000, 0x0)
setsockopt$inet_MCAST_MSFILTER(r0, 0x0, 0x30, &(0x7f00000000c0)={0x7ff, {{0x2, 0x4e24, @dev={0xac, 0x14, 0x14, 0x1b}}}, 0x1, 0x6, [{{0x2, 0x4e24, @multicast1}}, {{0x2, 0x4e21, @loopback}}, {{0x2, 0x4e24, @multicast2}}, {{0x2, 0x4e20, @empty}}, {{0x2, 0x4e22, @local}}, {{0x2, 0x4e24, @remote}}]}, 0x390)

15:06:17 executing program 5:
r0 = socket$inet_udplite(0x2, 0x2, 0x88)
ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f3188b070")
syz_open_procfs(0x0, &(0x7f0000000940)='syscall\x00')
r1 = syz_open_procfs(0x0, &(0x7f0000000040)='fd\x00')
recvmmsg(0xffffffffffffffff, &(0x7f0000003840)=[{{0x0, 0x0, 0x0}}], 0x1, 0x0, 0x0)
perf_event_open(&(0x7f0000940000)={0x2, 0x70, 0xee6a, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x100, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0xff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x10001, 0x1}, 0x0, 0x400000000000000}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
mlock(&(0x7f00005b8000/0x3000)=nil, 0x3000)
ioctl$SNDRV_TIMER_IOCTL_SELECT(r1, 0x40345410, 0x0)
openat$uinput(0xffffffffffffff9c, &(0x7f0000000080)='/dev/uinput\x00', 0x2, 0x0)
mmap(&(0x7f000060b000/0x1000)=nil, 0x1000, 0x5, 0x8000400200000033, r1, 0x0)
unshare(0x10000000)
r2 = getpid()
sched_setscheduler(r2, 0x5, &(0x7f00000000c0))
open$dir(&(0x7f0000000400)='./file0\x00', 0x0, 0x0)
r3 = perf_event_open(&(0x7f0000000180)={0x1, 0xfdf9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffff9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f00000004c0), 0x2}, 0x0, 0x0, 0x0, 0x3}, r2, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000340)='memory.current\x00', 0x0, 0x0)
ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, 0x0)
socketpair(0x1, 0x20000000000001, 0x0, &(0x7f0000000100)={<r4=>0xffffffffffffffff, <r5=>0xffffffffffffffff})
ioctl$PERF_EVENT_IOC_SET_FILTER(r5, 0x8914, &(0x7f0000000300)='lo\x00\x96o\xd6Q\xb9Y\xa9\xc8J,\x00\xd2\x97\x04\x03\xdc\r')
close(r3)
rt_sigprocmask(0x2, &(0x7f0000000240)={0x6}, &(0x7f00000002c0), 0x8)
ioctl$PERF_EVENT_IOC_SET_FILTER(r5, 0x8923, &(0x7f00000008c0)='lo\x00\x96o8\x0fd\xa1\xe3\xd7]b}\x1f\xa1Y\xad4\x90\x9d`\xd2\x98\x00\x00\x00 \'Y\x17]\x15c\xcaR\xdd\x98OC\x89\x1b\xe7\x84\xe2\x05\x80w\xd2|D\x8dK\x14Bx\xcbuH\xc2\xeec\xbf<>Y\x1a\xfc\x1f9OB\x81\x89\x186\xc5q@n\xb4\xb6s\xb0\x00\x00\xfc\x00\x00\b\x00\x00\xda\xef\xecE\xec\xd5I\xb2\x9b\xfe\x8d\x90?\x00\xe9\xe4~g:\xc1\xb2aj\x96\xbb\xa7\xe2\xc0\xdc\xf9Q\b\xeb\x16\x7fT\x11\xd3\r7\xe6\"f\xcf\x8e\xabd\x0ftp\x82\xae\xd2\x15\x8e+c\xf6\xbf\xe14>\xa6-\xa5c\xde\xd7\xab\xea\x1f\xf8s2\x9cVF\xd5\x18\xfe\x0e\x8f \x01\x00\x00y.\xfc*\x82\xa5\xa1p5\xc8{\xf7\xef\xab\xe8\x99\xebw#\x8at\x1c\x80\xfc\xb0\x95\xa2\xa7\xd7,Y]E8\x83X\xf5F\xdc\x88-\xf5\xb0\xb5^\xdb\x1a\xb6\xaa\x14\xe2\xb9\rh^J-\xd1\xbaUn\x04\'l\x1b\xe0o\xdb\xc8\x91%\x1c\xb5\xbf\xb6\x90\xb4\xc2\x7f]/\xb3\xe7\xc9\'\x94\xcfIo\xdf\x04\x95\xb5\x06\x84\x1fH>\xda\xc5\x04 \x94\x88\xeb\'\xd4;6\x7f\xd9\x99-\x1b|G\x8d\xd4\xb9%\xaaQ\xa0K\x10\x03\x93\xe1\xcc\xe7m\x80\'\xf0\xa5\xed(\r\xa8\x0f&\xb1\xf3\xff0\f\x82%_\x92\x8bD\xb9\xd9\xe7\xf2\xe4\xc1i#\xdc\x87A\xb9\xc7\r\x92\xfa\x11\x11\xb5\x1f\x03\x9d\xdd\x1bj\xdf\xacg\xe3\xa0S\xd3\x8a\xe1n\x97\xea\xf5\xa0\'\v\xe9\xa0\xf1 f\xaan\xcf\xb5i\xb6d\xbc\x92\v\xd58\x16\b\xb3_:\xa4!\ny\xc4&\nWMM\xa8\xc4\v\x9f\x01o\xf4\xab&\xb6\x17\x02P\xc3!N\xf4\b\x1a~\x91V1s\xe9\xbe\x9e\x9b\'\xcde\xb3\xa1\x86\"\xd7\x04\xf1\xc0!\xed\xff\xee$\xc89\x8cB0\xd1dD\xe0IP\x88\xa2\xf2Y\x9af$$\xf1cO\xf7P\xac\xca\x80:!\xb4\x94#\xcb^\x9f\'\x03\xe3\x93\xb9\x82\xbf\xcf\xc4\xe3\xf7\x03Oh\xf2r\xca\x8ff\xbb/\x9f*\xaf\x1a \xa5\xa0?%M\xa5\x86\x98\xf24\'1\xc7\f<\xcc@\xe8\x8a\xac.\xde\xe4\xc7\xf5\x9ck\xa40!\xe9\x14$\xb3\x05m\xb5m\xed\ft\x93\xd8\xa3\x80\'Y\xb9\x05\xbbt|\xbe\xbcz\n\xf3\xf5p\xf8\x9f~\x1b\xd0\v\x1cQ')
getsockopt$inet_IP_IPSEC_POLICY(r1, 0x0, 0x10, &(0x7f00000006c0)={{{@in6=@loopback}}, {{@in6=@initdev}}}, &(0x7f0000000500)=0xe8)
socketpair(0x2, 0x2000000080003, 0x100, &(0x7f0000000480))
syz_genetlink_get_family_id$SEG6(&(0x7f00000003c0)='SEG6\x00')
sendmsg$SEG6_CMD_DUMPHMAC(r4, &(0x7f0000000580)={&(0x7f0000000380)={0x10, 0x0, 0x0, 0x1000000}, 0xc, &(0x7f0000000440)={&(0x7f0000000f00)=ANY=[@ANYBLOB="2300260109447a0065a455e04ea56d0a47018c8e973bcac914471474a7e0d50a000eadd66d2e49a2ed40dc0100e046ab6aacc2097d8f75bd9c8b8a227950e116904efa3f9600092ab388644f66c2d5baec4079a81bae9927e49e91a4964656d7b227702926af5be846f3de49fad3900cb0532c8f31f663380e40ce7f6cb15ec8baab3b7c6f0000000000000000000000000000b0b410110184d408621701f959d7471ec90341da26657937e85b0bb1889a3948e06e15149a2ee65221dada1264da89c628dc1d8d894a53aab22b289ceb87fc96df1ce7c25e7d213d3a61aca85941bdc696f62987e2e143805447268793bc802c141b3a8c304d60f63e85d4d82a95aa38146e6cc1aea0a8bceafd87dcb8ef0c4bb8cf8a351af541c259c7a840141ca3cca78b90e56e2f0405000000ea10d36f4c3a7f64aa8c9cd0a9d40ae868e1cf1b1c260f3278185402bc8f0cf4c16978d8585eafc581decb6000e9199e501bde5b00036b8cc290527a27183629c738b35f438e0badf2211b06d34f7871fa147d604362c69944f69b90359487b625060a5e8d7fe52cfd4fde396b0b4a1325bc8717c3d4cb47f2a08779c4d2bc4f11add26a46fa4e05f3043f5e64adb5af6b0d1c4d1d5f2af3b2657b4f97a41a770726e1bbac92a2c6d47bf733d39e2054b64d53b9fc1a949a07bc33b2299128ef414cbc5417b9e570f1b047b441da8faeec646dd8d63b670f91102d30d9b80c47455ee1ff5819590efdf25878ca"], 0x1}, 0x1, 0x0, 0x0, 0x8000}, 0x804)
r6 = creat(&(0x7f0000000280)='./bus\x00', 0x0)
arch_prctl$ARCH_MAP_VDSO_32(0x2002, 0x7e)
ftruncate(r6, 0x2008200)
open(&(0x7f0000000140)='./bus\x00', 0x4000, 0x0)

15:06:17 executing program 3:
r0 = socket$inet_udplite(0x2, 0x2, 0x88)
ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f3188b070")
syz_open_procfs(0x0, &(0x7f0000000940)='syscall\x00')
r1 = syz_open_procfs(0x0, &(0x7f0000000040)='fd\x00')
recvmmsg(0xffffffffffffffff, &(0x7f0000003840)=[{{0x0, 0x0, 0x0}}], 0x1, 0x0, 0x0)
perf_event_open(&(0x7f0000940000)={0x2, 0x70, 0xee6a, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x100, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0xff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x10001, 0x1}, 0x0, 0x400000000000000}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
mlock(&(0x7f00005b8000/0x3000)=nil, 0x3000)
ioctl$SNDRV_TIMER_IOCTL_SELECT(0xffffffffffffffff, 0x40345410, 0x0)
openat$uinput(0xffffffffffffff9c, &(0x7f0000000080)='/dev/uinput\x00', 0x2, 0x0)
mmap(&(0x7f000060b000/0x1000)=nil, 0x1000, 0x5, 0x8000400200000033, r1, 0x0)
perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x2, 0x9, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2000000, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x4000000, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8)
r2 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)={0x10b, 0x6, 0x209e1e, 0x3, 0x1}, 0x2c)
bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000b40)={r2, &(0x7f0000000040), 0x0, 0x1}, 0x20)
r3 = creat(&(0x7f0000000640)='./file0\x00', 0x100)
setsockopt$inet6_tcp_TCP_REPAIR_QUEUE(r3, 0x6, 0x14, &(0x7f0000000980), 0x4)
unlink(&(0x7f0000000940)='./file0\x00')
r4 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r5 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r5, 0x0)
ioctl$BINDER_GET_NODE_DEBUG_INFO(r4, 0xc018620b, &(0x7f0000000100))
ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f00000000c0)=ANY=[@ANYBLOB="bb8f0000"], 0x0, 0x0, 0x0})
ioctl$BINDER_SET_CONTEXT_MGR(r5, 0x40046207, 0x0)
shutdown(0xffffffffffffffff, 0x1)
prctl$PR_SET_NAME(0xf, &(0x7f0000000380)='/group.stat\x00')
ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)})
ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0x0, 0x0, &(0x7f0000000780)})
ioctl$BINDER_WRITE_READ(r5, 0xc0306201, &(0x7f00000001c0)={0x8, 0x0, &(0x7f0000000500)=[@release={0x40046306, 0x1}], 0x0, 0x0, &(0x7f00000009c0)})
creat(&(0x7f00000000c0)='./file0\x00', 0x0)
syz_genetlink_get_family_id$tipc2(&(0x7f0000000a80)='TIPCv2\x00')

[ 1098.732398] binder: release 32494:32499 transaction 945 out, still active
[ 1098.741455] binder: send failed reply for transaction 945, target dead
[ 1098.749188] binder: send failed reply for transaction 948 to 32508:32510
15:06:17 executing program 4:
r0 = syz_open_procfs(0x0, &(0x7f00000001c0)='net/softnet_stat\x00')
lseek(r0, 0x20000, 0x0)
r1 = dup2(r0, r0)
signalfd(r1, &(0x7f0000000000)={0x2}, 0x8)

15:06:17 executing program 2:
r0 = syz_open_procfs(0x0, &(0x7f0000000280)='net/fib_triestat\x00')
ioctl$TCFLSH(r0, 0x540b, 0x7f)
lseek(r0, 0x20000, 0x0)

15:06:17 executing program 0:
r0 = syz_open_procfs(0x0, &(0x7f0000000200)='setgroups\x00\xb5\xd7[\xb6\x7f\xd1+\xcd\xbd\"\xaaE$\x8a+\xeb\x87\"W\xdfL\xe6\x93\x06\xe9>\xec \xc2\x83\xa2#\xceu\xd32<n\xfcJ]O\x8c&\x87i_\xee\xbb\x99(8P\x1bj\xcdy\x9a\x11\xb6\x1f\xa3W\xdb\xd0*D\x9e\xcf\xe2I3]\t\xf6\x1f\f\x06\xf5R\xa5D\b}5\xa3\xed\x14=\x90\x9c \x12\xe5\x8c\xb8n\xa5T\x8a\x0f\x1c\xa3')
writev(r0, &(0x7f0000000380)=[{&(0x7f0000000040)="c25ff6b011c323b7b78648fad1b69834a9a36d11d01ff54dd1751ad80c5c3e7164ff2e120c5dd52cde2f19bd60b8142fcd6a8b5a275c0f46d297094fd00cbdcb0e1178ae69b9d37cfb0c17448115abd5f15b", 0x52}], 0x1)

[ 1098.906474] binder: 32550:32561 unknown command 36795
15:06:17 executing program 4:
ioctl$sock_FIOGETOWN(0xffffffffffffff9c, 0x8903, &(0x7f0000000100)=<r0=>0x0)
r1 = syz_open_procfs(r0, &(0x7f0000000200)='net/soa\xa0\xf7\x9b\xd6>wf\x80t\x00\x00\x00\x00\x00\x00\x00\x00\x00\x7f\xb4\xb7\x93\xb7\xa1\xb6A\xe7\xfaI\xd8\xd4C\xbcc#\xe3!\xcd\xba\xfb\x9e_t\xd0\xe0KHZ\xaa\xd3\x80f\n\xbb\x8f>\xeclg^\xcc\x1f\xb3\x06\xd4\xe0%G\x98T\xfa\xb9\xb0p\xf7E\xe2\x91`s\xece1\xfb\x8c\x80\xdf(_\t\xd30r\x8a\xe4\x93\xf6\xa3(\xf4\xcc\x1f\xcf\xcf\xc9J.g\x01@O\xa3B4\xf3Q\xed\x854%\xe6\xfc\x13\x16\xfd\x1b\x18K\xafD\x86\xbd\xd5\xe2\x81\xf2M\xa6\x82\t\xb6\x87A%\xd4qb,v\xea\xeb\x7f\xef\x16hi\xe9\x81U\xb41\xe2\xed\xdd\xa9\x91\xe8F\xda\xaax\x06\x17\x01\xae3 lt\x93NK\x04\x91<\xc7\x8e\x04\xdbO\xfb\xf7W\xa6\x1e\x85_\xc4\xea:\x01+\x12i\x05\x1b\'Q{\xd3\x8e\xa31\xd2\xc4\xca\xe8\x01')
lseek(r1, 0x20000, 0x0)

15:06:17 executing program 2:
r0 = syz_open_procfs(0x0, &(0x7f0000000280)='net/fib_triestat\x00')
lseek(r0, 0x20000, 0x0)
ioctl$FS_IOC_FSGETXATTR(r0, 0x801c581f, &(0x7f0000000000)={0xfffffffffffffffa, 0x5, 0x0, 0x7, 0xffff})

[ 1098.929889] binder: 32550:32561 ioctl c0306201 20000140 returned -22
15:06:17 executing program 0:
r0 = syz_open_procfs(0x0, &(0x7f0000000200)='setgroups\x00\xb5\xd7[\xb6\x7f\xd1+\xcd\xbd\"\xaaE$\x8a+\xeb\x87\"W\xdfL\xe6\x93\x06\xe9>\xec \xc2\x83\xa2#\xceu\xd32<n\xfcJ]O\x8c&\x87i_\xee\xbb\x99(8P\x1bj\xcdy\x9a\x11\xb6\x1f\xa3W\xdb\xd0*D\x9e\xcf\xe2I3]\t\xf6\x1f\f\x06\xf5R\xa5D\b}5\xa3\xed\x14=\x90\x9c \x12\xe5\x8c\xb8n\xa5T\x8a\x0f\x1c\xa3')
writev(r0, &(0x7f0000000380)=[{&(0x7f0000000080)="6dfd57bbc4e23b3d", 0x8}], 0x1)

[ 1098.999191] binder: 32556:32566 unknown command 36795
[ 1098.999724] binder: 32550:32583 BC_INCREFS_DONE node 953 has no pending increfs request
[ 1099.006749] binder: 32556:32566 ioctl c0306201 20000140 returned -22
[ 1099.035816] binder: BINDER_SET_CONTEXT_MGR already set
[ 1099.061230] binder: 32556:32566 ioctl 40046207 0 returned -16
[ 1099.071111] binder: 32556:32574 Release 1 refcount change on invalid ref 1 ret -22
15:06:17 executing program 0:
r0 = syz_open_procfs(0x0, &(0x7f0000000200)='setgroups\x00\xb5\xd7[\xb6\x7f\xd1+\xcd\xbd\"\xaaE$\x8a+\xeb\x87\"W\xdfL\xe6\x93\x06\xe9>\xec \xc2\x83\xa2#\xceu\xd32<n\xfcJ]O\x8c&\x87i_\xee\xbb\x99(8P\x1bj\xcdy\x9a\x11\xb6\x1f\xa3W\xdb\xd0*D\x9e\xcf\xe2I3]\t\xf6\x1f\f\x06\xf5R\xa5D\b}5\xa3\xed\x14=\x90\x9c \x12\xe5\x8c\xb8n\xa5T\x8a\x0f\x1c\xa3')
writev(r0, &(0x7f0000000380)=[{&(0x7f0000000000)="6dfd57bbc4e23b3d", 0x8}], 0x100000000000015a)

15:06:17 executing program 4:
r0 = dup3(0xffffffffffffff9c, 0xffffffffffffffff, 0x80000)
ioctl$EVIOCGRAB(r0, 0x40044590, &(0x7f0000000040)=0x8001)
r1 = syz_open_procfs(0x0, &(0x7f0000000000)='net/ipv6_route\x00')
lseek(r1, 0x1fffc, 0x6)

15:06:17 executing program 5:
r0 = socket$inet_udplite(0x2, 0x2, 0x88)
ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f3188b070")
syz_open_procfs(0x0, &(0x7f0000000940)='syscall\x00')
r1 = syz_open_procfs(0x0, &(0x7f0000000540)='sesSio\xa1nid\x00')
recvmmsg(0xffffffffffffffff, &(0x7f0000003840)=[{{0x0, 0x0, 0x0}}], 0x1, 0x0, 0x0)
perf_event_open(&(0x7f0000940000)={0x2, 0x70, 0xee6a, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x100, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0xff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x10001, 0x1}, 0x0, 0x400000000000000}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
mlock(&(0x7f00005b8000/0x3000)=nil, 0x3000)
ioctl$SNDRV_TIMER_IOCTL_SELECT(0xffffffffffffffff, 0x40345410, 0x0)
openat$uinput(0xffffffffffffff9c, &(0x7f0000000080)='/dev/uinput\x00', 0x2, 0x0)
mmap(&(0x7f000060b000/0x1000)=nil, 0x1000, 0x5, 0x8000400200000033, r1, 0x0)
unshare(0xfffffffffffffffd)
r2 = getpid()
sched_setscheduler(r2, 0x5, &(0x7f00000000c0))
open$dir(&(0x7f0000000400)='./file0\x00', 0x0, 0x0)
perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f00000004c0), 0x2}, 0x0, 0x0, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r3 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000340)='memory.current\x00', 0x0, 0x0)
ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, 0x0)
socketpair(0x1, 0x20000000000001, 0x0, &(0x7f0000000100)={<r4=>0xffffffffffffffff, <r5=>0xffffffffffffffff})
ioctl$PERF_EVENT_IOC_SET_FILTER(r5, 0x8914, &(0x7f0000000300)='lo\x00\x96o\xd6Q\xb9Y\xa9\xc8J,\x00\xd2\x97\x04\x03\xdc\r')
close(r3)
rt_sigprocmask(0x2, &(0x7f0000000240)={0x6}, &(0x7f00000002c0), 0x8)
ioctl$PERF_EVENT_IOC_SET_FILTER(r5, 0x8923, &(0x7f00000008c0)='lo\x00\x96o8\x0fd\xa1\xe3\xd7]b}\x1f\xa1Y\xad4\x90\x9d`\xd2\x98\x00\x00\x00 \'Y\x17]\x15c\xcaR\xdd\x98OC\x89\x1b\xe7\x84\xe2\x05\x80w\xd2|D\x8dK\x14Bx\xcbuH\xc2\xeec\xbf<>Y\x1a\xfc\x1f9OB\x81\x89\x186\xc5q@n\xb4\xb6s\xb0\x00\x00\xfc\x00\x00\b\x00\x00\xda\xef\xecE\xec\xd5I\xb2\x9b\xfe\x8d\x90?\x00\xe9\xe4~g:\xc1\xb2aj\x96\xbb\xa7\xe2\xc0\xdc\xf9Q\b\xeb\x16\x7fT\x11\xd3\r7\xe6\"f\xcf\x8e\xabd\x0ftp\x82\xae\xd2\x15\x8e+c\xf6\xbf\xe14>\xa6-\xa5c\xde\xd7\xab\xea\x1f\xf8s2\x9cVF\xd5\x18\xfe\x0e\x8f \x01\x00\x00y.\xfc*\x82\xa5\xa1p5\xc8{\xf7\xef\xab\xe8\x99\xebw#\x8at\x1c\x80\xfc\xb0\x95\xa2\xa7\xd7,Y]E8\x83X\xf5F\xdc\x88-\xf5\xb0\xb5^\xdb\x1a\xb6\xaa\x14\xe2\xb9\rh^J-\xd1\xbaUn\x04\'l\x1b\xe0o\xdb\xc8\x91%\x1c\xb5\xbf\xb6\x90\xb4\xc2\x7f]/\xb3\xe7\xc9\'\x94\xcfIo\xdf\x04\x95\xb5\x06\x84\x1fH>\xda\xc5\x04 \x94\x88\xeb\'\xd4;6\x7f\xd9\x99-\x1b|G\x8d\xd4\xb9%\xaaQ\xa0K\x10\x03\x93\xe1\xcc\xe7m\x80\'\xf0\xa5\xed(\r\xa8\x0f&\xb1\xf3\xff0\f\x82%_\x92\x8bD\xb9\xd9\xe7\xf2\xe4\xc1i#\xdc\x87A\xb9\xc7\r\x92\xfa\x11\x11\xb5\x1f\x03\x9d\xdd\x1bj\xdf\xacg\xe3\xa0S\xd3\x8a\xe1n\x97\xea\xf5\xa0\'\v\xe9\xa0\xf1 f\xaan\xcf\xb5i\xb6d\xbc\x92\v\xd58\x16\b\xb3_:\xa4!\ny\xc4&\nWMM\xa8\xc4\v\x9f\x01o\xf4\xab&\xb6\x17\x02P\xc3!N\xf4\b\x1a~\x91V1s\xe9\xbe\x9e\x9b\'\xcde\xb3\xa1\x86\"\xd7\x04\xf1\xc0!\xed\xff\xee$\xc89\x8cB0\xd1dD\xe0IP\x88\xa2\xf2Y\x9af$$\xf1cO\xf7P\xac\xca\x80:!\xb4\x94#\xcb^\x9f\'\x03\xe3\x93\xb9\x82\xbf\xcf\xc4\xe3\xf7\x03Oh\xf2r\xca\x8ff\xbb/\x9f*\xaf\x1a \xa5\xa0?%M\xa5\x86\x98\xf24\'1\xc7\f<\xcc@\xe8\x8a\xac.\xde\xe4\xc7\xf5\x9ck\xa40!\xe9\x14$\xb3\x05m\xb5m\xed\ft\x93\xd8\xa3\x80\'Y\xb9\x05\xbbt|\xbe\xbcz\n\xf3\xf5p\xf8\x9f~\x1b\xd0\v\x1cQ')
getsockopt$inet_IP_IPSEC_POLICY(r1, 0x0, 0x10, &(0x7f00000006c0)={{{@in6=@loopback}}, {{@in6=@initdev}}}, &(0x7f0000000500)=0xe8)
socketpair(0x2, 0x2000000080003, 0x100, &(0x7f0000000480))
syz_genetlink_get_family_id$SEG6(&(0x7f00000003c0)='SEG6\x00')
sendmsg$SEG6_CMD_DUMPHMAC(r4, &(0x7f0000000580)={&(0x7f0000000380)={0x10, 0x0, 0x0, 0x1000000}, 0xc, &(0x7f0000000440)={&(0x7f00000005c0)=ANY=[@ANYBLOB="2300260109447a0000000000000000660000001400001a0065a455e04ea56d0a47018c8e973bcac914471474a7e0d50a000eadd66d2e49a2ed40dcafa1e046ab6aacc2097d8f75bd9c8b8a220bdde116904efa3f9600f22ab388644f66c2d5baec4079a81bae1927e49e91a4964656d7b227702926af5be846f3de49fad39048633fd9161123894d9427f854a30cb0532c8f31f663380e40ce7f6cb15ec8baab3b7c6f"], 0x1}, 0x1, 0x0, 0x0, 0x8000}, 0x804)
r6 = creat(&(0x7f0000000280)='./bus\x00', 0x0)
arch_prctl$ARCH_MAP_VDSO_32(0x2002, 0x7e)
ftruncate(r6, 0x2008200)
open(&(0x7f0000000140)='./bus\x00', 0x4000, 0x0)

15:06:17 executing program 1:
r0 = socket$inet_udplite(0x2, 0x2, 0x88)
ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f3188b070")
syz_open_procfs(0x0, &(0x7f0000000940)='syscall\x00')
r1 = syz_open_procfs(0x0, &(0x7f0000000040)='fd\x00')
recvmmsg(0xffffffffffffffff, &(0x7f0000003840)=[{{0x0, 0x0, 0x0}}], 0x1, 0x0, 0x0)
perf_event_open(&(0x7f0000940000)={0x2, 0x70, 0xee6a, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x100, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0xff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x10001, 0x1}, 0x0, 0x400000000000000}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
mlock(&(0x7f00005b8000/0x3000)=nil, 0x3000)
ioctl$SNDRV_TIMER_IOCTL_SELECT(0xffffffffffffffff, 0x40345410, 0x0)
openat$uinput(0xffffffffffffff9c, &(0x7f0000000080)='/dev/uinput\x00', 0x2, 0x0)
mmap(&(0x7f000060b000/0x1000)=nil, 0x1000, 0x5, 0x8000400200000033, r1, 0x0)
perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x2, 0x9, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2000000, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x4000000, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8)
r2 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)={0x10b, 0x6, 0x209e1e, 0x3, 0x1}, 0x2c)
bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000b40)={r2, &(0x7f0000000040), 0x0, 0x1}, 0x20)
r3 = creat(&(0x7f0000000640)='./file0\x00', 0x100)
setsockopt$inet6_tcp_TCP_REPAIR_QUEUE(r3, 0x6, 0x14, &(0x7f0000000980), 0x4)
unlink(&(0x7f0000000940)='./file0\x00')
r4 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r5 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r5, 0x0)
ioctl$BINDER_GET_NODE_DEBUG_INFO(r4, 0xc018620b, &(0x7f0000000100))
ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f00000000c0)=ANY=[@ANYBLOB="bb8f0000"], 0x0, 0x0, 0x0})
ioctl$BINDER_SET_CONTEXT_MGR(r5, 0x40046207, 0x0)
shutdown(0xffffffffffffffff, 0x1)
prctl$PR_SET_NAME(0xf, &(0x7f0000000380)='/group.stat\x00')
ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)})
ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0x0, 0x0, &(0x7f0000000780)})
ioctl$BINDER_WRITE_READ(r5, 0xc0306201, &(0x7f00000001c0)={0x8, 0x0, &(0x7f0000000500)=[@release={0x40046306, 0x1}], 0x0, 0x0, &(0x7f00000009c0)})
creat(&(0x7f00000000c0)='./file0\x00', 0x0)

15:06:17 executing program 2:
r0 = syz_open_procfs(0x0, &(0x7f0000000000)='net/fib_triestat\x00')
getsockopt$inet_tcp_int(r0, 0x6, 0x11, &(0x7f0000000100), &(0x7f0000000140)=0x4)
lsetxattr$security_selinux(&(0x7f0000000040)='./file0\x00', &(0x7f0000000080)='security.selinux\x00', &(0x7f00000000c0)='system_u:object_r:checkpolicy_exec_t:s0\x00', 0x28, 0x3)
ioctl$TIOCCBRK(r0, 0x5428)
lseek(r0, 0x48, 0x0)

[ 1099.114815] binder: release 32556:32574 transaction 955 out, still active
[ 1099.278606] binder: 32605:32611 unknown command 36795
[ 1099.288503] binder: 32605:32611 ioctl c0306201 20000140 returned -22
[ 1099.306080] binder: BINDER_SET_CONTEXT_MGR already set
[ 1099.313058] binder: 32605:32611 ioctl 40046207 0 returned -16
[ 1099.375504] binder: 32605:32625 BC_INCREFS_DONE node 959 has no pending increfs request
[ 1099.386119] binder: 32605:32625 Release 1 refcount change on invalid ref 1 ret -22
15:06:18 executing program 2:
io_setup(0x1, &(0x7f0000000000))
r0 = openat(0xffffffffffffff9c, &(0x7f0000000080)='./file0\x00', 0x2, 0x4)
getsockopt$IPT_SO_GET_INFO(r0, 0x0, 0x40, &(0x7f0000000180)={'nat\x00'}, &(0x7f0000000200)=0x54)
r1 = syz_open_procfs(0x0, &(0x7f0000000280)='net/fib_triestat\x00')
lseek(r1, 0x20000, 0x0)
epoll_ctl$EPOLL_CTL_DEL(r1, 0x2, r1)
openat$selinux_commit_pending_bools(0xffffffffffffff9c, &(0x7f0000000040)='/selinux/commit_pending_bools\x00', 0x1, 0x0)

15:06:18 executing program 3:
r0 = socket$inet_udplite(0x2, 0x2, 0x88)
ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f3188b070")
syz_open_procfs(0x0, &(0x7f0000000940)='syscall\x00')
r1 = syz_open_procfs(0x0, &(0x7f0000000040)='fd\x00')
recvmmsg(0xffffffffffffffff, &(0x7f0000003840)=[{{0x0, 0x0, 0x0}}], 0x1, 0x0, 0x0)
perf_event_open(&(0x7f0000940000)={0x2, 0x70, 0xee6a, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x100, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0xff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x10001, 0x1}, 0x0, 0x400000000000000}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
mlock(&(0x7f00005b8000/0x3000)=nil, 0x3000)
ioctl$SNDRV_TIMER_IOCTL_SELECT(0xffffffffffffffff, 0x40345410, 0x0)
openat$uinput(0xffffffffffffff9c, &(0x7f0000000080)='/dev/uinput\x00', 0x2, 0x0)
mmap(&(0x7f000060b000/0x1000)=nil, 0x1000, 0x5, 0x8000400200000033, r1, 0x0)
perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x2, 0x9, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2000000, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x4000000, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8)
r2 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)={0x10b, 0x6, 0x209e1e, 0x3, 0x1}, 0x2c)
bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000b40)={r2, &(0x7f0000000040), 0x0, 0x1}, 0x20)
r3 = creat(&(0x7f0000000640)='./file0\x00', 0x100)
setsockopt$inet6_tcp_TCP_REPAIR_QUEUE(r3, 0x6, 0x14, &(0x7f0000000980), 0x4)
unlink(&(0x7f0000000940)='./file0\x00')
r4 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r5 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r5, 0x0)
ioctl$BINDER_GET_NODE_DEBUG_INFO(r4, 0xc018620b, &(0x7f0000000100))
ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f00000000c0)=ANY=[@ANYBLOB="bb8f0000"], 0x0, 0x0, 0x0})
ioctl$BINDER_SET_CONTEXT_MGR(r5, 0x40046207, 0x0)
shutdown(0xffffffffffffffff, 0x1)
prctl$PR_SET_NAME(0xf, &(0x7f0000000380)='/group.stat\x00')
ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)})
ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0x0, 0x0, &(0x7f0000000780)})
ioctl$BINDER_WRITE_READ(r5, 0xc0306201, &(0x7f00000001c0)={0x8, 0x0, &(0x7f0000000500)=[@release={0x40046306, 0x1}], 0x0, 0x0, &(0x7f00000009c0)})
creat(&(0x7f00000000c0)='./file0\x00', 0x0)
syz_genetlink_get_family_id$tipc2(&(0x7f0000000a80)='TIPCv2\x00')

