lease 1 refcount change on invalid ref 2 ret -22 18:06:55 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000006c0)={0x118, 0x0, &(0x7f0000000540)=[@release={0x40046306, 0x2}, @acquire_done, @acquire_done={0x40106309, 0x3}, @transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x50, 0x18, &(0x7f0000000080)={@flat=@binder={0x73622a85, 0xa, 0x1}, @fda={0x66646185, 0xa, 0x1, 0x9}, @fd={0x66642a85, 0x0, r1}}, &(0x7f0000000100)={0x0, 0x18, 0x38}}, 0x1000}, @transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000180)={@ptr={0x70742a85, 0x0, &(0x7f0000000140)=""/51, 0x33, 0x2, 0x25}, @flat=@weak_handle={0x77682a85, 0x1}, @flat=@binder={0x73622a85, 0xa, 0x3}}, &(0x7f0000000280)={0x0, 0x28, 0x40}}, 0x1f8aed83e3349436}, @exit_looper, @transaction_sg={0x40486311, {0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x68, 0x18, &(0x7f0000000480)={@ptr={0x70742a85, 0x0, &(0x7f00000002c0)=""/11, 0xb, 0x2, 0x3f}, @fd={0x66642a85, 0x0, r0}, @ptr={0x70742a85, 0x0, &(0x7f0000000380)=""/70, 0x46, 0x1, 0x1f}}, &(0x7f0000000500)={0x0, 0x28, 0x40}}, 0x1000}], 0x14, 0x0, &(0x7f0000000680)="86621f50fcee8bdc5bf8c503a78812261b4bf6d7"}) 18:06:56 executing program 3: r0 = socket(0x10, 0x3, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") ioctl$sock_ifreq(r0, 0x89f3, &(0x7f0000000240)={'sit0\x00'}) [ 2588.303542] binder: 1875:1886 BC_ACQUIRE_DONE u0000000000000000 no match [ 2588.303550] binder: 1875:1886 BC_ACQUIRE_DONE u0000000000000003 no match 18:06:56 executing program 1: clone(0x2102001fff, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) socket(0x0, 0x0, 0x0) r0 = getpid() rt_tgsigqueueinfo(0x0, r0, 0x16, &(0x7f0000000100)) rt_sigqueueinfo(r0, 0x7, &(0x7f0000000180)={0x0, 0x0, 0xffffffff}) 18:06:56 executing program 5: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000001a00)='/dev/net/tun\x00', 0x0, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000080)="c0dc00025e0b01047be070") ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000300)={'nr0\x01\x00', 0x1132}) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000001a00)='/dev/net/tun\x00', 0x2, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000300)={'nr0\x01\x00', 0x1132}) write$cgroup_int(0xffffffffffffffff, &(0x7f00000000c0)=0x2, 0xfffffffffffffe75) close(r1) 18:06:56 executing program 3: r0 = socket(0x10, 0x3, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") ioctl$sock_ifreq(r0, 0x89f3, &(0x7f0000000240)={'sit0\x00'}) [ 2588.303562] binder: 1875:1886 transaction failed 29189/-22, size 80-24 line 3014 18:06:56 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000006c0)={0x118, 0x0, &(0x7f0000000540)=[@release={0x40046306, 0x2}, @acquire_done, @acquire_done={0x40106309, 0x3}, @transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x50, 0x18, &(0x7f0000000080)={@flat=@binder={0x73622a85, 0xa, 0x1}, @fda={0x66646185, 0xa, 0x1, 0x9}, @fd={0x66642a85, 0x0, r1}}, &(0x7f0000000100)={0x0, 0x18, 0x38}}, 0x1000}, @transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000180)={@ptr={0x70742a85, 0x0, &(0x7f0000000140)=""/51, 0x33, 0x2, 0x25}, @flat=@weak_handle={0x77682a85, 0x1}, @flat=@binder={0x73622a85, 0xa, 0x3}}, &(0x7f0000000280)={0x0, 0x28, 0x40}}, 0x1f8aed83e3349436}, @exit_looper, @transaction_sg={0x40486311, {0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x68, 0x18, &(0x7f0000000480)={@ptr={0x70742a85, 0x0, &(0x7f00000002c0)=""/11, 0xb, 0x2, 0x3f}, @fd={0x66642a85, 0x0, r0}, @ptr={0x70742a85, 0x0, &(0x7f0000000380)=""/70, 0x46, 0x1, 0x1f}}, &(0x7f0000000500)={0x0, 0x28, 0x40}}, 0x1000}], 0x14, 0x0, &(0x7f0000000680)="86621f50fcee8bdc5bf8c503a78812261b4bf6d7"}) [ 2588.305456] binder: undelivered TRANSACTION_ERROR: 29189 [ 2588.418807] binder: 1935:1941 Release 1 refcount change on invalid ref 2 ret -22 18:06:56 executing program 2: ioctl$FS_IOC_RESVSP(0xffffffffffffffff, 0x40305828, &(0x7f00000000c0)={0x0, 0x0, 0x100000000000001}) clone(0x2102001fff, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) socket(0x0, 0x0, 0x0) r0 = getpid() rt_tgsigqueueinfo(0x0, r0, 0x16, &(0x7f0000000100)) ptrace(0x10, r0) ptrace$poke(0x4209, r0, &(0x7f00000000c0), 0x70effd) 18:06:56 executing program 1: clone(0x2102001fff, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) socket(0x0, 0x0, 0x0) r0 = getpid() rt_tgsigqueueinfo(0x0, r0, 0x16, &(0x7f0000000100)) rt_sigqueueinfo(r0, 0x7, &(0x7f0000000180)={0x0, 0x0, 0xffffffff}) 18:06:56 executing program 3: r0 = socket(0x10, 0x3, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") ioctl$sock_ifreq(r0, 0x89f3, &(0x7f0000000240)={'sit0\x00'}) 18:06:56 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000006c0)={0x118, 0x0, &(0x7f0000000540)=[@release={0x40046306, 0x2}, @acquire_done, @acquire_done={0x40106309, 0x3}, @transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x50, 0x18, &(0x7f0000000080)={@flat=@binder={0x73622a85, 0xa, 0x1}, @fda={0x66646185, 0xa, 0x1, 0x9}, @fd={0x66642a85, 0x0, r1}}, &(0x7f0000000100)={0x0, 0x18, 0x38}}, 0x1000}, @transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000180)={@ptr={0x70742a85, 0x0, &(0x7f0000000140)=""/51, 0x33, 0x2, 0x25}, @flat=@weak_handle={0x77682a85, 0x1}, @flat=@binder={0x73622a85, 0xa, 0x3}}, &(0x7f0000000280)={0x0, 0x28, 0x40}}, 0x1f8aed83e3349436}, @exit_looper, @transaction_sg={0x40486311, {0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x68, 0x18, &(0x7f0000000480)={@ptr={0x70742a85, 0x0, &(0x7f00000002c0)=""/11, 0xb, 0x2, 0x3f}, @fd={0x66642a85, 0x0, r0}, @ptr={0x70742a85, 0x0, &(0x7f0000000380)=""/70, 0x46, 0x1, 0x1f}}, &(0x7f0000000500)={0x0, 0x28, 0x40}}, 0x1000}], 0x14, 0x0, &(0x7f0000000680)="86621f50fcee8bdc5bf8c503a78812261b4bf6d7"}) 18:06:56 executing program 4: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000040)='/dev/net/tun\x00', 0x0, 0x0) r1 = epoll_create1(0x0) epoll_ctl$EPOLL_CTL_ADD(0xffffffffffffffff, 0x1, r0, &(0x7f0000000100)) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000080)={'tunl0\x00', 0x1}) epoll_wait(r1, &(0x7f00000000c0)=[{}], 0x1, 0x0) [ 2588.418817] binder: 1935:1941 BC_ACQUIRE_DONE u0000000000000000 no match [ 2588.418825] binder: 1935:1941 BC_ACQUIRE_DONE u0000000000000003 no match [ 2588.418845] binder: 1935:1941 transaction failed 29189/-22, size 80-24 line 3014 18:06:56 executing program 3: r0 = socket(0x10, 0x3, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") ioctl$sock_ifreq(r0, 0x89f3, &(0x7f0000000240)={'sit0\x00'}) 18:06:56 executing program 1: clone(0x2102001fff, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) socket(0x0, 0x0, 0x0) r0 = getpid() rt_tgsigqueueinfo(0x0, r0, 0x16, &(0x7f0000000100)) rt_sigqueueinfo(r0, 0x7, &(0x7f0000000180)={0x0, 0x0, 0xffffffff}) 18:06:56 executing program 5: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000001a00)='/dev/net/tun\x00', 0x0, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000080)="c0dc00025e0b01047be070") ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000300)={'nr0\x01\x00', 0x1132}) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000001a00)='/dev/net/tun\x00', 0x2, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000300)={'nr0\x01\x00', 0x1132}) write$cgroup_int(0xffffffffffffffff, &(0x7f00000000c0)=0x2, 0xfffffffffffffe75) close(r1) 18:06:56 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000006c0)={0x118, 0x0, &(0x7f0000000540)=[@release={0x40046306, 0x2}, @acquire_done, @acquire_done={0x40106309, 0x3}, @transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x50, 0x18, &(0x7f0000000080)={@flat=@binder={0x73622a85, 0xa, 0x1}, @fda={0x66646185, 0xa, 0x1, 0x9}, @fd={0x66642a85, 0x0, r1}}, &(0x7f0000000100)={0x0, 0x18, 0x38}}, 0x1000}, @transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000180)={@ptr={0x70742a85, 0x0, &(0x7f0000000140)=""/51, 0x33, 0x2, 0x25}, @flat=@weak_handle={0x77682a85, 0x1}, @flat=@binder={0x73622a85, 0xa, 0x3}}, &(0x7f0000000280)={0x0, 0x28, 0x40}}, 0x1f8aed83e3349436}, @exit_looper, @transaction_sg={0x40486311, {0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x68, 0x18, &(0x7f0000000480)={@ptr={0x70742a85, 0x0, &(0x7f00000002c0)=""/11, 0xb, 0x2, 0x3f}, @fd={0x66642a85, 0x0, r0}, @ptr={0x70742a85, 0x0, &(0x7f0000000380)=""/70, 0x46, 0x1, 0x1f}}, &(0x7f0000000500)={0x0, 0x28, 0x40}}, 0x1000}], 0x14, 0x0, &(0x7f0000000680)="86621f50fcee8bdc5bf8c503a78812261b4bf6d7"}) 18:06:56 executing program 2: ioctl$FS_IOC_RESVSP(0xffffffffffffffff, 0x40305828, &(0x7f00000000c0)={0x0, 0x0, 0x100000000000001}) clone(0x2102001fff, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) socket(0x0, 0x0, 0x0) r0 = getpid() rt_tgsigqueueinfo(0x0, r0, 0x16, &(0x7f0000000100)) ptrace(0x10, r0) ptrace$poke(0x4209, r0, &(0x7f00000000c0), 0x70effd) [ 2588.419217] binder: undelivered TRANSACTION_ERROR: 29189 [ 2588.555660] binder: 1966:1977 Release 1 refcount change on invalid ref 2 ret -22 18:06:56 executing program 3: r0 = socket(0x10, 0x3, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") ioctl$sock_ifreq(r0, 0x89f3, &(0x7f0000000240)={'sit0\x00'}) 18:06:56 executing program 4: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000040)='/dev/net/tun\x00', 0x0, 0x0) r1 = epoll_create1(0x0) epoll_ctl$EPOLL_CTL_ADD(0xffffffffffffffff, 0x1, r0, &(0x7f0000000100)) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000080)={'tunl0\x00', 0x1}) epoll_wait(r1, &(0x7f00000000c0)=[{}], 0x1, 0x0) 18:06:56 executing program 1: clone(0x2102001fff, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) socket(0x0, 0x0, 0x0) r0 = getpid() rt_tgsigqueueinfo(0x0, r0, 0x16, &(0x7f0000000100)) rt_sigqueueinfo(r0, 0x7, &(0x7f0000000180)={0x0, 0x0, 0xffffffff}) [ 2588.555671] binder: 1966:1977 BC_ACQUIRE_DONE u0000000000000000 no match [ 2588.555680] binder: 1966:1977 BC_ACQUIRE_DONE u0000000000000003 no match 18:06:56 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000006c0)={0x118, 0x0, &(0x7f0000000540)=[@release={0x40046306, 0x2}, @acquire_done, @acquire_done={0x40106309, 0x3}, @transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x50, 0x18, &(0x7f0000000080)={@flat=@binder={0x73622a85, 0xa, 0x1}, @fda={0x66646185, 0xa, 0x1, 0x9}, @fd={0x66642a85, 0x0, r1}}, &(0x7f0000000100)={0x0, 0x18, 0x38}}, 0x1000}, @transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000180)={@ptr={0x70742a85, 0x0, &(0x7f0000000140)=""/51, 0x33, 0x2, 0x25}, @flat=@weak_handle={0x77682a85, 0x1}, @flat=@binder={0x73622a85, 0xa, 0x3}}, &(0x7f0000000280)={0x0, 0x28, 0x40}}, 0x1f8aed83e3349436}, @exit_looper, @transaction_sg={0x40486311, {0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x68, 0x18, &(0x7f0000000480)={@ptr={0x70742a85, 0x0, &(0x7f00000002c0)=""/11, 0xb, 0x2, 0x3f}, @fd={0x66642a85, 0x0, r0}, @ptr={0x70742a85, 0x0, &(0x7f0000000380)=""/70, 0x46, 0x1, 0x1f}}, &(0x7f0000000500)={0x0, 0x28, 0x40}}, 0x1000}], 0x14, 0x0, &(0x7f0000000680)="86621f50fcee8bdc5bf8c503a78812261b4bf6d7"}) [ 2588.555693] binder: 1966:1977 transaction failed 29189/-22, size 80-24 line 3014 [ 2588.555897] binder: undelivered TRANSACTION_ERROR: 29189 18:06:56 executing program 3: r0 = socket(0x10, 0x3, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") ioctl$sock_ifreq(r0, 0x89f3, &(0x7f0000000240)={'sit0\x00'}) 18:06:56 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000006c0)={0x118, 0x0, &(0x7f0000000540)=[@release={0x40046306, 0x2}, @acquire_done, @acquire_done={0x40106309, 0x3}, @transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x50, 0x18, &(0x7f0000000080)={@flat=@binder={0x73622a85, 0xa, 0x1}, @fda={0x66646185, 0xa, 0x1, 0x9}, @fd={0x66642a85, 0x0, r1}}, &(0x7f0000000100)={0x0, 0x18, 0x38}}, 0x1000}, @transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000180)={@ptr={0x70742a85, 0x0, &(0x7f0000000140)=""/51, 0x33, 0x2, 0x25}, @flat=@weak_handle={0x77682a85, 0x1}, @flat=@binder={0x73622a85, 0xa, 0x3}}, &(0x7f0000000280)={0x0, 0x28, 0x40}}, 0x1f8aed83e3349436}, @exit_looper, @transaction_sg={0x40486311, {0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x68, 0x18, &(0x7f0000000480)={@ptr={0x70742a85, 0x0, &(0x7f00000002c0)=""/11, 0xb, 0x2, 0x3f}, @fd={0x66642a85, 0x0, r0}, @ptr={0x70742a85, 0x0, &(0x7f0000000380)=""/70, 0x46, 0x1, 0x1f}}, &(0x7f0000000500)={0x0, 0x28, 0x40}}, 0x1000}], 0x14, 0x0, &(0x7f0000000680)="86621f50fcee8bdc5bf8c503a78812261b4bf6d7"}) [ 2588.656435] binder: 2017:2023 Release 1 refcount change on invalid ref 2 ret -22 18:06:56 executing program 3: r0 = socket(0x10, 0x3, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") ioctl$sock_ifreq(r0, 0x89f3, &(0x7f0000000240)={'sit0\x00'}) 18:06:56 executing program 4: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000040)='/dev/net/tun\x00', 0x0, 0x0) r1 = epoll_create1(0x0) epoll_ctl$EPOLL_CTL_ADD(0xffffffffffffffff, 0x1, r0, &(0x7f0000000100)) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000080)={'tunl0\x00', 0x1}) epoll_wait(r1, &(0x7f00000000c0)=[{}], 0x1, 0x0) 18:06:56 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000006c0)={0x118, 0x0, &(0x7f0000000540)=[@release={0x40046306, 0x2}, @acquire_done, @acquire_done={0x40106309, 0x3}, @transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x50, 0x18, &(0x7f0000000080)={@flat=@binder={0x73622a85, 0xa, 0x1}, @fda={0x66646185, 0xa, 0x1, 0x9}, @fd={0x66642a85, 0x0, r1}}, &(0x7f0000000100)={0x0, 0x18, 0x38}}, 0x1000}, @transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000180)={@ptr={0x70742a85, 0x0, &(0x7f0000000140)=""/51, 0x33, 0x2, 0x25}, @flat=@weak_handle={0x77682a85, 0x1}, @flat=@binder={0x73622a85, 0xa, 0x3}}, &(0x7f0000000280)={0x0, 0x28, 0x40}}, 0x1f8aed83e3349436}, @exit_looper, @transaction_sg={0x40486311, {0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x68, 0x18, &(0x7f0000000480)={@ptr={0x70742a85, 0x0, &(0x7f00000002c0)=""/11, 0xb, 0x2, 0x3f}, @fd={0x66642a85, 0x0, r0}, @ptr={0x70742a85, 0x0, &(0x7f0000000380)=""/70, 0x46, 0x1, 0x1f}}, &(0x7f0000000500)={0x0, 0x28, 0x40}}, 0x1000}], 0x14, 0x0, &(0x7f0000000680)="86621f50fcee8bdc5bf8c503a78812261b4bf6d7"}) 18:06:56 executing program 5: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000001a00)='/dev/net/tun\x00', 0x0, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000080)="c0dc00025e0b01047be070") ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000300)={'nr0\x01\x00', 0x1132}) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000001a00)='/dev/net/tun\x00', 0x2, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000300)={'nr0\x01\x00', 0x1132}) write$cgroup_int(0xffffffffffffffff, &(0x7f00000000c0)=0x2, 0xfffffffffffffe75) close(r1) 18:06:56 executing program 2: ioctl$FS_IOC_RESVSP(0xffffffffffffffff, 0x40305828, &(0x7f00000000c0)={0x0, 0x0, 0x100000000000001}) clone(0x2102001fff, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) socket(0x0, 0x0, 0x0) r0 = getpid() rt_tgsigqueueinfo(0x0, r0, 0x16, &(0x7f0000000100)) ptrace(0x10, r0) ptrace$poke(0x4209, r0, &(0x7f00000000c0), 0x70effd) [ 2588.656445] binder: 2017:2023 BC_ACQUIRE_DONE u0000000000000000 no match [ 2588.656453] binder: 2017:2023 BC_ACQUIRE_DONE u0000000000000003 no match 18:06:56 executing program 1: clone(0x2102001fff, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) socket(0x0, 0x0, 0x0) r0 = getpid() rt_tgsigqueueinfo(0x0, r0, 0x16, &(0x7f0000000100)) rt_sigqueueinfo(r0, 0x7, &(0x7f0000000180)={0x0, 0x0, 0xffffffff}) 18:06:56 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000006c0)={0x118, 0x0, &(0x7f0000000540)=[@release={0x40046306, 0x2}, @acquire_done, @acquire_done={0x40106309, 0x3}, @transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x50, 0x18, &(0x7f0000000080)={@flat=@binder={0x73622a85, 0xa, 0x1}, @fda={0x66646185, 0xa, 0x1, 0x9}, @fd={0x66642a85, 0x0, r1}}, &(0x7f0000000100)={0x0, 0x18, 0x38}}, 0x1000}, @transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000180)={@ptr={0x70742a85, 0x0, &(0x7f0000000140)=""/51, 0x33, 0x2, 0x25}, @flat=@weak_handle={0x77682a85, 0x1}, @flat=@binder={0x73622a85, 0xa, 0x3}}, &(0x7f0000000280)={0x0, 0x28, 0x40}}, 0x1f8aed83e3349436}, @exit_looper, @transaction_sg={0x40486311, {0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x68, 0x18, &(0x7f0000000480)={@ptr={0x70742a85, 0x0, &(0x7f00000002c0)=""/11, 0xb, 0x2, 0x3f}, @fd={0x66642a85, 0x0, r0}, @ptr={0x70742a85, 0x0, &(0x7f0000000380)=""/70, 0x46, 0x1, 0x1f}}, &(0x7f0000000500)={0x0, 0x28, 0x40}}, 0x1000}], 0x14, 0x0, &(0x7f0000000680)="86621f50fcee8bdc5bf8c503a78812261b4bf6d7"}) [ 2588.656465] binder: 2017:2023 transaction failed 29189/-22, size 80-24 line 3014 18:06:56 executing program 3: r0 = socket(0x10, 0x3, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") ioctl$sock_ifreq(r0, 0x89f3, &(0x7f0000000240)={'sit0\x00'}) 18:06:56 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000006c0)={0x118, 0x0, &(0x7f0000000540)=[@release={0x40046306, 0x2}, @acquire_done, @acquire_done={0x40106309, 0x3}, @transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x50, 0x18, &(0x7f0000000080)={@flat=@binder={0x73622a85, 0xa, 0x1}, @fda={0x66646185, 0xa, 0x1, 0x9}, @fd={0x66642a85, 0x0, r1}}, &(0x7f0000000100)={0x0, 0x18, 0x38}}, 0x1000}, @transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000180)={@ptr={0x70742a85, 0x0, &(0x7f0000000140)=""/51, 0x33, 0x2, 0x25}, @flat=@weak_handle={0x77682a85, 0x1}, @flat=@binder={0x73622a85, 0xa, 0x3}}, &(0x7f0000000280)={0x0, 0x28, 0x40}}, 0x1f8aed83e3349436}, @exit_looper, @transaction_sg={0x40486311, {0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x68, 0x18, &(0x7f0000000480)={@ptr={0x70742a85, 0x0, &(0x7f00000002c0)=""/11, 0xb, 0x2, 0x3f}, @fd={0x66642a85, 0x0, r0}, @ptr={0x70742a85, 0x0, &(0x7f0000000380)=""/70, 0x46, 0x1, 0x1f}}, &(0x7f0000000500)={0x0, 0x28, 0x40}}, 0x1000}], 0x14, 0x0, &(0x7f0000000680)="86621f50fcee8bdc5bf8c503a78812261b4bf6d7"}) [ 2588.656772] binder: undelivered TRANSACTION_ERROR: 29189 [ 2588.760575] binder: 2045:2049 Release 1 refcount change on invalid ref 2 ret -22 18:06:56 executing program 3: r0 = socket(0x10, 0x3, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") ioctl$sock_ifreq(r0, 0x89f3, &(0x7f0000000240)={'sit0\x00'}) 18:06:56 executing program 1: clone(0x2102001fff, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) socket(0x0, 0x0, 0x0) r0 = getpid() rt_tgsigqueueinfo(0x0, r0, 0x16, &(0x7f0000000100)) rt_sigqueueinfo(r0, 0x7, &(0x7f0000000180)={0x0, 0x0, 0xffffffff}) 18:06:56 executing program 5: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000001a00)='/dev/net/tun\x00', 0x0, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000080)="c0dc00025e0b01047be070") ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000300)={'nr0\x01\x00', 0x1132}) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000001a00)='/dev/net/tun\x00', 0x2, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000300)={'nr0\x01\x00', 0x1132}) write$cgroup_int(0xffffffffffffffff, &(0x7f00000000c0)=0x2, 0xfffffffffffffe75) close(r1) 18:06:56 executing program 2: ioctl$FS_IOC_RESVSP(0xffffffffffffffff, 0x40305828, &(0x7f00000000c0)={0x0, 0x0, 0x100000000000001}) clone(0x2102001fff, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) socket(0x0, 0x0, 0x0) r0 = getpid() rt_tgsigqueueinfo(0x0, r0, 0x16, &(0x7f0000000100)) ptrace(0x10, r0) ptrace$poke(0x4209, r0, &(0x7f00000000c0), 0x70effd) [ 2588.760586] binder: 2045:2049 BC_ACQUIRE_DONE u0000000000000000 no match [ 2588.760593] binder: 2045:2049 BC_ACQUIRE_DONE u0000000000000003 no match 18:06:57 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000006c0)={0x118, 0x0, &(0x7f0000000540)=[@release={0x40046306, 0x2}, @acquire_done, @acquire_done={0x40106309, 0x3}, @transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x50, 0x18, &(0x7f0000000080)={@flat=@binder={0x73622a85, 0xa, 0x1}, @fda={0x66646185, 0xa, 0x1, 0x9}, @fd={0x66642a85, 0x0, r1}}, &(0x7f0000000100)={0x0, 0x18, 0x38}}, 0x1000}, @transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000180)={@ptr={0x70742a85, 0x0, &(0x7f0000000140)=""/51, 0x33, 0x2, 0x25}, @flat=@weak_handle={0x77682a85, 0x1}, @flat=@binder={0x73622a85, 0xa, 0x3}}, &(0x7f0000000280)={0x0, 0x28, 0x40}}, 0x1f8aed83e3349436}, @exit_looper, @transaction_sg={0x40486311, {0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x68, 0x18, &(0x7f0000000480)={@ptr={0x70742a85, 0x0, &(0x7f00000002c0)=""/11, 0xb, 0x2, 0x3f}, @fd={0x66642a85, 0x0, r0}, @ptr={0x70742a85, 0x0, &(0x7f0000000380)=""/70, 0x46, 0x1, 0x1f}}, &(0x7f0000000500)={0x0, 0x28, 0x40}}, 0x1000}], 0x14, 0x0, &(0x7f0000000680)="86621f50fcee8bdc5bf8c503a78812261b4bf6d7"}) 18:06:57 executing program 4: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000040)='/dev/net/tun\x00', 0x0, 0x0) r1 = epoll_create1(0x0) epoll_ctl$EPOLL_CTL_ADD(0xffffffffffffffff, 0x1, r0, &(0x7f0000000100)) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000080)={'tunl0\x00', 0x1}) epoll_wait(r1, &(0x7f00000000c0)=[{}], 0x1, 0x0) [ 2588.760605] binder: 2045:2049 transaction failed 29189/-22, size 80-24 line 3014 18:06:57 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000006c0)={0x118, 0x0, &(0x7f0000000540)=[@release={0x40046306, 0x2}, @acquire_done, @acquire_done={0x40106309, 0x3}, @transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x50, 0x18, &(0x7f0000000080)={@flat=@binder={0x73622a85, 0xa, 0x1}, @fda={0x66646185, 0xa, 0x1, 0x9}, @fd={0x66642a85, 0x0, r1}}, &(0x7f0000000100)={0x0, 0x18, 0x38}}, 0x1000}, @transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000180)={@ptr={0x70742a85, 0x0, &(0x7f0000000140)=""/51, 0x33, 0x2, 0x25}, @flat=@weak_handle={0x77682a85, 0x1}, @flat=@binder={0x73622a85, 0xa, 0x3}}, &(0x7f0000000280)={0x0, 0x28, 0x40}}, 0x1f8aed83e3349436}, @exit_looper, @transaction_sg={0x40486311, {0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x68, 0x18, &(0x7f0000000480)={@ptr={0x70742a85, 0x0, &(0x7f00000002c0)=""/11, 0xb, 0x2, 0x3f}, @fd={0x66642a85, 0x0, r0}, @ptr={0x70742a85, 0x0, &(0x7f0000000380)=""/70, 0x46, 0x1, 0x1f}}, &(0x7f0000000500)={0x0, 0x28, 0x40}}, 0x1000}], 0x14, 0x0, &(0x7f0000000680)="86621f50fcee8bdc5bf8c503a78812261b4bf6d7"}) 18:06:57 executing program 1: clone(0x2102001fff, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) socket(0x0, 0x0, 0x0) r0 = getpid() rt_tgsigqueueinfo(0x0, r0, 0x16, &(0x7f0000000100)) rt_sigqueueinfo(r0, 0x7, &(0x7f0000000180)={0x0, 0x0, 0xffffffff}) [ 2588.760844] binder: undelivered TRANSACTION_ERROR: 29189 [ 2589.037038] binder: 2178:2182 Release 1 refcount change on invalid ref 2 ret -22 18:06:57 executing program 3: r0 = socket(0x10, 0x3, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") ioctl$sock_ifreq(r0, 0x89f3, &(0x7f0000000240)={'sit0\x00'}) 18:06:57 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000006c0)={0x118, 0x0, &(0x7f0000000540)=[@release={0x40046306, 0x2}, @acquire_done, @acquire_done={0x40106309, 0x3}, @transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x50, 0x18, &(0x7f0000000080)={@flat=@binder={0x73622a85, 0xa, 0x1}, @fda={0x66646185, 0xa, 0x1, 0x9}, @fd={0x66642a85, 0x0, r1}}, &(0x7f0000000100)={0x0, 0x18, 0x38}}, 0x1000}, @transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000180)={@ptr={0x70742a85, 0x0, &(0x7f0000000140)=""/51, 0x33, 0x2, 0x25}, @flat=@weak_handle={0x77682a85, 0x1}, @flat=@binder={0x73622a85, 0xa, 0x3}}, &(0x7f0000000280)={0x0, 0x28, 0x40}}, 0x1f8aed83e3349436}, @exit_looper, @transaction_sg={0x40486311, {0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x68, 0x18, &(0x7f0000000480)={@ptr={0x70742a85, 0x0, &(0x7f00000002c0)=""/11, 0xb, 0x2, 0x3f}, @fd={0x66642a85, 0x0, r0}, @ptr={0x70742a85, 0x0, &(0x7f0000000380)=""/70, 0x46, 0x1, 0x1f}}, &(0x7f0000000500)={0x0, 0x28, 0x40}}, 0x1000}], 0x14, 0x0, &(0x7f0000000680)="86621f50fcee8bdc5bf8c503a78812261b4bf6d7"}) [ 2589.037048] binder: 2178:2182 BC_ACQUIRE_DONE u0000000000000000 no match [ 2589.037056] binder: 2178:2182 BC_ACQUIRE_DONE u0000000000000003 no match [ 2589.037069] binder: 2178:2182 transaction failed 29189/-22, size 80-24 line 3014 [ 2589.037429] binder: undelivered TRANSACTION_ERROR: 29189 18:06:57 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000006c0)={0x118, 0x0, &(0x7f0000000540)=[@release={0x40046306, 0x2}, @acquire_done, @acquire_done={0x40106309, 0x3}, @transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x50, 0x18, &(0x7f0000000080)={@flat=@binder={0x73622a85, 0xa, 0x1}, @fda={0x66646185, 0xa, 0x1, 0x9}, @fd={0x66642a85, 0x0, r1}}, &(0x7f0000000100)={0x0, 0x18, 0x38}}, 0x1000}, @transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000180)={@ptr={0x70742a85, 0x0, &(0x7f0000000140)=""/51, 0x33, 0x2, 0x25}, @flat=@weak_handle={0x77682a85, 0x1}, @flat=@binder={0x73622a85, 0xa, 0x3}}, &(0x7f0000000280)={0x0, 0x28, 0x40}}, 0x1f8aed83e3349436}, @exit_looper, @transaction_sg={0x40486311, {0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x68, 0x18, &(0x7f0000000480)={@ptr={0x70742a85, 0x0, &(0x7f00000002c0)=""/11, 0xb, 0x2, 0x3f}, @fd={0x66642a85, 0x0, r0}, @ptr={0x70742a85, 0x0, &(0x7f0000000380)=""/70, 0x46, 0x1, 0x1f}}, &(0x7f0000000500)={0x0, 0x28, 0x40}}, 0x1000}], 0x14, 0x0, &(0x7f0000000680)="86621f50fcee8bdc5bf8c503a78812261b4bf6d7"}) 18:06:57 executing program 1: clone(0x2102001fff, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) socket(0x0, 0x0, 0x0) r0 = getpid() rt_tgsigqueueinfo(0x0, r0, 0x16, &(0x7f0000000100)) rt_sigqueueinfo(r0, 0x7, &(0x7f0000000180)={0x0, 0x0, 0xffffffff}) 18:06:57 executing program 2: ioctl$FS_IOC_RESVSP(0xffffffffffffffff, 0x40305828, &(0x7f00000000c0)={0x0, 0x0, 0x100000000000001}) clone(0x2102001fff, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) socket(0x0, 0x0, 0x0) r0 = getpid() rt_tgsigqueueinfo(0x0, r0, 0x16, &(0x7f0000000100)) ptrace(0x10, r0) ptrace$poke(0x4209, r0, &(0x7f00000000c0), 0x70effd) [ 2589.130209] binder: 2215:2226 Release 1 refcount change on invalid ref 2 ret -22 [ 2589.130218] binder: 2215:2226 BC_ACQUIRE_DONE u0000000000000000 no match 18:06:57 executing program 4: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000040)='/dev/net/tun\x00', 0x0, 0x0) r1 = epoll_create1(0x0) epoll_ctl$EPOLL_CTL_ADD(0xffffffffffffffff, 0x1, r0, &(0x7f0000000100)) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000080)={'tunl0\x00', 0x1}) epoll_wait(r1, &(0x7f00000000c0)=[{}], 0x1, 0x0) [ 2589.130226] binder: 2215:2226 BC_ACQUIRE_DONE u0000000000000003 no match 18:06:57 executing program 5: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000001a00)='/dev/net/tun\x00', 0x0, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000080)="c0dc00025e0b01047be070") ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000300)={'nr0\x01\x00', 0x1132}) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000001a00)='/dev/net/tun\x00', 0x2, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000300)={'nr0\x01\x00', 0x1132}) write$cgroup_int(0xffffffffffffffff, &(0x7f00000000c0)=0x2, 0xfffffffffffffe75) close(r1) 18:06:57 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000006c0)={0x118, 0x0, &(0x7f0000000540)=[@release={0x40046306, 0x2}, @acquire_done, @acquire_done={0x40106309, 0x3}, @transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x50, 0x18, &(0x7f0000000080)={@flat=@binder={0x73622a85, 0xa, 0x1}, @fda={0x66646185, 0xa, 0x1, 0x9}, @fd={0x66642a85, 0x0, r1}}, &(0x7f0000000100)={0x0, 0x18, 0x38}}, 0x1000}, @transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000180)={@ptr={0x70742a85, 0x0, &(0x7f0000000140)=""/51, 0x33, 0x2, 0x25}, @flat=@weak_handle={0x77682a85, 0x1}, @flat=@binder={0x73622a85, 0xa, 0x3}}, &(0x7f0000000280)={0x0, 0x28, 0x40}}, 0x1f8aed83e3349436}, @exit_looper, @transaction_sg={0x40486311, {0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x68, 0x18, &(0x7f0000000480)={@ptr={0x70742a85, 0x0, &(0x7f00000002c0)=""/11, 0xb, 0x2, 0x3f}, @fd={0x66642a85, 0x0, r0}, @ptr={0x70742a85, 0x0, &(0x7f0000000380)=""/70, 0x46, 0x1, 0x1f}}, &(0x7f0000000500)={0x0, 0x28, 0x40}}, 0x1000}], 0x14, 0x0, &(0x7f0000000680)="86621f50fcee8bdc5bf8c503a78812261b4bf6d7"}) 18:06:57 executing program 1: clone(0x2102001fff, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) socket(0x0, 0x0, 0x0) r0 = getpid() rt_tgsigqueueinfo(0x0, r0, 0x16, &(0x7f0000000100)) rt_sigqueueinfo(r0, 0x7, &(0x7f0000000180)={0x0, 0x0, 0xffffffff}) 18:06:57 executing program 3: r0 = socket(0x10, 0x3, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") ioctl$sock_ifreq(r0, 0x89f3, &(0x7f0000000240)={'sit0\x00'}) [ 2589.130239] binder: 2215:2226 transaction failed 29189/-22, size 80-24 line 3014 18:06:57 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000006c0)={0x118, 0x0, &(0x7f0000000540)=[@release={0x40046306, 0x2}, @acquire_done, @acquire_done={0x40106309, 0x3}, @transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x50, 0x18, &(0x7f0000000080)={@flat=@binder={0x73622a85, 0xa, 0x1}, @fda={0x66646185, 0xa, 0x1, 0x9}, @fd={0x66642a85, 0x0, r1}}, &(0x7f0000000100)={0x0, 0x18, 0x38}}, 0x1000}, @transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000180)={@ptr={0x70742a85, 0x0, &(0x7f0000000140)=""/51, 0x33, 0x2, 0x25}, @flat=@weak_handle={0x77682a85, 0x1}, @flat=@binder={0x73622a85, 0xa, 0x3}}, &(0x7f0000000280)={0x0, 0x28, 0x40}}, 0x1f8aed83e3349436}, @exit_looper, @transaction_sg={0x40486311, {0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x68, 0x18, &(0x7f0000000480)={@ptr={0x70742a85, 0x0, &(0x7f00000002c0)=""/11, 0xb, 0x2, 0x3f}, @fd={0x66642a85, 0x0, r0}, @ptr={0x70742a85, 0x0, &(0x7f0000000380)=""/70, 0x46, 0x1, 0x1f}}, &(0x7f0000000500)={0x0, 0x28, 0x40}}, 0x1000}], 0x14, 0x0, &(0x7f0000000680)="86621f50fcee8bdc5bf8c503a78812261b4bf6d7"}) [ 2589.130513] binder: undelivered TRANSACTION_ERROR: 29189 [ 2589.288048] binder: 2260:2271 Release 1 refcount change on invalid ref 2 ret -22 18:06:57 executing program 3: r0 = socket(0x10, 0x3, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") ioctl$sock_ifreq(r0, 0x89f3, &(0x7f0000000240)={'sit0\x00'}) 18:06:57 executing program 2: ioctl$FS_IOC_RESVSP(0xffffffffffffffff, 0x40305828, &(0x7f00000000c0)={0x0, 0x0, 0x100000000000001}) clone(0x2102001fff, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) socket(0x0, 0x0, 0x0) r0 = getpid() rt_tgsigqueueinfo(0x0, r0, 0x16, &(0x7f0000000100)) ptrace(0x10, r0) ptrace$poke(0x4209, r0, &(0x7f00000000c0), 0x70effd) [ 2589.288059] binder: 2260:2271 BC_ACQUIRE_DONE u0000000000000000 no match 18:06:57 executing program 4: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000040)='/dev/net/tun\x00', 0x0, 0x0) r1 = epoll_create1(0x0) epoll_ctl$EPOLL_CTL_ADD(0xffffffffffffffff, 0x1, r0, &(0x7f0000000100)) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000080)={'tunl0\x00', 0x1}) epoll_wait(r1, &(0x7f00000000c0)=[{}], 0x1, 0x0) 18:06:57 executing program 1: clone(0x2102001fff, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) socket(0x0, 0x0, 0x0) r0 = getpid() rt_tgsigqueueinfo(0x0, r0, 0x16, &(0x7f0000000100)) rt_sigqueueinfo(r0, 0x7, &(0x7f0000000180)={0x0, 0x0, 0xffffffff}) 18:06:57 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000006c0)={0x118, 0x0, &(0x7f0000000540)=[@release={0x40046306, 0x2}, @acquire_done, @acquire_done={0x40106309, 0x3}, @transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x50, 0x18, &(0x7f0000000080)={@flat=@binder={0x73622a85, 0xa, 0x1}, @fda={0x66646185, 0xa, 0x1, 0x9}, @fd={0x66642a85, 0x0, r1}}, &(0x7f0000000100)={0x0, 0x18, 0x38}}, 0x1000}, @transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000180)={@ptr={0x70742a85, 0x0, &(0x7f0000000140)=""/51, 0x33, 0x2, 0x25}, @flat=@weak_handle={0x77682a85, 0x1}, @flat=@binder={0x73622a85, 0xa, 0x3}}, &(0x7f0000000280)={0x0, 0x28, 0x40}}, 0x1f8aed83e3349436}, @exit_looper, @transaction_sg={0x40486311, {0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x68, 0x18, &(0x7f0000000480)={@ptr={0x70742a85, 0x0, &(0x7f00000002c0)=""/11, 0xb, 0x2, 0x3f}, @fd={0x66642a85, 0x0, r0}, @ptr={0x70742a85, 0x0, &(0x7f0000000380)=""/70, 0x46, 0x1, 0x1f}}, &(0x7f0000000500)={0x0, 0x28, 0x40}}, 0x1000}], 0x14, 0x0, &(0x7f0000000680)="86621f50fcee8bdc5bf8c503a78812261b4bf6d7"}) [ 2589.288067] binder: 2260:2271 BC_ACQUIRE_DONE u0000000000000003 no match 18:06:57 executing program 3: r0 = socket(0x10, 0x3, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") ioctl$sock_ifreq(r0, 0x89f3, &(0x7f0000000240)={'sit0\x00'}) 18:06:57 executing program 5: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000001a00)='/dev/net/tun\x00', 0x0, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000080)="c0dc00025e0b01047be070") ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000300)={'nr0\x01\x00', 0x1132}) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000001a00)='/dev/net/tun\x00', 0x2, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000300)={'nr0\x01\x00', 0x1132}) write$cgroup_int(0xffffffffffffffff, &(0x7f00000000c0)=0x2, 0xfffffffffffffe75) close(r1) [ 2589.288080] binder: 2260:2271 transaction failed 29189/-22, size 80-24 line 3014 18:06:57 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000006c0)={0x118, 0x0, &(0x7f0000000540)=[@release={0x40046306, 0x2}, @acquire_done, @acquire_done={0x40106309, 0x3}, @transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x50, 0x18, &(0x7f0000000080)={@flat=@binder={0x73622a85, 0xa, 0x1}, @fda={0x66646185, 0xa, 0x1, 0x9}, @fd={0x66642a85, 0x0, r1}}, &(0x7f0000000100)={0x0, 0x18, 0x38}}, 0x1000}, @transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000180)={@ptr={0x70742a85, 0x0, &(0x7f0000000140)=""/51, 0x33, 0x2, 0x25}, @flat=@weak_handle={0x77682a85, 0x1}, @flat=@binder={0x73622a85, 0xa, 0x3}}, &(0x7f0000000280)={0x0, 0x28, 0x40}}, 0x1f8aed83e3349436}, @exit_looper, @transaction_sg={0x40486311, {0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x68, 0x18, &(0x7f0000000480)={@ptr={0x70742a85, 0x0, &(0x7f00000002c0)=""/11, 0xb, 0x2, 0x3f}, @fd={0x66642a85, 0x0, r0}, @ptr={0x70742a85, 0x0, &(0x7f0000000380)=""/70, 0x46, 0x1, 0x1f}}, &(0x7f0000000500)={0x0, 0x28, 0x40}}, 0x1000}], 0x14, 0x0, &(0x7f0000000680)="86621f50fcee8bdc5bf8c503a78812261b4bf6d7"}) [ 2589.288375] binder: undelivered TRANSACTION_ERROR: 29189 18:06:57 executing program 3: r0 = socket(0x10, 0x3, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") ioctl$sock_ifreq(r0, 0x89f3, &(0x7f0000000240)={'sit0\x00'}) [ 2589.370267] binder: 2324:2326 Release 1 refcount change on invalid ref 2 ret -22 [ 2589.370278] binder: 2324:2326 BC_ACQUIRE_DONE u0000000000000000 no match [ 2589.370286] binder: 2324:2326 BC_ACQUIRE_DONE u0000000000000003 no match 18:06:57 executing program 1: clone(0x2102001fff, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) socket(0x0, 0x0, 0x0) r0 = getpid() rt_tgsigqueueinfo(0x0, r0, 0x16, &(0x7f0000000100)) rt_sigqueueinfo(r0, 0x7, &(0x7f0000000180)={0x0, 0x0, 0xffffffff}) 18:06:57 executing program 4: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000040)='/dev/net/tun\x00', 0x0, 0x0) r1 = epoll_create1(0x0) epoll_ctl$EPOLL_CTL_ADD(0xffffffffffffffff, 0x1, r0, &(0x7f0000000100)) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000080)={'tunl0\x00', 0x1}) epoll_wait(r1, &(0x7f00000000c0)=[{}], 0x1, 0x0) [ 2589.370299] binder: 2324:2326 transaction failed 29189/-22, size 80-24 line 3014 18:06:57 executing program 2: ioctl$FS_IOC_RESVSP(0xffffffffffffffff, 0x40305828, &(0x7f00000000c0)={0x0, 0x0, 0x100000000000001}) clone(0x2102001fff, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) socket(0x0, 0x0, 0x0) r0 = getpid() rt_tgsigqueueinfo(0x0, r0, 0x16, &(0x7f0000000100)) ptrace(0x10, r0) ptrace$poke(0x4209, r0, &(0x7f00000000c0), 0x70effd) 18:06:57 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000006c0)={0x118, 0x0, &(0x7f0000000540)=[@release={0x40046306, 0x2}, @acquire_done, @acquire_done={0x40106309, 0x3}, @transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x50, 0x18, &(0x7f0000000080)={@flat=@binder={0x73622a85, 0xa, 0x1}, @fda={0x66646185, 0xa, 0x1, 0x9}, @fd={0x66642a85, 0x0, r1}}, &(0x7f0000000100)={0x0, 0x18, 0x38}}, 0x1000}, @transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000180)={@ptr={0x70742a85, 0x0, &(0x7f0000000140)=""/51, 0x33, 0x2, 0x25}, @flat=@weak_handle={0x77682a85, 0x1}, @flat=@binder={0x73622a85, 0xa, 0x3}}, &(0x7f0000000280)={0x0, 0x28, 0x40}}, 0x1f8aed83e3349436}, @exit_looper, @transaction_sg={0x40486311, {0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x68, 0x18, &(0x7f0000000480)={@ptr={0x70742a85, 0x0, &(0x7f00000002c0)=""/11, 0xb, 0x2, 0x3f}, @fd={0x66642a85, 0x0, r0}, @ptr={0x70742a85, 0x0, &(0x7f0000000380)=""/70, 0x46, 0x1, 0x1f}}, &(0x7f0000000500)={0x0, 0x28, 0x40}}, 0x1000}], 0x14, 0x0, &(0x7f0000000680)="86621f50fcee8bdc5bf8c503a78812261b4bf6d7"}) 18:06:57 executing program 3: r0 = socket(0x10, 0x3, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") ioctl$sock_ifreq(r0, 0x89f3, &(0x7f0000000240)={'sit0\x00'}) [ 2589.370622] binder: undelivered TRANSACTION_ERROR: 29189 18:06:57 executing program 1: clone(0x2102001fff, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) socket(0x0, 0x0, 0x0) r0 = getpid() rt_tgsigqueueinfo(0x0, r0, 0x16, &(0x7f0000000100)) rt_sigqueueinfo(r0, 0x7, &(0x7f0000000180)={0x0, 0x0, 0xffffffff}) [ 2589.536711] binder: 2357:2410 Release 1 refcount change on invalid ref 2 ret -22 18:06:57 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000006c0)={0x118, 0x0, &(0x7f0000000540)=[@release={0x40046306, 0x2}, @acquire_done, @acquire_done={0x40106309, 0x3}, @transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x50, 0x18, &(0x7f0000000080)={@flat=@binder={0x73622a85, 0xa, 0x1}, @fda={0x66646185, 0xa, 0x1, 0x9}, @fd={0x66642a85, 0x0, r1}}, &(0x7f0000000100)={0x0, 0x18, 0x38}}, 0x1000}, @transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000180)={@ptr={0x70742a85, 0x0, &(0x7f0000000140)=""/51, 0x33, 0x2, 0x25}, @flat=@weak_handle={0x77682a85, 0x1}, @flat=@binder={0x73622a85, 0xa, 0x3}}, &(0x7f0000000280)={0x0, 0x28, 0x40}}, 0x1f8aed83e3349436}, @exit_looper, @transaction_sg={0x40486311, {0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x68, 0x18, &(0x7f0000000480)={@ptr={0x70742a85, 0x0, &(0x7f00000002c0)=""/11, 0xb, 0x2, 0x3f}, @fd={0x66642a85, 0x0, r0}, @ptr={0x70742a85, 0x0, &(0x7f0000000380)=""/70, 0x46, 0x1, 0x1f}}, &(0x7f0000000500)={0x0, 0x28, 0x40}}, 0x1000}], 0x14, 0x0, &(0x7f0000000680)="86621f50fcee8bdc5bf8c503a78812261b4bf6d7"}) 18:06:58 executing program 3: r0 = socket(0x10, 0x3, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") ioctl$sock_ifreq(r0, 0x89f3, &(0x7f0000000240)={'sit0\x00'}) [ 2589.536722] binder: 2357:2410 BC_ACQUIRE_DONE u0000000000000000 no match 18:06:58 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000006c0)={0x118, 0x0, &(0x7f0000000540)=[@release={0x40046306, 0x2}, @acquire_done, @acquire_done={0x40106309, 0x3}, @transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x50, 0x18, &(0x7f0000000080)={@flat=@binder={0x73622a85, 0xa, 0x1}, @fda={0x66646185, 0xa, 0x1, 0x9}, @fd={0x66642a85, 0x0, r1}}, &(0x7f0000000100)={0x0, 0x18, 0x38}}, 0x1000}, @transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000180)={@ptr={0x70742a85, 0x0, &(0x7f0000000140)=""/51, 0x33, 0x2, 0x25}, @flat=@weak_handle={0x77682a85, 0x1}, @flat=@binder={0x73622a85, 0xa, 0x3}}, &(0x7f0000000280)={0x0, 0x28, 0x40}}, 0x1f8aed83e3349436}, @exit_looper, @transaction_sg={0x40486311, {0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x68, 0x18, &(0x7f0000000480)={@ptr={0x70742a85, 0x0, &(0x7f00000002c0)=""/11, 0xb, 0x2, 0x3f}, @fd={0x66642a85, 0x0, r0}, @ptr={0x70742a85, 0x0, &(0x7f0000000380)=""/70, 0x46, 0x1, 0x1f}}, &(0x7f0000000500)={0x0, 0x28, 0x40}}, 0x1000}], 0x14, 0x0, &(0x7f0000000680)="86621f50fcee8bdc5bf8c503a78812261b4bf6d7"}) [ 2589.536729] binder: 2357:2410 BC_ACQUIRE_DONE u0000000000000003 no match 18:06:58 executing program 5: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000001a00)='/dev/net/tun\x00', 0x0, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000080)="c0dc00025e0b01047be070") ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000300)={'nr0\x01\x00', 0x1132}) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000001a00)='/dev/net/tun\x00', 0x2, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000300)={'nr0\x01\x00', 0x1132}) write$cgroup_int(0xffffffffffffffff, &(0x7f00000000c0)=0x2, 0xfffffffffffffe75) close(r1) 18:06:58 executing program 2: ioctl$FS_IOC_RESVSP(0xffffffffffffffff, 0x40305828, &(0x7f00000000c0)={0x0, 0x0, 0x100000000000001}) clone(0x2102001fff, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) socket(0x0, 0x0, 0x0) r0 = getpid() rt_tgsigqueueinfo(0x0, r0, 0x16, &(0x7f0000000100)) ptrace(0x10, r0) ptrace$poke(0x4209, r0, &(0x7f00000000c0), 0x70effd) 18:06:58 executing program 4: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000040)='/dev/net/tun\x00', 0x0, 0x0) r1 = epoll_create1(0x0) epoll_ctl$EPOLL_CTL_ADD(0xffffffffffffffff, 0x1, r0, &(0x7f0000000100)) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000080)={'tunl0\x00', 0x1}) epoll_wait(r1, &(0x7f00000000c0)=[{}], 0x1, 0x0) 18:06:58 executing program 3: r0 = socket(0x10, 0x3, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") ioctl$sock_ifreq(r0, 0x89f3, &(0x7f0000000240)={'sit0\x00'}) [ 2589.536742] binder: 2357:2410 transaction failed 29189/-22, size 80-24 line 3014 18:06:58 executing program 1: clone(0x2102001fff, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) socket(0x0, 0x0, 0x0) r0 = getpid() rt_tgsigqueueinfo(0x0, r0, 0x16, &(0x7f0000000100)) rt_sigqueueinfo(r0, 0x7, &(0x7f0000000180)={0x0, 0x0, 0xffffffff}) 18:06:58 executing program 3: r0 = socket(0x10, 0x3, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") ioctl$sock_ifreq(r0, 0x89f3, &(0x7f0000000240)={'sit0\x00'}) [ 2589.537043] binder: undelivered TRANSACTION_ERROR: 29189 [ 2589.717510] binder: 2423:2448 Release 1 refcount change on invalid ref 2 ret -22 [ 2589.717542] binder: 2423:2448 BC_ACQUIRE_DONE u0000000000000000 no match [ 2589.717550] binder: 2423:2448 BC_ACQUIRE_DONE u0000000000000003 no match 18:06:58 executing program 2: ioctl$FS_IOC_RESVSP(0xffffffffffffffff, 0x40305828, &(0x7f00000000c0)={0x0, 0x0, 0x100000000000001}) clone(0x2102001fff, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) socket(0x0, 0x0, 0x0) r0 = getpid() rt_tgsigqueueinfo(0x0, r0, 0x16, &(0x7f0000000100)) ptrace(0x10, r0) ptrace$poke(0x4209, r0, &(0x7f00000000c0), 0x70effd) 18:06:58 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000006c0)={0x118, 0x0, &(0x7f0000000540)=[@release={0x40046306, 0x2}, @acquire_done, @acquire_done={0x40106309, 0x3}, @transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x50, 0x18, &(0x7f0000000080)={@flat=@binder={0x73622a85, 0xa, 0x1}, @fda={0x66646185, 0xa, 0x1, 0x9}, @fd={0x66642a85, 0x0, r1}}, &(0x7f0000000100)={0x0, 0x18, 0x38}}, 0x1000}, @transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000180)={@ptr={0x70742a85, 0x0, &(0x7f0000000140)=""/51, 0x33, 0x2, 0x25}, @flat=@weak_handle={0x77682a85, 0x1}, @flat=@binder={0x73622a85, 0xa, 0x3}}, &(0x7f0000000280)={0x0, 0x28, 0x40}}, 0x1f8aed83e3349436}, @exit_looper, @transaction_sg={0x40486311, {0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x68, 0x18, &(0x7f0000000480)={@ptr={0x70742a85, 0x0, &(0x7f00000002c0)=""/11, 0xb, 0x2, 0x3f}, @fd={0x66642a85, 0x0, r0}, @ptr={0x70742a85, 0x0, &(0x7f0000000380)=""/70, 0x46, 0x1, 0x1f}}, &(0x7f0000000500)={0x0, 0x28, 0x40}}, 0x1000}], 0x14, 0x0, &(0x7f0000000680)="86621f50fcee8bdc5bf8c503a78812261b4bf6d7"}) 18:06:58 executing program 1: clone(0x2102001fff, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) socket(0x0, 0x0, 0x0) r0 = getpid() rt_tgsigqueueinfo(0x0, r0, 0x16, &(0x7f0000000100)) rt_sigqueueinfo(r0, 0x7, &(0x7f0000000180)={0x0, 0x0, 0xffffffff}) 18:06:58 executing program 4: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000040)='/dev/net/tun\x00', 0x0, 0x0) r1 = epoll_create1(0x0) epoll_ctl$EPOLL_CTL_ADD(0xffffffffffffffff, 0x1, r0, &(0x7f0000000100)) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000080)={'tunl0\x00', 0x1}) epoll_wait(r1, &(0x7f00000000c0)=[{}], 0x1, 0x0) [ 2589.717564] binder: 2423:2448 transaction failed 29189/-22, size 80-24 line 3014 18:06:58 executing program 5: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000001a00)='/dev/net/tun\x00', 0x0, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000080)="c0dc00025e0b01047be070") ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000300)={'nr0\x01\x00', 0x1132}) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000001a00)='/dev/net/tun\x00', 0x2, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000300)={'nr0\x01\x00', 0x1132}) write$cgroup_int(0xffffffffffffffff, &(0x7f00000000c0)=0x2, 0xfffffffffffffe75) close(r1) 18:06:58 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000006c0)={0x118, 0x0, &(0x7f0000000540)=[@release={0x40046306, 0x2}, @acquire_done, @acquire_done={0x40106309, 0x3}, @transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x50, 0x18, &(0x7f0000000080)={@flat=@binder={0x73622a85, 0xa, 0x1}, @fda={0x66646185, 0xa, 0x1, 0x9}, @fd={0x66642a85, 0x0, r1}}, &(0x7f0000000100)={0x0, 0x18, 0x38}}, 0x1000}, @transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000180)={@ptr={0x70742a85, 0x0, &(0x7f0000000140)=""/51, 0x33, 0x2, 0x25}, @flat=@weak_handle={0x77682a85, 0x1}, @flat=@binder={0x73622a85, 0xa, 0x3}}, &(0x7f0000000280)={0x0, 0x28, 0x40}}, 0x1f8aed83e3349436}, @exit_looper, @transaction_sg={0x40486311, {0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x68, 0x18, &(0x7f0000000480)={@ptr={0x70742a85, 0x0, &(0x7f00000002c0)=""/11, 0xb, 0x2, 0x3f}, @fd={0x66642a85, 0x0, r0}, @ptr={0x70742a85, 0x0, &(0x7f0000000380)=""/70, 0x46, 0x1, 0x1f}}, &(0x7f0000000500)={0x0, 0x28, 0x40}}, 0x1000}], 0x14, 0x0, &(0x7f0000000680)="86621f50fcee8bdc5bf8c503a78812261b4bf6d7"}) [ 2589.718010] binder: undelivered TRANSACTION_ERROR: 29189 18:06:58 executing program 1: clone(0x2102001fff, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) socket(0x0, 0x0, 0x0) r0 = getpid() rt_tgsigqueueinfo(0x0, r0, 0x16, &(0x7f0000000100)) rt_sigqueueinfo(r0, 0x7, &(0x7f0000000180)={0x0, 0x0, 0xffffffff}) 18:06:58 executing program 3: r0 = socket(0x10, 0x3, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") ioctl$sock_ifreq(r0, 0x89f3, &(0x7f0000000240)={'sit0\x00'}) 18:06:58 executing program 2: ioctl$FS_IOC_RESVSP(0xffffffffffffffff, 0x40305828, &(0x7f00000000c0)={0x0, 0x0, 0x100000000000001}) clone(0x2102001fff, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) socket(0x0, 0x0, 0x0) r0 = getpid() rt_tgsigqueueinfo(0x0, r0, 0x16, &(0x7f0000000100)) ptrace(0x10, r0) ptrace$poke(0x4209, r0, &(0x7f00000000c0), 0x70effd) [ 2589.879565] binder: 2494:2510 Release 1 refcount change on invalid ref 2 ret -22 18:06:58 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000006c0)={0x118, 0x0, &(0x7f0000000540)=[@release={0x40046306, 0x2}, @acquire_done, @acquire_done={0x40106309, 0x3}, @transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x50, 0x18, &(0x7f0000000080)={@flat=@binder={0x73622a85, 0xa, 0x1}, @fda={0x66646185, 0xa, 0x1, 0x9}, @fd={0x66642a85, 0x0, r1}}, &(0x7f0000000100)={0x0, 0x18, 0x38}}, 0x1000}, @transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000180)={@ptr={0x70742a85, 0x0, &(0x7f0000000140)=""/51, 0x33, 0x2, 0x25}, @flat=@weak_handle={0x77682a85, 0x1}, @flat=@binder={0x73622a85, 0xa, 0x3}}, &(0x7f0000000280)={0x0, 0x28, 0x40}}, 0x1f8aed83e3349436}, @exit_looper, @transaction_sg={0x40486311, {0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x68, 0x18, &(0x7f0000000480)={@ptr={0x70742a85, 0x0, &(0x7f00000002c0)=""/11, 0xb, 0x2, 0x3f}, @fd={0x66642a85, 0x0, r0}, @ptr={0x70742a85, 0x0, &(0x7f0000000380)=""/70, 0x46, 0x1, 0x1f}}, &(0x7f0000000500)={0x0, 0x28, 0x40}}, 0x1000}], 0x14, 0x0, &(0x7f0000000680)="86621f50fcee8bdc5bf8c503a78812261b4bf6d7"}) 18:06:58 executing program 1: clone(0x2102001fff, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) socket(0x0, 0x0, 0x0) r0 = getpid() rt_tgsigqueueinfo(0x0, r0, 0x16, &(0x7f0000000100)) rt_sigqueueinfo(r0, 0x7, &(0x7f0000000180)={0x0, 0x0, 0xffffffff}) [ 2589.879577] binder: 2494:2510 BC_ACQUIRE_DONE u0000000000000000 no match [ 2589.879585] binder: 2494:2510 BC_ACQUIRE_DONE u0000000000000003 no match [ 2589.879598] binder: 2494:2510 transaction failed 29189/-22, size 80-24 line 3014 [ 2589.879835] binder: undelivered TRANSACTION_ERROR: 29189 18:06:58 executing program 4: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000040)='/dev/net/tun\x00', 0x0, 0x0) r1 = epoll_create1(0x0) epoll_ctl$EPOLL_CTL_ADD(0xffffffffffffffff, 0x1, r0, &(0x7f0000000100)) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000080)={'tunl0\x00', 0x1}) epoll_wait(r1, &(0x7f00000000c0)=[{}], 0x1, 0x0) 18:06:58 executing program 3: r0 = socket(0x10, 0x3, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") ioctl$sock_ifreq(r0, 0x89f3, &(0x7f0000000240)={'sit0\x00'}) [ 2589.987458] binder: 2541:2558 Release 1 refcount change on invalid ref 2 ret -22 18:06:58 executing program 1: clone(0x2102001fff, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) socket(0x0, 0x0, 0x0) r0 = getpid() rt_tgsigqueueinfo(0x0, r0, 0x16, &(0x7f0000000100)) rt_sigqueueinfo(r0, 0x7, &(0x7f0000000180)={0x0, 0x0, 0xffffffff}) 18:06:58 executing program 3: r0 = socket(0x10, 0x3, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") ioctl$sock_ifreq(r0, 0x89f3, &(0x7f0000000240)={'sit0\x00'}) [ 2589.987468] binder: 2541:2558 BC_ACQUIRE_DONE u0000000000000000 no match [ 2589.987475] binder: 2541:2558 BC_ACQUIRE_DONE u0000000000000003 no match 18:06:58 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000006c0)={0x118, 0x0, &(0x7f0000000540)=[@release={0x40046306, 0x2}, @acquire_done, @acquire_done={0x40106309, 0x3}, @transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x50, 0x18, &(0x7f0000000080)={@flat=@binder={0x73622a85, 0xa, 0x1}, @fda={0x66646185, 0xa, 0x1, 0x9}, @fd={0x66642a85, 0x0, r1}}, &(0x7f0000000100)={0x0, 0x18, 0x38}}, 0x1000}, @transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000180)={@ptr={0x70742a85, 0x0, &(0x7f0000000140)=""/51, 0x33, 0x2, 0x25}, @flat=@weak_handle={0x77682a85, 0x1}, @flat=@binder={0x73622a85, 0xa, 0x3}}, &(0x7f0000000280)={0x0, 0x28, 0x40}}, 0x1f8aed83e3349436}, @exit_looper, @transaction_sg={0x40486311, {0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x68, 0x18, &(0x7f0000000480)={@ptr={0x70742a85, 0x0, &(0x7f00000002c0)=""/11, 0xb, 0x2, 0x3f}, @fd={0x66642a85, 0x0, r0}, @ptr={0x70742a85, 0x0, &(0x7f0000000380)=""/70, 0x46, 0x1, 0x1f}}, &(0x7f0000000500)={0x0, 0x28, 0x40}}, 0x1000}], 0x14, 0x0, &(0x7f0000000680)="86621f50fcee8bdc5bf8c503a78812261b4bf6d7"}) 18:06:58 executing program 5: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000001a00)='/dev/net/tun\x00', 0x0, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000080)="c0dc00025e0b01047be070") ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000300)={'nr0\x01\x00', 0x1132}) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000001a00)='/dev/net/tun\x00', 0x2, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000300)={'nr0\x01\x00', 0x1132}) write$cgroup_int(0xffffffffffffffff, &(0x7f00000000c0)=0x2, 0xfffffffffffffe75) close(r1) [ 2589.987487] binder: 2541:2558 transaction failed 29189/-22, size 80-24 line 3014 [ 2589.987775] binder: undelivered TRANSACTION_ERROR: 29189 18:06:58 executing program 4: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000040)='/dev/net/tun\x00', 0x0, 0x0) r1 = epoll_create1(0x0) epoll_ctl$EPOLL_CTL_ADD(0xffffffffffffffff, 0x1, r0, &(0x7f0000000100)) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000080)={'tunl0\x00', 0x1}) epoll_wait(r1, &(0x7f00000000c0)=[{}], 0x1, 0x0) 18:06:58 executing program 3: r0 = socket(0x10, 0x3, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") ioctl$sock_ifreq(r0, 0x89f3, &(0x7f0000000240)={'sit0\x00'}) 18:06:58 executing program 1: clone(0x2102001fff, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) socket(0x0, 0x0, 0x0) r0 = getpid() rt_tgsigqueueinfo(0x0, r0, 0x16, &(0x7f0000000100)) rt_sigqueueinfo(r0, 0x7, &(0x7f0000000180)={0x0, 0x0, 0xffffffff}) [ 2590.062243] binder: 2564:2576 Release 1 refcount change on invalid ref 2 ret -22 18:06:58 executing program 2: ioctl$FS_IOC_RESVSP(0xffffffffffffffff, 0x40305828, &(0x7f00000000c0)={0x0, 0x0, 0x100000000000001}) clone(0x2102001fff, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) socket(0x0, 0x0, 0x0) r0 = getpid() rt_tgsigqueueinfo(0x0, r0, 0x16, &(0x7f0000000100)) ptrace(0x10, r0) ptrace$poke(0x4209, r0, &(0x7f00000000c0), 0x70effd) 18:06:58 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000006c0)={0x118, 0x0, &(0x7f0000000540)=[@release={0x40046306, 0x2}, @acquire_done, @acquire_done={0x40106309, 0x3}, @transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x50, 0x18, &(0x7f0000000080)={@flat=@binder={0x73622a85, 0xa, 0x1}, @fda={0x66646185, 0xa, 0x1, 0x9}, @fd={0x66642a85, 0x0, r1}}, &(0x7f0000000100)={0x0, 0x18, 0x38}}, 0x1000}, @transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000180)={@ptr={0x70742a85, 0x0, &(0x7f0000000140)=""/51, 0x33, 0x2, 0x25}, @flat=@weak_handle={0x77682a85, 0x1}, @flat=@binder={0x73622a85, 0xa, 0x3}}, &(0x7f0000000280)={0x0, 0x28, 0x40}}, 0x1f8aed83e3349436}, @exit_looper, @transaction_sg={0x40486311, {0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x68, 0x18, &(0x7f0000000480)={@ptr={0x70742a85, 0x0, &(0x7f00000002c0)=""/11, 0xb, 0x2, 0x3f}, @fd={0x66642a85, 0x0, r0}, @ptr={0x70742a85, 0x0, &(0x7f0000000380)=""/70, 0x46, 0x1, 0x1f}}, &(0x7f0000000500)={0x0, 0x28, 0x40}}, 0x1000}], 0x14, 0x0, &(0x7f0000000680)="86621f50fcee8bdc5bf8c503a78812261b4bf6d7"}) [ 2590.062253] binder: 2564:2576 BC_ACQUIRE_DONE u0000000000000000 no match [ 2590.062260] binder: 2564:2576 BC_ACQUIRE_DONE u0000000000000003 no match [ 2590.062274] binder: 2564:2576 transaction failed 29189/-22, size 80-24 line 3014 [ 2590.062538] binder: undelivered TRANSACTION_ERROR: 29189 [ 2590.340075] binder: 2636:2648 Release 1 refcount change on invalid ref 2 ret -22 18:06:59 executing program 3: r0 = socket(0x10, 0x3, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") ioctl$sock_ifreq(r0, 0x89f3, &(0x7f0000000240)={'sit0\x00'}) 18:06:59 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000006c0)={0x118, 0x0, &(0x7f0000000540)=[@release={0x40046306, 0x2}, @acquire_done, @acquire_done={0x40106309, 0x3}, @transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x50, 0x18, &(0x7f0000000080)={@flat=@binder={0x73622a85, 0xa, 0x1}, @fda={0x66646185, 0xa, 0x1, 0x9}, @fd={0x66642a85, 0x0, r1}}, &(0x7f0000000100)={0x0, 0x18, 0x38}}, 0x1000}, @transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000180)={@ptr={0x70742a85, 0x0, &(0x7f0000000140)=""/51, 0x33, 0x2, 0x25}, @flat=@weak_handle={0x77682a85, 0x1}, @flat=@binder={0x73622a85, 0xa, 0x3}}, &(0x7f0000000280)={0x0, 0x28, 0x40}}, 0x1f8aed83e3349436}, @exit_looper, @transaction_sg={0x40486311, {0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x68, 0x18, &(0x7f0000000480)={@ptr={0x70742a85, 0x0, &(0x7f00000002c0)=""/11, 0xb, 0x2, 0x3f}, @fd={0x66642a85, 0x0, r0}, @ptr={0x70742a85, 0x0, &(0x7f0000000380)=""/70, 0x46, 0x1, 0x1f}}, &(0x7f0000000500)={0x0, 0x28, 0x40}}, 0x1000}], 0x14, 0x0, &(0x7f0000000680)="86621f50fcee8bdc5bf8c503a78812261b4bf6d7"}) 18:06:59 executing program 1: clone(0x2102001fff, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) socket(0x0, 0x0, 0x0) r0 = getpid() rt_tgsigqueueinfo(0x0, r0, 0x16, &(0x7f0000000100)) rt_sigqueueinfo(r0, 0x7, &(0x7f0000000180)={0x0, 0x0, 0xffffffff}) [ 2590.340085] binder: 2636:2648 BC_ACQUIRE_DONE u0000000000000000 no match [ 2590.340093] binder: 2636:2648 BC_ACQUIRE_DONE u0000000000000003 no match [ 2590.340106] binder: 2636:2648 transaction failed 29189/-22, size 80-24 line 3014 [ 2590.340891] binder: undelivered TRANSACTION_ERROR: 29189 18:06:59 executing program 4: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000040)='/dev/net/tun\x00', 0x0, 0x0) r1 = epoll_create1(0x0) epoll_ctl$EPOLL_CTL_ADD(0xffffffffffffffff, 0x1, r0, &(0x7f0000000100)) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000080)={'tunl0\x00', 0x1}) epoll_wait(r1, &(0x7f00000000c0)=[{}], 0x1, 0x0) 18:06:59 executing program 3: r0 = socket(0x10, 0x3, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") ioctl$sock_ifreq(r0, 0x89f3, &(0x7f0000000240)={'sit0\x00'}) 18:06:59 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000006c0)={0x118, 0x0, &(0x7f0000000540)=[@release={0x40046306, 0x2}, @acquire_done, @acquire_done={0x40106309, 0x3}, @transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x50, 0x18, &(0x7f0000000080)={@flat=@binder={0x73622a85, 0xa, 0x1}, @fda={0x66646185, 0xa, 0x1, 0x9}, @fd={0x66642a85, 0x0, r1}}, &(0x7f0000000100)={0x0, 0x18, 0x38}}, 0x1000}, @transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000180)={@ptr={0x70742a85, 0x0, &(0x7f0000000140)=""/51, 0x33, 0x2, 0x25}, @flat=@weak_handle={0x77682a85, 0x1}, @flat=@binder={0x73622a85, 0xa, 0x3}}, &(0x7f0000000280)={0x0, 0x28, 0x40}}, 0x1f8aed83e3349436}, @exit_looper, @transaction_sg={0x40486311, {0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x68, 0x18, &(0x7f0000000480)={@ptr={0x70742a85, 0x0, &(0x7f00000002c0)=""/11, 0xb, 0x2, 0x3f}, @fd={0x66642a85, 0x0, r0}, @ptr={0x70742a85, 0x0, &(0x7f0000000380)=""/70, 0x46, 0x1, 0x1f}}, &(0x7f0000000500)={0x0, 0x28, 0x40}}, 0x1000}], 0x14, 0x0, &(0x7f0000000680)="86621f50fcee8bdc5bf8c503a78812261b4bf6d7"}) [ 2590.449436] binder: 2677:2710 Release 1 refcount change on invalid ref 2 ret -22 [ 2590.449446] binder: 2677:2710 BC_ACQUIRE_DONE u0000000000000000 no match [ 2590.449454] binder: 2677:2710 BC_ACQUIRE_DONE u0000000000000003 no match 18:06:59 executing program 5: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000001a00)='/dev/net/tun\x00', 0x0, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000080)="c0dc00025e0b01047be070") ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000300)={'nr0\x01\x00', 0x1132}) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000001a00)='/dev/net/tun\x00', 0x2, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000300)={'nr0\x01\x00', 0x1132}) write$cgroup_int(0xffffffffffffffff, &(0x7f00000000c0)=0x2, 0xfffffffffffffe75) close(r1) [ 2590.449466] binder: 2677:2710 transaction failed 29189/-22, size 80-24 line 3014 18:06:59 executing program 2: ioctl$FS_IOC_RESVSP(0xffffffffffffffff, 0x40305828, &(0x7f00000000c0)={0x0, 0x0, 0x100000000000001}) clone(0x2102001fff, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) socket(0x0, 0x0, 0x0) r0 = getpid() rt_tgsigqueueinfo(0x0, r0, 0x16, &(0x7f0000000100)) ptrace(0x10, r0) ptrace$poke(0x4209, r0, &(0x7f00000000c0), 0x70effd) 18:06:59 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000006c0)={0x118, 0x0, &(0x7f0000000540)=[@release={0x40046306, 0x2}, @acquire_done, @acquire_done={0x40106309, 0x3}, @transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x50, 0x18, &(0x7f0000000080)={@flat=@binder={0x73622a85, 0xa, 0x1}, @fda={0x66646185, 0xa, 0x1, 0x9}, @fd={0x66642a85, 0x0, r1}}, &(0x7f0000000100)={0x0, 0x18, 0x38}}, 0x1000}, @transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000180)={@ptr={0x70742a85, 0x0, &(0x7f0000000140)=""/51, 0x33, 0x2, 0x25}, @flat=@weak_handle={0x77682a85, 0x1}, @flat=@binder={0x73622a85, 0xa, 0x3}}, &(0x7f0000000280)={0x0, 0x28, 0x40}}, 0x1f8aed83e3349436}, @exit_looper, @transaction_sg={0x40486311, {0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x68, 0x18, &(0x7f0000000480)={@ptr={0x70742a85, 0x0, &(0x7f00000002c0)=""/11, 0xb, 0x2, 0x3f}, @fd={0x66642a85, 0x0, r0}, @ptr={0x70742a85, 0x0, &(0x7f0000000380)=""/70, 0x46, 0x1, 0x1f}}, &(0x7f0000000500)={0x0, 0x28, 0x40}}, 0x1000}], 0x14, 0x0, &(0x7f0000000680)="86621f50fcee8bdc5bf8c503a78812261b4bf6d7"}) 18:06:59 executing program 3: r0 = socket(0x10, 0x3, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") ioctl$sock_ifreq(r0, 0x89f3, &(0x7f0000000240)={'sit0\x00'}) 18:06:59 executing program 1: clone(0x2102001fff, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) socket(0x0, 0x0, 0x0) r0 = getpid() rt_tgsigqueueinfo(0x0, r0, 0x16, &(0x7f0000000100)) rt_sigqueueinfo(r0, 0x7, &(0x7f0000000180)={0x0, 0x0, 0xffffffff}) [ 2590.449767] binder: undelivered TRANSACTION_ERROR: 29189 18:06:59 executing program 4: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000040)='/dev/net/tun\x00', 0x0, 0x0) r1 = epoll_create1(0x0) epoll_ctl$EPOLL_CTL_ADD(0xffffffffffffffff, 0x1, r0, &(0x7f0000000100)) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000080)={'tunl0\x00', 0x1}) epoll_wait(r1, &(0x7f00000000c0)=[{}], 0x1, 0x0) [ 2590.619557] binder: 2733:2752 Release 1 refcount change on invalid ref 2 ret -22 18:06:59 executing program 3: r0 = socket(0x10, 0x3, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") ioctl$sock_ifreq(r0, 0x89f3, &(0x7f0000000240)={'sit0\x00'}) 18:06:59 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000006c0)={0x118, 0x0, &(0x7f0000000540)=[@release={0x40046306, 0x2}, @acquire_done, @acquire_done={0x40106309, 0x3}, @transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x50, 0x18, &(0x7f0000000080)={@flat=@binder={0x73622a85, 0xa, 0x1}, @fda={0x66646185, 0xa, 0x1, 0x9}, @fd={0x66642a85, 0x0, r1}}, &(0x7f0000000100)={0x0, 0x18, 0x38}}, 0x1000}, @transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000180)={@ptr={0x70742a85, 0x0, &(0x7f0000000140)=""/51, 0x33, 0x2, 0x25}, @flat=@weak_handle={0x77682a85, 0x1}, @flat=@binder={0x73622a85, 0xa, 0x3}}, &(0x7f0000000280)={0x0, 0x28, 0x40}}, 0x1f8aed83e3349436}, @exit_looper, @transaction_sg={0x40486311, {0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x68, 0x18, &(0x7f0000000480)={@ptr={0x70742a85, 0x0, &(0x7f00000002c0)=""/11, 0xb, 0x2, 0x3f}, @fd={0x66642a85, 0x0, r0}, @ptr={0x70742a85, 0x0, &(0x7f0000000380)=""/70, 0x46, 0x1, 0x1f}}, &(0x7f0000000500)={0x0, 0x28, 0x40}}, 0x1000}], 0x14, 0x0, &(0x7f0000000680)="86621f50fcee8bdc5bf8c503a78812261b4bf6d7"}) [ 2590.619568] binder: 2733:2752 BC_ACQUIRE_DONE u0000000000000000 no match [ 2590.619578] binder: 2733:2752 BC_ACQUIRE_DONE u0000000000000003 no match [ 2590.619594] binder: 2733:2752 transaction failed 29189/-22, size 80-24 line 3014 18:06:59 executing program 1: clone(0x2102001fff, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) socket(0x0, 0x0, 0x0) r0 = getpid() rt_tgsigqueueinfo(0x0, r0, 0x16, &(0x7f0000000100)) rt_sigqueueinfo(r0, 0x7, &(0x7f0000000180)={0x0, 0x0, 0xffffffff}) 18:06:59 executing program 3: r0 = socket(0x10, 0x3, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") ioctl$sock_ifreq(r0, 0x89f3, &(0x7f0000000240)={'sit0\x00'}) 18:06:59 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000006c0)={0x118, 0x0, &(0x7f0000000540)=[@release={0x40046306, 0x2}, @acquire_done, @acquire_done={0x40106309, 0x3}, @transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x50, 0x18, &(0x7f0000000080)={@flat=@binder={0x73622a85, 0xa, 0x1}, @fda={0x66646185, 0xa, 0x1, 0x9}, @fd={0x66642a85, 0x0, r1}}, &(0x7f0000000100)={0x0, 0x18, 0x38}}, 0x1000}, @transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000180)={@ptr={0x70742a85, 0x0, &(0x7f0000000140)=""/51, 0x33, 0x2, 0x25}, @flat=@weak_handle={0x77682a85, 0x1}, @flat=@binder={0x73622a85, 0xa, 0x3}}, &(0x7f0000000280)={0x0, 0x28, 0x40}}, 0x1f8aed83e3349436}, @exit_looper, @transaction_sg={0x40486311, {0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x68, 0x18, &(0x7f0000000480)={@ptr={0x70742a85, 0x0, &(0x7f00000002c0)=""/11, 0xb, 0x2, 0x3f}, @fd={0x66642a85, 0x0, r0}, @ptr={0x70742a85, 0x0, &(0x7f0000000380)=""/70, 0x46, 0x1, 0x1f}}, &(0x7f0000000500)={0x0, 0x28, 0x40}}, 0x1000}], 0x14, 0x0, &(0x7f0000000680)="86621f50fcee8bdc5bf8c503a78812261b4bf6d7"}) 18:06:59 executing program 5: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000001a00)='/dev/net/tun\x00', 0x0, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000080)="c0dc00025e0b01047be070") ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000300)={'nr0\x01\x00', 0x1132}) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000001a00)='/dev/net/tun\x00', 0x2, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000300)={'nr0\x01\x00', 0x1132}) write$cgroup_int(0xffffffffffffffff, &(0x7f00000000c0)=0x2, 0xfffffffffffffe75) close(r1) [ 2590.619928] binder: undelivered TRANSACTION_ERROR: 29189 [ 2590.702362] binder: 2784:2809 Release 1 refcount change on invalid ref 2 ret -22 18:06:59 executing program 3: r0 = socket(0x10, 0x3, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") ioctl$sock_ifreq(r0, 0x89f3, &(0x7f0000000240)={'sit0\x00'}) [ 2590.702372] binder: 2784:2809 BC_ACQUIRE_DONE u0000000000000000 no match [ 2590.702380] binder: 2784:2809 BC_ACQUIRE_DONE u0000000000000003 no match [ 2590.702392] binder: 2784:2809 transaction failed 29189/-22, size 80-24 line 3014 [ 2590.702694] binder: undelivered TRANSACTION_ERROR: 29189 [ 2590.860624] binder: 2844:2858 Release 1 refcount change on invalid ref 2 ret -22 [ 2590.860635] binder: 2844:2858 BC_ACQUIRE_DONE u0000000000000000 no match [ 2590.860641] binder: 2844:2858 BC_ACQUIRE_DONE u0000000000000003 no match [ 2590.860654] binder: 2844:2858 transaction failed 29189/-22, size 80-24 line 3014 [ 2590.861160] binder: undelivered TRANSACTION_ERROR: 29189 [ 2591.000445] binder: 2925:2935 Release 1 refcount change on invalid ref 2 ret -22 18:06:59 executing program 2: ioctl$FS_IOC_RESVSP(0xffffffffffffffff, 0x40305828, &(0x7f00000000c0)={0x0, 0x0, 0x100000000000001}) clone(0x2102001fff, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) socket(0x0, 0x0, 0x0) r0 = getpid() rt_tgsigqueueinfo(0x0, r0, 0x16, &(0x7f0000000100)) ptrace(0x10, r0) ptrace$poke(0x4209, r0, &(0x7f00000000c0), 0x70effd) 18:06:59 executing program 4: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000040)='/dev/net/tun\x00', 0x0, 0x0) r1 = epoll_create1(0x0) epoll_ctl$EPOLL_CTL_ADD(0xffffffffffffffff, 0x1, r0, &(0x7f0000000100)) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000080)={'tunl0\x00', 0x1}) epoll_wait(r1, &(0x7f00000000c0)=[{}], 0x1, 0x0) 18:06:59 executing program 1: clone(0x2102001fff, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) socket(0x0, 0x0, 0x0) r0 = getpid() rt_tgsigqueueinfo(0x0, r0, 0x16, &(0x7f0000000100)) rt_sigqueueinfo(r0, 0x7, &(0x7f0000000180)={0x0, 0x0, 0xffffffff}) 18:06:59 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000006c0)={0x118, 0x0, &(0x7f0000000540)=[@release={0x40046306, 0x2}, @acquire_done, @acquire_done={0x40106309, 0x3}, @transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x50, 0x18, &(0x7f0000000080)={@flat=@binder={0x73622a85, 0xa, 0x1}, @fda={0x66646185, 0xa, 0x1, 0x9}, @fd={0x66642a85, 0x0, r1}}, &(0x7f0000000100)={0x0, 0x18, 0x38}}, 0x1000}, @transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000180)={@ptr={0x70742a85, 0x0, &(0x7f0000000140)=""/51, 0x33, 0x2, 0x25}, @flat=@weak_handle={0x77682a85, 0x1}, @flat=@binder={0x73622a85, 0xa, 0x3}}, &(0x7f0000000280)={0x0, 0x28, 0x40}}, 0x1f8aed83e3349436}, @exit_looper, @transaction_sg={0x40486311, {0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x68, 0x18, &(0x7f0000000480)={@ptr={0x70742a85, 0x0, &(0x7f00000002c0)=""/11, 0xb, 0x2, 0x3f}, @fd={0x66642a85, 0x0, r0}, @ptr={0x70742a85, 0x0, &(0x7f0000000380)=""/70, 0x46, 0x1, 0x1f}}, &(0x7f0000000500)={0x0, 0x28, 0x40}}, 0x1000}], 0x14, 0x0, &(0x7f0000000680)="86621f50fcee8bdc5bf8c503a78812261b4bf6d7"}) [ 2591.000455] binder: 2925:2935 BC_ACQUIRE_DONE u0000000000000000 no match [ 2591.000462] binder: 2925:2935 BC_ACQUIRE_DONE u0000000000000003 no match [ 2591.000475] binder: 2925:2935 transaction failed 29189/-22, size 80-24 line 3014 [ 2591.005529] binder: undelivered TRANSACTION_ERROR: 29189 [ 2591.116629] binder: 2954:2958 Release 1 refcount change on invalid ref 2 ret -22 [ 2591.116639] binder: 2954:2958 BC_ACQUIRE_DONE u0000000000000000 no match [ 2591.116647] binder: 2954:2958 BC_ACQUIRE_DONE u0000000000000003 no match [ 2591.116661] binder: 2954:2958 transaction failed 29189/-22, size 80-24 line 3014 [ 2591.121823] binder: undelivered TRANSACTION_ERROR: 29189 [ 2591.243868] binder: 3015:3023 Release 1 refcount change on invalid ref 2 ret -22 [ 2591.243878] binder: 3015:3023 BC_ACQUIRE_DONE u0000000000000000 no match [ 2591.243886] binder: 3015:3023 BC_ACQUIRE_DONE u0000000000000003 no match [ 2591.243899] binder: 3015:3023 transaction failed 29189/-22, size 80-24 line 3014 [ 2591.244774] binder: undelivered TRANSACTION_ERROR: 29189 [ 2591.713488] binder: 3115:3122 Release 1 refcount change on invalid ref 2 ret -22 [ 2591.713508] binder: 3115:3122 BC_ACQUIRE_DONE u0000000000000000 no match [ 2591.713516] binder: 3115:3122 BC_ACQUIRE_DONE u0000000000000003 no match 18:07:00 executing program 3: r0 = socket(0x10, 0x3, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") ioctl$sock_ifreq(r0, 0x89f3, &(0x7f0000000240)={'sit0\x00'}) 18:07:00 executing program 1: clone(0x2102001fff, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) socket(0x0, 0x0, 0x0) r0 = getpid() rt_tgsigqueueinfo(0x0, r0, 0x16, &(0x7f0000000100)) rt_sigqueueinfo(r0, 0x7, &(0x7f0000000180)={0x0, 0x0, 0xffffffff}) [ 2591.713529] binder: 3115:3122 transaction failed 29189/-22, size 80-24 line 3014 18:07:00 executing program 3: r0 = socket(0x10, 0x3, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") ioctl$sock_ifreq(r0, 0x89f3, &(0x7f0000000240)={'sit0\x00'}) 18:07:00 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000006c0)={0x118, 0x0, &(0x7f0000000540)=[@release={0x40046306, 0x2}, @acquire_done, @acquire_done={0x40106309, 0x3}, @transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x50, 0x18, &(0x7f0000000080)={@flat=@binder={0x73622a85, 0xa, 0x1}, @fda={0x66646185, 0xa, 0x1, 0x9}, @fd={0x66642a85, 0x0, r1}}, &(0x7f0000000100)={0x0, 0x18, 0x38}}, 0x1000}, @transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000180)={@ptr={0x70742a85, 0x0, &(0x7f0000000140)=""/51, 0x33, 0x2, 0x25}, @flat=@weak_handle={0x77682a85, 0x1}, @flat=@binder={0x73622a85, 0xa, 0x3}}, &(0x7f0000000280)={0x0, 0x28, 0x40}}, 0x1f8aed83e3349436}, @exit_looper, @transaction_sg={0x40486311, {0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x68, 0x18, &(0x7f0000000480)={@ptr={0x70742a85, 0x0, &(0x7f00000002c0)=""/11, 0xb, 0x2, 0x3f}, @fd={0x66642a85, 0x0, r0}, @ptr={0x70742a85, 0x0, &(0x7f0000000380)=""/70, 0x46, 0x1, 0x1f}}, &(0x7f0000000500)={0x0, 0x28, 0x40}}, 0x1000}], 0x14, 0x0, &(0x7f0000000680)="86621f50fcee8bdc5bf8c503a78812261b4bf6d7"}) [ 2591.713820] binder: undelivered TRANSACTION_ERROR: 29189 [ 2591.814722] binder: 3150:3151 Release 1 refcount change on invalid ref 2 ret -22 [ 2591.814732] binder: 3150:3151 BC_ACQUIRE_DONE u0000000000000000 no match [ 2591.814739] binder: 3150:3151 BC_ACQUIRE_DONE u0000000000000003 no match 18:07:00 executing program 4: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000040)='/dev/net/tun\x00', 0x0, 0x0) r1 = epoll_create1(0x0) epoll_ctl$EPOLL_CTL_ADD(0xffffffffffffffff, 0x1, r0, &(0x7f0000000100)) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000080)={'tunl0\x00', 0x1}) epoll_wait(r1, &(0x7f00000000c0)=[{}], 0x1, 0x0) 18:07:00 executing program 1: clone(0x2102001fff, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) socket(0x0, 0x0, 0x0) r0 = getpid() rt_tgsigqueueinfo(0x0, r0, 0x16, &(0x7f0000000100)) rt_sigqueueinfo(r0, 0x7, &(0x7f0000000180)={0x0, 0x0, 0xffffffff}) 18:07:00 executing program 5: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000001a00)='/dev/net/tun\x00', 0x0, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000080)="c0dc00025e0b01047be070") ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000300)={'nr0\x01\x00', 0x1132}) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000001a00)='/dev/net/tun\x00', 0x2, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000300)={'nr0\x01\x00', 0x1132}) write$cgroup_int(0xffffffffffffffff, &(0x7f00000000c0)=0x2, 0xfffffffffffffe75) close(r1) 18:07:00 executing program 3: r0 = socket(0x10, 0x3, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") ioctl$sock_ifreq(r0, 0x89f3, &(0x7f0000000240)={'sit0\x00'}) 18:07:00 executing program 2: ioctl$FS_IOC_RESVSP(0xffffffffffffffff, 0x40305828, &(0x7f00000000c0)={0x0, 0x0, 0x100000000000001}) clone(0x2102001fff, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) socket(0x0, 0x0, 0x0) r0 = getpid() rt_tgsigqueueinfo(0x0, r0, 0x16, &(0x7f0000000100)) ptrace(0x10, r0) ptrace$poke(0x4209, r0, &(0x7f00000000c0), 0x70effd) 18:07:00 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000006c0)={0x118, 0x0, &(0x7f0000000540)=[@release={0x40046306, 0x2}, @acquire_done, @acquire_done={0x40106309, 0x3}, @transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x50, 0x18, &(0x7f0000000080)={@flat=@binder={0x73622a85, 0xa, 0x1}, @fda={0x66646185, 0xa, 0x1, 0x9}, @fd={0x66642a85, 0x0, r1}}, &(0x7f0000000100)={0x0, 0x18, 0x38}}, 0x1000}, @transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000180)={@ptr={0x70742a85, 0x0, &(0x7f0000000140)=""/51, 0x33, 0x2, 0x25}, @flat=@weak_handle={0x77682a85, 0x1}, @flat=@binder={0x73622a85, 0xa, 0x3}}, &(0x7f0000000280)={0x0, 0x28, 0x40}}, 0x1f8aed83e3349436}, @exit_looper, @transaction_sg={0x40486311, {0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x68, 0x18, &(0x7f0000000480)={@ptr={0x70742a85, 0x0, &(0x7f00000002c0)=""/11, 0xb, 0x2, 0x3f}, @fd={0x66642a85, 0x0, r0}, @ptr={0x70742a85, 0x0, &(0x7f0000000380)=""/70, 0x46, 0x1, 0x1f}}, &(0x7f0000000500)={0x0, 0x28, 0x40}}, 0x1000}], 0x14, 0x0, &(0x7f0000000680)="86621f50fcee8bdc5bf8c503a78812261b4bf6d7"}) [ 2591.814752] binder: 3150:3151 transaction failed 29189/-22, size 80-24 line 3014 [ 2591.815056] binder: undelivered TRANSACTION_ERROR: 29189 [ 2591.929198] binder: 3170:3186 Release 1 refcount change on invalid ref 2 ret -22 18:07:00 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000006c0)={0x118, 0x0, &(0x7f0000000540)=[@release={0x40046306, 0x2}, @acquire_done, @acquire_done={0x40106309, 0x3}, @transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x50, 0x18, &(0x7f0000000080)={@flat=@binder={0x73622a85, 0xa, 0x1}, @fda={0x66646185, 0xa, 0x1, 0x9}, @fd={0x66642a85, 0x0, r1}}, &(0x7f0000000100)={0x0, 0x18, 0x38}}, 0x1000}, @transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000180)={@ptr={0x70742a85, 0x0, &(0x7f0000000140)=""/51, 0x33, 0x2, 0x25}, @flat=@weak_handle={0x77682a85, 0x1}, @flat=@binder={0x73622a85, 0xa, 0x3}}, &(0x7f0000000280)={0x0, 0x28, 0x40}}, 0x1f8aed83e3349436}, @exit_looper, @transaction_sg={0x40486311, {0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x68, 0x18, &(0x7f0000000480)={@ptr={0x70742a85, 0x0, &(0x7f00000002c0)=""/11, 0xb, 0x2, 0x3f}, @fd={0x66642a85, 0x0, r0}, @ptr={0x70742a85, 0x0, &(0x7f0000000380)=""/70, 0x46, 0x1, 0x1f}}, &(0x7f0000000500)={0x0, 0x28, 0x40}}, 0x1000}], 0x14, 0x0, &(0x7f0000000680)="86621f50fcee8bdc5bf8c503a78812261b4bf6d7"}) 18:07:00 executing program 3: r0 = socket(0x10, 0x3, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") ioctl$sock_ifreq(r0, 0x89f3, &(0x7f0000000240)={'sit0\x00'}) [ 2591.929207] binder: 3170:3186 BC_ACQUIRE_DONE u0000000000000000 no match [ 2591.929216] binder: 3170:3186 BC_ACQUIRE_DONE u0000000000000003 no match [ 2591.929230] binder: 3170:3186 transaction failed 29189/-22, size 80-24 line 3014 [ 2591.932176] binder: undelivered TRANSACTION_ERROR: 29189 18:07:00 executing program 1: clone(0x2102001fff, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) socket(0x0, 0x0, 0x0) r0 = getpid() rt_tgsigqueueinfo(0x0, r0, 0x16, &(0x7f0000000100)) rt_sigqueueinfo(r0, 0x7, &(0x7f0000000180)={0x0, 0x0, 0xffffffff}) 18:07:00 executing program 3: r0 = socket(0x10, 0x3, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") ioctl$sock_ifreq(r0, 0x89f3, &(0x7f0000000240)={'sit0\x00'}) [ 2592.116079] binder: 3231:3233 Release 1 refcount change on invalid ref 2 ret -22 [ 2592.116088] binder: 3231:3233 BC_ACQUIRE_DONE u0000000000000000 no match 18:07:00 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000006c0)={0x118, 0x0, &(0x7f0000000540)=[@release={0x40046306, 0x2}, @acquire_done, @acquire_done={0x40106309, 0x3}, @transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x50, 0x18, &(0x7f0000000080)={@flat=@binder={0x73622a85, 0xa, 0x1}, @fda={0x66646185, 0xa, 0x1, 0x9}, @fd={0x66642a85, 0x0, r1}}, &(0x7f0000000100)={0x0, 0x18, 0x38}}, 0x1000}, @transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000180)={@ptr={0x70742a85, 0x0, &(0x7f0000000140)=""/51, 0x33, 0x2, 0x25}, @flat=@weak_handle={0x77682a85, 0x1}, @flat=@binder={0x73622a85, 0xa, 0x3}}, &(0x7f0000000280)={0x0, 0x28, 0x40}}, 0x1f8aed83e3349436}, @exit_looper, @transaction_sg={0x40486311, {0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x68, 0x18, &(0x7f0000000480)={@ptr={0x70742a85, 0x0, &(0x7f00000002c0)=""/11, 0xb, 0x2, 0x3f}, @fd={0x66642a85, 0x0, r0}, @ptr={0x70742a85, 0x0, &(0x7f0000000380)=""/70, 0x46, 0x1, 0x1f}}, &(0x7f0000000500)={0x0, 0x28, 0x40}}, 0x1000}], 0x14, 0x0, &(0x7f0000000680)="86621f50fcee8bdc5bf8c503a78812261b4bf6d7"}) 18:07:00 executing program 4: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000040)='/dev/net/tun\x00', 0x0, 0x0) r1 = epoll_create1(0x0) epoll_ctl$EPOLL_CTL_ADD(0xffffffffffffffff, 0x1, r0, &(0x7f0000000100)) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000080)={'tunl0\x00', 0x1}) epoll_wait(r1, &(0x7f00000000c0)=[{}], 0x1, 0x0) [ 2592.116096] binder: 3231:3233 BC_ACQUIRE_DONE u0000000000000003 no match 18:07:00 executing program 1: clone(0x2102001fff, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) socket(0x0, 0x0, 0x0) r0 = getpid() rt_tgsigqueueinfo(0x0, r0, 0x16, &(0x7f0000000100)) rt_sigqueueinfo(r0, 0x7, &(0x7f0000000180)={0x0, 0x0, 0xffffffff}) 18:07:00 executing program 5: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000001a00)='/dev/net/tun\x00', 0x0, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000080)="c0dc00025e0b01047be070") ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000300)={'nr0\x01\x00', 0x1132}) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000001a00)='/dev/net/tun\x00', 0x2, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000300)={'nr0\x01\x00', 0x1132}) write$cgroup_int(0xffffffffffffffff, &(0x7f00000000c0)=0x2, 0xfffffffffffffe75) close(r1) 18:07:00 executing program 3: r0 = socket(0x10, 0x3, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") ioctl$sock_ifreq(r0, 0x89f3, &(0x7f0000000240)={'sit0\x00'}) 18:07:00 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000006c0)={0x118, 0x0, &(0x7f0000000540)=[@release={0x40046306, 0x2}, @acquire_done, @acquire_done={0x40106309, 0x3}, @transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x50, 0x18, &(0x7f0000000080)={@flat=@binder={0x73622a85, 0xa, 0x1}, @fda={0x66646185, 0xa, 0x1, 0x9}, @fd={0x66642a85, 0x0, r1}}, &(0x7f0000000100)={0x0, 0x18, 0x38}}, 0x1000}, @transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000180)={@ptr={0x70742a85, 0x0, &(0x7f0000000140)=""/51, 0x33, 0x2, 0x25}, @flat=@weak_handle={0x77682a85, 0x1}, @flat=@binder={0x73622a85, 0xa, 0x3}}, &(0x7f0000000280)={0x0, 0x28, 0x40}}, 0x1f8aed83e3349436}, @exit_looper, @transaction_sg={0x40486311, {0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x68, 0x18, &(0x7f0000000480)={@ptr={0x70742a85, 0x0, &(0x7f00000002c0)=""/11, 0xb, 0x2, 0x3f}, @fd={0x66642a85, 0x0, r0}, @ptr={0x70742a85, 0x0, &(0x7f0000000380)=""/70, 0x46, 0x1, 0x1f}}, &(0x7f0000000500)={0x0, 0x28, 0x40}}, 0x1000}], 0x14, 0x0, &(0x7f0000000680)="86621f50fcee8bdc5bf8c503a78812261b4bf6d7"}) [ 2592.116109] binder: 3231:3233 transaction failed 29189/-22, size 80-24 line 3014 18:07:00 executing program 2: ioctl$FS_IOC_RESVSP(0xffffffffffffffff, 0x40305828, &(0x7f00000000c0)={0x0, 0x0, 0x100000000000001}) clone(0x2102001fff, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) socket(0x0, 0x0, 0x0) r0 = getpid() rt_tgsigqueueinfo(0x0, r0, 0x16, &(0x7f0000000100)) ptrace(0x10, r0) ptrace$poke(0x4209, r0, &(0x7f00000000c0), 0x70effd) 18:07:00 executing program 3: r0 = socket(0x10, 0x3, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") ioctl$sock_ifreq(r0, 0x89f3, &(0x7f0000000240)={'sit0\x00'}) 18:07:00 executing program 1: clone(0x2102001fff, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) socket(0x0, 0x0, 0x0) r0 = getpid() rt_tgsigqueueinfo(0x0, r0, 0x16, &(0x7f0000000100)) rt_sigqueueinfo(r0, 0x7, &(0x7f0000000180)={0x0, 0x0, 0xffffffff}) 18:07:00 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000006c0)={0x118, 0x0, &(0x7f0000000540)=[@release={0x40046306, 0x2}, @acquire_done, @acquire_done={0x40106309, 0x3}, @transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x50, 0x18, &(0x7f0000000080)={@flat=@binder={0x73622a85, 0xa, 0x1}, @fda={0x66646185, 0xa, 0x1, 0x9}, @fd={0x66642a85, 0x0, r1}}, &(0x7f0000000100)={0x0, 0x18, 0x38}}, 0x1000}, @transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000180)={@ptr={0x70742a85, 0x0, &(0x7f0000000140)=""/51, 0x33, 0x2, 0x25}, @flat=@weak_handle={0x77682a85, 0x1}, @flat=@binder={0x73622a85, 0xa, 0x3}}, &(0x7f0000000280)={0x0, 0x28, 0x40}}, 0x1f8aed83e3349436}, @exit_looper, @transaction_sg={0x40486311, {0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x68, 0x18, &(0x7f0000000480)={@ptr={0x70742a85, 0x0, &(0x7f00000002c0)=""/11, 0xb, 0x2, 0x3f}, @fd={0x66642a85, 0x0, r0}, @ptr={0x70742a85, 0x0, &(0x7f0000000380)=""/70, 0x46, 0x1, 0x1f}}, &(0x7f0000000500)={0x0, 0x28, 0x40}}, 0x1000}], 0x14, 0x0, &(0x7f0000000680)="86621f50fcee8bdc5bf8c503a78812261b4bf6d7"}) [ 2592.118352] binder: undelivered TRANSACTION_ERROR: 29189 [ 2592.207683] binder: 3287:3300 Release 1 refcount change on invalid ref 2 ret -22 [ 2592.207693] binder: 3287:3300 BC_ACQUIRE_DONE u0000000000000000 no match [ 2592.207701] binder: 3287:3300 BC_ACQUIRE_DONE u0000000000000003 no match 18:07:00 executing program 1: clone(0x2102001fff, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) socket(0x0, 0x0, 0x0) r0 = getpid() rt_tgsigqueueinfo(0x0, r0, 0x16, &(0x7f0000000100)) rt_sigqueueinfo(r0, 0x7, &(0x7f0000000180)={0x0, 0x0, 0xffffffff}) 18:07:00 executing program 3: r0 = socket(0x10, 0x3, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") ioctl$sock_ifreq(r0, 0x89f3, &(0x7f0000000240)={'sit0\x00'}) 18:07:00 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000006c0)={0x118, 0x0, &(0x7f0000000540)=[@release={0x40046306, 0x2}, @acquire_done, @acquire_done={0x40106309, 0x3}, @transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x50, 0x18, &(0x7f0000000080)={@flat=@binder={0x73622a85, 0xa, 0x1}, @fda={0x66646185, 0xa, 0x1, 0x9}, @fd={0x66642a85, 0x0, r1}}, &(0x7f0000000100)={0x0, 0x18, 0x38}}, 0x1000}, @transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000180)={@ptr={0x70742a85, 0x0, &(0x7f0000000140)=""/51, 0x33, 0x2, 0x25}, @flat=@weak_handle={0x77682a85, 0x1}, @flat=@binder={0x73622a85, 0xa, 0x3}}, &(0x7f0000000280)={0x0, 0x28, 0x40}}, 0x1f8aed83e3349436}, @exit_looper, @transaction_sg={0x40486311, {0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x68, 0x18, &(0x7f0000000480)={@ptr={0x70742a85, 0x0, &(0x7f00000002c0)=""/11, 0xb, 0x2, 0x3f}, @fd={0x66642a85, 0x0, r0}, @ptr={0x70742a85, 0x0, &(0x7f0000000380)=""/70, 0x46, 0x1, 0x1f}}, &(0x7f0000000500)={0x0, 0x28, 0x40}}, 0x1000}], 0x14, 0x0, &(0x7f0000000680)="86621f50fcee8bdc5bf8c503a78812261b4bf6d7"}) [ 2592.207715] binder: 3287:3300 transaction failed 29189/-22, size 80-24 line 3014 [ 2592.208160] binder: undelivered TRANSACTION_ERROR: 29189 [ 2592.270535] binder: 3323:3329 Release 1 refcount change on invalid ref 2 ret -22 [ 2592.270545] binder: 3323:3329 BC_ACQUIRE_DONE u0000000000000000 no match [ 2592.270553] binder: 3323:3329 BC_ACQUIRE_DONE u0000000000000003 no match [ 2592.270566] binder: 3323:3329 transaction failed 29189/-22, size 80-24 line 3014 [ 2592.270857] binder: undelivered TRANSACTION_ERROR: 29189 18:07:01 executing program 4: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000040)='/dev/net/tun\x00', 0x0, 0x0) r1 = epoll_create1(0x0) epoll_ctl$EPOLL_CTL_ADD(0xffffffffffffffff, 0x1, r0, &(0x7f0000000100)) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000080)={'tunl0\x00', 0x1}) epoll_wait(r1, &(0x7f00000000c0)=[{}], 0x1, 0x0) 18:07:01 executing program 3: r0 = socket(0x10, 0x3, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") ioctl$sock_ifreq(r0, 0x89f3, &(0x7f0000000240)={'sit0\x00'}) 18:07:01 executing program 2: ioctl$FS_IOC_RESVSP(0xffffffffffffffff, 0x40305828, &(0x7f00000000c0)={0x0, 0x0, 0x100000000000001}) clone(0x2102001fff, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) socket(0x0, 0x0, 0x0) r0 = getpid() rt_tgsigqueueinfo(0x0, r0, 0x16, &(0x7f0000000100)) ptrace(0x10, r0) ptrace$poke(0x4209, r0, &(0x7f00000000c0), 0x70effd) 18:07:01 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000006c0)={0x118, 0x0, &(0x7f0000000540)=[@release={0x40046306, 0x2}, @acquire_done, @acquire_done={0x40106309, 0x3}, @transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x50, 0x18, &(0x7f0000000080)={@flat=@binder={0x73622a85, 0xa, 0x1}, @fda={0x66646185, 0xa, 0x1, 0x9}, @fd={0x66642a85, 0x0, r1}}, &(0x7f0000000100)={0x0, 0x18, 0x38}}, 0x1000}, @transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000180)={@ptr={0x70742a85, 0x0, &(0x7f0000000140)=""/51, 0x33, 0x2, 0x25}, @flat=@weak_handle={0x77682a85, 0x1}, @flat=@binder={0x73622a85, 0xa, 0x3}}, &(0x7f0000000280)={0x0, 0x28, 0x40}}, 0x1f8aed83e3349436}, @exit_looper, @transaction_sg={0x40486311, {0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x68, 0x18, &(0x7f0000000480)={@ptr={0x70742a85, 0x0, &(0x7f00000002c0)=""/11, 0xb, 0x2, 0x3f}, @fd={0x66642a85, 0x0, r0}, @ptr={0x70742a85, 0x0, &(0x7f0000000380)=""/70, 0x46, 0x1, 0x1f}}, &(0x7f0000000500)={0x0, 0x28, 0x40}}, 0x1000}], 0x14, 0x0, &(0x7f0000000680)="86621f50fcee8bdc5bf8c503a78812261b4bf6d7"}) 18:07:01 executing program 5: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000001a00)='/dev/net/tun\x00', 0x0, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000080)="c0dc00025e0b01047be070") ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000300)={'nr0\x01\x00', 0x1132}) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000001a00)='/dev/net/tun\x00', 0x2, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000300)={'nr0\x01\x00', 0x1132}) write$cgroup_int(0xffffffffffffffff, &(0x7f00000000c0)=0x2, 0xfffffffffffffe75) close(r1) 18:07:01 executing program 1: clone(0x2102001fff, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) socket(0x0, 0x0, 0x0) r0 = getpid() rt_tgsigqueueinfo(0x0, r0, 0x16, &(0x7f0000000100)) rt_sigqueueinfo(r0, 0x7, &(0x7f0000000180)={0x0, 0x0, 0xffffffff}) [ 2592.382469] binder: 3341:3361 Release 1 refcount change on invalid ref 2 ret -22 [ 2592.382479] binder: 3341:3361 BC_ACQUIRE_DONE u0000000000000000 no match [ 2592.382487] binder: 3341:3361 BC_ACQUIRE_DONE u0000000000000003 no match [ 2592.382508] binder: 3341:3361 transaction failed 29189/-22, size 80-24 line 3014 18:07:01 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000006c0)={0x118, 0x0, &(0x7f0000000540)=[@release={0x40046306, 0x2}, @acquire_done, @acquire_done={0x40106309, 0x3}, @transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x50, 0x18, &(0x7f0000000080)={@flat=@binder={0x73622a85, 0xa, 0x1}, @fda={0x66646185, 0xa, 0x1, 0x9}, @fd={0x66642a85, 0x0, r1}}, &(0x7f0000000100)={0x0, 0x18, 0x38}}, 0x1000}, @transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000180)={@ptr={0x70742a85, 0x0, &(0x7f0000000140)=""/51, 0x33, 0x2, 0x25}, @flat=@weak_handle={0x77682a85, 0x1}, @flat=@binder={0x73622a85, 0xa, 0x3}}, &(0x7f0000000280)={0x0, 0x28, 0x40}}, 0x1f8aed83e3349436}, @exit_looper, @transaction_sg={0x40486311, {0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x68, 0x18, &(0x7f0000000480)={@ptr={0x70742a85, 0x0, &(0x7f00000002c0)=""/11, 0xb, 0x2, 0x3f}, @fd={0x66642a85, 0x0, r0}, @ptr={0x70742a85, 0x0, &(0x7f0000000380)=""/70, 0x46, 0x1, 0x1f}}, &(0x7f0000000500)={0x0, 0x28, 0x40}}, 0x1000}], 0x14, 0x0, &(0x7f0000000680)="86621f50fcee8bdc5bf8c503a78812261b4bf6d7"}) [ 2592.382821] binder: undelivered TRANSACTION_ERROR: 29189 18:07:01 executing program 1: clone(0x2102001fff, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) socket(0x0, 0x0, 0x0) r0 = getpid() rt_tgsigqueueinfo(0x0, r0, 0x16, &(0x7f0000000100)) rt_sigqueueinfo(r0, 0x7, &(0x7f0000000180)={0x0, 0x0, 0xffffffff}) 18:07:01 executing program 2: ioctl$FS_IOC_RESVSP(0xffffffffffffffff, 0x40305828, &(0x7f00000000c0)={0x0, 0x0, 0x100000000000001}) clone(0x2102001fff, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) socket(0x0, 0x0, 0x0) r0 = getpid() rt_tgsigqueueinfo(0x0, r0, 0x16, &(0x7f0000000100)) ptrace(0x10, r0) ptrace$poke(0x4209, r0, &(0x7f00000000c0), 0x70effd) 18:07:01 executing program 3: r0 = socket(0x10, 0x3, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") ioctl$sock_ifreq(r0, 0x89f3, &(0x7f0000000240)={'sit0\x00'}) [ 2592.454434] binder: 3383:3388 Release 1 refcount change on invalid ref 2 ret -22 [ 2592.454445] binder: 3383:3388 BC_ACQUIRE_DONE u0000000000000000 no match [ 2592.454453] binder: 3383:3388 BC_ACQUIRE_DONE u0000000000000003 no match 18:07:01 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000006c0)={0x118, 0x0, &(0x7f0000000540)=[@release={0x40046306, 0x2}, @acquire_done, @acquire_done={0x40106309, 0x3}, @transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x50, 0x18, &(0x7f0000000080)={@flat=@binder={0x73622a85, 0xa, 0x1}, @fda={0x66646185, 0xa, 0x1, 0x9}, @fd={0x66642a85, 0x0, r1}}, &(0x7f0000000100)={0x0, 0x18, 0x38}}, 0x1000}, @transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000180)={@ptr={0x70742a85, 0x0, &(0x7f0000000140)=""/51, 0x33, 0x2, 0x25}, @flat=@weak_handle={0x77682a85, 0x1}, @flat=@binder={0x73622a85, 0xa, 0x3}}, &(0x7f0000000280)={0x0, 0x28, 0x40}}, 0x1f8aed83e3349436}, @exit_looper, @transaction_sg={0x40486311, {0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x68, 0x18, &(0x7f0000000480)={@ptr={0x70742a85, 0x0, &(0x7f00000002c0)=""/11, 0xb, 0x2, 0x3f}, @fd={0x66642a85, 0x0, r0}, @ptr={0x70742a85, 0x0, &(0x7f0000000380)=""/70, 0x46, 0x1, 0x1f}}, &(0x7f0000000500)={0x0, 0x28, 0x40}}, 0x1000}], 0x14, 0x0, &(0x7f0000000680)="86621f50fcee8bdc5bf8c503a78812261b4bf6d7"}) [ 2592.454467] binder: 3383:3388 transaction failed 29189/-22, size 80-24 line 3014 18:07:01 executing program 4: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000040)='/dev/net/tun\x00', 0x0, 0x0) r1 = epoll_create1(0x0) epoll_ctl$EPOLL_CTL_ADD(0xffffffffffffffff, 0x1, r0, &(0x7f0000000100)) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000080)={'tunl0\x00', 0x1}) epoll_wait(r1, &(0x7f00000000c0)=[{}], 0x1, 0x0) 18:07:01 executing program 3: r0 = socket(0x10, 0x3, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") ioctl$sock_ifreq(r0, 0x89f3, &(0x7f0000000240)={'sit0\x00'}) 18:07:01 executing program 5: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000001a00)='/dev/net/tun\x00', 0x0, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000080)="c0dc00025e0b01047be070") ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000300)={'nr0\x01\x00', 0x1132}) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000001a00)='/dev/net/tun\x00', 0x2, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000300)={'nr0\x01\x00', 0x1132}) write$cgroup_int(0xffffffffffffffff, &(0x7f00000000c0)=0x2, 0xfffffffffffffe75) close(r1) [ 2592.454774] binder: undelivered TRANSACTION_ERROR: 29189 [ 2592.532924] binder: 3415:3424 Release 1 refcount change on invalid ref 2 ret -22 18:07:01 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000006c0)={0x118, 0x0, &(0x7f0000000540)=[@release={0x40046306, 0x2}, @acquire_done, @acquire_done={0x40106309, 0x3}, @transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x50, 0x18, &(0x7f0000000080)={@flat=@binder={0x73622a85, 0xa, 0x1}, @fda={0x66646185, 0xa, 0x1, 0x9}, @fd={0x66642a85, 0x0, r1}}, &(0x7f0000000100)={0x0, 0x18, 0x38}}, 0x1000}, @transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000180)={@ptr={0x70742a85, 0x0, &(0x7f0000000140)=""/51, 0x33, 0x2, 0x25}, @flat=@weak_handle={0x77682a85, 0x1}, @flat=@binder={0x73622a85, 0xa, 0x3}}, &(0x7f0000000280)={0x0, 0x28, 0x40}}, 0x1f8aed83e3349436}, @exit_looper, @transaction_sg={0x40486311, {0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x68, 0x18, &(0x7f0000000480)={@ptr={0x70742a85, 0x0, &(0x7f00000002c0)=""/11, 0xb, 0x2, 0x3f}, @fd={0x66642a85, 0x0, r0}, @ptr={0x70742a85, 0x0, &(0x7f0000000380)=""/70, 0x46, 0x1, 0x1f}}, &(0x7f0000000500)={0x0, 0x28, 0x40}}, 0x1000}], 0x14, 0x0, &(0x7f0000000680)="86621f50fcee8bdc5bf8c503a78812261b4bf6d7"}) [ 2592.532934] binder: 3415:3424 BC_ACQUIRE_DONE u0000000000000000 no match [ 2592.532941] binder: 3415:3424 BC_ACQUIRE_DONE u0000000000000003 no match 18:07:01 executing program 3: r0 = socket(0x10, 0x3, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") ioctl$sock_ifreq(r0, 0x89f3, &(0x7f0000000240)={'sit0\x00'}) 18:07:01 executing program 1: clone(0x2102001fff, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) socket(0x0, 0x0, 0x0) r0 = getpid() rt_tgsigqueueinfo(0x0, r0, 0x16, &(0x7f0000000100)) rt_sigqueueinfo(r0, 0x7, &(0x7f0000000180)={0x0, 0x0, 0xffffffff}) 18:07:01 executing program 2: ioctl$FS_IOC_RESVSP(0xffffffffffffffff, 0x40305828, &(0x7f00000000c0)={0x0, 0x0, 0x100000000000001}) clone(0x2102001fff, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) socket(0x0, 0x0, 0x0) r0 = getpid() rt_tgsigqueueinfo(0x0, r0, 0x16, &(0x7f0000000100)) ptrace(0x10, r0) ptrace$poke(0x4209, r0, &(0x7f00000000c0), 0x70effd) [ 2592.532953] binder: 3415:3424 transaction failed 29189/-22, size 80-24 line 3014 18:07:01 executing program 4: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000040)='/dev/net/tun\x00', 0x0, 0x0) r1 = epoll_create1(0x0) epoll_ctl$EPOLL_CTL_ADD(0xffffffffffffffff, 0x1, r0, &(0x7f0000000100)) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000080)={'tunl0\x00', 0x1}) epoll_wait(r1, &(0x7f00000000c0)=[{}], 0x1, 0x0) [ 2592.533274] binder: undelivered TRANSACTION_ERROR: 29189 18:07:01 executing program 5: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000001a00)='/dev/net/tun\x00', 0x0, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000080)="c0dc00025e0b01047be070") ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000300)={'nr0\x01\x00', 0x1132}) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000001a00)='/dev/net/tun\x00', 0x2, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000300)={'nr0\x01\x00', 0x1132}) write$cgroup_int(0xffffffffffffffff, &(0x7f00000000c0)=0x2, 0xfffffffffffffe75) close(r1) 18:07:01 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000006c0)={0x118, 0x0, &(0x7f0000000540)=[@release={0x40046306, 0x2}, @acquire_done, @acquire_done={0x40106309, 0x3}, @transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x50, 0x18, &(0x7f0000000080)={@flat=@binder={0x73622a85, 0xa, 0x1}, @fda={0x66646185, 0xa, 0x1, 0x9}, @fd={0x66642a85, 0x0, r1}}, &(0x7f0000000100)={0x0, 0x18, 0x38}}, 0x1000}, @transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000180)={@ptr={0x70742a85, 0x0, &(0x7f0000000140)=""/51, 0x33, 0x2, 0x25}, @flat=@weak_handle={0x77682a85, 0x1}, @flat=@binder={0x73622a85, 0xa, 0x3}}, &(0x7f0000000280)={0x0, 0x28, 0x40}}, 0x1f8aed83e3349436}, @exit_looper, @transaction_sg={0x40486311, {0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x68, 0x18, &(0x7f0000000480)={@ptr={0x70742a85, 0x0, &(0x7f00000002c0)=""/11, 0xb, 0x2, 0x3f}, @fd={0x66642a85, 0x0, r0}, @ptr={0x70742a85, 0x0, &(0x7f0000000380)=""/70, 0x46, 0x1, 0x1f}}, &(0x7f0000000500)={0x0, 0x28, 0x40}}, 0x1000}], 0x14, 0x0, &(0x7f0000000680)="86621f50fcee8bdc5bf8c503a78812261b4bf6d7"}) 18:07:01 executing program 3: r0 = socket(0x10, 0x3, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") ioctl$sock_ifreq(r0, 0x89f3, &(0x7f0000000240)={'sit0\x00'}) [ 2592.626169] binder: 3433:3452 Release 1 refcount change on invalid ref 2 ret -22 [ 2592.626180] binder: 3433:3452 BC_ACQUIRE_DONE u0000000000000000 no match [ 2592.626188] binder: 3433:3452 BC_ACQUIRE_DONE u0000000000000003 no match [ 2592.626201] binder: 3433:3452 transaction failed 29189/-22, size 80-24 line 3014 18:07:01 executing program 2: ioctl$FS_IOC_RESVSP(0xffffffffffffffff, 0x40305828, &(0x7f00000000c0)={0x0, 0x0, 0x100000000000001}) clone(0x2102001fff, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) socket(0x0, 0x0, 0x0) r0 = getpid() rt_tgsigqueueinfo(0x0, r0, 0x16, &(0x7f0000000100)) ptrace(0x10, r0) ptrace$poke(0x4209, r0, &(0x7f00000000c0), 0x70effd) 18:07:01 executing program 1: clone(0x2102001fff, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) socket(0x0, 0x0, 0x0) r0 = getpid() rt_tgsigqueueinfo(0x0, r0, 0x16, &(0x7f0000000100)) rt_sigqueueinfo(r0, 0x7, &(0x7f0000000180)={0x0, 0x0, 0xffffffff}) [ 2592.631416] binder: undelivered TRANSACTION_ERROR: 29189 [ 2592.757736] binder: 3465:3478 Release 1 refcount change on invalid ref 2 ret -22 18:07:01 executing program 3: r0 = socket(0x10, 0x3, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") ioctl$sock_ifreq(r0, 0x89f3, &(0x7f0000000240)={'sit0\x00'}) 18:07:01 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000006c0)={0x118, 0x0, &(0x7f0000000540)=[@release={0x40046306, 0x2}, @acquire_done, @acquire_done={0x40106309, 0x3}, @transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x50, 0x18, &(0x7f0000000080)={@flat=@binder={0x73622a85, 0xa, 0x1}, @fda={0x66646185, 0xa, 0x1, 0x9}, @fd={0x66642a85, 0x0, r1}}, &(0x7f0000000100)={0x0, 0x18, 0x38}}, 0x1000}, @transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000180)={@ptr={0x70742a85, 0x0, &(0x7f0000000140)=""/51, 0x33, 0x2, 0x25}, @flat=@weak_handle={0x77682a85, 0x1}, @flat=@binder={0x73622a85, 0xa, 0x3}}, &(0x7f0000000280)={0x0, 0x28, 0x40}}, 0x1f8aed83e3349436}, @exit_looper, @transaction_sg={0x40486311, {0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x68, 0x18, &(0x7f0000000480)={@ptr={0x70742a85, 0x0, &(0x7f00000002c0)=""/11, 0xb, 0x2, 0x3f}, @fd={0x66642a85, 0x0, r0}, @ptr={0x70742a85, 0x0, &(0x7f0000000380)=""/70, 0x46, 0x1, 0x1f}}, &(0x7f0000000500)={0x0, 0x28, 0x40}}, 0x1000}], 0x14, 0x0, &(0x7f0000000680)="86621f50fcee8bdc5bf8c503a78812261b4bf6d7"}) [ 2592.757746] binder: 3465:3478 BC_ACQUIRE_DONE u0000000000000000 no match 18:07:01 executing program 4: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000040)='/dev/net/tun\x00', 0x0, 0x0) r1 = epoll_create1(0x0) epoll_ctl$EPOLL_CTL_ADD(0xffffffffffffffff, 0x1, r0, &(0x7f0000000100)) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000080)={'tunl0\x00', 0x1}) epoll_wait(r1, &(0x7f00000000c0)=[{}], 0x1, 0x0) 18:07:01 executing program 3: r0 = socket(0x10, 0x3, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") ioctl$sock_ifreq(r0, 0x89f3, &(0x7f0000000240)={'sit0\x00'}) [ 2592.757754] binder: 3465:3478 BC_ACQUIRE_DONE u0000000000000003 no match 18:07:01 executing program 5: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000001a00)='/dev/net/tun\x00', 0x0, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000080)="c0dc00025e0b01047be070") ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000300)={'nr0\x01\x00', 0x1132}) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000001a00)='/dev/net/tun\x00', 0x2, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000300)={'nr0\x01\x00', 0x1132}) write$cgroup_int(0xffffffffffffffff, &(0x7f00000000c0)=0x2, 0xfffffffffffffe75) close(r1) 18:07:01 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000006c0)={0x118, 0x0, &(0x7f0000000540)=[@release={0x40046306, 0x2}, @acquire_done, @acquire_done={0x40106309, 0x3}, @transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x50, 0x18, &(0x7f0000000080)={@flat=@binder={0x73622a85, 0xa, 0x1}, @fda={0x66646185, 0xa, 0x1, 0x9}, @fd={0x66642a85, 0x0, r1}}, &(0x7f0000000100)={0x0, 0x18, 0x38}}, 0x1000}, @transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000180)={@ptr={0x70742a85, 0x0, &(0x7f0000000140)=""/51, 0x33, 0x2, 0x25}, @flat=@weak_handle={0x77682a85, 0x1}, @flat=@binder={0x73622a85, 0xa, 0x3}}, &(0x7f0000000280)={0x0, 0x28, 0x40}}, 0x1f8aed83e3349436}, @exit_looper, @transaction_sg={0x40486311, {0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x68, 0x18, &(0x7f0000000480)={@ptr={0x70742a85, 0x0, &(0x7f00000002c0)=""/11, 0xb, 0x2, 0x3f}, @fd={0x66642a85, 0x0, r0}, @ptr={0x70742a85, 0x0, &(0x7f0000000380)=""/70, 0x46, 0x1, 0x1f}}, &(0x7f0000000500)={0x0, 0x28, 0x40}}, 0x1000}], 0x14, 0x0, &(0x7f0000000680)="86621f50fcee8bdc5bf8c503a78812261b4bf6d7"}) 18:07:01 executing program 1: clone(0x2102001fff, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) socket(0x0, 0x0, 0x0) r0 = getpid() rt_tgsigqueueinfo(0x0, r0, 0x16, &(0x7f0000000100)) rt_sigqueueinfo(r0, 0x7, &(0x7f0000000180)={0x0, 0x0, 0xffffffff}) [ 2592.757767] binder: 3465:3478 transaction failed 29189/-22, size 80-24 line 3014 [ 2592.758067] binder: undelivered TRANSACTION_ERROR: 29189 [ 2592.832592] binder: 3523:3529 Release 1 refcount change on invalid ref 2 ret -22 18:07:02 executing program 3: r0 = socket(0x10, 0x3, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") ioctl$sock_ifreq(r0, 0x89f3, &(0x7f0000000240)={'sit0\x00'}) 18:07:02 executing program 2: ioctl$FS_IOC_RESVSP(0xffffffffffffffff, 0x40305828, &(0x7f00000000c0)={0x0, 0x0, 0x100000000000001}) clone(0x2102001fff, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) socket(0x0, 0x0, 0x0) r0 = getpid() rt_tgsigqueueinfo(0x0, r0, 0x16, &(0x7f0000000100)) ptrace(0x10, r0) ptrace$poke(0x4209, r0, &(0x7f00000000c0), 0x70effd) [ 2592.832601] binder: 3523:3529 BC_ACQUIRE_DONE u0000000000000000 no match [ 2592.832609] binder: 3523:3529 BC_ACQUIRE_DONE u0000000000000003 no match 18:07:02 executing program 3: r0 = socket(0x10, 0x3, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") ioctl$sock_ifreq(r0, 0x89f3, &(0x7f0000000240)={'sit0\x00'}) 18:07:02 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000006c0)={0x118, 0x0, &(0x7f0000000540)=[@release={0x40046306, 0x2}, @acquire_done, @acquire_done={0x40106309, 0x3}, @transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x50, 0x18, &(0x7f0000000080)={@flat=@binder={0x73622a85, 0xa, 0x1}, @fda={0x66646185, 0xa, 0x1, 0x9}, @fd={0x66642a85, 0x0, r1}}, &(0x7f0000000100)={0x0, 0x18, 0x38}}, 0x1000}, @transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000180)={@ptr={0x70742a85, 0x0, &(0x7f0000000140)=""/51, 0x33, 0x2, 0x25}, @flat=@weak_handle={0x77682a85, 0x1}, @flat=@binder={0x73622a85, 0xa, 0x3}}, &(0x7f0000000280)={0x0, 0x28, 0x40}}, 0x1f8aed83e3349436}, @exit_looper, @transaction_sg={0x40486311, {0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x68, 0x18, &(0x7f0000000480)={@ptr={0x70742a85, 0x0, &(0x7f00000002c0)=""/11, 0xb, 0x2, 0x3f}, @fd={0x66642a85, 0x0, r0}, @ptr={0x70742a85, 0x0, &(0x7f0000000380)=""/70, 0x46, 0x1, 0x1f}}, &(0x7f0000000500)={0x0, 0x28, 0x40}}, 0x1000}], 0x14, 0x0, &(0x7f0000000680)="86621f50fcee8bdc5bf8c503a78812261b4bf6d7"}) 18:07:02 executing program 1: clone(0x2102001fff, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) socket(0x0, 0x0, 0x0) r0 = getpid() rt_tgsigqueueinfo(0x0, r0, 0x16, &(0x7f0000000100)) rt_sigqueueinfo(r0, 0x7, &(0x7f0000000180)={0x0, 0x0, 0xffffffff}) [ 2592.832622] binder: 3523:3529 transaction failed 29189/-22, size 80-24 line 3014 18:07:02 executing program 5: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000001a00)='/dev/net/tun\x00', 0x0, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000080)="c0dc00025e0b01047be070") ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000300)={'nr0\x01\x00', 0x1132}) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000001a00)='/dev/net/tun\x00', 0x2, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000300)={'nr0\x01\x00', 0x1132}) write$cgroup_int(0xffffffffffffffff, &(0x7f00000000c0)=0x2, 0xfffffffffffffe75) close(r1) [ 2592.832818] binder: undelivered TRANSACTION_ERROR: 29189 [ 2592.913025] binder: 3548:3555 Release 1 refcount change on invalid ref 2 ret -22 18:07:02 executing program 3: r0 = socket(0x10, 0x3, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") ioctl$sock_ifreq(r0, 0x89f3, &(0x7f0000000240)={'sit0\x00'}) 18:07:02 executing program 4: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000040)='/dev/net/tun\x00', 0x0, 0x0) r1 = epoll_create1(0x0) epoll_ctl$EPOLL_CTL_ADD(0xffffffffffffffff, 0x1, r0, &(0x7f0000000100)) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000080)={'tunl0\x00', 0x1}) epoll_wait(r1, &(0x7f00000000c0)=[{}], 0x1, 0x0) 18:07:02 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000006c0)={0x118, 0x0, &(0x7f0000000540)=[@release={0x40046306, 0x2}, @acquire_done, @acquire_done={0x40106309, 0x3}, @transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x50, 0x18, &(0x7f0000000080)={@flat=@binder={0x73622a85, 0xa, 0x1}, @fda={0x66646185, 0xa, 0x1, 0x9}, @fd={0x66642a85, 0x0, r1}}, &(0x7f0000000100)={0x0, 0x18, 0x38}}, 0x1000}, @transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000180)={@ptr={0x70742a85, 0x0, &(0x7f0000000140)=""/51, 0x33, 0x2, 0x25}, @flat=@weak_handle={0x77682a85, 0x1}, @flat=@binder={0x73622a85, 0xa, 0x3}}, &(0x7f0000000280)={0x0, 0x28, 0x40}}, 0x1f8aed83e3349436}, @exit_looper, @transaction_sg={0x40486311, {0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x68, 0x18, &(0x7f0000000480)={@ptr={0x70742a85, 0x0, &(0x7f00000002c0)=""/11, 0xb, 0x2, 0x3f}, @fd={0x66642a85, 0x0, r0}, @ptr={0x70742a85, 0x0, &(0x7f0000000380)=""/70, 0x46, 0x1, 0x1f}}, &(0x7f0000000500)={0x0, 0x28, 0x40}}, 0x1000}], 0x14, 0x0, &(0x7f0000000680)="86621f50fcee8bdc5bf8c503a78812261b4bf6d7"}) 18:07:02 executing program 3: r0 = socket(0x10, 0x3, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") ioctl$sock_ifreq(r0, 0x89f3, &(0x7f0000000240)={'sit0\x00'}) 18:07:02 executing program 2: ioctl$FS_IOC_RESVSP(0xffffffffffffffff, 0x40305828, &(0x7f00000000c0)={0x0, 0x0, 0x100000000000001}) clone(0x2102001fff, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) socket(0x0, 0x0, 0x0) r0 = getpid() rt_tgsigqueueinfo(0x0, r0, 0x16, &(0x7f0000000100)) ptrace(0x10, r0) ptrace$poke(0x4209, r0, &(0x7f00000000c0), 0x70effd) [ 2592.913036] binder: 3548:3555 BC_ACQUIRE_DONE u0000000000000000 no match [ 2592.913044] binder: 3548:3555 BC_ACQUIRE_DONE u0000000000000003 no match 18:07:02 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000006c0)={0x118, 0x0, &(0x7f0000000540)=[@release={0x40046306, 0x2}, @acquire_done, @acquire_done={0x40106309, 0x3}, @transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x50, 0x18, &(0x7f0000000080)={@flat=@binder={0x73622a85, 0xa, 0x1}, @fda={0x66646185, 0xa, 0x1, 0x9}, @fd={0x66642a85, 0x0, r1}}, &(0x7f0000000100)={0x0, 0x18, 0x38}}, 0x1000}, @transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000180)={@ptr={0x70742a85, 0x0, &(0x7f0000000140)=""/51, 0x33, 0x2, 0x25}, @flat=@weak_handle={0x77682a85, 0x1}, @flat=@binder={0x73622a85, 0xa, 0x3}}, &(0x7f0000000280)={0x0, 0x28, 0x40}}, 0x1f8aed83e3349436}, @exit_looper, @transaction_sg={0x40486311, {0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x68, 0x18, &(0x7f0000000480)={@ptr={0x70742a85, 0x0, &(0x7f00000002c0)=""/11, 0xb, 0x2, 0x3f}, @fd={0x66642a85, 0x0, r0}, @ptr={0x70742a85, 0x0, &(0x7f0000000380)=""/70, 0x46, 0x1, 0x1f}}, &(0x7f0000000500)={0x0, 0x28, 0x40}}, 0x1000}], 0x14, 0x0, &(0x7f0000000680)="86621f50fcee8bdc5bf8c503a78812261b4bf6d7"}) [ 2592.913057] binder: 3548:3555 transaction failed 29189/-22, size 80-24 line 3014 18:07:02 executing program 1: clone(0x2102001fff, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) socket(0x0, 0x0, 0x0) r0 = getpid() rt_tgsigqueueinfo(0x0, r0, 0x16, &(0x7f0000000100)) rt_sigqueueinfo(r0, 0x7, &(0x7f0000000180)={0x0, 0x0, 0xffffffff}) [ 2592.913944] binder: undelivered TRANSACTION_ERROR: 29189 [ 2593.005247] binder: 3564:3572 Release 1 refcount change on invalid ref 2 ret -22 [ 2593.005257] binder: 3564:3572 BC_ACQUIRE_DONE u0000000000000000 no match 18:07:02 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000006c0)={0x118, 0x0, &(0x7f0000000540)=[@release={0x40046306, 0x2}, @acquire_done, @acquire_done={0x40106309, 0x3}, @transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x50, 0x18, &(0x7f0000000080)={@flat=@binder={0x73622a85, 0xa, 0x1}, @fda={0x66646185, 0xa, 0x1, 0x9}, @fd={0x66642a85, 0x0, r1}}, &(0x7f0000000100)={0x0, 0x18, 0x38}}, 0x1000}, @transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000180)={@ptr={0x70742a85, 0x0, &(0x7f0000000140)=""/51, 0x33, 0x2, 0x25}, @flat=@weak_handle={0x77682a85, 0x1}, @flat=@binder={0x73622a85, 0xa, 0x3}}, &(0x7f0000000280)={0x0, 0x28, 0x40}}, 0x1f8aed83e3349436}, @exit_looper, @transaction_sg={0x40486311, {0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x68, 0x18, &(0x7f0000000480)={@ptr={0x70742a85, 0x0, &(0x7f00000002c0)=""/11, 0xb, 0x2, 0x3f}, @fd={0x66642a85, 0x0, r0}, @ptr={0x70742a85, 0x0, &(0x7f0000000380)=""/70, 0x46, 0x1, 0x1f}}, &(0x7f0000000500)={0x0, 0x28, 0x40}}, 0x1000}], 0x14, 0x0, &(0x7f0000000680)="86621f50fcee8bdc5bf8c503a78812261b4bf6d7"}) 18:07:02 executing program 4: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000040)='/dev/net/tun\x00', 0x0, 0x0) r1 = epoll_create1(0x0) epoll_ctl$EPOLL_CTL_ADD(0xffffffffffffffff, 0x1, r0, &(0x7f0000000100)) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000080)={'tunl0\x00', 0x1}) epoll_wait(r1, &(0x7f00000000c0)=[{}], 0x1, 0x0) 18:07:02 executing program 3: r0 = socket(0x10, 0x3, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") ioctl$sock_ifreq(r0, 0x89f3, &(0x7f0000000240)={'sit0\x00'}) [ 2593.005264] binder: 3564:3572 BC_ACQUIRE_DONE u0000000000000003 no match 18:07:02 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000006c0)={0x118, 0x0, &(0x7f0000000540)=[@release={0x40046306, 0x2}, @acquire_done, @acquire_done={0x40106309, 0x3}, @transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x50, 0x18, &(0x7f0000000080)={@flat=@binder={0x73622a85, 0xa, 0x1}, @fda={0x66646185, 0xa, 0x1, 0x9}, @fd={0x66642a85, 0x0, r1}}, &(0x7f0000000100)={0x0, 0x18, 0x38}}, 0x1000}, @transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000180)={@ptr={0x70742a85, 0x0, &(0x7f0000000140)=""/51, 0x33, 0x2, 0x25}, @flat=@weak_handle={0x77682a85, 0x1}, @flat=@binder={0x73622a85, 0xa, 0x3}}, &(0x7f0000000280)={0x0, 0x28, 0x40}}, 0x1f8aed83e3349436}, @exit_looper, @transaction_sg={0x40486311, {0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x68, 0x18, &(0x7f0000000480)={@ptr={0x70742a85, 0x0, &(0x7f00000002c0)=""/11, 0xb, 0x2, 0x3f}, @fd={0x66642a85, 0x0, r0}, @ptr={0x70742a85, 0x0, &(0x7f0000000380)=""/70, 0x46, 0x1, 0x1f}}, &(0x7f0000000500)={0x0, 0x28, 0x40}}, 0x1000}], 0x14, 0x0, &(0x7f0000000680)="86621f50fcee8bdc5bf8c503a78812261b4bf6d7"}) 18:07:02 executing program 5: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000001a00)='/dev/net/tun\x00', 0x0, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000080)="c0dc00025e0b01047be070") ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000300)={'nr0\x01\x00', 0x1132}) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000001a00)='/dev/net/tun\x00', 0x2, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000300)={'nr0\x01\x00', 0x1132}) write$cgroup_int(0xffffffffffffffff, &(0x7f00000000c0)=0x2, 0xfffffffffffffe75) close(r1) 18:07:02 executing program 1: clone(0x2102001fff, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) socket(0x0, 0x0, 0x0) r0 = getpid() rt_tgsigqueueinfo(0x0, r0, 0x16, &(0x7f0000000100)) rt_sigqueueinfo(r0, 0x7, &(0x7f0000000180)={0x0, 0x0, 0xffffffff}) 18:07:02 executing program 2: ioctl$FS_IOC_RESVSP(0xffffffffffffffff, 0x40305828, &(0x7f00000000c0)={0x0, 0x0, 0x100000000000001}) clone(0x2102001fff, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) socket(0x0, 0x0, 0x0) r0 = getpid() rt_tgsigqueueinfo(0x0, r0, 0x16, &(0x7f0000000100)) ptrace(0x10, r0) ptrace$poke(0x4209, r0, &(0x7f00000000c0), 0x70effd) 18:07:02 executing program 3: r0 = socket(0x10, 0x3, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") ioctl$sock_ifreq(r0, 0x89f3, &(0x7f0000000240)={'sit0\x00'}) [ 2593.005277] binder: 3564:3572 transaction failed 29189/-22, size 80-24 line 3014 18:07:02 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000006c0)={0x118, 0x0, &(0x7f0000000540)=[@release={0x40046306, 0x2}, @acquire_done, @acquire_done={0x40106309, 0x3}, @transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x50, 0x18, &(0x7f0000000080)={@flat=@binder={0x73622a85, 0xa, 0x1}, @fda={0x66646185, 0xa, 0x1, 0x9}, @fd={0x66642a85, 0x0, r1}}, &(0x7f0000000100)={0x0, 0x18, 0x38}}, 0x1000}, @transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000180)={@ptr={0x70742a85, 0x0, &(0x7f0000000140)=""/51, 0x33, 0x2, 0x25}, @flat=@weak_handle={0x77682a85, 0x1}, @flat=@binder={0x73622a85, 0xa, 0x3}}, &(0x7f0000000280)={0x0, 0x28, 0x40}}, 0x1f8aed83e3349436}, @exit_looper, @transaction_sg={0x40486311, {0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x68, 0x18, &(0x7f0000000480)={@ptr={0x70742a85, 0x0, &(0x7f00000002c0)=""/11, 0xb, 0x2, 0x3f}, @fd={0x66642a85, 0x0, r0}, @ptr={0x70742a85, 0x0, &(0x7f0000000380)=""/70, 0x46, 0x1, 0x1f}}, &(0x7f0000000500)={0x0, 0x28, 0x40}}, 0x1000}], 0x14, 0x0, &(0x7f0000000680)="86621f50fcee8bdc5bf8c503a78812261b4bf6d7"}) [ 2593.005604] binder: undelivered TRANSACTION_ERROR: 29189 [ 2593.144436] binder: 3627:3637 Release 1 refcount change on invalid ref 2 ret -22 18:07:02 executing program 4: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000040)='/dev/net/tun\x00', 0x0, 0x0) r1 = epoll_create1(0x0) epoll_ctl$EPOLL_CTL_ADD(0xffffffffffffffff, 0x1, r0, &(0x7f0000000100)) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000080)={'tunl0\x00', 0x1}) epoll_wait(r1, &(0x7f00000000c0)=[{}], 0x1, 0x0) 18:07:02 executing program 1: clone(0x2102001fff, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) socket(0x0, 0x0, 0x0) r0 = getpid() rt_tgsigqueueinfo(0x0, r0, 0x16, &(0x7f0000000100)) rt_sigqueueinfo(r0, 0x7, &(0x7f0000000180)={0x0, 0x0, 0xffffffff}) [ 2593.144446] binder: 3627:3637 BC_ACQUIRE_DONE u0000000000000000 no match [ 2593.144454] binder: 3627:3637 BC_ACQUIRE_DONE u0000000000000003 no match 18:07:02 executing program 2: ioctl$FS_IOC_RESVSP(0xffffffffffffffff, 0x40305828, &(0x7f00000000c0)={0x0, 0x0, 0x100000000000001}) clone(0x2102001fff, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) socket(0x0, 0x0, 0x0) r0 = getpid() rt_tgsigqueueinfo(0x0, r0, 0x16, &(0x7f0000000100)) ptrace(0x10, r0) ptrace$poke(0x4209, r0, &(0x7f00000000c0), 0x70effd) [ 2593.144467] binder: 3627:3637 transaction failed 29189/-22, size 80-24 line 3014 [ 2593.144770] binder: undelivered TRANSACTION_ERROR: 29189 18:07:02 executing program 3: r0 = socket(0x10, 0x3, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") ioctl$sock_ifreq(r0, 0x89f3, &(0x7f0000000240)={'sit0\x00'}) [ 2593.283644] binder: 3649:3654 Release 1 refcount change on invalid ref 2 ret -22 18:07:02 executing program 5: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000001a00)='/dev/net/tun\x00', 0x0, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000080)="c0dc00025e0b01047be070") ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000300)={'nr0\x01\x00', 0x1132}) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000001a00)='/dev/net/tun\x00', 0x2, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000300)={'nr0\x01\x00', 0x1132}) write$cgroup_int(0xffffffffffffffff, &(0x7f00000000c0)=0x2, 0xfffffffffffffe75) close(r1) 18:07:02 executing program 1: clone(0x2102001fff, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) socket(0x0, 0x0, 0x0) r0 = getpid() rt_tgsigqueueinfo(0x0, r0, 0x16, &(0x7f0000000100)) rt_sigqueueinfo(r0, 0x7, &(0x7f0000000180)={0x0, 0x0, 0xffffffff}) 18:07:02 executing program 4: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000040)='/dev/net/tun\x00', 0x0, 0x0) r1 = epoll_create1(0x0) epoll_ctl$EPOLL_CTL_ADD(0xffffffffffffffff, 0x1, r0, &(0x7f0000000100)) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000080)={'tunl0\x00', 0x1}) epoll_wait(r1, &(0x7f00000000c0)=[{}], 0x1, 0x0) 18:07:02 executing program 3: r0 = socket(0x10, 0x3, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") ioctl$sock_ifreq(r0, 0x89f3, &(0x7f0000000240)={'sit0\x00'}) [ 2593.283654] binder: 3649:3654 BC_ACQUIRE_DONE u0000000000000000 no match [ 2593.283662] binder: 3649:3654 BC_ACQUIRE_DONE u0000000000000003 no match 18:07:02 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000006c0)={0x118, 0x0, &(0x7f0000000540)=[@release={0x40046306, 0x2}, @acquire_done, @acquire_done={0x40106309, 0x3}, @transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x50, 0x18, &(0x7f0000000080)={@flat=@binder={0x73622a85, 0xa, 0x1}, @fda={0x66646185, 0xa, 0x1, 0x9}, @fd={0x66642a85, 0x0, r1}}, &(0x7f0000000100)={0x0, 0x18, 0x38}}, 0x1000}, @transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000180)={@ptr={0x70742a85, 0x0, &(0x7f0000000140)=""/51, 0x33, 0x2, 0x25}, @flat=@weak_handle={0x77682a85, 0x1}, @flat=@binder={0x73622a85, 0xa, 0x3}}, &(0x7f0000000280)={0x0, 0x28, 0x40}}, 0x1f8aed83e3349436}, @exit_looper, @transaction_sg={0x40486311, {0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x68, 0x18, &(0x7f0000000480)={@ptr={0x70742a85, 0x0, &(0x7f00000002c0)=""/11, 0xb, 0x2, 0x3f}, @fd={0x66642a85, 0x0, r0}, @ptr={0x70742a85, 0x0, &(0x7f0000000380)=""/70, 0x46, 0x1, 0x1f}}, &(0x7f0000000500)={0x0, 0x28, 0x40}}, 0x1000}], 0x14, 0x0, &(0x7f0000000680)="86621f50fcee8bdc5bf8c503a78812261b4bf6d7"}) 18:07:03 executing program 1: clone(0x2102001fff, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) socket(0x0, 0x0, 0x0) r0 = getpid() rt_tgsigqueueinfo(0x0, r0, 0x16, &(0x7f0000000100)) rt_sigqueueinfo(r0, 0x7, &(0x7f0000000180)={0x0, 0x0, 0xffffffff}) [ 2593.283675] binder: 3649:3654 transaction failed 29189/-22, size 80-24 line 3014 18:07:03 executing program 2: ioctl$FS_IOC_RESVSP(0xffffffffffffffff, 0x40305828, &(0x7f00000000c0)={0x0, 