x7f0000068f50)={{0x80}, 'por\xff\a\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x1f\x00\x00\xff\xff\xff\xff\xff\xff\xff\xef\x00\x00\x03\xff\x00\n\x00\x00\x00\x00\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x06\x00', 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2}) [ 952.353518][T10707] binder: 10698:10707 ioctl c0306201 20000000 returned -22 [ 952.362500][T10726] binder: 10722:10726 BC_REQUEST_DEATH_NOTIFICATION invalid ref 61952 [ 952.392453][T10726] binder: 10722:10726 unknown command -368808281 03:41:09 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) 03:41:09 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$EXT4_IOC_SWAP_BOOT(r1, 0x6611) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000000380)=ANY=[@ANYBLOB="1189ed1000c5a3589e96de02030726896182af5e10ee67ee02018b027af98ecd143e1300189740e7e831a5f021342307c354001b9aadabe15fd078ce4896ba9ef719cae41cfdc8ad68c6054b9ade80c64796d7963e8a"], 0x0, 0x0, 0x0}) r2 = openat$ipvs(0xffffffffffffff9c, &(0x7f0000000100)='/proc/sys/net/ipv4/vs/drop_packet\x00', 0x2, 0x0) ioctl$VIDIOC_TRY_EXT_CTRLS(r2, 0xc0205649, &(0x7f0000000480)={0x980000, 0x0, 0x446, [], &(0x7f0000000440)={0x9c0925, 0xbc, [], @string=&(0x7f0000000400)=0xcd}}) ioctl$SIOCRSGL2CALL(r2, 0x89e5, &(0x7f00000004c0)=@default) r3 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000200)='IPVS\x00') sendmsg$IPVS_CMD_GET_CONFIG(r2, &(0x7f0000000340)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0xc0}, 0xc, &(0x7f0000000300)={&(0x7f0000000240)={0xc0, r3, 0x100, 0x70bd27, 0x25dfdbfd, {}, [@IPVS_CMD_ATTR_DAEMON={0x50, 0x3, [@IPVS_DAEMON_ATTR_MCAST_PORT={0x8, 0x7, 0x4e24}, @IPVS_DAEMON_ATTR_MCAST_IFN={0x14, 0x2, 'veth0_to_team\x00'}, @IPVS_DAEMON_ATTR_MCAST_IFN={0x14, 0x2, 'nr0\x00'}, @IPVS_DAEMON_ATTR_MCAST_GROUP={0x8, 0x5, @multicast2}, @IPVS_DAEMON_ATTR_MCAST_IFN={0x14, 0x2, 'dummy0\x00'}]}, @IPVS_CMD_ATTR_DEST={0x54, 0x2, [@IPVS_DEST_ATTR_INACT_CONNS={0x8, 0x8, 0x7fff}, @IPVS_DEST_ATTR_L_THRESH={0x8, 0x6, 0x80000001}, @IPVS_DEST_ATTR_ADDR={0x14, 0x1, @ipv6=@mcast2}, @IPVS_DEST_ATTR_FWD_METHOD={0x8, 0x3, 0x7}, @IPVS_DEST_ATTR_U_THRESH={0x8, 0x5, 0x1d4}, @IPVS_DEST_ATTR_ADDR={0x14, 0x1, @ipv4=@local}, @IPVS_DEST_ATTR_INACT_CONNS={0x8, 0x8, 0x1}]}, @IPVS_CMD_ATTR_TIMEOUT_UDP={0x8, 0x6, 0x9}]}, 0xc0}, 0x1, 0x0, 0x0, 0x20000000}, 0x800) r4 = syz_open_dev$vcsn(&(0x7f0000000040)='/dev/vcs#\x00', 0x5, 0x40) ioctl$sock_inet_SIOCDARP(r4, 0x8953, &(0x7f0000000080)={{0x2, 0x4e21, @loopback}, {}, 0x0, {0x2, 0x4e24, @initdev={0xac, 0x1e, 0x0, 0x0}}, 'veth0_to_bridge\x00'}) [ 952.407341][T10700] binder: 10698:10700 ioctl c0306201 20008fd0 returned -14 [ 952.412745][T10726] binder: 10722:10726 ioctl c0306201 20000000 returned -22 03:41:09 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x4c, 0x0, &(0x7f0000000200)=ANY=[@ANYBLOB="05630440000000000e630c4000f200008c01acbcd9297cf4a76e04ea80b60b21d6efb41548e724db19f017cf6e830123c34234a0c43903464dd4e9c503844e734e52e396711327b0a8d8cf15"], 0x0, 0x0, 0x0}) 03:41:09 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000040)='/dev/vga_arbiter\x00', 0x2082, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f00000000c0)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00'], 0xfdfdffff00000000, 0x0, 0x0}) ioctl$UI_SET_PHYS(r1, 0x4008556c, &(0x7f0000000080)='syz0\x00') 03:41:09 executing program 1: r0 = socket$inet6(0xa, 0x5, 0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000180)='/dev/net/tun\x00', 0x0, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000100)={'lo\x00', 0x0}) ioctl$sock_SIOCGIFINDEX(r0, 0x8923, &(0x7f0000000380)={'bpq0\x00\v\x00\xfe\x00\x00\x00\x00\x00\xfa\xff\x00', r2}) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000000)={'bpq0\x00', 0x1212}) getpgid(0xffffffffffffffff) 03:41:09 executing program 5: r0 = syz_open_dev$sndseq(&(0x7f0000000040)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a85320, &(0x7f0000068f50)={{0x80}, 'por\xff\a\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x1f\x00\x00\xff\xff\xff\xff\xff\xff\xff\xef\x00\x00\x03\xff\x00H\x00\x00\x00\x00\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x06\x00', 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2}) [ 952.545342][T10735] binder: 10733:10735 unknown command 284002577 [ 952.625883][T10735] binder: 10733:10735 ioctl c0306201 20000000 returned -22 03:41:09 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000000080)=ANY=[@ANYBLOB="0563debc554db90440ae0000000293d2c0d27b4ea08300fff927cb26abf02de9d9d64a034711bb2dfe35264925000000"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f00000000c0)=[@release={0x400c630e}], 0x0, 0x0, 0x0}) r2 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000040)='cpuacct.usage_sys\x00', 0x0, 0x0) r3 = syz_genetlink_get_family_id$tipc(&(0x7f0000000180)='TIPC\x00') sendmsg$TIPC_CMD_GET_NODES(r2, &(0x7f0000000240)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x10400000}, 0xc, &(0x7f0000000200)={&(0x7f00000001c0)={0x1c, r3, 0x800, 0x70bd2a, 0x25dfdbfb, {}, ["", "", ""]}, 0x1c}, 0x1, 0x0, 0x0, 0x1}, 0x1) [ 952.666764][T10742] binder: 10741:10742 unknown command 0 [ 952.705095][T10742] binder: 10741:10742 ioctl c0306201 20008fd0 returned -22 03:41:09 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) pipe2(&(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}, 0x80800) ioctl$KVM_REINJECT_CONTROL(r1, 0xae71, &(0x7f00000000c0)={0x6e10}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x44bd5c9f710033ba, 0x0, 0x0, 0x0, 0x0, 0x0}) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$VIDIOC_S_MODULATOR(r2, 0x40445637, &(0x7f0000000180)={0x8, "c539e19cf192970f601b43a0518955154cbb990700b04a4e8be917813dd1ff54", 0x400, 0x1ff, 0x1fcf, 0x4, 0x2}) 03:41:09 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) r2 = syz_open_dev$adsp(&(0x7f0000000040)='/dev/adsp#\x00', 0x4, 0x10040) setsockopt$bt_BT_SNDMTU(r2, 0x112, 0xc, &(0x7f0000000080)=0x1, 0x2) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f00000000c0)=ANY=[@ANYBLOB="0f63000000000000"], 0xfdfdffff00000000, 0x0, 0x0}) [ 952.751437][T10754] binder: 10748:10754 BC_REQUEST_DEATH_NOTIFICATION invalid ref 61952 [ 952.779788][T10745] : renamed from bpq0 [ 952.792176][T10754] binder: 10748:10754 unknown command -368808281 03:41:09 executing program 5: r0 = syz_open_dev$sndseq(&(0x7f0000000040)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a85320, &(0x7f0000068f50)={{0x80}, 'por\xff\a\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x1f\x00\x00\xff\xff\xff\xff\xff\xff\xff\xef\x00\x00\x03\xff\x00L\x00\x00\x00\x00\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x06\x00', 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2}) [ 952.832142][T10754] binder: 10748:10754 ioctl c0306201 20000000 returned -22 [ 952.882135][T10758] binder: 10757:10758 unknown command -1126276347 [ 952.918535][T10758] binder: 10757:10758 ioctl c0306201 20000000 returned -22 03:41:10 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x4c, 0x0, &(0x7f0000000200)=ANY=[@ANYBLOB="05630440000000000e630c4000f200008c01acbcd9297cf4a76e04ea80b60b21d6efb41548e724db19f018cf6e830123c34234a0c43903464dd4e9c503844e734e52e396711327b0a8d8cf15"], 0x0, 0x0, 0x0}) [ 952.960345][T10768] binder: 10764:10768 ioctl c0306201 20000040 returned -14 [ 952.967863][T10769] binder: 10757:10769 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 03:41:10 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x400005, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = syz_open_dev$radio(&(0x7f0000000040)='/dev/radio#\x00', 0x3, 0x2) ioctl$BLKZEROOUT(r2, 0x127f, &(0x7f0000000100)={0x2, 0x9}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000000180)=ANY=[@ANYBLOB="05630440000000000e630c40000000006a6c70c83dd9fd7722b845a80fbe5426725d7181267555121b67593dbd488918c38b330cb3bfa7b729d3c2766382287779bbfbcc691d8119845e10853b814ffebb924b09c6c8b8d00b9141b6916225dfcf9efb774775ab39a91fff0deb1e21f1bd500d266b104915c238db0988d8b84e6defcd48bee79b14e9285a11ea5ca09ce62391c85270b0a94e53b67fd4ed043bd729247b2d60e147f20598881003dd3ac4b6f0a9441a13e0ecbe787ca7b5eeb9b1eba9e05156e7111d01472b046d01256f5c11d9191bbd35234b2977ef9045669c7ce955508035606484d631980ced78d5ad84661cf459445148f9f64a08fd06488f4fb2da852ced71f3bb142da16a752a382b4ec82c6fdf96bde30b6001d860514efd8b00daf520da411e5dd7f7739b0508008c9071e8ae757ac1ab32e56ecc9f3528ef0c4966f832454ceb1125c310cb65a41a13c239240cafc178c4048319e0a03e883072fabeb92a58093af7b474f6c2daa31a89fe76f83c11fbc00c10fd00dd478afcd2f2abb882eda2cd2c69d3d9d795ea2b73c57b1fdc2c62509e837a5aa2fd716671182747d0b70ef59ca813df2657a803"], 0x0, 0x0, 0x0}) setsockopt$inet6_MCAST_JOIN_GROUP(r2, 0x29, 0x2a, &(0x7f0000000340)={0x5, {{0xa, 0x4e23, 0x3, @dev={0xfe, 0x80, [], 0x24}}}}, 0x88) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f00000000c0)=[@release={0x400c630f}], 0xfdfdffff00000000, 0x0, 0x0}) 03:41:10 executing program 5: r0 = syz_open_dev$sndseq(&(0x7f0000000040)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a85320, &(0x7f0000068f50)={{0x80}, 'por\xff\a\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x1f\x00\x00\xff\xff\xff\xff\xff\xff\xff\xef\x00\x00\x03\xff\x00h\x00\x00\x00\x00\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x06\x00', 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2}) 03:41:10 executing program 1: r0 = socket$inet6(0xa, 0x5, 0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000180)='/dev/net/tun\x00', 0x0, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000100)={'lo\x00', 0x0}) ioctl$sock_SIOCGIFINDEX(r0, 0x8923, &(0x7f0000000380)={'bpq0\x00\v\x00\xfe\x00\x00\x00\x00\x00\xfa\xff\x00', r2}) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000000)={'bpq0\x00', 0x1212}) getpgid(0xffffffffffffffff) 03:41:10 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = openat(0xffffffffffffffff, &(0x7f0000000040)='./file0\x00', 0x188c2, 0x30) ioctl$IMGETCOUNT(r2, 0x80044943, &(0x7f0000000080)) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) 03:41:10 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) socket$inet6_icmp_raw(0xa, 0x3, 0x3a) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f00000000c0)=[@release={0x400c630e}], 0x0, 0x0, 0x0}) [ 953.152754][T10781] binder: 10772:10781 BC_REQUEST_DEATH_NOTIFICATION invalid ref 61952 [ 953.197319][T10780] binder: 10775:10780 BC_CLEAR_DEATH_NOTIFICATION death notification cookie mismatch 77fdd93dc8706c6a != 0000000000000000 [ 953.232496][T10781] binder: 10772:10781 unknown command -368808281 03:41:10 executing program 5: r0 = syz_open_dev$sndseq(&(0x7f0000000040)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a85320, &(0x7f0000068f50)={{0x80}, 'por\xff\a\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x1f\x00\x00\xff\xff\xff\xff\xff\xff\xff\xef\x00\x00\x03\xff\x00l\x00\x00\x00\x00\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x06\x00', 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2}) [ 953.255108][T10781] binder: 10772:10781 ioctl c0306201 20000000 returned -22 [ 953.262683][T10790] binder: 10783:10790 Acquire 1 refcount change on invalid ref 0 ret -22 [ 953.272475][T10780] binder: 10775:10780 ioctl c0306201 20008fd0 returned -14 03:41:10 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x4c, 0x0, &(0x7f0000000200)=ANY=[@ANYBLOB="05630440000000000e630c4000f200008c01acbcd9297cf4a76e04ea80b60b21d6efb41548e724db19f019cf6e830123c34234a0c43903464dd4e9c503844e734e52e396711327b0a8d8cf15"], 0x0, 0x0, 0x0}) [ 953.308199][T10790] binder: 10783:10790 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 953.333612][T10785] : renamed from bpq0 03:41:10 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000380)='/dev/binder#\x00', 0x0, 0x802) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, &(0x7f0000000040)={0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000340)={0xbc, 0x0, &(0x7f0000000200)=[@request_death={0x400c630e, 0x0, 0x1}, @release={0x40046306, 0x2}, @acquire_done={0x40106309, r1, 0x1}, @transaction={0x40406300, {0x2, 0x0, 0x3, 0x0, 0x11, 0x0, 0x0, 0x0, 0x20, &(0x7f0000000080), &(0x7f0000000100)=[0x60, 0x40, 0x30, 0x48]}}, @reply_sg={0x40486312, {{0x0, 0x0, 0x1, 0x0, 0x11, 0x0, 0x0, 0x0, 0x28, &(0x7f0000000180), &(0x7f00000001c0)=[0x30, 0x48, 0x38, 0x48, 0x78]}, 0x9}}], 0x52, 0x0, &(0x7f00000002c0)="59180dccd3879d0108a28d0060cbec8e3a4ee1e9f81a97e2d8e9b7689ceb5b89cebb812f24159c38fbb80d313ebce8dfebfd5881e687fdbd36f283630b7f4e3118495cb67579a76842094431cfe732e87285"}) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f00000000c0)=[@release={0x400c630e}], 0x0, 0x0, 0x0}) 03:41:10 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) openat$ptmx(0xffffffffffffff9c, &(0x7f0000000040)='/dev/ptmx\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) 03:41:10 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="05630440000000000e630c40e402ffff5bb18d10af11abb6c80779d9578a32f4551d1cac6266b94e432b81f05d4470"], 0x0, 0x0, 0x0}) r3 = fcntl$dupfd(r1, 0x406, r1) ioctl$SCSI_IOCTL_TEST_UNIT_READY(r3, 0x2) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f00000000c0)=[@release={0x400c630f}], 0xfdfdffff00000000, 0x0, 0x0}) 03:41:10 executing program 5: r0 = syz_open_dev$sndseq(&(0x7f0000000040)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a85320, &(0x7f0000068f50)={{0x80}, 'por\xff\a\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x1f\x00\x00\xff\xff\xff\xff\xff\xff\xff\xef\x00\x00\x03\xff\x00t\x00\x00\x00\x00\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x06\x00', 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2}) [ 953.494456][T10805] binder: 10800:10805 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 953.556577][T10804] binder: 10803:10804 BC_REQUEST_DEATH_NOTIFICATION invalid ref 61952 [ 953.595593][T10805] binder: 10800:10805 Release 1 refcount change on invalid ref 2 ret -22 03:41:10 executing program 1: r0 = socket$inet6(0xa, 0x5, 0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000180)='/dev/net/tun\x00', 0x0, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000100)={'lo\x00', 0x0}) ioctl$sock_SIOCGIFINDEX(r0, 0x8923, &(0x7f0000000380)={'bpq0\x00\v\x00\xfe\x00\x00\x00\x00\x00\xfa\xff\x00', r2}) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000000)={'bpq0\x00', 0x1212}) getpgid(0xffffffffffffffff) [ 953.616472][T10804] binder: 10803:10804 unknown command -368808281 [ 953.623170][T10810] binder: 10807:10810 BC_REQUEST_DEATH_NOTIFICATION invalid ref -64796 [ 953.628650][T10805] binder: 10800:10805 BC_ACQUIRE_DONE u0000000000000000 no match [ 953.650343][T10804] binder: 10803:10804 ioctl c0306201 20000000 returned -22 03:41:10 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) r2 = syz_open_dev$usb(&(0x7f0000000040)='/dev/bus/usb/00#/00#\x00', 0x100, 0x8040) ioctl$DRM_IOCTL_RES_CTX(0xffffffffffffff9c, 0xc0106426, &(0x7f00000000c0)={0x5, &(0x7f0000000080)=[{0x0}, {}, {}, {}, {}]}) ioctl$VIDIOC_CROPCAP(r0, 0xc02c563a, &(0x7f0000000180)={0xf, {0x401, 0xc60, 0x3ff, 0xb1}, {0xa1cb, 0xfffffffffffffffd, 0x8, 0xe72}, {0x2, 0x6}}) ioctl$DRM_IOCTL_UNLOCK(r2, 0x4008642b, &(0x7f0000000100)={r3, 0x21}) connect$unix(r2, &(0x7f0000000200)=@file={0x1, './file0\x00'}, 0x6e) 03:41:10 executing program 5: r0 = syz_open_dev$sndseq(&(0x7f0000000040)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a85320, &(0x7f0000068f50)={{0x80}, 'por\xff\a\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x1f\x00\x00\xff\xff\xff\xff\xff\xff\xff\xef\x00\x00\x03\xff\x00z\x00\x00\x00\x00\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x06\x00', 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2}) [ 