15:06:18 executing program 0:
r0 = socket$unix(0x1, 0x2, 0x0)
pwritev(r0, &(0x7f0000000300)=[{&(0x7f0000000040)="43c69d7c02a8eddb26955d88c5d48eb607127147566e112dad41e3ae1a21855858f2045c5b15c78c1fb2e44735948d5fef2bf909ce78fff2a04dab4ce28275681b3caee797f2cfa179a8adbc9d1c82d2936535531d0f2334ba25bce8b6a8766d324e47f83c0bd62dc8daec4e2f", 0x6d}, {&(0x7f0000000100)="0fba7cf174923ea34e5038355b41d808565c52faa4e085159ec92d1f60891916dda24aaea4f4eeed4f99d3a6fcc5af9222cc2f2122ba029dbbf149ba4be279c078204846ae36fcadc71da6b53a7e7d7c32831f8c745409ca170429a68fce180df3fbed20635da0e3b114241a802d9a219e1fb6811367667d65dd19f2284b628d613c433a570e38c71b", 0x89}, {&(0x7f00000001c0)="8bfbb871cb5d01085dab1ab9d35dafaaf87a4eaa1e40542b06b31ffb383ebc0095d4220dd1374d0348f7c91b7e111d75c01338f115d2ad1ef4", 0x39}, {&(0x7f0000000200)="b3f261a8a966206ebd62ed44d1f9884ee1eb8187e5828c6675ad5e3fd242665887d9ac762cee5a19c5a8284cb6980f32a4b12300db15df3765eb3540af48d303ebb9a14bd83def9e7ad4beb1f707d49e2fb54081e219de96391360acf542628dc0fa5dc12207298d660d86f2ccced552a65f912bd8ee7e2f4ce42b25d1337e2551727891b41d9812f521c4b6587e55ca2ba2d7da4b3d73ca4da79df798d0927b2e17323cb2eda444ec2214aa801c71cfb01c9f7f42dd3ce0f3352906511f25318c7656c85ce11ede896e5387bb6dba0db8766576a5bea005a8b458a20c91", 0xde}, {&(0x7f00000003c0)="7a97bfdc1320c474a9e85411a0664bb793514a47d6a67c1b5681e2e77adf2cd9474dd7a9897147c1300c26405c1fd6410206b92a8a0100937b1f53e2d8b1febc6fadf6c44fefcf2d122961e7bf1e8dede462714bbba5612c36ef7fbbc7c5bd73875f3d21606e372a6a47915676d4f3b6cf00d7df669ddfca74dd8d2af6f974ecdb0223045781f9d3e7faf79fc5e4dc366eb6fbdda5dabdf39b61a401f0028f78634748d34e5cb07e93dd6730a86046003dc0a7dbfba6a8cc711238489721a41b64d7331c2445ca27a0a241d71ee631445b3693c6cb0381e736d0b99f6f09c16884c39c44f1705fad22574cc054bde023d530a1abd5a196ffd1b4", 0xfa}], 0x5, 0x0)
r1 = syz_open_procfs(0x0, &(0x7f00000000c0)='net/tcp\x00')
writev(r1, &(0x7f0000000380)=[{&(0x7f0000000000)="6dfd57bbc4e23b3d", 0x8}], 0x1)

15:06:18 executing program 4:
r0 = syz_open_procfs(0x0, &(0x7f00000001c0)='net/softnet_stat\x00')
lseek(r0, 0x0, 0x4)

15:06:18 executing program 5:
r0 = socket$inet_udplite(0x2, 0x2, 0x88)
ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f3188b070")
syz_open_procfs(0x0, &(0x7f0000000940)='syscall\x00')
r1 = syz_open_procfs(0x0, &(0x7f0000000040)='fd\x00')
recvmmsg(0xffffffffffffffff, &(0x7f0000003840)=[{{0x0, 0x0, 0x0}}], 0x1, 0x0, 0x0)
perf_event_open(&(0x7f0000940000)={0x2, 0x70, 0xee6a, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x100, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0xff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x10001, 0x1}, 0x0, 0x400000000000000}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
mlock(&(0x7f00005b8000/0x3000)=nil, 0x3000)
ioctl$SNDRV_TIMER_IOCTL_SELECT(0xffffffffffffffff, 0x40345410, 0x0)
openat$uinput(0xffffffffffffff9c, &(0x7f0000000080)='/dev/uinput\x00', 0x2, 0x0)
mmap(&(0x7f000060b000/0x1000)=nil, 0x1000, 0x5, 0x8000400200000033, r1, 0x0)
unshare(0xfffffffffffffffd)
r2 = getpid()
sched_setscheduler(r2, 0x5, &(0x7f00000000c0))
open$dir(&(0x7f0000000400)='./file0\x00', 0x0, 0x0)
perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f00000004c0), 0x2}, 0x0, 0x0, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r3 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000340)='memory.current\x00', 0x0, 0x0)
ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, 0x0)
socketpair(0x1, 0x20000000000001, 0x0, &(0x7f0000000100)={<r4=>0xffffffffffffffff, <r5=>0xffffffffffffffff})
ioctl$PERF_EVENT_IOC_SET_FILTER(r5, 0x8914, &(0x7f0000000300)='lo\x00\x96o\xd6Q\xb9Y\xa9\xc8J,\x00\xd2\x97\x04\x03\xdc\r')
close(r3)
rt_sigprocmask(0x2, &(0x7f0000000240)={0x6}, &(0x7f00000002c0), 0x8)
ioctl$PERF_EVENT_IOC_SET_FILTER(r5, 0x8923, &(0x7f00000008c0)='lo\x00\x96o8\x0fd\xa1\xe3\xd7]b}\x1f\xa1Y\xad4\x90\x9d`\xd2\x98\x00\x00\x00 \'Y\x17]\x15c\xcaR\xdd\x98OC\x89\x1b\xe7\x84\xe2\x05\x80w\xd2|D\x8dK\x14Bx\xcbuH\xc2\xeec\xbf<>Y\x1a\xfc\x1f9OB\x81\x89\x186\xc5q@n\xb4\xb6s\xb0\x00\x00\xfc\x00\x00\b\x00\x00\xda\xef\xecE\xec\xd5I\xb2\x9b\xfe\x8d\x90?\x00\xe9\xe4~g:\xc1\xb2aj\x96\xbb\xa7\xe2\xc0\xdc\xf9Q\b\xeb\x16\x7fT\x11\xd3\r7\xe6\"f\xcf\x8e\xabd\x0ftp\x82\xae\xd2\x15\x8e+c\xf6\xbf\xe14>\xa6-\xa5c\xde\xd7\xab\xea\x1f\xf8s2\x9cVF\xd5\x18\xfe\x0e\x8f \x01\x00\x00y.\xfc*\x82\xa5\xa1p5\xc8{\xf7\xef\xab\xe8\x99\xebw#\x8at\x1c\x80\xfc\xb0\x95\xa2\xa7\xd7,Y]E8\x83X\xf5F\xdc\x88-\xf5\xb0\xb5^\xdb\x1a\xb6\xaa\x14\xe2\xb9\rh^J-\xd1\xbaUn\x04\'l\x1b\xe0o\xdb\xc8\x91%\x1c\xb5\xbf\xb6\x90\xb4\xc2\x7f]/\xb3\xe7\xc9\'\x94\xcfIo\xdf\x04\x95\xb5\x06\x84\x1fH>\xda\xc5\x04 \x94\x88\xeb\'\xd4;6\x7f\xd9\x99-\x1b|G\x8d\xd4\xb9%\xaaQ\xa0K\x10\x03\x93\xe1\xcc\xe7m\x80\'\xf0\xa5\xed(\r\xa8\x0f&\xb1\xf3\xff0\f\x82%_\x92\x8bD\xb9\xd9\xe7\xf2\xe4\xc1i#\xdc\x87A\xb9\xc7\r\x92\xfa\x11\x11\xb5\x1f\x03\x9d\xdd\x1bj\xdf\xacg\xe3\xa0S\xd3\x8a\xe1n\x97\xea\xf5\xa0\'\v\xe9\xa0\xf1 f\xaan\xcf\xb5i\xb6d\xbc\x92\v\xd58\x16\b\xb3_:\xa4!\ny\xc4&\nWMM\xa8\xc4\v\x9f\x01o\xf4\xab&\xb6\x17\x02P\xc3!N\xf4\b\x1a~\x91V1s\xe9\xbe\x9e\x9b\'\xcde\xb3\xa1\x86\"\xd7\x04\xf1\xc0!\xed\xff\xee$\xc89\x8cB0\xd1dD\xe0IP\x88\xa2\xf2Y\x9af$$\xf1cO\xf7P\xac\xca\x80:!\xb4\x94#\xcb^\x9f\'\x03\xe3\x93\xb9\x82\xbf\xcf\xc4\xe3\xf7\x03Oh\xf2r\xca\x8ff\xbb/\x9f*\xaf\x1a \xa5\xa0?%M\xa5\x86\x98\xf24\'1\xc7\f<\xcc@\xe8\x8a\xac.\xde\xe4\xc7\xf5\x9ck\xa40!\xe9\x14$\xb3\x05m\xb5m\xed\ft\x93\xd8\xa3\x80\'Y\xb9\x05\xbbt|\xbe\xbcz\n\xf3\xf5p\xf8\x9f~\x1b\xd0\v\x1cQ')
getsockopt$inet_IP_IPSEC_POLICY(r1, 0x0, 0x10, &(0x7f00000006c0)={{{@in6=@loopback}}, {{@in6=@initdev}}}, &(0x7f0000000500)=0xe8)
socketpair(0x2, 0x2000000080003, 0x100, &(0x7f0000000480))
syz_genetlink_get_family_id$SEG6(&(0x7f00000003c0)='SEG6\x00')
sendmsg$SEG6_CMD_DUMPHMAC(r4, &(0x7f0000000580)={&(0x7f0000000380)={0x10, 0x0, 0x0, 0x1000000}, 0xc, &(0x7f0000000440)={&(0x7f00000005c0)=ANY=[@ANYBLOB="2300260109447a0000000000000000660000001400001a1c65a455e04ea56d0a47018c8e973bcac914471474a7e0d5dcafa16046ab6aacc2097d8f75bd9c8b8a220bdde116904efa3f9600f22ab388644f66c2d5baec406aa81bae1927e49e91a4964656d7b227702926af5be846f3de49fad39048633fd9161123894d9427f854a30cb0532c8f31f66b380e40ce7f6cb15ec8baab3b7c6f0000000000000000000000"], 0x1}, 0x1, 0x0, 0x0, 0x8000}, 0x804)
r6 = creat(&(0x7f0000000540)='./bus/file0\x00', 0x0)
arch_prctl$ARCH_MAP_VDSO_32(0x2002, 0x7e)
ftruncate(r6, 0x2008200)
open(&(0x7f0000000140)='./bus\x00', 0x4000, 0x0)

15:06:18 executing program 1:
r0 = socket$inet_udplite(0x2, 0x2, 0x88)
ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f3188b070")
syz_open_procfs(0x0, &(0x7f0000000940)='syscall\x00')
r1 = syz_open_procfs(0x0, &(0x7f0000000040)='fd\x00')
recvmmsg(0xffffffffffffffff, &(0x7f0000003840)=[{{0x0, 0x0, 0x0}}], 0x1, 0x0, 0x0)
perf_event_open(&(0x7f0000940000)={0x2, 0x70, 0xee6a, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x100, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0xff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x10001, 0x1}, 0x0, 0x400000000000000}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
mlock(&(0x7f00005b8000/0x3000)=nil, 0x3000)
ioctl$SNDRV_TIMER_IOCTL_SELECT(0xffffffffffffffff, 0x40345410, 0x0)
openat$uinput(0xffffffffffffff9c, &(0x7f0000000080)='/dev/uinput\x00', 0x2, 0x0)
mmap(&(0x7f000060b000/0x1000)=nil, 0x1000, 0x5, 0x8000400200000033, r1, 0x0)
perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x2, 0x9, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2000000, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x4000000, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8)
r2 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)={0x10b, 0x6, 0x209e1e, 0x3, 0x1}, 0x2c)
bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000b40)={r2, &(0x7f0000000040), 0x0, 0x1}, 0x20)
r3 = creat(&(0x7f0000000640)='./file0\x00', 0x100)
setsockopt$inet6_tcp_TCP_REPAIR_QUEUE(r3, 0x6, 0x14, &(0x7f0000000980), 0x4)
unlink(&(0x7f0000000940)='./file0\x00')
r4 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r5 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r5, 0x0)
ioctl$BINDER_GET_NODE_DEBUG_INFO(r4, 0xc018620b, &(0x7f0000000100))
ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f00000000c0)=ANY=[@ANYBLOB="bb8f0000"], 0x0, 0x0, 0x0})
ioctl$BINDER_SET_CONTEXT_MGR(r5, 0x40046207, 0x0)
shutdown(0xffffffffffffffff, 0x1)
prctl$PR_SET_NAME(0xf, &(0x7f0000000380)='/group.stat\x00')
ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)})
ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0x0, 0x0, &(0x7f0000000780)})
ioctl$BINDER_WRITE_READ(r5, 0xc0306201, &(0x7f00000001c0)={0x8, 0x0, &(0x7f0000000500)=[@release={0x40046306, 0x1}], 0x0, 0x0, &(0x7f00000009c0)})

[ 1099.631243] binder: release 32550:32561 transaction 952 out, still active
[ 1099.648618] binder: send failed reply for transaction 952, target dead
[ 1099.657793] binder: send failed reply for transaction 955, target dead
[ 1099.668390] binder: send failed reply for transaction 958 to 32605:32611
15:06:18 executing program 0:
syz_open_procfs(0x0, &(0x7f0000000200)='setgroups\x00\xb5\xd7[\xb6\x7f\xd1+\xcd\xbd\"\xaaE$\x8a+\xeb\x87\"W\xdfL\xe6\x93\x06\xe9>\xec \xc2\x83\xa2#\xceu\xd32<n\xfcJ]O\x8c&\x87i_\xee\xbb\x99(8P\x1bj\xcdy\x9a\x11\xb6\x1f\xa3W\xdb\xd0*D\x9e\xcf\xe2I3]\t\xf6\x1f\f\x06\xf5R\xa5D\b}5\xa3\xed\x14=\x90\x9c \x12\xe5\x8c\xb8n\xa5T\x8a\x0f\x1c\xa3')

15:06:18 executing program 4:
r0 = syz_open_procfs(0x0, &(0x7f00000001c0)='net/softnet_stat\x00')
getsockopt$inet_pktinfo(r0, 0x0, 0x8, &(0x7f0000000100)={<r1=>0x0, @loopback, @empty}, &(0x7f0000000140)=0xc)
sendmmsg(r0, &(0x7f00000004c0)=[{{&(0x7f0000000000)=@tipc=@nameseq={0x1e, 0x1, 0x3, {0x1, 0x2, 0x3}}, 0x80, &(0x7f0000000280)=[{&(0x7f0000000080)="29132fb7a2bb1d065361b229ff77b9", 0xf}, {&(0x7f00000000c0)="b103fcf66f85fb0eac7b280495702b7e31cb3e1bb27c8e5883b2295799e386e946cdf0bdec7543334bab730dba5cdb4895b0c716b8", 0x35}, {&(0x7f0000000200)="1a2b9e2860197a65805cb9f2b84f927f8a7c6e3e0cc9476f1bf7558b518a2a6b5712b6bf303df8573c16bdd1f0ce8d910766323bd4223c6dc7bf52913303b76d2b24a88323b0dc1965824137c91be073c9c03a88480119cdbeecf7bc3478ce253d6b500c8b52975ff75e6b7fea2abb2f566a1d9b0bd620c676599f5474f40e", 0x7f}], 0x3, &(0x7f00000002c0)=[{0x88, 0x117, 0x3ff, "cd8ad1050c0d95afe8b9d5f947c758f3f3f013456abcfd44d3f672b8c8e6e19072a06b543167615b8672aa988a0ed948f1c7186f2ff7ee6ee4c45bf61d944b4c054d2e0c2b301679683c39a225974b42731637d53b800354906883254f519de09cb78f84961c2f72c03402bcd571218fb0402c359ffd188b"}, {0x90, 0x105, 0x7f, "03ff34e2ab0ec5a4c24816f9883c13591b532ea62a5dd920bdc649f7746ac1944d28f50342b85e150061dcecdf4bb076ef1c6cf2b98047bd12d5ad19222df4f413bfc221caf9cb90ee9c9e7929a62e9987a964586aaa2460f476c8099e9d7097f74ae7ac7cd1b263ce04cba14da7440657c3e64c6167d56124e7d65a"}, {0xc0, 0x119, 0x4, "171a8b0e1bb6ffc333aa3a2d179ce93d788fd3bfba643db04b202e6f5c32ffe37d029fa57ae679287c50d84f27704a6ac59ff913a7f67089fd3a96fc9cf39359c8cc17a7b609c5be239aca2c0c2d90ae0d9355166fbc6dddd5643aae1705a9ac31fd424cfe4b66ee2f6a617b48e75ce41f337769b80907b93a8c8c27b47227cc5be2c8d100a299313a6e80851b34e5e5a8043429be57c374b141a8ca47d2607268788b9d4b1fcca99d"}], 0x1d8}, 0x10001}], 0x1, 0x40000d4)
ioctl$sock_inet6_SIOCDIFADDR(r0, 0x8936, &(0x7f0000000180)={@initdev={0xfe, 0x88, [], 0x0, 0x0}, 0x3, r1})
lseek(r0, 0x20000, 0x0)

15:06:18 executing program 2:
r0 = inotify_init()
fsetxattr$trusted_overlay_nlink(r0, &(0x7f0000000000)='trusted.overlay.nlink\x00', &(0x7f0000000040)={'L-', 0x200}, 0x28, 0x3)
r1 = syz_open_procfs(0x0, &(0x7f00000000c0)='net/xfrm_stat\x00')
fcntl$getownex(r1, 0x10, &(0x7f0000000080)={0x0, <r2=>0x0})
prlimit64(r2, 0xf, &(0x7f0000000100)={0x4, 0x10001}, &(0x7f0000000140))
ioctl$TUNDETACHFILTER(r1, 0x401054d6, 0x0)
syz_genetlink_get_family_id$tipc2(&(0x7f0000000180)='TIPCv2\x00')
lseek(r1, 0x20000, 0x0)

15:06:18 executing program 0:
r0 = syz_open_procfs(0x0, &(0x7f0000000200)='setgroups\x00\xb5\xd7[\xb6\x7f\xd1+\xcd\xbd\"\xaaE$\x8a+\xeb\x87\"W\xdfL\xe6\x93\x06\xe9>\xec \xc2\x83\xa2#\xceu\xd32<n\xfcJ]O\x8c&\x87i_\xee\xbb\x99(8P\x1bj\xcdy\x9a\x11\xb6\x1f\xa3W\xdb\xd0*D\x9e\xcf\xe2I3]\t\xf6\x1f\f\x06\xf5R\xa5D\b}5\xa3\xed\x14=\x90\x9c \x12\xe5\x8c\xb8n\xa5T\x8a\x0f\x1c\xa3')
poll(&(0x7f0000000080)=[{r0, 0x4}, {r0, 0x300}, {r0, 0x10}, {r0, 0x4000}], 0x4, 0x9)
writev(r0, &(0x7f0000000380)=[{&(0x7f0000000000)="6dfd57bbc4e23b3d", 0x8}], 0x1)
ioctl$FS_IOC_MEASURE_VERITY(r0, 0xc0046686, &(0x7f0000000040)=ANY=[@ANYBLOB="036d63e7a591bdf6a63227cc3a0021010400000000000083177fdcadd177d25bbdd6d2d795"])
open$dir(&(0x7f00000000c0)='./file0\x00', 0x2, 0x10)

15:06:18 executing program 4:
r0 = syz_open_procfs(0x0, &(0x7f00000001c0)='net/softnet_stat\x00')
ioctl$UI_SET_FFBIT(r0, 0x4004556b, 0x7)
lseek(r0, 0x20000, 0x0)

[ 1099.837177] binder: 32638:32643 unknown command 36795
[ 1099.851691] binder: 32638:32643 ioctl c0306201 20000140 returned -22
[ 1099.866841] binder: 32645:32652 unknown command 36795
[ 1099.890319] binder: 32645:32652 ioctl c0306201 20000140 returned -22
[ 1099.909890] binder: BINDER_SET_CONTEXT_MGR already set
[ 1099.914244] binder: 32638:32651 BC_INCREFS_DONE node 963 has no pending increfs request
[ 1099.918929] binder: 32645:32647 ioctl 40046207 0 returned -16
15:06:18 executing program 2:
r0 = openat$selinux_commit_pending_bools(0xffffffffffffff9c, &(0x7f0000000080)='/selinux/commit_pending_bools\x00', 0x1, 0x0)
setsockopt$IP6T_SO_SET_REPLACE(r0, 0x29, 0x40, &(0x7f00000002c0)=@security={'security\x00', 0xe, 0x4, 0x428, 0x240, 0x0, 0x108, 0x240, 0x240, 0x358, 0x358, 0x358, 0x358, 0x358, 0x4, &(0x7f00000000c0), {[{{@uncond, 0x0, 0xc8, 0x108}, @common=@inet=@LOG={0x40, 'LOG\x00', 0x0, {0x2, 0x30, "cd2d0993a00f7abe5bd7e96780fee41cfdae9dc346bedc9fdbfb58d86f05"}}}, {{@ipv6={@empty, @mcast1, [0xffffffff, 0x0, 0xffffffff], [0x0, 0xff, 0xff, 0xff0000ff], 'vlan0\x00', 'hsr0\x00', {0xff}, {0xff}, 0x3c, 0xff, 0x2, 0x1}, 0x0, 0xf0, 0x138, 0x0, {}, [@common=@eui64={0x28, 'eui64\x00'}]}, @common=@unspec=@IDLETIMER={0x48, 'IDLETIMER\x00', 0x0, {0x6, 'syz1\x00', 0x3}}}, {{@uncond, 0x0, 0xf0, 0x118, 0x0, {}, [@common=@inet=@tcpmss={0x28, 'tcpmss\x00', 0x0, {0x0, 0x80000001, 0x1}}]}, @common=@inet=@SET1={0x28, 'SET\x00', 0x1, {{0x8, 0x80, 0x5}, {0x7fff, 0xfff, 0x5}}}}], {{[], 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x488)
r1 = syz_open_procfs(0x0, &(0x7f0000000280)='net/fib_triestat\x00')
lseek(r1, 0x20000, 0x0)
write$P9_RXATTRCREATE(r1, &(0x7f0000000040)={0x7, 0x21, 0x1}, 0x7)
ioctl$UI_GET_VERSION(r1, 0x8004552d, &(0x7f0000000000))

15:06:18 executing program 0:
r0 = syz_open_procfs(0x0, &(0x7f0000000200)='setgroups\x00\xb5\xd7[\xb6\x7f\xd1+\xcd\xbd\"\xaaE$\x8a+\xeb\x87\"W\xdfL\xe6\x93\x06\xe9>\xec \xc2\x83\xa2#\xceu\xd32<n\xfcJ]O\x8c&\x87i_\xee\xbb\x99(8P\x1bj\xcdy\x9a\x11\xb6\x1f\xa3W\xdb\xd0*D\x9e\xcf\xe2I3]\t\xf6\x1f\f\x06\xf5R\xa5D\b}5\xa3\xed\x14=\x90\x9c \x12\xe5\x8c\xb8n\xa5T\x8a\x0f\x1c\xa3')
writev(r0, &(0x7f0000000380), 0x0)

[ 1099.949795] binder: 32645:32647 Release 1 refcount change on invalid ref 1 ret -22
[ 1099.979450] binder: release 32645:32647 transaction 965 out, still active
15:06:19 executing program 4:
r0 = syz_open_procfs(0x0, &(0x7f00000001c0)='net/softnet_stat\x00')
lseek(r0, 0x20000, 0x0)
setsockopt$inet_tcp_TCP_REPAIR_QUEUE(r0, 0x6, 0x14, &(0x7f0000000140)=0x1, 0x4)
ioctl$FIGETBSZ(r0, 0x2, &(0x7f0000000000))
splice(r0, &(0x7f00000000c0), r0, &(0x7f0000000040), 0x54a, 0x2)
ioctl$sock_FIOGETOWN(r0, 0x8903, &(0x7f0000000080)=<r1=>0x0)
ptrace$PTRACE_SECCOMP_GET_METADATA(0x420d, r1, 0x10, &(0x7f0000000100)={0x7})

15:06:19 executing program 1:
r0 = socket$inet_udplite(0x2, 0x2, 0x88)
ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f3188b070")
syz_open_procfs(0x0, &(0x7f0000000940)='syscall\x00')
r1 = syz_open_procfs(0x0, &(0x7f0000000040)='fd\x00')
recvmmsg(0xffffffffffffffff, &(0x7f0000003840)=[{{0x0, 0x0, 0x0}}], 0x1, 0x0, 0x0)
perf_event_open(&(0x7f0000940000)={0x2, 0x70, 0xee6a, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x100, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0xff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x10001, 0x1}, 0x0, 0x400000000000000}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
mlock(&(0x7f00005b8000/0x3000)=nil, 0x3000)
ioctl$SNDRV_TIMER_IOCTL_SELECT(0xffffffffffffffff, 0x40345410, 0x0)
openat$uinput(0xffffffffffffff9c, &(0x7f0000000080)='/dev/uinput\x00', 0x2, 0x0)
mmap(&(0x7f000060b000/0x1000)=nil, 0x1000, 0x5, 0x8000400200000033, r1, 0x0)
perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x2, 0x9, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2000000, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x4000000, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8)
r2 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)={0x10b, 0x6, 0x209e1e, 0x3, 0x1}, 0x2c)
bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000b40)={r2, &(0x7f0000000040), 0x0, 0x1}, 0x20)
r3 = creat(&(0x7f0000000640)='./file0\x00', 0x100)
setsockopt$inet6_tcp_TCP_REPAIR_QUEUE(r3, 0x6, 0x14, &(0x7f0000000980), 0x4)
unlink(&(0x7f0000000940)='./file0\x00')
r4 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r5 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r5, 0x0)
ioctl$BINDER_GET_NODE_DEBUG_INFO(r4, 0xc018620b, &(0x7f0000000100))
ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f00000000c0)=ANY=[@ANYBLOB="bb8f0000"], 0x0, 0x0, 0x0})
ioctl$BINDER_SET_CONTEXT_MGR(r5, 0x40046207, 0x0)
shutdown(0xffffffffffffffff, 0x1)
prctl$PR_SET_NAME(0xf, &(0x7f0000000380)='/group.stat\x00')
ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)})
ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0x0, 0x0, &(0x7f0000000780)})
ioctl$BINDER_WRITE_READ(r5, 0xc0306201, &(0x7f00000001c0)={0x8, 0x0, &(0x7f0000000500)=[@release={0x40046306, 0x1}], 0x0, 0x0, &(0x7f00000009c0)})

15:06:19 executing program 3:
r0 = socket$inet_udplite(0x2, 0x2, 0x88)
ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f3188b070")
syz_open_procfs(0x0, &(0x7f0000000940)='syscall\x00')
r1 = syz_open_procfs(0x0, &(0x7f0000000040)='fd\x00')
recvmmsg(0xffffffffffffffff, &(0x7f0000003840)=[{{0x0, 0x0, 0x0}}], 0x1, 0x0, 0x0)
perf_event_open(&(0x7f0000940000)={0x2, 0x70, 0xee6a, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x100, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0xff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x10001, 0x1}, 0x0, 0x400000000000000}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
mlock(&(0x7f00005b8000/0x3000)=nil, 0x3000)
ioctl$SNDRV_TIMER_IOCTL_SELECT(0xffffffffffffffff, 0x40345410, 0x0)
openat$uinput(0xffffffffffffff9c, &(0x7f0000000080)='/dev/uinput\x00', 0x2, 0x0)
mmap(&(0x7f000060b000/0x1000)=nil, 0x1000, 0x5, 0x8000400200000033, r1, 0x0)
perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x2, 0x9, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2000000, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x4000000, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8)
r2 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)={0x10b, 0x6, 0x209e1e, 0x3, 0x1}, 0x2c)
bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000b40)={r2, &(0x7f0000000040), 0x0, 0x1}, 0x20)
r3 = creat(&(0x7f0000000640)='./file0\x00', 0x100)
setsockopt$inet6_tcp_TCP_REPAIR_QUEUE(r3, 0x6, 0x14, &(0x7f0000000980), 0x4)
unlink(&(0x7f0000000940)='./file0\x00')
r4 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r5 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r5, 0x0)
ioctl$BINDER_GET_NODE_DEBUG_INFO(r4, 0xc018620b, &(0x7f0000000100))
ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f00000000c0)=ANY=[@ANYBLOB="bb8f0000"], 0x0, 0x0, 0x0})
ioctl$BINDER_SET_CONTEXT_MGR(r5, 0x40046207, 0x0)
shutdown(0xffffffffffffffff, 0x1)
prctl$PR_SET_NAME(0xf, &(0x7f0000000380)='/group.stat\x00')
ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)})
ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0x0, 0x0, &(0x7f0000000780)})
ioctl$BINDER_WRITE_READ(r5, 0xc0306201, &(0x7f00000001c0)={0x8, 0x0, &(0x7f0000000500)=[@release={0x40046306, 0x1}], 0x0, 0x0, &(0x7f00000009c0)})
creat(&(0x7f00000000c0)='./file0\x00', 0x0)

15:06:19 executing program 2:
syz_open_procfs(0x0, &(0x7f0000000280)='net/fib_triestat\x00')

15:06:19 executing program 0:
r0 = open(&(0x7f00000000c0)='./file0\x00', 0x101ffff, 0x44)
write$selinux_attr(r0, &(0x7f0000000080)='system_u:object_r:etc_mail_t:s0\x00', 0xfc31)
r1 = syz_open_procfs(0x0, &(0x7f0000000200)='setgroups\x00\xb5\xd7[\xb6\x7f\xd1+\xcd\xbd\"\xaaE$\x8a+\xeb\x87\"W\xdfL\xe6\x93\x06\xe9>\xec \xc2\x83\xa2#\xceu\xd32<n\xfcJ]O\x8c&\x87i_\xee\xbb\x99(8P\x1bj\xcdy\x9a\x11\xb6\x1f\xa3W\xdb\xd0*D\x9e\xcf\xe2I3]\t\xf6\x1f\f\x06\xf5R\xa5D\b}5\xa3\xed\x14=\x90\x9c \x12\xe5\x8c\xb8n\xa5T\x8a\x0f\x1c\xa3')
writev(r1, &(0x7f00000005c0)=[{&(0x7f0000000280)="12cef48e67d87fec5d6717e215e29dfafd75ad4c05f0122b8d8a043b13684283ebe773a050204078d1e0857a4c134341e065ecb408cafbd1a4a1b79eabfb35569b233314281d6697f784bbd6e5d639269f18b32044068eacb972e5e9b8f89c9fe21f13700cd112997d724fa259eb01676bf9d8e972f5d94adeeb70b13ddcfd77058a296f6cc2842ea66bfadeb0201bb9ebdaa596d1804586005393b24f98ee6c0fc53187b7a5b0a56ea99abaaec6928cb1c09525181f7a3441bda71aa3c87f8784300c5ffe59df0b971abc0d6c64b4d63a31a2716c4600a91647b05eb5350f9b9e68063364108d1128c147", 0xeb}, {&(0x7f00000003c0)="c02adfd650f589b3209377580ddd7a93aab769d6deed1c4e099f004414f2909044257cd0c59ac08ea5baf3", 0x2b}, {&(0x7f0000000400)="c5f9c58732bc151269ed08503caf3144d7778ba03771a9105424adf07c7d2c851dd5ad290d7b87683e2bd43beedaf312fa91b5825156a2129c75b6e9d1a32ae778022fd416f981438f6da415217c2206e46894286204db564954fa91d8f780a13ebfd1c0ab539190acfa02595d613193b37753dbe0f313a4942b9b21b937f59a8310f430ec24e8db6bdecaadaa8088c7b2aa889d20d2afab4d90ce6514ec2d551a6a5ceacd9c61d6fca4464b23c79b587726aacfdd6cd58e1635e9ee7c02a7bc01975b6d6811a0596a4295d024", 0xcd}, {&(0x7f0000000500)="7baa62dd87884dd44ec0313e66d87cd3ba91d169ed80ea040c887cbaff9bef98c94c35def76b3fb45028e991d7b1445f00f5b77bb9dcbbce6b549d3213868624e5192a6417cba8eb680491e6530c4560e5b0fc0f6c2222d4f49a4eb07573e04886963fadadb8df1dc25778d47480fd206e7a7cc75045e40aea1c621351e88540c916fc2c4ac3468734a298319f25b7366f27ec7f0fd5a42b7789", 0x9a}], 0x4)
ioctl$TIOCGSOFTCAR(r0, 0x5419, &(0x7f0000000040))