0x0, 0x100000000000001}) clone(0x2102001fff, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) socket(0x0, 0x0, 0x0) r0 = getpid() rt_tgsigqueueinfo(0x0, r0, 0x16, &(0x7f0000000100)) ptrace(0x10, r0) ptrace$poke(0x4209, r0, &(0x7f00000000c0), 0x70effd) 18:07:03 executing program 3: r0 = socket(0x10, 0x3, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") ioctl$sock_ifreq(r0, 0x89f3, &(0x7f0000000240)={'sit0\x00'}) 18:07:03 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000006c0)={0x118, 0x0, &(0x7f0000000540)=[@release={0x40046306, 0x2}, @acquire_done, @acquire_done={0x40106309, 0x3}, @transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x50, 0x18, &(0x7f0000000080)={@flat=@binder={0x73622a85, 0xa, 0x1}, @fda={0x66646185, 0xa, 0x1, 0x9}, @fd={0x66642a85, 0x0, r1}}, &(0x7f0000000100)={0x0, 0x18, 0x38}}, 0x1000}, @transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000180)={@ptr={0x70742a85, 0x0, &(0x7f0000000140)=""/51, 0x33, 0x2, 0x25}, @flat=@weak_handle={0x77682a85, 0x1}, @flat=@binder={0x73622a85, 0xa, 0x3}}, &(0x7f0000000280)={0x0, 0x28, 0x40}}, 0x1f8aed83e3349436}, @exit_looper, @transaction_sg={0x40486311, {0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x68, 0x18, &(0x7f0000000480)={@ptr={0x70742a85, 0x0, &(0x7f00000002c0)=""/11, 0xb, 0x2, 0x3f}, @fd={0x66642a85, 0x0, r0}, @ptr={0x70742a85, 0x0, &(0x7f0000000380)=""/70, 0x46, 0x1, 0x1f}}, &(0x7f0000000500)={0x0, 0x28, 0x40}}, 0x1000}], 0x14, 0x0, &(0x7f0000000680)="86621f50fcee8bdc5bf8c503a78812261b4bf6d7"}) [ 2593.283909] binder: undelivered TRANSACTION_ERROR: 29189 [ 2593.366371] binder: 3713:3723 Release 1 refcount change on invalid ref 2 ret -22 18:07:03 executing program 4: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000040)='/dev/net/tun\x00', 0x0, 0x0) r1 = epoll_create1(0x0) epoll_ctl$EPOLL_CTL_ADD(0xffffffffffffffff, 0x1, r0, &(0x7f0000000100)) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000080)={'tunl0\x00', 0x1}) epoll_wait(r1, &(0x7f00000000c0)=[{}], 0x1, 0x0) 18:07:03 executing program 3: r0 = socket(0x10, 0x3, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") ioctl$sock_ifreq(r0, 0x89f3, &(0x7f0000000240)={'sit0\x00'}) [ 2593.366381] binder: 3713:3723 BC_ACQUIRE_DONE u0000000000000000 no match [ 2593.366389] binder: 3713:3723 BC_ACQUIRE_DONE u0000000000000003 no match [ 2593.366402] binder: 3713:3723 transaction failed 29189/-22, size 80-24 line 3014 18:07:03 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000006c0)={0x118, 0x0, &(0x7f0000000540)=[@release={0x40046306, 0x2}, @acquire_done, @acquire_done={0x40106309, 0x3}, @transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x50, 0x18, &(0x7f0000000080)={@flat=@binder={0x73622a85, 0xa, 0x1}, @fda={0x66646185, 0xa, 0x1, 0x9}, @fd={0x66642a85, 0x0, r1}}, &(0x7f0000000100)={0x0, 0x18, 0x38}}, 0x1000}, @transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000180)={@ptr={0x70742a85, 0x0, &(0x7f0000000140)=""/51, 0x33, 0x2, 0x25}, @flat=@weak_handle={0x77682a85, 0x1}, @flat=@binder={0x73622a85, 0xa, 0x3}}, &(0x7f0000000280)={0x0, 0x28, 0x40}}, 0x1f8aed83e3349436}, @exit_looper, @transaction_sg={0x40486311, {0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x68, 0x18, &(0x7f0000000480)={@ptr={0x70742a85, 0x0, &(0x7f00000002c0)=""/11, 0xb, 0x2, 0x3f}, @fd={0x66642a85, 0x0, r0}, @ptr={0x70742a85, 0x0, &(0x7f0000000380)=""/70, 0x46, 0x1, 0x1f}}, &(0x7f0000000500)={0x0, 0x28, 0x40}}, 0x1000}], 0x14, 0x0, &(0x7f0000000680)="86621f50fcee8bdc5bf8c503a78812261b4bf6d7"}) [ 2593.370690] binder: undelivered TRANSACTION_ERROR: 29189 [ 2593.461727] binder: 3747:3755 Release 1 refcount change on invalid ref 2 ret -22 18:07:03 executing program 5: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000001a00)='/dev/net/tun\x00', 0x0, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000080)="c0dc00025e0b01047be070") ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000300)={'nr0\x01\x00', 0x1132}) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000001a00)='/dev/net/tun\x00', 0x2, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000300)={'nr0\x01\x00', 0x1132}) write$cgroup_int(0xffffffffffffffff, &(0x7f00000000c0)=0x2, 0xfffffffffffffe75) close(r1) 18:07:03 executing program 1: clone(0x2102001fff, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) socket(0x0, 0x0, 0x0) r0 = getpid() rt_tgsigqueueinfo(0x0, r0, 0x16, &(0x7f0000000100)) rt_sigqueueinfo(r0, 0x7, &(0x7f0000000180)={0x0, 0x0, 0xffffffff}) 18:07:03 executing program 2: ioctl$FS_IOC_RESVSP(0xffffffffffffffff, 0x40305828, &(0x7f00000000c0)={0x0, 0x0, 0x100000000000001}) clone(0x2102001fff, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) socket(0x0, 0x0, 0x0) r0 = getpid() rt_tgsigqueueinfo(0x0, r0, 0x16, &(0x7f0000000100)) ptrace(0x10, r0) ptrace$poke(0x4209, r0, &(0x7f00000000c0), 0x70effd) 18:07:03 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000006c0)={0x118, 0x0, &(0x7f0000000540)=[@release={0x40046306, 0x2}, @acquire_done, @acquire_done={0x40106309, 0x3}, @transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x50, 0x18, &(0x7f0000000080)={@flat=@binder={0x73622a85, 0xa, 0x1}, @fda={0x66646185, 0xa, 0x1, 0x9}, @fd={0x66642a85, 0x0, r1}}, &(0x7f0000000100)={0x0, 0x18, 0x38}}, 0x1000}, @transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000180)={@ptr={0x70742a85, 0x0, &(0x7f0000000140)=""/51, 0x33, 0x2, 0x25}, @flat=@weak_handle={0x77682a85, 0x1}, @flat=@binder={0x73622a85, 0xa, 0x3}}, &(0x7f0000000280)={0x0, 0x28, 0x40}}, 0x1f8aed83e3349436}, @exit_looper, @transaction_sg={0x40486311, {0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x68, 0x18, &(0x7f0000000480)={@ptr={0x70742a85, 0x0, &(0x7f00000002c0)=""/11, 0xb, 0x2, 0x3f}, @fd={0x66642a85, 0x0, r0}, @ptr={0x70742a85, 0x0, &(0x7f0000000380)=""/70, 0x46, 0x1, 0x1f}}, &(0x7f0000000500)={0x0, 0x28, 0x40}}, 0x1000}], 0x14, 0x0, &(0x7f0000000680)="86621f50fcee8bdc5bf8c503a78812261b4bf6d7"}) [ 2593.461736] binder: 3747:3755 BC_ACQUIRE_DONE u0000000000000000 no match 18:07:03 executing program 4: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000040)='/dev/net/tun\x00', 0x0, 0x0) r1 = epoll_create1(0x0) epoll_ctl$EPOLL_CTL_ADD(0xffffffffffffffff, 0x1, r0, &(0x7f0000000100)) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000080)={'tunl0\x00', 0x1}) epoll_wait(r1, &(0x7f00000000c0)=[{}], 0x1, 0x0) [ 2593.461744] binder: 3747:3755 BC_ACQUIRE_DONE u0000000000000003 no match 18:07:03 executing program 1: clone(0x2102001fff, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) socket(0x0, 0x0, 0x0) r0 = getpid() rt_tgsigqueueinfo(0x0, r0, 0x16, &(0x7f0000000100)) rt_sigqueueinfo(r0, 0x7, &(0x7f0000000180)={0x0, 0x0, 0xffffffff}) [ 2593.461756] binder: 3747:3755 transaction failed 29189/-22, size 80-24 line 3014 18:07:03 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000006c0)={0x118, 0x0, &(0x7f0000000540)=[@release={0x40046306, 0x2}, @acquire_done, @acquire_done={0x40106309, 0x3}, @transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x50, 0x18, &(0x7f0000000080)={@flat=@binder={0x73622a85, 0xa, 0x1}, @fda={0x66646185, 0xa, 0x1, 0x9}, @fd={0x66642a85, 0x0, r1}}, &(0x7f0000000100)={0x0, 0x18, 0x38}}, 0x1000}, @transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000180)={@ptr={0x70742a85, 0x0, &(0x7f0000000140)=""/51, 0x33, 0x2, 0x25}, @flat=@weak_handle={0x77682a85, 0x1}, @flat=@binder={0x73622a85, 0xa, 0x3}}, &(0x7f0000000280)={0x0, 0x28, 0x40}}, 0x1f8aed83e3349436}, @exit_looper, @transaction_sg={0x40486311, {0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x68, 0x18, &(0x7f0000000480)={@ptr={0x70742a85, 0x0, &(0x7f00000002c0)=""/11, 0xb, 0x2, 0x3f}, @fd={0x66642a85, 0x0, r0}, @ptr={0x70742a85, 0x0, &(0x7f0000000380)=""/70, 0x46, 0x1, 0x1f}}, &(0x7f0000000500)={0x0, 0x28, 0x40}}, 0x1000}], 0x14, 0x0, &(0x7f0000000680)="86621f50fcee8bdc5bf8c503a78812261b4bf6d7"}) 18:07:03 executing program 2: ioctl$FS_IOC_RESVSP(0xffffffffffffffff, 0x40305828, &(0x7f00000000c0)={0x0, 0x0, 0x100000000000001}) clone(0x2102001fff, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) socket(0x0, 0x0, 0x0) r0 = getpid() rt_tgsigqueueinfo(0x0, r0, 0x16, &(0x7f0000000100)) ptrace(0x10, r0) ptrace$poke(0x4209, r0, &(0x7f00000000c0), 0x70effd) 18:07:03 executing program 3: r0 = socket(0x10, 0x3, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") ioctl$sock_ifreq(r0, 0x89f3, &(0x7f0000000240)={'sit0\x00'}) [ 2593.462097] binder: undelivered TRANSACTION_ERROR: 29189 [ 2593.753558] binder: 3785:3826 Release 1 refcount change on invalid ref 2 ret -22 [ 2593.753568] binder: 3785:3826 BC_ACQUIRE_DONE u0000000000000000 no match 18:07:03 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000006c0)={0x118, 0x0, &(0x7f0000000540)=[@release={0x40046306, 0x2}, @acquire_done, @acquire_done={0x40106309, 0x3}, @transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x50, 0x18, &(0x7f0000000080)={@flat=@binder={0x73622a85, 0xa, 0x1}, @fda={0x66646185, 0xa, 0x1, 0x9}, @fd={0x66642a85, 0x0, r1}}, &(0x7f0000000100)={0x0, 0x18, 0x38}}, 0x1000}, @transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000180)={@ptr={0x70742a85, 0x0, &(0x7f0000000140)=""/51, 0x33, 0x2, 0x25}, @flat=@weak_handle={0x77682a85, 0x1}, @flat=@binder={0x73622a85, 0xa, 0x3}}, &(0x7f0000000280)={0x0, 0x28, 0x40}}, 0x1f8aed83e3349436}, @exit_looper, @transaction_sg={0x40486311, {0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x68, 0x18, &(0x7f0000000480)={@ptr={0x70742a85, 0x0, &(0x7f00000002c0)=""/11, 0xb, 0x2, 0x3f}, @fd={0x66642a85, 0x0, r0}, @ptr={0x70742a85, 0x0, &(0x7f0000000380)=""/70, 0x46, 0x1, 0x1f}}, &(0x7f0000000500)={0x0, 0x28, 0x40}}, 0x1000}], 0x14, 0x0, &(0x7f0000000680)="86621f50fcee8bdc5bf8c503a78812261b4bf6d7"}) 18:07:03 executing program 5: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000001a00)='/dev/net/tun\x00', 0x0, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000080)="c0dc00025e0b01047be070") ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000300)={'nr0\x01\x00', 0x1132}) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000001a00)='/dev/net/tun\x00', 0x2, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000300)={'nr0\x01\x00', 0x1132}) write$cgroup_int(0xffffffffffffffff, &(0x7f00000000c0)=0x2, 0xfffffffffffffe75) close(r1) [ 2593.753576] binder: 3785:3826 BC_ACQUIRE_DONE u0000000000000003 no match 18:07:03 executing program 3: r0 = socket(0x10, 0x3, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") ioctl$sock_ifreq(r0, 0x89f3, &(0x7f0000000240)={'sit0\x00'}) 18:07:03 executing program 1: clone(0x2102001fff, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) socket(0x0, 0x0, 0x0) r0 = getpid() rt_tgsigqueueinfo(0x0, r0, 0x16, &(0x7f0000000100)) rt_sigqueueinfo(r0, 0x7, &(0x7f0000000180)={0x0, 0x0, 0xffffffff}) 18:07:03 executing program 4: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000040)='/dev/net/tun\x00', 0x0, 0x0) r1 = epoll_create1(0x0) epoll_ctl$EPOLL_CTL_ADD(0xffffffffffffffff, 0x1, r0, &(0x7f0000000100)) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000080)={'tunl0\x00', 0x1}) epoll_wait(r1, &(0x7f00000000c0)=[{}], 0x1, 0x0) [ 2593.753588] binder: 3785:3826 transaction failed 29189/-22, size 80-24 line 3014 [ 2593.753868] binder: undelivered TRANSACTION_ERROR: 29189 18:07:03 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000006c0)={0x118, 0x0, &(0x7f0000000540)=[@release={0x40046306, 0x2}, @acquire_done, @acquire_done={0x40106309, 0x3}, @transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x50, 0x18, &(0x7f0000000080)={@flat=@binder={0x73622a85, 0xa, 0x1}, @fda={0x66646185, 0xa, 0x1, 0x9}, @fd={0x66642a85, 0x0, r1}}, &(0x7f0000000100)={0x0, 0x18, 0x38}}, 0x1000}, @transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000180)={@ptr={0x70742a85, 0x0, &(0x7f0000000140)=""/51, 0x33, 0x2, 0x25}, @flat=@weak_handle={0x77682a85, 0x1}, @flat=@binder={0x73622a85, 0xa, 0x3}}, &(0x7f0000000280)={0x0, 0x28, 0x40}}, 0x1f8aed83e3349436}, @exit_looper, @transaction_sg={0x40486311, {0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x68, 0x18, &(0x7f0000000480)={@ptr={0x70742a85, 0x0, &(0x7f00000002c0)=""/11, 0xb, 0x2, 0x3f}, @fd={0x66642a85, 0x0, r0}, @ptr={0x70742a85, 0x0, &(0x7f0000000380)=""/70, 0x46, 0x1, 0x1f}}, &(0x7f0000000500)={0x0, 0x28, 0x40}}, 0x1000}], 0x14, 0x0, &(0x7f0000000680)="86621f50fcee8bdc5bf8c503a78812261b4bf6d7"}) 18:07:03 executing program 3: r0 = socket(0x10, 0x3, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") ioctl$sock_ifreq(r0, 0x89f3, &(0x7f0000000240)={'sit0\x00'}) [ 2593.883445] binder: 3864:3868 Release 1 refcount change on invalid ref 2 ret -22 [ 2593.883455] binder: 3864:3868 BC_ACQUIRE_DONE u0000000000000000 no match 18:07:03 executing program 2: ioctl$FS_IOC_RESVSP(0xffffffffffffffff, 0x40305828, &(0x7f00000000c0)={0x0, 0x0, 0x100000000000001}) clone(0x2102001fff, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) socket(0x0, 0x0, 0x0) r0 = getpid() rt_tgsigqueueinfo(0x0, r0, 0x16, &(0x7f0000000100)) ptrace(0x10, r0) ptrace$poke(0x4209, r0, &(0x7f00000000c0), 0x70effd) 18:07:03 executing program 1: clone(0x2102001fff, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) socket(0x0, 0x0, 0x0) r0 = getpid() rt_tgsigqueueinfo(0x0, r0, 0x16, &(0x7f0000000100)) rt_sigqueueinfo(r0, 0x7, &(0x7f0000000180)={0x0, 0x0, 0xffffffff}) [ 2593.883463] binder: 3864:3868 BC_ACQUIRE_DONE u0000000000000003 no match [ 2593.883476] binder: 3864:3868 transaction failed 29189/-22, size 80-24 line 3014 18:07:03 executing program 4: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000040)='/dev/net/tun\x00', 0x0, 0x0) r1 = epoll_create1(0x0) epoll_ctl$EPOLL_CTL_ADD(0xffffffffffffffff, 0x1, r0, &(0x7f0000000100)) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000080)={'tunl0\x00', 0x1}) epoll_wait(r1, &(0x7f00000000c0)=[{}], 0x1, 0x0) 18:07:03 executing program 1: clone(0x2102001fff, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) socket(0x0, 0x0, 0x0) r0 = getpid() rt_tgsigqueueinfo(0x0, r0, 0x16, &(0x7f0000000100)) rt_sigqueueinfo(r0, 0x7, &(0x7f0000000180)={0x0, 0x0, 0xffffffff}) 18:07:03 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000006c0)={0x118, 0x0, &(0x7f0000000540)=[@release={0x40046306, 0x2}, @acquire_done, @acquire_done={0x40106309, 0x3}, @transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x50, 0x18, &(0x7f0000000080)={@flat=@binder={0x73622a85, 0xa, 0x1}, @fda={0x66646185, 0xa, 0x1, 0x9}, @fd={0x66642a85, 0x0, r1}}, &(0x7f0000000100)={0x0, 0x18, 0x38}}, 0x1000}, @transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000180)={@ptr={0x70742a85, 0x0, &(0x7f0000000140)=""/51, 0x33, 0x2, 0x25}, @flat=@weak_handle={0x77682a85, 0x1}, @flat=@binder={0x73622a85, 0xa, 0x3}}, &(0x7f0000000280)={0x0, 0x28, 0x40}}, 0x1f8aed83e3349436}, @exit_looper, @transaction_sg={0x40486311, {0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x68, 0x18, &(0x7f0000000480)={@ptr={0x70742a85, 0x0, &(0x7f00000002c0)=""/11, 0xb, 0x2, 0x3f}, @fd={0x66642a85, 0x0, r0}, @ptr={0x70742a85, 0x0, &(0x7f0000000380)=""/70, 0x46, 0x1, 0x1f}}, &(0x7f0000000500)={0x0, 0x28, 0x40}}, 0x1000}], 0x14, 0x0, &(0x7f0000000680)="86621f50fcee8bdc5bf8c503a78812261b4bf6d7"}) [ 2593.884657] binder: undelivered TRANSACTION_ERROR: 29189 18:07:03 executing program 5: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000001a00)='/dev/net/tun\x00', 0x0, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000080)="c0dc00025e0b01047be070") ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000300)={'nr0\x01\x00', 0x1132}) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000001a00)='/dev/net/tun\x00', 0x2, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000300)={'nr0\x01\x00', 0x1132}) write$cgroup_int(0xffffffffffffffff, &(0x7f00000000c0)=0x2, 0xfffffffffffffe75) close(r1) [ 2594.023624] binder: 3900:3906 Release 1 refcount change on invalid ref 2 ret -22 18:07:03 executing program 3: r0 = socket(0x10, 0x3, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") ioctl$sock_ifreq(r0, 0x89f3, &(0x7f0000000240)={'sit0\x00'}) 18:07:04 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000006c0)={0x118, 0x0, &(0x7f0000000540)=[@release={0x40046306, 0x2}, @acquire_done, @acquire_done={0x40106309, 0x3}, @transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x50, 0x18, &(0x7f0000000080)={@flat=@binder={0x73622a85, 0xa, 0x1}, @fda={0x66646185, 0xa, 0x1, 0x9}, @fd={0x66642a85, 0x0, r1}}, &(0x7f0000000100)={0x0, 0x18, 0x38}}, 0x1000}, @transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000180)={@ptr={0x70742a85, 0x0, &(0x7f0000000140)=""/51, 0x33, 0x2, 0x25}, @flat=@weak_handle={0x77682a85, 0x1}, @flat=@binder={0x73622a85, 0xa, 0x3}}, &(0x7f0000000280)={0x0, 0x28, 0x40}}, 0x1f8aed83e3349436}, @exit_looper, @transaction_sg={0x40486311, {0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x68, 0x18, &(0x7f0000000480)={@ptr={0x70742a85, 0x0, &(0x7f00000002c0)=""/11, 0xb, 0x2, 0x3f}, @fd={0x66642a85, 0x0, r0}, @ptr={0x70742a85, 0x0, &(0x7f0000000380)=""/70, 0x46, 0x1, 0x1f}}, &(0x7f0000000500)={0x0, 0x28, 0x40}}, 0x1000}], 0x14, 0x0, &(0x7f0000000680)="86621f50fcee8bdc5bf8c503a78812261b4bf6d7"}) [ 2594.023634] binder: 3900:3906 BC_ACQUIRE_DONE u0000000000000000 no match [ 2594.023643] binder: 3900:3906 BC_ACQUIRE_DONE u0000000000000003 no match 18:07:04 executing program 2: ioctl$FS_IOC_RESVSP(0xffffffffffffffff, 0x40305828, &(0x7f00000000c0)={0x0, 0x0, 0x100000000000001}) clone(0x2102001fff, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) socket(0x0, 0x0, 0x0) r0 = getpid() rt_tgsigqueueinfo(0x0, r0, 0x16, &(0x7f0000000100)) ptrace(0x10, r0) ptrace$poke(0x4209, r0, &(0x7f00000000c0), 0x70effd) 18:07:04 executing program 1: clone(0x2102001fff, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) socket(0x0, 0x0, 0x0) r0 = getpid() rt_tgsigqueueinfo(0x0, r0, 0x16, &(0x7f0000000100)) rt_sigqueueinfo(r0, 0x7, &(0x7f0000000180)={0x0, 0x0, 0xffffffff}) 18:07:04 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000006c0)={0x118, 0x0, &(0x7f0000000540)=[@release={0x40046306, 0x2}, @acquire_done, @acquire_done={0x40106309, 0x3}, @transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x50, 0x18, &(0x7f0000000080)={@flat=@binder={0x73622a85, 0xa, 0x1}, @fda={0x66646185, 0xa, 0x1, 0x9}, @fd={0x66642a85, 0x0, r1}}, &(0x7f0000000100)={0x0, 0x18, 0x38}}, 0x1000}, @transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000180)={@ptr={0x70742a85, 0x0, &(0x7f0000000140)=""/51, 0x33, 0x2, 0x25}, @flat=@weak_handle={0x77682a85, 0x1}, @flat=@binder={0x73622a85, 0xa, 0x3}}, &(0x7f0000000280)={0x0, 0x28, 0x40}}, 0x1f8aed83e3349436}, @exit_looper, @transaction_sg={0x40486311, {0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x68, 0x18, &(0x7f0000000480)={@ptr={0x70742a85, 0x0, &(0x7f00000002c0)=""/11, 0xb, 0x2, 0x3f}, @fd={0x66642a85, 0x0, r0}, @ptr={0x70742a85, 0x0, &(0x7f0000000380)=""/70, 0x46, 0x1, 0x1f}}, &(0x7f0000000500)={0x0, 0x28, 0x40}}, 0x1000}], 0x14, 0x0, &(0x7f0000000680)="86621f50fcee8bdc5bf8c503a78812261b4bf6d7"}) [ 2594.023658] binder: 3900:3906 transaction failed 29189/-22, size 80-24 line 3014 [ 2594.026469] binder: undelivered TRANSACTION_ERROR: 29189 18:07:04 executing program 4: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000040)='/dev/net/tun\x00', 0x0, 0x0) r1 = epoll_create1(0x0) epoll_ctl$EPOLL_CTL_ADD(0xffffffffffffffff, 0x1, r0, &(0x7f0000000100)) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000080)={'tunl0\x00', 0x1}) epoll_wait(r1, &(0x7f00000000c0)=[{}], 0x1, 0x0) 18:07:04 executing program 3: r0 = socket(0x10, 0x3, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") ioctl$sock_ifreq(r0, 0x89f3, &(0x7f0000000240)={'sit0\x00'}) 18:07:04 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000006c0)={0x118, 0x0, &(0x7f0000000540)=[@release={0x40046306, 0x2}, @acquire_done, @acquire_done={0x40106309, 0x3}, @transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x50, 0x18, &(0x7f0000000080)={@flat=@binder={0x73622a85, 0xa, 0x1}, @fda={0x66646185, 0xa, 0x1, 0x9}, @fd={0x66642a85, 0x0, r1}}, &(0x7f0000000100)={0x0, 0x18, 0x38}}, 0x1000}, @transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000180)={@ptr={0x70742a85, 0x0, &(0x7f0000000140)=""/51, 0x33, 0x2, 0x25}, @flat=@weak_handle={0x77682a85, 0x1}, @flat=@binder={0x73622a85, 0xa, 0x3}}, &(0x7f0000000280)={0x0, 0x28, 0x40}}, 0x1f8aed83e3349436}, @exit_looper, @transaction_sg={0x40486311, {0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x68, 0x18, &(0x7f0000000480)={@ptr={0x70742a85, 0x0, &(0x7f00000002c0)=""/11, 0xb, 0x2, 0x3f}, @fd={0x66642a85, 0x0, r0}, @ptr={0x70742a85, 0x0, &(0x7f0000000380)=""/70, 0x46, 0x1, 0x1f}}, &(0x7f0000000500)={0x0, 0x28, 0x40}}, 0x1000}], 0x14, 0x0, &(0x7f0000000680)="86621f50fcee8bdc5bf8c503a78812261b4bf6d7"}) [ 2594.166049] binder: 3960:3987 Release 1 refcount change on invalid ref 2 ret -22 18:07:04 executing program 3: r0 = socket(0x10, 0x3, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") ioctl$sock_ifreq(r0, 0x89f3, &(0x7f0000000240)={'sit0\x00'}) 18:07:04 executing program 1: clone(0x2102001fff, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) socket(0x0, 0x0, 0x0) r0 = getpid() rt_tgsigqueueinfo(0x0, r0, 0x16, &(0x7f0000000100)) rt_sigqueueinfo(r0, 0x7, &(0x7f0000000180)={0x0, 0x0, 0xffffffff}) [ 2594.166059] binder: 3960:3987 BC_ACQUIRE_DONE u0000000000000000 no match [ 2594.166066] binder: 3960:3987 BC_ACQUIRE_DONE u0000000000000003 no match 18:07:04 executing program 5: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000001a00)='/dev/net/tun\x00', 0x0, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000080)="c0dc00025e0b01047be070") ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000300)={'nr0\x01\x00', 0x1132}) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000001a00)='/dev/net/tun\x00', 0x2, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000300)={'nr0\x01\x00', 0x1132}) write$cgroup_int(0xffffffffffffffff, &(0x7f00000000c0)=0x2, 0xfffffffffffffe75) close(r1) 18:07:04 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000006c0)={0x118, 0x0, &(0x7f0000000540)=[@release={0x40046306, 0x2}, @acquire_done, @acquire_done={0x40106309, 0x3}, @transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x50, 0x18, &(0x7f0000000080)={@flat=@binder={0x73622a85, 0xa, 0x1}, @fda={0x66646185, 0xa, 0x1, 0x9}, @fd={0x66642a85, 0x0, r1}}, &(0x7f0000000100)={0x0, 0x18, 0x38}}, 0x1000}, @transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000180)={@ptr={0x70742a85, 0x0, &(0x7f0000000140)=""/51, 0x33, 0x2, 0x25}, @flat=@weak_handle={0x77682a85, 0x1}, @flat=@binder={0x73622a85, 0xa, 0x3}}, &(0x7f0000000280)={0x0, 0x28, 0x40}}, 0x1f8aed83e3349436}, @exit_looper, @transaction_sg={0x40486311, {0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x68, 0x18, &(0x7f0000000480)={@ptr={0x70742a85, 0x0, &(0x7f00000002c0)=""/11, 0xb, 0x2, 0x3f}, @fd={0x66642a85, 0x0, r0}, @ptr={0x70742a85, 0x0, &(0x7f0000000380)=""/70, 0x46, 0x1, 0x1f}}, &(0x7f0000000500)={0x0, 0x28, 0x40}}, 0x1000}], 0x14, 0x0, &(0x7f0000000680)="86621f50fcee8bdc5bf8c503a78812261b4bf6d7"}) 18:07:04 executing program 3: r0 = socket(0x10, 0x3, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") ioctl$sock_ifreq(r0, 0x89f3, &(0x7f0000000240)={'sit0\x00'}) [ 2594.166079] binder: 3960:3987 transaction failed 29189/-22, size 80-24 line 3014 18:07:04 executing program 2: ioctl$FS_IOC_RESVSP(0xffffffffffffffff, 0x40305828, &(0x7f00000000c0)={0x0, 0x0, 0x100000000000001}) clone(0x2102001fff, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) socket(0x0, 0x0, 0x0) r0 = getpid() rt_tgsigqueueinfo(0x0, r0, 0x16, &(0x7f0000000100)) ptrace(0x10, r0) ptrace$poke(0x4209, r0, &(0x7f00000000c0), 0x70effd) 18:07:04 executing program 4: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000040)='/dev/net/tun\x00', 0x0, 0x0) r1 = epoll_create1(0x0) epoll_ctl$EPOLL_CTL_ADD(0xffffffffffffffff, 0x1, r0, &(0x7f0000000100)) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000080)={'tunl0\x00', 0x1}) epoll_wait(r1, &(0x7f00000000c0)=[{}], 0x1, 0x0) 18:07:04 executing program 1: clone(0x2102001fff, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) socket(0x0, 0x0, 0x0) r0 = getpid() rt_tgsigqueueinfo(0x0, r0, 0x16, &(0x7f0000000100)) rt_sigqueueinfo(r0, 0x7, &(0x7f0000000180)={0x0, 0x0, 0xffffffff}) [ 2594.166558] binder: undelivered TRANSACTION_ERROR: 29189 18:07:04 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000006c0)={0x118, 0x0, &(0x7f0000000540)=[@release={0x40046306, 0x2}, @acquire_done, @acquire_done={0x40106309, 0x3}, @transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x50, 0x18, &(0x7f0000000080)={@flat=@binder={0x73622a85, 0xa, 0x1}, @fda={0x66646185, 0xa, 0x1, 0x9}, @fd={0x66642a85, 0x0, r1}}, &(0x7f0000000100)={0x0, 0x18, 0x38}}, 0x1000}, @transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000180)={@ptr={0x70742a85, 0x0, &(0x7f0000000140)=""/51, 0x33, 0x2, 0x25}, @flat=@weak_handle={0x77682a85, 0x1}, @flat=@binder={0x73622a85, 0xa, 0x3}}, &(0x7f0000000280)={0x0, 0x28, 0x40}}, 0x1f8aed83e3349436}, @exit_looper, @transaction_sg={0x40486311, {0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x68, 0x18, &(0x7f0000000480)={@ptr={0x70742a85, 0x0, &(0x7f00000002c0)=""/11, 0xb, 0x2, 0x3f}, @fd={0x66642a85, 0x0, r0}, @ptr={0x70742a85, 0x0, &(0x7f0000000380)=""/70, 0x46, 0x1, 0x1f}}, &(0x7f0000000500)={0x0, 0x28, 0x40}}, 0x1000}], 0x14, 0x0, &(0x7f0000000680)="86621f50fcee8bdc5bf8c503a78812261b4bf6d7"}) [ 2594.350030] binder: 4020:4045 Release 1 refcount change on invalid ref 2 ret -22 18:07:04 executing program 3: r0 = socket(0x10, 0x3, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") ioctl$sock_ifreq(r0, 0x89f3, &(0x7f0000000240)={'sit0\x00'}) 18:07:04 executing program 1: clone(0x2102001fff, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) socket(0x0, 0x0, 0x0) r0 = getpid() rt_tgsigqueueinfo(0x0, r0, 0x16, &(0x7f0000000100)) rt_sigqueueinfo(r0, 0x7, &(0x7f0000000180)={0x0, 0x0, 0xffffffff}) [ 2594.350040] binder: 4020:4045 BC_ACQUIRE_DONE u0000000000000000 no match [ 2594.350047] binder: 4020:4045 BC_ACQUIRE_DONE u0000000000000003 no match 18:07:04 executing program 3: r0 = socket(0x10, 0x3, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") ioctl$sock_ifreq(r0, 0x89f3, &(0x7f0000000240)={'sit0\x00'}) [ 2594.350059] binder: 4020:4045 transaction failed 29189/-22, size 80-24 line 3014 18:07:04 executing program 4: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000040)='/dev/net/tun\x00', 0x0, 0x0) r1 = epoll_create1(0x0) epoll_ctl$EPOLL_CTL_ADD(0xffffffffffffffff, 0x1, r0, &(0x7f0000000100)) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000080)={'tunl0\x00', 0x1}) epoll_wait(r1, &(0x7f00000000c0)=[{}], 0x1, 0x0) 18:07:04 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000006c0)={0x118, 0x0, &(0x7f0000000540)=[@release={0x40046306, 0x2}, @acquire_done, @acquire_done={0x40106309, 0x3}, @transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x50, 0x18, &(0x7f0000000080)={@flat=@binder={0x73622a85, 0xa, 0x1}, @fda={0x66646185, 0xa, 0x1, 0x9}, @fd={0x66642a85, 0x0, r1}}, &(0x7f0000000100)={0x0, 0x18, 0x38}}, 0x1000}, @transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000180)={@ptr={0x70742a85, 0x0, &(0x7f0000000140)=""/51, 0x33, 0x2, 0x25}, @flat=@weak_handle={0x77682a85, 0x1}, @flat=@binder={0x73622a85, 0xa, 0x3}}, &(0x7f0000000280)={0x0, 0x28, 0x40}}, 0x1f8aed83e3349436}, @exit_looper, @transaction_sg={0x40486311, {0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x68, 0x18, &(0x7f0000000480)={@ptr={0x70742a85, 0x0, &(0x7f00000002c0)=""/11, 0xb, 0x2, 0x3f}, @fd={0x66642a85, 0x0, r0}, @ptr={0x70742a85, 0x0, &(0x7f0000000380)=""/70, 0x46, 0x1, 0x1f}}, &(0x7f0000000500)={0x0, 0x28, 0x40}}, 0x1000}], 0x14, 0x0, &(0x7f0000000680)="86621f50fcee8bdc5bf8c503a78812261b4bf6d7"}) [ 2594.350336] binder: undelivered TRANSACTION_ERROR: 29189 [ 2594.517341] binder: 4075:4088 Release 1 refcount change on invalid ref 2 ret -22 18:07:04 executing program 5: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000001a00)='/dev/net/tun\x00', 0x0, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000080)="c0dc00025e0b01047be070") ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000300)={'nr0\x01\x00', 0x1132}) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000001a00)='/dev/net/tun\x00', 0x2, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000300)={'nr0\x01\x00', 0x1132}) write$cgroup_int(0xffffffffffffffff, &(0x7f00000000c0)=0x2, 0xfffffffffffffe75) close(r1) 18:07:04 executing program 2: ioctl$FS_IOC_RESVSP(0xffffffffffffffff, 0x40305828, &(0x7f00000000c0)={0x0, 0x0, 0x100000000000001}) clone(0x2102001fff, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) socket(0x0, 0x0, 0x0) r0 = getpid() rt_tgsigqueueinfo(0x0, r0, 0x16, &(0x7f0000000100)) ptrace(0x10, r0) ptrace$poke(0x4209, r0, &(0x7f00000000c0), 0x70effd) 18:07:04 executing program 1: clone(0x2102001fff, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) socket(0x0, 0x0, 0x0) r0 = getpid() rt_tgsigqueueinfo(0x0, r0, 0x16, &(0x7f0000000100)) rt_sigqueueinfo(r0, 0x7, &(0x7f0000000180)={0x0, 0x0, 0xffffffff}) 18:07:04 executing program 3: r0 = socket(0x10, 0x3, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") ioctl$sock_ifreq(r0, 0x89f3, &(0x7f0000000240)={'sit0\x00'}) 18:07:04 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000006c0)={0x118, 0x0, &(0x7f0000000540)=[@release={0x40046306, 0x2}, @acquire_done, @acquire_done={0x40106309, 0x3}, @transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x50, 0x18, &(0x7f0000000080)={@flat=@binder={0x73622a85, 0xa, 0x1}, @fda={0x66646185, 0xa, 0x1, 0x9}, @fd={0x66642a85, 0x0, r1}}, &(0x7f0000000100)={0x0, 0x18, 0x38}}, 0x1000}, @transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000180)={@ptr={0x70742a85, 0x0, &(0x7f0000000140)=""/51, 0x33, 0x2, 0x25}, @flat=@weak_handle={0x77682a85, 0x1}, @flat=@binder={0x73622a85, 0xa, 0x3}}, &(0x7f0000000280)={0x0, 0x28, 0x40}}, 0x1f8aed83e3349436}, @exit_looper, @transaction_sg={0x40486311, {0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x68, 0x18, &(0x7f0000000480)={@ptr={0x70742a85, 0x0, &(0x7f00000002c0)=""/11, 0xb, 0x2, 0x3f}, @fd={0x66642a85, 0x0, r0}, @ptr={0x70742a85, 0x0, &(0x7f0000000380)=""/70, 0x46, 0x1, 0x1f}}, &(0x7f0000000500)={0x0, 0x28, 0x40}}, 0x1000}], 0x14, 0x0, &(0x7f0000000680)="86621f50fcee8bdc5bf8c503a78812261b4bf6d7"}) [ 2594.517351] binder: 4075:4088 BC_ACQUIRE_DONE u0000000000000000 no match [ 2594.517358] binder: 4075:4088 BC_ACQUIRE_DONE u0000000000000003 no match 18:07:04 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000006c0)={0x118, 0x0, &(0x7f0000000540)=[@release={0x40046306, 0x2}, @acquire_done, @acquire_done={0x40106309, 0x3}, @transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x50, 0x18, &(0x7f0000000080)={@flat=@binder={0x73622a85, 0xa, 0x1}, @fda={0x66646185, 0xa, 0x1, 0x9}, @fd={0x66642a85, 0x0, r1}}, &(0x7f0000000100)={0x0, 0x18, 0x38}}, 0x1000}, @transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000180)={@ptr={0x70742a85, 0x0, &(0x7f0000000140)=""/51, 0x33, 0x2, 0x25}, @flat=@weak_handle={0x77682a85, 0x1}, @flat=@binder={0x73622a85, 0xa, 0x3}}, &(0x7f0000000280)={0x0, 0x28, 0x40}}, 0x1f8aed83e3349436}, @exit_looper, @transaction_sg={0x40486311, {0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x68, 0x18, &(0x7f0000000480)={@ptr={0x70742a85, 0x0, &(0x7f00000002c0)=""/11, 0xb, 0x2, 0x3f}, @fd={0x66642a85, 0x0, r0}, @ptr={0x70742a85, 0x0, &(0x7f0000000380)=""/70, 0x46, 0x1, 0x1f}}, &(0x7f0000000500)={0x0, 0x28, 0x40}}, 0x1000}], 0x14, 0x0, &(0x7f0000000680)="86621f50fcee8bdc5bf8c503a78812261b4bf6d7"}) [ 2594.517370] binder: 4075:4088 transaction failed 29189/-22, size 80-24 line 3014 [ 2594.517645] binder: undelivered TRANSACTION_ERROR: 29189 [ 2594.662625] binder: 4164:4174 Release 1 refcount change on invalid ref 2 ret -22 [ 2594.662635] binder: 4164:4174 BC_ACQUIRE_DONE u0000000000000000 no match 18:07:04 executing program 2: ioctl$FS_IOC_RESVSP(0xffffffffffffffff, 0x40305828, &(0x7f00000000c0)={0x0, 0x0, 0x100000000000001}) clone(0x2102001fff, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) socket(0x0, 0x0, 0x0) r0 = getpid() rt_tgsigqueueinfo(0x0, r0, 0x16, &(0x7f0000000100)) ptrace(0x10, r0) ptrace$poke(0x4209, r0, &(0x7f00000000c0), 0x70effd) 18:07:04 executing program 1: clone(0x2102001fff, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) socket(0x0, 0x0, 0x0) r0 = getpid() rt_tgsigqueueinfo(0x0, r0, 0x16, &(0x7f0000000100)) rt_sigqueueinfo(r0, 0x7, &(0x7f0000000180)={0x0, 0x0, 0xffffffff}) [ 2594.662643] binder: 4164:4174 BC_ACQUIRE_DONE u0000000000000003 no match [ 2594.662656] binder: 4164:4174 transaction failed 29189/-22, size 80-24 line 3014 [ 2594.662948] binder: undelivered TRANSACTION_ERROR: 29189 18:07:04 executing program 3: r0 = socket(0x10, 0x3, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") ioctl$sock_ifreq(r0, 0x89f3, &(0x7f0000000240)={'sit0\x00'}) 18:07:04 executing program 4: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000040)='/dev/net/tun\x00', 0x0, 0x0) r1 = epoll_create1(0x0) epoll_ctl$EPOLL_CTL_ADD(0xffffffffffffffff, 0x1, r0, &(0x7f0000000100)) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000080)={'tunl0\x00', 0x1}) epoll_wait(r1, &(0x7f00000000c0)=[{}], 0x1, 0x0) [ 2594.825108] binder: 4224:4231 Release 1 refcount change on invalid ref 2 ret -22 18:07:05 executing program 1: clone(0x2102001fff, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) socket(0x0, 0x0, 0x0) r0 = getpid() rt_tgsigqueueinfo(0x0, r0, 0x16, &(0x7f0000000100)) rt_sigqueueinfo(r0, 0x7, &(0x7f0000000180)={0x0, 0x0, 0xffffffff}) 18:07:05 executing program 5: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000001a00)='/dev/net/tun\x00', 0x0, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000080)="c0dc00025e0b01047be070") ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000300)={'nr0\x01\x00', 0x1132}) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000001a00)='/dev/net/tun\x00', 0x2, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000300)={'nr0\x01\x00', 0x1132}) write$cgroup_int(0xffffffffffffffff, &(0x7f00000000c0)=0x2, 0xfffffffffffffe75) close(r1) 18:07:05 executing program 3: r0 = socket(0x10, 0x3, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") ioctl$sock_ifreq(r0, 0x89f3, &(0x7f0000000240)={'sit0\x00'}) 18:07:05 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000006c0)={0x118, 0x0, &(0x7f0000000540)=[@release={0x40046306, 0x2}, @acquire_done, @acquire_done={0x40106309, 0x3}, @transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x50, 0x18, &(0x7f0000000080)={@flat=@binder={0x73622a85, 0xa, 0x1}, @fda={0x66646185, 0xa, 0x1, 0x9}, @fd={0x66642a85, 0x0, r1}}, &(0x7f0000000100)={0x0, 0x18, 0x38}}, 0x1000}, @transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000180)={@ptr={0x70742a85, 0x0, &(0x7f0000000140)=""/51, 0x33, 0x2, 0x25}, @flat=@weak_handle={0x77682a85, 0x1}, @flat=@binder={0x73622a85, 0xa, 0x3}}, &(0x7f0000000280)={0x0, 0x28, 0x40}}, 0x1f8aed83e3349436}, @exit_looper, @transaction_sg={0x40486311, {0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x68, 0x18, &(0x7f0000000480)={@ptr={0x70742a85, 0x0, &(0x7f00000002c0)=""/11, 0xb, 0x2, 0x3f}, @fd={0x66642a85, 0x0, r0}, @ptr={0x70742a85, 0x0, &(0x7f0000000380)=""/70, 0x46, 0x1, 0x1f}}, &(0x7f0000000500)={0x0, 0x28, 0x40}}, 0x1000}], 0x14, 0x0, &(0x7f0000000680)="86621f50fcee8bdc5bf8c503a78812261b4bf6d7"}) [ 2594.825118] binder: 4224:4231 BC_ACQUIRE_DONE u0000000000000000 no match [ 2594.825126] binder: 4224:4231 BC_ACQUIRE_DONE u0000000000000003 no match 18:07:05 executing program 1: clone(0x2102001fff, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) socket(0x0, 0x0, 0x0) r0 = getpid() rt_tgsigqueueinfo(0x0, r0, 0x16, &(0x7f0000000100)) rt_sigqueueinfo(r0, 0x7, &(0x7f0000000180)={0x0, 0x0, 0xffffffff}) [ 2594.825141] binder: 4224:4231 transaction failed 29189/-22, size 80-24 line 3014 18:07:05 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000006c0)={0x118, 0x0, &(0x7f0000000540)=[@release={0x40046306, 0x2}, @acquire_done, @acquire_done={0x40106309, 0x3}, @transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x50, 0x18, &(0x7f0000000080)={@flat=@binder={0x73622a85, 0xa, 0x1}, @fda={0x66646185, 0xa, 0x1, 0x9}, @fd={0x66642a85, 0x0, r1}}, &(0x7f0000000100)={0x0, 0x18, 0x38}}, 0x1000}, @transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000180)={@ptr={0x70742a85, 0x0, &(0x7f0000000140)=""/51, 0x33, 0x2, 0x25}, @flat=@weak_handle={0x77682a85, 0x1}, @flat=@binder={0x73622a85, 0xa, 0x3}}, &(0x7f0000000280)={0x0, 0x28, 0x40}}, 0x1f8aed83e3349436}, @exit_looper, @transaction_sg={0x40486311, {0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x68, 0x18, &(0x7f0000000480)={@ptr={0x70742a85, 0x0, &(0x7f00000002c0)=""/11, 0xb, 0x2, 0x3f}, @fd={0x66642a85, 0x0, r0}, @ptr={0x70742a85, 0x0, &(0x7f0000000380)=""/70, 0x46, 0x1, 0x1f}}, &(0x7f0000000500)={0x0, 0x28, 0x40}}, 0x1000}], 0x14, 0x0, &(0x7f0000000680)="86621f50fcee8bdc5bf8c503a78812261b4bf6d7"}) 18:07:05 executing program 3: r0 = socket(0x10, 0x3, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") ioctl$sock_ifreq(r0, 0x89f3, &(0x7f0000000240)={'sit0\x00'}) [ 2594.825490] binder: undelivered TRANSACTION_ERROR: 29189 18:07:05 executing program 4: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000040)='/dev/net/tun\x00', 0x0, 0x0) r1 = epoll_create1(0x0) epoll_ctl$EPOLL_CTL_ADD(0xffffffffffffffff, 0x1, r0, &(0x7f0000000100)) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000080)={'tunl0\x00', 0x1}) epoll_wait(r1, &(0x7f00000000c0)=[{}], 0x1, 0x0) 18:07:05 executing program 2: ioctl$FS_IOC_RESVSP(0xffffffffffffffff, 0x40305828, &(0x7f00000000c0)={0x0, 0x0, 0x100000000000001}) clone(0x2102001fff, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) socket(0x0, 0x0, 0x0) r0 = getpid() rt_tgsigqueueinfo(0x0, r0, 0x16, &(0x7f0000000100)) ptrace(0x10, r0) ptrace$poke(0x4209, r0, &(0x7f00000000c0), 0x70effd) 18:07:05 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000006c0)={0x118, 0x0, &(0x7f0000000540)=[@release={0x40046306, 0x2}, @acquire_done, @acquire_done={0x40106309, 0x3}, @transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x50, 0x18, &(0x7f0000000080)={@flat=@binder={0x73622a85, 0xa, 0x1}, @fda={0x66646185, 0xa, 0x1, 0x9}, @fd={0x66642a85, 0x0, r1}}, &(0x7f0000000100)={0x0, 0x18, 0x38}}, 0x1000}, @transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000180)={@ptr={0x70742a85, 0x0, &(0x7f0000000140)=""/51, 0x33, 0x2, 0x25}, @flat=@weak_handle={0x77682a85, 0x1}, @flat=@binder={0x73622a85, 0xa, 0x3}}, &(0x7f0000000280)={0x0, 0x28, 0x40}}, 0x1f8aed83e3349436}, @exit_looper, @transaction_sg={0x40486311, {0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x68, 0x18, &(0x7f0000000480)={@ptr={0x70742a85, 0x0, &(0x7f00000002c0)=""/11, 0xb, 0x2, 0x3f}, @fd={0x66642a85, 0x0, r0}, @ptr={0x70742a85, 0x0, &(0x7f0000000380)=""/70, 0x46, 0x1, 0x1f}}, &(0x7f0000000500)={0x0, 0x28, 0x40}}, 0x1000}], 0x14, 0x0, &(0x7f0000000680)="86621f50fcee8bdc5bf8c503a78812261b4bf6d7"}) [ 2594.995966] binder: 4259:4271 Release 1 refcount change on invalid ref 2 ret -22 18:07:05 executing program 3: r0 = socket(0x10, 0x3, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") ioctl$sock_ifreq(r0, 0x89f3, &(0x7f0000000240)={'sit0\x00'}) 18:07:05 executing program 1: clone(0x2102001fff, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) socket(0x0, 0x0, 0x0) r0 = getpid() rt_tgsigqueueinfo(0x0, r0, 0x16, &(0x7f0000000100)) rt_sigqueueinfo(r0, 0x7, &(0x7f0000000180)={0x0, 0x0, 0xffffffff}) [ 2594.995975] binder: 4259:4271 BC_ACQUIRE_DONE u0000000000000000 no match 18:07:05 executing program 5: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000001a00)='/dev/net/tun\x00', 0x0, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000080)="c0dc00025e0b01047be070") ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000300)={'nr0\x01\x00', 0x1132}) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000001a00)='/dev/net/tun\x00', 0x2, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000300)={'nr0\x01\x00', 0x1132}) write$cgroup_int(0xffffffffffffffff, &(0x7f00000000c0)=0x2, 0xfffffffffffffe75) close(r1) 18:07:05 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000006c0)={0x118, 0x0, &(0x7f0000000540)=[@release={0x40046306, 0x2}, @acquire_done, @acquire_done={0x40106309, 0x3}, @transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x50, 0x18, &(0x7f0000000080)={@flat=@binder={0x73622a85, 0xa, 0x1}, @fda={0x66646185, 0xa, 0x1, 0x9}, @fd={0x66642a85, 0x0, r1}}, &(0x7f0000000100)={0x0, 0x18, 0x38}}, 0x1000}, @transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000180)={@ptr={0x70742a85, 0x0, &(0x7f0000000140)=""/51, 0x33, 0x2, 0x25}, @flat=@weak_handle={0x77682a85, 0x1}, @flat=@binder={0x73622a85, 0xa, 0x3}}, &(0x7f0000000280)={0x0, 0x28, 0x40}}, 0x1f8aed83e3349436}, @exit_looper, @transaction_sg={0x40486311, {0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x68, 0x18, &(0x7f0000000480)={@ptr={0x70742a85, 0x0, &(0x7f00000002c0)=""/11, 0xb, 0x2, 0x3f}, @fd={0x66642a85, 0x0, r0}, @ptr={0x70742a85, 0x0, &(0x7f0000000380)=""/70, 0x46, 0x1, 0x1f}}, &(0x7f0000000500)={0x0, 0x28, 0x40}}, 0x1000}], 0x14, 0x0, &(0x7f0000000680)="86621f50fcee8bdc5bf8c503a78812261b4bf6d7"}) [ 2594.996016] binder: 4259:4271 BC_ACQUIRE_DONE u0000000000000003 no match [ 2594.996029] binder: 4259:4271 transaction failed 29189/-22, size 80-24 line 3014 [ 2594.997062] binder: undelivered TRANSACTION_ERROR: 29189 18:07:05 executing program 1: clone(0x2102001fff, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) socket(0x0, 0x0, 0x0) r0 = getpid() rt_tgsigqueueinfo(0x0, r0, 0x16, &(0x7f0000000100)) rt_sigqueueinfo(r0, 0x7, &(0x7f0000000180)={0x0, 0x0, 0xffffffff}) 18:07:05 executing program 2: ioctl$FS_IOC_RESVSP(0xffffffffffffffff, 0x40305828, &(0x7f00000000c0)={0x0, 0x0, 0x100000000000001}) clone(0x2102001fff, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) socket(0x0, 0x0, 0x0) r0 = getpid() rt_tgsigqueueinfo(0x0, r0, 0x16, &(0x7f0000000100)) ptrace(0x10, r0) ptrace$poke(0x4209, r0, &(0x7f00000000c0), 0x70effd) 18:07:05 executing program 4: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000040)='/dev/net/tun\x00', 0x0, 0x0) r1 = epoll_create1(0x0) epoll_ctl$EPOLL_CTL_ADD(0xffffffffffffffff, 0x1, r0, &(0x7f0000000100)) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000080)={'tunl0\x00', 0x1}) epoll_wait(r1, &(0x7f00000000c0)=[{}], 0x1, 0x0) 18:07:05 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000006c0)={0x118, 0x0, &(0x7f0000000540)=[@release={0x40046306, 0x2}, @acquire_done, @acquire_done={0x40106309, 0x3}, @transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x50, 0x18, &(0x7f0000000080)={@flat=@binder={0x73622a85, 0xa, 0x1}, @fda={0x66646185, 0xa, 0x1, 0x9}, @fd={0x66642a85, 0x0, r1}}, &(0x7f0000000100)={0x0, 0x18, 0x38}}, 0x1000}, @transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000180)={@ptr={0x70742a85, 0x0, &(0x7f0000000140)=""/51, 0x33, 0x2, 0x25}, @flat=@weak_handle={0x77682a85, 0x1}, @flat=@binder={0x73622a85, 0xa, 0x3}}, &(0x7f0000000280)={0x0, 0x28, 0x40}}, 0x1f8aed83e3349436}, @exit_looper, @transaction_sg={0x40486311, {0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x68, 0x18, &(0x7f0000000480)={@ptr={0x70742a85, 0x0, &(0x7f00000002c0)=""/11, 0xb, 0x2, 0x3f}, @fd={0x66642a85, 0x0, r0}, @ptr={0x70742a85, 0x0, &(0x7f0000000380)=""/70, 0x46, 0x1, 0x1f}}, &(0x7f0000000500)={0x0, 0x28, 0x40}}, 0x1000}], 0x14, 0x0, &(0x7f0000000680)="86621f50fcee8bdc5bf8c503a78812261b4bf6d7"}) [ 2595.197963] binder: 4324:4338 Release 1 refcount change on invalid ref 2 ret -22 [ 2595.197973] binder: 4324:4338 BC_ACQUIRE_DONE u0000000000000000 no match 18:07:05 executing program 3: r0 = socket(0x10, 0x3, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") ioctl$sock_ifreq(r0, 0x89f3, &(0x7f0000000240)={'sit0\x00'}) [ 2595.197981] binder: 4324:4338 BC_ACQUIRE_DONE u0000000000000003 no match 18:07:05 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000006c0)={0x118, 0x0, &(0x7f0000000540)=[@release={0x40046306, 0x2}, @acquire_done, @acquire_done={0x40106309, 0x3}, @transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x50, 0x18, &(0x7f0000000080)={@flat=@binder={0x73622a85, 0xa, 0x1}, @fda={0x66646185, 0xa, 0x1, 0x9}, @fd={0x66642a85, 0x0, r1}}, &(0x7f0000000100)={0x0, 0x18, 0x38}}, 0x1000}, @transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000180)={@ptr={0x70742a85, 0x0, &(0x7f0000000140)=""/51, 0x33, 0x2, 0x25}, @flat=@weak_handle={0x77682a85, 0x1}, @flat=@binder={0x73622a85, 0xa, 0x3}}, &(0x7f0000000280)={0x0, 0x28, 0x40}}, 0x1f8aed83e3349436}, @exit_looper, @transaction_sg={0x40486311, {0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x68, 0x18, &(0x7f0000000480)={@ptr={0x70742a85, 0x0, &(0x7f00000002c0)=""/11, 0xb, 0x2, 0x3f}, @fd={0x66642a85, 0x0, r0}, @ptr={0x70742a85, 0x0, &(0x7f0000000380)=""/70, 0x46, 0x1, 0x1f}}, &(0x7f0000000500)={0x0, 0x28, 0x40}}, 0x1000}], 0x14, 0x0, &(0x7f0000000680)="86621f50fcee8bdc5bf8c503a78812261b4bf6d7"}) 18:07:05 executing program 5: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000001a00)='/dev/net/tun\x00', 0x0, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000080)="c0dc00025e0b01047be070") ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000300)={'nr0\x01\x00', 0x1132}) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000001a00)='/dev/net/tun\x00', 0x2, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000300)={'nr0\x01\x00', 0x1132}) write$cgroup_int(0xffffffffffffffff, &(0x7f00000000c0)=0x2, 0xfffffffffffffe75) close(r1) 18:07:05 executing program 1: clone(0x2102001fff, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) socket(0x0, 0x0, 0x0) r0 = getpid() rt_tgsigqueueinfo(0x0, r0, 0x16, &(0x7f0000000100)) rt_sigqueueinfo(r0, 0x7, &(0x7f0000000180)={0x0, 0x0, 0xffffffff}) [ 2595.197992] binder: 4324:4338 transaction failed 29189/-22, size 80-24 line 3014 [ 2595.198285] binder: undelivered TRANSACTION_ERROR: 29189 18:07:05 executing program 3: r0 = socket(0x10, 0x3, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") ioctl$sock_ifreq(r0, 0x89f3, &(0x7f0000000240)={'sit0\x00'}) [ 2595.327757] binder: 4391:4397 Release 1 refcount change on invalid ref 2 ret -22 [ 2595.327768] binder: 4391:4397 BC_ACQUIRE_DONE u0000000000000000 no match 18:07:05 executing program 2: ioctl$FS_IOC_RESVSP(0xffffffffffffffff, 0x40305828, &(0x7f00000000c0)={0x0, 0x0, 0x100000000000001}) clone(0x2102001fff, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) socket(0x0, 0x0, 0x0) r0 = getpid() rt_tgsigqueueinfo(0x0, r0, 0x16, &(0x7f0000000100)) ptrace(0x10, r0) ptrace$poke(0x4209, r0, &(0x7f00000000c0), 0x70effd) 18:07:05 executing program 1: clone(0x2102001fff, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) socket(0x0, 0x0, 0x0) r0 = getpid() rt_tgsigqueueinfo(0x0, r0, 0x16, &(0x7f0000000100)) rt_sigqueueinfo(r0, 0x7, &(0x7f0000000180)={0x0, 0x0, 0xffffffff}) [ 2595.327776] binder: 4391:4397 BC_ACQUIRE_DONE u0000000000000003 no match 18:07:05 executing program 4: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000040)='/dev/net/tun\x00', 0x0, 0x0) r1 = epoll_create1(0x0) epoll_ctl$EPOLL_CTL_ADD(0xffffffffffffffff, 0x1, r0, &(0x7f0000000100)) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000080)={'tunl0\x00', 0x1}) epoll_wait(r1, &(0x7f00000000c0)=[{}], 0x1, 0x0) 18:07:05 executing program 3: r0 = socket(0x10, 0x3, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") ioctl$sock_ifreq(r0, 0x89f3, &(0x7f0000000240)={'sit0\x00'}) [ 2595.327789] binder: 4391:4397 transaction failed 29189/-22, size 80-24 line 3014 18:07:05 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000006c0)={0x118, 0x0, &(0x7f0000000540)=[@release={0x40046306, 0x2}, @acquire_done, @acquire_done={0x40106309, 0x3}, @transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x50, 0x18, &(0x7f0000000080)={@flat=@binder={0x73622a85, 0xa, 0x1}, @fda={0x66646185, 0xa, 0x1, 0x9}, @fd={0x66642a85, 0x0, r1}}, &(0x7f0000000100)={0x0, 0x18, 0x38}}, 0x1000}, @transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000180)={@ptr={0x70742a85, 0x0, &(0x7f0000000140)=""/51, 0x33, 0x2, 0x25}, @flat=@weak_handle={0x77682a85, 0x1}, @flat=@binder={0x73622a85, 0xa, 0x3}}, &(0x7f0000000280)={0x0, 0x28, 0x40}}, 0x1f8aed83e3349436}, @exit_looper, @transaction_sg={0x40486311, {0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x68, 0x18, &(0x7f0000000480)={@ptr={0x70742a85, 0x0, &(0x7f00000002c0)=""/11, 0xb, 0x2, 0x3f}, @fd={0x66642a85, 0x0, r0}, @ptr={0x70742a85, 0x0, &(0x7f0000000380)=""/70, 0x46, 0x1, 0x1f}}, &(0x7f0000000500)={0x0, 0x28, 0x40}}, 0x1000}], 0x14, 0x0, &(0x7f0000000680)="86621f50fcee8bdc5bf8c503a78812261b4bf6d7"}) [ 2595.328096] binder: undelivered TRANSACTION_ERROR: 29189 [ 2595.510060] binder: 4432:4452 Release 1 refcount change on invalid ref 2 ret -22 [ 2595.510069] binder: 4432:4452 BC_ACQUIRE_DONE u0000000000000000 no match 18:07:05 executing program 1: clone(0x2102001fff, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) socket(0x0, 0x0, 0x0) r0 = getpid() rt_tgsigqueueinfo(0x0, r0, 0x16, &(0x7f0000000100)) rt_sigqueueinfo(r0, 0x7, &(0x7f0000000180)={0x0, 0x0, 0xffffffff}) 18:07:05 executing program 2: ioctl$FS_IOC_RESVSP(0xffffffffffffffff, 0x40305828, &(0x7f00000000c0)={0x0, 0x0, 0x100000000000001}) clone(0x2102001fff, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) socket(0x0, 0x0, 0x0) r0 = getpid() rt_tgsigqueueinfo(0x0, r0, 0x16, &(0x7f0000000100)) ptrace(0x10, r0) ptrace$poke(0x4209, r0, &(0x7f00000000c0), 0x70effd) 18:07:05 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000006c0)={0x118, 0x0, &(0x7f0000000540)=[@release={0x40046306, 0x2}, @acquire_done, @acquire_done={0x40106309, 0x3}, @transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x50, 0x18, &(0x7f0000000080)={@flat=@binder={0x73622a85, 0xa, 0x1}, @fda={0x66646185, 0xa, 0x1, 0x9}, @fd={0x66642a85, 0x0, r1}}, &(0x7f0000000100)={0x0, 0x18, 0x38}}, 0x1000}, @transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000180)={@ptr={0x70742a85, 0x0, &(0x7f0000000140)=""/51, 0x33, 0x2, 0x25}, @flat=@weak_handle={0x77682a85, 0x1}, @flat=@binder={0x73622a85, 0xa, 0x3}}, &(0x7f0000000280)={0x0, 0x28, 0x40}}, 0x1f8aed83e3349436}, @exit_looper, @transaction_sg={0x40486311, {0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x68, 0x18, &(0x7f0000000480)={@ptr={0x70742a85, 0x0, &(0x7f00000002c0)=""/11, 0xb, 0x2, 0x3f}, @fd={0x66642a85, 0x0, r0}, @ptr={0x70742a85, 0x0, &(0x7f0000000380)=""/70, 0x46, 0x1, 0x1f}}, &(0x7f0000000500)={0x0, 0x28, 0x40}}, 0x1000}], 0x14, 0x0, &(0x7f0000000680)="86621f50fcee8bdc5bf8c503a78812261b4bf6d7"}) 18:07:06 executing program 3: r0 = socket(0x10, 0x3, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") ioctl$sock_ifreq(r0, 0x89f3, &(0x7f0000000240)={'sit0\x00'}) [ 2595.510076] binder: 4432:4452 BC_ACQUIRE_DONE u0000000000000003 no match [ 2595.510090] binder: 4432:4452 transaction failed 29189/-22, size 80-24 line 3014 [ 2595.511300] binder: undelivered TRANSACTION_ERROR: 29189 [ 2595.703446] binder: 4479:4514 Release 1 refcount change on invalid ref 2 ret -22 [ 2595.703457] binder: 4479:4514 BC_ACQUIRE_DONE u0000000000000000 no match [ 2595.703464] binder: 4479:4514 BC_ACQUIRE_DONE u0000000000000003 no match 18:07:06 executing program 5: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000001a00)='/dev/net/tun\x00', 0x0, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000080)="c0dc00025e0b01047be070") ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000300)={'nr0\x01\x00', 0x1132}) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000001a00)='/dev/net/tun\x00', 0x2, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000300)={'nr0\x01\x00', 0x1132}) write$cgroup_int(0xffffffffffffffff, &(0x7f00000000c0)=0x2, 0xfffffffffffffe75) close(r1) 18:07:06 executing program 2: ioctl$FS_IOC_RESVSP(0xffffffffffffffff, 0x40305828, &(0x7f00000000c0)={0x0, 0x0, 0x100000000000001}) clone(0x2102001fff, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) socket(0x0, 0x0, 0x0) r0 = getpid() rt_tgsigqueueinfo(0x0, r0, 0x16, &(0x7f0000000100)) ptrace(0x10, r0) ptrace$poke(0x4209, r0, &(0x7f00000000c0), 0x70effd) 18:07:06 executing program 3: r0 = socket(0x10, 0x3, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") ioctl$sock_ifreq(r0, 0x89f3, &(0x7f0000000240)={'sit0\x00'}) [ 2595.703478] binder: 4479:4514 transaction failed 29189/-22, size 80-24 line 3014 [ 2595.704017] binder: undelivered TRANSACTION_ERROR: 29189 [ 2595.824902] binder: 4543:4547 Release 1 refcount change on invalid ref 2 ret -22 18:07:06 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000006c0)={0x118, 0x0, &(0x7f0000000540)=[@release={0x40046306, 0x2}, @acquire_done, @acquire_done={0x40106309, 0x3}, @transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x50, 0x18, &(0x7f0000000080)={@flat=@binder={0x73622a85, 0xa, 0x1}, @fda={0x66646185, 0xa, 0x1, 0x9}, @fd={0x66642a85, 0x0, r1}}, &(0x7f0000000100)={0x0, 0x18, 0x38}}, 0x1000}, @transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000180)={@ptr={0x70742a85, 0x0, &(0x7f0000000140)=""/51, 0x33, 0x2, 0x25}, @flat=@weak_handle={0x77682a85, 0x1}, @flat=@binder={0x73622a85, 0xa, 0x3}}, &(0x7f0000000280)={0x0, 0x28, 0x40}}, 0x1f8aed83e3349436}, @exit_looper, @transaction_sg={0x40486311, {0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x68, 0x18, &(0x7f0000000480)={@ptr={0x70742a85, 0x0, &(0x7f00000002c0)=""/11, 0xb, 0x2, 0x3f}, @fd={0x66642a85, 0x0, r0}, @ptr={0x70742a85, 0x0, &(0x7f0000000380)=""/70, 0x46, 0x1, 0x1f}}, &(0x7f0000000500)={0x0, 0x28, 0x40}}, 0x1000}], 0x14, 0x0, &(0x7f0000000680)="86621f50fcee8bdc5bf8c503a78812261b4bf6d7"}) 18:07:06 executing program 4: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000040)='/dev/net/tun\x00', 0x0, 0x0) r1 = epoll_create1(0x0) epoll_ctl$EPOLL_CTL_ADD(0xffffffffffffffff, 0x1, r0, &(0x7f0000000100)) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000080)={'tunl0\x00', 0x1}) epoll_wait(r1, &(0x7f00000000c0)=[{}], 0x1, 0x0) [ 2595.824912] binder: 4543:4547 BC_ACQUIRE_DONE u0000000000000000 no match [ 2595.824920] binder: 4543:4547 BC_ACQUIRE_DONE u0000000000000003 no match 18:07:06 executing program 1: clone(0x2102001fff, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) socket(0x0, 0x0, 0x0) r0 = getpid() rt_tgsigqueueinfo(0x0, r0, 0x16, &(0x7f0000000100)) rt_sigqueueinfo(r0, 0x7, &(0x7f0000000180)={0x0, 0x0, 0xffffffff}) [ 2595.824933] binder: 4543:4547 transaction failed 29189/-22, size 80-24 line 3014 18:07:06 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000006c0)={0x118, 0x0, &(0x7f0000000540)=[@release={0x40046306, 0x2}, @acquire_done, @acquire_done={0x40106309, 0x3}, @transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x50, 0x18, &(0x7f0000000080)={@flat=@binder={0x73622a85, 0xa, 0x1}, @fda={0x66646185, 0xa, 0x1, 0x9}, @fd={0x66642a85, 0x0, r1}}, &(0x7f0000000100)={0x0, 0x18, 0x38}}, 0x1000}, @transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000180)={@ptr={0x70742a85, 0x0, &(0x7f0000000140)=""/51, 0x33, 0x2, 0x25}, @flat=@weak_handle={0x77682a85, 0x1}, @flat=@binder={0x73622a85, 0xa, 0x3}}, &(0x7f0000000280)={0x0, 0x28, 0x40}}, 0x1f8aed83e3349436}, @exit_looper, @transaction_sg={0x40486311, {0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x68, 0x18, &(0x7f0000000480)={@ptr={0x70742a85, 0x0, &(0x7f00000002c0)=""/11, 0xb, 0x2, 0x3f}, @fd={0x66642a85, 0x0, r0}, @ptr={0x70742a85, 0x0, &(0x7f0000000380)=""/70, 0x46, 0x1, 0x1f}}, &(0x7f0000000500)={0x0, 0x28, 0x40}}, 0x1000}], 0x14, 0x0, &(0x7f0000000680)="86621f50fcee8bdc5bf8c503a78812261b4bf6d7"}) [ 2595.825330] binder: undelivered TRANSACTION_ERROR: 29189 [ 2595.893048] binder: 4575:4586 Release 1 refcount change on invalid ref 2 ret -22 18:07:06 executing program 3: r0 = socket(0x10, 0x3, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") ioctl$sock_ifreq(r0, 0x89f3, &(0x7f0000000240)={'sit0\x00'}) 18:07:06 executing program 2: ioctl$FS_IOC_RESVSP(0xffffffffffffffff, 0x40305828, &(0x7f00000000c0)={0x0, 0x0, 0x100000000000001}) clone(0x2102001fff, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) socket(0x0, 0x0, 0x0) r0 = getpid() rt_tgsigqueueinfo(0x0, r0, 0x16, &(0x7f0000000100)) ptrace(0x10, r0) ptrace$poke(0x4209, r0, &(0x7f00000000c0), 0x70effd) 18:07:06 executing program 4: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000040)='/dev/net/tun\x00', 0x0, 0x0) r1 = epoll_create1(0x0) epoll_ctl$EPOLL_CTL_ADD(0xffffffffffffffff, 0x1, r0, &(0x7f0000000100)) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000080)={'tunl0\x00', 0x1}) epoll_wait(r1, &(0x7f00000000c0)=[{}], 0x1, 0x0) [ 2595.893059] binder: 4575:4586 BC_ACQUIRE_DONE u0000000000000000 no match [ 2595.893067] binder: 4575:4586 BC_ACQUIRE_DONE u0000000000000003 no match 18:07:06 executing program 5: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000001a00)='/dev/net/tun\x00', 0x0, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000080)="c0dc00025e0b01047be070") ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000300)={'nr0\x01\x00', 0x1132}) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000001a00)='/dev/net/tun\x00', 0x2, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000300)={'nr0\x01\x00', 0x1132}) write$cgroup_int(0xffffffffffffffff, &(0x7f00000000c0)=0x2, 0xfffffffffffffe75) close(r1) 18:07:06 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000006c0)={0x118, 0x0, &(0x7f0000000540)=[@release={0x40046306, 0x2}, @acquire_done, @acquire_done={0x40106309, 0x3}, @transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x50, 0x18, &(0x7f0000000080)={@flat=@binder={0x73622a85, 0xa, 0x1}, @fda={0x66646185, 0xa, 0x1, 0x9}, @fd={0x66642a85, 0x0, r1}}, &(0x7f0000000100)={0x0, 0x18, 0x38}}, 0x1000}, @transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000180)={@ptr={0x70742a85, 0x0, &(0x7f0000000140)=""/51, 0x33, 0x2, 0x25}, @flat=@weak_handle={0x77682a85, 0x1}, @flat=@binder={0x73622a85, 0xa, 0x3}}, &(0x7f0000000280)={0x0, 0x28, 0x40}}, 0x1f8aed83e3349436}, @exit_looper, @transaction_sg={0x40486311, {0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x68, 0x18, &(0x7f0000000480)={@ptr={0x70742a85, 0x0, &(0x7f00000002c0)=""/11, 0xb, 0x2, 0x3f}, @fd={0x66642a85, 0x0, r0}, @ptr={0x70742a85, 0x0, &(0x7f0000000380)=""/70, 0x46, 0x1, 0x1f}}, &(0x7f0000000500)={0x0, 0x28, 0x40}}, 0x1000}], 0x14, 0x0, &(0x7f0000000680)="86621f50fcee8bdc5bf8c503a78812261b4bf6d7"}) [ 2595.893080] binder: 4575:4586 transaction failed 29189/-22, size 80-24 line 3014 18:07:06 executing program 1: clone(0x2102001fff, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) socket(0x0, 0x0, 0x0) r0 = getpid() rt_tgsigqueueinfo(0x0, r0, 0x16, &(0x7f0000000100)) rt_sigqueueinfo(r0, 0x7, &(0x7f0000000180)={0x0, 0x0, 0xffffffff}) [ 2595.898101] binder: undelivered TRANSACTION_ERROR: 29189 [ 2596.128361] binder: 4600:4627 Release 1 refcount change on invalid ref 2 ret -22 18:07:06 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000006c0)={0x118, 0x0, &(0x7f0000000540)=[@release={0x40046306, 0x2}, @acquire_done, @acquire_done={0x40106309, 0x3}, @transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x50, 0x18, &(0x7f0000000080)={@flat=@binder={0x73622a85, 0xa, 0x1}, @fda={0x66646185, 0xa, 0x1, 0x9}, @fd={0x66642a85, 0x0, r1}}, &(0x7f0000000100)={0x0, 0x18, 0x38}}, 0x1000}, @transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000180)={@ptr={0x70742a85, 0x0, &(0x7f0000000140)=""/51, 0x33, 0x2, 0x25}, @flat=@weak_handle={0x77682a85, 0x1}, @flat=@binder={0x73622a85, 0xa, 0x3}}, &(0x7f0000000280)={0x0, 0x28, 0x40}}, 0x1f8aed83e3349436}, @exit_looper, @transaction_sg={0x40486311, {0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x68, 0x18, &(0x7f0000000480)={@ptr={0x70742a85, 0x0, &(0x7f00000002c0)=""/11, 0xb, 0x2, 0x3f}, @fd={0x66642a85, 0x0, r0}, @ptr={0x70742a85, 0x0, &(0x7f0000000380)=""/70, 0x46, 0x1, 0x1f}}, &(0x7f0000000500)={0x0, 0x28, 0x40}}, 0x1000}], 0x14, 0x0, &(0x7f0000000680)="86621f50fcee8bdc5bf8c503a78812261b4bf6d7"}) 18:07:06 executing program 3: r0 = socket(0x10, 0x3, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") ioctl$sock_ifreq(r0, 0x89f3, &(0x7f0000000240)={'sit0\x00'}) 18:07:06 executing program 2: ioctl$FS_IOC_RESVSP(0xffffffffffffffff, 0x40305828, &(0x7f00000000c0)={0x0, 0x0, 0x100000000000001}) clone(0x2102001fff, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) socket(0x0, 0x0, 0x0) r0 = getpid() rt_tgsigqueueinfo(0x0, r0, 0x16, &(0x7f0000000100)) ptrace(0x10, r0) ptrace$poke(0x4209, r0, &(0x7f00000000c0), 0x70effd) [ 2596.128371] binder: 4600:4627 BC_ACQUIRE_DONE u0000000000000000 no match [ 2596.128378] binder: 4600:4627 BC_ACQUIRE_DONE u0000000000000003 no match [ 2596.128390] binder: 4600:4627 transaction failed 29189/-22, size 80-24 line 3014 18:07:06 executing program 1: clone(0x2102001fff, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) socket(0x0, 0x0, 0x0) r0 = getpid() rt_tgsigqueueinfo(0x0, r0, 0x16, &(0x7f0000000100)) rt_sigqueueinfo(r0, 0x7, &(0x7f0000000180)={0x0, 0x0, 0xffffffff}) 18:07:06 executing program 4: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000040)='/dev/net/tun\x00', 0x0, 0x0) r1 = epoll_create1(0x0) epoll_ctl$EPOLL_CTL_ADD(0xffffffffffffffff, 0x1, r0, &(0x7f0000000100)) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000080)={'tunl0\x00', 0x1}) epoll_wait(r1, &(0x7f00000000c0)=[{}], 0x1, 0x0) [ 2596.128628] binder: undelivered TRANSACTION_ERROR: 29189 18:07:06 executing program 5: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000001a00)='/dev/net/tun\x00', 0x0, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000080)="c0dc00025e0b01047be070") ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000300)={'nr0\x01\x00', 0x1132}) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000001a00)='/dev/net/tun\x00', 0x2, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000300)={'nr0\x01\x00', 0x1132}) write$cgroup_int(0xffffffffffffffff, &(0x7f00000000c0)=0x2, 0xfffffffffffffe75) close(r1) 18:07:06 executing program 3: r0 = socket(0x10, 0x3, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") ioctl$sock_ifreq(r0, 0x89f3, &(0x7f0000000240)={'sit0\x00'}) [ 2596.282168] binder: 4667:4672 Release 1 refcount change on invalid ref 2 ret -22 18:07:06 executing program 3: r0 = socket(0x10, 0x3, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") ioctl$sock_ifreq(r0, 0x89f3, &(0x7f0000000240)={'sit0\x00'}) [ 2596.282178] binder: 4667:4672 BC_ACQUIRE_DONE u0000000000000000 no match 18:07:06 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000006c0)={0x118, 0x0, &(0x7f0000000540)=[@release={0x40046306, 0x2}, @acquire_done, @acquire_done={0x40106309, 0x3}, @transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x50, 0x18, &(0x7f0000000080)={@flat=@binder={0x73622a85, 0xa, 0x1}, @fda={0x66646185, 0xa, 0x1, 0x9}, @fd={0x66642a85, 0x0, r1}}, &(0x7f0000000100)={0x0, 0x18, 0x38}}, 0x1000}, @transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000180)={@ptr={0x70742a85, 0x0, &(0x7f0000000140)=""/51, 0x33, 0x2, 0x25}, @flat=@weak_handle={0x77682a85, 0x1}, @flat=@binder={0x73622a85, 0xa, 0x3}}, &(0x7f0000000280)={0x0, 0x28, 0x40}}, 0x1f8aed83e3349436}, @exit_looper, @transaction_sg={0x40486311, {0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x68, 0x18, &(0x7f0000000480)={@ptr={0x70742a85, 0x0, &(0x7f00000002c0)=""/11, 0xb, 0x2, 0x3f}, @fd={0x66642a85, 0x0, r0}, @ptr={0x70742a85, 0x0, &(0x7f0000000380)=""/70, 0x46, 0x1, 0x1f}}, &(0x7f0000000500)={0x0, 0x28, 0x40}}, 0x1000}], 0x14, 0x0, &(0x7f0000000680)="86621f50fcee8bdc5bf8c503a78812261b4bf6d7"}) [ 2596.282186] binder: 4667:4672 BC_ACQUIRE_DONE u0000000000000003 no match 18:07:06 executing program 2: ioctl$FS_IOC_RESVSP(0xffffffffffffffff, 0x40305828, &(0x7f00000000c0)={0x0, 0x0, 0x100000000000001}) clone(0x2102001fff, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) socket(0x0, 0x0, 0x0) r0 = getpid() rt_tgsigqueueinfo(0x0, r0, 0x16, &(0x7f0000000100)) ptrace(0x10, r0) ptrace$poke(0x4209, r0, &(0x7f00000000c0), 0x70effd) 18:07:06 executing program 1: clone(0x2102001fff, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) socket(0x0, 0x0, 0x0) r0 = getpid() rt_tgsigqueueinfo(0x0, r0, 0x16, &(0x7f0000000100)) rt_sigqueueinfo(r0, 0x7, &(0x7f0000000180)={0x0, 0x0, 0xffffffff}) [ 2596.282199] binder: 4667:4672 transaction failed 29189/-22, size 80-24 line 3014 [ 2596.287443] binder: undelivered TRANSACTION_ERROR: 29189 [ 2596.513005] binder: 4755:4757 Release 1 refcount change on invalid ref 2 ret -22 18:07:06 executing program 4: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000040)='/dev/net/tun\x00', 0x0, 0x0) r1 = epoll_create1(0x0) epoll_ctl$EPOLL_CTL_ADD(0xffffffffffffffff, 0x1, r0, &(0x7f0000000100)) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000080)={'tunl0\x00', 0x1}) epoll_wait(r1, &(0x7f00000000c0)=[{}], 0x1, 0x0) [ 2596.513015] binder: 4755:4757 BC_ACQUIRE_DONE u0000000000000000 no match [ 2596.513023] binder: 4755:4757 BC_ACQUIRE_DONE u0000000000000003 no match [ 2596.513036] binder: 4755:4757 transaction failed 29189/-22, size 80-24 line 3014 [ 2596.513622] binder: undelivered TRANSACTION_ERROR: 29189 18:07:07 executing program 1: clone(0x2102001fff, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) socket(0x0, 0x0, 0x0) r0 = getpid() rt_tgsigqueueinfo(0x0, r0, 0x16, &(0x7f0000000100)) rt_sigqueueinfo(r0, 0x7, &(0x7f0000000180)={0x0, 0x0, 0xffffffff}) 18:07:07 executing program 2: ioctl$FS_IOC_RESVSP(0xffffffffffffffff, 0x40305828, &(0x7f00000000c0)={0x0, 0x0, 0x100000000000001}) clone(0x2102001fff, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) socket(0x0, 0x0, 0x0) r0 = getpid() rt_tgsigqueueinfo(0x0, r0, 0x16, &(0x7f0000000100)) ptrace(0x10, r0) ptrace$poke(0x4209, r0, &(0x7f00000000c0), 0x70effd) [ 2596.815862] binder: 4870:4879 Release 1 refcount change on invalid ref 2 ret -22 [ 2596.815873] binder: 4870:4879 BC_ACQUIRE_DONE u0000000000000000 no match [ 2596.815882] binder: 4870:4879 BC_ACQUIRE_DONE u0000000000000003 no match [ 2596.815897] binder: 4870:4879 transaction failed 29189/-22, size 80-24 line 3014 18:07:07 executing program 3: r0 = socket(0x10, 0x3, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") ioctl$sock_ifreq(r0, 0x89f3, &(0x7f0000000240)={'sit0\x00'}) [ 2596.820192] binder: undelivered TRANSACTION_ERROR: 29189 18:07:07 executing program 4: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000040)='/dev/net/tun\x00', 0x0, 0x0) r1 = epoll_create1(0x0) epoll_ctl$EPOLL_CTL_ADD(0xffffffffffffffff, 0x1, r0, &(0x7f0000000100)) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000080)={'tunl0\x00', 0x1}) epoll_wait(r1, &(0x7f00000000c0)=[{}], 0x1, 0x0) 18:07:07 executing program 3: r0 = socket(0x10, 0x3, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") ioctl$sock_ifreq(r0, 0x89f3, &(0x7f0000000240)={'sit0\x00'}) [ 2596.919952] binder: 4903:4929 Release 1 refcount change on invalid ref 2 ret -22 [ 2596.919963] binder: 4903:4929 BC_ACQUIRE_DONE u0000000000000000 no match [ 2596.919971] binder: 4903:4929 BC_ACQUIRE_DONE u0000000000000003 no match 18:07:07 executing program 5: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000001a00)='/dev/net/tun\x00', 0x0, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000080)="c0dc00025e0b01047be070") ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000300)={'nr0\x01\x00', 0x1132}) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000001a00)='/dev/net/tun\x00', 0x2, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000300)={'nr0\x01\x00', 0x1132}) write$cgroup_int(0xffffffffffffffff, &(0x7f00000000c0)=0x2, 0xfffffffffffffe75) close(r1) 18:07:07 executing program 1: clone(0x2102001fff, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) socket(0x0, 0x0, 0x0) r0 = getpid() rt_tgsigqueueinfo(0x0, r0, 0x16, &(0x7f0000000100)) rt_sigqueueinfo(r0, 0x7, &(0x7f0000000180)={0x0, 0x0, 0xffffffff}) 18:07:07 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000006c0)={0x118, 0x0, &(0x7f0000000540)=[@release={0x40046306, 0x2}, @acquire_done, @acquire_done={0x40106309, 0x3}, @transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x50, 0x18, &(0x7f0000000080)={@flat=@binder={0x73622a85, 0xa, 0x1}, @fda={0x66646185, 0xa, 0x1, 0x9}, @fd={0x66642a85, 0x0, r1}}, &(0x7f0000000100)={0x0, 0x18, 0x38}}, 0x1000}, @transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000180)={@ptr={0x70742a85, 0x0, &(0x7f0000000140)=""/51, 0x33, 0x2, 0x25}, @flat=@weak_handle={0x77682a85, 0x1}, @flat=@binder={0x73622a85, 0xa, 0x3}}, &(0x7f0000000280)={0x0, 0x28, 0x40}}, 0x1f8aed83e3349436}, @exit_looper, @transaction_sg={0x40486311, {0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x68, 0x18, &(0x7f0000000480)={@ptr={0x70742a85, 0x0, &(0x7f00000002c0)=""/11, 0xb, 0x2, 0x3f}, @fd={0x66642a85, 0x0, r0}, @ptr={0x70742a85, 0x0, &(0x7f0000000380)=""/70, 0x46, 0x1, 0x1f}}, &(0x7f0000000500)={0x0, 0x28, 0x40}}, 0x1000}], 0x14, 0x0, &(0x7f0000000680)="86621f50fcee8bdc5bf8c503a78812261b4bf6d7"}) 18:07:07 executing program 3: r0 = socket(0x10, 0x3, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") ioctl$sock_ifreq(r0, 0x89f3, &(0x7f0000000240)={'sit0\x00'}) [ 2596.919985] binder: 4903:4929 transaction failed 29189/-22, size 80-24 line 3014 [ 2596.920285] binder: undelivered TRANSACTION_ERROR: 29189 18:07:07 executing program 2: ioctl$FS_IOC_RESVSP(0xffffffffffffffff, 0x40305828, &(0x7f00000000c0)={0x0, 0x0, 0x100000000000001}) clone(0x2102001fff, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) socket(0x0, 0x0, 0x0) r0 = getpid() rt_tgsigqueueinfo(0x0, r0, 0x16, &(0x7f0000000100)) ptrace(0x10, r0) ptrace$poke(0x4209, r0, &(0x7f00000000c0), 0x70effd) 18:07:07 executing program 3: r0 = socket(0x10, 0x3, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") ioctl$sock_ifreq(r0, 0x89f3, &(0x7f0000000240)={'sit0\x00'}) [ 2597.017700] binder: 4951:4960 Release 1 refcount change on invalid ref 2 ret -22 [ 2597.017711] binder: 4951:4960 BC_ACQUIRE_DONE u0000000000000000 no match 18:07:07 executing program 4: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000040)='/dev/net/tun\x00', 0x0, 0x0) r1 = epoll_create1(0x0) epoll_ctl$EPOLL_CTL_ADD(0xffffffffffffffff, 0x1, r0, &(0x7f0000000100)) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000080)={'tunl0\x00', 0x1}) epoll_wait(r1, &(0x7f00000000c0)=[{}], 0x1, 0x0) 18:07:07 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000006c0)={0x118, 0x0, &(0x7f0000000540)=[@release={0x40046306, 0x2}, @acquire_done, @acquire_done={0x40106309, 0x3}, @transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x50, 0x18, &(0x7f0000000080)={@flat=@binder={0x73622a85, 0xa, 0x1}, @fda={0x66646185, 0xa, 0x1, 0x9}, @fd={0x66642a85, 0x0, r1}}, &(0x7f0000000100)={0x0, 0x18, 0x38}}, 0x1000}, @transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000180)={@ptr={0x70742a85, 0x0, &(0x7f0000000140)=""/51, 0x33, 0x2, 0x25}, @flat=@weak_handle={0x77682a85, 0x1}, @flat=@binder={0x73622a85, 0xa, 0x3}}, &(0x7f0000000280)={0x0, 0x28, 0x40}}, 0x1f8aed83e3349436}, @exit_looper, @transaction_sg={0x40486311, {0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x68, 0x18, &(0x7f0000000480)={@ptr={0x70742a85, 0x0, &(0x7f00000002c0)=""/11, 0xb, 0x2, 0x3f}, @fd={0x66642a85, 0x0, r0}, @ptr={0x70742a85, 0x0, &(0x7f0000000380)=""/70, 0x46, 0x1, 0x1f}}, &(0x7f0000000500)={0x0, 0x28, 0x40}}, 0x1000}], 0x14, 0x0, &(0x7f0000000680)="86621f50fcee8bdc5bf8c503a78812261b4bf6d7"}) 18:07:07 executing program 1: clone(0x2102001fff, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) socket(0x0, 0x0, 0x0) r0 = getpid() rt_tgsigqueueinfo(0x0, r0, 0x16, &(0x7f0000000100)) rt_sigqueueinfo(r0, 0x7, &(0x7f0000000180)={0x0, 0x0, 0xffffffff}) 18:07:07 executing program 3: r0 = socket(0x10, 0x3, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") ioctl$sock_ifreq(r0, 0x89f3, &(0x7f0000000240)={'sit0\x00'}) [ 2597.017718] binder: 4951:4960 BC_ACQUIRE_DONE u0000000000000003 no match 18:07:07 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000006c0)={0x118, 0x0, &(0x7f0000000540)=[@release={0x40046306, 0x2}, @acquire_done, @acquire_done={0x40106309, 0x3}, @transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x50, 0x18, &(0x7f0000000080)={@flat=@binder={0x73622a85, 0xa, 0x1}, @fda={0x66646185, 0xa, 0x1, 0x9}, @fd={0x66642a85, 0x0, r1}}, &(0x7f0000000100)={0x0, 0x18, 0x38}}, 0x1000}, @transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000180)={@ptr={0x70742a85, 0x0, &(0x7f0000000140)=""/51, 0x33, 0x2, 0x25}, @flat=@weak_handle={0x77682a85, 0x1}, @flat=@binder={0x73622a85, 0xa, 0x3}}, &(0x7f0000000280)={0x0, 0x28, 0x40}}, 0x1f8aed83e3349436}, @exit_looper, @transaction_sg={0x40486311, {0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x68, 0x18, &(0x7f0000000480)={@ptr={0x70742a85, 0x0, &(0x7f00000002c0)=""/11, 0xb, 0x2, 0x3f}, @fd={0x66642a85, 0x0, r0}, @ptr={0x70742a85, 0x0, &(0x7f0000000380)=""/70, 0x46, 0x1, 0x1f}}, &(0x7f0000000500)={0x0, 0x28, 0x40}}, 0x1000}], 0x14, 0x0, &(0x7f0000000680)="86621f50fcee8bdc5bf8c503a78812261b4bf6d7"}) [ 2597.017731] binder: 4951:4960 transaction failed 29189/-22, size 80-24 line 3014 18:07:07 executing program 5: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000001a00)='/dev/net/tun\x00', 0x0, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000080)="c0dc00025e0b01047be070") ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000300)={'nr0\x01\x00', 0x1132}) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000001a00)='/dev/net/tun\x00', 0x2, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000300)={'nr0\x01\x00', 0x1132}) write$cgroup_int(0xffffffffffffffff, &(0x7f00000000c0)=0x2, 0xfffffffffffffe75) close(r1) 18:07:07 executing program 3: r0 = socket(0x10, 0x3, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") ioctl$sock_ifreq(r0, 0x89f3, &(0x7f0000000240)={'sit0\x00'}) 18:07:07 executing program 1: clone(0x2102001fff, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) socket(0x0, 0x0, 0x0) r0 = getpid() rt_tgsigqueueinfo(0x0, r0, 0x16, &(0x7f0000000100)) rt_sigqueueinfo(r0, 0x7, &(0x7f0000000180)={0x0, 0x0, 0xffffffff}) [ 2597.017980] binder: undelivered TRANSACTION_ERROR: 29189 [ 2597.232360] binder: 4996:5029 Release 1 refcount change on invalid ref 2 ret -22 18:07:07 executing program 2: ioctl$FS_IOC_RESVSP(0xffffffffffffffff, 0x40305828, &(0x7f00000000c0)={0x0, 0x0, 0x100000000000001}) clone(0x2102001fff, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) socket(0x0, 0x0, 0x0) r0 = getpid() rt_tgsigqueueinfo(0x0, r0, 0x16, &(0x7f0000000100)) ptrace(0x10, r0) ptrace$poke(0x4209, r0, &(0x7f00000000c0), 0x70effd) [ 2597.232369] binder: 4996:5029 BC_ACQUIRE_DONE u0000000000000000 no match 18:07:07 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000006c0)={0x118, 0x0, &(0x7f0000000540)=[@release={0x40046306, 0x2}, @acquire_done, @acquire_done={0x40106309, 0x3}, @transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x50, 0x18, &(0x7f0000000080)={@flat=@binder={0x73622a85, 0xa, 0x1}, @fda={0x66646185, 0xa, 0x1, 0x9}, @fd={0x66642a85, 0x0, r1}}, &(0x7f0000000100)={0x0, 0x18, 0x38}}, 0x1000}, @transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000180)={@ptr={0x70742a85, 0x0, &(0x7f0000000140)=""/51, 0x33, 0x2, 0x25}, @flat=@weak_handle={0x77682a85, 0x1}, @flat=@binder={0x73622a85, 0xa, 0x3}}, &(0x7f0000000280)={0x0, 0x28, 0x40}}, 0x1f8aed83e3349436}, @exit_looper, @transaction_sg={0x40486311, {0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x68, 0x18, &(0x7f0000000480)={@ptr={0x70742a85, 0x0, &(0x7f00000002c0)=""/11, 0xb, 0x2, 0x3f}, @fd={0x66642a85, 0x0, r0}, @ptr={0x70742a85, 0x0, &(0x7f0000000380)=""/70, 0x46, 0x1, 0x1f}}, &(0x7f0000000500)={0x0, 0x28, 0x40}}, 0x1000}], 0x14, 0x0, &(0x7f0000000680)="86621f50fcee8bdc5bf8c503a78812261b4bf6d7"}) 18:07:07 executing program 1: clone(0x2102001fff, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) socket(0x0, 0x0, 0x0) r0 = getpid() rt_tgsigqueueinfo(0x0, r0, 0x16, &(0x7f0000000100)) rt_sigqueueinfo(r0, 0x7, &(0x7f0000000180)={0x0, 0x0, 0xffffffff}) 18:07:07 executing program 3: r0 = socket(0x10, 0x3, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") ioctl$sock_ifreq(r0, 0x89f3, &(0x7f0000000240)={'sit0\x00'}) [ 2597.232377] binder: 4996:5029 BC_ACQUIRE_DONE u0000000000000003 no match [ 2597.232389] binder: 4996:5029 transaction failed 29189/-22, size 80-24 line 3014 [ 2597.232708] binder: undelivered TRANSACTION_ERROR: 29189 [ 2597.504500] binder: 5076:5117 Release 1 refcount change on invalid ref 2 ret -22 [ 2597.504510] binder: 5076:5117 BC_ACQUIRE_DONE u0000000000000000 no match [ 2597.504518] binder: 5076:5117 BC_ACQUIRE_DONE u0000000000000003 no match 18:07:07 executing program 4: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000040)='/dev/net/tun\x00', 0x0, 0x0) r1 = epoll_create1(0x0) epoll_ctl$EPOLL_CTL_ADD(0xffffffffffffffff, 0x1, r0, &(0x7f0000000100)) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000080)={'tunl0\x00', 0x1}) epoll_wait(r1, &(0x7f00000000c0)=[{}], 0x1, 0x0) 18:07:07 executing program 2: ioctl$FS_IOC_RESVSP(0xffffffffffffffff, 0x40305828, &(0x7f00000000c0)={0x0, 0x0, 0x100000000000001}) clone(0x2102001fff, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) socket(0x0, 0x0, 0x0) r0 = getpid() rt_tgsigqueueinfo(0x0, r0, 0x16, &(0x7f0000000100)) ptrace(0x10, r0) ptrace$poke(0x4209, r0, &(0x7f00000000c0), 0x70effd) 18:07:07 executing program 1: clone(0x2102001fff, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) socket(0x0, 0x0, 0x0) r0 = getpid() rt_tgsigqueueinfo(0x0, r0, 0x16, &(0x7f0000000100)) rt_sigqueueinfo(r0, 0x7, &(0x7f0000000180)={0x0, 0x0, 0xffffffff}) 18:07:07 executing program 3: r0 = socket(0x10, 0x3, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") ioctl$sock_ifreq(r0, 0x89f3, &(0x7f0000000240)={'sit0\x00'}) 18:07:07 executing program 5: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000001a00)='/dev/net/tun\x00', 0x0, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000080)="c0dc00025e0b01047be070") ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000300)={'nr0\x01\x00', 0x1132}) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000001a00)='/dev/net/tun\x00', 0x2, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000300)={'nr0\x01\x00', 0x1132}) write$cgroup_int(0xffffffffffffffff, &(0x7f00000000c0)=0x2, 0xfffffffffffffe75) close(r1) 18:07:07 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000006c0)={0x118, 0x0, &(0x7f0000000540)=[@release={0x40046306, 0x2}, @acquire_done, @acquire_done={0x40106309, 0x3}, @transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x50, 0x18, &(0x7f0000000080)={@flat=@binder={0x73622a85, 0xa, 0x1}, @fda={0x66646185, 0xa, 0x1, 0x9}, @fd={0x66642a85, 0x0, r1}}, &(0x7f0000000100)={0x0, 0x18, 0x38}}, 0x1000}, @transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000180)={@ptr={0x70742a85, 0x0, &(0x7f0000000140)=""/51, 0x33, 0x2, 0x25}, @flat=@weak_handle={0x77682a85, 0x1}, @flat=@binder={0x73622a85, 0xa, 0x3}}, &(0x7f0000000280)={0x0, 0x28, 0x40}}, 0x1f8aed83e3349436}, @exit_looper, @transaction_sg={0x40486311, {0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x68, 0x18, &(0x7f0000000480)={@ptr={0x70742a85, 0x0, &(0x7f00000002c0)=""/11, 0xb, 0x2, 0x3f}, @fd={0x66642a85, 0x0, r0}, @ptr={0x70742a85, 0x0, &(0x7f0000000380)=""/70, 0x46, 0x1, 0x1f}}, &(0x7f0000000500)={0x0, 0x28, 0x40}}, 0x1000}], 0x14, 0x0, &(0x7f0000000680)="86621f50fcee8bdc5bf8c503a78812261b4bf6d7"}) [ 2597.504531] binder: 5076:5117 transaction failed 29189/-22, size 80-24 line 3014 [ 2597.504771] binder: undelivered TRANSACTION_ERROR: 29189 18:07:08 executing program 3: r0 = socket(0x10, 0x3, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") ioctl$sock_ifreq(r0, 0x89f3, &(0x7f0000000240)={'sit0\x00'}) 18:07:08 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000006c0)={0x118, 0x0, &(0x7f0000000540)=[@release={0x40046306, 0x2}, @acquire_done, @acquire_done={0x40106309, 0x3}, @transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x50, 0x18, &(0x7f0000000080)={@flat=@binder={0x73622a85, 0xa, 0x1}, @fda={0x66646185, 0xa, 0x1, 0x9}, @fd={0x66642a85, 0x0, r1}}, &(0x7f0000000100)={0x0, 0x18, 0x38}}, 0x1000}, @transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000180)={@ptr={0x70742a85, 0x0, &(0x7f0000000140)=""/51, 0x33, 0x2, 0x25}, @flat=@weak_handle={0x77682a85, 0x1}, @flat=@binder={0x73622a85, 0xa, 0x3}}, &(0x7f0000000280)={0x0, 0x28, 0x40}}, 0x1f8aed83e3349436}, @exit_looper, @transaction_sg={0x40486311, {0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x68, 0x18, &(0x7f0000000480)={@ptr={0x70742a85, 0x0, &(0x7f00000002c0)=""/11, 0xb, 0x2, 0x3f}, @fd={0x66642a85, 0x0, r0}, @ptr={0x70742a85, 0x0, &(0x7f0000000380)=""/70, 0x46, 0x1, 0x1f}}, &(0x7f0000000500)={0x0, 0x28, 0x40}}, 0x1000}], 0x14, 0x0, &(0x7f0000000680)="86621f50fcee8bdc5bf8c503a78812261b4bf6d7"}) [ 2597.739066] binder: 5146:5151 Release 1 refcount change on invalid ref 2 ret -22 [ 2597.739078] binder: 5146:5151 BC_ACQUIRE_DONE u0000000000000000 no match [ 2597.739086] binder: 5146:5151 BC_ACQUIRE_DONE u0000000000000003 no match [ 2597.739099] binder: 5146:5151 transaction failed 29189/-22, size 80-24 line 3014 18:07:08 executing program 2: ioctl$FS_IOC_RESVSP(0xffffffffffffffff, 0x40305828, &(0x7f00000000c0)={0x0, 0x0, 0x100000000000001}) clone(0x2102001fff, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) socket(0x0, 0x0, 0x0) r0 = getpid() rt_tgsigqueueinfo(0x0, r0, 0x16, &(0x7f0000000100)) ptrace(0x10, r0) ptrace$poke(0x4209, r0, &(0x7f00000000c0), 0x70effd) 18:07:08 executing program 3: r0 = socket(0x10, 0x3, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") ioctl$sock_ifreq(r0, 0x89f3, &(0x7f0000000240)={'sit0\x00'}) [ 2597.741050] binder: undelivered TRANSACTION_ERROR: 29189 [ 2597.887382] binder: 5219:5250 Release 1 refcount change on invalid ref 2 ret -22 18:07:08 executing program 4: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000040)='/dev/net/tun\x00', 0x0, 0x0) r1 = epoll_create1(0x0) epoll_ctl$EPOLL_CTL_ADD(0xffffffffffffffff, 0x1, r0, &(0x7f0000000100)) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000080)={'tunl0\x00', 0x1}) epoll_wait(r1, &(0x7f00000000c0)=[{}], 0x1, 0x0) 18:07:08 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000006c0)={0x118, 0x0, &(0x7f0000000540)=[@release={0x40046306, 0x2}, @acquire_done, @acquire_done={0x40106309, 0x3}, @transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x50, 0x18, &(0x7f0000000080)={@flat=@binder={0x73622a85, 0xa, 0x1}, @fda={0x66646185, 0xa, 0x1, 0x9}, @fd={0x66642a85, 0x0, r1}}, &(0x7f0000000100)={0x0, 0x18, 0x38}}, 0x1000}, @transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000180)={@ptr={0x70742a85, 0x0, &(0x7f0000000140)=""/51, 0x33, 0x2, 0x25}, @flat=@weak_handle={0x77682a85, 0x1}, @flat=@binder={0x73622a85, 0xa, 0x3}}, &(0x7f0000000280)={0x0, 0x28, 0x40}}, 0x1f8aed83e3349436}, @exit_looper, @transaction_sg={0x40486311, {0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x68, 0x18, &(0x7f0000000480)={@ptr={0x70742a85, 0x0, &(0x7f00000002c0)=""/11, 0xb, 0x2, 0x3f}, @fd={0x66642a85, 0x0, r0}, @ptr={0x70742a85, 0x0, &(0x7f0000000380)=""/70, 0x46, 0x1, 0x1f}}, &(0x7f0000000500)={0x0, 0x28, 0x40}}, 0x1000}], 0x14, 0x0, &(0x7f0000000680)="86621f50fcee8bdc5bf8c503a78812261b4bf6d7"}) 18:07:08 executing program 3: r0 = socket(0x10, 0x3, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") ioctl$sock_ifreq(r0, 0x89f3, &(0x7f0000000240)={'sit0\x00'}) 18:07:08 executing program 5: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000001a00)='/dev/net/tun\x00', 0x0, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000080)="c0dc00025e0b01047be070") ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000300)={'nr0\x01\x00', 0x1132}) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000001a00)='/dev/net/tun\x00', 0x2, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000300)={'nr0\x01\x00', 0x1132}) write$cgroup_int(0xffffffffffffffff, &(0x7f00000000c0)=0x2, 0xfffffffffffffe75) close(r1) [ 2597.887391] binder: 5219:5250 BC_ACQUIRE_DONE u0000000000000000 no match [ 2597.887399] binder: 5219:5250 BC_ACQUIRE_DONE u0000000000000003 no match [ 2597.887412] binder: 5219:5250 transaction failed 29189/-22, size 80-24 line 3014 [ 2597.887725] binder: undelivered TRANSACTION_ERROR: 29189 18:07:08 executing program 1: clone(0x2102001fff, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) socket(0x0, 0x0, 0x0) r0 = getpid() rt_tgsigqueueinfo(0x0, r0, 0x16, &(0x7f0000000100)) rt_sigqueueinfo(r0, 0x7, &(0x7f0000000180)={0x0, 0x0, 0xffffffff}) 18:07:08 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000006c0)={0x118, 0x0, &(0x7f0000000540)=[@release={0x40046306, 0x2}, @acquire_done, @acquire_done={0x40106309, 0x3}, @transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x50, 0x18, &(0x7f0000000080)={@flat=@binder={0x73622a85, 0xa, 0x1}, @fda={0x66646185, 0xa, 0x1, 0x9}, @fd={0x66642a85, 0x0, r1}}, &(0x7f0000000100)={0x0, 0x18, 0x38}}, 0x1000}, @transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000180)={@ptr={0x70742a85, 0x0, &(0x7f0000000140)=""/51, 0x33, 0x2, 0x25}, @flat=@weak_handle={0x77682a85, 0x1}, @flat=@binder={0x73622a85, 0xa, 0x3}}, &(0x7f0000000280)={0x0, 0x28, 0x40}}, 0x1f8aed83e3349436}, @exit_looper, @transaction_sg={0x40486311, {0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x68, 0x18, &(0x7f0000000480)={@ptr={0x70742a85, 0x0, &(0x7f00000002c0)=""/11, 0xb, 0x2, 0x3f}, @fd={0x66642a85, 0x0, r0}, @ptr={0x70742a85, 0x0, &(0x7f0000000380)=""/70, 0x46, 0x1, 0x1f}}, &(0x7f0000000500)={0x0, 0x28, 0x40}}, 0x1000}], 0x14, 0x0, &(0x7f0000000680)="86621f50fcee8bdc5bf8c503a78812261b4bf6d7"}) 18:07:08 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000006c0)={0x118, 0x0, &(0x7f0000000540)=[@release={0x40046306, 0x2}, @acquire_done, @acquire_done={0x40106309, 0x3}, @transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x50, 0x18, &(0x7f0000000080)={@flat=@binder={0x73622a85, 0xa, 0x1}, @fda={0x66646185, 0xa, 0x1, 0x9}, @fd={0x66642a85, 0x0, r1}}, &(0x7f0000000100)={0x0, 0x18, 0x38}}, 0x1000}, @transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000180)={@ptr={0x70742a85, 0x0, &(0x7f0000000140)=""/51, 0x33, 0x2, 0x25}, @flat=@weak_handle={0x77682a85, 0x1}, @flat=@binder={0x73622a85, 0xa, 0x3}}, &(0x7f0000000280)={0x0, 0x28, 0x40}}, 0x1f8aed83e3349436}, @exit_looper, @transaction_sg={0x40486311, {0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x68, 0x18, &(0x7f0000000480)={@ptr={0x70742a85, 0x0, &(0x7f00000002c0)=""/11, 0xb, 0x2, 0x3f}, @fd={0x66642a85, 0x0, r0}, @ptr={0x70742a85, 0x0, &(0x7f0000000380)=""/70, 0x46, 0x1, 0x1f}}, &(0x7f0000000500)={0x0, 0x28, 0x40}}, 0x1000}], 0x14, 0x0, &(0x7f0000000680)="86621f50fcee8bdc5bf8c503a78812261b4bf6d7"}) 18:07:08 executing program 2: ioctl$FS_IOC_RESVSP(0xffffffffffffffff, 0x40305828, &(0x7f00000000c0)={0x0, 0x0, 0x100000000000001}) clone(0x2102001fff, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) socket(0x0, 0x0, 0x0) r0 = getpid() rt_tgsigqueueinfo(0x0, r0, 0x16, &(0x7f0000000100)) ptrace(0x10, r0) ptrace$poke(0x4209, r0, &(0x7f00000000c0), 0x70effd) [ 2598.109304] binder: 5302:5314 Release 1 refcount change on invalid ref 2 ret -22 [ 2598.109314] binder: 5302:5314 BC_ACQUIRE_DONE u0000000000000000 no match [ 2598.109322] binder: 5302:5314 BC_ACQUIRE_DONE u0000000000000003 no match 18:07:08 executing program 3: r0 = socket(0x10, 0x3, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") ioctl$sock_ifreq(r0, 0x89f3, &(0x7f0000000240)={'sit0\x00'}) 18:07:08 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000006c0)={0x118, 0x0, &(0x7f0000000540)=[@release={0x40046306, 0x2}, @acquire_done, @acquire_done={0x40106309, 0x3}, @transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x50, 0x18, &(0x7f0000000080)={@flat=@binder={0x73622a85, 0xa, 0x1}, @fda={0x66646185, 0xa, 0x1, 0x9}, @fd={0x66642a85, 0x0, r1}}, &(0x7f0000000100)={0x0, 0x18, 0x38}}, 0x1000}, @transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000180)={@ptr={0x70742a85, 0x0, &(0x7f0000000140)=""/51, 0x33, 0x2, 0x25}, @flat=@weak_handle={0x77682a85, 0x1}, @flat=@binder={0x73622a85, 0xa, 0x3}}, &(0x7f0000000280)={0x0, 0x28, 0x40}}, 0x1f8aed83e3349436}, @exit_looper, @transaction_sg={0x40486311, {0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x68, 0x18, &(0x7f0000000480)={@ptr={0x70742a85, 0x0, &(0x7f00000002c0)=""/11, 0xb, 0x2, 0x3f}, @fd={0x66642a85, 0x0, r0}, @ptr={0x70742a85, 0x0, &(0x7f0000000380)=""/70, 0x46, 0x1, 0x1f}}, &(0x7f0000000500)={0x0, 0x28, 0x40}}, 0x1000}], 0x14, 0x0, &(0x7f0000000680)="86621f50fcee8bdc5bf8c503a78812261b4bf6d7"}) 18:07:08 executing program 4: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000040)='/dev/net/tun\x00', 0x0, 0x0) r1 = epoll_create1(0x0) epoll_ctl$EPOLL_CTL_ADD(0xffffffffffffffff, 0x1, r0, &(0x7f0000000100)) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000080)={'tunl0\x00', 0x1}) epoll_wait(r1, &(0x7f00000000c0)=[{}], 0x1, 0x0) [ 2598.109335] binder: 5302:5314 transaction failed 29189/-22, size 80-24 line 3014 [ 2598.110713] binder: undelivered TRANSACTION_ERROR: 29189 [ 2598.303299] binder: 5357:5364 Release 1 refcount change on invalid ref 2 ret -22 18:07:08 executing program 5: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000001a00)='/dev/net/tun\x00', 0x0, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000080)="c0dc00025e0b01047be070") ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000300)={'nr0\x01\x00', 0x1132}) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000001a00)='/dev/net/tun\x00', 0x2, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000300)={'nr0\x01\x00', 0x1132}) write$cgroup_int(0xffffffffffffffff, &(0x7f00000000c0)=0x2, 0xfffffffffffffe75) close(r1) 18:07:08 executing program 3: r0 = socket(0x10, 0x3, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") ioctl$sock_ifreq(r0, 0x89f3, &(0x7f0000000240)={'sit0\x00'}) 18:07:08 executing program 2: ioctl$FS_IOC_RESVSP(0xffffffffffffffff, 0x40305828, &(0x7f00000000c0)={0x0, 0x0, 0x100000000000001}) clone(0x2102001fff, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) socket(0x0, 0x0, 0x0) r0 = getpid() rt_tgsigqueueinfo(0x0, r0, 0x16, &(0x7f0000000100)) ptrace(0x10, r0) ptrace$poke(0x4209, r0, &(0x7f00000000c0), 0x70effd) 18:07:08 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000006c0)={0x118, 0x0, &(0x7f0000000540)=[@release={0x40046306, 0x2}, @acquire_done, @acquire_done={0x40106309, 0x3}, @transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x50, 0x18, &(0x7f0000000080)={@flat=@binder={0x73622a85, 0xa, 0x1}, @fda={0x66646185, 0xa, 0x1, 0x9}, @fd={0x66642a85, 0x0, r1}}, &(0x7f0000000100)={0x0, 0x18, 0x38}}, 0x1000}, @transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000180)={@ptr={0x70742a85, 0x0, &(0x7f0000000140)=""/51, 0x33, 0x2, 0x25}, @flat=@weak_handle={0x77682a85, 0x1}, @flat=@binder={0x73622a85, 0xa, 0x3}}, &(0x7f0000000280)={0x0, 0x28, 0x40}}, 0x1f8aed83e3349436}, @exit_looper, @transaction_sg={0x40486311, {0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x68, 0x18, &(0x7f0000000480)={@ptr={0x70742a85, 0x0, &(0x7f00000002c0)=""/11, 0xb, 0x2, 0x3f}, @fd={0x66642a85, 0x0, r0}, @ptr={0x70742a85, 0x0, &(0x7f0000000380)=""/70, 0x46, 0x1, 0x1f}}, &(0x7f0000000500)={0x0, 0x28, 0x40}}, 0x1000}], 0x14, 0x0, &(0x7f0000000680)="86621f50fcee8bdc5bf8c503a78812261b4bf6d7"}) [ 2598.303309] binder: 5357:5364 BC_ACQUIRE_DONE u0000000000000000 no match [ 2598.303317] binder: 5357:5364 BC_ACQUIRE_DONE u0000000000000003 no match 18:07:08 executing program 1: clone(0x2102001fff, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) socket(0x0, 0x0, 0x0) r0 = getpid() rt_tgsigqueueinfo(0x0, r0, 0x16, &(0x7f0000000100)) rt_sigqueueinfo(r0, 0x7, &(0x7f0000000180)={0x0, 0x0, 0xffffffff}) [ 2598.303330] binder: 5357:5364 transaction failed 29189/-22, size 80-24 line 3014 18:07:08 executing program 3: r0 = socket(0x10, 0x3, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") ioctl$sock_ifreq(r0, 0x89f3, &(0x7f0000000240)={'sit0\x00'}) 18:07:08 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000006c0)={0x118, 0x0, &(0x7f0000000540)=[@release={0x40046306, 0x2}, @acquire_done, @acquire_done={0x40106309, 0x3}, @transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x50, 0x18, &(0x7f0000000080)={@flat=@binder={0x73622a85, 0xa, 0x1}, @fda={0x66646185, 0xa, 0x1, 0x9}, @fd={0x66642a85, 0x0, r1}}, &(0x7f0000000100)={0x0, 0x18, 0x38}}, 0x1000}, @transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000180)={@ptr={0x70742a85, 0x0, &(0x7f0000000140)=""/51, 0x33, 0x2, 0x25}, @flat=@weak_handle={0x77682a85, 0x1}, @flat=@binder={0x73622a85, 0xa, 0x3}}, &(0x7f0000000280)={0x0, 0x28, 0x40}}, 0x1f8aed83e3349436}, @exit_looper, @transaction_sg={0x40486311, {0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x68, 0x18, &(0x7f0000000480)={@ptr={0x70742a85, 0x0, &(0x7f00000002c0)=""/11, 0xb, 0x2, 0x3f}, @fd={0x66642a85, 0x0, r0}, @ptr={0x70742a85, 0x0, &(0x7f0000000380)=""/70, 0x46, 0x1, 0x1f}}, &(0x7f0000000500)={0x0, 0x28, 0x40}}, 0x1000}], 0x14, 0x0, &(0x7f0000000680)="86621f50fcee8bdc5bf8c503a78812261b4bf6d7"}) [ 2598.303583] binder: undelivered TRANSACTION_ERROR: 29189 [ 2598.392095] binder: 5405:5406 Release 1 refcount change on invalid ref 2 ret -22 [ 2598.392105] binder: 5405:5406 BC_ACQUIRE_DONE u0000000000000000 no match 18:07:08 executing program 4: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000040)='/dev/net/tun\x00', 0x0, 0x0) r1 = epoll_create1(0x0) epoll_ctl$EPOLL_CTL_ADD(0xffffffffffffffff, 0x1, r0, &(0x7f0000000100)) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000080)={'tunl0\x00', 0x1}) epoll_wait(r1, &(0x7f00000000c0)=[{}], 0x1, 0x0) 18:07:08 executing program 3: r0 = socket(0x10, 0x3, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") ioctl$sock_ifreq(r0, 0x89f3, &(0x7f0000000240)={'sit0\x00'}) 18:07:08 executing program 1: clone(0x2102001fff, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) socket(0x0, 0x0, 0x0) r0 = getpid() rt_tgsigqueueinfo(0x0, r0, 0x16, &(0x7f0000000100)) rt_sigqueueinfo(r0, 0x7, &(0x7f0000000180)={0x0, 0x0, 0xffffffff}) 18:07:08 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000006c0)={0x118, 0x0, &(0x7f0000000540)=[@release={0x40046306, 0x2}, @acquire_done, @acquire_done={0x40106309, 0x3}, @transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x50, 0x18, &(0x7f0000000080)={@flat=@binder={0x73622a85, 0xa, 0x1}, @fda={0x66646185, 0xa, 0x1, 0x9}, @fd={0x66642a85, 0x0, r1}}, &(0x7f0000000100)={0x0, 0x18, 0x38}}, 0x1000}, @transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000180)={@ptr={0x70742a85, 0x0, &(0x7f0000000140)=""/51, 0x33, 0x2, 0x25}, @flat=@weak_handle={0x77682a85, 0x1}, @flat=@binder={0x73622a85, 0xa, 0x3}}, &(0x7f0000000280)={0x0, 0x28, 0x40}}, 0x1f8aed83e3349436}, @exit_looper, @transaction_sg={0x40486311, {0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x68, 0x18, &(0x7f0000000480)={@ptr={0x70742a85, 0x0, &(0x7f00000002c0)=""/11, 0xb, 0x2, 0x3f}, @fd={0x66642a85, 0x0, r0}, @ptr={0x70742a85, 0x0, &(0x7f0000000380)=""/70, 0x46, 0x1, 0x1f}}, &(0x7f0000000500)={0x0, 0x28, 0x40}}, 0x1000}], 0x14, 0x0, &(0x7f0000000680)="86621f50fcee8bdc5bf8c503a78812261b4bf6d7"}) 18:07:08 executing program 5: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000001a00)='/dev/net/tun\x00', 0x0, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000080)="c0dc00025e0b01047be070") ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000300)={'nr0\x01\x00', 0x1132}) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000001a00)='/dev/net/tun\x00', 0x2, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000300)={'nr0\x01\x00', 0x1132}) write$cgroup_int(0xffffffffffffffff, &(0x7f00000000c0)=0x2, 0xfffffffffffffe75) close(r1) [ 2598.392112] binder: 5405:5406 BC_ACQUIRE_DONE u0000000000000003 no match 18:07:08 executing program 3: r0 = socket(0x10, 0x3, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") ioctl$sock_ifreq(r0, 0x89f3, &(0x7f0000000240)={'sit0\x00'}) [ 2598.392126] binder: 5405:5406 transaction failed 29189/-22, size 80-24 line 3014 18:07:09 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000006c0)={0x118, 0x0, &(0x7f0000000540)=[@release={0x40046306, 0x2}, @acquire_done, @acquire_done={0x40106309, 0x3}, @transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x50, 0x18, &(0x7f0000000080)={@flat=@binder={0x73622a85, 0xa, 0x1}, @fda={0x66646185, 0xa, 0x1, 0x9}, @fd={0x66642a85, 0x0, r1}}, &(0x7f0000000100)={0x0, 0x18, 0x38}}, 0x1000}, @transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000180)={@ptr={0x70742a85, 0x0, &(0x7f0000000140)=""/51, 0x33, 0x2, 0x25}, @flat=@weak_handle={0x77682a85, 0x1}, @flat=@binder={0x73622a85, 0xa, 0x3}}, &(0x7f0000000280)={0x0, 0x28, 0x40}}, 0x1f8aed83e3349436}, @exit_looper, @transaction_sg={0x40486311, {0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x68, 0x18, &(0x7f0000000480)={@ptr={0x70742a85, 0x0, &(0x7f00000002c0)=""/11, 0xb, 0x2, 0x3f}, @fd={0x66642a85, 0x0, r0}, @ptr={0x70742a85, 0x0, &(0x7f0000000380)=""/70, 0x46, 0x1, 0x1f}}, &(0x7f0000000500)={0x0, 0x28, 0x40}}, 0x1000}], 0x14, 0x0, &(0x7f0000000680)="86621f50fcee8bdc5bf8c503a78812261b4bf6d7"}) [ 2598.392410] binder: undelivered TRANSACTION_ERROR: 29189 [ 2598.495359] binder: 5420:5428 Release 1 refcount change on invalid ref 2 ret -22 [ 2598.495369] binder: 5420:5428 BC_ACQUIRE_DONE u0000000000000000 no match 18:07:09 executing program 2: ioctl$FS_IOC_RESVSP(0xffffffffffffffff, 0x40305828, &(0x7f00000000c0)={0x0, 0x0, 0x100000000000001}) clone(0x2102001fff, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) socket(0x0, 0x0, 0x0) r0 = getpid() rt_tgsigqueueinfo(0x0, r0, 0x16, &(0x7f0000000100)) ptrace(0x10, r0) ptrace$poke(0x4209, r0, &(0x7f00000000c0), 0x70effd) 18:07:09 executing program 1: clone(0x2102001fff, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) socket(0x0, 0x0, 0x0) r0 = getpid() rt_tgsigqueueinfo(0x0, r0, 0x16, &(0x7f0000000100)) rt_sigqueueinfo(r0, 0x7, &(0x7f0000000180)={0x0, 0x0, 0xffffffff}) 18:07:09 executing program 3: r0 = socket(0x10, 0x3, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") ioctl$sock_ifreq(r0, 0x89f3, &(0x7f0000000240)={'sit0\x00'}) [ 2598.495378] binder: 5420:5428 BC_ACQUIRE_DONE u0000000000000003 no match [ 2598.495391] binder: 5420:5428 transaction failed 29189/-22, size 80-24 line 3014 [ 2598.497347] binder: undelivered TRANSACTION_ERROR: 29189 18:07:09 executing program 4: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000040)='/dev/net/tun\x00', 0x0, 0x0) r1 = epoll_create1(0x0) epoll_ctl$EPOLL_CTL_ADD(0xffffffffffffffff, 0x1, r0, &(0x7f0000000100)) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000080)={'tunl0\x00', 0x1}) epoll_wait(r1, &(0x7f00000000c0)=[{}], 0x1, 0x0) 18:07:09 executing program 1: clone(0x2102001fff, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) socket(0x0, 0x0, 0x0) r0 = getpid() rt_tgsigqueueinfo(0x0, r0, 0x16, &(0x7f0000000100)) rt_sigqueueinfo(r0, 0x7, &(0x7f0000000180)={0x0, 0x0, 0xffffffff}) 18:07:09 executing program 3: r0 = socket(0x10, 0x3, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") ioctl$sock_ifreq(r0, 0x89f3, &(0x7f0000000240)={'sit0\x00'}) [ 2598.680398] binder: 5488:5491 Release 1 refcount change on invalid ref 2 ret -22 18:07:09 executing program 5: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000001a00)='/dev/net/tun\x00', 0x0, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000080)="c0dc00025e0b01047be070") ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000300)={'nr0\x01\x00', 0x1132}) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000001a00)='/dev/net/tun\x00', 0x2, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000300)={'nr0\x01\x00', 0x1132}) write$cgroup_int(0xffffffffffffffff, &(0x7f00000000c0)=0x2, 0xfffffffffffffe75) close(r1) 18:07:09 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000006c0)={0x118, 0x0, &(0x7f0000000540)=[@release={0x40046306, 0x2}, @acquire_done, @acquire_done={0x40106309, 0x3}, @transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x50, 0x18, &(0x7f0000000080)={@flat=@binder={0x73622a85, 0xa, 0x1}, @fda={0x66646185, 0xa, 0x1, 0x9}, @fd={0x66642a85, 0x0, r1}}, &(0x7f0000000100)={0x0, 0x18, 0x38}}, 0x1000}, @transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000180)={@ptr={0x70742a85, 0x0, &(0x7f0000000140)=""/51, 0x33, 0x2, 0x25}, @flat=@weak_handle={0x77682a85, 0x1}, @flat=@binder={0x73622a85, 0xa, 0x3}}, &(0x7f0000000280)={0x0, 0x28, 0x40}}, 0x1f8aed83e3349436}, @exit_looper, @transaction_sg={0x40486311, {0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x68, 0x18, &(0x7f0000000480)={@ptr={0x70742a85, 0x0, &(0x7f00000002c0)=""/11, 0xb, 0x2, 0x3f}, @fd={0x66642a85, 0x0, r0}, @ptr={0x70742a85, 0x0, &(0x7f0000000380)=""/70, 0x46, 0x1, 0x1f}}, &(0x7f0000000500)={0x0, 0x28, 0x40}}, 0x1000}], 0x14, 0x0, &(0x7f0000000680)="86621f50fcee8bdc5bf8c503a78812261b4bf6d7"}) [ 2598.680408] binder: 5488:5491 BC_ACQUIRE_DONE u0000000000000000 no match [ 2598.680415] binder: 5488:5491 BC_ACQUIRE_DONE u0000000000000003 no match 18:07:09 executing program 3: r0 = socket(0x10, 0x3, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") ioctl$sock_ifreq(r0, 0x89f3, &(0x7f0000000240)={'sit0\x00'}) 18:07:09 executing program 2: ioctl$FS_IOC_RESVSP(0xffffffffffffffff, 0x40305828, &(0x7f00000000c0)={0x0, 0x0, 0x100000000000001}) clone(0x2102001fff, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) socket(0x0, 0x0, 0x0) r0 = getpid() rt_tgsigqueueinfo(0x0, r0, 0x16, &(0x7f0000000100)) ptrace(0x10, r0) ptrace$poke(0x4209, r0, &(0x7f00000000c0), 0x70effd) 18:07:09 executing program 1: clone(0x2102001fff, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) socket(0x0, 0x0, 0x0) r0 = getpid() rt_tgsigqueueinfo(0x0, r0, 0x16, &(0x7f0000000100)) rt_sigqueueinfo(r0, 0x7, &(0x7f0000000180)={0x0, 0x0, 0xffffffff}) [ 2598.680426] binder: 5488:5491 transaction failed 29189/-22, size 80-24 line 3014 [ 2598.682938] binder: undelivered TRANSACTION_ERROR: 29189 [ 2598.765448] binder: 5502:5508 Release 1 refcount change on invalid ref 2 ret -22 18:07:09 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000006c0)={0x118, 0x0, &(0x7f0000000540)=[@release={0x40046306, 0x2}, @acquire_done, @acquire_done={0x40106309, 0x3}, @transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x50, 0x18, &(0x7f0000000080)={@flat=@binder={0x73622a85, 0xa, 0x1}, @fda={0x66646185, 0xa, 0x1, 0x9}, @fd={0x66642a85, 0x0, r1}}, &(0x7f0000000100)={0x0, 0x18, 0x38}}, 0x1000}, @transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000180)={@ptr={0x70742a85, 0x0, &(0x7f0000000140)=""/51, 0x33, 0x2, 0x25}, @flat=@weak_handle={0x77682a85, 0x1}, @flat=@binder={0x73622a85, 0xa, 0x3}}, &(0x7f0000000280)={0x0, 0x28, 0x40}}, 0x1f8aed83e3349436}, @exit_looper, @transaction_sg={0x40486311, {0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x68, 0x18, &(0x7f0000000480)={@ptr={0x70742a85, 0x0, &(0x7f00000002c0)=""/11, 0xb, 0x2, 0x3f}, @fd={0x66642a85, 0x0, r0}, @ptr={0x70742a85, 0x0, &(0x7f0000000380)=""/70, 0x46, 0x1, 0x1f}}, &(0x7f0000000500)={0x0, 0x28, 0x40}}, 0x1000}], 0x14, 0x0, &(0x7f0000000680)="86621f50fcee8bdc5bf8c503a78812261b4bf6d7"}) [ 2598.765458] binder: 5502:5508 BC_ACQUIRE_DONE u0000000000000000 no match [ 2598.765608] binder: 5502:5508 BC_ACQUIRE_DONE u0000000000000003 no match [ 2598.765622] binder: 5502:5508 transaction failed 29189/-22, size 80-24 line 3014 18:07:09 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000006c0)={0x118, 0x0, &(0x7f0000000540)=[@release={0x40046306, 0x2}, @acquire_done, @acquire_done={0x40106309, 0x3}, @transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x50, 0x18, &(0x7f0000000080)={@flat=@binder={0x73622a85, 0xa, 0x1}, @fda={0x66646185, 0xa, 0x1, 0x9}, @fd={0x66642a85, 0x0, r1}}, &(0x7f0000000100)={0x0, 0x18, 0x38}}, 0x1000}, @transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000180)={@ptr={0x70742a85, 0x0, &(0x7f0000000140)=""/51, 0x33, 0x2, 0x25}, @flat=@weak_handle={0x77682a85, 0x1}, @flat=@binder={0x73622a85, 0xa, 0x3}}, &(0x7f0000000280)={0x0, 0x28, 0x40}}, 0x1f8aed83e3349436}, @exit_looper, @transaction_sg={0x40486311, {0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x68, 0x18, &(0x7f0000000480)={@ptr={0x70742a85, 0x0, &(0x7f00000002c0)=""/11, 0xb, 0x2, 0x3f}, @fd={0x66642a85, 0x0, r0}, @ptr={0x70742a85, 0x0, &(0x7f0000000380)=""/70, 0x46, 0x1, 0x1f}}, &(0x7f0000000500)={0x0, 0x28, 0x40}}, 0x1000}], 0x14, 0x0, &(0x7f0000000680)="86621f50fcee8bdc5bf8c503a78812261b4bf6d7"}) 18:07:09 executing program 2: ioctl$FS_IOC_RESVSP(0xffffffffffffffff, 0x40305828, &(0x7f00000000c0)={0x0, 0x0, 0x100000000000001}) clone(0x2102001fff, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) socket(0x0, 0x0, 0x0) r0 = getpid() rt_tgsigqueueinfo(0x0, r0, 0x16, &(0x7f0000000100)) ptrace(0x10, r0) ptrace$poke(0x4209, r0, &(0x7f00000000c0), 0x70effd) 18:07:09 executing program 3: r0 = socket(0x10, 0x3, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") ioctl$sock_ifreq(r0, 0x89f3, &(0x7f0000000240)={'sit0\x00'}) [ 2598.765977] binder: undelivered TRANSACTION_ERROR: 29189 [ 2598.899666] binder: 5530:5534 Release 1 refcount change on invalid ref 2 ret -22 18:07:09 executing program 4: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000040)='/dev/net/tun\x00', 0x0, 0x0) r1 = epoll_create1(0x0) epoll_ctl$EPOLL_CTL_ADD(0xffffffffffffffff, 0x1, r0, &(0x7f0000000100)) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000080)={'tunl0\x00', 0x1}) epoll_wait(r1, &(0x7f00000000c0)=[{}], 0x1, 0x0) 18:07:09 executing program 1: clone(0x2102001fff, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) socket(0x0, 0x0, 0x0) r0 = getpid() rt_tgsigqueueinfo(0x0, r0, 0x16, &(0x7f0000000100)) rt_sigqueueinfo(r0, 0x7, &(0x7f0000000180)={0x0, 0x0, 0xffffffff}) [ 2598.899677] binder: 5530:5534 BC_ACQUIRE_DONE u0000000000000000 no match 18:07:09 executing program 3: r0 = socket(0x10, 0x3, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") ioctl$sock_ifreq(r0, 0x89f3, &(0x7f0000000240)={'sit0\x00'}) [ 2598.899685] binder: 5530:5534 BC_ACQUIRE_DONE u0000000000000003 no match [ 2598.899698] binder: 5530:5534 transaction failed 29189/-22, size 80-24 line 3014 18:07:09 executing program 5: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000001a00)='/dev/net/tun\x00', 0x0, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000080)="c0dc00025e0b01047be070") ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000300)={'nr0\x01\x00', 0x1132}) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000001a00)='/dev/net/tun\x00', 0x2, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000300)={'nr0\x01\x00', 0x1132}) write$cgroup_int(0xffffffffffffffff, &(0x7f00000000c0)=0x2, 0xfffffffffffffe75) close(r1) 18:07:09 executing program 3: r0 = socket(0x10, 0x3, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") ioctl$sock_ifreq(r0, 0x89f3, &(0x7f0000000240)={'sit0\x00'}) 18:07:09 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000006c0)={0x118, 0x0, &(0x7f0000000540)=[@release={0x40046306, 0x2}, @acquire_done, @acquire_done={0x40106309, 0x3}, @transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x50, 0x18, &(0x7f0000000080)={@flat=@binder={0x73622a85, 0xa, 0x1}, @fda={0x66646185, 0xa, 0x1, 0x9}, @fd={0x66642a85, 0x0, r1}}, &(0x7f0000000100)={0x0, 0x18, 0x38}}, 0x1000}, @transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000180)={@ptr={0x70742a85, 0x0, &(0x7f0000000140)=""/51, 0x33, 0x2, 0x25}, @flat=@weak_handle={0x77682a85, 0x1}, @flat=@binder={0x73622a85, 0xa, 0x3}}, &(0x7f0000000280)={0x0, 0x28, 0x40}}, 0x1f8aed83e3349436}, @exit_looper, @transaction_sg={0x40486311, {0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x68, 0x18, &(0x7f0000000480)={@ptr={0x70742a85, 0x0, &(0x7f00000002c0)=""/11, 0xb, 0x2, 0x3f}, @fd={0x66642a85, 0x0, r0}, @ptr={0x70742a85, 0x0, &(0x7f0000000380)=""/70, 0x46, 0x1, 0x1f}}, &(0x7f0000000500)={0x0, 0x28, 0x40}}, 0x1000}], 0x14, 0x0, &(0x7f0000000680)="86621f50fcee8bdc5bf8c503a78812261b4bf6d7"}) 18:07:09 executing program 1: clone(0x2102001fff, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) socket(0x0, 0x0, 0x0) r0 = getpid() rt_tgsigqueueinfo(0x0, r0, 0x16, &(0x7f0000000100)) rt_sigqueueinfo(r0, 0x7, &(0x7f0000000180)={0x0, 0x0, 0xffffffff}) 18:07:09 executing program 2: ioctl$FS_IOC_RESVSP(0xffffffffffffffff, 0x40305828, &(0x7f00000000c0)={0x0, 0x0, 0x100000000000001}) clone(0x2102001fff, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) socket(0x0, 0x0, 0x0) r0 = getpid() rt_tgsigqueueinfo(0x0, r0, 0x16, &(0x7f0000000100)) ptrace(0x10, r0) ptrace$poke(0x4209, r0, &(0x7f00000000c0), 0x70effd) 18:07:09 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000006c0)={0x118, 0x0, &(0x7f0000000540)=[@release={0x40046306, 0x2}, @acquire_done, @acquire_done={0x40106309, 0x3}, @transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x50, 0x18, &(0x7f0000000080)={@flat=@binder={0x73622a85, 0xa, 0x1}, @fda={0x66646185, 0xa, 0x1, 0x9}, @fd={0x66642a85, 0x0, r1}}, &(0x7f0000000100)={0x0, 0x18, 0x38}}, 0x1000}, @transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000180)={@ptr={0x70742a85, 0x0, &(0x7f0000000140)=""/51, 0x33, 0x2, 0x25}, @flat=@weak_handle={0x77682a85, 0x1}, @flat=@binder={0x73622a85, 0xa, 0x3}}, &(0x7f0000000280)={0x0, 0x28, 0x40}}, 0x1f8aed83e3349436}, @exit_looper, @transaction_sg={0x40486311, {0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x68, 0x18, &(0x7f0000000480)={@ptr={0x70742a85, 0x0, &(0x7f00000002c0)=""/11, 0xb, 0x2, 0x3f}, @fd={0x66642a85, 0x0, r0}, @ptr={0x70742a85, 0x0, &(0x7f0000000380)=""/70, 0x46, 0x1, 0x1f}}, &(0x7f0000000500)={0x0, 0x28, 0x40}}, 0x1000}], 0x14, 0x0, &(0x7f0000000680)="86621f50fcee8bdc5bf8c503a78812261b4bf6d7"}) 18:07:09 executing program 3: r0 = socket(0x10, 0x3, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") ioctl$sock_ifreq(r0, 0x89f3, &(0x7f0000000240)={'sit0\x00'}) [ 2598.900734] binder: undelivered TRANSACTION_ERROR: 29189 [ 2598.999329] binder: 5579:5588 Release 1 refcount change on invalid ref 2 ret -22 [ 2598.999339] binder: 5579:5588 BC_ACQUIRE_DONE u0000000000000000 no match [ 2598.999347] binder: 5579:5588 BC_ACQUIRE_DONE u0000000000000003 no match 18:07:09 executing program 4: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000040)='/dev/net/tun\x00', 0x0, 0x0) r1 = epoll_create1(0x0) epoll_ctl$EPOLL_CTL_ADD(0xffffffffffffffff, 0x1, r0, &(0x7f0000000100)) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000080)={'tunl0\x00', 0x1}) epoll_wait(r1, &(0x7f00000000c0)=[{}], 0x1, 0x0) 18:07:09 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000006c0)={0x118, 0x0, &(0x7f0000000540)=[@release={0x40046306, 0x2}, @acquire_done, @acquire_done={0x40106309, 0x3}, @transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x50, 0x18, &(0x7f0000000080)={@flat=@binder={0x73622a85, 0xa, 0x1}, @fda={0x66646185, 0xa, 0x1, 0x9}, @fd={0x66642a85, 0x0, r1}}, &(0x7f0000000100)={0x0, 0x18, 0x38}}, 0x1000}, @transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000180)={@ptr={0x70742a85, 0x0, &(0x7f0000000140)=""/51, 0x33, 0x2, 0x25}, @flat=@weak_handle={0x77682a85, 0x1}, @flat=@binder={0x73622a85, 0xa, 0x3}}, &(0x7f0000000280)={0x0, 0x28, 0x40}}, 0x1f8aed83e3349436}, @exit_looper, @transaction_sg={0x40486311, {0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x68, 0x18, &(0x7f0000000480)={@ptr={0x70742a85, 0x0, &(0x7f00000002c0)=""/11, 0xb, 0x2, 0x3f}, @fd={0x66642a85, 0x0, r0}, @ptr={0x70742a85, 0x0, &(0x7f0000000380)=""/70, 0x46, 0x1, 0x1f}}, &(0x7f0000000500)={0x0, 0x28, 0x40}}, 0x1000}], 0x14, 0x0, &(0x7f0000000680)="86621f50fcee8bdc5bf8c503a78812261b4bf6d7"}) 18:07:09 executing program 1: clone(0x2102001fff, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) socket(0x0, 0x0, 0x0) r0 = getpid() rt_tgsigqueueinfo(0x0, r0, 0x16, &(0x7f0000000100)) rt_sigqueueinfo(r0, 0x7, &(0x7f0000000180)={0x0, 0x0, 0xffffffff}) 18:07:09 executing program 3: r0 = socket(0x10, 0x3, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") ioctl$sock_ifreq(r0, 0x89f3, &(0x7f0000000240)={'sit0\x00'}) [ 2598.999360] binder: 5579:5588 transaction failed 29189/-22, size 80-24 line 3014 [ 2598.999647] binder: undelivered TRANSACTION_ERROR: 29189 [ 2599.214470] binder: 5614:5654 Release 1 refcount change on invalid ref 2 ret -22 18:07:10 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000006c0)={0x118, 0x0, &(0x7f0000000540)=[@release={0x40046306, 0x2}, @acquire_done, @acquire_done={0x40106309, 0x3}, @transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x50, 0x18, &(0x7f0000000080)={@flat=@binder={0x73622a85, 0xa, 0x1}, @fda={0x66646185, 0xa, 0x1, 0x9}, @fd={0x66642a85, 0x0, r1}}, &(0x7f0000000100)={0x0, 0x18, 0x38}}, 0x1000}, @transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000180)={@ptr={0x70742a85, 0x0, &(0x7f0000000140)=""/51, 0x33, 0x2, 0x25}, @flat=@weak_handle={0x77682a85, 0x1}, @flat=@binder={0x73622a85, 0xa, 0x3}}, &(0x7f0000000280)={0x0, 0x28, 0x40}}, 0x1f8aed83e3349436}, @exit_looper, @transaction_sg={0x40486311, {0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x68, 0x18, &(0x7f0000000480)={@ptr={0x70742a85, 0x0, &(0x7f00000002c0)=""/11, 0xb, 0x2, 0x3f}, @fd={0x66642a85, 0x0, r0}, @ptr={0x70742a85, 0x0, &(0x7f0000000380)=""/70, 0x46, 0x1, 0x1f}}, &(0x7f0000000500)={0x0, 0x28, 0x40}}, 0x1000}], 0x14, 0x0, &(0x7f0000000680)="86621f50fcee8bdc5bf8c503a78812261b4bf6d7"}) 18:07:10 executing program 5: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000001a00)='/dev/net/tun\x00', 0x0, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000080)="c0dc00025e0b01047be070") ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000300)={'nr0\x01\x00', 0x1132}) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000001a00)='/dev/net/tun\x00', 0x2, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000300)={'nr0\x01\x00', 0x1132}) write$cgroup_int(0xffffffffffffffff, &(0x7f00000000c0)=0x2, 0xfffffffffffffe75) close(r1) 18:07:10 executing program 1: clone(0x2102001fff, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) socket(0x0, 0x0, 0x0) r0 = getpid() rt_tgsigqueueinfo(0x0, r0, 0x16, &(0x7f0000000100)) rt_sigqueueinfo(r0, 0x7, &(0x7f0000000180)={0x0, 0x0, 0xffffffff}) 18:07:10 executing program 2: ioctl$FS_IOC_RESVSP(0xffffffffffffffff, 0x40305828, &(0x7f00000000c0)={0x0, 0x0, 0x100000000000001}) clone(0x2102001fff, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) socket(0x0, 0x0, 0x0) r0 = getpid() rt_tgsigqueueinfo(0x0, r0, 0x16, &(0x7f0000000100)) ptrace(0x10, r0) ptrace$poke(0x4209, r0, &(0x7f00000000c0), 0x70effd) [ 2599.214480] binder: 5614:5654 BC_ACQUIRE_DONE u0000000000000000 no match [ 2599.214488] binder: 5614:5654 BC_ACQUIRE_DONE u0000000000000003 no match 18:07:10 executing program 3: r0 = socket(0x10, 0x3, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") ioctl$sock_ifreq(r0, 0x89f3, &(0x7f0000000240)={'sit0\x00'}) [ 2599.214511] binder: 5614:5654 transaction failed 29189/-22, size 80-24 line 3014 18:07:10 executing program 1: clone(0x2102001fff, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) socket(0x0, 0x0, 0x0) r0 = getpid() rt_tgsigqueueinfo(0x0, r0, 0x16, &(0x7f0000000100)) rt_sigqueueinfo(r0, 0x7, &(0x7f0000000180)={0x0, 0x0, 0xffffffff}) [ 2599.214769] binder: undelivered TRANSACTION_ERROR: 29189 [ 2599.340688] binder: 5705:5716 Release 1 refcount change on invalid ref 2 ret -22 [ 2599.340698] binder: 5705:5716 BC_ACQUIRE_DONE u0000000000000000 no match 18:07:10 executing program 3: r0 = socket(0x10, 0x3, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") ioctl$sock_ifreq(r0, 0x89f3, &(0x7f0000000240)={'sit0\x00'}) 18:07:10 executing program 4: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000040)='/dev/net/tun\x00', 0x0, 0x0) r1 = epoll_create1(0x0) epoll_ctl$EPOLL_CTL_ADD(0xffffffffffffffff, 0x1, r0, &(0x7f0000000100)) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000080)={'tunl0\x00', 0x1}) epoll_wait(r1, &(0x7f00000000c0)=[{}], 0x1, 0x0) 18:07:10 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000006c0)={0x118, 0x0, &(0x7f0000000540)=[@release={0x40046306, 0x2}, @acquire_done, @acquire_done={0x40106309, 0x3}, @transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x50, 0x18, &(0x7f0000000080)={@flat=@binder={0x73622a85, 0xa, 0x1}, @fda={0x66646185, 0xa, 0x1, 0x9}, @fd={0x66642a85, 0x0, r1}}, &(0x7f0000000100)={0x0, 0x18, 0x38}}, 0x1000}, @transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000180)={@ptr={0x70742a85, 0x0, &(0x7f0000000140)=""/51, 0x33, 0x2, 0x25}, @flat=@weak_handle={0x77682a85, 0x1}, @flat=@binder={0x73622a85, 0xa, 0x3}}, &(0x7f0000000280)={0x0, 0x28, 0x40}}, 0x1f8aed83e3349436}, @exit_looper, @transaction_sg={0x40486311, {0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x68, 0x18, &(0x7f0000000480)={@ptr={0x70742a85, 0x0, &(0x7f00000002c0)=""/11, 0xb, 0x2, 0x3f}, @fd={0x66642a85, 0x0, r0}, @ptr={0x70742a85, 0x0, &(0x7f0000000380)=""/70, 0x46, 0x1, 0x1f}}, &(0x7f0000000500)={0x0, 0x28, 0x40}}, 0x1000}], 0x14, 0x0, &(0x7f0000000680)="86621f50fcee8bdc5bf8c503a78812261b4bf6d7"}) 18:07:10 executing program 2: ioctl$FS_IOC_RESVSP(0xffffffffffffffff, 0x40305828, &(0x7f00000000c0)={0x0, 0x0, 0x100000000000001}) clone(0x2102001fff, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) socket(0x0, 0x0, 0x0) r0 = getpid() rt_tgsigqueueinfo(0x0, r0, 0x16, &(0x7f0000000100)) ptrace(0x10, r0) ptrace$poke(0x4209, r0, &(0x7f00000000c0), 0x70effd) [ 2599.340706] binder: 5705:5716 BC_ACQUIRE_DONE u0000000000000003 no match [ 2599.340720] binder: 5705:5716 transaction failed 29189/-22, size 80-24 line 3014 18:07:10 executing program 1: clone(0x2102001fff, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) socket(0x0, 0x0, 0x0) r0 = getpid() rt_tgsigqueueinfo(0x0, r0, 0x16, &(0x7f0000000100)) rt_sigqueueinfo(r0, 0x7, &(0x7f0000000180)={0x0, 0x0, 0xffffffff}) [ 2599.341112] binder: undelivered TRANSACTION_ERROR: 29189 18:07:10 executing program 3: r0 = socket(0x10, 0x3, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") ioctl$sock_ifreq(r0, 0x89f3, &(0x7f0000000240)={'sit0\x00'}) 18:07:10 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000006c0)={0x118, 0x0, &(0x7f0000000540)=[@release={0x40046306, 0x2}, @acquire_done, @acquire_done={0x40106309, 0x3}, @transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x50, 0x18, &(0x7f0000000080)={@flat=@binder={0x73622a85, 0xa, 0x1}, @fda={0x66646185, 0xa, 0x1, 0x9}, @fd={0x66642a85, 0x0, r1}}, &(0x7f0000000100)={0x0, 0x18, 0x38}}, 0x1000}, @transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000180)={@ptr={0x70742a85, 0x0, &(0x7f0000000140)=""/51, 0x33, 0x2, 0x25}, @flat=@weak_handle={0x77682a85, 0x1}, @flat=@binder={0x73622a85, 0xa, 0x3}}, &(0x7f0000000280)={0x0, 0x28, 0x40}}, 0x1f8aed83e3349436}, @exit_looper, @transaction_sg={0x40486311, {0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x68, 0x18, &(0x7f0000000480)={@ptr={0x70742a85, 0x0, &(0x7f00000002c0)=""/11, 0xb, 0x2, 0x3f}, @fd={0x66642a85, 0x0, r0}, @ptr={0x70742a85, 0x0, &(0x7f0000000380)=""/70, 0x46, 0x1, 0x1f}}, &(0x7f0000000500)={0x0, 0x28, 0x40}}, 0x1000}], 0x14, 0x0, &(0x7f0000000680)="86621f50fcee8bdc5bf8c503a78812261b4bf6d7"}) 18:07:10 executing program 5: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000001a00)='/dev/net/tun\x00', 0x0, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000080)="c0dc00025e0b01047be070") ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000300)={'nr0\x01\x00', 0x1132}) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000001a00)='/dev/net/tun\x00', 0x2, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000300)={'nr0\x01\x00', 0x1132}) write$cgroup_int(0xffffffffffffffff, &(0x7f00000000c0)=0x2, 0xfffffffffffffe75) close(r1) [ 2599.453438] binder: 5731:5735 Release 1 refcount change on invalid ref 2 ret -22 [ 2599.453447] binder: 5731:5735 BC_ACQUIRE_DONE u0000000000000000 no match [ 2599.453454] binder: 5731:5735 BC_ACQUIRE_DONE u0000000000000003 no match 18:07:10 executing program 1: clone(0x2102001fff, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) socket(0x0, 0x0, 0x0) r0 = getpid() rt_tgsigqueueinfo(0x0, r0, 0x16, &(0x7f0000000100)) rt_sigqueueinfo(r0, 0x7, &(0x7f0000000180)={0x0, 0x0, 0xffffffff}) 18:07:10 executing program 4: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000040)='/dev/net/tun\x00', 0x0, 0x0) r1 = epoll_create1(0x0) epoll_ctl$EPOLL_CTL_ADD(0xffffffffffffffff, 0x1, r0, &(0x7f0000000100)) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000080)={'tunl0\x00', 0x1}) epoll_wait(r1, &(0x7f00000000c0)=[{}], 0x1, 0x0) 18:07:10 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000006c0)={0x118, 0x0, &(0x7f0000000540)=[@release={0x40046306, 0x2}, @acquire_done, @acquire_done={0x40106309, 0x3}, @transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x50, 0x18, &(0x7f0000000080)={@flat=@binder={0x73622a85, 0xa, 0x1}, @fda={0x66646185, 0xa, 0x1, 0x9}, @fd={0x66642a85, 0x0, r1}}, &(0x7f0000000100)={0x0, 0x18, 0x38}}, 0x1000}, @transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000180)={@ptr={0x70742a85, 0x0, &(0x7f0000000140)=""/51, 0x33, 0x2, 0x25}, @flat=@weak_handle={0x77682a85, 0x1}, @flat=@binder={0x73622a85, 0xa, 0x3}}, &(0x7f0000000280)={0x0, 0x28, 0x40}}, 0x1f8aed83e3349436}, @exit_looper, @transaction_sg={0x40486311, {0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x68, 0x18, &(0x7f0000000480)={@ptr={0x70742a85, 0x0, &(0x7f00000002c0)=""/11, 0xb, 0x2, 0x3f}, @fd={0x66642a85, 0x0, r0}, @ptr={0x70742a85, 0x0, &(0x7f0000000380)=""/70, 0x46, 0x1, 0x1f}}, &(0x7f0000000500)={0x0, 0x28, 0x40}}, 0x1000}], 0x14, 0x0, &(0x7f0000000680)="86621f50fcee8bdc5bf8c503a78812261b4bf6d7"}) 18:07:10 executing program 2: ioctl$FS_IOC_RESVSP(0xffffffffffffffff, 0x40305828, &(0x7f00000000c0)={0x0, 0x0, 0x100000000000001}) clone(0x2102001fff, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) socket(0x0, 0x0, 0x0) r0 = getpid() rt_tgsigqueueinfo(0x0, r0, 0x16, &(0x7f0000000100)) ptrace(0x10, r0) ptrace$poke(0x4209, r0, &(0x7f00000000c0), 0x70effd) [ 2599.453468] binder: 5731:5735 transaction failed 29189/-22, size 80-24 line 3014 [ 2599.471644] binder: undelivered TRANSACTION_ERROR: 29189 [ 2599.520915] binder: 5766:5767 Release 1 refcount change on invalid ref 2 ret -22 [ 2599.520926] binder: 5766:5767 BC_ACQUIRE_DONE u0000000000000000 no match 18:07:10 executing program 1: clone(0x2102001fff, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) socket(0x0, 0x0, 0x0) r0 = getpid() rt_tgsigqueueinfo(0x0, r0, 0x16, &(0x7f0000000100)) rt_sigqueueinfo(r0, 0x7, &(0x7f0000000180)={0x0, 0x0, 0xffffffff}) 18:07:10 executing program 3: r0 = socket(0x10, 0x3, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") ioctl$sock_ifreq(r0, 0x89f3, &(0x7f0000000240)={'sit0\x00'}) [ 2599.520933] binder: 5766:5767 BC_ACQUIRE_DONE u0000000000000003 no match [ 2599.520947] binder: 5766:5767 transaction failed 29189/-22, size 80-24 line 3014 [ 2599.522372] binder: undelivered TRANSACTION_ERROR: 29189 18:07:10 executing program 3: r0 = socket(0x10, 0x3, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") ioctl$sock_ifreq(r0, 0x89f3, &(0x7f0000000240)={'sit0\x00'}) [ 2599.645767] binder: 5794:5809 Release 1 refcount change on invalid ref 2 ret -22 18:07:10 executing program 1: clone(0x2102001fff, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) socket(0x0, 0x0, 0x0) r0 = getpid() rt_tgsigqueueinfo(0x0, r0, 0x16, &(0x7f0000000100)) rt_sigqueueinfo(r0, 0x7, &(0x7f0000000180)={0x0, 0x0, 0xffffffff}) 18:07:10 executing program 2: ioctl$FS_IOC_RESVSP(0xffffffffffffffff, 0x40305828, &(0x7f00000000c0)={0x0, 0x0, 0x100000000000001}) clone(0x2102001fff, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) socket(0x0, 0x0, 0x0) r0 = getpid() rt_tgsigqueueinfo(0x0, r0, 0x16, &(0x7f0000000100)) ptrace(0x10, r0) ptrace$poke(0x4209, r0, &(0x7f00000000c0), 0x70effd) 18:07:10 executing program 4: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000040)='/dev/net/tun\x00', 0x0, 0x0) r1 = epoll_create1(0x0) epoll_ctl$EPOLL_CTL_ADD(0xffffffffffffffff, 0x1, r0, &(0x7f0000000100)) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000080)={'tunl0\x00', 0x1}) epoll_wait(r1, &(0x7f00000000c0)=[{}], 0x1, 0x0) 18:07:10 executing program 5: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000001a00)='/dev/net/tun\x00', 0x0, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000080)="c0dc00025e0b01047be070") ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000300)={'nr0\x01\x00', 0x1132}) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000001a00)='/dev/net/tun\x00', 0x2, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000300)={'nr0\x01\x00', 0x1132}) write$cgroup_int(0xffffffffffffffff, &(0x7f00000000c0)=0x2, 0xfffffffffffffe75) close(r1) [ 2599.645777] binder: 5794:5809 BC_ACQUIRE_DONE u0000000000000000 no match [ 2599.645786] binder: 5794:5809 BC_ACQUIRE_DONE u0000000000000003 no match 18:07:10 executing program 1: clone(0x2102001fff, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) socket(0x0, 0x0, 0x0) r0 = getpid() rt_tgsigqueueinfo(0x0, r0, 0x16, &(0x7f0000000100)) rt_sigqueueinfo(r0, 0x7, &(0x7f0000000180)={0x0, 0x0, 0xffffffff}) 18:07:10 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000006c0)={0x118, 0x0, &(0x7f0000000540)=[@release={0x40046306, 0x2}, @acquire_done, @acquire_done={0x40106309, 0x3}, @transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x50, 0x18, &(0x7f0000000080)={@flat=@binder={0x73622a85, 0xa, 0x1}, @fda={0x66646185, 0xa, 0x1, 0x9}, @fd={0x66642a85, 0x0, r1}}, &(0x7f0000000100)={0x0, 0x18, 0x38}}, 0x1000}, @transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000180)={@ptr={0x70742a85, 0x0, &(0x7f0000000140)=""/51, 0x33, 0x2, 0x25}, @flat=@weak_handle={0x77682a85, 0x1}, @flat=@binder={0x73622a85, 0xa, 0x3}}, &(0x7f0000000280)={0x0, 0x28, 0x40}}, 0x1f8aed83e3349436}, @exit_looper, @transaction_sg={0x40486311, {0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x68, 0x18, &(0x7f0000000480)={@ptr={0x70742a85, 0x0, &(0x7f00000002c0)=""/11, 0xb, 0x2, 0x3f}, @fd={0x66642a85, 0x0, r0}, @ptr={0x70742a85, 0x0, &(0x7f0000000380)=""/70, 0x46, 0x1, 0x1f}}, &(0x7f0000000500)={0x0, 0x28, 0x40}}, 0x1000}], 0x14, 0x0, &(0x7f0000000680)="86621f50fcee8bdc5bf8c503a78812261b4bf6d7"}) [ 2599.645798] binder: 5794:5809 transaction failed 29189/-22, size 80-24 line 3014 [ 2599.646102] binder: undelivered TRANSACTION_ERROR: 29189 [ 2599.700234] binder: 5837:5845 Release 1 refcount change on invalid ref 2 ret -22 [ 2599.700244] binder: 5837:5845 BC_ACQUIRE_DONE u0000000000000000 no match [ 2599.700253] binder: 5837:5845 BC_ACQUIRE_DONE u0000000000000003 no match 18:07:11 executing program 1: clone(0x2102001fff, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) socket(0x0, 0x0, 0x0) r0 = getpid() rt_tgsigqueueinfo(0x0, r0, 0x16, &(0x7f0000000100)) rt_sigqueueinfo(r0, 0x7, &(0x7f0000000180)={0x0, 0x0, 0xffffffff}) 18:07:11 executing program 3: r0 = socket(0x10, 0x3, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") ioctl$sock_ifreq(r0, 0x89f3, &(0x7f0000000240)={'sit0\x00'}) 18:07:11 executing program 2: ioctl$FS_IOC_RESVSP(0xffffffffffffffff, 0x40305828, &(0x7f00000000c0)={0x0, 0x0, 0x100000000000001}) clone(0x2102001fff, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) socket(0x0, 0x0, 0x0) r0 = getpid() rt_tgsigqueueinfo(0x0, r0, 0x16, &(0x7f0000000100)) ptrace(0x10, r0) ptrace$poke(0x4209, r0, &(0x7f00000000c0), 0x70effd) 18:07:11 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000006c0)={0x118, 0x0, &(0x7f0000000540)=[@release={0x40046306, 0x2}, @acquire_done, @acquire_done={0x40106309, 0x3}, @transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x50, 0x18, &(0x7f0000000080)={@flat=@binder={0x73622a85, 0xa, 0x1}, @fda={0x66646185, 0xa, 0x1, 0x9}, @fd={0x66642a85, 0x0, r1}}, &(0x7f0000000100)={0x0, 0x18, 0x38}}, 0x1000}, @transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000180)={@ptr={0x70742a85, 0x0, &(0x7f0000000140)=""/51, 0x33, 0x2, 0x25}, @flat=@weak_handle={0x77682a85, 0x1}, @flat=@binder={0x73622a85, 0xa, 0x3}}, &(0x7f0000000280)={0x0, 0x28, 0x40}}, 0x1f8aed83e3349436}, @exit_looper, @transaction_sg={0x40486311, {0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x68, 0x18, &(0x7f0000000480)={@ptr={0x70742a85, 0x0, &(0x7f00000002c0)=""/11, 0xb, 0x2, 0x3f}, @fd={0x66642a85, 0x0, r0}, @ptr={0x70742a85, 0x0, &(0x7f0000000380)=""/70, 0x46, 0x1, 0x1f}}, &(0x7f0000000500)={0x0, 0x28, 0x40}}, 0x1000}], 0x14, 0x0, &(0x7f0000000680)="86621f50fcee8bdc5bf8c503a78812261b4bf6d7"}) [ 2599.700267] binder: 5837:5845 transaction failed 29189/-22, size 80-24 line 3014 [ 2599.700554] binder: undelivered TRANSACTION_ERROR: 29189 18:07:11 executing program 1: clone(0x2102001fff, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) socket(0x0, 0x0, 0x0) r0 = getpid() rt_tgsigqueueinfo(0x0, r0, 0x16, &(0x7f0000000100)) rt_sigqueueinfo(r0, 0x7, &(0x7f0000000180)={0x0, 0x0, 0xffffffff}) [ 2599.860548] binder: 5912:5913 Release 1 refcount change on invalid ref 2 ret -22 [ 2599.860559] binder: 5912:5913 BC_ACQUIRE_DONE u0000000000000000 no match 18:07:11 executing program 3: r0 = socket(0x10, 0x3, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") ioctl$sock_ifreq(r0, 0x89f3, &(0x7f0000000240)={'sit0\x00'}) 18:07:11 executing program 4: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000040)='/dev/net/tun\x00', 0x0, 0x0) r1 = epoll_create1(0x0) epoll_ctl$EPOLL_CTL_ADD(0xffffffffffffffff, 0x1, r0, &(0x7f0000000100)) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000080)={'tunl0\x00', 0x1}) epoll_wait(r1, &(0x7f00000000c0)=[{}], 0x1, 0x0) 18:07:11 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000006c0)={0x118, 0x0, &(0x7f0000000540)=[@release={0x40046306, 0x2}, @acquire_done, @acquire_done={0x40106309, 0x3}, @transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x50, 0x18, &(0x7f0000000080)={@flat=@binder={0x73622a85, 0xa, 0x1}, @fda={0x66646185, 0xa, 0x1, 0x9}, @fd={0x66642a85, 0x0, r1}}, &(0x7f0000000100)={0x0, 0x18, 0x38}}, 0x1000}, @transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000180)={@ptr={0x70742a85, 0x0, &(0x7f0000000140)=""/51, 0x33, 0x2, 0x25}, @flat=@weak_handle={0x77682a85, 0x1}, @flat=@binder={0x73622a85, 0xa, 0x3}}, &(0x7f0000000280)={0x0, 0x28, 0x40}}, 0x1f8aed83e3349436}, @exit_looper, @transaction_sg={0x40486311, {0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x68, 0x18, &(0x7f0000000480)={@ptr={0x70742a85, 0x0, &(0x7f00000002c0)=""/11, 0xb, 0x2, 0x3f}, @fd={0x66642a85, 0x0, r0}, @ptr={0x70742a85, 0x0, &(0x7f0000000380)=""/70, 0x46, 0x1, 0x1f}}, &(0x7f0000000500)={0x0, 0x28, 0x40}}, 0x1000}], 0x14, 0x0, &(0x7f0000000680)="86621f50fcee8bdc5bf8c503a78812261b4bf6d7"}) [ 2599.860566] binder: 5912:5913 BC_ACQUIRE_DONE u0000000000000003 no match [ 2599.860578] binder: 5912:5913 transaction failed 29189/-22, size 80-24 line 3014 18:07:11 executing program 3: r0 = socket(0x10, 0x3, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") ioctl$sock_ifreq(r0, 0x89f3, &(0x7f0000000240)={'sit0\x00'}) 18:07:11 executing program 5: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000001a00)='/dev/net/tun\x00', 0x0, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000080)="c0dc00025e0b01047be070") ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000300)={'nr0\x01\x00', 0x1132}) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000001a00)='/dev/net/tun\x00', 0x2, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000300)={'nr0\x01\x00', 0x1132}) write$cgroup_int(0xffffffffffffffff, &(0x7f00000000c0)=0x2, 0xfffffffffffffe75) close(r1) 18:07:11 executing program 1: clone(0x2102001fff, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) socket(0x0, 0x0, 0x0) r0 = getpid() rt_tgsigqueueinfo(0x0, r0, 0x16, &(0x7f0000000100)) rt_sigqueueinfo(r0, 0x7, &(0x7f0000000180)={0x0, 0x0, 0xffffffff}) 18:07:11 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000006c0)={0x118, 0x0, &(0x7f0000000540)=[@release={0x40046306, 0x2}, @acquire_done, @acquire_done={0x40106309, 0x3}, @transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x50, 0x18, &(0x7f0000000080)={@flat=@binder={0x73622a85, 0xa, 0x1}, @fda={0x66646185, 0xa, 0x1, 0x9}, @fd={0x66642a85, 0x0, r1}}, &(0x7f0000000100)={0x0, 0x18, 0x38}}, 0x1000}, @transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000180)={@ptr={0x70742a85, 0x0, &(0x7f0000000140)=""/51, 0x33, 0x2, 0x25}, @flat=@weak_handle={0x77682a85, 0x1}, @flat=@binder={0x73622a85, 0xa, 0x3}}, &(0x7f0000000280)={0x0, 0x28, 0x40}}, 0x1f8aed83e3349436}, @exit_looper, @transaction_sg={0x40486311, {0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x68, 0x18, &(0x7f0000000480)={@ptr={0x70742a85, 0x0, &(0x7f00000002c0)=""/11, 0xb, 0x2, 0x3f}, @fd={0x66642a85, 0x0, r0}, @ptr={0x70742a85, 0x0, &(0x7f0000000380)=""/70, 0x46, 0x1, 0x1f}}, &(0x7f0000000500)={0x0, 0x28, 0x40}}, 0x1000}], 0x14, 0x0, &(0x7f0000000680)="86621f50fcee8bdc5bf8c503a78812261b4bf6d7"}) 18:07:11 executing program 3: r0 = socket(0x10, 0x3, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") ioctl$sock_ifreq(r0, 0x89f3, &(0x7f0000000240)={'sit0\x00'}) [ 2599.860857] binder: undelivered TRANSACTION_ERROR: 29189 [ 2599.972812] binder: 5925:5946 Release 1 refcount change on invalid ref 2 ret -22 18:07:11 executing program 3: r0 = socket(0x10, 0x3, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") ioctl$sock_ifreq(r0, 0x89f3, &(0x7f0000000240)={'sit0\x00'}) 18:07:11 executing program 2: ioctl$FS_IOC_RESVSP(0xffffffffffffffff, 0x40305828, &(0x7f00000000c0)={0x0, 0x0, 0x100000000000001}) clone(0x2102001fff, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) socket(0x0, 0x0, 0x0) r0 = getpid() rt_tgsigqueueinfo(0x0, r0, 0x16, &(0x7f0000000100)) ptrace(0x10, r0) ptrace$poke(0x4209, r0, &(0x7f00000000c0), 0x70effd) 18:07:11 executing program 1: clone(0x2102001fff, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) socket(0x0, 0x0, 0x0) r0 = getpid() rt_tgsigqueueinfo(0x0, r0, 0x16, &(0x7f0000000100)) rt_sigqueueinfo(r0, 0x7, &(0x7f0000000180)={0x0, 0x0, 0xffffffff}) 18:07:11 executing program 4: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000040)='/dev/net/tun\x00', 0x0, 0x0) r1 = epoll_create1(0x0) epoll_ctl$EPOLL_CTL_ADD(0xffffffffffffffff, 0x1, r0, &(0x7f0000000100)) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000080)={'tunl0\x00', 0x1}) epoll_wait(r1, &(0x7f00000000c0)=[{}], 0x1, 0x0) [ 2599.972823] binder: 5925:5946 BC_ACQUIRE_DONE u0000000000000000 no match [ 2599.972830] binder: 5925:5946 BC_ACQUIRE_DONE u0000000000000003 no match 18:07:11 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000006c0)={0x118, 0x0, &(0x7f0000000540)=[@release={0x40046306, 0x2}, @acquire_done, @acquire_done={0x40106309, 0x3}, @transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x50, 0x18, &(0x7f0000000080)={@flat=@binder={0x73622a85, 0xa, 0x1}, @fda={0x66646185, 0xa, 0x1, 0x9}, @fd={0x66642a85, 0x0, r1}}, &(0x7f0000000100)={0x0, 0x18, 0x38}}, 0x1000}, @transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000180)={@ptr={0x70742a85, 0x0, &(0x7f0000000140)=""/51, 0x33, 0x2, 0x25}, @flat=@weak_handle={0x77682a85, 0x1}, @flat=@binder={0x73622a85, 0xa, 0x3}}, &(0x7f0000000280)={0x0, 0x28, 0x40}}, 0x1f8aed83e3349436}, @exit_looper, @transaction_sg={0x40486311, {0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x68, 0x18, &(0x7f0000000480)={@ptr={0x70742a85, 0x0, &(0x7f00000002c0)=""/11, 0xb, 0x2, 0x3f}, @fd={0x66642a85, 0x0, r0}, @ptr={0x70742a85, 0x0, &(0x7f0000000380)=""/70, 0x46, 0x1, 0x1f}}, &(0x7f0000000500)={0x0, 0x28, 0x40}}, 0x1000}], 0x14, 0x0, &(0x7f0000000680)="86621f50fcee8bdc5bf8c503a78812261b4bf6d7"}) [ 2599.972842] binder: 5925:5946 transaction failed 29189/-22, size 80-24 line 3014 18:07:11 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000006c0)={0x118, 0x0, &(0x7f0000000540)=[@release={0x40046306, 0x2}, @acquire_done, @acquire_done={0x40106309, 0x3}, @transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x50, 0x18, &(0x7f0000000080)={@flat=@binder={0x73622a85, 0xa, 0x1}, @fda={0x66646185, 0xa, 0x1, 0x9}, @fd={0x66642a85, 0x0, r1}}, &(0x7f0000000100)={0x0, 0x18, 0x38}}, 0x1000}, @transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000180)={@ptr={0x70742a85, 0x0, &(0x7f0000000140)=""/51, 0x33, 0x2, 0x25}, @flat=@weak_handle={0x77682a85, 0x1}, @flat=@binder={0x73622a85, 0xa, 0x3}}, &(0x7f0000000280)={0x0, 0x28, 0x40}}, 0x1f8aed83e3349436}, @exit_looper, @transaction_sg={0x40486311, {0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x68, 0x18, &(0x7f0000000480)={@ptr={0x70742a85, 0x0, &(0x7f00000002c0)=""/11, 0xb, 0x2, 0x3f}, @fd={0x66642a85, 0x0, r0}, @ptr={0x70742a85, 0x0, &(0x7f0000000380)=""/70, 0x46, 0x1, 0x1f}}, &(0x7f0000000500)={0x0, 0x28, 0x40}}, 0x1000}], 0x14, 0x0, &(0x7f0000000680)="86621f50fcee8bdc5bf8c503a78812261b4bf6d7"}) 18:07:11 executing program 1: clone(0x2102001fff, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) socket(0x0, 0x0, 0x0) r0 = getpid() rt_tgsigqueueinfo(0x0, r0, 0x16, &(0x7f0000000100)) rt_sigqueueinfo(r0, 0x7, &(0x7f0000000180)={0x0, 0x0, 0xffffffff}) [ 2599.973029] binder: undelivered TRANSACTION_ERROR: 29189 [ 2600.022815] binder: 5989:5996 Release 1 refcount change on invalid ref 2 ret -22 18:07:11 executing program 2: ioctl$FS_IOC_RESVSP(0xffffffffffffffff, 0x40305828, &(0x7f00000000c0)={0x0, 0x0, 0x100000000000001}) clone(0x2102001fff, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) socket(0x0, 0x0, 0x0) r0 = getpid() rt_tgsigqueueinfo(0x0, r0, 0x16, &(0x7f0000000100)) ptrace(0x10, r0) ptrace$poke(0x4209, r0, &(0x7f00000000c0), 0x70effd) [ 2600.022825] binder: 5989:5996 BC_ACQUIRE_DONE u0000000000000000 no match [ 2600.022833] binder: 5989:5996 BC_ACQUIRE_DONE u0000000000000003 no match [ 2600.022846] binder: 5989:5996 transaction failed 29189/-22, size 80-24 line 3014 [ 2600.023214] binder: undelivered TRANSACTION_ERROR: 29189 [ 2600.313166] binder: 6022:6037 Release 1 refcount change on invalid ref 2 ret -22 [ 2600.313176] binder: 6022:6037 BC_ACQUIRE_DONE u0000000000000000 no match [ 2600.313184] binder: 6022:6037 BC_ACQUIRE_DONE u0000000000000003 no match 18:07:11 executing program 5: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000001a00)='/dev/net/tun\x00', 0x0, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000080)="c0dc00025e0b01047be070") ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000300)={'nr0\x01\x00', 0x1132}) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000001a00)='/dev/net/tun\x00', 0x2, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000300)={'nr0\x01\x00', 0x1132}) write$cgroup_int(0xffffffffffffffff, &(0x7f00000000c0)=0x2, 0xfffffffffffffe75) close(r1) 18:07:11 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000006c0)={0x118, 0x0, &(0x7f0000000540)=[@release={0x40046306, 0x2}, @acquire_done, @acquire_done={0x40106309, 0x3}, @transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x50, 0x18, &(0x7f0000000080)={@flat=@binder={0x73622a85, 0xa, 0x1}, @fda={0x66646185, 0xa, 0x1, 0x9}, @fd={0x66642a85, 0x0, r1}}, &(0x7f0000000100)={0x0, 0x18, 0x38}}, 0x1000}, @transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000180)={@ptr={0x70742a85, 0x0, &(0x7f0000000140)=""/51, 0x33, 0x2, 0x25}, @flat=@weak_handle={0x77682a85, 0x1}, @flat=@binder={0x73622a85, 0xa, 0x3}}, &(0x7f0000000280)={0x0, 0x28, 0x40}}, 0x1f8aed83e3349436}, @exit_looper, @transaction_sg={0x40486311, {0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x68, 0x18, &(0x7f0000000480)={@ptr={0x70742a85, 0x0, &(0x7f00000002c0)=""/11, 0xb, 0x2, 0x3f}, @fd={0x66642a85, 0x0, r0}, @ptr={0x70742a85, 0x0, &(0x7f0000000380)=""/70, 0x46, 0x1, 0x1f}}, &(0x7f0000000500)={0x0, 0x28, 0x40}}, 0x1000}], 0x14, 0x0, &(0x7f0000000680)="86621f50fcee8bdc5bf8c503a78812261b4bf6d7"}) 18:07:11 executing program 1: clone(0x2102001fff, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) socket(0x0, 0x0, 0x0) r0 = getpid() rt_tgsigqueueinfo(0x0, r0, 0x16, &(0x7f0000000100)) rt_sigqueueinfo(r0, 0x7, &(0x7f0000000180)={0x0, 0x0, 0xffffffff}) 18:07:11 executing program 3: r0 = socket(0x10, 0x3, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") ioctl$sock_ifreq(r0, 0x89f3, &(0x7f0000000240)={'sit0\x00'}) 18:07:11 executing program 4: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000040)='/dev/net/tun\x00', 0x0, 0x0) r1 = epoll_create1(0x0) epoll_ctl$EPOLL_CTL_ADD(0xffffffffffffffff, 0x1, r0, &(0x7f0000000100)) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000080)={'tunl0\x00', 0x1}) epoll_wait(r1, &(0x7f00000000c0)=[{}], 0x1, 0x0) 18:07:11 executing program 2: ioctl$FS_IOC_RESVSP(0xffffffffffffffff, 0x40305828, &(0x7f00000000c0)={0x0, 0x0, 0x100000000000001}) clone(0x2102001fff, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) socket(0x0, 0x0, 0x0) r0 = getpid() rt_tgsigqueueinfo(0x0, r0, 0x16, &(0x7f0000000100)) ptrace(0x10, r0) ptrace$poke(0x4209, r0, &(0x7f00000000c0), 0x70effd) 18:07:11 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000006c0)={0x118, 0x0, &(0x7f0000000540)=[@release={0x40046306, 0x2}, @acquire_done, @acquire_done={0x40106309, 0x3}, @transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x50, 0x18, &(0x7f0000000080)={@flat=@binder={0x73622a85, 0xa, 0x1}, @fda={0x66646185, 0xa, 0x1, 0x9}, @fd={0x66642a85, 0x0, r1}}, &(0x7f0000000100)={0x0, 0x18, 0x38}}, 0x1000}, @transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000180)={@ptr={0x70742a85, 0x0, &(0x7f0000000140)=""/51, 0x33, 0x2, 0x25}, @flat=@weak_handle={0x77682a85, 0x1}, @flat=@binder={0x73622a85, 0xa, 0x3}}, &(0x7f0000000280)={0x0, 0x28, 0x40}}, 0x1f8aed83e3349436}, @exit_looper, @transaction_sg={0x40486311, {0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x68, 0x18, &(0x7f0000000480)={@ptr={0x70742a85, 0x0, &(0x7f00000002c0)=""/11, 0xb, 0x2, 0x3f}, @fd={0x66642a85, 0x0, r0}, @ptr={0x70742a85, 0x0, &(0x7f0000000380)=""/70, 0x46, 0x1, 0x1f}}, &(0x7f0000000500)={0x0, 0x28, 0x40}}, 0x1000}], 0x14, 0x0, &(0x7f0000000680)="86621f50fcee8bdc5bf8c503a78812261b4bf6d7"}) 18:07:11 executing program 3: r0 = socket(0x10, 0x3, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") ioctl$sock_ifreq(r0, 0x89f3, &(0x7f0000000240)={'sit0\x00'}) [ 2600.313199] binder: 6022:6037 transaction failed 29189/-22, size 80-24 line 3014 [ 2600.313450] binder: undelivered TRANSACTION_ERROR: 29189 [ 2600.527023] binder: 6145:6181 Release 1 refcount change on invalid ref 2 ret -22 [ 2600.527054] binder: 6145:6181 BC_ACQUIRE_DONE u0000000000000000 no match [ 2600.527061] binder: 6145:6181 BC_ACQUIRE_DONE u0000000000000003 no match [ 2600.527073] binder: 6145:6181 transaction failed 29189/-22, size 80-24 line 3014 18:07:11 executing program 1: clone(0x2102001fff, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) socket(0x0, 0x0, 0x0) r0 = getpid() rt_tgsigqueueinfo(0x0, r0, 0x16, &(0x7f0000000100)) rt_sigqueueinfo(r0, 0x7, &(0x7f0000000180)={0x0, 0x0, 0xffffffff}) 18:07:11 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000006c0)={0x118, 0x0, &(0x7f0000000540)=[@release={0x40046306, 0x2}, @acquire_done, @acquire_done={0x40106309, 0x3}, @transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x50, 0x18, &(0x7f0000000080)={@flat=@binder={0x73622a85, 0xa, 0x1}, @fda={0x66646185, 0xa, 0x1, 0x9}, @fd={0x66642a85, 0x0, r1}}, &(0x7f0000000100)={0x0, 0x18, 0x38}}, 0x1000}, @transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000180)={@ptr={0x70742a85, 0x0, &(0x7f0000000140)=""/51, 0x33, 0x2, 0x25}, @flat=@weak_handle={0x77682a85, 0x1}, @flat=@binder={0x73622a85, 0xa, 0x3}}, &(0x7f0000000280)={0x0, 0x28, 0x40}}, 0x1f8aed83e3349436}, @exit_looper, @transaction_sg={0x40486311, {0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x68, 0x18, &(0x7f0000000480)={@ptr={0x70742a85, 0x0, &(0x7f00000002c0)=""/11, 0xb, 0x2, 0x3f}, @fd={0x66642a85, 0x0, r0}, @ptr={0x70742a85, 0x0, &(0x7f0000000380)=""/70, 0x46, 0x1, 0x1f}}, &(0x7f0000000500)={0x0, 0x28, 0x40}}, 0x1000}], 0x14, 0x0, &(0x7f0000000680)="86621f50fcee8bdc5bf8c503a78812261b4bf6d7"}) 18:07:12 executing program 3: r0 = socket(0x10, 0x3, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") ioctl$sock_ifreq(r0, 0x89f3, &(0x7f0000000240)={'sit0\x00'}) [ 2600.527311] binder: undelivered TRANSACTION_ERROR: 29189 [ 2600.628204] binder: 6221:6244 Release 1 refcount change on invalid ref 2 ret -22 18:07:12 executing program 4: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000040)='/dev/net/tun\x00', 0x0, 0x0) r1 = epoll_create1(0x0) epoll_ctl$EPOLL_CTL_ADD(0xffffffffffffffff, 0x1, r0, &(0x7f0000000100)) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000080)={'tunl0\x00', 0x1}) epoll_wait(r1, &(0x7f00000000c0)=[{}], 0x1, 0x0) [ 2600.628214] binder: 6221:6244 BC_ACQUIRE_DONE u0000000000000000 no match 18:07:12 executing program 5: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000001a00)='/dev/net/tun\x00', 0x0, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000080)="c0dc00025e0b01047be070") ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000300)={'nr0\x01\x00', 0x1132}) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000001a00)='/dev/net/tun\x00', 0x2, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000300)={'nr0\x01\x00', 0x1132}) write$cgroup_int(0xffffffffffffffff, &(0x7f00000000c0)=0x2, 0xfffffffffffffe75) close(r1) 18:07:12 executing program 3: r0 = socket(0x10, 0x3, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") ioctl$sock_ifreq(r0, 0x89f3, &(0x7f0000000240)={'sit0\x00'}) 18:07:12 executing program 1: clone(0x2102001fff, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) socket(0x0, 0x0, 0x0) r0 = getpid() rt_tgsigqueueinfo(0x0, r0, 0x16, &(0x7f0000000100)) rt_sigqueueinfo(r0, 0x7, &(0x7f0000000180)={0x0, 0x0, 0xffffffff}) 18:07:12 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000006c0)={0x118, 0x0, &(0x7f0000000540)=[@release={0x40046306, 0x2}, @acquire_done, @acquire_done={0x40106309, 0x3}, @transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x50, 0x18, &(0x7f0000000080)={@flat=@binder={0x73622a85, 0xa, 0x1}, @fda={0x66646185, 0xa, 0x1, 0x9}, @fd={0x66642a85, 0x0, r1}}, &(0x7f0000000100)={0x0, 0x18, 0x38}}, 0x1000}, @transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000180)={@ptr={0x70742a85, 0x0, &(0x7f0000000140)=""/51, 0x33, 0x2, 0x25}, @flat=@weak_handle={0x77682a85, 0x1}, @flat=@binder={0x73622a85, 0xa, 0x3}}, &(0x7f0000000280)={0x0, 0x28, 0x40}}, 0x1f8aed83e3349436}, @exit_looper, @transaction_sg={0x40486311, {0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x68, 0x18, &(0x7f0000000480)={@ptr={0x70742a85, 0x0, &(0x7f00000002c0)=""/11, 0xb, 0x2, 0x3f}, @fd={0x66642a85, 0x0, r0}, @ptr={0x70742a85, 0x0, &(0x7f0000000380)=""/70, 0x46, 0x1, 0x1f}}, &(0x7f0000000500)={0x0, 0x28, 0x40}}, 0x1000}], 0x14, 0x0, &(0x7f0000000680)="86621f50fcee8bdc5bf8c503a78812261b4bf6d7"}) [ 2600.628222] binder: 6221:6244 BC_ACQUIRE_DONE u0000000000000003 no match 18:07:12 executing program 3: r0 = socket(0x10, 0x3, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") ioctl$sock_ifreq(r0, 0x89f3, &(0x7f0000000240)={'sit0\x00'}) 18:07:12 executing program 2: ioctl$FS_IOC_RESVSP(0xffffffffffffffff, 0x40305828, &(0x7f00000000c0)={0x0, 0x0, 0x100000000000001}) clone(0x2102001fff, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) socket(0x0, 0x0, 0x0) r0 = getpid() rt_tgsigqueueinfo(0x0, r0, 0x16, &(0x7f0000000100)) ptrace(0x10, r0) ptrace$poke(0x4209, r0, &(0x7f00000000c0), 0x70effd) [ 2600.628235] binder: 6221:6244 transaction failed 29189/-22, size 80-24 line 3014 [ 2600.629814] binder: undelivered TRANSACTION_ERROR: 29189 [ 2600.753005] binder: 6280:6286 Release 1 refcount change on invalid ref 2 ret -22 18:07:12 executing program 1: clone(0x2102001fff, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) socket(0x0, 0x0, 0x0) r0 = getpid() rt_tgsigqueueinfo(0x0, r0, 0x16, &(0x7f0000000100)) rt_sigqueueinfo(r0, 0x7, &(0x7f0000000180)={0x0, 0x0, 0xffffffff}) 18:07:12 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000006c0)={0x118, 0x0, &(0x7f0000000540)=[@release={0x40046306, 0x2}, @acquire_done, @acquire_done={0x40106309, 0x3}, @transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x50, 0x18, &(0x7f0000000080)={@flat=@binder={0x73622a85, 0xa, 0x1}, @fda={0x66646185, 0xa, 0x1, 0x9}, @fd={0x66642a85, 0x0, r1}}, &(0x7f0000000100)={0x0, 0x18, 0x38}}, 0x1000}, @transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000180)={@ptr={0x70742a85, 0x0, &(0x7f0000000140)=""/51, 0x33, 0x2, 0x25}, @flat=@weak_handle={0x77682a85, 0x1}, @flat=@binder={0x73622a85, 0xa, 0x3}}, &(0x7f0000000280)={0x0, 0x28, 0x40}}, 0x1f8aed83e3349436}, @exit_looper, @transaction_sg={0x40486311, {0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x68, 0x18, &(0x7f0000000480)={@ptr={0x70742a85, 0x0, &(0x7f00000002c0)=""/11, 0xb, 0x2, 0x3f}, @fd={0x66642a85, 0x0, r0}, @ptr={0x70742a85, 0x0, &(0x7f0000000380)=""/70, 0x46, 0x1, 0x1f}}, &(0x7f0000000500)={0x0, 0x28, 0x40}}, 0x1000}], 0x14, 0x0, &(0x7f0000000680)="86621f50fcee8bdc5bf8c503a78812261b4bf6d7"}) 18:07:12 executing program 4: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000040)='/dev/net/tun\x00', 0x0, 0x0) r1 = epoll_create1(0x0) epoll_ctl$EPOLL_CTL_ADD(0xffffffffffffffff, 0x1, r0, &(0x7f0000000100)) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000080)={'tunl0\x00', 0x1}) epoll_wait(r1, &(0x7f00000000c0)=[{}], 0x1, 0x0) 18:07:12 executing program 3: r0 = socket(0x10, 0x3, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") ioctl$sock_ifreq(r0, 0x89f3, &(0x7f0000000240)={'sit0\x00'}) [ 2600.753015] binder: 6280:6286 BC_ACQUIRE_DONE u0000000000000000 no match 18:07:12 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000006c0)={0x118, 0x0, &(0x7f0000000540)=[@release={0x40046306, 0x2}, @acquire_done, @acquire_done={0x40106309, 0x3}, @transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x50, 0x18, &(0x7f0000000080)={@flat=@binder={0x73622a85, 0xa, 0x1}, @fda={0x66646185, 0xa, 0x1, 0x9}, @fd={0x66642a85, 0x0, r1}}, &(0x7f0000000100)={0x0, 0x18, 0x38}}, 0x1000}, @transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000180)={@ptr={0x70742a85, 0x0, &(0x7f0000000140)=""/51, 0x33, 0x2, 0x25}, @flat=@weak_handle={0x77682a85, 0x1}, @flat=@binder={0x73622a85, 0xa, 0x3}}, &(0x7f0000000280)={0x0, 0x28, 0x40}}, 0x1f8aed83e3349436}, @exit_looper, @transaction_sg={0x40486311, {0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x68, 0x18, &(0x7f0000000480)={@ptr={0x70742a85, 0x0, &(0x7f00000002c0)=""/11, 0xb, 0x2, 0x3f}, @fd={0x66642a85, 0x0, r0}, @ptr={0x70742a85, 0x0, &(0x7f0000000380)=""/70, 0x46, 0x1, 0x1f}}, &(0x7f0000000500)={0x0, 0x28, 0x40}}, 0x1000}], 0x14, 0x0, &(0x7f0000000680)="86621f50fcee8bdc5bf8c503a78812261b4bf6d7"}) 18:07:12 executing program 1: clone(0x2102001fff, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) socket(0x0, 0x0, 0x0) r0 = getpid() rt_tgsigqueueinfo(0x0, r0, 0x16, &(0x7f0000000100)) rt_sigqueueinfo(r0, 0x7, &(0x7f0000000180)={0x0, 0x0, 0xffffffff}) [ 2600.753023] binder: 6280:6286 BC_ACQUIRE_DONE u0000000000000003 no match [ 2600.753037] binder: 6280:6286 transaction failed 29189/-22, size 80-24 line 3014 18:07:12 executing program 5: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000001a00)='/dev/net/tun\x00', 0x0, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000080)="c0dc00025e0b01047be070") ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000300)={'nr0\x01\x00', 0x1132}) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000001a00)='/dev/net/tun\x00', 0x2, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000300)={'nr0\x01\x00', 0x1132}) write$cgroup_int(0xffffffffffffffff, &(0x7f00000000c0)=0x2, 0xfffffffffffffe75) close(r1) 18:07:12 executing program 3: r0 = socket(0x10, 0x3, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") ioctl$sock_ifreq(r0, 0x89f3, &(0x7f0000000240)={'sit0\x00'}) 18:07:12 executing program 4: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000040)='/dev/net/tun\x00', 0x0, 0x0) r1 = epoll_create1(0x0) epoll_ctl$EPOLL_CTL_ADD(0xffffffffffffffff, 0x1, r0, &(0x7f0000000100)) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000080)={'tunl0\x00', 0x1}) epoll_wait(r1, &(0x7f00000000c0)=[{}], 0x1, 0x0) 18:07:12 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000006c0)={0x118, 0x0, &(0x7f0000000540)=[@release={0x40046306, 0x2}, @acquire_done, @acquire_done={0x40106309, 0x3}, @transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x50, 0x18, &(0x7f0000000080)={@flat=@binder={0x73622a85, 0xa, 0x1}, @fda={0x66646185, 0xa, 0x1, 0x9}, @fd={0x66642a85, 0x0, r1}}, &(0x7f0000000100)={0x0, 0x18, 0x38}}, 0x1000}, @transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000180)={@ptr={0x70742a85, 0x0, &(0x7f0000000140)=""/51, 0x33, 0x2, 0x25}, @flat=@weak_handle={0x77682a85, 0x1}, @flat=@binder={0x73622a85, 0xa, 0x3}}, &(0x7f0000000280)={0x0, 0x28, 0x40}}, 0x1f8aed83e3349436}, @exit_looper, @transaction_sg={0x40486311, {0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x68, 0x18, &(0x7f0000000480)={@ptr={0x70742a85, 0x0, &(0x7f00000002c0)=""/11, 0xb, 0x2, 0x3f}, @fd={0x66642a85, 0x0, r0}, @ptr={0x70742a85, 0x0, &(0x7f0000000380)=""/70, 0x46, 0x1, 0x1f}}, &(0x7f0000000500)={0x0, 0x28, 0x40}}, 0x1000}], 0x14, 0x0, &(0x7f0000000680)="86621f50fcee8bdc5bf8c503a78812261b4bf6d7"}) 18:07:12 executing program 2: ioctl$FS_IOC_RESVSP(0xffffffffffffffff, 0x40305828, &(0x7f00000000c0)={0x0, 0x0, 0x100000000000001}) clone(0x2102001fff, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) socket(0x0, 0x0, 0x0) r0 = getpid() rt_tgsigqueueinfo(0x0, r0, 0x16, &(0x7f0000000100)) ptrace(0x10, r0) ptrace$poke(0x4209, r0, &(0x7f00000000c0), 0x70effd) [ 2600.753359] binder: undelivered TRANSACTION_ERROR: 29189 [ 2600.897499] binder: 6351:6363 Release 1 refcount change on invalid ref 2 ret -22 [ 2600.897509] binder: 6351:6363 BC_ACQUIRE_DONE u0000000000000000 no match 18:07:12 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000006c0)={0x118, 0x0, &(0x7f0000000540)=[@release={0x40046306, 0x2}, @acquire_done, @acquire_done={0x40106309, 0x3}, @transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x50, 0x18, &(0x7f0000000080)={@flat=@binder={0x73622a85, 0xa, 0x1}, @fda={0x66646185, 0xa, 0x1, 0x9}, @fd={0x66642a85, 0x0, r1}}, &(0x7f0000000100)={0x0, 0x18, 0x38}}, 0x1000}, @transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000180)={@ptr={0x70742a85, 0x0, &(0x7f0000000140)=""/51, 0x33, 0x2, 0x25}, @flat=@weak_handle={0x77682a85, 0x1}, @flat=@binder={0x73622a85, 0xa, 0x3}}, &(0x7f0000000280)={0x0, 0x28, 0x40}}, 0x1f8aed83e3349436}, @exit_looper, @transaction_sg={0x40486311, {0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x68, 0x18, &(0x7f0000000480)={@ptr={0x70742a85, 0x0, &(0x7f00000002c0)=""/11, 0xb, 0x2, 0x3f}, @fd={0x66642a85, 0x0, r0}, @ptr={0x70742a85, 0x0, &(0x7f0000000380)=""/70, 0x46, 0x1, 0x1f}}, &(0x7f0000000500)={0x0, 0x28, 0x40}}, 0x1000}], 0x14, 0x0, &(0x7f0000000680)="86621f50fcee8bdc5bf8c503a78812261b4bf6d7"}) 18:07:12 executing program 1: clone(0x2102001fff, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) socket(0x0, 0x0, 0x0) r0 = getpid() rt_tgsigqueueinfo(0x0, r0, 0x16, &(0x7f0000000100)) rt_sigqueueinfo(r0, 0x7, &(0x7f0000000180)={0x0, 0x0, 0xffffffff}) [ 2600.897517] binder: 6351:6363 BC_ACQUIRE_DONE u0000000000000003 no match [ 2600.897529] binder: 6351:6363 transaction failed 29189/-22, size 80-24 line 3014 18:07:12 executing program 3: r0 = socket(0x10, 0x3, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") ioctl$sock_ifreq(r0, 0x89f3, &(0x7f0000000240)={'sit0\x00'}) 18:07:12 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000006c0)={0x118, 0x0, &(0x7f0000000540)=[@release={0x40046306, 0x2}, @acquire_done, @acquire_done={0x40106309, 0x3}, @transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x50, 0x18, &(0x7f0000000080)={@flat=@binder={0x73622a85, 0xa, 0x1}, @fda={0x66646185, 0xa, 0x1, 0x9}, @fd={0x66642a85, 0x0, r1}}, &(0x7f0000000100)={0x0, 0x18, 0x38}}, 0x1000}, @transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000180)={@ptr={0x70742a85, 0x0, &(0x7f0000000140)=""/51, 0x33, 0x2, 0x25}, @flat=@weak_handle={0x77682a85, 0x1}, @flat=@binder={0x73622a85, 0xa, 0x3}}, &(0x7f0000000280)={0x0, 0x28, 0x40}}, 0x1f8aed83e3349436}, @exit_looper, @transaction_sg={0x40486311, {0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x68, 0x18, &(0x7f0000000480)={@ptr={0x70742a85, 0x0, &(0x7f00000002c0)=""/11, 0xb, 0x2, 0x3f}, @fd={0x66642a85, 0x0, r0}, @ptr={0x70742a85, 0x0, &(0x7f0000000380)=""/70, 0x46, 0x1, 0x1f}}, &(0x7f0000000500)={0x0, 0x28, 0x40}}, 0x1000}], 0x14, 0x0, &(0x7f0000000680)="86621f50fcee8bdc5bf8c503a78812261b4bf6d7"}) [ 2600.897858] binder: undelivered TRANSACTION_ERROR: 29189 [ 2600.988059] binder: 6395:6400 Release 1 refcount change on invalid ref 2 ret -22 18:07:12 executing program 3: r0 = socket(0x10, 0x3, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") ioctl$sock_ifreq(r0, 0x89f3, &(0x7f0000000240)={'sit0\x00'}) 18:07:12 executing program 1: clone(0x2102001fff, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) socket(0x0, 0x0, 0x0) r0 = getpid() rt_tgsigqueueinfo(0x0, r0, 0x16, &(0x7f0000000100)) rt_sigqueueinfo(r0, 0x7, &(0x7f0000000180)={0x0, 0x0, 0xffffffff}) 18:07:12 executing program 3: r0 = socket(0x10, 0x3, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") ioctl$sock_ifreq(r0, 0x89f3, &(0x7f0000000240)={'sit0\x00'}) [ 2600.988069] binder: 6395:6400 BC_ACQUIRE_DONE u0000000000000000 no match [ 2600.988077] binder: 6395:6400 BC_ACQUIRE_DONE u0000000000000003 no match 18:07:12 executing program 5: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000001a00)='/dev/net/tun\x00', 0x0, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000080)="c0dc00025e0b01047be070") ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000300)={'nr0\x01\x00', 0x1132}) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000001a00)='/dev/net/tun\x00', 0x2, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000300)={'nr0\x01\x00', 0x1132}) write$cgroup_int(0xffffffffffffffff, &(0x7f00000000c0)=0x2, 0xfffffffffffffe75) close(r1) 18:07:12 executing program 4: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000040)='/dev/net/tun\x00', 0x0, 0x0) r1 = epoll_create1(0x0) epoll_ctl$EPOLL_CTL_ADD(0xffffffffffffffff, 0x1, r0, &(0x7f0000000100)) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000080)={'tunl0\x00', 0x1}) epoll_wait(r1, &(0x7f00000000c0)=[{}], 0x1, 0x0) 18:07:12 executing program 2: ioctl$FS_IOC_RESVSP(0xffffffffffffffff, 0x40305828, &(0x7f00000000c0)={0x0, 0x0, 0x100000000000001}) clone(0x2102001fff, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) socket(0x0, 0x0, 0x0) r0 = getpid() rt_tgsigqueueinfo(0x0, r0, 0x16, &(0x7f0000000100)) ptrace(0x10, r0) ptrace$poke(0x4209, r0, &(0x7f00000000c0), 0x70effd) 18:07:12 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000006c0)={0x118, 0x0, &(0x7f0000000540)=[@release={0x40046306, 0x2}, @acquire_done, @acquire_done={0x40106309, 0x3}, @transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x50, 0x18, &(0x7f0000000080)={@flat=@binder={0x73622a85, 0xa, 0x1}, @fda={0x66646185, 0xa, 0x1, 0x9}, @fd={0x66642a85, 0x0, r1}}, &(0x7f0000000100)={0x0, 0x18, 0x38}}, 0x1000}, @transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000180)={@ptr={0x70742a85, 0x0, &(0x7f0000000140)=""/51, 0x33, 0x2, 0x25}, @flat=@weak_handle={0x77682a85, 0x1}, @flat=@binder={0x73622a85, 0xa, 0x3}}, &(0x7f0000000280)={0x0, 0x28, 0x40}}, 0x1f8aed83e3349436}, @exit_looper, @transaction_sg={0x40486311, {0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x68, 0x18, &(0x7f0000000480)={@ptr={0x70742a85, 0x0, &(0x7f00000002c0)=""/11, 0xb, 0x2, 0x3f}, @fd={0x66642a85, 0x0, r0}, @ptr={0x70742a85, 0x0, &(0x7f0000000380)=""/70, 0x46, 0x1, 0x1f}}, &(0x7f0000000500)={0x0, 0x28, 0x40}}, 0x1000}], 0x14, 0x0, &(0x7f0000000680)="86621f50fcee8bdc5bf8c503a78812261b4bf6d7"}) [ 2600.988090] binder: 6395:6400 transaction failed 29189/-22, size 80-24 line 3014 18:07:12 executing program 3: r0 = socket(0x10, 0x3, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") ioctl$sock_ifreq(r0, 0x89f3, &(0x7f0000000240)={'sit0\x00'}) 18:07:12 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000006c0)={0x118, 0x0, &(0x7f0000000540)=[@release={0x40046306, 0x2}, @acquire_done, @acquire_done={0x40106309, 0x3}, @transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x50, 0x18, &(0x7f0000000080)={@flat=@binder={0x73622a85, 0xa, 0x1}, @fda={0x66646185, 0xa, 0x1, 0x9}, @fd={0x66642a85, 0x0, r1}}, &(0x7f0000000100)={0x0, 0x18, 0x38}}, 0x1000}, @transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000180)={@ptr={0x70742a85, 0x0, &(0x7f0000000140)=""/51, 0x33, 0x2, 0x25}, @flat=@weak_handle={0x77682a85, 0x1}, @flat=@binder={0x73622a85, 0xa, 0x3}}, &(0x7f0000000280)={0x0, 0x28, 0x40}}, 0x1f8aed83e3349436}, @exit_looper, @transaction_sg={0x40486311, {0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x68, 0x18, &(0x7f0000000480)={@ptr={0x70742a85, 0x0, &(0x7f00000002c0)=""/11, 0xb, 0x2, 0x3f}, @fd={0x66642a85, 0x0, r0}, @ptr={0x70742a85, 0x0, &(0x7f0000000380)=""/70, 0x46, 0x1, 0x1f}}, &(0x7f0000000500)={0x0, 0x28, 0x40}}, 0x1000}], 0x14, 0x0, &(0x7f0000000680)="86621f50fcee8bdc5bf8c503a78812261b4bf6d7"}) 18:07:12 executing program 1: clone(0x2102001fff, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) socket(0x0, 0x0, 0x0) r0 = getpid() rt_tgsigqueueinfo(0x0, r0, 0x16, &(0x7f0000000100)) rt_sigqueueinfo(r0, 0x7, &(0x7f0000000180)={0x0, 0x0, 0xffffffff}) [ 2600.988722] binder: undelivered TRANSACTION_ERROR: 29189 [ 2601.080828] binder: 6438:6443 Release 1 refcount change on invalid ref 2 ret -22 [ 2601.080838] binder: 6438:6443 BC_ACQUIRE_DONE u0000000000000000 no match [ 2601.080847] binder: 6438:6443 BC_ACQUIRE_DONE u0000000000000003 no match [ 2601.080859] binder: 6438:6443 transaction failed 29189/-22, size 80-24 line 3014 [ 2601.081096] binder: undelivered TRANSACTION_ERROR: 29189 18:07:13 executing program 2: ioctl$FS_IOC_RESVSP(0xffffffffffffffff, 0x40305828, &(0x7f00000000c0)={0x0, 0x0, 0x100000000000001}) clone(0x2102001fff, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) socket(0x0, 0x0, 0x0) r0 = getpid() rt_tgsigqueueinfo(0x0, r0, 0x16, &(0x7f0000000100)) ptrace(0x10, r0) ptrace$poke(0x4209, r0, &(0x7f00000000c0), 0x70effd) 18:07:13 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000006c0)={0x118, 0x0, &(0x7f0000000540)=[@release={0x40046306, 0x2}, @acquire_done, @acquire_done={0x40106309, 0x3}, @transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x50, 0x18, &(0x7f0000000080)={@flat=@binder={0x73622a85, 0xa, 0x1}, @fda={0x66646185, 0xa, 0x1, 0x9}, @fd={0x66642a85, 0x0, r1}}, &(0x7f0000000100)={0x0, 0x18, 0x38}}, 0x1000}, @transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000180)={@ptr={0x70742a85, 0x0, &(0x7f0000000140)=""/51, 0x33, 0x2, 0x25}, @flat=@weak_handle={0x77682a85, 0x1}, @flat=@binder={0x73622a85, 0xa, 0x3}}, &(0x7f0000000280)={0x0, 0x28, 0x40}}, 0x1f8aed83e3349436}, @exit_looper, @transaction_sg={0x40486311, {0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x68, 0x18, &(0x7f0000000480)={@ptr={0x70742a85, 0x0, &(0x7f00000002c0)=""/11, 0xb, 0x2, 0x3f}, @fd={0x66642a85, 0x0, r0}, @ptr={0x70742a85, 0x0, &(0x7f0000000380)=""/70, 0x46, 0x1, 0x1f}}, &(0x7f0000000500)={0x0, 0x28, 0x40}}, 0x1000}], 0x14, 0x0, &(0x7f0000000680)="86621f50fcee8bdc5bf8c503a78812261b4bf6d7"}) 18:07:13 executing program 3: r0 = socket(0x10, 0x3, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") ioctl$sock_ifreq(r0, 0x89f3, &(0x7f0000000240)={'sit0\x00'}) [ 2601.221851] binder: 6496:6505 Release 1 refcount change on invalid ref 2 ret -22 18:07:13 executing program 4: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000040)='/dev/net/tun\x00', 0x0, 0x0) r1 = epoll_create1(0x0) epoll_ctl$EPOLL_CTL_ADD(0xffffffffffffffff, 0x1, r0, &(0x7f0000000100)) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000080)={'tunl0\x00', 0x1}) epoll_wait(r1, &(0x7f00000000c0)=[{}], 0x1, 0x0) 18:07:13 executing program 1: clone(0x2102001fff, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) socket(0x0, 0x0, 0x0) r0 = getpid() rt_tgsigqueueinfo(0x0, r0, 0x16, &(0x7f0000000100)) rt_sigqueueinfo(r0, 0x7, &(0x7f0000000180)={0x0, 0x0, 0xffffffff}) [ 2601.221861] binder: 6496:6505 BC_ACQUIRE_DONE u0000000000000000 no match [ 2601.221869] binder: 6496:6505 BC_ACQUIRE_DONE u0000000000000003 no match 18:07:13 executing program 5: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000001a00)='/dev/net/tun\x00', 0x0, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000080)="c0dc00025e0b01047be070") ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000300)={'nr0\x01\x00', 0x1132}) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000001a00)='/dev/net/tun\x00', 0x2, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000300)={'nr0\x01\x00', 0x1132}) write$cgroup_int(0xffffffffffffffff, &(0x7f00000000c0)=0x2, 0xfffffffffffffe75) close(r1) 18:07:13 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000006c0)={0x118, 0x0, &(0x7f0000000540)=[@release={0x40046306, 0x2}, @acquire_done, @acquire_done={0x40106309, 0x3}, @transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x50, 0x18, &(0x7f0000000080)={@flat=@binder={0x73622a85, 0xa, 0x1}, @fda={0x66646185, 0xa, 0x1, 0x9}, @fd={0x66642a85, 0x0, r1}}, &(0x7f0000000100)={0x0, 0x18, 0x38}}, 0x1000}, @transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000180)={@ptr={0x70742a85, 0x0, &(0x7f0000000140)=""/51, 0x33, 0x2, 0x25}, @flat=@weak_handle={0x77682a85, 0x1}, @flat=@binder={0x73622a85, 0xa, 0x3}}, &(0x7f0000000280)={0x0, 0x28, 0x40}}, 0x1f8aed83e3349436}, @exit_looper, @transaction_sg={0x40486311, {0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x68, 0x18, &(0x7f0000000480)={@ptr={0x70742a85, 0x0, &(0x7f00000002c0)=""/11, 0xb, 0x2, 0x3f}, @fd={0x66642a85, 0x0, r0}, @ptr={0x70742a85, 0x0, &(0x7f0000000380)=""/70, 0x46, 0x1, 0x1f}}, &(0x7f0000000500)={0x0, 0x28, 0x40}}, 0x1000}], 0x14, 0x0, &(0x7f0000000680)="86621f50fcee8bdc5bf8c503a78812261b4bf6d7"}) [ 2601.221882] binder: 6496:6505 transaction failed 29189/-22, size 80-24 line 3014 [ 2601.222181] binder: undelivered TRANSACTION_ERROR: 29189 18:07:13 executing program 3: r0 = socket(0x10, 0x3, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") ioctl$sock_ifreq(r0, 0x89f3, &(0x7f0000000240)={'sit0\x00'}) 18:07:13 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000006c0)={0x118, 0x0, &(0x7f0000000540)=[@release={0x40046306, 0x2}, @acquire_done, @acquire_done={0x40106309, 0x3}, @transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x50, 0x18, &(0x7f0000000080)={@flat=@binder={0x73622a85, 0xa, 0x1}, @fda={0x66646185, 0xa, 0x1, 0x9}, @fd={0x66642a85, 0x0, r1}}, &(0x7f0000000100)={0x0, 0x18, 0x38}}, 0x1000}, @transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000180)={@ptr={0x70742a85, 0x0, &(0x7f0000000140)=""/51, 0x33, 0x2, 0x25}, @flat=@weak_handle={0x77682a85, 0x1}, @flat=@binder={0x73622a85, 0xa, 0x3}}, &(0x7f0000000280)={0x0, 0x28, 0x40}}, 0x1f8aed83e3349436}, @exit_looper, @transaction_sg={0x40486311, {0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x68, 0x18, &(0x7f0000000480)={@ptr={0x70742a85, 0x0, &(0x7f00000002c0)=""/11, 0xb, 0x2, 0x3f}, @fd={0x66642a85, 0x0, r0}, @ptr={0x70742a85, 0x0, &(0x7f0000000380)=""/70, 0x46, 0x1, 0x1f}}, &(0x7f0000000500)={0x0, 0x28, 0x40}}, 0x1000}], 0x14, 0x0, &(0x7f0000000680)="86621f50fcee8bdc5bf8c503a78812261b4bf6d7"}) [ 2601.289406] binder: 6526:6541 Release 1 refcount change on invalid ref 2 ret -22 18:07:13 executing program 2: ioctl$FS_IOC_RESVSP(0xffffffffffffffff, 0x40305828, &(0x7f00000000c0)={0x0, 0x0, 0x100000000000001}) clone(0x2102001fff, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) socket(0x0, 0x0, 0x0) r0 = getpid() rt_tgsigqueueinfo(0x0, r0, 0x16, &(0x7f0000000100)) ptrace(0x10, r0) ptrace$poke(0x4209, r0, &(0x7f00000000c0), 0x70effd) [ 2601.289416] binder: 6526:6541 BC_ACQUIRE_DONE u0000000000000000 no match 18:07:13 executing program 1: clone(0x2102001fff, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) socket(0x0, 0x0, 0x0) r0 = getpid() rt_tgsigqueueinfo(0x0, r0, 0x16, &(0x7f0000000100)) rt_sigqueueinfo(r0, 0x7, &(0x7f0000000180)={0x0, 0x0, 0xffffffff}) [ 2601.289423] binder: 6526:6541 BC_ACQUIRE_DONE u0000000000000003 no match [ 2601.289435] binder: 6526:6541 transaction failed 29189/-22, size 80-24 line 3014 18:07:13 executing program 3: r0 = socket(0x10, 0x3, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") ioctl$sock_ifreq(r0, 0x89f3, &(0x7f0000000240)={'sit0\x00'}) [ 2601.289724] binder: undelivered TRANSACTION_ERROR: 29189 [ 2601.357509] binder: 6559:6565 Release 1 refcount change on invalid ref 2 ret -22 18:07:13 executing program 1: clone(0x2102001fff, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) socket(0x0, 0x0, 0x0) r0 = getpid() rt_tgsigqueueinfo(0x0, r0, 0x16, &(0x7f0000000100)) rt_sigqueueinfo(r0, 0x7, &(0x7f0000000180)={0x0, 0x0, 0xffffffff}) 18:07:13 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000006c0)={0x118, 0x0, &(0x7f0000000540)=[@release={0x40046306, 0x2}, @acquire_done, @acquire_done={0x40106309, 0x3}, @transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x50, 0x18, &(0x7f0000000080)={@flat=@binder={0x73622a85, 0xa, 0x1}, @fda={0x66646185, 0xa, 0x1, 0x9}, @fd={0x66642a85, 0x0, r1}}, &(0x7f0000000100)={0x0, 0x18, 0x38}}, 0x1000}, @transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000180)={@ptr={0x70742a85, 0x0, &(0x7f0000000140)=""/51, 0x33, 0x2, 0x25}, @flat=@weak_handle={0x77682a85, 0x1}, @flat=@binder={0x73622a85, 0xa, 0x3}}, &(0x7f0000000280)={0x0, 0x28, 0x40}}, 0x1f8aed83e3349436}, @exit_looper, @transaction_sg={0x40486311, {0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x68, 0x18, &(0x7f0000000480)={@ptr={0x70742a85, 0x0, &(0x7f00000002c0)=""/11, 0xb, 0x2, 0x3f}, @fd={0x66642a85, 0x0, r0}, @ptr={0x70742a85, 0x0, &(0x7f0000000380)=""/70, 0x46, 0x1, 0x1f}}, &(0x7f0000000500)={0x0, 0x28, 0x40}}, 0x1000}], 0x14, 0x0, &(0x7f0000000680)="86621f50fcee8bdc5bf8c503a78812261b4bf6d7"}) 18:07:13 executing program 4: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000040)='/dev/net/tun\x00', 0x0, 0x0) r1 = epoll_create1(0x0) epoll_ctl$EPOLL_CTL_ADD(0xffffffffffffffff, 0x1, r0, &(0x7f0000000100)) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000080)={'tunl0\x00', 0x1}) epoll_wait(r1, &(0x7f00000000c0)=[{}], 0x1, 0x0) 18:07:13 executing program 3: r0 = socket(0x10, 0x3, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") ioctl$sock_ifreq(r0, 0x89f3, &(0x7f0000000240)={'sit0\x00'}) [ 2601.357520] binder: 6559:6565 BC_ACQUIRE_DONE u0000000000000000 no match [ 2601.357527] binder: 6559:6565 BC_ACQUIRE_DONE u0000000000000003 no match [ 2601.357540] binder: 6559:6565 transaction failed 29189/-22, size 80-24 line 3014 [ 2601.358738] binder: undelivered TRANSACTION_ERROR: 29189 [ 2601.505261] binder: 6621:6634 Release 1 refcount change on invalid ref 2 ret -22 18:07:13 executing program 5: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000001a00)='/dev/net/tun\x00', 0x0, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000080)="c0dc00025e0b01047be070") ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000300)={'nr0\x01\x00', 0x1132}) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000001a00)='/dev/net/tun\x00', 0x2, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000300)={'nr0\x01\x00', 0x1132}) write$cgroup_int(0xffffffffffffffff, &(0x7f00000000c0)=0x2, 0xfffffffffffffe75) close(r1) 18:07:13 executing program 3: r0 = socket(0x10, 0x3, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") ioctl$sock_ifreq(r0, 0x89f3, &(0x7f0000000240)={'sit0\x00'}) [ 2601.505271] binder: 6621:6634 BC_ACQUIRE_DONE u0000000000000000 no match 18:07:13 executing program 2: ioctl$FS_IOC_RESVSP(0xffffffffffffffff, 0x40305828, &(0x7f00000000c0)={0x0, 0x0, 0x100000000000001}) clone(0x2102001fff, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) socket(0x0, 0x0, 0x0) r0 = getpid() rt_tgsigqueueinfo(0x0, r0, 0x16, &(0x7f0000000100)) ptrace(0x10, r0) ptrace$poke(0x4209, r0, &(0x7f00000000c0), 0x70effd) 18:07:13 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000006c0)={0x118, 0x0, &(0x7f0000000540)=[@release={0x40046306, 0x2}, @acquire_done, @acquire_done={0x40106309, 0x3}, @transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x50, 0x18, &(0x7f0000000080)={@flat=@binder={0x73622a85, 0xa, 0x1}, @fda={0x66646185, 0xa, 0x1, 0x9}, @fd={0x66642a85, 0x0, r1}}, &(0x7f0000000100)={0x0, 0x18, 0x38}}, 0x1000}, @transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000180)={@ptr={0x70742a85, 0x0, &(0x7f0000000140)=""/51, 0x33, 0x2, 0x25}, @flat=@weak_handle={0x77682a85, 0x1}, @flat=@binder={0x73622a85, 0xa, 0x3}}, &(0x7f0000000280)={0x0, 0x28, 0x40}}, 0x1f8aed83e3349436}, @exit_looper, @transaction_sg={0x40486311, {0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x68, 0x18, &(0x7f0000000480)={@ptr={0x70742a85, 0x0, &(0x7f00000002c0)=""/11, 0xb, 0x2, 0x3f}, @fd={0x66642a85, 0x0, r0}, @ptr={0x70742a85, 0x0, &(0x7f0000000380)=""/70, 0x46, 0x1, 0x1f}}, &(0x7f0000000500)={0x0, 0x28, 0x40}}, 0x1000}], 0x14, 0x0, &(0x7f0000000680)="86621f50fcee8bdc5bf8c503a78812261b4bf6d7"}) 18:07:13 executing program 1: clone(0x2102001fff, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) socket(0x0, 0x0, 0x0) r0 = getpid() rt_tgsigqueueinfo(0x0, r0, 0x16, &(0x7f0000000100)) rt_sigqueueinfo(r0, 0x7, &(0x7f0000000180)={0x0, 0x0, 0xffffffff}) [ 2601.505279] binder: 6621:6634 BC_ACQUIRE_DONE u0000000000000003 no match [ 2601.505292] binder: 6621:6634 transaction failed 29189/-22, size 80-24 line 3014 [ 2601.505640] binder: undelivered TRANSACTION_ERROR: 29189 18:07:13 executing program 3: r0 = socket(0x10, 0x3, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") ioctl$sock_ifreq(r0, 0x89f3, &(0x7f0000000240)={'sit0\x00'}) 18:07:13 executing program 4: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000040)='/dev/net/tun\x00', 0x0, 0x0) r1 = epoll_create1(0x0) epoll_ctl$EPOLL_CTL_ADD(0xffffffffffffffff, 0x1, r0, &(0x7f0000000100)) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000080)={'tunl0\x00', 0x1}) epoll_wait(r1, &(0x7f00000000c0)=[{}], 0x1, 0x0) 18:07:13 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000006c0)={0x118, 0x0, &(0x7f0000000540)=[@release={0x40046306, 0x2}, @acquire_done, @acquire_done={0x40106309, 0x3}, @transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x50, 0x18, &(0x7f0000000080)={@flat=@binder={0x73622a85, 0xa, 0x1}, @fda={0x66646185, 0xa, 0x1, 0x9}, @fd={0x66642a85, 0x0, r1}}, &(0x7f0000000100)={0x0, 0x18, 0x38}}, 0x1000}, @transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000180)={@ptr={0x70742a85, 0x0, &(0x7f0000000140)=""/51, 0x33, 0x2, 0x25}, @flat=@weak_handle={0x77682a85, 0x1}, @flat=@binder={0x73622a85, 0xa, 0x3}}, &(0x7f0000000280)={0x0, 0x28, 0x40}}, 0x1f8aed83e3349436}, @exit_looper, @transaction_sg={0x40486311, {0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x68, 0x18, &(0x7f0000000480)={@ptr={0x70742a85, 0x0, &(0x7f00000002c0)=""/11, 0xb, 0x2, 0x3f}, @fd={0x66642a85, 0x0, r0}, @ptr={0x70742a85, 0x0, &(0x7f0000000380)=""/70, 0x46, 0x1, 0x1f}}, &(0x7f0000000500)={0x0, 0x28, 0x40}}, 0x1000}], 0x14, 0x0, &(0x7f0000000680)="86621f50fcee8bdc5bf8c503a78812261b4bf6d7"}) [ 2601.613554] binder: 6665:6674 Release 1 refcount change on invalid ref 2 ret -22 [ 2601.613564] binder: 6665:6674 BC_ACQUIRE_DONE u0000000000000000 no match 18:07:13 executing program 1: clone(0x2102001fff, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) socket(0x0, 0x0, 0x0) r0 = getpid() rt_tgsigqueueinfo(0x0, r0, 0x16, &(0x7f0000000100)) rt_sigqueueinfo(r0, 0x7, &(0x7f0000000180)={0x0, 0x0, 0xffffffff}) [ 2601.613578] binder: 6665:6674 BC_ACQUIRE_DONE u0000000000000003 no match 18:07:13 executing program 3: r0 = socket(0x10, 0x3, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") ioctl$sock_ifreq(r0, 0x89f3, &(0x7f0000000240)={'sit0\x00'}) 18:07:13 executing program 1: clone(0x2102001fff, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) socket(0x0, 0x0, 0x0) r0 = getpid() rt_tgsigqueueinfo(0x0, r0, 0x16, &(0x7f0000000100)) rt_sigqueueinfo(r0, 0x7, &(0x7f0000000180)={0x0, 0x0, 0xffffffff}) 18:07:13 executing program 2: ioctl$FS_IOC_RESVSP(0xffffffffffffffff, 0x40305828, &(0x7f00000000c0)={0x0, 0x0, 0x100000000000001}) clone(0x2102001fff, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) socket(0x0, 0x0, 0x0) r0 = getpid() rt_tgsigqueueinfo(0x0, r0, 0x16, &(0x7f0000000100)) ptrace(0x10, r0) ptrace$poke(0x4209, r0, &(0x7f00000000c0), 0x70effd) 18:07:13 executing program 5: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000001a00)='/dev/net/tun\x00', 0x0, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000080)="c0dc00025e0b01047be070") ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000300)={'nr0\x01\x00', 0x1132}) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000001a00)='/dev/net/tun\x00', 0x2, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000300)={'nr0\x01\x00', 0x1132}) write$cgroup_int(0xffffffffffffffff, &(0x7f00000000c0)=0x2, 0xfffffffffffffe75) close(r1) [ 2601.613592] binder: 6665:6674 transaction failed 29189/-22, size 80-24 line 3014 18:07:14 executing program 3: r0 = socket(0x10, 0x3, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") ioctl$sock_ifreq(r0, 0x89f3, &(0x7f0000000240)={'sit0\x00'}) 18:07:14 executing program 4: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000040)='/dev/net/tun\x00', 0x0, 0x0) r1 = epoll_create1(0x0) epoll_ctl$EPOLL_CTL_ADD(0xffffffffffffffff, 0x1, r0, &(0x7f0000000100)) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000080)={'tunl0\x00', 0x1}) epoll_wait(r1, &(0x7f00000000c0)=[{}], 0x1, 0x0) 18:07:14 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000006c0)={0x118, 0x0, &(0x7f0000000540)=[@release={0x40046306, 0x2}, @acquire_done, @acquire_done={0x40106309, 0x3}, @transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x50, 0x18, &(0x7f0000000080)={@flat=@binder={0x73622a85, 0xa, 0x1}, @fda={0x66646185, 0xa, 0x1, 0x9}, @fd={0x66642a85, 0x0, r1}}, &(0x7f0000000100)={0x0, 0x18, 0x38}}, 0x1000}, @transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000180)={@ptr={0x70742a85, 0x0, &(0x7f0000000140)=""/51, 0x33, 0x2, 0x25}, @flat=@weak_handle={0x77682a85, 0x1}, @flat=@binder={0x73622a85, 0xa, 0x3}}, &(0x7f0000000280)={0x0, 0x28, 0x40}}, 0x1f8aed83e3349436}, @exit_looper, @transaction_sg={0x40486311, {0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x68, 0x18, &(0x7f0000000480)={@ptr={0x70742a85, 0x0, &(0x7f00000002c0)=""/11, 0xb, 0x2, 0x3f}, @fd={0x66642a85, 0x0, r0}, @ptr={0x70742a85, 0x0, &(0x7f0000000380)=""/70, 0x46, 0x1, 0x1f}}, &(0x7f0000000500)={0x0, 0x28, 0x40}}, 0x1000}], 0x14, 0x0, &(0x7f0000000680)="86621f50fcee8bdc5bf8c503a78812261b4bf6d7"}) [ 2601.613851] binder: undelivered TRANSACTION_ERROR: 29189 18:07:14 executing program 1: clone(0x2102001fff, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) socket(0x0, 0x0, 0x0) r0 = getpid() rt_tgsigqueueinfo(0x0, r0, 0x16, &(0x7f0000000100)) rt_sigqueueinfo(r0, 0x7, &(0x7f0000000180)={0x0, 0x0, 0xffffffff}) [ 2601.904351] binder: 6782:6784 Release 1 refcount change on invalid ref 2 ret -22 [ 2601.904372] binder: 6782:6784 BC_ACQUIRE_DONE u0000000000000000 no match 18:07:14 executing program 3: r0 = socket(0x10, 0x3, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") ioctl$sock_ifreq(r0, 0x89f3, &(0x7f0000000240)={'sit0\x00'}) 18:07:14 executing program 4: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000040)='/dev/net/tun\x00', 0x0, 0x0) r1 = epoll_create1(0x0) epoll_ctl$EPOLL_CTL_ADD(0xffffffffffffffff, 0x1, r0, &(0x7f0000000100)) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000080)={'tunl0\x00', 0x1}) epoll_wait(r1, &(0x7f00000000c0)=[{}], 0x1, 0x0) [ 2601.904380] binder: 6782:6784 BC_ACQUIRE_DONE u0000000000000003 no match [ 2601.904392] binder: 6782:6784 transaction failed 29189/-22, size 80-24 line 3014 18:07:14 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000006c0)={0x118, 0x0, &(0x7f0000000540)=[@release={0x40046306, 0x2}, @acquire_done, @acquire_done={0x40106309, 0x3}, @transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x50, 0x18, &(0x7f0000000080)={@flat=@binder={0x73622a85, 0xa, 0x1}, @fda={0x66646185, 0xa, 0x1, 0x9}, @fd={0x66642a85, 0x0, r1}}, &(0x7f0000000100)={0x0, 0x18, 0x38}}, 0x1000}, @transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000180)={@ptr={0x70742a85, 0x0, &(0x7f0000000140)=""/51, 0x33, 0x2, 0x25}, @flat=@weak_handle={0x77682a85, 0x1}, @flat=@binder={0x73622a85, 0xa, 0x3}}, &(0x7f0000000280)={0x0, 0x28, 0x40}}, 0x1f8aed83e3349436}, @exit_looper, @transaction_sg={0x40486311, {0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x68, 0x18, &(0x7f0000000480)={@ptr={0x70742a85, 0x0, &(0x7f00000002c0)=""/11, 0xb, 0x2, 0x3f}, @fd={0x66642a85, 0x0, r0}, @ptr={0x70742a85, 0x0, &(0x7f0000000380)=""/70, 0x46, 0x1, 0x1f}}, &(0x7f0000000500)={0x0, 0x28, 0x40}}, 0x1000}], 0x14, 0x0, &(0x7f0000000680)="86621f50fcee8bdc5bf8c503a78812261b4bf6d7"}) 18:07:14 executing program 3: r0 = socket(0x10, 0x3, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") ioctl$sock_ifreq(r0, 0x89f3, &(0x7f0000000240)={'sit0\x00'}) 18:07:14 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000006c0)={0x118, 0x0, &(0x7f0000000540)=[@release={0x40046306, 0x2}, @acquire_done, @acquire_done={0x40106309, 0x3}, @transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x50, 0x18, &(0x7f0000000080)={@flat=@binder={0x73622a85, 0xa, 0x1}, @fda={0x66646185, 0xa, 0x1, 0x9}, @fd={0x66642a85, 0x0, r1}}, &(0x7f0000000100)={0x0, 0x18, 0x38}}, 0x1000}, @transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000180)={@ptr={0x70742a85, 0x0, &(0x7f0000000140)=""/51, 0x33, 0x2, 0x25}, @flat=@weak_handle={0x77682a85, 0x1}, @flat=@binder={0x73622a85, 0xa, 0x3}}, &(0x7f0000000280)={0x0, 0x28, 0x40}}, 0x1f8aed83e3349436}, @exit_looper, @transaction_sg={0x40486311, {0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x68, 0x18, &(0x7f0000000480)={@ptr={0x70742a85, 0x0, &(0x7f00000002c0)=""/11, 0xb, 0x2, 0x3f}, @fd={0x66642a85, 0x0, r0}, @ptr={0x70742a85, 0x0, &(0x7f0000000380)=""/70, 0x46, 0x1, 0x1f}}, &(0x7f0000000500)={0x0, 0x28, 0x40}}, 0x1000}], 0x14, 0x0, &(0x7f0000000680)="86621f50fcee8bdc5bf8c503a78812261b4bf6d7"}) 18:07:14 executing program 2: ioctl$FS_IOC_RESVSP(0xffffffffffffffff, 0x40305828, &(0x7f00000000c0)={0x0, 0x0, 0x100000000000001}) clone(0x2102001fff, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) socket(0x0, 0x0, 0x0) r0 = getpid() rt_tgsigqueueinfo(0x0, r0, 0x16, &(0x7f0000000100)) ptrace(0x10, r0) ptrace$poke(0x4209, r0, &(0x7f00000000c0), 0x70effd) [ 2601.904893] binder: undelivered TRANSACTION_ERROR: 29189 [ 2602.052375] binder: 6833:6839 Release 1 refcount change on invalid ref 2 ret -22 18:07:14 executing program 1: clone(0x2102001fff, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) socket(0x0, 0x0, 0x0) r0 = getpid() rt_tgsigqueueinfo(0x0, r0, 0x16, &(0x7f0000000100)) rt_sigqueueinfo(r0, 0x7, &(0x7f0000000180)={0x0, 0x0, 0xffffffff}) [ 2602.052385] binder: 6833:6839 BC_ACQUIRE_DONE u0000000000000000 no match [ 2602.052393] binder: 6833:6839 BC_ACQUIRE_DONE u0000000000000003 no match [ 2602.052406] binder: 6833:6839 transaction failed 29189/-22, size 80-24 line 3014 [ 2602.052610] binder: undelivered TRANSACTION_ERROR: 29189 [ 2602.255117] binder: 6892:6957 Release 1 refcount change on invalid ref 2 ret -22 [ 2602.255127] binder: 6892:6957 BC_ACQUIRE_DONE u0000000000000000 no match [ 2602.255134] binder: 6892:6957 BC_ACQUIRE_DONE u0000000000000003 no match [ 2602.255148] binder: 6892:6957 transaction failed 29189/-22, size 80-24 line 3014 [ 2602.255466] binder: undelivered TRANSACTION_ERROR: 29189 [ 2602.309879] binder: 6984:6985 Release 1 refcount change on invalid ref 2 ret -22 18:07:14 executing program 5: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000001a00)='/dev/net/tun\x00', 0x0, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000080)="c0dc00025e0b01047be070") ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000300)={'nr0\x01\x00', 0x1132}) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000001a00)='/dev/net/tun\x00', 0x2, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000300)={'nr0\x01\x00', 0x1132}) write$cgroup_int(0xffffffffffffffff, &(0x7f00000000c0)=0x2, 0xfffffffffffffe75) close(r1) 18:07:14 executing program 3: r0 = socket(0x10, 0x3, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") ioctl$sock_ifreq(r0, 0x89f3, &(0x7f0000000240)={'sit0\x00'}) 18:07:14 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000006c0)={0x118, 0x0, &(0x7f0000000540)=[@release={0x40046306, 0x2}, @acquire_done, @acquire_done={0x40106309, 0x3}, @transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x50, 0x18, &(0x7f0000000080)={@flat=@binder={0x73622a85, 0xa, 0x1}, @fda={0x66646185, 0xa, 0x1, 0x9}, @fd={0x66642a85, 0x0, r1}}, &(0x7f0000000100)={0x0, 0x18, 0x38}}, 0x1000}, @transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000180)={@ptr={0x70742a85, 0x0, &(0x7f0000000140)=""/51, 0x33, 0x2, 0x25}, @flat=@weak_handle={0x77682a85, 0x1}, @flat=@binder={0x73622a85, 0xa, 0x3}}, &(0x7f0000000280)={0x0, 0x28, 0x40}}, 0x1f8aed83e3349436}, @exit_looper, @transaction_sg={0x40486311, {0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x68, 0x18, &(0x7f0000000480)={@ptr={0x70742a85, 0x0, &(0x7f00000002c0)=""/11, 0xb, 0x2, 0x3f}, @fd={0x66642a85, 0x0, r0}, @ptr={0x70742a85, 0x0, &(0x7f0000000380)=""/70, 0x46, 0x1, 0x1f}}, &(0x7f0000000500)={0x0, 0x28, 0x40}}, 0x1000}], 0x14, 0x0, &(0x7f0000000680)="86621f50fcee8bdc5bf8c503a78812261b4bf6d7"}) 18:07:14 executing program 4: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000040)='/dev/net/tun\x00', 0x0, 0x0) r1 = epoll_create1(0x0) epoll_ctl$EPOLL_CTL_ADD(0xffffffffffffffff, 0x1, r0, &(0x7f0000000100)) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000080)={'tunl0\x00', 0x1}) epoll_wait(r1, &(0x7f00000000c0)=[{}], 0x1, 0x0) 18:07:14 executing program 1: clone(0x2102001fff, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) socket(0x0, 0x0, 0x0) r0 = getpid() rt_tgsigqueueinfo(0x0, r0, 0x16, &(0x7f0000000100)) rt_sigqueueinfo(r0, 0x7, &(0x7f0000000180)={0x0, 0x0, 0xffffffff}) [ 2602.309889] binder: 6984:6985 BC_ACQUIRE_DONE u0000000000000000 no match [ 2602.309897] binder: 6984:6985 BC_ACQUIRE_DONE u0000000000000003 no match 18:07:14 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000006c0)={0x118, 0x0, &(0x7f0000000540)=[@release={0x40046306, 0x2}, @acquire_done, @acquire_done={0x40106309, 0x3}, @transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x50, 0x18, &(0x7f0000000080)={@flat=@binder={0x73622a85, 0xa, 0x1}, @fda={0x66646185, 0xa, 0x1, 0x9}, @fd={0x66642a85, 0x0, r1}}, &(0x7f0000000100)={0x0, 0x18, 0x38}}, 0x1000}, @transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000180)={@ptr={0x70742a85, 0x0, &(0x7f0000000140)=""/51, 0x33, 0x2, 0x25}, @flat=@weak_handle={0x77682a85, 0x1}, @flat=@binder={0x73622a85, 0xa, 0x3}}, &(0x7f0000000280)={0x0, 0x28, 0x40}}, 0x1f8aed83e3349436}, @exit_looper, @transaction_sg={0x40486311, {0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x68, 0x18, &(0x7f0000000480)={@ptr={0x70742a85, 0x0, &(0x7f00000002c0)=""/11, 0xb, 0x2, 0x3f}, @fd={0x66642a85, 0x0, r0}, @ptr={0x70742a85, 0x0, &(0x7f0000000380)=""/70, 0x46, 0x1, 0x1f}}, &(0x7f0000000500)={0x0, 0x28, 0x40}}, 0x1000}], 0x14, 0x0, &(0x7f0000000680)="86621f50fcee8bdc5bf8c503a78812261b4bf6d7"}) 18:07:14 executing program 2: ioctl$FS_IOC_RESVSP(0xffffffffffffffff, 0x40305828, &(0x7f00000000c0)={0x0, 0x0, 0x100000000000001}) clone(0x2102001fff, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) socket(0x0, 0x0, 0x0) r0 = getpid() rt_tgsigqueueinfo(0x0, r0, 0x16, &(0x7f0000000100)) ptrace(0x10, r0) ptrace$poke(0x4209, r0, &(0x7f00000000c0), 0x70effd) 18:07:14 executing program 1: clone(0x2102001fff, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) socket(0x0, 0x0, 0x0) r0 = getpid() rt_tgsigqueueinfo(0x0, r0, 0x16, &(0x7f0000000100)) rt_sigqueueinfo(r0, 0x7, &(0x7f0000000180)={0x0, 0x0, 0xffffffff}) [ 2602.309910] binder: 6984:6985 transaction failed 29189/-22, size 80-24 line 3014 18:07:14 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000006c0)={0x118, 0x0, &(0x7f0000000540)=[@release={0x40046306, 0x2}, @acquire_done, @acquire_done={0x40106309, 0x3}, @transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x50, 0x18, &(0x7f0000000080)={@flat=@binder={0x73622a85, 0xa, 0x1}, @fda={0x66646185, 0xa, 0x1, 0x9}, @fd={0x66642a85, 0x0, r1}}, &(0x7f0000000100)={0x0, 0x18, 0x38}}, 0x1000}, @transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000180)={@ptr={0x70742a85, 0x0, &(0x7f0000000140)=""/51, 0x33, 0x2, 0x25}, @flat=@weak_handle={0x77682a85, 0x1}, @flat=@binder={0x73622a85, 0xa, 0x3}}, &(0x7f0000000280)={0x0, 0x28, 0x40}}, 0x1f8aed83e3349436}, @exit_looper, @transaction_sg={0x40486311, {0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x68, 0x18, &(0x7f0000000480)={@ptr={0x70742a85, 0x0, &(0x7f00000002c0)=""/11, 0xb, 0x2, 0x3f}, @fd={0x66642a85, 0x0, r0}, @ptr={0x70742a85, 0x0, &(0x7f0000000380)=""/70, 0x46, 0x1, 0x1f}}, &(0x7f0000000500)={0x0, 0x28, 0x40}}, 0x1000}], 0x14, 0x0, &(0x7f0000000680)="86621f50fcee8bdc5bf8c503a78812261b4bf6d7"}) [ 2602.310231] binder: undelivered TRANSACTION_ERROR: 29189 [ 2602.563294] binder: 7094:7113 Release 1 refcount change on invalid ref 2 ret -22 18:07:14 executing program 3: r0 = socket(0x10, 0x3, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") ioctl$sock_ifreq(r0, 0x89f3, &(0x7f0000000240)={'sit0\x00'}) [ 2602.563304] binder: 7094:7113 BC_ACQUIRE_DONE u0000000000000000 no match 18:07:14 executing program 1: clone(0x2102001fff, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) socket(0x0, 0x0, 0x0) r0 = getpid() rt_tgsigqueueinfo(0x0, r0, 0x16, &(0x7f0000000100)) rt_sigqueueinfo(r0, 0x7, &(0x7f0000000180)={0x0, 0x0, 0xffffffff}) 18:07:14 executing program 4: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000040)='/dev/net/tun\x00', 0x0, 0x0) r1 = epoll_create1(0x0) epoll_ctl$EPOLL_CTL_ADD(0xffffffffffffffff, 0x1, r0, &(0x7f0000000100)) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000080)={'tunl0\x00', 0x1}) epoll_wait(r1, &(0x7f00000000c0)=[{}], 0x1, 0x0) [ 2602.563312] binder: 7094:7113 BC_ACQUIRE_DONE u0000000000000003 no match [ 2602.563325] binder: 7094:7113 transaction failed 29189/-22, size 80-24 line 3014 18:07:14 executing program 5: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000001a00)='/dev/net/tun\x00', 0x0, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000080)="c0dc00025e0b01047be070") ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000300)={'nr0\x01\x00', 0x1132}) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000001a00)='/dev/net/tun\x00', 0x2, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000300)={'nr0\x01\x00', 0x1132}) write$cgroup_int(0xffffffffffffffff, &(0x7f00000000c0)=0x2, 0xfffffffffffffe75) close(r1) 18:07:14 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000006c0)={0x118, 0x0, &(0x7f0000000540)=[@release={0x40046306, 0x2}, @acquire_done, @acquire_done={0x40106309, 0x3}, @transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x50, 0x18, &(0x7f0000000080)={@flat=@binder={0x73622a85, 0xa, 0x1}, @fda={0x66646185, 0xa, 0x1, 0x9}, @fd={0x66642a85, 0x0, r1}}, &(0x7f0000000100)={0x0, 0x18, 0x38}}, 0x1000}, @transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000180)={@ptr={0x70742a85, 0x0, &(0x7f0000000140)=""/51, 0x33, 0x2, 0x25}, @flat=@weak_handle={0x77682a85, 0x1}, @flat=@binder={0x73622a85, 0xa, 0x3}}, &(0x7f0000000280)={0x0, 0x28, 0x40}}, 0x1f8aed83e3349436}, @exit_looper, @transaction_sg={0x40486311, {0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x68, 0x18, &(0x7f0000000480)={@ptr={0x70742a85, 0x0, &(0x7f00000002c0)=""/11, 0xb, 0x2, 0x3f}, @fd={0x66642a85, 0x0, r0}, @ptr={0x70742a85, 0x0, &(0x7f0000000380)=""/70, 0x46, 0x1, 0x1f}}, &(0x7f0000000500)={0x0, 0x28, 0x40}}, 0x1000}], 0x14, 0x0, &(0x7f0000000680)="86621f50fcee8bdc5bf8c503a78812261b4bf6d7"}) 18:07:14 executing program 2: ioctl$FS_IOC_RESVSP(0xffffffffffffffff, 0x40305828, &(0x7f00000000c0)={0x0, 0x0, 0x100000000000001}) clone(0x2102001fff, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) socket(0x0, 0x0, 0x0) r0 = getpid() rt_tgsigqueueinfo(0x0, r0, 0x16, &(0x7f0000000100)) ptrace(0x10, r0) ptrace$poke(0x4209, r0, &(0x7f00000000c0), 0x70effd) 18:07:14 executing program 3: r0 = socket(0x10, 0x3, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") ioctl$sock_ifreq(r0, 0x89f3, &(0x7f0000000240)={'sit0\x00'}) [ 2602.563639] binder: undelivered TRANSACTION_ERROR: 29189 18:07:14 executing program 1: clone(0x2102001fff, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) socket(0x0, 0x0, 0x0) r0 = getpid() rt_tgsigqueueinfo(0x0, r0, 0x16, &(0x7f0000000100)) rt_sigqueueinfo(r0, 0x7, &(0x7f0000000180)={0x0, 0x0, 0xffffffff}) 18:07:14 executing program 4: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000040)='/dev/net/tun\x00', 0x0, 0x0) r1 = epoll_create1(0x0) epoll_ctl$EPOLL_CTL_ADD(0xffffffffffffffff, 0x1, r0, &(0x7f0000000100)) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000080)={'tunl0\x00', 0x1}) epoll_wait(r1, &(0x7f00000000c0)=[{}], 0x1, 0x0) 18:07:14 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000006c0)={0x118, 0x0, &(0x7f0000000540)=[@release={0x40046306, 0x2}, @acquire_done, @acquire_done={0x40106309, 0x3}, @transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x50, 0x18, &(0x7f0000000080)={@flat=@binder={0x73622a85, 0xa, 0x1}, @fda={0x66646185, 0xa, 0x1, 0x9}, @fd={0x66642a85, 0x0, r1}}, &(0x7f0000000100)={0x0, 0x18, 0x38}}, 0x1000}, @transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000180)={@ptr={0x70742a85, 0x0, &(0x7f0000000140)=""/51, 0x33, 0x2, 0x25}, @flat=@weak_handle={0x77682a85, 0x1}, @flat=@binder={0x73622a85, 0xa, 0x3}}, &(0x7f0000000280)={0x0, 0x28, 0x40}}, 0x1f8aed83e3349436}, @exit_looper, @transaction_sg={0x40486311, {0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x68, 0x18, &(0x7f0000000480)={@ptr={0x70742a85, 0x0, &(0x7f00000002c0)=""/11, 0xb, 0x2, 0x3f}, @fd={0x66642a85, 0x0, r0}, @ptr={0x70742a85, 0x0, &(0x7f0000000380)=""/70, 0x46, 0x1, 0x1f}}, &(0x7f0000000500)={0x0, 0x28, 0x40}}, 0x1000}], 0x14, 0x0, &(0x7f0000000680)="86621f50fcee8bdc5bf8c503a78812261b4bf6d7"}) [ 2602.677480] binder: 7139:7150 Release 1 refcount change on invalid ref 2 ret -22 [ 2602.677490] binder: 7139:7150 BC_ACQUIRE_DONE u0000000000000000 no match 18:07:14 executing program 3: r0 = socket(0x10, 0x3, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") ioctl$sock_ifreq(r0, 0x89f3, &(0x7f0000000240)={'sit0\x00'}) [ 2602.677498] binder: 7139:7150 BC_ACQUIRE_DONE u0000000000000003 no match [ 2602.677510] binder: 7139:7150 transaction failed 29189/-22, size 80-24 line 3014 18:07:15 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000006c0)={0x118, 0x0, &(0x7f0000000540)=[@release={0x40046306, 0x2}, @acquire_done, @acquire_done={0x40106309, 0x3}, @transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x50, 0x18, &(0x7f0000000080)={@flat=@binder={0x73622a85, 0xa, 0x1}, @fda={0x66646185, 0xa, 0x1, 0x9}, @fd={0x66642a85, 0x0, r1}}, &(0x7f0000000100)={0x0, 0x18, 0x38}}, 0x1000}, @transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000180)={@ptr={0x70742a85, 0x0, &(0x7f0000000140)=""/51, 0x33, 0x2, 0x25}, @flat=@weak_handle={0x77682a85, 0x1}, @flat=@binder={0x73622a85, 0xa, 0x3}}, &(0x7f0000000280)={0x0, 0x28, 0x40}}, 0x1f8aed83e3349436}, @exit_looper, @transaction_sg={0x40486311, {0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x68, 0x18, &(0x7f0000000480)={@ptr={0x70742a85, 0x0, &(0x7f00000002c0)=""/11, 0xb, 0x2, 0x3f}, @fd={0x66642a85, 0x0, r0}, @ptr={0x70742a85, 0x0, &(0x7f0000000380)=""/70, 0x46, 0x1, 0x1f}}, &(0x7f0000000500)={0x0, 0x28, 0x40}}, 0x1000}], 0x14, 0x0, &(0x7f0000000680)="86621f50fcee8bdc5bf8c503a78812261b4bf6d7"}) 18:07:15 executing program 3: r0 = socket(0x10, 0x3, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") ioctl$sock_ifreq(r0, 0x89f3, &(0x7f0000000240)={'sit0\x00'}) 18:07:15 executing program 1: clone(0x2102001fff, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) socket(0x0, 0x0, 0x0) r0 = getpid() rt_tgsigqueueinfo(0x0, r0, 0x16, &(0x7f0000000100)) rt_sigqueueinfo(r0, 0x7, &(0x7f0000000180)={0x0, 0x0, 0xffffffff}) [ 2602.678149] binder: undelivered TRANSACTION_ERROR: 29189 [ 2602.787386] binder: 7193:7199 Release 1 refcount change on invalid ref 2 ret -22 18:07:15 executing program 2: ioctl$FS_IOC_RESVSP(0xffffffffffffffff, 0x40305828, &(0x7f00000000c0)={0x0, 0x0, 0x100000000000001}) clone(0x2102001fff, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) socket(0x0, 0x0, 0x0) r0 = getpid() rt_tgsigqueueinfo(0x0, r0, 0x16, &(0x7f0000000100)) ptrace(0x10, r0) ptrace$poke(0x4209, r0, &(0x7f00000000c0), 0x70effd) [ 2602.787397] binder: 7193:7199 BC_ACQUIRE_DONE u0000000000000000 no match 18:07:15 executing program 5: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000001a00)='/dev/net/tun\x00', 0x0, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000080)="c0dc00025e0b01047be070") ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000300)={'nr0\x01\x00', 0x1132}) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000001a00)='/dev/net/tun\x00', 0x2, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000300)={'nr0\x01\x00', 0x1132}) write$cgroup_int(0xffffffffffffffff, &(0x7f00000000c0)=0x2, 0xfffffffffffffe75) close(r1) 18:07:15 executing program 4: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000040)='/dev/net/tun\x00', 0x0, 0x0) r1 = epoll_create1(0x0) epoll_ctl$EPOLL_CTL_ADD(0xffffffffffffffff, 0x1, r0, &(0x7f0000000100)) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000080)={'tunl0\x00', 0x1}) epoll_wait(r1, &(0x7f00000000c0)=[{}], 0x1, 0x0) 18:07:15 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000006c0)={0x118, 0x0, &(0x7f0000000540)=[@release={0x40046306, 0x2}, @acquire_done, @acquire_done={0x40106309, 0x3}, @transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x50, 0x18, &(0x7f0000000080)={@flat=@binder={0x73622a85, 0xa, 0x1}, @fda={0x66646185, 0xa, 0x1, 0x9}, @fd={0x66642a85, 0x0, r1}}, &(0x7f0000000100)={0x0, 0x18, 0x38}}, 0x1000}, @transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000180)={@ptr={0x70742a85, 0x0, &(0x7f0000000140)=""/51, 0x33, 0x2, 0x25}, @flat=@weak_handle={0x77682a85, 0x1}, @flat=@binder={0x73622a85, 0xa, 0x3}}, &(0x7f0000000280)={0x0, 0x28, 0x40}}, 0x1f8aed83e3349436}, @exit_looper, @transaction_sg={0x40486311, {0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x68, 0x18, &(0x7f0000000480)={@ptr={0x70742a85, 0x0, &(0x7f00000002c0)=""/11, 0xb, 0x2, 0x3f}, @fd={0x66642a85, 0x0, r0}, @ptr={0x70742a85, 0x0, &(0x7f0000000380)=""/70, 0x46, 0x1, 0x1f}}, &(0x7f0000000500)={0x0, 0x28, 0x40}}, 0x1000}], 0x14, 0x0, &(0x7f0000000680)="86621f50fcee8bdc5bf8c503a78812261b4bf6d7"}) 18:07:15 executing program 3: r0 = socket(0x10, 0x3, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") ioctl$sock_ifreq(r0, 0x89f3, &(0x7f0000000240)={'sit0\x00'}) [ 2602.787404] binder: 7193:7199 BC_ACQUIRE_DONE u0000000000000003 no match 18:07:15 executing program 1: clone(0x2102001fff, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) socket(0x0, 0x0, 0x0) r0 = getpid() rt_tgsigqueueinfo(0x0, r0, 0x16, &(0x7f0000000100)) rt_sigqueueinfo(r0, 0x7, &(0x7f0000000180)={0x0, 0x0, 0xffffffff}) 18:07:15 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000006c0)={0x118, 0x0, &(0x7f0000000540)=[@release={0x40046306, 0x2}, @acquire_done, @acquire_done={0x40106309, 0x3}, @transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x50, 0x18, &(0x7f0000000080)={@flat=@binder={0x73622a85, 0xa, 0x1}, @fda={0x66646185, 0xa, 0x1, 0x9}, @fd={0x66642a85, 0x0, r1}}, &(0x7f0000000100)={0x0, 0x18, 0x38}}, 0x1000}, @transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000180)={@ptr={0x70742a85, 0x0, &(0x7f0000000140)=""/51, 0x33, 0x2, 0x25}, @flat=@weak_handle={0x77682a85, 0x1}, @flat=@binder={0x73622a85, 0xa, 0x3}}, &(0x7f0000000280)={0x0, 0x28, 0x40}}, 0x1f8aed83e3349436}, @exit_looper, @transaction_sg={0x40486311, {0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x68, 0x18, &(0x7f0000000480)={@ptr={0x70742a85, 0x0, &(0x7f00000002c0)=""/11, 0xb, 0x2, 0x3f}, @fd={0x66642a85, 0x0, r0}, @ptr={0x70742a85, 0x0, &(0x7f0000000380)=""/70, 0x46, 0x1, 0x1f}}, &(0x7f0000000500)={0x0, 0x28, 0x40}}, 0x1000}], 0x14, 0x0, &(0x7f0000000680)="86621f50fcee8bdc5bf8c503a78812261b4bf6d7"}) 18:07:15 executing program 3: r0 = socket(0x10, 0x3, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") ioctl$sock_ifreq(r0, 0x89f3, &(0x7f0000000240)={'sit0\x00'}) [ 2602.787417] binder: 7193:7199 transaction failed 29189/-22, size 80-24 line 3014 [ 2602.787717] binder: undelivered TRANSACTION_ERROR: 29189 18:07:15 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000006c0)={0x118, 0x0, &(0x7f0000000540)=[@release={0x40046306, 0x2}, @acquire_done, @acquire_done={0x40106309, 0x3}, @transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x50, 0x18, &(0x7f0000000080)={@flat=@binder={0x73622a85, 0xa, 0x1}, @fda={0x66646185, 0xa, 0x1, 0x9}, @fd={0x66642a85, 0x0, r1}}, &(0x7f0000000100)={0x0, 0x18, 0x38}}, 0x1000}, @transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000180)={@ptr={0x70742a85, 0x0, &(0x7f0000000140)=""/51, 0x33, 0x2, 0x25}, @flat=@weak_handle={0x77682a85, 0x1}, @flat=@binder={0x73622a85, 0xa, 0x3}}, &(0x7f0000000280)={0x0, 0x28, 0x40}}, 0x1f8aed83e3349436}, @exit_looper, @transaction_sg={0x40486311, {0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x68, 0x18, &(0x7f0000000480)={@ptr={0x70742a85, 0x0, &(0x7f00000002c0)=""/11, 0xb, 0x2, 0x3f}, @fd={0x66642a85, 0x0, r0}, @ptr={0x70742a85, 0x0, &(0x7f0000000380)=""/70, 0x46, 0x1, 0x1f}}, &(0x7f0000000500)={0x0, 0x28, 0x40}}, 0x1000}], 0x14, 0x0, &(0x7f0000000680)="86621f50fcee8bdc5bf8c503a78812261b4bf6d7"}) [ 2602.879588] binder: 7237:7239 Release 1 refcount change on invalid ref 2 ret -22 [ 2602.879598] binder: 7237:7239 BC_ACQUIRE_DONE u0000000000000000 no match 18:07:15 executing program 4: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000040)='/dev/net/tun\x00', 0x0, 0x0) r1 = epoll_create1(0x0) epoll_ctl$EPOLL_CTL_ADD(0xffffffffffffffff, 0x1, r0, &(0x7f0000000100)) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000080)={'tunl0\x00', 0x1}) epoll_wait(r1, &(0x7f00000000c0)=[{}], 0x1, 0x0) 18:07:15 executing program 3: r0 = socket(0x10, 0x3, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") ioctl$sock_ifreq(r0, 0x89f3, &(0x7f0000000240)={'sit0\x00'}) 18:07:15 executing program 2: ioctl$FS_IOC_RESVSP(0xffffffffffffffff, 0x40305828, &(0x7f00000000c0)={0x0, 0x0, 0x100000000000001}) clone(0x2102001fff, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) socket(0x0, 0x0, 0x0) r0 = getpid() rt_tgsigqueueinfo(0x0, r0, 0x16, &(0x7f0000000100)) ptrace(0x10, r0) ptrace$poke(0x4209, r0, &(0x7f00000000c0), 0x70effd) [ 2602.879605] binder: 7237:7239 BC_ACQUIRE_DONE u0000000000000003 no match [ 2602.879616] binder: 7237:7239 transaction failed 29189/-22, size 80-24 line 3014 18:07:15 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000006c0)={0x118, 0x0, &(0x7f0000000540)=[@release={0x40046306, 0x2}, @acquire_done, @acquire_done={0x40106309, 0x3}, @transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x50, 0x18, &(0x7f0000000080)={@flat=@binder={0x73622a85, 0xa, 0x1}, @fda={0x66646185, 0xa, 0x1, 0x9}, @fd={0x66642a85, 0x0, r1}}, &(0x7f0000000100)={0x0, 0x18, 0x38}}, 0x1000}, @transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000180)={@ptr={0x70742a85, 0x0, &(0x7f0000000140)=""/51, 0x33, 0x2, 0x25}, @flat=@weak_handle={0x77682a85, 0x1}, @flat=@binder={0x73622a85, 0xa, 0x3}}, &(0x7f0000000280)={0x0, 0x28, 0x40}}, 0x1f8aed83e3349436}, @exit_looper, @transaction_sg={0x40486311, {0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x68, 0x18, &(0x7f0000000480)={@ptr={0x70742a85, 0x0, &(0x7f00000002c0)=""/11, 0xb, 0x2, 0x3f}, @fd={0x66642a85, 0x0, r0}, @ptr={0x70742a85, 0x0, &(0x7f0000000380)=""/70, 0x46, 0x1, 0x1f}}, &(0x7f0000000500)={0x0, 0x28, 0x40}}, 0x1000}], 0x14, 0x0, &(0x7f0000000680)="86621f50fcee8bdc5bf8c503a78812261b4bf6d7"}) [ 2602.881698] binder: undelivered TRANSACTION_ERROR: 29189 18:07:15 executing program 5: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000001a00)='/dev/net/tun\x00', 0x0, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000080)="c0dc00025e0b01047be070") ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000300)={'nr0\x01\x00', 0x1132}) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000001a00)='/dev/net/tun\x00', 0x2, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000300)={'nr0\x01\x00', 0x1132}) write$cgroup_int(0xffffffffffffffff, &(0x7f00000000c0)=0x2, 0xfffffffffffffe75) close(r1) 18:07:15 executing program 3: r0 = socket(0x10, 0x3, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") ioctl$sock_ifreq(r0, 0x89f3, &(0x7f0000000240)={'sit0\x00'}) [ 2603.142744] binder: 7276:7304 Release 1 refcount change on invalid ref 2 ret -22 18:07:15 executing program 1: clone(0x2102001fff, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) socket(0x0, 0x0, 0x0) r0 = getpid() rt_tgsigqueueinfo(0x0, r0, 0x16, &(0x7f0000000100)) rt_sigqueueinfo(r0, 0x7, &(0x7f0000000180)={0x0, 0x0, 0xffffffff}) 18:07:15 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000006c0)={0x118, 0x0, &(0x7f0000000540)=[@release={0x40046306, 0x2}, @acquire_done, @acquire_done={0x40106309, 0x3}, @transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x50, 0x18, &(0x7f0000000080)={@flat=@binder={0x73622a85, 0xa, 0x1}, @fda={0x66646185, 0xa, 0x1, 0x9}, @fd={0x66642a85, 0x0, r1}}, &(0x7f0000000100)={0x0, 0x18, 0x38}}, 0x1000}, @transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000180)={@ptr={0x70742a85, 0x0, &(0x7f0000000140)=""/51, 0x33, 0x2, 0x25}, @flat=@weak_handle={0x77682a85, 0x1}, @flat=@binder={0x73622a85, 0xa, 0x3}}, &(0x7f0000000280)={0x0, 0x28, 0x40}}, 0x1f8aed83e3349436}, @exit_looper, @transaction_sg={0x40486311, {0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x68, 0x18, &(0x7f0000000480)={@ptr={0x70742a85, 0x0, &(0x7f00000002c0)=""/11, 0xb, 0x2, 0x3f}, @fd={0x66642a85, 0x0, r0}, @ptr={0x70742a85, 0x0, &(0x7f0000000380)=""/70, 0x46, 0x1, 0x1f}}, &(0x7f0000000500)={0x0, 0x28, 0x40}}, 0x1000}], 0x14, 0x0, &(0x7f0000000680)="86621f50fcee8bdc5bf8c503a78812261b4bf6d7"}) [ 2603.142754] binder: 7276:7304 BC_ACQUIRE_DONE u0000000000000000 no match [ 2603.142762] binder: 7276:7304 BC_ACQUIRE_DONE u0000000000000003 no match 18:07:15 executing program 3: r0 = socket(0x10, 0x3, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") ioctl$sock_ifreq(r0, 0x89f3, &(0x7f0000000240)={'sit0\x00'}) 18:07:15 executing program 1: clone(0x2102001fff, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) socket(0x0, 0x0, 0x0) r0 = getpid() rt_tgsigqueueinfo(0x0, r0, 0x16, &(0x7f0000000100)) rt_sigqueueinfo(r0, 0x7, &(0x7f0000000180)={0x0, 0x0, 0xffffffff}) 18:07:15 executing program 4: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000040)='/dev/net/tun\x00', 0x0, 0x0) r1 = epoll_create1(0x0) epoll_ctl$EPOLL_CTL_ADD(0xffffffffffffffff, 0x1, r0, &(0x7f0000000100)) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000080)={'tunl0\x00', 0x1}) epoll_wait(r1, &(0x7f00000000c0)=[{}], 0x1, 0x0) [ 2603.142775] binder: 7276:7304 transaction failed 29189/-22, size 80-24 line 3014 [ 2603.150594] binder: undelivered TRANSACTION_ERROR: 29189 [ 2603.263942] binder: 7416:7423 Release 1 refcount change on invalid ref 2 ret -22 18:07:15 executing program 3: r0 = socket(0x10, 0x3, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") ioctl$sock_ifreq(r0, 0x89f3, &(0x7f0000000240)={'sit0\x00'}) 18:07:15 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000006c0)={0x118, 0x0, &(0x7f0000000540)=[@release={0x40046306, 0x2}, @acquire_done, @acquire_done={0x40106309, 0x3}, @transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x50, 0x18, &(0x7f0000000080)={@flat=@binder={0x73622a85, 0xa, 0x1}, @fda={0x66646185, 0xa, 0x1, 0x9}, @fd={0x66642a85, 0x0, r1}}, &(0x7f0000000100)={0x0, 0x18, 0x38}}, 0x1000}, @transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000180)={@ptr={0x70742a85, 0x0, &(0x7f0000000140)=""/51, 0x33, 0x2, 0x25}, @flat=@weak_handle={0x77682a85, 0x1}, @flat=@binder={0x73622a85, 0xa, 0x3}}, &(0x7f0000000280)={0x0, 0x28, 0x40}}, 0x1f8aed83e3349436}, @exit_looper, @transaction_sg={0x40486311, {0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x68, 0x18, &(0x7f0000000480)={@ptr={0x70742a85, 0x0, &(0x7f00000002c0)=""/11, 0xb, 0x2, 0x3f}, @fd={0x66642a85, 0x0, r0}, @ptr={0x70742a85, 0x0, &(0x7f0000000380)=""/70, 0x46, 0x1, 0x1f}}, &(0x7f0000000500)={0x0, 0x28, 0x40}}, 0x1000}], 0x14, 0x0, &(0x7f0000000680)="86621f50fcee8bdc5bf8c503a78812261b4bf6d7"}) 18:07:15 executing program 1: clone(0x2102001fff, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) socket(0x0, 0x0, 0x0) r0 = getpid() rt_tgsigqueueinfo(0x0, r0, 0x16, &(0x7f0000000100)) rt_sigqueueinfo(r0, 0x7, &(0x7f0000000180)={0x0, 0x0, 0xffffffff}) [ 2603.263952] binder: 7416:7423 BC_ACQUIRE_DONE u0000000000000000 no match [ 2603.263959] binder: 7416:7423 BC_ACQUIRE_DONE u0000000000000003 no match [ 2603.263973] binder: 7416:7423 transaction failed 29189/-22, size 80-24 line 3014 [ 2603.264268] binder: undelivered TRANSACTION_ERROR: 29189 [ 2603.346749] binder: 7454:7473 Release 1 refcount change on invalid ref 2 ret -22 [ 2603.346758] binder: 7454:7473 BC_ACQUIRE_DONE u0000000000000000 no match [ 2603.346766] binder: 7454:7473 BC_ACQUIRE_DONE u0000000000000003 no match [ 2603.346779] binder: 7454:7473 transaction failed 29189/-22, size 80-24 line 3014 [ 2603.347052] binder: undelivered TRANSACTION_ERROR: 29189 [ 2603.446014] binder: 7485:7496 Release 1 refcount change on invalid ref 2 ret -22 [ 2603.446025] binder: 7485:7496 BC_ACQUIRE_DONE u0000000000000000 no match [ 2603.446039] binder: 7485:7496 BC_ACQUIRE_DONE u0000000000000003 no match [ 2603.446052] binder: 7485:7496 transaction failed 29189/-22, size 80-24 line 3014 [ 2603.451205] binder: undelivered TRANSACTION_ERROR: 29189 [ 2603.574946] binder: 7537:7561 Release 1 refcount change on invalid ref 2 ret -22 [ 2603.574957] binder: 7537:7561 BC_ACQUIRE_DONE u0000000000000000 no match [ 2603.574965] binder: 7537:7561 BC_ACQUIRE_DONE u0000000000000003 no match [ 2603.574978] binder: 7537:7561 transaction failed 29189/-22, size 80-24 line 3014 [ 2603.575304] binder: undelivered TRANSACTION_ERROR: 29189 [ 2603.669645] binder: 7574:7590 Release 1 refcount change on invalid ref 2 ret -22 [ 2603.669655] binder: 7574:7590 BC_ACQUIRE_DONE u0000000000000000 no match [ 2603.669663] binder: 7574:7590 BC_ACQUIRE_DONE u0000000000000003 no match [ 2603.669676] binder: 7574:7590 transaction failed 29189/-22, size 80-24 line 3014 [ 2603.670037] binder: undelivered TRANSACTION_ERROR: 29189 [ 2603.875385] binder: 7632:7668 Release 1 refcount change on invalid ref 2 ret -22 [ 2603.875395] binder: 7632:7668 BC_ACQUIRE_DONE u0000000000000000 no match [ 2603.875403] binder: 7632:7668 BC_ACQUIRE_DONE u0000000000000003 no match [ 2603.875416] binder: 7632:7668 transaction failed 29189/-22, size 80-24 line 3014 [ 2603.875722] binder: undelivered TRANSACTION_ERROR: 29189 [ 2603.961458] binder: 7674:7689 Release 1 refcount change on invalid ref 2 ret -22 [ 2603.961630] binder: 7674:7689 BC_ACQUIRE_DONE u0000000000000000 no match [ 2603.961638] binder: 7674:7689 BC_ACQUIRE_DONE u0000000000000003 no match [ 2603.961651] binder: 7674:7689 transaction failed 29189/-22, size 80-24 line 3014 [ 2603.962472] binder: undelivered TRANSACTION_ERROR: 29189 [ 2604.286984] binder: 7809:7815 Release 1 refcount change on invalid ref 2 ret -22 [ 2604.286995] binder: 7809:7815 BC_ACQUIRE_DONE u0000000000000000 no match [ 2604.287002] binder: 7809:7815 BC_ACQUIRE_DONE u0000000000000003 no match [ 2604.287016] binder: 7809:7815 transaction failed 29189/-22, size 80-24 line 3014 [ 2604.287300] binder: undelivered TRANSACTION_ERROR: 29189 [ 2604.445419] binder: 7877:7894 Release 1 refcount change on invalid ref 2 ret -22 [ 2604.445429] binder: 7877:7894 BC_ACQUIRE_DONE u0000000000000000 no match [ 2604.445437] binder: 7877:7894 BC_ACQUIRE_DONE u0000000000000003 no match [ 2604.445450] binder: 7877:7894 transaction failed 29189/-22, size 80-24 line 3014 [ 2604.445701] binder: undelivered TRANSACTION_ERROR: 29189 [ 2604.523023] binder: 7925:7930 Release 1 refcount change on invalid ref 2 ret -22 [ 2604.523033] binder: 7925:7930 BC_ACQUIRE_DONE u0000000000000000 no match [ 2604.523041] binder: 7925:7930 BC_ACQUIRE_DONE u0000000000000003 no match [ 2604.523053] binder: 7925:7930 transaction failed 29189/-22, size 80-24 line 3014 [ 2604.523782] binder: undelivered TRANSACTION_ERROR: 29189 [ 2604.653650] binder: 7956:7974 Release 1 refcount change on invalid ref 2 ret -22 [ 2604.653661] binder: 7956:7974 BC_ACQUIRE_DONE u0000000000000000 no match [ 2604.653669] binder: 7956:7974 BC_ACQUIRE_DONE u0000000000000003 no match [ 2604.653683] binder: 7956:7974 transaction failed 29189/-22, size 80-24 line 3014 [ 2604.654014] binder: undelivered TRANSACTION_ERROR: 29189 [ 2604.792156] binder: 8014:8037 Release 1 refcount change on invalid ref 2 ret -22 [ 2604.792165] binder: 8014:8037 BC_ACQUIRE_DONE u0000000000000000 no match [ 2604.792173] binder: 8014:8037 BC_ACQUIRE_DONE u0000000000000003 no match [ 2604.792187] binder: 8014:8037 transaction failed 29189/-22, size 80-24 line 3014 [ 2604.797960] binder: undelivered TRANSACTION_ERROR: 29189 [ 2604.861284] binder: 8053:8061 Release 1 refcount change on invalid ref 2 ret -22 [ 2604.861294] binder: 8053:8061 BC_ACQUIRE_DONE u0000000000000000 no match [ 2604.861302] binder: 8053:8061 BC_ACQUIRE_DONE u0000000000000003 no match [ 2604.861314] binder: 8053:8061 transaction failed 29189/-22, size 80-24 line 3014 [ 2604.861537] binder: undelivered TRANSACTION_ERROR: 29189 [ 2605.037871] binder: 8113:8144 Release 1 refcount change on invalid ref 2 ret -22 [ 2605.037881] binder: 8113:8144 BC_ACQUIRE_DONE u0000000000000000 no match [ 2605.037889] binder: 8113:8144 BC_ACQUIRE_DONE u0000000000000003 no match [ 2605.037902] binder: 8113:8144 transaction failed 29189/-22, size 80-24 line 3014 [ 2605.038198] binder: undelivered TRANSACTION_ERROR: 29189 [ 2605.167698] binder: 8188:8200 Release 1 refcount change on invalid ref 2 ret -22 [ 2605.167708] binder: 8188:8200 BC_ACQUIRE_DONE u0000000000000000 no match [ 2605.167716] binder: 8188:8200 BC_ACQUIRE_DONE u0000000000000003 no match [ 2605.167728] binder: 8188:8200 transaction failed 29189/-22, size 80-24 line 3014 [ 2605.168029] binder: undelivered TRANSACTION_ERROR: 29189 [ 2605.239728] binder: 8220:8222 Release 1 refcount change on invalid ref 2 ret -22 [ 2605.239738] binder: 8220:8222 BC_ACQUIRE_DONE u0000000000000000 no match [ 2605.239746] binder: 8220:8222 BC_ACQUIRE_DONE u0000000000000003 no match [ 2605.239759] binder: 8220:8222 transaction failed 29189/-22, size 80-24 line 3014 [ 2605.240305] binder: undelivered TRANSACTION_ERROR: 29189 [ 2605.364221] binder: 8252:8266 Release 1 refcount change on invalid ref 2 ret -22 [ 2605.364234] binder: 8252:8266 BC_ACQUIRE_DONE u0000000000000000 no match [ 2605.364242] binder: 8252:8266 BC_ACQUIRE_DONE u0000000000000003 no match [ 2605.364256] binder: 8252:8266 transaction failed 29189/-22, size 80-24 line 3014 [ 2605.364586] binder: undelivered TRANSACTION_ERROR: 29189 [ 2605.442826] binder: 8284:8303 Release 1 refcount change on invalid ref 2 ret -22 [ 2605.442837] binder: 8284:8303 BC_ACQUIRE_DONE u0000000000000000 no match [ 2605.442845] binder: 8284:8303 BC_ACQUIRE_DONE u0000000000000003 no match [ 2605.442865] binder: 8284:8303 transaction failed 29189/-22, size 80-24 line 3014 [ 2605.444850] binder: undelivered TRANSACTION_ERROR: 29189 [ 2605.596802] binder: 8358:8374 Release 1 refcount change on invalid ref 2 ret -22 [ 2605.596813] binder: 8358:8374 BC_ACQUIRE_DONE u0000000000000000 no match [ 2605.596821] binder: 8358:8374 BC_ACQUIRE_DONE u0000000000000003 no match [ 2605.596833] binder: 8358:8374 transaction failed 29189/-22, size 80-24 line 3014 [ 2605.597133] binder: undelivered TRANSACTION_ERROR: 29189 [ 2605.696822] binder: 8416:8424 Release 1 refcount change on invalid ref 2 ret -22 [ 2605.696833] binder: 8416:8424 BC_ACQUIRE_DONE u0000000000000000 no match [ 2605.696840] binder: 8416:8424 BC_ACQUIRE_DONE u0000000000000003 no match [ 2605.696853] binder: 8416:8424 transaction failed 29189/-22, size 80-24 line 3014 [ 2605.697591] binder: undelivered TRANSACTION_ERROR: 29189 [ 2605.777475] binder: 8448:8466 Release 1 refcount change on invalid ref 2 ret -22 [ 2605.777486] binder: 8448:8466 BC_ACQUIRE_DONE u0000000000000000 no match [ 2605.777494] binder: 8448:8466 BC_ACQUIRE_DONE u0000000000000003 no match [ 2605.777517] binder: 8448:8466 transaction failed 29189/-22, size 80-24 line 3014 [ 2605.777871] binder: undelivered TRANSACTION_ERROR: 29189 [ 2605.886988] binder: 8495:8505 Release 1 refcount change on invalid ref 2 ret -22 [ 2605.887009] binder: 8495:8505 BC_ACQUIRE_DONE u0000000000000000 no match [ 2605.887018] binder: 8495:8505 BC_ACQUIRE_DONE u0000000000000003 no match [ 2605.887032] binder: 8495:8505 transaction failed 29189/-22, size 80-24 line 3014 [ 2605.890616] binder: undelivered TRANSACTION_ERROR: 29189 [ 2606.049522] binder: 8554:8564 Release 1 refcount change on invalid ref 2 ret -22 [ 2606.049532] binder: 8554:8564 BC_ACQUIRE_DONE u0000000000000000 no match [ 2606.049540] binder: 8554:8564 BC_ACQUIRE_DONE u0000000000000003 no match [ 2606.049553] binder: 8554:8564 transaction failed 29189/-22, size 80-24 line 3014 [ 2606.050013] binder: undelivered TRANSACTION_ERROR: 29189 [ 2606.158122] binder: 8601:8605 Release 1 refcount change on invalid ref 2 ret -22 [ 2606.158133] binder: 8601:8605 BC_ACQUIRE_DONE u0000000000000000 no match [ 2606.158140] binder: 8601:8605 BC_ACQUIRE_DONE u0000000000000003 no match [ 2606.158152] binder: 8601:8605 transaction failed 29189/-22, size 80-24 line 3014 [ 2606.159757] binder: undelivered TRANSACTION_ERROR: 29189 [ 2606.214362] binder: 8611:8613 Release 1 refcount change on invalid ref 2 ret -22 [ 2606.214372] binder: 8611:8613 BC_ACQUIRE_DONE u0000000000000000 no match [ 2606.214380] binder: 8611:8613 BC_ACQUIRE_DONE u0000000000000003 no match [ 2606.214393] binder: 8611:8613 transaction failed 29189/-22, size 80-24 line 3014 [ 2606.214735] binder: undelivered TRANSACTION_ERROR: 29189 [ 2606.291560] binder: 8639:8647 Release 1 refcount change on invalid ref 2 ret -22 [ 2606.291569] binder: 8639:8647 BC_ACQUIRE_DONE u0000000000000000 no match [ 2606.291577] binder: 8639:8647 BC_ACQUIRE_DONE u0000000000000003 no match [ 2606.291589] binder: 8639:8647 transaction failed 29189/-22, size 80-24 line 3014 [ 2606.307094] binder: undelivered TRANSACTION_ERROR: 29189 [ 2606.431894] binder: 8696:8704 Release 1 refcount change on invalid ref 2 ret -22 [ 2606.431904] binder: 8696:8704 BC_ACQUIRE_DONE u0000000000000000 no match [ 2606.431911] binder: 8696:8704 BC_ACQUIRE_DONE u0000000000000003 no match [ 2606.431923] binder: 8696:8704 transaction failed 29189/-22, size 80-24 line 3014 [ 2606.444014] binder: undelivered TRANSACTION_ERROR: 29189 [ 2606.525148] binder: 8745:8751 Release 1 refcount change on invalid ref 2 ret -22 [ 2606.525159] binder: 8745:8751 BC_ACQUIRE_DONE u0000000000000000 no match [ 2606.525167] binder: 8745:8751 BC_ACQUIRE_DONE u0000000000000003 no match [ 2606.525179] binder: 8745:8751 transaction failed 29189/-22, size 80-24 line 3014 [ 2606.525459] binder: undelivered TRANSACTION_ERROR: 29189 [ 2606.692258] binder: 8806:8812 Release 1 refcount change on invalid ref 2 ret -22 [ 2606.692268] binder: 8806:8812 BC_ACQUIRE_DONE u0000000000000000 no match [ 2606.692276] binder: 8806:8812 BC_ACQUIRE_DONE u0000000000000003 no match [ 2606.692290] binder: 8806:8812 transaction failed 29189/-22, size 80-24 line 3014 [ 2606.692592] binder: undelivered TRANSACTION_ERROR: 29189 [ 2606.791497] binder: 8832:8851 Release 1 refcount change on invalid ref 2 ret -22 [ 2606.791518] binder: 8832:8851 BC_ACQUIRE_DONE u0000000000000000 no match [ 2606.791526] binder: 8832:8851 BC_ACQUIRE_DONE u0000000000000003 no match [ 2606.791540] binder: 8832:8851 transaction failed 29189/-22, size 80-24 line 3014 [ 2606.791858] binder: undelivered TRANSACTION_ERROR: 29189 [ 2606.891906] binder: 8899:8912 Release 1 refcount change on invalid ref 2 ret -22 [ 2606.891917] binder: 8899:8912 BC_ACQUIRE_DONE u0000000000000000 no match [ 2606.891925] binder: 8899:8912 BC_ACQUIRE_DONE u0000000000000003 no match [ 2606.891937] binder: 8899:8912 transaction failed 29189/-22, size 80-24 line 3014 [ 2606.892147] binder: undelivered TRANSACTION_ERROR: 29189 [ 2607.080071] binder: 8959:8970 Release 1 refcount change on invalid ref 2 ret -22 [ 2607.080081] binder: 8959:8970 BC_ACQUIRE_DONE u0000000000000000 no match [ 2607.080089] binder: 8959:8970 BC_ACQUIRE_DONE u0000000000000003 no match [ 2607.080102] binder: 8959:8970 transaction failed 29189/-22, size 80-24 line 3014 [ 2607.080408] binder: undelivered TRANSACTION_ERROR: 29189 [ 2607.159124] binder: 9000:9009 Release 1 refcount change on invalid ref 2 ret -22 [ 2607.159134] binder: 9000:9009 BC_ACQUIRE_DONE u0000000000000000 no match [ 2607.159142] binder: 9000:9009 BC_ACQUIRE_DONE u0000000000000003 no match [ 2607.159156] binder: 9000:9009 transaction failed 29189/-22, size 80-24 line 3014 [ 2607.159460] binder: undelivered TRANSACTION_ERROR: 29189 [ 2607.266143] binder: 9057:9075 Release 1 refcount change on invalid ref 2 ret -22 [ 2607.266152] binder: 9057:9075 BC_ACQUIRE_DONE u0000000000000000 no match [ 2607.266159] binder: 9057:9075 BC_ACQUIRE_DONE u0000000000000003 no match [ 2607.266173] binder: 9057:9075 transaction failed 29189/-22, size 80-24 line 3014 [ 2607.266527] binder: undelivered TRANSACTION_ERROR: 29189 [ 2607.446272] binder: 9129:9139 Release 1 refcount change on invalid ref 2 ret -22 [ 2607.446282] binder: 9129:9139 BC_ACQUIRE_DONE u0000000000000000 no match [ 2607.446289] binder: 9129:9139 BC_ACQUIRE_DONE u0000000000000003 no match [ 2607.446302] binder: 9129:9139 transaction failed 29189/-22, size 80-24 line 3014 [ 2607.447507] binder: undelivered TRANSACTION_ERROR: 29189 [ 2607.637436] binder: 9231:9238 Release 1 refcount change on invalid ref 2 ret -22 [ 2607.637447] binder: 9231:9238 BC_ACQUIRE_DONE u0000000000000000 no match [ 2607.637455] binder: 9231:9238 BC_ACQUIRE_DONE u0000000000000003 no match [ 2607.637468] binder: 9231:9238 transaction failed 29189/-22, size 80-24 line 3014 [ 2607.641048] binder: undelivered TRANSACTION_ERROR: 29189 [ 2607.749390] binder: 9290:9300 Release 1 refcount change on invalid ref 2 ret -22 [ 2607.749400] binder: 9290:9300 BC_ACQUIRE_DONE u0000000000000000 no match [ 2607.749407] binder: 9290:9300 BC_ACQUIRE_DONE u0000000000000003 no match [ 2607.749420] binder: 9290:9300 transaction failed 29189/-22, size 80-24 line 3014 [ 2607.749628] binder: undelivered TRANSACTION_ERROR: 29189 [ 2608.054850] binder: 9346:9417 Release 1 refcount change on invalid ref 2 ret -22 [ 2608.054860] binder: 9346:9417 BC_ACQUIRE_DONE u0000000000000000 no match [ 2608.054869] binder: 9346:9417 BC_ACQUIRE_DONE u0000000000000003 no match [ 2608.054882] binder: 9346:9417 transaction failed 29189/-22, size 80-24 line 3014 [ 2608.055201] binder: undelivered TRANSACTION_ERROR: 29189 [ 2608.123651] binder: 9426:9429 Release 1 refcount change on invalid ref 2 ret -22 [ 2608.123661] binder: 9426:9429 BC_ACQUIRE_DONE u0000000000000000 no match [ 2608.123669] binder: 9426:9429 BC_ACQUIRE_DONE u0000000000000003 no match [ 2608.123682] binder: 9426:9429 transaction failed 29189/-22, size 80-24 line 3014 [ 2608.123969] binder: undelivered TRANSACTION_ERROR: 29189 [ 2608.235749] binder: 9447:9473 Release 1 refcount change on invalid ref 2 ret -22 [ 2608.235759] binder: 9447:9473 BC_ACQUIRE_DONE u0000000000000000 no match [ 2608.235775] binder: 9447:9473 BC_ACQUIRE_DONE u0000000000000003 no match [ 2608.235810] binder: 9447:9473 transaction failed 29189/-22, size 80-24 line 3014 [ 2608.237695] binder: undelivered TRANSACTION_ERROR: 29189 [ 2608.391236] binder: 9517:9530 Release 1 refcount change on invalid ref 2 ret -22 [ 2608.391246] binder: 9517:9530 BC_ACQUIRE_DONE u0000000000000000 no match [ 2608.391255] binder: 9517:9530 BC_ACQUIRE_DONE u0000000000000003 no match [ 2608.391270] binder: 9517:9530 transaction failed 29189/-22, size 80-24 line 3014 [ 2608.391591] binder: undelivered TRANSACTION_ERROR: 29189 [ 2608.462607] binder: 9566:9568 Release 1 refcount change on invalid ref 2 ret -22 [ 2608.462617] binder: 9566:9568 BC_ACQUIRE_DONE u0000000000000000 no match [ 2608.462625] binder: 9566:9568 BC_ACQUIRE_DONE u0000000000000003 no match [ 2608.462638] binder: 9566:9568 transaction failed 29189/-22, size 80-24 line 3014 [ 2608.462948] binder: undelivered TRANSACTION_ERROR: 29189 [ 2608.556189] binder: 9614:9624 Release 1 refcount change on invalid ref 2 ret -22 [ 2608.556199] binder: 9614:9624 BC_ACQUIRE_DONE u0000000000000000 no match [ 2608.556207] binder: 9614:9624 BC_ACQUIRE_DONE u0000000000000003 no match [ 2608.556219] binder: 9614:9624 transaction failed 29189/-22, size 80-24 line 3014 [ 2608.556441] binder: undelivered TRANSACTION_ERROR: 29189 [ 2608.814352] binder: 9710:9721 Release 1 refcount change on invalid ref 2 ret -22 [ 2608.814362] binder: 9710:9721 BC_ACQUIRE_DONE u0000000000000000 no match [ 2608.814368] binder: 9710:9721 BC_ACQUIRE_DONE u0000000000000003 no match [ 2608.814380] binder: 9710:9721 transaction failed 29189/-22, size 80-24 line 3014 [ 2608.816802] binder: undelivered TRANSACTION_ERROR: 29189 [ 2608.928435] binder: 9756:9771 Release 1 refcount change on invalid ref 2 ret -22 [ 2608.928445] binder: 9756:9771 BC_ACQUIRE_DONE u0000000000000000 no match [ 2608.928453] binder: 9756:9771 BC_ACQUIRE_DONE u0000000000000003 no match [ 2608.928465] binder: 9756:9771 transaction failed 29189/-22, size 80-24 line 3014 [ 2608.928701] binder: undelivered TRANSACTION_ERROR: 29189 [ 2609.062759] binder: 9793:9805 Release 1 refcount change on invalid ref 2 ret -22 [ 2609.062770] binder: 9793:9805 BC_ACQUIRE_DONE u0000000000000000 no match [ 2609.062777] binder: 9793:9805 BC_ACQUIRE_DONE u0000000000000003 no match [ 2609.062790] binder: 9793:9805 transaction failed 29189/-22, size 80-24 line 3014 [ 2609.063083] binder: undelivered TRANSACTION_ERROR: 29189 [ 2609.202658] binder: 9844:9856 Release 1 refcount change on invalid ref 2 ret -22 [ 2609.202668] binder: 9844:9856 BC_ACQUIRE_DONE u0000000000000000 no match [ 2609.202676] binder: 9844:9856 BC_ACQUIRE_DONE u0000000000000003 no match [ 2609.202689] binder: 9844:9856 transaction failed 29189/-22, size 80-24 line 3014 [ 2609.202991] binder: undelivered TRANSACTION_ERROR: 29189 [ 2609.336548] binder: 9882:9886 Release 1 refcount change on invalid ref 2 ret -22 [ 2609.336559] binder: 9882:9886 BC_ACQUIRE_DONE u0000000000000000 no match [ 2609.336566] binder: 9882:9886 BC_ACQUIRE_DONE u0000000000000003 no match [ 2609.336579] binder: 9882:9886 transaction failed 29189/-22, size 80-24 line 3014 [ 2609.336819] binder: undelivered TRANSACTION_ERROR: 29189 [ 2609.446175] binder: 9915:9944 Release 1 refcount change on invalid ref 2 ret -22 [ 2609.446185] binder: 9915:9944 BC_ACQUIRE_DONE u0000000000000000 no match [ 2609.446193] binder: 9915:9944 BC_ACQUIRE_DONE u0000000000000003 no match [ 2609.446207] binder: 9915:9944 transaction failed 29189/-22, size 80-24 line 3014 [ 2609.446581] binder: undelivered TRANSACTION_ERROR: 29189 [ 2609.577553] binder: 9975:9995 Release 1 refcount change on invalid ref 2 ret -22 [ 2609.577563] binder: 9975:9995 BC_ACQUIRE_DONE u0000000000000000 no match [ 2609.577571] binder: 9975:9995 BC_ACQUIRE_DONE u0000000000000003 no match [ 2609.577603] binder: 9975:9995 transaction failed 29189/-22, size 80-24 line 3014 [ 2609.578521] binder: undelivered TRANSACTION_ERROR: 29189 [ 2609.743403] binder: 10050:10062 Release 1 refcount change on invalid ref 2 ret -22 [ 2609.743414] binder: 10050:10062 BC_ACQUIRE_DONE u0000000000000000 no match [ 2609.743423] binder: 10050:10062 BC_ACQUIRE_DONE u0000000000000003 no match [ 2609.743442] binder: 10050:10062 transaction failed 29189/-22, size 80-24 line 3014 [ 2609.743777] binder: undelivered TRANSACTION_ERROR: 29189 [ 2609.896169] binder: 10091:10114 Release 1 refcount change on invalid ref 2 ret -22 [ 2609.896180] binder: 10091:10114 BC_ACQUIRE_DONE u0000000000000000 no match [ 2609.896188] binder: 10091:10114 BC_ACQUIRE_DONE u0000000000000003 no match [ 2609.896201] binder: 10091:10114 transaction failed 29189/-22, size 80-24 line 3014 [ 2609.896500] binder: undelivered TRANSACTION_ERROR: 29189 [ 2610.057323] binder: 10171:10176 Release 1 refcount change on invalid ref 2 ret -22 [ 2610.057332] binder: 10171:10176 BC_ACQUIRE_DONE u0000000000000000 no match [ 2610.057339] binder: 10171:10176 BC_ACQUIRE_DONE u0000000000000003 no match [ 2610.057353] binder: 10171:10176 transaction failed 29189/-22, size 80-24 line 3014 [ 2610.057618] binder: undelivered TRANSACTION_ERROR: 29189 [ 2610.148983] binder: 10216:10217 Release 1 refcount change on invalid ref 2 ret -22 [ 2610.148993] binder: 10216:10217 BC_ACQUIRE_DONE u0000000000000000 no match [ 2610.149008] binder: 10216:10217 BC_ACQUIRE_DONE u0000000000000003 no match [ 2610.149022] binder: 10216:10217 transaction failed 29189/-22, size 80-24 line 3014 [ 2610.152542] binder: undelivered TRANSACTION_ERROR: 29189 [ 2610.333585] binder: 10234:10270 Release 1 refcount change on invalid ref 2 ret -22 [ 2610.333596] binder: 10234:10270 BC_ACQUIRE_DONE u0000000000000000 no match [ 2610.333603] binder: 10234:10270 BC_ACQUIRE_DONE u0000000000000003 no match [ 2610.333623] binder: 10234:10270 transaction failed 29189/-22, size 80-24 line 3014 [ 2610.333941] binder: undelivered TRANSACTION_ERROR: 29189 [ 2610.469927] binder: 10295:10332 Release 1 refcount change on invalid ref 2 ret -22 [ 2610.469937] binder: 10295:10332 BC_ACQUIRE_DONE u0000000000000000 no match [ 2610.469945] binder: 10295:10332 BC_ACQUIRE_DONE u0000000000000003 no match [ 2610.469958] binder: 10295:10332 transaction failed 29189/-22, size 80-24 line 3014 [ 2610.470262] binder: undelivered TRANSACTION_ERROR: 29189 [ 2610.561356] binder: 10357:10362 Release 1 refcount change on invalid ref 2 ret -22 [ 2610.561365] binder: 10357:10362 BC_ACQUIRE_DONE u0000000000000000 no match [ 2610.561372] binder: 10357:10362 BC_ACQUIRE_DONE u0000000000000003 no match [ 2610.561385] binder: 10357:10362 transaction failed 29189/-22, size 80-24 line 3014 [ 2610.566282] binder: undelivered TRANSACTION_ERROR: 29189 [ 2610.653729] binder: 10379:10383 Release 1 refcount change on invalid ref 2 ret -22 [ 2610.653740] binder: 10379:10383 BC_ACQUIRE_DONE u0000000000000000 no match [ 2610.653747] binder: 10379:10383 BC_ACQUIRE_DONE u0000000000000003 no match [ 2610.653760] binder: 10379:10383 transaction failed 29189/-22, size 80-24 line 3014 [ 2610.655940] binder: undelivered TRANSACTION_ERROR: 29189 [ 2610.740091] binder: 10412:10428 Release 1 refcount change on invalid ref 2 ret -22 [ 2610.740102] binder: 10412:10428 BC_ACQUIRE_DONE u0000000000000000 no match [ 2610.740110] binder: 10412:10428 BC_ACQUIRE_DONE u0000000000000003 no match [ 2610.740124] binder: 10412:10428 transaction failed 29189/-22, size 80-24 line 3014 [ 2610.740492] binder: undelivered TRANSACTION_ERROR: 29189 [ 2610.819479] binder: 10460:10468 Release 1 refcount change on invalid ref 2 ret -22 [ 2610.819489] binder: 10460:10468 BC_ACQUIRE_DONE u0000000000000000 no match [ 2610.819496] binder: 10460:10468 BC_ACQUIRE_DONE u0000000000000003 no match [ 2610.819509] binder: 10460:10468 transaction failed 29189/-22, size 80-24 line 3014 [ 2610.826193] binder: undelivered TRANSACTION_ERROR: 29189 [ 2610.912272] binder: 10488:10495 Release 1 refcount change on invalid ref 2 ret -22 [ 2610.912282] binder: 10488:10495 BC_ACQUIRE_DONE u0000000000000000 no match [ 2610.912290] binder: 10488:10495 BC_ACQUIRE_DONE u0000000000000003 no match [ 2610.912304] binder: 10488:10495 transaction failed 29189/-22, size 80-24 line 3014 [ 2610.912587] binder: undelivered TRANSACTION_ERROR: 29189 [ 2611.041783] binder: 10534:10557 Release 1 refcount change on invalid ref 2 ret -22 [ 2611.041794] binder: 10534:10557 BC_ACQUIRE_DONE u0000000000000000 no match [ 2611.041801] binder: 10534:10557 BC_ACQUIRE_DONE u0000000000000003 no match [ 2611.041814] binder: 10534:10557 transaction failed 29189/-22, size 80-24 line 3014 [ 2611.042062] binder: undelivered TRANSACTION_ERROR: 29189 [ 2611.130273] binder: 10595:10609 Release 1 refcount change on invalid ref 2 ret -22 [ 2611.130283] binder: 10595:10609 BC_ACQUIRE_DONE u0000000000000000 no match [ 2611.130290] binder: 10595:10609 BC_ACQUIRE_DONE u0000000000000003 no match [ 2611.130303] binder: 10595:10609 transaction failed 29189/-22, size 80-24 line 3014 [ 2611.130710] binder: undelivered TRANSACTION_ERROR: 29189 [ 2611.229032] binder: 10620:10630 Release 1 refcount change on invalid ref 2 ret -22 [ 2611.229042] binder: 10620:10630 BC_ACQUIRE_DONE u0000000000000000 no match [ 2611.229050] binder: 10620:10630 BC_ACQUIRE_DONE u0000000000000003 no match [ 2611.229063] binder: 10620:10630 transaction failed 29189/-22, size 80-24 line 3014 [ 2611.229456] binder: undelivered TRANSACTION_ERROR: 29189 [ 2611.328789] binder: 10644:10655 Release 1 refcount change on invalid ref 2 ret -22 [ 2611.328799] binder: 10644:10655 BC_ACQUIRE_DONE u0000000000000000 no match [ 2611.328807] binder: 10644:10655 BC_ACQUIRE_DONE u0000000000000003 no match [ 2611.328820] binder: 10644:10655 transaction failed 29189/-22, size 80-24 line 3014 [ 2611.329067] binder: undelivered TRANSACTION_ERROR: 29189 [ 2611.429541] binder: 10694:10713 Release 1 refcount change on invalid ref 2 ret -22 [ 2611.429552] binder: 10694:10713 BC_ACQUIRE_DONE u0000000000000000 no match [ 2611.429560] binder: 10694:10713 BC_ACQUIRE_DONE u0000000000000003 no match [ 2611.429572] binder: 10694:10713 transaction failed 29189/-22, size 80-24 line 3014 [ 2611.430427] binder: undelivered TRANSACTION_ERROR: 29189 [ 2611.540574] binder: 10737:10745 Release 1 refcount change on invalid ref 2 ret -22 [ 2611.540585] binder: 10737:10745 BC_ACQUIRE_DONE u0000000000000000 no match [ 2611.540593] binder: 10737:10745 BC_ACQUIRE_DONE u0000000000000003 no match [ 2611.540605] binder: 10737:10745 transaction failed 29189/-22, size 80-24 line 3014 [ 2611.540900] binder: undelivered TRANSACTION_ERROR: 29189 [ 2611.689559] binder: 10791:10804 Release 1 refcount change on invalid ref 2 ret -22 [ 2611.689570] binder: 10791:10804 BC_ACQUIRE_DONE u0000000000000000 no match [ 2611.689578] binder: 10791:10804 BC_ACQUIRE_DONE u0000000000000003 no match [ 2611.689591] binder: 10791:10804 transaction failed 29189/-22, size 80-24 line 3014 [ 2611.689845] binder: undelivered TRANSACTION_ERROR: 29189 [ 2611.800017] binder: 10819:10832 Release 1 refcount change on invalid ref 2 ret -22 [ 2611.800028] binder: 10819:10832 BC_ACQUIRE_DONE u0000000000000000 no match [ 2611.800036] binder: 10819:10832 BC_ACQUIRE_DONE u0000000000000003 no match [ 2611.800048] binder: 10819:10832 transaction failed 29189/-22, size 80-24 line 3014 [ 2611.800474] binder: undelivered TRANSACTION_ERROR: 29189 [ 2611.940102] binder: 10878:10890 Release 1 refcount change on