953.668124][T10805] binder: 10800:10805 got transaction to invalid handle [ 953.676252][T10816] binder: 10807:10816 BC_CLEAR_DEATH_NOTIFICATION death notification not active [ 953.716279][T10805] binder: 10800:10805 transaction failed 29201/-22, size 0-32 line 2896 03:41:10 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x4c, 0x0, &(0x7f0000000200)=ANY=[@ANYBLOB="05630440000000000e630c4000f200008c01acbcd9297cf4a76e04ea80b60b21d6efb41548e724db19f01acf6e830123c34234a0c43903464dd4e9c503844e734e52e396711327b0a8d8cf15"], 0x0, 0x0, 0x0}) [ 953.766493][T10816] binder: 10807:10816 ioctl c0306201 20008fd0 returned -14 [ 953.774467][T10824] binder: 10800:10824 Acquire 1 refcount change on invalid ref 0 ret -22 03:41:10 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = openat$vfio(0xffffffffffffff9c, &(0x7f0000000040)='/dev/vfio/vfio\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MARK_BUFS(r2, 0x40206417, &(0x7f00000004c0)={0x6, 0xfff, 0xfffffffffffffffb, 0x3, 0x17, 0x3}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$VIDIOC_S_PARM(r2, 0xc0cc5616, &(0x7f0000000200)={0xf, @output={0x1000, 0x1, {0x401, 0x20000}, 0x6, 0x9}}) r3 = syz_genetlink_get_family_id$nbd(&(0x7f0000000180)='nbd\x00') sendmsg$NBD_CMD_STATUS(r2, &(0x7f0000000400)={&(0x7f00000000c0), 0xc, &(0x7f00000003c0)={&(0x7f0000000300)={0x8c, r3, 0xe20, 0x70bd26, 0x25dfdbfe, {}, [@NBD_ATTR_DEAD_CONN_TIMEOUT={0xc, 0x8, 0x4d14}, @NBD_ATTR_SOCKETS={0xc, 0x7, [{0x8, 0x1, r2}]}, @NBD_ATTR_SIZE_BYTES={0xc, 0x2, 0xffffffffffffff01}, @NBD_ATTR_BLOCK_SIZE_BYTES={0xc, 0x3, 0x4}, @NBD_ATTR_BLOCK_SIZE_BYTES={0xc, 0x3, 0x6}, @NBD_ATTR_CLIENT_FLAGS={0xc}, @NBD_ATTR_CLIENT_FLAGS={0xc, 0x6, 0x3}, @NBD_ATTR_CLIENT_FLAGS={0xc, 0x6, 0x3}, @NBD_ATTR_SIZE_BYTES={0xc, 0x2, 0x81}, @NBD_ATTR_BLOCK_SIZE_BYTES={0xc, 0x3, 0x3cb8}]}, 0x8c}, 0x1, 0x0, 0x0, 0x4000015}, 0x800) ioctl$CAPI_NCCI_OPENCOUNT(r2, 0x80044326, &(0x7f0000000100)=0x6) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) 03:41:10 executing program 5: r0 = syz_open_dev$sndseq(&(0x7f0000000040)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a85320, &(0x7f0000068f50)={{0x80}, 'por\xff\a\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x1f\x00\x00\xff\xff\xff\xff\xff\xff\xff\xef\x00\x00\x03\xff\x00\xfd\x00\x00\x00\x00\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x06\x00', 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2}) 03:41:10 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x7fffffffffb, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = syz_open_dev$adsp(&(0x7f0000000040)='/dev/adsp#\x00', 0x6, 0x60000) ioctl$PPPIOCGL2TPSTATS(r2, 0x80487436, &(0x7f0000000140)="0729231d2b246524e05bb3e343d10d6093bdc5767d5319561a45e611aac14746dea32d168d6564ed4cc2b94cead892561787730919275b9e0b643dd12bd463770fe88e53c59b171cd68585fce761b611d875bdc67a2cbd9c4fef489848cfb8aeddc88c855153ec4c3e3d353c4077dc6ceb58ace5584a993622a58401478ce61d436c2b658ab2e44e442a2141ef36c0aeee232034e92feb3bf315edf6f4ad2bc4f05eec57a3fb0b738745d6537d10e21aa2e3a1f924761e344ce334bbab0b963d22caf8155df28d005e") ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f00000000c0)=[@release={0x400c630f}], 0xfdfdffff00000000, 0x0, 0x0}) [ 953.898526][T10818] : renamed from bpq0 03:41:11 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000000200)=ANY=[@ANYBLOB="05630440000000000e630c40000000003ca8bb9f812a3c38bb53c7ede02e59cd044870ce4bedbc93550842acbc9ba54fa0eff3017db4228f00000000000000000000f820c72ee0642fbdf4fda8c6f8c02dbe0961ab6fa62008dc137f6018a3acfc07114077f2cf387e4965dcffa95139482df9142bac160689dd5d577766b420e9fd446801f5f21456183a246266fe060000000000006346cae2476982"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="00000c4000000000cc24ac8c4d399b0361fef687b609941b0e3531a530d9e1be95e63e064f078c7d97e05ae6a2c4fdc57c68cb2017cd8e8fdc10d50ffa6330ed93f5797fe600e572"], 0x0, 0x0, 0x0}) r2 = openat$hwrng(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/hwrng\x00', 0x80, 0x0) ioctl$SIOCGETLINKNAME(r2, 0x89e0, &(0x7f0000000180)={0x2, 0x3}) [ 953.948295][T10831] binder: 10830:10831 unknown command -368808281 [ 954.035068][T10831] binder: 10830:10831 ioctl c0306201 20000000 returned -22 [ 954.064091][T10846] binder: 10845:10846 unknown command 1074528256 [ 954.071170][T10846] binder: 10845:10846 ioctl c0306201 20008fd0 returned -22 03:41:11 executing program 2: r0 = openat(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x402, 0x4) write$RDMA_USER_CM_CMD_CREATE_ID(0xffffffffffffffff, &(0x7f0000000100)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000080)={0xffffffffffffffff}, 0x111, 0x7}}, 0x20) write$RDMA_USER_CM_CMD_LISTEN(r0, &(0x7f0000000180)={0x7, 0x8, 0xfa00, {r1, 0x3}}, 0x10) r2 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) prctl$PR_SET_SECUREBITS(0x1c, 0x11) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f00000000c0)=[@release={0x400c630e}], 0x0, 0x0, 0x0}) [ 954.082747][T10844] binder: 10839:10844 ioctl c0306201 20008fd0 returned -14 03:41:11 executing program 1: r0 = socket$inet6(0xa, 0x5, 0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000180)='/dev/net/tun\x00', 0x0, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000100)={'lo\x00', 0x0}) ioctl$sock_SIOCGIFINDEX(r0, 0x8923, &(0x7f0000000380)={'bpq0\x00\v\x00\xfe\x00\x00\x00\x00\x00\xfa\xff\x00', r2}) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000000)={'bpq0\x00', 0x1212}) getpgid(0xffffffffffffffff) 03:41:11 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) r2 = semget$private(0x0, 0x3, 0x80) semctl$GETNCNT(r2, 0x3, 0xe, &(0x7f0000000040)=""/135) 03:41:11 executing program 5: r0 = syz_open_dev$sndseq(&(0x7f0000000040)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a85320, &(0x7f0000068f50)={{0x80}, 'por\xff\a\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x1f\x00\x00\xff\xff\xff\xff\xff\xff\xff\xef\x00\x00\x03\xff\x00\x00\x03\x00\x00\x00\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x06\x00', 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2}) [ 954.138307][T10848] binder: 10839:10848 ioctl c0306201 20008fd0 returned -14 03:41:11 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x4c, 0x0, &(0x7f0000000200)=ANY=[@ANYBLOB="05630440000000000e630c4000f200008c01acbcd9297cf4a76e04ea80b60b21d6efb41548e724db19f01bcf6e830123c34234a0c43903464dd4e9c503844e734e52e396711327b0a8d8cf15"], 0x0, 0x0, 0x0}) [ 954.265124][T24007] binder: undelivered death notification, 0000000000000000 [ 954.275482][T10858] binder_thread_write: 2 callbacks suppressed [ 954.275492][T10858] binder: 10851:10858 BC_REQUEST_DEATH_NOTIFICATION death notification already set [ 954.293866][T24007] binder: undelivered death notification, 0000000000000000 03:41:11 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="0e40820000400000040000000000000000000000000000"], 0xfdfdffff00000000, 0x0, 0x0}) 03:41:11 executing program 5: r0 = syz_open_dev$sndseq(&(0x7f0000000040)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a85320, &(0x7f0000068f50)={{0x80}, 'por\xff\a\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x1f\x00\x00\xff\xff\xff\xff\xff\xff\xff\xef\x00\x00\x03\xff\x00\x00\x05\x00\x00\x00\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x06\x00', 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2}) 03:41:11 executing program 4: r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f00000002c0)='/dev/ubi_ctrl\x00', 0x40400, 0x0) ioctl$KDSKBSENT(r0, 0x4b49, &(0x7f0000000300)="2bb072f04750dbbb8a79595793551be417b252f8595163c372c118ddddf6") r1 = syz_open_dev$media(&(0x7f0000000040)='/dev/media#\x00', 0x2, 0x24000) getsockopt$inet_pktinfo(r1, 0x0, 0x8, &(0x7f0000000100)={0x0, @multicast1, @remote}, &(0x7f0000000180)=0xc) setsockopt$TIPC_GROUP_LEAVE(r0, 0x10f, 0x88) sendmsg$nl_route_sched(r1, &(0x7f0000000280)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x20}, 0xc, &(0x7f0000000240)={&(0x7f0000000200)=@gettclass={0x24, 0x2a, 0x400, 0x70bd2d, 0x25dfdbfd, {0x0, r2, {0x3, 0x1}, {0xfff3, 0x7}, {0x0, 0xfff7}}, ["", "", ""]}, 0x24}, 0x1, 0x0, 0x0, 0x1}, 0x801) setsockopt$packet_int(r1, 0x107, 0xb, &(0x7f0000000080)=0x200, 0x4) r3 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f00000001c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f00000000c0)={0xffffffffffffff45, 0x0, &(0x7f0000005fd4)=ANY=[@ANYBLOB="05630440000000000e6b0c4000000000"], 0x0, 0x0, 0x0}) [ 954.340290][T10866] binder: 10859:10866 unknown command -368808281 [ 954.348787][T10857] : renamed from bpq0 [ 954.359279][T10866] binder: 10859:10866 ioctl c0306201 20000000 returned -22 [ 954.458651][T10857] : renamed from bpq0 03:41:11 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$KVM_SET_XSAVE(r0, 0x5000aea5, &(0x7f0000000180)={"3ae25cbc943778fe2cf7fec695017e66bd91fe9064d789452eddccf6db006d3ca44b17323be1dfd105364ce01ea172310ed0548f4a94b6d32f3bf7e98738990a8ae3569dd9f8720e94b4dbb58d6a1d366366db1c3dee33ba90a6e4bd8540efe9a92cdd138c3f1efeae49bbf558bd87ba1e5a1242c37a35c43191c4bfa730bcadd186aade30ce854fd8ed9151973747c2ffe743468b2193826bacd78e2d6f36f2a054b073cddfe501759d939884281e8f4cd1f0c284fd457ab73ae8d04be1defee339f6ae57858c9147c6cdf216ede489283bf4c30482db639c44d2931e9da2c49edf19b5adf70a7a378bf11934bdb3f593f9b5901125fa65a514a7fa954fbe938265bf894e1c119c2cd283d55c425d51b1d1c2b6a237fc76c4a85fc9e6adcf0cf59aa2d49f5e3ab933c2d24575c20052ae526ad5929945370fa5af8ed102b81ce6ab07837c343ee74148c4340b7b4f7469ada07b3d36a1f1775f34c8cec21a96dc2aa284d8dd6f5df7c961388472201d42763125c1cb9602f1765a8f93022e55060b16a597cbbde280cc37135f9623be2a85a93ab45307b05cd2f9cb4ab8ff75a26417003a88ca5a7b2bd995978f1ba698c05d8c874c3ffda5219a9aaac5a0105e8450392861fcefccf18315ca5f0d8a14eac2d40caefdf24667afcb377fefd97c3d920cfd29e5424a04d53631a77b3c28e4a9fbfd157abeb3253c7a018c15a14bdf4bcb1c4cd37e8a101a103de16c984b468ae525f6188e2cf884b7405f9efbeedb797680f554058fcf079441396ebe37b848ecabea70238b660a106485bc2ce392d742965b3bf9e013b44844d06910a73e53f3bc37a17b84f99eb78ad0af8a56c56934b3b634cee87525caca4c28d828dbba075b62229d3bc3c03d38f2afc4695aa96c07a19d9c393d56783105343c265a9b61394d9eec1d77b5be4cf9a0aea18023823227629c643887873567ef63dc7d8155ef6e425b0060e85ed58779c4d376d3e9cca64aee476116f358317fbe6b70c614b35d262e8090b02a46860cde11bec8f3a291fed5e0d7b947037e41eec1bf831d2e91ac51ee219202a568991c90d85876dbe217ef5c47bdc1a3201b61733ca2d0c962c78ab972e165f21bdf4fd241f5e16bb1876054faeb9ba425e8c736e39f7ef85c59f14961632631e4fd0c9d506df6e3b665a7af7c803fce187a50269922e96790c0e00d880e4a970263ec7666c8a110cdd3ce4d07cefbf9e821615b197c0b6caf2cf876483f0c7899581e72caaf5a66951b565f0d0835ff39445e16d3303b064dd9ad41e8cc277be9221be72dde18957735e034e2acc1399b6d0a5b41fc61b9d319dafb9800564950fdcb8d7f0159325ecc392561996dd1f5a5bc3b059b95b562a83c64a1f0aaf6868785ca81155edf7040a6fab7a40fc169453764bbf87d46aa415aa8d9a3030002f4e4"}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f00000000c0)=[@release={0x400c630e}], 0x0, 0x0, 0x0}) write$binfmt_elf32(r0, &(0x7f0000000580)={{0x7f, 0x45, 0x4c, 0x46, 0x0, 0x8d4e, 0x6, 0x8d, 0x6e, 0x2, 0x6, 0x2, 0x1f5, 0x38, 0x195, 0x1000, 0x2, 0x20, 0x2, 0x0, 0x7f, 0x4}, [{0x7, 0x7fff, 0x0, 0x1, 0x80, 0x4800000000, 0xffffffffffffff1d, 0x80}, {0x60000000, 0xfffffffffffffffd, 0x1, 0x3ff, 0x9, 0x5, 0x80000001, 0x8001}], "25a648865cbb55fc07fce59fd25f80ba0e17e472a33752fee17aba1a22b02ac2ade066e34fac7e5d5d", [[], [], []]}, 0x3a1) r2 = openat$rfkill(0xffffffffffffff9c, &(0x7f0000000040)='/dev/rfkill\x00', 0x40000, 0x0) ioctl$DRM_IOCTL_PRIME_HANDLE_TO_FD(0xffffffffffffffff, 0xc00c642d, &(0x7f0000000080)={0x0, 0x80000}) ioctl$DRM_IOCTL_GEM_CLOSE(r2, 0x40086409, &(0x7f0000000940)={r3}) 03:41:11 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x4c, 0x0, &(0x7f0000000200)=ANY=[@ANYBLOB="05630440000000000e630c4000f200008c01acbcd9297cf4a76e04ea80b60b21d6efb41548e724db19f01ccf6e830123c34234a0c43903464dd4e9c503844e734e52e396711327b0a8d8cf15"], 0x0, 0x0, 0x0}) 03:41:11 executing program 5: r0 = syz_open_dev$sndseq(&(0x7f0000000040)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a85320, &(0x7f0000068f50)={{0x80}, 'por\xff\a\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x1f\x00\x00\xff\xff\xff\xff\xff\xff\xff\xef\x00\x00\x03\xff\x00\x00\x06\x00\x00\x00\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x06\x00', 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2}) [ 954.549574][T10875] binder: 10873:10875 unknown command 8536078 [ 954.585382][T10875] binder: 10873:10875 ioctl c0306201 20008fd0 returned -22 03:41:11 executing program 1: r0 = socket$inet6(0xa, 0x5, 0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000180)='/dev/net/tun\x00', 0x0, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000100)={'lo\x00', 0x0}) ioctl$sock_SIOCGIFINDEX(r0, 0x8923, &(0x7f0000000380)={'bpq0\x00\v\x00\xfe\x00\x00\x00\x00\x00\xfa\xff\x00', r2}) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000000)={'bpq0\x00', 0x1212}) getpgid(0xffffffffffffffff) 03:41:11 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=ANY=[@ANYBLOB="057c310ef7936d4a77630c4000000000"], 0x0, 0x0, 0x0}) [ 954.633822][T10885] binder: 10882:10885 unknown command -368808281 [ 954.645174][T10886] binder: 10884:10886 ioctl 5000aea5 20000180 returned -22 03:41:11 executing program 5: r0 = syz_open_dev$sndseq(&(0x7f0000000040)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a85320, &(0x7f0000068f50)={{0x80}, 'por\xff\a\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x1f\x00\x00\xff\xff\xff\xff\xff\xff\xff\xef\x00\x00\x03\xff\x00\x00\a\x00\x00\x00\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x06\x00', 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2}) [ 954.686741][T10886] binder: 10884:10886 Acquire 1 refcount change on invalid ref 0 ret -22 [ 954.700540][T10885] binder: 10882:10885 ioctl c0306201 20000000 returned -22 03:41:11 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = openat$zero(0xffffffffffffff9c, &(0x7f0000000040)='/dev/zero\x00', 0x40000, 0x0) getsockopt$inet_sctp6_SCTP_FRAGMENT_INTERLEAVE(r2, 0x84, 0x12, &(0x7f0000000080), &(0x7f0000000100)=0x4) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f00000000c0)=[@release={0x400c630f}], 0xfdfdffff00000000, 0x0, 0x0}) [ 954.775390][T10892] binder: 10890:10892 unknown command 238124037 03:41:11 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) 03:41:11 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x4c, 0x0, &(0x7f0000000200)=ANY=[@ANYBLOB="05630440000000000e630c4000f200008c01acbcd9297cf4a76e04ea80b60b21d6efb41548e724db19f01dcf6e830123c34234a0c43903464dd4e9c503844e734e52e396711327b0a8d8cf15"], 0x0, 0x0, 0x0}) [ 954.816686][T10892] binder: 10890:10892 ioctl c0306201 20000000 returned -22 03:41:11 executing program 5: r0 = syz_open_dev$sndseq(&(0x7f0000000040)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a85320, &(0x7f0000068f50)={{0x80}, 'por\xff\a\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x1f\x00\x00\xff\xff\xff\xff\xff\xff\xff\xef\x00\x00\x03\xff\x00\x00\n\x00\x00\x00\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x06\x00', 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2}) 03:41:11 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) [ 954.903128][T10893] : renamed from bpq0 [ 954.962614][T10906] binder: 10900:10906 ioctl c0306201 20008fd0 returned -14 03:41:12 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(0xffffffffffffffff, 0x84, 0x6f, &(0x7f0000000040)={0x0, 0x90, &(0x7f0000000180)=[@in6={0xa, 0x4e23, 0x6, @remote, 0x7fffffff}, @in6={0xa, 0x4e20, 0xfcf8, @mcast2, 0x4}, @in={0x2, 0x4e22, @remote}, @in6={0xa, 0x4e20, 0x8, @remote, 0xfff}, @in={0x2, 0x4e21, @multicast1}, @in6={0xa, 