15:06:19 executing program 5:
r0 = socket$inet_udplite(0x2, 0x2, 0x88)
ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f3188b070")
syz_open_procfs(0x0, &(0x7f0000000940)='syscall\x00')
r1 = syz_open_procfs(0x0, &(0x7f0000000040)='fd\x00')
recvmmsg(0xffffffffffffffff, &(0x7f0000003840)=[{{0x0, 0x0, 0x0}}], 0x1, 0x0, 0x0)
perf_event_open(&(0x7f0000940000)={0x2, 0x70, 0xee6a, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x100, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0xff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x10001, 0x1}, 0x0, 0x400000000000000}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
mlock(&(0x7f00005b8000/0x3000)=nil, 0x3000)
ioctl$SNDRV_TIMER_IOCTL_SELECT(0xffffffffffffffff, 0x40345410, 0x0)
r2 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000080)='/dev/uinput\x00', 0x2, 0x0)
mmap(&(0x7f000060b000/0x1000)=nil, 0x1000, 0x5, 0x8000400200000033, r1, 0x0)
unshare(0xfffffffffffffffd)
r3 = getpid()
sched_setscheduler(r3, 0x5, &(0x7f00000000c0))
open$dir(&(0x7f0000000400)='./file0\x00', 0x0, 0x0)
perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f00000004c0), 0x2}, 0x0, 0x0, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r4 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000340)='memory.current\x00', 0x0, 0x0)
ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, 0x0)
socketpair(0x1, 0x20000000000001, 0x0, &(0x7f0000000100)={<r5=>0xffffffffffffffff, <r6=>0xffffffffffffffff})
ioctl$PERF_EVENT_IOC_SET_FILTER(r2, 0x8914, &(0x7f0000000300)='lo\x00\x96o\xd6Q\xb9Y\xa9\xc8J,\x00\xd2\x97\x04\x03\xdc\r')
close(r4)
rt_sigprocmask(0x2, &(0x7f0000000240)={0x6}, &(0x7f00000002c0), 0x8)
ioctl$PERF_EVENT_IOC_SET_FILTER(r6, 0x8923, &(0x7f00000008c0)='lo\x00\x96o8\x0fd\xa1\xe3\xd7]b}\x1f\xa1Y\xad4\x90\x9d`\xd2\x98\x00\x00\x00 \'Y\x17]\x15c\xcaR\xdd\x98OC\x89\x1b\xe7\x84\xe2\x05\x80w\xd2|D\x8dK\x14Bx\xcbuH\xc2\xeec\xbf<>Y\x1a\xfc\x1f9OB\x81\x89\x186\xc5q@n\xb4\xb6s\xb0\x00\x00\xfc\x00\x00\b\x00\x00\xda\xef\xecE\xec\xd5I\xb2\x9b\xfe\x8d\x90?\x00\xe9\xe4~g:\xc1\xb2aj\x96\xbb\xa7\xe2\xc0\xdc\xf9Q\b\xeb\x16\x7fT\x11\xd3\r7\xe6\"f\xcf\x8e\xabd\x0ftp\x82\xae\xd2\x15\x8e+c\xf6\xbf\xe14>\xa6-\xa5c\xde\xd7\xab\xea\x1f\xf8s2\x9cVF\xd5\x18\xfe\x0e\x8f \x01\x00\x00y.\xfc*\x82\xa5\xa1p5\xc8{\xf7\xef\xab\xe8\x99\xebw#\x8at\x1c\x80\xfc\xb0\x95\xa2\xa7\xd7,Y]E8\x83X\xf5F\xdc\x88-\xf5\xb0\xb5^\xdb\x1a\xb6\xaa\x14\xe2\xb9\rh^J-\xd1\xbaUn\x04\'l\x1b\xe0o\xdb\xc8\x91%\x1c\xb5\xbf\xb6\x90\xb4\xc2\x7f]/\xb3\xe7\xc9\'\x94\xcfIo\xdf\x04\x95\xb5\x06\x84\x1fH>\xda\xc5\x04 \x94\x88\xeb\'\xd4;6\x7f\xd9\x99-\x1b|G\x8d\xd4\xb9%\xaaQ\xa0K\x10\x03\x93\xe1\xcc\xe7m\x80\'\xf0\xa5\xed(\r\xa8\x0f&\xb1\xf3\xff0\f\x82%_\x92\x8bD\xb9\xd9\xe7\xf2\xe4\xc1i#\xdc\x87A\xb9\xc7\r\x92\xfa\x11\x11\xb5\x1f\x03\x9d\xdd\x1bj\xdf\xacg\xe3\xa0S\xd3\x8a\xe1n\x97\xea\xf5\xa0\'\v\xe9\xa0\xf1 f\xaan\xcf\xb5i\xb6d\xbc\x92\v\xd58\x16\b\xb3_:\xa4!\ny\xc4&\nWMM\xa8\xc4\v\x9f\x01o\xf4\xab&\xb6\x17\x02P\xc3!N\xf4\b\x1a~\x91V1s\xe9\xbe\x9e\x9b\'\xcde\xb3\xa1\x86\"\xd7\x04\xf1\xc0!\xed\xff\xee$\xc89\x8cB0\xd1dD\xe0IP\x88\xa2\xf2Y\x9af$$\xf1cO\xf7P\xac\xca\x80:!\xb4\x94#\xcb^\x9f\'\x03\xe3\x93\xb9\x82\xbf\xcf\xc4\xe3\xf7\x03Oh\xf2r\xca\x8ff\xbb/\x9f*\xaf\x1a \xa5\xa0?%M\xa5\x86\x98\xf24\'1\xc7\f<\xcc@\xe8\x8a\xac.\xde\xe4\xc7\xf5\x9ck\xa40!\xe9\x14$\xb3\x05m\xb5m\xed\ft\x93\xd8\xa3\x80\'Y\xb9\x05\xbbt|\xbe\xbcz\n\xf3\xf5p\xf8\x9f~\x1b\xd0\v\x1cQ')
getsockopt$inet_IP_IPSEC_POLICY(r1, 0x0, 0x10, &(0x7f00000006c0)={{{@in6=@loopback}}, {{@in6=@initdev}}}, &(0x7f0000000500)=0xe8)
socketpair(0x2, 0x2000000080003, 0x100, &(0x7f0000000480))
syz_genetlink_get_family_id$SEG6(&(0x7f00000003c0)='SEG6\x00')
sendmsg$SEG6_CMD_DUMPHMAC(r5, &(0x7f0000000580)={&(0x7f0000000380)={0x10, 0x0, 0x0, 0x1000000}, 0xc, &(0x7f0000000440)={&(0x7f00000007c0)=ANY=[@ANYBLOB="2300260109447a0000000000000000660000001400001a0065a455e04ea56d0a47018c8e973bcac914471474a7e0d50a000eadd66d2e49a2ed40dcafa1e046ab6aacc2097d8f75bd9c8b8a220bdde116774efa3f9600f22ab388644f66c2d5baec4079a81bae1927e49e91a4964656d7b227702926af5be846f3de49fad39048633fd9161123894d9427f8bcff89196854a30cb0532c8f31f663380e40ce7f6cb15ec8baab3b7c6f"], 0x1}, 0x1, 0x0, 0x0, 0x8000}, 0x804)
r7 = creat(&(0x7f0000000280)='./bus\x00', 0x0)
arch_prctl$ARCH_MAP_VDSO_32(0x2002, 0x7e)
ftruncate(r7, 0x2008200)
open(&(0x7f0000000140)='./bus\x00', 0x4000, 0x0)

[ 1100.546751] binder: release 32638:32643 transaction 962 out, still active
[ 1100.561306] binder: send failed reply for transaction 962, target dead
[ 1100.572336] binder: send failed reply for transaction 965, target dead
15:06:19 executing program 2:
ioctl$TIOCGSID(0xffffffffffffff9c, 0x5429, &(0x7f0000000180)=<r0=>0x0)
r1 = syz_open_procfs(r0, &(0x7f0000000280)='net/fid\x00')
r2 = syz_genetlink_get_family_id$nbd(&(0x7f0000000040)='nbd\x00')
sendmsg$NBD_CMD_CONNECT(r1, &(0x7f0000000140)={&(0x7f0000000000), 0xc, &(0x7f0000000100)={&(0x7f0000000080)={0x5c, r2, 0x0, 0x70bd2c, 0x25dfdbfb, {}, [@NBD_ATTR_TIMEOUT={0xc, 0x4, 0x677}, @NBD_ATTR_BLOCK_SIZE_BYTES={0xc, 0x3, 0x6}, @NBD_ATTR_CLIENT_FLAGS={0xc, 0x6, 0x1}, @NBD_ATTR_SERVER_FLAGS={0xc, 0x5, 0x8}, @NBD_ATTR_BLOCK_SIZE_BYTES={0xc, 0x3, 0x6}, @NBD_ATTR_TIMEOUT={0xc, 0x4, 0x2}]}, 0x5c}, 0x1, 0x0, 0x0, 0x20000000}, 0x40)
lseek(r1, 0x20000, 0x7)

15:06:19 executing program 0:
r0 = syz_open_procfs(0x0, &(0x7f0000000200)='setgroups\x00\xb5\xd7[\xb6\x7f\xd1+\xcd\xbd\"\xaaE$\x8a+\xeb\x87\"W\xdfL\xe6\x93\x06\xe9>\xec \xc2\x83\xa2#\xceu\xd32<n\xfcJ]O\x8c&\x87i_\xee\xbb\x99(8P\x1bj\xcdy\x9a\x11\xb6\x1f\xa3W\xdb\xd0*D\x9e\xcf\xe2I3]\t\xf6\x1f\f\x06\xf5R\xa5D\b}5\xa3\xed\x14=\x90\x9c \x12\xe5\x8c\xb8n\xa5T\x8a\x0f\x1c\xa3')
getsockopt$packet_buf(r0, 0x107, 0x16, &(0x7f0000001780)=""/160, &(0x7f0000000380)=0xffffffffffffff77)
writev(r0, &(0x7f0000000180)=[{&(0x7f00000000c0)="2b9a4d1d832a82a5032487bcbe78a7b6926048d4ba0f03ca3e0d2f3380ac94beb0c3b4ccf1ac5c4e27156bfdb479c4e53b5af5b4c8cc1eff0cfcf515b9a79baa6d8ca5dbdbe6bd18ab88152dc60982505adc304ea9848ba6fb6bcbf6791888738eb0b29ff89816e0a49890d7558f25b64a398f9e2ee95fd6af743cf2d5e1d16a8eadfbc723f0b8e5f94f257a49489ee48ea362"}, {&(0x7f00000003c0)="aeff46c530e3ba81ee27fa6e446c1f45a226a4b178e59435d15c87dda0914e8dcae3d49a860fac0142964ea95477ac6e978a8c1178f103435806cc4512dd7d1c753732cece2e4c8568272c5087507ea36dac706decbc1dc74f116468d14d3d6b31e9134fa55d7316ac7fcfb4bb06364453645d9548637b8c1556ae96f638eb208c59a2a86ad3df8613ff2eb80a18b126e492e073f71eb0835350c0481f2235034cb6b869ab3c211e345e60e6bcd33c511af24dcd2d347c92246f65fe5d0fc85cd1c1253405cf2c62f91a1aa7120e4514c440f624555dcd2a5de77383682e59d553e44bf836c2eadc154a9c6464f4b6fa924b3fb3062346e126314f3fa90b3445138dda939ed6efbd29e76a25e21059c60ccbc19d3e04583a7e0e9575eb0cbc6529ac11c0148b377dbb11269dd9cddb12d351187632b8aed1b978067595d3868113c20216de436361b525bb4e47c40414240e92db9a7529618545b6161f764f93aba96e6b2f7f6292d62a8221a06695deb15dcb0dda2a7d0381ed3f1efe26c2698810e2bcbf933bdf1a9c97cb68bf1c92a6602478978f0a73ffec33a356bb72b90126e37bd786782664aa2ddc99666b43abbe9068324061d93b3f91c9fc2e77f5611f6c4b34cc1c7d264f09b21be13a4b02d4e6adf0c447d4188c7a637bcc1e49de024e2657d60961e90dab27505adbb6237bf9b7f5eb3cafc251a491182cc1d4f99e4734c8bfcbe28c93bdf51a84f1f15ebf16efc065e0710d84c49a748b94e56d08378d94b71ce1ad0cbf4814e3a4d245ce44a297691b5d33054ab53c08b73be882c6546908997f3c4725013db8c43f670c122790288c024643c91efa56f1b3136ad4c2bf54f617887fb4fa823ebbf1ba505ae651c4b533ee5d0722b2eef35fc185f8521c862bbf99cf969395aa9559f314215aaec2d793e5e7e2a9a9e5db92c9d92ff3a7e415729b2c3dbbf3d55ee0657293cf37f54ec737c813ff29d7d29c2cbe0d35c6a6570e590af34dcf3273ca5abeb4b4aeaf5832d3d5e600ea0701c7a4a47d5080d04b5bd34745857b2df202dbbf76454407595cb2a955cb49855d276cdce5a5f3170a710d22376065547ddbc7466c75684552ef51f1921b05e3e1c2b383f31cbfedc7d98c282bd6a9baa05925632c8deb62e179c9219027766eb9f7b791c67b64824630a7cf69aeaaf20349862735cc78afeabfb18b87cf0c71fed7cd41a0b0fe7fe5b5eab069ac2e531dfd7ed50812c7178f74261ef59f063fa4e59ecc106e718842704414fbe1ef8e00c6b1dafc2b0acb57e4389f452c671c2ca81cf62a009e12248cb9a136296daef9ffa15cb4c968d1459ab852425c3243690a89d3dec34e998724f1baeab365bfb583faf8cce75f44a9d8fb9828f273929bfbda3c7b7448ea8f73ce6ba04ebf0799a828c91d14df8a444a4806ea9c41eee7f428be3a4eccbc2ebd07df86ef31b4c808e5fd4518e555f145b09fec338fdc4adffa3392a04285c2783f5aa3aefd402ee3979930e4e006c1e066068ba7a2c8037f5b738a8363f4c4ca877448e0815124dd73b148bc66a13108824b6182db6bc7fce8ce5cfe8b439176536e81a254fe635c97e3316015def0f339ae4bde38c3388a05b6639cc9e4f83d81e5660983ab12e9b3e26ea8d88ce576768fca37eaa7c9e949772e6533a34a932c5ea182e42b5c94b52e1dbb282a146ad082bf307f5f610d6a751f731e5ee8ce1a6c4cc59bed35235ae4b92f8703cc7681f9dc9ca1591f7708f24ae86d8b0442a7922cbe9d09eb8f10fc972a371f7d745bb1144a339b99628157bcc4f9f4fde07785c1de71a0ce4c66bb8e71431a8466861adfafc60351f4c7f3320cbe3d634a4fa4ecbc6602a7a49eafe741509ab8964d255a8eb5ff07d38815eab1b42c629427ab8c07d594cadf3fd2b9ce8bbc517673dd409265de7991ba58563bd470123f2bb9acc7d759468e435443c543de32e367e689878535c116e08bfff04eddb87c1c6584f598d81c5eee31434effaa5ec15e110ddd783ca3ca7a7a5ed22b1fbd8c46e03e752aedf050117f43a7151e63fc1fb32daef4e30329d655de1b3a0ee0fe1b392eed849c5ce0e27387e68baed30fec0f0b53053fd2d3f06b532bb8c974118a7ddbcc2ba120d051051d54b3c56f3ce2ecbe94dbcab207853bfc353c5cab371591da82f82d9b3bbf362124953e8fb632b9e2f321dbaa5820457edc0bca3e762070cd456f7c874bec93da925067155fe37797604e02fe81e11924302bdf0e8701ee731a964ea72f9ca52aca3bf876aa9b1147cdf5bc88f39d7920858bb97a5856f9cd72462de75f8eff703c91c5b6c3df17ed3ca4213841c2d5f5854a0557723d0b9487c7b41858b0116fe0f70fbd1e83a70c26bd9c5778d278b5a643c375e536a7f18e2f9d1a167bc336c5735d273fd8a76219e0f1ead81e6d7dcfeaa794b76aa15581ac57409a0c07b6f4fa2b021aac671866b1bd276196461050ca84ec54f453198efe172986b65e142cb89d3feaa055b4c573f48a6948806b51f8fe599c9a846fa3bf375e6735a3f6256050c67bb9d5c25ae1593a05b0deaa40837e0da9227e7f7de156ff053dd97506e0d841c06ffd0d6f9e8ef3903d367b481e54aabdf10f3635693a910e7e78435b4fa85469381638a7b530b12887586a23be39d8ed305cefb96ec409efaf2beb639f0f20007335a994769722ae52c10b2e79f40f0567cbd4533e4bc6d6f0aa164520039ba497979a4a86ce87a16d9bc2230c59a4e4c910aee2bb887b964a8b4640639539e9c37639576da82ed46fd2fe0b36869c53f9856f3a7326802d2d6132c0ae1c8afc9df428dbb66d6e21260cf704d1b2a81e80315cb03fce1b1593da950ffb29454b65013191cba2e2a4001431404b752a86cadecadfb264449be88c27806f5bfa7950c7326387c36034bd14bf3034414fe2b5e8c246f73e391d7937c435ee568dfab92ed284bdb429ef7190052dd054e9cb3d4aca3811be5f45955b8b2f0d8e908daab0a311ff1b4117497bae7fb7fbdf6afb139831d4506b705ea87cff614eef0ba712501195181d29342e08f72ede854071417a1910fde30e412d545c968e53f27dfe2c22553dcda8f014da41252f8a9d930bb130992dfe23469765fe1c83043ff611dea49e447c18106b10d2faddee90e390e980845408bdd3df0e90d0ec497b6be7c1135cac68420322e77dc6058fc808327bef8fcfc61f3295edee148ed02bc68d571a4c9747ed8d4881d8d2710f7cf25790602ee5b85d6736d9a49d73b5032d2df8abd09d3c6209665c11280413651aa649debbc75e6d3c7409b95b365bfc49cd4f74031ea0d06389888fb9dbaa824dd2bdd19ce63adf4d85bcbdcb103f8a21f2103e2d9b28a8c500ad832e672a2b11195463485e8377ba3fa00ed07e76993fbe6e7a8a0e561b4e09e8ff7e6ff7128a278f3267941e5a03aa35e9cf6f9ef53d7eb019a8048d2145bd7572b0414b4502b333965ce74b4b20347029ea7a99c2b3ccb267604a56857bb0bb2437f571349ce6cb4c68a7332b44fcceb0e11add61c58d245f18a6035a7edf0e8784dff1b0473f3b005f228358ec1a68088062a92660a27c01be167033baf4b8fa48b8739a3c746f13a3c82e9278d489e46e0c5ad2f32caefe095dba28306642102b3ac6af889d676cd250ca69c43c270a2eb301b1594381004b29e8847a3379da6b0455dc2da67e8f421f3333aaf89884b9ff2610847f6488737e8a3af47ec50833f6960969ecd1c3a271371034ed811ddf28e07af3437ddb26a993418c7a70d54f1f612c82020465b8c42bcf53133ed7560b69b1405cac4ce791838feb08d7053db93bdb4008b7c1d80849227cd1ed830041cef6f5a6c433b29eff95c6ceb42724cae494d64bfd87b8cbbbb52ef8b01c7227001946ecf7606586d068594df3fc8e675b4ea240a6355cfbb54588d33ba516d7d26eaf7461913d2ccb736dc65c8d370bff3d3211d2162fbd39b7cb1ff3d57e4cf76aab1b180d571fe03efd89a684c15c9c3d63dcad3253111a8d073ef612fc74b6329649b0c3183a93ce8cacbaed0fbd7b09e3d53310cf11481b1967228d693c2f1b6985c1cb268a0cc17c2cd16af5c87b196714df926e2cdcf171ce23637be9f9c4376197a160dfd4417690feaa21f28efb213c2138a28417cfb69533cc0bab1cabfad277088459958f58dca3f8b2008db783fd2e48332170d115a8c6a3157d435dcd5046e45d00b00f232a541bea2b6de00f49090d913616bad567dd84a69b64245244c688950ee70abe17f82e8c6a398a41d61f5ff483e0d4128f36c36c2c5c99cd535a4e39e91cfb02fe45ece6621dd422e30abe788978eba8ddf04707d0ceb209e57933608543b56886432acaf0819351766781b58a4a253acb39889f9fbd62cb883bc5d9566c986d16c67af2ee25fe71d24a0fe69b927fe8f4b43a50b9e4dbab60d7f22740450310d2626a46ddd66c90d9986493541c859606103f77509b6e451513e8f028540c57b3de4e9d429982619fce6af22b48997d9d9a2d5d22a3e83ea23c6d628b0991032f709fd0618749517861b927b88d4087f1605df7d9111136e886a1c7bd5c6550dab0fa99ac86ac499f13e8559510e4fca5473443cba660238c2430b72577a234463c2ca407c7e62657aa7f4dc1de3a1efcee4e3af51b79e7ed2306f07813cbdcea94747ca7089ca184153256830c99ccf081462eb558127ae716bd5d771f3fba5c051511ec65a4fe076c31fe1c3a71ad18a3b652cb0ac78048d7cd0786f3a4732ec8c7effbee60a271bd97c18f9bf46ca9bbdd52c45cd472d363873cb10fff464582eb4650f616ed7e7606af60f8112203a7e1b63d478187a9e7ef837493190f3c8bd19b138efe4af34866fa0ab65c4b4ec6dac3537430cc1262e6a485f9d545378ba9ebd92b87bd71b30c7faba622f925bcdadb007cf1cf134487443479096c595c562572f27826167bf5cea4afce33743e2ce49370be0ee14074c82ad68775fb4f6826d2c6c79d45c5c7b5cef52d38671248d8c1b3c2b89d602ed8e2503716c2f5a14fc7ac9f7715365628614a2874a38daaf1bf05d6ede868723207922fc3210b6c729b95685c84f4a8f37331f4a698e1abb17510b8e9c58f0140e627f889a5472f208b564b9ea0a8cb50e85a0633a9f134f44b94bbb4fdc0f781de8b9ef2b295a2406f997eb87d92db11b49db7dd368c89bb140300fb66b1d78bf3156098662e72d137d199f8ef2a9c7ace9acee548c42a715975598786b822bd66a3247312c8b8c8e851e602162249813605e2c9f972dc62cfb4d7e89464da4dc5aeb7f45b9002b8b16d0cca6877d7db60ba10107c98d3a6c0e1388e3aff6b1e23b1078211c2db6f7d15d25ddc4b339f10c353251028ad8bcaba046adab32753be5ff85ca907e3a9600b043a195788e76622d828771fec7a60d9e387fdb7fd1485c69b03249e2756786c4e7501d1be0743eb8ed40b554f3719fcb8f581b4acce6a16663be3c486b3785c370f9345ddc31e2045f577f381253c053d38c2a7994464b437f0c81e6ddcfce83640c92f167a8d77588e74f9c45798821465ce3aef5330f35814e24b9d7621b902086798b0f3c564c3793c1c803ddbff51e1cfbc32226e730dfcad0fb3255fba18ca441e7ab2595b0fcd2ff01a7d25bdc4b9659e5efb91364b274ce4b82c59e6a2555e9a133b45d6d0ba9c3d46400033f4b5b158fb4c6e7ac94c9b4e34e635bf2c2bd6a0f975d480fc5548ec852fe3ade1e4c0c2f0b999e608"}, {&(0x7f0000000280)="1386b75277761de732d2fae1591e1984e2e42651da187fa19cbd61708e3284ce445f6dd800f902f385a1c353f90f415182bac7367a30b67599e8ddcb618a24747c21fde099feba496a7ac3984ece4d2b9d48663b14d570c21ebf14563708ea194249d1db7c526e18cffa8f8c28da7e720f2de1d2d61ea93b621d0cbd3b7999e06b5fec01de985a772d6285259af0f68dfc1386d9a2c79869d8961bbeed68c06c3d0c94269ef28a9b0d1a7c74a7b6eee204ffba1b6e158b3b9f"}], 0x1)
openat$null(0xffffffffffffff9c, &(0x7f0000000340)='/dev/null\x00', 0x0, 0x0)

15:06:19 executing program 4:
r0 = openat$selinux_policy(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/policy\x00', 0x0, 0x0)
ioctl$TIOCGPTPEER(r0, 0x5441, 0x0)
r1 = syz_open_procfs(0x0, &(0x7f00000001c0)='net/softnet_stat\x00')
accept4$packet(r0, &(0x7f0000000040)={0x11, 0x0, <r2=>0x0, 0x1, 0x0, 0x6, @remote}, &(0x7f0000000080)=0x14, 0x0)
ioctl$sock_inet6_SIOCDELRT(r0, 0x890c, &(0x7f00000000c0)={@rand_addr="80e7f2f87c6931d07837b129fa71ec0f", @mcast1, @initdev={0xfe, 0x88, [], 0x1, 0x0}, 0xbc8c, 0x3, 0x376, 0x400, 0x1f, 0x200, r2})
getpeername$inet6(r0, &(0x7f0000000140)={0xa, 0x0, 0x0, @local}, &(0x7f0000000180)=0x1c)
lseek(r1, 0x1fff8, 0x3)

[ 1100.694308] binder: 32684:32692 unknown command 36795
[ 1100.729794] binder: 32694:32698 unknown command 36795
[ 1100.736302] binder: 32684:32692 ioctl c0306201 20000140 returned -22
15:06:19 executing program 0:
r0 = syz_open_procfs(0x0, &(0x7f0000000200)='setgroups\x00\xb5\xd7[\xb6\x7f\xd1+\xcd\xbd\"\xaaE$\x8a+\xeb\x87\"W\xdfL\xe6\x93\x06\xe9>\xec \xc2\x83\xa2#\xceu\xd32<n\xfcJ]O\x8c&\x87i_\xee\xbb\x99(8P\x1bj\xcdy\x9a\x11\xb6\x1f\xa3W\xdb\xd0*D\x9e\xcf\xe2I3]\t\xf6\x1f\f\x06\xf5R\xa5D\b}5\xa3\xed\x14=\x90\x9c \x12\xe5\x8c\xb8n\xa5T\x8a\x0f\x1c\xa3')
r1 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000080)='IPVS\x00')
sendmsg$IPVS_CMD_DEL_DAEMON(r0, &(0x7f0000000100)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x10000000}, 0xc, &(0x7f00000000c0)={&(0x7f00000003c0)={0x144, r1, 0x0, 0x70bd2d, 0x25dfdbff, {}, [@IPVS_CMD_ATTR_TIMEOUT_TCP_FIN={0x8, 0x5, 0x3}, @IPVS_CMD_ATTR_DEST={0xc, 0x2, [@IPVS_DEST_ATTR_PORT={0x8, 0x2, 0x4e23}]}, @IPVS_CMD_ATTR_DAEMON={0x40, 0x3, [@IPVS_DAEMON_ATTR_SYNC_ID={0x8, 0x3, 0x4}, @IPVS_DAEMON_ATTR_MCAST_GROUP={0x8, 0x5, @remote}, @IPVS_DAEMON_ATTR_SYNC_ID={0x8, 0x3, 0x3}, @IPVS_DAEMON_ATTR_MCAST_GROUP6={0x14, 0x6, @ipv4={[], [], @empty}}, @IPVS_DAEMON_ATTR_MCAST_PORT={0x8, 0x7, 0x4e23}, @IPVS_DAEMON_ATTR_MCAST_PORT={0x8, 0x7, 0x4e24}]}, @IPVS_CMD_ATTR_SERVICE={0x34, 0x1, [@IPVS_SVC_ATTR_PE_NAME={0x8, 0xb, 'sip\x00'}, @IPVS_SVC_ATTR_AF={0x8, 0x1, 0xa}, @IPVS_SVC_ATTR_AF={0x8, 0x1, 0xa}, @IPVS_SVC_ATTR_PORT={0x8, 0x4, 0x4e21}, @IPVS_SVC_ATTR_NETMASK={0x8, 0x9, 0x58}, @IPVS_SVC_ATTR_PROTOCOL={0x8, 0x2, 0xdf}]}, @IPVS_CMD_ATTR_TIMEOUT_UDP={0x8, 0x6, 0x100000001}, @IPVS_CMD_ATTR_DAEMON={0x50, 0x3, [@IPVS_DAEMON_ATTR_MCAST_IFN={0x14, 0x2, 'bpq0\x00'}, @IPVS_DAEMON_ATTR_MCAST_IFN={0x14, 0x2, 'caif0\x00'}, @IPVS_DAEMON_ATTR_MCAST_TTL={0x8, 0x8, 0x5}, @IPVS_DAEMON_ATTR_MCAST_IFN={0x14, 0x2, 'eql\x00'}, @IPVS_DAEMON_ATTR_MCAST_GROUP={0x8, 0x5, @multicast1}]}, @IPVS_CMD_ATTR_DEST={0x50, 0x2, [@IPVS_DEST_ATTR_U_THRESH={0x8, 0x5, 0x7}, @IPVS_DEST_ATTR_ADDR={0x14, 0x1, @ipv6=@mcast2}, @IPVS_DEST_ATTR_FWD_METHOD={0x8, 0x3, 0x2}, @IPVS_DEST_ATTR_ACTIVE_CONNS={0x8, 0x7, 0x6}, @IPVS_DEST_ATTR_U_THRESH={0x8, 0x5, 0x401}, @IPVS_DEST_ATTR_FWD_METHOD={0x8, 0x3, 0x3}, @IPVS_DEST_ATTR_FWD_METHOD={0x8, 0x3, 0x5}, @IPVS_DEST_ATTR_U_THRESH={0x8, 0x5, 0xffffffff}]}]}, 0x144}, 0x1, 0x0, 0x0, 0x20000085}, 0x8804)
writev(r0, &(0x7f0000000380)=[{&(0x7f0000000000)="6dfd57bbc4e23b3d", 0x8}], 0x1)

15:06:19 executing program 2:
r0 = syz_open_procfs(0x0, &(0x7f0000000280)='net/fib_triestat\x00')
getresuid(&(0x7f0000000040), &(0x7f0000000080)=<r1=>0x0, &(0x7f00000000c0))
lstat(&(0x7f0000000100)='./file0\x00', &(0x7f0000000140)={0x0, 0x0, 0x0, 0x0, 0x0, <r2=>0x0})
rt_sigprocmask(0x1, &(0x7f00000002c0)={0x8}, 0x0, 0x8)
r3 = getgid()
ioctl$TIOCGSOFTCAR(r0, 0x5419, &(0x7f0000000300))
getgroups(0x7, &(0x7f00000001c0)=[<r4=>0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xee01, 0x0, 0xee00])
fsetxattr$system_posix_acl(r0, &(0x7f0000000000)='system.posix_acl_default\x00', &(0x7f0000000200)={{}, {0x1, 0x6}, [{0x2, 0x7, r1}], {0x4, 0x7}, [{0x8, 0x2, r2}, {0x8, 0x0, r3}, {0x8, 0x1, r4}], {0x10, 0x6}, {0x20, 0x3}}, 0x44, 0x2)
write$selinux_access(r0, &(0x7f0000000340)={'system_u:object_r:iptables_initrc_exec_t:s0', 0x20, 'unconfined', 0x20, 0xffff}, 0x4c)
lseek(r0, 0x20000, 0x0)