invalid ref 2 ret -22 [ 2611.940113] binder: 10878:10890 BC_ACQUIRE_DONE u0000000000000000 no match [ 2611.940121] binder: 10878:10890 BC_ACQUIRE_DONE u0000000000000003 no match [ 2611.940133] binder: 10878:10890 transaction failed 29189/-22, size 80-24 line 3014 [ 2611.944091] binder: undelivered TRANSACTION_ERROR: 29189 [ 2612.049993] binder: 10922:10931 Release 1 refcount change on invalid ref 2 ret -22 [ 2612.050014] binder: 10922:10931 BC_ACQUIRE_DONE u0000000000000000 no match [ 2612.050021] binder: 10922:10931 BC_ACQUIRE_DONE u0000000000000003 no match [ 2612.050033] binder: 10922:10931 transaction failed 29189/-22, size 80-24 line 3014 [ 2612.051319] binder: undelivered TRANSACTION_ERROR: 29189 18:07:18 executing program 2: ioctl$FS_IOC_RESVSP(0xffffffffffffffff, 0x40305828, &(0x7f00000000c0)={0x0, 0x0, 0x100000000000001}) clone(0x2102001fff, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) socket(0x0, 0x0, 0x0) r0 = getpid() rt_tgsigqueueinfo(0x0, r0, 0x16, &(0x7f0000000100)) ptrace(0x10, r0) ptrace$poke(0x4209, r0, &(0x7f00000000c0), 0x70effd) 18:07:18 executing program 3: r0 = socket(0x10, 0x3, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") ioctl$sock_ifreq(r0, 0x89f3, &(0x7f0000000240)={'sit0\x00'}) 18:07:18 executing program 4: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000040)='/dev/net/tun\x00', 0x0, 0x0) r1 = epoll_create1(0x0) epoll_ctl$EPOLL_CTL_ADD(0xffffffffffffffff, 0x1, r0, &(0x7f0000000100)) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000080)={'tunl0\x00', 0x1}) epoll_wait(r1, &(0x7f00000000c0)=[{}], 0x1, 0x0) 18:07:18 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000006c0)={0x118, 0x0, &(0x7f0000000540)=[@release={0x40046306, 0x2}, @acquire_done, @acquire_done={0x40106309, 0x3}, @transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x50, 0x18, &(0x7f0000000080)={@flat=@binder={0x73622a85, 0xa, 0x1}, @fda={0x66646185, 0xa, 0x1, 0x9}, @fd={0x66642a85, 0x0, r1}}, &(0x7f0000000100)={0x0, 0x18, 0x38}}, 0x1000}, @transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000180)={@ptr={0x70742a85, 0x0, &(0x7f0000000140)=""/51, 0x33, 0x2, 0x25}, @flat=@weak_handle={0x77682a85, 0x1}, @flat=@binder={0x73622a85, 0xa, 0x3}}, &(0x7f0000000280)={0x0, 0x28, 0x40}}, 0x1f8aed83e3349436}, @exit_looper, @transaction_sg={0x40486311, {0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x68, 0x18, &(0x7f0000000480)={@ptr={0x70742a85, 0x0, &(0x7f00000002c0)=""/11, 0xb, 0x2, 0x3f}, @fd={0x66642a85, 0x0, r0}, @ptr={0x70742a85, 0x0, &(0x7f0000000380)=""/70, 0x46, 0x1, 0x1f}}, &(0x7f0000000500)={0x0, 0x28, 0x40}}, 0x1000}], 0x14, 0x0, &(0x7f0000000680)="86621f50fcee8bdc5bf8c503a78812261b4bf6d7"}) 18:07:18 executing program 1: clone(0x2102001fff, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) socket(0x0, 0x0, 0x0) r0 = getpid() rt_tgsigqueueinfo(0x0, r0, 0x16, &(0x7f0000000100)) rt_sigqueueinfo(r0, 0x7, &(0x7f0000000180)={0x0, 0x0, 0xffffffff}) 18:07:18 executing program 5: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000001a00)='/dev/net/tun\x00', 0x0, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000080)="c0dc00025e0b01047be070") ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000300)={'nr0\x01\x00', 0x1132}) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000001a00)='/dev/net/tun\x00', 0x2, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000300)={'nr0\x01\x00', 0x1132}) write$cgroup_int(0xffffffffffffffff, &(0x7f00000000c0)=0x2, 0xfffffffffffffe75) close(r1) [ 2612.268911] binder: 10960:11044 Release 1 refcount change on invalid ref 2 ret -22 [ 2612.268922] binder: 10960:11044 BC_ACQUIRE_DONE u0000000000000000 no match [ 2612.268930] binder: 10960:11044 BC_ACQUIRE_DONE u0000000000000003 no match [ 2612.268943] binder: 10960:11044 transaction failed 29189/-22, size 80-24 line 3014 [ 2612.269627] binder: undelivered TRANSACTION_ERROR: 29189 [ 2612.391228] binder: 11063:11066 Release 1 refcount change on invalid ref 2 ret -22 [ 2612.391238] binder: 11063:11066 BC_ACQUIRE_DONE u0000000000000000 no match [ 2612.391246] binder: 11063:11066 BC_ACQUIRE_DONE u0000000000000003 no match [ 2612.391259] binder: 11063:11066 transaction failed 29189/-22, size 80-24 line 3014 18:07:18 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000006c0)={0x118, 0x0, &(0x7f0000000540)=[@release={0x40046306, 0x2}, @acquire_done, @acquire_done={0x40106309, 0x3}, @transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x50, 0x18, &(0x7f0000000080)={@flat=@binder={0x73622a85, 0xa, 0x1}, @fda={0x66646185, 0xa, 0x1, 0x9}, @fd={0x66642a85, 0x0, r1}}, &(0x7f0000000100)={0x0, 0x18, 0x38}}, 0x1000}, @transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000180)={@ptr={0x70742a85, 0x0, &(0x7f0000000140)=""/51, 0x33, 0x2, 0x25}, @flat=@weak_handle={0x77682a85, 0x1}, @flat=@binder={0x73622a85, 0xa, 0x3}}, &(0x7f0000000280)={0x0, 0x28, 0x40}}, 0x1f8aed83e3349436}, @exit_looper, @transaction_sg={0x40486311, {0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x68, 0x18, &(0x7f0000000480)={@ptr={0x70742a85, 0x0, &(0x7f00000002c0)=""/11, 0xb, 0x2, 0x3f}, @fd={0x66642a85, 0x0, r0}, @ptr={0x70742a85, 0x0, &(0x7f0000000380)=""/70, 0x46, 0x1, 0x1f}}, &(0x7f0000000500)={0x0, 0x28, 0x40}}, 0x1000}], 0x14, 0x0, &(0x7f0000000680)="86621f50fcee8bdc5bf8c503a78812261b4bf6d7"}) 18:07:18 executing program 3: r0 = socket(0x10, 0x3, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") ioctl$sock_ifreq(r0, 0x89f3, &(0x7f0000000240)={'sit0\x00'}) [ 2612.391578] binder: undelivered TRANSACTION_ERROR: 29189 18:07:18 executing program 1: clone(0x2102001fff, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) socket(0x0, 0x0, 0x0) r0 = getpid() rt_tgsigqueueinfo(0x0, r0, 0x16, &(0x7f0000000100)) rt_sigqueueinfo(r0, 0x7, &(0x7f0000000180)={0x0, 0x0, 0xffffffff}) 18:07:18 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000006c0)={0x118, 0x0, &(0x7f0000000540)=[@release={0x40046306, 0x2}, @acquire_done, @acquire_done={0x40106309, 0x3}, @transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x50, 0x18, &(0x7f0000000080)={@flat=@binder={0x73622a85, 0xa, 0x1}, @fda={0x66646185, 0xa, 0x1, 0x9}, @fd={0x66642a85, 0x0, r1}}, &(0x7f0000000100)={0x0, 0x18, 0x38}}, 0x1000}, @transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000180)={@ptr={0x70742a85, 0x0, &(0x7f0000000140)=""/51, 0x33, 0x2, 0x25}, @flat=@weak_handle={0x77682a85, 0x1}, @flat=@binder={0x73622a85, 0xa, 0x3}}, &(0x7f0000000280)={0x0, 0x28, 0x40}}, 0x1f8aed83e3349436}, @exit_looper, @transaction_sg={0x40486311, {0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x68, 0x18, &(0x7f0000000480)={@ptr={0x70742a85, 0x0, &(0x7f00000002c0)=""/11, 0xb, 0x2, 0x3f}, @fd={0x66642a85, 0x0, r0}, @ptr={0x70742a85, 0x0, &(0x7f0000000380)=""/70, 0x46, 0x1, 0x1f}}, &(0x7f0000000500)={0x0, 0x28, 0x40}}, 0x1000}], 0x14, 0x0, &(0x7f0000000680)="86621f50fcee8bdc5bf8c503a78812261b4bf6d7"}) [ 2612.488816] binder: 11101:11113 Release 1 refcount change on invalid ref 2 ret -22 [ 2612.488826] binder: 11101:11113 BC_ACQUIRE_DONE u0000000000000000 no match 18:07:18 executing program 4: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000040)='/dev/net/tun\x00', 0x0, 0x0) r1 = epoll_create1(0x0) epoll_ctl$EPOLL_CTL_ADD(0xffffffffffffffff, 0x1, r0, &(0x7f0000000100)) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000080)={'tunl0\x00', 0x1}) epoll_wait(r1, &(0x7f00000000c0)=[{}], 0x1, 0x0) [ 2612.488834] binder: 11101:11113 BC_ACQUIRE_DONE u0000000000000003 no match 18:07:18 executing program 3: r0 = socket(0x10, 0x3, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") ioctl$sock_ifreq(r0, 0x89f3, &(0x7f0000000240)={'sit0\x00'}) [ 2612.488847] binder: 11101:11113 transaction failed 29189/-22, size 80-24 line 3014 18:07:18 executing program 2: ioctl$FS_IOC_RESVSP(0xffffffffffffffff, 0x40305828, &(0x7f00000000c0)={0x0, 0x0, 0x100000000000001}) clone(0x2102001fff, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) socket(0x0, 0x0, 0x0) r0 = getpid() rt_tgsigqueueinfo(0x0, r0, 0x16, &(0x7f0000000100)) ptrace(0x10, r0) ptrace$poke(0x4209, r0, &(0x7f00000000c0), 0x70effd) 18:07:18 executing program 5: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000001a00)='/dev/net/tun\x00', 0x0, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000080)="c0dc00025e0b01047be070") ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000300)={'nr0\x01\x00', 0x1132}) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000001a00)='/dev/net/tun\x00', 0x2, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000300)={'nr0\x01\x00', 0x1132}) write$cgroup_int(0xffffffffffffffff, &(0x7f00000000c0)=0x2, 0xfffffffffffffe75) close(r1) 18:07:18 executing program 1: clone(0x2102001fff, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) socket(0x0, 0x0, 0x0) r0 = getpid() rt_tgsigqueueinfo(0x0, r0, 0x16, &(0x7f0000000100)) rt_sigqueueinfo(r0, 0x7, &(0x7f0000000180)={0x0, 0x0, 0xffffffff}) 18:07:18 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000006c0)={0x118, 0x0, &(0x7f0000000540)=[@release={0x40046306, 0x2}, @acquire_done, @acquire_done={0x40106309, 0x3}, @transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x50, 0x18, &(0x7f0000000080)={@flat=@binder={0x73622a85, 0xa, 0x1}, @fda={0x66646185, 0xa, 0x1, 0x9}, @fd={0x66642a85, 0x0, r1}}, &(0x7f0000000100)={0x0, 0x18, 0x38}}, 0x1000}, @transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000180)={@ptr={0x70742a85, 0x0, &(0x7f0000000140)=""/51, 0x33, 0x2, 0x25}, @flat=@weak_handle={0x77682a85, 0x1}, @flat=@binder={0x73622a85, 0xa, 0x3}}, &(0x7f0000000280)={0x0, 0x28, 0x40}}, 0x1f8aed83e3349436}, @exit_looper, @transaction_sg={0x40486311, {0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x68, 0x18, &(0x7f0000000480)={@ptr={0x70742a85, 0x0, &(0x7f00000002c0)=""/11, 0xb, 0x2, 0x3f}, @fd={0x66642a85, 0x0, r0}, @ptr={0x70742a85, 0x0, &(0x7f0000000380)=""/70, 0x46, 0x1, 0x1f}}, &(0x7f0000000500)={0x0, 0x28, 0x40}}, 0x1000}], 0x14, 0x0, &(0x7f0000000680)="86621f50fcee8bdc5bf8c503a78812261b4bf6d7"}) 18:07:18 executing program 3: r0 = socket(0x10, 0x3, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") ioctl$sock_ifreq(r0, 0x89f3, &(0x7f0000000240)={'sit0\x00'}) [ 2612.489139] binder: undelivered TRANSACTION_ERROR: 29189 [ 2612.638445] binder: 11144:11168 Release 1 refcount change on invalid ref 2 ret -22 18:07:18 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000006c0)={0x118, 0x0, &(0x7f0000000540)=[@release={0x40046306, 0x2}, @acquire_done, @acquire_done={0x40106309, 0x3}, @transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x50, 0x18, &(0x7f0000000080)={@flat=@binder={0x73622a85, 0xa, 0x1}, @fda={0x66646185, 0xa, 0x1, 0x9}, @fd={0x66642a85, 0x0, r1}}, &(0x7f0000000100)={0x0, 0x18, 0x38}}, 0x1000}, @transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000180)={@ptr={0x70742a85, 0x0, &(0x7f0000000140)=""/51, 0x33, 0x2, 0x25}, @flat=@weak_handle={0x77682a85, 0x1}, @flat=@binder={0x73622a85, 0xa, 0x3}}, &(0x7f0000000280)={0x0, 0x28, 0x40}}, 0x1f8aed83e3349436}, @exit_looper, @transaction_sg={0x40486311, {0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x68, 0x18, &(0x7f0000000480)={@ptr={0x70742a85, 0x0, &(0x7f00000002c0)=""/11, 0xb, 0x2, 0x3f}, @fd={0x66642a85, 0x0, r0}, @ptr={0x70742a85, 0x0, &(0x7f0000000380)=""/70, 0x46, 0x1, 0x1f}}, &(0x7f0000000500)={0x0, 0x28, 0x40}}, 0x1000}], 0x14, 0x0, &(0x7f0000000680)="86621f50fcee8bdc5bf8c503a78812261b4bf6d7"}) [ 2612.638455] binder: 11144:11168 BC_ACQUIRE_DONE u0000000000000000 no match [ 2612.638463] binder: 11144:11168 BC_ACQUIRE_DONE u0000000000000003 no match 18:07:18 executing program 4: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000040)='/dev/net/tun\x00', 0x0, 0x0) r1 = epoll_create1(0x0) epoll_ctl$EPOLL_CTL_ADD(0xffffffffffffffff, 0x1, r0, &(0x7f0000000100)) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000080)={'tunl0\x00', 0x1}) epoll_wait(r1, &(0x7f00000000c0)=[{}], 0x1, 0x0) 18:07:18 executing program 3: r0 = socket(0x10, 0x3, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") ioctl$sock_ifreq(r0, 0x89f3, &(0x7f0000000240)={'sit0\x00'}) 18:07:19 executing program 1: clone(0x2102001fff, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) socket(0x0, 0x0, 0x0) r0 = getpid() rt_tgsigqueueinfo(0x0, r0, 0x16, &(0x7f0000000100)) rt_sigqueueinfo(r0, 0x7, &(0x7f0000000180)={0x0, 0x0, 0xffffffff}) 18:07:19 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000006c0)={0x118, 0x0, &(0x7f0000000540)=[@release={0x40046306, 0x2}, @acquire_done, @acquire_done={0x40106309, 0x3}, @transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x50, 0x18, &(0x7f0000000080)={@flat=@binder={0x73622a85, 0xa, 0x1}, @fda={0x66646185, 0xa, 0x1, 0x9}, @fd={0x66642a85, 0x0, r1}}, &(0x7f0000000100)={0x0, 0x18, 0x38}}, 0x1000}, @transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000180)={@ptr={0x70742a85, 0x0, &(0x7f0000000140)=""/51, 0x33, 0x2, 0x25}, @flat=@weak_handle={0x77682a85, 0x1}, @flat=@binder={0x73622a85, 0xa, 0x3}}, &(0x7f0000000280)={0x0, 0x28, 0x40}}, 0x1f8aed83e3349436}, @exit_looper, @transaction_sg={0x40486311, {0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x68, 0x18, &(0x7f0000000480)={@ptr={0x70742a85, 0x0, &(0x7f00000002c0)=""/11, 0xb, 0x2, 0x3f}, @fd={0x66642a85, 0x0, r0}, @ptr={0x70742a85, 0x0, &(0x7f0000000380)=""/70, 0x46, 0x1, 0x1f}}, &(0x7f0000000500)={0x0, 0x28, 0x40}}, 0x1000}], 0x14, 0x0, &(0x7f0000000680)="86621f50fcee8bdc5bf8c503a78812261b4bf6d7"}) [ 2612.638476] binder: 11144:11168 transaction failed 29189/-22, size 80-24 line 3014 [ 2612.638821] binder: undelivered TRANSACTION_ERROR: 29189 18:07:19 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000006c0)={0x118, 0x0, &(0x7f0000000540)=[@release={0x40046306, 0x2}, @acquire_done, @acquire_done={0x40106309, 0x3}, @transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x50, 0x18, &(0x7f0000000080)={@flat=@binder={0x73622a85, 0xa, 0x1}, @fda={0x66646185, 0xa, 0x1, 0x9}, @fd={0x66642a85, 0x0, r1}}, &(0x7f0000000100)={0x0, 0x18, 0x38}}, 0x1000}, @transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000180)={@ptr={0x70742a85, 0x0, &(0x7f0000000140)=""/51, 0x33, 0x2, 0x25}, @flat=@weak_handle={0x77682a85, 0x1}, @flat=@binder={0x73622a85, 0xa, 0x3}}, &(0x7f0000000280)={0x0, 0x28, 0x40}}, 0x1f8aed83e3349436}, @exit_looper, @transaction_sg={0x40486311, {0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x68, 0x18, &(0x7f0000000480)={@ptr={0x70742a85, 0x0, &(0x7f00000002c0)=""/11, 0xb, 0x2, 0x3f}, @fd={0x66642a85, 0x0, r0}, @ptr={0x70742a85, 0x0, &(0x7f0000000380)=""/70, 0x46, 0x1, 0x1f}}, &(0x7f0000000500)={0x0, 0x28, 0x40}}, 0x1000}], 0x14, 0x0, &(0x7f0000000680)="86621f50fcee8bdc5bf8c503a78812261b4bf6d7"}) 18:07:19 executing program 1: clone(0x2102001fff, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) socket(0x0, 0x0, 0x0) r0 = getpid() rt_tgsigqueueinfo(0x0, r0, 0x16, &(0x7f0000000100)) rt_sigqueueinfo(r0, 0x7, &(0x7f0000000180)={0x0, 0x0, 0xffffffff}) 18:07:19 executing program 2: ioctl$FS_IOC_RESVSP(0xffffffffffffffff, 0x40305828, &(0x7f00000000c0)={0x0, 0x0, 0x100000000000001}) clone(0x2102001fff, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) socket(0x0, 0x0, 0x0) r0 = getpid() rt_tgsigqueueinfo(0x0, r0, 0x16, &(0x7f0000000100)) ptrace(0x10, r0) ptrace$poke(0x4209, r0, &(0x7f00000000c0), 0x70effd) [ 2612.885802] binder: 11244:11260 Release 1 refcount change on invalid ref 2 ret -22 18:07:19 executing program 5: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000001a00)='/dev/net/tun\x00', 0x0, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000080)="c0dc00025e0b01047be070") ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000300)={'nr0\x01\x00', 0x1132}) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000001a00)='/dev/net/tun\x00', 0x2, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000300)={'nr0\x01\x00', 0x1132}) write$cgroup_int(0xffffffffffffffff, &(0x7f00000000c0)=0x2, 0xfffffffffffffe75) close(r1) [ 2612.885813] binder: 11244:11260 BC_ACQUIRE_DONE u0000000000000000 no match [ 2612.885821] binder: 11244:11260 BC_ACQUIRE_DONE u0000000000000003 no match 18:07:19 executing program 3: r0 = socket(0x10, 0x3, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") ioctl$sock_ifreq(r0, 0x89f3, &(0x7f0000000240)={'sit0\x00'}) 18:07:19 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000006c0)={0x118, 0x0, &(0x7f0000000540)=[@release={0x40046306, 0x2}, @acquire_done, @acquire_done={0x40106309, 0x3}, @transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x50, 0x18, &(0x7f0000000080)={@flat=@binder={0x73622a85, 0xa, 0x1}, @fda={0x66646185, 0xa, 0x1, 0x9}, @fd={0x66642a85, 0x0, r1}}, &(0x7f0000000100)={0x0, 0x18, 0x38}}, 0x1000}, @transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000180)={@ptr={0x70742a85, 0x0, &(0x7f0000000140)=""/51, 0x33, 0x2, 0x25}, @flat=@weak_handle={0x77682a85, 0x1}, @flat=@binder={0x73622a85, 0xa, 0x3}}, &(0x7f0000000280)={0x0, 0x28, 0x40}}, 0x1f8aed83e3349436}, @exit_looper, @transaction_sg={0x40486311, {0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x68, 0x18, &(0x7f0000000480)={@ptr={0x70742a85, 0x0, &(0x7f00000002c0)=""/11, 0xb, 0x2, 0x3f}, @fd={0x66642a85, 0x0, r0}, @ptr={0x70742a85, 0x0, &(0x7f0000000380)=""/70, 0x46, 0x1, 0x1f}}, &(0x7f0000000500)={0x0, 0x28, 0x40}}, 0x1000}], 0x14, 0x0, &(0x7f0000000680)="86621f50fcee8bdc5bf8c503a78812261b4bf6d7"}) 18:07:19 executing program 1: clone(0x2102001fff, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) socket(0x0, 0x0, 0x0) r0 = getpid() rt_tgsigqueueinfo(0x0, r0, 0x16, &(0x7f0000000100)) rt_sigqueueinfo(r0, 0x7, &(0x7f0000000180)={0x0, 0x0, 0xffffffff}) [ 2612.885836] binder: 11244:11260 transaction failed 29189/-22, size 80-24 line 3014 18:07:19 executing program 3: r0 = socket(0x10, 0x3, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") ioctl$sock_ifreq(r0, 0x89f3, &(0x7f0000000240)={'sit0\x00'}) 18:07:19 executing program 4: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000040)='/dev/net/tun\x00', 0x0, 0x0) r1 = epoll_create1(0x0) epoll_ctl$EPOLL_CTL_ADD(0xffffffffffffffff, 0x1, r0, &(0x7f0000000100)) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000080)={'tunl0\x00', 0x1}) epoll_wait(r1, &(0x7f00000000c0)=[{}], 0x1, 0x0) [ 2612.889012] binder: undelivered TRANSACTION_ERROR: 29189 18:07:19 executing program 3: r0 = socket(0x10, 0x3, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") ioctl$sock_ifreq(r0, 0x89f3, &(0x7f0000000240)={'sit0\x00'}) 18:07:19 executing program 1: clone(0x2102001fff, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) socket(0x0, 0x0, 0x0) r0 = getpid() rt_tgsigqueueinfo(0x0, r0, 0x16, &(0x7f0000000100)) rt_sigqueueinfo(r0, 0x7, &(0x7f0000000180)={0x0, 0x0, 0xffffffff}) [ 2613.003103] binder: 11303:11327 Release 1 refcount change on invalid ref 2 ret -22 18:07:19 executing program 2: ioctl$FS_IOC_RESVSP(0xffffffffffffffff, 0x40305828, &(0x7f00000000c0)={0x0, 0x0, 0x100000000000001}) clone(0x2102001fff, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) socket(0x0, 0x0, 0x0) r0 = getpid() rt_tgsigqueueinfo(0x0, r0, 0x16, &(0x7f0000000100)) ptrace(0x10, r0) ptrace$poke(0x4209, r0, &(0x7f00000000c0), 0x70effd) 18:07:19 executing program 5: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000001a00)='/dev/net/tun\x00', 0x0, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000080)="c0dc00025e0b01047be070") ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000300)={'nr0\x01\x00', 0x1132}) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000001a00)='/dev/net/tun\x00', 0x2, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000300)={'nr0\x01\x00', 0x1132}) write$cgroup_int(0xffffffffffffffff, &(0x7f00000000c0)=0x2, 0xfffffffffffffe75) close(r1) [ 2613.003113] binder: 11303:11327 BC_ACQUIRE_DONE u0000000000000000 no match 18:07:19 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000006c0)={0x118, 0x0, &(0x7f0000000540)=[@release={0x40046306, 0x2}, @acquire_done, @acquire_done={0x40106309, 0x3}, @transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x50, 0x18, &(0x7f0000000080)={@flat=@binder={0x73622a85, 0xa, 0x1}, @fda={0x66646185, 0xa, 0x1, 0x9}, @fd={0x66642a85, 0x0, r1}}, &(0x7f0000000100)={0x0, 0x18, 0x38}}, 0x1000}, @transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000180)={@ptr={0x70742a85, 0x0, &(0x7f0000000140)=""/51, 0x33, 0x2, 0x25}, @flat=@weak_handle={0x77682a85, 0x1}, @flat=@binder={0x73622a85, 0xa, 0x3}}, &(0x7f0000000280)={0x0, 0x28, 0x40}}, 0x1f8aed83e3349436}, @exit_looper, @transaction_sg={0x40486311, {0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x68, 0x18, &(0x7f0000000480)={@ptr={0x70742a85, 0x0, &(0x7f00000002c0)=""/11, 0xb, 0x2, 0x3f}, @fd={0x66642a85, 0x0, r0}, @ptr={0x70742a85, 0x0, &(0x7f0000000380)=""/70, 0x46, 0x1, 0x1f}}, &(0x7f0000000500)={0x0, 0x28, 0x40}}, 0x1000}], 0x14, 0x0, &(0x7f0000000680)="86621f50fcee8bdc5bf8c503a78812261b4bf6d7"}) 18:07:19 executing program 3: r0 = socket(0x10, 0x3, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") ioctl$sock_ifreq(r0, 0x89f3, &(0x7f0000000240)={'sit0\x00'}) [ 2613.003120] binder: 11303:11327 BC_ACQUIRE_DONE u0000000000000003 no match [ 2613.003134] binder: 11303:11327 transaction failed 29189/-22, size 80-24 line 3014 18:07:19 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000006c0)={0x118, 0x0, &(0x7f0000000540)=[@release={0x40046306, 0x2}, @acquire_done, @acquire_done={0x40106309, 0x3}, @transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x50, 0x18, &(0x7f0000000080)={@flat=@binder={0x73622a85, 0xa, 0x1}, @fda={0x66646185, 0xa, 0x1, 0x9}, @fd={0x66642a85, 0x0, r1}}, &(0x7f0000000100)={0x0, 0x18, 0x38}}, 0x1000}, @transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000180)={@ptr={0x70742a85, 0x0, &(0x7f0000000140)=""/51, 0x33, 0x2, 0x25}, @flat=@weak_handle={0x77682a85, 0x1}, @flat=@binder={0x73622a85, 0xa, 0x3}}, &(0x7f0000000280)={0x0, 0x28, 0x40}}, 0x1f8aed83e3349436}, @exit_looper, @transaction_sg={0x40486311, {0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x68, 0x18, &(0x7f0000000480)={@ptr={0x70742a85, 0x0, &(0x7f00000002c0)=""/11, 0xb, 0x2, 0x3f}, @fd={0x66642a85, 0x0, r0}, @ptr={0x70742a85, 0x0, &(0x7f0000000380)=""/70, 0x46, 0x1, 0x1f}}, &(0x7f0000000500)={0x0, 0x28, 0x40}}, 0x1000}], 0x14, 0x0, &(0x7f0000000680)="86621f50fcee8bdc5bf8c503a78812261b4bf6d7"}) 18:07:19 executing program 4: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000040)='/dev/net/tun\x00', 0x0, 0x0) r1 = epoll_create1(0x0) epoll_ctl$EPOLL_CTL_ADD(0xffffffffffffffff, 0x1, r0, &(0x7f0000000100)) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000080)={'tunl0\x00', 0x1}) epoll_wait(r1, &(0x7f00000000c0)=[{}], 0x1, 0x0) 18:07:19 executing program 3: r0 = socket(0x10, 0x3, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") ioctl$sock_ifreq(r0, 0x89f3, &(0x7f0000000240)={'sit0\x00'}) [ 2613.003440] binder: undelivered TRANSACTION_ERROR: 29189 [ 2613.093242] binder: 11347:11355 Release 1 refcount change on invalid ref 2 ret -22 18:07:19 executing program 3: r0 = socket(0x10, 0x3, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") ioctl$sock_ifreq(r0, 0x89f3, &(0x7f0000000240)={'sit0\x00'}) [ 2613.093252] binder: 11347:11355 BC_ACQUIRE_DONE u0000000000000000 no match 18:07:19 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000006c0)={0x118, 0x0, &(0x7f0000000540)=[@release={0x40046306, 0x2}, @acquire_done, @acquire_done={0x40106309, 0x3}, @transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x50, 0x18, &(0x7f0000000080)={@flat=@binder={0x73622a85, 0xa, 0x1}, @fda={0x66646185, 0xa, 0x1, 0x9}, @fd={0x66642a85, 0x0, r1}}, &(0x7f0000000100)={0x0, 0x18, 0x38}}, 0x1000}, @transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000180)={@ptr={0x70742a85, 0x0, &(0x7f0000000140)=""/51, 0x33, 0x2, 0x25}, @flat=@weak_handle={0x77682a85, 0x1}, @flat=@binder={0x73622a85, 0xa, 0x3}}, &(0x7f0000000280)={0x0, 0x28, 0x40}}, 0x1f8aed83e3349436}, @exit_looper, @transaction_sg={0x40486311, {0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x68, 0x18, &(0x7f0000000480)={@ptr={0x70742a85, 0x0, &(0x7f00000002c0)=""/11, 0xb, 0x2, 0x3f}, @fd={0x66642a85, 0x0, r0}, @ptr={0x70742a85, 0x0, &(0x7f0000000380)=""/70, 0x46, 0x1, 0x1f}}, &(0x7f0000000500)={0x0, 0x28, 0x40}}, 0x1000}], 0x14, 0x0, &(0x7f0000000680)="86621f50fcee8bdc5bf8c503a78812261b4bf6d7"}) 18:07:19 executing program 1: clone(0x2102001fff, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) socket(0x0, 0x0, 0x0) r0 = getpid() rt_tgsigqueueinfo(0x0, r0, 0x16, &(0x7f0000000100)) rt_sigqueueinfo(r0, 0x7, &(0x7f0000000180)={0x0, 0x0, 0xffffffff}) 18:07:19 executing program 2: ioctl$FS_IOC_RESVSP(0xffffffffffffffff, 0x40305828, &(0x7f00000000c0)={0x0, 0x0, 0x100000000000001}) clone(0x2102001fff, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) socket(0x0, 0x0, 0x0) r0 = getpid() rt_tgsigqueueinfo(0x0, r0, 0x16, &(0x7f0000000100)) ptrace(0x10, r0) ptrace$poke(0x4209, r0, &(0x7f00000000c0), 0x70effd) 18:07:19 executing program 5: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000001a00)='/dev/net/tun\x00', 0x0, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000080)="c0dc00025e0b01047be070") ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000300)={'nr0\x01\x00', 0x1132}) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000001a00)='/dev/net/tun\x00', 0x2, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000300)={'nr0\x01\x00', 0x1132}) write$cgroup_int(0xffffffffffffffff, &(0x7f00000000c0)=0x2, 0xfffffffffffffe75) close(r1) [ 2613.093259] binder: 11347:11355 BC_ACQUIRE_DONE u0000000000000003 no match 18:07:19 executing program 3: r0 = socket(0x10, 0x3, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") ioctl$sock_ifreq(r0, 0x89f3, &(0x7f0000000240)={'sit0\x00'}) [ 2613.093272] binder: 11347:11355 transaction failed 29189/-22, size 80-24 line 3014 18:07:19 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000006c0)={0x118, 0x0, &(0x7f0000000540)=[@release={0x40046306, 0x2}, @acquire_done, @acquire_done={0x40106309, 0x3}, @transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x50, 0x18, &(0x7f0000000080)={@flat=@binder={0x73622a85, 0xa, 0x1}, @fda={0x66646185, 0xa, 0x1, 0x9}, @fd={0x66642a85, 0x0, r1}}, &(0x7f0000000100)={0x0, 0x18, 0x38}}, 0x1000}, @transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000180)={@ptr={0x70742a85, 0x0, &(0x7f0000000140)=""/51, 0x33, 0x2, 0x25}, @flat=@weak_handle={0x77682a85, 0x1}, @flat=@binder={0x73622a85, 0xa, 0x3}}, &(0x7f0000000280)={0x0, 0x28, 0x40}}, 0x1f8aed83e3349436}, @exit_looper, @transaction_sg={0x40486311, {0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x68, 0x18, &(0x7f0000000480)={@ptr={0x70742a85, 0x0, &(0x7f00000002c0)=""/11, 0xb, 0x2, 0x3f}, @fd={0x66642a85, 0x0, r0}, @ptr={0x70742a85, 0x0, &(0x7f0000000380)=""/70, 0x46, 0x1, 0x1f}}, &(0x7f0000000500)={0x0, 0x28, 0x40}}, 0x1000}], 0x14, 0x0, &(0x7f0000000680)="86621f50fcee8bdc5bf8c503a78812261b4bf6d7"}) 18:07:19 executing program 4: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000040)='/dev/net/tun\x00', 0x0, 0x0) r1 = epoll_create1(0x0) epoll_ctl$EPOLL_CTL_ADD(0xffffffffffffffff, 0x1, r0, &(0x7f0000000100)) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000080)={'tunl0\x00', 0x1}) epoll_wait(r1, &(0x7f00000000c0)=[{}], 0x1, 0x0) 18:07:19 executing program 3: r0 = socket(0x10, 0x3, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") ioctl$sock_ifreq(r0, 0x89f3, &(0x7f0000000240)={'sit0\x00'}) [ 2613.093604] binder: undelivered TRANSACTION_ERROR: 29189 18:07:19 executing program 1: clone(0x2102001fff, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) socket(0x0, 0x0, 0x0) r0 = getpid() rt_tgsigqueueinfo(0x0, r0, 0x16, &(0x7f0000000100)) rt_sigqueueinfo(r0, 0x7, &(0x7f0000000180)={0x0, 0x0, 0xffffffff}) [ 2613.232367] binder: 11372:11398 Release 1 refcount change on invalid ref 2 ret -22 18:07:19 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000006c0)={0x118, 0x0, &(0x7f0000000540)=[@release={0x40046306, 0x2}, @acquire_done, @acquire_done={0x40106309, 0x3}, @transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x50, 0x18, &(0x7f0000000080)={@flat=@binder={0x73622a85, 0xa, 0x1}, @fda={0x66646185, 0xa, 0x1, 0x9}, @fd={0x66642a85, 0x0, r1}}, &(0x7f0000000100)={0x0, 0x18, 0x38}}, 0x1000}, @transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000180)={@ptr={0x70742a85, 0x0, &(0x7f0000000140)=""/51, 0x33, 0x2, 0x25}, @flat=@weak_handle={0x77682a85, 0x1}, @flat=@binder={0x73622a85, 0xa, 0x3}}, &(0x7f0000000280)={0x0, 0x28, 0x40}}, 0x1f8aed83e3349436}, @exit_looper, @transaction_sg={0x40486311, {0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x68, 0x18, &(0x7f0000000480)={@ptr={0x70742a85, 0x0, &(0x7f00000002c0)=""/11, 0xb, 0x2, 0x3f}, @fd={0x66642a85, 0x0, r0}, @ptr={0x70742a85, 0x0, &(0x7f0000000380)=""/70, 0x46, 0x1, 0x1f}}, &(0x7f0000000500)={0x0, 0x28, 0x40}}, 0x1000}], 0x14, 0x0, &(0x7f0000000680)="86621f50fcee8bdc5bf8c503a78812261b4bf6d7"}) [ 2613.232377] binder: 11372:11398 BC_ACQUIRE_DONE u0000000000000000 no match 18:07:19 executing program 1: clone(0x2102001fff, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) socket(0x0, 0x0, 0x0) r0 = getpid() rt_tgsigqueueinfo(0x0, r0, 0x16, &(0x7f0000000100)) rt_sigqueueinfo(r0, 0x7, &(0x7f0000000180)={0x0, 0x0, 0xffffffff}) [ 2613.232385] binder: 11372:11398 BC_ACQUIRE_DONE u0000000000000003 no match 18:07:20 executing program 3: r0 = socket(0x10, 0x3, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") ioctl$sock_ifreq(r0, 0x89f3, &(0x7f0000000240)={'sit0\x00'}) 18:07:20 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000006c0)={0x118, 0x0, &(0x7f0000000540)=[@release={0x40046306, 0x2}, @acquire_done, @acquire_done={0x40106309, 0x3}, @transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x50, 0x18, &(0x7f0000000080)={@flat=@binder={0x73622a85, 0xa, 0x1}, @fda={0x66646185, 0xa, 0x1, 0x9}, @fd={0x66642a85, 0x0, r1}}, &(0x7f0000000100)={0x0, 0x18, 0x38}}, 0x1000}, @transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000180)={@ptr={0x70742a85, 0x0, &(0x7f0000000140)=""/51, 0x33, 0x2, 0x25}, @flat=@weak_handle={0x77682a85, 0x1}, @flat=@binder={0x73622a85, 0xa, 0x3}}, &(0x7f0000000280)={0x0, 0x28, 0x40}}, 0x1f8aed83e3349436}, @exit_looper, @transaction_sg={0x40486311, {0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x68, 0x18, &(0x7f0000000480)={@ptr={0x70742a85, 0x0, &(0x7f00000002c0)=""/11, 0xb, 0x2, 0x3f}, @fd={0x66642a85, 0x0, r0}, @ptr={0x70742a85, 0x0, &(0x7f0000000380)=""/70, 0x46, 0x1, 0x1f}}, &(0x7f0000000500)={0x0, 0x28, 0x40}}, 0x1000}], 0x14, 0x0, &(0x7f0000000680)="86621f50fcee8bdc5bf8c503a78812261b4bf6d7"}) [ 2613.232398] binder: 11372:11398 transaction failed 29189/-22, size 80-24 line 3014 [ 2613.232736] binder: undelivered TRANSACTION_ERROR: 29189 18:07:20 executing program 3: r0 = socket(0x10, 0x3, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") ioctl$sock_ifreq(r0, 0x89f3, &(0x7f0000000240)={'sit0\x00'}) 18:07:20 executing program 2: ioctl$FS_IOC_RESVSP(0xffffffffffffffff, 0x40305828, &(0x7f00000000c0)={0x0, 0x0, 0x100000000000001}) clone(0x2102001fff, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) socket(0x0, 0x0, 0x0) r0 = getpid() rt_tgsigqueueinfo(0x0, r0, 0x16, &(0x7f0000000100)) ptrace(0x10, r0) ptrace$poke(0x4209, r0, &(0x7f00000000c0), 0x70effd) 18:07:20 executing program 5: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000001a00)='/dev/net/tun\x00', 0x0, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000080)="c0dc00025e0b01047be070") ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000300)={'nr0\x01\x00', 0x1132}) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000001a00)='/dev/net/tun\x00', 0x2, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000300)={'nr0\x01\x00', 0x1132}) write$cgroup_int(0xffffffffffffffff, &(0x7f00000000c0)=0x2, 0xfffffffffffffe75) close(r1) 18:07:20 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000006c0)={0x118, 0x0, &(0x7f0000000540)=[@release={0x40046306, 0x2}, @acquire_done, @acquire_done={0x40106309, 0x3}, @transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x50, 0x18, &(0x7f0000000080)={@flat=@binder={0x73622a85, 0xa, 0x1}, @fda={0x66646185, 0xa, 0x1, 0x9}, @fd={0x66642a85, 0x0, r1}}, &(0x7f0000000100)={0x0, 0x18, 0x38}}, 0x1000}, @transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000180)={@ptr={0x70742a85, 0x0, &(0x7f0000000140)=""/51, 0x33, 0x2, 0x25}, @flat=@weak_handle={0x77682a85, 0x1}, @flat=@binder={0x73622a85, 0xa, 0x3}}, &(0x7f0000000280)={0x0, 0x28, 0x40}}, 0x1f8aed83e3349436}, @exit_looper, @transaction_sg={0x40486311, {0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x68, 0x18, &(0x7f0000000480)={@ptr={0x70742a85, 0x0, &(0x7f00000002c0)=""/11, 0xb, 0x2, 0x3f}, @fd={0x66642a85, 0x0, r0}, @ptr={0x70742a85, 0x0, &(0x7f0000000380)=""/70, 0x46, 0x1, 0x1f}}, &(0x7f0000000500)={0x0, 0x28, 0x40}}, 0x1000}], 0x14, 0x0, &(0x7f0000000680)="86621f50fcee8bdc5bf8c503a78812261b4bf6d7"}) [ 2613.368639] binder: 11432:11451 Release 1 refcount change on invalid ref 2 ret -22 [ 2613.368649] binder: 11432:11451 BC_ACQUIRE_DONE u0000000000000000 no match 18:07:20 executing program 1: clone(0x2102001fff, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) socket(0x0, 0x0, 0x0) r0 = getpid() rt_tgsigqueueinfo(0x0, r0, 0x16, &(0x7f0000000100)) rt_sigqueueinfo(r0, 0x7, &(0x7f0000000180)={0x0, 0x0, 0xffffffff}) 18:07:20 executing program 4: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000040)='/dev/net/tun\x00', 0x0, 0x0) r1 = epoll_create1(0x0) epoll_ctl$EPOLL_CTL_ADD(0xffffffffffffffff, 0x1, r0, &(0x7f0000000100)) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000080)={'tunl0\x00', 0x1}) epoll_wait(r1, &(0x7f00000000c0)=[{}], 0x1, 0x0) [ 2613.368658] binder: 11432:11451 BC_ACQUIRE_DONE u0000000000000003 no match 18:07:20 executing program 3: r0 = socket(0x10, 0x3, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") ioctl$sock_ifreq(r0, 0x89f3, &(0x7f0000000240)={'sit0\x00'}) 18:07:20 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000006c0)={0x118, 0x0, &(0x7f0000000540)=[@release={0x40046306, 0x2}, @acquire_done, @acquire_done={0x40106309, 0x3}, @transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x50, 0x18, &(0x7f0000000080)={@flat=@binder={0x73622a85, 0xa, 0x1}, @fda={0x66646185, 0xa, 0x1, 0x9}, @fd={0x66642a85, 0x0, r1}}, &(0x7f0000000100)={0x0, 0x18, 0x38}}, 0x1000}, @transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000180)={@ptr={0x70742a85, 0x0, &(0x7f0000000140)=""/51, 0x33, 0x2, 0x25}, @flat=@weak_handle={0x77682a85, 0x1}, @flat=@binder={0x73622a85, 0xa, 0x3}}, &(0x7f0000000280)={0x0, 0x28, 0x40}}, 0x1f8aed83e3349436}, @exit_looper, @transaction_sg={0x40486311, {0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x68, 0x18, &(0x7f0000000480)={@ptr={0x70742a85, 0x0, &(0x7f00000002c0)=""/11, 0xb, 0x2, 0x3f}, @fd={0x66642a85, 0x0, r0}, @ptr={0x70742a85, 0x0, &(0x7f0000000380)=""/70, 0x46, 0x1, 0x1f}}, &(0x7f0000000500)={0x0, 0x28, 0x40}}, 0x1000}], 0x14, 0x0, &(0x7f0000000680)="86621f50fcee8bdc5bf8c503a78812261b4bf6d7"}) [ 2613.368671] binder: 11432:11451 transaction failed 29189/-22, size 80-24 line 3014 18:07:20 executing program 1: clone(0x2102001fff, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) socket(0x0, 0x0, 0x0) r0 = getpid() rt_tgsigqueueinfo(0x0, r0, 0x16, &(0x7f0000000100)) rt_sigqueueinfo(r0, 0x7, &(0x7f0000000180)={0x0, 0x0, 0xffffffff}) 18:07:20 executing program 3: r0 = socket(0x10, 0x3, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") ioctl$sock_ifreq(r0, 0x89f3, &(0x7f0000000240)={'sit0\x00'}) [ 2613.368990] binder: undelivered TRANSACTION_ERROR: 29189 [ 2613.502079] binder: 11485:11494 Release 1 refcount change on invalid ref 2 ret -22 18:07:20 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000006c0)={0x118, 0x0, &(0x7f0000000540)=[@release={0x40046306, 0x2}, @acquire_done, @acquire_done={0x40106309, 0x3}, @transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x50, 0x18, &(0x7f0000000080)={@flat=@binder={0x73622a85, 0xa, 0x1}, @fda={0x66646185, 0xa, 0x1, 0x9}, @fd={0x66642a85, 0x0, r1}}, &(0x7f0000000100)={0x0, 0x18, 0x38}}, 0x1000}, @transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000180)={@ptr={0x70742a85, 0x0, &(0x7f0000000140)=""/51, 0x33, 0x2, 0x25}, @flat=@weak_handle={0x77682a85, 0x1}, @flat=@binder={0x73622a85, 0xa, 0x3}}, &(0x7f0000000280)={0x0, 0x28, 0x40}}, 0x1f8aed83e3349436}, @exit_looper, @transaction_sg={0x40486311, {0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x68, 0x18, &(0x7f0000000480)={@ptr={0x70742a85, 0x0, &(0x7f00000002c0)=""/11, 0xb, 0x2, 0x3f}, @fd={0x66642a85, 0x0, r0}, @ptr={0x70742a85, 0x0, &(0x7f0000000380)=""/70, 0x46, 0x1, 0x1f}}, &(0x7f0000000500)={0x0, 0x28, 0x40}}, 0x1000}], 0x14, 0x0, &(0x7f0000000680)="86621f50fcee8bdc5bf8c503a78812261b4bf6d7"}) [ 2613.502089] binder: 11485:11494 BC_ACQUIRE_DONE u0000000000000000 no match [ 2613.502098] binder: 11485:11494 BC_ACQUIRE_DONE u0000000000000003 no match 18:07:20 executing program 2: ioctl$FS_IOC_RESVSP(0xffffffffffffffff, 0x40305828, &(0x7f00000000c0)={0x0, 0x0, 0x100000000000001}) clone(0x2102001fff, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) socket(0x0, 0x0, 0x0) r0 = getpid() rt_tgsigqueueinfo(0x0, r0, 0x16, &(0x7f0000000100)) ptrace(0x10, r0) ptrace$poke(0x4209, r0, &(0x7f00000000c0), 0x70effd) 18:07:20 executing program 1: clone(0x2102001fff, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) socket(0x0, 0x0, 0x0) r0 = getpid() rt_tgsigqueueinfo(0x0, r0, 0x16, &(0x7f0000000100)) rt_sigqueueinfo(r0, 0x7, &(0x7f0000000180)={0x0, 0x0, 0xffffffff}) [ 2613.502110] binder: 11485:11494 transaction failed 29189/-22, size 80-24 line 3014 18:07:20 executing program 4: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000040)='/dev/net/tun\x00', 0x0, 0x0) r1 = epoll_create1(0x0) epoll_ctl$EPOLL_CTL_ADD(0xffffffffffffffff, 0x1, r0, &(0x7f0000000100)) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000080)={'tunl0\x00', 0x1}) epoll_wait(r1, &(0x7f00000000c0)=[{}], 0x1, 0x0) 18:07:20 executing program 5: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000001a00)='/dev/net/tun\x00', 0x0, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000080)="c0dc00025e0b01047be070") ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000300)={'nr0\x01\x00', 0x1132}) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000001a00)='/dev/net/tun\x00', 0x2, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000300)={'nr0\x01\x00', 0x1132}) write$cgroup_int(0xffffffffffffffff, &(0x7f00000000c0)=0x2, 0xfffffffffffffe75) close(r1) 18:07:20 executing program 3: r0 = socket(0x10, 0x3, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") ioctl$sock_ifreq(r0, 0x89f3, &(0x7f0000000240)={'sit0\x00'}) [ 2613.502408] binder: undelivered TRANSACTION_ERROR: 29189 [ 2613.587087] binder: 11517:11522 Release 1 refcount change on invalid ref 2 ret -22 18:07:20 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000006c0)={0x118, 0x0, &(0x7f0000000540)=[@release={0x40046306, 0x2}, @acquire_done, @acquire_done={0x40106309, 0x3}, @transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x50, 0x18, &(0x7f0000000080)={@flat=@binder={0x73622a85, 0xa, 0x1}, @fda={0x66646185, 0xa, 0x1, 0x9}, @fd={0x66642a85, 0x0, r1}}, &(0x7f0000000100)={0x0, 0x18, 0x38}}, 0x1000}, @transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000180)={@ptr={0x70742a85, 0x0, &(0x7f0000000140)=""/51, 0x33, 0x2, 0x25}, @flat=@weak_handle={0x77682a85, 0x1}, @flat=@binder={0x73622a85, 0xa, 0x3}}, &(0x7f0000000280)={0x0, 0x28, 0x40}}, 0x1f8aed83e3349436}, @exit_looper, @transaction_sg={0x40486311, {0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x68, 0x18, &(0x7f0000000480)={@ptr={0x70742a85, 0x0, &(0x7f00000002c0)=""/11, 0xb, 0x2, 0x3f}, @fd={0x66642a85, 0x0, r0}, @ptr={0x70742a85, 0x0, &(0x7f0000000380)=""/70, 0x46, 0x1, 0x1f}}, &(0x7f0000000500)={0x0, 0x28, 0x40}}, 0x1000}], 0x14, 0x0, &(0x7f0000000680)="86621f50fcee8bdc5bf8c503a78812261b4bf6d7"}) 18:07:20 executing program 3: r0 = socket(0x10, 0x3, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") ioctl$sock_ifreq(r0, 0x89f3, &(0x7f0000000240)={'sit0\x00'}) [ 2613.587098] binder: 11517:11522 BC_ACQUIRE_DONE u0000000000000000 no match [ 2613.587106] binder: 11517:11522 BC_ACQUIRE_DONE u0000000000000003 no match 18:07:20 executing program 1: clone(0x2102001fff, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) socket(0x0, 0x0, 0x0) r0 = getpid() rt_tgsigqueueinfo(0x0, r0, 0x16, &(0x7f0000000100)) rt_sigqueueinfo(r0, 0x7, &(0x7f0000000180)={0x0, 0x0, 0xffffffff}) 18:07:20 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000006c0)={0x118, 0x0, &(0x7f0000000540)=[@release={0x40046306, 0x2}, @acquire_done, @acquire_done={0x40106309, 0x3}, @transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x50, 0x18, &(0x7f0000000080)={@flat=@binder={0x73622a85, 0xa, 0x1}, @fda={0x66646185, 0xa, 0x1, 0x9}, @fd={0x66642a85, 0x0, r1}}, &(0x7f0000000100)={0x0, 0x18, 0x38}}, 0x1000}, @transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000180)={@ptr={0x70742a85, 0x0, &(0x7f0000000140)=""/51, 0x33, 0x2, 0x25}, @flat=@weak_handle={0x77682a85, 0x1}, @flat=@binder={0x73622a85, 0xa, 0x3}}, &(0x7f0000000280)={0x0, 0x28, 0x40}}, 0x1f8aed83e3349436}, @exit_looper, @transaction_sg={0x40486311, {0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x68, 0x18, &(0x7f0000000480)={@ptr={0x70742a85, 0x0, &(0x7f00000002c0)=""/11, 0xb, 0x2, 0x3f}, @fd={0x66642a85, 0x0, r0}, @ptr={0x70742a85, 0x0, &(0x7f0000000380)=""/70, 0x46, 0x1, 0x1f}}, &(0x7f0000000500)={0x0, 0x28, 0x40}}, 0x1000}], 0x14, 0x0, &(0x7f0000000680)="86621f50fcee8bdc5bf8c503a78812261b4bf6d7"}) [ 2613.587119] binder: 11517:11522 transaction failed 29189/-22, size 80-24 line 3014 18:07:20 executing program 4: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000040)='/dev/net/tun\x00', 0x0, 0x0) r1 = epoll_create1(0x0) epoll_ctl$EPOLL_CTL_ADD(0xffffffffffffffff, 0x1, r0, &(0x7f0000000100)) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000080)={'tunl0\x00', 0x1}) epoll_wait(r1, &(0x7f00000000c0)=[{}], 0x1, 0x0) 18:07:20 executing program 3: r0 = socket(0x10, 0x3, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") ioctl$sock_ifreq(r0, 0x89f3, &(0x7f0000000240)={'sit0\x00'}) 18:07:20 executing program 2: ioctl$FS_IOC_RESVSP(0xffffffffffffffff, 0x40305828, &(0x7f00000000c0)={0x0, 0x0, 0x100000000000001}) clone(0x2102001fff, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) socket(0x0, 0x0, 0x0) r0 = getpid() rt_tgsigqueueinfo(0x0, r0, 0x16, &(0x7f0000000100)) ptrace(0x10, r0) ptrace$poke(0x4209, r0, &(0x7f00000000c0), 0x70effd) [ 2613.587466] binder: undelivered TRANSACTION_ERROR: 29189 [ 2614.101668] binder: 11558:11565 Release 1 refcount change on invalid ref 2 ret -22 18:07:20 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000006c0)={0x118, 0x0, &(0x7f0000000540)=[@release={0x40046306, 0x2}, @acquire_done, @acquire_done={0x40106309, 0x3}, @transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x50, 0x18, &(0x7f0000000080)={@flat=@binder={0x73622a85, 0xa, 0x1}, @fda={0x66646185, 0xa, 0x1, 0x9}, @fd={0x66642a85, 0x0, r1}}, &(0x7f0000000100)={0x0, 0x18, 0x38}}, 0x1000}, @transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000180)={@ptr={0x70742a85, 0x0, &(0x7f0000000140)=""/51, 0x33, 0x2, 0x25}, @flat=@weak_handle={0x77682a85, 0x1}, @flat=@binder={0x73622a85, 0xa, 0x3}}, &(0x7f0000000280)={0x0, 0x28, 0x40}}, 0x1f8aed83e3349436}, @exit_looper, @transaction_sg={0x40486311, {0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x68, 0x18, &(0x7f0000000480)={@ptr={0x70742a85, 0x0, &(0x7f00000002c0)=""/11, 0xb, 0x2, 0x3f}, @fd={0x66642a85, 0x0, r0}, @ptr={0x70742a85, 0x0, &(0x7f0000000380)=""/70, 0x46, 0x1, 0x1f}}, &(0x7f0000000500)={0x0, 0x28, 0x40}}, 0x1000}], 0x14, 0x0, &(0x7f0000000680)="86621f50fcee8bdc5bf8c503a78812261b4bf6d7"}) 18:07:20 executing program 3: r0 = socket(0x10, 0x3, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") ioctl$sock_ifreq(r0, 0x89f3, &(0x7f0000000240)={'sit0\x00'}) 18:07:20 executing program 1: clone(0x2102001fff, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) socket(0x0, 0x0, 0x0) r0 = getpid() rt_tgsigqueueinfo(0x0, r0, 0x16, &(0x7f0000000100)) rt_sigqueueinfo(r0, 0x7, &(0x7f0000000180)={0x0, 0x0, 0xffffffff}) [ 2614.101679] binder: 11558:11565 BC_ACQUIRE_DONE u0000000000000000 no match 18:07:20 executing program 5: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000001a00)='/dev/net/tun\x00', 0x0, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000080)="c0dc00025e0b01047be070") ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000300)={'nr0\x01\x00', 0x1132}) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000001a00)='/dev/net/tun\x00', 0x2, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000300)={'nr0\x01\x00', 0x1132}) write$cgroup_int(0xffffffffffffffff, &(0x7f00000000c0)=0x2, 0xfffffffffffffe75) close(r1) [ 2614.101687] binder: 11558:11565 BC_ACQUIRE_DONE u0000000000000003 no match [ 2614.101701] binder: 11558:11565 transaction failed 29189/-22, size 80-24 line 3014 18:07:20 executing program 1: clone(0x2102001fff, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) socket(0x0, 0x0, 0x0) r0 = getpid() rt_tgsigqueueinfo(0x0, r0, 0x16, &(0x7f0000000100)) rt_sigqueueinfo(r0, 0x7, &(0x7f0000000180)={0x0, 0x0, 0xffffffff}) 18:07:20 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000006c0)={0x118, 0x0, &(0x7f0000000540)=[@release={0x40046306, 0x2}, @acquire_done, @acquire_done={0x40106309, 0x3}, @transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x50, 0x18, &(0x7f0000000080)={@flat=@binder={0x73622a85, 0xa, 0x1}, @fda={0x66646185, 0xa, 0x1, 0x9}, @fd={0x66642a85, 0x0, r1}}, &(0x7f0000000100)={0x0, 0x18, 0x38}}, 0x1000}, @transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000180)={@ptr={0x70742a85, 0x0, &(0x7f0000000140)=""/51, 0x33, 0x2, 0x25}, @flat=@weak_handle={0x77682a85, 0x1}, @flat=@binder={0x73622a85, 0xa, 0x3}}, &(0x7f0000000280)={0x0, 0x28, 0x40}}, 0x1f8aed83e3349436}, @exit_looper, @transaction_sg={0x40486311, {0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x68, 0x18, &(0x7f0000000480)={@ptr={0x70742a85, 0x0, &(0x7f00000002c0)=""/11, 0xb, 0x2, 0x3f}, @fd={0x66642a85, 0x0, r0}, @ptr={0x70742a85, 0x0, &(0x7f0000000380)=""/70, 0x46, 0x1, 0x1f}}, &(0x7f0000000500)={0x0, 0x28, 0x40}}, 0x1000}], 0x14, 0x0, &(0x7f0000000680)="86621f50fcee8bdc5bf8c503a78812261b4bf6d7"}) [ 2614.102033] binder: undelivered TRANSACTION_ERROR: 29189 [ 2614.224580] binder: 11661:11667 Release 1 refcount change on invalid ref 2 ret -22 18:07:20 executing program 4: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000040)='/dev/net/tun\x00', 0x0, 0x0) r1 = epoll_create1(0x0) epoll_ctl$EPOLL_CTL_ADD(0xffffffffffffffff, 0x1, r0, &(0x7f0000000100)) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000080)={'tunl0\x00', 0x1}) epoll_wait(r1, &(0x7f00000000c0)=[{}], 0x1, 0x0) 18:07:20 executing program 3: r0 = socket(0x10, 0x3, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") ioctl$sock_ifreq(r0, 0x89f3, &(0x7f0000000240)={'sit0\x00'}) 18:07:21 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000006c0)={0x118, 0x0, &(0x7f0000000540)=[@release={0x40046306, 0x2}, @acquire_done, @acquire_done={0x40106309, 0x3}, @transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x50, 0x18, &(0x7f0000000080)={@flat=@binder={0x73622a85, 0xa, 0x1}, @fda={0x66646185, 0xa, 0x1, 0x9}, @fd={0x66642a85, 0x0, r1}}, &(0x7f0000000100)={0x0, 0x18, 0x38}}, 0x1000}, @transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000180)={@ptr={0x70742a85, 0x0, &(0x7f0000000140)=""/51, 0x33, 0x2, 0x25}, @flat=@weak_handle={0x77682a85, 0x1}, @flat=@binder={0x73622a85, 0xa, 0x3}}, &(0x7f0000000280)={0x0, 0x28, 0x40}}, 0x1f8aed83e3349436}, @exit_looper, @transaction_sg={0x40486311, {0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x68, 0x18, &(0x7f0000000480)={@ptr={0x70742a85, 0x0, &(0x7f00000002c0)=""/11, 0xb, 0x2, 0x3f}, @fd={0x66642a85, 0x0, r0}, @ptr={0x70742a85, 0x0, &(0x7f0000000380)=""/70, 0x46, 0x1, 0x1f}}, &(0x7f0000000500)={0x0, 0x28, 0x40}}, 0x1000}], 0x14, 0x0, &(0x7f0000000680)="86621f50fcee8bdc5bf8c503a78812261b4bf6d7"}) 18:07:21 executing program 2: ioctl$FS_IOC_RESVSP(0xffffffffffffffff, 0x40305828, &(0x7f00000000c0)={0x0, 0x0, 0x100000000000001}) clone(0x2102001fff, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) socket(0x0, 0x0, 0x0) r0 = getpid() rt_tgsigqueueinfo(0x0, r0, 0x16, &(0x7f0000000100)) ptrace(0x10, r0) ptrace$poke(0x4209, r0, &(0x7f00000000c0), 0x70effd) [ 2614.224590] binder: 11661:11667 BC_ACQUIRE_DONE u0000000000000000 no match [ 2614.224599] binder: 11661:11667 BC_ACQUIRE_DONE u0000000000000003 no match 18:07:21 executing program 1: clone(0x2102001fff, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) socket(0x0, 0x0, 0x0) r0 = getpid() rt_tgsigqueueinfo(0x0, r0, 0x16, &(0x7f0000000100)) rt_sigqueueinfo(r0, 0x7, &(0x7f0000000180)={0x0, 0x0, 0xffffffff}) 18:07:21 executing program 3: r0 = socket(0x10, 0x3, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") ioctl$sock_ifreq(r0, 0x89f3, &(0x7f0000000240)={'sit0\x00'}) [ 2614.224613] binder: 11661:11667 transaction failed 29189/-22, size 80-24 line 3014 18:07:21 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000006c0)={0x118, 0x0, &(0x7f0000000540)=[@release={0x40046306, 0x2}, @acquire_done, @acquire_done={0x40106309, 0x3}, @transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x50, 0x18, &(0x7f0000000080)={@flat=@binder={0x73622a85, 0xa, 0x1}, @fda={0x66646185, 0xa, 0x1, 0x9}, @fd={0x66642a85, 0x0, r1}}, &(0x7f0000000100)={0x0, 0x18, 0x38}}, 0x1000}, @transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000180)={@ptr={0x70742a85, 0x0, &(0x7f0000000140)=""/51, 0x33, 0x2, 0x25}, @flat=@weak_handle={0x77682a85, 0x1}, @flat=@binder={0x73622a85, 0xa, 0x3}}, &(0x7f0000000280)={0x0, 0x28, 0x40}}, 0x1f8aed83e3349436}, @exit_looper, @transaction_sg={0x40486311, {0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x68, 0x18, &(0x7f0000000480)={@ptr={0x70742a85, 0x0, &(0x7f00000002c0)=""/11, 0xb, 0x2, 0x3f}, @fd={0x66642a85, 0x0, r0}, @ptr={0x70742a85, 0x0, &(0x7f0000000380)=""/70, 0x46, 0x1, 0x1f}}, &(0x7f0000000500)={0x0, 0x28, 0x40}}, 0x1000}], 0x14, 0x0, &(0x7f0000000680)="86621f50fcee8bdc5bf8c503a78812261b4bf6d7"}) 18:07:21 executing program 1: clone(0x2102001fff, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) socket(0x0, 0x0, 0x0) r0 = getpid() rt_tgsigqueueinfo(0x0, r0, 0x16, &(0x7f0000000100)) rt_sigqueueinfo(r0, 0x7, &(0x7f0000000180)={0x0, 0x0, 0xffffffff}) 18:07:21 executing program 5: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000001a00)='/dev/net/tun\x00', 0x0, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000080)="c0dc00025e0b01047be070") ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000300)={'nr0\x01\x00', 0x1132}) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000001a00)='/dev/net/tun\x00', 0x2, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000300)={'nr0\x01\x00', 0x1132}) write$cgroup_int(0xffffffffffffffff, &(0x7f00000000c0)=0x2, 0xfffffffffffffe75) close(r1) 18:07:21 executing program 3: r0 = socket(0x10, 0x3, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") ioctl$sock_ifreq(r0, 0x89f3, &(0x7f0000000240)={'sit0\x00'}) [ 2614.225604] binder: undelivered TRANSACTION_ERROR: 29189 18:07:21 executing program 4: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000040)='/dev/net/tun\x00', 0x0, 0x0) r1 = epoll_create1(0x0) epoll_ctl$EPOLL_CTL_ADD(0xffffffffffffffff, 0x1, r0, &(0x7f0000000100)) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000080)={'tunl0\x00', 0x1}) epoll_wait(r1, &(0x7f00000000c0)=[{}], 0x1, 0x0) [ 2614.292237] binder: 11700:11708 Release 1 refcount change on invalid ref 2 ret -22 18:07:21 executing program 3: r0 = socket(0x10, 0x3, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") ioctl$sock_ifreq(r0, 0x89f3, &(0x7f0000000240)={'sit0\x00'}) [ 2614.292247] binder: 11700:11708 BC_ACQUIRE_DONE u0000000000000000 no match 18:07:21 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000006c0)={0x118, 0x0, &(0x7f0000000540)=[@release={0x40046306, 0x2}, @acquire_done, @acquire_done={0x40106309, 0x3}, @transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x50, 0x18, &(0x7f0000000080)={@flat=@binder={0x73622a85, 0xa, 0x1}, @fda={0x66646185, 0xa, 0x1, 0x9}, @fd={0x66642a85, 0x0, r1}}, &(0x7f0000000100)={0x0, 0x18, 0x38}}, 0x1000}, @transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000180)={@ptr={0x70742a85, 0x0, &(0x7f0000000140)=""/51, 0x33, 0x2, 0x25}, @flat=@weak_handle={0x77682a85, 0x1}, @flat=@binder={0x73622a85, 0xa, 0x3}}, &(0x7f0000000280)={0x0, 0x28, 0x40}}, 0x1f8aed83e3349436}, @exit_looper, @transaction_sg={0x40486311, {0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x68, 0x18, &(0x7f0000000480)={@ptr={0x70742a85, 0x0, &(0x7f00000002c0)=""/11, 0xb, 0x2, 0x3f}, @fd={0x66642a85, 0x0, r0}, @ptr={0x70742a85, 0x0, &(0x7f0000000380)=""/70, 0x46, 0x1, 0x1f}}, &(0x7f0000000500)={0x0, 0x28, 0x40}}, 0x1000}], 0x14, 0x0, &(0x7f0000000680)="86621f50fcee8bdc5bf8c503a78812261b4bf6d7"}) 18:07:21 executing program 1: clone(0x2102001fff, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) socket(0x0, 0x0, 0x0) r0 = getpid() rt_tgsigqueueinfo(0x0, r0, 0x16, &(0x7f0000000100)) rt_sigqueueinfo(r0, 0x7, &(0x7f0000000180)={0x0, 0x0, 0xffffffff}) 18:07:21 executing program 3: r0 = socket(0x10, 0x3, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") ioctl$sock_ifreq(r0, 0x89f3, &(0x7f0000000240)={'sit0\x00'}) 18:07:21 executing program 2: ioctl$FS_IOC_RESVSP(0xffffffffffffffff, 0x40305828, &(0x7f00000000c0)={0x0, 0x0, 0x100000000000001}) clone(0x2102001fff, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) socket(0x0, 0x0, 0x0) r0 = getpid() rt_tgsigqueueinfo(0x0, r0, 0x16, &(0x7f0000000100)) ptrace(0x10, r0) ptrace$poke(0x4209, r0, &(0x7f00000000c0), 0x70effd) [ 2614.292256] binder: 11700:11708 BC_ACQUIRE_DONE u0000000000000003 no match [ 2614.292269] binder: 11700:11708 transaction failed 29189/-22, size 80-24 line 3014 18:07:21 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000006c0)={0x118, 0x0, &(0x7f0000000540)=[@release={0x40046306, 0x2}, @acquire_done, @acquire_done={0x40106309, 0x3}, @transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x50, 0x18, &(0x7f0000000080)={@flat=@binder={0x73622a85, 0xa, 0x1}, @fda={0x66646185, 0xa, 0x1, 0x9}, @fd={0x66642a85, 0x0, r1}}, &(0x7f0000000100)={0x0, 0x18, 0x38}}, 0x1000}, @transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000180)={@ptr={0x70742a85, 0x0, &(0x7f0000000140)=""/51, 0x33, 0x2, 0x25}, @flat=@weak_handle={0x77682a85, 0x1}, @flat=@binder={0x73622a85, 0xa, 0x3}}, &(0x7f0000000280)={0x0, 0x28, 0x40}}, 0x1f8aed83e3349436}, @exit_looper, @transaction_sg={0x40486311, {0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x68, 0x18, &(0x7f0000000480)={@ptr={0x70742a85, 0x0, &(0x7f00000002c0)=""/11, 0xb, 0x2, 0x3f}, @fd={0x66642a85, 0x0, r0}, @ptr={0x70742a85, 0x0, &(0x7f0000000380)=""/70, 0x46, 0x1, 0x1f}}, &(0x7f0000000500)={0x0, 0x28, 0x40}}, 0x1000}], 0x14, 0x0, &(0x7f0000000680)="86621f50fcee8bdc5bf8c503a78812261b4bf6d7"}) [ 2614.292833] binder: undelivered TRANSACTION_ERROR: 29189 [ 2614.465698] binder: 11746:11752 Release 1 refcount change on invalid ref 2 ret -22 18:07:21 executing program 1: clone(0x2102001fff, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) socket(0x0, 0x0, 0x0) r0 = getpid() rt_tgsigqueueinfo(0x0, r0, 0x16, &(0x7f0000000100)) rt_sigqueueinfo(r0, 0x7, &(0x7f0000000180)={0x0, 0x0, 0xffffffff}) 18:07:21 executing program 3: r0 = socket(0x10, 0x3, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") ioctl$sock_ifreq(r0, 0x89f3, &(0x7f0000000240)={'sit0\x00'}) [ 2614.465708] binder: 11746:11752 BC_ACQUIRE_DONE u0000000000000000 no match 18:07:21 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000006c0)={0x118, 0x0, &(0x7f0000000540)=[@release={0x40046306, 0x2}, @acquire_done, @acquire_done={0x40106309, 0x3}, @transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x50, 0x18, &(0x7f0000000080)={@flat=@binder={0x73622a85, 0xa, 0x1}, @fda={0x66646185, 0xa, 0x1, 0x9}, @fd={0x66642a85, 0x0, r1}}, &(0x7f0000000100)={0x0, 0x18, 0x38}}, 0x1000}, @transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000180)={@ptr={0x70742a85, 0x0, &(0x7f0000000140)=""/51, 0x33, 0x2, 0x25}, @flat=@weak_handle={0x77682a85, 0x1}, @flat=@binder={0x73622a85, 0xa, 0x3}}, &(0x7f0000000280)={0x0, 0x28, 0x40}}, 0x1f8aed83e3349436}, @exit_looper, @transaction_sg={0x40486311, {0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x68, 0x18, &(0x7f0000000480)={@ptr={0x70742a85, 0x0, &(0x7f00000002c0)=""/11, 0xb, 0x2, 0x3f}, @fd={0x66642a85, 0x0, r0}, @ptr={0x70742a85, 0x0, &(0x7f0000000380)=""/70, 0x46, 0x1, 0x1f}}, &(0x7f0000000500)={0x0, 0x28, 0x40}}, 0x1000}], 0x14, 0x0, &(0x7f0000000680)="86621f50fcee8bdc5bf8c503a78812261b4bf6d7"}) 18:07:21 executing program 5: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000001a00)='/dev/net/tun\x00', 0x0, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000080)="c0dc00025e0b01047be070") ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000300)={'nr0\x01\x00', 0x1132}) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000001a00)='/dev/net/tun\x00', 0x2, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000300)={'nr0\x01\x00', 0x1132}) write$cgroup_int(0xffffffffffffffff, &(0x7f00000000c0)=0x2, 0xfffffffffffffe75) close(r1) [ 2614.465715] binder: 11746:11752 BC_ACQUIRE_DONE u0000000000000003 no match 18:07:21 executing program 4: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000040)='/dev/net/tun\x00', 0x0, 0x0) r1 = epoll_create1(0x0) epoll_ctl$EPOLL_CTL_ADD(0xffffffffffffffff, 0x1, r0, &(0x7f0000000100)) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000080)={'tunl0\x00', 0x1}) epoll_wait(r1, &(0x7f00000000c0)=[{}], 0x1, 0x0) 18:07:21 executing program 3: r0 = socket(0x10, 0x3, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") ioctl$sock_ifreq(r0, 0x89f3, &(0x7f0000000240)={'sit0\x00'}) [ 2614.465727] binder: 11746:11752 transaction failed 29189/-22, size 80-24 line 3014 18:07:21 executing program 1: clone(0x2102001fff, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) socket(0x0, 0x0, 0x0) r0 = getpid() rt_tgsigqueueinfo(0x0, r0, 0x16, &(0x7f0000000100)) rt_sigqueueinfo(r0, 0x7, &(0x7f0000000180)={0x0, 0x0, 0xffffffff}) 18:07:21 executing program 2: ioctl$FS_IOC_RESVSP(0xffffffffffffffff, 0x40305828, &(0x7f00000000c0)={0x0, 0x0, 0x100000000000001}) clone(0x2102001fff, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) socket(0x0, 0x0, 0x0) r0 = getpid() rt_tgsigqueueinfo(0x0, r0, 0x16, &(0x7f0000000100)) ptrace(0x10, r0) ptrace$poke(0x4209, r0, &(0x7f00000000c0), 0x70effd) [ 2614.471333] binder: undelivered TRANSACTION_ERROR: 29189 [ 2614.575557] binder: 11798:11800 Release 1 refcount change on invalid ref 2 ret -22 [ 2614.575567] binder: 11798:11800 BC_ACQUIRE_DONE u0000000000000000 no match [ 2614.575575] binder: 11798:11800 BC_ACQUIRE_DONE u0000000000000003 no match 18:07:21 executing program 3: r0 = socket(0x10, 0x3, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") ioctl$sock_ifreq(r0, 0x89f3, &(0x7f0000000240)={'sit0\x00'}) 18:07:21 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000006c0)={0x118, 0x0, &(0x7f0000000540)=[@release={0x40046306, 0x2}, @acquire_done, @acquire_done={0x40106309, 0x3}, @transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x50, 0x18, &(0x7f0000000080)={@flat=@binder={0x73622a85, 0xa, 0x1}, @fda={0x66646185, 0xa, 0x1, 0x9}, @fd={0x66642a85, 0x0, r1}}, &(0x7f0000000100)={0x0, 0x18, 0x38}}, 0x1000}, @transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000180)={@ptr={0x70742a85, 0x0, &(0x7f0000000140)=""/51, 0x33, 0x2, 0x25}, @flat=@weak_handle={0x77682a85, 0x1}, @flat=@binder={0x73622a85, 0xa, 0x3}}, &(0x7f0000000280)={0x0, 0x28, 0x40}}, 0x1f8aed83e3349436}, @exit_looper, @transaction_sg={0x40486311, {0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x68, 0x18, &(0x7f0000000480)={@ptr={0x70742a85, 0x0, &(0x7f00000002c0)=""/11, 0xb, 0x2, 0x3f}, @fd={0x66642a85, 0x0, r0}, @ptr={0x70742a85, 0x0, &(0x7f0000000380)=""/70, 0x46, 0x1, 0x1f}}, &(0x7f0000000500)={0x0, 0x28, 0x40}}, 0x1000}], 0x14, 0x0, &(0x7f0000000680)="86621f50fcee8bdc5bf8c503a78812261b4bf6d7"}) [ 2614.575587] binder: 11798:11800 transaction failed 29189/-22, size 80-24 line 3014 18:07:21 executing program 1: clone(0x2102001fff, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) socket(0x0, 0x0, 0x0) r0 = getpid() rt_tgsigqueueinfo(0x0, r0, 0x16, &(0x7f0000000100)) rt_sigqueueinfo(r0, 0x7, &(0x7f0000000180)={0x0, 0x0, 0xffffffff}) 18:07:21 executing program 4: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000040)='/dev/net/tun\x00', 0x0, 0x0) r1 = epoll_create1(0x0) epoll_ctl$EPOLL_CTL_ADD(0xffffffffffffffff, 0x1, r0, &(0x7f0000000100)) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000080)={'tunl0\x00', 0x1}) epoll_wait(r1, &(0x7f00000000c0)=[{}], 0x1, 0x0) 18:07:21 executing program 5: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000001a00)='/dev/net/tun\x00', 0x0, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000080)="c0dc00025e0b01047be070") ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000300)={'nr0\x01\x00', 0x1132}) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000001a00)='/dev/net/tun\x00', 0x2, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000300)={'nr0\x01\x00', 0x1132}) write$cgroup_int(0xffffffffffffffff, &(0x7f00000000c0)=0x2, 0xfffffffffffffe75) close(r1) [ 2614.576055] binder: undelivered TRANSACTION_ERROR: 29189 [ 2614.672595] binder: 11845:11851 Release 1 refcount change on invalid ref 2 ret -22 18:07:21 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000006c0)={0x118, 0x0, &(0x7f0000000540)=[@release={0x40046306, 0x2}, @acquire_done, @acquire_done={0x40106309, 0x3}, @transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x50, 0x18, &(0x7f0000000080)={@flat=@binder={0x73622a85, 0xa, 0x1}, @fda={0x66646185, 0xa, 0x1, 0x9}, @fd={0x66642a85, 0x0, r1}}, &(0x7f0000000100)={0x0, 0x18, 0x38}}, 0x1000}, @transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000180)={@ptr={0x70742a85, 0x0, &(0x7f0000000140)=""/51, 0x33, 0x2, 0x25}, @flat=@weak_handle={0x77682a85, 0x1}, @flat=@binder={0x73622a85, 0xa, 0x3}}, &(0x7f0000000280)={0x0, 0x28, 0x40}}, 0x1f8aed83e3349436}, @exit_looper, @transaction_sg={0x40486311, {0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x68, 0x18, &(0x7f0000000480)={@ptr={0x70742a85, 0x0, &(0x7f00000002c0)=""/11, 0xb, 0x2, 0x3f}, @fd={0x66642a85, 0x0, r0}, @ptr={0x70742a85, 0x0, &(0x7f0000000380)=""/70, 0x46, 0x1, 0x1f}}, &(0x7f0000000500)={0x0, 0x28, 0x40}}, 0x1000}], 0x14, 0x0, &(0x7f0000000680)="86621f50fcee8bdc5bf8c503a78812261b4bf6d7"}) 18:07:21 executing program 3: r0 = socket(0x10, 0x3, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") ioctl$sock_ifreq(r0, 0x89f3, &(0x7f0000000240)={'sit0\x00'}) [ 2614.672605] binder: 11845:11851 BC_ACQUIRE_DONE u0000000000000000 no match 18:07:21 executing program 2: ioctl$FS_IOC_RESVSP(0xffffffffffffffff, 0x40305828, &(0x7f00000000c0)={0x0, 0x0, 0x100000000000001}) clone(0x2102001fff, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) socket(0x0, 0x0, 0x0) r0 = getpid() rt_tgsigqueueinfo(0x0, r0, 0x16, &(0x7f0000000100)) ptrace(0x10, r0) ptrace$poke(0x4209, r0, &(0x7f00000000c0), 0x70effd) 18:07:21 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000006c0)={0x118, 0x0, &(0x7f0000000540)=[@release={0x40046306, 0x2}, @acquire_done, @acquire_done={0x40106309, 0x3}, @transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x50, 0x18, &(0x7f0000000080)={@flat=@binder={0x73622a85, 0xa, 0x1}, @fda={0x66646185, 0xa, 0x1, 0x9}, @fd={0x66642a85, 0x0, r1}}, &(0x7f0000000100)={0x0, 0x18, 0x38}}, 0x1000}, @transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000180)={@ptr={0x70742a85, 0x0, &(0x7f0000000140)=""/51, 0x33, 0x2, 0x25}, @flat=@weak_handle={0x77682a85, 0x1}, @flat=@binder={0x73622a85, 0xa, 0x3}}, &(0x7f0000000280)={0x0, 0x28, 0x40}}, 0x1f8aed83e3349436}, @exit_looper, @transaction_sg={0x40486311, {0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x68, 0x18, &(0x7f0000000480)={@ptr={0x70742a85, 0x0, &(0x7f00000002c0)=""/11, 0xb, 0x2, 0x3f}, @fd={0x66642a85, 0x0, r0}, @ptr={0x70742a85, 0x0, &(0x7f0000000380)=""/70, 0x46, 0x1, 0x1f}}, &(0x7f0000000500)={0x0, 0x28, 0x40}}, 0x1000}], 0x14, 0x0, &(0x7f0000000680)="86621f50fcee8bdc5bf8c503a78812261b4bf6d7"}) 18:07:21 executing program 1: clone(0x2102001fff, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) socket(0x0, 0x0, 0x0) r0 = getpid() rt_tgsigqueueinfo(0x0, r0, 0x16, &(0x7f0000000100)) rt_sigqueueinfo(r0, 0x7, &(0x7f0000000180)={0x0, 0x0, 0xffffffff}) 18:07:21 executing program 3: r0 = socket(0x10, 0x3, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") ioctl$sock_ifreq(r0, 0x89f3, &(0x7f0000000240)={'sit0\x00'}) [ 2614.672613] binder: 11845:11851 BC_ACQUIRE_DONE u0000000000000003 no match [ 2614.672625] binder: 11845:11851 transaction failed 29189/-22, size 80-24 line 3014 [ 2614.673378] binder: undelivered TRANSACTION_ERROR: 29189 18:07:22 executing program 4: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000040)='/dev/net/tun\x00', 0x0, 0x0) r1 = epoll_create1(0x0) epoll_ctl$EPOLL_CTL_ADD(0xffffffffffffffff, 0x1, r0, &(0x7f0000000100)) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000080)={'tunl0\x00', 0x1}) epoll_wait(r1, &(0x7f00000000c0)=[{}], 0x1, 0x0) 18:07:22 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000006c0)={0x118, 0x0, &(0x7f0000000540)=[@release={0x40046306, 0x2}, @acquire_done, @acquire_done={0x40106309, 0x3}, @transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x50, 0x18, &(0x7f0000000080)={@flat=@binder={0x73622a85, 0xa, 0x1}, @fda={0x66646185, 0xa, 0x1, 0x9}, @fd={0x66642a85, 0x0, r1}}, &(0x7f0000000100)={0x0, 0x18, 0x38}}, 0x1000}, @transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000180)={@ptr={0x70742a85, 0x0, &(0x7f0000000140)=""/51, 0x33, 0x2, 0x25}, @flat=@weak_handle={0x77682a85, 0x1}, @flat=@binder={0x73622a85, 0xa, 0x3}}, &(0x7f0000000280)={0x0, 0x28, 0x40}}, 0x1f8aed83e3349436}, @exit_looper, @transaction_sg={0x40486311, {0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x68, 0x18, &(0x7f0000000480)={@ptr={0x70742a85, 0x0, &(0x7f00000002c0)=""/11, 0xb, 0x2, 0x3f}, @fd={0x66642a85, 0x0, r0}, @ptr={0x70742a85, 0x0, &(0x7f0000000380)=""/70, 0x46, 0x1, 0x1f}}, &(0x7f0000000500)={0x0, 0x28, 0x40}}, 0x1000}], 0x14, 0x0, &(0x7f0000000680)="86621f50fcee8bdc5bf8c503a78812261b4bf6d7"}) 18:07:22 executing program 1: clone(0x2102001fff, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) socket(0x0, 0x0, 0x0) r0 = getpid() rt_tgsigqueueinfo(0x0, r0, 0x16, &(0x7f0000000100)) rt_sigqueueinfo(r0, 0x7, &(0x7f0000000180)={0x0, 0x0, 0xffffffff}) [ 2614.799534] binder: 11886:11889 Release 1 refcount change on invalid ref 2 ret -22 [ 2614.799543] binder: 11886:11889 BC_ACQUIRE_DONE u0000000000000000 no match 18:07:22 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000006c0)={0x118, 0x0, &(0x7f0000000540)=[@release={0x40046306, 0x2}, @acquire_done, @acquire_done={0x40106309, 0x3}, @transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x50, 0x18, &(0x7f0000000080)={@flat=@binder={0x73622a85, 0xa, 0x1}, @fda={0x66646185, 0xa, 0x1, 0x9}, @fd={0x66642a85, 0x0, r1}}, &(0x7f0000000100)={0x0, 0x18, 0x38}}, 0x1000}, @transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000180)={@ptr={0x70742a85, 0x0, &(0x7f0000000140)=""/51, 0x33, 0x2, 0x25}, @flat=@weak_handle={0x77682a85, 0x1}, @flat=@binder={0x73622a85, 0xa, 0x3}}, &(0x7f0000000280)={0x0, 0x28, 0x40}}, 0x1f8aed83e3349436}, @exit_looper, @transaction_sg={0x40486311, {0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x68, 0x18, &(0x7f0000000480)={@ptr={0x70742a85, 0x0, &(0x7f00000002c0)=""/11, 0xb, 0x2, 0x3f}, @fd={0x66642a85, 0x0, r0}, @ptr={0x70742a85, 0x0, &(0x7f0000000380)=""/70, 0x46, 0x1, 0x1f}}, &(0x7f0000000500)={0x0, 0x28, 0x40}}, 0x1000}], 0x14, 0x0, &(0x7f0000000680)="86621f50fcee8bdc5bf8c503a78812261b4bf6d7"}) 18:07:22 executing program 2: ioctl$FS_IOC_RESVSP(0xffffffffffffffff, 0x40305828, &(0x7f00000000c0)={0x0, 0x0, 0x100000000000001}) clone(0x2102001fff, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) socket(0x0, 0x0, 0x0) r0 = getpid() rt_tgsigqueueinfo(0x0, r0, 0x16, &(0x7f0000000100)) ptrace(0x10, r0) ptrace$poke(0x4209, r0, &(0x7f00000000c0), 0x70effd) [ 2614.799552] binder: 11886:11889 BC_ACQUIRE_DONE u0000000000000003 no match [ 2614.799565] binder: 11886:11889 transaction failed 29189/-22, size 80-24 line 3014 [ 2614.799880] binder: undelivered TRANSACTION_ERROR: 29189 [ 2614.928566] binder: 11919:11928 Release 1 refcount change on invalid ref 2 ret -22 18:07:22 executing program 5: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000001a00)='/dev/net/tun\x00', 0x0, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000080)="c0dc00025e0b01047be070") ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000300)={'nr0\x01\x00', 0x1132}) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000001a00)='/dev/net/tun\x00', 0x2, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000300)={'nr0\x01\x00', 0x1132}) write$cgroup_int(0xffffffffffffffff, &(0x7f00000000c0)=0x2, 0xfffffffffffffe75) close(r1) 18:07:22 executing program 1: clone(0x2102001fff, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) socket(0x0, 0x0, 0x0) r0 = getpid() rt_tgsigqueueinfo(0x0, r0, 0x16, &(0x7f0000000100)) rt_sigqueueinfo(r0, 0x7, &(0x7f0000000180)={0x0, 0x0, 0xffffffff}) 18:07:22 executing program 3: r0 = socket(0x10, 0x3, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") ioctl$sock_ifreq(r0, 0x89f3, &(0x7f0000000240)={'sit0\x00'}) 18:07:22 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000006c0)={0x118, 0x0, &(0x7f0000000540)=[@release={0x40046306, 0x2}, @acquire_done, @acquire_done={0x40106309, 0x3}, @transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x50, 0x18, &(0x7f0000000080)={@flat=@binder={0x73622a85, 0xa, 0x1}, @fda={0x66646185, 0xa, 0x1, 0x9}, @fd={0x66642a85, 0x0, r1}}, &(0x7f0000000100)={0x0, 0x18, 0x38}}, 0x1000}, @transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000180)={@ptr={0x70742a85, 0x0, &(0x7f0000000140)=""/51, 0x33, 0x2, 0x25}, @flat=@weak_handle={0x77682a85, 0x1}, @flat=@binder={0x73622a85, 0xa, 0x3}}, &(0x7f0000000280)={0x0, 0x28, 0x40}}, 0x1f8aed83e3349436}, @exit_looper, @transaction_sg={0x40486311, {0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x68, 0x18, &(0x7f0000000480)={@ptr={0x70742a85, 0x0, &(0x7f00000002c0)=""/11, 0xb, 0x2, 0x3f}, @fd={0x66642a85, 0x0, r0}, @ptr={0x70742a85, 0x0, &(0x7f0000000380)=""/70, 0x46, 0x1, 0x1f}}, &(0x7f0000000500)={0x0, 0x28, 0x40}}, 0x1000}], 0x14, 0x0, &(0x7f0000000680)="86621f50fcee8bdc5bf8c503a78812261b4bf6d7"}) [ 2614.928576] binder: 11919:11928 BC_ACQUIRE_DONE u0000000000000000 no match 18:07:22 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000006c0)={0x118, 0x0, &(0x7f0000000540)=[@release={0x40046306, 0x2}, @acquire_done, @acquire_done={0x40106309, 0x3}, @transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x50, 0x18, &(0x7f0000000080)={@flat=@binder={0x73622a85, 0xa, 0x1}, @fda={0x66646185, 0xa, 0x1, 0x9}, @fd={0x66642a85, 0x0, r1}}, &(0x7f0000000100)={0x0, 0x18, 0x38}}, 0x1000}, @transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000180)={@ptr={0x70742a85, 0x0, &(0x7f0000000140)=""/51, 0x33, 0x2, 0x25}, @flat=@weak_handle={0x77682a85, 0x1}, @flat=@binder={0x73622a85, 0xa, 0x3}}, &(0x7f0000000280)={0x0, 0x28, 0x40}}, 0x1f8aed83e3349436}, @exit_looper, @transaction_sg={0x40486311, {0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x68, 0x18, &(0x7f0000000480)={@ptr={0x70742a85, 0x0, &(0x7f00000002c0)=""/11, 0xb, 0x2, 0x3f}, @fd={0x66642a85, 0x0, r0}, @ptr={0x70742a85, 0x0, &(0x7f0000000380)=""/70, 0x46, 0x1, 0x1f}}, &(0x7f0000000500)={0x0, 0x28, 0x40}}, 0x1000}], 0x14, 0x0, &(0x7f0000000680)="86621f50fcee8bdc5bf8c503a78812261b4bf6d7"}) 18:07:22 executing program 3: r0 = socket(0x10, 0x3, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") ioctl$sock_ifreq(r0, 0x89f3, &(0x7f0000000240)={'sit0\x00'}) [ 2614.928584] binder: 11919:11928 BC_ACQUIRE_DONE u0000000000000003 no match 18:07:22 executing program 1: clone(0x2102001fff, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) socket(0x0, 0x0, 0x0) r0 = getpid() rt_tgsigqueueinfo(0x0, r0, 0x16, &(0x7f0000000100)) rt_sigqueueinfo(r0, 0x7, &(0x7f0000000180)={0x0, 0x0, 0xffffffff}) [ 2614.928597] binder: 11919:11928 transaction failed 29189/-22, size 80-24 line 3014 18:07:22 executing program 4: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000040)='/dev/net/tun\x00', 0x0, 0x0) r1 = epoll_create1(0x0) epoll_ctl$EPOLL_CTL_ADD(0xffffffffffffffff, 0x1, r0, &(0x7f0000000100)) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000080)={'tunl0\x00', 0x1}) epoll_wait(r1, &(0x7f00000000c0)=[{}], 0x1, 0x0) 18:07:22 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000006c0)={0x118, 0x0, &(0x7f0000000540)=[@release={0x40046306, 0x2}, @acquire_done, @acquire_done={0x40106309, 0x3}, @transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x50, 0x18, &(0x7f0000000080)={@flat=@binder={0x73622a85, 0xa, 0x1}, @fda={0x66646185, 0xa, 0x1, 0x9}, @fd={0x66642a85, 0x0, r1}}, &(0x7f0000000100)={0x0, 0x18, 0x38}}, 0x1000}, @transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000180)={@ptr={0x70742a85, 0x0, &(0x7f0000000140)=""/51, 0x33, 0x2, 0x25}, @flat=@weak_handle={0x77682a85, 0x1}, @flat=@binder={0x73622a85, 0xa, 0x3}}, &(0x7f0000000280)={0x0, 0x28, 0x40}}, 0x1f8aed83e3349436}, @exit_looper, @transaction_sg={0x40486311, {0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x68, 0x18, &(0x7f0000000480)={@ptr={0x70742a85, 0x0, &(0x7f00000002c0)=""/11, 0xb, 0x2, 0x3f}, @fd={0x66642a85, 0x0, r0}, @ptr={0x70742a85, 0x0, &(0x7f0000000380)=""/70, 0x46, 0x1, 0x1f}}, &(0x7f0000000500)={0x0, 0x28, 0x40}}, 0x1000}], 0x14, 0x0, &(0x7f0000000680)="86621f50fcee8bdc5bf8c503a78812261b4bf6d7"}) 18:07:22 executing program 3: r0 = socket(0x10, 0x3, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") ioctl$sock_ifreq(r0, 0x89f3, &(0x7f0000000240)={'sit0\x00'}) [ 2614.929359] binder: undelivered TRANSACTION_ERROR: 29189 18:07:22 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000006c0)={0x118, 0x0, &(0x7f0000000540)=[@release={0x40046306, 0x2}, @acquire_done, @acquire_done={0x40106309, 0x3}, @transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x50, 0x18, &(0x7f0000000080)={@flat=@binder={0x73622a85, 0xa, 0x1}, @fda={0x66646185, 0xa, 0x1, 0x9}, @fd={0x66642a85, 0x0, r1}}, &(0x7f0000000100)={0x0, 0x18, 0x38}}, 0x1000}, @transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000180)={@ptr={0x70742a85, 0x0, &(0x7f0000000140)=""/51, 0x33, 0x2, 0x25}, @flat=@weak_handle={0x77682a85, 0x1}, @flat=@binder={0x73622a85, 0xa, 0x3}}, &(0x7f0000000280)={0x0, 0x28, 0x40}}, 0x1f8aed83e3349436}, @exit_looper, @transaction_sg={0x40486311, {0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x68, 0x18, &(0x7f0000000480)={@ptr={0x70742a85, 0x0, &(0x7f00000002c0)=""/11, 0xb, 0x2, 0x3f}, @fd={0x66642a85, 0x0, r0}, @ptr={0x70742a85, 0x0, &(0x7f0000000380)=""/70, 0x46, 0x1, 0x1f}}, &(0x7f0000000500)={0x0, 0x28, 0x40}}, 0x1000}], 0x14, 0x0, &(0x7f0000000680)="86621f50fcee8bdc5bf8c503a78812261b4bf6d7"}) [ 2615.073111] binder: 11959:11976 Release 1 refcount change on invalid ref 2 ret -22 18:07:22 executing program 2: ioctl$FS_IOC_RESVSP(0xffffffffffffffff, 0x40305828, &(0x7f00000000c0)={0x0, 0x0, 0x100000000000001}) clone(0x2102001fff, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) socket(0x0, 0x0, 0x0) r0 = getpid() rt_tgsigqueueinfo(0x0, r0, 0x16, &(0x7f0000000100)) ptrace(0x10, r0) ptrace$poke(0x4209, r0, &(0x7f00000000c0), 0x70effd) [ 2615.073121] binder: 11959:11976 BC_ACQUIRE_DONE u0000000000000000 no match 18:07:22 executing program 5: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000001a00)='/dev/net/tun\x00', 0x0, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000080)="c0dc00025e0b01047be070") ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000300)={'nr0\x01\x00', 0x1132}) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000001a00)='/dev/net/tun\x00', 0x2, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000300)={'nr0\x01\x00', 0x1132}) write$cgroup_int(0xffffffffffffffff, &(0x7f00000000c0)=0x2, 0xfffffffffffffe75) close(r1) 18:07:22 executing program 3: r0 = socket(0x10, 0x3, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") ioctl$sock_ifreq(r0, 0x89f3, &(0x7f0000000240)={'sit0\x00'}) 18:07:22 executing program 1: clone(0x2102001fff, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) socket(0x0, 0x0, 0x0) r0 = getpid() rt_tgsigqueueinfo(0x0, r0, 0x16, &(0x7f0000000100)) rt_sigqueueinfo(r0, 0x7, &(0x7f0000000180)={0x0, 0x0, 0xffffffff}) 18:07:22 executing program 4: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000040)='/dev/net/tun\x00', 0x0, 0x0) r1 = epoll_create1(0x0) epoll_ctl$EPOLL_CTL_ADD(0xffffffffffffffff, 0x1, r0, &(0x7f0000000100)) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000080)={'tunl0\x00', 0x1}) epoll_wait(r1, &(0x7f00000000c0)=[{}], 0x1, 0x0) [ 2615.073129] binder: 11959:11976 BC_ACQUIRE_DONE u0000000000000003 no match 18:07:22 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000006c0)={0x118, 0x0, &(0x7f0000000540)=[@release={0x40046306, 0x2}, @acquire_done, @acquire_done={0x40106309, 0x3}, @transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x50, 0x18, &(0x7f0000000080)={@flat=@binder={0x73622a85, 0xa, 0x1}, @fda={0x66646185, 0xa, 0x1, 0x9}, @fd={0x66642a85, 0x0, r1}}, &(0x7f0000000100)={0x0, 0x18, 0x38}}, 0x1000}, @transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000180)={@ptr={0x70742a85, 0x0, &(0x7f0000000140)=""/51, 0x33, 0x2, 0x25}, @flat=@weak_handle={0x77682a85, 0x1}, @flat=@binder={0x73622a85, 0xa, 0x3}}, &(0x7f0000000280)={0x0, 0x28, 0x40}}, 0x1f8aed83e3349436}, @exit_looper, @transaction_sg={0x40486311, {0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x68, 0x18, &(0x7f0000000480)={@ptr={0x70742a85, 0x0, &(0x7f00000002c0)=""/11, 0xb, 0x2, 0x3f}, @fd={0x66642a85, 0x0, r0}, @ptr={0x70742a85, 0x0, &(0x7f0000000380)=""/70, 0x46, 0x1, 0x1f}}, &(0x7f0000000500)={0x0, 0x28, 0x40}}, 0x1000}], 0x14, 0x0, &(0x7f0000000680)="86621f50fcee8bdc5bf8c503a78812261b4bf6d7"}) 18:07:22 executing program 3: r0 = socket(0x10, 0x3, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") ioctl$sock_ifreq(r0, 0x89f3, &(0x7f0000000240)={'sit0\x00'}) 18:07:22 executing program 1: clone(0x2102001fff, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) socket(0x0, 0x0, 0x0) r0 = getpid() rt_tgsigqueueinfo(0x0, r0, 0x16, &(0x7f0000000100)) rt_sigqueueinfo(r0, 0x7, &(0x7f0000000180)={0x0, 0x0, 0xffffffff}) [ 2615.073142] binder: 11959:11976 transaction failed 29189/-22, size 80-24 line 3014 [ 2615.073394] binder: undelivered TRANSACTION_ERROR: 29189 18:07:22 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000006c0)={0x118, 0x0, &(0x7f0000000540)=[@release={0x40046306, 0x2}, @acquire_done, @acquire_done={0x40106309, 0x3}, @transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x50, 0x18, &(0x7f0000000080)={@flat=@binder={0x73622a85, 0xa, 0x1}, @fda={0x66646185, 0xa, 0x1, 0x9}, @fd={0x66642a85, 0x0, r1}}, &(0x7f0000000100)={0x0, 0x18, 0x38}}, 0x1000}, @transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000180)={@ptr={0x70742a85, 0x0, &(0x7f0000000140)=""/51, 0x33, 0x2, 0x25}, @flat=@weak_handle={0x77682a85, 0x1}, @flat=@binder={0x73622a85, 0xa, 0x3}}, &(0x7f0000000280)={0x0, 0x28, 0x40}}, 0x1f8aed83e3349436}, @exit_looper, @transaction_sg={0x40486311, {0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x68, 0x18, &(0x7f0000000480)={@ptr={0x70742a85, 0x0, &(0x7f00000002c0)=""/11, 0xb, 0x2, 0x3f}, @fd={0x66642a85, 0x0, r0}, @ptr={0x70742a85, 0x0, &(0x7f0000000380)=""/70, 0x46, 0x1, 0x1f}}, &(0x7f0000000500)={0x0, 0x28, 0x40}}, 0x1000}], 0x14, 0x0, &(0x7f0000000680)="86621f50fcee8bdc5bf8c503a78812261b4bf6d7"}) 18:07:22 executing program 3: r0 = socket(0x10, 0x3, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") ioctl$sock_ifreq(r0, 0x89f3, &(0x7f0000000240)={'sit0\x00'}) [ 2615.211318] binder: 12020:12022 Release 1 refcount change on invalid ref 2 ret -22 [ 2615.211328] binder: 12020:12022 BC_ACQUIRE_DONE u0000000000000000 no match 18:07:22 executing program 2: ioctl$FS_IOC_RESVSP(0xffffffffffffffff, 0x40305828, &(0x7f00000000c0)={0x0, 0x0, 0x100000000000001}) clone(0x2102001fff, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) socket(0x0, 0x0, 0x0) r0 = getpid() rt_tgsigqueueinfo(0x0, r0, 0x16, &(0x7f0000000100)) ptrace(0x10, r0) ptrace$poke(0x4209, r0, &(0x7f00000000c0), 0x70effd) 18:07:22 executing program 4: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000040)='/dev/net/tun\x00', 0x0, 0x0) r1 = epoll_create1(0x0) epoll_ctl$EPOLL_CTL_ADD(0xffffffffffffffff, 0x1, r0, &(0x7f0000000100)) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000080)={'tunl0\x00', 0x1}) epoll_wait(r1, &(0x7f00000000c0)=[{}], 0x1, 0x0) [ 2615.211336] binder: 12020:12022 BC_ACQUIRE_DONE u0000000000000003 no match 18:07:22 executing program 3: r0 = socket(0x10, 0x3, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") ioctl$sock_ifreq(r0, 0x89f3, &(0x7f0000000240)={'sit0\x00'}) [ 2615.211350] binder: 12020:12022 transaction failed 29189/-22, size 80-24 line 3014 18:07:23 executing program 5: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000001a00)='/dev/net/tun\x00', 0x0, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000080)="c0dc00025e0b01047be070") ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000300)={'nr0\x01\x00', 0x1132}) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000001a00)='/dev/net/tun\x00', 0x2, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000300)={'nr0\x01\x00', 0x1132}) write$cgroup_int(0xffffffffffffffff, &(0x7f00000000c0)=0x2, 0xfffffffffffffe75) close(r1) 18:07:23 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000006c0)={0x118, 0x0, &(0x7f0000000540)=[@release={0x40046306, 0x2}, @acquire_done, @acquire_done={0x40106309, 0x3}, @transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x50, 0x18, &(0x7f0000000080)={@flat=@binder={0x73622a85, 0xa, 0x1}, @fda={0x66646185, 0xa, 0x1, 0x9}, @fd={0x66642a85, 0x0, r1}}, &(0x7f0000000100)={0x0, 0x18, 0x38}}, 0x1000}, @transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000180)={@ptr={0x70742a85, 0x0, &(0x7f0000000140)=""/51, 0x33, 0x2, 0x25}, @flat=@weak_handle={0x77682a85, 0x1}, @flat=@binder={0x73622a85, 0xa, 0x3}}, &(0x7f0000000280)={0x0, 0x28, 0x40}}, 0x1f8aed83e3349436}, @exit_looper, @transaction_sg={0x40486311, {0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x68, 0x18, &(0x7f0000000480)={@ptr={0x70742a85, 0x0, &(0x7f00000002c0)=""/11, 0xb, 0x2, 0x3f}, @fd={0x66642a85, 0x0, r0}, @ptr={0x70742a85, 0x0, &(0x7f0000000380)=""/70, 0x46, 0x1, 0x1f}}, &(0x7f0000000500)={0x0, 0x28, 0x40}}, 0x1000}], 0x14, 0x0, &(0x7f0000000680)="86621f50fcee8bdc5bf8c503a78812261b4bf6d7"}) 18:07:23 executing program 1: clone(0x2102001fff, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) socket(0x0, 0x0, 0x0) r0 = getpid() rt_tgsigqueueinfo(0x0, r0, 0x16, &(0x7f0000000100)) rt_sigqueueinfo(r0, 0x7, &(0x7f0000000180)={0x0, 0x0, 0xffffffff}) 18:07:23 executing program 3: r0 = socket(0x10, 0x3, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") ioctl$sock_ifreq(r0, 0x89f3, &(0x7f0000000240)={'sit0\x00'}) [ 2615.211549] binder: undelivered TRANSACTION_ERROR: 29189 [ 2615.376466] binder: 12055:12078 Release 1 refcount change on invalid ref 2 ret -22 18:07:23 executing program 4: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000040)='/dev/net/tun\x00', 0x0, 0x0) r1 = epoll_create1(0x0) epoll_ctl$EPOLL_CTL_ADD(0xffffffffffffffff, 0x1, r0, &(0x7f0000000100)) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000080)={'tunl0\x00', 0x1}) epoll_wait(r1, &(0x7f00000000c0)=[{}], 0x1, 0x0) 18:07:23 executing program 3: r0 = socket(0x10, 0x3, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") ioctl$sock_ifreq(r0, 0x89f3, &(0x7f0000000240)={'sit0\x00'}) [ 2615.376476] binder: 12055:12078 BC_ACQUIRE_DONE u0000000000000000 no match [ 2615.376483] binder: 12055:12078 BC_ACQUIRE_DONE u0000000000000003 no match 18:07:23 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000006c0)={0x118, 0x0, &(0x7f0000000540)=[@release={0x40046306, 0x2}, @acquire_done, @acquire_done={0x40106309, 0x3}, @transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x50, 0x18, &(0x7f0000000080)={@flat=@binder={0x73622a85, 0xa, 0x1}, @fda={0x66646185, 0xa, 0x1, 0x9}, @fd={0x66642a85, 0x0, r1}}, &(0x7f0000000100)={0x0, 0x18, 0x38}}, 0x1000}, @transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000180)={@ptr={0x70742a85, 0x0, &(0x7f0000000140)=""/51, 0x33, 0x2, 0x25}, @flat=@weak_handle={0x77682a85, 0x1}, @flat=@binder={0x73622a85, 0xa, 0x3}}, &(0x7f0000000280)={0x0, 0x28, 0x40}}, 0x1f8aed83e3349436}, @exit_looper, @transaction_sg={0x40486311, {0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x68, 0x18, &(0x7f0000000480)={@ptr={0x70742a85, 0x0, &(0x7f00000002c0)=""/11, 0xb, 0x2, 0x3f}, @fd={0x66642a85, 0x0, r0}, @ptr={0x70742a85, 0x0, &(0x7f0000000380)=""/70, 0x46, 0x1, 0x1f}}, &(0x7f0000000500)={0x0, 0x28, 0x40}}, 0x1000}], 0x14, 0x0, &(0x7f0000000680)="86621f50fcee8bdc5bf8c503a78812261b4bf6d7"}) 18:07:23 executing program 1: clone(0x2102001fff, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) socket(0x0, 0x0, 0x0) r0 = getpid() rt_tgsigqueueinfo(0x0, r0, 0x16, &(0x7f0000000100)) rt_sigqueueinfo(r0, 0x7, &(0x7f0000000180)={0x0, 0x0, 0xffffffff}) [ 2615.376495] binder: 12055:12078 transaction failed 29189/-22, size 80-24 line 3014 18:07:23 executing program 3: r0 = socket(0x10, 0x3, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") ioctl$sock_ifreq(r0, 0x89f3, &(0x7f0000000240)={'sit0\x00'}) [ 2615.377891] binder: undelivered TRANSACTION_ERROR: 29189 [ 2615.522208] binder: 12121:12136 Release 1 refcount change on invalid ref 2 ret -22 18:07:23 executing program 2: ioctl$FS_IOC_RESVSP(0xffffffffffffffff, 0x40305828, &(0x7f00000000c0)={0x0, 0x0, 0x100000000000001}) clone(0x2102001fff, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) socket(0x0, 0x0, 0x0) r0 = getpid() rt_tgsigqueueinfo(0x0, r0, 0x16, &(0x7f0000000100)) ptrace(0x10, r0) ptrace$poke(0x4209, r0, &(0x7f00000000c0), 0x70effd) 18:07:23 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000006c0)={0x118, 0x0, &(0x7f0000000540)=[@release={0x40046306, 0x2}, @acquire_done, @acquire_done={0x40106309, 0x3}, @transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x50, 0x18, &(0x7f0000000080)={@flat=@binder={0x73622a85, 0xa, 0x1}, @fda={0x66646185, 0xa, 0x1, 0x9}, @fd={0x66642a85, 0x0, r1}}, &(0x7f0000000100)={0x0, 0x18, 0x38}}, 0x1000}, @transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000180)={@ptr={0x70742a85, 0x0, &(0x7f0000000140)=""/51, 0x33, 0x2, 0x25}, @flat=@weak_handle={0x77682a85, 0x1}, @flat=@binder={0x73622a85, 0xa, 0x3}}, &(0x7f0000000280)={0x0, 0x28, 0x40}}, 0x1f8aed83e3349436}, @exit_looper, @transaction_sg={0x40486311, {0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x68, 0x18, &(0x7f0000000480)={@ptr={0x70742a85, 0x0, &(0x7f00000002c0)=""/11, 0xb, 0x2, 0x3f}, @fd={0x66642a85, 0x0, r0}, @ptr={0x70742a85, 0x0, &(0x7f0000000380)=""/70, 0x46, 0x1, 0x1f}}, &(0x7f0000000500)={0x0, 0x28, 0x40}}, 0x1000}], 0x14, 0x0, &(0x7f0000000680)="86621f50fcee8bdc5bf8c503a78812261b4bf6d7"}) 18:07:23 executing program 1: clone(0x2102001fff, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) socket(0x0, 0x0, 0x0) r0 = getpid() rt_tgsigqueueinfo(0x0, r0, 0x16, &(0x7f0000000100)) rt_sigqueueinfo(r0, 0x7, &(0x7f0000000180)={0x0, 0x0, 0xffffffff}) [ 2615.522219] binder: 12121:12136 BC_ACQUIRE_DONE u0000000000000000 no match [ 2615.522226] binder: 12121:12136 BC_ACQUIRE_DONE u0000000000000003 no match [ 2615.522239] binder: 12121:12136 transaction failed 29189/-22, size 80-24 line 3014 [ 2615.522644] binder: undelivered TRANSACTION_ERROR: 29189 18:07:23 executing program 5: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000001a00)='/dev/net/tun\x00', 0x0, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000080)="c0dc00025e0b01047be070") ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000300)={'nr0\x01\x00', 0x1132}) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000001a00)='/dev/net/tun\x00', 0x2, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000300)={'nr0\x01\x00', 0x1132}) write$cgroup_int(0xffffffffffffffff, &(0x7f00000000c0)=0x2, 0xfffffffffffffe75) close(r1) 18:07:23 executing program 3: r0 = socket(0x10, 0x3, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") ioctl$sock_ifreq(r0, 0x89f3, &(0x7f0000000240)={'sit0\x00'}) 18:07:23 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000006c0)={0x118, 0x0, &(0x7f0000000540)=[@release={0x40046306, 0x2}, @acquire_done, @acquire_done={0x40106309, 0x3}, @transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x50, 0x18, &(0x7f0000000080)={@flat=@binder={0x73622a85, 0xa, 0x1}, @fda={0x66646185, 0xa, 0x1, 0x9}, @fd={0x66642a85, 0x0, r1}}, &(0x7f0000000100)={0x0, 0x18, 0x38}}, 0x1000}, @transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000180)={@ptr={0x70742a85, 0x0, &(0x7f0000000140)=""/51, 0x33, 0x2, 0x25}, @flat=@weak_handle={0x77682a85, 0x1}, @flat=@binder={0x73622a85, 0xa, 0x3}}, &(0x7f0000000280)={0x0, 0x28, 0x40}}, 0x1f8aed83e3349436}, @exit_looper, @transaction_sg={0x40486311, {0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x68, 0x18, &(0x7f0000000480)={@ptr={0x70742a85, 0x0, &(0x7f00000002c0)=""/11, 0xb, 0x2, 0x3f}, @fd={0x66642a85, 0x0, r0}, @ptr={0x70742a85, 0x0, &(0x7f0000000380)=""/70, 0x46, 0x1, 0x1f}}, &(0x7f0000000500)={0x0, 0x28, 0x40}}, 0x1000}], 0x14, 0x0, &(0x7f0000000680)="86621f50fcee8bdc5bf8c503a78812261b4bf6d7"}) 18:07:23 executing program 1: clone(0x2102001fff, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) socket(0x0, 0x0, 0x0) r0 = getpid() rt_tgsigqueueinfo(0x0, r0, 0x16, &(0x7f0000000100)) rt_sigqueueinfo(r0, 0x7, &(0x7f0000000180)={0x0, 0x0, 0xffffffff}) [ 2615.729168] binder: 12185:12202 Release 1 refcount change on invalid ref 2 ret -22 18:07:23 executing program 4: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000040)='/dev/net/tun\x00', 0x0, 0x0) r1 = epoll_create1(0x0) epoll_ctl$EPOLL_CTL_ADD(0xffffffffffffffff, 0x1, r0, &(0x7f0000000100)) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000080)={'tunl0\x00', 0x1}) epoll_wait(r1, &(0x7f00000000c0)=[{}], 0x1, 0x0) 18:07:23 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000006c0)={0x118, 0x0, &(0x7f0000000540)=[@release={0x40046306, 0x2}, @acquire_done, @acquire_done={0x40106309, 0x3}, @transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x50, 0x18, &(0x7f0000000080)={@flat=@binder={0x73622a85, 0xa, 0x1}, @fda={0x66646185, 0xa, 0x1, 0x9}, @fd={0x66642a85, 0x0, r1}}, &(0x7f0000000100)={0x0, 0x18, 0x38}}, 0x1000}, @transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000180)={@ptr={0x70742a85, 0x0, &(0x7f0000000140)=""/51, 0x33, 0x2, 0x25}, @flat=@weak_handle={0x77682a85, 0x1}, @flat=@binder={0x73622a85, 0xa, 0x3}}, &(0x7f0000000280)={0x0, 0x28, 0x40}}, 0x1f8aed83e3349436}, @exit_looper, @transaction_sg={0x40486311, {0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x68, 0x18, &(0x7f0000000480)={@ptr={0x70742a85, 0x0, &(0x7f00000002c0)=""/11, 0xb, 0x2, 0x3f}, @fd={0x66642a85, 0x0, r0}, @ptr={0x70742a85, 0x0, &(0x7f0000000380)=""/70, 0x46, 0x1, 0x1f}}, &(0x7f0000000500)={0x0, 0x28, 0x40}}, 0x1000}], 0x14, 0x0, &(0x7f0000000680)="86621f50fcee8bdc5bf8c503a78812261b4bf6d7"}) [ 2615.729177] binder: 12185:12202 BC_ACQUIRE_DONE u0000000000000000 no match 18:07:23 executing program 3: r0 = socket(0x10, 0x3, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") ioctl$sock_ifreq(r0, 0x89f3, &(0x7f0000000240)={'sit0\x00'}) 18:07:23 executing program 1: clone(0x2102001fff, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) socket(0x0, 0x0, 0x0) r0 = getpid() rt_tgsigqueueinfo(0x0, r0, 0x16, &(0x7f0000000100)) rt_sigqueueinfo(r0, 0x7, &(0x7f0000000180)={0x0, 0x0, 0xffffffff}) 18:07:23 executing program 2: ioctl$FS_IOC_RESVSP(0xffffffffffffffff, 0x40305828, &(0x7f00000000c0)={0x0, 0x0, 0x100000000000001}) clone(0x2102001fff, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) socket(0x0, 0x0, 0x0) r0 = getpid() rt_tgsigqueueinfo(0x0, r0, 0x16, &(0x7f0000000100)) ptrace(0x10, r0) ptrace$poke(0x4209, r0, &(0x7f00000000c0), 0x70effd) [ 2615.729185] binder: 12185:12202 BC_ACQUIRE_DONE u0000000000000003 no match [ 2615.729205] binder: 12185:12202 transaction failed 29189/-22, size 80-24 line 3014 18:07:23 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000006c0)={0x118, 0x0, &(0x7f0000000540)=[@release={0x40046306, 0x2}, @acquire_done, @acquire_done={0x40106309, 0x3}, @transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x50, 0x18, &(0x7f0000000080)={@flat=@binder={0x73622a85, 0xa, 0x1}, @fda={0x66646185, 0xa, 0x1, 0x9}, @fd={0x66642a85, 0x0, r1}}, &(0x7f0000000100)={0x0, 0x18, 0x38}}, 0x1000}, @transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000180)={@ptr={0x70742a85, 0x0, &(0x7f0000000140)=""/51, 0x33, 0x2, 0x25}, @flat=@weak_handle={0x77682a85, 0x1}, @flat=@binder={0x73622a85, 0xa, 0x3}}, &(0x7f0000000280)={0x0, 0x28, 0x40}}, 0x1f8aed83e3349436}, @exit_looper, @transaction_sg={0x40486311, {0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x68, 0x18, &(0x7f0000000480)={@ptr={0x70742a85, 0x0, &(0x7f00000002c0)=""/11, 0xb, 0x2, 0x3f}, @fd={0x66642a85, 0x0, r0}, @ptr={0x70742a85, 0x0, &(0x7f0000000380)=""/70, 0x46, 0x1, 0x1f}}, &(0x7f0000000500)={0x0, 0x28, 0x40}}, 0x1000}], 0x14, 0x0, &(0x7f0000000680)="86621f50fcee8bdc5bf8c503a78812261b4bf6d7"}) 18:07:23 executing program 3: r0 = socket(0x10, 0x3, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") ioctl$sock_ifreq(r0, 0x89f3, &(0x7f0000000240)={'sit0\x00'}) 18:07:23 executing program 4: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000040)='/dev/net/tun\x00', 0x0, 0x0) r1 = epoll_create1(0x0) epoll_ctl$EPOLL_CTL_ADD(0xffffffffffffffff, 0x1, r0, &(0x7f0000000100)) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000080)={'tunl0\x00', 0x1}) epoll_wait(r1, &(0x7f00000000c0)=[{}], 0x1, 0x0) [ 2615.731318] binder: undelivered TRANSACTION_ERROR: 29189 18:07:23 executing program 5: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000001a00)='/dev/net/tun\x00', 0x0, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000080)="c0dc00025e0b01047be070") ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000300)={'nr0\x01\x00', 0x1132}) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000001a00)='/dev/net/tun\x00', 0x2, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000300)={'nr0\x01\x00', 0x1132}) write$cgroup_int(0xffffffffffffffff, &(0x7f00000000c0)=0x2, 0xfffffffffffffe75) close(r1) 18:07:23 executing program 1: clone(0x2102001fff, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) socket(0x0, 0x0, 0x0) r0 = getpid() rt_tgsigqueueinfo(0x0, r0, 0x16, &(0x7f0000000100)) rt_sigqueueinfo(r0, 0x7, &(0x7f0000000180)={0x0, 0x0, 0xffffffff}) 18:07:23 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000006c0)={0x118, 0x0, &(0x7f0000000540)=[@release={0x40046306, 0x2}, @acquire_done, @acquire_done={0x40106309, 0x3}, @transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x50, 0x18, &(0x7f0000000080)={@flat=@binder={0x73622a85, 0xa, 0x1}, @fda={0x66646185, 0xa, 0x1, 0x9}, @fd={0x66642a85, 0x0, r1}}, &(0x7f0000000100)={0x0, 0x18, 0x38}}, 0x1000}, @transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000180)={@ptr={0x70742a85, 0x0, &(0x7f0000000140)=""/51, 0x33, 0x2, 0x25}, @flat=@weak_handle={0x77682a85, 0x1}, @flat=@binder={0x73622a85, 0xa, 0x3}}, &(0x7f0000000280)={0x0, 0x28, 0x40}}, 0x1f8aed83e3349436}, @exit_looper, @transaction_sg={0x40486311, {0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x68, 0x18, &(0x7f0000000480)={@ptr={0x70742a85, 0x0, &(0x7f00000002c0)=""/11, 0xb, 0x2, 0x3f}, @fd={0x66642a85, 0x0, r0}, @ptr={0x70742a85, 0x0, &(0x7f0000000380)=""/70, 0x46, 0x1, 0x1f}}, &(0x7f0000000500)={0x0, 0x28, 0x40}}, 0x1000}], 0x14, 0x0, &(0x7f0000000680)="86621f50fcee8bdc5bf8c503a78812261b4bf6d7"}) 18:07:23 executing program 3: r0 = socket(0x10, 0x3, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") ioctl$sock_ifreq(r0, 0x89f3, &(0x7f0000000240)={'sit0\x00'}) [ 2615.897678] binder: 12239:12267 Release 1 refcount change on invalid ref 2 ret -22 [ 2615.897689] binder: 12239:12267 BC_ACQUIRE_DONE u0000000000000000 no match [ 2615.897697] binder: 12239:12267 BC_ACQUIRE_DONE u0000000000000003 no match 18:07:23 executing program 2: ioctl$FS_IOC_RESVSP(0xffffffffffffffff, 0x40305828, &(0x7f00000000c0)={0x0, 0x0, 0x100000000000001}) clone(0x2102001fff, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) socket(0x0, 0x0, 0x0) r0 = getpid() rt_tgsigqueueinfo(0x0, r0, 0x16, &(0x7f0000000100)) ptrace(0x10, r0) ptrace$poke(0x4209, r0, &(0x7f00000000c0), 0x70effd) [ 2615.897709] binder: 12239:12267 transaction failed 29189/-22, size 80-24 line 3014 18:07:23 executing program 3: r0 = socket(0x10, 0x3, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") ioctl$sock_ifreq(r0, 0x89f3, &(0x7f0000000240)={'sit0\x00'}) [ 2615.897941] binder: undelivered TRANSACTION_ERROR: 29189 18:07:23 executing program 1: clone(0x2102001fff, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) socket(0x0, 0x0, 0x0) r0 = getpid() rt_tgsigqueueinfo(0x0, r0, 0x16, &(0x7f0000000100)) rt_sigqueueinfo(r0, 0x7, &(0x7f0000000180)={0x0, 0x0, 0xffffffff}) 18:07:23 executing program 2: ioctl$FS_IOC_RESVSP(0xffffffffffffffff, 0x40305828, &(0x7f00000000c0)={0x0, 0x0, 0x100000000000001}) clone(0x2102001fff, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) socket(0x0, 0x0, 0x0) r0 = getpid() rt_tgsigqueueinfo(0x0, r0, 0x16, &(0x7f0000000100)) ptrace(0x10, r0) ptrace$poke(0x4209, r0, &(0x7f00000000c0), 0x70effd) 18:07:23 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000006c0)={0x118, 0x0, &(0x7f0000000540)=[@release={0x40046306, 0x2}, @acquire_done, @acquire_done={0x40106309, 0x3}, @transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x50, 0x18, &(0x7f0000000080)={@flat=@binder={0x73622a85, 0xa, 0x1}, @fda={0x66646185, 0xa, 0x1, 0x9}, @fd={0x66642a85, 0x0, r1}}, &(0x7f0000000100)={0x0, 0x18, 0x38}}, 0x1000}, @transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000180)={@ptr={0x70742a85, 0x0, &(0x7f0000000140)=""/51, 0x33, 0x2, 0x25}, @flat=@weak_handle={0x77682a85, 0x1}, @flat=@binder={0x73622a85, 0xa, 0x3}}, &(0x7f0000000280)={0x0, 0x28, 0x40}}, 0x1f8aed83e3349436}, @exit_looper, @transaction_sg={0x40486311, {0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x68, 0x18, &(0x7f0000000480)={@ptr={0x70742a85, 0x0, &(0x7f00000002c0)=""/11, 0xb, 0x2, 0x3f}, @fd={0x66642a85, 0x0, r0}, @ptr={0x70742a85, 0x0, &(0x7f0000000380)=""/70, 0x46, 0x1, 0x1f}}, &(0x7f0000000500)={0x0, 0x28, 0x40}}, 0x1000}], 0x14, 0x0, &(0x7f0000000680)="86621f50fcee8bdc5bf8c503a78812261b4bf6d7"}) [ 2616.027572] binder: 12290:12310 Release 1 refcount change on invalid ref 2 ret -22 18:07:23 executing program 3: r0 = socket(0x10, 0x3, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") ioctl$sock_ifreq(r0, 0x89f3, &(0x7f0000000240)={'sit0\x00'}) 18:07:24 executing program 4: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000040)='/dev/net/tun\x00', 0x0, 0x0) r1 = epoll_create1(0x0) epoll_ctl$EPOLL_CTL_ADD(0xffffffffffffffff, 0x1, r0, &(0x7f0000000100)) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000080)={'tunl0\x00', 0x1}) epoll_wait(r1, &(0x7f00000000c0)=[{}], 0x1, 0x0) 18:07:24 executing program 1: clone(0x2102001fff, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) socket(0x0, 0x0, 0x0) r0 = getpid() rt_tgsigqueueinfo(0x0, r0, 0x16, &(0x7f0000000100)) rt_sigqueueinfo(r0, 0x7, &(0x7f0000000180)={0x0, 0x0, 0xffffffff}) [ 2616.027582] binder: 12290:12310 BC_ACQUIRE_DONE u0000000000000000 no match [ 2616.027590] binder: 12290:12310 BC_ACQUIRE_DONE u0000000000000003 no match [ 2616.027603] binder: 12290:12310 transaction failed 29189/-22, size 80-24 line 3014 [ 2616.027905] binder: undelivered TRANSACTION_ERROR: 29189 [ 2616.203000] binder: 12340:12351 Release 1 refcount change on invalid ref 2 ret -22 [ 2616.203010] binder: 12340:12351 BC_ACQUIRE_DONE u0000000000000000 no match [ 2616.203018] binder: 12340:12351 BC_ACQUIRE_DONE u0000000000000003 no match [ 2616.203031] binder: 12340:12351 transaction failed 29189/-22, size 80-24 line 3014 [ 2616.203275] binder: undelivered TRANSACTION_ERROR: 29189 [ 2616.275169] binder: 12376:12386 Release 1 refcount change on invalid ref 2 ret -22 [ 2616.275179] binder: 12376:12386 BC_ACQUIRE_DONE u0000000000000000 no match [ 2616.275187] binder: 12376:12386 BC_ACQUIRE_DONE u0000000000000003 no match 18:07:24 executing program 5: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000001a00)='/dev/net/tun\x00', 0x0, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000080)="c0dc00025e0b01047be070") ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000300)={'nr0\x01\x00', 0x1132}) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000001a00)='/dev/net/tun\x00', 0x2, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000300)={'nr0\x01\x00', 0x1132}) write$cgroup_int(0xffffffffffffffff, &(0x7f00000000c0)=0x2, 0xfffffffffffffe75) close(r1) 18:07:24 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000006c0)={0x118, 0x0, &(0x7f0000000540)=[@release={0x40046306, 0x2}, @acquire_done, @acquire_done={0x40106309, 0x3}, @transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x50, 0x18, &(0x7f0000000080)={@flat=@binder={0x73622a85, 0xa, 0x1}, @fda={0x66646185, 0xa, 0x1, 0x9}, @fd={0x66642a85, 0x0, r1}}, &(0x7f0000000100)={0x0, 0x18, 0x38}}, 0x1000}, @transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000180)={@ptr={0x70742a85, 0x0, &(0x7f0000000140)=""/51, 0x33, 0x2, 0x25}, @flat=@weak_handle={0x77682a85, 0x1}, @flat=@binder={0x73622a85, 0xa, 0x3}}, &(0x7f0000000280)={0x0, 0x28, 0x40}}, 0x1f8aed83e3349436}, @exit_looper, @transaction_sg={0x40486311, {0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x68, 0x18, &(0x7f0000000480)={@ptr={0x70742a85, 0x0, &(0x7f00000002c0)=""/11, 0xb, 0x2, 0x3f}, @fd={0x66642a85, 0x0, r0}, @ptr={0x70742a85, 0x0, &(0x7f0000000380)=""/70, 0x46, 0x1, 0x1f}}, &(0x7f0000000500)={0x0, 0x28, 0x40}}, 0x1000}], 0x14, 0x0, &(0x7f0000000680)="86621f50fcee8bdc5bf8c503a78812261b4bf6d7"}) 18:07:24 executing program 3: r0 = socket(0x10, 0x3, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") ioctl$sock_ifreq(r0, 0x89f3, &(0x7f0000000240)={'sit0\x00'}) 18:07:24 executing program 1: clone(0x2102001fff, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) socket(0x0, 0x0, 0x0) r0 = getpid() rt_tgsigqueueinfo(0x0, r0, 0x16, &(0x7f0000000100)) rt_sigqueueinfo(r0, 0x7, &(0x7f0000000180)={0x0, 0x0, 0xffffffff}) 18:07:24 executing program 2: ioctl$FS_IOC_RESVSP(0xffffffffffffffff, 0x40305828, &(0x7f00000000c0)={0x0, 0x0, 0x100000000000001}) clone(0x2102001fff, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) socket(0x0, 0x0, 0x0) r0 = getpid() rt_tgsigqueueinfo(0x0, r0, 0x16, &(0x7f0000000100)) ptrace(0x10, r0) ptrace$poke(0x4209, r0, &(0x7f00000000c0), 0x70effd) 18:07:24 executing program 4: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000040)='/dev/net/tun\x00', 0x0, 0x0) r1 = epoll_create1(0x0) epoll_ctl$EPOLL_CTL_ADD(0xffffffffffffffff, 0x1, r0, &(0x7f0000000100)) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000080)={'tunl0\x00', 0x1}) epoll_wait(r1, &(0x7f00000000c0)=[{}], 0x1, 0x0) [ 2616.275200] binder: 12376:12386 transaction failed 29189/-22, size 80-24 line 3014 [ 2616.275482] binder: undelivered TRANSACTION_ERROR: 29189 [ 2616.422558] binder: 12421:12432 Release 1 refcount change on invalid ref 2 ret -22 [ 2616.422568] binder: 12421:12432 BC_ACQUIRE_DONE u0000000000000000 no match [ 2616.422576] binder: 12421:12432 BC_ACQUIRE_DONE u0000000000000003 no match 18:07:24 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000006c0)={0x118, 0x0, &(0x7f0000000540)=[@release={0x40046306, 0x2}, @acquire_done, @acquire_done={0x40106309, 0x3}, @transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x50, 0x18, &(0x7f0000000080)={@flat=@binder={0x73622a85, 0xa, 0x1}, @fda={0x66646185, 0xa, 0x1, 0x9}, @fd={0x66642a85, 0x0, r1}}, &(0x7f0000000100)={0x0, 0x18, 0x38}}, 0x1000}, @transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000180)={@ptr={0x70742a85, 0x0, &(0x7f0000000140)=""/51, 0x33, 0x2, 0x25}, @flat=@weak_handle={0x77682a85, 0x1}, @flat=@binder={0x73622a85, 0xa, 0x3}}, &(0x7f0000000280)={0x0, 0x28, 0x40}}, 0x1f8aed83e3349436}, @exit_looper, @transaction_sg={0x40486311, {0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x68, 0x18, &(0x7f0000000480)={@ptr={0x70742a85, 0x0, &(0x7f00000002c0)=""/11, 0xb, 0x2, 0x3f}, @fd={0x66642a85, 0x0, r0}, @ptr={0x70742a85, 0x0, &(0x7f0000000380)=""/70, 0x46, 0x1, 0x1f}}, &(0x7f0000000500)={0x0, 0x28, 0x40}}, 0x1000}], 0x14, 0x0, &(0x7f0000000680)="86621f50fcee8bdc5bf8c503a78812261b4bf6d7"}) [ 2616.422589] binder: 12421:12432 transaction failed 29189/-22, size 80-24 line 3014 18:07:24 executing program 4: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000040)='/dev/net/tun\x00', 0x0, 0x0) r1 = epoll_create1(0x0) epoll_ctl$EPOLL_CTL_ADD(0xffffffffffffffff, 0x1, r0, &(0x7f0000000100)) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000080)={'tunl0\x00', 0x1}) epoll_wait(r1, &(0x7f00000000c0)=[{}], 0x1, 0x0) 18:07:24 executing program 3: r0 = socket(0x10, 0x3, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") ioctl$sock_ifreq(r0, 0x89f3, &(0x7f0000000240)={'sit0\x00'}) [ 2616.422780] binder: undelivered TRANSACTION_ERROR: 29189 18:07:24 executing program 1: clone(0x2102001fff, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) socket(0x0, 0x0, 0x0) r0 = getpid() rt_tgsigqueueinfo(0x0, r0, 0x16, &(0x7f0000000100)) rt_sigqueueinfo(r0, 0x7, &(0x7f0000000180)={0x0, 0x0, 0xffffffff}) 18:07:24 executing program 3: r0 = socket(0x10, 0x3, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") ioctl$sock_ifreq(r0, 0x89f3, &(0x7f0000000240)={'sit0\x00'}) 18:07:24 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000006c0)={0x118, 0x0, &(0x7f0000000540)=[@release={0x40046306, 0x2}, @acquire_done, @acquire_done={0x40106309, 0x3}, @transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x50, 0x18, &(0x7f0000000080)={@flat=@binder={0x73622a85, 0xa, 0x1}, @fda={0x66646185, 0xa, 0x1, 0x9}, @fd={0x66642a85, 0x0, r1}}, &(0x7f0000000100)={0x0, 0x18, 0x38}}, 0x1000}, @transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000180)={@ptr={0x70742a85, 0x0, &(0x7f0000000140)=""/51, 0x33, 0x2, 0x25}, @flat=@weak_handle={0x77682a85, 0x1}, @flat=@binder={0x73622a85, 0xa, 0x3}}, &(0x7f0000000280)={0x0, 0x28, 0x40}}, 0x1f8aed83e3349436}, @exit_looper, @transaction_sg={0x40486311, {0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x68, 0x18, &(0x7f0000000480)={@ptr={0x70742a85, 0x0, &(0x7f00000002c0)=""/11, 0xb, 0x2, 0x3f}, @fd={0x66642a85, 0x0, r0}, @ptr={0x70742a85, 0x0, &(0x7f0000000380)=""/70, 0x46, 0x1, 0x1f}}, &(0x7f0000000500)={0x0, 0x28, 0x40}}, 0x1000}], 0x14, 0x0, &(0x7f0000000680)="86621f50fcee8bdc5bf8c503a78812261b4bf6d7"}) [ 2616.490870] binder: 12467:12482 Release 1 refcount change on invalid ref 2 ret -22 [ 2616.490880] binder: 12467:12482 BC_ACQUIRE_DONE u0000000000000000 no match 18:07:24 executing program 5: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000001a00)='/dev/net/tun\x00', 0x0, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000080)="c0dc00025e0b01047be070") ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000300)={'nr0\x01\x00', 0x1132}) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000001a00)='/dev/net/tun\x00', 0x2, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000300)={'nr0\x01\x00', 0x1132}) write$cgroup_int(0xffffffffffffffff, &(0x7f00000000c0)=0x2, 0xfffffffffffffe75) close(r1) 18:07:24 executing program 2: ioctl$FS_IOC_RESVSP(0xffffffffffffffff, 0x40305828, &(0x7f00000000c0)={0x0, 0x0, 0x100000000000001}) clone(0x2102001fff, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) socket(0x0, 0x0, 0x0) r0 = getpid() rt_tgsigqueueinfo(0x0, r0, 0x16, &(0x7f0000000100)) ptrace(0x10, r0) ptrace$poke(0x4209, r0, &(0x7f00000000c0), 0x70effd) [ 2616.490888] binder: 12467:12482 BC_ACQUIRE_DONE u0000000000000003 no match 18:07:24 executing program 4: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000040)='/dev/net/tun\x00', 0x0, 0x0) r1 = epoll_create1(0x0) epoll_ctl$EPOLL_CTL_ADD(0xffffffffffffffff, 0x1, r0, &(0x7f0000000100)) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000080)={'tunl0\x00', 0x1}) epoll_wait(r1, &(0x7f00000000c0)=[{}], 0x1, 0x0) 18:07:24 executing program 1: clone(0x2102001fff, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) socket(0x0, 0x0, 0x0) r0 = getpid() rt_tgsigqueueinfo(0x0, r0, 0x16, &(0x7f0000000100)) rt_sigqueueinfo(r0, 0x7, &(0x7f0000000180)={0x0, 0x0, 0xffffffff}) 18:07:24 executing program 3: r0 = socket(0x10, 0x3, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") ioctl$sock_ifreq(r0, 0x89f3, &(0x7f0000000240)={'sit0\x00'}) [ 2616.490911] binder: 12467:12482 transaction failed 29189/-22, size 80-24 line 3014 18:07:24 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000006c0)={0x118, 0x0, &(0x7f0000000540)=[@release={0x40046306, 0x2}, @acquire_done, @acquire_done={0x40106309, 0x3}, @transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x50, 0x18, &(0x7f0000000080)={@flat=@binder={0x73622a85, 0xa, 0x1}, @fda={0x66646185, 0xa, 0x1, 0x9}, @fd={0x66642a85, 0x0, r1}}, &(0x7f0000000100)={0x0, 0x18, 0x38}}, 0x1000}, @transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000180)={@ptr={0x70742a85, 0x0, &(0x7f0000000140)=""/51, 0x33, 0x2, 0x25}, @flat=@weak_handle={0x77682a85, 0x1}, @flat=@binder={0x73622a85, 0xa, 0x3}}, &(0x7f0000000280)={0x0, 0x28, 0x40}}, 0x1f8aed83e3349436}, @exit_looper, @transaction_sg={0x40486311, {0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x68, 0x18, &(0x7f0000000480)={@ptr={0x70742a85, 0x0, &(0x7f00000002c0)=""/11, 0xb, 0x2, 0x3f}, @fd={0x66642a85, 0x0, r0}, @ptr={0x70742a85, 0x0, &(0x7f0000000380)=""/70, 0x46, 0x1, 0x1f}}, &(0x7f0000000500)={0x0, 0x28, 0x40}}, 0x1000}], 0x14, 0x0, &(0x7f0000000680)="86621f50fcee8bdc5bf8c503a78812261b4bf6d7"}) [ 2616.492614] binder: undelivered TRANSACTION_ERROR: 29189 [ 2616.601566] binder: 12490:12531 Release 1 refcount change on invalid ref 2 ret -22 18:07:24 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000006c0)={0x118, 0x0, &(0x7f0000000540)=[@release={0x40046306, 0x2}, @acquire_done, @acquire_done={0x40106309, 0x3}, @transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x50, 0x18, &(0x7f0000000080)={@flat=@binder={0x73622a85, 0xa, 0x1}, @fda={0x66646185, 0xa, 0x1, 0x9}, @fd={0x66642a85, 0x0, r1}}, &(0x7f0000000100)={0x0, 0x18, 0x38}}, 0x1000}, @transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000180)={@ptr={0x70742a85, 0x0, &(0x7f0000000140)=""/51, 0x33, 0x2, 0x25}, @flat=@weak_handle={0x77682a85, 0x1}, @flat=@binder={0x73622a85, 0xa, 0x3}}, &(0x7f0000000280)={0x0, 0x28, 0x40}}, 0x1f8aed83e3349436}, @exit_looper, @transaction_sg={0x40486311, {0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x68, 0x18, &(0x7f0000000480)={@ptr={0x70742a85, 0x0, &(0x7f00000002c0)=""/11, 0xb, 0x2, 0x3f}, @fd={0x66642a85, 0x0, r0}, @ptr={0x70742a85, 0x0, &(0x7f0000000380)=""/70, 0x46, 0x1, 0x1f}}, &(0x7f0000000500)={0x0, 0x28, 0x40}}, 0x1000}], 0x14, 0x0, &(0x7f0000000680)="86621f50fcee8bdc5bf8c503a78812261b4bf6d7"}) 18:07:24 executing program 3: r0 = socket(0x10, 0x3, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") ioctl$sock_ifreq(r0, 0x89f3, &(0x7f0000000240)={'sit0\x00'}) [ 2616.601576] binder: 12490:12531 BC_ACQUIRE_DONE u0000000000000000 no match [ 2616.601585] binder: 12490:12531 BC_ACQUIRE_DONE u0000000000000003 no match [ 2616.601597] binder: 12490:12531 transaction failed 29189/-22, size 80-24 line 3014 18:07:24 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000006c0)={0x118, 0x0, &(0x7f0000000540)=[@release={0x40046306, 0x2}, @acquire_done, @acquire_done={0x40106309, 0x3}, @transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x50, 0x18, &(0x7f0000000080)={@flat=@binder={0x73622a85, 0xa, 0x1}, @fda={0x66646185, 0xa, 0x1, 0x9}, @fd={0x66642a85, 0x0, r1}}, &(0x7f0000000100)={0x0, 0x18, 0x38}}, 0x1000}, @transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000180)={@ptr={0x70742a85, 0x0, &(0x7f0000000140)=""/51, 0x33, 0x2, 0x25}, @flat=@weak_handle={0x77682a85, 0x1}, @flat=@binder={0x73622a85, 0xa, 0x3}}, &(0x7f0000000280)={0x0, 0x28, 0x40}}, 0x1f8aed83e3349436}, @exit_looper, @transaction_sg={0x40486311, {0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x68, 0x18, &(0x7f0000000480)={@ptr={0x70742a85, 0x0, &(0x7f00000002c0)=""/11, 0xb, 0x2, 0x3f}, @fd={0x66642a85, 0x0, r0}, @ptr={0x70742a85, 0x0, &(0x7f0000000380)=""/70, 0x46, 0x1, 0x1f}}, &(0x7f0000000500)={0x0, 0x28, 0x40}}, 0x1000}], 0x14, 0x0, &(0x7f0000000680)="86621f50fcee8bdc5bf8c503a78812261b4bf6d7"}) 18:07:24 executing program 4: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000040)='/dev/net/tun\x00', 0x0, 0x0) r1 = epoll_create1(0x0) epoll_ctl$EPOLL_CTL_ADD(0xffffffffffffffff, 0x1, r0, &(0x7f0000000100)) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000080)={'tunl0\x00', 0x1}) epoll_wait(r1, &(0x7f00000000c0)=[{}], 0x1, 0x0) 18:07:24 executing program 2: ioctl$FS_IOC_RESVSP(0xffffffffffffffff, 0x40305828, &(0x7f00000000c0)={0x0, 0x0, 0x100000000000001}) clone(0x2102001fff, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) socket(0x0, 0x0, 0x0) r0 = getpid() rt_tgsigqueueinfo(0x0, r0, 0x16, &(0x7f0000000100)) ptrace(0x10, r0) ptrace$poke(0x4209, r0, &(0x7f00000000c0), 0x70effd) 18:07:24 executing program 3: r0 = socket(0x10, 0x3, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") ioctl$sock_ifreq(r0, 0x89f3, &(0x7f0000000240)={'sit0\x00'}) [ 2616.601943] binder: undelivered TRANSACTION_ERROR: 29189 [ 2616.760323] binder: 12567:12579 Release 1 refcount change on invalid ref 2 ret -22 [ 2616.760334] binder: 12567:12579 BC_ACQUIRE_DONE u0000000000000000 no match [ 2616.760341] binder: 12567:12579 BC_ACQUIRE_DONE u0000000000000003 no match [ 2616.760355] binder: 12567:12579 transaction failed 29189/-22, size 80-24 line 3014 [ 2616.760714] binder: undelivered TRANSACTION_ERROR: 29189 [ 2617.019616] binder: 12665:12667 Release 1 refcount change on invalid ref 2 ret -22 [ 2617.019626] binder: 12665:12667 BC_ACQUIRE_DONE u0000000000000000 no match [ 2617.019634] binder: 12665:12667 BC_ACQUIRE_DONE u0000000000000003 no match [ 2617.019648] binder: 12665:12667 transaction failed 29189/-22, size 80-24 line 3014 [ 2617.020104] binder: undelivered TRANSACTION_ERROR: 29189 [ 2617.135876] binder: 12724:12743 Release 1 refcount change on invalid ref 2 ret -22 [ 2617.135886] binder: 12724:12743 BC_ACQUIRE_DONE u0000000000000000 no match [ 2617.135895] binder: 12724:12743 BC_ACQUIRE_DONE u0000000000000003 no match [ 2617.135907] binder: 12724:12743 transaction failed 29189/-22, size 80-24 line 3014 18:07:25 executing program 5: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000001a00)='/dev/net/tun\x00', 0x0, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000080)="c0dc00025e0b01047be070") ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000300)={'nr0\x01\x00', 0x1132}) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000001a00)='/dev/net/tun\x00', 0x2, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000300)={'nr0\x01\x00', 0x1132}) write$cgroup_int(0xffffffffffffffff, &(0x7f00000000c0)=0x2, 0xfffffffffffffe75) close(r1) 18:07:25 executing program 1: clone(0x2102001fff, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) socket(0x0, 0x0, 0x0) r0 = getpid() rt_tgsigqueueinfo(0x0, r0, 0x16, &(0x7f0000000100)) rt_sigqueueinfo(r0, 0x7, &(0x7f0000000180)={0x0, 0x0, 0xffffffff}) 18:07:25 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000006c0)={0x118, 0x0, &(0x7f0000000540)=[@release={0x40046306, 0x2}, @acquire_done, @acquire_done={0x40106309, 0x3}, @transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x50, 0x18, &(0x7f0000000080)={@flat=@binder={0x73622a85, 0xa, 0x1}, @fda={0x66646185, 0xa, 0x1, 0x9}, @fd={0x66642a85, 0x0, r1}}, &(0x7f0000000100)={0x0, 0x18, 0x38}}, 0x1000}, @transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000180)={@ptr={0x70742a85, 0x0, &(0x7f0000000140)=""/51, 0x33, 0x2, 0x25}, @flat=@weak_handle={0x77682a85, 0x1}, @flat=@binder={0x73622a85, 0xa, 0x3}}, &(0x7f0000000280)={0x0, 0x28, 0x40}}, 0x1f8aed83e3349436}, @exit_looper, @transaction_sg={0x40486311, {0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x68, 0x18, &(0x7f0000000480)={@ptr={0x70742a85, 0x0, &(0x7f00000002c0)=""/11, 0xb, 0x2, 0x3f}, @fd={0x66642a85, 0x0, r0}, @ptr={0x70742a85, 0x0, &(0x7f0000000380)=""/70, 0x46, 0x1, 0x1f}}, &(0x7f0000000500)={0x0, 0x28, 0x40}}, 0x1000}], 0x14, 0x0, &(0x7f0000000680)="86621f50fcee8bdc5bf8c503a78812261b4bf6d7"}) 18:07:25 executing program 4: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000040)='/dev/net/tun\x00', 0x0, 0x0) r1 = epoll_create1(0x0) epoll_ctl$EPOLL_CTL_ADD(0xffffffffffffffff, 0x1, r0, &(0x7f0000000100)) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000080)={'tunl0\x00', 0x1}) epoll_wait(r1, &(0x7f00000000c0)=[{}], 0x1, 0x0) [ 2617.160088] binder: undelivered TRANSACTION_ERROR: 29189 [ 2617.254843] binder: 12766:12769 Release 1 refcount change on invalid ref 2 ret -22 [ 2617.254853] binder: 12766:12769 BC_ACQUIRE_DONE u0000000000000000 no match 18:07:25 