0x4e21, 0x3f, @mcast1, 0xfffffffffffffffb}]}, &(0x7f0000000080)=0x10) setsockopt$inet_sctp6_SCTP_MAXSEG(r1, 0x84, 0xd, &(0x7f0000000100)=@assoc_id=r2, 0x4) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f00000000c0)=[@release={0x400c630e}], 0x0, 0x0, 0x0}) [ 955.048554][T10913] binder: 10909:10913 unknown command -368808281 [ 955.072890][T10913] binder: 10909:10913 ioctl c0306201 20000000 returned -22 03:41:12 executing program 5: r0 = syz_open_dev$sndseq(&(0x7f0000000040)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a85320, &(0x7f0000068f50)={{0x80}, 'por\xff\a\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x1f\x00\x00\xff\xff\xff\xff\xff\xff\xff\xef\x00\x00\x03\xff\x00\x00H\x00\x00\x00\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x06\x00', 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2}) 03:41:12 executing program 3: r0 = syz_open_procfs(0x0, &(0x7f0000000000)='net/dev\x00') r1 = mmap$binder(&(0x7f0000ffa000/0x3000)=nil, 0x3000, 0x2000000, 0x10, 0xffffffffffffff9c, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000180)={0x28, 0x0, &(0x7f0000000080)=[@release={0x40046306, 0x1}, @increfs_done={0x40106308, r1, 0x1}, @enter_looper, @decrefs={0x40046307, 0x3}], 0x40, 0x0, &(0x7f0000000100)="41d4cfbb0db56161c08fa070bdd3643499307a43f541124b96bb85db073c236751290c3f8d57bd6e3d6489e44ff694e15815c01763906735a54a8e617eb06375"}) r2 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000040)={0x9, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f00000000c0)=[@release={0x400c630f}], 0xfdfdffff00000000, 0x0, 0x0}) [ 955.131597][ T7288] binder: undelivered death notification, 0000000000000000 03:41:12 executing program 1: r0 = socket$inet6(0xa, 0x5, 0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000180)='/dev/net/tun\x00', 0x0, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000100)={'lo\x00', 0x0}) ioctl$sock_SIOCGIFINDEX(r0, 0x8923, &(0x7f0000000380)={'bpq0\x00\v\x00\xfe\x00\x00\x00\x00\x00\xfa\xff\x00', r2}) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000000)={'bpq0\x00', 0x1212}) getpgid(0xffffffffffffffff) 03:41:12 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x4c, 0x0, &(0x7f0000000200)=ANY=[@ANYBLOB="05630440000000000e630c4000f200008c01acbcd9297cf4a76e04ea80b60b21d6efb41548e724db19f01ecf6e830123c34234a0c43903464dd4e9c503844e734e52e396711327b0a8d8cf15"], 0x0, 0x0, 0x0}) [ 955.176737][T10919] binder: 10918:10919 BC_REQUEST_DEATH_NOTIFICATION death notification already set 03:41:12 executing program 4: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0x0, 0x2) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff}) socket$nl_route(0x10, 0x3, 0x0) r2 = openat$dlm_plock(0xffffffffffffff9c, &(0x7f0000000040)='/dev/dlm_plock\x00', 0x8000, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x4) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) epoll_ctl$EPOLL_CTL_ADD(r2, 0x1, r1, &(0x7f0000000080)={0x20000000}) 03:41:12 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000280)='/dev/binder#\x00', 0x0, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) getsockopt$sock_cred(r1, 0x1, 0x11, &(0x7f0000000100)={0x0}, &(0x7f0000000180)=0xc) r4 = syz_open_procfs(r3, &(0x7f00000001c0)='personality\x00') ioctl$KVM_ASSIGN_SET_MSIX_ENTRY(r4, 0x4010ae74, &(0x7f0000000200)={0x7fff, 0x1, 0x43}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0xff) r5 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000040)='cpuacct.stat\x00', 0x0, 0x0) ioctl$LOOP_CHANGE_FD(r5, 0x4c06, r0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f00000000c0)=[@release={0x400c630e}], 0x0, 0x0, 0x0}) syz_open_dev$mice(&(0x7f0000000080)='/dev/input/mice\x00', 0x0, 0x100) 03:41:12 executing program 5: r0 = syz_open_dev$sndseq(&(0x7f0000000040)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a85320, &(0x7f0000068f50)={{0x80}, 'por\xff\a\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x1f\x00\x00\xff\xff\xff\xff\xff\xff\xff\xef\x00\x00\x03\xff\x00\x00L\x00\x00\x00\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x06\x00', 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2}) [ 955.306253][T10931] binder: 10924:10931 ioctl c0306201 20008fd0 returned -14 [ 955.338952][T10935] binder: 10930:10935 Acquire 1 refcount change on invalid ref 0 ret -22 [ 955.347296][T10936] binder: 10927:10936 unknown command -368808281 [ 955.384055][T10936] binder: 10927:10936 ioctl c0306201 20000000 returned -22 [ 955.423335][T10933] : renamed from bpq0 [ 955.434215][T10943] binder: 10930:10943 Acquire 1 refcount change on invalid ref 0 ret -22 [ 955.453848][T10944] binder: 10940:10944 Acquire 1 refcount change on invalid ref 0 ret -22 03:41:12 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)) r1 = perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0xfffffffffffffff8, 0x0, 0x6, 0x7fffffff, 0x0, 0x8, 0x9802, 0x4, 0x5, 0x2, 0x4, 0x4, 0x3, 0x0, 0x80, 0x100000001, 0x7fff, 0x0, 0x10001, 0xdc02, 0x10001, 0xffff, 0x6, 0x0, 0x80000001, 0x150, 0x80000000000, 0x10000, 0x6311, 0x800, 0x20, 0x9b, 0x8, 0x2, 0xffffffff, 0x5, 0x0, 0x4, 0x3, @perf_config_ext={0x7fff, 0x577}, 0x1404, 0x5f, 0x400, 0x4, 0x3, 0xff, 0x7}, 0x0, 0xc, 0xffffffffffffff9c, 0x9) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f00000000c0)=[@release={0x400c630f}], 0xfdfdffff00000000, 0x0, 0x0}) r2 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000100)='/dev/hwrng\x00', 0x8040, 0x0) r3 = syz_genetlink_get_family_id$tipc2(&(0x7f00000001c0)='TIPCv2\x00') sendmsg$TIPC_NL_BEARER_SET(r2, &(0x7f00000003c0)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x10000}, 0xc, &(0x7f0000000380)={&(0x7f0000000200)={0x150, r3, 0x101, 0x70bd27, 0x25dfdbfc, {}, [@TIPC_NLA_SOCK={0x4}, @TIPC_NLA_BEARER={0xc8, 0x1, [@TIPC_NLA_BEARER_DOMAIN={0x8, 0x3, 0x5}, @TIPC_NLA_BEARER_DOMAIN={0x8, 0x3, 0x8103}, @TIPC_NLA_BEARER_UDP_OPTS={0x2c, 0x4, {{0x14, 0x1, @in={0x2, 0x4e20, @loopback}}, {0x14, 0x2, @in={0x2, 0x9, @local}}}}, @TIPC_NLA_BEARER_DOMAIN={0x8, 0x3, 0x7}, @TIPC_NLA_BEARER_UDP_OPTS={0x2c, 0x4, {{0x14, 0x1, @in={0x2, 0x4e24, @initdev={0xac, 0x1e, 0x0, 0x0}}}, {0x14, 0x2, @in={0x2, 0x4e23, @empty}}}}, @TIPC_NLA_BEARER_NAME={0x10, 0x1, @l2={'eth', 0x3a, 'gre0\x00'}}, @TIPC_NLA_BEARER_NAME={0x10, 0x1, @udp='udp:syz2\x00'}, @TIPC_NLA_BEARER_DOMAIN={0x8, 0x3, 0x200}, @TIPC_NLA_BEARER_UDP_OPTS={0x2c, 0x4, {{0x14, 0x1, @in={0x2, 0x4e20, @empty}}, {0x14, 0x2, @in={0x2, 0x4e21, @broadcast}}}}]}, @TIPC_NLA_NODE={0x1c, 0x6, [@TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_ADDR={0x8, 0x1, 0xfffffffffffffffb}]}, @TIPC_NLA_MEDIA={0x10, 0x5, [@TIPC_NLA_MEDIA_PROP={0xc, 0x2, [@TIPC_NLA_PROP_PRIO={0x8}]}]}, @TIPC_NLA_SOCK={0x1c, 0x2, [@TIPC_NLA_SOCK_ADDR={0x8}, @TIPC_NLA_SOCK_REF={0x8, 0x2, 0x7f}, @TIPC_NLA_SOCK_REF={0x8, 0x2, 0x7ff}]}, @TIPC_NLA_MEDIA={0x1c, 0x5, [@TIPC_NLA_MEDIA_NAME={0x8, 0x1, 'ib\x00'}, @TIPC_NLA_MEDIA_NAME={0x8, 0x1, 'ib\x00'}, @TIPC_NLA_MEDIA_NAME={0x8, 0x1, 'udp\x00'}]}, @TIPC_NLA_MON={0xc, 0x9, [@TIPC_NLA_MON_ACTIVATION_THRESHOLD={0x8, 0x1, 0xd75f}]}]}, 0x150}, 0x1, 0x0, 0x0, 0x8000}, 0x8000) 03:41:12 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x4c, 0x0, &(0x7f0000000200)=ANY=[@ANYBLOB="05630440000000000e630c4000f200008c01acbcd9297cf4a76e04ea80b60b21d6efb41548e724db19f021cf6e830123c34234a0c43903464dd4e9c503844e734e52e396711327b0a8d8cf15"], 0x0, 0x0, 0x0}) 03:41:12 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)) syz_open_dev$radio(&(0x7f0000000040)='/dev/radio#\x00', 0x3, 0x2) r1 = syz_open_dev$audion(&(0x7f0000000080)='/dev/audio#\x00', 0x9, 0x4000) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400240) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) [ 955.505955][T24007] binder: undelivered death notification, 0000000000000000 [ 955.538408][T10949] binder: 10940:10949 Acquire 1 refcount change on invalid ref 0 ret -22 03:41:12 executing program 5: r0 = syz_open_dev$sndseq(&(0x7f0000000040)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a85320, &(0x7f0000068f50)={{0x80}, 'por\xff\a\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x1f\x00\x00\xff\xff\xff\xff\xff\xff\xff\xef\x00\x00\x03\xff\x00\x00h\x00\x00\x00\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x06\x00', 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2}) 03:41:12 executing program 1: r0 = socket$inet6(0xa, 0x5, 0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000180)='/dev/net/tun\x00', 0x0, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000100)={'lo\x00', 0x0}) ioctl$sock_SIOCGIFINDEX(r0, 0x8923, &(0x7f0000000380)={'bpq0\x00\v\x00\xfe\x00\x00\x00\x00\x00\xfa\xff\x00', r2}) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000000)={'bpq0\x00', 0x1212}) getpgid(0xffffffffffffffff) [ 955.654636][T10958] binder: 10953:10958 ioctl c0306201 20008fd0 returned -14 [ 955.697100][T10963] binder: 10956:10963 unknown command -368808281 [ 955.707258][T10964] binder: 10953:10964 ioctl c0306201 20008fd0 returned -14 [ 955.731574][ T7288] binder: undelivered death notification, 0000000000000000 03:41:12 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="0600002dda007f000000000000004a6dc90ed2e0c0218bcc1d0001"], 0x0, 0x0, 0x0}) 03:41:12 executing program 5: r0 = syz_open_dev$sndseq(&(0x7f0000000040)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a85320, &(0x7f0000068f50)={{0x80}, 'por\xff\a\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x1f\x00\x00\xff\xff\xff\xff\xff\xff\xff\xef\x00\x00\x03\xff\x00\x00l\x00\x00\x00\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x06\x00', 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2}) 03:41:12 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x400000000) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = syz_open_dev$dmmidi(&(0x7f0000000040)='/dev/dmmidi#\x00', 0x3ff, 0x0) ioctl$PPPIOCGCHAN(r2, 0x80047437, &(0x7f0000000080)) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$sock_netrom_SIOCDELRT(r2, 0x890c, &(0x7f0000000200)={0x0, @null, @netrom={'nr', 0x0}, 0xffff, 'syz1\x00', @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, 0x0, 0x4, [@default, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x0}, @bcast, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x2}, @null, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}]}) epoll_wait(r2, &(0x7f00000000c0)=[{}, {}, {}], 0x3, 0x4c) [ 955.741461][T10963] binder: 10956:10963 ioctl c0306201 20000000 returned -22 [ 955.750796][ T7288] binder: undelivered death notification, 0000000000000000 03:41:12 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="05630440000000000e630c40b8b271420a09fecc03ee00000000100db7f749bc4211530f83a15e2ae4a80e25d103907f7631d555a5c5b96aed5dfe0743cfae99"], 0x0, 0x0, 0x0}) ioctl$KVM_S390_UCAS_UNMAP(r0, 0x4018ae51, &(0x7f0000000080)={0x0, 0x2, 0x5}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f00000000c0)=[@release={0x400c630f}], 0xfdfdffff00000000, 0x0, 0x0}) 03:41:12 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x4c, 0x0, &(0x7f0000000200)=ANY=[@ANYBLOB="05630440000000000e630c4000f200008c01acbcd9297cf4a76e04ea80b60b21d6efb41548e724db19f022cf6e830123c34234a0c43903464dd4e9c503844e734e52e396711327b0a8d8cf15"], 0x0, 0x0, 0x0}) [ 955.905793][T10978] binder: 10975:10978 unknown command 754974726 [ 955.919843][T10966] : renamed from bpq0 [ 955.921054][T10978] binder: 10975:10978 ioctl c0306201 20008fd0 returned -22 03:41:13 executing program 5: r0 = syz_open_dev$sndseq(&(0x7f0000000040)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a85320, &(0x7f0000068f50)={{0x80}, 'por\xff\a\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x1f\x00\x00\xff\xff\xff\xff\xff\xff\xff\xef\x00\x00\x03\xff\x00\x00t\x00\x00\x00\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x06\x00', 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2}) 03:41:13 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=ANY=[@ANYBLOB="05630440007316000e630c4000000000"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f00000000c0)=[@release={0x400c630e}], 0x0, 0x0, 0x0}) [ 956.019651][T10987] binder: 10981:10987 ioctl 4018ae51 20000080 returned -22 [ 956.027907][T10986] binder: 10985:10986 unknown command -368808281 [ 956.057933][T10987] binder: 10981:10987 BC_CLEAR_DEATH_NOTIFICATION death notification not active 03:41:13 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) write$binfmt_misc(r1, &(0x7f0000000040)={'syz0', "4f00d0b45a8faefb1283c3ba1de43a002b17def5b154d3bc849a04516ca53880587cf2b33731ad19f7e3e166c10473de0cefa86c4498892dca9bc96edef4b3"}, 0x43) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) [ 956.081747][T10986] binder: 10985:10986 ioctl c0306201 20000000 returned -22 03:41:13 executing program 1: r0 = socket$inet6(0xa, 0x5, 0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000180)='/dev/net/tun\x00', 0x0, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000100)={'lo\x00', 0x0}) ioctl$sock_SIOCGIFINDEX(r0, 0x8923, &(0x7f0000000380)={'bpq0\x00\v\x00\xfe\x00\x00\x00\x00\x00\xfa\xff\x00', r2}) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000000)={'bpq0\x00', 0x1212}) getpgid(0xffffffffffffffff) [ 956.134062][T10987] binder: 10981:10987 ioctl c0306201 20008fd0 returned -14 03:41:13 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f00000000c0)=[@release={0x400c630f}], 0xfdfdffff00000000, 0x0, 0x0}) r1 = openat$dsp(0xffffffffffffff9c, &(0x7f0000000040)='/dev/dsp\x00', 0x0, 0x0) setsockopt$packet_tx_ring(r1, 0x107, 0xd, &(0x7f0000000080)=@req3={0x100, 0x0, 0x462, 0x5, 0x3ff, 0x7ff, 0xb761}, 0x1c) 03:41:13 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x4c, 0x0, &(0x7f0000000200)=ANY=[@ANYBLOB="05630440000000000e630c4000f200008c01acbcd9297cf4a76e04ea80b60b21d6efb41548e724db19f023cf6e830123c34234a0c43903464dd4e9c503844e734e52e396711327b0a8d8cf15"], 0x0, 0x0, 0x0}) [ 956.212379][T10996] binder: 10995:10996 Acquire 1 refcount change on invalid ref 1471232 ret -22 03:41:13 executing program 5: r0 = syz_open_dev$sndseq(&(0x7f0000000040)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a85320, &(0x7f0000068f50)={{0x80}, 'por\xff\a\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x1f\x00\x00\xff\xff\xff\xff\xff\xff\xff\xef\x00\x00\x03\xff\x00\x00z\x00\x00\x00\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x06\x00', 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2}) 03:41:13 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = openat$sequencer(0xffffffffffffff9c, &(0x7f0000000040)='/dev/sequencer\x00', 0x480, 0x0) setsockopt$inet6_buf(r1, 0x29, 0x0, &(0x7f0000000180)="66f9fea71db5c073bb8669e43c2daebdf886c44b5419bf75d03ffb3cfd26510eb867a3127cdb1b6bcbaf0a03707d10735bc523cc127fb8282a02c286576c4ad1a31300af97261074c1bc8b6657a6b1e8c3ac7e68c73372d55a71cdcfbff70fb7b937cac136fa58da79059da0e4fc58cdafba9a3865d9010299b33a3d389f6400e5a0c0d364a15f291c528d623bd6bfeab50bff1d5eedf433783c65dfa559e77edf9110c427e330830a83ce6b33004fb836f7c61d9f00ba448c505ec1c9b1d52578a97a7c16bf21ee3d3166a1aac89472726b0604117c0862c083ed42567694ae8f4c55fd87b17c8d38df6e4cd9cba1c5cbe9c4b56d6f13b02568c7", 0xfb) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) prctl$PR_SET_FPEXC(0xc, 0x1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f00000000c0)=[@release={0x400c630e}], 0x0, 0x0, 0x0}) 03:41:13 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000180)={0x10, 0x0, &(0x7f0000005fd4), 0xffffffffffffff6c, 0x0, 0x0}) ioctl$sock_netdev_private(r1, 