15:06:19 executing program 4:
r0 = syz_open_procfs(0x0, &(0x7f00000001c0)='net/softnet_stat\x00')
lseek(r0, 0x0, 0xffffffffffffffff)

[ 1100.749750] binder: 32694:32698 ioctl c0306201 20000140 returned -22
[ 1100.763743] binder: BINDER_SET_CONTEXT_MGR already set
[ 1100.770597] binder: 32694:32698 ioctl 40046207 0 returned -16
[ 1100.816191] binder: 32684:32712 BC_INCREFS_DONE node 970 has no pending increfs request
[ 1100.829339] binder: 32694:32719 BC_INCREFS_DONE node 973 has no pending increfs request
15:06:19 executing program 2:
r0 = syz_open_procfs(0x0, &(0x7f0000000280)='net/fib_triestat\x00')
lseek(r0, 0x20000, 0x0)
ioctl$EXT4_IOC_GROUP_EXTEND(r0, 0x40086607, &(0x7f0000000040)=0x1)
r1 = openat$null(0xffffffffffffff9c, &(0x7f0000000080)='/dev/null\x00', 0x4000, 0x0)
ioctl$FICLONERANGE(r0, 0x4020940d, &(0x7f0000000140)={r1, 0x0, 0x8, 0x80, 0x21e})
setsockopt$netlink_NETLINK_BROADCAST_ERROR(r0, 0x10e, 0x4, &(0x7f00000013c0)=0x9, 0x4)
setsockopt$inet6_buf(r0, 0x29, 0xee, &(0x7f00000003c0)="3a8677373edbd7c9611a7fade39040180e0d594ae94c4c2e4ce6b4e91d14fc2b891d632e0033fb7493b694cfa0728b5ccfc866100a560b5b4b14988c5dfb38912d98408edffff26a21a2759537d0b094c4bbd739fdaaeb919c1b6d89d8f93f8b30502937f8bdb38c27549aeee53a05a082b53fe6d3b879ef19aa81d194e5d35cc2f34e0d3b68a70df644a241bbc353e1627529ee31ea3e19a5957097fefe4ff0edcb7002d3bc0c647e4c405825bfb30fe6bbabbed9a7fb56579465736ad8fef5cc02d09d18df691b18d1d9ace014b40ee75a93a9fa743c057f4a4eeeb535916d0bbf478a80b634ee0403508f10f83675a4003196882f824bdeb7751d52b5a21a2460ad767e4d4d39d82bf78d82d6c99d2475c7225c1e2cadcb3159ec2ff890a5f56689b607f1b74a458a389a480448916f1495eb671146b5bd119e8d32ec29a49aed55bb416a664af898c3e3f33fc1a50698389fe205353a2fd0973261504b697e2edfd685f36009425ef01abaa8d6f046362fc28bea18351f3e278726a8f74d2901a0d1fb05fb82ef15f9695f45f3ab1cecaf6eb70316d7c7646d451180ca9a6211f1138776c37b41f032c6b1e9fb212ddcdd34fd5ce68b014c4923996fe95ac40c000abde67f4ebd6f63d2d453b32341074189880e40a47770265932a51145580b4993364847c1f0ecfc9de202cd0e5e8c8b72fbec0589e04eda0e5f83c60b0f5077830da477dbe400b33051d430cdb2d46847a3edab8dd9be23ae8d42f20da1467e9c067cb7b68213266a54438ca649b2e537c62ee3fb2e755a6982f6b623749ad50d49c5a56a24aaad15ff31abc12990d06e8ad0e4d77b62bd5caa8309fb2b7ecf777abacf9755af7e7ac2a1685977d779c822d221adeff6470e2fb6d3600eaa6530f5865eacebb40ec7fab104c7169011ab280661479688a2566498d620445d7b8f6daa6e377a3df9a416c1158f56394aefbd73075f96af790bc0f1752c725613d6f2b0e90edf9b3a2f5e9f0f6c1003f3d3c336d599f93e41f7b7a7b076168f157df12f1c36e81ab2e11c858773bb81f97b7d7461ed576083fb9c31f2bad9cf8e5e2e085184d620a600ce1293adc6ba0f512b09face6f49731e0850cafcd0837281260c09c45eb26b03c34251d96835f0781043823600d002dc9fe5b09866913c65eefa1de8ff7f056b62b86c5b23a5305d3ccc1183219ac800cba14ccf22d6074fbbd80abc0272f03f3373212d71f3a12c95a7679ac9ae9bae7252475ebf008e81b9d91c673827918f1277474374a495cd413c3b1cbe894140b423569fb46b4c53158f515ae05a6c9696263dddb97dfd5e95a3e59e08116f5bf4612b93be3510d0e31e7c4abe87c934b396e2bb63a2189ec00ae5084c062260d756ed386db1d5eed8bfb8c5aff2a7a03dab53cc63c5fecd810707e39b5660c362e720ea84ad9581f141efa3dd892635e497532096b7038cbb159352d02044406fb86d58bac6c5cc37aa57b73ed21c4771bc730b04120cfa9067b18035840b9da9d487aae4b1c926c158047223fd6ee4df6cf40f24f1033852f384fd37d98d64ef28c37cab9a293e02b4a7f583d5ca1ad5fb6fffa38b1eab3c6765e37a26217e822581c273ef8fa7a94d5de9aef018f0f1fff99010a53754b09dd54bdc93911386c99abcdd4ab1df92e6a660c76c9f41725fe57f3085d9d624f966ccbc9db616199f22695c89f47818643a3a4e878b31fc5dbba26b37fd33a204cb6b410595f9ea86f7f165c8d20e251fb7d1bd5ace1c11db1d03c87f5cfef53a064f4e51490c3914cc972ade556c78f03f812095fb768577767623cf9c53f4f9a086525794e62659c4c576aa8ef53da42373ee0a4fa2df7e247d5cad9988030d4451f67fcad4ef2132899b1a90fe2aac9e999be86528233147422bde2c469b23455cd2a7f80a15d127cddeb3503140a4775a1ededa5c7783d68a36baeb5447fc83173ff7f3d26a9ff83f82160c45b8452cc396e629e4c0d4fee9f86368a0ea2b835eb9b1ccb7d5a2975f214d0b254ecd86d4cae2fef3ccf324bd610ea7eeaba46ac8fa8f6d6ae2be2e085638d595ae2eb6693eaddde98a3acc935cfdb58a1f7fff04e9e935fe8343bc7ba2f9b9b70dbe6b0493d295a77032ca6b95fb95134a613b755aff9b8340677bd16e14d2718d4694e7a9bbe7df3276f18514273dea0f5d8e47928ff0f0d8b00b34ab349f7f7170445e0d1c8b477d091527678f494e0023ad6f7a106a26f8ccb7912e329c7247bcd3f3439e20077f42ee954f99e81206318f39effbabc70f431bccf0c1601e878bc623e5f9dcdda268f2be85e1400b47d4f7477b621e4914e4db9050fc8723ff9fb4c1e95b3e648eddaafd528f109dac69c66147a283d3b9487ee39bc18a2af9ef9ea75b2795ab24c9b1bc5125855e19d3cbbdae5846ee1c8f6fd0588b4daaa3529aed9dc5aa426651bed29475e311fc1312318f5f2b600e0bfd4083eca55fd77c68aef401d926fe7dd4cd21da4d6954e209489724e61c710beea8b547da28faf0c102e2fa400ee226e7ab5648ebf66bf41351845fd2017e54e04e0e099f554f4a97dcce1ec0ec4d9352766ca96841843ddc8564a21576ce74fa7bef399d6e6eb7f46aca482d7c0215cf80108a3091ad4e0b22458cab5a1b4bda1874a406600245b2b0cfea71303f86b93f9b8c1454172811197a7ae00337662e686813d67db06a47e551ca05fec73862383eea848a3044f0ab41b42f2e86c1674618e28e3b494b026149adcba605018baac2c808254d3e4b704e5432ab7d4b979070a257c602902ee99b88b4bd71f219a68b44e094a72669d9e4909814e25f9140e9a1ba9b5729d6a817b944eb340df5f5a4ec8d8f8a5bda225fc1b9afc996dcf61a2c009c36dab7d32a9618b20f95c950b65d3585cc64b9bc924f6423cd112e3ee32cdd9924225e51fe62495c3b4be83d4cc493bfd54e4f81c6031d4430090ef57025607500f0416f58f94a86a898e08f76854de8cfa92d4e6966cc6de47de73e95e3fcbdd84135b4dd2c6cded10dd1ef40b18f16be918c453fbfda4ae14aba65743a0c86c55b871f3606c25d0c4c8d95f8b262d6a05ddac2f6bcf1fdca7fca906ada5dcc470337344962bbaf707456b6df00f5946cd985f25df575dbe921cd7b6c22e68fb11461306a2b31d4146f0a1c71b0ae9e9af9d8a94cb9d1c8a24d826aa21267e0345be8533423f526f28d5ce3d0fa3e66041e8b1e4b9a8dfe33b3f090b62e16867e2802364af46cde797a532e1ba08a19700298652c718434427f6621db0307d8d8665156813c91cb748be4c2b3c63edaad3753edb129c25868398b6b29f1236a3b3dfc4383a02a1bc204d72fcfbe8eb5580939d9943e16bb91974195d651ad47d991ac0f48aa74af93cb293e8680da67b2eb92ba14af2deb33b15cdff8e006df61566d5b6300ac28dd33c1270fdc7c91c4a1e1ebc24b7c90d207c87dcf9520d08e94c7a50b2338f3139affdb1b9b6b0a1b52267cc1f5bcd7fa4b8cca5be661f7d91f8954ddcf26b461a36068078077feb8c22ddcab4a2e683a42d87230482d5e08e2df2a7351b799010486c155279d98242507290764517be859d374c65e3587b20680d4cb164192ffbf5db359be5463c4c999508a7ca0ea29100ac3d072668daa9eeb33ede02ff5275c26f166bc98aefe413f36e71950742a06ccce636d61950484df6ba7f614f6655d2f3058b680aec516605b043d50f3b19efaf15cd05bc5900fdd646facf125515be7f7f30cd67aab924e3e5fadcd41c0c2090c6a641afe89103d911c5e0b69361beea8a48b9fdb2db0d7345f8045dd32ec28324c6f517c81061139e50cd22529b2973f031c7ef079bce3310bd7911c71fbd894be1759444c500703a92dd38de4cb3acc7bebfc1f886664c914b81907ff1c09d5a314073d5a3fe263e36da73bb5c8d8d025921fcebbe3a4d5e6654f8218cb95f09bb2f4e49c5b59518cc313c2ef3e10b375bbf3a16137f9ddca41f22bb3cc3ac9d63f4e057726fa037bbc50b45a342d7c747e110086834737edbfa9d243aac7c804cd9ccd0ae795745adc40430186e99cc8a1d465b48fa32b0634f448aa56eee55e6e3cffd7c74daa50711bc96e05cd1691e7eacbc828740ad5f3e133a5b77cc3fbfae5aee1fde8d07af17841cca585bdd3a83fc736ddfdeebadeb674a3c2871799c8f6db192af45ad4899c07e1091cf8f0db25a986bbdfa578fbc864bc6a486e90b163578225cc2cdb808625e89a395f14987f0b2fdf0b1cb2d718063e40ab32ac82ca5d76f6c1c7cac1e0f63bc14318b11fa5cbde3c2ba4af5ffe7a427d46a7664662ae628388aff81f59631d18a6b08c07bd0f37c2d81a46489a0e0d7b096c99d7b3ccc0eb8bd6acf0f554cf1435424a4d3e07c8a503a64eaa248bf732a65ec5a2dc19e265adba89a559abd6c96b1cf0a166c0f211119dd8ab58289dd4fbb0fbfd29866c34646e4247c7f407080a48a4b3d101c97118d727f05c45d979c89d88f8749569b35c62ea05e90990cba9e38094a8e4f02133d0eacb65a2489873e82a343e434c1648a5e5cfd51cd2d2f2dfce1a77bbf17986f897247c4ea6dcfb79c84ca1b6b9641f4e5269211abfa4623b7a672b0ee9d1642bdaa8c247e7f2a7a4c42f97091b6c70287abe414f212de850be4b5df80e4d2b20480f9e13e364f39088039c27d2f07510b18184272cdabd49c3e436dc6a46b493868a3bca5ef5ac65c8e54b0a603fc5824819d67fd94748845796f73b3324b49f8ec5f8f570d8e9d856528a9946aa09e613f5e6da54d003ccf0e57098fc863b9420d82772766bba06cfe486021c4b629d60ec6e4767ad88716bee9f8bbd65112eb034727bc042d1e087f3b84928c375949478a5b67907f53d1c99f8fb18b0eb492294d72cb35793adb11c61b2cb85968dac2b0e662932353b8afe9af2d2ef414edad9177f73c1b8514d0b194e833f24d66ab3eeeb5373f28d60b31769de2d6ef542349dc6d23c685e355f160d0bd2a1de1c52ea8fed6caf7a4c04f7cde6195b2b073133e411a9448218b427772202a800aae517801cff5ce46baeac23e2b196ee0b79e5419274484efb273bb902367290140caf24659855c1fd47f07be96b5b7859611f15bf857af40722f36d32f5ec7f616fbc33b7b4f19bf8fb1e69d5714eb845117029589b776a125393d31b853634b3793b448a1d1c460e8cf3bdc5f566a8e6fbfa7bc3701a21481ebb5f76483bbd1fa688428ff6841c2dc6fb80ee2b69c33eb9039de92065bbdff9b3db61c66b74ef7b3fadf51f73844e17dc53c3dc236f390553ab3b24e23139b4850727375e8496a1cd1f877d095d041f0de2c09b174bc7c7f8c8641c117b85d448801d3b9059fa2b3d2d917b1fe8f2de43062e3fa28baa81f533286055d9af8b4743e32ebe40fadc4d05b60488139c8f6f18f1a8fb3f242733bd5c187825310d6465880200e8582d94a5e5f4b0c2b52636258a67614d39d65496160d3c1af095500be75a93d6379ab04142a8d53840651a01ba5d16358eff829f97ab447a9e9523f0594b82003aca389c0315e53b4e4930fd19d019bcbeef439a3a3682e42b599754fc8b77aec2bc7ad4c30cf572b7405aee842ae8ca83189bf91b79cfda6fb85f412bf8127db92493586decec56a04f92b0619c5b8b4c17edb619b0254268d41af99f2679835ba74dbb59c3964d1fd83f426c39650eb8091d8e61595d9050bd6935a6352fabc36d7e71cf59592e157ed061310885b2edd258f1852528d0", 0x1000)
ioctl$void(r0, 0x5450)
r2 = syz_genetlink_get_family_id$nbd(&(0x7f0000000100)='nbd\x00')
sendmsg$NBD_CMD_STATUS(r1, &(0x7f0000000240)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x40004000}, 0xc, &(0x7f0000000200)={&(0x7f0000000180)=ANY=[@ANYBLOB='l\x00\x00\x00', @ANYRES16=r2, @ANYBLOB="030028bd7000ffdbdf250500200008000000000c00060003000000000000000c00050009000000000000000c00080001000000000000000ccdb2e56f7d6008e50000000c00740081000000100000000800010000000000000000000000000000000000000800"], 0x6c}, 0x1, 0x0, 0x0, 0x800}, 0x20000000)
ioctl$GIO_FONTX(r1, 0x4b6b, &(0x7f00000002c0)=""/254)
fcntl$getownex(r0, 0x10, &(0x7f0000000000))

[ 1100.858270] binder: 32694:32719 Release 1 refcount change on invalid ref 1 ret -22
15:06:20 executing program 1:
r0 = socket$inet_udplite(0x2, 0x2, 0x88)
ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f3188b070")
syz_open_procfs(0x0, &(0x7f0000000940)='syscall\x00')
r1 = syz_open_procfs(0x0, &(0x7f0000000040)='fd\x00')
recvmmsg(0xffffffffffffffff, &(0x7f0000003840)=[{{0x0, 0x0, 0x0}}], 0x1, 0x0, 0x0)
perf_event_open(&(0x7f0000940000)={0x2, 0x70, 0xee6a, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x100, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0xff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x10001, 0x1}, 0x0, 0x400000000000000}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
mlock(&(0x7f00005b8000/0x3000)=nil, 0x3000)
ioctl$SNDRV_TIMER_IOCTL_SELECT(0xffffffffffffffff, 0x40345410, 0x0)
openat$uinput(0xffffffffffffff9c, &(0x7f0000000080)='/dev/uinput\x00', 0x2, 0x0)
mmap(&(0x7f000060b000/0x1000)=nil, 0x1000, 0x5, 0x8000400200000033, r1, 0x0)
perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x2, 0x9, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2000000, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x4000000, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8)
r2 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)={0x10b, 0x6, 0x209e1e, 0x3, 0x1}, 0x2c)
bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000b40)={r2, &(0x7f0000000040), 0x0, 0x1}, 0x20)
r3 = creat(&(0x7f0000000640)='./file0\x00', 0x100)
setsockopt$inet6_tcp_TCP_REPAIR_QUEUE(r3, 0x6, 0x14, &(0x7f0000000980), 0x4)
unlink(&(0x7f0000000940)='./file0\x00')
r4 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r5 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r5, 0x0)
ioctl$BINDER_GET_NODE_DEBUG_INFO(r4, 0xc018620b, &(0x7f0000000100))
ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f00000000c0)=ANY=[@ANYBLOB="bb8f0000"], 0x0, 0x0, 0x0})
ioctl$BINDER_SET_CONTEXT_MGR(r5, 0x40046207, 0x0)
shutdown(0xffffffffffffffff, 0x1)
prctl$PR_SET_NAME(0xf, &(0x7f0000000380)='/group.stat\x00')
ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)})
ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0x0, 0x0, &(0x7f0000000780)})

15:06:20 executing program 4:
r0 = openat$selinux_member(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/member\x00', 0x2, 0x0)
ioctl$FS_IOC_SETFLAGS(r0, 0x40086602, &(0x7f0000000040)=0x2)
r1 = syz_open_procfs(0x0, &(0x7f00000000c0)='net/sof\"\x9b\xe3\xe4_s\x88\xe4\xed\xd2_,|\x84\x00\x00\x00\x00\x00\x00\x004M\x97\x9cy~')
lseek(r1, 0x20000, 0x0)
setsockopt$inet6_udp_int(r1, 0x11, 0xb, &(0x7f0000000140)=0x7cf4de20, 0x4)

15:06:20 executing program 0:
r0 = syz_open_procfs(0x0, &(0x7f0000000200)='setgroups\x00\xb5\xd7[\xb6\x7f\xd1+\xcd\xbd\"\xaaE$\x8a+\xeb\x87\"W\xdfL\xe6\x93\x06\xe9>\xec \xc2\x83\xa2#\xceu\xd32<n\xfcJ]O\x8c&\x87i_\xee\xbb\x99(8P\x1bj\xcdy\x9a\x11\xb6\x1f\xa3W\xdb\xd0*D\x9e\xcf\xe2I3]\t\xf6\x1f\f\x06\xf5R\xa5D\b}5\xa3\xed\x14=\x90\x9c \x12\xe5\x8c\xb8n\xa5T\x8a\x0f\x1c\xa3')
dup(r0)
writev(r0, &(0x7f0000000380)=[{&(0x7f0000000000)="6dfd57bbc4e23b3d", 0x8}], 0x1)

15:06:20 executing program 5:
r0 = socket$inet_udplite(0x2, 0x2, 0x88)
ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f3188b070")
r1 = syz_open_procfs(0x0, &(0x7f0000000940)='syscall\x00')
r2 = syz_open_procfs(0x0, &(0x7f0000000040)='fd\x00')
perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
socket$netlink(0x10, 0x3, 0x0)
r3 = fcntl$dupfd(r2, 0x3, 0xffffffffffffffff)
r4 = syz_open_dev$loop(&(0x7f00000000c0)='/dev/loop#\x00', 0x0, 0x4082)
r5 = memfd_create(&(0x7f00000001c0)='erspan0\x00', 0x0)
pwritev(r5, 0x0, 0x0, 0x81806)
ioctl$LOOP_CHANGE_FD(r4, 0x4c00, r5)
sendfile(r3, r4, 0x0, 0x2000006)
recvmmsg(0xffffffffffffffff, &(0x7f0000003840)=[{{0x0, 0x0, 0x0}}], 0x1, 0x0, 0x0)
perf_event_open(&(0x7f0000940000)={0x2, 0x70, 0xee6a, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x100, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0xff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x10001, 0x1}, 0x0, 0x400000000000000}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
ioctl$SNDRV_TIMER_IOCTL_SELECT(0xffffffffffffffff, 0x40345410, 0x0)
ioctl$sock_FIOGETOWN(r1, 0x8903, &(0x7f0000000140))
openat$uinput(0xffffffffffffff9c, &(0x7f0000000080)='/dev/uinput\x00', 0x2, 0x0)
mmap(&(0x7f000060b000/0x1000)=nil, 0x1000, 0x5, 0x8000400200000033, r2, 0x0)
unshare(0xfffffffffffffffd)
r6 = getpid()
sched_setscheduler(r6, 0x5, &(0x7f00000000c0))
open$dir(&(0x7f0000000400)='./file0\x00', 0x0, 0x0)
perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f00000004c0), 0x2}, 0x0, 0x0, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r7 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000340)='memory.current\x00', 0x0, 0x0)
ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, 0x0)
socketpair(0x1, 0x20000000000001, 0x0, &(0x7f0000000100)={0xffffffffffffffff, <r8=>0xffffffffffffffff})
ioctl$PERF_EVENT_IOC_SET_FILTER(r8, 0x8914, &(0x7f0000000300)='lo\x00\x96o\xd6Q\xb9Y\xa9\xc8J,\x00\xd2\x97\x04\x03\xdc\r')
close(r7)
rt_sigprocmask(0x2, &(0x7f0000000240)={0x6}, &(0x7f00000002c0), 0x8)
ioctl$PERF_EVENT_IOC_SET_FILTER(r1, 0x8923, &(0x7f00000008c0)='lo\x00\x96o8\x0fd\xa1\xe3\xd7]b}\x1f\xa1Y\xad4\x90\x9d`\xd2\x98\x00\x00\x00 \'Y\x17]\x15c\xcaR\xdd\x98OC\x89\x1b\xe7\x84\xe2\x05\x80w\xd2|D\x8dK\x14Bx\xcbuH\xc2\xeec\xbf<>Y\x1a\xfc\x1f9OB\x81\x89\x186\xc5q@n\xb4\xb6s\xb0\x00\x00\xfc\x00\x00\b\x00\x00\xda\xef\xecE\xec\xd5I\xb2\x9b\xfe\x8d\x90?\x00\xe9\xe4~g:\xc1\xb2aj\x96\xbb\xa7\xe2\xc0\xdc\xf9Q\b\xeb\x16\x7fT\x11\xd3\r7\xe6\"f\xcf\x8e\xabd\x0ftp\x82\xae\xd2\x15\x8e+c\xf6\xbf\xe14>\xa6-\xa5c\xde\xd7\xab\xea\x1f\xf8s2\x9cVF\xd5\x18\xfe\x0e\x8f \x01\x00\x00y.\xfc*\x82\xa5\xa1p5\xc8{\xf7\xef\xab\xe8\x99\xebw#\x8at\x1c\x80\xfc\xb0\x95\xa2\xa7\xd7,Y]E8\x83X\xf5F\xdc\x88-\xf5\xb0\xb5^\xdb\x1a\xb6\xaa\x14\xe2\xb9\rh^J-\xd1\xbaUn\x04\'l\x1b\xe0o\xdb\xc8\x91%\x1c\xb5\xbf\xb6\x90\xb4\xc2\x7f]/\xb3\xe7\xc9\'\x94\xcfIo\xdf\x04\x95\xb5\x06\x84\x1fH>\xda\xc5\x04 \x94\x88\xeb\'\xd4;6\x7f\xd9\x99-\x1b|G\x8d\xd4\xb9%\xaaQ\xa0K\x10\x03\x93\xe1\xcc\xe7m\x80\'\xf0\xa5\xed(\r\xa8\x0f&\xb1\xf3\xff0\f\x82%_\x92\x8bD\xb9\xd9\xe7\xf2\xe4\xc1i#\xdc\x87A\xb9\xc7\r\x92\xfa\x11\x11\xb5\x1f\x03\x9d\xdd\x1bj\xdf\xacg\xe3\xa0S\xd3\x8a\xe1n\x97\xea\xf5\xa0\'\v\xe9\xa0\xf1 f\xaan\xcf\xb5i\xb6d\xbc\x92\v\xd58\x16\b\xb3_:\xa4!\ny\xc4&\nWMM\xa8\xc4\v\x9f\x01o\xf4\xab&\xb6\x17\x02P\xc3!N\xf4\b\x1a~\x91V1s\xe9\xbe\x9e\x9b\'\xcde\xb3\xa1\x86\"\xd7\x04\xf1\xc0!\xed\xff\xee$\xc89\x8cB0\xd1dD\xe0IP\x88\xa2\xf2Y\x9af$$\xf1cO\xf7P\xac\xca\x80:!\xb4\x94#\xcb^\x9f\'\x03\xe3\x93\xb9\x82\xbf\xcf\xc4\xe3\xf7\x03Oh\xf2r\xca\x8ff\xbb/\x9f*\xaf\x1a \xa5\xa0?%M\xa5\x86\x98\xf24\'1\xc7\f<\xcc@\xe8\x8a\xac.\xde\xe4\xc7\xf5\x9ck\xa40!\xe9\x14$\xb3\x05m\xb5m\xed\ft\x93\xd8\xa3\x80\'Y\xb9\x05\xbbt|\xbe\xbcz\n\xf3\xf5p\xf8\x9f~\x1b\xd0\v\x1cQ')

15:06:20 executing program 3:
r0 = socket$inet_udplite(0x2, 0x2, 0x88)
ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f3188b070")
syz_open_procfs(0x0, &(0x7f0000000940)='syscall\x00')
r1 = syz_open_procfs(0x0, &(0x7f0000000040)='fd\x00')
recvmmsg(0xffffffffffffffff, &(0x7f0000003840)=[{{0x0, 0x0, 0x0}}], 0x1, 0x0, 0x0)
perf_event_open(&(0x7f0000940000)={0x2, 0x70, 0xee6a, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x100, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0xff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x10001, 0x1}, 0x0, 0x400000000000000}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
mlock(&(0x7f00005b8000/0x3000)=nil, 0x3000)
ioctl$SNDRV_TIMER_IOCTL_SELECT(0xffffffffffffffff, 0x40345410, 0x0)
openat$uinput(0xffffffffffffff9c, &(0x7f0000000080)='/dev/uinput\x00', 0x2, 0x0)
mmap(&(0x7f000060b000/0x1000)=nil, 0x1000, 0x5, 0x8000400200000033, r1, 0x0)
perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x2, 0x9, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2000000, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x4000000, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8)
r2 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)={0x10b, 0x6, 0x209e1e, 0x3, 0x1}, 0x2c)
bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000b40)={r2, &(0x7f0000000040), 0x0, 0x1}, 0x20)
r3 = creat(&(0x7f0000000640)='./file0\x00', 0x100)
setsockopt$inet6_tcp_TCP_REPAIR_QUEUE(r3, 0x6, 0x14, &(0x7f0000000980), 0x4)
unlink(&(0x7f0000000940)='./file0\x00')
r4 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r5 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r5, 0x0)
ioctl$BINDER_GET_NODE_DEBUG_INFO(r4, 0xc018620b, &(0x7f0000000100))
ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f00000000c0)=ANY=[@ANYBLOB="bb8f0000"], 0x0, 0x0, 0x0})
ioctl$BINDER_SET_CONTEXT_MGR(r5, 0x40046207, 0x0)
shutdown(0xffffffffffffffff, 0x1)
prctl$PR_SET_NAME(0xf, &(0x7f0000000380)='/group.stat\x00')
ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)})
ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0x0, 0x0, &(0x7f0000000780)})
ioctl$BINDER_WRITE_READ(r5, 0xc0306201, &(0x7f00000001c0)={0x8, 0x0, &(0x7f0000000500)=[@release={0x40046306, 0x1}], 0x0, 0x0, &(0x7f00000009c0)})
creat(&(0x7f00000000c0)='./file0\x00', 0x0)

15:06:20 executing program 2:
syz_open_procfs(0x0, &(0x7f0000000280))

[ 1101.410253] binder: send failed reply for transaction 969 to 32684:32692
[ 1101.417336] binder: send failed reply for transaction 972 to 32694:32698
[ 1101.426263] binder: undelivered TRANSACTION_COMPLETE
[ 1101.432265] binder: undelivered TRANSACTION_ERROR: 29189
15:06:20 executing program 2:
r0 = syz_open_procfs(0x0, &(0x7f0000000280)='net/fib_triestat\x00')
lseek(r0, 0x20000, 0x0)
openat$selinux_avc_cache_stats(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/avc/cache_stats\x00', 0x0, 0x0)

15:06:20 executing program 0:
r0 = syz_open_procfs(0x0, &(0x7f0000000200)='setgroups\x00\xb5\xd7[\xb6\x7f\xd1+\xcd\xbd\"\xaaE$\x8a+\xeb\x87\"W\xdfL\xe6\x93\x06\xe9>\xec \xc2\x83\xa2#\xceu\xd32<n\xfcJ]O\x8c&\x87i_\xee\xbb\x99(8P\x1bj\xcdy\x9a\x11\xb6\x1f\xa3W\xdb\xd0*D\x9e\xcf\xe2I3]\t\xf6\x1f\f\x06\xf5R\xa5D\b}5\xa3\xed\x14=\x90\x9c \x12\xe5\x8c\xb8n\xa5T\x8a\x0f\x1c\xa3')
writev(r0, &(0x7f0000000380)=[{&(0x7f0000000000)="6dfd57bbc4e23b3d", 0x8}], 0x1)
fcntl$notify(r0, 0x402, 0x80000000)

15:06:20 executing program 4:
r0 = syz_open_procfs(0x0, &(0x7f00000001c0)='net/softnet_stat\x00')
socket$inet6_udplite(0xa, 0x2, 0x88)
getdents64(r0, &(0x7f0000000040)=""/154, 0xfd11)
lseek(r0, 0x20001, 0x0)

15:06:20 executing program 2:
r0 = getpgrp(0xffffffffffffffff)
r1 = openat$selinux_enforce(0xffffffffffffff9c, &(0x7f0000000080)='/selinux/enforce\x00', 0x40, 0x0)
perf_event_open(&(0x7f0000000000)={0x0, 0x70, 0x5, 0xaa7, 0x3, 0x7e6, 0x0, 0x631b, 0x0, 0xa3ef16fcebf41ec7, 0x100, 0x2, 0xc1, 0x83d, 0x448b1b4a, 0x4, 0x1000, 0x8, 0x2, 0x90, 0x7da, 0x1, 0x3, 0x1, 0x6, 0x0, 0xc9f, 0x7f, 0x4, 0x1, 0x8000, 0x1, 0x945, 0xffffffffffffffaa, 0x5, 0x6, 0x400, 0xbab, 0x0, 0x1, 0x0, @perf_config_ext={0x5, 0xff}, 0x1, 0x236, 0x6, 0x8, 0x7, 0x10001, 0x3}, r0, 0x10, r1, 0x9)
r2 = syz_open_procfs(0x0, &(0x7f0000000280)='net/ipv6_route\x00')
lseek(r2, 0x20000, 0x0)

15:06:20 executing program 0:
r0 = getpgrp(0xffffffffffffffff)
r1 = syz_open_procfs(r0, &(0x7f0000000200)='setgroups\x00\xb5\xd7[\xb6\x7f\xd1+\xcd\xbd\"\xaaE$\x8a+\xeb\x87\"W\xdfL\xe6\x93\x06\xe9>\xec \xc2\x83\xa2#\xceu\xd32<n\xfcJ]O\x8c&\x87i_\xee\xbb\x99(8P\x1bj\xcdy\x9a\x11\xb6\x1f\xa3W\xdb\xd0*D\x9e\xcf\xe2I3]\t\xf6\x1f\f\x06\xf5R\xa5D\b}5\xa3\xed\x14=\x90\x9c \x12\xe5\x8c\xb8n\xa5T\x8a\x0f\x1c\xa3')
sendfile(r1, r1, 0x0, 0x6bc)
writev(r1, &(0x7f0000000380)=[{&(0x7f0000000000)="6dfd57bbc4e23b3d", 0x8}], 0x1)
ioctl$VT_RESIZEX(r1, 0x560a, &(0x7f0000000040)={0x8, 0x9, 0x8001, 0x400, 0xffffffffffff8000, 0x80000001})