executing program 2: ioctl$FS_IOC_RESVSP(0xffffffffffffffff, 0x40305828, &(0x7f00000000c0)={0x0, 0x0, 0x100000000000001}) clone(0x2102001fff, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) socket(0x0, 0x0, 0x0) r0 = getpid() rt_tgsigqueueinfo(0x0, r0, 0x16, &(0x7f0000000100)) ptrace(0x10, r0) ptrace$poke(0x4209, r0, &(0x7f00000000c0), 0x70effd) [ 2617.254862] binder: 12766:12769 BC_ACQUIRE_DONE u0000000000000003 no match [ 2617.254877] binder: 12766:12769 transaction failed 29189/-22, size 80-24 line 3014 [ 2617.255159] binder: undelivered TRANSACTION_ERROR: 29189 [ 2617.420746] binder: 12826:12838 Release 1 refcount change on invalid ref 2 ret -22 18:07:25 executing program 3: r0 = socket(0x10, 0x3, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") ioctl$sock_ifreq(r0, 0x89f3, &(0x7f0000000240)={'sit0\x00'}) [ 2617.420756] binder: 12826:12838 BC_ACQUIRE_DONE u0000000000000000 no match [ 2617.420763] binder: 12826:12838 BC_ACQUIRE_DONE u0000000000000003 no match [ 2617.420776] binder: 12826:12838 transaction failed 29189/-22, size 80-24 line 3014 [ 2617.421136] binder: undelivered TRANSACTION_ERROR: 29189 [ 2617.512839] binder: 12866:12878 Release 1 refcount change on invalid ref 2 ret -22 18:07:25 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000006c0)={0x118, 0x0, &(0x7f0000000540)=[@release={0x40046306, 0x2}, @acquire_done, @acquire_done={0x40106309, 0x3}, @transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x50, 0x18, &(0x7f0000000080)={@flat=@binder={0x73622a85, 0xa, 0x1}, @fda={0x66646185, 0xa, 0x1, 0x9}, @fd={0x66642a85, 0x0, r1}}, &(0x7f0000000100)={0x0, 0x18, 0x38}}, 0x1000}, @transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000180)={@ptr={0x70742a85, 0x0, &(0x7f0000000140)=""/51, 0x33, 0x2, 0x25}, @flat=@weak_handle={0x77682a85, 0x1}, @flat=@binder={0x73622a85, 0xa, 0x3}}, &(0x7f0000000280)={0x0, 0x28, 0x40}}, 0x1f8aed83e3349436}, @exit_looper, @transaction_sg={0x40486311, {0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x68, 0x18, &(0x7f0000000480)={@ptr={0x70742a85, 0x0, &(0x7f00000002c0)=""/11, 0xb, 0x2, 0x3f}, @fd={0x66642a85, 0x0, r0}, @ptr={0x70742a85, 0x0, &(0x7f0000000380)=""/70, 0x46, 0x1, 0x1f}}, &(0x7f0000000500)={0x0, 0x28, 0x40}}, 0x1000}], 0x14, 0x0, &(0x7f0000000680)="86621f50fcee8bdc5bf8c503a78812261b4bf6d7"}) [ 2617.512849] binder: 12866:12878 BC_ACQUIRE_DONE u0000000000000000 no match 18:07:25 executing program 3: r0 = socket(0x10, 0x3, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") ioctl$sock_ifreq(r0, 0x89f3, &(0x7f0000000240)={'sit0\x00'}) 18:07:25 executing program 1: clone(0x2102001fff, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) socket(0x0, 0x0, 0x0) r0 = getpid() rt_tgsigqueueinfo(0x0, r0, 0x16, &(0x7f0000000100)) rt_sigqueueinfo(r0, 0x7, &(0x7f0000000180)={0x0, 0x0, 0xffffffff}) [ 2617.512857] binder: 12866:12878 BC_ACQUIRE_DONE u0000000000000003 no match [ 2617.512869] binder: 12866:12878 transaction failed 29189/-22, size 80-24 line 3014 [ 2617.514136] binder: undelivered TRANSACTION_ERROR: 29189 [ 2617.649217] binder: 12927:12942 Release 1 refcount change on invalid ref 2 ret -22 18:07:25 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000006c0)={0x118, 0x0, &(0x7f0000000540)=[@release={0x40046306, 0x2}, @acquire_done, @acquire_done={0x40106309, 0x3}, @transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x50, 0x18, &(0x7f0000000080)={@flat=@binder={0x73622a85, 0xa, 0x1}, @fda={0x66646185, 0xa, 0x1, 0x9}, @fd={0x66642a85, 0x0, r1}}, &(0x7f0000000100)={0x0, 0x18, 0x38}}, 0x1000}, @transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000180)={@ptr={0x70742a85, 0x0, &(0x7f0000000140)=""/51, 0x33, 0x2, 0x25}, @flat=@weak_handle={0x77682a85, 0x1}, @flat=@binder={0x73622a85, 0xa, 0x3}}, &(0x7f0000000280)={0x0, 0x28, 0x40}}, 0x1f8aed83e3349436}, @exit_looper, @transaction_sg={0x40486311, {0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x68, 0x18, &(0x7f0000000480)={@ptr={0x70742a85, 0x0, &(0x7f00000002c0)=""/11, 0xb, 0x2, 0x3f}, @fd={0x66642a85, 0x0, r0}, @ptr={0x70742a85, 0x0, &(0x7f0000000380)=""/70, 0x46, 0x1, 0x1f}}, &(0x7f0000000500)={0x0, 0x28, 0x40}}, 0x1000}], 0x14, 0x0, &(0x7f0000000680)="86621f50fcee8bdc5bf8c503a78812261b4bf6d7"}) 18:07:25 executing program 4: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000040)='/dev/net/tun\x00', 0x0, 0x0) r1 = epoll_create1(0x0) epoll_ctl$EPOLL_CTL_ADD(0xffffffffffffffff, 0x1, r0, &(0x7f0000000100)) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000080)={'tunl0\x00', 0x1}) epoll_wait(r1, &(0x7f00000000c0)=[{}], 0x1, 0x0) 18:07:25 executing program 2: ioctl$FS_IOC_RESVSP(0xffffffffffffffff, 0x40305828, &(0x7f00000000c0)={0x0, 0x0, 0x100000000000001}) clone(0x2102001fff, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) socket(0x0, 0x0, 0x0) r0 = getpid() rt_tgsigqueueinfo(0x0, r0, 0x16, &(0x7f0000000100)) ptrace(0x10, r0) ptrace$poke(0x4209, r0, &(0x7f00000000c0), 0x70effd) 18:07:25 executing program 5: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000001a00)='/dev/net/tun\x00', 0x0, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000080)="c0dc00025e0b01047be070") ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000300)={'nr0\x01\x00', 0x1132}) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000001a00)='/dev/net/tun\x00', 0x2, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000300)={'nr0\x01\x00', 0x1132}) write$cgroup_int(0xffffffffffffffff, &(0x7f00000000c0)=0x2, 0xfffffffffffffe75) close(r1) [ 2617.649227] binder: 12927:12942 BC_ACQUIRE_DONE u0000000000000000 no match 18:07:25 executing program 1: clone(0x2102001fff, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) socket(0x0, 0x0, 0x0) r0 = getpid() rt_tgsigqueueinfo(0x0, r0, 0x16, &(0x7f0000000100)) rt_sigqueueinfo(r0, 0x7, &(0x7f0000000180)={0x0, 0x0, 0xffffffff}) 18:07:25 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000006c0)={0x118, 0x0, &(0x7f0000000540)=[@release={0x40046306, 0x2}, @acquire_done, @acquire_done={0x40106309, 0x3}, @transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x50, 0x18, &(0x7f0000000080)={@flat=@binder={0x73622a85, 0xa, 0x1}, @fda={0x66646185, 0xa, 0x1, 0x9}, @fd={0x66642a85, 0x0, r1}}, &(0x7f0000000100)={0x0, 0x18, 0x38}}, 0x1000}, @transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000180)={@ptr={0x70742a85, 0x0, &(0x7f0000000140)=""/51, 0x33, 0x2, 0x25}, @flat=@weak_handle={0x77682a85, 0x1}, @flat=@binder={0x73622a85, 0xa, 0x3}}, &(0x7f0000000280)={0x0, 0x28, 0x40}}, 0x1f8aed83e3349436}, @exit_looper, @transaction_sg={0x40486311, {0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x68, 0x18, &(0x7f0000000480)={@ptr={0x70742a85, 0x0, &(0x7f00000002c0)=""/11, 0xb, 0x2, 0x3f}, @fd={0x66642a85, 0x0, r0}, @ptr={0x70742a85, 0x0, &(0x7f0000000380)=""/70, 0x46, 0x1, 0x1f}}, &(0x7f0000000500)={0x0, 0x28, 0x40}}, 0x1000}], 0x14, 0x0, &(0x7f0000000680)="86621f50fcee8bdc5bf8c503a78812261b4bf6d7"}) [ 2617.649234] binder: 12927:12942 BC_ACQUIRE_DONE u0000000000000003 no match [ 2617.649246] binder: 12927:12942 transaction failed 29189/-22, size 80-24 line 3014 [ 2617.649592] binder: undelivered TRANSACTION_ERROR: 29189 [ 2617.800435] binder: 12982:13012 Release 1 refcount change on invalid ref 2 ret -22 18:07:25 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000006c0)={0x118, 0x0, &(0x7f0000000540)=[@release={0x40046306, 0x2}, @acquire_done, @acquire_done={0x40106309, 0x3}, @transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x50, 0x18, &(0x7f0000000080)={@flat=@binder={0x73622a85, 0xa, 0x1}, @fda={0x66646185, 0xa, 0x1, 0x9}, @fd={0x66642a85, 0x0, r1}}, &(0x7f0000000100)={0x0, 0x18, 0x38}}, 0x1000}, @transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000180)={@ptr={0x70742a85, 0x0, &(0x7f0000000140)=""/51, 0x33, 0x2, 0x25}, @flat=@weak_handle={0x77682a85, 0x1}, @flat=@binder={0x73622a85, 0xa, 0x3}}, &(0x7f0000000280)={0x0, 0x28, 0x40}}, 0x1f8aed83e3349436}, @exit_looper, @transaction_sg={0x40486311, {0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x68, 0x18, &(0x7f0000000480)={@ptr={0x70742a85, 0x0, &(0x7f00000002c0)=""/11, 0xb, 0x2, 0x3f}, @fd={0x66642a85, 0x0, r0}, @ptr={0x70742a85, 0x0, &(0x7f0000000380)=""/70, 0x46, 0x1, 0x1f}}, &(0x7f0000000500)={0x0, 0x28, 0x40}}, 0x1000}], 0x14, 0x0, &(0x7f0000000680)="86621f50fcee8bdc5bf8c503a78812261b4bf6d7"}) 18:07:25 executing program 3: r0 = socket(0x10, 0x3, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") ioctl$sock_ifreq(r0, 0x89f3, &(0x7f0000000240)={'sit0\x00'}) [ 2617.800445] binder: 12982:13012 BC_ACQUIRE_DONE u0000000000000000 no match [ 2617.800454] binder: 12982:13012 BC_ACQUIRE_DONE u0000000000000003 no match [ 2617.800467] binder: 12982:13012 transaction failed 29189/-22, size 80-24 line 3014 18:07:25 executing program 1: clone(0x2102001fff, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) socket(0x0, 0x0, 0x0) r0 = getpid() rt_tgsigqueueinfo(0x0, r0, 0x16, &(0x7f0000000100)) rt_sigqueueinfo(r0, 0x7, &(0x7f0000000180)={0x0, 0x0, 0xffffffff}) 18:07:25 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000006c0)={0x118, 0x0, &(0x7f0000000540)=[@release={0x40046306, 0x2}, @acquire_done, @acquire_done={0x40106309, 0x3}, @transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x50, 0x18, &(0x7f0000000080)={@flat=@binder={0x73622a85, 0xa, 0x1}, @fda={0x66646185, 0xa, 0x1, 0x9}, @fd={0x66642a85, 0x0, r1}}, &(0x7f0000000100)={0x0, 0x18, 0x38}}, 0x1000}, @transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000180)={@ptr={0x70742a85, 0x0, &(0x7f0000000140)=""/51, 0x33, 0x2, 0x25}, @flat=@weak_handle={0x77682a85, 0x1}, @flat=@binder={0x73622a85, 0xa, 0x3}}, &(0x7f0000000280)={0x0, 0x28, 0x40}}, 0x1f8aed83e3349436}, @exit_looper, @transaction_sg={0x40486311, {0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x68, 0x18, &(0x7f0000000480)={@ptr={0x70742a85, 0x0, &(0x7f00000002c0)=""/11, 0xb, 0x2, 0x3f}, @fd={0x66642a85, 0x0, r0}, @ptr={0x70742a85, 0x0, &(0x7f0000000380)=""/70, 0x46, 0x1, 0x1f}}, &(0x7f0000000500)={0x0, 0x28, 0x40}}, 0x1000}], 0x14, 0x0, &(0x7f0000000680)="86621f50fcee8bdc5bf8c503a78812261b4bf6d7"}) 18:07:25 executing program 2: ioctl$FS_IOC_RESVSP(0xffffffffffffffff, 0x40305828, &(0x7f00000000c0)={0x0, 0x0, 0x100000000000001}) clone(0x2102001fff, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) socket(0x0, 0x0, 0x0) r0 = getpid() rt_tgsigqueueinfo(0x0, r0, 0x16, &(0x7f0000000100)) ptrace(0x10, r0) ptrace$poke(0x4209, r0, &(0x7f00000000c0), 0x70effd) 18:07:25 executing program 4: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000040)='/dev/net/tun\x00', 0x0, 0x0) r1 = epoll_create1(0x0) epoll_ctl$EPOLL_CTL_ADD(0xffffffffffffffff, 0x1, r0, &(0x7f0000000100)) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000080)={'tunl0\x00', 0x1}) epoll_wait(r1, &(0x7f00000000c0)=[{}], 0x1, 0x0) 18:07:25 executing program 3: r0 = socket(0x10, 0x3, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") ioctl$sock_ifreq(r0, 0x89f3, &(0x7f0000000240)={'sit0\x00'}) [ 2617.800959] binder: undelivered TRANSACTION_ERROR: 29189 [ 2617.958376] binder: 13035:13044 Release 1 refcount change on invalid ref 2 ret -22 18:07:25 executing program 1: clone(0x2102001fff, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) socket(0x0, 0x0, 0x0) r0 = getpid() rt_tgsigqueueinfo(0x0, r0, 0x16, &(0x7f0000000100)) rt_sigqueueinfo(r0, 0x7, &(0x7f0000000180)={0x0, 0x0, 0xffffffff}) 18:07:25 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000006c0)={0x118, 0x0, &(0x7f0000000540)=[@release={0x40046306, 0x2}, @acquire_done, @acquire_done={0x40106309, 0x3}, @transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x50, 0x18, &(0x7f0000000080)={@flat=@binder={0x73622a85, 0xa, 0x1}, @fda={0x66646185, 0xa, 0x1, 0x9}, @fd={0x66642a85, 0x0, r1}}, &(0x7f0000000100)={0x0, 0x18, 0x38}}, 0x1000}, @transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000180)={@ptr={0x70742a85, 0x0, &(0x7f0000000140)=""/51, 0x33, 0x2, 0x25}, @flat=@weak_handle={0x77682a85, 0x1}, @flat=@binder={0x73622a85, 0xa, 0x3}}, &(0x7f0000000280)={0x0, 0x28, 0x40}}, 0x1f8aed83e3349436}, @exit_looper, @transaction_sg={0x40486311, {0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x68, 0x18, &(0x7f0000000480)={@ptr={0x70742a85, 0x0, &(0x7f00000002c0)=""/11, 0xb, 0x2, 0x3f}, @fd={0x66642a85, 0x0, r0}, @ptr={0x70742a85, 0x0, &(0x7f0000000380)=""/70, 0x46, 0x1, 0x1f}}, &(0x7f0000000500)={0x0, 0x28, 0x40}}, 0x1000}], 0x14, 0x0, &(0x7f0000000680)="86621f50fcee8bdc5bf8c503a78812261b4bf6d7"}) [ 2617.958386] binder: 13035:13044 BC_ACQUIRE_DONE u0000000000000000 no match 18:07:26 executing program 5: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000001a00)='/dev/net/tun\x00', 0x0, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000080)="c0dc00025e0b01047be070") ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000300)={'nr0\x01\x00', 0x1132}) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000001a00)='/dev/net/tun\x00', 0x2, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000300)={'nr0\x01\x00', 0x1132}) write$cgroup_int(0xffffffffffffffff, &(0x7f00000000c0)=0x2, 0xfffffffffffffe75) close(r1) 18:07:26 executing program 2: ioctl$FS_IOC_RESVSP(0xffffffffffffffff, 0x40305828, &(0x7f00000000c0)={0x0, 0x0, 0x100000000000001}) clone(0x2102001fff, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) socket(0x0, 0x0, 0x0) r0 = getpid() rt_tgsigqueueinfo(0x0, r0, 0x16, &(0x7f0000000100)) ptrace(0x10, r0) ptrace$poke(0x4209, r0, &(0x7f00000000c0), 0x70effd) 18:07:26 executing program 3: r0 = socket(0x10, 0x3, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") ioctl$sock_ifreq(r0, 0x89f3, &(0x7f0000000240)={'sit0\x00'}) [ 2617.958394] binder: 13035:13044 BC_ACQUIRE_DONE u0000000000000003 no match [ 2617.958408] binder: 13035:13044 transaction failed 29189/-22, size 80-24 line 3014 18:07:26 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000006c0)={0x118, 0x0, &(0x7f0000000540)=[@release={0x40046306, 0x2}, @acquire_done, @acquire_done={0x40106309, 0x3}, @transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x50, 0x18, &(0x7f0000000080)={@flat=@binder={0x73622a85, 0xa, 0x1}, @fda={0x66646185, 0xa, 0x1, 0x9}, @fd={0x66642a85, 0x0, r1}}, &(0x7f0000000100)={0x0, 0x18, 0x38}}, 0x1000}, @transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000180)={@ptr={0x70742a85, 0x0, &(0x7f0000000140)=""/51, 0x33, 0x2, 0x25}, @flat=@weak_handle={0x77682a85, 0x1}, @flat=@binder={0x73622a85, 0xa, 0x3}}, &(0x7f0000000280)={0x0, 0x28, 0x40}}, 0x1f8aed83e3349436}, @exit_looper, @transaction_sg={0x40486311, {0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x68, 0x18, &(0x7f0000000480)={@ptr={0x70742a85, 0x0, &(0x7f00000002c0)=""/11, 0xb, 0x2, 0x3f}, @fd={0x66642a85, 0x0, r0}, @ptr={0x70742a85, 0x0, &(0x7f0000000380)=""/70, 0x46, 0x1, 0x1f}}, &(0x7f0000000500)={0x0, 0x28, 0x40}}, 0x1000}], 0x14, 0x0, &(0x7f0000000680)="86621f50fcee8bdc5bf8c503a78812261b4bf6d7"}) 18:07:26 executing program 1: clone(0x2102001fff, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) socket(0x0, 0x0, 0x0) r0 = getpid() rt_tgsigqueueinfo(0x0, r0, 0x16, &(0x7f0000000100)) rt_sigqueueinfo(r0, 0x7, &(0x7f0000000180)={0x0, 0x0, 0xffffffff}) 18:07:26 executing program 4: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000040)='/dev/net/tun\x00', 0x0, 0x0) r1 = epoll_create1(0x0) epoll_ctl$EPOLL_CTL_ADD(0xffffffffffffffff, 0x1, r0, &(0x7f0000000100)) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000080)={'tunl0\x00', 0x1}) epoll_wait(r1, &(0x7f00000000c0)=[{}], 0x1, 0x0) [ 2617.961099] binder: undelivered TRANSACTION_ERROR: 29189 [ 2618.000477] binder: 13069:13071 Release 1 refcount change on invalid ref 2 ret -22 18:07:26 executing program 3: r0 = socket(0x10, 0x3, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") ioctl$sock_ifreq(r0, 0x89f3, &(0x7f0000000240)={'sit0\x00'}) 18:07:26 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000006c0)={0x118, 0x0, &(0x7f0000000540)=[@release={0x40046306, 0x2}, @acquire_done, @acquire_done={0x40106309, 0x3}, @transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x50, 0x18, &(0x7f0000000080)={@flat=@binder={0x73622a85, 0xa, 0x1}, @fda={0x66646185, 0xa, 0x1, 0x9}, @fd={0x66642a85, 0x0, r1}}, &(0x7f0000000100)={0x0, 0x18, 0x38}}, 0x1000}, @transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000180)={@ptr={0x70742a85, 0x0, &(0x7f0000000140)=""/51, 0x33, 0x2, 0x25}, @flat=@weak_handle={0x77682a85, 0x1}, @flat=@binder={0x73622a85, 0xa, 0x3}}, &(0x7f0000000280)={0x0, 0x28, 0x40}}, 0x1f8aed83e3349436}, @exit_looper, @transaction_sg={0x40486311, {0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x68, 0x18, &(0x7f0000000480)={@ptr={0x70742a85, 0x0, &(0x7f00000002c0)=""/11, 0xb, 0x2, 0x3f}, @fd={0x66642a85, 0x0, r0}, @ptr={0x70742a85, 0x0, &(0x7f0000000380)=""/70, 0x46, 0x1, 0x1f}}, &(0x7f0000000500)={0x0, 0x28, 0x40}}, 0x1000}], 0x14, 0x0, &(0x7f0000000680)="86621f50fcee8bdc5bf8c503a78812261b4bf6d7"}) 18:07:26 executing program 1: clone(0x2102001fff, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) socket(0x0, 0x0, 0x0) r0 = getpid() rt_tgsigqueueinfo(0x0, r0, 0x16, &(0x7f0000000100)) rt_sigqueueinfo(r0, 0x7, &(0x7f0000000180)={0x0, 0x0, 0xffffffff}) [ 2618.000488] binder: 13069:13071 BC_ACQUIRE_DONE u0000000000000000 no match [ 2618.000496] binder: 13069:13071 BC_ACQUIRE_DONE u0000000000000003 no match [ 2618.000520] binder: 13069:13071 transaction failed 29189/-22, size 80-24 line 3014 [ 2618.002946] binder: undelivered TRANSACTION_ERROR: 29189 18:07:26 executing program 3: r0 = socket(0x10, 0x3, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") ioctl$sock_ifreq(r0, 0x89f3, &(0x7f0000000240)={'sit0\x00'}) [ 2618.057682] binder: 13086:13100 Release 1 refcount change on invalid ref 2 ret -22 [ 2618.057691] binder: 13086:13100 BC_ACQUIRE_DONE u0000000000000000 no match 18:07:26 executing program 2: ioctl$FS_IOC_RESVSP(0xffffffffffffffff, 0x40305828, &(0x7f00000000c0)={0x0, 0x0, 0x100000000000001}) clone(0x2102001fff, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) socket(0x0, 0x0, 0x0) r0 = getpid() rt_tgsigqueueinfo(0x0, r0, 0x16, &(0x7f0000000100)) ptrace(0x10, r0) ptrace$poke(0x4209, r0, &(0x7f00000000c0), 0x70effd) [ 2618.057698] binder: 13086:13100 BC_ACQUIRE_DONE u0000000000000003 no match [ 2618.057710] binder: 13086:13100 transaction failed 29189/-22, size 80-24 line 3014 [ 2618.058066] binder: undelivered TRANSACTION_ERROR: 29189 18:07:26 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000006c0)={0x118, 0x0, &(0x7f0000000540)=[@release={0x40046306, 0x2}, @acquire_done, @acquire_done={0x40106309, 0x3}, @transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x50, 0x18, &(0x7f0000000080)={@flat=@binder={0x73622a85, 0xa, 0x1}, @fda={0x66646185, 0xa, 0x1, 0x9}, @fd={0x66642a85, 0x0, r1}}, &(0x7f0000000100)={0x0, 0x18, 0x38}}, 0x1000}, @transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000180)={@ptr={0x70742a85, 0x0, &(0x7f0000000140)=""/51, 0x33, 0x2, 0x25}, @flat=@weak_handle={0x77682a85, 0x1}, @flat=@binder={0x73622a85, 0xa, 0x3}}, &(0x7f0000000280)={0x0, 0x28, 0x40}}, 0x1f8aed83e3349436}, @exit_looper, @transaction_sg={0x40486311, {0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x68, 0x18, &(0x7f0000000480)={@ptr={0x70742a85, 0x0, &(0x7f00000002c0)=""/11, 0xb, 0x2, 0x3f}, @fd={0x66642a85, 0x0, r0}, @ptr={0x70742a85, 0x0, &(0x7f0000000380)=""/70, 0x46, 0x1, 0x1f}}, &(0x7f0000000500)={0x0, 0x28, 0x40}}, 0x1000}], 0x14, 0x0, &(0x7f0000000680)="86621f50fcee8bdc5bf8c503a78812261b4bf6d7"}) 18:07:26 executing program 5: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000001a00)='/dev/net/tun\x00', 0x0, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000080)="c0dc00025e0b01047be070") ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000300)={'nr0\x01\x00', 0x1132}) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000001a00)='/dev/net/tun\x00', 0x2, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000300)={'nr0\x01\x00', 0x1132}) write$cgroup_int(0xffffffffffffffff, &(0x7f00000000c0)=0x2, 0xfffffffffffffe75) close(r1) [ 2618.211634] binder: 13164:13172 Release 1 refcount change on invalid ref 2 ret -22 [ 2618.211643] binder: 13164:13172 BC_ACQUIRE_DONE u0000000000000000 no match 18:07:26 executing program 1: clone(0x2102001fff, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) socket(0x0, 0x0, 0x0) r0 = getpid() rt_tgsigqueueinfo(0x0, r0, 0x16, &(0x7f0000000100)) rt_sigqueueinfo(r0, 0x7, &(0x7f0000000180)={0x0, 0x0, 0xffffffff}) 18:07:26 executing program 4: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000040)='/dev/net/tun\x00', 0x0, 0x0) r1 = epoll_create1(0x0) epoll_ctl$EPOLL_CTL_ADD(0xffffffffffffffff, 0x1, r0, &(0x7f0000000100)) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000080)={'tunl0\x00', 0x1}) epoll_wait(r1, &(0x7f00000000c0)=[{}], 0x1, 0x0) 18:07:26 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000006c0)={0x118, 0x0, &(0x7f0000000540)=[@release={0x40046306, 0x2}, @acquire_done, @acquire_done={0x40106309, 0x3}, @transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x50, 0x18, &(0x7f0000000080)={@flat=@binder={0x73622a85, 0xa, 0x1}, @fda={0x66646185, 0xa, 0x1, 0x9}, @fd={0x66642a85, 0x0, r1}}, &(0x7f0000000100)={0x0, 0x18, 0x38}}, 0x1000}, @transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000180)={@ptr={0x70742a85, 0x0, &(0x7f0000000140)=""/51, 0x33, 0x2, 0x25}, @flat=@weak_handle={0x77682a85, 0x1}, @flat=@binder={0x73622a85, 0xa, 0x3}}, &(0x7f0000000280)={0x0, 0x28, 0x40}}, 0x1f8aed83e3349436}, @exit_looper, @transaction_sg={0x40486311, {0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x68, 0x18, &(0x7f0000000480)={@ptr={0x70742a85, 0x0, &(0x7f00000002c0)=""/11, 0xb, 0x2, 0x3f}, @fd={0x66642a85, 0x0, r0}, @ptr={0x70742a85, 0x0, &(0x7f0000000380)=""/70, 0x46, 0x1, 0x1f}}, &(0x7f0000000500)={0x0, 0x28, 0x40}}, 0x1000}], 0x14, 0x0, &(0x7f0000000680)="86621f50fcee8bdc5bf8c503a78812261b4bf6d7"}) 18:07:26 executing program 3: r0 = socket(0x10, 0x3, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") ioctl$sock_ifreq(r0, 0x89f3, &(0x7f0000000240)={'sit0\x00'}) [ 2618.211650] binder: 13164:13172 BC_ACQUIRE_DONE u0000000000000003 no match [ 2618.211663] binder: 13164:13172 transaction failed 29189/-22, size 80-24 line 3014 18:07:26 executing program 2: ioctl$FS_IOC_RESVSP(0xffffffffffffffff, 0x40305828, &(0x7f00000000c0)={0x0, 0x0, 0x100000000000001}) clone(0x2102001fff, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) socket(0x0, 0x0, 0x0) r0 = getpid() rt_tgsigqueueinfo(0x0, r0, 0x16, &(0x7f0000000100)) ptrace(0x10, r0) ptrace$poke(0x4209, r0, &(0x7f00000000c0), 0x70effd) [ 2618.227110] binder: undelivered TRANSACTION_ERROR: 29189 18:07:26 executing program 3: r0 = socket(0x10, 0x3, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") ioctl$sock_ifreq(r0, 0x89f3, &(0x7f0000000240)={'sit0\x00'}) 18:07:26 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000006c0)={0x118, 0x0, &(0x7f0000000540)=[@release={0x40046306, 0x2}, @acquire_done, @acquire_done={0x40106309, 0x3}, @transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x50, 0x18, &(0x7f0000000080)={@flat=@binder={0x73622a85, 0xa, 0x1}, @fda={0x66646185, 0xa, 0x1, 0x9}, @fd={0x66642a85, 0x0, r1}}, &(0x7f0000000100)={0x0, 0x18, 0x38}}, 0x1000}, @transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000180)={@ptr={0x70742a85, 0x0, &(0x7f0000000140)=""/51, 0x33, 0x2, 0x25}, @flat=@weak_handle={0x77682a85, 0x1}, @flat=@binder={0x73622a85, 0xa, 0x3}}, &(0x7f0000000280)={0x0, 0x28, 0x40}}, 0x1f8aed83e3349436}, @exit_looper, @transaction_sg={0x40486311, {0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x68, 0x18, &(0x7f0000000480)={@ptr={0x70742a85, 0x0, &(0x7f00000002c0)=""/11, 0xb, 0x2, 0x3f}, @fd={0x66642a85, 0x0, r0}, @ptr={0x70742a85, 0x0, &(0x7f0000000380)=""/70, 0x46, 0x1, 0x1f}}, &(0x7f0000000500)={0x0, 0x28, 0x40}}, 0x1000}], 0x14, 0x0, &(0x7f0000000680)="86621f50fcee8bdc5bf8c503a78812261b4bf6d7"}) 18:07:26 executing program 1: clone(0x2102001fff, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) socket(0x0, 0x0, 0x0) r0 = getpid() rt_tgsigqueueinfo(0x0, r0, 0x16, &(0x7f0000000100)) rt_sigqueueinfo(r0, 0x7, &(0x7f0000000180)={0x0, 0x0, 0xffffffff}) 18:07:26 executing program 4: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000040)='/dev/net/tun\x00', 0x0, 0x0) r1 = epoll_create1(0x0) epoll_ctl$EPOLL_CTL_ADD(0xffffffffffffffff, 0x1, r0, &(0x7f0000000100)) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000080)={'tunl0\x00', 0x1}) epoll_wait(r1, &(0x7f00000000c0)=[{}], 0x1, 0x0) [ 2618.363341] binder: 13225:13228 Release 1 refcount change on invalid ref 2 ret -22 [ 2618.363359] binder: 13225:13228 BC_ACQUIRE_DONE u0000000000000000 no match [ 2618.363465] binder: 13225:13228 BC_ACQUIRE_DONE u0000000000000003 no match 18:07:26 executing program 5: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000001a00)='/dev/net/tun\x00', 0x0, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000080)="c0dc00025e0b01047be070") ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000300)={'nr0\x01\x00', 0x1132}) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000001a00)='/dev/net/tun\x00', 0x2, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000300)={'nr0\x01\x00', 0x1132}) write$cgroup_int(0xffffffffffffffff, &(0x7f00000000c0)=0x2, 0xfffffffffffffe75) close(r1) 18:07:26 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000006c0)={0x118, 0x0, &(0x7f0000000540)=[@release={0x40046306, 0x2}, @acquire_done, @acquire_done={0x40106309, 0x3}, @transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x50, 0x18, &(0x7f0000000080)={@flat=@binder={0x73622a85, 0xa, 0x1}, @fda={0x66646185, 0xa, 0x1, 0x9}, @fd={0x66642a85, 0x0, r1}}, &(0x7f0000000100)={0x0, 0x18, 0x38}}, 0x1000}, @transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000180)={@ptr={0x70742a85, 0x0, &(0x7f0000000140)=""/51, 0x33, 0x2, 0x25}, @flat=@weak_handle={0x77682a85, 0x1}, @flat=@binder={0x73622a85, 0xa, 0x3}}, &(0x7f0000000280)={0x0, 0x28, 0x40}}, 0x1f8aed83e3349436}, @exit_looper, @transaction_sg={0x40486311, {0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x68, 0x18, &(0x7f0000000480)={@ptr={0x70742a85, 0x0, &(0x7f00000002c0)=""/11, 0xb, 0x2, 0x3f}, @fd={0x66642a85, 0x0, r0}, @ptr={0x70742a85, 0x0, &(0x7f0000000380)=""/70, 0x46, 0x1, 0x1f}}, &(0x7f0000000500)={0x0, 0x28, 0x40}}, 0x1000}], 0x14, 0x0, &(0x7f0000000680)="86621f50fcee8bdc5bf8c503a78812261b4bf6d7"}) [ 2618.363478] binder: 13225:13228 transaction failed 29189/-22, size 80-24 line 3014 18:07:26 executing program 3: r0 = socket(0x10, 0x3, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") ioctl$sock_ifreq(r0, 0x89f3, &(0x7f0000000240)={'sit0\x00'}) [ 2618.363682] binder: undelivered TRANSACTION_ERROR: 29189 [ 2618.644665] binder: 13342:13353 Release 1 refcount change on invalid ref 2 ret -22 [ 2618.644675] binder: 13342:13353 BC_ACQUIRE_DONE u0000000000000000 no match 18:07:26 executing program 1: clone(0x2102001fff, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) socket(0x0, 0x0, 0x0) r0 = getpid() rt_tgsigqueueinfo(0x0, r0, 0x16, &(0x7f0000000100)) rt_sigqueueinfo(r0, 0x7, &(0x7f0000000180)={0x0, 0x0, 0xffffffff}) 18:07:26 executing program 3: r0 = socket(0x10, 0x3, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") ioctl$sock_ifreq(r0, 0x89f3, &(0x7f0000000240)={'sit0\x00'}) [ 2618.644683] binder: 13342:13353 BC_ACQUIRE_DONE u0000000000000003 no match [ 2618.644695] binder: 13342:13353 transaction failed 29189/-22, size 80-24 line 3014 18:07:26 executing program 2: ioctl$FS_IOC_RESVSP(0xffffffffffffffff, 0x40305828, &(0x7f00000000c0)={0x0, 0x0, 0x100000000000001}) clone(0x2102001fff, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) socket(0x0, 0x0, 0x0) r0 = getpid() rt_tgsigqueueinfo(0x0, r0, 0x16, &(0x7f0000000100)) ptrace(0x10, r0) ptrace$poke(0x4209, r0, &(0x7f00000000c0), 0x70effd) 18:07:26 executing program 4: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000040)='/dev/net/tun\x00', 0x0, 0x0) r1 = epoll_create1(0x0) epoll_ctl$EPOLL_CTL_ADD(0xffffffffffffffff, 0x1, r0, &(0x7f0000000100)) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000080)={'tunl0\x00', 0x1}) epoll_wait(r1, &(0x7f00000000c0)=[{}], 0x1, 0x0) 18:07:26 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000006c0)={0x118, 0x0, &(0x7f0000000540)=[@release={0x40046306, 0x2}, @acquire_done, @acquire_done={0x40106309, 0x3}, @transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x50, 0x18, &(0x7f0000000080)={@flat=@binder={0x73622a85, 0xa, 0x1}, @fda={0x66646185, 0xa, 0x1, 0x9}, @fd={0x66642a85, 0x0, r1}}, &(0x7f0000000100)={0x0, 0x18, 0x38}}, 0x1000}, @transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000180)={@ptr={0x70742a85, 0x0, &(0x7f0000000140)=""/51, 0x33, 0x2, 0x25}, @flat=@weak_handle={0x77682a85, 0x1}, @flat=@binder={0x73622a85, 0xa, 0x3}}, &(0x7f0000000280)={0x0, 0x28, 0x40}}, 0x1f8aed83e3349436}, @exit_looper, @transaction_sg={0x40486311, {0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x68, 0x18, &(0x7f0000000480)={@ptr={0x70742a85, 0x0, &(0x7f00000002c0)=""/11, 0xb, 0x2, 0x3f}, @fd={0x66642a85, 0x0, r0}, @ptr={0x70742a85, 0x0, &(0x7f0000000380)=""/70, 0x46, 0x1, 0x1f}}, &(0x7f0000000500)={0x0, 0x28, 0x40}}, 0x1000}], 0x14, 0x0, &(0x7f0000000680)="86621f50fcee8bdc5bf8c503a78812261b4bf6d7"}) 18:07:26 executing program 1: clone(0x2102001fff, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) socket(0x0, 0x0, 0x0) r0 = getpid() rt_tgsigqueueinfo(0x0, r0, 0x16, &(0x7f0000000100)) rt_sigqueueinfo(r0, 0x7, &(0x7f0000000180)={0x0, 0x0, 0xffffffff}) [ 2618.644986] binder: undelivered TRANSACTION_ERROR: 29189 [ 2618.753025] binder: 13376:13388 Release 1 refcount change on invalid ref 2 ret -22 18:07:27 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000006c0)={0x118, 0x0, &(0x7f0000000540)=[@release={0x40046306, 0x2}, @acquire_done, @acquire_done={0x40106309, 0x3}, @transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x50, 0x18, &(0x7f0000000080)={@flat=@binder={0x73622a85, 0xa, 0x1}, @fda={0x66646185, 0xa, 0x1, 0x9}, @fd={0x66642a85, 0x0, r1}}, &(0x7f0000000100)={0x0, 0x18, 0x38}}, 0x1000}, @transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000180)={@ptr={0x70742a85, 0x0, &(0x7f0000000140)=""/51, 0x33, 0x2, 0x25}, @flat=@weak_handle={0x77682a85, 0x1}, @flat=@binder={0x73622a85, 0xa, 0x3}}, &(0x7f0000000280)={0x0, 0x28, 0x40}}, 0x1f8aed83e3349436}, @exit_looper, @transaction_sg={0x40486311, {0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x68, 0x18, &(0x7f0000000480)={@ptr={0x70742a85, 0x0, &(0x7f00000002c0)=""/11, 0xb, 0x2, 0x3f}, @fd={0x66642a85, 0x0, r0}, @ptr={0x70742a85, 0x0, &(0x7f0000000380)=""/70, 0x46, 0x1, 0x1f}}, &(0x7f0000000500)={0x0, 0x28, 0x40}}, 0x1000}], 0x14, 0x0, &(0x7f0000000680)="86621f50fcee8bdc5bf8c503a78812261b4bf6d7"}) [ 2618.753035] binder: 13376:13388 BC_ACQUIRE_DONE u0000000000000000 no match 18:07:27 executing program 2: ioctl$FS_IOC_RESVSP(0xffffffffffffffff, 0x40305828, &(0x7f00000000c0)={0x0, 0x0, 0x100000000000001}) clone(0x2102001fff, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) socket(0x0, 0x0, 0x0) r0 = getpid() rt_tgsigqueueinfo(0x0, r0, 0x16, &(0x7f0000000100)) ptrace(0x10, r0) ptrace$poke(0x4209, r0, &(0x7f00000000c0), 0x70effd) 18:07:27 executing program 5: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000001a00)='/dev/net/tun\x00', 0x0, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000080)="c0dc00025e0b01047be070") ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000300)={'nr0\x01\x00', 0x1132}) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000001a00)='/dev/net/tun\x00', 0x2, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000300)={'nr0\x01\x00', 0x1132}) write$cgroup_int(0xffffffffffffffff, &(0x7f00000000c0)=0x2, 0xfffffffffffffe75) close(r1) [ 2618.753043] binder: 13376:13388 BC_ACQUIRE_DONE u0000000000000003 no match [ 2618.753056] binder: 13376:13388 transaction failed 29189/-22, size 80-24 line 3014 18:07:27 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000006c0)={0x118, 0x0, &(0x7f0000000540)=[@release={0x40046306, 0x2}, @acquire_done, @acquire_done={0x40106309, 0x3}, @transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x50, 0x18, &(0x7f0000000080)={@flat=@binder={0x73622a85, 0xa, 0x1}, @fda={0x66646185, 0xa, 0x1, 0x9}, @fd={0x66642a85, 0x0, r1}}, &(0x7f0000000100)={0x0, 0x18, 0x38}}, 0x1000}, @transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000180)={@ptr={0x70742a85, 0x0, &(0x7f0000000140)=""/51, 0x33, 0x2, 0x25}, @flat=@weak_handle={0x77682a85, 0x1}, @flat=@binder={0x73622a85, 0xa, 0x3}}, &(0x7f0000000280)={0x0, 0x28, 0x40}}, 0x1f8aed83e3349436}, @exit_looper, @transaction_sg={0x40486311, {0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x68, 0x18, &(0x7f0000000480)={@ptr={0x70742a85, 0x0, &(0x7f00000002c0)=""/11, 0xb, 0x2, 0x3f}, @fd={0x66642a85, 0x0, r0}, @ptr={0x70742a85, 0x0, &(0x7f0000000380)=""/70, 0x46, 0x1, 0x1f}}, &(0x7f0000000500)={0x0, 0x28, 0x40}}, 0x1000}], 0x14, 0x0, &(0x7f0000000680)="86621f50fcee8bdc5bf8c503a78812261b4bf6d7"}) 18:07:27 executing program 3: r0 = socket(0x10, 0x3, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") ioctl$sock_ifreq(r0, 0x89f3, &(0x7f0000000240)={'sit0\x00'}) 18:07:27 executing program 1: clone(0x2102001fff, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) socket(0x0, 0x0, 0x0) r0 = getpid() rt_tgsigqueueinfo(0x0, r0, 0x16, &(0x7f0000000100)) rt_sigqueueinfo(r0, 0x7, &(0x7f0000000180)={0x0, 0x0, 0xffffffff}) 18:07:27 executing program 4: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000040)='/dev/net/tun\x00', 0x0, 0x0) r1 = epoll_create1(0x0) epoll_ctl$EPOLL_CTL_ADD(0xffffffffffffffff, 0x1, r0, &(0x7f0000000100)) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000080)={'tunl0\x00', 0x1}) epoll_wait(r1, &(0x7f00000000c0)=[{}], 0x1, 0x0) [ 2618.753400] binder: undelivered TRANSACTION_ERROR: 29189 [ 2619.009434] binder: 13420:13461 Release 1 refcount change on invalid ref 2 ret -22 18:07:27 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000006c0)={0x118, 0x0, &(0x7f0000000540)=[@release={0x40046306, 0x2}, @acquire_done, @acquire_done={0x40106309, 0x3}, @transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x50, 0x18, &(0x7f0000000080)={@flat=@binder={0x73622a85, 0xa, 0x1}, @fda={0x66646185, 0xa, 0x1, 0x9}, @fd={0x66642a85, 0x0, r1}}, &(0x7f0000000100)={0x0, 0x18, 0x38}}, 0x1000}, @transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000180)={@ptr={0x70742a85, 0x0, &(0x7f0000000140)=""/51, 0x33, 0x2, 0x25}, @flat=@weak_handle={0x77682a85, 0x1}, @flat=@binder={0x73622a85, 0xa, 0x3}}, &(0x7f0000000280)={0x0, 0x28, 0x40}}, 0x1f8aed83e3349436}, @exit_looper, @transaction_sg={0x40486311, {0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x68, 0x18, &(0x7f0000000480)={@ptr={0x70742a85, 0x0, &(0x7f00000002c0)=""/11, 0xb, 0x2, 0x3f}, @fd={0x66642a85, 0x0, r0}, @ptr={0x70742a85, 0x0, &(0x7f0000000380)=""/70, 0x46, 0x1, 0x1f}}, &(0x7f0000000500)={0x0, 0x28, 0x40}}, 0x1000}], 0x14, 0x0, &(0x7f0000000680)="86621f50fcee8bdc5bf8c503a78812261b4bf6d7"}) 18:07:27 executing program 1: clone(0x2102001fff, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) socket(0x0, 0x0, 0x0) r0 = getpid() rt_tgsigqueueinfo(0x0, r0, 0x16, &(0x7f0000000100)) rt_sigqueueinfo(r0, 0x7, &(0x7f0000000180)={0x0, 0x0, 0xffffffff}) [ 2619.009444] binder: 13420:13461 BC_ACQUIRE_DONE u0000000000000000 no match [ 2619.009452] binder: 13420:13461 BC_ACQUIRE_DONE u0000000000000003 no match [ 2619.009469] binder: 13420:13461 transaction failed 29189/-22, size 80-24 line 3014 18:07:27 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000006c0)={0x118, 0x0, &(0x7f0000000540)=[@release={0x40046306, 0x2}, @acquire_done, @acquire_done={0x40106309, 0x3}, @transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x50, 0x18, &(0x7f0000000080)={@flat=@binder={0x73622a85, 0xa, 0x1}, @fda={0x66646185, 0xa, 0x1, 0x9}, @fd={0x66642a85, 0x0, r1}}, &(0x7f0000000100)={0x0, 0x18, 0x38}}, 0x1000}, @transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000180)={@ptr={0x70742a85, 0x0, &(0x7f0000000140)=""/51, 0x33, 0x2, 0x25}, @flat=@weak_handle={0x77682a85, 0x1}, @flat=@binder={0x73622a85, 0xa, 0x3}}, &(0x7f0000000280)={0x0, 0x28, 0x40}}, 0x1f8aed83e3349436}, @exit_looper, @transaction_sg={0x40486311, {0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x68, 0x18, &(0x7f0000000480)={@ptr={0x70742a85, 0x0, &(0x7f00000002c0)=""/11, 0xb, 0x2, 0x3f}, @fd={0x66642a85, 0x0, r0}, @ptr={0x70742a85, 0x0, &(0x7f0000000380)=""/70, 0x46, 0x1, 0x1f}}, &(0x7f0000000500)={0x0, 0x28, 0x40}}, 0x1000}], 0x14, 0x0, &(0x7f0000000680)="86621f50fcee8bdc5bf8c503a78812261b4bf6d7"}) [ 2619.009701] binder: undelivered TRANSACTION_ERROR: 29189 18:07:27 executing program 2: ioctl$FS_IOC_RESVSP(0xffffffffffffffff, 0x40305828, &(0x7f00000000c0)={0x0, 0x0, 0x100000000000001}) clone(0x2102001fff, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) socket(0x0, 0x0, 0x0) r0 = getpid() rt_tgsigqueueinfo(0x0, r0, 0x16, &(0x7f0000000100)) ptrace(0x10, r0) ptrace$poke(0x4209, r0, &(0x7f00000000c0), 0x70effd) 18:07:27 executing program 3: r0 = socket(0x10, 0x3, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") ioctl$sock_ifreq(r0, 0x89f3, &(0x7f0000000240)={'sit0\x00'}) [ 2619.113777] binder: 13522:13529 Release 1 refcount change on invalid ref 2 ret -22 18:07:27 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000006c0)={0x118, 0x0, &(0x7f0000000540)=[@release={0x40046306, 0x2}, @acquire_done, @acquire_done={0x40106309, 0x3}, @transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x50, 0x18, &(0x7f0000000080)={@flat=@binder={0x73622a85, 0xa, 0x1}, @fda={0x66646185, 0xa, 0x1, 0x9}, @fd={0x66642a85, 0x0, r1}}, &(0x7f0000000100)={0x0, 0x18, 0x38}}, 0x1000}, @transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000180)={@ptr={0x70742a85, 0x0, &(0x7f0000000140)=""/51, 0x33, 0x2, 0x25}, @flat=@weak_handle={0x77682a85, 0x1}, @flat=@binder={0x73622a85, 0xa, 0x3}}, &(0x7f0000000280)={0x0, 0x28, 0x40}}, 0x1f8aed83e3349436}, @exit_looper, @transaction_sg={0x40486311, {0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x68, 0x18, &(0x7f0000000480)={@ptr={0x70742a85, 0x0, &(0x7f00000002c0)=""/11, 0xb, 0x2, 0x3f}, @fd={0x66642a85, 0x0, r0}, @ptr={0x70742a85, 0x0, &(0x7f0000000380)=""/70, 0x46, 0x1, 0x1f}}, &(0x7f0000000500)={0x0, 0x28, 0x40}}, 0x1000}], 0x14, 0x0, &(0x7f0000000680)="86621f50fcee8bdc5bf8c503a78812261b4bf6d7"}) [ 2619.113787] binder: 13522:13529 BC_ACQUIRE_DONE u0000000000000000 no match 18:07:27 executing program 4: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000040)='/dev/net/tun\x00', 0x0, 0x0) r1 = epoll_create1(0x0) epoll_ctl$EPOLL_CTL_ADD(0xffffffffffffffff, 0x1, r0, &(0x7f0000000100)) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000080)={'tunl0\x00', 0x1}) epoll_wait(r1, &(0x7f00000000c0)=[{}], 0x1, 0x0) 18:07:27 executing program 5: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000001a00)='/dev/net/tun\x00', 0x0, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000080)="c0dc00025e0b01047be070") ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000300)={'nr0\x01\x00', 0x1132}) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000001a00)='/dev/net/tun\x00', 0x2, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000300)={'nr0\x01\x00', 0x1132}) write$cgroup_int(0xffffffffffffffff, &(0x7f00000000c0)=0x2, 0xfffffffffffffe75) close(r1) 18:07:27 executing program 1: clone(0x2102001fff, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) socket(0x0, 0x0, 0x0) r0 = getpid() rt_tgsigqueueinfo(0x0, r0, 0x16, &(0x7f0000000100)) rt_sigqueueinfo(r0, 0x7, &(0x7f0000000180)={0x0, 0x0, 0xffffffff}) [ 2619.113795] binder: 13522:13529 BC_ACQUIRE_DONE u0000000000000003 no match 18:07:27 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000006c0)={0x118, 0x0, &(0x7f0000000540)=[@release={0x40046306, 0x2}, @acquire_done, @acquire_done={0x40106309, 0x3}, @transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x50, 0x18, &(0x7f0000000080)={@flat=@binder={0x73622a85, 0xa, 0x1}, @fda={0x66646185, 0xa, 0x1, 0x9}, @fd={0x66642a85, 0x0, r1}}, &(0x7f0000000100)={0x0, 0x18, 0x38}}, 0x1000}, @transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000180)={@ptr={0x70742a85, 0x0, &(0x7f0000000140)=""/51, 0x33, 0x2, 0x25}, @flat=@weak_handle={0x77682a85, 0x1}, @flat=@binder={0x73622a85, 0xa, 0x3}}, &(0x7f0000000280)={0x0, 0x28, 0x40}}, 0x1f8aed83e3349436}, @exit_looper, @transaction_sg={0x40486311, {0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x68, 0x18, &(0x7f0000000480)={@ptr={0x70742a85, 0x0, &(0x7f00000002c0)=""/11, 0xb, 0x2, 0x3f}, @fd={0x66642a85, 0x0, r0}, @ptr={0x70742a85, 0x0, &(0x7f0000000380)=""/70, 0x46, 0x1, 0x1f}}, &(0x7f0000000500)={0x0, 0x28, 0x40}}, 0x1000}], 0x14, 0x0, &(0x7f0000000680)="86621f50fcee8bdc5bf8c503a78812261b4bf6d7"}) 18:07:27 executing program 3: r0 = socket(0x10, 0x3, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") ioctl$sock_ifreq(r0, 0x89f3, &(0x7f0000000240)={'sit0\x00'}) 18:07:27 executing program 2: ioctl$FS_IOC_RESVSP(0xffffffffffffffff, 0x40305828, &(0x7f00000000c0)={0x0, 0x0, 0x100000000000001}) clone(0x2102001fff, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) socket(0x0, 0x0, 0x0) r0 = getpid() rt_tgsigqueueinfo(0x0, r0, 0x16, &(0x7f0000000100)) ptrace(0x10, r0) ptrace$poke(0x4209, r0, &(0x7f00000000c0), 0x70effd) [ 2619.113807] binder: 13522:13529 transaction failed 29189/-22, size 80-24 line 3014 18:07:27 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000006c0)={0x118, 0x0, &(0x7f0000000540)=[@release={0x40046306, 0x2}, @acquire_done, @acquire_done={0x40106309, 0x3}, @transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x50, 0x18, &(0x7f0000000080)={@flat=@binder={0x73622a85, 0xa, 0x1}, @fda={0x66646185, 0xa, 0x1, 0x9}, @fd={0x66642a85, 0x0, r1}}, &(0x7f0000000100)={0x0, 0x18, 0x38}}, 0x1000}, @transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000180)={@ptr={0x70742a85, 0x0, &(0x7f0000000140)=""/51, 0x33, 0x2, 0x25}, @flat=@weak_handle={0x77682a85, 0x1}, @flat=@binder={0x73622a85, 0xa, 0x3}}, &(0x7f0000000280)={0x0, 0x28, 0x40}}, 0x1f8aed83e3349436}, @exit_looper, @transaction_sg={0x40486311, {0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x68, 0x18, &(0x7f0000000480)={@ptr={0x70742a85, 0x0, &(0x7f00000002c0)=""/11, 0xb, 0x2, 0x3f}, @fd={0x66642a85, 0x0, r0}, @ptr={0x70742a85, 0x0, &(0x7f0000000380)=""/70, 0x46, 0x1, 0x1f}}, &(0x7f0000000500)={0x0, 0x28, 0x40}}, 0x1000}], 0x14, 0x0, &(0x7f0000000680)="86621f50fcee8bdc5bf8c503a78812261b4bf6d7"}) 18:07:27 executing program 1: clone(0x2102001fff, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) socket(0x0, 0x0, 0x0) r0 = getpid() rt_tgsigqueueinfo(0x0, r0, 0x16, &(0x7f0000000100)) rt_sigqueueinfo(r0, 0x7, &(0x7f0000000180)={0x0, 0x0, 0xffffffff}) [ 2619.118592] binder: undelivered TRANSACTION_ERROR: 29189 [ 2619.188661] binder: 13536:13543 Release 1 refcount change on invalid ref 2 ret -22 18:07:27 executing program 4: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000040)='/dev/net/tun\x00', 0x0, 0x0) r1 = epoll_create1(0x0) epoll_ctl$EPOLL_CTL_ADD(0xffffffffffffffff, 0x1, r0, &(0x7f0000000100)) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000080)={'tunl0\x00', 0x1}) epoll_wait(r1, &(0x7f00000000c0)=[{}], 0x1, 0x0) 18:07:27 executing program 3: r0 = socket(0x10, 0x3, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") ioctl$sock_ifreq(r0, 0x89f3, &(0x7f0000000240)={'sit0\x00'}) [ 2619.188672] binder: 13536:13543 BC_ACQUIRE_DONE u0000000000000000 no match 18:07:27 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000006c0)={0x118, 0x0, &(0x7f0000000540)=[@release={0x40046306, 0x2}, @acquire_done, @acquire_done={0x40106309, 0x3}, @transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x50, 0x18, &(0x7f0000000080)={@flat=@binder={0x73622a85, 0xa, 0x1}, @fda={0x66646185, 0xa, 0x1, 0x9}, @fd={0x66642a85, 0x0, r1}}, &(0x7f0000000100)={0x0, 0x18, 0x38}}, 0x1000}, @transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000180)={@ptr={0x70742a85, 0x0, &(0x7f0000000140)=""/51, 0x33, 0x2, 0x25}, @flat=@weak_handle={0x77682a85, 0x1}, @flat=@binder={0x73622a85, 0xa, 0x3}}, &(0x7f0000000280)={0x0, 0x28, 0x40}}, 0x1f8aed83e3349436}, @exit_looper, @transaction_sg={0x40486311, {0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x68, 0x18, &(0x7f0000000480)={@ptr={0x70742a85, 0x0, &(0x7f00000002c0)=""/11, 0xb, 0x2, 0x3f}, @fd={0x66642a85, 0x0, r0}, @ptr={0x70742a85, 0x0, &(0x7f0000000380)=""/70, 0x46, 0x1, 0x1f}}, &(0x7f0000000500)={0x0, 0x28, 0x40}}, 0x1000}], 0x14, 0x0, &(0x7f0000000680)="86621f50fcee8bdc5bf8c503a78812261b4bf6d7"}) 18:07:27 executing program 1: clone(0x2102001fff, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) socket(0x0, 0x0, 0x0) r0 = getpid() rt_tgsigqueueinfo(0x0, r0, 0x16, &(0x7f0000000100)) rt_sigqueueinfo(r0, 0x7, &(0x7f0000000180)={0x0, 0x0, 0xffffffff}) [ 2619.188679] binder: 13536:13543 BC_ACQUIRE_DONE u0000000000000003 no match [ 2619.188692] binder: 13536:13543 transaction failed 29189/-22, size 80-24 line 3014 18:07:27 executing program 3: r0 = socket(0x10, 0x3, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") ioctl$sock_ifreq(r0, 0x89f3, &(0x7f0000000240)={'sit0\x00'}) [ 2619.189018] binder: undelivered TRANSACTION_ERROR: 29189 [ 2619.328186] binder: 13619:13634 Release 1 refcount change on invalid ref 2 ret -22 [ 2619.328196] binder: 13619:13634 BC_ACQUIRE_DONE u0000000000000000 no match 18:07:27 executing program 1: clone(0x2102001fff, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) socket(0x0, 0x0, 0x0) r0 = getpid() rt_tgsigqueueinfo(0x0, r0, 0x16, &(0x7f0000000100)) rt_sigqueueinfo(r0, 0x7, &(0x7f0000000180)={0x0, 0x0, 0xffffffff}) 18:07:27 executing program 2: ioctl$FS_IOC_RESVSP(0xffffffffffffffff, 0x40305828, &(0x7f00000000c0)={0x0, 0x0, 0x100000000000001}) clone(0x2102001fff, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) socket(0x0, 0x0, 0x0) r0 = getpid() rt_tgsigqueueinfo(0x0, r0, 0x16, &(0x7f0000000100)) ptrace(0x10, r0) ptrace$poke(0x4209, r0, &(0x7f00000000c0), 0x70effd) 18:07:27 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000006c0)={0x118, 0x0, &(0x7f0000000540)=[@release={0x40046306, 0x2}, @acquire_done, @acquire_done={0x40106309, 0x3}, @transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x50, 0x18, &(0x7f0000000080)={@flat=@binder={0x73622a85, 0xa, 0x1}, @fda={0x66646185, 0xa, 0x1, 0x9}, @fd={0x66642a85, 0x0, r1}}, &(0x7f0000000100)={0x0, 0x18, 0x38}}, 0x1000}, @transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000180)={@ptr={0x70742a85, 0x0, &(0x7f0000000140)=""/51, 0x33, 0x2, 0x25}, @flat=@weak_handle={0x77682a85, 0x1}, @flat=@binder={0x73622a85, 0xa, 0x3}}, &(0x7f0000000280)={0x0, 0x28, 0x40}}, 0x1f8aed83e3349436}, @exit_looper, @transaction_sg={0x40486311, {0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x68, 0x18, &(0x7f0000000480)={@ptr={0x70742a85, 0x0, &(0x7f00000002c0)=""/11, 0xb, 0x2, 0x3f}, @fd={0x66642a85, 0x0, r0}, @ptr={0x70742a85, 0x0, &(0x7f0000000380)=""/70, 0x46, 0x1, 0x1f}}, &(0x7f0000000500)={0x0, 0x28, 0x40}}, 0x1000}], 0x14, 0x0, &(0x7f0000000680)="86621f50fcee8bdc5bf8c503a78812261b4bf6d7"}) 18:07:27 executing program 5: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000001a00)='/dev/net/tun\x00', 0x0, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000080)="c0dc00025e0b01047be070") ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000300)={'nr0\x01\x00', 0x1132}) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000001a00)='/dev/net/tun\x00', 0x2, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000300)={'nr0\x01\x00', 0x1132}) write$cgroup_int(0xffffffffffffffff, &(0x7f00000000c0)=0x2, 0xfffffffffffffe75) close(r1) 18:07:27 executing program 3: r0 = socket(0x10, 0x3, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") ioctl$sock_ifreq(r0, 0x89f3, &(0x7f0000000240)={'sit0\x00'}) [ 2619.328203] binder: 13619:13634 BC_ACQUIRE_DONE u0000000000000003 no match 18:07:28 executing program 3: r0 = socket(0x10, 0x3, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") ioctl$sock_ifreq(r0, 0x89f3, &(0x7f0000000240)={'sit0\x00'}) [ 2619.328216] binder: 13619:13634 transaction failed 29189/-22, size 80-24 line 3014 [ 2619.328474] binder: undelivered TRANSACTION_ERROR: 29189 18:07:28 executing program 1: clone(0x2102001fff, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) socket(0x0, 0x0, 0x0) r0 = getpid() rt_tgsigqueueinfo(0x0, r0, 0x16, &(0x7f0000000100)) rt_sigqueueinfo(r0, 0x7, &(0x7f0000000180)={0x0, 0x0, 0xffffffff}) 18:07:28 executing program 4: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000040)='/dev/net/tun\x00', 0x0, 0x0) r1 = epoll_create1(0x0) epoll_ctl$EPOLL_CTL_ADD(0xffffffffffffffff, 0x1, r0, &(0x7f0000000100)) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000080)={'tunl0\x00', 0x1}) epoll_wait(r1, &(0x7f00000000c0)=[{}], 0x1, 0x0) [ 2619.429338] binder: 13663:13670 Release 1 refcount change on invalid ref 2 ret -22 18:07:28 executing program 3: r0 = socket(0x10, 0x3, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") ioctl$sock_ifreq(r0, 0x89f3, &(0x7f0000000240)={'sit0\x00'}) 18:07:28 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000006c0)={0x118, 0x0, &(0x7f0000000540)=[@release={0x40046306, 0x2}, @acquire_done, @acquire_done={0x40106309, 0x3}, @transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x50, 0x18, &(0x7f0000000080)={@flat=@binder={0x73622a85, 0xa, 0x1}, @fda={0x66646185, 0xa, 0x1, 0x9}, @fd={0x66642a85, 0x0, r1}}, &(0x7f0000000100)={0x0, 0x18, 0x38}}, 0x1000}, @transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000180)={@ptr={0x70742a85, 0x0, &(0x7f0000000140)=""/51, 0x33, 0x2, 0x25}, @flat=@weak_handle={0x77682a85, 0x1}, @flat=@binder={0x73622a85, 0xa, 0x3}}, &(0x7f0000000280)={0x0, 0x28, 0x40}}, 0x1f8aed83e3349436}, @exit_looper, @transaction_sg={0x40486311, {0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x68, 0x18, &(0x7f0000000480)={@ptr={0x70742a85, 0x0, &(0x7f00000002c0)=""/11, 0xb, 0x2, 0x3f}, @fd={0x66642a85, 0x0, r0}, @ptr={0x70742a85, 0x0, &(0x7f0000000380)=""/70, 0x46, 0x1, 0x1f}}, &(0x7f0000000500)={0x0, 0x28, 0x40}}, 0x1000}], 0x14, 0x0, &(0x7f0000000680)="86621f50fcee8bdc5bf8c503a78812261b4bf6d7"}) [ 2619.429348] binder: 13663:13670 BC_ACQUIRE_DONE u0000000000000000 no match 18:07:28 executing program 2: ioctl$FS_IOC_RESVSP(0xffffffffffffffff, 0x40305828, &(0x7f00000000c0)={0x0, 0x0, 0x100000000000001}) clone(0x2102001fff, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) socket(0x0, 0x0, 0x0) r0 = getpid() rt_tgsigqueueinfo(0x0, r0, 0x16, &(0x7f0000000100)) ptrace(0x10, r0) ptrace$poke(0x4209, r0, &(0x7f00000000c0), 0x70effd) 18:07:28 executing program 1: clone(0x2102001fff, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) socket(0x0, 0x0, 0x0) r0 = getpid() rt_tgsigqueueinfo(0x0, r0, 0x16, &(0x7f0000000100)) rt_sigqueueinfo(r0, 0x7, &(0x7f0000000180)={0x0, 0x0, 0xffffffff}) [ 2619.429355] binder: 13663:13670 BC_ACQUIRE_DONE u0000000000000003 no match [ 2619.429368] binder: 13663:13670 transaction failed 29189/-22, size 80-24 line 3014 18:07:28 executing program 3: r0 = socket(0x10, 0x3, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") ioctl$sock_ifreq(r0, 0x89f3, &(0x7f0000000240)={'sit0\x00'}) 18:07:28 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000006c0)={0x118, 0x0, &(0x7f0000000540)=[@release={0x40046306, 0x2}, @acquire_done, @acquire_done={0x40106309, 0x3}, @transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x50, 0x18, &(0x7f0000000080)={@flat=@binder={0x73622a85, 0xa, 0x1}, @fda={0x66646185, 0xa, 0x1, 0x9}, @fd={0x66642a85, 0x0, r1}}, &(0x7f0000000100)={0x0, 0x18, 0x38}}, 0x1000}, @transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000180)={@ptr={0x70742a85, 0x0, &(0x7f0000000140)=""/51, 0x33, 0x2, 0x25}, @flat=@weak_handle={0x77682a85, 0x1}, @flat=@binder={0x73622a85, 0xa, 0x3}}, &(0x7f0000000280)={0x0, 0x28, 0x40}}, 0x1f8aed83e3349436}, @exit_looper, @transaction_sg={0x40486311, {0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x68, 0x18, &(0x7f0000000480)={@ptr={0x70742a85, 0x0, &(0x7f00000002c0)=""/11, 0xb, 0x2, 0x3f}, @fd={0x66642a85, 0x0, r0}, @ptr={0x70742a85, 0x0, &(0x7f0000000380)=""/70, 0x46, 0x1, 0x1f}}, &(0x7f0000000500)={0x0, 0x28, 0x40}}, 0x1000}], 0x14, 0x0, &(0x7f0000000680)="86621f50fcee8bdc5bf8c503a78812261b4bf6d7"}) 18:07:28 executing program 4: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000040)='/dev/net/tun\x00', 0x0, 0x0) r1 = epoll_create1(0x0) epoll_ctl$EPOLL_CTL_ADD(0xffffffffffffffff, 0x1, r0, &(0x7f0000000100)) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000080)={'tunl0\x00', 0x1}) epoll_wait(r1, &(0x7f00000000c0)=[{}], 0x1, 0x0) [ 2619.429669] binder: undelivered TRANSACTION_ERROR: 29189 [ 2619.559187] binder: 13694:13699 Release 1 refcount change on invalid ref 2 ret -22 18:07:28 executing program 5: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000001a00)='/dev/net/tun\x00', 0x0, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000080)="c0dc00025e0b01047be070") ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000300)={'nr0\x01\x00', 0x1132}) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000001a00)='/dev/net/tun\x00', 0x2, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000300)={'nr0\x01\x00', 0x1132}) write$cgroup_int(0xffffffffffffffff, &(0x7f00000000c0)=0x2, 0xfffffffffffffe75) close(r1) 18:07:28 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000006c0)={0x118, 0x0, &(0x7f0000000540)=[@release={0x40046306, 0x2}, @acquire_done, @acquire_done={0x40106309, 0x3}, @transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x50, 0x18, &(0x7f0000000080)={@flat=@binder={0x73622a85, 0xa, 0x1}, @fda={0x66646185, 0xa, 0x1, 0x9}, @fd={0x66642a85, 0x0, r1}}, &(0x7f0000000100)={0x0, 0x18, 0x38}}, 0x1000}, @transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000180)={@ptr={0x70742a85, 0x0, &(0x7f0000000140)=""/51, 0x33, 0x2, 0x25}, @flat=@weak_handle={0x77682a85, 0x1}, @flat=@binder={0x73622a85, 0xa, 0x3}}, &(0x7f0000000280)={0x0, 0x28, 0x40}}, 0x1f8aed83e3349436}, @exit_looper, @transaction_sg={0x40486311, {0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x68, 0x18, &(0x7f0000000480)={@ptr={0x70742a85, 0x0, &(0x7f00000002c0)=""/11, 0xb, 0x2, 0x3f}, @fd={0x66642a85, 0x0, r0}, @ptr={0x70742a85, 0x0, &(0x7f0000000380)=""/70, 0x46, 0x1, 0x1f}}, &(0x7f0000000500)={0x0, 0x28, 0x40}}, 0x1000}], 0x14, 0x0, &(0x7f0000000680)="86621f50fcee8bdc5bf8c503a78812261b4bf6d7"}) 18:07:28 executing program 3: r0 = socket(0x10, 0x3, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") ioctl$sock_ifreq(r0, 0x89f3, &(0x7f0000000240)={'sit0\x00'}) 18:07:28 executing program 1: clone(0x2102001fff, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) socket(0x0, 0x0, 0x0) r0 = getpid() rt_tgsigqueueinfo(0x0, r0, 0x16, &(0x7f0000000100)) rt_sigqueueinfo(r0, 0x7, &(0x7f0000000180)={0x0, 0x0, 0xffffffff}) [ 2619.559198] binder: 13694:13699 BC_ACQUIRE_DONE u0000000000000000 no match [ 2619.559206] binder: 13694:13699 BC_ACQUIRE_DONE u0000000000000003 no match 18:07:28 executing program 2: ioctl$FS_IOC_RESVSP(0xffffffffffffffff, 0x40305828, &(0x7f00000000c0)={0x0, 0x0, 0x100000000000001}) clone(0x2102001fff, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) socket(0x0, 0x0, 0x0) r0 = getpid() rt_tgsigqueueinfo(0x0, r0, 0x16, &(0x7f0000000100)) ptrace(0x10, r0) ptrace$poke(0x4209, r0, &(0x7f00000000c0), 0x70effd) 18:07:28 executing program 3: r0 = socket(0x10, 0x3, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") ioctl$sock_ifreq(r0, 0x89f3, &(0x7f0000000240)={'sit0\x00'}) [ 2619.559219] binder: 13694:13699 transaction failed 29189/-22, size 80-24 line 3014 [ 2619.559502] binder: undelivered TRANSACTION_ERROR: 29189 [ 2619.789420] binder: 13737:13779 Release 1 refcount change on invalid ref 2 ret -22 [ 2619.789429] binder: 13737:13779 BC_ACQUIRE_DONE u0000000000000000 no match 18:07:28 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000006c0)={0x118, 0x0, &(0x7f0000000540)=[@release={0x40046306, 0x2}, @acquire_done, @acquire_done={0x40106309, 0x3}, @transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x50, 0x18, &(0x7f0000000080)={@flat=@binder={0x73622a85, 0xa, 0x1}, @fda={0x66646185, 0xa, 0x1, 0x9}, @fd={0x66642a85, 0x0, r1}}, &(0x7f0000000100)={0x0, 0x18, 0x38}}, 0x1000}, @transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000180)={@ptr={0x70742a85, 0x0, &(0x7f0000000140)=""/51, 0x33, 0x2, 0x25}, @flat=@weak_handle={0x77682a85, 0x1}, @flat=@binder={0x73622a85, 0xa, 0x3}}, &(0x7f0000000280)={0x0, 0x28, 0x40}}, 0x1f8aed83e3349436}, @exit_looper, @transaction_sg={0x40486311, {0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x68, 0x18, &(0x7f0000000480)={@ptr={0x70742a85, 0x0, &(0x7f00000002c0)=""/11, 0xb, 0x2, 0x3f}, @fd={0x66642a85, 0x0, r0}, @ptr={0x70742a85, 0x0, &(0x7f0000000380)=""/70, 0x46, 0x1, 0x1f}}, &(0x7f0000000500)={0x0, 0x28, 0x40}}, 0x1000}], 0x14, 0x0, &(0x7f0000000680)="86621f50fcee8bdc5bf8c503a78812261b4bf6d7"}) 18:07:28 executing program 1: clone(0x2102001fff, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) socket(0x0, 0x0, 0x0) r0 = getpid() rt_tgsigqueueinfo(0x0, r0, 0x16, &(0x7f0000000100)) rt_sigqueueinfo(r0, 0x7, &(0x7f0000000180)={0x0, 0x0, 0xffffffff}) [ 2619.789437] binder: 13737:13779 BC_ACQUIRE_DONE u0000000000000003 no match [ 2619.789870] binder: 13737:13779 transaction failed 29189/-22, size 80-24 line 3014 [ 2619.790150] binder: undelivered TRANSACTION_ERROR: 29189 [ 2619.925689] binder: 13818:13824 Release 1 refcount change on invalid ref 2 ret -22 18:07:28 executing program 4: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000040)='/dev/net/tun\x00', 0x0, 0x0) r1 = epoll_create1(0x0) epoll_ctl$EPOLL_CTL_ADD(0xffffffffffffffff, 0x1, r0, &(0x7f0000000100)) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000080)={'tunl0\x00', 0x1}) epoll_wait(r1, &(0x7f00000000c0)=[{}], 0x1, 0x0) 18:07:28 executing program 3: r0 = socket(0x10, 0x3, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") ioctl$sock_ifreq(r0, 0x89f3, &(0x7f0000000240)={'sit0\x00'}) 18:07:28 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000006c0)={0x118, 0x0, &(0x7f0000000540)=[@release={0x40046306, 0x2}, @acquire_done, @acquire_done={0x40106309, 0x3}, @transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x50, 0x18, &(0x7f0000000080)={@flat=@binder={0x73622a85, 0xa, 0x1}, @fda={0x66646185, 0xa, 0x1, 0x9}, @fd={0x66642a85, 0x0, r1}}, &(0x7f0000000100)={0x0, 0x18, 0x38}}, 0x1000}, @transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000180)={@ptr={0x70742a85, 0x0, &(0x7f0000000140)=""/51, 0x33, 0x2, 0x25}, @flat=@weak_handle={0x77682a85, 0x1}, @flat=@binder={0x73622a85, 0xa, 0x3}}, &(0x7f0000000280)={0x0, 0x28, 0x40}}, 0x1f8aed83e3349436}, @exit_looper, @transaction_sg={0x40486311, {0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x68, 0x18, &(0x7f0000000480)={@ptr={0x70742a85, 0x0, &(0x7f00000002c0)=""/11, 0xb, 0x2, 0x3f}, @fd={0x66642a85, 0x0, r0}, @ptr={0x70742a85, 0x0, &(0x7f0000000380)=""/70, 0x46, 0x1, 0x1f}}, &(0x7f0000000500)={0x0, 0x28, 0x40}}, 0x1000}], 0x14, 0x0, &(0x7f0000000680)="86621f50fcee8bdc5bf8c503a78812261b4bf6d7"}) [ 2619.925699] binder: 13818:13824 BC_ACQUIRE_DONE u0000000000000000 no match 18:07:28 executing program 5: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000001a00)='/dev/net/tun\x00', 0x0, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000080)="c0dc00025e0b01047be070") ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000300)={'nr0\x01\x00', 0x1132}) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000001a00)='/dev/net/tun\x00', 0x2, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000300)={'nr0\x01\x00', 0x1132}) write$cgroup_int(0xffffffffffffffff, &(0x7f00000000c0)=0x2, 0xfffffffffffffe75) close(r1) 18:07:28 executing program 3: r0 = socket(0x10, 0x3, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") ioctl$sock_ifreq(r0, 0x89f3, &(0x7f0000000240)={'sit0\x00'}) [ 2619.925707] binder: 13818:13824 BC_ACQUIRE_DONE u0000000000000003 no match 18:07:28 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000006c0)={0x118, 0x0, &(0x7f0000000540)=[@release={0x40046306, 0x2}, @acquire_done, @acquire_done={0x40106309, 0x3}, @transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x50, 0x18, &(0x7f0000000080)={@flat=@binder={0x73622a85, 0xa, 0x1}, @fda={0x66646185, 0xa, 0x1, 0x9}, @fd={0x66642a85, 0x0, r1}}, &(0x7f0000000100)={0x0, 0x18, 0x38}}, 0x1000}, @transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000180)={@ptr={0x70742a85, 0x0, &(0x7f0000000140)=""/51, 0x33, 0x2, 0x25}, @flat=@weak_handle={0x77682a85, 0x1}, @flat=@binder={0x73622a85, 0xa, 0x3}}, &(0x7f0000000280)={0x0, 0x28, 0x40}}, 0x1f8aed83e3349436}, @exit_looper, @transaction_sg={0x40486311, {0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x68, 0x18, &(0x7f0000000480)={@ptr={0x70742a85, 0x0, &(0x7f00000002c0)=""/11, 0xb, 0x2, 0x3f}, @fd={0x66642a85, 0x0, r0}, @ptr={0x70742a85, 0x0, &(0x7f0000000380)=""/70, 0x46, 0x1, 0x1f}}, &(0x7f0000000500)={0x0, 0x28, 0x40}}, 0x1000}], 0x14, 0x0, &(0x7f0000000680)="86621f50fcee8bdc5bf8c503a78812261b4bf6d7"}) 18:07:28 executing program 1: clone(0x2102001fff, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) socket(0x0, 0x0, 0x0) r0 = getpid() rt_tgsigqueueinfo(0x0, r0, 0x16, &(0x7f0000000100)) rt_sigqueueinfo(r0, 0x7, &(0x7f0000000180)={0x0, 0x0, 0xffffffff}) [ 2619.925721] binder: 13818:13824 transaction failed 29189/-22, size 80-24 line 3014 [ 2619.925948] binder: undelivered TRANSACTION_ERROR: 29189 [ 2620.143067] binder: 13836:13860 Release 1 refcount change on invalid ref 2 ret -22 [ 2620.143078] binder: 13836:13860 BC_ACQUIRE_DONE u0000000000000000 no match [ 2620.143085] binder: 13836:13860 BC_ACQUIRE_DONE u0000000000000003 no match 18:07:28 executing program 2: ioctl$FS_IOC_RESVSP(0xffffffffffffffff, 0x40305828, &(0x7f00000000c0)={0x0, 0x0, 0x100000000000001}) clone(0x2102001fff, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) socket(0x0, 0x0, 0x0) r0 = getpid() rt_tgsigqueueinfo(0x0, r0, 0x16, &(0x7f0000000100)) ptrace(0x10, r0) ptrace$poke(0x4209, r0, &(0x7f00000000c0), 0x70effd) 18:07:28 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000006c0)={0x118, 0x0, &(0x7f0000000540)=[@release={0x40046306, 0x2}, @acquire_done, @acquire_done={0x40106309, 0x3}, @transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x50, 0x18, &(0x7f0000000080)={@flat=@binder={0x73622a85, 0xa, 0x1}, @fda={0x66646185, 0xa, 0x1, 0x9}, @fd={0x66642a85, 0x0, r1}}, &(0x7f0000000100)={0x0, 0x18, 0x38}}, 0x1000}, @transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000180)={@ptr={0x70742a85, 0x0, &(0x7f0000000140)=""/51, 0x33, 0x2, 0x25}, @flat=@weak_handle={0x77682a85, 0x1}, @flat=@binder={0x73622a85, 0xa, 0x3}}, &(0x7f0000000280)={0x0, 0x28, 0x40}}, 0x1f8aed83e3349436}, @exit_looper, @transaction_sg={0x40486311, {0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x68, 0x18, &(0x7f0000000480)={@ptr={0x70742a85, 0x0, &(0x7f00000002c0)=""/11, 0xb, 0x2, 0x3f}, @fd={0x66642a85, 0x0, r0}, @ptr={0x70742a85, 0x0, &(0x7f0000000380)=""/70, 0x46, 0x1, 0x1f}}, &(0x7f0000000500)={0x0, 0x28, 0x40}}, 0x1000}], 0x14, 0x0, &(0x7f0000000680)="86621f50fcee8bdc5bf8c503a78812261b4bf6d7"}) 18:07:28 executing program 4: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000040)='/dev/net/tun\x00', 0x0, 0x0) r1 = epoll_create1(0x0) epoll_ctl$EPOLL_CTL_ADD(0xffffffffffffffff, 0x1, r0, &(0x7f0000000100)) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000080)={'tunl0\x00', 0x1}) epoll_wait(r1, &(0x7f00000000c0)=[{}], 0x1, 0x0) 18:07:28 executing program 3: r0 = socket(0x10, 0x3, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") ioctl$sock_ifreq(r0, 0x89f3, &(0x7f0000000240)={'sit0\x00'}) [ 2620.143100] binder: 13836:13860 transaction failed 29189/-22, size 80-24 line 3014 [ 2620.143288] binder: undelivered TRANSACTION_ERROR: 29189 [ 2620.303101] binder: 13909:13911 Release 1 refcount change on invalid ref 2 ret -22 18:07:29 executing program 3: r0 = socket(0x10, 0x3, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") ioctl$sock_ifreq(r0, 0x89f3, &(0x7f0000000240)={'sit0\x00'}) 18:07:29 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000006c0)={0x118, 0x0, &(0x7f0000000540)=[@release={0x40046306, 0x2}, @acquire_done, @acquire_done={0x40106309, 0x3}, @transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x50, 0x18, &(0x7f0000000080)={@flat=@binder={0x73622a85, 0xa, 0x1}, @fda={0x66646185, 0xa, 0x1, 0x9}, @fd={0x66642a85, 0x0, r1}}, &(0x7f0000000100)={0x0, 0x18, 0x38}}, 0x1000}, @transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000180)={@ptr={0x70742a85, 0x0, &(0x7f0000000140)=""/51, 0x33, 0x2, 0x25}, @flat=@weak_handle={0x77682a85, 0x1}, @flat=@binder={0x73622a85, 0xa, 0x3}}, &(0x7f0000000280)={0x0, 0x28, 0x40}}, 0x1f8aed83e3349436}, @exit_looper, @transaction_sg={0x40486311, {0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x68, 0x18, &(0x7f0000000480)={@ptr={0x70742a85, 0x0, &(0x7f00000002c0)=""/11, 0xb, 0x2, 0x3f}, @fd={0x66642a85, 0x0, r0}, @ptr={0x70742a85, 0x0, &(0x7f0000000380)=""/70, 0x46, 0x1, 0x1f}}, &(0x7f0000000500)={0x0, 0x28, 0x40}}, 0x1000}], 0x14, 0x0, &(0x7f0000000680)="86621f50fcee8bdc5bf8c503a78812261b4bf6d7"}) [ 2620.303112] binder: 13909:13911 BC_ACQUIRE_DONE u0000000000000000 no match 18:07:29 executing program 1: clone(0x2102001fff, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) socket(0x0, 0x0, 0x0) r0 = getpid() rt_tgsigqueueinfo(0x0, r0, 0x16, &(0x7f0000000100)) rt_sigqueueinfo(r0, 0x7, &(0x7f0000000180)={0x0, 0x0, 0xffffffff}) 18:07:29 executing program 3: r0 = socket(0x10, 0x3, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") ioctl$sock_ifreq(r0, 0x89f3, &(0x7f0000000240)={'sit0\x00'}) [ 2620.303120] binder: 13909:13911 BC_ACQUIRE_DONE u0000000000000003 no match 18:07:29 executing program 5: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000001a00)='/dev/net/tun\x00', 0x0, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000080)="c0dc00025e0b01047be070") ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000300)={'nr0\x01\x00', 0x1132}) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000001a00)='/dev/net/tun\x00', 0x2, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000300)={'nr0\x01\x00', 0x1132}) write$cgroup_int(0xffffffffffffffff, &(0x7f00000000c0)=0x2, 0xfffffffffffffe75) close(r1) 18:07:29 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000006c0)={0x118, 0x0, &(0x7f0000000540)=[@release={0x40046306, 0x2}, @acquire_done, @acquire_done={0x40106309, 0x3}, @transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x50, 0x18, &(0x7f0000000080)={@flat=@binder={0x73622a85, 0xa, 0x1}, @fda={0x66646185, 0xa, 0x1, 0x9}, @fd={0x66642a85, 0x0, r1}}, &(0x7f0000000100)={0x0, 0x18, 0x38}}, 0x1000}, @transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000180)={@ptr={0x70742a85, 0x0, &(0x7f0000000140)=""/51, 0x33, 0x2, 0x25}, @flat=@weak_handle={0x77682a85, 0x1}, @flat=@binder={0x73622a85, 0xa, 0x3}}, &(0x7f0000000280)={0x0, 0x28, 0x40}}, 0x1f8aed83e3349436}, @exit_looper, @transaction_sg={0x40486311, {0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x68, 0x18, &(0x7f0000000480)={@ptr={0x70742a85, 0x0, &(0x7f00000002c0)=""/11, 0xb, 0x2, 0x3f}, @fd={0x66642a85, 0x0, r0}, @ptr={0x70742a85, 0x0, &(0x7f0000000380)=""/70, 0x46, 0x1, 0x1f}}, &(0x7f0000000500)={0x0, 0x28, 0x40}}, 0x1000}], 0x14, 0x0, &(0x7f0000000680)="86621f50fcee8bdc5bf8c503a78812261b4bf6d7"}) [ 2620.303132] binder: 13909:13911 transaction failed 29189/-22, size 80-24 line 3014 18:07:29 executing program 4: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000040)='/dev/net/tun\x00', 0x0, 0x0) r1 = epoll_create1(0x0) epoll_ctl$EPOLL_CTL_ADD(0xffffffffffffffff, 0x1, r0, &(0x7f0000000100)) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000080)={'tunl0\x00', 0x1}) epoll_wait(r1, &(0x7f00000000c0)=[{}], 0x1, 0x0) 18:07:29 executing program 3: r0 = socket(0x10, 0x3, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") ioctl$sock_ifreq(r0, 0x89f3, &(0x7f0000000240)={'sit0\x00'}) [ 2620.303430] binder: undelivered TRANSACTION_ERROR: 29189 18:07:29 executing program 2: ioctl$FS_IOC_RESVSP(0xffffffffffffffff, 0x40305828, &(0x7f00000000c0)={0x0, 0x0, 0x100000000000001}) clone(0x2102001fff, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) socket(0x0, 0x0, 0x0) r0 = getpid() rt_tgsigqueueinfo(0x0, r0, 0x16, &(0x7f0000000100)) ptrace(0x10, r0) ptrace$poke(0x4209, r0, &(0x7f00000000c0), 0x70effd) 18:07:29 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000006c0)={0x118, 0x0, &(0x7f0000000540)=[@release={0x40046306, 0x2}, @acquire_done, @acquire_done={0x40106309, 0x3}, @transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x50, 0x18, &(0x7f0000000080)={@flat=@binder={0x73622a85, 0xa, 0x1}, @fda={0x66646185, 0xa, 0x1, 0x9}, @fd={0x66642a85, 0x0, r1}}, &(0x7f0000000100)={0x0, 0x18, 0x38}}, 0x1000}, @transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000180)={@ptr={0x70742a85, 0x0, &(0x7f0000000140)=""/51, 0x33, 0x2, 0x25}, @flat=@weak_handle={0x77682a85, 0x1}, @flat=@binder={0x73622a85, 0xa, 0x3}}, &(0x7f0000000280)={0x0, 0x28, 0x40}}, 0x1f8aed83e3349436}, @exit_looper, @transaction_sg={0x40486311, {0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x68, 0x18, &(0x7f0000000480)={@ptr={0x70742a85, 0x0, &(0x7f00000002c0)=""/11, 0xb, 0x2, 0x3f}, @fd={0x66642a85, 0x0, r0}, @ptr={0x70742a85, 0x0, &(0x7f0000000380)=""/70, 0x46, 0x1, 0x1f}}, &(0x7f0000000500)={0x0, 0x28, 0x40}}, 0x1000}], 0x14, 0x0, &(0x7f0000000680)="86621f50fcee8bdc5bf8c503a78812261b4bf6d7"}) 18:07:29 executing program 1: clone(0x2102001fff, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) socket(0x0, 0x0, 0x0) r0 = getpid() rt_tgsigqueueinfo(0x0, r0, 0x16, &(0x7f0000000100)) rt_sigqueueinfo(r0, 0x7, &(0x7f0000000180)={0x0, 0x0, 0xffffffff}) [ 2620.417998] binder: 13919:13947 Release 1 refcount change on invalid ref 2 ret -22 [ 2620.418007] binder: 13919:13947 BC_ACQUIRE_DONE u0000000000000000 no match 18:07:29 executing program 3: r0 = socket(0x10, 0x3, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") ioctl$sock_ifreq(r0, 0x89f3, &(0x7f0000000240)={'sit0\x00'}) [ 2620.418015] binder: 13919:13947 BC_ACQUIRE_DONE u0000000000000003 no match [ 2620.418027] binder: 13919:13947 transaction failed 29189/-22, size 80-24 line 3014 18:07:29 executing program 3: r0 = socket(0x10, 0x3, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") ioctl$sock_ifreq(r0, 0x89f3, &(0x7f0000000240)={'sit0\x00'}) [ 2620.418357] binder: undelivered TRANSACTION_ERROR: 29189 18:07:29 executing program 1: clone(0x2102001fff, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) socket(0x0, 0x0, 0x0) r0 = getpid() rt_tgsigqueueinfo(0x0, r0, 0x16, &(0x7f0000000100)) rt_sigqueueinfo(r0, 0x7, &(0x7f0000000180)={0x0, 0x0, 0xffffffff}) 18:07:29 executing program 4: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000040)='/dev/net/tun\x00', 0x0, 0x0) r1 = epoll_create1(0x0) epoll_ctl$EPOLL_CTL_ADD(0xffffffffffffffff, 0x1, r0, &(0x7f0000000100)) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000080)={'tunl0\x00', 0x1}) epoll_wait(r1, &(0x7f00000000c0)=[{}], 0x1, 0x0) 18:07:29 executing program 2: ioctl$FS_IOC_RESVSP(0xffffffffffffffff, 0x40305828, &(0x7f00000000c0)={0x0, 0x0, 0x100000000000001}) clone(0x2102001fff, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) socket(0x0, 0x0, 0x0) r0 = getpid() rt_tgsigqueueinfo(0x0, r0, 0x16, &(0x7f0000000100)) ptrace(0x10, r0) ptrace$poke(0x4209, r0, &(0x7f00000000c0), 0x70effd) [ 2620.547584] binder: 13996:13998 Release 1 refcount change on invalid ref 2 ret -22 [ 2620.547595] binder: 13996:13998 BC_ACQUIRE_DONE u0000000000000000 no match 18:07:29 executing program 5: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000001a00)='/dev/net/tun\x00', 0x0, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000080)="c0dc00025e0b01047be070") ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000300)={'nr0\x01\x00', 0x1132}) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000001a00)='/dev/net/tun\x00', 0x2, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000300)={'nr0\x01\x00', 0x1132}) write$cgroup_int(0xffffffffffffffff, &(0x7f00000000c0)=0x2, 0xfffffffffffffe75) close(r1) 18:07:29 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000006c0)={0x118, 0x0, &(0x7f0000000540)=[@release={0x40046306, 0x2}, @acquire_done, @acquire_done={0x40106309, 0x3}, @transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x50, 0x18, &(0x7f0000000080)={@flat=@binder={0x73622a85, 0xa, 0x1}, @fda={0x66646185, 0xa, 0x1, 0x9}, @fd={0x66642a85, 0x0, r1}}, &(0x7f0000000100)={0x0, 0x18, 0x38}}, 0x1000}, @transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000180)={@ptr={0x70742a85, 0x0, &(0x7f0000000140)=""/51, 0x33, 0x2, 0x25}, @flat=@weak_handle={0x77682a85, 0x1}, @flat=@binder={0x73622a85, 0xa, 0x3}}, &(0x7f0000000280)={0x0, 0x28, 0x40}}, 0x1f8aed83e3349436}, @exit_looper, @transaction_sg={0x40486311, {0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x68, 0x18, &(0x7f0000000480)={@ptr={0x70742a85, 0x0, &(0x7f00000002c0)=""/11, 0xb, 0x2, 0x3f}, @fd={0x66642a85, 0x0, r0}, @ptr={0x70742a85, 0x0, &(0x7f0000000380)=""/70, 0x46, 0x1, 0x1f}}, &(0x7f0000000500)={0x0, 0x28, 0x40}}, 0x1000}], 0x14, 0x0, &(0x7f0000000680)="86621f50fcee8bdc5bf8c503a78812261b4bf6d7"}) 18:07:29 executing program 3: r0 = socket(0x10, 0x3, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") ioctl$sock_ifreq(r0, 0x89f3, &(0x7f0000000240)={'sit0\x00'}) 18:07:29 executing program 1: clone(0x2102001fff, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) socket(0x0, 0x0, 0x0) r0 = getpid() rt_tgsigqueueinfo(0x0, r0, 0x16, &(0x7f0000000100)) rt_sigqueueinfo(r0, 0x7, &(0x7f0000000180)={0x0, 0x0, 0xffffffff}) [ 2620.547603] binder: 13996:13998 BC_ACQUIRE_DONE u0000000000000003 no match 18:07:29 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000006c0)={0x118, 0x0, &(0x7f0000000540)=[@release={0x40046306, 0x2}, @acquire_done, @acquire_done={0x40106309, 0x3}, @transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x50, 0x18, &(0x7f0000000080)={@flat=@binder={0x73622a85, 0xa, 0x1}, @fda={0x66646185, 0xa, 0x1, 0x9}, @fd={0x66642a85, 0x0, r1}}, &(0x7f0000000100)={0x0, 0x18, 0x38}}, 0x1000}, @transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000180)={@ptr={0x70742a85, 0x0, &(0x7f0000000140)=""/51, 0x33, 0x2, 0x25}, @flat=@weak_handle={0x77682a85, 0x1}, @flat=@binder={0x73622a85, 0xa, 0x3}}, &(0x7f0000000280)={0x0, 0x28, 0x40}}, 0x1f8aed83e3349436}, @exit_looper, @transaction_sg={0x40486311, {0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x68, 0x18, &(0x7f0000000480)={@ptr={0x70742a85, 0x0, &(0x7f00000002c0)=""/11, 0xb, 0x2, 0x3f}, @fd={0x66642a85, 0x0, r0}, @ptr={0x70742a85, 0x0, &(0x7f0000000380)=""/70, 0x46, 0x1, 0x1f}}, &(0x7f0000000500)={0x0, 0x28, 0x40}}, 0x1000}], 0x14, 0x0, &(0x7f0000000680)="86621f50fcee8bdc5bf8c503a78812261b4bf6d7"}) [ 2620.547616] binder: 13996:13998 transaction failed 29189/-22, size 80-24 line 3014 18:07:29 executing program 1: clone(0x2102001fff, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) socket(0x0, 0x0, 0x0) r0 = getpid() rt_tgsigqueueinfo(0x0, r0, 0x16, &(0x7f0000000100)) rt_sigqueueinfo(r0, 0x7, &(0x7f0000000180)={0x0, 0x0, 0xffffffff}) 18:07:29 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000006c0)={0x118, 0x0, &(0x7f0000000540)=[@release={0x40046306, 0x2}, @acquire_done, @acquire_done={0x40106309, 0x3}, @transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x50, 0x18, &(0x7f0000000080)={@flat=@binder={0x73622a85, 0xa, 0x1}, @fda={0x66646185, 0xa, 0x1, 0x9}, @fd={0x66642a85, 0x0, r1}}, &(0x7f0000000100)={0x0, 0x18, 0x38}}, 0x1000}, @transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000180)={@ptr={0x70742a85, 0x0, &(0x7f0000000140)=""/51, 0x33, 0x2, 0x25}, @flat=@weak_handle={0x77682a85, 0x1}, @flat=@binder={0x73622a85, 0xa, 0x3}}, &(0x7f0000000280)={0x0, 0x28, 0x40}}, 0x1f8aed83e3349436}, @exit_looper, @transaction_sg={0x40486311, {0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x68, 0x18, &(0x7f0000000480)={@ptr={0x70742a85, 0x0, &(0x7f00000002c0)=""/11, 0xb, 0x2, 0x3f}, @fd={0x66642a85, 0x0, r0}, @ptr={0x70742a85, 0x0, &(0x7f0000000380)=""/70, 0x46, 0x1, 0x1f}}, &(0x7f0000000500)={0x0, 0x28, 0x40}}, 0x1000}], 0x14, 0x0, &(0x7f0000000680)="86621f50fcee8bdc5bf8c503a78812261b4bf6d7"}) 18:07:29 executing program 3: r0 = socket(0x10, 0x3, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") ioctl$sock_ifreq(r0, 0x89f3, &(0x7f0000000240)={'sit0\x00'}) [ 2620.548336] binder: undelivered TRANSACTION_ERROR: 29189 [ 2620.595442] binder: 14022:14023 Release 1 refcount change on invalid ref 2 ret -22 [ 2620.595453] binder: 14022:14023 BC_ACQUIRE_DONE u0000000000000000 no match 18:07:29 executing program 4: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000040)='/dev/net/tun\x00', 0x0, 0x0) r1 = epoll_create1(0x0) epoll_ctl$EPOLL_CTL_ADD(0xffffffffffffffff, 0x1, r0, &(0x7f0000000100)) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000080)={'tunl0\x00', 0x1}) epoll_wait(r1, &(0x7f00000000c0)=[{}], 0x1, 0x0) 18:07:29 executing program 2: ioctl$FS_IOC_RESVSP(0xffffffffffffffff, 0x40305828, &(0x7f00000000c0)={0x0, 0x0, 0x100000000000001}) clone(0x2102001fff, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) socket(0x0, 0x0, 0x0) r0 = getpid() rt_tgsigqueueinfo(0x0, r0, 0x16, &(0x7f0000000100)) ptrace(0x10, r0) ptrace$poke(0x4209, r0, &(0x7f00000000c0), 0x70effd) 18:07:29 executing program 5: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000001a00)='/dev/net/tun\x00', 0x0, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000080)="c0dc00025e0b01047be070") ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000300)={'nr0\x01\x00', 0x1132}) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000001a00)='/dev/net/tun\x00', 0x2, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000300)={'nr0\x01\x00', 0x1132}) write$cgroup_int(0xffffffffffffffff, &(0x7f00000000c0)=0x2, 0xfffffffffffffe75) close(r1) [ 2620.595461] binder: 14022:14023 BC_ACQUIRE_DONE u0000000000000003 no match 18:07:29 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000006c0)={0x118, 0x0, &(0x7f0000000540)=[@release={0x40046306, 0x2}, @acquire_done, @acquire_done={0x40106309, 0x3}, @transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x50, 0x18, &(0x7f0000000080)={@flat=@binder={0x73622a85, 0xa, 0x1}, @fda={0x66646185, 0xa, 0x1, 0x9}, @fd={0x66642a85, 0x0, r1}}, &(0x7f0000000100)={0x0, 0x18, 0x38}}, 0x1000}, @transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000180)={@ptr={0x70742a85, 0x0, &(0x7f0000000140)=""/51, 0x33, 0x2, 0x25}, @flat=@weak_handle={0x77682a85, 0x1}, @flat=@binder={0x73622a85, 0xa, 0x3}}, &(0x7f0000000280)={0x0, 0x28, 0x40}}, 0x1f8aed83e3349436}, @exit_looper, @transaction_sg={0x40486311, {0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x68, 0x18, &(0x7f0000000480)={@ptr={0x70742a85, 0x0, &(0x7f00000002c0)=""/11, 0xb, 0x2, 0x3f}, @fd={0x66642a85, 0x0, r0}, @ptr={0x70742a85, 0x0, &(0x7f0000000380)=""/70, 0x46, 0x1, 0x1f}}, &(0x7f0000000500)={0x0, 0x28, 0x40}}, 0x1000}], 0x14, 0x0, &(0x7f0000000680)="86621f50fcee8bdc5bf8c503a78812261b4bf6d7"}) 18:07:29 executing program 3: r0 = socket(0x10, 0x3, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") ioctl$sock_ifreq(r0, 0x89f3, &(0x7f0000000240)={'sit0\x00'}) 18:07:29 executing program 1: clone(0x2102001fff, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) socket(0x0, 0x0, 0x0) r0 = getpid() rt_tgsigqueueinfo(0x0, r0, 0x16, &(0x7f0000000100)) rt_sigqueueinfo(r0, 0x7, &(0x7f0000000180)={0x0, 0x0, 0xffffffff}) [ 2620.595474] binder: 14022:14023 transaction failed 29189/-22, size 80-24 line 3014 18:07:29 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000006c0)={0x118, 0x0, &(0x7f0000000540)=[@release={0x40046306, 0x2}, @acquire_done, @acquire_done={0x40106309, 0x3}, @transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x50, 0x18, &(0x7f0000000080)={@flat=@binder={0x73622a85, 0xa, 0x1}, @fda={0x66646185, 0xa, 0x1, 0x9}, @fd={0x66642a85, 0x0, r1}}, &(0x7f0000000100)={0x0, 0x18, 0x38}}, 0x1000}, @transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000180)={@ptr={0x70742a85, 0x0, &(0x7f0000000140)=""/51, 0x33, 0x2, 0x25}, @flat=@weak_handle={0x77682a85, 0x1}, @flat=@binder={0x73622a85, 0xa, 0x3}}, &(0x7f0000000280)={0x0, 0x28, 0x40}}, 0x1f8aed83e3349436}, @exit_looper, @transaction_sg={0x40486311, {0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x68, 0x18, &(0x7f0000000480)={@ptr={0x70742a85, 0x0, &(0x7f00000002c0)=""/11, 0xb, 0x2, 0x3f}, @fd={0x66642a85, 0x0, r0}, @ptr={0x70742a85, 0x0, &(0x7f0000000380)=""/70, 0x46, 0x1, 0x1f}}, &(0x7f0000000500)={0x0, 0x28, 0x40}}, 0x1000}], 0x14, 0x0, &(0x7f0000000680)="86621f50fcee8bdc5bf8c503a78812261b4bf6d7"}) [ 2620.595992] binder: undelivered TRANSACTION_ERROR: 29189 18:07:29 executing program 3: r0 = socket(0x10, 0x3, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") ioctl$sock_ifreq(r0, 0x89f3, &(0x7f0000000240)={'sit0\x00'}) 18:07:29 executing program 4: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000040)='/dev/net/tun\x00', 0x0, 0x0) r1 = epoll_create1(0x0) epoll_ctl$EPOLL_CTL_ADD(0xffffffffffffffff, 0x1, r0, &(0x7f0000000100)) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000080)={'tunl0\x00', 0x1}) epoll_wait(r1, &(0x7f00000000c0)=[{}], 0x1, 0x0) [ 2621.279885] binder: 14115:14175 Release 1 refcount change on invalid ref 2 ret -22 18:07:29 executing program 1: clone(0x2102001fff, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) socket(0x0, 0x0, 0x0) r0 = getpid() rt_tgsigqueueinfo(0x0, r0, 0x16, &(0x7f0000000100)) rt_sigqueueinfo(r0, 0x7, &(0x7f0000000180)={0x0, 0x0, 0xffffffff}) 18:07:30 executing program 3: r0 = socket(0x10, 0x3, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") ioctl$sock_ifreq(r0, 0x89f3, &(0x7f0000000240)={'sit0\x00'}) 18:07:30 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000006c0)={0x118, 0x0, &(0x7f0000000540)=[@release={0x40046306, 0x2}, @acquire_done, @acquire_done={0x40106309, 0x3}, @transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x50, 0x18, &(0x7f0000000080)={@flat=@binder={0x73622a85, 0xa, 0x1}, @fda={0x66646185, 0xa, 0x1, 0x9}, @fd={0x66642a85, 0x0, r1}}, &(0x7f0000000100)={0x0, 0x18, 0x38}}, 0x1000}, @transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000180)={@ptr={0x70742a85, 0x0, &(0x7f0000000140)=""/51, 0x33, 0x2, 0x25}, @flat=@weak_handle={0x77682a85, 0x1}, @flat=@binder={0x73622a85, 0xa, 0x3}}, &(0x7f0000000280)={0x0, 0x28, 0x40}}, 0x1f8aed83e3349436}, @exit_looper, @transaction_sg={0x40486311, {0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x68, 0x18, &(0x7f0000000480)={@ptr={0x70742a85, 0x0, &(0x7f00000002c0)=""/11, 0xb, 0x2, 0x3f}, @fd={0x66642a85, 0x0, r0}, @ptr={0x70742a85, 0x0, &(0x7f0000000380)=""/70, 0x46, 0x1, 0x1f}}, &(0x7f0000000500)={0x0, 0x28, 0x40}}, 0x1000}], 0x14, 0x0, &(0x7f0000000680)="86621f50fcee8bdc5bf8c503a78812261b4bf6d7"}) [ 2621.279895] binder: 14115:14175 BC_ACQUIRE_DONE u0000000000000000 no match 18:07:30 executing program 2: ioctl$FS_IOC_RESVSP(0xffffffffffffffff, 0x40305828, &(0x7f00000000c0)={0x0, 0x0, 0x100000000000001}) clone(0x2102001fff, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) socket(0x0, 0x0, 0x0) r0 = getpid() rt_tgsigqueueinfo(0x0, r0, 0x16, &(0x7f0000000100)) ptrace(0x10, r0) ptrace$poke(0x4209, r0, &(0x7f00000000c0), 0x70effd) 18:07:30 executing program 1: clone(0x2102001fff, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) socket(0x0, 0x0, 0x0) r0 = getpid() rt_tgsigqueueinfo(0x0, r0, 0x16, &(0x7f0000000100)) rt_sigqueueinfo(r0, 0x7, &(0x7f0000000180)={0x0, 0x0, 0xffffffff}) [ 2621.279903] binder: 14115:14175 BC_ACQUIRE_DONE u0000000000000003 no match [ 2621.279915] binder: 14115:14175 transaction failed 29189/-22, size 80-24 line 3014 [ 2621.280248] binder: undelivered TRANSACTION_ERROR: 29189 [ 2621.387910] binder: 14273:14275 Release 1 refcount change on invalid ref 2 ret -22 [ 2621.387920] binder: 14273:14275 BC_ACQUIRE_DONE u0000000000000000 no match [ 2621.387927] binder: 14273:14275 BC_ACQUIRE_DONE u0000000000000003 no match 18:07:30 executing program 5: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000001a00)='/dev/net/tun\x00', 0x0, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000080)="c0dc00025e0b01047be070") ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000300)={'nr0\x01\x00', 0x1132}) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000001a00)='/dev/net/tun\x00', 0x2, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000300)={'nr0\x01\x00', 0x1132}) write$cgroup_int(0xffffffffffffffff, &(0x7f00000000c0)=0x2, 0xfffffffffffffe75) close(r1) 18:07:30 executing program 3: r0 = socket(0x10, 0x3, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") ioctl$sock_ifreq(r0, 0x89f3, &(0x7f0000000240)={'sit0\x00'}) 18:07:30 executing program 1: clone(0x2102001fff, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) socket(0x0, 0x0, 0x0) r0 = getpid() rt_tgsigqueueinfo(0x0, r0, 0x16, &(0x7f0000000100)) rt_sigqueueinfo(r0, 0x7, &(0x7f0000000180)={0x0, 0x0, 0xffffffff}) 18:07:30 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000006c0)={0x118, 0x0, &(0x7f0000000540)=[@release={0x40046306, 0x2}, @acquire_done, @acquire_done={0x40106309, 0x3}, @transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x50, 0x18, &(0x7f0000000080)={@flat=@binder={0x73622a85, 0xa, 0x1}, @fda={0x66646185, 0xa, 0x1, 0x9}, @fd={0x66642a85, 0x0, r1}}, &(0x7f0000000100)={0x0, 0x18, 0x38}}, 0x1000}, @transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000180)={@ptr={0x70742a85, 0x0, &(0x7f0000000140)=""/51, 0x33, 0x2, 0x25}, @flat=@weak_handle={0x77682a85, 0x1}, @flat=@binder={0x73622a85, 0xa, 0x3}}, &(0x7f0000000280)={0x0, 0x28, 0x40}}, 0x1f8aed83e3349436}, @exit_looper, @transaction_sg={0x40486311, {0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x68, 0x18, &(0x7f0000000480)={@ptr={0x70742a85, 0x0, &(0x7f00000002c0)=""/11, 0xb, 0x2, 0x3f}, @fd={0x66642a85, 0x0, r0}, @ptr={0x70742a85, 0x0, &(0x7f0000000380)=""/70, 0x46, 0x1, 0x1f}}, &(0x7f0000000500)={0x0, 0x28, 0x40}}, 0x1000}], 0x14, 0x0, &(0x7f0000000680)="86621f50fcee8bdc5bf8c503a78812261b4bf6d7"}) 18:07:30 executing program 4: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000040)='/dev/net/tun\x00', 0x0, 0x0) r1 = epoll_create1(0x0) epoll_ctl$EPOLL_CTL_ADD(0xffffffffffffffff, 0x1, r0, &(0x7f0000000100)) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000080)={'tunl0\x00', 0x1}) epoll_wait(r1, &(0x7f00000000c0)=[{}], 0x1, 0x0) 18:07:30 executing program 2: ioctl$FS_IOC_RESVSP(0xffffffffffffffff, 0x40305828, &(0x7f00000000c0)={0x0, 0x0, 0x100000000000001}) clone(0x2102001fff, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) socket(0x0, 0x0, 0x0) r0 = getpid() rt_tgsigqueueinfo(0x0, r0, 0x16, &(0x7f0000000100)) ptrace(0x10, r0) ptrace$poke(0x4209, r0, &(0x7f00000000c0), 0x70effd) [ 2621.387940] binder: 14273:14275 transaction failed 29189/-22, size 80-24 line 3014 [ 2621.388178] binder: undelivered TRANSACTION_ERROR: 29189 [ 2621.554266] binder: 14321:14322 Release 1 refcount change on invalid ref 2 ret -22 [ 2621.554276] binder: 14321:14322 BC_ACQUIRE_DONE u0000000000000000 no match 18:07:30 executing program 3: r0 = socket(0x10, 0x3, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") ioctl$sock_ifreq(r0, 0x89f3, &(0x7f0000000240)={'sit0\x00'}) 18:07:30 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000006c0)={0x118, 0x0, &(0x7f0000000540)=[@release={0x40046306, 0x2}, @acquire_done, @acquire_done={0x40106309, 0x3}, @transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x50, 0x18, &(0x7f0000000080)={@flat=@binder={0x73622a85, 0xa, 0x1}, @fda={0x66646185, 0xa, 0x1, 0x9}, @fd={0x66642a85, 0x0, r1}}, &(0x7f0000000100)={0x0, 0x18, 0x38}}, 0x1000}, @transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000180)={@ptr={0x70742a85, 0x0, &(0x7f0000000140)=""/51, 0x33, 0x2, 0x25}, @flat=@weak_handle={0x77682a85, 0x1}, @flat=@binder={0x73622a85, 0xa, 0x3}}, &(0x7f0000000280)={0x0, 0x28, 0x40}}, 0x1f8aed83e3349436}, @exit_looper, @transaction_sg={0x40486311, {0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x68, 0x18, &(0x7f0000000480)={@ptr={0x70742a85, 0x0, &(0x7f00000002c0)=""/11, 0xb, 0x2, 0x3f}, @fd={0x66642a85, 0x0, r0}, @ptr={0x70742a85, 0x0, &(0x7f0000000380)=""/70, 0x46, 0x1, 0x1f}}, &(0x7f0000000500)={0x0, 0x28, 0x40}}, 0x1000}], 0x14, 0x0, &(0x7f0000000680)="86621f50fcee8bdc5bf8c503a78812261b4bf6d7"}) 18:07:30 executing program 1: clone(0x2102001fff, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) socket(0x0, 0x0, 0x0) r0 = getpid() rt_tgsigqueueinfo(0x0, r0, 0x16, &(0x7f0000000100)) rt_sigqueueinfo(r0, 0x7, &(0x7f0000000180)={0x0, 0x0, 0xffffffff}) [ 2621.554284] binder: 14321:14322 BC_ACQUIRE_DONE u0000000000000003 no match 18:07:30 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000006c0)={0x118, 0x0, &(0x7f0000000540)=[@release={0x40046306, 0x2}, @acquire_done, @acquire_done={0x40106309, 0x3}, @transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x50, 0x18, &(0x7f0000000080)={@flat=@binder={0x73622a85, 0xa, 0x1}, @fda={0x66646185, 0xa, 0x1, 0x9}, @fd={0x66642a85, 0x0, r1}}, &(0x7f0000000100)={0x0, 0x18, 0x38}}, 0x1000}, @transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000180)={@ptr={0x70742a85, 0x0, &(0x7f0000000140)=""/51, 0x33, 0x2, 0x25}, @flat=@weak_handle={0x77682a85, 0x1}, @flat=@binder={0x73622a85, 0xa, 0x3}}, &(0x7f0000000280)={0x0, 0x28, 0x40}}, 0x1f8aed83e3349436}, @exit_looper, @transaction_sg={0x40486311, {0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x68, 0x18, &(0x7f0000000480)={@ptr={0x70742a85, 0x0, &(0x7f00000002c0)=""/11, 0xb, 0x2, 0x3f}, @fd={0x66642a85, 0x0, r0}, @ptr={0x70742a85, 0x0, &(0x7f0000000380)=""/70, 0x46, 0x1, 0x1f}}, &(0x7f0000000500)={0x0, 0x28, 0x40}}, 0x1000}], 0x14, 0x0, &(0x7f0000000680)="86621f50fcee8bdc5bf8c503a78812261b4bf6d7"}) [ 2621.554298] binder: 14321:14322 transaction failed 29189/-22, size 80-24 line 3014 18:07:30 executing program 2: ioctl$FS_IOC_RESVSP(0xffffffffffffffff, 0x40305828, &(0x7f00000000c0)={0x0, 0x0, 0x100000000000001}) clone(0x2102001fff, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) socket(0x0, 0x0, 0x0) r0 = getpid() rt_tgsigqueueinfo(0x0, r0, 0x16, &(0x7f0000000100)) ptrace(0x10, r0) ptrace$poke(0x4209, r0, &(0x7f00000000c0), 0x70effd) 18:07:30 executing program 1: clone(0x2102001fff, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) socket(0x0, 0x0, 0x0) r0 = getpid() rt_tgsigqueueinfo(0x0, r0, 0x16, &(0x7f0000000100)) rt_sigqueueinfo(r0, 0x7, &(0x7f0000000180)={0x0, 0x0, 0xffffffff}) [ 2621.554583] binder: undelivered TRANSACTION_ERROR: 29189 [ 2621.680766] binder: 14352:14362 Release 1 refcount change on invalid ref 2 ret -22 [ 2621.680776] binder: 14352:14362 BC_ACQUIRE_DONE u0000000000000000 no match [ 2621.680784] binder: 14352:14362 BC_ACQUIRE_DONE u0000000000000003 no match [ 2621.680797] binder: 14352:14362 transaction failed 29189/-22, size 80-24 line 3014 [ 2621.685349] binder: undelivered TRANSACTION_ERROR: 29189 [ 2621.886537] binder: 14410:14436 Release 1 refcount change on invalid ref 2 ret -22 [ 2621.886547] binder: 14410:14436 BC_ACQUIRE_DONE u0000000000000000 no match [ 2621.886555] binder: 14410:14436 BC_ACQUIRE_DONE u0000000000000003 no match [ 2621.886568] binder: 14410:14436 transaction failed 29189/-22, size 80-24 line 3014 [ 2621.888021] binder: undelivered TRANSACTION_ERROR: 29189 18:07:30 executing program 5: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000001a00)='/dev/net/tun\x00', 0x0, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000080)="c0dc00025e0b01047be070") ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000300)={'nr0\x01\x00', 0x1132}) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000001a00)='/dev/net/tun\x00', 0x2, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000300)={'nr0\x01\x00', 0x1132}) write$cgroup_int(0xffffffffffffffff, &(0x7f00000000c0)=0x2, 0xfffffffffffffe75) close(r1) 18:07:30 executing program 3: r0 = socket(0x10, 0x3, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") ioctl$sock_ifreq(r0, 0x89f3, &(0x7f0000000240)={'sit0\x00'}) 18:07:30 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000006c0)={0x118, 0x0, &(0x7f0000000540)=[@release={0x40046306, 0x2}, @acquire_done, @acquire_done={0x40106309, 0x3}, @transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x50, 0x18, &(0x7f0000000080)={@flat=@binder={0x73622a85, 0xa, 0x1}, @fda={0x66646185, 0xa, 0x1, 0x9}, @fd={0x66642a85, 0x0, r1}}, &(0x7f0000000100)={0x0, 0x18, 0x38}}, 0x1000}, @transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000180)={@ptr={0x70742a85, 0x0, &(0x7f0000000140)=""/51, 0x33, 0x2, 0x25}, @flat=@weak_handle={0x77682a85, 0x1}, @flat=@binder={0x73622a85, 0xa, 0x3}}, &(0x7f0000000280)={0x0, 0x28, 0x40}}, 0x1f8aed83e3349436}, @exit_looper, @transaction_sg={0x40486311, {0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x68, 0x18, &(0x7f0000000480)={@ptr={0x70742a85, 0x0, &(0x7f00000002c0)=""/11, 0xb, 0x2, 0x3f}, @fd={0x66642a85, 0x0, r0}, @ptr={0x70742a85, 0x0, &(0x7f0000000380)=""/70, 0x46, 0x1, 0x1f}}, &(0x7f0000000500)={0x0, 0x28, 0x40}}, 0x1000}], 0x14, 0x0, &(0x7f0000000680)="86621f50fcee8bdc5bf8c503a78812261b4bf6d7"}) 18:07:30 executing program 4: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000040)='/dev/net/tun\x00', 0x0, 0x0) r1 = epoll_create1(0x0) epoll_ctl$EPOLL_CTL_ADD(0xffffffffffffffff, 0x1, r0, &(0x7f0000000100)) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000080)={'tunl0\x00', 0x1}) epoll_wait(r1, &(0x7f00000000c0)=[{}], 0x1, 0x0) 18:07:30 executing program 1: clone(0x2102001fff, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) socket(0x0, 0x0, 0x0) r0 = getpid() rt_tgsigqueueinfo(0x0, r0, 0x16, &(0x7f0000000100)) rt_sigqueueinfo(r0, 0x7, &(0x7f0000000180)={0x0, 0x0, 0xffffffff}) [ 2622.005755] binder: 14478:14514 Release 1 refcount change on invalid ref 2 ret -22 [ 2622.005764] binder: 14478:14514 BC_ACQUIRE_DONE u0000000000000000 no match 18:07:30 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000006c0)={0x118, 0x0, &(0x7f0000000540)=[@release={0x40046306, 0x2}, @acquire_done, @acquire_done={0x40106309, 0x3}, @transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x50, 0x18, &(0x7f0000000080)={@flat=@binder={0x73622a85, 0xa, 0x1}, @fda={0x66646185, 0xa, 0x1, 0x9}, @fd={0x66642a85, 0x0, r1}}, &(0x7f0000000100)={0x0, 0x18, 0x38}}, 0x1000}, @transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000180)={@ptr={0x70742a85, 0x0, &(0x7f0000000140)=""/51, 0x33, 0x2, 0x25}, @flat=@weak_handle={0x77682a85, 0x1}, @flat=@binder={0x73622a85, 0xa, 0x3}}, &(0x7f0000000280)={0x0, 0x28, 0x40}}, 0x1f8aed83e3349436}, @exit_looper, @transaction_sg={0x40486311, {0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x68, 0x18, &(0x7f0000000480)={@ptr={0x70742a85, 0x0, &(0x7f00000002c0)=""/11, 0xb, 0x2, 0x3f}, @fd={0x66642a85, 0x0, r0}, @ptr={0x70742a85, 0x0, &(0x7f0000000380)=""/70, 0x46, 0x1, 0x1f}}, &(0x7f0000000500)={0x0, 0x28, 0x40}}, 0x1000}], 0x14, 0x0, &(0x7f0000000680)="86621f50fcee8bdc5bf8c503a78812261b4bf6d7"}) 18:07:30 executing program 1: clone(0x2102001fff, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) socket(0x0, 0x0, 0x0) r0 = getpid() rt_tgsigqueueinfo(0x0, r0, 0x16, &(0x7f0000000100)) rt_sigqueueinfo(r0, 0x7, &(0x7f0000000180)={0x0, 0x0, 0xffffffff}) 18:07:30 executing program 3: r0 = socket(0x10, 0x3, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") ioctl$sock_ifreq(r0, 0x89f3, &(0x7f0000000240)={'sit0\x00'}) [ 2622.005771] binder: 14478:14514 BC_ACQUIRE_DONE u0000000000000003 no match [ 2622.005784] binder: 14478:14514 transaction failed 29189/-22, size 80-24 line 3014 18:07:30 executing program 2: ioctl$FS_IOC_RESVSP(0xffffffffffffffff, 0x40305828, &(0x7f00000000c0)={0x0, 0x0, 0x100000000000001}) clone(0x2102001fff, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) socket(0x0, 0x0, 0x0) r0 = getpid() rt_tgsigqueueinfo(0x0, r0, 0x16, &(0x7f0000000100)) ptrace(0x10, r0) ptrace$poke(0x4209, r0, &(0x7f00000000c0), 0x70effd) 18:07:30 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000006c0)={0x118, 0x0, &(0x7f0000000540)=[@release={0x40046306, 0x2}, @acquire_done, @acquire_done={0x40106309, 0x3}, @transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x50, 0x18, &(0x7f0000000080)={@flat=@binder={0x73622a85, 0xa, 0x1}, @fda={0x66646185, 0xa, 0x1, 0x9}, @fd={0x66642a85, 0x0, r1}}, &(0x7f0000000100)={0x0, 0x18, 0x38}}, 0x1000}, @transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000180)={@ptr={0x70742a85, 0x0, &(0x7f0000000140)=""/51, 0x33, 0x2, 0x25}, @flat=@weak_handle={0x77682a85, 0x1}, @flat=@binder={0x73622a85, 0xa, 0x3}}, &(0x7f0000000280)={0x0, 0x28, 0x40}}, 0x1f8aed83e3349436}, @exit_looper, @transaction_sg={0x40486311, {0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x68, 0x18, &(0x7f0000000480)={@ptr={0x70742a85, 0x0, &(0x7f00000002c0)=""/11, 0xb, 0x2, 0x3f}, @fd={0x66642a85, 0x0, r0}, @ptr={0x70742a85, 0x0, &(0x7f0000000380)=""/70, 0x46, 0x1, 0x1f}}, &(0x7f0000000500)={0x0, 0x28, 0x40}}, 0x1000}], 0x14, 0x0, &(0x7f0000000680)="86621f50fcee8bdc5bf8c503a78812261b4bf6d7"}) [ 2622.006532] binder: undelivered TRANSACTION_ERROR: 29189 18:07:30 executing program 3: r0 = socket(0x10, 0x3, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") ioctl$sock_ifreq(r0, 0x89f3, &(0x7f0000000240)={'sit0\x00'}) 18:07:30 executing program 4: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000040)='/dev/net/tun\x00', 0x0, 0x0) r1 = epoll_create1(0x0) epoll_ctl$EPOLL_CTL_ADD(0xffffffffffffffff, 0x1, r0, &(0x7f0000000100)) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000080)={'tunl0\x00', 0x1}) epoll_wait(r1, &(0x7f00000000c0)=[{}], 0x1, 0x0) [ 2622.138696] binder: 14536:14543 Release 1 refcount change on invalid ref 2 ret -22 18:07:31 executing program 5: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000001a00)='/dev/net/tun\x00', 0x0, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000080)="c0dc00025e0b01047be070") ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000300)={'nr0\x01\x00', 0x1132}) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000001a00)='/dev/net/tun\x00', 0x2, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000300)={'nr0\x01\x00', 0x1132}) write$cgroup_int(0xffffffffffffffff, &(0x7f00000000c0)=0x2, 0xfffffffffffffe75) close(r1) 18:07:31 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000006c0)={0x118, 0x0, &(0x7f0000000540)=[@release={0x40046306, 0x2}, @acquire_done, @acquire_done={0x40106309, 0x3}, @transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x50, 0x18, &(0x7f0000000080)={@flat=@binder={0x73622a85, 0xa, 0x1}, @fda={0x66646185, 0xa, 0x1, 0x9}, @fd={0x66642a85, 0x0, r1}}, &(0x7f0000000100)={0x0, 0x18, 0x38}}, 0x1000}, @transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000180)={@ptr={0x70742a85, 0x0, &(0x7f0000000140)=""/51, 0x33, 0x2, 0x25}, @flat=@weak_handle={0x77682a85, 0x1}, @flat=@binder={0x73622a85, 0xa, 0x3}}, &(0x7f0000000280)={0x0, 0x28, 0x40}}, 0x1f8aed83e3349436}, @exit_looper, @transaction_sg={0x40486311, {0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x68, 0x18, &(0x7f0000000480)={@ptr={0x70742a85, 0x0, &(0x7f00000002c0)=""/11, 0xb, 0x2, 0x3f}, @fd={0x66642a85, 0x0, r0}, @ptr={0x70742a85, 0x0, &(0x7f0000000380)=""/70, 0x46, 0x1, 0x1f}}, &(0x7f0000000500)={0x0, 0x28, 0x40}}, 0x1000}], 0x14, 0x0, &(0x7f0000000680)="86621f50fcee8bdc5bf8c503a78812261b4bf6d7"}) 18:07:31 executing program 3: r0 = socket(0x10, 0x3, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") ioctl$sock_ifreq(r0, 0x89f3, &(0x7f0000000240)={'sit0\x00'}) 18:07:31 executing program 1: clone(0x2102001fff, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) socket(0x0, 0x0, 0x0) r0 = getpid() rt_tgsigqueueinfo(0x0, r0, 0x16, &(0x7f0000000100)) rt_sigqueueinfo(r0, 0x7, &(0x7f0000000180)={0x0, 0x0, 0xffffffff}) [ 2622.138706] binder: 14536:14543 BC_ACQUIRE_DONE u0000000000000000 no match [ 2622.138713] binder: 14536:14543 BC_ACQUIRE_DONE u0000000000000003 no match 18:07:31 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000006c0)={0x118, 0x0, &(0x7f0000000540)=[@release={0x40046306, 0x2}, @acquire_done, @acquire_done={0x40106309, 0x3}, @transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x50, 0x18, &(0x7f0000000080)={@flat=@binder={0x73622a85, 0xa, 0x1}, @fda={0x66646185, 0xa, 0x1, 0x9}, @fd={0x66642a85, 0x0, r1}}, &(0x7f0000000100)={0x0, 0x18, 0x38}}, 0x1000}, @transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000180)={@ptr={0x70742a85, 0x0, &(0x7f0000000140)=""/51, 0x33, 0x2, 0x25}, @flat=@weak_handle={0x77682a85, 0x1}, @flat=@binder={0x73622a85, 0xa, 0x3}}, &(0x7f0000000280)={0x0, 0x28, 0x40}}, 0x1f8aed83e3349436}, @exit_looper, @transaction_sg={0x40486311, {0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x68, 0x18, &(0x7f0000000480)={@ptr={0x70742a85, 0x0, &(0x7f00000002c0)=""/11, 0xb, 0x2, 0x3f}, @fd={0x66642a85, 0x0, r0}, @ptr={0x70742a85, 0x0, &(0x7f0000000380)=""/70, 0x46, 0x1, 0x1f}}, &(0x7f0000000500)={0x0, 0x28, 0x40}}, 0x1000}], 0x14, 0x0, &(0x7f0000000680)="86621f50fcee8bdc5bf8c503a78812261b4bf6d7"}) [ 2622.138726] binder: 14536:14543 transaction failed 29189/-22, size 80-24 line 3014 [ 2622.139216] binder: undelivered TRANSACTION_ERROR: 29189 18:07:31 executing program 2: ioctl$FS_IOC_RESVSP(0xffffffffffffffff, 0x40305828, &(0x7f00000000c0)={0x0, 0x0, 0x100000000000001}) clone(0x2102001fff, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) socket(0x0, 0x0, 0x0) r0 = getpid() rt_tgsigqueueinfo(0x0, r0, 0x16, &(0x7f0000000100)) ptrace(0x10, r0) ptrace$poke(0x4209, r0, &(0x7f00000000c0), 0x70effd) 18:07:31 executing program 1: clone(0x2102001fff, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) socket(0x0, 0x0, 0x0) r0 = getpid() rt_tgsigqueueinfo(0x0, r0, 0x16, &(0x7f0000000100)) rt_sigqueueinfo(r0, 0x7, &(0x7f0000000180)={0x0, 0x0, 0xffffffff}) [ 2622.282381] binder: 14584:14586 Release 1 refcount change on invalid ref 2 ret -22 [ 2622.282391] binder: 14584:14586 BC_ACQUIRE_DONE u0000000000000000 no match 18:07:31 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000006c0)={0x118, 0x0, &(0x7f0000000540)=[@release={0x40046306, 0x2}, @acquire_done, @acquire_done={0x40106309, 0x3}, @transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x50, 0x18, &(0x7f0000000080)={@flat=@binder={0x73622a85, 0xa, 0x1}, @fda={0x66646185, 0xa, 0x1, 0x9}, @fd={0x66642a85, 0x0, r1}}, &(0x7f0000000100)={0x0, 0x18, 0x38}}, 0x1000}, @transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000180)={@ptr={0x70742a85, 0x0, &(0x7f0000000140)=""/51, 0x33, 0x2, 0x25}, @flat=@weak_handle={0x77682a85, 0x1}, @flat=@binder={0x73622a85, 0xa, 0x3}}, &(0x7f0000000280)={0x0, 0x28, 0x40}}, 0x1f8aed83e3349436}, @exit_looper, @transaction_sg={0x40486311, {0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x68, 0x18, &(0x7f0000000480)={@ptr={0x70742a85, 0x0, &(0x7f00000002c0)=""/11, 0xb, 0x2, 0x3f}, @fd={0x66642a85, 0x0, r0}, @ptr={0x70742a85, 0x0, &(0x7f0000000380)=""/70, 0x46, 0x1, 0x1f}}, &(0x7f0000000500)={0x0, 0x28, 0x40}}, 0x1000}], 0x14, 0x0, &(0x7f0000000680)="86621f50fcee8bdc5bf8c503a78812261b4bf6d7"}) [ 2622.282399] binder: 14584:14586 BC_ACQUIRE_DONE u0000000000000003 no match [ 2622.282411] binder: 14584:14586 transaction failed 29189/-22, size 80-24 line 3014 18:07:31 executing program 3: r0 = socket(0x10, 0x3, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") ioctl$sock_ifreq(r0, 0x89f3, &(0x7f0000000240)={'sit0\x00'}) 18:07:31 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000006c0)={0x118, 0x0, &(0x7f0000000540)=[@release={0x40046306, 0x2}, @acquire_done, @acquire_done={0x40106309, 0x3}, @transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x50, 0x18, &(0x7f0000000080)={@flat=@binder={0x73622a85, 0xa, 0x1}, @fda={0x66646185, 0xa, 0x1, 0x9}, @fd={0x66642a85, 0x0, r1}}, &(0x7f0000000100)={0x0, 0x18, 0x38}}, 0x1000}, @transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000180)={@ptr={0x70742a85, 0x0, &(0x7f0000000140)=""/51, 0x33, 0x2, 0x25}, @flat=@weak_handle={0x77682a85, 0x1}, @flat=@binder={0x73622a85, 0xa, 0x3}}, &(0x7f0000000280)={0x0, 0x28, 0x40}}, 0x1f8aed83e3349436}, @exit_looper, @transaction_sg={0x40486311, {0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x68, 0x18, &(0x7f0000000480)={@ptr={0x70742a85, 0x0, &(0x7f00000002c0)=""/11, 0xb, 0x2, 0x3f}, @fd={0x66642a85, 0x0, r0}, @ptr={0x70742a85, 0x0, &(0x7f0000000380)=""/70, 0x46, 0x1, 0x1f}}, &(0x7f0000000500)={0x0, 0x28, 0x40}}, 0x1000}], 0x14, 0x0, &(0x7f0000000680)="86621f50fcee8bdc5bf8c503a78812261b4bf6d7"}) 18:07:31 executing program 5: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000001a00)='/dev/net/tun\x00', 0x0, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000080)="c0dc00025e0b01047be070") ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000300)={'nr0\x01\x00', 0x1132}) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000001a00)='/dev/net/tun\x00', 0x2, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000300)={'nr0\x01\x00', 0x1132}) write$cgroup_int(0xffffffffffffffff, &(0x7f00000000c0)=0x2, 0xfffffffffffffe75) close(r1) [ 2622.282650] binder: undelivered TRANSACTION_ERROR: 29189 [ 2622.370151] binder: 14613:14616 Release 1 refcount change on invalid ref 2 ret -22 18:07:31 executing program 4: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000040)='/dev/net/tun\x00', 0x0, 0x0) r1 = epoll_create1(0x0) epoll_ctl$EPOLL_CTL_ADD(0xffffffffffffffff, 0x1, r0, &(0x7f0000000100)) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000080)={'tunl0\x00', 0x1}) epoll_wait(r1, &(0x7f00000000c0)=[{}], 0x1, 0x0) 18:07:31 executing program 3: r0 = socket(0x10, 0x3, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") ioctl$sock_ifreq(r0, 0x89f3, &(0x7f0000000240)={'sit0\x00'}) 18:07:31 executing program 1: clone(0x2102001fff, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) socket(0x0, 0x0, 0x0) r0 = getpid() rt_tgsigqueueinfo(0x0, r0, 0x16, &(0x7f0000000100)) rt_sigqueueinfo(r0, 0x7, &(0x7f0000000180)={0x0, 0x0, 0xffffffff}) 18:07:31 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000006c0)={0x118, 0x0, &(0x7f0000000540)=[@release={0x40046306, 0x2}, @acquire_done, @acquire_done={0x40106309, 0x3}, @transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x50, 0x18, &(0x7f0000000080)={@flat=@binder={0x73622a85, 0xa, 0x1}, @fda={0x66646185, 0xa, 0x1, 0x9}, @fd={0x66642a85, 0x0, r1}}, &(0x7f0000000100)={0x0, 0x18, 0x38}}, 0x1000}, @transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000180)={@ptr={0x70742a85, 0x0, &(0x7f0000000140)=""/51, 0x33, 0x2, 0x25}, @flat=@weak_handle={0x77682a85, 0x1}, @flat=@binder={0x73622a85, 0xa, 0x3}}, &(0x7f0000000280)={0x0, 0x28, 0x40}}, 0x1f8aed83e3349436}, @exit_looper, @transaction_sg={0x40486311, {0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x68, 0x18, &(0x7f0000000480)={@ptr={0x70742a85, 0x0, &(0x7f00000002c0)=""/11, 0xb, 0x2, 0x3f}, @fd={0x66642a85, 0x0, r0}, @ptr={0x70742a85, 0x0, &(0x7f0000000380)=""/70, 0x46, 0x1, 0x1f}}, &(0x7f0000000500)={0x0, 0x28, 0x40}}, 0x1000}], 0x14, 0x0, &(0x7f0000000680)="86621f50fcee8bdc5bf8c503a78812261b4bf6d7"}) 18:07:31 executing program 2: ioctl$FS_IOC_RESVSP(0xffffffffffffffff, 0x40305828, &(0x7f00000000c0)={0x0, 0x0, 0x100000000000001}) clone(0x2102001fff, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) socket(0x0, 0x0, 0x0) r0 = getpid() rt_tgsigqueueinfo(0x0, r0, 0x16, &(0x7f0000000100)) ptrace(0x10, r0) ptrace$poke(0x4209, r0, &(0x7f00000000c0), 0x70effd) [ 2622.370160] binder: 14613:14616 BC_ACQUIRE_DONE u0000000000000000 no match [ 2622.370168] binder: 14613:14616 BC_ACQUIRE_DONE u0000000000000003 no match 18:07:31 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000006c0)={0x118, 0x0, &(0x7f0000000540)=[@release={0x40046306, 0x2}, @acquire_done, @acquire_done={0x40106309, 0x3}, @transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x50, 0x18, &(0x7f0000000080)={@flat=@binder={0x73622a85, 0xa, 0x1}, @fda={0x66646185, 0xa, 0x1, 0x9}, @fd={0x66642a85, 0x0, r1}}, &(0x7f0000000100)={0x0, 0x18, 0x38}}, 0x1000}, @transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000180)={@ptr={0x70742a85, 0x0, &(0x7f0000000140)=""/51, 0x33, 0x2, 0x25}, @flat=@weak_handle={0x77682a85, 0x1}, @flat=@binder={0x73622a85, 0xa, 0x3}}, &(0x7f0000000280)={0x0, 0x28, 0x40}}, 0x1f8aed83e3349436}, @exit_looper, @transaction_sg={0x40486311, {0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x68, 0x18, &(0x7f0000000480)={@ptr={0x70742a85, 0x0, &(0x7f00000002c0)=""/11, 0xb, 0x2, 0x3f}, @fd={0x66642a85, 0x0, r0}, @ptr={0x70742a85, 0x0, &(0x7f0000000380)=""/70, 0x46, 0x1, 0x1f}}, &(0x7f0000000500)={0x0, 0x28, 0x40}}, 0x1000}], 0x14, 0x0, &(0x7f0000000680)="86621f50fcee8bdc5bf8c503a78812261b4bf6d7"}) [ 2622.370180] binder: 14613:14616 transaction failed 29189/-22, size 80-24 line 3014 [ 2622.370473] binder: undelivered TRANSACTION_ERROR: 29189 18:07:31 executing program 1: clone(0x2102001fff, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) socket(0x0, 0x0, 0x0) r0 = getpid() rt_tgsigqueueinfo(0x0, r0, 0x16, &(0x7f0000000100)) rt_sigqueueinfo(r0, 0x7, &(0x7f0000000180)={0x0, 0x0, 0xffffffff}) [ 2622.439748] binder: 14628:14631 Release 1 refcount change on invalid ref 2 ret -22 18:07:31 executing program 3: r0 = socket(0x10, 0x3, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") ioctl$sock_ifreq(r0, 0x89f3, &(0x7f0000000240)={'sit0\x00'}) 18:07:31 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000006c0)={0x118, 0x0, &(0x7f0000000540)=[@release={0x40046306, 0x2}, @acquire_done, @acquire_done={0x40106309, 0x3}, @transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x50, 0x18, &(0x7f0000000080)={@flat=@binder={0x73622a85, 0xa, 0x1}, @fda={0x66646185, 0xa, 0x1, 0x9}, @fd={0x66642a85, 0x0, r1}}, &(0x7f0000000100)={0x0, 0x18, 0x38}}, 0x1000}, @transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000180)={@ptr={0x70742a85, 0x0, &(0x7f0000000140)=""/51, 0x33, 0x2, 0x25}, @flat=@weak_handle={0x77682a85, 0x1}, @flat=@binder={0x73622a85, 0xa, 0x3}}, &(0x7f0000000280)={0x0, 0x28, 0x40}}, 0x1f8aed83e3349436}, @exit_looper, @transaction_sg={0x40486311, {0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x68, 0x18, &(0x7f0000000480)={@ptr={0x70742a85, 0x0, &(0x7f00000002c0)=""/11, 0xb, 0x2, 0x3f}, @fd={0x66642a85, 0x0, r0}, @ptr={0x70742a85, 0x0, &(0x7f0000000380)=""/70, 0x46, 0x1, 0x1f}}, &(0x7f0000000500)={0x0, 0x28, 0x40}}, 0x1000}], 0x14, 0x0, &(0x7f0000000680)="86621f50fcee8bdc5bf8c503a78812261b4bf6d7"}) [ 2622.439758] binder: 14628:14631 BC_ACQUIRE_DONE u0000000000000000 no match 18:07:31 executing program 3: r0 = socket(0x10, 0x3, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") ioctl$sock_ifreq(r0, 0x89f3, &(0x7f0000000240)={'sit0\x00'}) [ 2622.439765] binder: 14628:14631 BC_ACQUIRE_DONE u0000000000000003 no match [ 2622.439778] binder: 14628:14631 transaction failed 29189/-22, size 80-24 line 3014 18:07:31 executing program 5: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000001a00)='/dev/net/tun\x00', 0x0, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000080)="c0dc00025e0b01047be070") ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000300)={'nr0\x01\x00', 0x1132}) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000001a00)='/dev/net/tun\x00', 0x2, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000300)={'nr0\x01\x00', 0x1132}) write$cgroup_int(0xffffffffffffffff, &(0x7f00000000c0)=0x2, 0xfffffffffffffe75) close(r1) 18:07:31 executing program 2: ioctl$FS_IOC_RESVSP(0xffffffffffffffff, 0x40305828, &(0x7f00000000c0)={0x0, 0x0, 0x100000000000001}) clone(0x2102001fff, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) socket(0x0, 0x0, 0x0) r0 = getpid() rt_tgsigqueueinfo(0x0, r0, 0x16, &(0x7f0000000100)) ptrace(0x10, r0) ptrace$poke(0x4209, r0, &(0x7f00000000c0), 0x70effd) [ 2622.448584] binder: undelivered TRANSACTION_ERROR: 29189 18:07:31 executing program 4: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000040)='/dev/net/tun\x00', 0x0, 0x0) r1 = epoll_create1(0x0) epoll_ctl$EPOLL_CTL_ADD(0xffffffffffffffff, 0x1, r0, &(0x7f0000000100)) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000080)={'tunl0\x00', 0x1}) epoll_wait(r1, &(0x7f00000000c0)=[{}], 0x1, 0x0) 18:07:31 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000006c0)={0x118, 0x0, &(0x7f0000000540)=[@release={0x40046306, 0x2}, @acquire_done, @acquire_done={0x40106309, 0x3}, @transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x50, 0x18, &(0x7f0000000080)={@flat=@binder={0x73622a85, 0xa, 0x1}, @fda={0x66646185, 0xa, 0x1, 0x9}, @fd={0x66642a85, 0x0, r1}}, &(0x7f0000000100)={0x0, 0x18, 0x38}}, 0x1000}, @transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000180)={@ptr={0x70742a85, 0x0, &(0x7f0000000140)=""/51, 0x33, 0x2, 0x25}, @flat=@weak_handle={0x77682a85, 0x1}, @flat=@binder={0x73622a85, 0xa, 0x3}}, &(0x7f0000000280)={0x0, 0x28, 0x40}}, 0x1f8aed83e3349436}, @exit_looper, @transaction_sg={0x40486311, {0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x68, 0x18, &(0x7f0000000480)={@ptr={0x70742a85, 0x0, &(0x7f00000002c0)=""/11, 0xb, 0x2, 0x3f}, @fd={0x66642a85, 0x0, r0}, @ptr={0x70742a85, 0x0, &(0x7f0000000380)=""/70, 0x46, 0x1, 0x1f}}, &(0x7f0000000500)={0x0, 0x28, 0x40}}, 0x1000}], 0x14, 0x0, &(0x7f0000000680)="86621f50fcee8bdc5bf8c503a78812261b4bf6d7"}) 18:07:31 executing program 1: clone(0x2102001fff, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) socket(0x0, 0x0, 0x0) r0 = getpid() rt_tgsigqueueinfo(0x0, r0, 0x16, &(0x7f0000000100)) rt_sigqueueinfo(r0, 0x7, &(0x7f0000000180)={0x0, 0x0, 0xffffffff}) [ 2622.586886] binder: 14666:14671 Release 1 refcount change on invalid ref 2 ret -22 18:07:31 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000006c0)={0x118, 0x0, &(0x7f0000000540)=[@release={0x40046306, 0x2}, @acquire_done, @acquire_done={0x40106309, 0x3}, @transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x50, 0x18, &(0x7f0000000080)={@flat=@binder={0x73622a85, 0xa, 0x1}, @fda={0x66646185, 0xa, 0x1, 0x9}, @fd={0x66642a85, 0x0, r1}}, &(0x7f0000000100)={0x0, 0x18, 0x38}}, 0x1000}, @transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000180)={@ptr={0x70742a85, 0x0, &(0x7f0000000140)=""/51, 0x33, 0x2, 0x25}, @flat=@weak_handle={0x77682a85, 0x1}, @flat=@binder={0x73622a85, 0xa, 0x3}}, &(0x7f0000000280)={0x0, 0x28, 0x40}}, 0x1f8aed83e3349436}, @exit_looper, @transaction_sg={0x40486311, {0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x68, 0x18, &(0x7f0000000480)={@ptr={0x70742a85, 0x0, &(0x7f00000002c0)=""/11, 0xb, 0x2, 0x3f}, @fd={0x66642a85, 0x0, r0}, @ptr={0x70742a85, 0x0, &(0x7f0000000380)=""/70, 0x46, 0x1, 0x1f}}, &(0x7f0000000500)={0x0, 0x28, 0x40}}, 0x1000}], 0x14, 0x0, &(0x7f0000000680)="86621f50fcee8bdc5bf8c503a78812261b4bf6d7"}) 18:07:31 executing program 3: r0 = socket(0x10, 0x3, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") ioctl$sock_ifreq(r0, 0x89f3, &(0x7f0000000240)={'sit0\x00'}) [ 2622.586897] binder: 14666:14671 BC_ACQUIRE_DONE u0000000000000000 no match [ 2622.586905] binder: 14666:14671 BC_ACQUIRE_DONE u0000000000000003 no match [ 2622.586917] binder: 14666:14671 transaction failed 29189/-22, size 80-24 line 3014 18:07:31 executing program 1: clone(0x2102001fff, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) socket(0x0, 0x0, 0x0) r0 = getpid() rt_tgsigqueueinfo(0x0, r0, 0x16, &(0x7f0000000100)) rt_sigqueueinfo(r0, 0x7, &(0x7f0000000180)={0x0, 0x0, 0xffffffff}) 18:07:31 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000006c0)={0x118, 0x0, &(0x7f0000000540)=[@release={0x40046306, 0x2}, @acquire_done, @acquire_done={0x40106309, 0x3}, @transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x50, 0x18, &(0x7f0000000080)={@flat=@binder={0x73622a85, 0xa, 0x1}, @fda={0x66646185, 0xa, 0x1, 0x9}, @fd={0x66642a85, 0x0, r1}}, &(0x7f0000000100)={0x0, 0x18, 0x38}}, 0x1000}, @transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000180)={@ptr={0x70742a85, 0x0, &(0x7f0000000140)=""/51, 0x33, 0x2, 0x25}, @flat=@weak_handle={0x77682a85, 0x1}, @flat=@binder={0x73622a85, 0xa, 0x3}}, &(0x7f0000000280)={0x0, 0x28, 0x40}}, 0x1f8aed83e3349436}, @exit_looper, @transaction_sg={0x40486311, {0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x68, 0x18, &(0x7f0000000480)={@ptr={0x70742a85, 0x0, &(0x7f00000002c0)=""/11, 0xb, 0x2, 0x3f}, @fd={0x66642a85, 0x0, r0}, @ptr={0x70742a85, 0x0, &(0x7f0000000380)=""/70, 0x46, 0x1, 0x1f}}, &(0x7f0000000500)={0x0, 0x28, 0x40}}, 0x1000}], 0x14, 0x0, &(0x7f0000000680)="86621f50fcee8bdc5bf8c503a78812261b4bf6d7"}) [ 2622.587513] binder: undelivered TRANSACTION_ERROR: 29189 [ 2622.685261] binder: 14691:14695 Release 1 refcount change on invalid ref 2 ret -22 18:07:31 executing program 4: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000040)='/dev/net/tun\x00', 0x0, 0x0) r1 = epoll_create1(0x0) epoll_ctl$EPOLL_CTL_ADD(0xffffffffffffffff, 0x1, r0, &(0x7f0000000100)) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000080)={'tunl0\x00', 0x1}) epoll_wait(r1, &(0x7f00000000c0)=[{}], 0x1, 0x0) 18:07:32 executing program 3: r0 = socket(0x10, 0x3, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") ioctl$sock_ifreq(r0, 0x89f3, &(0x7f0000000240)={'sit0\x00'}) [ 2622.685272] binder: 14691:14695 BC_ACQUIRE_DONE u0000000000000000 no match 18:07:32 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000006c0)={0x118, 0x0, &(0x7f0000000540)=[@release={0x40046306, 0x2}, @acquire_done, @acquire_done={0x40106309, 0x3}, @transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x50, 0x18, &(0x7f0000000080)={@flat=@binder={0x73622a85, 0xa, 0x1}, @fda={0x66646185, 0xa, 0x1, 0x9}, @fd={0x66642a85, 