0x89fd, &(0x7f0000000040)="f243a2ed06febf4689f8df94ec21e15b0e77e626b45e8bb804b82571cab2177d16622867108b548d71a658de38ee40e1c2621c959e49be5e6006cea747610a9fde89619c1103ccc089dbf1725df965b9951d746b928864826af705e4a6ea975ea247d5464ee4245cd655307d5be044eb489d86f3bf144da70c7508c0a864a2f1201952717a90bc87e61e4554f69d4a905d95ad6b9803750f9433187d69c624706b71c70f74b4191eed58925ecc27cd621e78323884340ea083b5607a1377808d2dc5f0423e3bc871570ca6147fe1ce66496014") r2 = openat$vfio(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vfio/vfio\x00', 0x2, 0x0) setsockopt$XDP_RX_RING(r2, 0x11b, 0x2, &(0x7f0000000200)=0x2000, 0x4) [ 956.376773][T11014] binder: 11010:11014 unknown command -368808281 [ 956.380112][T11016] binder: 11011:11016 ioctl c0306201 20008fd0 returned -14 [ 956.383149][T11014] binder: 11010:11014 ioctl c0306201 20000000 returned -22 [ 956.387433][T11006] : renamed from bpq0 [ 956.436785][T11016] binder: 11011:11016 ioctl c0306201 20008fd0 returned -14 [ 956.473734][T24007] binder: undelivered death notification, 0000000000000000 03:41:13 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x4c, 0x0, &(0x7f0000000200)=ANY=[@ANYBLOB="05630440000000000e630c4000f200008c01acbcd9297cf4a76e04ea80b60b21d6efb41548e724db19f024cf6e830123c34234a0c43903464dd4e9c503844e734e52e396711327b0a8d8cf15"], 0x0, 0x0, 0x0}) 03:41:13 executing program 5: r0 = syz_open_dev$sndseq(&(0x7f0000000040)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a85320, &(0x7f0000068f50)={{0x80}, 'por\xff\a\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x1f\x00\x00\xff\xff\xff\xff\xff\xff\xff\xef\x00\x00\x03\xff\x00\x00\xfd\x00\x00\x00\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x06\x00', 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2}) [ 956.493498][T24007] binder: undelivered death notification, 0000000000000000 03:41:13 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = accept4$inet(0xffffffffffffffff, &(0x7f0000000040)={0x2, 0x0, @multicast2}, &(0x7f0000000080)=0x10, 0x0) getsockopt$inet_sctp_SCTP_RTOINFO(0xffffffffffffff9c, 0x84, 0x0, &(0x7f0000000100)={0x0, 0x6, 0x8}, &(0x7f0000000180)=0x10) getsockopt$inet_sctp_SCTP_PRIMARY_ADDR(r2, 0x84, 0x6, &(0x7f00000001c0)={r3, @in6={{0xa, 0x4e22, 0x4, @empty, 0x2}}}, &(0x7f0000000280)=0x84) r5 = creat(&(0x7f00000002c0)='./file0\x00', 0x4) getsockopt$inet_sctp6_SCTP_PRIMARY_ADDR(r5, 0x84, 0x6, &(0x7f0000000300)={r4, @in={{0x2, 0x4e24, @empty}}}, &(0x7f00000003c0)=0x84) ioctl$EVIOCSKEYCODE_V2(r5, 0x40284504, &(0x7f00000000c0)={0x80000001, 0x17, 0x4, 0x100000001, "2309b7c9d40bda0e0ae6b2d68ae0385babb6de8d16a846fa924e971173d71db4"}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) write$P9_RAUTH(r5, &(0x7f0000000440)={0x14, 0x67, 0x2, {0x0, 0x0, 0x4}}, 0x14) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=ANY=[@ANYBLOB="05520440000000000e630c4000000000"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f0000000400)=ANY=[@ANYBLOB="13dd5b43fed009ef5133abb4fb0000000000000000000000000000"], 0xfdfdffff00000000, 0x0, 0x0}) [ 956.602130][T11006] : renamed from bpq0 [ 956.613096][T11031] binder: 11021:11031 BC_REQUEST_DEATH_NOTIFICATION death notification already set 03:41:13 executing program 5: r0 = syz_open_dev$sndseq(&(0x7f0000000040)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a85320, &(0x7f0000068f50)={{0x80}, 'por\xff\a\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x1f\x00\x00\xff\xff\xff\xff\xff\xff\xff\xef\x00\x00\x03\xff\x00\x00\x00\x00\x01\x00\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x06\x00', 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2}) [ 956.652639][T11034] binder: 11023:11034 unknown command 0 [ 956.670596][T11035] binder_thread_write: 21 callbacks suppressed [ 956.670611][T11035] binder: 11026:11035 BC_REQUEST_DEATH_NOTIFICATION invalid ref 61952 [ 956.695272][T11034] binder: 11023:11034 ioctl c0306201 20000180 returned -22 03:41:13 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="0563044000fce0465725d500b3615c1600000002a74f9687c42e3f"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f00000000c0)=[@release={0x400c630e}], 0x0, 0x0, 0x0}) 03:41:13 executing program 1: r0 = socket$inet6(0xa, 0x5, 0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000180)='/dev/net/tun\x00', 0x0, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000100)={'lo\x00', 0x0}) ioctl$sock_SIOCGIFINDEX(r0, 0x8923, &(0x7f0000000380)={'bpq0\x00\v\x00\xfe\x00\x00\x00\x00\x00\xfa\xff\x00', r2}) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000000)={'bpq0\x00', 0x1212}) getpgid(0xffffffffffffffff) [ 956.777308][T11040] binder: 11038:11040 unknown command 1074024965 [ 956.792592][T11035] binder: 11026:11035 unknown command -368808281 03:41:13 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) r1 = openat$audio(0xffffffffffffff9c, &(0x7f0000000040)='/dev/audio\x00', 0x0, 0x0) ioctl$KVM_DIRTY_TLB(r1, 0x4010aeaa, &(0x7f0000000080)={0x4}) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) [ 956.819190][T11040] binder: 11038:11040 ioctl c0306201 20000000 returned -22 [ 956.834944][T11035] binder: 11026:11035 ioctl c0306201 20000000 returned -22 [ 956.863709][T11045] binder: 11038:11045 unknown command 1130093843 [ 956.898401][T11045] binder: 11038:11045 ioctl c0306201 20008fd0 returned -22 03:41:13 executing program 5: r0 = syz_open_dev$sndseq(&(0x7f0000000040)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a85320, &(0x7f0000068f50)={{0x80}, 'por\xff\a\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x1f\x00\x00\xff\xff\xff\xff\xff\xff\xff\xef\x00\x00\x03\xff\x00\x00\x00\x00\x02\x00\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x06\x00', 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2}) [ 956.909138][T11051] binder: 11044:11051 Acquire 1 refcount change on invalid ref 1189149696 ret -22 03:41:14 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x4c, 0x0, &(0x7f0000000200)=ANY=[@ANYBLOB="05630440000000000e630c4000f200008c01acbcd9297cf4a76e04ea80b60b21d6efb41548e724db19f025cf6e830123c34234a0c43903464dd4e9c503844e734e52e396711327b0a8d8cf15"], 0x0, 0x0, 0x0}) 03:41:14 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0xfffffffffffffffd) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = syz_open_dev$sndpcmp(&(0x7f0000000040)='/dev/snd/pcmC#D#p\x00', 0x1, 0x400000) ioctl$ifreq_SIOCGIFINDEX_vcan(0xffffffffffffffff, 0x8933, &(0x7f00000000c0)={'vcan0\x00', 0x0}) bind$xdp(r2, &(0x7f0000000100)={0x2c, 0x0, r3, 0x27, 0xffffffffffffff9c}, 0x10) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000000080)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008fd0)={0xfffffffffffffef5, 0x0, &(0x7f00000000c0), 0xffffffffffffff2f, 0x0, 0x0}) [ 956.993314][T11051] binder: 11044:11051 unknown command 13968727 [ 957.020919][T11048] : renamed from bpq0 [ 957.039392][T11056] binder: 11044:11056 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 03:41:14 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) time(&(0x7f0000000040)) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) r3 = fcntl$dupfd(r1, 0x406, r0) epoll_ctl$EPOLL_CTL_ADD(r3, 0x1, r2, &(0x7f0000000080)={0x20000000}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) [ 957.075304][T11051] binder: 11044:11051 ioctl c0306201 20000000 returned -22 03:41:14 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) rename(&(0x7f0000000040)='./file0\x00', &(0x7f0000000080)='./file0\x00') ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f0000000180)=ANY=[@ANYBLOB="0e2d1c8a63000200af93e5761e7f7fe2ed6b8a1cb563abf4a42c55111ddb3c3476b7b4b26caa0941c2934114a1a6701ff70a67fe8fe29775660fdb8b0d9076c26c364a75cec3c02ec1f0b4fa5be13c6c1fb4e33417890982c344ccb90a63927cc424acee7db9dec3b2c161671422798bffd7570d4727c5d1d88fdfd2da0b0a783c56512daa29b178169a958906e810b007bbf8c48776b2a8d4e4fcebb9"], 0x0, 0x0, 0x0}) [ 957.140253][T11064] binder: 11058:11064 BC_REQUEST_DEATH_NOTIFICATION invalid ref 61952 [ 957.163861][T11064] binder: 11058:11064 unknown command -368808281 03:41:14 executing program 5: r0 = syz_open_dev$sndseq(&(0x7f0000000040)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a85320, &(0x7f0000068f50)={{0x80}, 'por\xff\a\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x1f\x00\x00\xff\xff\xff\xff\xff\xff\xff\xef\x00\x00\x03\xff\x00\x00\x00\x00\x03\x00\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x06\x00', 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2}) [ 957.208892][T11064] binder: 11058:11064 ioctl c0306201 20000000 returned -22 03:41:14 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) fcntl$setpipe(r0, 0x407, 0x2) r2 = syz_open_dev$radio(&(0x7f0000000040)='/dev/radio#\x00', 0x0, 0x2) ioctl$VIDIOC_OVERLAY(r2, 0x4004560e, &(0x7f0000000080)=0x99) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0xbc, 0x0, &(0x7f00000002c0)=[@release={0x40046306, 0x3}, @clear_death={0x400c630f, 0x2, 0x100020000}, @enter_looper, @increfs={0x40046304, 0x2}, @transaction={0x40406300, {0x1, 0x0, 0x3, 0x0, 0x11, 0x0, 0x0, 0x0, 0x8, &(0x7f0000000100), &(0x7f0000000180)=[0x28]}}, @reply={0x40406301, {0x1, 0x0, 0x1, 0x0, 0x10, 0x0, 0x0, 0x48, 0x8, &(0x7f0000000200)=[@ptr={0x70742a85, 0x0, &(0x7f00000001c0), 0x1, 0x0, 0x3e}, @fda={0x66646185, 0x4, 0x0, 0x25}], &(0x7f0000000280)=[0x40]}}, @clear_death={0x400c630f, 0x3}], 0xf, 0x0, &(0x7f0000000380)="ba7b1d419a78364c86a191cd88f475"}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f00000000c0)=[@release={0x400c630f}], 0xfdfdffff00000000, 0x0, 0x0}) 03:41:14 executing program 1: r0 = socket$inet6(0xa, 0x5, 0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000180)='/dev/net/tun\x00', 0x0, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000100)={'lo\x00', 0x0}) ioctl$sock_SIOCGIFINDEX(r0, 0x8923, &(0x7f0000000380)={'bpq0\x00\v\x00\xfe\x00\x00\x00\x00\x00\xfa\xff\x00', r2}) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000000)={'bpq0\x00', 0x1212}) getpgid(0xffffffffffffffff) 03:41:14 executing program 5: r0 = syz_open_dev$sndseq(&(0x7f0000000040)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a85320, &(0x7f0000068f50)={{0x80}, 'por\xff\a\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x1f\x00\x00\xff\xff\xff\xff\xff\xff\xff\xef\x00\x00\x03\xff\x00\x00\x00\x00\x04\x00\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x06\x00', 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2}) 03:41:14 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0x0, 0x2) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) socketpair$unix(0x1, 0x1000000, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) r3 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000340)='cgroup.stat\x00', 0x0, 0x0) getsockopt$inet_sctp_SCTP_ENABLE_STREAM_RESET(r3, 0x84, 0x76, &(0x7f0000000640)={0x0, 0xffbad99}, &(0x7f0000000b80)=0x8) getsockopt$inet_sctp6_SCTP_DEFAULT_SEND_PARAM(r3, 0x84, 0xa, &(0x7f0000000bc0)={0x6, 0xffffffffffffffc0, 0x800a, 0x2, 0x10000, 0x6, 0x0, 0x81, r4}, &(0x7f0000000c00)=0x20) ioctl$sock_rose_SIOCADDRT(r3, 0x890b, &(0x7f0000000b00)={@remote={0xcc, 0xcc, 0xcc, 0xcc, 0x2}, 0x0, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @netrom={'nr', 0x0}, 0x1, [@rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @default, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @bcast, @bcast, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}]}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000000080)=ANY=[@ANYBLOB="e46204520000000000000058000000005cac4dfba9be24a90defb060128071c8b586bfc87af04632d28fd95ae6c0095c8de2933726e802c9b4f62259a0526ba370744df5f22374cfd2f6b63802eb3a6a7691f3e80338a22659a471d218e319fd"], 0x0, 0x0, 0x0}) r5 = openat$cachefiles(0xffffffffffffff9c, &(0x7f0000000100)='/dev/cachefiles\x00', 0x80000, 0x0) sendmsg$rds(r5, &(0x7f0000000ac0)={&(0x7f0000000180)={0x2, 0x4e20, @remote}, 0x10, &(0x7f00000005c0)=[{&(0x7f00000002c0)=""/89, 0x59}, {&(0x7f0000000340)}, {&(0x7f0000000380)=""/74, 0x4a}, {&(0x7f0000000400)=""/184, 0xb8}, {&(0x7f00000004c0)=""/80, 0x50}, {&(0x7f0000000540)=""/104, 0x68}], 0x6, &(0x7f0000000a40)=ANY=[@ANYBLOB="480000000000000014010000010000000700000000000080", @ANYPTR=&(0x7f0000000640)=ANY=[], @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00', @ANYPTR=&(0x7f00000009c0)=ANY=[@ANYPTR=&(0x7f0000000680)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00'], @ANYBLOB="ea00000000000000", @ANYPTR=&(0x7f0000000780)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00'], @ANYBLOB='K\x00\x00\x00\x00\x00\x00\x00', @ANYPTR=&(0x7f0000000800)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00'], @ANYBLOB='9\x00\x00\x00\x00\x00\x00\x00', @ANYPTR=&(0x7f0000000840)=ANY=[@ANYBLOB="0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000e100000000000000006a06c05c55b6946427ab0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000"], @ANYBLOB="8800000000000000", @ANYPTR=&(0x7f0000000900)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00'], @ANYBLOB='\\\x00\x00\x00\x00\x00\x00\x00', @ANYPTR=&(0x7f0000000980)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00'], @ANYBLOB='+\x00\x00\x00\x00\x00\x00\x00'], @ANYBLOB="060000000000000001000000000000000000010000000000"], 0x48, 0x880}, 0x810) setsockopt(r1, 0x7, 0x9, &(0x7f0000000200)="2771c54f6b9bfaaff8c10d5dee4078629e9fc5831ae9cc147e8b154c8e8d24d08986c3a4f5e328abb6ce16a97c8dcf4fdd6000c9169fc8b80c64a3183fc9295f31796f6289ff3d91f81e2b92cb05ef4bbd4b49677bb6b6896771c240f7942b965c41baa872f98e5f61b35b523874d4b2885d4d60f962179bb1df97d59f91eacdf9f6f40b87fd6218c2928cf5a254952b2f88343cfc21a110056a58715361b69ac1e8e1db6c4f1603e1fb2f9222759c0767fe451e29", 0xb5) [ 957.347185][T11079] binder: 11073:11079 unknown command -1977864946 [ 957.376084][T11079] binder: 11073:11079 ioctl c0306201 20008fd0 returned -22 03:41:14 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x4c, 0x0, &(0x7f0000000200)=ANY=[@ANYBLOB="05630440000000000e630c4000f200008c01acbcd9297cf4a76e04ea80b60b21d6efb41548e724db19f026cf6e830123c34234a0c43903464dd4e9c503844e734e52e396711327b0a8d8cf15"], 0x0, 0x0, 0x0}) 03:41:14 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000000180)=ANY=[@ANYBLOB="05630440000000000e630c40fe16000027dc554f540c244e8eaf32541ac2cb42a65b9d2bfc2fd29baff0dd40dff4f0c8742bd7cc567b9829c0a51f67c9339134be425f76aab24ae49dbf38a6615ef1927612578c68ba65e6f03706a3fbb634a52dceb2ed08e9ace28e1c404de54cd3348a8613810ddb9a5d9621776a8c84d3db26d7447c503074063e81b01346246ac7865e40ca2e48954ee671a527cd3f367c8b0f5aa008d564e4f241f3f112"], 0x0, 0x0, 0x0}) r2 = openat$mixer(0xffffffffffffff9c, &(0x7f0000000040)='/dev/mixer\x00', 0x8000, 0x0) getsockopt$inet_sctp_SCTP_I_WANT_MAPPED_V4_ADDR(r2, 0x84, 0xc, &(0x7f0000000080), &(0x7f0000000100)=0x4) ioctl$TCSBRK(r2, 0x5409, 0x1) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008fd0)={0x0, 0x0, &(0x7f0000000380), 0x0, 0x0, 0x0}) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f00000000c0)={r2, &(0x7f0000000240)="814d61040be57ebe2cd0e4566c70a20a1c2a17707d33a9532da7ba12835a5a273caec112c4b8bd14082f67cceb5116dddac89b84f6f125f02a6ec5588a75358ac6e9ee55a780a07c62696ec74206a404b23b0b26b2abff13d112502f59ad3a3b78368382c76ffc31008dbd88c8213e2ccd377878087be962578d65eabef3331cbd4f662d5ac773e1709f688d594d6f340964b49d8c669a67317f97d01a3cb6c2b4d3d5436fddcb91af234c09c82c2f0dbf06a99ff75a2e", &(0x7f0000000300)="d734ea348c62153f4f778540157fd3bdce1aef45d4668faf0046abc18cc8aaec7b7933edef27589105b3394fbcfbcf88ff80a91d600d682696061bd1b6c677fa51499b86a928cbd27fe7105a6b1df638cfd3fb3db88a3d1f5089e1e59f9dca866221042f1d2e5702ae539e470bf8d2d73f063ab30495834d0be2a4aefee4f05d7fbbd90fa0a58d0c1cb546c13403300a62b620ffa00c561c65867e6725bfe42b9cfffb0049047b5dee550b4f6b37ba337042c1cf5a5c3dcdfadb7648a5290f569596aadb0f3ec5a9ded41533771835f33d55e8e08c22b61616a076b253db9bd68558", 0x1}, 0x20) 