[ 1101.593060] binder: 32742:32757 unknown command 36795
[ 1101.600594] binder: 32742:32757 ioctl c0306201 20000140 returned -22
[ 1101.633861] binder: 32748:32754 unknown command 36795
[ 1101.644306] binder: release 32742:32752 transaction 976 out, still active
[ 1101.669078] binder: 32748:32754 ioctl c0306201 20000140 returned -22
15:06:20 executing program 1:
r0 = socket$inet_udplite(0x2, 0x2, 0x88)
ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f3188b070")
syz_open_procfs(0x0, &(0x7f0000000940)='syscall\x00')
r1 = syz_open_procfs(0x0, &(0x7f0000000040)='fd\x00')
recvmmsg(0xffffffffffffffff, &(0x7f0000003840)=[{{0x0, 0x0, 0x0}}], 0x1, 0x0, 0x0)
perf_event_open(&(0x7f0000940000)={0x2, 0x70, 0xee6a, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x100, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0xff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x10001, 0x1}, 0x0, 0x400000000000000}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
mlock(&(0x7f00005b8000/0x3000)=nil, 0x3000)
ioctl$SNDRV_TIMER_IOCTL_SELECT(0xffffffffffffffff, 0x40345410, 0x0)
openat$uinput(0xffffffffffffff9c, &(0x7f0000000080)='/dev/uinput\x00', 0x2, 0x0)
mmap(&(0x7f000060b000/0x1000)=nil, 0x1000, 0x5, 0x8000400200000033, r1, 0x0)
perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x2, 0x9, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2000000, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x4000000, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8)
r2 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)={0x10b, 0x6, 0x209e1e, 0x3, 0x1}, 0x2c)
bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000b40)={r2, &(0x7f0000000040), 0x0, 0x1}, 0x20)
r3 = creat(&(0x7f0000000640)='./file0\x00', 0x100)
setsockopt$inet6_tcp_TCP_REPAIR_QUEUE(r3, 0x6, 0x14, &(0x7f0000000980), 0x4)
unlink(&(0x7f0000000940)='./file0\x00')
r4 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r5 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r5, 0x0)
ioctl$BINDER_GET_NODE_DEBUG_INFO(r4, 0xc018620b, &(0x7f0000000100))
ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f00000000c0)=ANY=[@ANYBLOB="bb8f0000"], 0x0, 0x0, 0x0})
ioctl$BINDER_SET_CONTEXT_MGR(r5, 0x40046207, 0x0)
shutdown(0xffffffffffffffff, 0x1)
prctl$PR_SET_NAME(0xf, &(0x7f0000000380)='/group.stat\x00')
ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)})
ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0x0, 0x0, &(0x7f0000000780)})

15:06:20 executing program 2:
fcntl$getownex(0xffffffffffffffff, 0x10, &(0x7f0000000000))
r0 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000140)='/dev/vga_arbiter\x00', 0x2840, 0x0)
bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f00000000c0)={<r1=>0xffffffffffffffff, r0, 0x0, 0x1, &(0x7f0000000080)='\x00'}, 0x30)
r2 = socket$netlink(0x10, 0x3, 0x15)
open(&(0x7f00000001c0)='./file0\x00', 0x81, 0x44)
ioctl$sock_inet_SIOCSIFDSTADDR(r2, 0x8918, &(0x7f0000000100)={'vxcan1\x00', {0x2, 0x4e21, @dev={0xac, 0x14, 0x14, 0xb}}})
r3 = syz_open_procfs(r1, &(0x7f0000000040)='net/llc\x00')
lseek(r3, 0x20000, 0x0)
openat$selinux_avc_hash_stats(0xffffffffffffff9c, &(0x7f0000000180)='/selinux/avc/hash_stats\x00', 0x0, 0x0)

[ 1101.679282] binder: BINDER_SET_CONTEXT_MGR already set
[ 1101.686415] binder: 32748:32762 ioctl 40046207 0 returned -16
[ 1101.691920] binder: send failed reply for transaction 976, target dead
[ 1101.698858] binder: 32748:32762 transaction failed 29189/-22, size 24-8 line 3117
[ 1101.715666] binder: 32748:32754 BC_INCREFS_DONE u0000000000000000 no match
15:06:20 executing program 4:
bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x38, &(0x7f0000000000)='^*proc-eth1\\mime_typewlan1bdev$posix_acl_access,cgroupb\x00'}, 0x30)
ioctl$sock_SIOCGPGRP(0xffffffffffffff9c, 0x8904, &(0x7f0000000080)=<r0=>0x0)
r1 = syz_open_procfs(r0, &(0x7f00000000c0)='net/softnet_stat\x00')
lseek(r1, 0x20000, 0x0)

[ 1101.725939] binder: 32748:32754 Release 1 refcount change on invalid ref 1 ret -22
15:06:20 executing program 3:
r0 = socket$inet_udplite(0x2, 0x2, 0x88)
ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f3188b070")
syz_open_procfs(0x0, &(0x7f0000000940)='syscall\x00')
r1 = syz_open_procfs(0x0, &(0x7f0000000040)='fd\x00')
recvmmsg(0xffffffffffffffff, &(0x7f0000003840)=[{{0x0, 0x0, 0x0}}], 0x1, 0x0, 0x0)
perf_event_open(&(0x7f0000940000)={0x2, 0x70, 0xee6a, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x100, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0xff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x10001, 0x1}, 0x0, 0x400000000000000}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
mlock(&(0x7f00005b8000/0x3000)=nil, 0x3000)
ioctl$SNDRV_TIMER_IOCTL_SELECT(0xffffffffffffffff, 0x40345410, 0x0)
openat$uinput(0xffffffffffffff9c, &(0x7f0000000080)='/dev/uinput\x00', 0x2, 0x0)
mmap(&(0x7f000060b000/0x1000)=nil, 0x1000, 0x5, 0x8000400200000033, r1, 0x0)
perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x2, 0x9, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2000000, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x4000000, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8)
r2 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)={0x10b, 0x6, 0x209e1e, 0x3, 0x1}, 0x2c)
bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000b40)={r2, &(0x7f0000000040), 0x0, 0x1}, 0x20)
r3 = creat(&(0x7f0000000640)='./file0\x00', 0x100)
setsockopt$inet6_tcp_TCP_REPAIR_QUEUE(r3, 0x6, 0x14, &(0x7f0000000980), 0x4)
unlink(&(0x7f0000000940)='./file0\x00')
r4 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r5 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r5, 0x0)
ioctl$BINDER_GET_NODE_DEBUG_INFO(r4, 0xc018620b, &(0x7f0000000100))
ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f00000000c0)=ANY=[@ANYBLOB="bb8f0000"], 0x0, 0x0, 0x0})
ioctl$BINDER_SET_CONTEXT_MGR(r5, 0x40046207, 0x0)
shutdown(0xffffffffffffffff, 0x1)
prctl$PR_SET_NAME(0xf, &(0x7f0000000380)='/group.stat\x00')
ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)})
ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0x0, 0x0, &(0x7f0000000780)})
ioctl$BINDER_WRITE_READ(r5, 0xc0306201, &(0x7f00000001c0)={0x8, 0x0, &(0x7f0000000500)=[@release={0x40046306, 0x1}], 0x0, 0x0, &(0x7f00000009c0)})
creat(&(0x7f00000000c0)='./file0\x00', 0x0)

15:06:20 executing program 5:
r0 = socket$inet_udplite(0x2, 0x2, 0x88)
ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f3188b070")
syz_open_procfs(0x0, &(0x7f0000000940)='syscall\x00')
r1 = syz_open_procfs(0x0, &(0x7f0000000040)='fd\x00')
recvmmsg(0xffffffffffffffff, &(0x7f0000003840)=[{{0x0, 0x0, 0x0}}], 0x1, 0x0, 0x0)
perf_event_open(&(0x7f0000940000)={0x2, 0x70, 0xee6a, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x100, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0xff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x10001, 0x1}, 0x0, 0x400000000000000}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
mlock(&(0x7f00005b8000/0x3000)=nil, 0x3000)
ioctl$SNDRV_TIMER_IOCTL_SELECT(0xffffffffffffffff, 0x40345410, 0x0)
openat$uinput(0xffffffffffffff9c, &(0x7f0000000080)='/dev/uinput\x00', 0x2, 0x0)
mmap(&(0x7f000060b000/0x1000)=nil, 0x1000, 0x5, 0x8000400200000033, r1, 0x0)
unshare(0xfffffffffffffffd)
r2 = getpid()
sched_setscheduler(r2, 0x5, &(0x7f00000000c0))
open$dir(&(0x7f0000000400)='./file0\x00', 0x0, 0x0)
perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f00000004c0), 0x2}, 0x0, 0x0, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r3 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000340)='memory.current\x00', 0x0, 0x0)
ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, 0x0)
socketpair(0x1, 0x20000000000001, 0x0, &(0x7f0000000100)={<r4=>0xffffffffffffffff, <r5=>0xffffffffffffffff})
ioctl$PERF_EVENT_IOC_SET_FILTER(r5, 0x8914, &(0x7f0000000300)='lo\x00\x96o\xd6Q\xb9Y\xa9\xc8J,\x00\xd2\x97\x04\x03\xdc\r')
close(r3)
rt_sigprocmask(0x2, &(0x7f0000000240)={0x6}, &(0x7f00000002c0), 0x8)
ioctl$PERF_EVENT_IOC_SET_FILTER(r5, 0x8923, &(0x7f00000008c0)='lo\x00\x96o8\x0fd\xa1\xe3\xd7]b}\x1f\xa1Y\xad4\x90\x9d`\xd2\x98\x00\x00\x00 \'Y\x17]\x15c\xcaR\xdd\x98OC\x89\x1b\xe7\x84\xe2\x05\x80w\xd2|D\x8dK\x14Bx\xcbuH\xc2\xeec\xbf<>Y\x1a\xfc\x1f9OB\x81\x89\x186\xc5q@n\xb4\xb6s\xb0\x00\x00\xfc\x00\x00\b\x00\x00\xda\xef\xecE\xec\xd5I\xb2\x9b\xfe\x8d\x90?\x00\xe9\xe4~g:\xc1\xb2aj\x96\xbb\xa7\xe2\xc0\xdc\xf9Q\b\xeb\x16\x7fT\x11\xd3\r7\xe6\"f\xcf\x8e\xabd\x0ftp\x82\xae\xd2\x15\x8e+c\xf6\xbf\xe14>\xa6-\xa5c\xde\xd7\xab\xea\x1f\xf8s2\x9cVF\xd5\x18\xfe\x0e\x8f \x01\x00\x00y.\xfc*\x82\xa5\xa1p5\xc8{\xf7\xef\xab\xe8\x99\xebw#\x8at\x1c\x80\xfc\xb0\x95\xa2\xa7\xd7,Y]E8\x83X\xf5F\xdc\x88-\xf5\xb0\xb5^\xdb\x1a\xb6\xaa\x14\xe2\xb9\rh^J-\xd1\xbaUn\x04\'l\x1b\xe0o\xdb\xc8\x91%\x1c\xb5\xbf\xb6\x90\xb4\xc2\x7f]/\xb3\xe7\xc9\'\x94\xcfIo\xdf\x04\x95\xb5\x06\x84\x1fH>\xda\xc5\x04 \x94\x88\xeb\'\xd4;6\x7f\xd9\x99-\x1b|G\x8d\xd4\xb9%\xaaQ\xa0K\x10\x03\x93\xe1\xcc\xe7m\x80\'\xf0\xa5\xed(\r\xa8\x0f&\xb1\xf3\xff0\f\x82%_\x92\x8bD\xb9\xd9\xe7\xf2\xe4\xc1i#\xdc\x87A\xb9\xc7\r\x92\xfa\x11\x11\xb5\x1f\x03\x9d\xdd\x1bj\xdf\xacg\xe3\xa0S\xd3\x8a\xe1n\x97\xea\xf5\xa0\'\v\xe9\xa0\xf1 f\xaan\xcf\xb5i\xb6d\xbc\x92\v\xd58\x16\b\xb3_:\xa4!\ny\xc4&\nWMM\xa8\xc4\v\x9f\x01o\xf4\xab&\xb6\x17\x02P\xc3!N\xf4\b\x1a~\x91V1s\xe9\xbe\x9e\x9b\'\xcde\xb3\xa1\x86\"\xd7\x04\xf1\xc0!\xed\xff\xee$\xc89\x8cB0\xd1dD\xe0IP\x88\xa2\xf2Y\x9af$$\xf1cO\xf7P\xac\xca\x80:!\xb4\x94#\xcb^\x9f\'\x03\xe3\x93\xb9\x82\xbf\xcf\xc4\xe3\xf7\x03Oh\xf2r\xca\x8ff\xbb/\x9f*\xaf\x1a \xa5\xa0?%M\xa5\x86\x98\xf24\'1\xc7\f<\xcc@\xe8\x8a\xac.\xde\xe4\xc7\xf5\x9ck\xa40!\xe9\x14$\xb3\x05m\xb5m\xed\ft\x93\xd8\xa3\x80\'Y\xb9\x05\xbbt|\xbe\xbcz\n\xf3\xf5p\xf8\x9f~\x1b\xd0\v\x1cQ')
getsockopt$inet_IP_IPSEC_POLICY(r1, 0x0, 0x10, &(0x7f00000006c0)={{{@in6=@loopback}}, {{@in6=@initdev}}}, &(0x7f0000000500)=0xe8)
socketpair(0x2, 0x80807, 0x0, &(0x7f0000000480))
syz_genetlink_get_family_id$SEG6(&(0x7f0000000880)='SEG6\x00')
sendmsg$SEG6_CMD_DUMPHMAC(r4, &(0x7f0000000580)={&(0x7f0000000380)={0x10, 0x0, 0x0, 0x1000000}, 0xc, &(0x7f0000000440)={&(0x7f00000005c0)=ANY=[@ANYBLOB="2300260109447a0000000000000000660000001400001a0065a455e04ea56d0a47018c8e973bcac914471474a7e0d50a000eadd66d2e49a2ed40dcafa1e046ab6aacc2097d8f75bd9c8b8a220bdde116904efa3f9600f22ab388644f66c2d5baec4079a81bae1927e49e91a4964656d7b227702926af5be846f3de49fad39048633fd9161123894d9427f854a30cb0532c8f31f663380e40ce7f6cb15ec8baab3b7c6f"], 0x1}, 0x1, 0x0, 0x0, 0x8000}, 0x804)
r6 = creat(&(0x7f0000000200)='./bus\x00', 0x0)
arch_prctl$ARCH_MAP_VDSO_32(0x2002, 0x7e)
ftruncate(r6, 0x2008200)
open(&(0x7f0000000140)='./bus\x00', 0x4000, 0x0)

15:06:20 executing program 0:
r0 = syz_open_procfs(0x0, &(0x7f0000000040)='net/ip6_mr_cache\x00')
prctl$PR_SET_SECCOMP(0x16, 0x1, &(0x7f00000000c0)={0x4, &(0x7f0000000080)=[{0x7, 0x0, 0x101, 0x8001}, {0x20, 0x3, 0xfffffffffffffff7, 0x9}, {0x101, 0x8, 0x10001, 0x7}, {0x7ff, 0x2, 0x7, 0x3}]})
socket$nl_netfilter(0x10, 0x3, 0xc)
writev(r0, &(0x7f0000000380)=[{&(0x7f0000000000)="6dfd57bbc4e23b3d", 0x8}], 0x1)

[ 1101.802605] audit: type=1400 audit(1553699180.659:116): avc:  denied  { create } for  pid=310 comm="syz-executor.2" scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tclass=netlink_crypto_socket permissive=1
15:06:20 executing program 2:
r0 = syz_open_procfs(0x0, &(0x7f0000000280)='net/fib_triestat\x00')
socket$inet6_udplite(0xa, 0x2, 0x88)
r1 = socket$inet_tcp(0x2, 0x1, 0x0)
setsockopt$inet6_tcp_TCP_REPAIR_WINDOW(0xffffffffffffffff, 0x6, 0x1d, 0x0, 0x0)
perf_event_open(&(0x7f0000000140)={0x0, 0x70, 0xee6b, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f0000000080)={'bpq0\x00'})
perf_event_open(&(0x7f0000000100)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
ioctl$PERF_EVENT_IOC_SET_FILTER(0xffffffffffffffff, 0x89f1, 0x0)
setsockopt$inet_tcp_int(r1, 0x6, 0x17, &(0x7f00000000c0), 0x4)
lseek(r0, 0x20000, 0x0)
setsockopt$inet6_tcp_TCP_FASTOPEN_KEY(r0, 0x6, 0x21, &(0x7f0000000000)="aed49fbedfb7a0621c5776933e9b601c", 0x10)
ioctl$sock_SIOCGSKNS(r0, 0x894c, &(0x7f0000000040)=0x800)

[ 1101.867617] binder: 312:315 unknown command 36795
[ 1101.877366] binder: 312:315 ioctl c0306201 20000140 returned -22
15:06:20 executing program 4:
r0 = openat$selinux_policy(0xffffffffffffff9c, &(0x7f0000000040)='/selinux/policy\x00', 0x0, 0x0)
ioctl$BLKTRACESTART(r0, 0x1274, 0x0)
r1 = syz_open_procfs(0x0, &(0x7f00000001c0)='net/softnet_stat\x00')
lseek(r1, 0x20000, 0x0)
poll(&(0x7f0000000000)=[{r0, 0x2001}, {r0, 0x100}, {r0, 0x1}, {r0, 0x2}], 0x4, 0x4)
socket$inet6_udp(0xa, 0x2, 0x0)

[ 1101.903760] audit: type=1326 audit(1553699180.759:117): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 pid=322 comm="syz-executor.0" exe="/root/syz-executor.0" sig=9 arch=c000003e syscall=228 compat=0 ip=0x45b06a code=0x0
[ 1101.939192] binder: release 312:331 transaction 981 out, still active
15:06:20 executing program 1:
r0 = socket$inet_udplite(0x2, 0x2, 0x88)
ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f3188b070")
syz_open_procfs(0x0, &(0x7f0000000940)='syscall\x00')
r1 = syz_open_procfs(0x0, &(0x7f0000000040)='fd\x00')
recvmmsg(0xffffffffffffffff, &(0x7f0000003840)=[{{0x0, 0x0, 0x0}}], 0x1, 0x0, 0x0)
perf_event_open(&(0x7f0000940000)={0x2, 0x70, 0xee6a, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x100, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0xff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x10001, 0x1}, 0x0, 0x400000000000000}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
mlock(&(0x7f00005b8000/0x3000)=nil, 0x3000)
ioctl$SNDRV_TIMER_IOCTL_SELECT(0xffffffffffffffff, 0x40345410, 0x0)
openat$uinput(0xffffffffffffff9c, &(0x7f0000000080)='/dev/uinput\x00', 0x2, 0x0)
mmap(&(0x7f000060b000/0x1000)=nil, 0x1000, 0x5, 0x8000400200000033, r1, 0x0)
perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x2, 0x9, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2000000, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x4000000, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8)
r2 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)={0x10b, 0x6, 0x209e1e, 0x3, 0x1}, 0x2c)
bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000b40)={r2, &(0x7f0000000040), 0x0, 0x1}, 0x20)
r3 = creat(&(0x7f0000000640)='./file0\x00', 0x100)
setsockopt$inet6_tcp_TCP_REPAIR_QUEUE(r3, 0x6, 0x14, &(0x7f0000000980), 0x4)
unlink(&(0x7f0000000940)='./file0\x00')
r4 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r5 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r5, 0x0)
ioctl$BINDER_GET_NODE_DEBUG_INFO(r4, 0xc018620b, &(0x7f0000000100))
ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f00000000c0)=ANY=[@ANYBLOB="bb8f0000"], 0x0, 0x0, 0x0})
ioctl$BINDER_SET_CONTEXT_MGR(r5, 0x40046207, 0x0)
shutdown(0xffffffffffffffff, 0x1)
prctl$PR_SET_NAME(0xf, &(0x7f0000000380)='/group.stat\x00')
ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)})
ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0x0, 0x0, &(0x7f0000000780)})

[ 1101.970859] binder: send failed reply for transaction 981, target dead
[ 1102.008537] binder: 321:329 unknown command 36795
15:06:20 executing program 2:
r0 = socket$inet_udplite(0x2, 0x2, 0x88)
ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f3188b070")
perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x3950, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r1 = open(&(0x7f00000003c0)='./file0\x00', 0x141042, 0x0)
write$binfmt_elf64(r1, &(0x7f0000000480)=ANY=[], 0x2e7)
sendfile(r1, r1, &(0x7f0000000040), 0xa198)
r2 = syz_open_procfs(0x0, &(0x7f0000000280)='net/fib_triestat\x00')
lseek(r2, 0x20000, 0x0)
getsockopt(r2, 0x8, 0x2, &(0x7f0000000000)=""/130, &(0x7f00000000c0)=0x82)

[ 1102.037146] binder: 321:329 ioctl c0306201 20000140 returned -22
[ 1102.105381] binder: 321:333 BC_INCREFS_DONE node 986 has no pending increfs request
[ 1102.132418] binder: 341:347 unknown command 36795
[ 1102.144074] binder: 341:347 ioctl c0306201 20000140 returned -22
15:06:21 executing program 4:
r0 = syz_open_procfs(0x0, &(0x7f00000001c0)='net/softnet_stat\x00')
lseek(r0, 0x20000, 0x0)
r1 = syz_genetlink_get_family_id$team(&(0x7f0000000180)='team\x00')
bind$inet6(r0, &(0x7f0000000040)={0xa, 0x4e22, 0x3, @remote, 0x8}, 0x1c)
getpeername$packet(r0, &(0x7f0000000080)={0x11, 0x0, <r2=>0x0, 0x1, 0x0, 0x6, @random}, &(0x7f00000000c0)=0x14)
recvmmsg(r0, &(0x7f0000003a80)=[{{0x0, 0x0, &(0x7f0000002400)=[{&(0x7f0000001fc0)=""/42, 0x2a}, {&(0x7f0000002000)=""/212, 0xd4}, {&(0x7f0000002100)=""/158, 0x9e}, {&(0x7f00000021c0)=""/242, 0xf2}, {&(0x7f00000022c0)=""/143, 0x8f}, {&(0x7f0000002380)=""/120, 0x78}], 0x6, &(0x7f0000002480)=""/70, 0x46}, 0x2}, {{&(0x7f0000002500)=@xdp={0x2c, 0x0, <r3=>0x0}, 0x80, &(0x7f0000003640)=[{&(0x7f0000002580)=""/49, 0x31}, {&(0x7f00000025c0)=""/4096, 0x1000}, {&(0x7f00000035c0)=""/103, 0x67}], 0x3}, 0x4}, {{&(0x7f0000003680)=@nfc_llcp, 0x80, &(0x7f0000003a00)=[{&(0x7f0000003700)=""/66, 0x42}, {&(0x7f0000003780)=""/85, 0x55}, {&(0x7f0000003800)=""/78, 0x4e}, {&(0x7f0000003880)=""/103, 0x67}, {&(0x7f0000003900)=""/201, 0xc9}], 0x5}, 0x1ff}], 0x3, 0x20, &(0x7f0000003b40)={0x77359400})
getpeername$packet(r0, &(0x7f0000004180)={0x11, 0x0, <r4=>0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f00000041c0)=0x14)
getpeername$packet(r0, &(0x7f0000004200)={0x11, 0x0, <r5=>0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000004240)=0x14)
getsockname$packet(r0, &(0x7f0000004280)={0x11, 0x0, <r6=>0x0, 0x1, 0x0, 0x6, @local}, &(0x7f00000042c0)=0x14)
getsockname$packet(r0, &(0x7f0000004300)={0x11, 0x0, <r7=>0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f0000004340)=0x14)
getsockopt$inet6_IPV6_IPSEC_POLICY(r0, 0x29, 0x22, &(0x7f0000004380)={{{@in=@local, @in6=@empty, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, <r8=>0x0}}, {{@in6=@mcast2}, 0x0, @in=@multicast2}}, &(0x7f0000004480)=0xe8)
accept$packet(r0, &(0x7f00000044c0)={0x11, 0x0, <r9=>0x0, 0x1, 0x0, 0x6, @remote}, &(0x7f0000004500)=0x14)
getsockopt$inet6_IPV6_XFRM_POLICY(r0, 0x29, 0x23, &(0x7f0000004600)={{{@in6=@ipv4={[], [], @broadcast}, @in6=@empty, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, <r10=>0x0}}, {{@in6=@ipv4={[], [], @remote}}, 0x0, @in6}}, &(0x7f0000004700)=0xe8)
r11 = accept(r0, &(0x7f0000004800)=@xdp={0x2c, 0x0, <r12=>0x0}, &(0x7f0000004880)=0x80)
getsockopt$inet_mreqn(r0, 0x0, 0x24, &(0x7f0000004f40)={@broadcast, @loopback, <r13=>0x0}, &(0x7f0000004f80)=0xc)
getsockopt$inet_pktinfo(r0, 0x0, 0x8, &(0x7f0000005200)={<r14=>0x0, @remote, @loopback}, &(0x7f0000005240)=0xc)
accept4$packet(r0, &(0x7f0000005280)={0x11, 0x0, <r15=>0x0, 0x1, 0x0, 0x6, @random}, &(0x7f00000052c0)=0x14, 0x800)
getsockopt$inet6_mreq(r0, 0x29, 0x15, &(0x7f00000053c0)={@empty, <r16=>0x0}, &(0x7f0000005400)=0x14)
ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000005440)={'gretap0\x00', <r17=>0x0})
getpeername$packet(r0, &(0x7f0000005480)={0x11, 0x0, <r18=>0x0, 0x1, 0x0, 0x6, @random}, &(0x7f00000054c0)=0x14)
getsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x11, &(0x7f0000005500)={{{@in, @in6=@dev, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, <r19=>0x0}}, {{@in=@initdev}, 0x0, @in6=@empty}}, &(0x7f0000005600)=0xe8)
getsockopt$inet_IP_IPSEC_POLICY(r0, 0x0, 0x10, &(0x7f0000005640)={{{@in6=@empty, @in6=@mcast2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, <r20=>0x0}}, {{@in6=@mcast2}, 0x0, @in6=@ipv4={[], [], @remote}}}, &(0x7f0000005740)=0xe8)
getsockopt$inet6_IPV6_XFRM_POLICY(r11, 0x29, 0x23, &(0x7f0000005780)={{{@in=@dev, @in=@multicast2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, <r21=>0x0}}, {{@in=@empty}, 0x0, @in=@loopback}}, &(0x7f0000005880)=0xe8)
sendmsg$TEAM_CMD_NOOP(r0, &(0x7f0000006000)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x4000}, 0xc, &(0x7f0000005fc0)={&(0x7f00000058c0)=ANY=[@ANYBLOB='\x00\a\x00\x00', @ANYRES16=r1, @ANYBLOB="08042cbd7000ffdbdf250000000008000100", @ANYRES32=r2, @ANYBLOB="8800020040000100240001006c625f686173685f737461747300000000000000000000000000000000000000080003000b0000000800040009000000080007000000000044000100240001006d6f6465000000000000000000000000000000000000000000000000000000000800030005000000140004006163746976656261636b75700000000008000100", @ANYRES32=r3, @ANYBLOB="c00002003c00010024000100757365725f6c696e6b757000000000000000000000000000000000000000000008000300060000000400040008000600", @ANYRES32=r4, @ANYBLOB="40000100240001007072696f72697479000000000000000000000000000000000000000000000000080003000e000000080004000200000008000600", @ANYRES32=r5, @ANYBLOB="40000100240001006d6f6465000000000000000000000000000000000000000000000000000000000800030005000000100004006c6f616462616c616e63650008000100", @ANYRES32=r6, @ANYBLOB="7c00020040000100240001006c625f706f72745f737461747300000000000000000000000000000000000000080003000b000000080004000700000008000600", @ANYRES32=r7, @ANYBLOB="38000100240001006d636173745f72656a00040000636f756e7400000000005f38546b576642010008000300030000000800040001f0ffff08000100", @ANYRES32=r8, @ANYBLOB="7c00020040000100240001006c625f706f72745f737461747300000000000000000000000000000000000000080003000b000000080004000200000008000600", @ANYRES32=r9, @ANYBLOB="38000100240001006d636173745f72656a6f696e5f696e74657276616c00000000000000000000000800030003000000080004000180000008000100", @ANYRES32=r10, @ANYBLOB="400002003c000100240001006c625f74785f6d6574686f64000000000000000000000000000000000000000008000300050000000c000400686173680000000008000100", @ANYRES32=r12, @ANYBLOB="f400020038000100240001006d636173745f72656a6f696e5f696e74657276616c00000000000000000000000800030003000000080004000100000040000100240001006c625f686173685f737461747300000000000000000000000000000000000000080003000b00000008000400feffffff080007000000000040000100240001006c625f74785f686173685f746f5f706f72745f6d617070696e67000000000000080003000300000008000400", @ANYRES32=r13, @ANYBLOB="08000700000000003800010024000100616374697665706f727400000000000000000000000000000000000000000000080003000300000008000400", @ANYRES32=r14, @ANYBLOB="08000100", @ANYRES32=r15, @ANYBLOB="ac01020038000100240001006e6f746966795f70656572735f636f756e7400000000000000000000000000000800030003000000080004009800000040000100240001006c625f686173685f737461747300000000000000000000000000000000000000080003000b00000008000400db4a0000080007000000000038000100240001006d636173745f72656a6f696e5f636f756e740000000000000000000000000000080003000300000008000400ff00000038000100240001006c625f73746174735f726566726573685f696e74657276616c00000000000000080003000300000008000400010000004c000100240001006c625f74785f6d6574686f64000000000000000000000000000000000000000008000300050000001c000400686173685f746f5f706f72745f6d617070696e670000000038000100240001006e6f746966795f70656572735f636f756e740000000000000000000000000000080003000300000008000400030000003c00010024000100757365725f6c696e6b757000000000000000000000000000000000000000000008000300060000000400040008000600", @ANYRES32=r16, @ANYBLOB="08000100", @ANYRES32=r17, @ANYBLOB="bc00020040000100240001006c625f74785f686173685f746f5f706f72745f6d617070696e67000000000000080003000300000008000400", @ANYRES32=r18, @ANYBLOB="080007000000000038000100240001006d636173745f72656a6f696e5f696e74657276616c00000000000000000000000800030003000000080004000300000040000100240001006c625f686173685f737461747300000000000000000000000000000000000000080003000b0000000800040004000000080007000000000008000100", @ANYRES32=r19, @ANYBLOB="c800020044000100240001006d6f6465000000000000000000000000000000000000000000000000000000000800030005000000140004006163746976656261636b75700000000040000100240001007072696f72697479000000000000000000000000000000000000000000000000080003000e000000080004000500000008000600", @ANYRES32=r20, @ANYBLOB="40000100240001006c625f74785f686173685f746f5f706f72745f6d617070696e67000000000000080003000300000008000400", @ANYRES32=r21, @ANYBLOB='\b\x00\a\x00\x00\x00\x00\x00'], 0x700}, 0x1, 0x0, 0x0, 0x4000}, 0x40000c4)