0x0, r1}}, &(0x7f0000000100)={0x0, 0x18, 0x38}}, 0x1000}, @transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000180)={@ptr={0x70742a85, 0x0, &(0x7f0000000140)=""/51, 0x33, 0x2, 0x25}, @flat=@weak_handle={0x77682a85, 0x1}, @flat=@binder={0x73622a85, 0xa, 0x3}}, &(0x7f0000000280)={0x0, 0x28, 0x40}}, 0x1f8aed83e3349436}, @exit_looper, @transaction_sg={0x40486311, {0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x68, 0x18, &(0x7f0000000480)={@ptr={0x70742a85, 0x0, &(0x7f00000002c0)=""/11, 0xb, 0x2, 0x3f}, @fd={0x66642a85, 0x0, r0}, @ptr={0x70742a85, 0x0, &(0x7f0000000380)=""/70, 0x46, 0x1, 0x1f}}, &(0x7f0000000500)={0x0, 0x28, 0x40}}, 0x1000}], 0x14, 0x0, &(0x7f0000000680)="86621f50fcee8bdc5bf8c503a78812261b4bf6d7"}) [ 2622.685280] binder: 14691:14695 BC_ACQUIRE_DONE u0000000000000003 no match [ 2622.685292] binder: 14691:14695 transaction failed 29189/-22, size 80-24 line 3014 [ 2622.686202] binder: undelivered TRANSACTION_ERROR: 29189 [ 2622.777641] binder: 14716:14719 Release 1 refcount change on invalid ref 2 ret -22 18:07:32 executing program 1: clone(0x2102001fff, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) socket(0x0, 0x0, 0x0) r0 = getpid() rt_tgsigqueueinfo(0x0, r0, 0x16, &(0x7f0000000100)) rt_sigqueueinfo(r0, 0x7, &(0x7f0000000180)={0x0, 0x0, 0xffffffff}) 18:07:32 executing program 2: ioctl$FS_IOC_RESVSP(0xffffffffffffffff, 0x40305828, &(0x7f00000000c0)={0x0, 0x0, 0x100000000000001}) clone(0x2102001fff, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) socket(0x0, 0x0, 0x0) r0 = getpid() rt_tgsigqueueinfo(0x0, r0, 0x16, &(0x7f0000000100)) ptrace(0x10, r0) ptrace$poke(0x4209, r0, &(0x7f00000000c0), 0x70effd) 18:07:32 executing program 3: r0 = socket(0x10, 0x3, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") ioctl$sock_ifreq(r0, 0x89f3, &(0x7f0000000240)={'sit0\x00'}) 18:07:32 executing program 4: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000040)='/dev/net/tun\x00', 0x0, 0x0) r1 = epoll_create1(0x0) epoll_ctl$EPOLL_CTL_ADD(0xffffffffffffffff, 0x1, r0, &(0x7f0000000100)) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000080)={'tunl0\x00', 0x1}) epoll_wait(r1, &(0x7f00000000c0)=[{}], 0x1, 0x0) 18:07:32 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000006c0)={0x118, 0x0, &(0x7f0000000540)=[@release={0x40046306, 0x2}, @acquire_done, @acquire_done={0x40106309, 0x3}, @transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x50, 0x18, &(0x7f0000000080)={@flat=@binder={0x73622a85, 0xa, 0x1}, @fda={0x66646185, 0xa, 0x1, 0x9}, @fd={0x66642a85, 0x0, r1}}, &(0x7f0000000100)={0x0, 0x18, 0x38}}, 0x1000}, @transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000180)={@ptr={0x70742a85, 0x0, &(0x7f0000000140)=""/51, 0x33, 0x2, 0x25}, @flat=@weak_handle={0x77682a85, 0x1}, @flat=@binder={0x73622a85, 0xa, 0x3}}, &(0x7f0000000280)={0x0, 0x28, 0x40}}, 0x1f8aed83e3349436}, @exit_looper, @transaction_sg={0x40486311, {0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x68, 0x18, &(0x7f0000000480)={@ptr={0x70742a85, 0x0, &(0x7f00000002c0)=""/11, 0xb, 0x2, 0x3f}, @fd={0x66642a85, 0x0, r0}, @ptr={0x70742a85, 0x0, &(0x7f0000000380)=""/70, 0x46, 0x1, 0x1f}}, &(0x7f0000000500)={0x0, 0x28, 0x40}}, 0x1000}], 0x14, 0x0, &(0x7f0000000680)="86621f50fcee8bdc5bf8c503a78812261b4bf6d7"}) 18:07:32 executing program 5: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000001a00)='/dev/net/tun\x00', 0x0, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000080)="c0dc00025e0b01047be070") ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000300)={'nr0\x01\x00', 0x1132}) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000001a00)='/dev/net/tun\x00', 0x2, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000300)={'nr0\x01\x00', 0x1132}) write$cgroup_int(0xffffffffffffffff, &(0x7f00000000c0)=0x2, 0xfffffffffffffe75) close(r1) [ 2622.777651] binder: 14716:14719 BC_ACQUIRE_DONE u0000000000000000 no match [ 2622.777659] binder: 14716:14719 BC_ACQUIRE_DONE u0000000000000003 no match 18:07:32 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000006c0)={0x118, 0x0, &(0x7f0000000540)=[@release={0x40046306, 0x2}, @acquire_done, @acquire_done={0x40106309, 0x3}, @transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x50, 0x18, &(0x7f0000000080)={@flat=@binder={0x73622a85, 0xa, 0x1}, @fda={0x66646185, 0xa, 0x1, 0x9}, @fd={0x66642a85, 0x0, r1}}, &(0x7f0000000100)={0x0, 0x18, 0x38}}, 0x1000}, @transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000180)={@ptr={0x70742a85, 0x0, &(0x7f0000000140)=""/51, 0x33, 0x2, 0x25}, @flat=@weak_handle={0x77682a85, 0x1}, @flat=@binder={0x73622a85, 0xa, 0x3}}, &(0x7f0000000280)={0x0, 0x28, 0x40}}, 0x1f8aed83e3349436}, @exit_looper, @transaction_sg={0x40486311, {0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x68, 0x18, &(0x7f0000000480)={@ptr={0x70742a85, 0x0, &(0x7f00000002c0)=""/11, 0xb, 0x2, 0x3f}, @fd={0x66642a85, 0x0, r0}, @ptr={0x70742a85, 0x0, &(0x7f0000000380)=""/70, 0x46, 0x1, 0x1f}}, &(0x7f0000000500)={0x0, 0x28, 0x40}}, 0x1000}], 0x14, 0x0, &(0x7f0000000680)="86621f50fcee8bdc5bf8c503a78812261b4bf6d7"}) 18:07:32 executing program 1: clone(0x2102001fff, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) socket(0x0, 0x0, 0x0) r0 = getpid() rt_tgsigqueueinfo(0x0, r0, 0x16, &(0x7f0000000100)) rt_sigqueueinfo(r0, 0x7, &(0x7f0000000180)={0x0, 0x0, 0xffffffff}) [ 2622.777674] binder: 14716:14719 transaction failed 29189/-22, size 80-24 line 3014 [ 2622.779099] binder: undelivered TRANSACTION_ERROR: 29189 18:07:32 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000006c0)={0x118, 0x0, &(0x7f0000000540)=[@release={0x40046306, 0x2}, @acquire_done, @acquire_done={0x40106309, 0x3}, @transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x50, 0x18, &(0x7f0000000080)={@flat=@binder={0x73622a85, 0xa, 0x1}, @fda={0x66646185, 0xa, 0x1, 0x9}, @fd={0x66642a85, 0x0, r1}}, &(0x7f0000000100)={0x0, 0x18, 0x38}}, 0x1000}, @transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000180)={@ptr={0x70742a85, 0x0, &(0x7f0000000140)=""/51, 0x33, 0x2, 0x25}, @flat=@weak_handle={0x77682a85, 0x1}, @flat=@binder={0x73622a85, 0xa, 0x3}}, &(0x7f0000000280)={0x0, 0x28, 0x40}}, 0x1f8aed83e3349436}, @exit_looper, @transaction_sg={0x40486311, {0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x68, 0x18, &(0x7f0000000480)={@ptr={0x70742a85, 0x0, &(0x7f00000002c0)=""/11, 0xb, 0x2, 0x3f}, @fd={0x66642a85, 0x0, r0}, @ptr={0x70742a85, 0x0, &(0x7f0000000380)=""/70, 0x46, 0x1, 0x1f}}, &(0x7f0000000500)={0x0, 0x28, 0x40}}, 0x1000}], 0x14, 0x0, &(0x7f0000000680)="86621f50fcee8bdc5bf8c503a78812261b4bf6d7"}) 18:07:32 executing program 2: ioctl$FS_IOC_RESVSP(0xffffffffffffffff, 0x40305828, &(0x7f00000000c0)={0x0, 0x0, 0x100000000000001}) clone(0x2102001fff, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) socket(0x0, 0x0, 0x0) r0 = getpid() rt_tgsigqueueinfo(0x0, r0, 0x16, &(0x7f0000000100)) ptrace(0x10, r0) ptrace$poke(0x4209, r0, &(0x7f00000000c0), 0x70effd) 18:07:32 executing program 3: r0 = socket(0x10, 0x3, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") ioctl$sock_ifreq(r0, 0x89f3, &(0x7f0000000240)={'sit0\x00'}) [ 2622.944668] binder: 14770:14790 Release 1 refcount change on invalid ref 2 ret -22 18:07:32 executing program 4: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000040)='/dev/net/tun\x00', 0x0, 0x0) r1 = epoll_create1(0x0) epoll_ctl$EPOLL_CTL_ADD(0xffffffffffffffff, 0x1, r0, &(0x7f0000000100)) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000080)={'tunl0\x00', 0x1}) epoll_wait(r1, &(0x7f00000000c0)=[{}], 0x1, 0x0) 18:07:32 executing program 1: clone(0x2102001fff, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) socket(0x0, 0x0, 0x0) r0 = getpid() rt_tgsigqueueinfo(0x0, r0, 0x16, &(0x7f0000000100)) rt_sigqueueinfo(r0, 0x7, &(0x7f0000000180)={0x0, 0x0, 0xffffffff}) [ 2622.944686] binder: 14770:14790 BC_ACQUIRE_DONE u0000000000000000 no match 18:07:32 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000006c0)={0x118, 0x0, &(0x7f0000000540)=[@release={0x40046306, 0x2}, @acquire_done, @acquire_done={0x40106309, 0x3}, @transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x50, 0x18, &(0x7f0000000080)={@flat=@binder={0x73622a85, 0xa, 0x1}, @fda={0x66646185, 0xa, 0x1, 0x9}, @fd={0x66642a85, 0x0, r1}}, &(0x7f0000000100)={0x0, 0x18, 0x38}}, 0x1000}, @transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000180)={@ptr={0x70742a85, 0x0, &(0x7f0000000140)=""/51, 0x33, 0x2, 0x25}, @flat=@weak_handle={0x77682a85, 0x1}, @flat=@binder={0x73622a85, 0xa, 0x3}}, &(0x7f0000000280)={0x0, 0x28, 0x40}}, 0x1f8aed83e3349436}, @exit_looper, @transaction_sg={0x40486311, {0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x68, 0x18, &(0x7f0000000480)={@ptr={0x70742a85, 0x0, &(0x7f00000002c0)=""/11, 0xb, 0x2, 0x3f}, @fd={0x66642a85, 0x0, r0}, @ptr={0x70742a85, 0x0, &(0x7f0000000380)=""/70, 0x46, 0x1, 0x1f}}, &(0x7f0000000500)={0x0, 0x28, 0x40}}, 0x1000}], 0x14, 0x0, &(0x7f0000000680)="86621f50fcee8bdc5bf8c503a78812261b4bf6d7"}) 18:07:32 executing program 3: r0 = socket(0x10, 0x3, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") ioctl$sock_ifreq(r0, 0x89f3, &(0x7f0000000240)={'sit0\x00'}) [ 2622.944694] binder: 14770:14790 BC_ACQUIRE_DONE u0000000000000003 no match [ 2622.944706] binder: 14770:14790 transaction failed 29189/-22, size 80-24 line 3014 [ 2622.944996] binder: undelivered TRANSACTION_ERROR: 29189 18:07:32 executing program 5: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000001a00)='/dev/net/tun\x00', 0x0, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000080)="c0dc00025e0b01047be070") ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000300)={'nr0\x01\x00', 0x1132}) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000001a00)='/dev/net/tun\x00', 0x2, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000300)={'nr0\x01\x00', 0x1132}) write$cgroup_int(0xffffffffffffffff, &(0x7f00000000c0)=0x2, 0xfffffffffffffe75) close(r1) [ 2623.055346] binder: 14814:14819 Release 1 refcount change on invalid ref 2 ret -22 18:07:32 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000006c0)={0x118, 0x0, &(0x7f0000000540)=[@release={0x40046306, 0x2}, @acquire_done, @acquire_done={0x40106309, 0x3}, @transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x50, 0x18, &(0x7f0000000080)={@flat=@binder={0x73622a85, 0xa, 0x1}, @fda={0x66646185, 0xa, 0x1, 0x9}, @fd={0x66642a85, 0x0, r1}}, &(0x7f0000000100)={0x0, 0x18, 0x38}}, 0x1000}, @transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000180)={@ptr={0x70742a85, 0x0, &(0x7f0000000140)=""/51, 0x33, 0x2, 0x25}, @flat=@weak_handle={0x77682a85, 0x1}, @flat=@binder={0x73622a85, 0xa, 0x3}}, &(0x7f0000000280)={0x0, 0x28, 0x40}}, 0x1f8aed83e3349436}, @exit_looper, @transaction_sg={0x40486311, {0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x68, 0x18, &(0x7f0000000480)={@ptr={0x70742a85, 0x0, &(0x7f00000002c0)=""/11, 0xb, 0x2, 0x3f}, @fd={0x66642a85, 0x0, r0}, @ptr={0x70742a85, 0x0, &(0x7f0000000380)=""/70, 0x46, 0x1, 0x1f}}, &(0x7f0000000500)={0x0, 0x28, 0x40}}, 0x1000}], 0x14, 0x0, &(0x7f0000000680)="86621f50fcee8bdc5bf8c503a78812261b4bf6d7"}) 18:07:32 executing program 4: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000040)='/dev/net/tun\x00', 0x0, 0x0) r1 = epoll_create1(0x0) epoll_ctl$EPOLL_CTL_ADD(0xffffffffffffffff, 0x1, r0, &(0x7f0000000100)) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000080)={'tunl0\x00', 0x1}) epoll_wait(r1, &(0x7f00000000c0)=[{}], 0x1, 0x0) 18:07:32 executing program 2: ioctl$FS_IOC_RESVSP(0xffffffffffffffff, 0x40305828, &(0x7f00000000c0)={0x0, 0x0, 0x100000000000001}) clone(0x2102001fff, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) socket(0x0, 0x0, 0x0) r0 = getpid() rt_tgsigqueueinfo(0x0, r0, 0x16, &(0x7f0000000100)) ptrace(0x10, r0) ptrace$poke(0x4209, r0, &(0x7f00000000c0), 0x70effd) 18:07:32 executing program 1: clone(0x2102001fff, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) socket(0x0, 0x0, 0x0) r0 = getpid() rt_tgsigqueueinfo(0x0, r0, 0x16, &(0x7f0000000100)) rt_sigqueueinfo(r0, 0x7, &(0x7f0000000180)={0x0, 0x0, 0xffffffff}) [ 2623.055356] binder: 14814:14819 BC_ACQUIRE_DONE u0000000000000000 no match [ 2623.055364] binder: 14814:14819 BC_ACQUIRE_DONE u0000000000000003 no match 18:07:32 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000006c0)={0x118, 0x0, &(0x7f0000000540)=[@release={0x40046306, 0x2}, @acquire_done, @acquire_done={0x40106309, 0x3}, @transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x50, 0x18, &(0x7f0000000080)={@flat=@binder={0x73622a85, 0xa, 0x1}, @fda={0x66646185, 0xa, 0x1, 0x9}, @fd={0x66642a85, 0x0, r1}}, &(0x7f0000000100)={0x0, 0x18, 0x38}}, 0x1000}, @transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000180)={@ptr={0x70742a85, 0x0, &(0x7f0000000140)=""/51, 0x33, 0x2, 0x25}, @flat=@weak_handle={0x77682a85, 0x1}, @flat=@binder={0x73622a85, 0xa, 0x3}}, &(0x7f0000000280)={0x0, 0x28, 0x40}}, 0x1f8aed83e3349436}, @exit_looper, @transaction_sg={0x40486311, {0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x68, 0x18, &(0x7f0000000480)={@ptr={0x70742a85, 0x0, &(0x7f00000002c0)=""/11, 0xb, 0x2, 0x3f}, @fd={0x66642a85, 0x0, r0}, @ptr={0x70742a85, 0x0, &(0x7f0000000380)=""/70, 0x46, 0x1, 0x1f}}, &(0x7f0000000500)={0x0, 0x28, 0x40}}, 0x1000}], 0x14, 0x0, &(0x7f0000000680)="86621f50fcee8bdc5bf8c503a78812261b4bf6d7"}) 18:07:32 executing program 3: r0 = socket(0x10, 0x3, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") ioctl$sock_ifreq(r0, 0x89f3, &(0x7f0000000240)={'sit0\x00'}) [ 2623.055377] binder: 14814:14819 transaction failed 29189/-22, size 80-24 line 3014 [ 2623.058997] binder: undelivered TRANSACTION_ERROR: 29189 18:07:32 executing program 3: r0 = socket(0x10, 0x3, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") ioctl$sock_ifreq(r0, 0x89f3, &(0x7f0000000240)={'sit0\x00'}) [ 2623.327140] binder: 14914:14922 Release 1 refcount change on invalid ref 2 ret -22 18:07:32 executing program 1: clone(0x2102001fff, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) socket(0x0, 0x0, 0x0) r0 = getpid() rt_tgsigqueueinfo(0x0, r0, 0x16, &(0x7f0000000100)) rt_sigqueueinfo(r0, 0x7, &(0x7f0000000180)={0x0, 0x0, 0xffffffff}) 18:07:32 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000006c0)={0x118, 0x0, &(0x7f0000000540)=[@release={0x40046306, 0x2}, @acquire_done, @acquire_done={0x40106309, 0x3}, @transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x50, 0x18, &(0x7f0000000080)={@flat=@binder={0x73622a85, 0xa, 0x1}, @fda={0x66646185, 0xa, 0x1, 0x9}, @fd={0x66642a85, 0x0, r1}}, &(0x7f0000000100)={0x0, 0x18, 0x38}}, 0x1000}, @transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000180)={@ptr={0x70742a85, 0x0, &(0x7f0000000140)=""/51, 0x33, 0x2, 0x25}, @flat=@weak_handle={0x77682a85, 0x1}, @flat=@binder={0x73622a85, 0xa, 0x3}}, &(0x7f0000000280)={0x0, 0x28, 0x40}}, 0x1f8aed83e3349436}, @exit_looper, @transaction_sg={0x40486311, {0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x68, 0x18, &(0x7f0000000480)={@ptr={0x70742a85, 0x0, &(0x7f00000002c0)=""/11, 0xb, 0x2, 0x3f}, @fd={0x66642a85, 0x0, r0}, @ptr={0x70742a85, 0x0, &(0x7f0000000380)=""/70, 0x46, 0x1, 0x1f}}, &(0x7f0000000500)={0x0, 0x28, 0x40}}, 0x1000}], 0x14, 0x0, &(0x7f0000000680)="86621f50fcee8bdc5bf8c503a78812261b4bf6d7"}) 18:07:32 executing program 4: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000040)='/dev/net/tun\x00', 0x0, 0x0) r1 = epoll_create1(0x0) epoll_ctl$EPOLL_CTL_ADD(0xffffffffffffffff, 0x1, r0, &(0x7f0000000100)) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000080)={'tunl0\x00', 0x1}) epoll_wait(r1, &(0x7f00000000c0)=[{}], 0x1, 0x0) [ 2623.327150] binder: 14914:14922 BC_ACQUIRE_DONE u0000000000000000 no match 18:07:32 executing program 5: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000001a00)='/dev/net/tun\x00', 0x0, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000080)="c0dc00025e0b01047be070") ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000300)={'nr0\x01\x00', 0x1132}) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000001a00)='/dev/net/tun\x00', 0x2, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000300)={'nr0\x01\x00', 0x1132}) write$cgroup_int(0xffffffffffffffff, &(0x7f00000000c0)=0x2, 0xfffffffffffffe75) close(r1) 18:07:32 executing program 3: r0 = socket(0x10, 0x3, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") ioctl$sock_ifreq(r0, 0x89f3, &(0x7f0000000240)={'sit0\x00'}) [ 2623.327158] binder: 14914:14922 BC_ACQUIRE_DONE u0000000000000003 no match 18:07:32 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000006c0)={0x118, 0x0, &(0x7f0000000540)=[@release={0x40046306, 0x2}, @acquire_done, @acquire_done={0x40106309, 0x3}, @transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x50, 0x18, &(0x7f0000000080)={@flat=@binder={0x73622a85, 0xa, 0x1}, @fda={0x66646185, 0xa, 0x1, 0x9}, @fd={0x66642a85, 0x0, r1}}, &(0x7f0000000100)={0x0, 0x18, 0x38}}, 0x1000}, @transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000180)={@ptr={0x70742a85, 0x0, &(0x7f0000000140)=""/51, 0x33, 0x2, 0x25}, @flat=@weak_handle={0x77682a85, 0x1}, @flat=@binder={0x73622a85, 0xa, 0x3}}, &(0x7f0000000280)={0x0, 0x28, 0x40}}, 0x1f8aed83e3349436}, @exit_looper, @transaction_sg={0x40486311, {0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x68, 0x18, &(0x7f0000000480)={@ptr={0x70742a85, 0x0, &(0x7f00000002c0)=""/11, 0xb, 0x2, 0x3f}, @fd={0x66642a85, 0x0, r0}, @ptr={0x70742a85, 0x0, &(0x7f0000000380)=""/70, 0x46, 0x1, 0x1f}}, &(0x7f0000000500)={0x0, 0x28, 0x40}}, 0x1000}], 0x14, 0x0, &(0x7f0000000680)="86621f50fcee8bdc5bf8c503a78812261b4bf6d7"}) 18:07:32 executing program 3: r0 = socket(0x10, 0x3, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") ioctl$sock_ifreq(r0, 0x89f3, &(0x7f0000000240)={'sit0\x00'}) 18:07:32 executing program 2: ioctl$FS_IOC_RESVSP(0xffffffffffffffff, 0x40305828, &(0x7f00000000c0)={0x0, 0x0, 0x100000000000001}) clone(0x2102001fff, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) socket(0x0, 0x0, 0x0) r0 = getpid() rt_tgsigqueueinfo(0x0, r0, 0x16, &(0x7f0000000100)) ptrace(0x10, r0) ptrace$poke(0x4209, r0, &(0x7f00000000c0), 0x70effd) 18:07:32 executing program 1: clone(0x2102001fff, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) socket(0x0, 0x0, 0x0) r0 = getpid() rt_tgsigqueueinfo(0x0, r0, 0x16, &(0x7f0000000100)) rt_sigqueueinfo(r0, 0x7, &(0x7f0000000180)={0x0, 0x0, 0xffffffff}) [ 2623.327171] binder: 14914:14922 transaction failed 29189/-22, size 80-24 line 3014 [ 2623.327456] binder: undelivered TRANSACTION_ERROR: 29189 18:07:33 executing program 4: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000040)='/dev/net/tun\x00', 0x0, 0x0) r1 = epoll_create1(0x0) epoll_ctl$EPOLL_CTL_ADD(0xffffffffffffffff, 0x1, r0, &(0x7f0000000100)) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000080)={'tunl0\x00', 0x1}) epoll_wait(r1, &(0x7f00000000c0)=[{}], 0x1, 0x0) [ 2623.439109] binder: 14953:14955 Release 1 refcount change on invalid ref 2 ret -22 18:07:33 executing program 3: r0 = socket(0x10, 0x3, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") ioctl$sock_ifreq(r0, 0x89f3, &(0x7f0000000240)={'sit0\x00'}) 18:07:33 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000006c0)={0x118, 0x0, &(0x7f0000000540)=[@release={0x40046306, 0x2}, @acquire_done, @acquire_done={0x40106309, 0x3}, @transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x50, 0x18, &(0x7f0000000080)={@flat=@binder={0x73622a85, 0xa, 0x1}, @fda={0x66646185, 0xa, 0x1, 0x9}, @fd={0x66642a85, 0x0, r1}}, &(0x7f0000000100)={0x0, 0x18, 0x38}}, 0x1000}, @transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000180)={@ptr={0x70742a85, 0x0, &(0x7f0000000140)=""/51, 0x33, 0x2, 0x25}, @flat=@weak_handle={0x77682a85, 0x1}, @flat=@binder={0x73622a85, 0xa, 0x3}}, &(0x7f0000000280)={0x0, 0x28, 0x40}}, 0x1f8aed83e3349436}, @exit_looper, @transaction_sg={0x40486311, {0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x68, 0x18, &(0x7f0000000480)={@ptr={0x70742a85, 0x0, &(0x7f00000002c0)=""/11, 0xb, 0x2, 0x3f}, @fd={0x66642a85, 0x0, r0}, @ptr={0x70742a85, 0x0, &(0x7f0000000380)=""/70, 0x46, 0x1, 0x1f}}, &(0x7f0000000500)={0x0, 0x28, 0x40}}, 0x1000}], 0x14, 0x0, &(0x7f0000000680)="86621f50fcee8bdc5bf8c503a78812261b4bf6d7"}) 18:07:33 executing program 3: r0 = socket(0x10, 0x3, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") ioctl$sock_ifreq(r0, 0x89f3, &(0x7f0000000240)={'sit0\x00'}) 18:07:33 executing program 5: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000001a00)='/dev/net/tun\x00', 0x0, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000080)="c0dc00025e0b01047be070") ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000300)={'nr0\x01\x00', 0x1132}) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000001a00)='/dev/net/tun\x00', 0x2, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000300)={'nr0\x01\x00', 0x1132}) write$cgroup_int(0xffffffffffffffff, &(0x7f00000000c0)=0x2, 0xfffffffffffffe75) close(r1) [ 2623.439119] binder: 14953:14955 BC_ACQUIRE_DONE u0000000000000000 no match [ 2623.439127] binder: 14953:14955 BC_ACQUIRE_DONE u0000000000000003 no match [ 2623.439140] binder: 14953:14955 transaction failed 29189/-22, size 80-24 line 3014 18:07:33 executing program 4: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000040)='/dev/net/tun\x00', 0x0, 0x0) r1 = epoll_create1(0x0) epoll_ctl$EPOLL_CTL_ADD(0xffffffffffffffff, 0x1, r0, &(0x7f0000000100)) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000080)={'tunl0\x00', 0x1}) epoll_wait(r1, &(0x7f00000000c0)=[{}], 0x1, 0x0) 18:07:33 executing program 2: ioctl$FS_IOC_RESVSP(0xffffffffffffffff, 0x40305828, &(0x7f00000000c0)={0x0, 0x0, 0x100000000000001}) clone(0x2102001fff, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) socket(0x0, 0x0, 0x0) r0 = getpid() rt_tgsigqueueinfo(0x0, r0, 0x16, &(0x7f0000000100)) ptrace(0x10, r0) ptrace$poke(0x4209, r0, &(0x7f00000000c0), 0x70effd) 18:07:33 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000006c0)={0x118, 0x0, &(0x7f0000000540)=[@release={0x40046306, 0x2}, @acquire_done, @acquire_done={0x40106309, 0x3}, @transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x50, 0x18, &(0x7f0000000080)={@flat=@binder={0x73622a85, 0xa, 0x1}, @fda={0x66646185, 0xa, 0x1, 0x9}, @fd={0x66642a85, 0x0, r1}}, &(0x7f0000000100)={0x0, 0x18, 0x38}}, 0x1000}, @transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000180)={@ptr={0x70742a85, 0x0, &(0x7f0000000140)=""/51, 0x33, 0x2, 0x25}, @flat=@weak_handle={0x77682a85, 0x1}, @flat=@binder={0x73622a85, 0xa, 0x3}}, &(0x7f0000000280)={0x0, 0x28, 0x40}}, 0x1f8aed83e3349436}, @exit_looper, @transaction_sg={0x40486311, {0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x68, 0x18, &(0x7f0000000480)={@ptr={0x70742a85, 0x0, &(0x7f00000002c0)=""/11, 0xb, 0x2, 0x3f}, @fd={0x66642a85, 0x0, r0}, @ptr={0x70742a85, 0x0, &(0x7f0000000380)=""/70, 0x46, 0x1, 0x1f}}, &(0x7f0000000500)={0x0, 0x28, 0x40}}, 0x1000}], 0x14, 0x0, &(0x7f0000000680)="86621f50fcee8bdc5bf8c503a78812261b4bf6d7"}) 18:07:33 executing program 3: r0 = socket(0x10, 0x3, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") ioctl$sock_ifreq(r0, 0x89f3, &(0x7f0000000240)={'sit0\x00'}) 18:07:33 executing program 1: clone(0x2102001fff, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) socket(0x0, 0x0, 0x0) r0 = getpid() rt_tgsigqueueinfo(0x0, r0, 0x16, &(0x7f0000000100)) rt_sigqueueinfo(r0, 0x7, &(0x7f0000000180)={0x0, 0x0, 0xffffffff}) 18:07:33 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000006c0)={0x118, 0x0, &(0x7f0000000540)=[@release={0x40046306, 0x2}, @acquire_done, @acquire_done={0x40106309, 0x3}, @transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x50, 0x18, &(0x7f0000000080)={@flat=@binder={0x73622a85, 0xa, 0x1}, @fda={0x66646185, 0xa, 0x1, 0x9}, @fd={0x66642a85, 0x0, r1}}, &(0x7f0000000100)={0x0, 0x18, 0x38}}, 0x1000}, @transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000180)={@ptr={0x70742a85, 0x0, &(0x7f0000000140)=""/51, 0x33, 0x2, 0x25}, @flat=@weak_handle={0x77682a85, 0x1}, @flat=@binder={0x73622a85, 0xa, 0x3}}, &(0x7f0000000280)={0x0, 0x28, 0x40}}, 0x1f8aed83e3349436}, @exit_looper, @transaction_sg={0x40486311, {0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x68, 0x18, &(0x7f0000000480)={@ptr={0x70742a85, 0x0, &(0x7f00000002c0)=""/11, 0xb, 0x2, 0x3f}, @fd={0x66642a85, 0x0, r0}, @ptr={0x70742a85, 0x0, &(0x7f0000000380)=""/70, 0x46, 0x1, 0x1f}}, &(0x7f0000000500)={0x0, 0x28, 0x40}}, 0x1000}], 0x14, 0x0, &(0x7f0000000680)="86621f50fcee8bdc5bf8c503a78812261b4bf6d7"}) [ 2623.439466] binder: undelivered TRANSACTION_ERROR: 29189 [ 2623.562595] binder: 14973:14982 Release 1 refcount change on invalid ref 2 ret -22 18:07:33 executing program 3: r0 = socket(0x10, 0x3, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") ioctl$sock_ifreq(r0, 0x89f3, &(0x7f0000000240)={'sit0\x00'}) [ 2623.562604] binder: 14973:14982 BC_ACQUIRE_DONE u0000000000000000 no match [ 2623.562611] binder: 14973:14982 BC_ACQUIRE_DONE u0000000000000003 no match 18:07:33 executing program 1: clone(0x2102001fff, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) socket(0x0, 0x0, 0x0) r0 = getpid() rt_tgsigqueueinfo(0x0, r0, 0x16, &(0x7f0000000100)) rt_sigqueueinfo(r0, 0x7, &(0x7f0000000180)={0x0, 0x0, 0xffffffff}) 18:07:33 executing program 4: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000040)='/dev/net/tun\x00', 0x0, 0x0) r1 = epoll_create1(0x0) epoll_ctl$EPOLL_CTL_ADD(0xffffffffffffffff, 0x1, r0, &(0x7f0000000100)) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000080)={'tunl0\x00', 0x1}) epoll_wait(r1, &(0x7f00000000c0)=[{}], 0x1, 0x0) [ 2623.562624] binder: 14973:14982 transaction failed 29189/-22, size 80-24 line 3014 18:07:33 executing program 3: r0 = socket(0x10, 0x3, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") ioctl$sock_ifreq(r0, 0x89f3, &(0x7f0000000240)={'sit0\x00'}) 18:07:33 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000006c0)={0x118, 0x0, &(0x7f0000000540)=[@release={0x40046306, 0x2}, @acquire_done, @acquire_done={0x40106309, 0x3}, @transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x50, 0x18, &(0x7f0000000080)={@flat=@binder={0x73622a85, 0xa, 0x1}, @fda={0x66646185, 0xa, 0x1, 0x9}, @fd={0x66642a85, 0x0, r1}}, &(0x7f0000000100)={0x0, 0x18, 0x38}}, 0x1000}, @transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000180)={@ptr={0x70742a85, 0x0, &(0x7f0000000140)=""/51, 0x33, 0x2, 0x25}, @flat=@weak_handle={0x77682a85, 0x1}, @flat=@binder={0x73622a85, 0xa, 0x3}}, &(0x7f0000000280)={0x0, 0x28, 0x40}}, 0x1f8aed83e3349436}, @exit_looper, @transaction_sg={0x40486311, {0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x68, 0x18, &(0x7f0000000480)={@ptr={0x70742a85, 0x0, &(0x7f00000002c0)=""/11, 0xb, 0x2, 0x3f}, @fd={0x66642a85, 0x0, r0}, @ptr={0x70742a85, 0x0, &(0x7f0000000380)=""/70, 0x46, 0x1, 0x1f}}, &(0x7f0000000500)={0x0, 0x28, 0x40}}, 0x1000}], 0x14, 0x0, &(0x7f0000000680)="86621f50fcee8bdc5bf8c503a78812261b4bf6d7"}) [ 2623.563573] binder: undelivered TRANSACTION_ERROR: 29189 [ 2623.735489] binder: 15050:15056 Release 1 refcount change on invalid ref 2 ret -22 18:07:33 executing program 5: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000001a00)='/dev/net/tun\x00', 0x0, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000080)="c0dc00025e0b01047be070") ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000300)={'nr0\x01\x00', 0x1132}) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000001a00)='/dev/net/tun\x00', 0x2, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000300)={'nr0\x01\x00', 0x1132}) write$cgroup_int(0xffffffffffffffff, &(0x7f00000000c0)=0x2, 0xfffffffffffffe75) close(r1) 18:07:33 executing program 2: ioctl$FS_IOC_RESVSP(0xffffffffffffffff, 0x40305828, &(0x7f00000000c0)={0x0, 0x0, 0x100000000000001}) clone(0x2102001fff, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) socket(0x0, 0x0, 0x0) r0 = getpid() rt_tgsigqueueinfo(0x0, r0, 0x16, &(0x7f0000000100)) ptrace(0x10, r0) ptrace$poke(0x4209, r0, &(0x7f00000000c0), 0x70effd) 18:07:33 executing program 1: clone(0x2102001fff, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) socket(0x0, 0x0, 0x0) r0 = getpid() rt_tgsigqueueinfo(0x0, r0, 0x16, &(0x7f0000000100)) rt_sigqueueinfo(r0, 0x7, &(0x7f0000000180)={0x0, 0x0, 0xffffffff}) 18:07:33 executing program 3: r0 = socket(0x10, 0x3, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") ioctl$sock_ifreq(r0, 0x89f3, &(0x7f0000000240)={'sit0\x00'}) [ 2623.735499] binder: 15050:15056 BC_ACQUIRE_DONE u0000000000000000 no match 18:07:33 executing program 4: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000040)='/dev/net/tun\x00', 0x0, 0x0) r1 = epoll_create1(0x0) epoll_ctl$EPOLL_CTL_ADD(0xffffffffffffffff, 0x1, r0, &(0x7f0000000100)) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000080)={'tunl0\x00', 0x1}) epoll_wait(r1, &(0x7f00000000c0)=[{}], 0x1, 0x0) 18:07:33 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000006c0)={0x118, 0x0, &(0x7f0000000540)=[@release={0x40046306, 0x2}, @acquire_done, @acquire_done={0x40106309, 0x3}, @transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x50, 0x18, &(0x7f0000000080)={@flat=@binder={0x73622a85, 0xa, 0x1}, @fda={0x66646185, 0xa, 0x1, 0x9}, @fd={0x66642a85, 0x0, r1}}, &(0x7f0000000100)={0x0, 0x18, 0x38}}, 0x1000}, @transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000180)={@ptr={0x70742a85, 0x0, &(0x7f0000000140)=""/51, 0x33, 0x2, 0x25}, @flat=@weak_handle={0x77682a85, 0x1}, @flat=@binder={0x73622a85, 0xa, 0x3}}, &(0x7f0000000280)={0x0, 0x28, 0x40}}, 0x1f8aed83e3349436}, @exit_looper, @transaction_sg={0x40486311, {0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x68, 0x18, &(0x7f0000000480)={@ptr={0x70742a85, 0x0, &(0x7f00000002c0)=""/11, 0xb, 0x2, 0x3f}, @fd={0x66642a85, 0x0, r0}, @ptr={0x70742a85, 0x0, &(0x7f0000000380)=""/70, 0x46, 0x1, 0x1f}}, &(0x7f0000000500)={0x0, 0x28, 0x40}}, 0x1000}], 0x14, 0x0, &(0x7f0000000680)="86621f50fcee8bdc5bf8c503a78812261b4bf6d7"}) 18:07:33 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000006c0)={0x118, 0x0, &(0x7f0000000540)=[@release={0x40046306, 0x2}, @acquire_done, @acquire_done={0x40106309, 0x3}, @transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x50, 0x18, &(0x7f0000000080)={@flat=@binder={0x73622a85, 0xa, 0x1}, @fda={0x66646185, 0xa, 0x1, 0x9}, @fd={0x66642a85, 0x0, r1}}, &(0x7f0000000100)={0x0, 0x18, 0x38}}, 0x1000}, @transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000180)={@ptr={0x70742a85, 0x0, &(0x7f0000000140)=""/51, 0x33, 0x2, 0x25}, @flat=@weak_handle={0x77682a85, 0x1}, @flat=@binder={0x73622a85, 0xa, 0x3}}, &(0x7f0000000280)={0x0, 0x28, 0x40}}, 0x1f8aed83e3349436}, @exit_looper, @transaction_sg={0x40486311, {0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x68, 0x18, &(0x7f0000000480)={@ptr={0x70742a85, 0x0, &(0x7f00000002c0)=""/11, 0xb, 0x2, 0x3f}, @fd={0x66642a85, 0x0, r0}, @ptr={0x70742a85, 0x0, &(0x7f0000000380)=""/70, 0x46, 0x1, 0x1f}}, &(0x7f0000000500)={0x0, 0x28, 0x40}}, 0x1000}], 0x14, 0x0, &(0x7f0000000680)="86621f50fcee8bdc5bf8c503a78812261b4bf6d7"}) [ 2623.735516] binder: 15050:15056 BC_ACQUIRE_DONE u0000000000000003 no match [ 2623.735530] binder: 15050:15056 transaction failed 29189/-22, size 80-24 line 3014 18:07:33 executing program 2: ioctl$FS_IOC_RESVSP(0xffffffffffffffff, 0x40305828, &(0x7f00000000c0)={0x0, 0x0, 0x100000000000001}) clone(0x2102001fff, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) socket(0x0, 0x0, 0x0) r0 = getpid() rt_tgsigqueueinfo(0x0, r0, 0x16, &(0x7f0000000100)) ptrace(0x10, r0) ptrace$poke(0x4209, r0, &(0x7f00000000c0), 0x70effd) 18:07:33 executing program 3: r0 = socket(0x10, 0x3, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") ioctl$sock_ifreq(r0, 0x89f3, &(0x7f0000000240)={'sit0\x00'}) [ 2623.735741] binder: undelivered TRANSACTION_ERROR: 29189 [ 2623.822496] binder: 15081:15095 Release 1 refcount change on invalid ref 2 ret -22 18:07:33 executing program 4: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000040)='/dev/net/tun\x00', 0x0, 0x0) r1 = epoll_create1(0x0) epoll_ctl$EPOLL_CTL_ADD(0xffffffffffffffff, 0x1, r0, &(0x7f0000000100)) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000080)={'tunl0\x00', 0x1}) epoll_wait(r1, &(0x7f00000000c0)=[{}], 0x1, 0x0) 18:07:33 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000006c0)={0x118, 0x0, &(0x7f0000000540)=[@release={0x40046306, 0x2}, @acquire_done, @acquire_done={0x40106309, 0x3}, @transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x50, 0x18, &(0x7f0000000080)={@flat=@binder={0x73622a85, 0xa, 0x1}, @fda={0x66646185, 0xa, 0x1, 0x9}, @fd={0x66642a85, 0x0, r1}}, &(0x7f0000000100)={0x0, 0x18, 0x38}}, 0x1000}, @transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000180)={@ptr={0x70742a85, 0x0, &(0x7f0000000140)=""/51, 0x33, 0x2, 0x25}, @flat=@weak_handle={0x77682a85, 0x1}, @flat=@binder={0x73622a85, 0xa, 0x3}}, &(0x7f0000000280)={0x0, 0x28, 0x40}}, 0x1f8aed83e3349436}, @exit_looper, @transaction_sg={0x40486311, {0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x68, 0x18, &(0x7f0000000480)={@ptr={0x70742a85, 0x0, &(0x7f00000002c0)=""/11, 0xb, 0x2, 0x3f}, @fd={0x66642a85, 0x0, r0}, @ptr={0x70742a85, 0x0, &(0x7f0000000380)=""/70, 0x46, 0x1, 0x1f}}, &(0x7f0000000500)={0x0, 0x28, 0x40}}, 0x1000}], 0x14, 0x0, &(0x7f0000000680)="86621f50fcee8bdc5bf8c503a78812261b4bf6d7"}) 18:07:33 executing program 3: r0 = socket(0x10, 0x3, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") ioctl$sock_ifreq(r0, 0x89f3, &(0x7f0000000240)={'sit0\x00'}) [ 2623.822532] binder: 15081:15095 BC_ACQUIRE_DONE u0000000000000000 no match [ 2623.822539] binder: 15081:15095 BC_ACQUIRE_DONE u0000000000000003 no match [ 2623.822551] binder: 15081:15095 transaction failed 29189/-22, size 80-24 line 3014 [ 2623.831780] binder: undelivered TRANSACTION_ERROR: 29189 [ 2623.948909] binder: 15140:15162 Release 1 refcount change on invalid ref 2 ret -22 [ 2623.948919] binder: 15140:15162 BC_ACQUIRE_DONE u0000000000000000 no match [ 2623.948927] binder: 15140:15162 BC_ACQUIRE_DONE u0000000000000003 no match 18:07:34 executing program 5: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000001a00)='/dev/net/tun\x00', 0x0, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000080)="c0dc00025e0b01047be070") ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000300)={'nr0\x01\x00', 0x1132}) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000001a00)='/dev/net/tun\x00', 0x2, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000300)={'nr0\x01\x00', 0x1132}) write$cgroup_int(0xffffffffffffffff, &(0x7f00000000c0)=0x2, 0xfffffffffffffe75) close(r1) 18:07:34 executing program 1: clone(0x2102001fff, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) socket(0x0, 0x0, 0x0) r0 = getpid() rt_tgsigqueueinfo(0x0, r0, 0x16, &(0x7f0000000100)) rt_sigqueueinfo(r0, 0x7, &(0x7f0000000180)={0x0, 0x0, 0xffffffff}) 18:07:34 executing program 2: ioctl$FS_IOC_RESVSP(0xffffffffffffffff, 0x40305828, &(0x7f00000000c0)={0x0, 0x0, 0x100000000000001}) clone(0x2102001fff, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) socket(0x0, 0x0, 0x0) r0 = getpid() rt_tgsigqueueinfo(0x0, r0, 0x16, &(0x7f0000000100)) ptrace(0x10, r0) ptrace$poke(0x4209, r0, &(0x7f00000000c0), 0x70effd) 18:07:34 executing program 3: r0 = socket(0x10, 0x3, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") ioctl$sock_ifreq(r0, 0x89f3, &(0x7f0000000240)={'sit0\x00'}) 18:07:34 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000006c0)={0x118, 0x0, &(0x7f0000000540)=[@release={0x40046306, 0x2}, @acquire_done, @acquire_done={0x40106309, 0x3}, @transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x50, 0x18, &(0x7f0000000080)={@flat=@binder={0x73622a85, 0xa, 0x1}, @fda={0x66646185, 0xa, 0x1, 0x9}, @fd={0x66642a85, 0x0, r1}}, &(0x7f0000000100)={0x0, 0x18, 0x38}}, 0x1000}, @transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000180)={@ptr={0x70742a85, 0x0, &(0x7f0000000140)=""/51, 0x33, 0x2, 0x25}, @flat=@weak_handle={0x77682a85, 0x1}, @flat=@binder={0x73622a85, 0xa, 0x3}}, &(0x7f0000000280)={0x0, 0x28, 0x40}}, 0x1f8aed83e3349436}, @exit_looper, @transaction_sg={0x40486311, {0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x68, 0x18, &(0x7f0000000480)={@ptr={0x70742a85, 0x0, &(0x7f00000002c0)=""/11, 0xb, 0x2, 0x3f}, @fd={0x66642a85, 0x0, r0}, @ptr={0x70742a85, 0x0, &(0x7f0000000380)=""/70, 0x46, 0x1, 0x1f}}, &(0x7f0000000500)={0x0, 0x28, 0x40}}, 0x1000}], 0x14, 0x0, &(0x7f0000000680)="86621f50fcee8bdc5bf8c503a78812261b4bf6d7"}) [ 2623.948945] binder: 15140:15162 transaction failed 29189/-22, size 80-24 line 3014 18:07:34 executing program 4: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000040)='/dev/net/tun\x00', 0x0, 0x0) r1 = epoll_create1(0x0) epoll_ctl$EPOLL_CTL_ADD(0xffffffffffffffff, 0x1, r0, &(0x7f0000000100)) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000080)={'tunl0\x00', 0x1}) epoll_wait(r1, &(0x7f00000000c0)=[{}], 0x1, 0x0) 18:07:34 executing program 3: r0 = socket(0x10, 0x3, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") ioctl$sock_ifreq(r0, 0x89f3, &(0x7f0000000240)={'sit0\x00'}) [ 2623.949300] binder: undelivered TRANSACTION_ERROR: 29189 18:07:34 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000006c0)={0x118, 0x0, &(0x7f0000000540)=[@release={0x40046306, 0x2}, @acquire_done, @acquire_done={0x40106309, 0x3}, @transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x50, 0x18, &(0x7f0000000080)={@flat=@binder={0x73622a85, 0xa, 0x1}, @fda={0x66646185, 0xa, 0x1, 0x9}, @fd={0x66642a85, 0x0, r1}}, &(0x7f0000000100)={0x0, 0x18, 0x38}}, 0x1000}, @transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000180)={@ptr={0x70742a85, 0x0, &(0x7f0000000140)=""/51, 0x33, 0x2, 0x25}, @flat=@weak_handle={0x77682a85, 0x1}, @flat=@binder={0x73622a85, 0xa, 0x3}}, &(0x7f0000000280)={0x0, 0x28, 0x40}}, 0x1f8aed83e3349436}, @exit_looper, @transaction_sg={0x40486311, {0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x68, 0x18, &(0x7f0000000480)={@ptr={0x70742a85, 0x0, &(0x7f00000002c0)=""/11, 0xb, 0x2, 0x3f}, @fd={0x66642a85, 0x0, r0}, @ptr={0x70742a85, 0x0, &(0x7f0000000380)=""/70, 0x46, 0x1, 0x1f}}, &(0x7f0000000500)={0x0, 0x28, 0x40}}, 0x1000}], 0x14, 0x0, &(0x7f0000000680)="86621f50fcee8bdc5bf8c503a78812261b4bf6d7"}) [ 2624.167114] binder: 15198:15251 Release 1 refcount change on invalid ref 2 ret -22 18:07:34 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000006c0)={0x118, 0x0, &(0x7f0000000540)=[@release={0x40046306, 0x2}, @acquire_done, @acquire_done={0x40106309, 0x3}, @transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x50, 0x18, &(0x7f0000000080)={@flat=@binder={0x73622a85, 0xa, 0x1}, @fda={0x66646185, 0xa, 0x1, 0x9}, @fd={0x66642a85, 0x0, r1}}, &(0x7f0000000100)={0x0, 0x18, 0x38}}, 0x1000}, @transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000180)={@ptr={0x70742a85, 0x0, &(0x7f0000000140)=""/51, 0x33, 0x2, 0x25}, @flat=@weak_handle={0x77682a85, 0x1}, @flat=@binder={0x73622a85, 0xa, 0x3}}, &(0x7f0000000280)={0x0, 0x28, 0x40}}, 0x1f8aed83e3349436}, @exit_looper, @transaction_sg={0x40486311, {0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x68, 0x18, &(0x7f0000000480)={@ptr={0x70742a85, 0x0, &(0x7f00000002c0)=""/11, 0xb, 0x2, 0x3f}, @fd={0x66642a85, 0x0, r0}, @ptr={0x70742a85, 0x0, &(0x7f0000000380)=""/70, 0x46, 0x1, 0x1f}}, &(0x7f0000000500)={0x0, 0x28, 0x40}}, 0x1000}], 0x14, 0x0, &(0x7f0000000680)="86621f50fcee8bdc5bf8c503a78812261b4bf6d7"}) 18:07:34 executing program 3: r0 = socket(0x10, 0x3, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") ioctl$sock_ifreq(r0, 0x89f3, &(0x7f0000000240)={'sit0\x00'}) [ 2624.167124] binder: 15198:15251 BC_ACQUIRE_DONE u0000000000000000 no match [ 2624.167131] binder: 15198:15251 BC_ACQUIRE_DONE u0000000000000003 no match 18:07:34 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000006c0)={0x118, 0x0, &(0x7f0000000540)=[@release={0x40046306, 0x2}, @acquire_done, @acquire_done={0x40106309, 0x3}, @transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x50, 0x18, &(0x7f0000000080)={@flat=@binder={0x73622a85, 0xa, 0x1}, @fda={0x66646185, 0xa, 0x1, 0x9}, @fd={0x66642a85, 0x0, r1}}, &(0x7f0000000100)={0x0, 0x18, 0x38}}, 0x1000}, @transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000180)={@ptr={0x70742a85, 0x0, &(0x7f0000000140)=""/51, 0x33, 0x2, 0x25}, @flat=@weak_handle={0x77682a85, 0x1}, @flat=@binder={0x73622a85, 0xa, 0x3}}, &(0x7f0000000280)={0x0, 0x28, 0x40}}, 0x1f8aed83e3349436}, @exit_looper, @transaction_sg={0x40486311, {0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x68, 0x18, &(0x7f0000000480)={@ptr={0x70742a85, 0x0, &(0x7f00000002c0)=""/11, 0xb, 0x2, 0x3f}, @fd={0x66642a85, 0x0, r0}, @ptr={0x70742a85, 0x0, &(0x7f0000000380)=""/70, 0x46, 0x1, 0x1f}}, &(0x7f0000000500)={0x0, 0x28, 0x40}}, 0x1000}], 0x14, 0x0, &(0x7f0000000680)="86621f50fcee8bdc5bf8c503a78812261b4bf6d7"}) 18:07:34 executing program 2: ioctl$FS_IOC_RESVSP(0xffffffffffffffff, 0x40305828, &(0x7f00000000c0)={0x0, 0x0, 0x100000000000001}) clone(0x2102001fff, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) socket(0x0, 0x0, 0x0) r0 = getpid() rt_tgsigqueueinfo(0x0, r0, 0x16, &(0x7f0000000100)) ptrace(0x10, r0) ptrace$poke(0x4209, r0, &(0x7f00000000c0), 0x70effd) [ 2624.167144] binder: 15198:15251 transaction failed 29189/-22, size 80-24 line 3014 18:07:34 executing program 5: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000001a00)='/dev/net/tun\x00', 0x0, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000080)="c0dc00025e0b01047be070") ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000300)={'nr0\x01\x00', 0x1132}) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000001a00)='/dev/net/tun\x00', 0x2, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000300)={'nr0\x01\x00', 0x1132}) write$cgroup_int(0xffffffffffffffff, &(0x7f00000000c0)=0x2, 0xfffffffffffffe75) close(r1) 18:07:34 executing program 1: clone(0x2102001fff, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) socket(0x0, 0x0, 0x0) r0 = getpid() rt_tgsigqueueinfo(0x0, r0, 0x16, &(0x7f0000000100)) rt_sigqueueinfo(r0, 0x7, &(0x7f0000000180)={0x0, 0x0, 0xffffffff}) 18:07:34 executing program 3: r0 = socket(0x10, 0x3, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") ioctl$sock_ifreq(r0, 0x89f3, &(0x7f0000000240)={'sit0\x00'}) 18:07:34 executing program 4: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000040)='/dev/net/tun\x00', 0x0, 0x0) r1 = epoll_create1(0x0) epoll_ctl$EPOLL_CTL_ADD(0xffffffffffffffff, 0x1, r0, &(0x7f0000000100)) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000080)={'tunl0\x00', 0x1}) epoll_wait(r1, &(0x7f00000000c0)=[{}], 0x1, 0x0) [ 2624.167434] binder: undelivered TRANSACTION_ERROR: 29189 [ 2624.315005] binder: 15292:15295 Release 1 refcount change on invalid ref 2 ret -22 18:07:34 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000006c0)={0x118, 0x0, &(0x7f0000000540)=[@release={0x40046306, 0x2}, @acquire_done, @acquire_done={0x40106309, 0x3}, @transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x50, 0x18, &(0x7f0000000080)={@flat=@binder={0x73622a85, 0xa, 0x1}, @fda={0x66646185, 0xa, 0x1, 0x9}, @fd={0x66642a85, 0x0, r1}}, &(0x7f0000000100)={0x0, 0x18, 0x38}}, 0x1000}, @transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000180)={@ptr={0x70742a85, 0x0, &(0x7f0000000140)=""/51, 0x33, 0x2, 0x25}, @flat=@weak_handle={0x77682a85, 0x1}, @flat=@binder={0x73622a85, 0xa, 0x3}}, &(0x7f0000000280)={0x0, 0x28, 0x40}}, 0x1f8aed83e3349436}, @exit_looper, @transaction_sg={0x40486311, {0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x68, 0x18, &(0x7f0000000480)={@ptr={0x70742a85, 0x0, &(0x7f00000002c0)=""/11, 0xb, 0x2, 0x3f}, @fd={0x66642a85, 0x0, r0}, @ptr={0x70742a85, 0x0, &(0x7f0000000380)=""/70, 0x46, 0x1, 0x1f}}, &(0x7f0000000500)={0x0, 0x28, 0x40}}, 0x1000}], 0x14, 0x0, &(0x7f0000000680)="86621f50fcee8bdc5bf8c503a78812261b4bf6d7"}) [ 2624.315015] binder: 15292:15295 BC_ACQUIRE_DONE u0000000000000000 no match [ 2624.315023] binder: 15292:15295 BC_ACQUIRE_DONE u0000000000000003 no match 18:07:34 executing program 1: clone(0x2102001fff, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) socket(0x0, 0x0, 0x0) r0 = getpid() rt_tgsigqueueinfo(0x0, r0, 0x16, &(0x7f0000000100)) rt_sigqueueinfo(r0, 0x7, &(0x7f0000000180)={0x0, 0x0, 0xffffffff}) 18:07:34 executing program 3: r0 = socket(0x10, 0x3, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") ioctl$sock_ifreq(r0, 0x89f3, &(0x7f0000000240)={'sit0\x00'}) [ 2624.315035] binder: 15292:15295 transaction failed 29189/-22, size 80-24 line 3014 [ 2624.315538] binder: undelivered TRANSACTION_ERROR: 29189 18:07:34 executing program 3: r0 = socket(0x10, 0x3, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") ioctl$sock_ifreq(r0, 0x89f3, &(0x7f0000000240)={'sit0\x00'}) 18:07:34 executing program 1: clone(0x2102001fff, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) socket(0x0, 0x0, 0x0) r0 = getpid() rt_tgsigqueueinfo(0x0, r0, 0x16, &(0x7f0000000100)) rt_sigqueueinfo(r0, 0x7, &(0x7f0000000180)={0x0, 0x0, 0xffffffff}) 18:07:34 executing program 5: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000001a00)='/dev/net/tun\x00', 0x0, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000080)="c0dc00025e0b01047be070") ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000300)={'nr0\x01\x00', 0x1132}) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000001a00)='/dev/net/tun\x00', 0x2, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000300)={'nr0\x01\x00', 0x1132}) write$cgroup_int(0xffffffffffffffff, &(0x7f00000000c0)=0x2, 0xfffffffffffffe75) close(r1) 18:07:34 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000006c0)={0x118, 0x0, &(0x7f0000000540)=[@release={0x40046306, 0x2}, @acquire_done, @acquire_done={0x40106309, 0x3}, @transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x50, 0x18, &(0x7f0000000080)={@flat=@binder={0x73622a85, 0xa, 0x1}, @fda={0x66646185, 0xa, 0x1, 0x9}, @fd={0x66642a85, 0x0, r1}}, &(0x7f0000000100)={0x0, 0x18, 0x38}}, 0x1000}, @transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000180)={@ptr={0x70742a85, 0x0, &(0x7f0000000140)=""/51, 0x33, 0x2, 0x25}, @flat=@weak_handle={0x77682a85, 0x1}, @flat=@binder={0x73622a85, 0xa, 0x3}}, &(0x7f0000000280)={0x0, 0x28, 0x40}}, 0x1f8aed83e3349436}, @exit_looper, @transaction_sg={0x40486311, {0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x68, 0x18, &(0x7f0000000480)={@ptr={0x70742a85, 0x0, &(0x7f00000002c0)=""/11, 0xb, 0x2, 0x3f}, @fd={0x66642a85, 0x0, r0}, @ptr={0x70742a85, 0x0, &(0x7f0000000380)=""/70, 0x46, 0x1, 0x1f}}, &(0x7f0000000500)={0x0, 0x28, 0x40}}, 0x1000}], 0x14, 0x0, &(0x7f0000000680)="86621f50fcee8bdc5bf8c503a78812261b4bf6d7"}) 18:07:34 executing program 2: ioctl$FS_IOC_RESVSP(0xffffffffffffffff, 0x40305828, &(0x7f00000000c0)={0x0, 0x0, 0x100000000000001}) clone(0x2102001fff, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) socket(0x0, 0x0, 0x0) r0 = getpid() rt_tgsigqueueinfo(0x0, r0, 0x16, &(0x7f0000000100)) ptrace(0x10, r0) ptrace$poke(0x4209, r0, &(0x7f00000000c0), 0x70effd) [ 2624.506471] binder: 15348:15369 Release 1 refcount change on invalid ref 2 ret -22 [ 2624.506482] binder: 15348:15369 BC_ACQUIRE_DONE u0000000000000000 no match [ 2624.506494] binder: 15348:15369 BC_ACQUIRE_DONE u0000000000000003 no match 18:07:34 executing program 3: r0 = socket(0x10, 0x3, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") ioctl$sock_ifreq(r0, 0x89f3, &(0x7f0000000240)={'sit0\x00'}) [ 2624.506514] binder: 15348:15369 transaction failed 29189/-22, size 80-24 line 3014 18:07:34 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000006c0)={0x118, 0x0, &(0x7f0000000540)=[@release={0x40046306, 0x2}, @acquire_done, @acquire_done={0x40106309, 0x3}, @transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x50, 0x18, &(0x7f0000000080)={@flat=@binder={0x73622a85, 0xa, 0x1}, @fda={0x66646185, 0xa, 0x1, 0x9}, @fd={0x66642a85, 0x0, r1}}, &(0x7f0000000100)={0x0, 0x18, 0x38}}, 0x1000}, @transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000180)={@ptr={0x70742a85, 0x0, &(0x7f0000000140)=""/51, 0x33, 0x2, 0x25}, @flat=@weak_handle={0x77682a85, 0x1}, @flat=@binder={0x73622a85, 0xa, 0x3}}, &(0x7f0000000280)={0x0, 0x28, 0x40}}, 0x1f8aed83e3349436}, @exit_looper, @transaction_sg={0x40486311, {0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x68, 0x18, &(0x7f0000000480)={@ptr={0x70742a85, 0x0, &(0x7f00000002c0)=""/11, 0xb, 0x2, 0x3f}, @fd={0x66642a85, 0x0, r0}, @ptr={0x70742a85, 0x0, &(0x7f0000000380)=""/70, 0x46, 0x1, 0x1f}}, &(0x7f0000000500)={0x0, 0x28, 0x40}}, 0x1000}], 0x14, 0x0, &(0x7f0000000680)="86621f50fcee8bdc5bf8c503a78812261b4bf6d7"}) 18:07:34 executing program 1: clone(0x2102001fff, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) socket(0x0, 0x0, 0x0) r0 = getpid() rt_tgsigqueueinfo(0x0, r0, 0x16, &(0x7f0000000100)) rt_sigqueueinfo(r0, 0x7, &(0x7f0000000180)={0x0, 0x0, 0xffffffff}) [ 2624.506871] binder: undelivered TRANSACTION_ERROR: 29189 [ 2624.719294] binder: 15400:15449 Release 1 refcount change on invalid ref 2 ret -22 18:07:34 executing program 4: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000040)='/dev/net/tun\x00', 0x0, 0x0) r1 = epoll_create1(0x0) epoll_ctl$EPOLL_CTL_ADD(0xffffffffffffffff, 0x1, r0, &(0x7f0000000100)) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000080)={'tunl0\x00', 0x1}) epoll_wait(r1, &(0x7f00000000c0)=[{}], 0x1, 0x0) 18:07:34 executing program 3: r0 = socket(0x10, 0x3, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") ioctl$sock_ifreq(r0, 0x89f3, &(0x7f0000000240)={'sit0\x00'}) 18:07:34 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000006c0)={0x118, 0x0, &(0x7f0000000540)=[@release={0x40046306, 0x2}, @acquire_done, @acquire_done={0x40106309, 0x3}, @transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x50, 0x18, &(0x7f0000000080)={@flat=@binder={0x73622a85, 0xa, 0x1}, @fda={0x66646185, 0xa, 0x1, 0x9}, @fd={0x66642a85, 0x0, r1}}, &(0x7f0000000100)={0x0, 0x18, 0x38}}, 0x1000}, @transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000180)={@ptr={0x70742a85, 0x0, &(0x7f0000000140)=""/51, 0x33, 0x2, 0x25}, @flat=@weak_handle={0x77682a85, 0x1}, @flat=@binder={0x73622a85, 0xa, 0x3}}, &(0x7f0000000280)={0x0, 0x28, 0x40}}, 0x1f8aed83e3349436}, @exit_looper, @transaction_sg={0x40486311, {0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x68, 0x18, &(0x7f0000000480)={@ptr={0x70742a85, 0x0, &(0x7f00000002c0)=""/11, 0xb, 0x2, 0x3f}, @fd={0x66642a85, 0x0, r0}, @ptr={0x70742a85, 0x0, &(0x7f0000000380)=""/70, 0x46, 0x1, 0x1f}}, &(0x7f0000000500)={0x0, 0x28, 0x40}}, 0x1000}], 0x14, 0x0, &(0x7f0000000680)="86621f50fcee8bdc5bf8c503a78812261b4bf6d7"}) 18:07:34 executing program 1: clone(0x2102001fff, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) socket(0x0, 0x0, 0x0) r0 = getpid() rt_tgsigqueueinfo(0x0, r0, 0x16, &(0x7f0000000100)) rt_sigqueueinfo(r0, 0x7, &(0x7f0000000180)={0x0, 0x0, 0xffffffff}) [ 2624.719305] binder: 15400:15449 BC_ACQUIRE_DONE u0000000000000000 no match [ 2624.719312] binder: 15400:15449 BC_ACQUIRE_DONE u0000000000000003 no match 18:07:34 executing program 3: r0 = socket(0x10, 0x3, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") ioctl$sock_ifreq(r0, 0x89f3, &(0x7f0000000240)={'sit0\x00'}) 18:07:34 executing program 2: ioctl$FS_IOC_RESVSP(0xffffffffffffffff, 0x40305828, &(0x7f00000000c0)={0x0, 0x0, 0x100000000000001}) clone(0x2102001fff, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) socket(0x0, 0x0, 0x0) r0 = getpid() rt_tgsigqueueinfo(0x0, r0, 0x16, &(0x7f0000000100)) ptrace(0x10, r0) ptrace$poke(0x4209, r0, &(0x7f00000000c0), 0x70effd) [ 2624.719325] binder: 15400:15449 transaction failed 29189/-22, size 80-24 line 3014 18:07:34 executing program 5: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000001a00)='/dev/net/tun\x00', 0x0, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000080)="c0dc00025e0b01047be070") ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000300)={'nr0\x01\x00', 0x1132}) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000001a00)='/dev/net/tun\x00', 0x2, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000300)={'nr0\x01\x00', 0x1132}) write$cgroup_int(0xffffffffffffffff, &(0x7f00000000c0)=0x2, 0xfffffffffffffe75) close(r1) 18:07:34 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000006c0)={0x118, 0x0, &(0x7f0000000540)=[@release={0x40046306, 0x2}, @acquire_done, @acquire_done={0x40106309, 0x3}, @transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x50, 0x18, &(0x7f0000000080)={@flat=@binder={0x73622a85, 0xa, 0x1}, @fda={0x66646185, 0xa, 0x1, 0x9}, @fd={0x66642a85, 0x0, r1}}, &(0x7f0000000100)={0x0, 0x18, 0x38}}, 0x1000}, @transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000180)={@ptr={0x70742a85, 0x0, &(0x7f0000000140)=""/51, 0x33, 0x2, 0x25}, @flat=@weak_handle={0x77682a85, 0x1}, @flat=@binder={0x73622a85, 0xa, 0x3}}, &(0x7f0000000280)={0x0, 0x28, 0x40}}, 0x1f8aed83e3349436}, @exit_looper, @transaction_sg={0x40486311, {0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x68, 0x18, &(0x7f0000000480)={@ptr={0x70742a85, 0x0, &(0x7f00000002c0)=""/11, 0xb, 0x2, 0x3f}, @fd={0x66642a85, 0x0, r0}, @ptr={0x70742a85, 0x0, &(0x7f0000000380)=""/70, 0x46, 0x1, 0x1f}}, &(0x7f0000000500)={0x0, 0x28, 0x40}}, 0x1000}], 0x14, 0x0, &(0x7f0000000680)="86621f50fcee8bdc5bf8c503a78812261b4bf6d7"}) [ 2624.721039] binder: undelivered TRANSACTION_ERROR: 29189 18:07:35 executing program 3: r0 = socket(0x10, 0x3, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") ioctl$sock_ifreq(r0, 0x89f3, &(0x7f0000000240)={'sit0\x00'}) 18:07:35 executing program 4: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000040)='/dev/net/tun\x00', 0x0, 0x0) r1 = epoll_create1(0x0) epoll_ctl$EPOLL_CTL_ADD(0xffffffffffffffff, 0x1, r0, &(0x7f0000000100)) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000080)={'tunl0\x00', 0x1}) epoll_wait(r1, &(0x7f00000000c0)=[{}], 0x1, 0x0) 18:07:35 executing program 1: clone(0x2102001fff, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) socket(0x0, 0x0, 0x0) r0 = getpid() rt_tgsigqueueinfo(0x0, r0, 0x16, &(0x7f0000000100)) rt_sigqueueinfo(r0, 0x7, &(0x7f0000000180)={0x0, 0x0, 0xffffffff}) 18:07:35 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000006c0)={0x118, 0x0, &(0x7f0000000540)=[@release={0x40046306, 0x2}, @acquire_done, @acquire_done={0x40106309, 0x3}, @transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x50, 0x18, &(0x7f0000000080)={@flat=@binder={0x73622a85, 0xa, 0x1}, @fda={0x66646185, 0xa, 0x1, 0x9}, @fd={0x66642a85, 0x0, r1}}, &(0x7f0000000100)={0x0, 0x18, 0x38}}, 0x1000}, @transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000180)={@ptr={0x70742a85, 0x0, &(0x7f0000000140)=""/51, 0x33, 0x2, 0x25}, @flat=@weak_handle={0x77682a85, 0x1}, @flat=@binder={0x73622a85, 0xa, 0x3}}, &(0x7f0000000280)={0x0, 0x28, 0x40}}, 0x1f8aed83e3349436}, @exit_looper, @transaction_sg={0x40486311, {0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x68, 0x18, &(0x7f0000000480)={@ptr={0x70742a85, 0x0, &(0x7f00000002c0)=""/11, 0xb, 0x2, 0x3f}, @fd={0x66642a85, 0x0, r0}, @ptr={0x70742a85, 0x0, &(0x7f0000000380)=""/70, 0x46, 0x1, 0x1f}}, &(0x7f0000000500)={0x0, 0x28, 0x40}}, 0x1000}], 0x14, 0x0, &(0x7f0000000680)="86621f50fcee8bdc5bf8c503a78812261b4bf6d7"}) [ 2625.110403] binder: 15592:15599 Release 1 refcount change on invalid ref 2 ret -22 [ 2625.142090] binder: 15592:15599 BC_ACQUIRE_DONE u0000000000000000 no match [ 2625.142099] binder: 15592:15599 BC_ACQUIRE_DONE u0000000000000003 no match 18:07:35 executing program 1: clone(0x2102001fff, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) socket(0x0, 0x0, 0x0) r0 = getpid() rt_tgsigqueueinfo(0x0, r0, 0x16, &(0x7f0000000100)) rt_sigqueueinfo(r0, 0x7, &(0x7f0000000180)={0x0, 0x0, 0xffffffff}) 18:07:35 executing program 3: r0 = socket(0x10, 0x3, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") ioctl$sock_ifreq(r0, 0x89f3, &(0x7f0000000240)={'sit0\x00'}) 18:07:35 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000006c0)={0x118, 0x0, &(0x7f0000000540)=[@release={0x40046306, 0x2}, @acquire_done, @acquire_done={0x40106309, 0x3}, @transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x50, 0x18, &(0x7f0000000080)={@flat=@binder={0x73622a85, 0xa, 0x1}, @fda={0x66646185, 0xa, 0x1, 0x9}, @fd={0x66642a85, 0x0, r1}}, &(0x7f0000000100)={0x0, 0x18, 0x38}}, 0x1000}, @transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000180)={@ptr={0x70742a85, 0x0, &(0x7f0000000140)=""/51, 0x33, 0x2, 0x25}, @flat=@weak_handle={0x77682a85, 0x1}, @flat=@binder={0x73622a85, 0xa, 0x3}}, &(0x7f0000000280)={0x0, 0x28, 0x40}}, 0x1f8aed83e3349436}, @exit_looper, @transaction_sg={0x40486311, {0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x68, 0x18, &(0x7f0000000480)={@ptr={0x70742a85, 0x0, &(0x7f00000002c0)=""/11, 0xb, 0x2, 0x3f}, @fd={0x66642a85, 0x0, r0}, @ptr={0x70742a85, 0x0, &(0x7f0000000380)=""/70, 0x46, 0x1, 0x1f}}, &(0x7f0000000500)={0x0, 0x28, 0x40}}, 0x1000}], 0x14, 0x0, &(0x7f0000000680)="86621f50fcee8bdc5bf8c503a78812261b4bf6d7"}) [ 2625.142113] binder: 15592:15599 transaction failed 29189/-22, size 80-24 line 3014 [ 2625.142377] binder: undelivered TRANSACTION_ERROR: 29189 [ 2625.271442] binder: 15649:15659 Release 1 refcount change on invalid ref 2 ret -22 18:07:35 executing program 3: r0 = socket(0x10, 0x3, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") ioctl$sock_ifreq(r0, 0x89f3, &(0x7f0000000240)={'sit0\x00'}) 18:07:35 executing program 4: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000040)='/dev/net/tun\x00', 0x0, 0x0) r1 = epoll_create1(0x0) epoll_ctl$EPOLL_CTL_ADD(0xffffffffffffffff, 0x1, r0, &(0x7f0000000100)) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000080)={'tunl0\x00', 0x1}) epoll_wait(r1, &(0x7f00000000c0)=[{}], 0x1, 0x0) [ 2625.271453] binder: 15649:15659 BC_ACQUIRE_DONE u0000000000000000 no match 18:07:35 executing program 2: ioctl$FS_IOC_RESVSP(0xffffffffffffffff, 0x40305828, &(0x7f00000000c0)={0x0, 0x0, 0x100000000000001}) clone(0x2102001fff, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) socket(0x0, 0x0, 0x0) r0 = getpid() rt_tgsigqueueinfo(0x0, r0, 0x16, &(0x7f0000000100)) ptrace(0x10, r0) ptrace$poke(0x4209, r0, &(0x7f00000000c0), 0x70effd) 18:07:35 executing program 5: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000001a00)='/dev/net/tun\x00', 0x0, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000080)="c0dc00025e0b01047be070") ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000300)={'nr0\x01\x00', 0x1132}) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000001a00)='/dev/net/tun\x00', 0x2, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000300)={'nr0\x01\x00', 0x1132}) write$cgroup_int(0xffffffffffffffff, &(0x7f00000000c0)=0x2, 0xfffffffffffffe75) close(r1) 18:07:35 executing program 3: r0 = socket(0x10, 0x3, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") ioctl$sock_ifreq(r0, 0x89f3, &(0x7f0000000240)={'sit0\x00'}) 18:07:35 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000006c0)={0x118, 0x0, &(0x7f0000000540)=[@release={0x40046306, 0x2}, @acquire_done, @acquire_done={0x40106309, 0x3}, @transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x50, 0x18, &(0x7f0000000080)={@flat=@binder={0x73622a85, 0xa, 0x1}, @fda={0x66646185, 0xa, 0x1, 0x9}, @fd={0x66642a85, 0x0, r1}}, &(0x7f0000000100)={0x0, 0x18, 0x38}}, 0x1000}, @transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000180)={@ptr={0x70742a85, 0x0, &(0x7f0000000140)=""/51, 0x33, 0x2, 0x25}, @flat=@weak_handle={0x77682a85, 0x1}, @flat=@binder={0x73622a85, 0xa, 0x3}}, &(0x7f0000000280)={0x0, 0x28, 0x40}}, 0x1f8aed83e3349436}, @exit_looper, @transaction_sg={0x40486311, {0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x68, 0x18, &(0x7f0000000480)={@ptr={0x70742a85, 0x0, &(0x7f00000002c0)=""/11, 0xb, 0x2, 0x3f}, @fd={0x66642a85, 0x0, r0}, @ptr={0x70742a85, 0x0, &(0x7f0000000380)=""/70, 0x46, 0x1, 0x1f}}, &(0x7f0000000500)={0x0, 0x28, 0x40}}, 0x1000}], 0x14, 0x0, &(0x7f0000000680)="86621f50fcee8bdc5bf8c503a78812261b4bf6d7"}) [ 2625.271460] binder: 15649:15659 BC_ACQUIRE_DONE u0000000000000003 no match [ 2625.271472] binder: 15649:15659 transaction failed 29189/-22, size 80-24 line 3014 [ 2625.271710] binder: undelivered TRANSACTION_ERROR: 29189 18:07:35 executing program 3: r0 = socket(0x10, 0x3, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") ioctl$sock_ifreq(r0, 0x89f3, &(0x7f0000000240)={'sit0\x00'}) 18:07:35 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000006c0)={0x118, 0x0, &(0x7f0000000540)=[@release={0x40046306, 0x2}, @acquire_done, @acquire_done={0x40106309, 0x3}, @transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x50, 0x18, &(0x7f0000000080)={@flat=@binder={0x73622a85, 0xa, 0x1}, @fda={0x66646185, 0xa, 0x1, 0x9}, @fd={0x66642a85, 0x0, r1}}, &(0x7f0000000100)={0x0, 0x18, 0x38}}, 0x1000}, @transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000180)={@ptr={0x70742a85, 0x0, &(0x7f0000000140)=""/51, 0x33, 0x2, 0x25}, @flat=@weak_handle={0x77682a85, 0x1}, @flat=@binder={0x73622a85, 0xa, 0x3}}, &(0x7f0000000280)={0x0, 0x28, 0x40}}, 0x1f8aed83e3349436}, @exit_looper, @transaction_sg={0x40486311, {0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x68, 0x18, &(0x7f0000000480)={@ptr={0x70742a85, 0x0, &(0x7f00000002c0)=""/11, 0xb, 0x2, 0x3f}, @fd={0x66642a85, 0x0, r0}, @ptr={0x70742a85, 0x0, &(0x7f0000000380)=""/70, 0x46, 0x1, 0x1f}}, &(0x7f0000000500)={0x0, 0x28, 0x40}}, 0x1000}], 0x14, 0x0, &(0x7f0000000680)="86621f50fcee8bdc5bf8c503a78812261b4bf6d7"}) 18:07:35 executing program 1: clone(0x2102001fff, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) socket(0x0, 0x0, 0x0) r0 = getpid() rt_tgsigqueueinfo(0x0, r0, 0x16, &(0x7f0000000100)) rt_sigqueueinfo(r0, 0x7, &(0x7f0000000180)={0x0, 0x0, 0xffffffff}) [ 2625.349877] binder: 15687:15694 Release 1 refcount change on invalid ref 2 ret -22 [ 2625.349887] binder: 15687:15694 BC_ACQUIRE_DONE u0000000000000000 no match 18:07:35 executing program 4: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000040)='/dev/net/tun\x00', 0x0, 0x0) r1 = epoll_create1(0x0) epoll_ctl$EPOLL_CTL_ADD(0xffffffffffffffff, 0x1, r0, &(0x7f0000000100)) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000080)={'tunl0\x00', 0x1}) epoll_wait(r1, &(0x7f00000000c0)=[{}], 0x1, 0x0) [ 2625.349894] binder: 15687:15694 BC_ACQUIRE_DONE u0000000000000003 no match 18:07:35 executing program 3: r0 = socket(0x10, 0x3, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") ioctl$sock_ifreq(r0, 0x89f3, &(0x7f0000000240)={'sit0\x00'}) [ 2625.349906] binder: 15687:15694 transaction failed 29189/-22, size 80-24 line 3014 18:07:35 executing program 1: clone(0x2102001fff, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) socket(0x0, 0x0, 0x0) r0 = getpid() rt_tgsigqueueinfo(0x0, r0, 0x16, &(0x7f0000000100)) rt_sigqueueinfo(r0, 0x7, &(0x7f0000000180)={0x0, 0x0, 0xffffffff}) 18:07:35 executing program 5: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000001a00)='/dev/net/tun\x00', 0x0, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000080)="c0dc00025e0b01047be070") ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000300)={'nr0\x01\x00', 0x1132}) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000001a00)='/dev/net/tun\x00', 0x2, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000300)={'nr0\x01\x00', 0x1132}) write$cgroup_int(0xffffffffffffffff, &(0x7f00000000c0)=0x2, 0xfffffffffffffe75) close(r1) [ 2625.370216] binder: undelivered TRANSACTION_ERROR: 29189 [ 2625.513665] binder: 15767:15774 Release 1 refcount change on invalid ref 2 ret -22 18:07:35 executing program 3: r0 = socket(0x10, 0x3, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") ioctl$sock_ifreq(r0, 0x89f3, &(0x7f0000000240)={'sit0\x00'}) [ 2625.513676] binder: 15767:15774 BC_ACQUIRE_DONE u0000000000000000 no match [ 2625.513689] binder: 15767:15774 BC_ACQUIRE_DONE u0000000000000003 no match [ 2625.513702] binder: 15767:15774 transaction failed 29189/-22, size 80-24 line 3014 [ 2625.514061] binder: undelivered TRANSACTION_ERROR: 29189 [ 2625.627955] binder: 15777:15801 Release 1 refcount change on invalid ref 2 ret -22 18:07:35 executing program 2: ioctl$FS_IOC_RESVSP(0xffffffffffffffff, 0x40305828, &(0x7f00000000c0)={0x0, 0x0, 0x100000000000001}) clone(0x2102001fff, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) socket(0x0, 0x0, 0x0) r0 = getpid() rt_tgsigqueueinfo(0x0, r0, 0x16, &(0x7f0000000100)) ptrace(0x10, r0) ptrace$poke(0x4209, r0, &(0x7f00000000c0), 0x70effd) 18:07:35 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000006c0)={0x118, 0x0, &(0x7f0000000540)=[@release={0x40046306, 0x2}, @acquire_done, @acquire_done={0x40106309, 0x3}, @transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x50, 0x18, &(0x7f0000000080)={@flat=@binder={0x73622a85, 0xa, 0x1}, @fda={0x66646185, 0xa, 0x1, 0x9}, @fd={0x66642a85, 0x0, r1}}, &(0x7f0000000100)={0x0, 0x18, 0x38}}, 0x1000}, @transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000180)={@ptr={0x70742a85, 0x0, &(0x7f0000000140)=""/51, 0x33, 0x2, 0x25}, @flat=@weak_handle={0x77682a85, 0x1}, @flat=@binder={0x73622a85, 0xa, 0x3}}, &(0x7f0000000280)={0x0, 0x28, 0x40}}, 0x1f8aed83e3349436}, @exit_looper, @transaction_sg={0x40486311, {0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x68, 0x18, &(0x7f0000000480)={@ptr={0x70742a85, 0x0, &(0x7f00000002c0)=""/11, 0xb, 0x2, 0x3f}, @fd={0x66642a85, 0x0, r0}, @ptr={0x70742a85, 0x0, &(0x7f0000000380)=""/70, 0x46, 0x1, 0x1f}}, &(0x7f0000000500)={0x0, 0x28, 0x40}}, 0x1000}], 0x14, 0x0, &(0x7f0000000680)="86621f50fcee8bdc5bf8c503a78812261b4bf6d7"}) 18:07:35 executing program 4: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000040)='/dev/net/tun\x00', 0x0, 0x0) r1 = epoll_create1(0x0) epoll_ctl$EPOLL_CTL_ADD(0xffffffffffffffff, 0x1, r0, &(0x7f0000000100)) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000080)={'tunl0\x00', 0x1}) epoll_wait(r1, &(0x7f00000000c0)=[{}], 0x1, 0x0) 18:07:35 executing program 3: r0 = socket(0x10, 0x3, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") ioctl$sock_ifreq(r0, 0x89f3, &(0x7f0000000240)={'sit0\x00'}) 18:07:35 executing program 1: clone(0x2102001fff, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) socket(0x0, 0x0, 0x0) r0 = getpid() rt_tgsigqueueinfo(0x0, r0, 0x16, &(0x7f0000000100)) rt_sigqueueinfo(r0, 0x7, &(0x7f0000000180)={0x0, 0x0, 0xffffffff}) [ 2625.627965] binder: 15777:15801 BC_ACQUIRE_DONE u0000000000000000 no match [ 2625.627972] binder: 15777:15801 BC_ACQUIRE_DONE u0000000000000003 no match [ 2625.627984] binder: 15777:15801 transaction failed 29189/-22, size 80-24 line 3014 18:07:35 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000006c0)={0x118, 0x0, &(0x7f0000000540)=[@release={0x40046306, 0x2}, @acquire_done, @acquire_done={0x40106309, 0x3}, @transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x50, 0x18, &(0x7f0000000080)={@flat=@binder={0x73622a85, 0xa, 0x1}, @fda={0x66646185, 0xa, 0x1, 0x9}, @fd={0x66642a85, 0x0, r1}}, &(0x7f0000000100)={0x0, 0x18, 0x38}}, 0x1000}, @transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000180)={@ptr={0x70742a85, 0x0, &(0x7f0000000140)=""/51, 0x33, 0x2, 0x25}, @flat=@weak_handle={0x77682a85, 0x1}, @flat=@binder={0x73622a85, 0xa, 0x3}}, &(0x7f0000000280)={0x0, 0x28, 0x40}}, 0x1f8aed83e3349436}, @exit_looper, @transaction_sg={0x40486311, {0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x68, 0x18, &(0x7f0000000480)={@ptr={0x70742a85, 0x0, &(0x7f00000002c0)=""/11, 0xb, 0x2, 0x3f}, @fd={0x66642a85, 0x0, r0}, @ptr={0x70742a85, 0x0, &(0x7f0000000380)=""/70, 0x46, 0x1, 0x1f}}, &(0x7f0000000500)={0x0, 0x28, 0x40}}, 0x1000}], 0x14, 0x0, &(0x7f0000000680)="86621f50fcee8bdc5bf8c503a78812261b4bf6d7"}) [ 2625.628283] binder: undelivered TRANSACTION_ERROR: 29189 [ 2625.819772] binder: 15824:15831 Release 1 refcount change on invalid ref 2 ret -22 [ 2625.819783] binder: 15824:15831 BC_ACQUIRE_DONE u0000000000000000 no match 18:07:35 executing program 3: r0 = socket(0x10, 0x3, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") ioctl$sock_ifreq(r0, 0x89f3, &(0x7f0000000240)={'sit0\x00'}) 18:07:35 executing program 5: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000001a00)='/dev/net/tun\x00', 0x0, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000080)="c0dc00025e0b01047be070") ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000300)={'nr0\x01\x00', 0x1132}) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000001a00)='/dev/net/tun\x00', 0x2, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000300)={'nr0\x01\x00', 0x1132}) write$cgroup_int(0xffffffffffffffff, &(0x7f00000000c0)=0x2, 0xfffffffffffffe75) close(r1) [ 2625.819790] binder: 15824:15831 BC_ACQUIRE_DONE u0000000000000003 no match [ 2625.819803] binder: 15824:15831 transaction failed 29189/-22, size 80-24 line 3014 18:07:36 executing program 1: clone(0x2102001fff, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) socket(0x0, 0x0, 0x0) r0 = getpid() rt_tgsigqueueinfo(0x0, r0, 0x16, &(0x7f0000000100)) rt_sigqueueinfo(r0, 0x7, &(0x7f0000000180)={0x0, 0x0, 0xffffffff}) 18:07:36 executing program 4: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000040)='/dev/net/tun\x00', 0x0, 0x0) r1 = epoll_create1(0x0) epoll_ctl$EPOLL_CTL_ADD(0xffffffffffffffff, 0x1, r0, &(0x7f0000000100)) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000080)={'tunl0\x00', 0x1}) epoll_wait(r1, &(0x7f00000000c0)=[{}], 0x1, 0x0) 18:07:36 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000006c0)={0x118, 0x0, &(0x7f0000000540)=[@release={0x40046306, 0x2}, @acquire_done, @acquire_done={0x40106309, 0x3}, @transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x50, 0x18, &(0x7f0000000080)={@flat=@binder={0x73622a85, 0xa, 0x1}, @fda={0x66646185, 0xa, 0x1, 0x9}, @fd={0x66642a85, 0x0, r1}}, &(0x7f0000000100)={0x0, 0x18, 0x38}}, 0x1000}, @transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000180)={@ptr={0x70742a85, 0x0, &(0x7f0000000140)=""/51, 0x33, 0x2, 0x25}, @flat=@weak_handle={0x77682a85, 0x1}, @flat=@binder={0x73622a85, 0xa, 0x3}}, &(0x7f0000000280)={0x0, 0x28, 0x40}}, 0x1f8aed83e3349436}, @exit_looper, @transaction_sg={0x40486311, {0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x68, 0x18, &(0x7f0000000480)={@ptr={0x70742a85, 0x0, &(0x7f00000002c0)=""/11, 0xb, 0x2, 0x3f}, @fd={0x66642a85, 0x0, r0}, @ptr={0x70742a85, 0x0, &(0x7f0000000380)=""/70, 0x46, 0x1, 0x1f}}, &(0x7f0000000500)={0x0, 0x28, 0x40}}, 0x1000}], 0x14, 0x0, &(0x7f0000000680)="86621f50fcee8bdc5bf8c503a78812261b4bf6d7"}) [ 2625.820376] binder: undelivered TRANSACTION_ERROR: 29189 18:07:36 executing program 3: r0 = socket(0x10, 0x3, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") ioctl$sock_ifreq(r0, 0x89f3, &(0x7f0000000240)={'sit0\x00'}) [ 2625.931561] binder: 15892:15904 Release 1 refcount change on invalid ref 2 ret -22 18:07:36 executing program 2: ioctl$FS_IOC_RESVSP(0xffffffffffffffff, 0x40305828, &(0x7f00000000c0)={0x0, 0x0, 0x100000000000001}) clone(0x2102001fff, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) socket(0x0, 0x0, 0x0) r0 = getpid() rt_tgsigqueueinfo(0x0, r0, 0x16, &(0x7f0000000100)) ptrace(0x10, r0) ptrace$poke(0x4209, r0, &(0x7f00000000c0), 0x70effd) 18:07:36 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000006c0)={0x118, 0x0, &(0x7f0000000540)=[@release={0x40046306, 0x2}, @acquire_done, @acquire_done={0x40106309, 0x3}, @transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x50, 0x18, &(0x7f0000000080)={@flat=@binder={0x73622a85, 0xa, 0x1}, @fda={0x66646185, 0xa, 0x1, 0x9}, @fd={0x66642a85, 0x0, r1}}, &(0x7f0000000100)={0x0, 0x18, 0x38}}, 0x1000}, @transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000180)={@ptr={0x70742a85, 0x0, &(0x7f0000000140)=""/51, 0x33, 0x2, 0x25}, @flat=@weak_handle={0x77682a85, 0x1}, @flat=@binder={0x73622a85, 0xa, 0x3}}, &(0x7f0000000280)={0x0, 0x28, 0x40}}, 0x1f8aed83e3349436}, @exit_looper, @transaction_sg={0x40486311, {0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x68, 0x18, &(0x7f0000000480)={@ptr={0x70742a85, 0x0, &(0x7f00000002c0)=""/11, 0xb, 0x2, 0x3f}, @fd={0x66642a85, 0x0, r0}, @ptr={0x70742a85, 0x0, &(0x7f0000000380)=""/70, 0x46, 0x1, 0x1f}}, &(0x7f0000000500)={0x0, 0x28, 0x40}}, 0x1000}], 0x14, 0x0, &(0x7f0000000680)="86621f50fcee8bdc5bf8c503a78812261b4bf6d7"}) [ 2625.931571] binder: 15892:15904 BC_ACQUIRE_DONE u0000000000000000 no match [ 2625.931578] binder: 15892:15904 BC_ACQUIRE_DONE u0000000000000003 no match 18:07:36 executing program 1: clone(0x2102001fff, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) socket(0x0, 0x0, 0x0) r0 = getpid() rt_tgsigqueueinfo(0x0, r0, 0x16, &(0x7f0000000100)) rt_sigqueueinfo(r0, 0x7, &(0x7f0000000180)={0x0, 0x0, 0xffffffff}) [ 2625.931591] binder: 15892:15904 transaction failed 29189/-22, size 80-24 line 3014 [ 2625.931974] binder: undelivered TRANSACTION_ERROR: 29189 [ 2626.046967] binder: 15923:15938 Release 1 refcount change on invalid ref 2 ret -22 18:07:36 executing program 3: r0 = socket(0x10, 0x3, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") ioctl$sock_ifreq(r0, 0x89f3, &(0x7f0000000240)={'sit0\x00'}) [ 2626.046977] binder: 15923:15938 BC_ACQUIRE_DONE u0000000000000000 no match [ 2626.046985] binder: 15923:15938 BC_ACQUIRE_DONE u0000000000000003 no match 18:07:36 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000006c0)={0x118, 0x0, &(0x7f0000000540)=[@release={0x40046306, 0x2}, @acquire_done, @acquire_done={0x40106309, 0x3}, @transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x50, 0x18, &(0x7f0000000080)={@flat=@binder={0x73622a85, 0xa, 0x1}, @fda={0x66646185, 0xa, 0x1, 0x9}, @fd={0x66642a85, 0x0, r1}}, &(0x7f0000000100)={0x0, 0x18, 0x38}}, 0x1000}, @transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000180)={@ptr={0x70742a85, 0x0, &(0x7f0000000140)=""/51, 0x33, 0x2, 0x25}, @flat=@weak_handle={0x77682a85, 0x1}, @flat=@binder={0x73622a85, 0xa, 0x3}}, &(0x7f0000000280)={0x0, 0x28, 0x40}}, 0x1f8aed83e3349436}, @exit_looper, @transaction_sg={0x40486311, {0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x68, 0x18, &(0x7f0000000480)={@ptr={0x70742a85, 0x0, &(0x7f00000002c0)=""/11, 0xb, 0x2, 0x3f}, @fd={0x66642a85, 0x0, r0}, @ptr={0x70742a85, 0x0, &(0x7f0000000380)=""/70, 0x46, 0x1, 0x1f}}, &(0x7f0000000500)={0x0, 0x28, 0x40}}, 0x1000}], 0x14, 0x0, &(0x7f0000000680)="86621f50fcee8bdc5bf8c503a78812261b4bf6d7"}) 18:07:36 executing program 4: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000040)='/dev/net/tun\x00', 0x0, 0x0) r1 = epoll_create1(0x0) epoll_ctl$EPOLL_CTL_ADD(0xffffffffffffffff, 0x1, r0, &(0x7f0000000100)) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000080)={'tunl0\x00', 0x1}) epoll_wait(r1, &(0x7f00000000c0)=[{}], 0x1, 0x0) 18:07:36 executing program 1: clone(0x2102001fff, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) socket(0x0, 0x0, 0x0) r0 = getpid() rt_tgsigqueueinfo(0x0, r0, 0x16, &(0x7f0000000100)) rt_sigqueueinfo(r0, 0x7, &(0x7f0000000180)={0x0, 0x0, 0xffffffff}) 18:07:36 executing program 5: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000001a00)='/dev/net/tun\x00', 0x0, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000080)="c0dc00025e0b01047be070") ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000300)={'nr0\x01\x00', 0x1132}) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000001a00)='/dev/net/tun\x00', 0x2, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000300)={'nr0\x01\x00', 0x1132}) write$cgroup_int(0xffffffffffffffff, &(0x7f00000000c0)=0x2, 0xfffffffffffffe75) close(r1) 18:07:36 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000006c0)={0x118, 0x0, &(0x7f0000000540)=[@release={0x40046306, 0x2}, @acquire_done, @acquire_done={0x40106309, 0x3}, @transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x50, 0x18, &(0x7f0000000080)={@flat=@binder={0x73622a85, 0xa, 0x1}, @fda={0x66646185, 0xa, 0x1, 0x9}, @fd={0x66642a85, 0x0, r1}}, &(0x7f0000000100)={0x0, 0x18, 0x38}}, 0x1000}, @transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000180)={@ptr={0x70742a85, 0x0, &(0x7f0000000140)=""/51, 0x33, 0x2, 0x25}, @flat=@weak_handle={0x77682a85, 0x1}, @flat=@binder={0x73622a85, 0xa, 0x3}}, &(0x7f0000000280)={0x0, 0x28, 0x40}}, 0x1f8aed83e3349436}, @exit_looper, @transaction_sg={0x40486311, {0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x68, 0x18, &(0x7f0000000480)={@ptr={0x70742a85, 0x0, &(0x7f00000002c0)=""/11, 0xb, 0x2, 0x3f}, @fd={0x66642a85, 0x0, r0}, @ptr={0x70742a85, 0x0, &(0x7f0000000380)=""/70, 0x46, 0x1, 0x1f}}, &(0x7f0000000500)={0x0, 0x28, 0x40}}, 0x1000}], 0x14, 0x0, &(0x7f0000000680)="86621f50fcee8bdc5bf8c503a78812261b4bf6d7"}) [ 2626.046999] binder: 15923:15938 transaction failed 29189/-22, size 80-24 line 3014 18:07:36 executing program 3: r0 = socket(0x10, 0x3, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") ioctl$sock_ifreq(r0, 0x89f3, &(0x7f0000000240)={'sit0\x00'}) [ 2626.047562] binder: undelivered TRANSACTION_ERROR: 29189 [ 2626.200710] binder: 15991:16003 Release 1 refcount change on invalid ref 2 ret -22 [ 2626.200720] binder: 15991:16003 BC_ACQUIRE_DONE u0000000000000000 no match 18:07:36 executing program 1: clone(0x2102001fff, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) socket(0x0, 0x0, 0x0) r0 = getpid() rt_tgsigqueueinfo(0x0, r0, 0x16, &(0x7f0000000100)) rt_sigqueueinfo(r0, 0x7, &(0x7f0000000180)={0x0, 0x0, 0xffffffff}) 18:07:36 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000006c0)={0x118, 0x0, &(0x7f0000000540)=[@release={0x40046306, 0x2}, @acquire_done, @acquire_done={0x40106309, 0x3}, @transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x50, 0x18, &(0x7f0000000080)={@flat=@binder={0x73622a85, 0xa, 0x1}, @fda={0x66646185, 0xa, 0x1, 0x9}, @fd={0x66642a85, 0x0, r1}}, &(0x7f0000000100)={0x0, 0x18, 0x38}}, 0x1000}, @transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000180)={@ptr={0x70742a85, 0x0, &(0x7f0000000140)=""/51, 0x33, 0x2, 0x25}, @flat=@weak_handle={0x77682a85, 0x1}, @flat=@binder={0x73622a85, 0xa, 0x3}}, &(0x7f0000000280)={0x0, 0x28, 0x40}}, 0x1f8aed83e3349436}, @exit_looper, @transaction_sg={0x40486311, {0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x68, 0x18, &(0x7f0000000480)={@ptr={0x70742a85, 0x0, &(0x7f00000002c0)=""/11, 0xb, 0x2, 0x3f}, @fd={0x66642a85, 0x0, r0}, @ptr={0x70742a85, 0x0, &(0x7f0000000380)=""/70, 0x46, 0x1, 0x1f}}, &(0x7f0000000500)={0x0, 0x28, 0x40}}, 0x1000}], 0x14, 0x0, &(0x7f0000000680)="86621f50fcee8bdc5bf8c503a78812261b4bf6d7"}) [ 2626.200729] binder: 15991:16003 BC_ACQUIRE_DONE u0000000000000003 no match 18:07:36 executing program 2: ioctl$FS_IOC_RESVSP(0xffffffffffffffff, 0x40305828, &(0x7f00000000c0)={0x0, 0x0, 0x100000000000001}) clone(0x2102001fff, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) socket(0x0, 0x0, 0x0) r0 = getpid() rt_tgsigqueueinfo(0x0, r0, 0x16, &(0x7f0000000100)) ptrace(0x10, r0) ptrace$poke(0x4209, r0, &(0x7f00000000c0), 0x70effd) 18:07:36 executing program 4: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000040)='/dev/net/tun\x00', 0x0, 0x0) r1 = epoll_create1(0x0) epoll_ctl$EPOLL_CTL_ADD(0xffffffffffffffff, 0x1, r0, &(0x7f0000000100)) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000080)={'tunl0\x00', 0x1}) epoll_wait(r1, &(0x7f00000000c0)=[{}], 0x1, 0x0) 18:07:36 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000006c0)={0x118, 0x0, &(0x7f0000000540)=[@release={0x40046306, 0x2}, @acquire_done, @acquire_done={0x40106309, 0x3}, @transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x50, 0x18, &(0x7f0000000080)={@flat=@binder={0x73622a85, 0xa, 0x1}, @fda={0x66646185, 0xa, 0x1, 0x9}, @fd={0x66642a85, 0x0, r1}}, &(0x7f0000000100)={0x0, 0x18, 0x38}}, 0x1000}, @transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000180)={@ptr={0x70742a85, 0x0, &(0x7f0000000140)=""/51, 0x33, 0x2, 0x25}, @flat=@weak_handle={0x77682a85, 0x1}, @flat=@binder={0x73622a85, 0xa, 0x3}}, &(0x7f0000000280)={0x0, 0x28, 0x40}}, 0x1f8aed83e3349436}, @exit_looper, @transaction_sg={0x40486311, {0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x68, 0x18, &(0x7f0000000480)={@ptr={0x70742a85, 0x0, &(0x7f00000002c0)=""/11, 0xb, 0x2, 0x3f}, @fd={0x66642a85, 0x0, r0}, @ptr={0x70742a85, 0x0, &(0x7f0000000380)=""/70, 0x46, 0x1, 0x1f}}, &(0x7f0000000500)={0x0, 0x28, 0x40}}, 0x1000}], 0x14, 0x0, &(0x7f0000000680)="86621f50fcee8bdc5bf8c503a78812261b4bf6d7"}) 18:07:36 executing program 3: r0 = socket(0x10, 0x3, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") ioctl$sock_ifreq(r0, 0x89f3, &(0x7f0000000240)={'sit0\x00'}) [ 2626.200742] binder: 15991:16003 transaction failed 29189/-22, size 80-24 line 3014 [ 2626.203257] binder: undelivered TRANSACTION_ERROR: 29189 18:07:36 executing program 5: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000001a00)='/dev/net/tun\x00', 0x0, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000080)="c0dc00025e0b01047be070") ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000300)={'nr0\x01\x00', 0x1132}) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000001a00)='/dev/net/tun\x00', 0x2, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000300)={'nr0\x01\x00', 0x1132}) write$cgroup_int(0xffffffffffffffff, &(0x7f00000000c0)=0x2, 0xfffffffffffffe75) close(r1) 18:07:36 executing program 3: r0 = socket(0x10, 0x3, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") ioctl$sock_ifreq(r0, 0x89f3, &(0x7f0000000240)={'sit0\x00'}) [ 2626.311692] binder: 16024:16047 Release 1 refcount change on invalid ref 2 ret -22 18:07:36 executing program 4: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000040)='/dev/net/tun\x00', 0x0, 0x0) r1 = epoll_create1(0x0) epoll_ctl$EPOLL_CTL_ADD(0xffffffffffffffff, 0x1, r0, &(0x7f0000000100)) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000080)={'tunl0\x00', 0x1}) epoll_wait(r1, &(0x7f00000000c0)=[{}], 0x1, 0x0) 18:07:36 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000006c0)={0x118, 0x0, &(0x7f0000000540)=[@release={0x40046306, 0x2}, @acquire_done, @acquire_done={0x40106309, 0x3}, @transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x50, 0x18, &(0x7f0000000080)={@flat=@binder={0x73622a85, 0xa, 0x1}, @fda={0x66646185, 0xa, 0x1, 0x9}, @fd={0x66642a85, 0x0, r1}}, &(0x7f0000000100)={0x0, 0x18, 0x38}}, 0x1000}, @transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000180)={@ptr={0x70742a85, 0x0, &(0x7f0000000140)=""/51, 0x33, 0x2, 0x25}, @flat=@weak_handle={0x77682a85, 0x1}, @flat=@binder={0x73622a85, 0xa, 0x3}}, &(0x7f0000000280)={0x0, 0x28, 0x40}}, 0x1f8aed83e3349436}, @exit_looper, @transaction_sg={0x40486311, {0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x68, 0x18, &(0x7f0000000480)={@ptr={0x70742a85, 0x0, &(0x7f00000002c0)=""/11, 0xb, 0x2, 0x3f}, @fd={0x66642a85, 0x0, r0}, @ptr={0x70742a85, 0x0, &(0x7f0000000380)=""/70, 0x46, 0x1, 0x1f}}, &(0x7f0000000500)={0x0, 0x28, 0x40}}, 0x1000}], 0x14, 0x0, &(0x7f0000000680)="86621f50fcee8bdc5bf8c503a78812261b4bf6d7"}) [ 2626.311702] binder: 16024:16047 BC_ACQUIRE_DONE u0000000000000000 no match 18:07:36 executing program 3: r0 = socket(0x10, 0x3, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") ioctl$sock_ifreq(r0, 0x89f3, &(0x7f0000000240)={'sit0\x00'}) 18:07:36 executing program 1: clone(0x2102001fff, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) socket(0x0, 0x0, 0x0) r0 = getpid() rt_tgsigqueueinfo(0x0, r0, 0x16, &(0x7f0000000100)) rt_sigqueueinfo(r0, 0x7, &(0x7f0000000180)={0x0, 0x0, 0xffffffff}) 18:07:36 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000006c0)={0x118, 0x0, &(0x7f0000000540)=[@release={0x40046306, 0x2}, @acquire_done, @acquire_done={0x40106309, 0x3}, @transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x50, 0x18, &(0x7f0000000080)={@flat=@binder={0x73622a85, 0xa, 0x1}, @fda={0x66646185, 0xa, 0x1, 0x9}, @fd={0x66642a85, 0x0, r1}}, &(0x7f0000000100)={0x0, 0x18, 0x38}}, 0x1000}, @transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000180)={@ptr={0x70742a85, 0x0, &(0x7f0000000140)=""/51, 0x33, 0x2, 0x25}, @flat=@weak_handle={0x77682a85, 0x1}, @flat=@binder={0x73622a85, 0xa, 0x3}}, &(0x7f0000000280)={0x0, 0x28, 0x40}}, 0x1f8aed83e3349436}, @exit_looper, @transaction_sg={0x40486311, {0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x68, 0x18, &(0x7f0000000480)={@ptr={0x70742a85, 0x0, &(0x7f00000002c0)=""/11, 0xb, 0x2, 0x3f}, @fd={0x66642a85, 0x0, r0}, @ptr={0x70742a85, 0x0, &(0x7f0000000380)=""/70, 0x46, 0x1, 0x1f}}, &(0x7f0000000500)={0x0, 0x28, 0x40}}, 0x1000}], 0x14, 0x0, &(0x7f0000000680)="86621f50fcee8bdc5bf8c503a78812261b4bf6d7"}) [ 2626.311709] binder: 16024:16047 BC_ACQUIRE_DONE u0000000000000003 no match [ 2626.311722] binder: 16024:16047 transaction failed 29189/-22, size 80-24 line 3014 18:07:36 executing program 2: ioctl$FS_IOC_RESVSP(0xffffffffffffffff, 0x40305828, &(0x7f00000000c0)={0x0, 0x0, 0x100000000000001}) clone(0x2102001fff, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) socket(0x0, 0x0, 0x0) r0 = getpid() rt_tgsigqueueinfo(0x0, r0, 0x16, &(0x7f0000000100)) ptrace(0x10, r0) ptrace$poke(0x4209, r0, &(0x7f00000000c0), 0x70effd) 18:07:36 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000006c0)={0x118, 0x0, &(0x7f0000000540)=[@release={0x40046306, 0x2}, @acquire_done, @acquire_done={0x40106309, 0x3}, @transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x50, 0x18, &(0x7f0000000080)={@flat=@binder={0x73622a85, 0xa, 0x1}, @fda={0x66646185, 0xa, 0x1, 0x9}, @fd={0x66642a85, 0x0, r1}}, &(0x7f0000000100)={0x0, 0x18, 0x38}}, 0x1000}, @transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000180)={@ptr={0x70742a85, 0x0, &(0x7f0000000140)=""/51, 0x33, 0x2, 0x25}, @flat=@weak_handle={0x77682a85, 0x1}, @flat=@binder={0x73622a85, 0xa, 0x3}}, &(0x7f0000000280)={0x0, 0x28, 0x40}}, 0x1f8aed83e3349436}, @exit_looper, @transaction_sg={0x40486311, {0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x68, 0x18, &(0x7f0000000480)={@ptr={0x70742a85, 0x0, &(0x7f00000002c0)=""/11, 0xb, 0x2, 0x3f}, @fd={0x66642a85, 0x0, r0}, @ptr={0x70742a85, 0x0, &(0x7f0000000380)=""/70, 0x46, 0x1, 0x1f}}, &(0x7f0000000500)={0x0, 0x28, 0x40}}, 0x1000}], 0x14, 0x0, &(0x7f0000000680)="86621f50fcee8bdc5bf8c503a78812261b4bf6d7"}) 18:07:36 executing program 3: r0 = socket(0x10, 0x3, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") ioctl$sock_ifreq(r0, 0x89f3, &(0x7f0000000240)={'sit0\x00'}) [ 2626.312112] binder: undelivered TRANSACTION_ERROR: 29189 [ 2626.426677] binder: 16070:16084 Release 1 refcount change on invalid ref 2 ret -22 [ 2626.426687] binder: 16070:16084 BC_ACQUIRE_DONE u0000000000000000 no match 18:07:36 executing program 1: clone(0x2102001fff, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) socket(0x0, 0x0, 0x0) r0 = getpid() rt_tgsigqueueinfo(0x0, r0, 0x16, &(0x7f0000000100)) rt_sigqueueinfo(r0, 0x7, &(0x7f0000000180)={0x0, 0x0, 0xffffffff}) [ 2626.426695] binder: 16070:16084 BC_ACQUIRE_DONE u0000000000000003 no match [ 2626.426707] binder: 16070:16084 transaction failed 29189/-22, size 80-24 line 3014 18:07:37 executing program 5: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000001a00)='/dev/net/tun\x00', 0x0, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000080)="c0dc00025e0b01047be070") ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000300)={'nr0\x01\x00', 0x1132}) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000001a00)='/dev/net/tun\x00', 0x2, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000300)={'nr0\x01\x00', 0x1132}) write$cgroup_int(0xffffffffffffffff, &(0x7f00000000c0)=0x2, 0xfffffffffffffe75) close(r1) 18:07:37 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000006c0)={0x118, 0x0, &(0x7f0000000540)=[@release={0x40046306, 0x2}, @acquire_done, @acquire_done={0x40106309, 0x3}, @transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x50, 0x18, &(0x7f0000000080)={@flat=@binder={0x73622a85, 0xa, 0x1}, @fda={0x66646185, 0xa, 0x1, 0x9}, @fd={0x66642a85, 0x0, r1}}, &(0x7f0000000100)={0x0, 0x18, 0x38}}, 0x1000}, @transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000180)={@ptr={0x70742a85, 0x0, &(0x7f0000000140)=""/51, 0x33, 0x2, 0x25}, @flat=@weak_handle={0x77682a85, 0x1}, @flat=@binder={0x73622a85, 0xa, 0x3}}, &(0x7f0000000280)={0x0, 0x28, 0x40}}, 0x1f8aed83e3349436}, @exit_looper, @transaction_sg={0x40486311, {0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x68, 0x18, &(0x7f0000000480)={@ptr={0x70742a85, 0x0, &(0x7f00000002c0)=""/11, 0xb, 0x2, 0x3f}, @fd={0x66642a85, 0x0, r0}, @ptr={0x70742a85, 0x0, &(0x7f0000000380)=""/70, 0x46, 0x1, 0x1f}}, &(0x7f0000000500)={0x0, 0x28, 0x40}}, 0x1000}], 0x14, 0x0, &(0x7f0000000680)="86621f50fcee8bdc5bf8c503a78812261b4bf6d7"}) 18:07:37 executing program 3: r0 = socket(0x10, 0x3, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") ioctl$sock_ifreq(r0, 0x89f3, &(0x7f0000000240)={'sit0\x00'}) [ 2626.431449] binder: undelivered TRANSACTION_ERROR: 29189 [ 2626.537743] binder: 16126:16140 Release 1 refcount change on invalid ref 2 ret -22 18:07:37 executing program 4: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000040)='/dev/net/tun\x00', 0x0, 0x0) r1 = epoll_create1(0x0) epoll_ctl$EPOLL_CTL_ADD(0xffffffffffffffff, 0x1, r0, &(0x7f0000000100)) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000080)={'tunl0\x00', 0x1}) epoll_wait(r1, &(0x7f00000000c0)=[{}], 0x1, 0x0) 18:07:37 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000006c0)={0x118, 0x0, &(0x7f0000000540)=[@release={0x40046306, 0x2}, @acquire_done, @acquire_done={0x40106309, 0x3}, @transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x50, 0x18, &(0x7f0000000080)={@flat=@binder={0x73622a85, 0xa, 0x1}, @fda={0x66646185, 0xa, 0x1, 0x9}, @fd={0x66642a85, 0x0, r1}}, &(0x7f0000000100)={0x0, 0x18, 0x38}}, 0x1000}, @transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000180)={@ptr={0x70742a85, 0x0, &(0x7f0000000140)=""/51, 0x33, 0x2, 0x25}, @flat=@weak_handle={0x77682a85, 0x1}, @flat=@binder={0x73622a85, 0xa, 0x3}}, &(0x7f0000000280)={0x0, 0x28, 0x40}}, 0x1f8aed83e3349436}, @exit_looper, @transaction_sg={0x40486311, {0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x68, 0x18, &(0x7f0000000480)={@ptr={0x70742a85, 0x0, &(0x7f00000002c0)=""/11, 0xb, 0x2, 0x3f}, @fd={0x66642a85, 0x0, r0}, @ptr={0x70742a85, 0x0, &(0x7f0000000380)=""/70, 0x46, 0x1, 0x1f}}, &(0x7f0000000500)={0x0, 0x28, 0x40}}, 0x1000}], 0x14, 0x0, &(0x7f0000000680)="86621f50fcee8bdc5bf8c503a78812261b4bf6d7"}) 18:07:37 executing program 1: clone(0x2102001fff, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) socket(0x0, 0x0, 0x0) r0 = getpid() rt_tgsigqueueinfo(0x0, r0, 0x16, &(0x7f0000000100)) rt_sigqueueinfo(r0, 0x7, &(0x7f0000000180)={0x0, 0x0, 0xffffffff}) 18:07:37 executing program 3: r0 = socket(0x10, 0x3, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") ioctl$sock_ifreq(r0, 0x89f3, &(0x7f0000000240)={'sit0\x00'}) 18:07:37 executing program 2: ioctl$FS_IOC_RESVSP(0xffffffffffffffff, 0x40305828, &(0x7f00000000c0)={0x0, 0x0, 0x100000000000001}) clone(0x2102001fff, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) socket(0x0, 0x0, 0x0) r0 = getpid() rt_tgsigqueueinfo(0x0, r0, 0x16, &(0x7f0000000100)) ptrace(0x10, r0) ptrace$poke(0x4209, r0, &(0x7f00000000c0), 0x70effd) [ 2626.537754] binder: 16126:16140 BC_ACQUIRE_DONE u0000000000000000 no match [ 2626.537762] binder: 16126:16140 BC_ACQUIRE_DONE u0000000000000003 no match 18:07:37 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000006c0)={0x118, 0x0, &(0x7f0000000540)=[@release={0x40046306, 0x2}, @acquire_done, @acquire_done={0x40106309, 0x3}, @transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x50, 0x18, &(0x7f0000000080)={@flat=@binder={0x73622a85, 0xa, 0x1}, @fda={0x66646185, 0xa, 0x1, 0x9}, @fd={0x66642a85, 0x0, r1}}, &(0x7f0000000100)={0x0, 0x18, 0x38}}, 0x1000}, @transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000180)={@ptr={0x70742a85, 0x0, &(0x7f0000000140)=""/51, 0x33, 0x2, 0x25}, @flat=@weak_handle={0x77682a85, 0x1}, @flat=@binder={0x73622a85, 0xa, 0x3}}, &(0x7f0000000280)={0x0, 0x28, 0x40}}, 0x1f8aed83e3349436}, @exit_looper, @transaction_sg={0x40486311, {0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x68, 0x18, &(0x7f0000000480)={@ptr={0x70742a85, 0x0, &(0x7f00000002c0)=""/11, 0xb, 0x2, 0x3f}, @fd={0x66642a85, 0x0, r0}, @ptr={0x70742a85, 0x0, &(0x7f0000000380)=""/70, 0x46, 0x1, 0x1f}}, &(0x7f0000000500)={0x0, 0x28, 0x40}}, 0x1000}], 0x14, 0x0, &(0x7f0000000680)="86621f50fcee8bdc5bf8c503a78812261b4bf6d7"}) [ 2626.537775] binder: 16126:16140 transaction failed 29189/-22, size 80-24 line 3014 18:07:37 executing program 3: r0 = socket(0x10, 0x3, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") ioctl$sock_ifreq(r0, 0x89f3, &(0x7f0000000240)={'sit0\x00'}) 18:07:37 executing program 1: clone(0x2102001fff, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) socket(0x0, 0x0, 0x0) r0 = getpid() rt_tgsigqueueinfo(0x0, r0, 0x16, &(0x7f0000000100)) rt_sigqueueinfo(r0, 0x7, &(0x7f0000000180)={0x0, 0x0, 0xffffffff}) [ 2626.538269] binder: undelivered TRANSACTION_ERROR: 29189 18:07:37 executing program 5: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000001a00)='/dev/net/tun\x00', 0x0, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000080)="c0dc00025e0b01047be070") ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000300)={'nr0\x01\x00', 0x1132}) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000001a00)='/dev/net/tun\x00', 0x2, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000300)={'nr0\x01\x00', 0x1132}) write$cgroup_int(0xffffffffffffffff, &(0x7f00000000c0)=0x2, 0xfffffffffffffe75) close(r1) [ 2626.646795] binder: 16191:16198 Release 1 refcount change on invalid ref 2 ret -22 18:07:37 executing program 3: r0 = socket(0x10, 0x3, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") ioctl$sock_ifreq(r0, 0x89f3, &(0x7f0000000240)={'sit0\x00'}) 18:07:37 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000006c0)={0x118, 0x0, &(0x7f0000000540)=[@release={0x40046306, 0x2}, @acquire_done, @acquire_done={0x40106309, 0x3}, @transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x50, 0x18, &(0x7f0000000080)={@flat=@binder={0x73622a85, 0xa, 0x1}, @fda={0x66646185, 0xa, 0x1, 0x9}, @fd={0x66642a85, 0x0, r1}}, &(0x7f0000000100)={0x0, 0x18, 0x38}}, 0x1000}, @transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000180)={@ptr={0x70742a85, 0x0, &(0x7f0000000140)=""/51, 0x33, 0x2, 0x25}, @flat=@weak_handle={0x77682a85, 0x1}, @flat=@binder={0x73622a85, 0xa, 0x3}}, &(0x7f0000000280)={0x0, 0x28, 0x40}}, 0x1f8aed83e3349436}, @exit_looper, @transaction_sg={0x40486311, {0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x68, 0x18, &(0x7f0000000480)={@ptr={0x70742a85, 0x0, &(0x7f00000002c0)=""/11, 0xb, 0x2, 0x3f}, @fd={0x66642a85, 0x0, r0}, @ptr={0x70742a85, 0x0, &(0x7f0000000380)=""/70, 0x46, 0x1, 0x1f}}, &(0x7f0000000500)={0x0, 0x28, 0x40}}, 0x1000}], 0x14, 0x0, &(0x7f0000000680)="86621f50fcee8bdc5bf8c503a78812261b4bf6d7"}) 18:07:37 executing program 4: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000040)='/dev/net/tun\x00', 0x0, 0x0) r1 = epoll_create1(0x0) epoll_ctl$EPOLL_CTL_ADD(0xffffffffffffffff, 0x1, r0, &(0x7f0000000100)) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000080)={'tunl0\x00', 0x1}) epoll_wait(r1, &(0x7f00000000c0)=[{}], 0x1, 0x0) 18:07:37 executing program 1: clone(0x2102001fff, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) socket(0x0, 0x0, 0x0) r0 = getpid() rt_tgsigqueueinfo(0x0, r0, 0x16, &(0x7f0000000100)) rt_sigqueueinfo(r0, 0x7, &(0x7f0000000180)={0x0, 0x0, 0xffffffff}) [ 2626.646805] binder: 16191:16198 BC_ACQUIRE_DONE u0000000000000000 no match 18:07:37 executing program 2: ioctl$FS_IOC_RESVSP(0xffffffffffffffff, 0x40305828, &(0x7f00000000c0)={0x0, 0x0, 0x100000000000001}) clone(0x2102001fff, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) socket(0x0, 0x0, 0x0) r0 = getpid() rt_tgsigqueueinfo(0x0, r0, 0x16, &(0x7f0000000100)) ptrace(0x10, r0) ptrace$poke(0x4209, r0, &(0x7f00000000c0), 0x70effd) 18:07:37 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000006c0)={0x118, 0x0, &(0x7f0000000540)=[@release={0x40046306, 0x2}, @acquire_done, @acquire_done={0x40106309, 0x3}, @transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x50, 0x18, &(0x7f0000000080)={@flat=@binder={0x73622a85, 0xa, 0x1}, @fda={0x66646185, 0xa, 0x1, 0x9}, @fd={0x66642a85, 0x0, r1}}, &(0x7f0000000100)={0x0, 0x18, 0x38}}, 0x1000}, @transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000180)={@ptr={0x70742a85, 0x0, &(0x7f0000000140)=""/51, 0x33, 0x2, 0x25}, @flat=@weak_handle={0x77682a85, 0x1}, @flat=@binder={0x73622a85, 0xa, 0x3}}, &(0x7f0000000280)={0x0, 0x28, 0x40}}, 0x1f8aed83e3349436}, @exit_looper, @transaction_sg={0x40486311, {0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x68, 0x18, &(0x7f0000000480)={@ptr={0x70742a85, 0x0, &(0x7f00000002c0)=""/11, 0xb, 0x2, 0x3f}, @fd={0x66642a85, 0x0, r0}, @ptr={0x70742a85, 0x0, &(0x7f0000000380)=""/70, 0x46, 0x1, 0x1f}}, &(0x7f0000000500)={0x0, 0x28, 0x40}}, 0x1000}], 0x14, 0x0, &(0x7f0000000680)="86621f50fcee8bdc5bf8c503a78812261b4bf6d7"}) [ 2626.646821] binder: 16191:16198 BC_ACQUIRE_DONE u0000000000000003 no match [ 2626.646896] binder: 16191:16198 transaction failed 29189/-22, size 80-24 line 3014 [ 2626.654011] binder: undelivered TRANSACTION_ERROR: 29189 18:07:37 executing program 3: r0 = socket(0x10, 0x3, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") ioctl$sock_ifreq(r0, 0x89f3, &(0x7f0000000240)={'sit0\x00'}) 18:07:37 executing program 4: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000040)='/dev/net/tun\x00', 0x0, 0x0) r1 = epoll_create1(0x0) epoll_ctl$EPOLL_CTL_ADD(0xffffffffffffffff, 0x1, r0, &(0x7f0000000100)) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000080)={'tunl0\x00', 0x1}) epoll_wait(r1, &(0x7f00000000c0)=[{}], 0x1, 0x0) [ 2626.762955] binder: 16228:16229 Release 1 refcount change on invalid ref 2 ret -22 18:07:37 executing program 1: clone(0x2102001fff, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) socket(0x0, 0x0, 0x0) r0 = getpid() rt_tgsigqueueinfo(0x0, r0, 0x16, &(0x7f0000000100)) rt_sigqueueinfo(r0, 0x7, &(0x7f0000000180)={0x0, 0x0, 0xffffffff}) 18:07:37 executing program 3: r0 = socket(0x10, 0x3, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") ioctl$sock_ifreq(r0, 0x89f3, &(0x7f0000000240)={'sit0\x00'}) 18:07:37 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000006c0)={0x118, 0x0, &(0x7f0000000540)=[@release={0x40046306, 0x2}, @acquire_done, @acquire_done={0x40106309, 0x3}, @transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x50, 0x18, &(0x7f0000000080)={@flat=@binder={0x73622a85, 0xa, 0x1}, @fda={0x66646185, 0xa, 0x1, 0x9}, @fd={0x66642a85, 0x0, r1}}, &(0x7f0000000100)={0x0, 0x18, 0x38}}, 0x1000}, @transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000180)={@ptr={0x70742a85, 0x0, &(0x7f0000000140)=""/51, 0x33, 0x2, 0x25}, @flat=@weak_handle={0x77682a85, 0x1}, @flat=@binder={0x73622a85, 0xa, 0x3}}, &(0x7f0000000280)={0x0, 0x28, 0x40}}, 0x1f8aed83e3349436}, @exit_looper, @transaction_sg={0x40486311, {0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x68, 0x18, &(0x7f0000000480)={@ptr={0x70742a85, 0x0, &(0x7f00000002c0)=""/11, 0xb, 0x2, 0x3f}, @fd={0x66642a85, 0x0, r0}, @ptr={0x70742a85, 0x0, &(0x7f0000000380)=""/70, 0x46, 0x1, 0x1f}}, &(0x7f0000000500)={0x0, 0x28, 0x40}}, 0x1000}], 0x14, 0x0, &(0x7f0000000680)="86621f50fcee8bdc5bf8c503a78812261b4bf6d7"}) [ 2626.762965] binder: 16228:16229 BC_ACQUIRE_DONE u0000000000000000 no match [ 2626.762973] binder: 16228:16229 BC_ACQUIRE_DONE u0000000000000003 no match 18:07:37 executing program 5: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000001a00)='/dev/net/tun\x00', 0x0, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000080)="c0dc00025e0b01047be070") ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000300)={'nr0\x01\x00', 0x1132}) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000001a00)='/dev/net/tun\x00', 0x2, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000300)={'nr0\x01\x00', 0x1132}) write$cgroup_int(0xffffffffffffffff, &(0x7f00000000c0)=0x2, 0xfffffffffffffe75) close(r1) 18:07:37 executing program 3: r0 = socket(0x10, 0x3, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") ioctl$sock_ifreq(r0, 0x89f3, &(0x7f0000000240)={'sit0\x00'}) [ 2626.762987] binder: 16228:16229 transaction failed 29189/-22, size 80-24 line 3014 18:07:37 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000006c0)={0x118, 0x0, &(0x7f0000000540)=[@release={0x40046306, 0x2}, @acquire_done, @acquire_done={0x40106309, 0x3}, @transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x50, 0x18, &(0x7f0000000080)={@flat=@binder={0x73622a85, 0xa, 0x1}, @fda={0x66646185, 0xa, 0x1, 0x9}, @fd={0x66642a85, 0x0, r1}}, &(0x7f0000000100)={0x0, 0x18, 0x38}}, 0x1000}, @transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000180)={@ptr={0x70742a85, 0x0, &(0x7f0000000140)=""/51, 0x33, 0x2, 0x25}, @flat=@weak_handle={0x77682a85, 0x1}, @flat=@binder={0x73622a85, 0xa, 0x3}}, &(0x7f0000000280)={0x0, 0x28, 0x40}}, 0x1f8aed83e3349436}, @exit_looper, @transaction_sg={0x40486311, {0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x68, 0x18, &(0x7f0000000480)={@ptr={0x70742a85, 0x0, &(0x7f00000002c0)=""/11, 0xb, 0x2, 0x3f}, @fd={0x66642a85, 0x0, r0}, @ptr={0x70742a85, 0x0, &(0x7f0000000380)=""/70, 0x46, 0x1, 0x1f}}, &(0x7f0000000500)={0x0, 0x28, 0x40}}, 0x1000}], 0x14, 0x0, &(0x7f0000000680)="86621f50fcee8bdc5bf8c503a78812261b4bf6d7"}) 18:07:37 executing program 1: clone(0x2102001fff, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) socket(0x0, 0x0, 0x0) r0 = getpid() rt_tgsigqueueinfo(0x0, r0, 0x16, &(0x7f0000000100)) rt_sigqueueinfo(r0, 0x7, &(0x7f0000000180)={0x0, 0x0, 0xffffffff}) 18:07:37 executing program 4: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000040)='/dev/net/tun\x00', 0x0, 0x0) r1 = epoll_create1(0x0) epoll_ctl$EPOLL_CTL_ADD(0xffffffffffffffff, 0x1, r0, &(0x7f0000000100)) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000080)={'tunl0\x00', 0x1}) epoll_wait(r1, &(0x7f00000000c0)=[{}], 0x1, 0x0) 18:07:37 executing program 2: ioctl$FS_IOC_RESVSP(0xffffffffffffffff, 0x40305828, &(0x7f00000000c0)={0x0, 0x0, 0x100000000000001}) clone(0x2102001fff, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) socket(0x0, 0x0, 0x0) r0 = getpid() rt_tgsigqueueinfo(0x0, r0, 0x16, &(0x7f0000000100)) ptrace(0x10, r0) ptrace$poke(0x4209, r0, &(0x7f00000000c0), 0x70effd) [ 2626.766184] binder: undelivered TRANSACTION_ERROR: 29189 [ 2626.841375] binder: 16268:16284 Release 1 refcount change on invalid ref 2 ret -22 18:07:37 executing program 3: r0 = socket(0x10, 0x3, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") ioctl$sock_ifreq(r0, 0x89f3, &(0x7f0000000240)={'sit0\x00'}) 18:07:37 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000006c0)={0x118, 0x0, &(0x7f0000000540)=[@release={0x40046306, 0x2}, @acquire_done, @acquire_done={0x40106309, 0x3}, @transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x50, 0x18, &(0x7f0000000080)={@flat=@binder={0x73622a85, 0xa, 0x1}, @fda={0x66646185, 0xa, 0x1, 0x9}, @fd={0x66642a85, 0x0, r1}}, &(0x7f0000000100)={0x0, 0x18, 0x38}}, 0x1000}, @transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000180)={@ptr={0x70742a85, 0x0, &(0x7f0000000140)=""/51, 0x33, 0x2, 0x25}, @flat=@weak_handle={0x77682a85, 0x1}, @flat=@binder={0x73622a85, 0xa, 0x3}}, &(0x7f0000000280)={0x0, 0x28, 0x40}}, 0x1f8aed83e3349436}, @exit_looper, @transaction_sg={0x40486311, {0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x68, 0x18, &(0x7f0000000480)={@ptr={0x70742a85, 0x0, &(0x7f00000002c0)=""/11, 0xb, 0x2, 0x3f}, @fd={0x66642a85, 0x0, r0}, @ptr={0x70742a85, 0x0, &(0x7f0000000380)=""/70, 0x46, 0x1, 0x1f}}, &(0x7f0000000500)={0x0, 0x28, 0x40}}, 0x1000}], 0x14, 0x0, &(0x7f0000000680)="86621f50fcee8bdc5bf8c503a78812261b4bf6d7"}) [ 2626.841384] binder: 16268:16284 BC_ACQUIRE_DONE u0000000000000000 no match 18:07:37 executing program 1: clone(0x2102001fff, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) socket(0x0, 0x0, 0x0) r0 = getpid() rt_tgsigqueueinfo(0x0, r0, 0x16, &(0x7f0000000100)) rt_sigqueueinfo(r0, 0x7, &(0x7f0000000180)={0x0, 0x0, 0xffffffff}) [ 2626.841392] binder: 16268:16284 BC_ACQUIRE_DONE u0000000000000003 no match 18:07:38 executing program 3: r0 = socket(0x10, 0x3, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") ioctl$sock_ifreq(r0, 0x89f3, &(0x7f0000000240)={'sit0\x00'}) 18:07:38 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000006c0)={0x118, 0x0, &(0x7f0000000540)=[@release={0x40046306, 0x2}, @acquire_done, @acquire_done={0x40106309, 0x3}, @transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x50, 0x18, &(0x7f0000000080)={@flat=@binder={0x73622a85, 0xa, 0x1}, @fda={0x66646185, 0xa, 0x1, 0x9}, @fd={0x66642a85, 0x0, r1}}, &(0x7f0000000100)={0x0, 0x18, 0x38}}, 0x1000}, @transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000180)={@ptr={0x70742a85, 0x0, &(0x7f0000000140)=""/51, 0x33, 0x2, 0x25}, @flat=@weak_handle={0x77682a85, 0x1}, @flat=@binder={0x73622a85, 0xa, 0x3}}, &(0x7f0000000280)={0x0, 0x28, 0x40}}, 0x1f8aed83e3349436}, @exit_looper, @transaction_sg={0x40486311, {0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x68, 0x18, &(0x7f0000000480)={@ptr={0x70742a85, 0x0, &(0x7f00000002c0)=""/11, 0xb, 0x2, 0x3f}, @fd={0x66642a85, 0x0, r0}, @ptr={0x70742a85, 0x0, &(0x7f0000000380)=""/70, 0x46, 0x1, 0x1f}}, &(0x7f0000000500)={0x0, 0x28, 0x40}}, 0x1000}], 0x14, 0x0, &(0x7f0000000680)="86621f50fcee8bdc5bf8c503a78812261b4bf6d7"}) [ 2626.841405] binder: 16268:16284 transaction failed 29189/-22, size 80-24 line 3014 18:07:38 executing program 2: ioctl$FS_IOC_RESVSP(0xffffffffffffffff, 0x40305828, &(0x7f00000000c0)={0x0, 0x0, 0x100000000000001}) clone(0x2102001fff, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) socket(0x0, 0x0, 0x0) r0 = getpid() rt_tgsigqueueinfo(0x0, r0, 0x16, &(0x7f0000000100)) ptrace(0x10, r0) ptrace$poke(0x4209, r0, &(0x7f00000000c0), 0x70effd) [ 2626.842172] binder: undelivered TRANSACTION_ERROR: 29189 [ 2627.022663] binder: 16323:16350 Release 1 refcount change on invalid ref 2 ret -22 [ 2627.022672] binder: 16323:16350 BC_ACQUIRE_DONE u0000000000000000 no match 18:07:38 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000006c0)={0x118, 0x0, &(0x7f0000000540)=[@release={0x40046306, 0x2}, @acquire_done, @acquire_done={0x40106309, 0x3}, @transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x50, 0x18, &(0x7f0000000080)={@flat=@binder={0x73622a85, 0xa, 0x1}, @fda={0x66646185, 0xa, 0x1, 0x9}, @fd={0x66642a85, 0x0, r1}}, &(0x7f0000000100)={0x0, 0x18, 0x38}}, 0x1000}, @transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000180)={@ptr={0x70742a85, 0x0, &(0x7f0000000140)=""/51, 0x33, 0x2, 0x25}, @flat=@weak_handle={0x77682a85, 0x1}, @flat=@binder={0x73622a85, 0xa, 0x3}}, &(0x7f0000000280)={0x0, 0x28, 0x40}}, 0x1f8aed83e3349436}, @exit_looper, @transaction_sg={0x40486311, {0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x68, 0x18, &(0x7f0000000480)={@ptr={0x70742a85, 0x0, &(0x7f00000002c0)=""/11, 0xb, 0x2, 0x3f}, @fd={0x66642a85, 0x0, r0}, @ptr={0x70742a85, 0x0, &(0x7f0000000380)=""/70, 0x46, 0x1, 0x1f}}, &(0x7f0000000500)={0x0, 0x28, 0x40}}, 0x1000}], 0x14, 0x0, &(0x7f0000000680)="86621f50fcee8bdc5bf8c503a78812261b4bf6d7"}) 18:07:38 executing program 3: r0 = socket(0x10, 0x3, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") ioctl$sock_ifreq(r0, 0x89f3, &(0x7f0000000240)={'sit0\x00'}) 18:07:38 executing program 5: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000001a00)='/dev/net/tun\x00', 0x0, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000080)="c0dc00025e0b01047be070") ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000300)={'nr0\x01\x00', 0x1132}) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000001a00)='/dev/net/tun\x00', 0x2, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000300)={'nr0\x01\x00', 0x1132}) write$cgroup_int(0xffffffffffffffff, &(0x7f00000000c0)=0x2, 0xfffffffffffffe75) close(r1) 18:07:38 executing program 4: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000040)='/dev/net/tun\x00', 0x0, 0x0) r1 = epoll_create1(0x0) epoll_ctl$EPOLL_CTL_ADD(0xffffffffffffffff, 0x1, r0, &(0x7f0000000100)) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000080)={'tunl0\x00', 0x1}) epoll_wait(r1, &(0x7f00000000c0)=[{}], 0x1, 0x0) [ 2627.022680] binder: 16323:16350 BC_ACQUIRE_DONE u0000000000000003 no match 18:07:38 executing program 1: clone(0x2102001fff, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) socket(0x0, 0x0, 0x0) r0 = getpid() rt_tgsigqueueinfo(0x0, r0, 0x16, &(0x7f0000000100)) rt_sigqueueinfo(r0, 0x7, &(0x7f0000000180)={0x0, 0x0, 0xffffffff}) [ 2627.022692] binder: 16323:16350 transaction failed 29189/-22, size 80-24 line 3014 [ 2627.022985] binder: undelivered TRANSACTION_ERROR: 29189 18:07:38 executing program 3: r0 = socket(0x10, 0x3, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") ioctl$sock_ifreq(r0, 0x89f3, &(0x7f0000000240)={'sit0\x00'}) 18:07:38 executing program 2: ioctl$FS_IOC_RESVSP(0xffffffffffffffff, 0x40305828, &(0x7f00000000c0)={0x0, 0x0, 0x100000000000001}) clone(0x2102001fff, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) socket(0x0, 0x0, 0x0) r0 = getpid() rt_tgsigqueueinfo(0x0, r0, 0x16, &(0x7f0000000100)) ptrace(0x10, r0) ptrace$poke(0x4209, r0, &(0x7f00000000c0), 0x70effd) 18:07:38 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000006c0)={0x118, 0x0, &(0x7f0000000540)=[@release={0x40046306, 0x2}, @acquire_done, @acquire_done={0x40106309, 0x3}, @transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x50, 0x18, &(0x7f0000000080)={@flat=@binder={0x73622a85, 0xa, 0x1}, @fda={0x66646185, 0xa, 0x1, 0x9}, @fd={0x66642a85, 0x0, r1}}, &(0x7f0000000100)={0x0, 0x18, 0x38}}, 0x1000}, @transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000180)={@ptr={0x70742a85, 0x0, &(0x7f0000000140)=""/51, 0x33, 0x2, 0x25}, @flat=@weak_handle={0x77682a85, 0x1}, @flat=@binder={0x73622a85, 0xa, 0x3}}, &(0x7f0000000280)={0x0, 0x28, 0x40}}, 0x1f8aed83e3349436}, @exit_looper, @transaction_sg={0x40486311, {0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x68, 0x18, &(0x7f0000000480)={@ptr={0x70742a85, 0x0, &(0x7f00000002c0)=""/11, 0xb, 0x2, 0x3f}, @fd={0x66642a85, 0x0, r0}, @ptr={0x70742a85, 0x0, &(0x7f0000000380)=""/70, 0x46, 0x1, 0x1f}}, &(0x7f0000000500)={0x0, 0x28, 0x40}}, 0x1000}], 0x14, 0x0, &(0x7f0000000680)="86621f50fcee8bdc5bf8c503a78812261b4bf6d7"}) [ 2627.090724] binder: 16372:16374 Release 1 refcount change on invalid ref 2 ret -22 [ 2627.090734] binder: 16372:16374 BC_ACQUIRE_DONE u0000000000000000 no match 18:07:38 executing program 3: r0 = socket(0x10, 0x3, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") ioctl$sock_ifreq(r0, 0x89f3, &(0x7f0000000240)={'sit0\x00'}) 18:07:38 executing program 4: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000040)='/dev/net/tun\x00', 0x0, 0x0) r1 = epoll_create1(0x0) epoll_ctl$EPOLL_CTL_ADD(0xffffffffffffffff, 0x1, r0, &(0x7f0000000100)) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000080)={'tunl0\x00', 0x1}) epoll_wait(r1, &(0x7f00000000c0)=[{}], 0x1, 0x0) [ 2627.090742] binder: 16372:16374 BC_ACQUIRE_DONE u0000000000000003 no match 18:07:38 executing program 1: clone(0x2102001fff, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) socket(0x0, 0x0, 0x0) r0 = getpid() rt_tgsigqueueinfo(0x0, r0, 0x16, &(0x7f0000000100)) rt_sigqueueinfo(r0, 0x7, &(0x7f0000000180)={0x0, 0x0, 0xffffffff}) 18:07:38 executing program 5: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000001a00)='/dev/net/tun\x00', 0x0, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000080)="c0dc00025e0b01047be070") ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000300)={'nr0\x01\x00', 0x1132}) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000001a00)='/dev/net/tun\x00', 0x2, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000300)={'nr0\x01\x00', 0x1132}) write$cgroup_int(0xffffffffffffffff, &(0x7f00000000c0)=0x2, 0xfffffffffffffe75) close(r1) 18:07:38 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000006c0)={0x118, 0x0, &(0x7f0000000540)=[@release={0x40046306, 0x2}, @acquire_done, @acquire_done={0x40106309, 0x3}, @transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x50, 0x18, &(0x7f0000000080)={@flat=@binder={0x73622a85, 0xa, 0x1}, @fda={0x66646185, 0xa, 0x1, 0x9}, @fd={0x66642a85, 0x0, r1}}, &(0x7f0000000100)={0x0, 0x18, 0x38}}, 0x1000}, @transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000180)={@ptr={0x70742a85, 0x0, &(0x7f0000000140)=""/51, 0x33, 0x2, 0x25}, @flat=@weak_handle={0x77682a85, 0x1}, @flat=@binder={0x73622a85, 0xa, 0x3}}, &(0x7f0000000280)={0x0, 0x28, 0x40}}, 0x1f8aed83e3349436}, @exit_looper, @transaction_sg={0x40486311, {0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x68, 0x18, &(0x7f0000000480)={@ptr={0x70742a85, 0x0, &(0x7f00000002c0)=""/11, 0xb, 0x2, 0x3f}, @fd={0x66642a85, 0x0, r0}, @ptr={0x70742a85, 0x0, &(0x7f0000000380)=""/70, 0x46, 0x1, 0x1f}}, &(0x7f0000000500)={0x0, 0x28, 0x40}}, 0x1000}], 0x14, 0x0, &(0x7f0000000680)="86621f50fcee8bdc5bf8c503a78812261b4bf6d7"}) 18:07:38 executing program 3: r0 = socket(0x10, 0x3, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") ioctl$sock_ifreq(r0, 0x89f3, &(0x7f0000000240)={'sit0\x00'}) [ 2627.090754] binder: 16372:16374 transaction failed 29189/-22, size 80-24 line 3014 [ 2627.091237] binder: undelivered TRANSACTION_ERROR: 29189 [ 2627.194804] binder: 16423:16424 Release 1 refcount change on invalid ref 2 ret -22 18:07:38 executing program 1: clone(0x2102001fff, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) socket(0x0, 0x0, 0x0) r0 = getpid() rt_tgsigqueueinfo(0x0, r0, 0x16, &(0x7f0000000100)) rt_sigqueueinfo(r0, 0x7, &(0x7f0000000180)={0x0, 0x0, 0xffffffff}) [ 2627.194815] binder: 16423:16424 BC_ACQUIRE_DONE u0000000000000000 no match 18:07:38 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000006c0)={0x118, 0x0, &(0x7f0000000540)=[@release={0x40046306, 0x2}, @acquire_done, @acquire_done={0x40106309, 0x3}, @transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x50, 0x18, &(0x7f0000000080)={@flat=@binder={0x73622a85, 0xa, 0x1}, @fda={0x66646185, 0xa, 0x1, 0x9}, @fd={0x66642a85, 0x0, r1}}, &(0x7f0000000100)={0x0, 0x18, 0x38}}, 0x1000}, @transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000180)={@ptr={0x70742a85, 0x0, &(0x7f0000000140)=""/51, 0x33, 0x2, 0x25}, @flat=@weak_handle={0x77682a85, 0x1}, @flat=@binder={0x73622a85, 0xa, 0x3}}, &(0x7f0000000280)={0x0, 0x28, 0x40}}, 0x1f8aed83e3349436}, @exit_looper, @transaction_sg={0x40486311, {0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x68, 0x18, &(0x7f0000000480)={@ptr={0x70742a85, 0x0, &(0x7f00000002c0)=""/11, 0xb, 0x2, 0x3f}, @fd={0x66642a85, 0x0, r0}, @ptr={0x70742a85, 0x0, &(0x7f0000000380)=""/70, 0x46, 0x1, 0x1f}}, &(0x7f0000000500)={0x0, 0x28, 0x40}}, 0x1000}], 0x14, 0x0, &(0x7f0000000680)="86621f50fcee8bdc5bf8c503a78812261b4bf6d7"}) 18:07:38 executing program 3: r0 = socket(0x10, 0x3, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") ioctl$sock_ifreq(r0, 0x89f3, &(0x7f0000000240)={'sit0\x00'}) [ 2627.194823] binder: 16423:16424 BC_ACQUIRE_DONE u0000000000000003 no match [ 2627.194835] binder: 16423:16424 transaction failed 29189/-22, size 80-24 line 3014 18:07:38 executing program 2: ioctl$FS_IOC_RESVSP(0xffffffffffffffff, 0x40305828, &(0x7f00000000c0)={0x0, 0x0, 0x100000000000001}) clone(0x2102001fff, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) socket(0x0, 0x0, 0x0) r0 = getpid() rt_tgsigqueueinfo(0x0, r0, 0x16, &(0x7f0000000100)) ptrace(0x10, r0) ptrace$poke(0x4209, r0, &(0x7f00000000c0), 0x70effd) 18:07:38 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000006c0)={0x118, 0x0, &(0x7f0000000540)=[@release={0x40046306, 0x2}, @acquire_done, @acquire_done={0x40106309, 0x3}, @transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x50, 0x18, &(0x7f0000000080)={@flat=@binder={0x73622a85, 0xa, 0x1}, @fda={0x66646185, 0xa, 0x1, 0x9}, @fd={0x66642a85, 0x0, r1}}, &(0x7f0000000100)={0x0, 0x18, 0x38}}, 0x1000}, @transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000180)={@ptr={0x70742a85, 0x0, &(0x7f0000000140)=""/51, 0x33, 0x2, 0x25}, @flat=@weak_handle={0x77682a85, 0x1}, @flat=@binder={0x73622a85, 0xa, 0x3}}, &(0x7f0000000280)={0x0, 0x28, 0x40}}, 0x1f8aed83e3349436}, @exit_looper, @transaction_sg={0x40486311, {0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x68, 0x18, &(0x7f0000000480)={@ptr={0x70742a85, 0x0, &(0x7f00000002c0)=""/11, 0xb, 0x2, 0x3f}, @fd={0x66642a85, 0x0, r0}, @ptr={0x70742a85, 0x0, &(0x7f0000000380)=""/70, 0x46, 0x1, 0x1f}}, &(0x7f0000000500)={0x0, 0x28, 0x40}}, 0x1000}], 0x14, 0x0, &(0x7f0000000680)="86621f50fcee8bdc5bf8c503a78812261b4bf6d7"}) 18:07:38 executing program 3: r0 = socket(0x10, 0x3, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") ioctl$sock_ifreq(r0, 0x89f3, &(0x7f0000000240)={'sit0\x00'}) 18:07:38 executing program 1: clone(0x2102001fff, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) socket(0x0, 0x0, 0x0) r0 = getpid() rt_tgsigqueueinfo(0x0, r0, 0x16, &(0x7f0000000100)) rt_sigqueueinfo(r0, 0x7, &(0x7f0000000180)={0x0, 0x0, 0xffffffff}) [ 2627.195144] binder: undelivered TRANSACTION_ERROR: 29189 [ 2627.415594] binder: 16465:16500 Release 1 refcount change on invalid ref 2 ret -22 18:07:38 executing program 4: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000040)='/dev/net/tun\x00', 0x0, 0x0) r1 = epoll_create1(0x0) epoll_ctl$EPOLL_CTL_ADD(0xffffffffffffffff, 0x1, r0, &(0x7f0000000100)) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000080)={'tunl0\x00', 0x1}) epoll_wait(r1, &(0x7f00000000c0)=[{}], 0x1, 0x0) 18:07:38 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000006c0)={0x118, 0x0, &(0x7f0000000540)=[@release={0x40046306, 0x2}, @acquire_done, @acquire_done={0x40106309, 0x3}, @transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x50, 