03:41:14 executing program 5: r0 = syz_open_dev$sndseq(&(0x7f0000000040)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a85320, &(0x7f0000068f50)={{0x80}, 'por\xff\a\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x1f\x00\x00\xff\xff\xff\xff\xff\xff\xff\xef\x00\x00\x03\xff\x00\x00\x00\x00\x05\x00\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x06\x00', 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2}) 03:41:14 executing program 3: r0 = openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000000040)='/dev/dlm-monitor\x00', 0x208000, 0x0) ioctl$ASHMEM_SET_SIZE(r0, 0x40087703, 0x168533d8) r1 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) setsockopt$sock_int(r0, 0x1, 0x9, &(0x7f0000000080)=0x3ff, 0x4) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f00000000c0)=[@release={0x400c630f}], 0xfdfdffff00000000, 0x0, 0x0}) [ 957.547093][T11094] binder: 11090:11094 unknown command 1376019172 [ 957.558211][T11081] : renamed from bpq0 [ 957.586712][T11094] binder: 11090:11094 ioctl c0306201 20000000 returned -22 [ 957.612385][T11100] binder: 11089:11100 BC_REQUEST_DEATH_NOTIFICATION invalid ref 61952 [ 957.645342][T11100] binder: 11089:11100 unknown command -368808281 03:41:14 executing program 4: r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000200)=ANY=[@ANYBLOB="020a040007000000ebff0fdf333f220005001a00051300000005ef0554c6c6598d2ba7c61400ebe0d28de8fe2c8ce6ae96b306200a000000"], 0x38}}, 0x0) sendmmsg(r0, &(0x7f0000000180), 0x20, 0x0) 03:41:14 executing program 5: r0 = syz_open_dev$sndseq(&(0x7f0000000040)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a85320, &(0x7f0000068f50)={{0x80}, 'por\xff\a\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x1f\x00\x00\xff\xff\xff\xff\xff\xff\xff\xef\x00\x00\x03\xff\x00\x00\x00\x00\x06\x00\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x06\x00', 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2}) [ 957.674050][T11106] binder: 11096:11106 BC_REQUEST_DEATH_NOTIFICATION invalid ref 5886 [ 957.684422][T11081] : renamed from bpq0 [ 957.689430][T11100] binder: 11089:11100 ioctl c0306201 20000000 returned -22 [ 957.747121][T11107] binder: 11105:11107 ioctl c0306201 20008fd0 returned -14 03:41:14 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x4c, 0x0, &(0x7f0000000200)=ANY=[@ANYBLOB="05630440000000000e630c4000f200008c01acbcd9297cf4a76e04ea80b60b21d6efb41548e724db19f027cf6e830123c34234a0c43903464dd4e9c503844e734e52e396711327b0a8d8cf15"], 0x0, 0x0, 0x0}) 03:41:14 executing program 1: r0 = socket$inet6(0xa, 0x5, 0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000180)='/dev/net/tun\x00', 0x0, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000100)={'lo\x00', 0x0}) ioctl$sock_SIOCGIFINDEX(r0, 0x8923, &(0x7f0000000380)={'bpq0\x00\v\x00\xfe\x00\x00\x00\x00\x00\xfa\xff\x00', r2}) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000000)={'bpq0\x00', 0x1212}) getpgid(0xffffffffffffffff) 03:41:14 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = openat$vcs(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/vcs\x00', 0x301002, 0x0) ioctl$KVM_GET_DEBUGREGS(r2, 0x8080aea1, &(0x7f0000000200)) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f0000000180)=ANY=[@ANYBLOB="00e915b59b47d2878006d6d6c50a44c8680bb48b946ca1a5c52b8b550561949d0ed06dba27df01cedb112d836e1eabdcb89b497a9f535d3443d8247bc0a10621e7bfd9e77fe20ab590955d957b0bae5f1050bd9a1aa6a1b9ac3a"], 0x0, 0x0, 0x0}) r3 = syz_open_dev$dmmidi(&(0x7f0000000040)='/dev/dmmidi#\x00', 0x20, 0x8000) setsockopt$inet_tcp_TCP_REPAIR_QUEUE(r3, 0x6, 0x14, &(0x7f0000000080)=0x2, 0x4) mmap$perf(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x2000002, 0x11, r3, 0x0) 03:41:14 executing program 4: r0 = socket$kcm(0x10, 0x100000000002, 0x0) sendmsg$kcm(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000000c0)=[{&(0x7f0000000240)="d800000018008100e00f80ecdb4cb904021965000b007c05e87c55a11200e1730000000000000000000000000000812fa80005001b4163e3e53db14ca0508ac1799d58f030035c3b61c1d67f6faf7d7134cf6efbe06bbace8017cbec4c2ee5a7cef4c02631631fb791643a5ee4ce1b14d6d930dfe1d9d322fe7c9f8775730d16a4683e4f6dd457c0b03c10964c360db798262f3d40fad95667e04adcdf634c1f215ce3bb9ad809d5e1cace80ed0b7fece0b42a9ecbee5de6ccd40dd6e4edef3d93452a92954b43370e9703db0de796ac5abeb3a79dd14678", 0xd8}], 0x1}, 0x0) 03:41:14 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="05630440000000000e630c40000000008c3c8d64d64b6c96508f053932ce94f29ef65e6114b2c4ed54129e23f96695f7a351b36d"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f00000000c0)=[@release={0x400c630f}], 0xfdfdffff00000000, 0x0, 0x0}) 03:41:14 executing program 5: r0 = syz_open_dev$sndseq(&(0x7f0000000040)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a85320, &(0x7f0000068f50)={{0x80}, 'por\xff\a\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x1f\x00\x00\xff\xff\xff\xff\xff\xff\xff\xef\x00\x00\x03\xff\x00\x00\x00\x00\a\x00\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x06\x00', 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2}) [ 957.915347][T24007] binder: undelivered death notification, 0000000000000000 [ 958.010671][T11127] binder: 11125:11127 BC_CLEAR_DEATH_NOTIFICATION death notification cookie mismatch 966c4bd6648d3c8c != 0000000000000000 [ 958.023929][T11124] binder: 11118:11124 BC_REQUEST_DEATH_NOTIFICATION invalid ref 61952 [ 958.049922][T11132] binder: 11123:11132 unknown command -1256855296 [ 958.056351][T11124] binder: 11118:11124 unknown command -368808281 [ 958.056372][T11124] binder: 11118:11124 ioctl c0306201 20000000 returned -22 [ 958.083608][T11134] netlink: 'syz-executor4': attribute type 5 has an invalid length. [ 958.096214][T11127] binder: 11125:11127 ioctl c0306201 20008fd0 returned -14 03:41:15 executing program 5: r0 = syz_open_dev$sndseq(&(0x7f0000000040)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a85320, &(0x7f0000068f50)={{0x80}, 'por\xff\a\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x1f\x00\x00\xff\xff\xff\xff\xff\xff\xff\xef\x00\x00\x03\xff\x00\x00\x00\x00\n\x00\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x06\x00', 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2}) [ 958.105463][T11132] binder: 11123:11132 ioctl c0306201 20008fd0 returned -22 03:41:15 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x4c, 0x0, &(0x7f0000000200)=ANY=[@ANYBLOB="05630440000000000e630c4000f200008c01acbcd9297cf4a76e04ea80b60b21d6efb41548e724db19f028cf6e830123c34234a0c43903464dd4e9c503844e734e52e396711327b0a8d8cf15"], 0x0, 0x0, 0x0}) [ 958.139619][T11129] : renamed from bpq0 03:41:15 executing program 4: syz_open_dev$admmidi(&(0x7f0000000000)='/dev/admmidi#\x00', 0x9222, 0x0) ioctl$FS_IOC_SET_ENCRYPTION_POLICY(0xffffffffffffffff, 0x800c6613, &(0x7f0000000080)={0x0, @speck128, 0x2, "d80a611d3ada197f"}) r0 = fcntl$getown(0xffffffffffffffff, 0x9) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5, 0x0, 0x100000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = syz_open_dev$sg(&(0x7f0000000040)='/dev/sg#\x00', 0x0, 0x2) getresuid(0x0, &(0x7f0000000540), &(0x7f00000005c0)) r2 = getegid() setsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000000600)={r0, 0x0, r2}, 0xc) r3 = getpid() rt_tgsigqueueinfo(r3, r3, 0x16, &(0x7f0000000100)) ioctl$EXT4_IOC_GROUP_ADD(0xffffffffffffffff, 0x40286608, 0x0) gettid() ptrace(0x4206, r3) connect$netlink(0xffffffffffffffff, &(0x7f0000000500)=@proc={0x10, 0x0, 0x25dfdbfd, 0x800000}, 0xc) ioctl$SG_IO(r1, 0x2285, &(0x7f0000000440)={0x53, 0xfffffffffffffffd, 0x7c, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f00000002c0)="9e9d0693e3f44b2fa6859e080a581db57936ff5113569a1d1324c874117168fb8eab8ed2161969c21552f71e416fd5eb2c688ad663afe891608078828aef4262661198a7cb9a57cb8b2eebc989f844ab084888067c5b309601c6f6a2282e0025866deb94fc1c26384f4c0f125cdd34b2d58fde854f41671224debc03", 0x0, 0x0, 0x1, 0x1, 0x0}) 03:41:15 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) r2 = request_key(&(0x7f0000000180)='cifs.idmap\x00', &(0x7f00000001c0)={'syz', 0x3}, &(0x7f0000000200)='proc\x00', 0xfffffffffffffffc) request_key(&(0x7f0000000040)='asymmetric\x00', &(0x7f0000000080)={'syz', 0x3}, &(0x7f0000000100)='/dev/binder#\x00', r2) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f00000000c0)=[@release={0x400c630f}], 0xfdfdffff00000000, 0x0, 0x0}) 03:41:15 executing program 5: r0 = syz_open_dev$sndseq(&(0x7f0000000040)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a85320, &(0x7f0000068f50)={{0x80}, 'por\xff\a\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x1f\x00\x00\xff\xff\xff\xff\xff\xff\xff\xef\x00\x00\x03\xff\x00\x00\x00\x00H\x00\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x06\x00', 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2}) 03:41:15 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000580)='/dev/binder#\x00', 0x0, 0x2) r1 = openat$dsp(0xffffffffffffff9c, &(0x7f0000000480)='/dev/dsp\x00', 0x101000, 0x0) sendto$packet(r1, &(0x7f00000004c0)="fb841ba17bde83d2d98d3af83cf2cd09968a86550a466cffe118f48135831d414c17343069f78f3582eee53bade6734766226217a606518228829ccef901da437e8c847891e197e74a9867dc63ea7937d40e9c72cf01d525af9382819f1b7fea81c4", 0x62, 0x80, 0x0, 0x0) bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000400)={&(0x7f0000000240)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0xb8, 0xd0, 0x7ff, {"5f6729d24904696c64f20a0bea4a5f9e2e0c4592a808e8b70522edad619d49a67be330f56502fbc976065a62b7f1ef6d921434dfebaa71ea93d5a31f810a4fffcdce29c16376a9ad1364dde2d07faa6fd5e9f81baa0d73e2f74905071a9dabfbde6b2d2b40026e803550b9f2e5f4cf972e6d1b8197edd2a9b78fbfa6dab8428ffd0c478b6f8203ce0c9d19bc9fb264778c561e373d93ea75a16b7ab9c13da62c88c12d4c4855e261f440ab4003550b9af0d8f3ea86"}}, {0x0, "cc6268dde66bb394ad75701f7b80a8a0b17ae416e1846d91184c0bd932fb90886645f523167396fa3e54ace9b06cc76a2ac06f702bea2446d613e1e10999c9a86ddf01954c700cf9a30c5926e3ce8a2d83d4d1cd6d801874f0c5b5fcbf7d2414a7310dd1de211ec177d422499b7a88950a6e1c388d2413f12542516888bac5f467b4b4103ccef64592be70755a"}}, &(0x7f00000003c0)=""/53, 0x15f, 0x35, 0x1}, 0x20) r2 = open(&(0x7f0000000440)='./file0\x00', 0x3144e6695f449c62, 0x200000) getsockopt$inet_sctp_SCTP_RECVRCVINFO(r2, 0x84, 0x20, &(0x7f0000000080), &(0x7f0000000100)=0x4) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) ioctl$sock_SIOCGPGRP(r1, 0x8904, &(0x7f0000001980)=0x0) getsockopt$inet_IP_XFRM_POLICY(r1, 0x0, 0x11, &(0x7f00000019c0)={{{@in6=@mcast2, @in=@empty, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6}, 0x0, @in6=@loopback}}, &(0x7f0000001ac0)=0xe8) getsockopt$sock_cred(r3, 0x1, 0x11, &(0x7f0000001b00)={0x0, 0x0, 0x0}, &(0x7f0000001b40)=0xc) sendmsg$unix(r3, &(0x7f0000001bc0)={&(0x7f00000005c0)=@file={0x1, './file1\x00'}, 0x6e, &(0x7f0000001900)=[{&(0x7f0000000640)="d1b0bac88f94ea9811560f715749b231f7b8ac8436950e7c16b9fd5a695625b178278623d2f33ddde4b29ee6157f5d34363758e978691d2934ada85fa91bb122f77948a4bc94770b07afbce8c5e03247bde2cf2955908ec004929f6d3e2f391b76fa3727c1bac451ed55e230d4d49361d3536a08fb5679d3df9fb34e1a46fce4feae8edf243c0da506201059b54eed08aaf4ac0e440373eb795ebd088ddcd06743f8afb044c91a4156bda573", 0xac}, {&(0x7f0000000700)="9537a3823a715ac6ea230604367779583bb469d22503a1fc1fc31f9bfca8a6b535f992cdc12d246fd40d2fa522f3d1a9af3c9f9b9611e87fdad9d1c1b358873f721af41256894c5588fa9190099aa4f689dac4dc55c46d424bbb5a78b109acf9a6c446a17f7e8b5468bd25fe407e2828d34fb93080a780318804acc46b76a2e44ac56a4cc8743b7bf7a2d91a539b26bc2b2b7cc91659eec3e96f69baa27b861e9a2760a2b3bc0ba164ae1414fb8f0c8d8b54130c1ea5289e5f0659d908e48f0b17fb1ee9fa6e399c7b275d64082b5119da4c29b79f4539dfb692ac732be0ba32262dd59bf994cccd13b4dc8113a92b8c2668fe5f45815afb91a8ef52e73a8fb41fa48c4d3b4956b301a45141c014490e3d681131bd32ad4d93f3ba918a8c81c0c43a9682c7a739251a610f37d02d119e446a7b80b2fddb0ae21c745107399ad7fb32652237650ae95a1e585e462be968d65a658d7a32ec37cec0ce9f2c7c69a5ccae8a575fd76388c1353d1e0785bb39f95b3968ebbc5608fba69a23acd3bacecd30911d2e4f15929720f794da7ffe9792860811b714646c641acd7129feb4f4866474e81075d61ff0de4ca29a2ea032f04ae1283148a7a4b2bbbd856b44413d8443009842b4b4a5b51903b3425f0a40843f8241bcedac16812dc5437a8889855011a4122f08636313633b0b1c4791dd299f7679578e0cd8d4c370c447f4dc7249083728b4d6101bff24475c911774aa2b19dbb30ff60da8a15687821595a8aae190d2192c14ac812d33a608abd18866be73c875a603b5de2c3a7169ec1f1b1a48381789c4b570c68440d97ddfe30a011bf3e11566017f4c4017c4cc2c76e47fa07add9ffed5f9d65ad5c40516a5d5a45a3580b05a01d3834be1d13ac6ad3af0328b28fb96102b2b162b4bbc167e7d690a6ccb282e17ceef6c69e2aaec61be70b286995e9a0369ec67f5aad70ccdf43dce4a41c9ac7eb821da4a56feab472747f737eb61a7bd9c0f61d8b9fe04936c158d3d73803fc2e53ca962dd6f29e4435405ee8c4ab6f869a3b95a4818dea144b4b0cddbba6b1dcb4dd37c1edd87a3652c048a422936632f7186e8d76b54538167c75c1456cddd756f2159fe4f4120228ca64903d522489388cffebb8fae67af82f60b47715f66f36213d9a7d2e86603af93940ec10a73d0c99208bc851218ab418247985c0b1fb1026f7393c1b76e9829a6a7401d5ebcb481f0915884e1758521e7b1ab9bd2ac238cca14674f9298659adef1b847579326ede55b18a267d84b7f5aad0cdaf8721b0e478a7c53f6b055789b6f8f038d3900280ec4c729d6d6ca95cb17131391873a38ad3694d6537573c0ec58a2a1a010077a5618685d83678020a2309fd71efdc698b6fbfb66d2be623a451f5ba2cf54547d5da1f6b8ee287cd5db0e00435f1a65cdbe86cc71169396cb1925b5ec30413cbc2b1f1eb90b27d55676e6b27372de07e12c446d43b0969106abc7f5570b82822b89250d41af4b61a7cb288bc0c3ce5f14b69441361838ec00949b1d777ac2c906c64fe5c4197a442d4f090e664f174ba58c03cd0379ef8bf44aba6f4d321b3bb026b6d024d82b19c343815b4f136c6456d877146e1a891f66b1b9cad8af7f2e50c0711d13201afe240da7675f4b0c72532856c404c183f294b87237d19068399f4e20085c3700b2716b7d85f5040d854040d291f39fba556a0fa8b712e98a5e950d723bab7c291acef66c09fca27494525b28522f0bbe57b3accb2b36e74a28dcc302b711e450286da7104889b99e44c0e63f4be31aac992f5b746c9b47c807ccc2695dd83f0bd064165bee626ae8631706811eca01336fcd8d62485a310fed68bae64371d71dab1e431f48341af0be2c8d66953726f2a06795577341b92c72186ffead20d85dec9dcd70558994450f9c83e52c6c677fa648b7913344ca7f88d28d646f2157fa5652515f113d2aa88b5d0a25061145fbb7c00d47577d98a6f433549407c3d5c90c1671f92b2a3ea2e2422a6743067a24ca92b81c6972d21cd6045be4dbd71c6cc475db50ce42f0416aa813e2e1bfcacf2a5818ac9ae4b2b98f76d29857736824dc3d1cbb448abf0c1729a975c2cd44e2c3f9bfafb46090c96179ae73caba08573db261b8a623a8025870673f55aec13ac8c4dd3613d6c2bac75285ad6822bae44264476f88fe228101b5025740b14eb2ccbcbdb8fc8f727163ba306fdea131825311fd2d3a6658f8a7a363b54c16303957f03e9fc118896e6d1cce831f845fa3c77b75959bd25c1efa319f3b70c4b36e2806c2825c86cbd1023abca29f38943dd61d2e6a05a622d161b517fba71fb7e801021946b61cbfadd314831766b55da6a283e998071a4cf7bbabc895cb20fbc1c9a1b18f70a5ec07a9a8910f2b5d80be52199cc683b8891dc1620828e855c6a7610e304a9d015e2cf2915ee407baebe4936dd973fcae50170f67eee70671fc888b8ef6e793f309ed5dd79ac788e3e84207d1a0260e006d021c8ad073788c3dfaebf524988a368be1a2a690709b8cae74ab3341622c17e448fb072517a108dc104f510dfe82728881160f273e03bcda6880c329c7b59e0406c4bee2829fea60893500dc296422b080d56aa61bc7316658a6fe0186287bb6cd2f535b1a673931f8d223f0e231e29b63ebbc9afc14afd084d33e61b1e4c76f2fe909bbda6da06b030a647f77c436b5103a1b9b5b6d7e3d62074521617bd00c7eda607b184e8ca7fe0d38db5cdac046bf102aa976b6a37de85f9712071905ebfca42d8ebe7c92dc26060aaacf0b4d3811f04fc677493f4f1dfab36d4188c8a9e989fdb665f54cb5a3a4a1b530f19454454b63fcf6abdb3b099ffc872211d196ec2f873edecd0207b2d4c0ed0998e11c4307776eab4a95f80270c746f3db7b78f68ab6887230665cd9ccc4e0dc47dfd173bece9f7d8a092cb94d6b0d5189417ea0aac084ea0c479f9e624073de27456865807332ad3ca7429d3b96b8824c0d2409f13daafbc9896c2f1c8334155ceb357d20b501c43c211e735c1a9379e053649c18ee14daae62619d4191f65e415739d2e919789a7c9f22bf150792b9de1c2f5cb49ed0e8729db7945345e4