[ 1102.155436] binder: BINDER_SET_CONTEXT_MGR already set
[ 1102.164239] binder: 341:347 ioctl 40046207 0 returned -16
[ 1102.221751] binder: 341:360 BC_INCREFS_DONE node 989 has no pending increfs request
15:06:21 executing program 4:
r0 = dup(0xffffffffffffffff)
r1 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000140)='IPVS\x00')
sendmsg$IPVS_CMD_NEW_DEST(r0, &(0x7f0000000300)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x2c7e3dc71c304c96}, 0xc, &(0x7f0000000180)={&(0x7f0000000200)={0xfc, r1, 0x4, 0x70bd2b, 0x25dfdbfd, {}, [@IPVS_CMD_ATTR_TIMEOUT_TCP_FIN={0x8, 0x5, 0x3}, @IPVS_CMD_ATTR_TIMEOUT_TCP={0x8, 0x4, 0x4}, @IPVS_CMD_ATTR_SERVICE={0x38, 0x1, [@IPVS_SVC_ATTR_PROTOCOL={0x8}, @IPVS_SVC_ATTR_PORT={0x8, 0x4, 0x4e23}, @IPVS_SVC_ATTR_FLAGS={0xc, 0x7, {0x10, 0x8}}, @IPVS_SVC_ATTR_TIMEOUT={0x8, 0x8, 0xfff}, @IPVS_SVC_ATTR_PROTOCOL={0x8, 0x2, 0x84}, @IPVS_SVC_ATTR_NETMASK={0x8, 0x9, 0x11}]}, @IPVS_CMD_ATTR_TIMEOUT_TCP_FIN={0x8, 0x5, 0x720d}, @IPVS_CMD_ATTR_DAEMON={0x60, 0x3, [@IPVS_DAEMON_ATTR_STATE={0x8, 0x1, 0x1}, @IPVS_DAEMON_ATTR_MCAST_PORT={0x8, 0x7, 0x4e20}, @IPVS_DAEMON_ATTR_SYNC_ID={0x8, 0x3, 0x4}, @IPVS_DAEMON_ATTR_SYNC_MAXLEN={0x8, 0x4, 0x1}, @IPVS_DAEMON_ATTR_STATE={0x8, 0x1, 0x2}, @IPVS_DAEMON_ATTR_SYNC_ID={0x8, 0x3, 0x4}, @IPVS_DAEMON_ATTR_MCAST_IFN={0x14, 0x2, 'hsr0\x00'}, @IPVS_DAEMON_ATTR_MCAST_PORT={0x8, 0x7, 0x4e21}, @IPVS_DAEMON_ATTR_MCAST_GROUP={0x8, 0x5, @broadcast}, @IPVS_DAEMON_ATTR_SYNC_MAXLEN={0x8, 0x4, 0x3ff}]}, @IPVS_CMD_ATTR_DAEMON={0x38, 0x3, [@IPVS_DAEMON_ATTR_MCAST_PORT={0x8, 0x7, 0x4e24}, @IPVS_DAEMON_ATTR_SYNC_ID={0x8, 0x3, 0x2}, @IPVS_DAEMON_ATTR_STATE={0x8, 0x1, 0x2}, @IPVS_DAEMON_ATTR_STATE={0x8}, @IPVS_DAEMON_ATTR_MCAST_IFN={0x14, 0x2, 'bridge_slave_0\x00'}]}]}, 0xfc}, 0x1, 0x0, 0x0, 0x4000000}, 0x80)
r2 = getpgrp(0xffffffffffffffff)
r3 = syz_open_procfs(r2, &(0x7f00000001c0)='w\xfbYY\xeb)d\xe6')
ptrace$setregset(0x4205, r2, 0x203, &(0x7f00000000c0)={&(0x7f0000000000)="5c446414d268d173eca180cec4563a3fe3996169b1e2d04a0fadd347008914c5ad34f95710f8bd4e8048aa8cc3b975ea2a8b7489a2f6a8e07399d016b180ef6cd8424e8722a459c251ba6d15ebaa9b5779b50b78b38094766cd794dc735a28882d0d9cc18c08fcf7454eebb2d905d4060424524f6221e79f25a2f76457a413b9d021d50505c4bff1da4cf79b7e0da3cbf877d09acb9245b784b2662ec198c154455219aaa5afb3cd0935630a6b40c78e9036d378", 0xb4})
lseek(r3, 0x20000, 0x0)

15:06:21 executing program 5:
r0 = socket$inet_udplite(0x2, 0x2, 0x88)
ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f3188b070")
syz_open_procfs(0x0, &(0x7f0000000940)='syscall\x00')
r1 = syz_open_procfs(0x0, &(0x7f0000000040)='fd\x00')
recvmmsg(0xffffffffffffffff, &(0x7f0000003840)=[{{0x0, 0x0, 0x0}}], 0x1, 0x0, 0x0)
perf_event_open(&(0x7f0000940000)={0x2, 0x70, 0xee6a, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x100, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0xff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x10001, 0x1}, 0x0, 0x400000000000000}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
mlock(&(0x7f00005b8000/0x3000)=nil, 0x3000)
ioctl$SNDRV_TIMER_IOCTL_SELECT(0xffffffffffffffff, 0x40345410, 0x0)
openat$uinput(0xffffffffffffff9c, &(0x7f0000000080)='/dev/uinput\x00', 0x2, 0x0)
mmap(&(0x7f000060b000/0x1000)=nil, 0x1000, 0x5, 0x8000400200000033, r1, 0x0)
unshare(0xfffffffffffffffd)
r2 = getpid()
sched_setscheduler(r2, 0x5, &(0x7f00000000c0))
open$dir(&(0x7f0000000400)='./file0\x00', 0x0, 0x0)
perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f00000004c0), 0x2}, 0x0, 0x0, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r3 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000340)='memory.current\x00', 0x0, 0x0)
ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, 0x0)
socketpair(0x1, 0x20000000000001, 0x0, &(0x7f0000000100)={<r4=>0xffffffffffffffff, <r5=>0xffffffffffffffff})
ioctl$PERF_EVENT_IOC_SET_FILTER(r5, 0x8914, &(0x7f0000000300)='lo\x00\x96o\xd6Q\xb9Y\xa9\xc8J,\x00\xd2\x97\x04\x03\xdc\r')
close(r3)
rt_sigprocmask(0x2, &(0x7f0000000240)={0x6}, &(0x7f00000002c0), 0x8)
ioctl$PERF_EVENT_IOC_SET_FILTER(r5, 0x8923, &(0x7f00000008c0)='lo\x00\x96o8\x0fd\xa1\xe3\xd7]b}\x1f\xa1Y\xad4\x90\x9d`\xd2\x98\x00\x00\x00 \'Y\x17]\x15c\xcaR\xdd\x98OC\x89\x1b\xe7\x84\xe2\x05\x80w\xd2|D\x8dK\x14Bx\xcbuH\xc2\xeec\xbf<>Y\x1a\xfc\x1f9OB\x81\x89\x186\xc5q@n\xb4\xb6s\xb0\x00\x00\xfc\x00\x00\b\x00\x00\xda\xef\xecE\xec\xd5I\xb2\x9b\xfe\x8d\x90?\x00\xe9\xe4~g:\xc1\xb2aj\x96\xbb\xa7\xe2\xc0\xdc\xf9Q\b\xeb\x16\x7fT\x11\xd3\r7\xe6\"f\xcf\x8e\xabd\x0ftp\x82\xae\xd2\x15\x8e+c\xf6\xbf\xe14>\xa6-\xa5c\xde\xd7\xab\xea\x1f\xf8s2\x9cVF\xd5\x18\xfe\x0e\x8f \x01\x00\x00y.\xfc*\x82\xa5\xa1p5\xc8{\xf7\xef\xab\xe8\x99\xebw#\x8at\x1c\x80\xfc\xb0\x95\xa2\xa7\xd7,Y]E8\x83X\xf5F\xdc\x88-\xf5\xb0\xb5^\xdb\x1a\xb6\xaa\x14\xe2\xb9\rh^J-\xd1\xbaUn\x04\'l\x1b\xe0o\xdb\xc8\x91%\x1c\xb5\xbf\xb6\x90\xb4\xc2\x7f]/\xb3\xe7\xc9\'\x94\xcfIo\xdf\x04\x95\xb5\x06\x84\x1fH>\xda\xc5\x04 \x94\x88\xeb\'\xd4;6\x7f\xd9\x99-\x1b|G\x8d\xd4\xb9%\xaaQ\xa0K\x10\x03\x93\xe1\xcc\xe7m\x80\'\xf0\xa5\xed(\r\xa8\x0f&\xb1\xf3\xff0\f\x82%_\x92\x8bD\xb9\xd9\xe7\xf2\xe4\xc1i#\xdc\x87A\xb9\xc7\r\x92\xfa\x11\x11\xb5\x1f\x03\x9d\xdd\x1bj\xdf\xacg\xe3\xa0S\xd3\x8a\xe1n\x97\xea\xf5\xa0\'\v\xe9\xa0\xf1 f\xaan\xcf\xb5i\xb6d\xbc\x92\v\xd58\x16\b\xb3_:\xa4!\ny\xc4&\nWMM\xa8\xc4\v\x9f\x01o\xf4\xab&\xb6\x17\x02P\xc3!N\xf4\b\x1a~\x91V1s\xe9\xbe\x9e\x9b\'\xcde\xb3\xa1\x86\"\xd7\x04\xf1\xc0!\xed\xff\xee$\xc89\x8cB0\xd1dD\xe0IP\x88\xa2\xf2Y\x9af$$\xf1cO\xf7P\xac\xca\x80:!\xb4\x94#\xcb^\x9f\'\x03\xe3\x93\xb9\x82\xbf\xcf\xc4\xe3\xf7\x03Oh\xf2r\xca\x8ff\xbb/\x9f*\xaf\x1a \xa5\xa0?%M\xa5\x86\x98\xf24\'1\xc7\f<\xcc@\xe8\x8a\xac.\xde\xe4\xc7\xf5\x9ck\xa40!\xe9\x14$\xb3\x05m\xb5m\xed\ft\x93\xd8\xa3\x80\'Y\xb9\x05\xbbt|\xbe\xbcz\n\xf3\xf5p\xf8\x9f~\x1b\xd0\v\x1cQ')
getsockopt$inet_IP_IPSEC_POLICY(r1, 0x0, 0x10, &(0x7f00000006c0)={{{@in6=@loopback}}, {{@in6=@initdev}}}, &(0x7f0000000500)=0xe8)
socketpair(0x2, 0x2000000080003, 0x100, &(0x7f0000000480))
syz_genetlink_get_family_id$SEG6(&(0x7f0000000200)='SEG6\x00')
sendmsg$SEG6_CMD_DUMPHMAC(r4, &(0x7f0000000580)={&(0x7f0000000380)={0x10, 0x0, 0x0, 0x1000000}, 0xc, &(0x7f0000000440)={&(0x7f0000000b00)=ANY=[@ANYBLOB="2300260109447a0000000000000000660000001400001a0065a455e04ea56d0a47018c06003bcac914471474a7e0d50a000eadd62d2e49a2ed40dcafa1e046ab6aacc2097d8f75bd048b8a220bdde116904efa3f9600f22ab388644f660000c0004079a81bae1927e49e91a4964656d7b227702926af5be846f3de49fad39048633fd9161123894d9427f854a30cb0532c8f31f663388c40ce7f6cb15ec8baab3b7c6fa873ee21c0578345825dc356abdf74b2a993d73eb7cd0217e299295a7b8b304a063467ff365893220be520c74bd28fac74667059d1f9bb3e1bce52a32b50eabafb312d94f80b0f84cb145a591141835a335f5f06aa728b090401b4a914270054770fc624b575cbf5c574b2e33e71746bb6ab93a8b942800a186ce8953e53869950c4f89d02a0c35a744bb9b7851513fde450a031f0ece9b2"], 0x1}, 0x1, 0x0, 0x0, 0x8000}, 0x804)
r6 = creat(&(0x7f0000000280)='./bus\x00', 0x0)
arch_prctl$ARCH_MAP_VDSO_32(0x2002, 0x7e)
ftruncate(r6, 0x2008200)
open(&(0x7f0000000140)='./bus\x00', 0x4000, 0x0)

15:06:21 executing program 4:
r0 = syz_open_procfs(0x0, &(0x7f00000001c0)='net/softnet_stat\x00')
lseek(r0, 0x20000, 0x0)
r1 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000000)='attr/prev\x00')
fsetxattr$trusted_overlay_upper(r1, &(0x7f0000000040)='trusted.overlay.upper\x00', &(0x7f0000000080)={0x0, 0xfb, 0x109, 0x2, 0x3, "0388f4f7cdbf8a53381f3affdf4499d7", "5ea24cdba1a2b34a937723d70c4f5c7567fe628cdce662f0be41b2048e7e7ff94b1d3bbd1eade7de013f723a0c684d1978aa33c7babe05d48261be1571a35dd9e6a717145b24a3eaebffc3cc2a2cf2773616c7f2c7dc918ed912a6b9d3ec3020f70988cabeb12812e18b45a4271510946700246d1f7b0fdb42e477fc47f8d8dd2dd5c4080be379cdbd25e2d90817838857f0a2c51f1debb8d3187a54015b9f1cd994fc54f90adba99d460406fef71c4506a6158dc8c510f2de28551812f1da90401548518ba71b7529df0b103719db54c7548ebd05d8a10aecca3ba7caaafd7c964b7fc9e6cc639f72c38272a4f2c0fe531d3c5b"}, 0x109, 0x3)

15:06:21 executing program 4:
r0 = syz_open_procfs(0x0, &(0x7f00000001c0)='net/softnet_stat\x00')
lseek(r0, 0x20000, 0x0)
r1 = fcntl$getown(r0, 0x9)
getpriority(0x1, r1)

[ 1102.696196] audit: type=1326 audit(1553699181.549:118): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 pid=322 comm="syz-executor.0" exe="/root/syz-executor.0" sig=9 arch=c000003e syscall=228 compat=0 ip=0x45b06a code=0x0
15:06:21 executing program 5:
r0 = socket$inet_udplite(0x2, 0x2, 0x88)
ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f3188b070")
syz_open_procfs(0x0, &(0x7f0000000940)='syscall\x00')
r1 = syz_open_procfs(0x0, &(0x7f0000000040)='fd\x00')
recvmmsg(0xffffffffffffffff, &(0x7f0000003840)=[{{0x0, 0x0, 0x0}}], 0x1, 0x0, 0x0)
perf_event_open(&(0x7f0000940000)={0x2, 0x70, 0xee6a, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x100, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0xff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x10001, 0x1}, 0x0, 0x400000000000000}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
mlock(&(0x7f00005b8000/0x3000)=nil, 0x3000)
ioctl$SNDRV_TIMER_IOCTL_SELECT(0xffffffffffffffff, 0x40345410, 0x0)
openat$uinput(0xffffffffffffff9c, &(0x7f0000000080)='/dev/uinput\x00', 0x2, 0x0)
mmap(&(0x7f000060b000/0x1000)=nil, 0x1000, 0x5, 0x8000400200000033, r1, 0x0)
unshare(0xfffffffffffffffd)
r2 = getpid()
sched_setscheduler(r2, 0x5, &(0x7f00000000c0))
open$dir(&(0x7f0000000400)='./file0\x00', 0x0, 0x0)
perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f00000004c0), 0x2}, 0x0, 0x0, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000340)='memory.current\x00', 0x0, 0x0)
ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, 0x0)
socketpair(0x1, 0x20000000000001, 0x0, &(0x7f0000000100)={<r3=>0xffffffffffffffff, <r4=>0xffffffffffffffff})
ioctl$PERF_EVENT_IOC_SET_FILTER(r4, 0x8914, &(0x7f0000000300)='lo\x00\x96o\xd6Q\xb9Y\xa9\xc8J,\x00\xd2\x97\x04\x03\xdc\r')
close(r3)
rt_sigprocmask(0x2, &(0x7f0000000240)={0x6}, &(0x7f00000002c0), 0x8)
ioctl$PERF_EVENT_IOC_SET_FILTER(r4, 0x8923, &(0x7f00000008c0)='lo\x00\x96o8\x0fd\xa1\xe3\xd7]b}\x1f\xa1Y\xad4\x90\x9d`\xd2\x98\x00\x00\x00 \'Y\x17]\x15c\xcaR\xdd\x98OC\x89\x1b\xe7\x84\xe2\x05\x80w\xd2|D\x8dK\x14Bx\xcbuH\xc2\xeec\xbf<>Y\x1a\xfc\x1f9OB\x81\x89\x186\xc5q@n\xb4\xb6s\xb0\x00\x00\xfc\x00\x00\b\x00\x00\xda\xef\xecE\xec\xd5I\xb2\x9b\xfe\x8d\x90?\x00\xe9\xe4~g:\xc1\xb2aj\x96\xbb\xa7\xe2\xc0\xdc\xf9Q\b\xeb\x16\x7fT\x11\xd3\r7\xe6\"f\xcf\x8e\xabd\x0ftp\x82\xae\xd2\x15\x8e+c\xf6\xbf\xe14>\xa6-\xa5c\xde\xd7\xab\xea\x1f\xf8s2\x9cVF\xd5\x18\xfe\x0e\x8f \x01\x00\x00y.\xfc*\x82\xa5\xa1p5\xc8{\xf7\xef\xab\xe8\x99\xebw#\x8at\x1c\x80\xfc\xb0\x95\xa2\xa7\xd7,Y]E8\x83X\xf5F\xdc\x88-\xf5\xb0\xb5^\xdb\x1a\xb6\xaa\x14\xe2\xb9\rh^J-\xd1\xbaUn\x04\'l\x1b\xe0o\xdb\xc8\x91%\x1c\xb5\xbf\xb6\x90\xb4\xc2\x7f]/\xb3\xe7\xc9\'\x94\xcfIo\xdf\x04\x95\xb5\x06\x84\x1fH>\xda\xc5\x04 \x94\x88\xeb\'\xd4;6\x7f\xd9\x99-\x1b|G\x8d\xd4\xb9%\xaaQ\xa0K\x10\x03\x93\xe1\xcc\xe7m\x80\'\xf0\xa5\xed(\r\xa8\x0f&\xb1\xf3\xff0\f\x82%_\x92\x8bD\xb9\xd9\xe7\xf2\xe4\xc1i#\xdc\x87A\xb9\xc7\r\x92\xfa\x11\x11\xb5\x1f\x03\x9d\xdd\x1bj\xdf\xacg\xe3\xa0S\xd3\x8a\xe1n\x97\xea\xf5\xa0\'\v\xe9\xa0\xf1 f\xaan\xcf\xb5i\xb6d\xbc\x92\v\xd58\x16\b\xb3_:\xa4!\ny\xc4&\nWMM\xa8\xc4\v\x9f\x01o\xf4\xab&\xb6\x17\x02P\xc3!N\xf4\b\x1a~\x91V1s\xe9\xbe\x9e\x9b\'\xcde\xb3\xa1\x86\"\xd7\x04\xf1\xc0!\xed\xff\xee$\xc89\x8cB0\xd1dD\xe0IP\x88\xa2\xf2Y\x9af$$\xf1cO\xf7P\xac\xca\x80:!\xb4\x94#\xcb^\x9f\'\x03\xe3\x93\xb9\x82\xbf\xcf\xc4\xe3\xf7\x03Oh\xf2r\xca\x8ff\xbb/\x9f*\xaf\x1a \xa5\xa0?%M\xa5\x86\x98\xf24\'1\xc7\f<\xcc@\xe8\x8a\xac.\xde\xe4\xc7\xf5\x9ck\xa40!\xe9\x14$\xb3\x05m\xb5m\xed\ft\x93\xd8\xa3\x80\'Y\xb9\x05\xbbt|\xbe\xbcz\n\xf3\xf5p\xf8\x9f~\x1b\xd0\v\x1cQ')
getsockopt$inet_IP_IPSEC_POLICY(r1, 0x0, 0x10, &(0x7f00000006c0)={{{@in6=@loopback}}, {{@in6=@initdev}}}, &(0x7f0000000500)=0xe8)
socketpair(0x2, 0x2000000080003, 0x100, &(0x7f0000000480))
syz_genetlink_get_family_id$SEG6(&(0x7f00000003c0)='SEG6\x00')
sendmsg$SEG6_CMD_DUMPHMAC(r3, &(0x7f0000000580)={&(0x7f0000000380)={0x10, 0x0, 0x0, 0x1000000}, 0xc, &(0x7f0000000440)={&(0x7f00000005c0)=ANY=[@ANYBLOB="2300260109447a0000000000000000660000001400001a0065a455e04ea56d0a47018c8e973bcac914471474a7e0d50a000eadd66d2e49a2ed40dcafa1e046ab6aacc2097d8f75bd9c8b8a220bdde116904efa3f9600f22ab388644f66c2d5baec4079a81bae1927e49e91a4964656d7b227702926af5be846f3de49fad39048633fd9161123894d9427f854a30cb0532c8f31f663380e40ce7f6cb15ec8baab3b7c6f"], 0x1}, 0x1, 0x0, 0x0, 0x8000}, 0x804)
r5 = creat(&(0x7f0000000280)='./bus\x00', 0x0)
arch_prctl$ARCH_MAP_VDSO_32(0x2002, 0x7e)
ftruncate(r5, 0x2008200)
open(&(0x7f0000000140)='./bus\x00', 0x4000, 0x0)

15:06:21 executing program 4:
r0 = openat$dir(0xffffffffffffff9c, &(0x7f00000016c0)='./file0\x00', 0xc8200, 0x100)
writev(r0, &(0x7f0000001600)=[{&(0x7f0000000080)="a1620b7303034beefb6e767f4857adc78b29ac8cc1c6d8347edeaff77796199781e4c374174b3ea1f47022e07fd88857f6a6d0", 0x33}, {&(0x7f00000000c0)="29f07f60df6079e1709eab9fef7e69cd1d834a7378ae2df110cf5f2a7e8a6efd8ff6bf92bf384bf21900a225a00a969e68924fbf96bdc10f7158eff0acb006c69ee51e7c320ed5795cd5901881a8f69a3740c375611e2345742294f8ff848be9ba9d89980349ce5e81d02fa53f1e2fef1e83e60985cd43ca34817ce56a46010892de36251adccf9fe0ece95b472103b03668c1ee8799ba59a387f3", 0x9b}, {&(0x7f0000000180)="a6752333ce010dffbe95aa29fb908b4c21a336e5043a0b786ba5815b966f4beb", 0x20}, {&(0x7f0000000200)="592b7d3232a798a44594134bf45e0db22168beadd2c46e1dfed555ac9eea27db573d58e3dd7daae38aadee196bcd74cb66b3fdd7fb14b354384468c2c4b38a864a0a428a9b8bb29f4316fb7a532ba4b19a94dc39c50891f5ccc24f89db7d2c9a48b03debaec5f5e4d8acf0b8579d15b763e3efb2b642d4bcd7b1ca388196db4390a75f54fdbde67d91d3ffccee947ec3e6ddf65a5fe49a8267b90ae53fced973405846feb80fc50a933f7fb1d29d053dbbf829b5dddecab27ada0a4edd6533f51c7b034e8b745957fd478dd8496f5621a4cf10b65b", 0xd5}, {&(0x7f0000000300)="6b9405d171010fc06d819d424fee4917a8609429e4eae11dedddcc7da44b3d5f91f55e30fd0fa416dad8c4385e96a800e0bff569c38e8d142d84ad7295739701e2dd8b1663a52e88c34e847e26e3cdeabb38395d3b847bf558134183627adf17dba75ae09a60e29fa643b1238575b0fd83dcb0aa7249a5f300f448f2558046f37a6ed059a8c2b436685207ff5c0765c4972ecdc28ddfc91b95b626bc330572bc7001587c7a1e764a354192e62a4d5b6b3ebc743e50cdd47d3701ca3fd4d6463d7337a4c9b28abd6f4246bd57d44154382d06a9884f0ceb5dbeb3d0f52baa20946abdbd0a20d02cfbfd4eb86201cff7cb55", 0xf1}, {&(0x7f0000000400)="e57bcdc644dc12c0109be6b247eef33ede100d3c3f21021f8bd54eed828316adc70c394f84e3e2bc6594636caba15f19b4cda57fa685e1154c03cc0d8f36357c5fec2d28fde35d927c29cb297dc62a3c6acc206c4a529f8a42345483eb3d25ad1a13db964ab1d51e39808654ddda305903b1a7aec359214141f82408126c32a7023e96c8a4e14f298e2af60c93f2289ba6d11ffe1f7e277b9aee258c888ebac4b8b675d59e2600dac4ca256499ecda6cadb4ba2059ee9a033adde9fc6a5e1bc34aeee9ddfd32198efbdea294b0a77f39f2da531e877a8b65ca877589546eb2f7f5573b58031f80825f653721fa7d9084067ca6330dfb9e7fba218ef9405a7615a735878fdfed006fa4d58ccf7c1fd9fcabc0be5e6ea430107ef619778646bae2d25dd3f41a367b61032557b6a68c69557ba18079a8cae19bcc2a9ff7ab2a5332b6ba0b6178d03bbef316b647e89a8512e293e24aa40132e906d681c8710b9e73abc1edc53c5a09fa7c5a26bf18f00e97af29d34917e7f3240d82972fb572041543e4ce948c90d7c58c7e57b5fe709c30b6a65571a0681aadc0362bd7cc895ceb2934e64c83ccf0bcee31f0076a14a41d6ae63f382323a526bd91b4e09dd34916f029a912349a71fd7e1af4c4a4c53fb6242c8e9021af569f03abdb25716051f18298ce5413d06ce1e6117af0f824c85bbaa98da3ab0b1edc89c529ce4fc83f1d63cf973cea33b8d2842ddefefa99d7f1341e7fbcd171d42bbc0041cb8cf15e29ca7f3ef65f39e304e6c4348cae2a0f6c6c90cc163bd78d4fa3575d85bc4f15b86267fe3e2c78c00d46ecbf09b569347302e3b509af30323c8eebe10be863af6a8daf592726b6c24284ec88c8b664497d83b9fd2de63e7995cfcb47a8432f9dd6a3e879572dfaa459b970ee43d1148bb8e2e964751a6ea523c9598ce7ec33edfb1de4cf5354fdfa97d78b60a99ef6c6c7b84aa1309f225732f143b5db458fc1bf30457d89e9f942dea744e692bbcd2c4dc898d76d6c56dbb2f5a2220730d76c41f5baf5327270d8e4c9f9b76f1799fcf7c3a197edd23b4b07cf0c9d037eb2e980112f7f2ccaabe5e2a7af29c3bb2a35edd21df0f02a8537f3b06e2a485d165d22df1efb7defeaffcf095e94f2720b2a51031d9ec670ea9eae8b5c4e88fb612205c3a7e9cf35bc59ecb4da7958024dd41b34099a0b3acbf77b2ed4e600642c7fdca8897294f6b09fd7121bba5e2bc15f5a2b4c0ec8cb57c740389e640e0e70471cdb56ad176362a07cba2681ee35ac841977236121220e96708459689a6d24464272ee4adc45552d983a7fa175817245cf8fff2f735487e7016d5853d1b43c697188a60fdd8aa81dd48d1802cdcb542771e9048f9571dd1e50613f739b04bfe37032972c64fd441c67314d582178cd0823e84a2b959a8c1e991af5d183f97485262ca9ee1abac3f73a38bf13071723d053665167a3506fd2a2745c8fc796044126167b30248a9b82b60da432cf0d9ccd814e6dae1c2c458a037be5830653c3fdade9d272b296ddcc85c0064c47adc3bcdcaf514a94da5499e2b2dea8c921416b37ebcb45853ff39e7ca90cd3e09a3c1db3fa28464406cbdb5cd753e6464f89ea2ada69426d01af5cad056d2a13381eddb3ada76de9eef1b243d418ab3e3d4b65e78076628e9ae31cdd5d44631d04a298482528f7f90c7892bc831c8a89d830dcd37fe927552a16c96cedf5200a36fdbaed2a86d3f61b043dec9fd4c145fc692acb5a635cbc8f1536d8c0508245b09077c659960c47d3a267e5c1bd34455465c92507b79d80939523f5247a9e6f7abf3b3d70cdd98d3d11f6e97ded9b5997d9e30098e3da509c924e7ae65bee4b95c2520abeeee89c7a654e785830ac63a67addc23c449f218d052a53fc33549b9f4fbbc04f80bf45ede2e49b915d09cbfa9643ce0b2f7d153fbf374092dca164f4562f3d55dbbc700a77e64eead35531f7f75efcd2f5a5362f069ae4bb6c4658527adbee477830b358a05ee70954f525745b24a15b9677a3a548de671d4e71ad8b12669af01b829d5a925f4ab24344c849847e40d298bdeea9ac4fa4d73e7ab54b388b081f8db1f3adf157020a52042f7b7d199544d89e3759bb81f81320c3f6f28182a2eebb857ecb2686bb3129ebf06af6d2eab4a472529d003ba2646232b6b79a355825362bf2077a96914e784c53ace430c4e480ab64365ae5830280ba66adbf4acc0428784b2dbbe2b0b95af7f30a783384a1eb53e6e096cd7fc5b1512431ae9dc60d67d93aaeab9e4449cdb64e0f2476e86a3d9b7a08e51d1c5ba56520eecae9aa1f72d2cd851262ab9d22a33768357c45b986ff460c8c2df3f31da363cdc479ad6a8112d17cb90916c93f72991c4f27c4c1ba2ac69024251eee569ba2e93137d3f2a62a52f73e2b9045c61792eff74a516636a0c290f80e08578524df046638796819dcc4b9850826f8be85c93f3662657161fbb2a2099e5c6f34653d4d5831c63db1c18d280bfe5611bf5e014157680219514a1f62e703e4ff9446f092023ff713ac9e7eca30bcbfbeeeec0be6936db5414c8c5508d1e784866f82825066d15b4ab777c66973478458c3c6b7cfd88aa43060e508616493a3013ca0a783823e8d1aae322688487c8e3dfaf6a68afad4a57dabe86ccfd1a1c3bfe83c310d4a62e7b544cad98cffce9b0af6fefdf9d1ca828ef9c36f60d38c49078b6d38f9bb403b34a1237aac5a0586249f8149ddab87b5f10aa2a0d7a60d06491eda12e9d710774580ff17a975c0b77cf72195392dff420270bb6a122e7fbd6ce62a0be91f349f2d22a7aa397646f9dcacb61cd663630a6f0e4f0bca5469c4933e17d7441a25aadda114535201f1a8b1655ada9871f98c5db45466d507721ca4826cea13a8f2591d9beea4b2c132b528445c8f7411431290d19a472b1ad494fe38a43743719b8c43f33f3a475fd4f1d68a9efeff6afc1533e9efd082eb6c5aa51bb9b839527a7860b5dfb02fe81fc5ccec2c0a9e566df2318c00d026c4ebe0f170b0ad40c052f9dca99df0e76562ef3b0b3be9153e0f466761a900347183d01cc55dacbc449eceaa0745f12a428446a4fe7f77b02d3fe126878804117ad9cb3875c3b2f87b71941dcb44504b76eb56d4006cea375fbf7bb4e1fb07fcc7921b5de2180f5f22d71eb5d43e407c74da1cdf0f1d93416664ed262d69b337676a39167f0f84e14f10ce8b81e0ccc5d46b330306d833276cdfe6640868a5787820dffe4c08430bcf45ec3287064ba50098b7e2bc155ce15dfa5890be5d7e9dc0ca8a3b4d2361f6ac8aac2b6c9554cd3441cd528302e36da6d60dee3ea5e243e6bc43263cc8ec56313139c6f47618db81417d19031cfb10a25493c9abd4419833cd1e5a12dcbf0cdd4e809fcf0bcb00e384a9cfdd7b9741ae75944569ffa6c2cee9e95fbe8d8c4fe6995afedf2712747bf6db94e27c2d8446e9ce2f9010a655bee6858244a503f9eeba598f59ae114c8d0817c52e1c4daccc20ef3f05381422ec39aa3e10317a35994675bf7eba8707cb639c125bdf12e12aa5661878449e1409bee1a84c48174e81a1998f49a7150d3dee8ed998c9ed30680402d82d21b772d2dab451de18c10b37e32567631f121a382f9cd71fe241710a12475dedf2187a24bd049d0cc7fe7b16fd277a376997f5e3b9a636f269f9c45ab7f9ba7b7860a936f8d40c6a5b47fe9250b4af0292f7e4358e6da98117605d50bd8eee1b5b4b1f4e9de60086ee30a402fb722fb8508603cbe8f562b7a251d14fefde51391736e5d57782e27314bf08dd3bb98785a3460596c0c074fdbc8df74cfbcd43eeafaafde1d69cf74d9bb57fffbf4a830e403f8f7584b272af4f435a66e1ece6902ad4d5386ef98776dc5d0dffc5fd99ddf61f7a85dc75b679fa46b944e0aed6687feef98a9c7f6170089c577ff9506d5e696fe1984f63df27c3f8448d62c820174db98fe70826049c4ac168a1fc21cd1d7e6d2e5e28aeb4bec94f20cab29706626b1cdaac548c7ef02f42644829c71c9b2e6e8d55409c14bb9f0864e0042354e3eaa1fe601dd02646764a49d528427b9a473e34146afcdae49d82b3de78b4bc18a80a7004158dbab1c52230a23def16f567004bb7057fa215e3cf8d9e5a8c308c36ed47ce552442861899fd5bfb1a4be68ee46a27a3ca05e5578265dfeb29f82d67e72dc2dae6fd3ce913be2886c2c1b9068b2b3f5ef09f1449ac58d49389f55850d9725c94dec54e6e5b21a8e780bbf15c2ab759e23dd6030d1e0b83940b669883b8ee646e3c344406492d529edf8dfe7bf46aef663061dd9d8ce3404e28e07d04bf2ec71ed1a7852bbde6ffe6f221ce289a4798fece5520e9f78e89913c270531a05a670967bfe638fee967407216c0e972e73d4866e85e03116c09ae4240603a42774c36e9e95cd3ed890579946cfcf9f7deedeff768ef33a6b24ed801709d52ba100fc8bbdbf3a6a9ba9703e018dc2bc2429fa0edad9cf3362d42ea9add080ee12409bca38c6a135ee68ac6d5c39a242cd101758c16ac7fddf3b455b695c447381b62fcaf34602d5615b5949a2c8a254c1cbb2f8367149c47647cb774dd1c0426d9c9265f768e44edae5446c24145df54a45b51f79568a040ab108738bad32742002fdcc5b1ebc316fb463c1b9009df894fae24e339f0d1fd962920e2cd3da879d5408c5d7efd931c8ca28ad13720bc9435b27a9080f6c98524c8ebcd834ba3fed2b5928644317ef7f754862a1a1e25ac2637ddbfe1b92cf143ca1516da96afe2fc83bda9d6f0fa5a90655a1ca0aad01bdbc6af1611ad55187aeccd9aacb9b689dfe613f393b3b19c48af70a51eee0b801839be7d7aa442c7736c2f094283f8056f962c1fdddcde577e570a06360c769c3665a6d15e2b72783eeaad1bb8ae3b238defd29bd28df7c9b31cf7d151dd027b4d855fd793d2e3e1348e6a50b3d49595503149ea352d36cceaa16bcd6a441d50dddf49c874595dd18c09e0774f78322722f980947dad019d9ca72bd31f48b89269a3f9e1ab096e28f6e76f3448f8f00c4b29952220230490251cece19bd3c9d4b833302c71c7a9ebf01f2c802a87f92ff0c9903fdfef52ea2e0b48a7bedf765b58b4f3698a5250897a8b5fecc39dd7131095731103e7035a44e2a9a315568a19d262b41e87747dde9bdf8d3a99a56afee2fa98579b3c6a3c1761dfef69d553fe21deb468147daa3f25daec97ab508f65e821a07e63b3a32c2eb4de45ca2cf5df42b8fd147de0ee4a612d994b67704eeee86d4e8f2d3119fc7eb87e1917b2a619107ce63a8b0634aa178b1d676fa397128b16413aca3a7b9d78386e822cde96d834f01ef6862863640fd43c49d57826415a9a82d53388b8445b52dfa41173a5032898859641fd8bf552f25dc1976681d3f565522e42d85f83de8a829cbf6d440dc87badfd36bd6b680cdc91c9fea0f9a39ede92a7bab5b5583f37e26ec509dc9e8b42c125a77f2ffefab544027ae622778a3479a5544d694cd0b7a7f0f6a22726c23578ad02d5e49a8364c476e1becf5f5a5ec0321b1b900a8126b1c45b56399fb05c8b194d64c18e04022f633b0dd325b3b464f99a9374a194ab0507b5d0fcb59dc5e1823890a5e7f644cab9dc7a0ef263ff62d405783b7eafbb4939f5378b2ab598835f3c834994e94c532ad3ce3b8500237079ed3ca27d5a87313c567b24af4c4a93bcde0d01ef09a742b00524e3066e6110fcd36580e2bb19db72554c155da6006be100a500f72e096d98", 0x1000}, {&(0x7f0000001400)="32f3fa33582438c63e1149c3ae9e99e2ce59543ce60025b9941148db35705402953e1165e22a6c89550978a9fc0e1bf1d782e7a707011887416120ae31e7f830ff970bd73ed3a91dcba52588634b32788b1b841624aec375603340ebefe9e7ae7250585798d006660ab66f46604aab9388938b8a31fac5078129ada6db4c55852a69419c6b08a04ef09a4caaed43b2682bdaa71def4c", 0x96}, {&(0x7f00000014c0)="2df398c8a58ce40d4a10d7e5693ceae9c99fe8e00f6694e155181ee9488356d65e3df6e3de5f366e254eef1f9ba7bf61f6c93bbcff26cc5d63b58c85f7987cc857461fdd8de6e10dd1ecc9f76f82392fa3e8ed0ddcfb0426be6c758eddc2b0e20f546442e2a43afdcaf58f99121aa27eb0ad23854af967a6afd935bf5f58e2deca2fb1335235ac6ee49a8e07207cc331cc80ca0713072c37865d08ec0b8ed1992945c17f74355d4b7205bcda8fba5ce29441c4c0a48cfc59971da1183b5e9e70bd03e620cacc066df16eb258fd0e4654ebb5dcab5d2ef476edfd568d553c6f73e748394500444e3167253244e7b01d", 0xef}, {&(0x7f00000015c0)="1b6ce528f3116c2a6744ea", 0xb}], 0x9)
r1 = syz_open_procfs(0x0, &(0x7f00000001c0)='net/softnet_stat\x00')
mknod$loop(&(0x7f0000000040)='./file0\x00', 0xd005, 0x1)
lseek(r1, 0x20000, 0x200003)
socket$netlink(0x10, 0x3, 0x7)
pipe2(&(0x7f0000000000), 0x4000)