0x18, &(0x7f0000000080)={@flat=@binder={0x73622a85, 0xa, 0x1}, @fda={0x66646185, 0xa, 0x1, 0x9}, @fd={0x66642a85, 0x0, r1}}, &(0x7f0000000100)={0x0, 0x18, 0x38}}, 0x1000}, @transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000180)={@ptr={0x70742a85, 0x0, &(0x7f0000000140)=""/51, 0x33, 0x2, 0x25}, @flat=@weak_handle={0x77682a85, 0x1}, @flat=@binder={0x73622a85, 0xa, 0x3}}, &(0x7f0000000280)={0x0, 0x28, 0x40}}, 0x1f8aed83e3349436}, @exit_looper, @transaction_sg={0x40486311, {0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x68, 0x18, &(0x7f0000000480)={@ptr={0x70742a85, 0x0, &(0x7f00000002c0)=""/11, 0xb, 0x2, 0x3f}, @fd={0x66642a85, 0x0, r0}, @ptr={0x70742a85, 0x0, &(0x7f0000000380)=""/70, 0x46, 0x1, 0x1f}}, &(0x7f0000000500)={0x0, 0x28, 0x40}}, 0x1000}], 0x14, 0x0, &(0x7f0000000680)="86621f50fcee8bdc5bf8c503a78812261b4bf6d7"}) [ 2627.415604] binder: 16465:16500 BC_ACQUIRE_DONE u0000000000000000 no match [ 2627.415611] binder: 16465:16500 BC_ACQUIRE_DONE u0000000000000003 no match 18:07:38 executing program 5: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000001a00)='/dev/net/tun\x00', 0x0, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000080)="c0dc00025e0b01047be070") ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000300)={'nr0\x01\x00', 0x1132}) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000001a00)='/dev/net/tun\x00', 0x2, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000300)={'nr0\x01\x00', 0x1132}) write$cgroup_int(0xffffffffffffffff, &(0x7f00000000c0)=0x2, 0xfffffffffffffe75) close(r1) 18:07:38 executing program 3: r0 = socket(0x10, 0x3, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") ioctl$sock_ifreq(r0, 0x89f3, &(0x7f0000000240)={'sit0\x00'}) 18:07:38 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000006c0)={0x118, 0x0, &(0x7f0000000540)=[@release={0x40046306, 0x2}, @acquire_done, @acquire_done={0x40106309, 0x3}, @transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x50, 0x18, &(0x7f0000000080)={@flat=@binder={0x73622a85, 0xa, 0x1}, @fda={0x66646185, 0xa, 0x1, 0x9}, @fd={0x66642a85, 0x0, r1}}, &(0x7f0000000100)={0x0, 0x18, 0x38}}, 0x1000}, @transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000180)={@ptr={0x70742a85, 0x0, &(0x7f0000000140)=""/51, 0x33, 0x2, 0x25}, @flat=@weak_handle={0x77682a85, 0x1}, @flat=@binder={0x73622a85, 0xa, 0x3}}, &(0x7f0000000280)={0x0, 0x28, 0x40}}, 0x1f8aed83e3349436}, @exit_looper, @transaction_sg={0x40486311, {0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x68, 0x18, &(0x7f0000000480)={@ptr={0x70742a85, 0x0, &(0x7f00000002c0)=""/11, 0xb, 0x2, 0x3f}, @fd={0x66642a85, 0x0, r0}, @ptr={0x70742a85, 0x0, &(0x7f0000000380)=""/70, 0x46, 0x1, 0x1f}}, &(0x7f0000000500)={0x0, 0x28, 0x40}}, 0x1000}], 0x14, 0x0, &(0x7f0000000680)="86621f50fcee8bdc5bf8c503a78812261b4bf6d7"}) 18:07:38 executing program 2: ioctl$FS_IOC_RESVSP(0xffffffffffffffff, 0x40305828, &(0x7f00000000c0)={0x0, 0x0, 0x100000000000001}) clone(0x2102001fff, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) socket(0x0, 0x0, 0x0) r0 = getpid() rt_tgsigqueueinfo(0x0, r0, 0x16, &(0x7f0000000100)) ptrace(0x10, r0) ptrace$poke(0x4209, r0, &(0x7f00000000c0), 0x70effd) 18:07:38 executing program 1: clone(0x2102001fff, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) socket(0x0, 0x0, 0x0) r0 = getpid() rt_tgsigqueueinfo(0x0, r0, 0x16, &(0x7f0000000100)) rt_sigqueueinfo(r0, 0x7, &(0x7f0000000180)={0x0, 0x0, 0xffffffff}) [ 2627.415624] binder: 16465:16500 transaction failed 29189/-22, size 80-24 line 3014 [ 2627.415867] binder: undelivered TRANSACTION_ERROR: 29189 [ 2627.567081] binder: 16531:16565 Release 1 refcount change on invalid ref 2 ret -22 18:07:39 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000006c0)={0x118, 0x0, &(0x7f0000000540)=[@release={0x40046306, 0x2}, @acquire_done, @acquire_done={0x40106309, 0x3}, @transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x50, 0x18, &(0x7f0000000080)={@flat=@binder={0x73622a85, 0xa, 0x1}, @fda={0x66646185, 0xa, 0x1, 0x9}, @fd={0x66642a85, 0x0, r1}}, &(0x7f0000000100)={0x0, 0x18, 0x38}}, 0x1000}, @transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000180)={@ptr={0x70742a85, 0x0, &(0x7f0000000140)=""/51, 0x33, 0x2, 0x25}, @flat=@weak_handle={0x77682a85, 0x1}, @flat=@binder={0x73622a85, 0xa, 0x3}}, &(0x7f0000000280)={0x0, 0x28, 0x40}}, 0x1f8aed83e3349436}, @exit_looper, @transaction_sg={0x40486311, {0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x68, 0x18, &(0x7f0000000480)={@ptr={0x70742a85, 0x0, &(0x7f00000002c0)=""/11, 0xb, 0x2, 0x3f}, @fd={0x66642a85, 0x0, r0}, @ptr={0x70742a85, 0x0, &(0x7f0000000380)=""/70, 0x46, 0x1, 0x1f}}, &(0x7f0000000500)={0x0, 0x28, 0x40}}, 0x1000}], 0x14, 0x0, &(0x7f0000000680)="86621f50fcee8bdc5bf8c503a78812261b4bf6d7"}) 18:07:39 executing program 3: r0 = socket(0x10, 0x3, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") ioctl$sock_ifreq(r0, 0x89f3, &(0x7f0000000240)={'sit0\x00'}) 18:07:39 executing program 1: clone(0x2102001fff, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) socket(0x0, 0x0, 0x0) r0 = getpid() rt_tgsigqueueinfo(0x0, r0, 0x16, &(0x7f0000000100)) rt_sigqueueinfo(r0, 0x7, &(0x7f0000000180)={0x0, 0x0, 0xffffffff}) [ 2627.567091] binder: 16531:16565 BC_ACQUIRE_DONE u0000000000000000 no match [ 2627.567099] binder: 16531:16565 BC_ACQUIRE_DONE u0000000000000003 no match 18:07:39 executing program 4: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000040)='/dev/net/tun\x00', 0x0, 0x0) r1 = epoll_create1(0x0) epoll_ctl$EPOLL_CTL_ADD(0xffffffffffffffff, 0x1, r0, &(0x7f0000000100)) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000080)={'tunl0\x00', 0x1}) epoll_wait(r1, &(0x7f00000000c0)=[{}], 0x1, 0x0) 18:07:39 executing program 3: r0 = socket(0x10, 0x3, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") ioctl$sock_ifreq(r0, 0x89f3, &(0x7f0000000240)={'sit0\x00'}) [ 2627.567112] binder: 16531:16565 transaction failed 29189/-22, size 80-24 line 3014 18:07:39 executing program 3: r0 = socket(0x10, 0x3, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") ioctl$sock_ifreq(r0, 0x89f3, &(0x7f0000000240)={'sit0\x00'}) 18:07:39 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000006c0)={0x118, 0x0, &(0x7f0000000540)=[@release={0x40046306, 0x2}, @acquire_done, @acquire_done={0x40106309, 0x3}, @transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x50, 0x18, &(0x7f0000000080)={@flat=@binder={0x73622a85, 0xa, 0x1}, @fda={0x66646185, 0xa, 0x1, 0x9}, @fd={0x66642a85, 0x0, r1}}, &(0x7f0000000100)={0x0, 0x18, 0x38}}, 0x1000}, @transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000180)={@ptr={0x70742a85, 0x0, &(0x7f0000000140)=""/51, 0x33, 0x2, 0x25}, @flat=@weak_handle={0x77682a85, 0x1}, @flat=@binder={0x73622a85, 0xa, 0x3}}, &(0x7f0000000280)={0x0, 0x28, 0x40}}, 0x1f8aed83e3349436}, @exit_looper, @transaction_sg={0x40486311, {0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x68, 0x18, &(0x7f0000000480)={@ptr={0x70742a85, 0x0, &(0x7f00000002c0)=""/11, 0xb, 0x2, 0x3f}, @fd={0x66642a85, 0x0, r0}, @ptr={0x70742a85, 0x0, &(0x7f0000000380)=""/70, 0x46, 0x1, 0x1f}}, &(0x7f0000000500)={0x0, 0x28, 0x40}}, 0x1000}], 0x14, 0x0, &(0x7f0000000680)="86621f50fcee8bdc5bf8c503a78812261b4bf6d7"}) [ 2627.567405] binder: undelivered TRANSACTION_ERROR: 29189 18:07:39 executing program 5: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000001a00)='/dev/net/tun\x00', 0x0, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000080)="c0dc00025e0b01047be070") ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000300)={'nr0\x01\x00', 0x1132}) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000001a00)='/dev/net/tun\x00', 0x2, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000300)={'nr0\x01\x00', 0x1132}) write$cgroup_int(0xffffffffffffffff, &(0x7f00000000c0)=0x2, 0xfffffffffffffe75) close(r1) 18:07:39 executing program 2: ioctl$FS_IOC_RESVSP(0xffffffffffffffff, 0x40305828, &(0x7f00000000c0)={0x0, 0x0, 0x100000000000001}) clone(0x2102001fff, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) socket(0x0, 0x0, 0x0) r0 = getpid() rt_tgsigqueueinfo(0x0, r0, 0x16, &(0x7f0000000100)) ptrace(0x10, r0) ptrace$poke(0x4209, r0, &(0x7f00000000c0), 0x70effd) 18:07:39 executing program 3: r0 = socket(0x10, 0x3, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") ioctl$sock_ifreq(r0, 0x89f3, &(0x7f0000000240)={'sit0\x00'}) [ 2627.705193] binder: 16595:16596 Release 1 refcount change on invalid ref 2 ret -22 18:07:39 executing program 1: clone(0x2102001fff, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) socket(0x0, 0x0, 0x0) r0 = getpid() rt_tgsigqueueinfo(0x0, r0, 0x16, &(0x7f0000000100)) rt_sigqueueinfo(r0, 0x7, &(0x7f0000000180)={0x0, 0x0, 0xffffffff}) 18:07:39 executing program 4: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000040)='/dev/net/tun\x00', 0x0, 0x0) r1 = epoll_create1(0x0) epoll_ctl$EPOLL_CTL_ADD(0xffffffffffffffff, 0x1, r0, &(0x7f0000000100)) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000080)={'tunl0\x00', 0x1}) epoll_wait(r1, &(0x7f00000000c0)=[{}], 0x1, 0x0) 18:07:39 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000006c0)={0x118, 0x0, &(0x7f0000000540)=[@release={0x40046306, 0x2}, @acquire_done, @acquire_done={0x40106309, 0x3}, @transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x50, 0x18, &(0x7f0000000080)={@flat=@binder={0x73622a85, 0xa, 0x1}, @fda={0x66646185, 0xa, 0x1, 0x9}, @fd={0x66642a85, 0x0, r1}}, &(0x7f0000000100)={0x0, 0x18, 0x38}}, 0x1000}, @transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000180)={@ptr={0x70742a85, 0x0, &(0x7f0000000140)=""/51, 0x33, 0x2, 0x25}, @flat=@weak_handle={0x77682a85, 0x1}, @flat=@binder={0x73622a85, 0xa, 0x3}}, &(0x7f0000000280)={0x0, 0x28, 0x40}}, 0x1f8aed83e3349436}, @exit_looper, @transaction_sg={0x40486311, {0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x68, 0x18, &(0x7f0000000480)={@ptr={0x70742a85, 0x0, &(0x7f00000002c0)=""/11, 0xb, 0x2, 0x3f}, @fd={0x66642a85, 0x0, r0}, @ptr={0x70742a85, 0x0, &(0x7f0000000380)=""/70, 0x46, 0x1, 0x1f}}, &(0x7f0000000500)={0x0, 0x28, 0x40}}, 0x1000}], 0x14, 0x0, &(0x7f0000000680)="86621f50fcee8bdc5bf8c503a78812261b4bf6d7"}) [ 2627.705204] binder: 16595:16596 BC_ACQUIRE_DONE u0000000000000000 no match [ 2627.705212] binder: 16595:16596 BC_ACQUIRE_DONE u0000000000000003 no match 18:07:39 executing program 1: clone(0x2102001fff, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) socket(0x0, 0x0, 0x0) r0 = getpid() rt_tgsigqueueinfo(0x0, r0, 0x16, &(0x7f0000000100)) rt_sigqueueinfo(r0, 0x7, &(0x7f0000000180)={0x0, 0x0, 0xffffffff}) 18:07:39 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000006c0)={0x118, 0x0, &(0x7f0000000540)=[@release={0x40046306, 0x2}, @acquire_done, @acquire_done={0x40106309, 0x3}, @transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x50, 0x18, &(0x7f0000000080)={@flat=@binder={0x73622a85, 0xa, 0x1}, @fda={0x66646185, 0xa, 0x1, 0x9}, @fd={0x66642a85, 0x0, r1}}, &(0x7f0000000100)={0x0, 0x18, 0x38}}, 0x1000}, @transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000180)={@ptr={0x70742a85, 0x0, &(0x7f0000000140)=""/51, 0x33, 0x2, 0x25}, @flat=@weak_handle={0x77682a85, 0x1}, @flat=@binder={0x73622a85, 0xa, 0x3}}, &(0x7f0000000280)={0x0, 0x28, 0x40}}, 0x1f8aed83e3349436}, @exit_looper, @transaction_sg={0x40486311, {0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x68, 0x18, &(0x7f0000000480)={@ptr={0x70742a85, 0x0, &(0x7f00000002c0)=""/11, 0xb, 0x2, 0x3f}, @fd={0x66642a85, 0x0, r0}, @ptr={0x70742a85, 0x0, &(0x7f0000000380)=""/70, 0x46, 0x1, 0x1f}}, &(0x7f0000000500)={0x0, 0x28, 0x40}}, 0x1000}], 0x14, 0x0, &(0x7f0000000680)="86621f50fcee8bdc5bf8c503a78812261b4bf6d7"}) 18:07:39 executing program 3: r0 = socket(0x10, 0x3, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") ioctl$sock_ifreq(r0, 0x89f3, &(0x7f0000000240)={'sit0\x00'}) [ 2627.705225] binder: 16595:16596 transaction failed 29189/-22, size 80-24 line 3014 [ 2627.705492] binder: undelivered TRANSACTION_ERROR: 29189 [ 2627.964432] binder: 16678:16694 Release 1 refcount change on invalid ref 2 ret -22 [ 2627.964444] binder: 16678:16694 BC_ACQUIRE_DONE u0000000000000000 no match 18:07:39 executing program 3: r0 = socket(0x10, 0x3, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") ioctl$sock_ifreq(r0, 0x89f3, &(0x7f0000000240)={'sit0\x00'}) 18:07:39 executing program 4: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000040)='/dev/net/tun\x00', 0x0, 0x0) r1 = epoll_create1(0x0) epoll_ctl$EPOLL_CTL_ADD(0xffffffffffffffff, 0x1, r0, &(0x7f0000000100)) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000080)={'tunl0\x00', 0x1}) epoll_wait(r1, &(0x7f00000000c0)=[{}], 0x1, 0x0) 18:07:39 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000006c0)={0x118, 0x0, &(0x7f0000000540)=[@release={0x40046306, 0x2}, @acquire_done, @acquire_done={0x40106309, 0x3}, @transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x50, 0x18, &(0x7f0000000080)={@flat=@binder={0x73622a85, 0xa, 0x1}, @fda={0x66646185, 0xa, 0x1, 0x9}, @fd={0x66642a85, 0x0, r1}}, &(0x7f0000000100)={0x0, 0x18, 0x38}}, 0x1000}, @transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000180)={@ptr={0x70742a85, 0x0, &(0x7f0000000140)=""/51, 0x33, 0x2, 0x25}, @flat=@weak_handle={0x77682a85, 0x1}, @flat=@binder={0x73622a85, 0xa, 0x3}}, &(0x7f0000000280)={0x0, 0x28, 0x40}}, 0x1f8aed83e3349436}, @exit_looper, @transaction_sg={0x40486311, {0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x68, 0x18, &(0x7f0000000480)={@ptr={0x70742a85, 0x0, &(0x7f00000002c0)=""/11, 0xb, 0x2, 0x3f}, @fd={0x66642a85, 0x0, r0}, @ptr={0x70742a85, 0x0, &(0x7f0000000380)=""/70, 0x46, 0x1, 0x1f}}, &(0x7f0000000500)={0x0, 0x28, 0x40}}, 0x1000}], 0x14, 0x0, &(0x7f0000000680)="86621f50fcee8bdc5bf8c503a78812261b4bf6d7"}) [ 2627.964452] binder: 16678:16694 BC_ACQUIRE_DONE u0000000000000003 no match [ 2627.964465] binder: 16678:16694 transaction failed 29189/-22, size 80-24 line 3014 [ 2627.964749] binder: undelivered TRANSACTION_ERROR: 29189 18:07:39 executing program 5: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000001a00)='/dev/net/tun\x00', 0x0, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000080)="c0dc00025e0b01047be070") ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000300)={'nr0\x01\x00', 0x1132}) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000001a00)='/dev/net/tun\x00', 0x2, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000300)={'nr0\x01\x00', 0x1132}) write$cgroup_int(0xffffffffffffffff, &(0x7f00000000c0)=0x2, 0xfffffffffffffe75) close(r1) 18:07:39 executing program 2: ioctl$FS_IOC_RESVSP(0xffffffffffffffff, 0x40305828, &(0x7f00000000c0)={0x0, 0x0, 0x100000000000001}) clone(0x2102001fff, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) socket(0x0, 0x0, 0x0) r0 = getpid() rt_tgsigqueueinfo(0x0, r0, 0x16, &(0x7f0000000100)) ptrace(0x10, r0) ptrace$poke(0x4209, r0, &(0x7f00000000c0), 0x70effd) 18:07:39 executing program 1: clone(0x2102001fff, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) socket(0x0, 0x0, 0x0) r0 = getpid() rt_tgsigqueueinfo(0x0, r0, 0x16, &(0x7f0000000100)) rt_sigqueueinfo(r0, 0x7, &(0x7f0000000180)={0x0, 0x0, 0xffffffff}) [ 2628.109434] binder: 16743:16744 Release 1 refcount change on invalid ref 2 ret -22 [ 2628.109443] binder: 16743:16744 BC_ACQUIRE_DONE u0000000000000000 no match 18:07:39 executing program 3: r0 = socket(0x10, 0x3, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") ioctl$sock_ifreq(r0, 0x89f3, &(0x7f0000000240)={'sit0\x00'}) 18:07:39 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000006c0)={0x118, 0x0, &(0x7f0000000540)=[@release={0x40046306, 0x2}, @acquire_done, @acquire_done={0x40106309, 0x3}, @transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x50, 0x18, &(0x7f0000000080)={@flat=@binder={0x73622a85, 0xa, 0x1}, @fda={0x66646185, 0xa, 0x1, 0x9}, @fd={0x66642a85, 0x0, r1}}, &(0x7f0000000100)={0x0, 0x18, 0x38}}, 0x1000}, @transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000180)={@ptr={0x70742a85, 0x0, &(0x7f0000000140)=""/51, 0x33, 0x2, 0x25}, @flat=@weak_handle={0x77682a85, 0x1}, @flat=@binder={0x73622a85, 0xa, 0x3}}, &(0x7f0000000280)={0x0, 0x28, 0x40}}, 0x1f8aed83e3349436}, @exit_looper, @transaction_sg={0x40486311, {0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x68, 0x18, &(0x7f0000000480)={@ptr={0x70742a85, 0x0, &(0x7f00000002c0)=""/11, 0xb, 0x2, 0x3f}, @fd={0x66642a85, 0x0, r0}, @ptr={0x70742a85, 0x0, &(0x7f0000000380)=""/70, 0x46, 0x1, 0x1f}}, &(0x7f0000000500)={0x0, 0x28, 0x40}}, 0x1000}], 0x14, 0x0, &(0x7f0000000680)="86621f50fcee8bdc5bf8c503a78812261b4bf6d7"}) 18:07:39 executing program 3: r0 = socket(0x10, 0x3, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") ioctl$sock_ifreq(r0, 0x89f3, &(0x7f0000000240)={'sit0\x00'}) 18:07:39 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000006c0)={0x118, 0x0, &(0x7f0000000540)=[@release={0x40046306, 0x2}, @acquire_done, @acquire_done={0x40106309, 0x3}, @transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x50, 0x18, &(0x7f0000000080)={@flat=@binder={0x73622a85, 0xa, 0x1}, @fda={0x66646185, 0xa, 0x1, 0x9}, @fd={0x66642a85, 0x0, r1}}, &(0x7f0000000100)={0x0, 0x18, 0x38}}, 0x1000}, @transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000180)={@ptr={0x70742a85, 0x0, &(0x7f0000000140)=""/51, 0x33, 0x2, 0x25}, @flat=@weak_handle={0x77682a85, 0x1}, @flat=@binder={0x73622a85, 0xa, 0x3}}, &(0x7f0000000280)={0x0, 0x28, 0x40}}, 0x1f8aed83e3349436}, @exit_looper, @transaction_sg={0x40486311, {0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x68, 0x18, &(0x7f0000000480)={@ptr={0x70742a85, 0x0, &(0x7f00000002c0)=""/11, 0xb, 0x2, 0x3f}, @fd={0x66642a85, 0x0, r0}, @ptr={0x70742a85, 0x0, &(0x7f0000000380)=""/70, 0x46, 0x1, 0x1f}}, &(0x7f0000000500)={0x0, 0x28, 0x40}}, 0x1000}], 0x14, 0x0, &(0x7f0000000680)="86621f50fcee8bdc5bf8c503a78812261b4bf6d7"}) [ 2628.109450] binder: 16743:16744 BC_ACQUIRE_DONE u0000000000000003 no match [ 2628.109462] binder: 16743:16744 transaction failed 29189/-22, size 80-24 line 3014 18:07:39 executing program 4: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000040)='/dev/net/tun\x00', 0x0, 0x0) r1 = epoll_create1(0x0) epoll_ctl$EPOLL_CTL_ADD(0xffffffffffffffff, 0x1, r0, &(0x7f0000000100)) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000080)={'tunl0\x00', 0x1}) epoll_wait(r1, &(0x7f00000000c0)=[{}], 0x1, 0x0) 18:07:39 executing program 3: r0 = socket(0x10, 0x3, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") ioctl$sock_ifreq(r0, 0x89f3, &(0x7f0000000240)={'sit0\x00'}) [ 2628.110585] binder: undelivered TRANSACTION_ERROR: 29189 [ 2628.178922] binder: 16773:16787 Release 1 refcount change on invalid ref 2 ret -22 18:07:39 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000006c0)={0x118, 0x0, &(0x7f0000000540)=[@release={0x40046306, 0x2}, @acquire_done, @acquire_done={0x40106309, 0x3}, @transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x50, 0x18, &(0x7f0000000080)={@flat=@binder={0x73622a85, 0xa, 0x1}, @fda={0x66646185, 0xa, 0x1, 0x9}, @fd={0x66642a85, 0x0, r1}}, &(0x7f0000000100)={0x0, 0x18, 0x38}}, 0x1000}, @transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000180)={@ptr={0x70742a85, 0x0, &(0x7f0000000140)=""/51, 0x33, 0x2, 0x25}, @flat=@weak_handle={0x77682a85, 0x1}, @flat=@binder={0x73622a85, 0xa, 0x3}}, &(0x7f0000000280)={0x0, 0x28, 0x40}}, 0x1f8aed83e3349436}, @exit_looper, @transaction_sg={0x40486311, {0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x68, 0x18, &(0x7f0000000480)={@ptr={0x70742a85, 0x0, &(0x7f00000002c0)=""/11, 0xb, 0x2, 0x3f}, @fd={0x66642a85, 0x0, r0}, @ptr={0x70742a85, 0x0, &(0x7f0000000380)=""/70, 0x46, 0x1, 0x1f}}, &(0x7f0000000500)={0x0, 0x28, 0x40}}, 0x1000}], 0x14, 0x0, &(0x7f0000000680)="86621f50fcee8bdc5bf8c503a78812261b4bf6d7"}) 18:07:39 executing program 2: ioctl$FS_IOC_RESVSP(0xffffffffffffffff, 0x40305828, &(0x7f00000000c0)={0x0, 0x0, 0x100000000000001}) clone(0x2102001fff, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) socket(0x0, 0x0, 0x0) r0 = getpid() rt_tgsigqueueinfo(0x0, r0, 0x16, &(0x7f0000000100)) ptrace(0x10, r0) ptrace$poke(0x4209, r0, &(0x7f00000000c0), 0x70effd) 18:07:39 executing program 1: clone(0x2102001fff, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) socket(0x0, 0x0, 0x0) r0 = getpid() rt_tgsigqueueinfo(0x0, r0, 0x16, &(0x7f0000000100)) rt_sigqueueinfo(r0, 0x7, &(0x7f0000000180)={0x0, 0x0, 0xffffffff}) [ 2628.178932] binder: 16773:16787 BC_ACQUIRE_DONE u0000000000000000 no match 18:07:39 executing program 5: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000001a00)='/dev/net/tun\x00', 0x0, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000080)="c0dc00025e0b01047be070") ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000300)={'nr0\x01\x00', 0x1132}) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000001a00)='/dev/net/tun\x00', 0x2, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000300)={'nr0\x01\x00', 0x1132}) write$cgroup_int(0xffffffffffffffff, &(0x7f00000000c0)=0x2, 0xfffffffffffffe75) close(r1) 18:07:39 executing program 3: r0 = socket(0x10, 0x3, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") ioctl$sock_ifreq(r0, 0x89f3, &(0x7f0000000240)={'sit0\x00'}) [ 2628.178940] binder: 16773:16787 BC_ACQUIRE_DONE u0000000000000003 no match 18:07:40 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000006c0)={0x118, 0x0, &(0x7f0000000540)=[@release={0x40046306, 0x2}, @acquire_done, @acquire_done={0x40106309, 0x3}, @transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x50, 0x18, &(0x7f0000000080)={@flat=@binder={0x73622a85, 0xa, 0x1}, @fda={0x66646185, 0xa, 0x1, 0x9}, @fd={0x66642a85, 0x0, r1}}, &(0x7f0000000100)={0x0, 0x18, 0x38}}, 0x1000}, @transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000180)={@ptr={0x70742a85, 0x0, &(0x7f0000000140)=""/51, 0x33, 0x2, 0x25}, @flat=@weak_handle={0x77682a85, 0x1}, @flat=@binder={0x73622a85, 0xa, 0x3}}, &(0x7f0000000280)={0x0, 0x28, 0x40}}, 0x1f8aed83e3349436}, @exit_looper, @transaction_sg={0x40486311, {0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x68, 0x18, &(0x7f0000000480)={@ptr={0x70742a85, 0x0, &(0x7f00000002c0)=""/11, 0xb, 0x2, 0x3f}, @fd={0x66642a85, 0x0, r0}, @ptr={0x70742a85, 0x0, &(0x7f0000000380)=""/70, 0x46, 0x1, 0x1f}}, &(0x7f0000000500)={0x0, 0x28, 0x40}}, 0x1000}], 0x14, 0x0, &(0x7f0000000680)="86621f50fcee8bdc5bf8c503a78812261b4bf6d7"}) 18:07:40 executing program 2: ioctl$FS_IOC_RESVSP(0xffffffffffffffff, 0x40305828, &(0x7f00000000c0)={0x0, 0x0, 0x100000000000001}) clone(0x2102001fff, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) socket(0x0, 0x0, 0x0) r0 = getpid() rt_tgsigqueueinfo(0x0, r0, 0x16, &(0x7f0000000100)) ptrace(0x10, r0) ptrace$poke(0x4209, r0, &(0x7f00000000c0), 0x70effd) [ 2628.178953] binder: 16773:16787 transaction failed 29189/-22, size 80-24 line 3014 [ 2628.179251] binder: undelivered TRANSACTION_ERROR: 29189 [ 2628.270764] binder: 16806:16817 Release 1 refcount change on invalid ref 2 ret -22 18:07:40 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000006c0)={0x118, 0x0, &(0x7f0000000540)=[@release={0x40046306, 0x2}, @acquire_done, @acquire_done={0x40106309, 0x3}, @transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x50, 0x18, &(0x7f0000000080)={@flat=@binder={0x73622a85, 0xa, 0x1}, @fda={0x66646185, 0xa, 0x1, 0x9}, @fd={0x66642a85, 0x0, r1}}, &(0x7f0000000100)={0x0, 0x18, 0x38}}, 0x1000}, @transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000180)={@ptr={0x70742a85, 0x0, &(0x7f0000000140)=""/51, 0x33, 0x2, 0x25}, @flat=@weak_handle={0x77682a85, 0x1}, @flat=@binder={0x73622a85, 0xa, 0x3}}, &(0x7f0000000280)={0x0, 0x28, 0x40}}, 0x1f8aed83e3349436}, @exit_looper, @transaction_sg={0x40486311, {0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x68, 0x18, &(0x7f0000000480)={@ptr={0x70742a85, 0x0, &(0x7f00000002c0)=""/11, 0xb, 0x2, 0x3f}, @fd={0x66642a85, 0x0, r0}, @ptr={0x70742a85, 0x0, &(0x7f0000000380)=""/70, 0x46, 0x1, 0x1f}}, &(0x7f0000000500)={0x0, 0x28, 0x40}}, 0x1000}], 0x14, 0x0, &(0x7f0000000680)="86621f50fcee8bdc5bf8c503a78812261b4bf6d7"}) 18:07:40 executing program 4: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000040)='/dev/net/tun\x00', 0x0, 0x0) r1 = epoll_create1(0x0) epoll_ctl$EPOLL_CTL_ADD(0xffffffffffffffff, 0x1, r0, &(0x7f0000000100)) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000080)={'tunl0\x00', 0x1}) epoll_wait(r1, &(0x7f00000000c0)=[{}], 0x1, 0x0) 18:07:40 executing program 3: r0 = socket(0x10, 0x3, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") ioctl$sock_ifreq(r0, 0x89f3, &(0x7f0000000240)={'sit0\x00'}) 18:07:40 executing program 1: clone(0x2102001fff, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) socket(0x0, 0x0, 0x0) r0 = getpid() rt_tgsigqueueinfo(0x0, r0, 0x16, &(0x7f0000000100)) rt_sigqueueinfo(r0, 0x7, &(0x7f0000000180)={0x0, 0x0, 0xffffffff}) [ 2628.270773] binder: 16806:16817 BC_ACQUIRE_DONE u0000000000000000 no match [ 2628.270780] binder: 16806:16817 BC_ACQUIRE_DONE u0000000000000003 no match 18:07:40 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000006c0)={0x118, 0x0, &(0x7f0000000540)=[@release={0x40046306, 0x2}, @acquire_done, @acquire_done={0x40106309, 0x3}, @transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x50, 0x18, &(0x7f0000000080)={@flat=@binder={0x73622a85, 0xa, 0x1}, @fda={0x66646185, 0xa, 0x1, 0x9}, @fd={0x66642a85, 0x0, r1}}, &(0x7f0000000100)={0x0, 0x18, 0x38}}, 0x1000}, @transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000180)={@ptr={0x70742a85, 0x0, &(0x7f0000000140)=""/51, 0x33, 0x2, 0x25}, @flat=@weak_handle={0x77682a85, 0x1}, @flat=@binder={0x73622a85, 0xa, 0x3}}, &(0x7f0000000280)={0x0, 0x28, 0x40}}, 0x1f8aed83e3349436}, @exit_looper, @transaction_sg={0x40486311, {0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x68, 0x18, &(0x7f0000000480)={@ptr={0x70742a85, 0x0, &(0x7f00000002c0)=""/11, 0xb, 0x2, 0x3f}, @fd={0x66642a85, 0x0, r0}, @ptr={0x70742a85, 0x0, &(0x7f0000000380)=""/70, 0x46, 0x1, 0x1f}}, &(0x7f0000000500)={0x0, 0x28, 0x40}}, 0x1000}], 0x14, 0x0, &(0x7f0000000680)="86621f50fcee8bdc5bf8c503a78812261b4bf6d7"}) [ 2628.270793] binder: 16806:16817 transaction failed 29189/-22, size 80-24 line 3014 18:07:40 executing program 5: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000001a00)='/dev/net/tun\x00', 0x0, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000080)="c0dc00025e0b01047be070") ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000300)={'nr0\x01\x00', 0x1132}) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000001a00)='/dev/net/tun\x00', 0x2, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000300)={'nr0\x01\x00', 0x1132}) write$cgroup_int(0xffffffffffffffff, &(0x7f00000000c0)=0x2, 0xfffffffffffffe75) close(r1) 18:07:40 executing program 3: r0 = socket(0x10, 0x3, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") ioctl$sock_ifreq(r0, 0x89f3, &(0x7f0000000240)={'sit0\x00'}) 18:07:40 executing program 1: clone(0x2102001fff, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) socket(0x0, 0x0, 0x0) r0 = getpid() rt_tgsigqueueinfo(0x0, r0, 0x16, &(0x7f0000000100)) rt_sigqueueinfo(r0, 0x7, &(0x7f0000000180)={0x0, 0x0, 0xffffffff}) [ 2628.290813] binder: undelivered TRANSACTION_ERROR: 29189 [ 2628.485235] binder: 16856:16866 Release 1 refcount change on invalid ref 2 ret -22 [ 2628.485245] binder: 16856:16866 BC_ACQUIRE_DONE u0000000000000000 no match 18:07:40 executing program 3: r0 = socket(0x10, 0x3, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") ioctl$sock_ifreq(r0, 0x89f3, &(0x7f0000000240)={'sit0\x00'}) 18:07:40 executing program 4: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000040)='/dev/net/tun\x00', 0x0, 0x0) r1 = epoll_create1(0x0) epoll_ctl$EPOLL_CTL_ADD(0xffffffffffffffff, 0x1, r0, &(0x7f0000000100)) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000080)={'tunl0\x00', 0x1}) epoll_wait(r1, &(0x7f00000000c0)=[{}], 0x1, 0x0) [ 2628.485253] binder: 16856:16866 BC_ACQUIRE_DONE u0000000000000003 no match [ 2628.485266] binder: 16856:16866 transaction failed 29189/-22, size 80-24 line 3014 18:07:40 executing program 1: clone(0x2102001fff, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) socket(0x0, 0x0, 0x0) r0 = getpid() rt_tgsigqueueinfo(0x0, r0, 0x16, &(0x7f0000000100)) rt_sigqueueinfo(r0, 0x7, &(0x7f0000000180)={0x0, 0x0, 0xffffffff}) 18:07:40 executing program 2: ioctl$FS_IOC_RESVSP(0xffffffffffffffff, 0x40305828, &(0x7f00000000c0)={0x0, 0x0, 0x100000000000001}) clone(0x2102001fff, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) socket(0x0, 0x0, 0x0) r0 = getpid() rt_tgsigqueueinfo(0x0, r0, 0x16, &(0x7f0000000100)) ptrace(0x10, r0) ptrace$poke(0x4209, r0, &(0x7f00000000c0), 0x70effd) 18:07:40 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000006c0)={0x118, 0x0, &(0x7f0000000540)=[@release={0x40046306, 0x2}, @acquire_done, @acquire_done={0x40106309, 0x3}, @transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x50, 0x18, &(0x7f0000000080)={@flat=@binder={0x73622a85, 0xa, 0x1}, @fda={0x66646185, 0xa, 0x1, 0x9}, @fd={0x66642a85, 0x0, r1}}, &(0x7f0000000100)={0x0, 0x18, 0x38}}, 0x1000}, @transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000180)={@ptr={0x70742a85, 0x0, &(0x7f0000000140)=""/51, 0x33, 0x2, 0x25}, @flat=@weak_handle={0x77682a85, 0x1}, @flat=@binder={0x73622a85, 0xa, 0x3}}, &(0x7f0000000280)={0x0, 0x28, 0x40}}, 0x1f8aed83e3349436}, @exit_looper, @transaction_sg={0x40486311, {0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x68, 0x18, &(0x7f0000000480)={@ptr={0x70742a85, 0x0, &(0x7f00000002c0)=""/11, 0xb, 0x2, 0x3f}, @fd={0x66642a85, 0x0, r0}, @ptr={0x70742a85, 0x0, &(0x7f0000000380)=""/70, 0x46, 0x1, 0x1f}}, &(0x7f0000000500)={0x0, 0x28, 0x40}}, 0x1000}], 0x14, 0x0, &(0x7f0000000680)="86621f50fcee8bdc5bf8c503a78812261b4bf6d7"}) [ 2628.485439] binder: undelivered TRANSACTION_ERROR: 29189 [ 2628.542695] binder: 16889:16893 Release 1 refcount change on invalid ref 2 ret -22 18:07:40 executing program 3: r0 = socket(0x10, 0x3, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") ioctl$sock_ifreq(r0, 0x89f3, &(0x7f0000000240)={'sit0\x00'}) [ 2628.542705] binder: 16889:16893 BC_ACQUIRE_DONE u0000000000000000 no match 18:07:40 executing program 1: clone(0x2102001fff, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) socket(0x0, 0x0, 0x0) r0 = getpid() rt_tgsigqueueinfo(0x0, r0, 0x16, &(0x7f0000000100)) rt_sigqueueinfo(r0, 0x7, &(0x7f0000000180)={0x0, 0x0, 0xffffffff}) 18:07:40 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000006c0)={0x118, 0x0, &(0x7f0000000540)=[@release={0x40046306, 0x2}, @acquire_done, @acquire_done={0x40106309, 0x3}, @transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x50, 0x18, &(0x7f0000000080)={@flat=@binder={0x73622a85, 0xa, 0x1}, @fda={0x66646185, 0xa, 0x1, 0x9}, @fd={0x66642a85, 0x0, r1}}, &(0x7f0000000100)={0x0, 0x18, 0x38}}, 0x1000}, @transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000180)={@ptr={0x70742a85, 0x0, &(0x7f0000000140)=""/51, 0x33, 0x2, 0x25}, @flat=@weak_handle={0x77682a85, 0x1}, @flat=@binder={0x73622a85, 0xa, 0x3}}, &(0x7f0000000280)={0x0, 0x28, 0x40}}, 0x1f8aed83e3349436}, @exit_looper, @transaction_sg={0x40486311, {0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x68, 0x18, &(0x7f0000000480)={@ptr={0x70742a85, 0x0, &(0x7f00000002c0)=""/11, 0xb, 0x2, 0x3f}, @fd={0x66642a85, 0x0, r0}, @ptr={0x70742a85, 0x0, &(0x7f0000000380)=""/70, 0x46, 0x1, 0x1f}}, &(0x7f0000000500)={0x0, 0x28, 0x40}}, 0x1000}], 0x14, 0x0, &(0x7f0000000680)="86621f50fcee8bdc5bf8c503a78812261b4bf6d7"}) [ 2628.542713] binder: 16889:16893 BC_ACQUIRE_DONE u0000000000000003 no match [ 2628.542725] binder: 16889:16893 transaction failed 29189/-22, size 80-24 line 3014 18:07:40 executing program 4: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000040)='/dev/net/tun\x00', 0x0, 0x0) r1 = epoll_create1(0x0) epoll_ctl$EPOLL_CTL_ADD(0xffffffffffffffff, 0x1, r0, &(0x7f0000000100)) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000080)={'tunl0\x00', 0x1}) epoll_wait(r1, &(0x7f00000000c0)=[{}], 0x1, 0x0) [ 2628.546846] binder: undelivered TRANSACTION_ERROR: 29189 18:07:40 executing program 5: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000001a00)='/dev/net/tun\x00', 0x0, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000080)="c0dc00025e0b01047be070") ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000300)={'nr0\x01\x00', 0x1132}) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000001a00)='/dev/net/tun\x00', 0x2, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000300)={'nr0\x01\x00', 0x1132}) write$cgroup_int(0xffffffffffffffff, &(0x7f00000000c0)=0x2, 0xfffffffffffffe75) close(r1) 18:07:40 executing program 1: clone(0x2102001fff, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) socket(0x0, 0x0, 0x0) r0 = getpid() rt_tgsigqueueinfo(0x0, r0, 0x16, &(0x7f0000000100)) rt_sigqueueinfo(r0, 0x7, &(0x7f0000000180)={0x0, 0x0, 0xffffffff}) 18:07:40 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000006c0)={0x118, 0x0, &(0x7f0000000540)=[@release={0x40046306, 0x2}, @acquire_done, @acquire_done={0x40106309, 0x3}, @transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x50, 0x18, &(0x7f0000000080)={@flat=@binder={0x73622a85, 0xa, 0x1}, @fda={0x66646185, 0xa, 0x1, 0x9}, @fd={0x66642a85, 0x0, r1}}, &(0x7f0000000100)={0x0, 0x18, 0x38}}, 0x1000}, @transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000180)={@ptr={0x70742a85, 0x0, &(0x7f0000000140)=""/51, 0x33, 0x2, 0x25}, @flat=@weak_handle={0x77682a85, 0x1}, @flat=@binder={0x73622a85, 0xa, 0x3}}, &(0x7f0000000280)={0x0, 0x28, 0x40}}, 0x1f8aed83e3349436}, @exit_looper, @transaction_sg={0x40486311, {0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x68, 0x18, &(0x7f0000000480)={@ptr={0x70742a85, 0x0, &(0x7f00000002c0)=""/11, 0xb, 0x2, 0x3f}, @fd={0x66642a85, 0x0, r0}, @ptr={0x70742a85, 0x0, &(0x7f0000000380)=""/70, 0x46, 0x1, 0x1f}}, &(0x7f0000000500)={0x0, 0x28, 0x40}}, 0x1000}], 0x14, 0x0, &(0x7f0000000680)="86621f50fcee8bdc5bf8c503a78812261b4bf6d7"}) [ 2628.812385] binder: 16989:17007 Release 1 refcount change on invalid ref 2 ret -22 18:07:40 executing program 3: r0 = socket(0x10, 0x3, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") ioctl$sock_ifreq(r0, 0x89f3, &(0x7f0000000240)={'sit0\x00'}) 18:07:40 executing program 2: ioctl$FS_IOC_RESVSP(0xffffffffffffffff, 0x40305828, &(0x7f00000000c0)={0x0, 0x0, 0x100000000000001}) clone(0x2102001fff, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) socket(0x0, 0x0, 0x0) r0 = getpid() rt_tgsigqueueinfo(0x0, r0, 0x16, &(0x7f0000000100)) ptrace(0x10, r0) ptrace$poke(0x4209, r0, &(0x7f00000000c0), 0x70effd) 18:07:40 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000006c0)={0x118, 0x0, &(0x7f0000000540)=[@release={0x40046306, 0x2}, @acquire_done, @acquire_done={0x40106309, 0x3}, @transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x50, 0x18, &(0x7f0000000080)={@flat=@binder={0x73622a85, 0xa, 0x1}, @fda={0x66646185, 0xa, 0x1, 0x9}, @fd={0x66642a85, 0x0, r1}}, &(0x7f0000000100)={0x0, 0x18, 0x38}}, 0x1000}, @transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000180)={@ptr={0x70742a85, 0x0, &(0x7f0000000140)=""/51, 0x33, 0x2, 0x25}, @flat=@weak_handle={0x77682a85, 0x1}, @flat=@binder={0x73622a85, 0xa, 0x3}}, &(0x7f0000000280)={0x0, 0x28, 0x40}}, 0x1f8aed83e3349436}, @exit_looper, @transaction_sg={0x40486311, {0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x68, 0x18, &(0x7f0000000480)={@ptr={0x70742a85, 0x0, &(0x7f00000002c0)=""/11, 0xb, 0x2, 0x3f}, @fd={0x66642a85, 0x0, r0}, @ptr={0x70742a85, 0x0, &(0x7f0000000380)=""/70, 0x46, 0x1, 0x1f}}, &(0x7f0000000500)={0x0, 0x28, 0x40}}, 0x1000}], 0x14, 0x0, &(0x7f0000000680)="86621f50fcee8bdc5bf8c503a78812261b4bf6d7"}) [ 2628.812395] binder: 16989:17007 BC_ACQUIRE_DONE u0000000000000000 no match [ 2628.812403] binder: 16989:17007 BC_ACQUIRE_DONE u0000000000000003 no match 18:07:40 executing program 1: clone(0x2102001fff, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) socket(0x0, 0x0, 0x0) r0 = getpid() rt_tgsigqueueinfo(0x0, r0, 0x16, &(0x7f0000000100)) rt_sigqueueinfo(r0, 0x7, &(0x7f0000000180)={0x0, 0x0, 0xffffffff}) 18:07:40 executing program 3: r0 = socket(0x10, 0x3, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") ioctl$sock_ifreq(r0, 0x89f3, &(0x7f0000000240)={'sit0\x00'}) [ 2628.812416] binder: 16989:17007 transaction failed 29189/-22, size 80-24 line 3014 [ 2628.812702] binder: undelivered TRANSACTION_ERROR: 29189 [ 2628.952333] binder: 17060:17070 Release 1 refcount change on invalid ref 2 ret -22 [ 2628.952343] binder: 17060:17070 BC_ACQUIRE_DONE u0000000000000000 no match 18:07:40 executing program 4: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000040)='/dev/net/tun\x00', 0x0, 0x0) r1 = epoll_create1(0x0) epoll_ctl$EPOLL_CTL_ADD(0xffffffffffffffff, 0x1, r0, &(0x7f0000000100)) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000080)={'tunl0\x00', 0x1}) epoll_wait(r1, &(0x7f00000000c0)=[{}], 0x1, 0x0) 18:07:40 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000006c0)={0x118, 0x0, &(0x7f0000000540)=[@release={0x40046306, 0x2}, @acquire_done, @acquire_done={0x40106309, 0x3}, @transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x50, 0x18, &(0x7f0000000080)={@flat=@binder={0x73622a85, 0xa, 0x1}, @fda={0x66646185, 0xa, 0x1, 0x9}, @fd={0x66642a85, 0x0, r1}}, &(0x7f0000000100)={0x0, 0x18, 0x38}}, 0x1000}, @transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000180)={@ptr={0x70742a85, 0x0, &(0x7f0000000140)=""/51, 0x33, 0x2, 0x25}, @flat=@weak_handle={0x77682a85, 0x1}, @flat=@binder={0x73622a85, 0xa, 0x3}}, &(0x7f0000000280)={0x0, 0x28, 0x40}}, 0x1f8aed83e3349436}, @exit_looper, @transaction_sg={0x40486311, {0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x68, 0x18, &(0x7f0000000480)={@ptr={0x70742a85, 0x0, &(0x7f00000002c0)=""/11, 0xb, 0x2, 0x3f}, @fd={0x66642a85, 0x0, r0}, @ptr={0x70742a85, 0x0, &(0x7f0000000380)=""/70, 0x46, 0x1, 0x1f}}, &(0x7f0000000500)={0x0, 0x28, 0x40}}, 0x1000}], 0x14, 0x0, &(0x7f0000000680)="86621f50fcee8bdc5bf8c503a78812261b4bf6d7"}) [ 2628.952350] binder: 17060:17070 BC_ACQUIRE_DONE u0000000000000003 no match 18:07:40 executing program 3: r0 = socket(0x10, 0x3, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") ioctl$sock_ifreq(r0, 0x89f3, &(0x7f0000000240)={'sit0\x00'}) [ 2628.952362] binder: 17060:17070 transaction failed 29189/-22, size 80-24 line 3014 18:07:41 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000006c0)={0x118, 0x0, &(0x7f0000000540)=[@release={0x40046306, 0x2}, @acquire_done, @acquire_done={0x40106309, 0x3}, @transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x50, 0x18, &(0x7f0000000080)={@flat=@binder={0x73622a85, 0xa, 0x1}, @fda={0x66646185, 0xa, 0x1, 0x9}, @fd={0x66642a85, 0x0, r1}}, &(0x7f0000000100)={0x0, 0x18, 0x38}}, 0x1000}, @transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000180)={@ptr={0x70742a85, 0x0, &(0x7f0000000140)=""/51, 0x33, 0x2, 0x25}, @flat=@weak_handle={0x77682a85, 0x1}, @flat=@binder={0x73622a85, 0xa, 0x3}}, &(0x7f0000000280)={0x0, 0x28, 0x40}}, 0x1f8aed83e3349436}, @exit_looper, @transaction_sg={0x40486311, {0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x68, 0x18, &(0x7f0000000480)={@ptr={0x70742a85, 0x0, &(0x7f00000002c0)=""/11, 0xb, 0x2, 0x3f}, @fd={0x66642a85, 0x0, r0}, @ptr={0x70742a85, 0x0, &(0x7f0000000380)=""/70, 0x46, 0x1, 0x1f}}, &(0x7f0000000500)={0x0, 0x28, 0x40}}, 0x1000}], 0x14, 0x0, &(0x7f0000000680)="86621f50fcee8bdc5bf8c503a78812261b4bf6d7"}) 18:07:41 executing program 5: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000001a00)='/dev/net/tun\x00', 0x0, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000080)="c0dc00025e0b01047be070") ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000300)={'nr0\x01\x00', 0x1132}) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000001a00)='/dev/net/tun\x00', 0x2, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000300)={'nr0\x01\x00', 0x1132}) write$cgroup_int(0xffffffffffffffff, &(0x7f00000000c0)=0x2, 0xfffffffffffffe75) close(r1) 18:07:41 executing program 1: clone(0x2102001fff, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) socket(0x0, 0x0, 0x0) r0 = getpid() rt_tgsigqueueinfo(0x0, r0, 0x16, &(0x7f0000000100)) rt_sigqueueinfo(r0, 0x7, &(0x7f0000000180)={0x0, 0x0, 0xffffffff}) 18:07:41 executing program 3: r0 = socket(0x10, 0x3, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") ioctl$sock_ifreq(r0, 0x89f3, &(0x7f0000000240)={'sit0\x00'}) [ 2628.952646] binder: undelivered TRANSACTION_ERROR: 29189 [ 2629.084714] binder: 17089:17099 Release 1 refcount change on invalid ref 2 ret -22 18:07:41 executing program 2: ioctl$FS_IOC_RESVSP(0xffffffffffffffff, 0x40305828, &(0x7f00000000c0)={0x0, 0x0, 0x100000000000001}) clone(0x2102001fff, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) socket(0x0, 0x0, 0x0) r0 = getpid() rt_tgsigqueueinfo(0x0, r0, 0x16, &(0x7f0000000100)) ptrace(0x10, r0) ptrace$poke(0x4209, r0, &(0x7f00000000c0), 0x70effd) 18:07:41 executing program 3: r0 = socket(0x10, 0x3, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") ioctl$sock_ifreq(r0, 0x89f3, &(0x7f0000000240)={'sit0\x00'}) 18:07:41 executing program 4: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000040)='/dev/net/tun\x00', 0x0, 0x0) r1 = epoll_create1(0x0) epoll_ctl$EPOLL_CTL_ADD(0xffffffffffffffff, 0x1, r0, &(0x7f0000000100)) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000080)={'tunl0\x00', 0x1}) epoll_wait(r1, &(0x7f00000000c0)=[{}], 0x1, 0x0) [ 2629.084724] binder: 17089:17099 BC_ACQUIRE_DONE u0000000000000000 no match 18:07:41 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000006c0)={0x118, 0x0, &(0x7f0000000540)=[@release={0x40046306, 0x2}, @acquire_done, @acquire_done={0x40106309, 0x3}, @transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x50, 0x18, &(0x7f0000000080)={@flat=@binder={0x73622a85, 0xa, 0x1}, @fda={0x66646185, 0xa, 0x1, 0x9}, @fd={0x66642a85, 0x0, r1}}, &(0x7f0000000100)={0x0, 0x18, 0x38}}, 0x1000}, @transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000180)={@ptr={0x70742a85, 0x0, &(0x7f0000000140)=""/51, 0x33, 0x2, 0x25}, @flat=@weak_handle={0x77682a85, 0x1}, @flat=@binder={0x73622a85, 0xa, 0x3}}, &(0x7f0000000280)={0x0, 0x28, 0x40}}, 0x1f8aed83e3349436}, @exit_looper, @transaction_sg={0x40486311, {0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x68, 0x18, &(0x7f0000000480)={@ptr={0x70742a85, 0x0, &(0x7f00000002c0)=""/11, 0xb, 0x2, 0x3f}, @fd={0x66642a85, 0x0, r0}, @ptr={0x70742a85, 0x0, &(0x7f0000000380)=""/70, 0x46, 0x1, 0x1f}}, &(0x7f0000000500)={0x0, 0x28, 0x40}}, 0x1000}], 0x14, 0x0, &(0x7f0000000680)="86621f50fcee8bdc5bf8c503a78812261b4bf6d7"}) 18:07:41 executing program 1: clone(0x2102001fff, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) socket(0x0, 0x0, 0x0) r0 = getpid() rt_tgsigqueueinfo(0x0, r0, 0x16, &(0x7f0000000100)) rt_sigqueueinfo(r0, 0x7, &(0x7f0000000180)={0x0, 0x0, 0xffffffff}) [ 2629.084732] binder: 17089:17099 BC_ACQUIRE_DONE u0000000000000003 no match [ 2629.084746] binder: 17089:17099 transaction failed 29189/-22, size 80-24 line 3014 18:07:41 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000006c0)={0x118, 0x0, &(0x7f0000000540)=[@release={0x40046306, 0x2}, @acquire_done, @acquire_done={0x40106309, 0x3}, @transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x50, 0x18, &(0x7f0000000080)={@flat=@binder={0x73622a85, 0xa, 0x1}, @fda={0x66646185, 0xa, 0x1, 0x9}, @fd={0x66642a85, 0x0, r1}}, &(0x7f0000000100)={0x0, 0x18, 0x38}}, 0x1000}, @transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000180)={@ptr={0x70742a85, 0x0, &(0x7f0000000140)=""/51, 0x33, 0x2, 0x25}, @flat=@weak_handle={0x77682a85, 0x1}, @flat=@binder={0x73622a85, 0xa, 0x3}}, &(0x7f0000000280)={0x0, 0x28, 0x40}}, 0x1f8aed83e3349436}, @exit_looper, @transaction_sg={0x40486311, {0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x68, 0x18, &(0x7f0000000480)={@ptr={0x70742a85, 0x0, &(0x7f00000002c0)=""/11, 0xb, 0x2, 0x3f}, @fd={0x66642a85, 0x0, r0}, @ptr={0x70742a85, 0x0, &(0x7f0000000380)=""/70, 0x46, 0x1, 0x1f}}, &(0x7f0000000500)={0x0, 0x28, 0x40}}, 0x1000}], 0x14, 0x0, &(0x7f0000000680)="86621f50fcee8bdc5bf8c503a78812261b4bf6d7"}) [ 2629.085038] binder: undelivered TRANSACTION_ERROR: 29189 [ 2629.235703] binder: 17146:17169 Release 1 refcount change on invalid ref 2 ret -22 [ 2629.235713] binder: 17146:17169 BC_ACQUIRE_DONE u0000000000000000 no match 18:07:41 executing program 3: r0 = socket(0x10, 0x3, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") ioctl$sock_ifreq(r0, 0x89f3, &(0x7f0000000240)={'sit0\x00'}) 18:07:41 executing program 1: clone(0x2102001fff, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) socket(0x0, 0x0, 0x0) r0 = getpid() rt_tgsigqueueinfo(0x0, r0, 0x16, &(0x7f0000000100)) rt_sigqueueinfo(r0, 0x7, &(0x7f0000000180)={0x0, 0x0, 0xffffffff}) 18:07:41 executing program 5: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000001a00)='/dev/net/tun\x00', 0x0, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000080)="c0dc00025e0b01047be070") ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000300)={'nr0\x01\x00', 0x1132}) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000001a00)='/dev/net/tun\x00', 0x2, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000300)={'nr0\x01\x00', 0x1132}) write$cgroup_int(0xffffffffffffffff, &(0x7f00000000c0)=0x2, 0xfffffffffffffe75) close(r1) 18:07:41 executing program 3: r0 = socket(0x10, 0x3, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") ioctl$sock_ifreq(r0, 0x89f3, &(0x7f0000000240)={'sit0\x00'}) [ 2629.235720] binder: 17146:17169 BC_ACQUIRE_DONE u0000000000000003 no match [ 2629.235733] binder: 17146:17169 transaction failed 29189/-22, size 80-24 line 3014 18:07:41 executing program 4: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000040)='/dev/net/tun\x00', 0x0, 0x0) r1 = epoll_create1(0x0) epoll_ctl$EPOLL_CTL_ADD(0xffffffffffffffff, 0x1, r0, &(0x7f0000000100)) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000080)={'tunl0\x00', 0x1}) epoll_wait(r1, &(0x7f00000000c0)=[{}], 0x1, 0x0) 18:07:41 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000006c0)={0x118, 0x0, &(0x7f0000000540)=[@release={0x40046306, 0x2}, @acquire_done, @acquire_done={0x40106309, 0x3}, @transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x50, 0x18, &(0x7f0000000080)={@flat=@binder={0x73622a85, 0xa, 0x1}, @fda={0x66646185, 0xa, 0x1, 0x9}, @fd={0x66642a85, 0x0, r1}}, &(0x7f0000000100)={0x0, 0x18, 0x38}}, 0x1000}, @transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000180)={@ptr={0x70742a85, 0x0, &(0x7f0000000140)=""/51, 0x33, 0x2, 0x25}, @flat=@weak_handle={0x77682a85, 0x1}, @flat=@binder={0x73622a85, 0xa, 0x3}}, &(0x7f0000000280)={0x0, 0x28, 0x40}}, 0x1f8aed83e3349436}, @exit_looper, @transaction_sg={0x40486311, {0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x68, 0x18, &(0x7f0000000480)={@ptr={0x70742a85, 0x0, &(0x7f00000002c0)=""/11, 0xb, 0x2, 0x3f}, @fd={0x66642a85, 0x0, r0}, @ptr={0x70742a85, 0x0, &(0x7f0000000380)=""/70, 0x46, 0x1, 0x1f}}, &(0x7f0000000500)={0x0, 0x28, 0x40}}, 0x1000}], 0x14, 0x0, &(0x7f0000000680)="86621f50fcee8bdc5bf8c503a78812261b4bf6d7"}) 18:07:41 executing program 2: ioctl$FS_IOC_RESVSP(0xffffffffffffffff, 0x40305828, &(0x7f00000000c0)={0x0, 0x0, 0x100000000000001}) clone(0x2102001fff, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) socket(0x0, 0x0, 0x0) r0 = getpid() rt_tgsigqueueinfo(0x0, r0, 0x16, &(0x7f0000000100)) ptrace(0x10, r0) ptrace$poke(0x4209, r0, &(0x7f00000000c0), 0x70effd) 18:07:41 executing program 1: clone(0x2102001fff, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) socket(0x0, 0x0, 0x0) r0 = getpid() rt_tgsigqueueinfo(0x0, r0, 0x16, &(0x7f0000000100)) rt_sigqueueinfo(r0, 0x7, &(0x7f0000000180)={0x0, 0x0, 0xffffffff}) [ 2629.236933] binder: undelivered TRANSACTION_ERROR: 29189 [ 2629.309079] binder: 17187:17197 Release 1 refcount change on invalid ref 2 ret -22 [ 2629.309089] binder: 17187:17197 BC_ACQUIRE_DONE u0000000000000000 no match 18:07:41 executing program 3: r0 = socket(0x10, 0x3, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") ioctl$sock_ifreq(r0, 0x89f3, &(0x7f0000000240)={'sit0\x00'}) 18:07:41 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000006c0)={0x118, 0x0, &(0x7f0000000540)=[@release={0x40046306, 0x2}, @acquire_done, @acquire_done={0x40106309, 0x3}, @transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x50, 0x18, &(0x7f0000000080)={@flat=@binder={0x73622a85, 0xa, 0x1}, @fda={0x66646185, 0xa, 0x1, 0x9}, @fd={0x66642a85, 0x0, r1}}, &(0x7f0000000100)={0x0, 0x18, 0x38}}, 0x1000}, @transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000180)={@ptr={0x70742a85, 0x0, &(0x7f0000000140)=""/51, 0x33, 0x2, 0x25}, @flat=@weak_handle={0x77682a85, 0x1}, @flat=@binder={0x73622a85, 0xa, 0x3}}, &(0x7f0000000280)={0x0, 0x28, 0x40}}, 0x1f8aed83e3349436}, @exit_looper, @transaction_sg={0x40486311, {0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x68, 0x18, &(0x7f0000000480)={@ptr={0x70742a85, 0x0, &(0x7f00000002c0)=""/11, 0xb, 0x2, 0x3f}, @fd={0x66642a85, 0x0, r0}, @ptr={0x70742a85, 0x0, &(0x7f0000000380)=""/70, 0x46, 0x1, 0x1f}}, &(0x7f0000000500)={0x0, 0x28, 0x40}}, 0x1000}], 0x14, 0x0, &(0x7f0000000680)="86621f50fcee8bdc5bf8c503a78812261b4bf6d7"}) 18:07:41 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000006c0)={0x118, 0x0, &(0x7f0000000540)=[@release={0x40046306, 0x2}, @acquire_done, @acquire_done={0x40106309, 0x3}, @transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x50, 0x18, &(0x7f0000000080)={@flat=@binder={0x73622a85, 0xa, 0x1}, @fda={0x66646185, 0xa, 0x1, 0x9}, @fd={0x66642a85, 0x0, r1}}, &(0x7f0000000100)={0x0, 0x18, 0x38}}, 0x1000}, @transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000180)={@ptr={0x70742a85, 0x0, &(0x7f0000000140)=""/51, 0x33, 0x2, 0x25}, @flat=@weak_handle={0x77682a85, 0x1}, @flat=@binder={0x73622a85, 0xa, 0x3}}, &(0x7f0000000280)={0x0, 0x28, 0x40}}, 0x1f8aed83e3349436}, @exit_looper, @transaction_sg={0x40486311, {0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x68, 0x18, &(0x7f0000000480)={@ptr={0x70742a85, 0x0, &(0x7f00000002c0)=""/11, 0xb, 0x2, 0x3f}, @fd={0x66642a85, 0x0, r0}, @ptr={0x70742a85, 0x0, &(0x7f0000000380)=""/70, 0x46, 0x1, 0x1f}}, &(0x7f0000000500)={0x0, 0x28, 0x40}}, 0x1000}], 0x14, 0x0, &(0x7f0000000680)="86621f50fcee8bdc5bf8c503a78812261b4bf6d7"}) 18:07:41 executing program 1: clone(0x2102001fff, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) socket(0x0, 0x0, 0x0) r0 = getpid() rt_tgsigqueueinfo(0x0, r0, 0x16, &(0x7f0000000100)) rt_sigqueueinfo(r0, 0x7, &(0x7f0000000180)={0x0, 0x0, 0xffffffff}) 18:07:41 executing program 3: r0 = socket(0x10, 0x3, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") ioctl$sock_ifreq(r0, 0x89f3, &(0x7f0000000240)={'sit0\x00'}) [ 2629.309097] binder: 17187:17197 BC_ACQUIRE_DONE u0000000000000003 no match 18:07:41 executing program 4: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000040)='/dev/net/tun\x00', 0x0, 0x0) r1 = epoll_create1(0x0) epoll_ctl$EPOLL_CTL_ADD(0xffffffffffffffff, 0x1, r0, &(0x7f0000000100)) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000080)={'tunl0\x00', 0x1}) epoll_wait(r1, &(0x7f00000000c0)=[{}], 0x1, 0x0) [ 2629.309109] binder: 17187:17197 transaction failed 29189/-22, size 80-24 line 3014 [ 2629.309396] binder: undelivered TRANSACTION_ERROR: 29189 [ 2629.435027] binder: 17223:17230 Release 1 refcount change on invalid ref 2 ret -22 [ 2629.435037] binder: 17223:17230 BC_ACQUIRE_DONE u0000000000000000 no match 18:07:41 executing program 5: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000001a00)='/dev/net/tun\x00', 0x0, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000080)="c0dc00025e0b01047be070") ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000300)={'nr0\x01\x00', 0x1132}) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000001a00)='/dev/net/tun\x00', 0x2, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000300)={'nr0\x01\x00', 0x1132}) write$cgroup_int(0xffffffffffffffff, &(0x7f00000000c0)=0x2, 0xfffffffffffffe75) close(r1) 18:07:41 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000006c0)={0x118, 0x0, &(0x7f0000000540)=[@release={0x40046306, 0x2}, @acquire_done, @acquire_done={0x40106309, 0x3}, @transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x50, 0x18, &(0x7f0000000080)={@flat=@binder={0x73622a85, 0xa, 0x1}, @fda={0x66646185, 0xa, 0x1, 0x9}, @fd={0x66642a85, 0x0, r1}}, &(0x7f0000000100)={0x0, 0x18, 0x38}}, 0x1000}, @transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000180)={@ptr={0x70742a85, 0x0, &(0x7f0000000140)=""/51, 0x33, 0x2, 0x25}, @flat=@weak_handle={0x77682a85, 0x1}, @flat=@binder={0x73622a85, 0xa, 0x3}}, &(0x7f0000000280)={0x0, 0x28, 0x40}}, 0x1f8aed83e3349436}, @exit_looper, @transaction_sg={0x40486311, {0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x68, 0x18, &(0x7f0000000480)={@ptr={0x70742a85, 0x0, &(0x7f00000002c0)=""/11, 0xb, 0x2, 0x3f}, @fd={0x66642a85, 0x0, r0}, @ptr={0x70742a85, 0x0, &(0x7f0000000380)=""/70, 0x46, 0x1, 0x1f}}, &(0x7f0000000500)={0x0, 0x28, 0x40}}, 0x1000}], 0x14, 0x0, &(0x7f0000000680)="86621f50fcee8bdc5bf8c503a78812261b4bf6d7"}) 18:07:41 executing program 1: clone(0x2102001fff, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) socket(0x0, 0x0, 0x0) r0 = getpid() rt_tgsigqueueinfo(0x0, r0, 0x16, &(0x7f0000000100)) rt_sigqueueinfo(r0, 0x7, &(0x7f0000000180)={0x0, 0x0, 0xffffffff}) 18:07:41 executing program 3: r0 = socket(0x10, 0x3, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") ioctl$sock_ifreq(r0, 0x89f3, &(0x7f0000000240)={'sit0\x00'}) 18:07:41 executing program 2: ioctl$FS_IOC_RESVSP(0xffffffffffffffff, 0x40305828, &(0x7f00000000c0)={0x0, 0x0, 0x100000000000001}) clone(0x2102001fff, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) socket(0x0, 0x0, 0x0) r0 = getpid() rt_tgsigqueueinfo(0x0, r0, 0x16, &(0x7f0000000100)) ptrace(0x10, r0) ptrace$poke(0x4209, r0, &(0x7f00000000c0), 0x70effd) 18:07:41 executing program 4: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000040)='/dev/net/tun\x00', 0x0, 0x0) r1 = epoll_create1(0x0) epoll_ctl$EPOLL_CTL_ADD(0xffffffffffffffff, 0x1, r0, &(0x7f0000000100)) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000080)={'tunl0\x00', 0x1}) epoll_wait(r1, &(0x7f00000000c0)=[{}], 0x1, 0x0) [ 2629.435045] binder: 17223:17230 BC_ACQUIRE_DONE u0000000000000003 no match [ 2629.435058] binder: 17223:17230 transaction failed 29189/-22, size 80-24 line 3014 [ 2629.435354] binder: undelivered TRANSACTION_ERROR: 29189 [ 2629.530377] binder: 17259:17287 Release 1 refcount change on invalid ref 2 ret -22 18:07:41 executing program 3: r0 = socket(0x10, 0x3, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") ioctl$sock_ifreq(r0, 0x89f3, &(0x7f0000000240)={'sit0\x00'}) 18:07:41 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000006c0)={0x118, 0x0, &(0x7f0000000540)=[@release={0x40046306, 0x2}, @acquire_done, @acquire_done={0x40106309, 0x3}, @transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x50, 0x18, &(0x7f0000000080)={@flat=@binder={0x73622a85, 0xa, 0x1}, @fda={0x66646185, 0xa, 0x1, 0x9}, @fd={0x66642a85, 0x0, r1}}, &(0x7f0000000100)={0x0, 0x18, 0x38}}, 0x1000}, @transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000180)={@ptr={0x70742a85, 0x0, &(0x7f0000000140)=""/51, 0x33, 0x2, 0x25}, @flat=@weak_handle={0x77682a85, 0x1}, @flat=@binder={0x73622a85, 0xa, 0x3}}, &(0x7f0000000280)={0x0, 0x28, 0x40}}, 0x1f8aed83e3349436}, @exit_looper, @transaction_sg={0x40486311, {0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x68, 0x18, &(0x7f0000000480)={@ptr={0x70742a85, 0x0, &(0x7f00000002c0)=""/11, 0xb, 0x2, 0x3f}, @fd={0x66642a85, 0x0, r0}, @ptr={0x70742a85, 0x0, &(0x7f0000000380)=""/70, 0x46, 0x1, 0x1f}}, &(0x7f0000000500)={0x0, 0x28, 0x40}}, 0x1000}], 0x14, 0x0, &(0x7f0000000680)="86621f50fcee8bdc5bf8c503a78812261b4bf6d7"}) 18:07:41 executing program 1: clone(0x2102001fff, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) socket(0x0, 0x0, 0x0) r0 = getpid() rt_tgsigqueueinfo(0x0, r0, 0x16, &(0x7f0000000100)) rt_sigqueueinfo(r0, 0x7, &(0x7f0000000180)={0x0, 0x0, 0xffffffff}) [ 2629.530387] binder: 17259:17287 BC_ACQUIRE_DONE u0000000000000000 no match 18:07:41 executing program 3: r0 = socket(0x10, 0x3, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") ioctl$sock_ifreq(r0, 0x89f3, &(0x7f0000000240)={'sit0\x00'}) 18:07:41 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000006c0)={0x118, 0x0, &(0x7f0000000540)=[@release={0x40046306, 0x2}, @acquire_done, @acquire_done={0x40106309, 0x3}, @transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x50, 0x18, &(0x7f0000000080)={@flat=@binder={0x73622a85, 0xa, 0x1}, @fda={0x66646185, 0xa, 0x1, 0x9}, @fd={0x66642a85, 0x0, r1}}, &(0x7f0000000100)={0x0, 0x18, 0x38}}, 0x1000}, @transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000180)={@ptr={0x70742a85, 0x0, &(0x7f0000000140)=""/51, 0x33, 0x2, 0x25}, @flat=@weak_handle={0x77682a85, 0x1}, @flat=@binder={0x73622a85, 0xa, 0x3}}, &(0x7f0000000280)={0x0, 0x28, 0x40}}, 0x1f8aed83e3349436}, @exit_looper, @transaction_sg={0x40486311, {0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x68, 0x18, &(0x7f0000000480)={@ptr={0x70742a85, 0x0, &(0x7f00000002c0)=""/11, 0xb, 0x2, 0x3f}, @fd={0x66642a85, 0x0, r0}, @ptr={0x70742a85, 0x0, &(0x7f0000000380)=""/70, 0x46, 0x1, 0x1f}}, &(0x7f0000000500)={0x0, 0x28, 0x40}}, 0x1000}], 0x14, 0x0, &(0x7f0000000680)="86621f50fcee8bdc5bf8c503a78812261b4bf6d7"}) [ 2629.530394] binder: 17259:17287 BC_ACQUIRE_DONE u0000000000000003 no match 18:07:42 executing program 1: clone(0x2102001fff, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) socket(0x0, 0x0, 0x0) r0 = getpid() rt_tgsigqueueinfo(0x0, r0, 0x16, &(0x7f0000000100)) rt_sigqueueinfo(r0, 0x7, &(0x7f0000000180)={0x0, 0x0, 0xffffffff}) [ 2629.530407] binder: 17259:17287 transaction failed 29189/-22, size 80-24 line 3014 [ 2629.533069] binder: undelivered TRANSACTION_ERROR: 29189 [ 2629.796808] binder: 17317:17379 Release 1 refcount change on invalid ref 2 ret -22 18:07:42 executing program 5: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000001a00)='/dev/net/tun\x00', 0x0, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000080)="c0dc00025e0b01047be070") ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000300)={'nr0\x01\x00', 0x1132}) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000001a00)='/dev/net/tun\x00', 0x2, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000300)={'nr0\x01\x00', 0x1132}) write$cgroup_int(0xffffffffffffffff, &(0x7f00000000c0)=0x2, 0xfffffffffffffe75) close(r1) 18:07:42 executing program 3: r0 = socket(0x10, 0x3, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") ioctl$sock_ifreq(r0, 0x89f3, &(0x7f0000000240)={'sit0\x00'}) 18:07:42 executing program 4: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000040)='/dev/net/tun\x00', 0x0, 0x0) r1 = epoll_create1(0x0) epoll_ctl$EPOLL_CTL_ADD(0xffffffffffffffff, 0x1, r0, &(0x7f0000000100)) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000080)={'tunl0\x00', 0x1}) epoll_wait(r1, &(0x7f00000000c0)=[{}], 0x1, 0x0) 18:07:42 executing program 2: ioctl$FS_IOC_RESVSP(0xffffffffffffffff, 0x40305828, &(0x7f00000000c0)={0x0, 0x0, 0x100000000000001}) clone(0x2102001fff, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) socket(0x0, 0x0, 0x0) r0 = getpid() rt_tgsigqueueinfo(0x0, r0, 0x16, &(0x7f0000000100)) ptrace(0x10, r0) ptrace$poke(0x4209, r0, &(0x7f00000000c0), 0x70effd) 18:07:42 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000006c0)={0x118, 0x0, &(0x7f0000000540)=[@release={0x40046306, 0x2}, @acquire_done, @acquire_done={0x40106309, 0x3}, @transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x50, 0x18, &(0x7f0000000080)={@flat=@binder={0x73622a85, 0xa, 0x1}, @fda={0x66646185, 0xa, 0x1, 0x9}, @fd={0x66642a85, 0x0, r1}}, &(0x7f0000000100)={0x0, 0x18, 0x38}}, 0x1000}, @transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000180)={@ptr={0x70742a85, 0x0, &(0x7f0000000140)=""/51, 0x33, 0x2, 0x25}, @flat=@weak_handle={0x77682a85, 0x1}, @flat=@binder={0x73622a85, 0xa, 0x3}}, &(0x7f0000000280)={0x0, 0x28, 0x40}}, 0x1f8aed83e3349436}, @exit_looper, @transaction_sg={0x40486311, {0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x68, 0x18, &(0x7f0000000480)={@ptr={0x70742a85, 0x0, &(0x7f00000002c0)=""/11, 0xb, 0x2, 0x3f}, @fd={0x66642a85, 0x0, r0}, @ptr={0x70742a85, 0x0, &(0x7f0000000380)=""/70, 0x46, 0x1, 0x1f}}, &(0x7f0000000500)={0x0, 0x28, 0x40}}, 0x1000}], 0x14, 0x0, &(0x7f0000000680)="86621f50fcee8bdc5bf8c503a78812261b4bf6d7"}) [ 2629.796817] binder: 17317:17379 BC_ACQUIRE_DONE u0000000000000000 no match [ 2629.796825] binder: 17317:17379 BC_ACQUIRE_DONE u0000000000000003 no match [ 2629.796838] binder: 17317:17379 transaction failed 29189/-22, size 80-24 line 3014 18:07:42 executing program 1: clone(0x2102001fff, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) socket(0x0, 0x0, 0x0) r0 = getpid() rt_tgsigqueueinfo(0x0, r0, 0x16, &(0x7f0000000100)) rt_sigqueueinfo(r0, 0x7, &(0x7f0000000180)={0x0, 0x0, 0xffffffff}) 18:07:42 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000006c0)={0x118, 0x0, &(0x7f0000000540)=[@release={0x40046306, 0x2}, @acquire_done, @acquire_done={0x40106309, 0x3}, @transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x50, 0x18, &(0x7f0000000080)={@flat=@binder={0x73622a85, 0xa, 0x1}, @fda={0x66646185, 0xa, 0x1, 0x9}, @fd={0x66642a85, 0x0, r1}}, &(0x7f0000000100)={0x0, 0x18, 0x38}}, 0x1000}, @transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000180)={@ptr={0x70742a85, 0x0, &(0x7f0000000140)=""/51, 0x33, 0x2, 0x25}, @flat=@weak_handle={0x77682a85, 0x1}, @flat=@binder={0x73622a85, 0xa, 0x3}}, &(0x7f0000000280)={0x0, 0x28, 0x40}}, 0x1f8aed83e3349436}, @exit_looper, @transaction_sg={0x40486311, {0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x68, 0x18, &(0x7f0000000480)={@ptr={0x70742a85, 0x0, &(0x7f00000002c0)=""/11, 0xb, 0x2, 0x3f}, @fd={0x66642a85, 0x0, r0}, @ptr={0x70742a85, 0x0, &(0x7f0000000380)=""/70, 0x46, 0x1, 0x1f}}, &(0x7f0000000500)={0x0, 0x28, 0x40}}, 0x1000}], 0x14, 0x0, &(0x7f0000000680)="86621f50fcee8bdc5bf8c503a78812261b4bf6d7"}) [ 2629.797656] binder: undelivered TRANSACTION_ERROR: 29189 [ 2629.894813] binder: 17393:17397 Release 1 refcount change on invalid ref 2 ret -22 18:07:42 executing program 4: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000040)='/dev/net/tun\x00', 0x0, 0x0) r1 = epoll_create1(0x0) epoll_ctl$EPOLL_CTL_ADD(0xffffffffffffffff, 0x1, r0, &(0x7f0000000100)) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000080)={'tunl0\x00', 0x1}) epoll_wait(r1, &(0x7f00000000c0)=[{}], 0x1, 0x0) 18:07:42 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000006c0)={0x118, 0x0, &(0x7f0000000540)=[@release={0x40046306, 0x2}, @acquire_done, @acquire_done={0x40106309, 0x3}, @transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x50, 0x18, &(0x7f0000000080)={@flat=@binder={0x73622a85, 0xa, 0x1}, @fda={0x66646185, 0xa, 0x1, 0x9}, @fd={0x66642a85, 0x0, r1}}, &(0x7f0000000100)={0x0, 0x18, 0x38}}, 0x1000}, @transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000180)={@ptr={0x70742a85, 0x0, &(0x7f0000000140)=""/51, 0x33, 0x2, 0x25}, @flat=@weak_handle={0x77682a85, 0x1}, @flat=@binder={0x73622a85, 0xa, 0x3}}, &(0x7f0000000280)={0x0, 0x28, 0x40}}, 0x1f8aed83e3349436}, @exit_looper, @transaction_sg={0x40486311, {0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x68, 0x18, &(0x7f0000000480)={@ptr={0x70742a85, 0x0, &(0x7f00000002c0)=""/11, 0xb, 0x2, 0x3f}, @fd={0x66642a85, 0x0, r0}, @ptr={0x70742a85, 0x0, &(0x7f0000000380)=""/70, 0x46, 0x1, 0x1f}}, &(0x7f0000000500)={0x0, 0x28, 0x40}}, 0x1000}], 0x14, 0x0, &(0x7f0000000680)="86621f50fcee8bdc5bf8c503a78812261b4bf6d7"}) 18:07:42 executing program 3: r0 = socket(0x10, 0x3, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") ioctl$sock_ifreq(r0, 0x89f3, &(0x7f0000000240)={'sit0\x00'}) 18:07:42 executing program 1: clone(0x2102001fff, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) socket(0x0, 0x0, 0x0) r0 = getpid() rt_tgsigqueueinfo(0x0, r0, 0x16, &(0x7f0000000100)) rt_sigqueueinfo(r0, 0x7, &(0x7f0000000180)={0x0, 0x0, 0xffffffff}) [ 2629.894823] binder: 17393:17397 BC_ACQUIRE_DONE u0000000000000000 no match 18:07:42 executing program 2: ioctl$FS_IOC_RESVSP(0xffffffffffffffff, 0x40305828, &(0x7f00000000c0)={0x0, 0x0, 0x100000000000001}) clone(0x2102001fff, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) socket(0x0, 0x0, 0x0) r0 = getpid() rt_tgsigqueueinfo(0x0, r0, 0x16, &(0x7f0000000100)) ptrace(0x10, r0) ptrace$poke(0x4209, r0, &(0x7f00000000c0), 0x70effd) [ 2629.894832] binder: 17393:17397 BC_ACQUIRE_DONE u0000000000000003 no match 18:07:42 executing program 5: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000001a00)='/dev/net/tun\x00', 0x0, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000080)="c0dc00025e0b01047be070") ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000300)={'nr0\x01\x00', 0x1132}) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000001a00)='/dev/net/tun\x00', 0x2, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000300)={'nr0\x01\x00', 0x1132}) write$cgroup_int(0xffffffffffffffff, &(0x7f00000000c0)=0x2, 0xfffffffffffffe75) close(r1) 18:07:42 executing program 3: r0 = socket(0x10, 0x3, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") ioctl$sock_ifreq(r0, 0x89f3, &(0x7f0000000240)={'sit0\x00'}) 18:07:42 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000006c0)={0x118, 0x0, &(0x7f0000000540)=[@release={0x40046306, 0x2}, @acquire_done, @acquire_done={0x40106309, 0x3}, @transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x50, 0x18, &(0x7f0000000080)={@flat=@binder={0x73622a85, 0xa, 0x1}, @fda={0x66646185, 0xa, 0x1, 0x9}, @fd={0x66642a85, 0x0, r1}}, &(0x7f0000000100)={0x0, 0x18, 0x38}}, 0x1000}, @transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000180)={@ptr={0x70742a85, 0x0, &(0x7f0000000140)=""/51, 0x33, 0x2, 0x25}, @flat=@weak_handle={0x77682a85, 0x1}, @flat=@binder={0x73622a85, 0xa, 0x3}}, &(0x7f0000000280)={0x0, 0x28, 0x40}}, 0x1f8aed83e3349436}, @exit_looper, @transaction_sg={0x40486311, {0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x68, 0x18, &(0x7f0000000480)={@ptr={0x70742a85, 0x0, &(0x7f00000002c0)=""/11, 0xb, 0x2, 0x3f}, @fd={0x66642a85, 0x0, r0}, @ptr={0x70742a85, 0x0, &(0x7f0000000380)=""/70, 0x46, 0x1, 0x1f}}, &(0x7f0000000500)={0x0, 0x28, 0x40}}, 0x1000}], 0x14, 0x0, &(0x7f0000000680)="86621f50fcee8bdc5bf8c503a78812261b4bf6d7"}) [ 2629.894846] binder: 17393:17397 transaction failed 29189/-22, size 80-24 line 3014 [ 2629.895413] binder: undelivered TRANSACTION_ERROR: 29189 18:07:42 executing program 1: clone(0x2102001fff, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) socket(0x0, 0x0, 0x0) r0 = getpid() rt_tgsigqueueinfo(0x0, r0, 0x16, &(0x7f0000000100)) rt_sigqueueinfo(r0, 0x7, &(0x7f0000000180)={0x0, 0x0, 0xffffffff}) 18:07:42 executing program 4: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000040)='/dev/net/tun\x00', 0x0, 0x0) r1 = epoll_create1(0x0) epoll_ctl$EPOLL_CTL_ADD(0xffffffffffffffff, 0x1, r0, &(0x7f0000000100)) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000080)={'tunl0\x00', 0x1}) epoll_wait(r1, &(0x7f00000000c0)=[{}], 0x1, 0x0) 18:07:42 executing program 3: r0 = socket(0x10, 0x3, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") ioctl$sock_ifreq(r0, 0x89f3, &(0x7f0000000240)={'sit0\x00'}) [ 2632.517445] binder: 17422:17442 Release 1 refcount change on invalid ref 2 ret -22 18:07:42 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000006c0)={0x118, 0x0, &(0x7f0000000540)=[@release={0x40046306, 0x2}, @acquire_done, @acquire_done={0x40106309, 0x3}, @transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x50, 0x18, &(0x7f0000000080)={@flat=@binder={0x73622a85, 0xa, 0x1}, @fda={0x66646185, 0xa, 0x1, 0x9}, @fd={0x66642a85, 0x0, r1}}, &(0x7f0000000100)={0x0, 0x18, 0x38}}, 0x1000}, @transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000180)={@ptr={0x70742a85, 0x0, &(0x7f0000000140)=""/51, 0x33, 0x2, 0x25}, @flat=@weak_handle={0x77682a85, 0x1}, @flat=@binder={0x73622a85, 0xa, 0x3}}, &(0x7f0000000280)={0x0, 0x28, 0x40}}, 0x1f8aed83e3349436}, @exit_looper, @transaction_sg={0x40486311, {0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x68, 0x18, &(0x7f0000000480)={@ptr={0x70742a85, 0x0, &(0x7f00000002c0)=""/11, 0xb, 0x2, 0x3f}, @fd={0x66642a85, 0x0, r0}, @ptr={0x70742a85, 0x0, &(0x7f0000000380)=""/70, 0x46, 0x1, 0x1f}}, &(0x7f0000000500)={0x0, 0x28, 0x40}}, 0x1000}], 0x14, 0x0, &(0x7f0000000680)="86621f50fcee8bdc5bf8c503a78812261b4bf6d7"}) [ 2632.517455] binder: 17422:17442 BC_ACQUIRE_DONE u0000000000000000 no match 18:07:42 executing program 2: ioctl$FS_IOC_RESVSP(0xffffffffffffffff, 0x40305828, &(0x7f00000000c0)={0x0, 0x0, 0x100000000000001}) clone(0x2102001fff, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) socket(0x0, 0x0, 0x0) r0 = getpid() rt_tgsigqueueinfo(0x0, r0, 0x16, &(0x7f0000000100)) ptrace(0x10, r0) ptrace$poke(0x4209, r0, &(0x7f00000000c0), 0x70effd) 18:07:42 executing program 1: clone(0x2102001fff, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) socket(0x0, 0x0, 0x0) r0 = getpid() rt_tgsigqueueinfo(0x0, r0, 0x16, &(0x7f0000000100)) rt_sigqueueinfo(r0, 0x7, &(0x7f0000000180)={0x0, 0x0, 0xffffffff}) [ 2632.517463] binder: 17422:17442 BC_ACQUIRE_DONE u0000000000000003 no match [ 2632.517476] binder: 17422:17442 transaction failed 29189/-22, size 80-24 line 3014 18:07:42 executing program 4: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000040)='/dev/net/tun\x00', 0x0, 0x0) r1 = epoll_create1(0x0) epoll_ctl$EPOLL_CTL_ADD(0xffffffffffffffff, 0x1, r0, &(0x7f0000000100)) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000080)={'tunl0\x00', 0x1}) epoll_wait(r1, &(0x7f00000000c0)=[{}], 0x1, 0x0) 18:07:42 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000006c0)={0x118, 0x0, &(0x7f0000000540)=[@release={0x40046306, 0x2}, @acquire_done, @acquire_done={0x40106309, 0x3}, @transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x50, 0x18, &(0x7f0000000080)={@flat=@binder={0x73622a85, 0xa, 0x1}, @fda={0x66646185, 0xa, 0x1, 0x9}, @fd={0x66642a85, 0x0, r1}}, &(0x7f0000000100)={0x0, 0x18, 0x38}}, 0x1000}, @transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000180)={@ptr={0x70742a85, 0x0, &(0x7f0000000140)=""/51, 0x33, 0x2, 0x25}, @flat=@weak_handle={0x77682a85, 0x1}, @flat=@binder={0x73622a85, 0xa, 0x3}}, &(0x7f0000000280)={0x0, 0x28, 0x40}}, 0x1f8aed83e3349436}, @exit_looper, @transaction_sg={0x40486311, {0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x68, 0x18, &(0x7f0000000480)={@ptr={0x70742a85, 0x0, &(0x7f00000002c0)=""/11, 0xb, 0x2, 0x3f}, @fd={0x66642a85, 0x0, r0}, @ptr={0x70742a85, 0x0, &(0x7f0000000380)=""/70, 0x46, 0x1, 0x1f}}, &(0x7f0000000500)={0x0, 0x28, 0x40}}, 0x1000}], 0x14, 0x0, &(0x7f0000000680)="86621f50fcee8bdc5bf8c503a78812261b4bf6d7"}) 18:07:42 executing program 3: r0 = socket(0x10, 0x3, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") ioctl$sock_ifreq(r0, 0x89f3, &(0x7f0000000240)={'sit0\x00'}) 18:07:42 executing program 5: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000001a00)='/dev/net/tun\x00', 0x0, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000080)="c0dc00025e0b01047be070") ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000300)={'nr0\x01\x00', 0x1132}) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000001a00)='/dev/net/tun\x00', 0x2, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000300)={'nr0\x01\x00', 0x1132}) write$cgroup_int(0xffffffffffffffff, &(0x7f00000000c0)=0x2, 0xfffffffffffffe75) close(r1) [ 2632.517728] binder: undelivered TRANSACTION_ERROR: 29189 [ 2632.599931] binder: 17478:17489 Release 1 refcount change on invalid ref 2 ret -22 [ 2632.599940] binder: 17478:17489 BC_ACQUIRE_DONE u0000000000000000 no match [ 2632.599948] binder: 17478:17489 BC_ACQUIRE_DONE u0000000000000003 no match 18:07:42 executing program 3: r0 = socket(0x10, 0x3, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") ioctl$sock_ifreq(r0, 0x89f3, &(0x7f0000000240)={'sit0\x00'}) [ 2632.599960] binder: 17478:17489 transaction failed 29189/-22, size 80-24 line 3014 18:07:42 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000006c0)={0x118, 0x0, &(0x7f0000000540)=[@release={0x40046306, 0x2}, @acquire_done, @acquire_done={0x40106309, 0x3}, @transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x50, 0x18, &(0x7f0000000080)={@flat=@binder={0x73622a85, 0xa, 0x1}, @fda={0x66646185, 0xa, 0x1, 0x9}, @fd={0x66642a85, 0x0, r1}}, &(0x7f0000000100)={0x0, 0x18, 0x38}}, 0x1000}, @transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000180)={@ptr={0x70742a85, 0x0, &(0x7f0000000140)=""/51, 0x33, 0x2, 0x25}, @flat=@weak_handle={0x77682a85, 0x1}, @flat=@binder={0x73622a85, 0xa, 0x3}}, &(0x7f0000000280)={0x0, 0x28, 0x40}}, 0x1f8aed83e3349436}, @exit_looper, @transaction_sg={0x40486311, {0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x68, 0x18, &(0x7f0000000480)={@ptr={0x70742a85, 0x0, &(0x7f00000002c0)=""/11, 0xb, 0x2, 0x3f}, @fd={0x66642a85, 0x0, r0}, @ptr={0x70742a85, 0x0, &(0x7f0000000380)=""/70, 0x46, 0x1, 0x1f}}, &(0x7f0000000500)={0x0, 0x28, 0x40}}, 0x1000}], 0x14, 0x0, &(0x7f0000000680)="86621f50fcee8bdc5bf8c503a78812261b4bf6d7"}) 18:07:43 executing program 2: ioctl$FS_IOC_RESVSP(0xffffffffffffffff, 0x40305828, &(0x7f00000000c0)={0x0, 0x0, 0x100000000000001}) clone(0x2102001fff, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) socket(0x0, 0x0, 0x0) r0 = getpid() rt_tgsigqueueinfo(0x0, r0, 0x16, &(0x7f0000000100)) ptrace(0x10, r0) ptrace$poke(0x4209, r0, &(0x7f00000000c0), 0x70effd) 18:07:43 executing program 4: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000040)='/dev/net/tun\x00', 0x0, 0x0) r1 = epoll_create1(0x0) epoll_ctl$EPOLL_CTL_ADD(0xffffffffffffffff, 0x1, r0, &(0x7f0000000100)) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000080)={'tunl0\x00', 0x1}) epoll_wait(r1, &(0x7f00000000c0)=[{}], 0x1, 0x0) 18:07:43 executing program 1: clone(0x2102001fff, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) socket(0x0, 0x0, 0x0) r0 = getpid() rt_tgsigqueueinfo(0x0, r0, 0x16, &(0x7f0000000100)) rt_sigqueueinfo(r0, 0x7, &(0x7f0000000180)={0x0, 0x0, 0xffffffff}) 18:07:43 executing program 5: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000001a00)='/dev/net/tun\x00', 0x0, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000080)="c0dc00025e0b01047be070") ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000300)={'nr0\x01\x00', 0x1132}) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000001a00)='/dev/net/tun\x00', 0x2, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000300)={'nr0\x01\x00', 0x1132}) write$cgroup_int(0xffffffffffffffff, &(0x7f00000000c0)=0x2, 0xfffffffffffffe75) close(r1) [ 2632.607453] binder: undelivered TRANSACTION_ERROR: 29189 [ 2632.693476] binder: 17510:17514 Release 1 refcount change on invalid ref 2 ret -22 18:07:43 executing program 3: r0 = socket(0x10, 0x3, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") ioctl$sock_ifreq(r0, 0x89f3, &(0x7f0000000240)={'sit0\x00'}) 18:07:43 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000006c0)={0x118, 0x0, &(0x7f0000000540)=[@release={0x40046306, 0x2}, @acquire_done, @acquire_done={0x40106309, 0x3}, @transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x50, 0x18, &(0x7f0000000080)={@flat=@binder={0x73622a85, 0xa, 0x1}, @fda={0x66646185, 0xa, 0x1, 0x9}, @fd={0x66642a85, 0x0, r1}}, &(0x7f0000000100)={0x0, 0x18, 0x38}}, 0x1000}, @transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000180)={@ptr={0x70742a85, 0x0, &(0x7f0000000140)=""/51, 0x33, 0x2, 0x25}, @flat=@weak_handle={0x77682a85, 0x1}, @flat=@binder={0x73622a85, 0xa, 0x3}}, &(0x7f0000000280)={0x0, 0x28, 0x40}}, 0x1f8aed83e3349436}, @exit_looper, @transaction_sg={0x40486311, {0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x68, 0x18, &(0x7f0000000480)={@ptr={0x70742a85, 0x0, &(0x7f00000002c0)=""/11, 0xb, 0x2, 0x3f}, @fd={0x66642a85, 0x0, r0}, @ptr={0x70742a85, 0x0, &(0x7f0000000380)=""/70, 0x46, 0x1, 0x1f}}, &(0x7f0000000500)={0x0, 0x28, 0x40}}, 0x1000}], 0x14, 0x0, &(0x7f0000000680)="86621f50fcee8bdc5bf8c503a78812261b4bf6d7"}) [ 2632.693486] binder: 17510:17514 BC_ACQUIRE_DONE u0000000000000000 no match [ 2632.693494] binder: 17510:17514 BC_ACQUIRE_DONE u0000000000000003 no match 18:07:43 executing program 1: clone(0x2102001fff, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) socket(0x0, 0x0, 0x0) r0 = getpid() rt_tgsigqueueinfo(0x0, r0, 0x16, &(0x7f0000000100)) rt_sigqueueinfo(r0, 0x7, &(0x7f0000000180)={0x0, 0x0, 0xffffffff}) 18:07:43 executing program 3: r0 = socket(0x10, 0x3, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") ioctl$sock_ifreq(r0, 0x89f3, &(0x7f0000000240)={'sit0\x00'}) [ 2632.693515] binder: 17510:17514 transaction failed 29189/-22, size 80-24 line 3014 18:07:43 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000006c0)={0x118, 0x0, &(0x7f0000000540)=[@release={0x40046306, 0x2}, @acquire_done, @acquire_done={0x40106309, 0x3}, @transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x50, 0x18, &(0x7f0000000080)={@flat=@binder={0x73622a85, 0xa, 0x1}, @fda={0x66646185, 0xa, 0x1, 0x9}, @fd={0x66642a85, 0x0, r1}}, &(0x7f0000000100)={0x0, 0x18, 0x38}}, 0x1000}, @transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000180)={@ptr={0x70742a85, 0x0, &(0x7f0000000140)=""/51, 0x33, 0x2, 0x25}, @flat=@weak_handle={0x77682a85, 0x1}, @flat=@binder={0x73622a85, 0xa, 0x3}}, &(0x7f0000000280)={0x0, 0x28, 0x40}}, 0x1f8aed83e3349436}, @exit_looper, @transaction_sg={0x40486311, {0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x68, 0x18, &(0x7f0000000480)={@ptr={0x70742a85, 0x0, &(0x7f00000002c0)=""/11, 0xb, 0x2, 0x3f}, @fd={0x66642a85, 0x0, r0}, @ptr={0x70742a85, 0x0, &(0x7f0000000380)=""/70, 0x46, 0x1, 0x1f}}, &(0x7f0000000500)={0x0, 0x28, 0x40}}, 0x1000}], 0x14, 0x0, &(0x7f0000000680)="86621f50fcee8bdc5bf8c503a78812261b4bf6d7"}) [ 2632.693817] binder: undelivered TRANSACTION_ERROR: 29189 [ 2632.882703] binder: 17566:17584 Release 1 refcount change on invalid ref 2 ret -22 18:07:43 executing program 3: r0 = socket(0x10, 0x3, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") ioctl$sock_ifreq(r0, 0x89f3, &(0x7f0000000240)={'sit0\x00'}) [ 2632.882713] binder: 17566:17584 BC_ACQUIRE_DONE u0000000000000000 no match 18:07:43 executing program 1: clone(0x2102001fff, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) socket(0x0, 0x0, 0x0) r0 = getpid() rt_tgsigqueueinfo(0x0, r0, 0x16, &(0x7f0000000100)) rt_sigqueueinfo(r0, 0x7, &(0x7f0000000180)={0x0, 0x0, 0xffffffff}) 18:07:43 executing program 4: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000040)='/dev/net/tun\x00', 0x0, 0x0) r1 = epoll_create1(0x0) epoll_ctl$EPOLL_CTL_ADD(0xffffffffffffffff, 0x1, r0, &(0x7f0000000100)) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000080)={'tunl0\x00', 0x1}) epoll_wait(r1, &(0x7f00000000c0)=[{}], 0x1, 0x0) 18:07:43 executing program 2: ioctl$FS_IOC_RESVSP(0xffffffffffffffff, 0x40305828, &(0x7f00000000c0)={0x0, 0x0, 0x100000000000001}) clone(0x2102001fff, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) socket(0x0, 0x0, 0x0) r0 = getpid() rt_tgsigqueueinfo(0x0, r0, 0x16, &(0x7f0000000100)) ptrace(0x10, r0) ptrace$poke(0x4209, r0, &(0x7f00000000c0), 0x70effd) 18:07:43 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000006c0)={0x118, 0x0, &(0x7f0000000540)=[@release={0x40046306, 0x2}, @acquire_done, @acquire_done={0x40106309, 0x3}, @transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x50, 0x18, &(0x7f0000000080)={@flat=@binder={0x73622a85, 0xa, 0x1}, @fda={0x66646185, 0xa, 0x1, 0x9}, @fd={0x66642a85, 0x0, r1}}, &(0x7f0000000100)={0x0, 0x18, 0x38}}, 0x1000}, @transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000180)={@ptr={0x70742a85, 0x0, &(0x7f0000000140)=""/51, 0x33, 0x2, 0x25}, @flat=@weak_handle={0x77682a85, 0x1}, @flat=@binder={0x73622a85, 0xa, 0x3}}, &(0x7f0000000280)={0x0, 0x28, 0x40}}, 0x1f8aed83e3349436}, @exit_looper, @transaction_sg={0x40486311, {0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x68, 0x18, &(0x7f0000000480)={@ptr={0x70742a85, 0x0, &(0x7f00000002c0)=""/11, 0xb, 0x2, 0x3f}, @fd={0x66642a85, 0x0, r0}, @ptr={0x70742a85, 0x0, &(0x7f0000000380)=""/70, 0x46, 0x1, 0x1f}}, &(0x7f0000000500)={0x0, 0x28, 0x40}}, 0x1000}], 0x14, 0x0, &(0x7f0000000680)="86621f50fcee8bdc5bf8c503a78812261b4bf6d7"}) [ 2632.882720] binder: 17566:17584 BC_ACQUIRE_DONE u0000000000000003 no match 18:07:43 executing program 5: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000001a00)='/dev/net/tun\x00', 0x0, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000080)="c0dc00025e0b01047be070") ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000300)={'nr0\x01\x00', 0x1132}) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000001a00)='/dev/net/tun\x00', 0x2, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000300)={'nr0\x01\x00', 0x1132}) write$cgroup_int(0xffffffffffffffff, &(0x7f00000000c0)=0x2, 0xfffffffffffffe75) close(r1) [ 2632.882733] binder: 17566:17584 transaction failed 29189/-22, size 80-24 line 3014 18:07:43 executing program 1: clone(0x2102001fff, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) socket(0x0, 0x0, 0x0) r0 = getpid() rt_tgsigqueueinfo(0x0, r0, 0x16, &(0x7f0000000100)) rt_sigqueueinfo(r0, 0x7, &(0x7f0000000180)={0x0, 0x0, 0xffffffff}) [ 2632.882983] binder: undelivered TRANSACTION_ERROR: 29189 [ 2632.975577] binder: 17609:17612 Release 1 refcount change on invalid ref 2 ret -22 [ 2632.975588] binder: 17609:17612 BC_ACQUIRE_DONE u0000000000000000 no match 18:07:43 executing program 3: r0 = socket(0x10, 0x3, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") ioctl$sock_ifreq(r0, 0x89f3, &(0x7f0000000240)={'sit0\x00'}) 18:07:43 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000006c0)={0x118, 0x0, &(0x7f0000000540)=[@release={0x40046306, 0x2}, @acquire_done, @acquire_done={0x40106309, 0x3}, @transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x50, 0x18, &(0x7f0000000080)={@flat=@binder={0x73622a85, 0xa, 0x1}, @fda={0x66646185, 0xa, 0x1, 0x9}, @fd={0x66642a85, 0x0, r1}}, &(0x7f0000000100)={0x0, 0x18, 0x38}}, 0x1000}, @transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000180)={@ptr={0x70742a85, 0x0, &(0x7f0000000140)=""/51, 0x33, 0x2, 0x25}, @flat=@weak_handle={0x77682a85, 0x1}, @flat=@binder={0x73622a85, 0xa, 0x3}}, &(0x7f0000000280)={0x0, 0x28, 0x40}}, 0x1f8aed83e3349436}, @exit_looper, @transaction_sg={0x40486311, {0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x68, 0x18, &(0x7f0000000480)={@ptr={0x70742a85, 0x0, &(0x7f00000002c0)=""/11, 0xb, 0x2, 0x3f}, @fd={0x66642a85, 0x0, r0}, @ptr={0x70742a85, 0x0, &(0x7f0000000380)=""/70, 0x46, 0x1, 0x1f}}, &(0x7f0000000500)={0x0, 0x28, 0x40}}, 0x1000}], 0x14, 0x0, &(0x7f0000000680)="86621f50fcee8bdc5bf8c503a78812261b4bf6d7"}) [ 2632.975596] binder: 17609:17612 BC_ACQUIRE_DONE u0000000000000003 no match 18:07:43 executing program 2: ioctl$FS_IOC_RESVSP(0xffffffffffffffff, 0x40305828, &(0x7f00000000c0)={0x0, 0x0, 0x100000000000001}) clone(0x2102001fff, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) socket(0x0, 0x0, 0x0) r0 = getpid() rt_tgsigqueueinfo(0x0, r0, 0x16, &(0x7f0000000100)) ptrace(0x10, r0) ptrace$poke(0x4209, r0, &(0x7f00000000c0), 0x70effd) [ 2632.975611] binder: 17609:17612 transaction failed 29189/-22, size 80-24 line 3014 18:07:43 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000006c0)={0x118, 0x0, &(0x7f0000000540)=[@release={0x40046306, 0x2}, @acquire_done, @acquire_done={0x40106309, 0x3}, @transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x50, 0x18, &(0x7f0000000080)={@flat=@binder={0x73622a85, 0xa, 0x1}, @fda={0x66646185, 0xa, 0x1, 0x9}, @fd={0x66642a85, 0x0, r1}}, &(0x7f0000000100)={0x0, 0x18, 0x38}}, 0x1000}, @transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000180)={@ptr={0x70742a85, 0x0, &(0x7f0000000140)=""/51, 0x33, 0x2, 0x25}, @flat=@weak_handle={0x77682a85, 0x1}, @flat=@binder={0x73622a85, 0xa, 0x3}}, &(0x7f0000000280)={0x0, 0x28, 0x40}}, 0x1f8aed83e3349436}, @exit_looper, @transaction_sg={0x40486311, {0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x68, 0x18, &(0x7f0000000480)={@ptr={0x70742a85, 0x0, &(0x7f00000002c0)=""/11, 0xb, 0x2, 0x3f}, @fd={0x66642a85, 0x0, r0}, @ptr={0x70742a85, 0x0, &(0x7f0000000380)=""/70, 0x46, 0x1, 0x1f}}, &(0x7f0000000500)={0x0, 0x28, 0x40}}, 0x1000}], 0x14, 0x0, &(0x7f0000000680)="86621f50fcee8bdc5bf8c503a78812261b4bf6d7"}) 18:07:43 executing program 4: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000040)='/dev/net/tun\x00', 0x0, 0x0) r1 = epoll_create1(0x0) epoll_ctl$EPOLL_CTL_ADD(0xffffffffffffffff, 0x1, r0, &(0x7f0000000100)) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000080)={'tunl0\x00', 0x1}) epoll_wait(r1, &(0x7f00000000c0)=[{}], 0x1, 0x0) [ 2632.975925] binder: undelivered TRANSACTION_ERROR: 29189 18:07:43 executing program 1: clone(0x2102001fff, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) socket(0x0, 0x0, 0x0) r0 = getpid() rt_tgsigqueueinfo(0x0, r0, 0x16, &(0x7f0000000100)) rt_sigqueueinfo(r0, 0x7, &(0x7f0000000180)={0x0, 0x0, 0xffffffff}) 18:07:43 executing program 3: r0 = socket(0x10, 0x3, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") ioctl$sock_ifreq(r0, 0x89f3, &(0x7f0000000240)={'sit0\x00'}) 18:07:43 executing program 5: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000001a00)='/dev/net/tun\x00', 0x0, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000080)="c0dc00025e0b01047be070") ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000300)={'nr0\x01\x00', 0x1132}) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000001a00)='/dev/net/tun\x00', 0x2, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000300)={'nr0\x01\x00', 0x1132}) write$cgroup_int(0xffffffffffffffff, &(0x7f00000000c0)=0x2, 0xfffffffffffffe75) close(r1) 18:07:43 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000006c0)={0x118, 0x0, &(0x7f0000000540)=[@release={0x40046306, 0x2}, @acquire_done, @acquire_done={0x40106309, 0x3}, @transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x50, 0x18, &(0x7f0000000080)={@flat=@binder={0x73622a85, 0xa, 0x1}, @fda={0x66646185, 0xa, 0x1, 0x9}, @fd={0x66642a85, 0x0, r1}}, &(0x7f0000000100)={0x0, 0x18, 0x38}}, 0x1000}, @transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000180)={@ptr={0x70742a85, 0x0, &(0x7f0000000140)=""/51, 0x33, 0x2, 0x25}, @flat=@weak_handle={0x77682a85, 0x1}, @flat=@binder={0x73622a85, 0xa, 0x3}}, &(0x7f0000000280)={0x0, 0x28, 0x40}}, 0x1f8aed83e3349436}, @exit_looper, @transaction_sg={0x40486311, {0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x68, 0x18, &(0x7f0000000480)={@ptr={0x70742a85, 0x0, &(0x7f00000002c0)=""/11, 0xb, 0x2, 0x3f}, @fd={0x66642a85, 0x0, r0}, @ptr={0x70742a85, 0x0, &(0x7f0000000380)=""/70, 0x46, 0x1, 0x1f}}, &(0x7f0000000500)={0x0, 0x28, 0x40}}, 0x1000}], 0x14, 0x0, &(0x7f0000000680)="86621f50fcee8bdc5bf8c503a78812261b4bf6d7"}) [ 2633.066357] binder: 17637:17648 Release 1 refcount change on invalid ref 2 ret -22 18:07:43 executing program 3: r0 = socket(0x10, 0x3, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") ioctl$sock_ifreq(r0, 0x89f3, &(0x7f0000000240)={'sit0\x00'}) [ 2633.066367] binder: 17637:17648 BC_ACQUIRE_DONE u0000000000000000 no match 18:07:43 executing program 1: clone(0x2102001fff, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) socket(0x0, 0x0, 0x0) r0 = getpid() rt_tgsigqueueinfo(0x0, r0, 0x16, &(0x7f0000000100)) rt_sigqueueinfo(r0, 0x7, &(0x7f0000000180)={0x0, 0x0, 0xffffffff}) 18:07:43 executing program 2: ioctl$FS_IOC_RESVSP(0xffffffffffffffff, 0x40305828, &(0x7f00000000c0)={0x0, 0x0, 0x100000000000001}) clone(0x2102001fff, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) socket(0x0, 0x0, 0x0) r0 = getpid() rt_tgsigqueueinfo(0x0, r0, 0x16, &(0x7f0000000100)) ptrace(0x10, r0) ptrace$poke(0x4209, r0, &(0x7f00000000c0), 0x70effd) 18:07:43 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000006c0)={0x118, 0x0, &(0x7f0000000540)=[@release={0x40046306, 0x2}, @acquire_done, @acquire_done={0x40106309, 0x3}, @transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x50, 0x18, &(0x7f0000000080)={@flat=@binder={0x73622a85, 0xa, 0x1}, @fda={0x66646185, 0xa, 0x1, 0x9}, @fd={0x66642a85, 0x0, r1}}, &(0x7f0000000100)={0x0, 0x18, 0x38}}, 0x1000}, @transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000180)={@ptr={0x70742a85, 0x0, &(0x7f0000000140)=""/51, 0x33, 0x2, 0x25}, @flat=@weak_handle={0x77682a85, 0x1}, @flat=@binder={0x73622a85, 0xa, 0x3}}, &(0x7f0000000280)={0x0, 0x28, 0x40}}, 0x1f8aed83e3349436}, @exit_looper, @transaction_sg={0x40486311, {0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x68, 0x18, &(0x7f0000000480)={@ptr={0x70742a85, 0x0, &(0x7f00000002c0)=""/11, 0xb, 0x2, 0x3f}, @fd={0x66642a85, 0x0, r0}, @ptr={0x70742a85, 0x0, &(0x7f0000000380)=""/70, 0x46, 0x1, 0x1f}}, &(0x7f0000000500)={0x0, 0x28, 0x40}}, 0x1000}], 0x14, 0x0, &(0x7f0000000680)="86621f50fcee8bdc5bf8c503a78812261b4bf6d7"}) [ 2633.066375] binder: 17637:17648 BC_ACQUIRE_DONE u0000000000000003 no match 18:07:43 executing program 2: ioctl$FS_IOC_RESVSP(0xffffffffffffffff, 0x40305828, &(0x7f00000000c0)={0x0, 0x0, 0x100000000000001}) clone(0x2102001fff, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) socket(0x0, 0x0, 0x0) r0 = getpid() rt_tgsigqueueinfo(0x0, r0, 0x16, &(0x7f0000000100)) ptrace(0x10, r0) ptrace$poke(0x4209, r0, &(0x7f00000000c0), 0x70effd) 18:07:43 executing program 1: clone(0x2102001fff, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) socket(0x0, 0x0, 0x0) r0 = getpid() rt_tgsigqueueinfo(0x0, r0, 0x16, &(0x7f0000000100)) rt_sigqueueinfo(r0, 0x7, &(0x7f0000000180)={0x0, 0x0, 0xffffffff}) [ 2633.066387] binder: 17637:17648 transaction failed 29189/-22, size 80-24 line 3014 [ 2633.066681] binder: undelivered TRANSACTION_ERROR: 29189 [ 2633.178722] binder: 17673:17685 Release 1 refcount change on invalid ref 2 ret -22 [ 2633.178734] binder: 17673:17685 BC_ACQUIRE_DONE u0000000000000000 no match 18:07:44 executing program 3: r0 = socket(0x10, 0x3, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") ioctl$sock_ifreq(r0, 0x89f3, &(0x7f0000000240)={'sit0\x00'}) [ 2633.178744] binder: 17673:17685 BC_ACQUIRE_DONE u0000000000000003 no match [ 2633.178759] binder: 17673:17685 transaction failed 29189/-22, size 80-24 line 3014 18:07:44 executing program 4: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000040)='/dev/net/tun\x00', 0x0, 0x0) r1 = epoll_create1(0x0) epoll_ctl$EPOLL_CTL_ADD(0xffffffffffffffff, 0x1, r0, &(0x7f0000000100)) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000080)={'tunl0\x00', 0x1}) epoll_wait(r1, &(0x7f00000000c0)=[{}], 0x1, 0x0) 18:07:44 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000006c0)={0x118, 0x0, &(0x7f0000000540)=[@release={0x40046306, 0x2}, @acquire_done, @acquire_done={0x40106309, 0x3}, @transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x50, 0x18, &(0x7f0000000080)={@flat=@binder={0x73622a85, 0xa, 0x1}, @fda={0x66646185, 0xa, 0x1, 0x9}, @fd={0x66642a85, 0x0, r1}}, &(0x7f0000000100)={0x0, 0x18, 0x38}}, 0x1000}, @transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000180)={@ptr={0x70742a85, 0x0, &(0x7f0000000140)=""/51, 0x33, 0x2, 0x25}, @flat=@weak_handle={0x77682a85, 0x1}, @flat=@binder={0x73622a85, 0xa, 0x3}}, &(0x7f0000000280)={0x0, 0x28, 0x40}}, 0x1f8aed83e3349436}, @exit_looper, @transaction_sg={0x40486311, {0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x68, 0x18, &(0x7f0000000480)={@ptr={0x70742a85, 0x0, &(0x7f00000002c0)=""/11, 0xb, 0x2, 0x3f}, @fd={0x66642a85, 0x0, r0}, @ptr={0x70742a85, 0x0, &(0x7f0000000380)=""/70, 0x46, 0x1, 0x1f}}, &(0x7f0000000500)={0x0, 0x28, 0x40}}, 0x1000}], 0x14, 0x0, &(0x7f0000000680)="86621f50fcee8bdc5bf8c503a78812261b4bf6d7"}) 18:07:44 executing program 1: clone(0x2102001fff, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) socket(0x0, 0x0, 0x0) r0 = getpid() rt_tgsigqueueinfo(0x0, r0, 0x16, &(0x7f0000000100)) rt_sigqueueinfo(r0, 0x7, &(0x7f0000000180)={0x0, 0x0, 0xffffffff}) 18:07:44 executing program 5: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000001a00)='/dev/net/tun\x00', 0x0, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000080)="c0dc00025e0b01047be070") ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000300)={'nr0\x01\x00', 0x1132}) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000001a00)='/dev/net/tun\x00', 0x2, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000300)={'nr0\x01\x00', 0x1132}) write$cgroup_int(0xffffffffffffffff, &(0x7f00000000c0)=0x2, 0xfffffffffffffe75) close(r1) 18:07:44 executing program 1: clone(0x2102001fff, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) socket(0x0, 0x0, 0x0) r0 = getpid() rt_tgsigqueueinfo(0x0, r0, 0x16, &(0x7f0000000100)) rt_sigqueueinfo(r0, 0x7, &(0x7f0000000180)={0x0, 0x0, 0xffffffff}) [ 2633.181330] binder: undelivered TRANSACTION_ERROR: 29189 [ 2633.283174] binder: 17745:17751 Release 1 refcount change on invalid ref 2 ret -22 [ 2633.283184] binder: 17745:17751 BC_ACQUIRE_DONE u0000000000000000 no match 18:07:44 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000006c0)={0x118, 0x0, &(0x7f0000000540)=[@release={0x40046306, 0x2}, @acquire_done, @acquire_done={0x40106309, 0x3}, @transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x50, 0x18, &(0x7f0000000080)={@flat=@binder={0x73622a85, 0xa, 0x1}, @fda={0x66646185, 0xa, 0x1, 0x9}, @fd={0x66642a85, 0x0, r1}}, &(0x7f0000000100)={0x0, 0x18, 0x38}}, 0x1000}, @transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000180)={@ptr={0x70742a85, 0x0, &(0x7f0000000140)=""/51, 0x33, 0x2, 0x25}, @flat=@weak_handle={0x77682a85, 0x1}, @flat=@binder={0x73622a85, 0xa, 0x3}}, &(0x7f0000000280)={0x0, 0x28, 0x40}}, 0x1f8aed83e3349436}, @exit_looper, @transaction_sg={0x40486311, {0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x68, 0x18, &(0x7f0000000480)={@ptr={0x70742a85, 0x0, &(0x7f00000002c0)=""/11, 0xb, 0x2, 0x3f}, @fd={0x66642a85, 0x0, r0}, @ptr={0x70742a85, 0x0, &(0x7f0000000380)=""/70, 0x46, 0x1, 0x1f}}, &(0x7f0000000500)={0x0, 0x28, 0x40}}, 0x1000}], 0x14, 0x0, &(0x7f0000000680)="86621f50fcee8bdc5bf8c503a78812261b4bf6d7"}) 18:07:44 executing program 2: ioctl$FS_IOC_RESVSP(0xffffffffffffffff, 0x40305828, &(0x7f00000000c0)={0x0, 0x0, 0x100000000000001}) clone(0x2102001fff, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) socket(0x0, 0x0, 0x0) r0 = getpid() rt_tgsigqueueinfo(0x0, r0, 0x16, &(0x7f0000000100)) ptrace(0x10, r0) ptrace$poke(0x4209, r0, &(0x7f00000000c0), 0x70effd) [ 2633.283192] binder: 17745:17751 BC_ACQUIRE_DONE u0000000000000003 no match [ 2633.283206] binder: 17745:17751 transaction failed 29189/-22, size 80-24 line 3014 18:07:44 executing program 3: r0 = socket(0x10, 0x3, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") ioctl$sock_ifreq(r0, 0x89f3, &(0x7f0000000240)={'sit0\x00'}) [ 2633.283499] binder: undelivered TRANSACTION_ERROR: 29189 [ 2633.522823] binder: 17829:17845 Release 1 refcount change on invalid ref 2 ret -22 18:07:44 executing program 1: clone(0x2102001fff, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) socket(0x0, 0x0, 0x0) r0 = getpid() rt_tgsigqueueinfo(0x0, r0, 0x16, &(0x7f0000000100)) rt_sigqueueinfo(r0, 0x7, &(0x7f0000000180)={0x0, 0x0, 0xffffffff}) 18:07:44 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000006c0)={0x118, 0x0, &(0x7f0000000540)=[@release={0x40046306, 0x2}, @acquire_done, @acquire_done={0x40106309, 0x3}, @transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x50, 0x18, &(0x7f0000000080)={@flat=@binder={0x73622a85, 0xa, 0x1}, @fda={0x66646185, 0xa, 0x1, 0x9}, @fd={0x66642a85, 0x0, r1}}, &(0x7f0000000100)={0x0, 0x18, 0x38}}, 0x1000}, @transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000180)={@ptr={0x70742a85, 0x0, &(0x7f0000000140)=""/51, 0x33, 0x2, 0x25}, @flat=@weak_handle={0x77682a85, 0x1}, @flat=@binder={0x73622a85, 0xa, 0x3}}, &(0x7f0000000280)={0x0, 0x28, 0x40}}, 0x1f8aed83e3349436}, @exit_looper, @transaction_sg={0x40486311, {0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x68, 0x18, &(0x7f0000000480)={@ptr={0x70742a85, 0x0, &(0x7f00000002c0)=""/11, 0xb, 0x2, 0x3f}, @fd={0x66642a85, 0x0, r0}, @ptr={0x70742a85, 0x0, &(0x7f0000000380)=""/70, 0x46, 0x1, 0x1f}}, &(0x7f0000000500)={0x0, 0x28, 0x40}}, 0x1000}], 0x14, 0x0, &(0x7f0000000680)="86621f50fcee8bdc5bf8c503a78812261b4bf6d7"}) [ 2633.522833] binder: 17829:17845 BC_ACQUIRE_DONE u0000000000000000 no match 18:07:44 executing program 4: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000040)='/dev/net/tun\x00', 0x0, 0x0) r1 = epoll_create1(0x0) epoll_ctl$EPOLL_CTL_ADD(0xffffffffffffffff, 0x1, r0, &(0x7f0000000100)) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000080)={'tunl0\x00', 0x1}) epoll_wait(r1, &(0x7f00000000c0)=[{}], 0x1, 0x0) 18:07:44 executing program 3: r0 = socket(0x10, 0x3, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") ioctl$sock_ifreq(r0, 0x89f3, &(0x7f0000000240)={'sit0\x00'}) [ 2633.522841] binder: 17829:17845 BC_ACQUIRE_DONE u0000000000000003 no match 18:07:44 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000006c0)={0x118, 0x0, &(0x7f0000000540)=[@release={0x40046306, 0x2}, @acquire_done, @acquire_done={0x40106309, 0x3}, @transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x50, 0x18, &(0x7f0000000080)={@flat=@binder={0x73622a85, 0xa, 0x1}, @fda={0x66646185, 0xa, 0x1, 0x9}, @fd={0x66642a85, 0x0, r1}}, &(0x7f0000000100)={0x0, 0x18, 0x38}}, 0x1000}, @transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000180)={@ptr={0x70742a85, 0x0, &(0x7f0000000140)=""/51, 0x33, 0x2, 0x25}, @flat=@weak_handle={0x77682a85, 0x1}, @flat=@binder={0x73622a85, 0xa, 0x3}}, &(0x7f0000000280)={0x0, 0x28, 0x40}}, 0x1f8aed83e3349436}, @exit_looper, @transaction_sg={0x40486311, {0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x68, 0x18, &(0x7f0000000480)={@ptr={0x70742a85, 0x0, &(0x7f00000002c0)=""/11, 0xb, 0x2, 0x3f}, @fd={0x66642a85, 0x0, r0}, @ptr={0x70742a85, 0x0, &(0x7f0000000380)=""/70, 0x46, 0x1, 0x1f}}, &(0x7f0000000500)={0x0, 0x28, 0x40}}, 0x1000}], 0x14, 0x0, &(0x7f0000000680)="86621f50fcee8bdc5bf8c503a78812261b4bf6d7"}) [ 2633.522853] binder: 17829:17845 transaction failed 29189/-22, size 80-24 line 3014 18:07:44 executing program 1: clone(0x2102001fff, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) socket(0x0, 0x0, 0x0) r0 = getpid() rt_tgsigqueueinfo(0x0, r0, 0x16, &(0x7f0000000100)) rt_sigqueueinfo(r0, 0x7, &(0x7f0000000180)={0x0, 0x0, 0xffffffff}) 18:07:44 executing program 5: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000001a00)='/dev/net/tun\x00', 0x0, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000080)="c0dc00025e0b01047be070") ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000300)={'nr0\x01\x00', 0x1132}) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000001a00)='/dev/net/tun\x00', 0x2, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000300)={'nr0\x01\x00', 0x1132}) write$cgroup_int(0xffffffffffffffff, &(0x7f00000000c0)=0x2, 0xfffffffffffffe75) close(r1) [ 2633.523323] binder: undelivered TRANSACTION_ERROR: 29189 [ 2633.648523] binder: 17902:17904 Release 1 refcount change on invalid ref 2 ret -22 18:07:44 executing program 2: ioctl$FS_IOC_RESVSP(0xffffffffffffffff, 0x40305828, &(0x7f00000000c0)={0x0, 0x0, 0x100000000000001}) clone(0x2102001fff, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) socket(0x0, 0x0, 0x0) r0 = getpid() rt_tgsigqueueinfo(0x0, r0, 0x16, &(0x7f0000000100)) ptrace(0x10, r0) ptrace$poke(0x4209, r0, &(0x7f00000000c0), 0x70effd) 18:07:44 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000006c0)={0x118, 0x0, &(0x7f0000000540)=[@release={0x40046306, 0x2}, @acquire_done, @acquire_done={0x40106309, 0x3}, @transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x50, 0x18, &(0x7f0000000080)={@flat=@binder={0x73622a85, 0xa, 0x1}, @fda={0x66646185, 0xa, 0x1, 0x9}, @fd={0x66642a85, 0x0, r1}}, &(0x7f0000000100)={0x0, 0x18, 0x38}}, 0x1000}, @transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000180)={@ptr={0x70742a85, 0x0, &(0x7f0000000140)=""/51, 0x33, 0x2, 0x25}, @flat=@weak_handle={0x77682a85, 0x1}, @flat=@binder={0x73622a85, 0xa, 0x3}}, &(0x7f0000000280)={0x0, 0x28, 0x40}}, 0x1f8aed83e3349436}, @exit_looper, @transaction_sg={0x40486311, {0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x68, 0x18, &(0x7f0000000480)={@ptr={0x70742a85, 0x0, &(0x7f00000002c0)=""/11, 0xb, 0x2, 0x3f}, @fd={0x66642a85, 0x0, r0}, @ptr={0x70742a85, 0x0, &(0x7f0000000380)=""/70, 0x46, 0x1, 0x1f}}, &(0x7f0000000500)={0x0, 0x28, 0x40}}, 0x1000}], 0x14, 0x0, &(0x7f0000000680)="86621f50fcee8bdc5bf8c503a78812261b4bf6d7"}) [ 2633.648534] binder: 17902:17904 BC_ACQUIRE_DONE u0000000000000000 no match 18:07:44 executing program 3: r0 = socket(0x10, 0x3, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") ioctl$sock_ifreq(r0, 0x89f3, &(0x7f0000000240)={'sit0\x00'}) 18:07:44 executing program 4: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000040)='/dev/net/tun\x00', 0x0, 0x0) r1 = epoll_create1(0x0) epoll_ctl$EPOLL_CTL_ADD(0xffffffffffffffff, 0x1, r0, &(0x7f0000000100)) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000080)={'tunl0\x00', 0x1}) epoll_wait(r1, &(0x7f00000000c0)=[{}], 0x1, 0x0) [ 2633.648541] binder: 17902:17904 BC_ACQUIRE_DONE u0000000000000003 no match 18:07:44 executing program 1: clone(0x2102001fff, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) socket(0x0, 0x0, 0x0) r0 = getpid() rt_tgsigqueueinfo(0x0, r0, 0x16, &(0x7f0000000100)) rt_sigqueueinfo(r0, 0x7, &(0x7f0000000180)={0x0, 0x0, 0xffffffff}) 18:07:44 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000006c0)={0x118, 0x0, &(0x7f0000000540)=[@release={0x40046306, 0x2}, @acquire_done, @acquire_done={0x40106309, 0x3}, @transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x50, 0x18, &(0x7f0000000080)={@flat=@binder={0x73622a85, 0xa, 0x1}, @fda={0x66646185, 0xa, 0x1, 0x9}, @fd={0x66642a85, 0x0, r1}}, &(0x7f0000000100)={0x0, 0x18, 0x38}}, 0x1000}, @transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000180)={@ptr={0x70742a85, 0x0, &(0x7f0000000140)=""/51, 0x33, 0x2, 0x25}, @flat=@weak_handle={0x77682a85, 0x1}, @flat=@binder={0x73622a85, 0xa, 0x3}}, &(0x7f0000000280)={0x0, 0x28, 0x40}}, 0x1f8aed83e3349436}, @exit_looper, @transaction_sg={0x40486311, {0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x68, 0x18, &(0x7f0000000480)={@ptr={0x70742a85, 0x0, &(0x7f00000002c0)=""/11, 0xb, 0x2, 0x3f}, @fd={0x66642a85, 0x0, r0}, @ptr={0x70742a85, 0x0, &(0x7f0000000380)=""/70, 0x46, 0x1, 0x1f}}, &(0x7f0000000500)={0x0, 0x28, 0x40}}, 0x1000}], 0x14, 0x0, &(0x7f0000000680)="86621f50fcee8bdc5bf8c503a78812261b4bf6d7"}) [ 2633.648557] binder: 17902:17904 transaction failed 29189/-22, size 80-24 line 3014 [ 2633.648882] binder: undelivered TRANSACTION_ERROR: 29189 18:07:44 executing program 3: r0 = socket(0x10, 0x3, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") ioctl$sock_ifreq(r0, 0x89f3, &(0x7f0000000240)={'sit0\x00'}) [ 2633.742550] binder: 17918:17924 Release 1 refcount change on invalid ref 2 ret -22 18:07:44 executing program 5: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000001a00)='/dev/net/tun\x00', 0x0, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000080)="c0dc00025e0b01047be070") ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000300)={'nr0\x01\x00', 0x1132}) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000001a00)='/dev/net/tun\x00', 0x2, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000300)={'nr0\x01\x00', 0x1132}) write$cgroup_int(0xffffffffffffffff, &(0x7f00000000c0)=0x2, 0xfffffffffffffe75) close(r1) 18:07:44 executing program 2: ioctl$FS_IOC_RESVSP(0xffffffffffffffff, 0x40305828, &(0x7f00000000c0)={0x0, 0x0, 0x100000000000001}) clone(0x2102001fff, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) socket(0x0, 0x0, 0x0) r0 = getpid() rt_tgsigqueueinfo(0x0, r0, 0x16, &(0x7f0000000100)) ptrace(0x10, r0) ptrace$poke(0x4209, r0, &(0x7f00000000c0), 0x70effd) 18:07:44 executing program 1: clone(0x2102001fff, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) socket(0x0, 0x0, 0x0) r0 = getpid() rt_tgsigqueueinfo(0x0, r0, 0x16, &(0x7f0000000100)) rt_sigqueueinfo(r0, 0x7, &(0x7f0000000180)={0x0, 0x0, 0xffffffff}) 18:07:44 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000006c0)={0x118, 0x0, &(0x7f0000000540)=[@release={0x40046306, 0x2}, @acquire_done, @acquire_done={0x40106309, 0x3}, @transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x50, 0x18, &(0x7f0000000080)={@flat=@binder={0x73622a85, 0xa, 0x1}, @fda={0x66646185, 0xa, 0x1, 0x9}, @fd={0x66642a85, 0x0, r1}}, &(0x7f0000000100)={0x0, 0x18, 0x38}}, 0x1000}, @transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000180)={@ptr={0x70742a85, 0x0, &(0x7f0000000140)=""/51, 0x33, 0x2, 0x25}, @flat=@weak_handle={0x77682a85, 0x1}, @flat=@binder={0x73622a85, 0xa, 0x3}}, &(0x7f0000000280)={0x0, 0x28, 0x40}}, 0x1f8aed83e3349436}, @exit_looper, @transaction_sg={0x40486311, {0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x68, 0x18, &(0x7f0000000480)={@ptr={0x70742a85, 0x0, &(0x7f00000002c0)=""/11, 0xb, 0x2, 0x3f}, @fd={0x66642a85, 0x0, r0}, @ptr={0x70742a85, 0x0, &(0x7f0000000380)=""/70, 0x46, 0x1, 0x1f}}, &(0x7f0000000500)={0x0, 0x28, 0x40}}, 0x1000}], 0x14, 0x0, &(0x7f0000000680)="86621f50fcee8bdc5bf8c503a78812261b4bf6d7"}) [ 2633.742560] binder: 17918:17924 BC_ACQUIRE_DONE u0000000000000000 no match 18:07:44 executing program 4: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000040)='/dev/net/tun\x00', 0x0, 0x0) r1 = epoll_create1(0x0) epoll_ctl$EPOLL_CTL_ADD(0xffffffffffffffff, 0x1, r0, &(0x7f0000000100)) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000080)={'tunl0\x00', 0x1}) epoll_wait(r1, &(0x7f00000000c0)=[{}], 0x1, 0x0) 18:07:44 executing program 3: r0 = socket(0x10, 0x3, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") ioctl$sock_ifreq(r0, 0x89f3, &(0x7f0000000240)={'sit0\x00'}) [ 2633.742568] binder: 17918:17924 BC_ACQUIRE_DONE u0000000000000003 no match 18:07:45 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000006c0)={0x118, 0x0, &(0x7f0000000540)=[@release={0x40046306, 0x2}, @acquire_done, @acquire_done={0x40106309, 0x3}, @transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x50, 0x18, &(0x7f0000000080)={@flat=@binder={0x73622a85, 0xa, 0x1}, @fda={0x66646185, 0xa, 0x1, 0x9}, @fd={0x66642a85, 0x0, r1}}, &(0x7f0000000100)={0x0, 0x18, 0x38}}, 0x1000}, @transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000180)={@ptr={0x70742a85, 0x0, &(0x7f0000000140)=""/51, 0x33, 0x2, 0x25}, @flat=@weak_handle={0x77682a85, 0x1}, @flat=@binder={0x73622a85, 0xa, 0x3}}, &(0x7f0000000280)={0x0, 0x28, 0x40}}, 0x1f8aed83e3349436}, @exit_looper, @transaction_sg={0x40486311, {0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x68, 0x18, &(0x7f0000000480)={@ptr={0x70742a85, 0x0, &(0x7f00000002c0)=""/11, 0xb, 0x2, 0x3f}, @fd={0x66642a85, 0x0, r0}, @ptr={0x70742a85, 0x0, &(0x7f0000000380)=""/70, 0x46, 0x1, 0x1f}}, &(0x7f0000000500)={0x0, 0x28, 0x40}}, 0x1000}], 0x14, 0x0, &(0x7f0000000680)="86621f50fcee8bdc5bf8c503a78812261b4bf6d7"}) [ 2633.742581] binder: 17918:17924 transaction failed 29189/-22, size 80-24 line 3014 [ 2633.742829] binder: undelivered TRANSACTION_ERROR: 29189 [ 2633.877038] binder: 17989:17990 Release 1 refcount change on invalid ref 2 ret -22 [ 2633.877048] binder: 17989:17990 BC_ACQUIRE_DONE u0000000000000000 no match 18:07:45 executing program 1: clone(0x2102001fff, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) socket(0x0, 0x0, 0x0) r0 = getpid() rt_tgsigqueueinfo(0x0, r0, 0x16, &(0x7f0000000100)) rt_sigqueueinfo(r0, 0x7, &(0x7f0000000180)={0x0, 0x0, 0xffffffff}) 18:07:45 executing program 2: ioctl$FS_IOC_RESVSP(0xffffffffffffffff, 0x40305828, &(0x7f00000000c0)={0x0, 0x0, 0x100000000000001}) clone(0x2102001fff, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) socket(0x0, 0x0, 0x0) r0 = getpid() rt_tgsigqueueinfo(0x0, r0, 0x16, &(0x7f0000000100)) ptrace(0x10, r0) ptrace$poke(0x4209, r0, &(0x7f00000000c0), 0x70effd) [ 2633.877056] binder: 17989:17990 BC_ACQUIRE_DONE u0000000000000003 no match [ 2633.877069] binder: 17989:17990 transaction failed 29189/-22, size 80-24 line 3014 18:07:45 executing program 3: r0 = socket(0x10, 0x3, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") ioctl$sock_ifreq(r0, 0x89f3, &(0x7f0000000240)={'sit0\x00'}) 18:07:45 executing program 4: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000040)='/dev/net/tun\x00', 0x0, 0x0) r1 = epoll_create1(0x0) epoll_ctl$EPOLL_CTL_ADD(0xffffffffffffffff, 0x1, r0, &(0x7f0000000100)) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000080)={'tunl0\x00', 0x1}) epoll_wait(r1, &(0x7f00000000c0)=[{}], 0x1, 0x0) 18:07:45 executing program 5: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000001a00)='/dev/net/tun\x00', 0x0, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000080)="c0dc00025e0b01047be070") ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000300)={'nr0\x01\x00', 0x1132}) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000001a00)='/dev/net/tun\x00', 0x2, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000300)={'nr0\x01\x00', 0x1132}) write$cgroup_int(0xffffffffffffffff, &(0x7f00000000c0)=0x2, 0xfffffffffffffe75) close(r1) [ 2633.877282] binder: undelivered TRANSACTION_ERROR: 29189 [ 2633.989027] binder: 18040:18041 Release 1 refcount change on invalid ref 2 ret -22 18:07:45 executing program 3: r0 = socket(0x10, 0x3, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") ioctl$sock_ifreq(r0, 0x89f3, &(0x7f0000000240)={'sit0\x00'}) [ 2633.989036] binder: 18040:18041 BC_ACQUIRE_DONE u0000000000000000 no match 18:07:45 executing program 1: clone(0x2102001fff, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) socket(0x0, 0x0, 0x0) r0 = getpid() rt_tgsigqueueinfo(0x0, r0, 0x16, &(0x7f0000000100)) rt_sigqueueinfo(r0, 0x7, &(0x7f0000000180)={0x0, 0x0, 0xffffffff}) 18:07:45 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000006c0)={0x118, 0x0, &(0x7f0000000540)=[@release={0x40046306, 0x2}, @acquire_done, @acquire_done={0x40106309, 0x3}, @transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x50, 0x18, &(0x7f0000000080)={@flat=@binder={0x73622a85, 0xa, 0x1}, @fda={0x66646185, 0xa, 0x1, 0x9}, @fd={0x66642a85, 0x0, r1}}, &(0x7f0000000100)={0x0, 0x18, 0x38}}, 0x1000}, @transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000180)={@ptr={0x70742a85, 0x0, &(0x7f0000000140)=""/51, 0x33, 0x2, 0x25}, @flat=@weak_handle={0x77682a85, 0x1}, @flat=@binder={0x73622a85, 0xa, 0x3}}, &(0x7f0000000280)={0x0, 0x28, 0x40}}, 0x1f8aed83e3349436}, @exit_looper, @transaction_sg={0x40486311, {0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x68, 0x18, &(0x7f0000000480)={@ptr={0x70742a85, 0x0, &(0x7f00000002c0)=""/11, 0xb, 0x2, 0x3f}, @fd={0x66642a85, 0x0, r0}, @ptr={0x70742a85, 0x0, &(0x7f0000000380)=""/70, 0x46, 0x1, 0x1f}}, &(0x7f0000000500)={0x0, 0x28, 0x40}}, 0x1000}], 0x14, 0x0, &(0x7f0000000680)="86621f50fcee8bdc5bf8c503a78812261b4bf6d7"}) [ 2633.989043] binder: 18040:18041 BC_ACQUIRE_DONE u0000000000000003 no match 18:07:45 executing program 2: ioctl$FS_IOC_RESVSP(0xffffffffffffffff, 0x40305828, &(0x7f00000000c0)={0x0, 0x0, 0x100000000000001}) clone(0x2102001fff, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) socket(0x0, 0x0, 0x0) r0 = getpid() rt_tgsigqueueinfo(0x0, r0, 0x16, &(0x7f0000000100)) ptrace(0x10, r0) ptrace$poke(0x4209, r0, &(0x7f00000000c0), 0x70effd) [ 2633.989054] binder: 18040:18041 transaction failed 29189/-22, size 80-24 line 3014 18:07:45 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000006c0)={0x118, 0x0, &(0x7f0000000540)=[@release={0x40046306, 0x2}, @acquire_done, @acquire_done={0x40106309, 0x3}, @transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x50, 0x18, &(0x7f0000000080)={@flat=@binder={0x73622a85, 0xa, 0x1}, @fda={0x66646185, 0xa, 0x1, 0x9}, @fd={0x66642a85, 0x0, r1}}, &(0x7f0000000100)={0x0, 0x18, 0x38}}, 0x1000}, @transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000180)={@ptr={0x70742a85, 0x0, &(0x7f0000000140)=""/51, 0x33, 0x2, 0x25}, @flat=@weak_handle={0x77682a85, 0x1}, @flat=@binder={0x73622a85, 0xa, 0x3}}, &(0x7f0000000280)={0x0, 0x28, 0x40}}, 0x1f8aed83e3349436}, @exit_looper, @transaction_sg={0x40486311, {0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x68, 0x18, &(0x7f0000000480)={@ptr={0x70742a85, 0x0, &(0x7f00000002c0)=""/11, 0xb, 0x2, 0x3f}, @fd={0x66642a85, 0x0, r0}, @ptr={0x70742a85, 0x0, &(0x7f0000000380)=""/70, 0x46, 0x1, 0x1f}}, &(0x7f0000000500)={0x0, 0x28, 0x40}}, 0x1000}], 0x14, 0x0, &(0x7f0000000680)="86621f50fcee8bdc5bf8c503a78812261b4bf6d7"}) 18:07:45 executing program 4: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000040)='/dev/net/tun\x00', 0x0, 0x0) r1 = epoll_create1(0x0) epoll_ctl$EPOLL_CTL_ADD(0xffffffffffffffff, 0x1, r0, &(0x7f0000000100)) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000080)={'tunl0\x00', 0x1}) epoll_wait(r1, &(0x7f00000000c0)=[{}], 0x1, 0x0) [ 2633.989681] binder: undelivered TRANSACTION_ERROR: 29189 [ 2634.053372] binder: 18062:18063 Release 1 refcount change on invalid ref 2 ret -22 18:07:45 executing program 3: r0 = socket(0x10, 0x3, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") ioctl$sock_ifreq(r0, 0x89f3, &(0x7f0000000240)={'sit0\x00'}) [ 2634.053382] binder: 18062:18063 BC_ACQUIRE_DONE u0000000000000000 no match 18:07:45 executing program 5: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000001a00)='/dev/net/tun\x00', 0x0, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000080)="c0dc00025e0b01047be070") ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000300)={'nr0\x01\x00', 0x1132}) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000001a00)='/dev/net/tun\x00', 0x2, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000300)={'nr0\x01\x00', 0x1132}) write$cgroup_int(0xffffffffffffffff, &(0x7f00000000c0)=0x2, 0xfffffffffffffe75) close(r1) 18:07:45 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000006c0)={0x118, 0x0, &(0x7f0000000540)=[@release={0x40046306, 0x2}, @acquire_done, @acquire_done={0x40106309, 0x3}, @transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x50, 0x18, &(0x7f0000000080)={@flat=@binder={0x73622a85, 0xa, 0x1}, @fda={0x66646185, 0xa, 0x1, 0x9}, @fd={0x66642a85, 0x0, r1}}, &(0x7f0000000100)={0x0, 0x18, 0x38}}, 0x1000}, @transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000180)={@ptr={0x70742a85, 0x0, &(0x7f0000000140)=""/51, 0x33, 0x2, 0x25}, @flat=@weak_handle={0x77682a85, 0x1}, @flat=@binder={0x73622a85, 0xa, 0x3}}, &(0x7f0000000280)={0x0, 0x28, 0x40}}, 0x1f8aed83e3349436}, @exit_looper, @transaction_sg={0x40486311, {0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x68, 0x18, &(0x7f0000000480)={@ptr={0x70742a85, 0x0, &(0x7f00000002c0)=""/11, 0xb, 0x2, 0x3f}, @fd={0x66642a85, 0x0, r0}, @ptr={0x70742a85, 0x0, &(0x7f0000000380)=""/70, 0x46, 0x1, 0x1f}}, &(0x7f0000000500)={0x0, 0x28, 0x40}}, 0x1000}], 0x14, 0x0, &(0x7f0000000680)="86621f50fcee8bdc5bf8c503a78812261b4bf6d7"}) 18:07:45 executing program 3: r0 = socket(0x10, 0x3, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") ioctl$sock_ifreq(r0, 0x89f3, &(0x7f0000000240)={'sit0\x00'}) [ 2634.053390] binder: 18062:18063 BC_ACQUIRE_DONE u0000000000000003 no match 18:07:45 executing program 1: clone(0x2102001fff, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) socket(0x0, 0x0, 0x0) r0 = getpid() rt_tgsigqueueinfo(0x0, r0, 0x16, &(0x7f0000000100)) rt_sigqueueinfo(r0, 0x7, &(0x7f0000000180)={0x0, 0x0, 0xffffffff}) [ 2634.053402] binder: 18062:18063 transaction failed 29189/-22, size 80-24 line 3014 [ 2634.053695] binder: undelivered TRANSACTION_ERROR: 29189 18:07:45 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000006c0)={0x118, 0x0, &(0x7f0000000540)=[@release={0x40046306, 0x2}, @acquire_done, @acquire_done={0x40106309, 0x3}, @transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x50, 0x18, &(0x7f0000000080)={@flat=@binder={0x73622a85, 0xa, 0x1}, @fda={0x66646185, 0xa, 0x1, 0x9}, @fd={0x66642a85, 0x0, r1}}, &(0x7f0000000100)={0x0, 0x18, 0x38}}, 0x1000}, @transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000180)={@ptr={0x70742a85, 0x0, &(0x7f0000000140)=""/51, 0x33, 0x2, 0x25}, @flat=@weak_handle={0x77682a85, 0x1}, @flat=@binder={0x73622a85, 0xa, 0x3}}, &(0x7f0000000280)={0x0, 0x28, 0x40}}, 0x1f8aed83e3349436}, @exit_looper, @transaction_sg={0x40486311, {0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x68, 0x18, &(0x7f0000000480)={@ptr={0x70742a85, 0x0, &(0x7f00000002c0)=""/11, 0xb, 0x2, 0x3f}, @fd={0x66642a85, 0x0, r0}, @ptr={0x70742a85, 0x0, &(0x7f0000000380)=""/70, 0x46, 0x1, 0x1f}}, &(0x7f0000000500)={0x0, 0x28, 0x40}}, 0x1000}], 0x14, 0x0, &(0x7f0000000680)="86621f50fcee8bdc5bf8c503a78812261b4bf6d7"}) 18:07:45 executing program 3: r0 = socket(0x10, 0x3, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") ioctl$sock_ifreq(r0, 0x89f3, &(0x7f0000000240)={'sit0\x00'}) 18:07:45 executing program 4: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000040)='/dev/net/tun\x00', 0x0, 0x0) r1 = epoll_create1(0x0) epoll_ctl$EPOLL_CTL_ADD(0xffffffffffffffff, 0x1, r0, &(0x7f0000000100)) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000080)={'tunl0\x00', 0x1}) epoll_wait(r1, &(0x7f00000000c0)=[{}], 0x1, 0x0) [ 2634.195937] binder: 18093:18102 Release 1 refcount change on invalid ref 2 ret -22 [ 2634.195948] binder: 18093:18102 BC_ACQUIRE_DONE u0000000000000000 no match 18:07:45 executing program 1: clone(0x2102001fff, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) socket(0x0, 0x0, 0x0) r0 = getpid() rt_tgsigqueueinfo(0x0, r0, 0x16, &(0x7f0000000100)) rt_sigqueueinfo(r0, 0x7, &(0x7f0000000180)={0x0, 0x0, 0xffffffff}) [ 2634.195955] binder: 18093:18102 BC_ACQUIRE_DONE