e279043f7a9aa8e49a9dae2f6f7a83ce772e36df40f0af661a3a6a12a5ee221a6e8ee5d7ed3660d02df710cfb2443575af752e1f99c6074b6d960127511f13fa245e47757cfd0c141c1a53f358278d39bc4a3d8c10f013f9c716a69d05ab508cf8c8fdd94095c1976a3b4dc05acb708771c222fedea60f9f5600113d5a10a012e4f439a76b87e89a8f2c1b4bf047a637dc8a97f6e0dbadb5a6ee8792b8474452a045932fdc7744880ccdf48aa66f036781de954884f050e6ab397aa22d93602f43b9d8eec7af81ad468878fd17635ee6612d4034318446cca2cc18316ec56a1915eb69d47bab402c189788cbe2616a58abfd455efe91cc9c1885dc2857bff230f6db8f9d04c65ab99719d8f65d9354cb0c5d30d26ecef5c24bd3cea602926a65ff59ca9acafd8bac7ac90beee5e450d4fe36fd14c1f7f23b3dce6314d916c3ad39e62b3e5ab46262b8ebd3642e96407575f46bc54fdc792563a9c251019002ea137d91fc9c3a9a8aaf6a938ffd9cbd58a5feb3f97e6d237f14fd1874c764764092befa34ef2e6c86e995502f370d7ee29aac9d2330683d4d90dce2bfef91fcd62971dedd4143d7a361812a9131b4cf666472db7f5f64b622550fd5a75e665c0dff62fad950fc5efc3140327c12f5d9530abe32ce797e38f4ddace551c9db433a2d40feb4f3ff24c356acf9d27edad2bba25769097e3c302a385f37262d23d44880f165abde71c479d9bfc77964ee78757d0300988e4170568321850813e1c86a27f893aef224cfbafe6cf241031c26e34653be66b3b812665add2ba82f76dbae16566fcffdda6f8db7dcf0222ae1a87d8b561587f2f8854ad456a368b7737a23ef7a33e55ff8c013c211d831cb845e79194a5cd2ed4ba1b4c4197c397d1fb62ce68bd5a130de3d517725cdcbb8fdd926b6c0de93fbf679da1deabda14e4b07a240e1221a213d7d5a68e3cf3ae67dcbb92167fdeece553c9eba071f2f3c8241c82f624c1b1420fc215ea3d02f73cfeecdd02261d9805f9bb5fc437e8c8db207bd4744659e566118c820f9f7d599701320c4c536de8fa0b5cab2de3eb119c22c730135864681c3c43df72de9dd95318a5526163aea9b2e586fb35361f50dc41dbb2e56f2c84810efb7defc1e9d6b72c72997682cc53238f07287179d60076d353bcfb0273912f4e42afde3a80e099acf87ac5bb46d61c9778812940548e21c129f591af41a4e4cb21d64ad4d01fb0c3f8781204ca2b455ba0ce690b8dbc436ea5dd3e3e526cf79f71c7ed008621dcef4b562e39f9799221a7b1fda39a7e17caa130ce1ff38485d5931c6f14eec378fc07d97aba772f79a62e1032a34d0cae967df36b363992969dfec094d961cccf9dae7c6e35cca8937a0101e76189794e910808ccb565007ede6854b4d72b59a0c95a169e567960794afa8a502b8e76795473d91a3a378216744164cdc6f7066e92991e5dcb4e5aa37e61a4ccdd54844f23e8ab821f08ae6fa2b89b0e5d074eae617277a61256b468004cc63c34ee879afacf569951c1fc557fb471e80e91c3ad929d79239b9a676431e1d8a3409d631dde24f78120793df25435047d90e69365b918fa25ab2835cbfa2363ee9b660e2c476677f15ce3fc68410b978d9d2bcf7ea1a30b0924a98dfe2df52f9a97837d9f87d0a0bd1b39d7109afd2580ffd63898afa356a2268f131cda72e886959065fb2b2b0f8ca91066ab8ad24f3dc5c005529628029938551e5ca1da4058687143c8225c0729c848ca9c7881735ec41d1946e0fc6416a5f514781c7037008efc100a2aed5828c0088d385ee188c743d9f65324e68a48e9271ce5e06fe1e6b0cabf2a8b158f331f8c905a65844bd1cfc481832c00eac1afb70e982af27cd2e725e27f1a45f6cdfff7bcd5f4925c55b99e7588dcf71bba073acbf7b22ad255d3203df674c2a0d187f3a6a3a80164b74129f07bb330965b2fca3c23794f7a4a9cf1b2e5317c0e69522fb944b7681325c8721d2aaed0dcfacda0177b7f697d01639d9292c26e9e0d8cb5d8cc40cdd35a2b782d1a8802966c03f1466e991c2665d57e0809b2a53505f3db73ee3ea0cdcd56b55129f3934d0456d455c25c494b4abb721363f8636630eb954cadde69c740ee8a5e3313788a411331eafc342a8f26f93234d3e821ca840a3a7aea1b28df4bff42750c12046812afef7223566f243c1450888cc11851c0828bbdaad4a104cb588d8a5cd8f783b4ffb8200a6b777bbd5b3913128b34cd9026b025dcf08fa753fe40d6bbc930e45d375070f7c08ee287e43007d9fca60145e18951303916e8a95ce98ec08f83207c2fe29725054cce320bd57924645ec2b553ce39dedc145dc751db902467b91210b00697c9917da45814500d17fa057a3eccb9f5873fe1518b93273b35304b8229a7f42a0abe196123f78e860b4f8f83b6d541e3aaa39d99b74c78d3b112bcdae03e29976e11928f592354d198806b8499f8434c96dde3c6d8767af0b507037c8aea79936a92fe045ed45c29e603b435957aea5275f959ab7efd31cae4874ec3f1132d47456d03bf74ec554d903721811133168afd0595ace9fc19a31eb4d3b18a1590d86f8525096d3cac45acb8d0114c0dba54a89beec64fda748ff41eff4b73854b38424d378036400e5af1992", 0x1000}, {&(0x7f0000001700)="5c488cfe959463651da833cb086eefa6cfe7f31a01b0da9640c0409e61eb64008b04d0cb9512e8e068d5895254f10626c626654d158e744fd444aba7a5e7702187cdc8c5be", 0x45}, {&(0x7f0000001780)="689d8da0f05bf716988b1a7a2124724abd11da007e12d1a1d5e97c20c12d0b24de80a493bd5dab38101756cfa1de826a90f5e152d11162d1fe77e4ec624c857db408f80696d56523a0fcebc004ae53a66091db32395110940b335d43876482fd70176a1e8aa204996c158eb821fcf80fd053b8d99cc44c7cc870b75f62ad1062a3d7f31238435d7e598d8d74640d0686c0f7dab821b149d2f624ea6d94c75e7f78adf59253321348de8b688c32b05cf821f487815e97355ae0035436b2c837f88b51a7cf5f1440983c7f7df2f0d855a86da675445024761862aa943e2a4e", 0xde}, {&(0x7f0000001880)="e68ed0169c3b60828caa874351e79c719afe3c9e2ef4712923f66d488ace595c3f013eb5eabbe628964ad0b4e65b79dfe53d580104b910acac8face8abb941e3a91ad33386d4d0cb483ad1eca54dc87b70c6e97fe9b3e81bae0417147e53a024923c5ce4f31d633a7a10fbc6a8cdca", 0x6f}], 0x5, &(0x7f0000001b80)=[@cred={0x20, 0x1, 0x2, r5, r6, r7}], 0x20}, 0x4) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000000200)=ANY=[@ANYBLOB="0061a46bbd2d00"], 0x0, 0x0, 0x0}) ioctl$sock_FIOGETOWN(r3, 0x8903, &(0x7f0000000180)=0x0) ioctl$TIOCSPGRP(r2, 0x5410, &(0x7f00000001c0)=r8) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000540)={0x8, 0x0, &(0x7f00000000c0)=[@release={0x400c630e}], 0x0, 0x0, 0x0}) write$P9_RCREATE(r2, &(0x7f0000000040)={0x18, 0x73, 0x2, {{0x0, 0x3, 0x3}, 0x3f}}, 0x18) [ 958.298429][T11145] binder: 11142:11145 BC_REQUEST_DEATH_NOTIFICATION invalid ref 61952 [ 958.317611][T11145] binder: 11142:11145 unknown command -368808281 [ 958.367983][ C0] sd 0:0:1:0: [sg0] tag#2864 FAILED Result: hostbyte=DID_ABORT driverbyte=DRIVER_OK [ 958.368121][T11145] binder: 11142:11145 ioctl c0306201 20000000 returned -22 [ 958.377454][ C0] sd 0:0:1:0: [sg0] tag#2864 CDB: Service action in(16), sa=0x1d [ 958.377476][ C0] sd 0:0:1:0: [sg0] tag#2864 CDB[00]: 9e 9d 06 93 e3 f4 4b 2f a6 85 9e 08 0a 58 1d b5 [ 958.377496][ C0] sd 0:0:1:0: [sg0] tag#2864 CDB[10]: 79 36 ff 51 13 56 9a 1d 13 24 c8 74 11 71 68 fb [ 958.377520][ C0] sd 0:0:1:0: [sg0] tag#2864 CDB[20]: 8e ab 8e d2 16 19 69 c2 15 52 f7 1e 41 6f d5 eb [ 958.421271][ C0] sd 0:0:1:0: [sg0] tag#2864 CDB[30]: 2c 68 8a d6 63 af e8 91 60 80 78 82 8a ef 42 62 [ 958.422816][T11154] binder: 11153:11154 unknown command 1805934848 [ 958.430889][ C0] sd 0:0:1:0: [sg0] tag#2864 CDB[40]: 66 11 98 a7 cb 9a 57 cb 8b 2e eb c9 89 f8 44 ab [ 958.430909][ C0] sd 0:0:1:0: [sg0] tag#2864 CDB[50]: 08 48 88 06 7c 5b 30 96 01 c6 f6 a2 28 2e 00 25 [ 958.430927][ C0] sd 0:0:1:0: [sg0] tag#2864 CDB[60]: 86 6d eb 94 fc 1c 26 38 4f 4c 0f 12 5c dd 34 b2 03:41:15 executing program 4: syz_open_dev$admmidi(&(0x7f0000000000)='/dev/admmidi#\x00', 0x9222, 0x0) ioctl$FS_IOC_SET_ENCRYPTION_POLICY(0xffffffffffffffff, 0x800c6613, &(0x7f0000000080)={0x0, @speck128, 0x2, "d80a611d3ada197f"}) r0 = fcntl$getown(0xffffffffffffffff, 0x9) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5, 0x0, 0x100000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = syz_open_dev$sg(&(0x7f0000000040)='/dev/sg#\x00', 0x0, 0x2) getresuid(0x0, &(0x7f0000000540), &(0x7f00000005c0)) r2 = getegid() setsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000000600)={r0, 0x0, r2}, 0xc) r3 = getpid() rt_tgsigqueueinfo(r3, r3, 0x16, &(0x7f0000000100)) ioctl$EXT4_IOC_GROUP_ADD(0xffffffffffffffff, 0x40286608, 0x0) gettid() ptrace(0x4206, r3) connect$netlink(0xffffffffffffffff, &(0x7f0000000500)=@proc={0x10, 0x0, 0x25dfdbfd, 0x800000}, 0xc) ioctl$SG_IO(r1, 0x2285, &(0x7f0000000440)={0x53, 0xfffffffffffffffd, 0x7c, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f00000002c0)="9e9d0693e3f44b2fa6859e080a581db57936ff5113569a1d1324c874117168fb8eab8ed2161969c21552f71e416fd5eb2c688ad663afe891608078828aef4262661198a7cb9a57cb8b2eebc989f844ab084888067c5b309601c6f6a2282e0025866deb94fc1c26384f4c0f125cdd34b2d58fde854f41671224debc03", 0x0, 0x0, 0x1, 0x1, 0x0}) [ 958.430944][ C0] sd 0:0:1:0: [sg0] tag#2864 CDB[70]: d5 8f de 85 4f 41 67 12 24 de bc 03 [ 958.471256][T11157] binder: 11152:11157 ioctl c0306201 20008fd0 returned -14 [ 958.526401][T11161] binder: 11153:11161 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 958.544575][T24007] binder: undelivered death notification, 0000000000000000 [ 958.558210][T11154] binder: 11153:11154 ioctl c0306201 20000000 returned -22 03:41:15 executing program 1: r0 = socket$inet6(0xa, 0x5, 0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000180)='/dev/net/tun\x00', 0x0, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000100)={'lo\x00', 0x0}) ioctl$sock_SIOCGIFINDEX(r0, 0x8923, &(0x7f0000000380)={'bpq0\x00\v\x00\xfe\x00\x00\x00\x00\x00\xfa\xff\x00', r2}) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000000)={'bpq0\x00', 0x1212}) getpgid(0xffffffffffffffff) 03:41:15 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=ANY=[@ANYBLOB="059995fc410000000e630c40004e8800"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f00000000c0)=[@release={0x400c630f}], 0xfdfdffff00000000, 0x0, 0x0}) 03:41:15 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x4c, 0x0, &(0x7f0000000200)=ANY=[@ANYBLOB="05630440000000000e630c4000f200008c01acbcd9297cf4a76e04ea80b60b21d6efb41548e724db19f029cf6e830123c34234a0c43903464dd4e9c503844e734e52e396711327b0a8d8cf15"], 0x0, 0x0, 0x0}) 03:41:15 executing program 5: r0 = syz_open_dev$sndseq(&(0x7f0000000040)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a85320, &(0x7f0000068f50)={{0x80}, 'por\xff\a\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x1f\x00\x00\xff\xff\xff\xff\xff\xff\xff\xef\x00\x00\x03\xff\x00\x00\x00\x00L\x00\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x06\x00', 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2}) 03:41:15 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=ANY=[@ANYBLOB="05630440040093e7f0f10c4000000000"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f00000000c0)=[@release={0x400c630e}], 0x0, 0x0, 0x0}) [ 958.780618][T11174] binder: 11167:11174 unknown command -57304827 [ 958.806646][T11171] binder: 11170:11171 BC_REQUEST_DEATH_NOTIFICATION invalid ref 61952 [ 958.825330][T11174] binder: 11167:11174 ioctl c0306201 20000000 returned -22 [ 958.847869][T11171] binder: 11170:11171 unknown command -368808281 [ 958.859750][T11171] binder: 11170:11171 ioctl c0306201 20000000 returned -22 [ 958.872683][T11179] binder: 11167:11179 BC_CLEAR_DEATH_NOTIFICATION invalid ref 0 03:41:15 executing program 5: r0 = syz_open_dev$sndseq(&(0x7f0000000040)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a85320, &(0x7f0000068f50)={{0x80}, 'por\xff\a\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x1f\x00\x00\xff\xff\xff\xff\xff\xff\xff\xef\x00\x00\x03\xff\x00\x00\x00\x00h\x00\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x06\x00', 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2}) [ 958.885260][T11182] binder: 11177:11182 Acquire 1 refcount change on invalid ref -409796604 ret -22 [ 958.893703][T11179] binder: 11167:11179 ioctl c0306201 20008fd0 returned -14 [ 958.927306][T11182] binder: 11177:11182 unknown command 1074590192 [ 958.934115][T11176] : renamed from bpq0 [ 958.942817][T11182] binder: 11177:11182 ioctl c0306201 20000000 returned -22 03:41:16 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x4c, 0x0, &(0x7f0000000200)=ANY=[@ANYBLOB="05630440000000000e630c4000f200008c01acbcd9297cf4a76e04ea80b60b21d6efb41548e724db19f02acf6e830123c34234a0c43903464dd4e9c503844e734e52e396711327b0a8d8cf15"], 0x0, 0x0, 0x0}) 03:41:16 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = openat$audio(0xffffffffffffff9c, &(0x7f0000000040)='/dev/audio\x00', 0x20200, 0x0) ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f00000000c0)=[@release={0x400c630f}], 0xfdfdffff00000000, 0x0, 0x0}) 03:41:16 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) sched_setaffinity(0x0, 0x3, &(0x7f0000000680)=0x5) r1 = perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r2 = syz_open_procfs(0x0, &(0x7f0000dec000)='smaps\x00') ioctl$PERF_EVENT_IOC_PAUSE_OUTPUT(r1, 0x40042409, 0x1) write$RDMA_USER_CM_CMD_CREATE_ID(r2, &(0x7f00000001c0)={0x0, 0x18, 0xfa00, {0x3, &(0x7f0000000180), 0x13f}}, 0x20) madvise(&(0x7f000092d000/0x400000)=nil, 0x400000, 0x10200000008) mlock2(&(0x7f0000bbd000/0x1000)=nil, 0x1000, 0x0) sendfile(r2, r2, &(0x7f0000b58000)=0x200000, 0xffff) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) getsockopt$inet_sctp_SCTP_GET_PEER_ADDR_INFO(r2, 0x84, 0xf, 0x0, 0x0) ioctl$BINDER_SET_MAX_THREADS(r2, 0x40046205, 0x9) getsockopt$inet_sctp_SCTP_ENABLE_STREAM_RESET(r2, 0x84, 0x76, &(0x7f0000000600)={0x0, 0x7}, &(0x7f0000000640)=0x8) getsockopt$inet_sctp_SCTP_GET_PEER_ADDRS(r2, 0x84, 0x6c, &(0x7f0000000900)=ANY=[@ANYRES32=r3], 0x0) r4 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000100)='/dev/vcs\x00', 0x2000, 0x0) clone(0x2902001fff, 0x0, 0xfffffffffffffffe, &(0x7f0000000000), 0xffffffffffffffff) keyctl$assume_authority(0x10, 0x0) msgget(0xffffffffffffffff, 0x20c) mmap(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1000000, 0x910, r0, 0x0) prctl$PR_GET_SPECULATION_CTRL(0x34, 0x0, 0x2) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_PAUSE_OUTPUT(r4, 0x40042409, 0x1) ioctl$PERF_EVENT_IOC_ENABLE(r5, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f00000000c0)=[@release={0x400c630e}], 0x0, 0x0, 0x0}) 03:41:16 executing program 5: r0 = syz_open_dev$sndseq(&(0x7f0000000040)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a85320, &(0x7f0000068f50)={{0x80}, 'por\xff\a\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x1f\x00\x00\xff\xff\xff\xff\xff\xff\xff\xef\x00\x00\x03\xff\x00\x00\x00\x00l\x00\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x06\x00', 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2}) [ 959.179363][T11197] binder: 11189:11197 unknown command -368808281 [ 959.224992][T11197] binder: 11189:11197 ioctl c0306201 20000000 returned -22 [ 959.230339][T11200] binder: 11192:11200 ioctl c0306201 20008fd0 returned -14 03:41:16 executing program 5: r0 = syz_open_dev$sndseq(&(0x7f0000000040)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a85320, &(0x7f0000068f50)={{0x80}, 'por\xff\a\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x1f\x00\x00\xff\xff\xff\xff\xff\xff\xff\xef\x00\x00\x03\xff\x00\x00\x00\x00t\x00\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x06\x00', 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2}) [ 959.515348][ T7288] binder: undelivered death notification, 0000000000000000 [ 959.573543][T11195] binder: 11191:11195 BC_REQUEST_DEATH_NOTIFICATION death notification already set 03:41:19 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x4c, 0x0, &(0x7f0000000200)=ANY=[@ANYBLOB="05630440000000000e630c4000f200008c01acbcd9297cf4a76e04ea80b60b21d6efb41548e724db19f02bcf6e830123c34234a0c43903464dd4e9c503844e734e52e396711327b0a8d8cf15"], 0x0, 0x0, 0x0}) 03:41:19 executing program 3: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$EVIOCSABS0(r0, 0x401845c0, &(0x7f0000000040)={0x2, 0x6, 0x5, 0x78a, 0xffffffff, 0x1}) r1 = fcntl$dupfd(r0, 0x406, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x5) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f0000000180)=ANY=[@ANYBLOB="e791e82489ad1c18fa4334ad02fd959be3785c48696ad7ba3b735428940a25350e6dbda26b43cf55735a7e4efd2d95c6c7419ec01780cb382a895702d3bc17477d2a4741b690655eb293f6d52f5e62c549ec83e944b06851ecdb2b45d28484302f46db796f070434b98fd5789657c2a5bc767a099a281a46b9cd88d7ea23c7982535e38b9244a874468ee30771dfb1ba6d3eb9f254993b2f119b8510"], 0xfdfdffff00000000, 0x0, 0x0}) 03:41:19 executing program 5: r0 = syz_open_dev$sndseq(&(0x7f0000000040)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a85320, &(0x7f0000068f50)={{0x80}, 