15:06:21 executing program 0:
r0 = syz_open_procfs(0x0, &(0x7f0000000200)='setgroups\x00\xb5\xd7[\xb6\x7f\xd1+\xcd\xbd\"\xaaE$\x8a+\xeb\x87\"W\xdfL\xe6\x93\x06\xe9>\xec \xc2\x83\xa2#\xceu\xd32<n\xfcJ]O\x8c&\x87i_\xee\xbb\x99(8P\x1bj\xcdy\x9a\x11\xb6\x1f\xa3W\xdb\xd0*D\x9e\xcf\xe2I3]\t\xf6\x1f\f\x06\xf5R\xa5D\b}5\xa3\xed\x14=\x90\x9c \x12\xe5\x8c\xb8n\xa5T\x8a\x0f\x1c\xa3')
writev(r0, &(0x7f00000001c0)=[{&(0x7f0000000680)="ca55cc2c6ffbedc113e0ba358d99ae6ad0edc6a2c7e2ca1afba1bce22a86f4c6f4359d44264c4469d8f8413c62f7d8eac26c925bef1a1d6176cc1d6a18d05d0a3f03361a0dbbe5e16e9f250a5ec004d91d56a3ebe9ab09bf45c549560b8ba264aad51fc3aaa50832c36805aa595b5730821f3f8842a6fc1428275c8f5b7b68362218fc9d3ceb3274d906ec4b1893da6dd1db99e9c1daf719348f6e38a985409c58af9c1c667829ea3b94c4bf337cc3510a1b3b751ffd68542ee82bc7ed8145233df79773f487964cf3fb5b46ab659dcd", 0xd0}, {&(0x7f0000000780)="3a1e5739a54aea4e40ab30f0f3bdb966eab5ddcf37a9826fc6e5b5fb4b8200081cd1ba72b3abdae0461b8de8d82a4e7ffd8847c67579164e73b8d90a03a1b67ad91d552d02eebce2ae74f154c389d15cf950c3f2f26f8319c65c90fd1a51c7d0f6ba9bd8dee1355c0d09010ee7baf9facd8ef3acb9223e53836c6b33572f4d2828ec9cda3df8ab735d2189a814e2f13393e2b3b5e0a09a403dcf6f9d636d1ec296f880e70e5f1cdbf05e9ddd664b3f896892b2ab88452e0b3a7e987ecefd54684412f3edcb57515a01c93e5e549333d02f4569e5b0c49c60bd6cd49d41d282bc0b3f211a58572e89bc678761252e585c3a9088", 0xf3}, {&(0x7f0000000880)="3130e47f16a05780fbc1556dd948d8fff73704907a003c1e9a522eeaa06f448a7be62ffafaba84922e0b2042daf8ed3d211f85ee646033830de2d94cf3cf7558b5f1a457b996d1458a74f6ba76c9cd09d2b83f32c46b4d0d4467e0b99fc0be1f8b4655a958b2", 0x66}, {&(0x7f0000000900)="7ad8b3b12f7e0aee82b1cd7612c8bf604891fcc7a85248e0105f6254d5ef9bde4e7fd881802359edf0006afd3bfeacfb7a9823d95eed1eb2e101f7d0f37802a893fa76adcdb1815d7d6bc4c33692980a63e9e23de9bf07a1593de73687a0d2de9b7883b01422546298230bdba3bed1346e7500f7d55c6a7d5cb9c1cd177caa361ebada4f292a750df36c490e384817f14667b14853ddc05dd9e218bfb7e3456de09fe18c9ca632c2c08c60e74cc3707c99fd41a04d21deeb434f986ae7d218b8831308e2baa3d4f8", 0xc8}], 0x4)

15:06:21 executing program 2:
r0 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000140)='cpuacct.usage_percpu_user\x00', 0x0, 0x0)
ioctl$EVIOCGMTSLOTS(r0, 0x8040450a, &(0x7f0000000200)=""/103)
r1 = syz_open_procfs(0x0, &(0x7f0000000000)='net/fib_triestat\x00')
sendmsg$nl_netfilter(r1, &(0x7f0000000100)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x11000}, 0xc, &(0x7f00000000c0)={&(0x7f0000000080)={0x18, 0x7, 0x9, 0x2, 0x70bd27, 0x25dfdbfe, {0x0, 0x0, 0x1}, [@typed={0x4, 0x2a}]}, 0x18}, 0x1, 0x0, 0x0, 0x800}, 0x800)
lseek(r1, 0x20000, 0x0)
bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f00000001c0)={<r2=>0xffffffffffffffff, r1, 0x0, 0x2e5, &(0x7f0000000280)='fposix_a#\x00', 0xffffffffffffffff}, 0x96)
getsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000180), &(0x7f00000002c0)=0x14)
getpgrp(r2)

15:06:21 executing program 3:
r0 = socket$inet_udplite(0x2, 0x2, 0x88)
ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f3188b070")
syz_open_procfs(0x0, &(0x7f0000000940)='syscall\x00')
r1 = syz_open_procfs(0x0, &(0x7f0000000040)='fd\x00')
recvmmsg(0xffffffffffffffff, &(0x7f0000003840)=[{{0x0, 0x0, 0x0}}], 0x1, 0x0, 0x0)
perf_event_open(&(0x7f0000940000)={0x2, 0x70, 0xee6a, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x100, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0xff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x10001, 0x1}, 0x0, 0x400000000000000}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
mlock(&(0x7f00005b8000/0x3000)=nil, 0x3000)
ioctl$SNDRV_TIMER_IOCTL_SELECT(0xffffffffffffffff, 0x40345410, 0x0)
openat$uinput(0xffffffffffffff9c, &(0x7f0000000080)='/dev/uinput\x00', 0x2, 0x0)
mmap(&(0x7f000060b000/0x1000)=nil, 0x1000, 0x5, 0x8000400200000033, r1, 0x0)
perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x2, 0x9, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2000000, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x4000000, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8)
r2 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)={0x10b, 0x6, 0x209e1e, 0x3, 0x1}, 0x2c)
bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000b40)={r2, &(0x7f0000000040), 0x0, 0x1}, 0x20)
r3 = creat(&(0x7f0000000640)='./file0\x00', 0x100)
setsockopt$inet6_tcp_TCP_REPAIR_QUEUE(r3, 0x6, 0x14, &(0x7f0000000980), 0x4)
unlink(&(0x7f0000000940)='./file0\x00')
r4 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r5 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r5, 0x0)
ioctl$BINDER_GET_NODE_DEBUG_INFO(r4, 0xc018620b, &(0x7f0000000100))
ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f00000000c0)=ANY=[@ANYBLOB="bb8f0000"], 0x0, 0x0, 0x0})
ioctl$BINDER_SET_CONTEXT_MGR(r5, 0x40046207, 0x0)
shutdown(0xffffffffffffffff, 0x1)
prctl$PR_SET_NAME(0xf, &(0x7f0000000380)='/group.stat\x00')
ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)})
ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0x0, 0x0, &(0x7f0000000780)})
ioctl$BINDER_WRITE_READ(r5, 0xc0306201, &(0x7f00000001c0)={0x8, 0x0, &(0x7f0000000500)=[@release={0x40046306, 0x1}], 0x0, 0x0, &(0x7f00000009c0)})

15:06:21 executing program 1:
r0 = socket$inet_udplite(0x2, 0x2, 0x88)
ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f3188b070")
syz_open_procfs(0x0, &(0x7f0000000940)='syscall\x00')
r1 = syz_open_procfs(0x0, &(0x7f0000000040)='fd\x00')
recvmmsg(0xffffffffffffffff, &(0x7f0000003840)=[{{0x0, 0x0, 0x0}}], 0x1, 0x0, 0x0)
perf_event_open(&(0x7f0000940000)={0x2, 0x70, 0xee6a, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x100, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0xff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x10001, 0x1}, 0x0, 0x400000000000000}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
mlock(&(0x7f00005b8000/0x3000)=nil, 0x3000)
ioctl$SNDRV_TIMER_IOCTL_SELECT(0xffffffffffffffff, 0x40345410, 0x0)
openat$uinput(0xffffffffffffff9c, &(0x7f0000000080)='/dev/uinput\x00', 0x2, 0x0)
mmap(&(0x7f000060b000/0x1000)=nil, 0x1000, 0x5, 0x8000400200000033, r1, 0x0)
perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x2, 0x9, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2000000, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x4000000, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8)
r2 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)={0x10b, 0x6, 0x209e1e, 0x3, 0x1}, 0x2c)
bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000b40)={r2, &(0x7f0000000040), 0x0, 0x1}, 0x20)
r3 = creat(&(0x7f0000000640)='./file0\x00', 0x100)
setsockopt$inet6_tcp_TCP_REPAIR_QUEUE(r3, 0x6, 0x14, &(0x7f0000000980), 0x4)
unlink(&(0x7f0000000940)='./file0\x00')
r4 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r5 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r5, 0x0)
ioctl$BINDER_GET_NODE_DEBUG_INFO(r4, 0xc018620b, &(0x7f0000000100))
ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f00000000c0)=ANY=[@ANYBLOB="bb8f0000"], 0x0, 0x0, 0x0})
ioctl$BINDER_SET_CONTEXT_MGR(r5, 0x40046207, 0x0)
shutdown(0xffffffffffffffff, 0x1)
prctl$PR_SET_NAME(0xf, &(0x7f0000000380)='/group.stat\x00')
ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0x0, 0x0, &(0x7f0000000780)})

[ 1102.736462] binder: release 321:329 transaction 985 out, still active
[ 1102.750258] binder: undelivered TRANSACTION_COMPLETE
[ 1102.760472] binder: send failed reply for transaction 985, target dead
[ 1102.768907] binder: send failed reply for transaction 988 to 341:347
15:06:21 executing program 4:
r0 = getpid()
sched_getaffinity(r0, 0x8, &(0x7f0000000000))
syz_open_procfs(r0, &(0x7f00000001c0)='net/softnet_stat\x00')

15:06:21 executing program 0:
r0 = syz_open_procfs(0x0, &(0x7f0000000200)='setgroups\x00\xb5\xd7[\xb6\x7f\xd1+\xcd\xbd\"\xaaE$\x8a+\xeb\x87\"W\xdfL\xe6\x93\x06\xe9>\xec \xc2\x83\xa2#\xceu\xd32<n\xfcJ]O\x8c&\x87i_\xee\xbb\x99(8P\x1bj\xcdy\x9a\x11\xb6\x1f\xa3W\xdb\xd0*D\x9e\xcf\xe2I3]\t\xf6\x1f\f\x06\xf5R\xa5D\b}5\xa3\xed\x14=\x90\x9c \x12\xe5\x8c\xb8n\xa5T\x8a\x0f\x1c\xa3')
writev(r0, &(0x7f0000000300)=[{&(0x7f0000000040)="01e05302b2b56b4fbf8201d7b548fe5d837dde259dddd4c8dcfe697d50c3bdc9651963a4cf921158007f8637f2450aa86dcbf186994b6f8917b330b583e9d8017ab56766c8c295c9c77c1a4b6e7b532c28262bed4a2dff3d1adbd6c79ff7fa3aa860a8da7401ddb527d497ed50dc4caa016155f24c947c4a5fa2e4be69a03d349b", 0x81}, {&(0x7f0000000100)="c1dd875a69011d84ba1ccaf463af623ef51d4299cdac2a6c2f6a3660a7e5048f3f33d20bfa5c5a12da35ce07dedb7e4269e1fa6eddca016e902fcac5b64bc2dbe771a566d9873fe79856b3f99b4d377ff5250323cfd673528d15e1d53efd3f24deb54a17d8c0abf12e6ba57339ed0c8ef7bf7a05e8e7c97dee927e4034b52064527d6995f03a8a93b3c31c620abe48da63d8e3c3abf9128955c0ae2f8e68fcf4c6f45dcf89316b42c628c2b4006aa9dda50cb1acab2f6a26a737cf868e9dc6ec401ddd9d9438f60aae7127fa2000a3cbc6fc45a2aba1c90d1be3d4091dcc7de5831c728ab210964d916c00ccf2e7926d46c20e221c088e37ad0ffcd8", 0xfc}, {&(0x7f0000000280)="ada41b4545c5375696ed", 0xa}, {&(0x7f00000002c0)="b64cf1500f8a9de8a2fafde52c0d65aa05c311b614e5b820e74c84abec52c42351a85002cb3de0ce86928034", 0x2c}], 0x4)
writev(r0, &(0x7f0000000380)=[{&(0x7f0000000000)="6dfd57bbc4e23b3d", 0x8}], 0x1)

15:06:21 executing program 2:
socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000040)={<r0=>0xffffffffffffffff})
write$binfmt_script(r0, &(0x7f0000000080)={'#! ', './file0', [{0x20, 'vmnet0systemuser{-'}, {0x20, 'net/fib_triestat\x00'}, {}, {0x20, 'net/fib_triestat\x00'}, {0x20, '\xdf'}], 0xa, "80707178daf5889f14d2c84e698af15451ab3356a776586b96b79e5c4172d0140f15f701618e770d2ffcbf1a2f83e0668a1721498135d69bc02a0bd3af6ecba20f43a51396f24f603cb05807c2444a7f02d0205299aa7dc01ce1d7a9fca2777f3c013da9c3d190ebc4661fc3c315aba384960217b39a608029f5363fa7d5c3066898cda1dbfaef7890f0e16a775debeee4a2"}, 0xd7)
r1 = syz_open_procfs(0x0, &(0x7f0000000280)='net/fib_triestat\x00')
lseek(r1, 0x20000, 0x0)
ustat(0x7e40, &(0x7f0000000000))

[ 1102.904568] binder: 407:413 unknown command 36795
[ 1102.922755] binder: 407:413 ioctl c0306201 20000140 returned -22
15:06:21 executing program 4:
getpid()
bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000000)={<r0=>0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x4, &(0x7f00000000c0)=':$.\x00'}, 0x30)
r1 = syz_open_procfs(r0, &(0x7f0000000080)='\x9aer/iets\x00')
lseek(r1, 0x20000, 0x0)
ioctl$KDADDIO(r1, 0x4b34, 0x100000000)

15:06:21 executing program 2:
r0 = accept4(0xffffffffffffffff, &(0x7f0000000000)=@rc, &(0x7f0000000080)=0x80, 0x80800)
bind$unix(r0, &(0x7f00000000c0)=@abs={0x0, 0x0, 0x4e20}, 0x6e)
lseek(0xffffffffffffffff, 0x20000, 0x0)

15:06:21 executing program 0:
getpid()
getsockopt$sock_cred(0xffffffffffffff9c, 0x1, 0x11, &(0x7f0000000100)={<r0=>0x0}, &(0x7f0000000140)=0xc)
r1 = syz_open_procfs(r0, &(0x7f0000000200)='schedstat\x00')
writev(r1, &(0x7f0000000380)=[{&(0x7f0000000000)="6dfd57bbc4e23b3d", 0x8}], 0x1)
accept$unix(r1, 0x0, &(0x7f0000000180))
getsockopt$IP6T_SO_GET_INFO(r1, 0x29, 0x40, &(0x7f0000000040)={'nat\x00'}, &(0x7f00000000c0)=0x54)
getsockopt$inet6_opts(r1, 0x29, 0x3f, &(0x7f00000001c0)=""/8, &(0x7f0000000240)=0x8)

[ 1102.980235] binder: 412:414 unknown command 36795
[ 1102.995062] binder: 412:414 ioctl c0306201 20000140 returned -22
[ 1103.004829] binder: 407:429 BC_INCREFS_DONE node 993 has no pending increfs request
[ 1103.010746] binder: BINDER_SET_CONTEXT_MGR already set
[ 1103.021542] binder: 412:414 ioctl 40046207 0 returned -16
[ 1103.044629] binder: 412:414 BC_INCREFS_DONE u0000000000000000 no match
15:06:22 executing program 5:
r0 = socket$inet_udplite(0x2, 0x2, 0x88)
ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f3188b070")
syz_open_procfs(0x0, &(0x7f0000000200)='syscall\x00')
r1 = syz_open_procfs(0x0, &(0x7f0000000040)='fd\x00')
recvmmsg(0xffffffffffffffff, &(0x7f0000003840)=[{{0x0, 0x0, 0x0}}], 0x1, 0x0, 0x0)
perf_event_open(&(0x7f0000940000)={0x2, 0x70, 0xee6a, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x100, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0xff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x10001, 0x1}, 0x0, 0x400000000000000}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
mlock(&(0x7f00005b8000/0x3000)=nil, 0x3000)
ioctl$SNDRV_TIMER_IOCTL_SELECT(0xffffffffffffffff, 0x40345410, 0x0)
openat$uinput(0xffffffffffffff9c, &(0x7f0000000080)='/dev/uinput\x00', 0x2, 0x0)
mmap(&(0x7f000060b000/0x1000)=nil, 0x1000, 0x5, 0x8000400200000033, r1, 0x0)
unshare(0xfffffffffffffffd)
r2 = getpid()
sched_setscheduler(r2, 0x5, &(0x7f00000000c0))
open$dir(&(0x7f0000000400)='./file0\x00', 0x0, 0x0)
perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f00000004c0), 0x2}, 0x0, 0x0, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r3 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000340)='memory.current\x00', 0x0, 0x0)
ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, 0x0)
socketpair(0x1, 0x20000000000001, 0x0, &(0x7f0000000100)={<r4=>0xffffffffffffffff, <r5=>0xffffffffffffffff})
ioctl$PERF_EVENT_IOC_SET_FILTER(r5, 0x8914, &(0x7f0000000540)='\xa5\xb5C\xb5N\x19\x84\x85\x15qlo\x00\x96o\xd6Q\xb9Y\xa9\xda\xa5\x9b\xe1\x8fk\t\v\xdc\r')
close(r3)
rt_sigprocmask(0x2, &(0x7f0000000240)={0x6}, &(0x7f00000002c0), 0x8)
ioctl$PERF_EVENT_IOC_SET_FILTER(r5, 0x8923, &(0x7f00000008c0)='lo\x00\x96o8\x0fd\xa1\xe3\xd7]b}\x1f\xa1Y\xad4\x90\x9d`\xd2\x98\x00\x00\x00 \'Y\x17]\x15c\xcaR\xdd\x98OC\x89\x1b\xe7\x84\xe2\x05\x80w\xd2|D\x8dK\x14Bx\xcbuH\xc2\xeec\xbf<>Y\x1a\xfc\x1f9OB\x81\x89\x186\xc5q@n\xb4\xb6s\xb0\x00\x00\xfc\x00\x00\b\x00\x00\xda\xef\xecE\xec\xd5I\xb2\x9b\xfe\x8d\x90?\x00\xe9\xe4~g:\xc1\xb2aj\x96\xbb\xa7\xe2\xc0\xdc\xf9Q\b\xeb\x16\x7fT\x11\xd3\r7\xe6\"f\xcf\x8e\xabd\x0ftp\x82\xae\xd2\x15\x8e+c\xf6\xbf\xe14>\xa6-\xa5c\xde\xd7\xab\xea\x1f\xf8s2\x9cVF\xd5\x18\xfe\x0e\x8f \x01\x00\x00y.\xfc*\x82\xa5\xa1p5\xc8{\xf7\xef\xab\xe8\x99\xebw#\x8at\x1c\x80\xfc\xb0\x95\xa2\xa7\xd7,Y]E8\x83X\xf5F\xdc\x88-\xf5\xb0\xb5^\xdb\x1a\xb6\xaa\x14\xe2\xb9\rh^J-\xd1\xbaUn\x04\'l\x1b\xe0o\xdb\xc8\x91%\x1c\xb5\xbf\xb6\x90\xb4\xc2\x7f]/\xb3\xe7\xc9\'\x94\xcfIo\xdf\x04\x95\xb5\x06\x84\x1fH>\xda\xc5\x04 \x94\x88\xeb\'\xd4;6\x7f\xd9\x99-\x1b|G\x8d\xd4\xb9%\xaaQ\xa0K\x10\x03\x93\xe1\xcc\xe7m\x80\'\xf0\xa5\xed(\r\xa8\x0f&\xb1\xf3\xff0\f\x82%_\x92\x8bD\xb9\xd9\xe7\xf2\xe4\xc1i#\xdc\x87A\xb9\xc7\r\x92\xfa\x11\x11\xb5\x1f\x03\x9d\xdd\x1bj\xdf\xacg\xe3\xa0S\xd3\x8a\xe1n\x97\xea\xf5\xa0\'\v\xe9\xa0\xf1 f\xaan\xcf\xb5i\xb6d\xbc\x92\v\xd58\x16\b\xb3_:\xa4!\ny\xc4&\nWMM\xa8\xc4\v\x9f\x01o\xf4\xab&\xb6\x17\x02P\xc3!N\xf4\b\x1a~\x91V1s\xe9\xbe\x9e\x9b\'\xcde\xb3\xa1\x86\"\xd7\x04\xf1\xc0!\xed\xff\xee$\xc89\x8cB0\xd1dD\xe0IP\x88\xa2\xf2Y\x9af$$\xf1cO\xf7P\xac\xca\x80:!\xb4\x94#\xcb^\x9f\'\x03\xe3\x93\xb9\x82\xbf\xcf\xc4\xe3\xf7\x03Oh\xf2r\xca\x8ff\xbb/\x9f*\xaf\x1a \xa5\xa0?%M\xa5\x86\x98\xf24\'1\xc7\f<\xcc@\xe8\x8a\xac.\xde\xe4\xc7\xf5\x9ck\xa40!\xe9\x14$\xb3\x05m\xb5m\xed\ft\x93\xd8\xa3\x80\'Y\xb9\x05\xbbt|\xbe\xbcz\n\xf3\xf5p\xf8\x9f~\x1b\xd0\v\x1cQ')
getsockopt$inet_IP_IPSEC_POLICY(r1, 0x0, 0x10, &(0x7f00000006c0)={{{@in6=@loopback}}, {{@in6=@initdev}}}, &(0x7f0000000500)=0xe8)
socketpair(0x2, 0x2000000080003, 0x100, &(0x7f0000000480))
syz_genetlink_get_family_id$SEG6(&(0x7f00000003c0)='SEG6\x00')
sendmsg$SEG6_CMD_DUMPHMAC(r4, &(0x7f0000000580)={&(0x7f0000000380)={0x10, 0x0, 0x0, 0x1000000}, 0xc, &(0x7f0000000440)={&(0x7f00000007c0)=ANY=[@ANYBLOB="2300260109447a0000000000000000660000001400001a0065a455e04ea56d0a47018c8e973bcac914471474a7e0d50a000eadd66d2e49a2edea40dcafa1e046ab6aacc2097d8f75bd9c8b8a220bdde116904efa3f9600f22ab388644f66c2d5baec4079a81bae1927e49e91a4964656d7b227702926af5be846f3de49fad39048633fd9161123894d9427f854a30cb0532c8f31f663380e40ce7f6cb15ec8baab3b7c6f"], 0x1}, 0x1, 0x0, 0x0, 0x8000}, 0x804)
r6 = creat(&(0x7f0000000280)='./bus\x00', 0x0)
arch_prctl$ARCH_MAP_VDSO_32(0x2002, 0x7e)
ftruncate(r6, 0x2008200)
open(&(0x7f0000000140)='./bus\x00', 0x4000, 0x0)

15:06:22 executing program 1:
r0 = socket$inet_udplite(0x2, 0x2, 0x88)
ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f3188b070")
syz_open_procfs(0x0, &(0x7f0000000940)='syscall\x00')
r1 = syz_open_procfs(0x0, &(0x7f0000000040)='fd\x00')
recvmmsg(0xffffffffffffffff, &(0x7f0000003840)=[{{0x0, 0x0, 0x0}}], 0x1, 0x0, 0x0)
perf_event_open(&(0x7f0000940000)={0x2, 0x70, 0xee6a, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x100, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0xff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x10001, 0x1}, 0x0, 0x400000000000000}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
mlock(&(0x7f00005b8000/0x3000)=nil, 0x3000)
ioctl$SNDRV_TIMER_IOCTL_SELECT(0xffffffffffffffff, 0x40345410, 0x0)
openat$uinput(0xffffffffffffff9c, &(0x7f0000000080)='/dev/uinput\x00', 0x2, 0x0)
mmap(&(0x7f000060b000/0x1000)=nil, 0x1000, 0x5, 0x8000400200000033, r1, 0x0)
perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x2, 0x9, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2000000, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x4000000, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8)
r2 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)={0x10b, 0x6, 0x209e1e, 0x3, 0x1}, 0x2c)
bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000b40)={r2, &(0x7f0000000040), 0x0, 0x1}, 0x20)
r3 = creat(&(0x7f0000000640)='./file0\x00', 0x100)
setsockopt$inet6_tcp_TCP_REPAIR_QUEUE(r3, 0x6, 0x14, &(0x7f0000000980), 0x4)
unlink(&(0x7f0000000940)='./file0\x00')
r4 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r5 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r5, 0x0)
ioctl$BINDER_GET_NODE_DEBUG_INFO(r4, 0xc018620b, &(0x7f0000000100))
ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f00000000c0)=ANY=[@ANYBLOB="bb8f0000"], 0x0, 0x0, 0x0})
ioctl$BINDER_SET_CONTEXT_MGR(r5, 0x40046207, 0x0)
shutdown(0xffffffffffffffff, 0x1)
prctl$PR_SET_NAME(0xf, &(0x7f0000000380)='/group.stat\x00')
ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0x0, 0x0, &(0x7f0000000780)})

15:06:22 executing program 4:
r0 = syz_open_procfs(0x0, &(0x7f0000000000)='net/softnet_stat\x00')
lseek(r0, 0x20000, 0x200000000000)

15:06:22 executing program 2:
r0 = syz_open_procfs(0x0, &(0x7f0000000280)='net/fib_triestat\x00')
write$P9_RMKDIR(r0, &(0x7f0000000140)={0x14, 0x49, 0x2, {0x88, 0x1, 0x2}}, 0x14)
lseek(r0, 0x20000, 0x0)
r1 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000040)='IPVS\x00')
r2 = getpgid(0x0)
ptrace$setopts(0x4200, r2, 0x2aea7445, 0x100065)
sendmsg$IPVS_CMD_SET_INFO(r0, &(0x7f0000000100)={&(0x7f0000000000), 0xc, &(0x7f00000000c0)={&(0x7f0000000080)={0x34, r1, 0x100, 0x70bd25, 0x25dfdbfd, {}, [@IPVS_CMD_ATTR_TIMEOUT_UDP={0x8, 0x6, 0x8}, @IPVS_CMD_ATTR_TIMEOUT_TCP={0x8, 0x4, 0x6}, @IPVS_CMD_ATTR_TIMEOUT_UDP={0x8, 0x6, 0x8}, @IPVS_CMD_ATTR_TIMEOUT_TCP={0x8, 0x4, 0x4}]}, 0x34}}, 0x4)