u0000000000000003 no match [ 2634.195968] binder: 18093:18102 transaction failed 29189/-22, size 80-24 line 3014 [ 2634.196210] binder: undelivered TRANSACTION_ERROR: 29189 18:07:45 executing program 2: ioctl$FS_IOC_RESVSP(0xffffffffffffffff, 0x40305828, &(0x7f00000000c0)={0x0, 0x0, 0x100000000000001}) clone(0x2102001fff, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) socket(0x0, 0x0, 0x0) r0 = getpid() rt_tgsigqueueinfo(0x0, r0, 0x16, &(0x7f0000000100)) ptrace(0x10, r0) ptrace$poke(0x4209, r0, &(0x7f00000000c0), 0x70effd) 18:07:45 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000006c0)={0x118, 0x0, &(0x7f0000000540)=[@release={0x40046306, 0x2}, @acquire_done, @acquire_done={0x40106309, 0x3}, @transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x50, 0x18, &(0x7f0000000080)={@flat=@binder={0x73622a85, 0xa, 0x1}, @fda={0x66646185, 0xa, 0x1, 0x9}, @fd={0x66642a85, 0x0, r1}}, &(0x7f0000000100)={0x0, 0x18, 0x38}}, 0x1000}, @transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000180)={@ptr={0x70742a85, 0x0, &(0x7f0000000140)=""/51, 0x33, 0x2, 0x25}, @flat=@weak_handle={0x77682a85, 0x1}, @flat=@binder={0x73622a85, 0xa, 0x3}}, &(0x7f0000000280)={0x0, 0x28, 0x40}}, 0x1f8aed83e3349436}, @exit_looper, @transaction_sg={0x40486311, {0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x68, 0x18, &(0x7f0000000480)={@ptr={0x70742a85, 0x0, &(0x7f00000002c0)=""/11, 0xb, 0x2, 0x3f}, @fd={0x66642a85, 0x0, r0}, @ptr={0x70742a85, 0x0, &(0x7f0000000380)=""/70, 0x46, 0x1, 0x1f}}, &(0x7f0000000500)={0x0, 0x28, 0x40}}, 0x1000}], 0x14, 0x0, &(0x7f0000000680)="86621f50fcee8bdc5bf8c503a78812261b4bf6d7"}) 18:07:45 executing program 5: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000001a00)='/dev/net/tun\x00', 0x0, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000080)="c0dc00025e0b01047be070") ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000300)={'nr0\x01\x00', 0x1132}) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000001a00)='/dev/net/tun\x00', 0x2, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000300)={'nr0\x01\x00', 0x1132}) write$cgroup_int(0xffffffffffffffff, &(0x7f00000000c0)=0x2, 0xfffffffffffffe75) close(r1) 18:07:45 executing program 3: r0 = socket(0x10, 0x3, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") ioctl$sock_ifreq(r0, 0x89f3, &(0x7f0000000240)={'sit0\x00'}) 18:07:45 executing program 4: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000040)='/dev/net/tun\x00', 0x0, 0x0) r1 = epoll_create1(0x0) epoll_ctl$EPOLL_CTL_ADD(0xffffffffffffffff, 0x1, r0, &(0x7f0000000100)) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000080)={'tunl0\x00', 0x1}) epoll_wait(r1, &(0x7f00000000c0)=[{}], 0x1, 0x0) [ 2634.323265] binder: 18156:18158 Release 1 refcount change on invalid ref 2 ret -22 18:07:45 executing program 1: clone(0x2102001fff, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) socket(0x0, 0x0, 0x0) r0 = getpid() rt_tgsigqueueinfo(0x0, r0, 0x16, &(0x7f0000000100)) rt_sigqueueinfo(r0, 0x7, &(0x7f0000000180)={0x0, 0x0, 0xffffffff}) 18:07:45 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000006c0)={0x118, 0x0, &(0x7f0000000540)=[@release={0x40046306, 0x2}, @acquire_done, @acquire_done={0x40106309, 0x3}, @transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x50, 0x18, &(0x7f0000000080)={@flat=@binder={0x73622a85, 0xa, 0x1}, @fda={0x66646185, 0xa, 0x1, 0x9}, @fd={0x66642a85, 0x0, r1}}, &(0x7f0000000100)={0x0, 0x18, 0x38}}, 0x1000}, @transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000180)={@ptr={0x70742a85, 0x0, &(0x7f0000000140)=""/51, 0x33, 0x2, 0x25}, @flat=@weak_handle={0x77682a85, 0x1}, @flat=@binder={0x73622a85, 0xa, 0x3}}, &(0x7f0000000280)={0x0, 0x28, 0x40}}, 0x1f8aed83e3349436}, @exit_looper, @transaction_sg={0x40486311, {0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x68, 0x18, &(0x7f0000000480)={@ptr={0x70742a85, 0x0, &(0x7f00000002c0)=""/11, 0xb, 0x2, 0x3f}, @fd={0x66642a85, 0x0, r0}, @ptr={0x70742a85, 0x0, &(0x7f0000000380)=""/70, 0x46, 0x1, 0x1f}}, &(0x7f0000000500)={0x0, 0x28, 0x40}}, 0x1000}], 0x14, 0x0, &(0x7f0000000680)="86621f50fcee8bdc5bf8c503a78812261b4bf6d7"}) [ 2634.323276] binder: 18156:18158 BC_ACQUIRE_DONE u0000000000000000 no match [ 2634.323285] binder: 18156:18158 BC_ACQUIRE_DONE u0000000000000003 no match 18:07:46 executing program 3: r0 = socket(0x10, 0x3, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") ioctl$sock_ifreq(r0, 0x89f3, &(0x7f0000000240)={'sit0\x00'}) [ 2634.323299] binder: 18156:18158 transaction failed 29189/-22, size 80-24 line 3014 18:07:46 executing program 4: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000040)='/dev/net/tun\x00', 0x0, 0x0) r1 = epoll_create1(0x0) epoll_ctl$EPOLL_CTL_ADD(0xffffffffffffffff, 0x1, r0, &(0x7f0000000100)) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000080)={'tunl0\x00', 0x1}) epoll_wait(r1, &(0x7f00000000c0)=[{}], 0x1, 0x0) 18:07:46 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000006c0)={0x118, 0x0, &(0x7f0000000540)=[@release={0x40046306, 0x2}, @acquire_done, @acquire_done={0x40106309, 0x3}, @transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x50, 0x18, &(0x7f0000000080)={@flat=@binder={0x73622a85, 0xa, 0x1}, @fda={0x66646185, 0xa, 0x1, 0x9}, @fd={0x66642a85, 0x0, r1}}, &(0x7f0000000100)={0x0, 0x18, 0x38}}, 0x1000}, @transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000180)={@ptr={0x70742a85, 0x0, &(0x7f0000000140)=""/51, 0x33, 0x2, 0x25}, @flat=@weak_handle={0x77682a85, 0x1}, @flat=@binder={0x73622a85, 0xa, 0x3}}, &(0x7f0000000280)={0x0, 0x28, 0x40}}, 0x1f8aed83e3349436}, @exit_looper, @transaction_sg={0x40486311, {0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x68, 0x18, &(0x7f0000000480)={@ptr={0x70742a85, 0x0, &(0x7f00000002c0)=""/11, 0xb, 0x2, 0x3f}, @fd={0x66642a85, 0x0, r0}, @ptr={0x70742a85, 0x0, &(0x7f0000000380)=""/70, 0x46, 0x1, 0x1f}}, &(0x7f0000000500)={0x0, 0x28, 0x40}}, 0x1000}], 0x14, 0x0, &(0x7f0000000680)="86621f50fcee8bdc5bf8c503a78812261b4bf6d7"}) [ 2634.323631] binder: undelivered TRANSACTION_ERROR: 29189 18:07:46 executing program 1: clone(0x2102001fff, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) socket(0x0, 0x0, 0x0) r0 = getpid() rt_tgsigqueueinfo(0x0, r0, 0x16, &(0x7f0000000100)) rt_sigqueueinfo(r0, 0x7, &(0x7f0000000180)={0x0, 0x0, 0xffffffff}) 18:07:46 executing program 2: ioctl$FS_IOC_RESVSP(0xffffffffffffffff, 0x40305828, &(0x7f00000000c0)={0x0, 0x0, 0x100000000000001}) clone(0x2102001fff, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) socket(0x0, 0x0, 0x0) r0 = getpid() rt_tgsigqueueinfo(0x0, r0, 0x16, &(0x7f0000000100)) ptrace(0x10, r0) ptrace$poke(0x4209, r0, &(0x7f00000000c0), 0x70effd) 18:07:46 executing program 5: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000001a00)='/dev/net/tun\x00', 0x0, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000080)="c0dc00025e0b01047be070") ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000300)={'nr0\x01\x00', 0x1132}) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000001a00)='/dev/net/tun\x00', 0x2, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000300)={'nr0\x01\x00', 0x1132}) write$cgroup_int(0xffffffffffffffff, &(0x7f00000000c0)=0x2, 0xfffffffffffffe75) close(r1) 18:07:46 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000006c0)={0x118, 0x0, &(0x7f0000000540)=[@release={0x40046306, 0x2}, @acquire_done, @acquire_done={0x40106309, 0x3}, @transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x50, 0x18, &(0x7f0000000080)={@flat=@binder={0x73622a85, 0xa, 0x1}, @fda={0x66646185, 0xa, 0x1, 0x9}, @fd={0x66642a85, 0x0, r1}}, &(0x7f0000000100)={0x0, 0x18, 0x38}}, 0x1000}, @transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000180)={@ptr={0x70742a85, 0x0, &(0x7f0000000140)=""/51, 0x33, 0x2, 0x25}, @flat=@weak_handle={0x77682a85, 0x1}, @flat=@binder={0x73622a85, 0xa, 0x3}}, &(0x7f0000000280)={0x0, 0x28, 0x40}}, 0x1f8aed83e3349436}, @exit_looper, @transaction_sg={0x40486311, {0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x68, 0x18, &(0x7f0000000480)={@ptr={0x70742a85, 0x0, &(0x7f00000002c0)=""/11, 0xb, 0x2, 0x3f}, @fd={0x66642a85, 0x0, r0}, @ptr={0x70742a85, 0x0, &(0x7f0000000380)=""/70, 0x46, 0x1, 0x1f}}, &(0x7f0000000500)={0x0, 0x28, 0x40}}, 0x1000}], 0x14, 0x0, &(0x7f0000000680)="86621f50fcee8bdc5bf8c503a78812261b4bf6d7"}) [ 2634.429831] binder: 18186:18189 Release 1 refcount change on invalid ref 2 ret -22 [ 2634.429842] binder: 18186:18189 BC_ACQUIRE_DONE u0000000000000000 no match 18:07:46 executing program 4: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000040)='/dev/net/tun\x00', 0x0, 0x0) r1 = epoll_create1(0x0) epoll_ctl$EPOLL_CTL_ADD(0xffffffffffffffff, 0x1, r0, &(0x7f0000000100)) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000080)={'tunl0\x00', 0x1}) epoll_wait(r1, &(0x7f00000000c0)=[{}], 0x1, 0x0) 18:07:46 executing program 3: r0 = socket(0x10, 0x3, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") ioctl$sock_ifreq(r0, 0x89f3, &(0x7f0000000240)={'sit0\x00'}) [ 2634.429851] binder: 18186:18189 BC_ACQUIRE_DONE u0000000000000003 no match 18:07:46 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000006c0)={0x118, 0x0, &(0x7f0000000540)=[@release={0x40046306, 0x2}, @acquire_done, @acquire_done={0x40106309, 0x3}, @transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x50, 0x18, &(0x7f0000000080)={@flat=@binder={0x73622a85, 0xa, 0x1}, @fda={0x66646185, 0xa, 0x1, 0x9}, @fd={0x66642a85, 0x0, r1}}, &(0x7f0000000100)={0x0, 0x18, 0x38}}, 0x1000}, @transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000180)={@ptr={0x70742a85, 0x0, &(0x7f0000000140)=""/51, 0x33, 0x2, 0x25}, @flat=@weak_handle={0x77682a85, 0x1}, @flat=@binder={0x73622a85, 0xa, 0x3}}, &(0x7f0000000280)={0x0, 0x28, 0x40}}, 0x1f8aed83e3349436}, @exit_looper, @transaction_sg={0x40486311, {0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x68, 0x18, &(0x7f0000000480)={@ptr={0x70742a85, 0x0, &(0x7f00000002c0)=""/11, 0xb, 0x2, 0x3f}, @fd={0x66642a85, 0x0, r0}, @ptr={0x70742a85, 0x0, &(0x7f0000000380)=""/70, 0x46, 0x1, 0x1f}}, &(0x7f0000000500)={0x0, 0x28, 0x40}}, 0x1000}], 0x14, 0x0, &(0x7f0000000680)="86621f50fcee8bdc5bf8c503a78812261b4bf6d7"}) [ 2634.429865] binder: 18186:18189 transaction failed 29189/-22, size 80-24 line 3014 [ 2634.430233] binder: undelivered TRANSACTION_ERROR: 29189 18:07:46 executing program 3: r0 = socket(0x10, 0x3, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") ioctl$sock_ifreq(r0, 0x89f3, &(0x7f0000000240)={'sit0\x00'}) 18:07:46 executing program 1: clone(0x2102001fff, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) socket(0x0, 0x0, 0x0) r0 = getpid() rt_tgsigqueueinfo(0x0, r0, 0x16, &(0x7f0000000100)) rt_sigqueueinfo(r0, 0x7, &(0x7f0000000180)={0x0, 0x0, 0xffffffff}) 18:07:46 executing program 4: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000040)='/dev/net/tun\x00', 0x0, 0x0) r1 = epoll_create1(0x0) epoll_ctl$EPOLL_CTL_ADD(0xffffffffffffffff, 0x1, r0, &(0x7f0000000100)) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000080)={'tunl0\x00', 0x1}) epoll_wait(r1, &(0x7f00000000c0)=[{}], 0x1, 0x0) 18:07:46 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000006c0)={0x118, 0x0, &(0x7f0000000540)=[@release={0x40046306, 0x2}, @acquire_done, @acquire_done={0x40106309, 0x3}, @transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x50, 0x18, &(0x7f0000000080)={@flat=@binder={0x73622a85, 0xa, 0x1}, @fda={0x66646185, 0xa, 0x1, 0x9}, @fd={0x66642a85, 0x0, r1}}, &(0x7f0000000100)={0x0, 0x18, 0x38}}, 0x1000}, @transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000180)={@ptr={0x70742a85, 0x0, &(0x7f0000000140)=""/51, 0x33, 0x2, 0x25}, @flat=@weak_handle={0x77682a85, 0x1}, @flat=@binder={0x73622a85, 0xa, 0x3}}, &(0x7f0000000280)={0x0, 0x28, 0x40}}, 0x1f8aed83e3349436}, @exit_looper, @transaction_sg={0x40486311, {0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x68, 0x18, &(0x7f0000000480)={@ptr={0x70742a85, 0x0, &(0x7f00000002c0)=""/11, 0xb, 0x2, 0x3f}, @fd={0x66642a85, 0x0, r0}, @ptr={0x70742a85, 0x0, &(0x7f0000000380)=""/70, 0x46, 0x1, 0x1f}}, &(0x7f0000000500)={0x0, 0x28, 0x40}}, 0x1000}], 0x14, 0x0, &(0x7f0000000680)="86621f50fcee8bdc5bf8c503a78812261b4bf6d7"}) [ 2634.532118] binder: 18249:18274 Release 1 refcount change on invalid ref 2 ret -22 18:07:46 executing program 2: ioctl$FS_IOC_RESVSP(0xffffffffffffffff, 0x40305828, &(0x7f00000000c0)={0x0, 0x0, 0x100000000000001}) clone(0x2102001fff, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) socket(0x0, 0x0, 0x0) r0 = getpid() rt_tgsigqueueinfo(0x0, r0, 0x16, &(0x7f0000000100)) ptrace(0x10, r0) ptrace$poke(0x4209, r0, &(0x7f00000000c0), 0x70effd) 18:07:46 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000006c0)={0x118, 0x0, &(0x7f0000000540)=[@release={0x40046306, 0x2}, @acquire_done, @acquire_done={0x40106309, 0x3}, @transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x50, 0x18, &(0x7f0000000080)={@flat=@binder={0x73622a85, 0xa, 0x1}, @fda={0x66646185, 0xa, 0x1, 0x9}, @fd={0x66642a85, 0x0, r1}}, &(0x7f0000000100)={0x0, 0x18, 0x38}}, 0x1000}, @transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000180)={@ptr={0x70742a85, 0x0, &(0x7f0000000140)=""/51, 0x33, 0x2, 0x25}, @flat=@weak_handle={0x77682a85, 0x1}, @flat=@binder={0x73622a85, 0xa, 0x3}}, &(0x7f0000000280)={0x0, 0x28, 0x40}}, 0x1f8aed83e3349436}, @exit_looper, @transaction_sg={0x40486311, {0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x68, 0x18, &(0x7f0000000480)={@ptr={0x70742a85, 0x0, &(0x7f00000002c0)=""/11, 0xb, 0x2, 0x3f}, @fd={0x66642a85, 0x0, r0}, @ptr={0x70742a85, 0x0, &(0x7f0000000380)=""/70, 0x46, 0x1, 0x1f}}, &(0x7f0000000500)={0x0, 0x28, 0x40}}, 0x1000}], 0x14, 0x0, &(0x7f0000000680)="86621f50fcee8bdc5bf8c503a78812261b4bf6d7"}) [ 2634.532128] binder: 18249:18274 BC_ACQUIRE_DONE u0000000000000000 no match [ 2634.532135] binder: 18249:18274 BC_ACQUIRE_DONE u0000000000000003 no match 18:07:46 executing program 1: clone(0x2102001fff, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) socket(0x0, 0x0, 0x0) r0 = getpid() rt_tgsigqueueinfo(0x0, r0, 0x16, &(0x7f0000000100)) rt_sigqueueinfo(r0, 0x7, &(0x7f0000000180)={0x0, 0x0, 0xffffffff}) [ 2634.532146] binder: 18249:18274 transaction failed 29189/-22, size 80-24 line 3014 18:07:46 executing program 5: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000001a00)='/dev/net/tun\x00', 0x0, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000080)="c0dc00025e0b01047be070") ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000300)={'nr0\x01\x00', 0x1132}) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000001a00)='/dev/net/tun\x00', 0x2, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000300)={'nr0\x01\x00', 0x1132}) write$cgroup_int(0xffffffffffffffff, &(0x7f00000000c0)=0x2, 0xfffffffffffffe75) close(r1) 18:07:46 executing program 3: r0 = socket(0x10, 0x3, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") ioctl$sock_ifreq(r0, 0x89f3, &(0x7f0000000240)={'sit0\x00'}) 18:07:46 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000006c0)={0x118, 0x0, &(0x7f0000000540)=[@release={0x40046306, 0x2}, @acquire_done, @acquire_done={0x40106309, 0x3}, @transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x50, 0x18, &(0x7f0000000080)={@flat=@binder={0x73622a85, 0xa, 0x1}, @fda={0x66646185, 0xa, 0x1, 0x9}, @fd={0x66642a85, 0x0, r1}}, &(0x7f0000000100)={0x0, 0x18, 0x38}}, 0x1000}, @transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000180)={@ptr={0x70742a85, 0x0, &(0x7f0000000140)=""/51, 0x33, 0x2, 0x25}, @flat=@weak_handle={0x77682a85, 0x1}, @flat=@binder={0x73622a85, 0xa, 0x3}}, &(0x7f0000000280)={0x0, 0x28, 0x40}}, 0x1f8aed83e3349436}, @exit_looper, @transaction_sg={0x40486311, {0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x68, 0x18, &(0x7f0000000480)={@ptr={0x70742a85, 0x0, &(0x7f00000002c0)=""/11, 0xb, 0x2, 0x3f}, @fd={0x66642a85, 0x0, r0}, @ptr={0x70742a85, 0x0, &(0x7f0000000380)=""/70, 0x46, 0x1, 0x1f}}, &(0x7f0000000500)={0x0, 0x28, 0x40}}, 0x1000}], 0x14, 0x0, &(0x7f0000000680)="86621f50fcee8bdc5bf8c503a78812261b4bf6d7"}) 18:07:46 executing program 4: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000040)='/dev/net/tun\x00', 0x0, 0x0) r1 = epoll_create1(0x0) epoll_ctl$EPOLL_CTL_ADD(0xffffffffffffffff, 0x1, r0, &(0x7f0000000100)) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000080)={'tunl0\x00', 0x1}) epoll_wait(r1, &(0x7f00000000c0)=[{}], 0x1, 0x0) [ 2634.532529] binder: undelivered TRANSACTION_ERROR: 29189 [ 2634.686902] binder: 18303:18316 Release 1 refcount change on invalid ref 2 ret -22 18:07:46 executing program 3: r0 = socket(0x10, 0x3, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") ioctl$sock_ifreq(r0, 0x89f3, &(0x7f0000000240)={'sit0\x00'}) 18:07:46 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000006c0)={0x118, 0x0, &(0x7f0000000540)=[@release={0x40046306, 0x2}, @acquire_done, @acquire_done={0x40106309, 0x3}, @transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x50, 0x18, &(0x7f0000000080)={@flat=@binder={0x73622a85, 0xa, 0x1}, @fda={0x66646185, 0xa, 0x1, 0x9}, @fd={0x66642a85, 0x0, r1}}, &(0x7f0000000100)={0x0, 0x18, 0x38}}, 0x1000}, @transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000180)={@ptr={0x70742a85, 0x0, &(0x7f0000000140)=""/51, 0x33, 0x2, 0x25}, @flat=@weak_handle={0x77682a85, 0x1}, @flat=@binder={0x73622a85, 0xa, 0x3}}, &(0x7f0000000280)={0x0, 0x28, 0x40}}, 0x1f8aed83e3349436}, @exit_looper, @transaction_sg={0x40486311, {0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x68, 0x18, &(0x7f0000000480)={@ptr={0x70742a85, 0x0, &(0x7f00000002c0)=""/11, 0xb, 0x2, 0x3f}, @fd={0x66642a85, 0x0, r0}, @ptr={0x70742a85, 0x0, &(0x7f0000000380)=""/70, 0x46, 0x1, 0x1f}}, &(0x7f0000000500)={0x0, 0x28, 0x40}}, 0x1000}], 0x14, 0x0, &(0x7f0000000680)="86621f50fcee8bdc5bf8c503a78812261b4bf6d7"}) [ 2634.686912] binder: 18303:18316 BC_ACQUIRE_DONE u0000000000000000 no match [ 2634.686920] binder: 18303:18316 BC_ACQUIRE_DONE u0000000000000003 no match [ 2634.686934] binder: 18303:18316 transaction failed 29189/-22, size 80-24 line 3014 18:07:46 executing program 1: clone(0x2102001fff, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) socket(0x0, 0x0, 0x0) r0 = getpid() rt_tgsigqueueinfo(0x0, r0, 0x16, &(0x7f0000000100)) rt_sigqueueinfo(r0, 0x7, &(0x7f0000000180)={0x0, 0x0, 0xffffffff}) 18:07:46 executing program 2: ioctl$FS_IOC_RESVSP(0xffffffffffffffff, 0x40305828, &(0x7f00000000c0)={0x0, 0x0, 0x100000000000001}) clone(0x2102001fff, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) socket(0x0, 0x0, 0x0) r0 = getpid() rt_tgsigqueueinfo(0x0, r0, 0x16, &(0x7f0000000100)) ptrace(0x10, r0) ptrace$poke(0x4209, r0, &(0x7f00000000c0), 0x70effd) 18:07:46 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000006c0)={0x118, 0x0, &(0x7f0000000540)=[@release={0x40046306, 0x2}, @acquire_done, @acquire_done={0x40106309, 0x3}, @transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x50, 0x18, &(0x7f0000000080)={@flat=@binder={0x73622a85, 0xa, 0x1}, @fda={0x66646185, 0xa, 0x1, 0x9}, @fd={0x66642a85, 0x0, r1}}, &(0x7f0000000100)={0x0, 0x18, 0x38}}, 0x1000}, @transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000180)={@ptr={0x70742a85, 0x0, &(0x7f0000000140)=""/51, 0x33, 0x2, 0x25}, @flat=@weak_handle={0x77682a85, 0x1}, @flat=@binder={0x73622a85, 0xa, 0x3}}, &(0x7f0000000280)={0x0, 0x28, 0x40}}, 0x1f8aed83e3349436}, @exit_looper, @transaction_sg={0x40486311, {0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x68, 0x18, &(0x7f0000000480)={@ptr={0x70742a85, 0x0, &(0x7f00000002c0)=""/11, 0xb, 0x2, 0x3f}, @fd={0x66642a85, 0x0, r0}, @ptr={0x70742a85, 0x0, &(0x7f0000000380)=""/70, 0x46, 0x1, 0x1f}}, &(0x7f0000000500)={0x0, 0x28, 0x40}}, 0x1000}], 0x14, 0x0, &(0x7f0000000680)="86621f50fcee8bdc5bf8c503a78812261b4bf6d7"}) 18:07:46 executing program 3: r0 = socket(0x10, 0x3, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") ioctl$sock_ifreq(r0, 0x89f3, &(0x7f0000000240)={'sit0\x00'}) [ 2634.687235] binder: undelivered TRANSACTION_ERROR: 29189 [ 2634.834587] binder: 18352:18385 Release 1 refcount change on invalid ref 2 ret -22 [ 2634.834598] binder: 18352:18385 BC_ACQUIRE_DONE u0000000000000000 no match 18:07:46 executing program 4: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000040)='/dev/net/tun\x00', 0x0, 0x0) r1 = epoll_create1(0x0) epoll_ctl$EPOLL_CTL_ADD(0xffffffffffffffff, 0x1, r0, &(0x7f0000000100)) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000080)={'tunl0\x00', 0x1}) epoll_wait(r1, &(0x7f00000000c0)=[{}], 0x1, 0x0) 18:07:46 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000006c0)={0x118, 0x0, &(0x7f0000000540)=[@release={0x40046306, 0x2}, @acquire_done, @acquire_done={0x40106309, 0x3}, @transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x50, 0x18, &(0x7f0000000080)={@flat=@binder={0x73622a85, 0xa, 0x1}, @fda={0x66646185, 0xa, 0x1, 0x9}, @fd={0x66642a85, 0x0, r1}}, &(0x7f0000000100)={0x0, 0x18, 0x38}}, 0x1000}, @transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000180)={@ptr={0x70742a85, 0x0, &(0x7f0000000140)=""/51, 0x33, 0x2, 0x25}, @flat=@weak_handle={0x77682a85, 0x1}, @flat=@binder={0x73622a85, 0xa, 0x3}}, &(0x7f0000000280)={0x0, 0x28, 0x40}}, 0x1f8aed83e3349436}, @exit_looper, @transaction_sg={0x40486311, {0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x68, 0x18, &(0x7f0000000480)={@ptr={0x70742a85, 0x0, &(0x7f00000002c0)=""/11, 0xb, 0x2, 0x3f}, @fd={0x66642a85, 0x0, r0}, @ptr={0x70742a85, 0x0, &(0x7f0000000380)=""/70, 0x46, 0x1, 0x1f}}, &(0x7f0000000500)={0x0, 0x28, 0x40}}, 0x1000}], 0x14, 0x0, &(0x7f0000000680)="86621f50fcee8bdc5bf8c503a78812261b4bf6d7"}) 18:07:46 executing program 5: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000001a00)='/dev/net/tun\x00', 0x0, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000080)="c0dc00025e0b01047be070") ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000300)={'nr0\x01\x00', 0x1132}) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000001a00)='/dev/net/tun\x00', 0x2, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000300)={'nr0\x01\x00', 0x1132}) write$cgroup_int(0xffffffffffffffff, &(0x7f00000000c0)=0x2, 0xfffffffffffffe75) close(r1) [ 2634.834606] binder: 18352:18385 BC_ACQUIRE_DONE u0000000000000003 no match 18:07:46 executing program 1: clone(0x2102001fff, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) socket(0x0, 0x0, 0x0) r0 = getpid() rt_tgsigqueueinfo(0x0, r0, 0x16, &(0x7f0000000100)) rt_sigqueueinfo(r0, 0x7, &(0x7f0000000180)={0x0, 0x0, 0xffffffff}) 18:07:46 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000006c0)={0x118, 0x0, &(0x7f0000000540)=[@release={0x40046306, 0x2}, @acquire_done, @acquire_done={0x40106309, 0x3}, @transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x50, 0x18, &(0x7f0000000080)={@flat=@binder={0x73622a85, 0xa, 0x1}, @fda={0x66646185, 0xa, 0x1, 0x9}, @fd={0x66642a85, 0x0, r1}}, &(0x7f0000000100)={0x0, 0x18, 0x38}}, 0x1000}, @transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000180)={@ptr={0x70742a85, 0x0, &(0x7f0000000140)=""/51, 0x33, 0x2, 0x25}, @flat=@weak_handle={0x77682a85, 0x1}, @flat=@binder={0x73622a85, 0xa, 0x3}}, &(0x7f0000000280)={0x0, 0x28, 0x40}}, 0x1f8aed83e3349436}, @exit_looper, @transaction_sg={0x40486311, {0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x68, 0x18, &(0x7f0000000480)={@ptr={0x70742a85, 0x0, &(0x7f00000002c0)=""/11, 0xb, 0x2, 0x3f}, @fd={0x66642a85, 0x0, r0}, @ptr={0x70742a85, 0x0, &(0x7f0000000380)=""/70, 0x46, 0x1, 0x1f}}, &(0x7f0000000500)={0x0, 0x28, 0x40}}, 0x1000}], 0x14, 0x0, &(0x7f0000000680)="86621f50fcee8bdc5bf8c503a78812261b4bf6d7"}) 18:07:46 executing program 3: r0 = socket(0x10, 0x3, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") ioctl$sock_ifreq(r0, 0x89f3, &(0x7f0000000240)={'sit0\x00'}) [ 2634.834619] binder: 18352:18385 transaction failed 29189/-22, size 80-24 line 3014 [ 2634.834982] binder: undelivered TRANSACTION_ERROR: 29189 [ 2634.912597] binder: 18393:18394 Release 1 refcount change on invalid ref 2 ret -22 18:07:47 executing program 4: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000040)='/dev/net/tun\x00', 0x0, 0x0) r1 = epoll_create1(0x0) epoll_ctl$EPOLL_CTL_ADD(0xffffffffffffffff, 0x1, r0, &(0x7f0000000100)) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000080)={'tunl0\x00', 0x1}) epoll_wait(r1, &(0x7f00000000c0)=[{}], 0x1, 0x0) 18:07:47 executing program 2: ioctl$FS_IOC_RESVSP(0xffffffffffffffff, 0x40305828, &(0x7f00000000c0)={0x0, 0x0, 0x100000000000001}) clone(0x2102001fff, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) socket(0x0, 0x0, 0x0) r0 = getpid() rt_tgsigqueueinfo(0x0, r0, 0x16, &(0x7f0000000100)) ptrace(0x10, r0) ptrace$poke(0x4209, r0, &(0x7f00000000c0), 0x70effd) 18:07:47 executing program 1: clone(0x2102001fff, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) socket(0x0, 0x0, 0x0) r0 = getpid() rt_tgsigqueueinfo(0x0, r0, 0x16, &(0x7f0000000100)) rt_sigqueueinfo(r0, 0x7, &(0x7f0000000180)={0x0, 0x0, 0xffffffff}) [ 2634.912607] binder: 18393:18394 BC_ACQUIRE_DONE u0000000000000000 no match [ 2634.912613] binder: 18393:18394 BC_ACQUIRE_DONE u0000000000000003 no match [ 2634.912624] binder: 18393:18394 transaction failed 29189/-22, size 80-24 line 3014 18:07:47 executing program 3: r0 = socket(0x10, 0x3, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") ioctl$sock_ifreq(r0, 0x89f3, &(0x7f0000000240)={'sit0\x00'}) 18:07:47 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000006c0)={0x118, 0x0, &(0x7f0000000540)=[@release={0x40046306, 0x2}, @acquire_done, @acquire_done={0x40106309, 0x3}, @transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x50, 0x18, &(0x7f0000000080)={@flat=@binder={0x73622a85, 0xa, 0x1}, @fda={0x66646185, 0xa, 0x1, 0x9}, @fd={0x66642a85, 0x0, r1}}, &(0x7f0000000100)={0x0, 0x18, 0x38}}, 0x1000}, @transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000180)={@ptr={0x70742a85, 0x0, &(0x7f0000000140)=""/51, 0x33, 0x2, 0x25}, @flat=@weak_handle={0x77682a85, 0x1}, @flat=@binder={0x73622a85, 0xa, 0x3}}, &(0x7f0000000280)={0x0, 0x28, 0x40}}, 0x1f8aed83e3349436}, @exit_looper, @transaction_sg={0x40486311, {0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x68, 0x18, &(0x7f0000000480)={@ptr={0x70742a85, 0x0, &(0x7f00000002c0)=""/11, 0xb, 0x2, 0x3f}, @fd={0x66642a85, 0x0, r0}, @ptr={0x70742a85, 0x0, &(0x7f0000000380)=""/70, 0x46, 0x1, 0x1f}}, &(0x7f0000000500)={0x0, 0x28, 0x40}}, 0x1000}], 0x14, 0x0, &(0x7f0000000680)="86621f50fcee8bdc5bf8c503a78812261b4bf6d7"}) 18:07:47 executing program 5: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000001a00)='/dev/net/tun\x00', 0x0, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000080)="c0dc00025e0b01047be070") ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000300)={'nr0\x01\x00', 0x1132}) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000001a00)='/dev/net/tun\x00', 0x2, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000300)={'nr0\x01\x00', 0x1132}) write$cgroup_int(0xffffffffffffffff, &(0x7f00000000c0)=0x2, 0xfffffffffffffe75) close(r1) [ 2634.912902] binder: undelivered TRANSACTION_ERROR: 29189 18:07:47 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000006c0)={0x118, 0x0, &(0x7f0000000540)=[@release={0x40046306, 0x2}, @acquire_done, @acquire_done={0x40106309, 0x3}, @transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x50, 0x18, &(0x7f0000000080)={@flat=@binder={0x73622a85, 0xa, 0x1}, @fda={0x66646185, 0xa, 0x1, 0x9}, @fd={0x66642a85, 0x0, r1}}, &(0x7f0000000100)={0x0, 0x18, 0x38}}, 0x1000}, @transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000180)={@ptr={0x70742a85, 0x0, &(0x7f0000000140)=""/51, 0x33, 0x2, 0x25}, @flat=@weak_handle={0x77682a85, 0x1}, @flat=@binder={0x73622a85, 0xa, 0x3}}, &(0x7f0000000280)={0x0, 0x28, 0x40}}, 0x1f8aed83e3349436}, @exit_looper, @transaction_sg={0x40486311, {0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x68, 0x18, &(0x7f0000000480)={@ptr={0x70742a85, 0x0, &(0x7f00000002c0)=""/11, 0xb, 0x2, 0x3f}, @fd={0x66642a85, 0x0, r0}, @ptr={0x70742a85, 0x0, &(0x7f0000000380)=""/70, 0x46, 0x1, 0x1f}}, &(0x7f0000000500)={0x0, 0x28, 0x40}}, 0x1000}], 0x14, 0x0, &(0x7f0000000680)="86621f50fcee8bdc5bf8c503a78812261b4bf6d7"}) [ 2635.070383] binder: 18432:18436 Release 1 refcount change on invalid ref 2 ret -22 [ 2635.070394] binder: 18432:18436 BC_ACQUIRE_DONE u0000000000000000 no match 18:07:47 executing program 2: ioctl$FS_IOC_RESVSP(0xffffffffffffffff, 0x40305828, &(0x7f00000000c0)={0x0, 0x0, 0x100000000000001}) clone(0x2102001fff, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) socket(0x0, 0x0, 0x0) r0 = getpid() rt_tgsigqueueinfo(0x0, r0, 0x16, &(0x7f0000000100)) ptrace(0x10, r0) ptrace$poke(0x4209, r0, &(0x7f00000000c0), 0x70effd) 18:07:47 executing program 3: r0 = socket(0x10, 0x3, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") ioctl$sock_ifreq(r0, 0x89f3, &(0x7f0000000240)={'sit0\x00'}) 18:07:47 executing program 1: clone(0x2102001fff, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) socket(0x0, 0x0, 0x0) r0 = getpid() rt_tgsigqueueinfo(0x0, r0, 0x16, &(0x7f0000000100)) rt_sigqueueinfo(r0, 0x7, &(0x7f0000000180)={0x0, 0x0, 0xffffffff}) [ 2635.070403] binder: 18432:18436 BC_ACQUIRE_DONE u0000000000000003 no match [ 2635.070416] binder: 18432:18436 transaction failed 29189/-22, size 80-24 line 3014 [ 2635.070716] binder: undelivered TRANSACTION_ERROR: 29189 18:07:47 executing program 3: r0 = socket(0x10, 0x3, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") ioctl$sock_ifreq(r0, 0x89f3, &(0x7f0000000240)={'sit0\x00'}) [ 2635.225054] binder: 18488:18508 Release 1 refcount change on invalid ref 2 ret -22 18:07:47 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000006c0)={0x118, 0x0, &(0x7f0000000540)=[@release={0x40046306, 0x2}, @acquire_done, @acquire_done={0x40106309, 0x3}, @transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x50, 0x18, &(0x7f0000000080)={@flat=@binder={0x73622a85, 0xa, 0x1}, @fda={0x66646185, 0xa, 0x1, 0x9}, @fd={0x66642a85, 0x0, r1}}, &(0x7f0000000100)={0x0, 0x18, 0x38}}, 0x1000}, @transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000180)={@ptr={0x70742a85, 0x0, &(0x7f0000000140)=""/51, 0x33, 0x2, 0x25}, @flat=@weak_handle={0x77682a85, 0x1}, @flat=@binder={0x73622a85, 0xa, 0x3}}, &(0x7f0000000280)={0x0, 0x28, 0x40}}, 0x1f8aed83e3349436}, @exit_looper, @transaction_sg={0x40486311, {0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x68, 0x18, &(0x7f0000000480)={@ptr={0x70742a85, 0x0, &(0x7f00000002c0)=""/11, 0xb, 0x2, 0x3f}, @fd={0x66642a85, 0x0, r0}, @ptr={0x70742a85, 0x0, &(0x7f0000000380)=""/70, 0x46, 0x1, 0x1f}}, &(0x7f0000000500)={0x0, 0x28, 0x40}}, 0x1000}], 0x14, 0x0, &(0x7f0000000680)="86621f50fcee8bdc5bf8c503a78812261b4bf6d7"}) [ 2635.225065] binder: 18488:18508 BC_ACQUIRE_DONE u0000000000000000 no match [ 2635.225073] binder: 18488:18508 BC_ACQUIRE_DONE u0000000000000003 no match [ 2635.225088] binder: 18488:18508 transaction failed 29189/-22, size 80-24 line 3014 [ 2635.225849] binder: undelivered TRANSACTION_ERROR: 29189 [ 2635.312056] binder: 18531:18534 Release 1 refcount change on invalid ref 2 ret -22 [ 2635.312066] binder: 18531:18534 BC_ACQUIRE_DONE u0000000000000000 no match [ 2635.312074] binder: 18531:18534 BC_ACQUIRE_DONE u0000000000000003 no match [ 2635.312087] binder: 18531:18534 transaction failed 29189/-22, size 80-24 line 3014 [ 2635.312932] binder: undelivered TRANSACTION_ERROR: 29189 [ 2635.429285] binder: 18584:18589 Release 1 refcount change on invalid ref 2 ret -22 [ 2635.429295] binder: 18584:18589 BC_ACQUIRE_DONE u0000000000000000 no match [ 2635.429303] binder: 18584:18589 BC_ACQUIRE_DONE u0000000000000003 no match [ 2635.429318] binder: 18584:18589 transaction failed 29189/-22, size 80-24 line 3014 [ 2635.431714] binder: undelivered TRANSACTION_ERROR: 29189 [ 2635.717121] binder: 18639:18646 Release 1 refcount change on invalid ref 2 ret -22 [ 2635.717130] binder: 18639:18646 BC_ACQUIRE_DONE u0000000000000000 no match [ 2635.717135] binder: 18639:18646 BC_ACQUIRE_DONE u0000000000000003 no match [ 2635.717146] binder: 18639:18646 transaction failed 29189/-22, size 80-24 line 3014 [ 2635.720153] binder: undelivered TRANSACTION_ERROR: 29189 [ 2635.799935] binder: 18694:18707 Release 1 refcount change on invalid ref 2 ret -22 [ 2635.799945] binder: 18694:18707 BC_ACQUIRE_DONE u0000000000000000 no match [ 2635.799953] binder: 18694:18707 BC_ACQUIRE_DONE u0000000000000003 no match [ 2635.799966] binder: 18694:18707 transaction failed 29189/-22, size 80-24 line 3014 [ 2635.800219] binder: undelivered TRANSACTION_ERROR: 29189 [ 2635.916671] binder: 18746:18750 Release 1 refcount change on invalid ref 2 ret -22 [ 2635.916684] binder: 18746:18750 BC_ACQUIRE_DONE u0000000000000000 no match [ 2635.916692] binder: 18746:18750 BC_ACQUIRE_DONE u0000000000000003 no match [ 2635.916704] binder: 18746:18750 transaction failed 29189/-22, size 80-24 line 3014 [ 2635.916988] binder: undelivered TRANSACTION_ERROR: 29189 [ 2636.033272] binder: 18762:18787 Release 1 refcount change on invalid ref 2 ret -22 [ 2636.033282] binder: 18762:18787 BC_ACQUIRE_DONE u0000000000000000 no match [ 2636.033290] binder: 18762:18787 BC_ACQUIRE_DONE u0000000000000003 no match [ 2636.033302] binder: 18762:18787 transaction failed 29189/-22, size 80-24 line 3014 [ 2636.034053] binder: undelivered TRANSACTION_ERROR: 29189 [ 2636.117983] binder: 18809:18820 Release 1 refcount change on invalid ref 2 ret -22 [ 2636.117992] binder: 18809:18820 BC_ACQUIRE_DONE u0000000000000000 no match [ 2636.117999] binder: 18809:18820 BC_ACQUIRE_DONE u0000000000000003 no match [ 2636.118020] binder: 18809:18820 transaction failed 29189/-22, size 80-24 line 3014 [ 2636.118320] binder: undelivered TRANSACTION_ERROR: 29189 [ 2636.190739] binder: 18847:18849 Release 1 refcount change on invalid ref 2 ret -22 [ 2636.190750] binder: 18847:18849 BC_ACQUIRE_DONE u0000000000000000 no match [ 2636.190759] binder: 18847:18849 BC_ACQUIRE_DONE u0000000000000003 no match [ 2636.190775] binder: 18847:18849 transaction failed 29189/-22, size 80-24 line 3014 [ 2636.193912] binder: undelivered TRANSACTION_ERROR: 29189 [ 2636.326671] binder: 18888:18892 Release 1 refcount change on invalid ref 2 ret -22 [ 2636.326681] binder: 18888:18892 BC_ACQUIRE_DONE u0000000000000000 no match [ 2636.326689] binder: 18888:18892 BC_ACQUIRE_DONE u0000000000000003 no match [ 2636.326701] binder: 18888:18892 transaction failed 29189/-22, size 80-24 line 3014 [ 2636.327127] binder: undelivered TRANSACTION_ERROR: 29189 [ 2636.399109] binder: 18916:18926 Release 1 refcount change on invalid ref 2 ret -22 [ 2636.399119] binder: 18916:18926 BC_ACQUIRE_DONE u0000000000000000 no match [ 2636.399127] binder: 18916:18926 BC_ACQUIRE_DONE u0000000000000003 no match [ 2636.399139] binder: 18916:18926 transaction failed 29189/-22, size 80-24 line 3014 [ 2636.399942] binder: undelivered TRANSACTION_ERROR: 29189 [ 2636.510713] binder: 18963:18970 Release 1 refcount change on invalid ref 2 ret -22 [ 2636.510723] binder: 18963:18970 BC_ACQUIRE_DONE u0000000000000000 no match [ 2636.510731] binder: 18963:18970 BC_ACQUIRE_DONE u0000000000000003 no match [ 2636.510744] binder: 18963:18970 transaction failed 29189/-22, size 80-24 line 3014 [ 2636.511940] binder: undelivered TRANSACTION_ERROR: 29189 [ 2636.671837] binder: 19007:19032 Release 1 refcount change on invalid ref 2 ret -22 [ 2636.671854] binder: 19007:19032 BC_ACQUIRE_DONE u0000000000000000 no match [ 2636.671862] binder: 19007:19032 BC_ACQUIRE_DONE u0000000000000003 no match [ 2636.671874] binder: 19007:19032 transaction failed 29189/-22, size 80-24 line 3014 [ 2636.672356] binder: undelivered TRANSACTION_ERROR: 29189 [ 2636.745967] binder: 19081:19087 Release 1 refcount change on invalid ref 2 ret -22 [ 2636.745978] binder: 19081:19087 BC_ACQUIRE_DONE u0000000000000000 no match [ 2636.745985] binder: 19081:19087 BC_ACQUIRE_DONE u0000000000000003 no match [ 2636.745997] binder: 19081:19087 transaction failed 29189/-22, size 80-24 line 3014 [ 2636.746332] binder: undelivered TRANSACTION_ERROR: 29189 [ 2636.879612] binder: 19105:19120 Release 1 refcount change on invalid ref 2 ret -22 [ 2636.879622] binder: 19105:19120 BC_ACQUIRE_DONE u0000000000000000 no match [ 2636.879629] binder: 19105:19120 BC_ACQUIRE_DONE u0000000000000003 no match [ 2636.879641] binder: 19105:19120 transaction failed 29189/-22, size 80-24 line 3014 [ 2636.880053] binder: undelivered TRANSACTION_ERROR: 29189 [ 2637.061195] binder: 19162:19190 Release 1 refcount change on invalid ref 2 ret -22 [ 2637.061204] binder: 19162:19190 BC_ACQUIRE_DONE u0000000000000000 no match [ 2637.061212] binder: 19162:19190 BC_ACQUIRE_DONE u0000000000000003 no match [ 2637.061225] binder: 19162:19190 transaction failed 29189/-22, size 80-24 line 3014 [ 2637.061584] binder: undelivered TRANSACTION_ERROR: 29189 [ 2637.174376] binder: 19216:19228 Release 1 refcount change on invalid ref 2 ret -22 [ 2637.174386] binder: 19216:19228 BC_ACQUIRE_DONE u0000000000000000 no match [ 2637.174394] binder: 19216:19228 BC_ACQUIRE_DONE u0000000000000003 no match [ 2637.174407] binder: 19216:19228 transaction failed 29189/-22, size 80-24 line 3014 [ 2637.174711] binder: undelivered TRANSACTION_ERROR: 29189 [ 2637.302638] binder: 19257:19262 Release 1 refcount change on invalid ref 2 ret -22 [ 2637.302648] binder: 19257:19262 BC_ACQUIRE_DONE u0000000000000000 no match [ 2637.302656] binder: 19257:19262 BC_ACQUIRE_DONE u0000000000000003 no match [ 2637.302669] binder: 19257:19262 transaction failed 29189/-22, size 80-24 line 3014 [ 2637.303456] binder: undelivered TRANSACTION_ERROR: 29189 [ 2637.412901] binder: 19300:19308 Release 1 refcount change on invalid ref 2 ret -22 [ 2637.412911] binder: 19300:19308 BC_ACQUIRE_DONE u0000000000000000 no match [ 2637.412919] binder: 19300:19308 BC_ACQUIRE_DONE u0000000000000003 no match [ 2637.412932] binder: 19300:19308 transaction failed 29189/-22, size 80-24 line 3014 [ 2637.413170] binder: undelivered TRANSACTION_ERROR: 29189 [ 2637.518698] binder: 19346:19349 Release 1 refcount change on invalid ref 2 ret -22 [ 2637.518708] binder: 19346:19349 BC_ACQUIRE_DONE u0000000000000000 no match [ 2637.518716] binder: 19346:19349 BC_ACQUIRE_DONE u0000000000000003 no match [ 2637.518729] binder: 19346:19349 transaction failed 29189/-22, size 80-24 line 3014 [ 2637.521471] binder: undelivered TRANSACTION_ERROR: 29189 [ 2637.683155] binder: 19375:19415 Release 1 refcount change on invalid ref 2 ret -22 [ 2637.683166] binder: 19375:19415 BC_ACQUIRE_DONE u0000000000000000 no match [ 2637.683173] binder: 19375:19415 BC_ACQUIRE_DONE u0000000000000003 no match [ 2637.683186] binder: 19375:19415 transaction failed 29189/-22, size 80-24 line 3014 [ 2637.684346] binder: undelivered TRANSACTION_ERROR: 29189 [ 2637.819665] binder: 19452:19455 Release 1 refcount change on invalid ref 2 ret -22 [ 2637.819675] binder: 19452:19455 BC_ACQUIRE_DONE u0000000000000000 no match [ 2637.819682] binder: 19452:19455 BC_ACQUIRE_DONE u0000000000000003 no match [ 2637.819695] binder: 19452:19455 transaction failed 29189/-22, size 80-24 line 3014 [ 2637.819911] binder: undelivered TRANSACTION_ERROR: 29189 [ 2638.022667] binder: 19523:19529 Release 1 refcount change on invalid ref 2 ret -22 [ 2638.022677] binder: 19523:19529 BC_ACQUIRE_DONE u0000000000000000 no match [ 2638.022685] binder: 19523:19529 BC_ACQUIRE_DONE u0000000000000003 no match [ 2638.022698] binder: 19523:19529 transaction failed 29189/-22, size 80-24 line 3014 [ 2638.023003] binder: undelivered TRANSACTION_ERROR: 29189 [ 2638.315738] binder: 19577:19594 Release 1 refcount change on invalid ref 2 ret -22 [ 2638.315747] binder: 19577:19594 BC_ACQUIRE_DONE u0000000000000000 no match [ 2638.315754] binder: 19577:19594 BC_ACQUIRE_DONE u0000000000000003 no match [ 2638.315766] binder: 19577:19594 transaction failed 29189/-22, size 80-24 line 3014 [ 2638.316367] binder: undelivered TRANSACTION_ERROR: 29189 [ 2638.425697] binder: 19617:19621 Release 1 refcount change on invalid ref 2 ret -22 [ 2638.425735] binder: 19617:19621 BC_ACQUIRE_DONE u0000000000000000 no match [ 2638.425743] binder: 19617:19621 BC_ACQUIRE_DONE u0000000000000003 no match [ 2638.425755] binder: 19617:19621 transaction failed 29189/-22, size 80-24 line 3014 [ 2638.426159] binder: undelivered TRANSACTION_ERROR: 29189 [ 2638.549677] binder: 19646:19674 Release 1 refcount change on invalid ref 2 ret -22 [ 2638.549687] binder: 19646:19674 BC_ACQUIRE_DONE u0000000000000000 no match [ 2638.549695] binder: 19646:19674 BC_ACQUIRE_DONE u0000000000000003 no match [ 2638.549708] binder: 19646:19674 transaction failed 29189/-22, size 80-24 line 3014 [ 2638.550117] binder: undelivered TRANSACTION_ERROR: 29189 [ 2638.690531] binder: 19721:19745 Release 1 refcount change on invalid ref 2 ret -22 [ 2638.690541] binder: 19721:19745 BC_ACQUIRE_DONE u0000000000000000 no match [ 2638.690549] binder: 19721:19745 BC_ACQUIRE_DONE u0000000000000003 no match [ 2638.690562] binder: 19721:19745 transaction failed 29189/-22, size 80-24 line 3014 [ 2638.690917] binder: undelivered TRANSACTION_ERROR: 29189 [ 2638.751365] binder: 19747:19748 Release 1 refcount change on invalid ref 2 ret -22 [ 2638.751374] binder: 19747:19748 BC_ACQUIRE_DONE u0000000000000000 no match [ 2638.751381] binder: 19747:19748 BC_ACQUIRE_DONE u0000000000000003 no match [ 2638.751393] binder: 19747:19748 transaction failed 29189/-22, size 80-24 line 3014 [ 2638.753988] binder: undelivered TRANSACTION_ERROR: 29189 [ 2639.327131] binder: 19826:19827 Release 1 refcount change on invalid ref 2 ret -22 [ 2639.327141] binder: 19826:19827 BC_ACQUIRE_DONE u0000000000000000 no match [ 2639.327149] binder: 19826:19827 BC_ACQUIRE_DONE u0000000000000003 no match [ 2639.327162] binder: 19826:19827 transaction failed 29189/-22, size 80-24 line 3014 [ 2639.332370] binder: undelivered TRANSACTION_ERROR: 29189 [ 2639.479575] binder: 19870:19884 Release 1 refcount change on invalid ref 2 ret -22 [ 2639.479585] binder: 19870:19884 BC_ACQUIRE_DONE u0000000000000000 no match [ 2639.479593] binder: 19870:19884 BC_ACQUIRE_DONE u0000000000000003 no match [ 2639.479607] binder: 19870:19884 transaction failed 29189/-22, size 80-24 line 3014 [ 2639.479811] binder: undelivered TRANSACTION_ERROR: 29189 [ 2639.589596] binder: 19912:19924 Release 1 refcount change on invalid ref 2 ret -22 [ 2639.589606] binder: 19912:19924 BC_ACQUIRE_DONE u0000000000000000 no match [ 2639.589616] binder: 19912:19924 BC_ACQUIRE_DONE u0000000000000003 no match [ 2639.589631] binder: 19912:19924 transaction failed 29189/-22, size 80-24 line 3014 [ 2639.589859] binder: undelivered TRANSACTION_ERROR: 29189 [ 2639.687894] binder: 19968:19979 Release 1 refcount change on invalid ref 2 ret -22 [ 2639.687904] binder: 19968:19979 BC_ACQUIRE_DONE u0000000000000000 no match [ 2639.687911] binder: 19968:19979 BC_ACQUIRE_DONE u0000000000000003 no match [ 2639.687923] binder: 19968:19979 transaction failed 29189/-22, size 80-24 line 3014 [ 2639.689109] binder: undelivered TRANSACTION_ERROR: 29189 [ 2639.788925] binder: 19987:19995 Release 1 refcount change on invalid ref 2 ret -22 [ 2639.788935] binder: 19987:19995 BC_ACQUIRE_DONE u0000000000000000 no match [ 2639.788943] binder: 19987:19995 BC_ACQUIRE_DONE u0000000000000003 no match [ 2639.788955] binder: 19987:19995 transaction failed 29189/-22, size 80-24 line 3014 [ 2639.789187] binder: undelivered TRANSACTION_ERROR: 29189 [ 2639.914838] binder: 20043:20059 Release 1 refcount change on invalid ref 2 ret -22 [ 2639.914848] binder: 20043:20059 BC_ACQUIRE_DONE u0000000000000000 no match [ 2639.914856] binder: 20043:20059 BC_ACQUIRE_DONE u0000000000000003 no match [ 2639.914869] binder: 20043:20059 transaction failed 29189/-22, size 80-24 line 3014 [ 2639.915088] binder: undelivered TRANSACTION_ERROR: 29189 [ 2640.017913] binder: 20084:20096 Release 1 refcount change on invalid ref 2 ret -22 [ 2640.017922] binder: 20084:20096 BC_ACQUIRE_DONE u0000000000000000 no match [ 2640.017931] binder: 20084:20096 BC_ACQUIRE_DONE u0000000000000003 no match [ 2640.017944] binder: 20084:20096 transaction failed 29189/-22, size 80-24 line 3014 [ 2640.018284] binder: undelivered TRANSACTION_ERROR: 29189 [ 2640.151923] binder: 20136:20154 Release 1 refcount change on invalid ref 2 ret -22 [ 2640.151934] binder: 20136:20154 BC_ACQUIRE_DONE u0000000000000000 no match [ 2640.151941] binder: 20136:20154 BC_ACQUIRE_DONE u0000000000000003 no match [ 2640.151954] binder: 20136:20154 transaction failed 29189/-22, size 80-24 line 3014 [ 2640.152230] binder: undelivered TRANSACTION_ERROR: 29189 [ 2640.326151] binder: 20196:20212 Release 1 refcount change on invalid ref 2 ret -22 [ 2640.326162] binder: 20196:20212 BC_ACQUIRE_DONE u0000000000000000 no match [ 2640.326169] binder: 20196:20212 BC_ACQUIRE_DONE u0000000000000003 no match [ 2640.326183] binder: 20196:20212 transaction failed 29189/-22, size 80-24 line 3014 [ 2640.326674] binder: undelivered TRANSACTION_ERROR: 29189 [ 2640.431835] binder: 20236:20249 Release 1 refcount change on invalid ref 2 ret -22 [ 2640.431845] binder: 20236:20249 BC_ACQUIRE_DONE u0000000000000000 no match [ 2640.431853] binder: 20236:20249 BC_ACQUIRE_DONE u0000000000000003 no match [ 2640.431867] binder: 20236:20249 transaction failed 29189/-22, size 80-24 line 3014 [ 2640.432206] binder: undelivered TRANSACTION_ERROR: 29189 [ 2640.547169] binder: 20287:20297 Release 1 refcount change on invalid ref 2 ret -22 [ 2640.547224] binder: 20287:20297 BC_ACQUIRE_DONE u0000000000000000 no match [ 2640.547231] binder: 20287:20297 BC_ACQUIRE_DONE u0000000000000003 no match [ 2640.547242] binder: 20287:20297 transaction failed 29189/-22, size 80-24 line 3014 [ 2640.549689] binder: undelivered TRANSACTION_ERROR: 29189 [ 2640.687173] binder: 20323:20338 Release 1 refcount change on invalid ref 2 ret -22 [ 2640.687184] binder: 20323:20338 BC_ACQUIRE_DONE u0000000000000000 no match [ 2640.687191] binder: 20323:20338 BC_ACQUIRE_DONE u0000000000000003 no match [ 2640.687207] binder: 20323:20338 transaction failed 29189/-22, size 80-24 line 3014 [ 2640.688860] binder: undelivered TRANSACTION_ERROR: 29189 [ 2640.867086] binder: 20419:20434 Release 1 refcount change on invalid ref 2 ret -22 [ 2640.867096] binder: 20419:20434 BC_ACQUIRE_DONE u0000000000000000 no match [ 2640.867104] binder: 20419:20434 BC_ACQUIRE_DONE u0000000000000003 no match [ 2640.867118] binder: 20419:20434 transaction failed 29189/-22, size 80-24 line 3014 [ 2640.867430] binder: undelivered TRANSACTION_ERROR: 29189 [ 2640.986892] binder: 20460:20468 Release 1 refcount change on invalid ref 2 ret -22 [ 2640.986901] binder: 20460:20468 BC_ACQUIRE_DONE u0000000000000000 no match [ 2640.986908] binder: 20460:20468 BC_ACQUIRE_DONE u0000000000000003 no match [ 2640.986919] binder: 20460:20468 transaction failed 29189/-22, size 80-24 line 3014 [ 2640.987110] binder: undelivered TRANSACTION_ERROR: 29189 [ 2641.058438] binder: 20498:20511 Release 1 refcount change on invalid ref 2 ret -22 [ 2641.058448] binder: 20498:20511 BC_ACQUIRE_DONE u0000000000000000 no match [ 2641.058455] binder: 20498:20511 BC_ACQUIRE_DONE u0000000000000003 no match [ 2641.058467] binder: 20498:20511 transaction failed 29189/-22, size 80-24 line 3014 [ 2641.058948] binder: undelivered TRANSACTION_ERROR: 29189 [ 2641.188885] binder: 20537:20542 Release 1 refcount change on invalid ref 2 ret -22 [ 2641.188896] binder: 20537:20542 BC_ACQUIRE_DONE u0000000000000000 no match [ 2641.188905] binder: 20537:20542 BC_ACQUIRE_DONE u0000000000000003 no match [ 2641.188920] binder: 20537:20542 transaction failed 29189/-22, size 80-24 line 3014 [ 2641.189265] binder: undelivered TRANSACTION_ERROR: 29189 [ 2641.257540] binder: 20586:20591 Release 1 refcount change on invalid ref 2 ret -22 [ 2641.257551] binder: 20586:20591 BC_ACQUIRE_DONE u0000000000000000 no match [ 2641.257559] binder: 20586:20591 BC_ACQUIRE_DONE u0000000000000003 no match [ 2641.257571] binder: 20586:20591 transaction failed 29189/-22, size 80-24 line 3014 [ 2641.257847] binder: undelivered TRANSACTION_ERROR: 29189 [ 2641.373006] binder: 20616:20620 Release 1 refcount change on invalid ref 2 ret -22 [ 2641.373026] binder: 20616:20620 BC_ACQUIRE_DONE u0000000000000000 no match [ 2641.373033] binder: 20616:20620 BC_ACQUIRE_DONE u0000000000000003 no match [ 2641.373044] binder: 20616:20620 transaction failed 29189/-22, size 80-24 line 3014 [ 2641.373334] binder: undelivered TRANSACTION_ERROR: 29189 [ 2641.473538] binder: 20653:20666 Release 1 refcount change on invalid ref 2 ret -22 [ 2641.473548] binder: 20653:20666 BC_ACQUIRE_DONE u0000000000000000 no match [ 2641.473555] binder: 20653:20666 BC_ACQUIRE_DONE u0000000000000003 no match [ 2641.473568] binder: 20653:20666 transaction failed 29189/-22, size 80-24 line 3014 [ 2641.473935] binder: undelivered TRANSACTION_ERROR: 29189 [ 2641.569034] binder: 20695:20697 Release 1 refcount change on invalid ref 2 ret -22 [ 2641.569044] binder: 20695:20697 BC_ACQUIRE_DONE u0000000000000000 no match [ 2641.569052] binder: 20695:20697 BC_ACQUIRE_DONE u0000000000000003 no match [ 2641.569065] binder: 20695:20697 transaction failed 29189/-22, size 80-24 line 3014 [ 2641.569300] binder: undelivered TRANSACTION_ERROR: 29189 [ 2641.715260] binder: 20716:20733 Release 1 refcount change on invalid ref 2 ret -22 [ 2641.715270] binder: 20716:20733 BC_ACQUIRE_DONE u0000000000000000 no match [ 2641.715278] binder: 20716:20733 BC_ACQUIRE_DONE u0000000000000003 no match [ 2641.715290] binder: 20716:20733 transaction failed 29189/-22, size 80-24 line 3014 [ 2641.715574] binder: undelivered TRANSACTION_ERROR: 29189 [ 2641.840456] binder: 20782:20789 Release 1 refcount change on invalid ref 2 ret -22 [ 2641.840467] binder: 20782:20789 BC_ACQUIRE_DONE u0000000000000000 no match [ 2641.840474] binder: 20782:20789 BC_ACQUIRE_DONE u0000000000000003 no match [ 2641.840487] binder: 20782:20789 transaction failed 29189/-22, size 80-24 line 3014 [ 2641.840795] binder: undelivered TRANSACTION_ERROR: 29189 [ 2642.095597] binder: 20818:20869 Release 1 refcount change on invalid ref 2 ret -22 [ 2642.095607] binder: 20818:20869 BC_ACQUIRE_DONE u0000000000000000 no match [ 2642.095614] binder: 20818:20869 BC_ACQUIRE_DONE u0000000000000003 no match [ 2642.095627] binder: 20818:20869 transaction failed 29189/-22, size 80-24 line 3014 [ 2642.117092] binder: undelivered TRANSACTION_ERROR: 29189 [ 2642.215126] binder: 20906:20913 Release 1 refcount change on invalid ref 2 ret -22 [ 2642.215136] binder: 20906:20913 BC_ACQUIRE_DONE u0000000000000000 no match [ 2642.215144] binder: 20906:20913 BC_ACQUIRE_DONE u0000000000000003 no match [ 2642.215157] binder: 20906:20913 transaction failed 29189/-22, size 80-24 line 3014 [ 2642.215392] binder: undelivered TRANSACTION_ERROR: 29189 [ 2642.332951] binder: 20929:20937 Release 1 refcount change on invalid ref 2 ret -22 [ 2642.332962] binder: 20929:20937 BC_ACQUIRE_DONE u0000000000000000 no match [ 2642.332971] binder: 20929:20937 BC_ACQUIRE_DONE u0000000000000003 no match [ 2642.332995] binder: 20929:20937 transaction failed 29189/-22, size 80-24 line 3014 [ 2642.333247] binder: undelivered TRANSACTION_ERROR: 29189 [ 2642.501472] binder: 20983:21009 Release 1 refcount change on invalid ref 2 ret -22 [ 2642.501482] binder: 20983:21009 BC_ACQUIRE_DONE u0000000000000000 no match [ 2642.501490] binder: 20983:21009 BC_ACQUIRE_DONE u0000000000000003 no match [ 2642.501503] binder: 20983:21009 transaction failed 29189/-22, size 80-24 line 3014 [ 2642.504498] binder: undelivered TRANSACTION_ERROR: 29189 [ 2642.597094] binder: 21025:21027 Release 1 refcount change on invalid ref 2 ret -22 [ 2642.597103] binder: 21025:21027 BC_ACQUIRE_DONE u0000000000000000 no match [ 2642.597110] binder: 21025:21027 BC_ACQUIRE_DONE u0000000000000003 no match [ 2642.597122] binder: 21025:21027 transaction failed 29189/-22, size 80-24 line 3014 [ 2642.597418] binder: undelivered TRANSACTION_ERROR: 29189 [ 2642.719532] binder: 21066:21085 Release 1 refcount change on invalid ref 2 ret -22 [ 2642.719542] binder: 21066:21085 BC_ACQUIRE_DONE u0000000000000000 no match [ 2642.719549] binder: 21066:21085 BC_ACQUIRE_DONE u0000000000000003 no match [ 2642.719561] binder: 21066:21085 transaction failed 29189/-22, size 80-24 line 3014 [ 2642.719811] binder: undelivered TRANSACTION_ERROR: 29189 [ 2642.825046] binder: 21115:21118 Release 1 refcount change on invalid ref 2 ret -22 [ 2642.825056] binder: 21115:21118 BC_ACQUIRE_DONE u0000000000000000 no match [ 2642.825063] binder: 21115:21118 BC_ACQUIRE_DONE u0000000000000003 no match [ 2642.825076] binder: 21115:21118 transaction failed 29189/-22, size 80-24 line 3014 [ 2642.825315] binder: undelivered TRANSACTION_ERROR: 29189 [ 2642.947398] binder: 21141:21165 Release 1 refcount change on invalid ref 2 ret -22 [ 2642.947409] binder: 21141:21165 BC_ACQUIRE_DONE u0000000000000000 no match [ 2642.947417] binder: 21141:21165 BC_ACQUIRE_DONE u0000000000000003 no match [ 2642.947431] binder: 21141:21165 transaction failed 29189/-22, size 80-24 line 3014 [ 2642.947705] binder: undelivered TRANSACTION_ERROR: 29189 [ 2643.057012] binder: 21191:21194 Release 1 refcount change on invalid ref 2 ret -22 [ 2643.057022] binder: 21191:21194 BC_ACQUIRE_DONE u0000000000000000 no match [ 2643.057030] binder: 21191:21194 BC_ACQUIRE_DONE u0000000000000003 no match [ 2643.057043] binder: 21191:21194 transaction failed 29189/-22, size 80-24 line 3014 [ 2643.057324] binder: undelivered TRANSACTION_ERROR: 29189 [ 2643.145969] binder: 21219:21224 Release 1 refcount change on invalid ref 2 ret -22 [ 2643.145979] binder: 21219:21224 BC_ACQUIRE_DONE u0000000000000000 no match [ 2643.145988] binder: 21219:21224 BC_ACQUIRE_DONE u0000000000000003 no match [ 2643.146003] binder: 21219:21224 transaction failed 29189/-22, size 80-24 line 3014 [ 2643.146334] binder: undelivered TRANSACTION_ERROR: 29189 [ 2643.387654] binder: 21249:21299 Release 1 refcount change on invalid ref 2 ret -22 [ 2643.387665] binder: 21249:21299 BC_ACQUIRE_DONE u0000000000000000 no match [ 2643.387674] binder: 21249:21299 BC_ACQUIRE_DONE u0000000000000003 no match [ 2643.387689] binder: 21249:21299 transaction failed 29189/-22, size 80-24 line 3014 [ 2643.388012] binder: undelivered TRANSACTION_ERROR: 29189 [ 2643.519251] binder: 21328:21351 Release 1 refcount change on invalid ref 2 ret -22 [ 2643.519261] binder: 21328:21351 BC_ACQUIRE_DONE u0000000000000000 no match [ 2643.519269] binder: 21328:21351 BC_ACQUIRE_DONE u0000000000000003 no match [ 2643.519282] binder: 21328:21351 transaction failed 29189/-22, size 80-24 line 3014 [ 2643.519617] binder: undelivered TRANSACTION_ERROR: 29189 [ 2643.574585] binder: 21398:21403 Release 1 refcount change on invalid ref 2 ret -22 [ 2643.574595] binder: 21398:21403 BC_ACQUIRE_DONE u0000000000000000 no match [ 2643.574603] binder: 21398:21403 BC_ACQUIRE_DONE u0000000000000003 no match [ 2643.574617] binder: 21398:21403 transaction failed 29189/-22, size 80-24 line 3014 [ 2643.574913] binder: undelivered TRANSACTION_ERROR: 29189 [ 2643.700259] binder: 21422:21440 Release 1 refcount change on invalid ref 2 ret -22 [ 2643.700270] binder: 21422:21440 BC_ACQUIRE_DONE u0000000000000000 no match [ 2643.700278] binder: 21422:21440 BC_ACQUIRE_DONE u0000000000000003 no match [ 2643.700291] binder: 21422:21440 transaction failed 29189/-22, size 80-24 line 3014 [ 2643.703399] binder: undelivered TRANSACTION_ERROR: 29189 [ 2643.840320] binder: 21489:21500 Release 1 refcount change on invalid ref 2 ret -22 [ 2643.840330] binder: 21489:21500 BC_ACQUIRE_DONE u0000000000000000 no match [ 2643.840338] binder: 21489:21500 BC_ACQUIRE_DONE u0000000000000003 no match [ 2643.840351] binder: 21489:21500 transaction failed 29189/-22, size 80-24 line 3014 [ 2643.840641] binder: undelivered TRANSACTION_ERROR: 29189 [ 2643.970429] binder: 21527:21536 Release 1 refcount change on invalid ref 2 ret -22 [ 2643.970439] binder: 21527:21536 BC_ACQUIRE_DONE u0000000000000000 no match [ 2643.970447] binder: 21527:21536 BC_ACQUIRE_DONE u0000000000000003 no match [ 2643.970460] binder: 21527:21536 transaction failed 29189/-22, size 80-24 line 3014 [ 2643.970746] binder: undelivered TRANSACTION_ERROR: 29189 [ 2644.053465] binder: 21564:21565 Release 1 refcount change on invalid ref 2 ret -22 [ 2644.053475] binder: 21564:21565 BC_ACQUIRE_DONE u0000000000000000 no match [ 2644.053483] binder: 21564:21565 BC_ACQUIRE_DONE u0000000000000003 no match [ 2644.053496] binder: 21564:21565 transaction failed 29189/-22, size 80-24 line 3014 [ 2644.053821] binder: undelivered TRANSACTION_ERROR: 29189 [ 2644.321894] binder: 21645:21662 Release 1 refcount change on invalid ref 2 ret -22 [ 2644.321904] binder: 21645:21662 BC_ACQUIRE_DONE u0000000000000000 no match [ 2644.321912] binder: 21645:21662 BC_ACQUIRE_DONE u0000000000000003 no match [ 2644.321925] binder: 21645:21662 transaction failed 29189/-22, size 80-24 line 3014 [ 2644.322220] binder: undelivered TRANSACTION_ERROR: 29189 [ 2644.423377] binder: 21717:21721 Release 1 refcount change on invalid ref 2 ret -22 [ 2644.423386] binder: 21717:21721 BC_ACQUIRE_DONE u0000000000000000 no match [ 2644.423394] binder: 21717:21721 BC_ACQUIRE_DONE u0000000000000003 no match [ 2644.423407] binder: 21717:21721 transaction failed 29189/-22, size 80-24 line 3014 [ 2644.424886] binder: undelivered TRANSACTION_ERROR: 29189 [ 2644.513598] binder: 21745:21748 Release 1 refcount change on invalid ref 2 ret -22 [ 2644.513607] binder: 21745:21748 BC_ACQUIRE_DONE u0000000000000000 no match [ 2644.513615] binder: 21745:21748 BC_ACQUIRE_DONE u0000000000000003 no match [ 2644.513629] binder: 21745:21748 transaction failed 29189/-22, size 80-24 line 3014 [ 2644.513911] binder: undelivered TRANSACTION_ERROR: 29189 [ 2644.721321] binder: 21782:21826 Release 1 refcount change on invalid ref 2 ret -22 [ 2644.721331] binder: 21782:21826 BC_ACQUIRE_DONE u0000000000000000 no match [ 2644.721338] binder: 21782:21826 BC_ACQUIRE_DONE u0000000000000003 no match [ 2644.721351] binder: 21782:21826 transaction failed 29189/-22, size 80-24 line 3014 [ 2644.721642] binder: undelivered TRANSACTION_ERROR: 29189 [ 2644.795017] binder: 21846:21853 Release 1 refcount change on invalid ref 2 ret -22 [ 2644.795028] binder: 21846:21853 BC_ACQUIRE_DONE u0000000000000000 no match [ 2644.795036] binder: 21846:21853 BC_ACQUIRE_DONE u0000000000000003 no match [ 2644.795049] binder: 21846:21853 transaction failed 29189/-22, size 80-24 line 3014 [ 2644.795260] binder: undelivered TRANSACTION_ERROR: 29189 [ 2644.933897] binder: 21878:21902 Release 1 refcount change on invalid ref 2 ret -22 [ 2644.933907] binder: 21878:21902 BC_ACQUIRE_DONE u0000000000000000 no match [ 2644.933915] binder: 21878:21902 BC_ACQUIRE_DONE u0000000000000003 no match [ 2644.933928] binder: 21878:21902 transaction failed 29189/-22, size 80-24 line 3014 [ 2644.934228] binder: undelivered TRANSACTION_ERROR: 29189 [ 2645.060890] binder: 21929:21937 Release 1 refcount change on invalid ref 2 ret -22 [ 2645.060901] binder: 21929:21937 BC_ACQUIRE_DONE u0000000000000000 no match [ 2645.060909] binder: 21929:21937 BC_ACQUIRE_DONE u0000000000000003 no match [ 2645.060922] binder: 21929:21937 transaction failed 29189/-22, size 80-24 line 3014 [ 2645.061248] binder: undelivered TRANSACTION_ERROR: 29189 [ 2645.121138] binder: 21956:21961 Release 1 refcount change on invalid ref 2 ret -22 [ 2645.121148] binder: 21956:21961 BC_ACQUIRE_DONE u0000000000000000 no match [ 2645.121156] binder: 21956:21961 BC_ACQUIRE_DONE u0000000000000003 no match [ 2645.121168] binder: 21956:21961 transaction failed 29189/-22, size 80-24 line 3014 [ 2645.121401] binder: undelivered TRANSACTION_ERROR: 29189 [ 2645.248233] binder: 21987:21996 Release 1 refcount change on invalid ref 2 ret -22 [ 2645.248242] binder: 21987:21996 BC_ACQUIRE_DONE u0000000000000000 no match [ 2645.248249] binder: 21987:21996 BC_ACQUIRE_DONE u0000000000000003 no match [ 2645.248261] binder: 21987:21996 transaction failed 29189/-22, size 80-24 line 3014 [ 2645.249126] binder: undelivered TRANSACTION_ERROR: 29189 [ 2645.346971] binder: 22016:22020 Release 1 refcount change on invalid ref 2 ret -22 [ 2645.346982] binder: 22016:22020 BC_ACQUIRE_DONE u0000000000000000 no match [ 2645.346989] binder: 22016:22020 BC_ACQUIRE_DONE u0000000000000003 no match [ 2645.347001] binder: 22016:22020 transaction failed 29189/-22, size 80-24 line 3014 [ 2645.347330] binder: undelivered TRANSACTION_ERROR: 29189 [ 2645.424462] binder: 22059:22070 Release 1 refcount change on invalid ref 2 ret -22 [ 2645.424471] binder: 22059:22070 BC_ACQUIRE_DONE u0000000000000000 no match [ 2645.424479] binder: 22059:22070 BC_ACQUIRE_DONE u0000000000000003 no match [ 2645.424491] binder: 22059:22070 transaction failed 29189/-22, size 80-24 line 3014 [ 2645.425240] binder: undelivered TRANSACTION_ERROR: 29189 [ 2645.518947] binder: 22092:22101 Release 1 refcount change on invalid ref 2 ret -22 [ 2645.518958] binder: 22092:22101 BC_ACQUIRE_DONE u0000000000000000 no match [ 2645.518966] binder: 22092:22101 BC_ACQUIRE_DONE u0000000000000003 no match [ 2645.518978] binder: 22092:22101 transaction failed 29189/-22, size 80-24 line 3014 [ 2645.519286] binder: undelivered TRANSACTION_ERROR: 29189 [ 2645.628674] binder: 22125:22129 Release 1 refcount change on invalid ref 2 ret -22 [ 2645.628684] binder: 22125:22129 BC_ACQUIRE_DONE u0000000000000000 no match [ 2645.628692] binder: 22125:22129 BC_ACQUIRE_DONE u0000000000000003 no match [ 2645.628705] binder: 22125:22129 transaction failed 29189/-22, size 80-24 line 3014 [ 2645.628992] binder: undelivered TRANSACTION_ERROR: 29189 [ 2645.773073] binder: 22160:22166 Release 1 refcount change on invalid ref 2 ret -22 [ 2645.773084] binder: 22160:22166 BC_ACQUIRE_DONE u0000000000000000 no match [ 2645.773091] binder: 22160:22166 BC_ACQUIRE_DONE u0000000000000003 no match [ 2645.773103] binder: 22160:22166 transaction failed 29189/-22, size 80-24 line 3014 [ 2645.773412] binder: undelivered TRANSACTION_ERROR: 29189 [ 2645.875765] binder: 22206:22210 Release 1 refcount change on invalid ref 2 ret -22 [ 2645.875776] binder: 22206:22210 BC_ACQUIRE_DONE u0000000000000000 no match [ 2645.875784] binder: 22206:22210 BC_ACQUIRE_DONE u0000000000000003 no match [ 2645.875797] binder: 22206:22210 transaction failed 29189/-22, size 80-24 line 3014 [ 2645.876113] binder: undelivered TRANSACTION_ERROR: 29189 [ 2645.995096] binder: 22225:22235 Release 1 refcount change on invalid ref 2 ret -22 [ 2645.995107] binder: 22225:22235 BC_ACQUIRE_DONE u0000000000000000 no match [ 2645.995115] binder: 22225:22235 BC_ACQUIRE_DONE u0000000000000003 no match [ 2645.995130] binder: 22225:22235 transaction failed 29189/-22, size 80-24 line 3014 [ 2645.996516] binder: undelivered TRANSACTION_ERROR: 29189 [ 2646.102787] binder: 22261:22274 Release 1 refcount change on invalid ref 2 ret -22 [ 2646.102799] binder: 22261:22274 BC_ACQUIRE_DONE u0000000000000000 no match [ 2646.102809] binder: 22261:22274 BC_ACQUIRE_DONE u0000000000000003 no match [ 2646.102825] binder: 22261:22274 transaction failed 29189/-22, size 80-24 line 3014 [ 2646.103163] binder: undelivered TRANSACTION_ERROR: 29189 [ 2646.197474] binder: 22297:22328 Release 1 refcount change on invalid ref 2 ret -22 [ 2646.197485] binder: 22297:22328 BC_ACQUIRE_DONE u0000000000000000 no match [ 2646.197493] binder: 22297:22328 BC_ACQUIRE_DONE u0000000000000003 no match [ 2646.197506] binder: 22297:22328 transaction failed 29189/-22, size 80-24 line 3014 [ 2646.198467] binder: undelivered TRANSACTION_ERROR: 29189 [ 2646.272823] binder: 22342:22346 Release 1 refcount change on invalid ref 2 ret -22 [ 2646.272833] binder: 22342:22346 BC_ACQUIRE_DONE u0000000000000000 no match [ 2646.272841] binder: 22342:22346 BC_ACQUIRE_DONE u0000000000000003 no match [ 2646.272854] binder: 22342:22346 transaction failed 29189/-22, size 80-24 line 3014 [ 2646.273273] binder: undelivered TRANSACTION_ERROR: 29189 [ 2646.387491] binder: 22383:22393 Release 1 refcount change on invalid ref 2 ret -22 [ 2646.387502] binder: 22383:22393 BC_ACQUIRE_DONE u0000000000000000 no match [ 2646.387511] binder: 22383:22393 BC_ACQUIRE_DONE u0000000000000003 no match [ 2646.387529] binder: 22383:22393 transaction failed 29189/-22, size 80-24 line 3014 [ 2646.389178] binder: undelivered TRANSACTION_ERROR: 29189 [ 2646.502016] binder: 22434:22444 Release 1 refcount change on invalid ref 2 ret -22 [ 2646.502025] binder: 22434:22444 BC_ACQUIRE_DONE u0000000000000000 no match [ 2646.502033] binder: 22434:22444 BC_ACQUIRE_DONE u0000000000000003 no match [ 2646.502046] binder: 22434:22444 transaction failed 29189/-22, size 80-24 line 3014 [ 2646.502345] binder: undelivered TRANSACTION_ERROR: 29189 [ 2646.643416] binder: 22474:22480 Release 1 refcount change on invalid ref 2 ret -22 [ 2646.643427] binder: 22474:22480 BC_ACQUIRE_DONE u0000000000000000 no match [ 2646.643434] binder: 22474:22480 BC_ACQUIRE_DONE u0000000000000003 no match [ 2646.643447] binder: 22474:22480 transaction failed 29189/-22, size 80-24 line 3014 [ 2646.644527] binder: undelivered TRANSACTION_ERROR: 29189 [ 2646.779402] binder: 22533:22545 Release 1 refcount change on invalid ref 2 ret -22 [ 2646.779413] binder: 22533:22545 BC_ACQUIRE_DONE u0000000000000000 no match [ 2646.779421] binder: 22533:22545 BC_ACQUIRE_DONE u0000000000000003 no match [ 2646.779433] binder: 22533:22545 transaction failed 29189/-22, size 80-24 line 3014 [ 2646.781543] binder: undelivered TRANSACTION_ERROR: 29189 [ 2646.910359] binder: 22572:22595 Release 1 refcount change on invalid ref 2 ret -22 [ 2646.910369] binder: 22572:22595 BC_ACQUIRE_DONE u0000000000000000 no match [ 2646.910377] binder: 22572:22595 BC_ACQUIRE_DONE u0000000000000003 no match [ 2646.910390] binder: 22572:22595 transaction failed 29189/-22, size 80-24 line 3014 [ 2646.910690] binder: undelivered TRANSACTION_ERROR: 29189 [ 2647.144624] binder: 22663:22676 Release 1 refcount change on invalid ref 2 ret -22 [ 2647.144634] binder: 22663:22676 BC_ACQUIRE_DONE u0000000000000000 no match [ 2647.144642] binder: 22663:22676 BC_ACQUIRE_DONE u0000000000000003 no match [ 2647.144655] binder: 22663:22676 transaction failed 29189/-22, size 80-24 line 3014 [ 2647.145108] binder: undelivered TRANSACTION_ERROR: 29189 [ 2647.255144] binder: 22702:22718 Release 1 refcount change on invalid ref 2 ret -22 [ 2647.255155] binder: 22702:22718 BC_ACQUIRE_DONE u0000000000000000 no match [ 2647.255163] binder: 22702:22718 BC_ACQUIRE_DONE u0000000000000003 no match [ 2647.255175] binder: 22702:22718 transaction failed 29189/-22, size 80-24 line 3014 [ 2647.255384] binder: undelivered TRANSACTION_ERROR: 29189 [ 2647.379116] binder: 22749:22757 Release 1 refcount change on invalid ref 2 ret -22 [ 2647.379126] binder: 22749:22757 BC_ACQUIRE_DONE u0000000000000000 no match [ 2647.379134] binder: 22749:22757 BC_ACQUIRE_DONE u0000000000000003 no match [ 2647.379147] binder: 22749:22757 transaction failed 29189/-22, size 80-24 line 3014 [ 2647.379434] binder: undelivered TRANSACTION_ERROR: 29189 [ 2647.577896] binder: 22808:22813 Release 1 refcount change on invalid ref 2 ret -22 [ 2647.577906] binder: 22808:22813 BC_ACQUIRE_DONE u0000000000000000 no match [ 2647.577914] binder: 22808:22813 BC_ACQUIRE_DONE u0000000000000003 no match [ 2647.577926] binder: 22808:22813 transaction failed 29189/-22, size 80-24 line 3014 [ 2647.578118] binder: undelivered TRANSACTION_ERROR: 29189 [ 2647.687074] binder: 22848:22861 Release 1 refcount change on invalid ref 2 ret -22 [ 2647.687084] binder: 22848:22861 BC_ACQUIRE_DONE u0000000000000000 no match [ 2647.687093] binder: 22848:22861 BC_ACQUIRE_DONE u0000000000000003 no match [ 2647.687107] binder: 22848:22861 transaction failed 29189/-22, size 80-24 line 3014 [ 2647.687356] binder: undelivered TRANSACTION_ERROR: 29189 [ 2647.809417] binder: 22874:22892 Release 1 refcount change on invalid ref 2 ret -22 [ 2647.809427] binder: 22874:22892 BC_ACQUIRE_DONE u0000000000000000 no match [ 2647.809434] binder: 22874:22892 BC_ACQUIRE_DONE u0000000000000003 no match [ 2647.809448] binder: 22874:22892 transaction failed 29189/-22, size 80-24 line 3014 [ 2647.816524] binder: undelivered TRANSACTION_ERROR: 29189 [ 2648.057206] binder: 22958:22984 Release 1 refcount change on invalid ref 2 ret -22 [ 2648.057217] binder: 22958:22984 BC_ACQUIRE_DONE u0000000000000000 no match [ 2648.057227] binder: 22958:22984 BC_ACQUIRE_DONE u0000000000000003 no match [ 2648.057242] binder: 22958:22984 transaction failed 29189/-22, size 80-24 line 3014 [ 2648.061289] binder: undelivered TRANSACTION_ERROR: 29189 [ 2648.138311] binder: 23011:23023 Release 1 refcount change on invalid ref 2 ret -22 [ 2648.138322] binder: 23011:23023 BC_ACQUIRE_DONE u0000000000000000 no match [ 2648.138330] binder: 23011:23023 BC_ACQUIRE_DONE u0000000000000003 no match [ 2648.138343] binder: 23011:23023 transaction failed 29189/-22, size 80-24 line 3014 [ 2648.139197] binder: undelivered TRANSACTION_ERROR: 29189 [ 2648.202843] binder: 23039:23045 Release 1 refcount change on invalid ref 2 ret -22 [ 2648.202854] binder: 23039:23045 BC_ACQUIRE_DONE u0000000000000000 no match [ 2648.202862] binder: 23039:23045 BC_ACQUIRE_DONE u0000000000000003 no match [ 2648.202875] binder: 23039:23045 transaction failed 29189/-22, size 80-24 line 3014 [ 2648.203086] binder: undelivered TRANSACTION_ERROR: 29189 [ 2648.282229] binder: 23058:23068 Release 1 refcount change on invalid ref 2 ret -22 [ 2648.282239] binder: 23058:23068 BC_ACQUIRE_DONE u0000000000000000 no match [ 2648.282247] binder: 23058:23068 BC_ACQUIRE_DONE u0000000000000003 no match [ 2648.282261] binder: 23058:23068 transaction failed 29189/-22, size 80-24 line 3014 [ 2648.283019] binder: undelivered TRANSACTION_ERROR: 29189 [ 2648.521191] binder: 23120:23160 Release 1 refcount change on invalid ref 2 ret -22 [ 2648.521201] binder: 23120:23160 BC_ACQUIRE_DONE u0000000000000000 no match [ 2648.521209] binder: 23120:23160 BC_ACQUIRE_DONE u0000000000000003 no match [ 2648.521223] binder: 23120:23160 transaction failed 29189/-22, size 80-24 line 3014 [ 2648.521583] binder: undelivered TRANSACTION_ERROR: 29189 [ 2648.629317] binder: 23205:23218 Release 1 refcount change on invalid ref 2 ret -22 [ 2648.629327] binder: 23205:23218 BC_ACQUIRE_DONE u0000000000000000 no match [ 2648.629336] binder: 23205:23218 BC_ACQUIRE_DONE u0000000000000003 no match [ 2648.629349] binder: 23205:23218 transaction failed 29189/-22, size 80-24 line 3014 [ 2648.629642] binder: undelivered TRANSACTION_ERROR: 29189 [ 2648.718421] binder: 23250:23253 Release 1 refcount change on invalid ref 2 ret -22 [ 2648.718431] binder: 23250:23253 BC_ACQUIRE_DONE u0000000000000000 no match [ 2648.718439] binder: 23250:23253 BC_ACQUIRE_DONE u0000000000000003 no match [ 2648.718451] binder: 23250:23253 transaction failed 29189/-22, size 80-24 line 3014 [ 2648.721851] binder: undelivered TRANSACTION_ERROR: 29189 [ 2648.863532] binder: 23276:23283 Release 1 refcount change on invalid ref 2 ret -22 [ 2648.863541] binder: 23276:23283 BC_ACQUIRE_DONE u0000000000000000 no match [ 2648.863549] binder: 23276:23283 BC_ACQUIRE_DONE u0000000000000003 no match [ 2648.863563] binder: 23276:23283 transaction failed 29189/-22, size 80-24 line 3014 [ 2648.863801] binder: undelivered TRANSACTION_ERROR: 29189 [ 2649.015178] binder: 23315:23332 Release 1 refcount change on invalid ref 2 ret -22 [ 2649.015189] binder: 23315:23332 BC_ACQUIRE_DONE u0000000000000000 no match [ 2649.015197] binder: 23315:23332 BC_ACQUIRE_DONE u0000000000000003 no match [ 2649.015209] binder: 23315:23332 transaction failed 29189/-22, size 80-24 line 3014 [ 2649.015483] binder: undelivered TRANSACTION_ERROR: 29189 [ 2649.113180] binder: 23364:23379 Release 1 refcount change on invalid ref 2 ret -22 [ 2649.113189] binder: 23364:23379 BC_ACQUIRE_DONE u0000000000000000 no match [ 2649.113196] binder: 23364:23379 BC_ACQUIRE_DONE u0000000000000003 no match [ 2649.113209] binder: 23364:23379 transaction failed 29189/-22, size 80-24 line 3014 [ 2649.114473] binder: undelivered TRANSACTION_ERROR: 29189 [ 2649.258882] binder: 23412:23422 Release 1 refcount change on invalid ref 2 ret -22 [ 2649.258892] binder: 23412:23422 BC_ACQUIRE_DONE u0000000000000000 no match [ 2649.258908] binder: 23412:23422 BC_ACQUIRE_DONE u0000000000000003 no match [ 2649.258944] binder: 23412:23422 transaction failed 29189/-22, size 80-24 line 3014 [ 2649.259664] binder: undelivered TRANSACTION_ERROR: 29189 [ 2649.370617] binder: 23456:23470 Release 1 refcount change on invalid ref 2 ret -22 [ 2649.370627] binder: 23456:23470 BC_ACQUIRE_DONE u0000000000000000 no match [ 2649.370635] binder: 23456:23470 BC_ACQUIRE_DONE u0000000000000003 no match [ 2649.370648] binder: 23456:23470 transaction failed 29189/-22, size 80-24 line 3014 [ 2649.370948] binder: undelivered TRANSACTION_ERROR: 29189 [ 2649.511400] binder: 23483:23495 Release 1 refcount change on invalid ref 2 ret -22 [ 2649.511410] binder: 23483:23495 BC_ACQUIRE_DONE u0000000000000000 no match [ 2649.511474] binder: 23483:23495 BC_ACQUIRE_DONE u0000000000000003 no match [ 2649.511488] binder: 23483:23495 transaction failed 29189/-22, size 80-24 line 3014 [ 2649.512208] binder: undelivered TRANSACTION_ERROR: 29189 [ 2649.839647] binder: 23578:23603 Release 1 refcount change on invalid ref 2 ret -22 [ 2649.839657] binder: 23578:23603 BC_ACQUIRE_DONE u0000000000000000 no match [ 2649.839664] binder: 23578:23603 BC_ACQUIRE_DONE u0000000000000003 no match [ 2649.839677] binder: 23578:23603 transaction failed 29189/-22, size 80-24 line 3014 [ 2649.839966] binder: undelivered TRANSACTION_ERROR: 29189 [ 2649.992504] binder: 23629:23635 Release 1 refcount change on invalid ref 2 ret -22 [ 2649.992514] binder: 23629:23635 BC_ACQUIRE_DONE u0000000000000000 no match [ 2649.992521] binder: 23629:23635 BC_ACQUIRE_DONE u0000000000000003 no match [ 2649.992534] binder: 23629:23635 transaction failed 29189/-22, size 80-24 line 3014 [ 2649.992838] binder: undelivered TRANSACTION_ERROR: 29189 [ 2650.094933] binder: 23673:23683 Release 1 refcount change on invalid ref 2 ret -22 [ 2650.094944] binder: 23673:23683 BC_ACQUIRE_DONE u0000000000000000 no match [ 2650.094953] binder: 23673:23683 BC_ACQUIRE_DONE u0000000000000003 no match [ 2650.094968] binder: 23673:23683 transaction failed 29189/-22, size 80-24 line 3014 [ 2650.095290] binder: undelivered TRANSACTION_ERROR: 29189 [ 2650.208536] binder: 23723:23729 Release 1 refcount change on invalid ref 2 ret -22 [ 2650.208546] binder: 23723:23729 BC_ACQUIRE_DONE u0000000000000000 no match [ 2650.208554] binder: 23723:23729 BC_ACQUIRE_DONE u0000000000000003 no match [ 2650.208566] binder: 23723:23729 transaction failed 29189/-22, size 80-24 line 3014 [ 2650.209031] binder: undelivered TRANSACTION_ERROR: 29189 [ 2650.344184] binder: 23764:23774 Release 1 refcount change on invalid ref 2 ret -22 [ 2650.344193] binder: 23764:23774 BC_ACQUIRE_DONE u0000000000000000 no match [ 2650.344201] binder: 23764:23774 BC_ACQUIRE_DONE u0000000000000003 no match [ 2650.344213] binder: 23764:23774 transaction failed 29189/-22, size 80-24 line 3014 [ 2650.344460] binder: undelivered TRANSACTION_ERROR: 29189 [ 2650.466779] binder: 23807:23820 Release 1 refcount change on invalid ref 2 ret -22 [ 2650.466789] binder: 23807:23820 BC_ACQUIRE_DONE u0000000000000000 no match [ 2650.466796] binder: 23807:23820 BC_ACQUIRE_DONE u0000000000000003 no match [ 2650.466808] binder: 23807:23820 transaction failed 29189/-22, size 80-24 line 3014 [ 2650.467111] binder: undelivered TRANSACTION_ERROR: 29189 [ 2650.531627] binder: 23829:23844 Release 1 refcount change on invalid ref 2 ret -22 [ 2650.531700] binder: 23829:23844 BC_ACQUIRE_DONE u0000000000000000 no match [ 2650.531709] binder: 23829:23844 BC_ACQUIRE_DONE u0000000000000003 no match [ 2650.531721] binder: 23829:23844 transaction failed 29189/-22, size 80-24 line 3014 [ 2650.532101] binder: undelivered TRANSACTION_ERROR: 29189 [ 2650.705115] binder: 23901:23922 Release 1 refcount change on invalid ref 2 ret -22 [ 2650.705125] binder: 23901:23922 BC_ACQUIRE_DONE u0000000000000000 no match [ 2650.705133] binder: 23901:23922 BC_ACQUIRE_DONE u0000000000000003 no match [ 2650.705146] binder: 23901:23922 transaction failed 29189/-22, size 80-24 line 3014 [ 2650.708793] binder: undelivered TRANSACTION_ERROR: 29189 [ 2650.785929] binder: 23958:23965 Release 1 refcount change on invalid ref 2 ret -22 [ 2650.785940] binder: 23958:23965 BC_ACQUIRE_DONE u0000000000000000 no match [ 2650.785947] binder: 23958:23965 BC_ACQUIRE_DONE u0000000000000003 no match [ 2650.785960] binder: 23958:23965 transaction failed 29189/-22, size 80-24 line 3014 [ 2650.786258] binder: undelivered TRANSACTION_ERROR: 29189 [ 2650.868606] binder: 23981:23983 Release 1 refcount change on invalid ref 2 ret -22 [ 2650.868615] binder: 23981:23983 BC_ACQUIRE_DONE u0000000000000000 no match [ 2650.868623] binder: 23981:23983 BC_ACQUIRE_DONE u0000000000000003 no match [ 2650.868635] binder: 23981:23983 transaction failed 29189/-22, size 80-24 line 3014 [ 2650.868912] binder: undelivered TRANSACTION_ERROR: 29189 [ 2650.986397] binder: 24020:24046 Release 1 refcount change on invalid ref 2 ret -22 [ 2650.986408] binder: 24020:24046 BC_ACQUIRE_DONE u0000000000000000 no match [ 2650.986416] binder: 24020:24046 BC_ACQUIRE_DONE u0000000000000003 no match [ 2650.986429] binder: 24020:24046 transaction failed 29189/-22, size 80-24 line 3014 [ 2650.986720] binder: undelivered TRANSACTION_ERROR: 29189 [ 2651.119511] binder: 24060:24100 Release 1 refcount change on invalid ref 2 ret -22 [ 2651.119520] binder: 24060:24100 BC_ACQUIRE_DONE u0000000000000000 no match [ 2651.119528] binder: 24060:24100 BC_ACQUIRE_DONE u0000000000000003 no match [ 2651.119542] binder: 24060:24100 transaction failed 29189/-22, size 80-24 line 3014 [ 2651.119823] binder: undelivered TRANSACTION_ERROR: 29189 [ 2651.198650] binder: 24106:24137 Release 1 refcount change on invalid ref 2 ret -22 [ 2651.198686] binder: 24106:24137 BC_ACQUIRE_DONE u0000000000000000 no match [ 2651.198693] binder: 24106:24137 BC_ACQUIRE_DONE u0000000000000003 no match [ 2651.198706] binder: 24106:24137 transaction failed 29189/-22, size 80-24 line 3014 [ 2651.202711] binder: undelivered TRANSACTION_ERROR: 29189 [ 2651.336572] binder: 24149:24163 Release 1 refcount change on invalid ref 2 ret -22 [ 2651.336583] binder: 24149:24163 BC_ACQUIRE_DONE u0000000000000000 no match [ 2651.336591] binder: 24149:24163 BC_ACQUIRE_DONE u0000000000000003 no match [ 2651.336603] binder: 24149:24163 transaction failed 29189/-22, size 80-24 line 3014 [ 2651.336938] binder: undelivered TRANSACTION_ERROR: 29189 [ 2651.460356] binder: 24217:24218 Release 1 refcount change on invalid ref 2 ret -22 [ 2651.460367] binder: 24217:24218 BC_ACQUIRE_DONE u0000000000000000 no match [ 2651.460375] binder: 24217:24218 BC_ACQUIRE_DONE u0000000000000003 no match [ 2651.460388] binder: 24217:24218 transaction failed 29189/-22, size 80-24 line 3014 [ 2651.460696] binder: undelivered TRANSACTION_ERROR: 29189 [ 2651.609330] binder: 24262:24272 Release 1 refcount change on invalid ref 2 ret -22 [ 2651.609340] binder: 24262:24272 BC_ACQUIRE_DONE u0000000000000000 no match [ 2651.609348] binder: 24262:24272 BC_ACQUIRE_DONE u0000000000000003 no match [ 2651.609360] binder: 24262:24272 transaction failed 29189/-22, size 80-24 line 3014 [ 2651.615840] binder: undelivered TRANSACTION_ERROR: 29189 [ 2651.721346] binder: 24307:24313 Release 1 refcount change on invalid ref 2 ret -22 [ 2651.721356] binder: 24307:24313 BC_ACQUIRE_DONE u0000000000000000 no match [ 2651.721363] binder: 24307:24313 BC_ACQUIRE_DONE u0000000000000003 no match [ 2651.721375] binder: 24307:24313 transaction failed 29189/-22, size 80-24 line 3014 [ 2651.721670] binder: undelivered TRANSACTION_ERROR: 29189 [ 2651.830558] binder: 24358:24368 Release 1 refcount change on invalid ref 2 ret -22 [ 2651.830569] binder: 24358:24368 BC_ACQUIRE_DONE u0000000000000000 no match [ 2651.830576] binder: 24358:24368 BC_ACQUIRE_DONE u0000000000000003 no match [ 2651.830589] binder: 24358:24368 transaction failed 29189/-22, size 80-24 line 3014 [ 2651.832292] binder: undelivered TRANSACTION_ERROR: 29189 [ 2651.945166] binder: 24418:24427 Release 1 refcount change on invalid ref 2 ret -22 [ 2651.945176] binder: 24418:24427 BC_ACQUIRE_DONE u0000000000000000 no match [ 2651.945184] binder: 24418:24427 BC_ACQUIRE_DONE u0000000000000003 no match [ 2651.945197] binder: 24418:24427 transaction failed 29189/-22, size 80-24 line 3014 [ 2651.945839] binder: undelivered TRANSACTION_ERROR: 29189 [ 2652.056170] binder: 24452:24457 Release 1 refcount change on invalid ref 2 ret -22 [ 2652.056188] binder: 24452:24457 BC_ACQUIRE_DONE u0000000000000000 no match [ 2652.057473] binder: 24452:24457 BC_ACQUIRE_DONE u0000000000000003 no match [ 2652.057486] binder: 24452:24457 transaction failed 29189/-22, size 80-24 line 3014 [ 2652.057786] binder: undelivered TRANSACTION_ERROR: 29189 [ 2652.189906] binder: 24480:24491 Release 1 refcount change on invalid ref 2 ret -22 [ 2652.189917] binder: 24480:24491 BC_ACQUIRE_DONE u0000000000000000 no match [ 2652.189924] binder: 24480:24491 BC_ACQUIRE_DONE u0000000000000003 no match [ 2652.189937] binder: 24480:24491 transaction failed 29189/-22, size 80-24 line 3014 [ 2652.190348] binder: undelivered TRANSACTION_ERROR: 29189 [ 2652.426860] binder: 24552:24573 Release 1 refcount change on invalid ref 2 ret -22 [ 2652.426871] binder: 24552:24573 BC_ACQUIRE_DONE u0000000000000000 no match [ 2652.426879] binder: 24552:24573 BC_ACQUIRE_DONE u0000000000000003 no match [ 2652.426892] binder: 24552:24573 transaction failed 29189/-22, size 80-24 line 3014 [ 2652.427153] binder: undelivered TRANSACTION_ERROR: 29189 [ 2652.509331] binder: 24597:24611 Release 1 refcount change on invalid ref 2 ret -22 [ 2652.509342] binder: 24597:24611 BC_ACQUIRE_DONE u0000000000000000 no match [ 2652.509356] binder: 24597:24611 BC_ACQUIRE_DONE u0000000000000003 no match [ 2652.509369] binder: 24597:24611 transaction failed 29189/-22, size 80-24 line 3014 [ 2652.510443] binder: undelivered TRANSACTION_ERROR: 29189 [ 2652.611500] binder: 24638:24640 Release 1 refcount change on invalid ref 2 ret -22 [ 2652.611510] binder: 24638:24640 BC_ACQUIRE_DONE u0000000000000000 no match [ 2652.611528] binder: 24638:24640 BC_ACQUIRE_DONE u0000000000000003 no match [ 2652.611541] binder: 24638:24640 transaction failed 29189/-22, size 80-24 line 3014 [ 2652.611848] binder: undelivered TRANSACTION_ERROR: 29189 [ 2652.749107] binder: 24667:24684 Release 1 refcount change on invalid ref 2 ret -22 [ 2652.749117] binder: 24667:24684 BC_ACQUIRE_DONE u0000000000000000 no match [ 2652.749125] binder: 24667:24684 BC_ACQUIRE_DONE u0000000000000003 no match [ 2652.749137] binder: 24667:24684 transaction failed 29189/-22, size 80-24 line 3014 [ 2652.749931] binder: undelivered TRANSACTION_ERROR: 29189 [ 2652.837339] binder: 24721:24726 Release 1 refcount change on invalid ref 2 ret -22 [ 2652.837349] binder: 24721:24726 BC_ACQUIRE_DONE u0000000000000000 no match [ 2652.837358] binder: 24721:24726 BC_ACQUIRE_DONE u0000000000000003 no match [ 2652.837370] binder: 24721:24726 transaction failed 29189/-22, size 80-24 line 3014 [ 2652.838120] binder: undelivered TRANSACTION_ERROR: 29189 [ 2652.938285] binder: 24746:24752 Release 1 refcount change on invalid ref 2 ret -22 [ 2652.938295] binder: 24746:24752 BC_ACQUIRE_DONE u0000000000000000 no match [ 2652.938303] binder: 24746:24752 BC_ACQUIRE_DONE u0000000000000003 no match [ 2652.938316] binder: 24746:24752 transaction failed 29189/-22, size 80-24 line 3014 [ 2652.938615] binder: undelivered TRANSACTION_ERROR: 29189 [ 2653.260591] binder: 24857:24876 Release 1 refcount change on invalid ref 2 ret -22 [ 2653.260600] binder: 24857:24876 BC_ACQUIRE_DONE u0000000000000000 no match [ 2653.260608] binder: 24857:24876 BC_ACQUIRE_DONE u0000000000000003 no match [ 2653.260621] binder: 24857:24876 transaction failed 29189/-22, size 80-24 line 3014 [ 2653.260917] binder: undelivered TRANSACTION_ERROR: 29189 [ 2653.359634] binder: 24933:24944 Release 1 refcount change on invalid ref 2 ret -22 [ 2653.359644] binder: 24933:24944 BC_ACQUIRE_DONE u0000000000000000 no match [ 2653.359652] binder: 24933:24944 BC_ACQUIRE_DONE u0000000000000003 no match [ 2653.359664] binder: 24933:24944 transaction failed 29189/-22, size 80-24 line 3014 [ 2653.363716] binder: undelivered TRANSACTION_ERROR: 29189 [ 2653.485082] binder: 24968:24972 Release 1 refcount change on invalid ref 2 ret -22 [ 2653.485092] binder: 24968:24972 BC_ACQUIRE_DONE u0000000000000000 no match [ 2653.485100] binder: 24968:24972 BC_ACQUIRE_DONE u0000000000000003 no match [ 2653.485113] binder: 24968:24972 transaction failed 29189/-22, size 80-24 line 3014 [ 2653.506172] binder: undelivered TRANSACTION_ERROR: 29189 [ 2653.578334] binder: 25010:25019 Release 1 refcount change on invalid ref 2 ret -22 [ 2653.578344] binder: 25010:25019 BC_ACQUIRE_DONE u0000000000000000 no match [ 2653.578352] binder: 25010:25019 BC_ACQUIRE_DONE u0000000000000003 no match [ 2653.578365] binder: 25010:25019 transaction failed 29189/-22, size 80-24 line 3014 [ 2653.578660] binder: undelivered TRANSACTION_ERROR: 29189 [ 2653.693117] binder: 25063:25069 Release 1 refcount change on invalid ref 2 ret -22 [ 2653.693127] binder: 25063:25069 BC_ACQUIRE_DONE u0000000000000000 no match [ 2653.693135] binder: 25063:25069 BC_ACQUIRE_DONE u0000000000000003 no match [ 2653.693148] binder: 25063:25069 transaction failed 29189/-22, size 80-24 line 3014 [ 2653.693513] binder: undelivered TRANSACTION_ERROR: 29189 [ 2653.780146] binder: 25103:25104 Release 1 refcount change on invalid ref 2 ret -22 [ 2653.780156] binder: 25103:25104 BC_ACQUIRE_DONE u0000000000000000 no match [ 2653.780164] binder: 25103:25104 BC_ACQUIRE_DONE u0000000000000003 no match [ 2653.780178] binder: 25103:25104 transaction failed 29189/-22, size 80-24 line 3014 [ 2653.780491] binder: undelivered TRANSACTION_ERROR: 29189 [ 2653.958556] binder: 25140:25149 Release 1 refcount change on invalid ref 2 ret -22 [ 2653.958567] binder: 25140:25149 BC_ACQUIRE_DONE u0000000000000000 no match [ 2653.958576] binder: 25140:25149 BC_ACQUIRE_DONE u0000000000000003 no match [ 2653.958590] binder: 25140:25149 transaction failed 29189/-22, size 80-24 line 3014 [ 2653.961088] binder: undelivered TRANSACTION_ERROR: 29189 [ 2653.995729] binder: 25190:25192 Release 1 refcount change on invalid ref 2 ret -22 [ 2653.995739] binder: 25190:25192 BC_ACQUIRE_DONE u0000000000000000 no match [ 2653.995746] binder: 25190:25192 BC_ACQUIRE_DONE u0000000000000003 no match [ 2653.995759] binder: 25190:25192 transaction failed 29189/-22, size 80-24 line 3014 [ 2653.996091] binder: undelivered TRANSACTION_ERROR: 29189 [ 2654.133312] binder: 25243:25244 Release 1 refcount change on invalid ref 2 ret -22 [ 2654.133322] binder: 25243:25244 BC_ACQUIRE_DONE u0000000000000000 no match [ 2654.133330] binder: 25243:25244 BC_ACQUIRE_DONE u0000000000000003 no match [ 2654.133342] binder: 25243:25244 transaction failed 29189/-22, size 80-24 line 3014 [ 2654.133626] binder: undelivered TRANSACTION_ERROR: 29189 [ 2654.382286] binder: 25289:25292 Release 1 refcount change on invalid ref 2 ret -22 [ 2654.382297] binder: 25289:25292 BC_ACQUIRE_DONE u0000000000000000 no match [ 2654.382304] binder: 25289:25292 BC_ACQUIRE_DONE u0000000000000003 no match [ 2654.382317] binder: 25289:25292 transaction failed 29189/-22, size 80-24 line 3014 [ 2654.382595] binder: undelivered TRANSACTION_ERROR: 29189 [ 2654.539458] binder: 25372:25389 Release 1 refcount change on invalid ref 2 ret -22 [ 2654.539468] binder: 25372:25389 BC_ACQUIRE_DONE u0000000000000000 no match [ 2654.539475] binder: 25372:25389 BC_ACQUIRE_DONE u0000000000000003 no match [ 2654.539488] binder: 25372:25389 transaction failed 29189/-22, size 80-24 line 3014 [ 2654.539821] binder: undelivered TRANSACTION_ERROR: 29189 [ 2654.634711] binder: 25397:25407 Release 1 refcount change on invalid ref 2 ret -22 [ 2654.634721] binder: 25397:25407 BC_ACQUIRE_DONE u0000000000000000 no match [ 2654.634729] binder: 25397:25407 BC_ACQUIRE_DONE u0000000000000003 no match [ 2654.634742] binder: 25397:25407 transaction failed 29189/-22, size 80-24 line 3014 [ 2654.635100] binder: undelivered TRANSACTION_ERROR: 29189 [ 2654.734036] binder: 25439:25452 Release 1 refcount change on invalid ref 2 ret -22 [ 2654.734046] binder: 25439:25452 BC_ACQUIRE_DONE u0000000000000000 no match [ 2654.734055] binder: 25439:25452 BC_ACQUIRE_DONE u0000000000000003 no match [ 2654.734068] binder: 25439:25452 transaction failed 29189/-22, size 80-24 line 3014 [ 2654.734426] binder: undelivered TRANSACTION_ERROR: 29189 [ 2654.859812] binder: 25484:25497 Release 1 refcount change on invalid ref 2 ret -22 [ 2654.859822] binder: 25484:25497 BC_ACQUIRE_DONE u0000000000000000 no match [ 2654.859831] binder: 25484:25497 BC_ACQUIRE_DONE u0000000000000003 no match [ 2654.859845] binder: 25484:25497 transaction failed 29189/-22, size 80-24 line 3014 [ 2654.870718] binder: undelivered TRANSACTION_ERROR: 29189 [ 2654.947174] binder: 25532:25548 Release 1 refcount change on invalid ref 2 ret -22 [ 2654.947184] binder: 25532:25548 BC_ACQUIRE_DONE u0000000000000000 no match [ 2654.947191] binder: 25532:25548 BC_ACQUIRE_DONE u0000000000000003 no match [ 2654.947203] binder: 25532:25548 transaction failed 29189/-22, size 80-24 line 3014 [ 2654.948406] binder: undelivered TRANSACTION_ERROR: 29189 [ 2655.062437] binder: 25569:25586 Release 1 refcount change on invalid ref 2 ret -22 [ 2655.062447] binder: 25569:25586 BC_ACQUIRE_DONE u0000000000000000 no match [ 2655.062455] binder: 25569:25586 BC_ACQUIRE_DONE u0000000000000003 no match [ 2655.062467] binder: 25569:25586 transaction failed 29189/-22, size 80-24 line 3014 [ 2655.065029] binder: undelivered TRANSACTION_ERROR: 29189 [ 2655.213441] binder: 25630:25647 Release 1 refcount change on invalid ref 2 ret -22 [ 2655.213452] binder: 25630:25647 BC_ACQUIRE_DONE u0000000000000000 no match [ 2655.213460] binder: 25630:25647 BC_ACQUIRE_DONE u0000000000000003 no match [ 2655.213473] binder: 25630:25647 transaction failed 29189/-22, size 80-24 line 3014 [ 2655.216609] binder: undelivered TRANSACTION_ERROR: 29189 [ 2655.388372] binder: 25684:25693 Release 1 refcount change on invalid ref 2 ret -22 [ 2655.388382] binder: 25684:25693 BC_ACQUIRE_DONE u0000000000000000 no match [ 2655.388390] binder: 25684:25693 BC_ACQUIRE_DONE u0000000000000003 no match [ 2655.388403] binder: 25684:25693 transaction failed 29189/-22, size 80-24 line 3014 [ 2655.394594] binder: undelivered TRANSACTION_ERROR: 29189 [ 2655.463229] binder: 25752:25754 Release 1 refcount change on invalid ref 2 ret -22 [ 2655.463239] binder: 25752:25754 BC_ACQUIRE_DONE u0000000000000000 no match [ 2655.463247] binder: 25752:25754 BC_ACQUIRE_DONE u0000000000000003 no match [ 2655.463260] binder: 25752:25754 transaction failed 29189/-22, size 80-24 line 3014 [ 2655.463490] binder: undelivered TRANSACTION_ERROR: 29189 [ 2655.538890] binder: 25774:25800 Release 1 refcount change on invalid ref 2 ret -22 [ 2655.538900] binder: 25774:25800 BC_ACQUIRE_DONE u0000000000000000 no match [ 2655.538908] binder: 25774:25800 BC_ACQUIRE_DONE u0000000000000003 no match [ 2655.538921] binder: 25774:25800 transaction failed 29189/-22, size 80-24 line 3014 [ 2655.539217] binder: undelivered TRANSACTION_ERROR: 29189 [ 2655.637333] binder: 25819:25824 Release 1 refcount change on invalid ref 2 ret -22 [ 2655.637343] binder: 25819:25824 BC_ACQUIRE_DONE u0000000000000000 no match [ 2655.637351] binder: 25819:25824 BC_ACQUIRE_DONE u0000000000000003 no match [ 2655.637364] binder: 25819:25824 transaction failed 29189/-22, size 80-24 line 3014 [ 2655.644764] binder: undelivered TRANSACTION_ERROR: 29189 [ 2655.843520] binder: 25868:25875 Release 1 refcount change on invalid ref 2 ret -22 [ 2655.843531] binder: 25868:25875 BC_ACQUIRE_DONE u0000000000000000 no match [ 2655.843539] binder: 25868:25875 BC_ACQUIRE_DONE u0000000000000003 no match [ 2655.843551] binder: 25868:25875 transaction failed 29189/-22, size 80-24 line 3014 [ 2655.843855] binder: undelivered TRANSACTION_ERROR: 29189 [ 2655.947023] binder: 25916:25917 Release 1 refcount change on invalid ref 2 ret -22 [ 2655.947034] binder: 25916:25917 BC_ACQUIRE_DONE u0000000000000000 no match [ 2655.947042] binder: 25916:25917 BC_ACQUIRE_DONE u0000000000000003 no match [ 2655.947056] binder: 25916:25917 transaction failed 29189/-22, size 80-24 line 3014 [ 2655.947286] binder: undelivered TRANSACTION_ERROR: 29189 [ 2656.050978] binder: 25942:25950 Release 1 refcount change on invalid ref 2 ret -22 [ 2656.051076] binder: 25942:25950 BC_ACQUIRE_DONE u0000000000000000 no match [ 2656.051084] binder: 25942:25950 BC_ACQUIRE_DONE u0000000000000003 no match [ 2656.051097] binder: 25942:25950 transaction failed 29189/-22, size 80-24 line 3014 [ 2656.051436] binder: undelivered TRANSACTION_ERROR: 29189 [ 2656.174908] binder: 25993:26008 Release 1 refcount change on invalid ref 2 ret -22 [ 2656.174918] binder: 25993:26008 BC_ACQUIRE_DONE u0000000000000000 no match [ 2656.174926] binder: 25993:26008 BC_ACQUIRE_DONE u0000000000000003 no match [ 2656.174938] binder: 25993:26008 transaction failed 29189/-22, size 80-24 line 3014 [ 2656.175241] binder: undelivered TRANSACTION_ERROR: 29189 [ 2656.239718] binder: 26028:26034 Release 1 refcount change on invalid ref 2 ret -22 [ 2656.243422] binder: 26028:26034 BC_ACQUIRE_DONE u0000000000000000 no match [ 2656.243431] binder: 26028:26034 BC_ACQUIRE_DONE u0000000000000003 no match [ 2656.243444] binder: 26028:26034 transaction failed 29189/-22, size 80-24 line 3014 [ 2656.243736] binder: undelivered TRANSACTION_ERROR: 29189 [ 2656.395188] binder: 26087:26091 Release 1 refcount change on invalid ref 2 ret -22 [ 2656.395199] binder: 26087:26091 BC_ACQUIRE_DONE u0000000000000000 no match [ 2656.395207] binder: 26087:26091 BC_ACQUIRE_DONE u0000000000000003 no match [ 2656.395220] binder: 26087:26091 transaction failed 29189/-22, size 80-24 line 3014 [ 2656.395553] binder: undelivered TRANSACTION_ERROR: 29189 [ 2656.557591] binder: 26138:26162 Release 1 refcount change on invalid ref 2 ret -22 [ 2656.557602] binder: 26138:26162 BC_ACQUIRE_DONE u0000000000000000 no match [ 2656.557609] binder: 26138:26162 BC_ACQUIRE_DONE u0000000000000003 no match [ 2656.557622] binder: 26138:26162 transaction failed 29189/-22, size 80-24 line 3014 [ 2656.557862] binder: undelivered TRANSACTION_ERROR: 29189 [ 2656.672349] binder: 26202:26204 Release 1 refcount change on invalid ref 2 ret -22 [ 2656.672360] binder: 26202:26204 BC_ACQUIRE_DONE u0000000000000000 no match [ 2656.672368] binder: 26202:26204 BC_ACQUIRE_DONE u0000000000000003 no match [ 2656.672382] binder: 26202:26204 transaction failed 29189/-22, size 80-24 line 3014 [ 2656.672990] binder: undelivered TRANSACTION_ERROR: 29189 [ 2656.906733] binder: 26246:26281 Release 1 refcount change on invalid ref 2 ret -22 [ 2656.906742] binder: 26246:26281 BC_ACQUIRE_DONE u0000000000000000 no match [ 2656.906749] binder: 26246:26281 BC_ACQUIRE_DONE u0000000000000003 no match [ 2656.906761] binder: 26246:26281 transaction failed 29189/-22, size 80-24 line 3014 [ 2656.927648] binder: undelivered TRANSACTION_ERROR: 29189 [ 2657.043105] binder: 26299:26309 Release 1 refcount change on invalid ref 2 ret -22 [ 2657.043115] binder: 26299:26309 BC_ACQUIRE_DONE u0000000000000000 no match [ 2657.043123] binder: 26299:26309 BC_ACQUIRE_DONE u0000000000000003 no match [ 2657.043136] binder: 26299:26309 transaction failed 29189/-22, size 80-24 line 3014 [ 2657.043800] binder: undelivered TRANSACTION_ERROR: 29189 [ 2657.193892] binder: 26358:26405 Release 1 refcount change on invalid ref 2 ret -22 [ 2657.193902] binder: 26358:26405 BC_ACQUIRE_DONE u0000000000000000 no match [ 2657.193909] binder: 26358:26405 BC_ACQUIRE_DONE u0000000000000003 no match [ 2657.193922] binder: 26358:26405 transaction failed 29189/-22, size 80-24 line 3014 [ 2657.194251] binder: undelivered TRANSACTION_ERROR: 29189 [ 2657.302159] binder: 26419:26427 Release 1 refcount change on invalid ref 2 ret -22 [ 2657.302170] binder: 26419:26427 BC_ACQUIRE_DONE u0000000000000000 no match [ 2657.302178] binder: 26419:26427 BC_ACQUIRE_DONE u0000000000000003 no match [ 2657.302192] binder: 26419:26427 transaction failed 29189/-22, size 80-24 line 3014 [ 2657.302503] binder: undelivered TRANSACTION_ERROR: 29189 [ 2657.467526] binder: 26466:26475 Release 1 refcount change on invalid ref 2 ret -22 [ 2657.467536] binder: 26466:26475 BC_ACQUIRE_DONE u0000000000000000 no match [ 2657.467544] binder: 26466:26475 BC_ACQUIRE_DONE u0000000000000003 no match [ 2657.467557] binder: 26466:26475 transaction failed 29189/-22, size 80-24 line 3014 [ 2657.467840] binder: undelivered TRANSACTION_ERROR: 29189 [ 2657.596246] binder: 26503:26510 Release 1 refcount change on invalid ref 2 ret -22 [ 2657.596256] binder: 26503:26510 BC_ACQUIRE_DONE u0000000000000000 no match [ 2657.596264] binder: 26503:26510 BC_ACQUIRE_DONE u0000000000000003 no match [ 2657.596276] binder: 26503:26510 transaction failed 29189/-22, size 80-24 line 3014 [ 2657.596553] binder: undelivered TRANSACTION_ERROR: 29189 [ 2657.689320] binder: 26519:26525 Release 1 refcount change on invalid ref 2 ret -22 [ 2657.689330] binder: 26519:26525 BC_ACQUIRE_DONE u0000000000000000 no match [ 2657.689337] binder: 26519:26525 BC_ACQUIRE_DONE u0000000000000003 no match [ 2657.689349] binder: 26519:26525 transaction failed 29189/-22, size 80-24 line 3014 [ 2657.689597] binder: undelivered TRANSACTION_ERROR: 29189 [ 2657.790896] binder: 26578:26590 Release 1 refcount change on invalid ref 2 ret -22 [ 2657.790907] binder: 26578:26590 BC_ACQUIRE_DONE u0000000000000000 no match [ 2657.790915] binder: 26578:26590 BC_ACQUIRE_DONE u0000000000000003 no match [ 2657.790927] binder: 26578:26590 transaction failed 29189/-22, size 80-24 line 3014 [ 2657.794031] binder: undelivered TRANSACTION_ERROR: 29189 [ 2658.018741] binder: 26606:26664 Release 1 refcount change on invalid ref 2 ret -22 [ 2658.018752] binder: 26606:26664 BC_ACQUIRE_DONE u0000000000000000 no match [ 2658.018760] binder: 26606:26664 BC_ACQUIRE_DONE u0000000000000003 no match [ 2658.018773] binder: 26606:26664 transaction failed 29189/-22, size 80-24 line 3014 [ 2658.019145] binder: undelivered TRANSACTION_ERROR: 29189 [ 2658.165336] binder: 26707:26711 Release 1 refcount change on invalid ref 2 ret -22 [ 2658.165345] binder: 26707:26711 BC_ACQUIRE_DONE u0000000000000000 no match [ 2658.165353] binder: 26707:26711 BC_ACQUIRE_DONE u0000000000000003 no match [ 2658.165375] binder: 26707:26711 transaction failed 29189/-22, size 80-24 line 3014 [ 2658.165623] binder: undelivered TRANSACTION_ERROR: 29189 [ 2658.273679] binder: 26740:26773 Release 1 refcount change on invalid ref 2 ret -22 [ 2658.273690] binder: 26740:26773 BC_ACQUIRE_DONE u0000000000000000 no match [ 2658.273698] binder: 26740:26773 BC_ACQUIRE_DONE u0000000000000003 no match [ 2658.273711] binder: 26740:26773 transaction failed 29189/-22, size 80-24 line 3014 [ 2658.273997] binder: undelivered TRANSACTION_ERROR: 29189 [ 2658.446494] binder: 26812:26823 Release 1 refcount change on invalid ref 2 ret -22 [ 2658.446504] binder: 26812:26823 BC_ACQUIRE_DONE u0000000000000000 no match [ 2658.446511] binder: 26812:26823 BC_ACQUIRE_DONE u0000000000000003 no match [ 2658.446524] binder: 26812:26823 transaction failed 29189/-22, size 80-24 line 3014 [ 2658.446819] binder: undelivered TRANSACTION_ERROR: 29189 [ 2658.568628] binder: 26848:26856 Release 1 refcount change on invalid ref 2 ret -22 [ 2658.568639] binder: 26848:26856 BC_ACQUIRE_DONE u0000000000000000 no match [ 2658.568647] binder: 26848:26856 BC_ACQUIRE_DONE u0000000000000003 no match [ 2658.568661] binder: 26848:26856 transaction failed 29189/-22, size 80-24 line 3014 [ 2658.569039] binder: undelivered TRANSACTION_ERROR: 29189 [ 2658.712369] binder: 26910:26918 Release 1 refcount change on invalid ref 2 ret -22 [ 2658.712379] binder: 26910:26918 BC_ACQUIRE_DONE u0000000000000000 no match [ 2658.712387] binder: 26910:26918 BC_ACQUIRE_DONE u0000000000000003 no match [ 2658.712400] binder: 26910:26918 transaction failed 29189/-22, size 80-24 line 3014 [ 2658.714787] binder: undelivered TRANSACTION_ERROR: 29189 [ 2658.848427] binder: 26952:26974 Release 1 refcount change on invalid ref 2 ret -22 [ 2658.848437] binder: 26952:26974 BC_ACQUIRE_DONE u0000000000000000 no match [ 2658.848445] binder: 26952:26974 BC_ACQUIRE_DONE u0000000000000003 no match [ 2658.848459] binder: 26952:26974 transaction failed 29189/-22, size 80-24 line 3014 [ 2658.848786] binder: undelivered TRANSACTION_ERROR: 29189 [ 2658.927223] binder: 26984:26998 Release 1 refcount change on invalid ref 2 ret -22 [ 2658.927232] binder: 26984:26998 BC_ACQUIRE_DONE u0000000000000000 no match [ 2658.927239] binder: 26984:26998 BC_ACQUIRE_DONE u0000000000000003 no match [ 2658.927252] binder: 26984:26998 transaction failed 29189/-22, size 80-24 line 3014 [ 2658.927480] binder: undelivered TRANSACTION_ERROR: 29189 [ 2659.183262] binder: 27029:27047 Release 1 refcount change on invalid ref 2 ret -22 [ 2659.183272] binder: 27029:27047 BC_ACQUIRE_DONE u0000000000000000 no match [ 2659.183280] binder: 27029:27047 BC_ACQUIRE_DONE u0000000000000003 no match [ 2659.183294] binder: 27029:27047 transaction failed 29189/-22, size 80-24 line 3014 [ 2659.183864] binder: undelivered TRANSACTION_ERROR: 29189 [ 2659.349088] binder: 27107:27116 Release 1 refcount change on invalid ref 2 ret -22 [ 2659.349098] binder: 27107:27116 BC_ACQUIRE_DONE u0000000000000000 no match [ 2659.349105] binder: 27107:27116 BC_ACQUIRE_DONE u0000000000000003 no match [ 2659.349118] binder: 27107:27116 transaction failed 29189/-22, size 80-24 line 3014 [ 2659.349362] binder: undelivered TRANSACTION_ERROR: 29189 [ 2659.444294] binder: 27148:27154 Release 1 refcount change on invalid ref 2 ret -22 [ 2659.444304] binder: 27148:27154 BC_ACQUIRE_DONE u0000000000000000 no match [ 2659.444310] binder: 27148:27154 BC_ACQUIRE_DONE u0000000000000003 no match [ 2659.444329] binder: 27148:27154 transaction failed 29189/-22, size 80-24 line 3014 [ 2659.444819] binder: undelivered TRANSACTION_ERROR: 29189 [ 2659.563651] binder: 27196:27206 Release 1 refcount change on invalid ref 2 ret -22 [ 2659.563661] binder: 27196:27206 BC_ACQUIRE_DONE u0000000000000000 no match [ 2659.563668] binder: 27196:27206 BC_ACQUIRE_DONE u0000000000000003 no match [ 2659.563680] binder: 27196:27206 transaction failed 29189/-22, size 80-24 line 3014 [ 2659.564162] binder: undelivered TRANSACTION_ERROR: 29189 [ 2659.678488] binder: 27236:27245 Release 1 refcount change on invalid ref 2 ret -22 [ 2659.678496] binder: 27236:27245 BC_ACQUIRE_DONE u0000000000000000 no match [ 2659.678511] binder: 27236:27245 BC_ACQUIRE_DONE u0000000000000003 no match [ 2659.678530] binder: 27236:27245 transaction failed 29189/-22, size 80-24 line 3014 [ 2659.679134] binder: undelivered TRANSACTION_ERROR: 29189 [ 2659.895001] binder: 27313:27324 Release 1 refcount change on invalid ref 2 ret -22 [ 2659.895011] binder: 27313:27324 BC_ACQUIRE_DONE u0000000000000000 no match [ 2659.895028] binder: 27313:27324 BC_ACQUIRE_DONE u0000000000000003 no match [ 2659.895042] binder: 27313:27324 transaction failed 29189/-22, size 80-24 line 3014 [ 2659.895346] binder: undelivered TRANSACTION_ERROR: 29189 [ 2660.030738] binder: 27359:27383 Release 1 refcount change on invalid ref 2 ret -22 [ 2660.030747] binder: 27359:27383 BC_ACQUIRE_DONE u0000000000000000 no match [ 2660.030756] binder: 27359:27383 BC_ACQUIRE_DONE u0000000000000003 no match [ 2660.030771] binder: 27359:27383 transaction failed 29189/-22, size 80-24 line 3014 [ 2660.035516] binder: undelivered TRANSACTION_ERROR: 29189 [ 2660.125282] binder: 27396:27400 Release 1 refcount change on invalid ref 2 ret -22 [ 2660.125292] binder: 27396:27400 BC_ACQUIRE_DONE u0000000000000000 no match [ 2660.125299] binder: 27396:27400 BC_ACQUIRE_DONE u0000000000000003 no match [ 2660.125311] binder: 27396:27400 transaction failed 29189/-22, size 80-24 line 3014 [ 2660.126194] binder: undelivered TRANSACTION_ERROR: 29189 [ 2660.222162] binder: 27424:27444 Release 1 refcount change on invalid ref 2 ret -22 [ 2660.222172] binder: 27424:27444 BC_ACQUIRE_DONE u0000000000000000 no match [ 2660.222179] binder: 27424:27444 BC_ACQUIRE_DONE u0000000000000003 no match [ 2660.222191] binder: 27424:27444 transaction failed 29189/-22, size 80-24 line 3014 [ 2660.222475] binder: undelivered TRANSACTION_ERROR: 29189 [ 2660.338697] binder: 27469:27478 Release 1 refcount change on invalid ref 2 ret -22 [ 2660.338706] binder: 27469:27478 BC_ACQUIRE_DONE u0000000000000000 no match [ 2660.338714] binder: 27469:27478 BC_ACQUIRE_DONE u0000000000000003 no match [ 2660.338726] binder: 27469:27478 transaction failed 29189/-22, size 80-24 line 3014 [ 2660.339456] binder: undelivered TRANSACTION_ERROR: 29189 [ 2660.415620] binder: 27499:27503 Release 1 refcount change on invalid ref 2 ret -22 [ 2660.415631] binder: 27499:27503 BC_ACQUIRE_DONE u0000000000000000 no match [ 2660.415639] binder: 27499:27503 BC_ACQUIRE_DONE u0000000000000003 no match [ 2660.415652] binder: 27499:27503 transaction failed 29189/-22, size 80-24 line 3014 [ 2660.416418] binder: undelivered TRANSACTION_ERROR: 29189 [ 2660.543525] binder: 27516:27561 Release 1 refcount change on invalid ref 2 ret -22 [ 2660.543536] binder: 27516:27561 BC_ACQUIRE_DONE u0000000000000000 no match [ 2660.543544] binder: 27516:27561 BC_ACQUIRE_DONE u0000000000000003 no match [ 2660.543558] binder: 27516:27561 transaction failed 29189/-22, size 80-24 line 3014 [ 2660.544247] binder: undelivered TRANSACTION_ERROR: 29189 [ 2660.645200] binder: 27593:27595 Release 1 refcount change on invalid ref 2 ret -22 [ 2660.645210] binder: 27593:27595 BC_ACQUIRE_DONE u0000000000000000 no match [ 2660.645218] binder: 27593:27595 BC_ACQUIRE_DONE u0000000000000003 no match [ 2660.645231] binder: 27593:27595 transaction failed 29189/-22, size 80-24 line 3014 [ 2660.645739] binder: undelivered TRANSACTION_ERROR: 29189 [ 2660.700403] binder: 27605:27617 Release 1 refcount change on invalid ref 2 ret -22 [ 2660.700413] binder: 27605:27617 BC_ACQUIRE_DONE u0000000000000000 no match [ 2660.700421] binder: 27605:27617 BC_ACQUIRE_DONE u0000000000000003 no match [ 2660.700434] binder: 27605:27617 transaction failed 29189/-22, size 80-24 line 3014 [ 2660.700782] binder: undelivered TRANSACTION_ERROR: 29189 [ 2660.815426] binder: 27628:27651 Release 1 refcount change on invalid ref 2 ret -22 [ 2660.815436] binder: 27628:27651 BC_ACQUIRE_DONE u0000000000000000 no match [ 2660.815444] binder: 27628:27651 BC_ACQUIRE_DONE u0000000000000003 no match [ 2660.815457] binder: 27628:27651 transaction failed 29189/-22, size 80-24 line 3014 [ 2660.815790] binder: undelivered TRANSACTION_ERROR: 29189 [ 2660.895250] binder: 27673:27688 Release 1 refcount change on invalid ref 2 ret -22 [ 2660.895268] binder: 27673:27688 BC_ACQUIRE_DONE u0000000000000000 no match [ 2660.895276] binder: 27673:27688 BC_ACQUIRE_DONE u0000000000000003 no match [ 2660.895289] binder: 27673:27688 transaction failed 29189/-22, size 80-24 line 3014 [ 2660.895625] binder: undelivered TRANSACTION_ERROR: 29189 [ 2661.053670] binder: 27701:27724 Release 1 refcount change on invalid ref 2 ret -22 [ 2661.053680] binder: 27701:27724 BC_ACQUIRE_DONE u0000000000000000 no match [ 2661.053688] binder: 27701:27724 BC_ACQUIRE_DONE u0000000000000003 no match [ 2661.053702] binder: 27701:27724 transaction failed 29189/-22, size 80-24 line 3014 [ 2661.053934] binder: undelivered TRANSACTION_ERROR: 29189 [ 2661.175280] binder: 27770:27778 Release 1 refcount change on invalid ref 2 ret -22 [ 2661.175299] binder: 27770:27778 BC_ACQUIRE_DONE u0000000000000000 no match [ 2661.179300] binder: 27770:27778 BC_ACQUIRE_DONE u0000000000000003 no match [ 2661.179313] binder: 27770:27778 transaction failed 29189/-22, size 80-24 line 3014 [ 2661.179652] binder: undelivered TRANSACTION_ERROR: 29189 [ 2661.541329] binder: 27824:27826 Release 1 refcount change on invalid ref 2 ret -22 [ 2661.541339] binder: 27824:27826 BC_ACQUIRE_DONE u0000000000000000 no match [ 2661.541346] binder: 27824:27826 BC_ACQUIRE_DONE u0000000000000003 no match [ 2661.541359] binder: 27824:27826 transaction failed 29189/-22, size 80-24 line 3014 [ 2661.542311] binder: undelivered TRANSACTION_ERROR: 29189 [ 2661.575564] INFO: task init:18959 blocked for more than 140 seconds. [ 2661.575569] Not tainted 4.4.174+ #4 [ 2661.575572] "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. [ 2661.575594] init D ffff880042b4f718 29280 18959 1 0x00000000 [ 2661.575606] ffff880042b4f718 ffff8801511597c0 d112f8d56f4d23e1 ffff8801511597c0 [ 2661.575615] 0000000000000000 ffff88015115a000 ffff8801db61f180 ffff8801db61f1a8 [ 2661.575624] ffff8801db61e898 ffff8801d7705f00 ffff8801511597c0 ffffed0008569001 [ 2661.575626] Call Trace: [ 2661.575641] [] schedule+0x99/0x1d0 [ 2661.575649] [] schedule_preempt_disabled+0x13/0x20 [ 2661.575658] [] mutex_lock_nested+0x3c2/0xb80 [ 2661.575667] [] ? tty_open+0x56a/0xf50 [ 2661.575675] [] ? assoc_array_gc+0x1233/0x12e0 [ 2661.575683] [] ? mutex_trylock+0x500/0x500 [ 2661.575692] [] ? kmem_cache_alloc_trace+0x123/0x2d0 [ 2661.575700] [] tty_open+0x56a/0xf50 [ 2661.575708] [] ? tty_init_dev+0x420/0x420 [ 2661.575716] [] ? chrdev_open+0xca/0x630 [ 2661.575724] [] ? tty_init_dev+0x420/0x420 [ 2661.575731] [] chrdev_open+0x230/0x630 [ 2661.575738] [] ? cdev_put.part.0+0x50/0x50 [ 2661.575748] [] do_dentry_open+0x38f/0xbd0 [ 2661.575755] [] ? __inode_permission2+0x9e/0x250 [ 2661.575762] [] ? cdev_put.part.0+0x50/0x50 [ 2661.575769] [] vfs_open+0x10b/0x210 [ 2661.575776] [] ? may_open.isra.0+0xe7/0x210 [ 2661.575783] [] path_openat+0x136f/0x4470 [ 2661.575790] [] ? kasan_kmalloc.part.0+0xc6/0xf0 [ 2661.575798] [] ? may_open.isra.0+0x210/0x210 [ 2661.575806] [] ? trace_hardirqs_on+0x10/0x10 [ 2661.575813] [] do_filp_open+0x1a1/0x270 [ 2661.575821] [] ? user_path_mountpoint_at+0x50/0x50 [ 2661.575829] [] ? __alloc_fd+0x1ea/0x490 [ 2661.575836] [] ? _raw_spin_unlock+0x2d/0x50 [ 2661.575843] [] do_sys_open+0x2f8/0x600 [ 2661.575849] [] ? filp_open+0x70/0x70 [ 2661.575857] [] ? trace_hardirqs_on_caller+0x385/0x5a0 [ 2661.575863] [] SyS_open+0x2d/0x40 [ 2661.575871] [] entry_SYSCALL_64_fastpath+0x1e/0x9a [ 2661.575877] 1 lock held by init/18959: [ 2661.575893] #0: (tty_mutex){+.+.+.}, at: [] tty_open+0x56a/0xf50 [ 2661.575897] Sending NMI to all CPUs: [ 2661.577193] NMI backtrace for cpu 0 [ 2661.577197] CPU: 0 PID: 20 Comm: khungtaskd Not tainted 4.4.174+ #4 [ 2661.577200] task: ffff8801da6c4740 task.stack: ffff8801d9ef0000 [ 2661.577204] RIP: 0010:[] [] flat_send_IPI_mask+0xf7/0x1b0 [ 2661.577206] RSP: 0018:ffff8801d9ef7c88 EFLAGS: 00000046 [ 2661.577210] RAX: 0000000000000000 RBX: 0000000000000c00 RCX: 0000000000000000 [ 2661.577213] RDX: 0000000000000c00 RSI: 0000000000000000 RDI: ffffffffff5fc300 [ 2661.577217] RBP: ffff8801d9ef7cb8 R08: 0000000000000018 R09: 0000000000000000 [ 2661.577220] R10: 0000000000000001 R11: 0000000000000001 R12: 0000000000000246 [ 2661.577223] R13: 0000000003000000 R14: ffffffff82e5f2e0 R15: 0000000000000002 [ 2661.577227] FS: 0000000000000000(0000) GS:ffff8801db600000(0000) knlGS:0000000000000000 [ 2661.577230] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 2661.577233] CR2: 0000000000710934 CR3: 0000000002e0a000 CR4: 00000000001606b0 [ 2661.577235] Stack: [ 2661.577238] 0000000000000001 ffffffff82e5f2e0 ffffffff831a6ac0 fffffbfff0634c34 [ 2661.577242] 000000000001b6c0 0000000000000008 ffff8801d9ef7cd8 ffffffff81092bee [ 2661.577245] 0000000000000008 ffffffff82924260 ffff8801d9ef7d30 ffffffff81ab8252 [ 2661.577247] Call Trace: [ 2661.577250] [] nmi_raise_cpu_backtrace+0x5e/0x80 [ 2661.577253] [] nmi_trigger_all_cpu_backtrace.cold+0xa1/0xae [ 2661.577256] [] ? print_lock+0xa8/0xab [ 2661.577259] [] ? irq_force_complete_move+0x330/0x330 [ 2661.577263] [] arch_trigger_all_cpu_backtrace+0x14/0x20 [ 2661.577266] [] watchdog.cold+0xd3/0xee [ 2661.577268] [] ? watchdog+0x2a5/0xa00 [ 2661.577271] [] ? reset_hung_task_detector+0x20/0x20 [ 2661.577274] [] kthread+0x273/0x310 [ 2661.577277] [] ? kthread_create_on_node+0x4c0/0x4c0 [ 2661.577280] [] ? _raw_spin_unlock_irq+0x39/0x60 [ 2661.577283] [] ? finish_task_switch+0x1e1/0x660 [ 2661.577286] [] ? finish_task_switch+0x1b3/0x660 [ 2661.577289] [] ? __schedule+0x7af/0x1ee0 [ 2661.577292] [] ? __schedule+0x7a3/0x1ee0 [ 2661.577295] [] ? __schedule+0x7af/0x1ee0 [ 2661.577298] [] ? kthread_create_on_node+0x4c0/0x4c0 [ 2661.577301] [] ret_from_fork+0x55/0x80 [ 2661.577304] [] ? kthread_create_on_node+0x4c0/0x4c0 [ 2661.577311] Code: 00 c3 5f ff 80 e6 10 75 e1 41 c1 e5 18 44 89 2c 25 10 c3 5f ff 44 89 fa 09 da 80 cf 04 41 83 ff 02 0f 44 d3 89 14 25 00 c3 5f ff <41> f7 c4 00 02 00 00 75 1e 4c 89 e7 57 9d 0f 1f 44 00 00 e8 f1 [ 2661.577313] NMI backtrace for cpu 1 [ 2661.577316] CPU: 1 PID: 15933 Comm: init Not tainted 4.4.174+ #4 [ 2661.577320] task: ffff8801522917c0 task.stack: ffff880042810000 [ 2661.577323] RIP: 0010:[] [] io_serial_in+0x6b/0x90 [ 2661.577326] RSP: 0018:ffff880042817578 EFLAGS: 00000002 [ 2661.577329] RAX: dffffc0000000000 RBX: 00000000000003fd RCX: 0000000000000000 [ 2661.577333] RDX: 00000000000003fd RSI: ffffffff81cc24d1 RDI: ffffffff8496e518 [ 2661.577336] RBP: ffff880042817588 R08: 0000000000000002 R09: ffff8801522920f8 [ 2661.577339] R10: ffffffff83a4d0b0 R11: 0000000000000000 R12: ffffffff8496e4e0 [ 2661.577343] R13: 0000000000000020 R14: fffffbfff092dce3 R15: fffffbfff092dca5 [ 2661.577346] FS: 00007f51ca24d7a0(0000) GS:ffff8801db700000(0000) knlGS:0000000000000000 [ 2661.577349] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 2661.577353] CR2: 00007fffce8a70d0 CR3: 00000000433c5000 CR4: 00000000001606b0 [ 2661.577354] Stack: [ 2661.577358] ffffffff8496e4e0 000000000000270f ffff8800428175d8 ffffffff81cc461f [ 2661.577361] 0000000000000046 ffffffff8496e528 ffffffff8496e71a ffffffff83fdf15b [ 2661.577364] ffffffff8496e4e0 0000000000000038 dffffc0000000000 0000000000000038 [ 2661.577366] Call Trace: [ 2661.577369] [] wait_for_xmitr+0x8f/0x1e0 [ 2661.577372] [] serial8250_console_putchar+0x20/0x60 [ 2661.577375] [] ? wait_for_xmitr+0x1e0/0x1e0 [ 2661.577378] [] uart_console_write+0x56/0xe0 [ 2661.577381] [] serial8250_console_write+0x2fb/0x870 [ 2661.577384] [] ? serial8250_release_port+0x20/0x20 [ 2661.577387] [] ? trace_hardirqs_on_caller+0x385/0x5a0 [ 2661.577390] [] ? debug_lockdep_rcu_enabled+0x71/0xa0 [ 2661.577394] [] ? univ8250_console_setup+0xe0/0xe0 [ 2661.577397] [] univ8250_console_write+0x5f/0x70 [ 2661.577400] [] call_console_drivers.constprop.0+0x1ef/0x3f0 [ 2661.577403] [] console_unlock+0x602/0xa10 [ 2661.577406] [] ? uart_handle_cts_change+0x2a0/0x2a0 [ 2661.577409] [] console_device+0x97/0xc0 [ 2661.577412] [] tty_open+0x8e7/0xf50 [ 2661.577415] [] ? tty_init_dev+0x420/0x420 [ 2661.577417] [] ? chrdev_open+0xca/0x630 [ 2661.577420] [] ? tty_init_dev+0x420/0x420 [ 2661.577423] [] chrdev_open+0x230/0x630 [ 2661.577426] [] ? cdev_put.part.0+0x50/0x50 [ 2661.577429] [] do_dentry_open+0x38f/0xbd0 [ 2661.577432] [] ? __inode_permission2+0x9e/0x250 [ 2661.577435] [] ? cdev_put.part.0+0x50/0x50 [ 2661.577438] [] vfs_open+0x10b/0x210 [ 2661.577441] [] ? may_open.isra.0+0xe7/0x210 [ 2661.577444] [] path_openat+0x136f/0x4470 [ 2661.577447] [] ? kasan_kmalloc.part.0+0xc6/0xf0 [ 2661.577451] [] ? may_open.isra.0+0x210/0x210 [ 2661.577454] [] ? trace_hardirqs_on+0x10/0x10 [ 2661.577456] [] do_filp_open+0x1a1/0x270 [ 2661.577460] [] ? user_path_mountpoint_at+0x50/0x50 [ 2661.577462] [] ? __alloc_fd+0x1ea/0x490 [ 2661.577465] [] ? _raw_spin_unlock+0x2d/0x50 [ 2661.577468] [] do_sys_open+0x2f8/0x600 [ 2661.577471] [] ? filp_open+0x70/0x70 [ 2661.577475] [] ? trace_hardirqs_on_caller+0x385/0x5a0 [ 2661.577478] [] SyS_open+0x2d/0x40 [ 2661.577481] [] entry_SYSCALL_64_fastpath+0x1e/0x9a [ 2661.577487] Code: 24 c1 00 00 00 49 8d 7c 24 38 48 b8 00 00 00 00 00 fc ff df 48 89 fa 48 c1 ea 03 d3 e3 80 3c 02 00 75 17 41 03 5c 24 38 89 da ec <5b> 0f b6 c0 41 5c 5d c3 e8 28 29 7c ff eb c2 e8 81 29 7c ff eb [ 2661.577611] Kernel panic - not syncing: hung_task: blocked tasks [ 2661.577619] CPU: 0 PID: 20 Comm: khungtaskd Not tainted 4.4.174+ #4 [ 2661.577628] 0000000000000000 c367249387704df6 ffff8801d9ef7c60 ffffffff81aad1a1 [ 2661.577637] ffff8801511597c0 ffffffff82872120 dffffc0000000000 0000000000000002 [ 2661.577646] 00000000003fd5ae ffff8801d9ef7d40 ffffffff813a48c2 0000000041b58ab3 [ 2661.577647] Call Trace: [ 2661.577655] [] dump_stack+0xc1/0x120 [ 2661.577664] [] panic+0x1b9/0x37b [ 2661.577672] [] ? add_taint.cold+0x16/0x16 [ 2661.577680] [] ? find_next_bit+0x44/0x50 [ 2661.577688] [] ? nmi_trigger_all_cpu_backtrace+0x3c6/0x490 [ 2661.577697] [] ? nmi_trigger_all_cpu_backtrace+0x3c6/0x490 [ 2661.577704] [] watchdog.cold+0xe4/0xee [ 2661.577710] [] ? watchdog+0x2a5/0xa00 [ 2661.577718] [] ? reset_hung_task_detector+0x20/0x20 [ 2661.577725] [] kthread+0x273/0x310 [ 2661.577733] [] ? kthread_create_on_node+0x4c0/0x4c0 [ 2661.577740] [] ? _raw_spin_unlock_irq+0x39/0x60 [ 2661.577747] [] ? finish_task_switch+0x1e1/0x660 [ 2661.577753] [] ? finish_task_switch+0x1b3/0x660 [ 2661.577760] [] ? __schedule+0x7af/0x1ee0 [ 2661.577767] [] ? __schedule+0x7a3/0x1ee0 [ 2661.577774] [] ? __schedule+0x7af/0x1ee0 [ 2661.577782] [] ? kthread_create_on_node+0x4c0/0x4c0 [ 2661.577789] [] ret_from_fork+0x55/0x80 [ 2661.577797] [] ? kthread_create_on_node+0x4c0/0x4c0 [ 2661.582005] Kernel Offset: disabled [ 2669.708336] Rebooting in 86400 seconds..