'por\xff\a\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x1f\x00\x00\xff\xff\xff\xff\xff\xff\xff\xef\x00\x00\x03\xff\x00\x00\x00\x00z\x00\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x06\x00', 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2}) 03:41:19 executing program 1: r0 = socket$inet6(0xa, 0x5, 0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000180)='/dev/net/tun\x00', 0x0, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000100)={'lo\x00', 0x0}) ioctl$sock_SIOCGIFINDEX(r0, 0x8923, &(0x7f0000000380)={'bpq0\x00\v\x00\xfe\x00\x00\x00\x00\x00\xfa\xff\x00', r2}) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000000)={'bpq0\x00', 0x1212}) getpgid(0xffffffffffffffff) 03:41:19 executing program 4: syz_open_dev$admmidi(&(0x7f0000000000)='/dev/admmidi#\x00', 0x9222, 0x0) ioctl$FS_IOC_SET_ENCRYPTION_POLICY(0xffffffffffffffff, 0x800c6613, &(0x7f0000000080)={0x0, @speck128, 0x2, "d80a611d3ada197f"}) r0 = fcntl$getown(0xffffffffffffffff, 0x9) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5, 0x0, 0x100000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = syz_open_dev$sg(&(0x7f0000000040)='/dev/sg#\x00', 0x0, 0x2) getresuid(0x0, &(0x7f0000000540), &(0x7f00000005c0)) r2 = getegid() setsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000000600)={r0, 0x0, r2}, 0xc) r3 = getpid() rt_tgsigqueueinfo(r3, r3, 0x16, &(0x7f0000000100)) ioctl$EXT4_IOC_GROUP_ADD(0xffffffffffffffff, 0x40286608, 0x0) gettid() ptrace(0x4206, r3) connect$netlink(0xffffffffffffffff, &(0x7f0000000500)=@proc={0x10, 0x0, 0x25dfdbfd, 0x800000}, 0xc) ioctl$SG_IO(r1, 0x2285, &(0x7f0000000440)={0x53, 0xfffffffffffffffd, 0x7c, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f00000002c0)="9e9d0693e3f44b2fa6859e080a581db57936ff5113569a1d1324c874117168fb8eab8ed2161969c21552f71e416fd5eb2c688ad663afe891608078828aef4262661198a7cb9a57cb8b2eebc989f844ab084888067c5b309601c6f6a2282e0025866deb94fc1c26384f4c0f125cdd34b2d58fde854f41671224debc03", 0x0, 0x0, 0x1, 0x1, 0x0}) 03:41:19 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x2) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = openat$vhci(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/vhci\x00', 0x80000) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r3 = openat$vfio(0xffffffffffffff9c, &(0x7f0000000180)='/dev/vfio/vfio\x00', 0x101140, 0x0) write$P9_RSYMLINK(r3, &(0x7f00000001c0)={0x14, 0x11, 0x1, {0x28, 0x1, 0x1}}, 0x14) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000000)={0x30e, 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB="0f1e57b373c90063fc0d00000000000000"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="0e630840000000007bbf97865fd49c13d0e3d586b69d05c21bdb8610790f80fb1aa689ce28e5cf3ae1440b2678f456505abbde73900e48672597f51464f2bdfec17953cba06ce5be827b8a6389c1c2fe20700e7561a6142801b57e5e37000000000000000000000000"], 0x0, 0x0, 0x0}) 03:41:19 executing program 5: r0 = syz_open_dev$sndseq(&(0x7f0000000040)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a85320, &(0x7f0000068f50)={{0x80}, 'por\xff\a\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x1f\x00\x00\xff\xff\xff\xff\xff\xff\xff\xef\x00\x00\x03\xff\x00\x00\x00\x00\xfd\x00\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x06\x00', 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2}) [ 962.425679][T11223] binder: 11219:11223 unknown command 1074291470 [ 962.457071][T11223] binder: 11219:11223 ioctl c0306201 20008fd0 returned -22 03:41:19 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = openat$proc_capi20(0xffffffffffffff9c, &(0x7f0000000040)='/proc/capi/capi20\x00', 0x200000, 0x0) getsockopt$inet6_IPV6_IPSEC_POLICY(r1, 0x29, 0x22, &(0x7f0000000300)={{{@in=@local, @in6=@remote, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in=@initdev}, 0x0, @in=@empty}}, &(0x7f0000000100)=0xe8) fstat(r1, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) fchownat(r1, &(0x7f0000000080)='./file0\x00', r2, r3, 0xd00) ioctl$DRM_IOCTL_GET_STATS(r1, 0x80f86406, &(0x7f0000000240)=""/136) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) bpf$BPF_GET_MAP_INFO(0xf, &(0x7f00000004c0)={r1, 0x28, &(0x7f0000000480)}, 0x10) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0xbc, 0x0, &(0x7f0000000180)=ANY=[@ANYBLOB="630c4000000000005f0ef600000000004f09ac66b188d2f510006e9154afd26f354bd37fec5a1aceb4b417d75fa6fb25300e661af6db5ad29051d03e472a1e1649a983af9e26962b6151e03023503de4293b7d3a3b5462ce0ce5c0d18ac9e655c4cb521a3d6bc075f1d717d9535a4665a8b518e58d4cc5c4f3b5fa56ab70c88510ed1d47d6ef9d31bcd576d10df07ed10f8f860230a21aa1a709299784000901492f3f4ebd66534c3ac7ad682da02bde61e95eef81bc9f5acdd4a973"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f00000000c0)=[@release={0x400c630f}], 0xfdfdffff00000000, 0x0, 0x0}) [ 962.503692][T11232] binder_thread_write: 2 callbacks suppressed [ 962.503706][T11232] binder: 11222:11232 BC_REQUEST_DEATH_NOTIFICATION invalid ref 61952 03:41:19 executing program 2: r0 = syz_open_dev$amidi(&(0x7f0000000080)='/dev/amidi#\x00', 0x9, 0x80002) getsockopt$inet6_udp_int(r0, 0x11, 0x1, &(0x7f0000000100), &(0x7f0000000180)=0x4) r1 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$FIGETBSZ(r1, 0x2, &(0x7f0000000040)) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f00000000c0)=[@release={0x400c630e}], 0x0, 0x0, 0x0}) [ 962.560208][T11232] binder: 11222:11232 unknown command -368808281 [ 962.591431][T11232] binder: 11222:11232 ioctl c0306201 20000000 returned -22 03:41:19 executing program 5: r0 = syz_open_dev$sndseq(&(0x7f0000000040)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a85320, &(0x7f0000068f50)={{0x80}, 'por\xff\a\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x1f\x00\x00\xff\xff\xff\xff\xff\xff\xff\xef\x00\x00\x03\xff\x00\x00\x02\x00\x00\x00\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x06\x00', 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2}) [ 962.760633][T11244] binder: 11238:11244 BC_REQUEST_DEATH_NOTIFICATION death notification already set [ 962.771470][T11246] binder: 11237:11246 unknown command 4197475 [ 962.785415][T11246] binder: 11237:11246 ioctl c0306201 20000000 returned -22 03:41:19 executing program 5: r0 = syz_open_dev$sndseq(&(0x7f0000000040)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a85320, &(0x7f0000068f50)={{0x80}, 'por\xff\a\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x1f\x00\x00\xff\xff\xff\xff\xff\xff\xff\xef\x00\x00\x03\xff\x00\x00\x03\x00\x00\x00\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x06\x00', 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2}) [ 962.807028][T11246] binder: 11237:11246 BC_CLEAR_DEATH_NOTIFICATION invalid ref 0 [ 962.835349][T11246] binder: 11237:11246 ioctl c0306201 20008fd0 returned -14 03:41:20 executing program 5: r0 = syz_open_dev$sndseq(&(0x7f0000000040)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a85320, &(0x7f0000068f50)={{0x80}, 'por\xff\a\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x1f\x00\x00\xff\xff\xff\xff\xff\xff\xff\xef\x00\x00\x03\xff\x00\x00\x04\x00\x00\x00\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x06\x00', 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2}) [ 963.258960][T11225] binder: 11222:11225 BC_REQUEST_DEATH_NOTIFICATION invalid ref 61952 [ 963.264585][T11230] : renamed from bpq0 [ 963.281468][T11225] binder: 11222:11225 unknown command -368808281 [ 963.285344][T11241] IPVS: ftp: loaded support on port[0] = 21 [ 963.302840][T11225] binder: 11222:11225 ioctl c0306201 20000000 returned -22 [ 963.985966][T11241] chnl_net:caif_netlink_parms(): no params data found [ 964.194309][T11241] bridge0: port 1(bridge_slave_0) entered blocking state [ 964.201655][T11241] bridge0: port 1(bridge_slave_0) entered disabled state [ 964.211033][T11241] device bridge_slave_0 entered promiscuous mode [ 964.377974][T11241] bridge0: port 2(bridge_slave_1) entered blocking state [ 964.386294][T11241] bridge0: port 2(bridge_slave_1) entered disabled state [ 964.394077][T11241] device bridge_slave_1 entered promiscuous mode [ 964.417185][T11241] bond0: Enslaving bond_slave_0 as an active interface with an up link [ 964.585800][T11241] bond0: Enslaving bond_slave_1 as an active interface with an up link [ 964.603365][T11241] IPv6: ADDRCONF(NETDEV_UP): team_slave_0: link is not ready [ 964.611719][T11241] team0: Port device team_slave_0 added [ 964.618271][T11241] IPv6: ADDRCONF(NETDEV_UP): team_slave_1: link is not ready [ 964.626561][T11241] team0: Port device team_slave_1 added [ 964.632697][T11241] IPv6: ADDRCONF(NETDEV_UP): bridge_slave_0: link is not ready [ 964.794894][T11241] IPv6: ADDRCONF(NETDEV_UP): bridge_slave_1: link is not ready [ 964.868408][T11241] device hsr_slave_0 entered promiscuous mode [ 964.905253][T11241] device hsr_slave_1 entered promiscuous mode [ 964.975496][T11241] IPv6: ADDRCONF(NETDEV_UP): hsr_slave_0: link is not ready [ 965.143101][T11241] IPv6: ADDRCONF(NETDEV_UP): hsr_slave_1: link is not ready [ 965.161190][T11241] IPv6: ADDRCONF(NETDEV_UP): bridge0: link is not ready [ 965.168700][ T39] device bridge_slave_1 left promiscuous mode [ 965.175921][ T39] bridge0: port 2(bridge_slave_1) entered disabled state [ 965.236129][ T39] device bridge_slave_0 left promiscuous mode [ 965.242369][ T39] bridge0: port 1(bridge_slave_0) entered disabled state [ 969.648339][ T39] device hsr_slave_1 left promiscuous mode [ 969.678565][ T39] device hsr_slave_0 left promiscuous mode [ 969.731719][ T39] team0 (unregistering): Port device team_slave_1 removed [ 969.744346][ T39] team0 (unregistering): Port device team_slave_0 removed [ 969.758165][ T39] bond0 (unregistering): Releasing backup interface bond_slave_1 [ 969.799933][ T39] bond0 (unregistering): Releasing backup interface bond_slave_0 [ 969.903878][ T39] bond0 (unregistering): Released all slaves [ 970.038937][T11241] 8021q: adding VLAN 0 to HW filter on device bond0 [ 970.051693][T11241] IPv6: ADDRCONF(NETDEV_UP): veth0: link is not ready [ 970.060882][T11241] IPv6: ADDRCONF(NETDEV_UP): veth1: link is not ready [ 970.068865][ T8161] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 970.077020][ T8161] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 970.088145][T11241] IPv6: ADDRCONF(NETDEV_UP): team0: link is not ready [ 970.095050][T11241] 8021q: adding VLAN 0 to HW filter on device team0 [ 970.104691][T11241] IPv6: ADDRCONF(NETDEV_UP): veth0_to_bridge: link is not ready [ 970.112986][ T8161] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 970.122285][ T8161] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 970.131188][ T8161] bridge0: port 1(bridge_slave_0) entered blocking state [ 970.138324][ T8161] bridge0: port 1(bridge_slave_0) entered forwarding state [ 970.149622][T11241] IPv6: ADDRCONF(NETDEV_UP): veth1_to_bridge: link is not ready [ 970.158336][T24007] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 970.166479][T24007] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 970.175331][T24007] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 970.183652][T24007] bridge0: port 2(bridge_slave_1) entered blocking state [ 970.190755][T24007] bridge0: port 2(bridge_slave_1) entered forwarding state [ 970.209094][T11241] IPv6: ADDRCONF(NETDEV_UP): veth0_to_bond: link is not ready [ 970.220037][T24007] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready [ 970.232842][T11241] IPv6: ADDRCONF(NETDEV_UP): veth1_to_bond: link is not ready [ 970.240677][ T8164] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready [ 970.297684][T11241] IPv6: ADDRCONF(NETDEV_UP): veth0_to_team: link is not ready [ 970.305448][ T7288] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready [ 970.314041][ T7288] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 970.324127][ T7288] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready [ 970.333629][T11241] IPv6: ADDRCONF(NETDEV_UP): veth1_to_team: link is not ready [ 970.341419][T24007] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready [ 970.350574][T24007] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 970.361123][T11241] IPv6: ADDRCONF(NETDEV_UP): veth0_to_hsr: link is not ready [ 970.369579][ T8164] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 970.395651][ T8164] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 970.406775][T11241] IPv6: ADDRCONF(NETDEV_UP): veth1_to_hsr: link is not ready [ 970.423219][T24007] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 970.434502][T24007] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 970.452160][T11241] IPv6: ADDRCONF(NETDEV_UP): hsr0: link is not ready [ 970.460466][T11241] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready [ 970.492645][T11241] IPv6: ADDRCONF(NETDEV_UP): vxcan1: link is not ready [ 970.520602][T11241] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 970.683039][ C0] sd 0:0:1:0: [sg0] tag#2839 FAILED Result: hostbyte=DID_ABORT driverbyte=DRIVER_OK [ 970.692558][ C0] sd 0:0:1:0: [sg0] tag#2839 CDB: Service action in(16), sa=0x1d [ 970.700362][ C0] sd 0:0:1:0: [sg0] tag#2839 CDB[00]: 9e 9d 06 93 e3 f4 4b 2f a6 85 9e 08 0a 58 1d b5 [ 970.709969][ C0] sd 0:0:1:0: [sg0] tag#2839 CDB[10]: 79 36 ff 51 13 56 9a 1d 13 24 c8 74 11 71 68 fb [ 970.719613][ C0] sd 0:0:1:0: [sg0] tag#2839 CDB[20]: 8e ab 8e d2 16 19 69 c2 15 52 f7 1e 41 6f d5 eb 03:41:27 executing program 4: openat$rfkill(0xffffffffffffff9c, &(0x7f0000000340)='/dev/rfkill\x00', 0x0, 0x0) r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$sock_int(r0, 0x1, 0x3c, &(0x7f0000d4effc)=0x1, 0x4) sendto$inet(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0) poll(&(0x7f00000003c0)=[{r0}], 0x1, 0x7ff) 03:41:27 executing program 5: r0 = syz_open_dev$sndseq(&(0x7f0000000040)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a85320, &(0x7f0000068f50)={{0x80}, 'por\xff\a\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x1f\x00\x00\xff\xff\xff\xff\xff\xff\xff\xef\x00\x00\x03\xff\x00\x00\x05\x00\x00\x00\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x06\x00', 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2}) 03:41:27 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = dup(r0) ioctl$PIO_FONT(r1, 0x4b61, &(0x7f0000000100)="687b4d88b81b838a9209e5f1eade8890551603074aee21cbbdf586104c5ee333fe9d98444fc96ce0967ce9b14f2387ea2eb02ab83b1512c9bd77343a430f3f28a2a4fafa118579c17b055769479dd3baa6e8c22aa412649182b1ec4e32b2d8a860") socketpair$unix(0x1, 0x4ba31465881e4b62, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f00000000c0)=ANY=[@ANYBLOB="050000780f000000"], 0x0, 0x0, 0x0}) prctl$PR_GET_TIMERSLACK(0x1e) 03:41:27 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000300)='/dev/binder#\x00', 0x0, 0x1fffffffff) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=ANY=[@ANYBLOB="0563044000008c000e630c4000000000"], 0x0, 0x0, 0x0}) r2 = open(&(0x7f0000000040)='./file0\x00', 0x100, 0x20) socketpair$unix(0x1, 0x40000000005, 0x0, &(0x7f0000000280)={0xffffffffffffffff, 0xffffffffffffffff}) pipe(&(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) r6 = socket$inet_tcp(0x2, 0x1, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) write(r5, &(0x7f0000000340), 0x10000014c) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) tee(r6, r5, 0x0, 0x0) clock_gettime(0x0, &(0x7f0000000240)={0x0, 0x0}) pselect6(0x40, &(0x7f00000000c0), 0x0, &(0x7f0000000140)={0x1b7}, &(0x7f0000000200)={0x0, r7+30000000}, 0x0) vmsplice(r4, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) setsockopt$sock_int(r3, 0x1, 0x2e, &(0x7f00000003c0)=0x5, 0x4) r8 = syz_genetlink_get_family_id$tipc2(&(0x7f0000000100)='TIPCv2\x00') ioctl$VIDIOC_SUBDEV_G_CROP(r2, 0xc038563b, &(0x7f0000000340)={0x1, 0x0, {0x7f, 0x1000, 0x20000000004, 0xfffffffffffffff8}}) sendmsg$TIPC_NL_MON_PEER_GET(r2, &(0x7f0000000280)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x400000}, 0xc, &(0x7f0000000240)={&(0x7f0000000180)={0xb4, r8, 0x2, 0x70bd2d, 0x25dfdbfc, {}, [@TIPC_NLA_NET={0x64, 0x7, [@TIPC_NLA_NET_ID={0x8, 0x1, 0xffff}, @TIPC_NLA_NET_NODEID_W1={0xc, 0x4, 0x5}, @TIPC_NLA_NET_NODEID_W1={0xc, 0x4, 0xffff}, @TIPC_NLA_NET_NODEID_W1={0xc, 0x4, 0x1}, @TIPC_NLA_NET_NODEID={0xc, 0x3, 0x1}, @TIPC_NLA_NET_ADDR={0x8, 0x2, 0x7}, @TIPC_NLA_NET_NODEID_W1={0xc, 0x4, 0x3c}, @TIPC_NLA_NET_ID={0x8, 0x1, 0x9}, @TIPC_NLA_NET_NODEID_W1={0xc, 0x4, 0x5}]}, @TIPC_NLA_MON={0x3c, 0x9, [@TIPC_NLA_MON_ACTIVATION_THRESHOLD={0x8, 0x1, 0xffffffff}, @TIPC_NLA_MON_ACTIVATION_THRESHOLD={0x8, 0x1, 0x4}, @TIPC_NLA_MON_REF={0x8, 0x2, 0x5}, @TIPC_NLA_MON_ACTIVATION_THRESHOLD={0x8, 0x1, 0x10000}, @TIPC_NLA_MON_REF={0x8, 0x2, 0x1f}, @TIPC_NLA_MON_REF={0x8, 0x2, 0x1ff}, @TIPC_NLA_MON_ACTIVATION_THRESHOLD={0x8, 0x1, 0xffff}]}]}, 0xb4}, 0x1, 0x0, 0x0, 0x10}, 0x20008010) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f00000000c0)=[@release={0x400c630f}], 0xfdfdffff00000000, 0x0, 0x0}) 03:41:27 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x4c, 0x0, &(0x7f0000000200)=ANY=[@ANYBLOB="05630440000000000e630c4000f200008c01acbcd9297cf4a76e04ea80b60b21d6efb41548e724db19f02ccf6e830123c34234a0c43903464dd4e9c503844e734e52e396711327b0a8d8cf15"], 0x0, 0x0, 0x0}) 03:41:27 executing program 1: r0 = socket$inet6(0xa, 0x5, 0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000180)='/dev/net/tun\x00', 0x0, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000100)={'lo\x00', 0x0}) ioctl$sock_SIOCGIFINDEX(r0, 0x8923, &(0x7f0000000380)={'bpq0\x00\v\x00\xfe\x00\x00\x00\x00\x00\xfa\xff\x00', r2}) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000000)={'bpq0\x00', 0x1212}) getpgid(0xffffffffffffffff) [ 970.729234][ C0] sd 0:0:1:0: [sg0] tag#2839 CDB[30]: 2c 68 8a d6 63 af e8 91 60 80 78 82 8a ef 42 62 [ 970.738837][ C0] sd 0:0:1:0: [sg0] tag#2839 CDB[40]: 66 11 98 a7 cb 9a 57 cb 8b 2e eb c9 89 f8 44 ab [ 970.748435][ C0] sd 0:0:1:0: [sg0] tag#2839 CDB[50]: 08 48 88 06 7c 5b 30 96 01 c6 f6 a2 28 2e 00 25 [ 970.758051][ C0] sd 0:0:1:0: [sg0] tag#2839 CDB[60]: 86 6d eb 94 fc 1c 26 38 4f 4c 0f 12 5c dd 34 b2 [ 970.767655][ C0] sd 0:0:1:0: [sg0] tag#2839 CDB[70]: d5 8f de 85 4f 41 67 12 24 de bc 03 [ 970.849550][T11278] binder: 11272:11278 BC_REQUEST_DEATH_NOTIFICATION invalid ref 61952 [ 970.852664][T11281] binder: 11273:11281 ioctl 4b61 20000100 returned -22 [ 970.876367][T11278] binder: 11272:11278 unknown command -368808281 [ 970.902164][T11287] binder: 11273:11287 unknown command 2013265925 [ 970.912183][T11278] binder: 11272:11278 ioctl c0306201 20000000 returned -22 [ 970.929249][T11287] binder: 11273:11287 ioctl c0306201 20008fd0 returned -22 03:41:28 executing program 5: r0 = syz_open_dev$sndseq(&(0x7f0000000040)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a85320, &(0x7f0000068f50)={{0x80}, 'por\xff\a\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x1f\x00\x00\xff\xff\xff\xff\xff\xff\xff\xef\x00\x00\x03\xff\x00\x00\x06\x00\x00\x00\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x06\x00', 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2}) [ 970.949218][T11275] : renamed from bpq0 03:41:28 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x4c, 0x0, &(0x7f0000000200)=ANY=[@ANYBLOB="05630440000000000e630c4000f200008c01acbcd9297cf4a76e04ea80b60b21d6efb41548e724db19f02dcf6e830123c34234a0c43903464dd4e9c503844e734e52e396711327b0a8d8cf15"], 0x0, 0x0, 0x0}) 03:41:28 executing program 4: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) renameat2(0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0, 0x7) [ 971.021211][T11281] binder: 11273:11281 ioctl 4b61 20000100 returned -22 [ 971.081466][T11299] binder: 11273:11299 unknown command 2013265925 [ 971.105487][T11299] binder: 11273:11299 ioctl c0306201 20008fd0 returned -22 03:41:28 executing program 5: r0 = syz_open_dev$sndseq(&(0x7f0000000040)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a85320, &(0x7f0000068f50)={{0x80}, 'por\xff\a\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x1f\x00\x00\xff\xff\xff\xff\xff\xff\xff\xef\x00\x00\x03\xff\x00\x00\a\x00\x00\x00\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x06\x00', 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2}) 03:41:28 executing program 1: r0 = socket$inet6(0xa, 0x5, 0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000180)='/dev/net/tun\x00', 0x0, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000100)={'lo\x00', 0x0}) ioctl$sock_SIOCGIFINDEX(r0, 0x8923, &(0x7f0000000380)={'bpq0\x00\v\x00\xfe\x00\x00\x00\x00\x00\xfa\xff\x00', r2}) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000000)={'bpq0\x00', 0x1212}) getpgid(0xffffffffffffffff) [ 971.201702][T11302] binder: 11301:11302 BC_REQUEST_DEATH_NOTIFICATION invalid ref 61952 03:41:28 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = openat$audio(0xffffffffffffff9c, &(0x7f0000000180)='/dev/audio\x00', 0x1, 0x0) ioctl$SG_GET_VERSION_NUM(r2, 0x2282, &(0x7f00000001c0)) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$SIOCRSSCAUSE(r2, 0x89e1, &(0x7f0000000200)=0x1) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f00000000c0)=ANY=[@ANYBLOB='p\f\x00\x00\x00\x00\x00\x00'], 0x0, 0x0, 0x0}) getsockname$ax25(r0, &(0x7f0000000040)={{0x3, @null}, [@remote, @rose, @bcast, @null, @remote, @netrom, @null, @bcast]}, &(0x7f0000000100)=0x48) 03:41:28 executing program 4: mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x0) r0 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000100)='/dev/fuse\x00', 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000300)='fuse\x00', 0x0, &(0x7f0000000400)={{'fd', 0x3d, r0}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {'user_id'}, 0x2c, {'group_id'}}) r1 = epoll_create1(0x0) epoll_ctl$EPOLL_CTL_ADD(r1, 0x1, r0, &(0x7f0000000180)) umount2(&(0x7f0000000040)='./file0\x00', 0x0) [ 971.284358][T11302] binder: 11301:11302 unknown command -368808281 [ 971.305983][T11302] binder: 11301:11302 ioctl c0306201 20000000 returned -22 03:41:28 executing program 5: r0 = syz_open_dev$sndseq(&(0x7f0000000040)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a85320, &(0x7f0000068f50)={{0x80}, 'por\xff\a\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x1f\x00\x00\xff\xff\xff\xff\xff\xff\xff\xef\x00\x00\x03\xff\x00\x00\n\x00\x00\x00\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x06\x00', 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2}) [ 971.406218][T11309] : renamed from bpq0 03:41:28 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x4c, 0x0, &(0x7f0000000200)=ANY=[@ANYBLOB="05630440000000000e630c4000f200008c01acbcd9297cf4a76e04ea80b60b21d6efb41548e724db19f02ecf6e830123c34234a0c43903464dd4e9c503844e734e52e396711327b0a8d8cf15"], 0x0, 0x0, 0x0}) [ 971.484335][T11318] binder: 11317:11318 unknown command 3184 [ 971.509971][T11318] binder: 11317:11318 ioctl c0306201 20008fd0 returned -22 [ 971.528644][T11321] ------------[ cut here ]------------ [ 971.534647][T11321] IRQs not disabled as expected [ 971.539939][T11321] WARNING: CPU: 0 PID: 11321 at fs/eventpoll.c:1224 ep_poll_callback+0x77e/0x1450 [ 971.549156][T11321] Kernel panic - not syncing: panic_on_warn set ... [ 971.555766][T11321] CPU: 0 PID: 11321 Comm: syz-executor4 Not tainted 5.0.0-rc1-next-20190109 #8 [ 971.564706][T11321] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 971.574767][T11321] Call Trace: [ 971.578078][T11321] dump_stack+0x1db/0x2d0 [ 971.582423][T11321] ? dump_stack_print_info.cold+0x20/0x20 [ 971.588168][T11321] ? ep_poll_callback+0x6c0/0x1450 [ 971.593626][T11321] panic+0x2cb/0x65c [ 971.597530][T11321] ? add_taint.cold+0x16/0x16 [ 971.602226][T11321] ? ep_poll_callback+0x77e/0x1450 [ 971.607343][T11321] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 971.613665][T11321] ? __probe_kernel_read+0x1f4/0x250 [ 971.618965][T11321] ? __warn.cold+0x5/0x48 [ 971.623343][T11321] ? ep_poll_callback+0x77e/0x1450 [ 971.628768][T11321] __warn.cold+0x20/0x48 [ 971.633040][T11321] ? ep_poll_callback+0x77e/0x1450 [ 971.638169][T11321] report_bug+0x263/0x2b0 [ 971.642597][T11321] do_error_trap+0x11b/0x200 [ 971.646350][ T3867] kobject: 'loop5' (00000000b04fa882): kobject_uevent_env [ 971.647207][T11321] do_invalid_op+0x37/0x50 [ 971.647237][T11321] ? ep_poll_callback+0x77e/0x1450 [ 971.647257][T11321] invalid_op+0x14/0x20 [ 971.647278][T11321] RIP: 0010:ep_poll_callback+0x77e/0x1450 [ 971.654535][ T3867] kobject: 'loop5' (00000000b04fa882): fill_kobj_path: path = '/devices/virtual/block/loop5' [ 971.658787][T11321] Code: ff 44 89 ee e8 e3 81 98 ff 45 84 ed 0f 85 4a fa ff ff e8 95 80 98 ff 48 c7 c7 00 6d 56 88 c6 05 30 ad 6e 08 01 e8 02 bb 61 ff <0f> 0b e9 2b fa ff ff e8 76 80 98 ff 48 8d 7b 30 48 b8 00 00 00 00 [ 971.658796][T11321] RSP: 0018:ffff88808807f6a0 EFLAGS: 00010282 [ 971.658809][T11321] RAX: 0000000000000000 RBX: ffff88808c5d7b40 RCX: ffffc90011436000 [ 971.658817][T11321] RDX: 000000000000fb31 RSI: ffffffff816878e6 RDI: 0000000000000005 [ 971.658827][T11321] RBP: ffff88808807f880 R08: ffff888019cd8480 R09: ffff888019cd8d70 03:41:28 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) socketpair(0x4, 0x2, 0x401, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) r3 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000180)='IPVS\x00') sendmsg$IPVS_CMD_SET_DEST(r2, &(0x7f0000000240)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x401800}, 0xc, &(0x7f0000000200)={&(0x7f00000001c0)={0x1c, r3, 0x2, 0x70bd27, 0x25dfdbff, {}, [@IPVS_CMD_ATTR_TIMEOUT_UDP={0x8, 0x6, 0x9}]}, 0x1c}, 0x1, 0x0, 0x0, 0x4054}, 0x4000000) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) r4 = creat(&(0x7f0000000040)='./file0\x00', 0x10) ioctl$UI_SET_RELBIT(r4, 0x40045566, 0xd) ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f0000008fd0)={0xfffffffffffffce8, 0x0, &(0x7f00000000c0)=[@release={0x400c630f}], 0xfdfdffff000003ce, 0x0, 0x0}) 03:41:28 executing program 5: r0 = syz_open_dev$sndseq(&(0x7f0000000040)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a85320, &(0x7f0000068f50)={{0x80}, 'por\xff\a\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x1f\x00\x00\xff\xff\xff\xff\xff\xff\xff\xef\x00\x00\x03\xff\x00\x00H\x00\x00\x00\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x06\x00', 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2}) 03:41:28 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f00000000c0)=[@release={0x400c630e}], 0x0, 0x0, 0x0}) pselect6(0x40, &(0x7f0000000040)={0x5, 0xffffffffffffffff, 0x7, 0x6, 0x6, 0x80000000000000, 0x0, 0x7ff}, &(0x7f0000000080)={0x0, 0x7, 0x3, 0x9, 0xc406, 0x9, 0xd2, 0x3}, &(0x7f0000000100)={0x2, 0x8, 0x7fffffff, 0x2, 0x9, 0x2, 0x5, 0x8}, &(0x7f0000000180)={0x77359400}, &(0x7f0000000200)={&(0x7f00000001c0)={0xff}, 0x8}) [ 971.658836][T11321] R10: ffff888019cd8480 R11: 0000000000000000 R12: ffff88808807f858 [ 971.658845][T11321] R13: 0000000000000000 R14: ffff88808c5d7b90 R15: 0000000000000000 [ 971.658949][T11321] ? vprintk_func+0x86/0x189 [ 971.658980][T11321] ? ep_send_events_proc+0xfa0/0xfa0 [ 971.726773][ T3867] kobject: 'loop2' (000000006a2a808e): kobject_uevent_env [ 971.733673][T11321] ? debug_smp_processor_id+0x1c/0x20 [ 971.733691][T11321] ? perf_trace_lock+0x12f/0x750 [ 971.733713][T11321] ? add_lock_to_list.isra.0+0x450/0x450 [ 971.733729][T11321] ? add_lock_to_list.isra.0+0x450/0x450 [ 971.733824][T11321] ? unwind_get_return_address+0x61/0xa0 [ 971.733853][T11321] ? __save_stack_trace+0x8a/0xf0 [ 971.798992][T11321] ? __lock_is_held+0xb6/0x140 [ 971.803797][T11321] __wake_up_common+0x1d3/0x7d0 [ 971.808707][T11321] ? do_wait_intr+0x3c0/0x3c0 [ 971.813422][T11321] ? rwlock_bug.part.0+0x90/0x90 [ 971.818373][T11321] ? print_usage_bug+0xd0/0xd0 [ 971.823159][T11321] ? do_raw_spin_unlock+0xa0/0x330 [ 971.827224][ T3867] kobject: 'loop2' (000000006a2a808e): fill_kobj_path: path = '/devices/virtual/block/loop2' [ 971.828306][T11321] __wake_up_locked+0x11/0x20 [ 971.828400][T11321] fuse_abort_conn+0xd01/0x1200 [ 971.828429][T11321] ? end_requests+0x420/0x420 [ 971.845130][T11328] binder: 11326:11328 BC_REQUEST_DEATH_NOTIFICATION invalid ref 61952 [ 971.848094][T11321] ? trace_hardirqs_on+0xbd/0x310 [ 971.848185][T11321] ? unregister_shrinker+0x26e/0x460 [ 971.848221][T11321] ? __kasan_slab_free+0x119/0x150 [ 971.857186][T11328] binder: 11326:11328 unknown command -368808281 [ 971.861070][T11321] ? unregister_shrinker+0x26e/0x460 [ 971.861093][T11321] ? unregister_shrinker+0x296/0x460 [ 971.861113][T11321] ? prepare_kswapd_sleep+0x220/0x220 [ 971.861146][T11321] fuse_sb_destroy+0xd3/0x1d0 [ 971.861190][T11321] fuse_kill_sb_anon+0x16/0x30 [ 971.905580][T11328] binder: 11326:11328 ioctl c0306201 20000000 returned -22 [ 971.908277][T11321] deactivate_locked_super+0x9a/0x100 [ 971.908296][T11321] deactivate_super+0x2ab/0x320 [ 971.908314][T11321] ? mount_ns+0x1d0/0x1d0 [ 971.908349][T11321] ? cpumask_next+0x41/0x50 03:41:29 executing program 5: r0 = syz_open_dev$sndseq(&(0x7f0000000040)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a85320, &(0x7f0000068f50)={{0x80}, 'por\xff\a\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x1f\x00\x00\xff\xff\xff\xff\xff\xff\xff\xef\x00\x00\x03\xff\x00\x00L\x00\x00\x00\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x06\x00', 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2}) [ 971.908367][T11321] ? __sanitizer_cov_trace_cmp4+0x16/0x20 [ 971.908399][T11321] ? mnt_get_writers.isra.0+0xf9/0x150 [ 971.908421][T11321] cleanup_mnt+0xbf/0x160 [ 971.945435][ T3867] kobject: 'loop3' (0000000065708567): kobject_uevent_env [ 971.945734][T11321] __cleanup_mnt+0x16/0x20 [ 971.961550][T11321] task_work_run+0x1f4/0x2b0 [ 971.966158][T11321] ? task_work_cancel+0x2c0/0x2c0 [ 971.971270][T11321] ? nsecs_to_jiffies+0x30/0x30 [ 971.971736][ T3867] kobject: 'loop3' (0000000065708567): fill_kobj_path: path = '/devices/virtual/block/loop3' [ 971.976137][T11321] ? do_syscall_64+0x8c/0x800 [ 971.976161][T11321] exit_to_usermode_loop+0x32a/0x3b0 [ 971.976185][T11321] ? entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 971.976203][T11321] ? syscall_trace_enter+0x12a0/0x12a0 [ 971.976221][T11321] ? trace_hardirqs_on_thunk+0x1a/0x1c [ 971.976247][T11321] do_syscall_64+0x696/0x800 [ 971.976265][T11321] ? syscall_return_slowpath+0x5f0/0x5f0 [ 971.976284][T11321] ? prepare_exit_to_usermode+0x232/0x3b0 [ 971.976305][T11321] ? trace_hardirqs_off_thunk+0x1a/0x1c [ 971.976330][T11321] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 971.976342][T11321] RIP: 0033:0x457ec9 [ 971.976358][T11321] Code: 6d b7 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 3b b7 fb ff c3 66 2e 0f 1f 84 00 00 00 00 [ 971.976366][T11321] RSP: 002b:00007f8203ca8c78 EFLAGS: 00000246 ORIG_RAX: 00000000000000a6 [ 971.976380][T11321] RAX: 0000000000000000 RBX: 0000000000000002 RCX: 0000000000457ec9 [ 971.976411][T11321] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000020000040 [ 972.088585][T11321] RBP: 000000000073bf00 R08: 0000000000000000 R09: 0000000000000000 [ 972.096566][T11321] R10: 0000000000000000 R11: 0000000000000246 R12: 00007f8203ca96d4 [ 972.104549][T11321] R13: 00000000004c6ab2 R14: 00000000004dbdb8 R15: 00000000ffffffff [ 972.113789][T11321] Kernel Offset: disabled [ 972.118292][T11321] Rebooting in 86400 seconds..