[ 1103.303300] binder: 449:454 unknown command 36795
[ 1103.308522] binder: 449:454 ioctl c0306201 20000140 returned -22
[ 1103.317068] binder: BINDER_SET_CONTEXT_MGR already set
[ 1103.324509] binder: 449:454 ioctl 40046207 0 returned -16
[ 1103.333317] binder: 449:454 BC_INCREFS_DONE u0000000000000000 no match
15:06:22 executing program 3:
r0 = socket$inet_udplite(0x2, 0x2, 0x88)
ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f3188b070")
syz_open_procfs(0x0, &(0x7f0000000940)='syscall\x00')
r1 = syz_open_procfs(0x0, &(0x7f0000000040)='fd\x00')
recvmmsg(0xffffffffffffffff, &(0x7f0000003840)=[{{0x0, 0x0, 0x0}}], 0x1, 0x0, 0x0)
perf_event_open(&(0x7f0000940000)={0x2, 0x70, 0xee6a, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x100, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0xff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x10001, 0x1}, 0x0, 0x400000000000000}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
mlock(&(0x7f00005b8000/0x3000)=nil, 0x3000)
ioctl$SNDRV_TIMER_IOCTL_SELECT(0xffffffffffffffff, 0x40345410, 0x0)
openat$uinput(0xffffffffffffff9c, &(0x7f0000000080)='/dev/uinput\x00', 0x2, 0x0)
mmap(&(0x7f000060b000/0x1000)=nil, 0x1000, 0x5, 0x8000400200000033, r1, 0x0)
perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x2, 0x9, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2000000, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x4000000, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8)
r2 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)={0x10b, 0x6, 0x209e1e, 0x3, 0x1}, 0x2c)
bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000b40)={r2, &(0x7f0000000040), 0x0, 0x1}, 0x20)
r3 = creat(&(0x7f0000000640)='./file0\x00', 0x100)
setsockopt$inet6_tcp_TCP_REPAIR_QUEUE(r3, 0x6, 0x14, &(0x7f0000000980), 0x4)
unlink(&(0x7f0000000940)='./file0\x00')
r4 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r5 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r5, 0x0)
ioctl$BINDER_GET_NODE_DEBUG_INFO(r4, 0xc018620b, &(0x7f0000000100))
ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f00000000c0)=ANY=[@ANYBLOB="bb8f0000"], 0x0, 0x0, 0x0})
ioctl$BINDER_SET_CONTEXT_MGR(r5, 0x40046207, 0x0)
shutdown(0xffffffffffffffff, 0x1)
prctl$PR_SET_NAME(0xf, &(0x7f0000000380)='/group.stat\x00')
ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)})
ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0x0, 0x0, &(0x7f0000000780)})

15:06:22 executing program 5:
r0 = socket$inet_udplite(0x2, 0x2, 0x88)
ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f3188b070")
syz_open_procfs(0x0, &(0x7f0000000940)='syscall\x00')
r1 = syz_open_procfs(0x0, &(0x7f0000000040)='fd\x00')
perf_event_open(&(0x7f0000940000)={0x2, 0x70, 0xee6a, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x100, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0xff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x10001, 0x1}, 0x0, 0x400000000000000}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
mlock(&(0x7f00005b8000/0x3000)=nil, 0x3000)
ioctl$SNDRV_TIMER_IOCTL_SELECT(r1, 0x40345410, 0x0)
openat$uinput(0xffffffffffffff9c, &(0x7f0000000080)='/dev/uinput\x00', 0x2, 0x0)
mmap(&(0x7f000060b000/0x1000)=nil, 0x1000, 0x5, 0x8000400200000033, r1, 0x0)
unshare(0xfffffffffffffffd)
r2 = getpid()
ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000200)={'bond_slave_1\x00', 0x4000})
sched_setscheduler(r2, 0x5, &(0x7f00000000c0))
open$dir(&(0x7f0000000400)='./file0\x00', 0x0, 0x0)
perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x5, 0x0, 0x0, 0x1ff, 0x402, 0x0, 0x0, 0x0, 0x28b3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f00000004c0), 0x2}, 0x0, 0x0, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r3 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000340)='memory.current\x00', 0x0, 0x0)
ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, 0x0)
socketpair(0x1, 0x20000000000001, 0x0, &(0x7f0000000100)={<r4=>0xffffffffffffffff, <r5=>0xffffffffffffffff})
ioctl$PERF_EVENT_IOC_SET_FILTER(r5, 0x8914, &(0x7f0000000300)='lo\x00\x96o\xd6Q\xb9Y\xa9\xc8J,\x00\xd2\x97\x04\x03\xdc\r')
close(r3)
rt_sigprocmask(0x2, &(0x7f0000000240)={0x6}, &(0x7f00000002c0), 0x8)
ioctl$PERF_EVENT_IOC_SET_FILTER(r5, 0x8923, &(0x7f00000008c0)='lo\x00\x96o8\x0fd\xa1\xe3\xd7]b}\x1f\xa1Y\xad4\x90\x9d`\xd2\x98\x00\x00\x00 \'Y\x17]\x15c\xcaR\xdd\x98OC\x89\x1b\xe7\x84\xe2\x05\x80w\xd2|D\x8dK\x14Bx\xcbuH\xc2\xeec\xbf<>Y\x1a\xfc\x1f9OB\x81\x89\x186\xc5q@n\xb4\xb6s\xb0\x00\x00\xfc\x00\x00\b\x00\x00\xda\xef\xecE\xec\xd5I\xb2\x9b\xfe\x8d\x90?\x00\xe9\xe4~g:\xc1\xb2aj\x96\xbb\xa7\xe2\xc0\xdc\xf9Q\b\xeb\x16\x7fT\x11\xd3\r7\xe6\"f\xcf\x8e\xabd\x0ftp\x82\xae\xd2\x15\x8e+c\xf6\xbf\xe14>\xa6-\xa5c\xde\xd7\xab\xea\x1f\xf8s2\x9cVF\xd5\x18\xfe\x0e\x8f \x01\x00\x00y.\xfc*\x82\xa5\xa1p5\xc8{\xf7\xef\xab\xe8\x99\xebw#\x8at\x1c\x80\xfc\xb0\x95\xa2\xa7\xd7,Y]E8\x83X\xf5F\xdc\x88-\xf5\xb0\xb5^\xdb\x1a\xb6\xaa\x14\xe2\xb9\rh^J-\xd1\xbaUn\x04\'l\x1b\xe0o\xdb\xc8\x91%\x1c\xb5\xbf\xb6\x90\xb4\xc2\x7f]/\xb3\xe7\xc9\'\x94\xcfIo\xdf\x04\x95\xb5\x06\x84\x1fH>\xda\xc5\x04 \x94\x88\xeb\'\xd4;6\x7f\xd9\x99-\x1b|G\x8d\xd4\xb9%\xaaQ\xa0K\x10\x03\x93\xe1\xcc\xe7m\x80\'\xf0\xa5\xed(\r\xa8\x0f&\xb1\xf3\xff0\f\x82%_\x92\x8bD\xb9\xd9\xe7\xf2\xe4\xc1i#\xdc\x87A\xb9\xc7\r\x92\xfa\x11\x11\xb5\x1f\x03\x9d\xdd\x1bj\xdf\xacg\xe3\xa0S\xd3\x8a\xe1n\x97\xea\xf5\xa0\'\v\xe9\xa0\xf1 f\xaan\xcf\xb5i\xb6d\xbc\x92\v\xd58\x16\b\xb3_:\xa4!\ny\xc4&\nWMM\xa8\xc4\v\x9f\x01o\xf4\xab&\xb6\x17\x02P\xc3!N\xf4\b\x1a~\x91V1s\xe9\xbe\x9e\x9b\'\xcde\xb3\xa1\x86\"\xd7\x04\xf1\xc0!\xed\xff\xee$\xc89\x8cB0\xd1dD\xe0IP\x88\xa2\xf2Y\x9af$$\xf1cO\xf7P\xac\xca\x80:!\xb4\x94#\xcb^\x9f\'\x03\xe3\x93\xb9\x82\xbf\xcf\xc4\xe3\xf7\x03Oh\xf2r\xca\x8ff\xbb/\x9f*\xaf\x1a \xa5\xa0?%M\xa5\x86\x98\xf24\'1\xc7\f<\xcc@\xe8\x8a\xac.\xde\xe4\xc7\xf5\x9ck\xa40!\xe9\x14$\xb3\x05m\xb5m\xed\ft\x93\xd8\xa3\x80\'Y\xb9\x05\xbbt|\xbe\xbcz\n\xf3\xf5p\xf8\x9f~\x1b\xd0\v\x1cQ')
getsockopt$inet_IP_IPSEC_POLICY(r1, 0x0, 0x10, &(0x7f00000006c0)={{{@in6=@loopback}}, {{@in6=@initdev}}}, &(0x7f0000000500)=0xe8)
socketpair(0x2, 0x2000000080003, 0x100, &(0x7f0000000480))
syz_genetlink_get_family_id$SEG6(&(0x7f0000000840)='SEG6\x00')
sendmsg$SEG6_CMD_DUMPHMAC(r4, &(0x7f0000000580)={&(0x7f0000000380)={0x10, 0x0, 0x0, 0x1000000}, 0xc, &(0x7f0000000440)={&(0x7f0000000cc0)=ANY=[@ANYBLOB="2300260109447a0000000000000000660000001400001a0065a455e04ea56d0a47018c08973bcac9146d2e49a2ed40dcafa1e046ab6aacc2097d8f75bd9c8b8a220bdde116904efa3f9600f22ab388644f66c2d5baec4079a81bae1927e49e91a496465685b227702926af5be846f3de49fad39048633fd916074d3b3d615d93361123894d9427f854a30cb0532c8f31f663380e40ce7f6cb15ec8baab3b7c6f9e60394ccb65e927a7437624ef3b498b63611035f2a044b24b4d697502780de6070700000000000000739f10b6a7ec7c71017394905365282bda26e3d64d62c0b5b1edba6f97c3836996d4cae011f5fee9a654048b665b14a642486252c2d365c894b24c0abea1c5c93f140898c514b701079952315506d103de415e20b05057de8e68ed20a9d747d648e331cde319db87f63cc3d12fba830b33990e8d81e07a6bb25c58855de21ccb8d61d82d5e46787c0b1f4b84911aa7a60bedf893c8e9b682b90967f6d723fe65bad44f5320fb87edb2d86a22bba550ba2cdc680a12408201ee2f3d151b44bcb4705af48be6333bcad39461dfeb6c761f5c6d20b9bdb59f0c5d8fecd035d86dedb2800aa3913e6633229a9f642eb6b2a027763e8956"], 0x1}, 0x1, 0x0, 0x0, 0x8000}, 0x804)
r6 = creat(&(0x7f0000000280)='./bus\x00', 0x0)
ftruncate(r6, 0x2008200)
open(&(0x7f0000000140)='./bus\x00', 0x4000, 0x0)

15:06:22 executing program 4:
r0 = syz_open_procfs(0x0, &(0x7f00000001c0)='net/softnet_stat\x00')
lseek(r0, 0x20000, 0x0)
write$P9_RWRITE(r0, &(0x7f0000000100)={0xb, 0x77, 0x2, 0x9}, 0xb)
pwrite64(r0, &(0x7f0000000000)="1c43693aee0804446e2e429a574cf045777679fb35b2176a2e92c4cd75183e03009a5c8fe021598dde94ee617531675879ca4846ff0c5ab785a3eb4ea6bf426928671b70ddd24dd0100e126f2932ff26272fb7fc11355a67040b24f3629397e78faa98d83d72fe33cf5c4eb22f1bcd4480450a8afe5def9f9d943c6dbab1dcf43e856df073dbbea45607", 0x8a, 0x0)
bpf$BPF_MAP_LOOKUP_AND_DELETE_ELEM(0x15, &(0x7f0000000180)={r0, &(0x7f0000000140)="32e067df6bb504ba661b7ffa5035762c984990913f", &(0x7f0000000200)=""/203}, 0x18)
ioctl$TUNSETOFFLOAD(r0, 0x400454d0, 0x1c)
setsockopt$packet_rx_ring(r0, 0x107, 0x5, &(0x7f00000000c0)=@req={0x4, 0x0, 0xd3f, 0x9}, 0x10)
accept$inet6(r0, &(0x7f0000000300)={0xa, 0x0, 0x0, @ipv4={[], [], @remote}}, &(0x7f0000000340)=0x1c)

15:06:22 executing program 0:
r0 = openat$selinux_enforce(0xffffffffffffff9c, &(0x7f0000000040)='/selinux/enforce\x00', 0x200, 0x0)
setsockopt$inet_tcp_buf(r0, 0x6, 0xe, &(0x7f0000000080)="418a64d96887720c8fe807aef7500214c47724692fbf384de04b0bc8391e51018353510ce707d261cfe2f228db73025680324b0424ac787e5519415886fcf21bc258e44e881b8ee7104e3566e5558c62ff581b0fa1a240817cb8b869a4e2dca3f813a45df8f5ecd97fc5e925e11db2ba12a4536464bc466c6180398dd130b05ce41422d3fcbe1423a2e78c6c84f983c504a9f208a31d80d011bc7255e23dd21fe2b12d4344e697aa4f7a754c4b1c1ed16399d473b1e74725999b4dc103b5182a8b492fc58ee9b4898d9c10122973f2474e9aa882dae15f9bd89592b4ff4e3519bba0e1", 0xe3)
r1 = syz_open_procfs(0x0, &(0x7f0000000200)='setgroups\x00\xb5\xd7[\xb6\x7f\xd1+\xcd\xbd\"\xaaE$\x8a+\xeb\x87\"W\xdfL\xe6\x93\x06\xe9>\xec \xc2\x83\xa2#\xceu\xd32<n\xfcJ]O\x8c&\x87i_\xee\xbb\x99(8P\x1bj\xcdy\x9a\x11\xb6\x1f\xa3W\xdb\xd0*D\x9e\xcf\xe2I3]\t\xf6\x1f\f\x06\xf5R\xa5D\b}5\xa3\xed\x14=\x90\x9c \x12\xe5\x8c\xb8n\xa5T\x8a\x0f\x1c\xa3')
writev(r1, &(0x7f0000000380)=[{&(0x7f0000000000)="6dfd57bbc4e23b3d", 0xd3}], 0x1)
ioctl$PIO_UNIMAPCLR(r0, 0x4b68, &(0x7f0000000180)={0x3, 0x400, 0x100000001})
ioctl$TIOCNOTTY(r1, 0x5422)

15:06:22 executing program 2:
r0 = syz_open_procfs(0x0, &(0x7f0000000280)='net/fib_triestat\x00')
ioctl$SNDRV_TIMER_IOCTL_NEXT_DEVICE(r0, 0xc0145401, &(0x7f0000000000)={0x3, 0x3, 0x2, 0x1, 0x401})
ioctl(r0, 0x3, &(0x7f0000000140)="41666ad10ed05838a10703fc5ea259209613e9a38369bccf101dbfeb35eab306ad07fde9d3ab9ec1d46f8bf5d1d59132fbbb8a9bb2ab2e9efaefc6e51b7c11f8d2ad151ef6df540baa9fcbe0552250ccfb27abe67c34cd42627ec94335fa2ff9f631e133d0336b6c2523ff675b8607bcd55d5668d9cedb824b40f561a837f4f35436da0ad56ef4ef4b33e7a785d20e5cb3c5f927fa2a5e5b5e1cf7fb8b7d62cd1fd7bdac72199a53c9035a262b4ae09d6aba60c9ca5e2394e2a30519d569af5126d2fd6bbd34ca")
lseek(r0, 0x0, 0x2)

15:06:22 executing program 1:
r0 = socket$inet_udplite(0x2, 0x2, 0x88)
ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f3188b070")
syz_open_procfs(0x0, &(0x7f0000000940)='syscall\x00')
r1 = syz_open_procfs(0x0, &(0x7f0000000040)='fd\x00')
recvmmsg(0xffffffffffffffff, &(0x7f0000003840)=[{{0x0, 0x0, 0x0}}], 0x1, 0x0, 0x0)
perf_event_open(&(0x7f0000940000)={0x2, 0x70, 0xee6a, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x100, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0xff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x10001, 0x1}, 0x0, 0x400000000000000}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
mlock(&(0x7f00005b8000/0x3000)=nil, 0x3000)
ioctl$SNDRV_TIMER_IOCTL_SELECT(0xffffffffffffffff, 0x40345410, 0x0)
openat$uinput(0xffffffffffffff9c, &(0x7f0000000080)='/dev/uinput\x00', 0x2, 0x0)
mmap(&(0x7f000060b000/0x1000)=nil, 0x1000, 0x5, 0x8000400200000033, r1, 0x0)
perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x2, 0x9, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2000000, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x4000000, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8)
r2 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)={0x10b, 0x6, 0x209e1e, 0x3, 0x1}, 0x2c)
bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000b40)={r2, &(0x7f0000000040), 0x0, 0x1}, 0x20)
r3 = creat(&(0x7f0000000640)='./file0\x00', 0x100)
setsockopt$inet6_tcp_TCP_REPAIR_QUEUE(r3, 0x6, 0x14, &(0x7f0000000980), 0x4)
unlink(&(0x7f0000000940)='./file0\x00')
r4 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r5 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r5, 0x0)
ioctl$BINDER_GET_NODE_DEBUG_INFO(r4, 0xc018620b, &(0x7f0000000100))
ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f00000000c0)=ANY=[@ANYBLOB="bb8f0000"], 0x0, 0x0, 0x0})
ioctl$BINDER_SET_CONTEXT_MGR(r5, 0x40046207, 0x0)
shutdown(0xffffffffffffffff, 0x1)
prctl$PR_SET_NAME(0xf, &(0x7f0000000380)='/group.stat\x00')
ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0x0, 0x0, &(0x7f0000000780)})

[ 1103.660164] binder: release 407:413 transaction 992 out, still active
[ 1103.667132] binder: send failed reply for transaction 992, target dead
15:06:22 executing program 2:
r0 = syz_open_procfs(0x0, &(0x7f0000000280)='net/fib_triestat\x00')
lseek(r0, 0x20000, 0x0)
ioctl$FS_IOC_FIEMAP(r0, 0xc020660b, &(0x7f0000000000)={0x1, 0x0, 0x1, 0x0, 0x4, [{0xffffffffffffffff, 0x1ff, 0x7, 0x0, 0x0, 0x600}, {0x0, 0x3918, 0xff, 0x0, 0x0, 0x80}, {0x2, 0x80, 0x2, 0x0, 0x0, 0x580}, {0x80000001, 0x6, 0x8, 0x0, 0x0, 0xe80}]})

15:06:22 executing program 0:
r0 = openat$pfkey(0xffffffffffffff9c, &(0x7f0000000080)='/proc/self/net/pfkey\x00', 0x80200, 0x0)
setxattr$security_capability(&(0x7f0000000100)='./file0\x00', &(0x7f0000000140)='security.capability\x00', &(0x7f0000000180)=@v1={0x1000000, [{0x40, 0x7}]}, 0xc, 0x2)
ioctl$UI_SET_MSCBIT(r0, 0x40045568, 0x38)
memfd_create(&(0x7f0000000600)='-B\xd5NI\xc5j\xbappp\xf0\b\x84\xa2m\x00:)\x00\xbb\x8d\xac\xacva}knh#\xcb)\x0f\xc8\xc0:\x9cc\x10d\xee\xa9\x8bCc\xad\x89\x9ck\xde\xc5\xe96\xddU\xa9=\xcdJx\xaa\x8f~\xb90a\xa9\xb2\x04K\x98\x93?\x88Q\xf7\xd6\x1d\xa1\xce\x8b\x19\xea\xef\xe3\xab\xb6\xa5$4\xd6\xfe7\x0f\xe7\xd9$\xce \xabN\xae\xc9\xbd\xd3g@\xe1\'s\x0e\x90\xf2\xcdr\xb8(', 0x0)
clone(0x802102001ffe, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
r1 = gettid()
wait4(0x0, 0x0, 0x80000000, 0x0)
ptrace$setopts(0x4206, r1, 0x0, 0x0)
tkill(r1, 0x38)
ptrace$cont(0x18, r1, 0x0, 0x0)
ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f00000000c0)={[], 0x0, 0x0, 0x0, 0x3, 0x10})
ptrace$setregs(0x400000000000a, r1, 0x0, &(0x7f0000000280)="2d5b0181776dafcc7332fe465285156c2c10436a17121394a1db51c061ba7975bd8530682e155a16cf632c167b94d29c6bfc9f42e420bdd54e94f99822e0e67b8e60aaf2cb304c9810dd87ef4704c9d0746126772935813b03171e4b3f94764a06442109288a5cb63f2b4e582b344b07846d3df0a1b01311e340e8ebbfe27d881f3e1347c49833448116aa66")
ptrace$cont(0x9, r1, 0x0, 0x0)
r2 = syz_open_procfs(0x0, &(0x7f0000000200)='setgroups\x00\xb5\xd7[\xb6\x7f\xd1+\xcd\xbd\"\xaaE$\x8a+\xeb\x87\"W\xdfL\xe6\x93\x06\xe9>\xec \xc2\x83\xa2#\xceu\xd32<n\xfcJ]O\x8c&\x87i_\xee\xbb\x99(8P\x1bj\xcdy\x9a\x11\xb6\x1f\xa3W\xdb\xd0*D\x9e\xcf\xe2I3]\t\xf6\x1f\f\x06\xf5R\xa5D\b}5\xa3\xed\x14=\x90\x9c \x12\xe5\x8c\xb8n\xa5T\x8a\x0f\x1c\xa3')
ioctl$sock_SIOCDELDLCI(r2, 0x8981, &(0x7f0000000040)={'bond_slave_1\x00', 0x8})
fcntl$getownex(r2, 0x10, &(0x7f00000001c0))
writev(r2, &(0x7f0000000380)=[{&(0x7f0000000000)="6dfd57bbc4e23b3d", 0x8}], 0x1)
fcntl$setflags(r0, 0x2, 0x1)
timerfd_gettime(r0, &(0x7f00000000c0))

15:06:22 executing program 4:
r0 = gettid()
r1 = syz_open_procfs(r0, &(0x7f00000001c0)='net/softnet_stat\x00')
r2 = syz_genetlink_get_family_id$tipc2(&(0x7f0000000080)='TIPCv2\x00')
sendmsg$TIPC_NL_MON_PEER_GET(r1, &(0x7f0000000180)={&(0x7f0000000040), 0xc, &(0x7f0000000140)={&(0x7f0000000240)=ANY=[@ANYBLOB="634b74645c9f5fd40551be49989b0ec17e0838fbf462c88831e0e9", @ANYRES16=r2, @ANYBLOB="00022cbd7000fcdbdf251300000034000900080002003a6b00000800020004000000080001000400000008000200feffffff08000200000000000800010003000000"], 0x48}, 0x1, 0x0, 0x0, 0x4004}, 0x8004)
ioctl$PPPIOCGNPMODE(r1, 0xc008744c, &(0x7f0000000200)={0x82bf, 0x6})
lseek(r1, 0x1fffc, 0xfffffffffffffffe)

[ 1103.765129] binder: 476:481 unknown command 36795
[ 1103.777570] binder: 476:481 ioctl c0306201 20000140 returned -22
[ 1103.792644] binder: 476:481 BC_INCREFS_DONE u0000000000000000 no match
15:06:22 executing program 1:
r0 = socket$inet_udplite(0x2, 0x2, 0x88)
ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f3188b070")
syz_open_procfs(0x0, &(0x7f0000000940)='syscall\x00')
r1 = syz_open_procfs(0x0, &(0x7f0000000040)='fd\x00')
recvmmsg(0xffffffffffffffff, &(0x7f0000003840)=[{{0x0, 0x0, 0x0}}], 0x1, 0x0, 0x0)
perf_event_open(&(0x7f0000940000)={0x2, 0x70, 0xee6a, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x100, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0xff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x10001, 0x1}, 0x0, 0x400000000000000}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
mlock(&(0x7f00005b8000/0x3000)=nil, 0x3000)
ioctl$SNDRV_TIMER_IOCTL_SELECT(0xffffffffffffffff, 0x40345410, 0x0)
openat$uinput(0xffffffffffffff9c, &(0x7f0000000080)='/dev/uinput\x00', 0x2, 0x0)
mmap(&(0x7f000060b000/0x1000)=nil, 0x1000, 0x5, 0x8000400200000033, r1, 0x0)
perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x2, 0x9, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2000000, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x4000000, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8)
r2 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)={0x10b, 0x6, 0x209e1e, 0x3, 0x1}, 0x2c)
bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000b40)={r2, &(0x7f0000000040), 0x0, 0x1}, 0x20)
r3 = creat(&(0x7f0000000640)='./file0\x00', 0x100)
setsockopt$inet6_tcp_TCP_REPAIR_QUEUE(r3, 0x6, 0x14, &(0x7f0000000980), 0x4)
unlink(&(0x7f0000000940)='./file0\x00')
r4 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r5 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r5, 0x0)
ioctl$BINDER_GET_NODE_DEBUG_INFO(r4, 0xc018620b, &(0x7f0000000100))
ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f00000000c0)=ANY=[@ANYBLOB="bb8f0000"], 0x0, 0x0, 0x0})
ioctl$BINDER_SET_CONTEXT_MGR(r5, 0x40046207, 0x0)
shutdown(0xffffffffffffffff, 0x1)
ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)})
ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0x0, 0x0, &(0x7f0000000780)})

15:06:22 executing program 2:
r0 = syz_open_procfs(0x0, &(0x7f0000000280)='net/fib_triestat\x00')
lseek(r0, 0x20000, 0x0)
prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000000040)={&(0x7f0000ffb000/0x4000)=nil, &(0x7f0000fef000/0x11000)=nil, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000ff8000/0x3000)=nil, &(0x7f0000fef000/0x4000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ff0000/0x2000)=nil, &(0x7f0000fef000/0x1000)=nil, &(0x7f0000fee000/0x4000)=nil, &(0x7f0000ff4000/0x3000)=nil, &(0x7f0000ff6000/0x4000)=nil, &(0x7f0000000000)="4c61f40cdbb8096ea590ec", 0xb, r0}, 0x68)

[ 1103.818685] binder: 485:490 unknown command 36795
[ 1103.830218] ip6_tunnel: ip6tnl1 xmit: Local address not yet configured!
[ 1103.850717] binder: 485:490 ioctl c0306201 20000140 returned -22
15:06:22 executing program 3:
r0 = socket$inet_udplite(0x2, 0x2, 0x88)
ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f3188b070")
syz_open_procfs(0x0, &(0x7f0000000940)='syscall\x00')
r1 = syz_open_procfs(0x0, &(0x7f0000000040)='fd\x00')
recvmmsg(0xffffffffffffffff, &(0x7f0000003840)=[{{0x0, 0x0, 0x0}}], 0x1, 0x0, 0x0)
perf_event_open(&(0x7f0000940000)={0x2, 0x70, 0xee6a, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x100, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0xff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x10001, 0x1}, 0x0, 0x400000000000000}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
mlock(&(0x7f00005b8000/0x3000)=nil, 0x3000)
ioctl$SNDRV_TIMER_IOCTL_SELECT(0xffffffffffffffff, 0x40345410, 0x0)
openat$uinput(0xffffffffffffff9c, &(0x7f0000000080)='/dev/uinput\x00', 0x2, 0x0)
mmap(&(0x7f000060b000/0x1000)=nil, 0x1000, 0x5, 0x8000400200000033, r1, 0x0)
perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x2, 0x9, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2000000, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x4000000, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8)
r2 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)={0x10b, 0x6, 0x209e1e, 0x3, 0x1}, 0x2c)
bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000b40)={r2, &(0x7f0000000040), 0x0, 0x1}, 0x20)
r3 = creat(&(0x7f0000000640)='./file0\x00', 0x100)
setsockopt$inet6_tcp_TCP_REPAIR_QUEUE(r3, 0x6, 0x14, &(0x7f0000000980), 0x4)
unlink(&(0x7f0000000940)='./file0\x00')
r4 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r5 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r5, 0x0)
ioctl$BINDER_GET_NODE_DEBUG_INFO(r4, 0xc018620b, &(0x7f0000000100))
ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f00000000c0)=ANY=[@ANYBLOB="bb8f0000"], 0x0, 0x0, 0x0})
ioctl$BINDER_SET_CONTEXT_MGR(r5, 0x40046207, 0x0)
shutdown(0xffffffffffffffff, 0x1)
prctl$PR_SET_NAME(0xf, &(0x7f0000000380)='/group.stat\x00')
ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)})

15:06:22 executing program 0:
ioctl$TIOCGSID(0xffffffffffffff9c, 0x5429, &(0x7f0000000040)=<r0=>0x0)
r1 = syz_open_procfs(r0, &(0x7f0000000200)='setgroups\x00\xb5\xd7[\xb6\x7f\xd1+\xcd\xbd\"\xaaE$\x8a+\xeb\x87\"W\xdfL\xe6\x93\x06\xe9>\xec \xc2\x83\xa2#\xceu\xd32<n\xfcJ]O\x8c&\x87i_\xee\xbb\x99(8P\x1bj\xcdy\x9a\x11\xb6\x1f\xa3W\xdb\xd0*D\x9e\xcf\xe2I3]\t\xf6\x1f\f\x06\xf5R\xa5D\b}5\xa3\xed\x14=\x90\x9c \x12\xe5\x8c\xb8n\xa5T\x8a\x0f\x1c\xa3')
writev(r1, &(0x7f0000000380)=[{&(0x7f0000000000)="6dfd57bbc4e23b3d", 0x8}], 0x1)
socketpair(0xa, 0x80802, 0x3, &(0x7f0000000100))
setsockopt$ARPT_SO_SET_ADD_COUNTERS(r1, 0x0, 0x61, &(0x7f0000000080)={'filter\x00', 0x4}, 0x68)
ioctl$TIOCGPTPEER(r1, 0x5441, 0xfffffffffffffffe)

[ 1103.870800] binder: release 485:493 transaction 997 out, still active
[ 1103.899570] binder: send failed reply for transaction 997, target dead
15:06:22 executing program 2:
bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000040)={<r0=>0x0, 0xffffffffffffffff, 0x0, 0x1, &(0x7f0000000000)='\x00', 0xffffffffffffffff}, 0x30)
r1 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000080)='hugetlb.2MB.usage_in_bytes\x00', 0x0, 0x0)
r2 = syz_genetlink_get_family_id$net_dm(&(0x7f0000000100)='NET_DM\x00')
sendmsg$NET_DM_CMD_STOP(r1, &(0x7f00000001c0)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x1400800}, 0xc, &(0x7f0000000180)={&(0x7f0000000140)={0x14, r2, 0x20, 0x70bd26, 0x25dfdbfd, {}, ["", "", "", "", "", ""]}, 0x14}, 0x1, 0x0, 0x0, 0x4804}, 0x1)
r3 = syz_open_procfs(r0, &(0x7f0000000280)='net/sockstat\x00')
lseek(r3, 0x20000, 0x0)
pread64(r1, &(0x7f0000000200)=""/114, 0x72, 0x0)

15:06:22 executing program 4:
r0 = openat$zero(0xffffffffffffff9c, &(0x7f0000000000)='/dev/zero\x00', 0x90001, 0x0)
gettid()
timerfd_create(0x3, 0x800)
ioctl$sock_FIOGETOWN(r0, 0x8903, &(0x7f00000000c0)=<r1=>0x0)
r2 = getpgid(r1)
epoll_ctl$EPOLL_CTL_ADD(r0, 0x1, r0, &(0x7f0000000080)={0x80000000})
getpriority(0x2, r2)
ioctl$RTC_RD_TIME(r0, 0x80247009, &(0x7f0000000040))
r3 = syz_open_procfs(0x0, &(0x7f00000001c0)='net/softnet_stat\x00')
lseek(r3, 0x20000, 0x0)

[ 1103.996723] binder: 504:513 unknown command 36795
[ 1104.008704] binder: 504:513 ioctl c0306201 20000140 returned -22
[ 1104.028742] binder: 517:522 unknown command 36795
15:06:22 executing program 0:
r0 = syz_open_procfs(0x0, &(0x7f0000000200)='setgroups\x00\xb5\xd7[\xb6\x7f\xd1+\xcd\xbd\"\xaaE$\x8a+\xeb\x87\"W\xdfL\xe6\x93\x06\xe9>\xec \xc2\x83\xa2#\xceu\xd32<n\xfcJ]O\x8c&\x87i_\xee\xbb\x99(8P\x1bj\xcdy\x9a\x11\xb6\x1f\xa3W\xdb\xd0*D\x9e\xcf\xe2I3]\t\xf6\x1f\f\x06\xf5R\xa5D\b}5\xa3\xed\x14=\x90\x9c \x12\xe5\x8c\xb8n\xa5T\x8a\x0f\x1c\xa3')
writev(r0, &(0x7f0000000380)=[{&(0x7f0000000000)="6dfd57bbc4e23b3d", 0x8}], 0x1)
flistxattr(r0, &(0x7f0000000040)=""/179, 0xb3)

15:06:22 executing program 4:
r0 = socket$nl_xfrm(0x10, 0x3, 0x6)
r1 = openat$selinux_mls(0xffffffffffffff9c, &(0x7f00000000c0)='/selinux/mls\x00', 0x0, 0x0)
ioctl$TUNGETSNDBUF(r1, 0x800454d3, &(0x7f0000000100))
getsockopt$sock_timeval(r0, 0x1, 0x14, &(0x7f0000000040), &(0x7f0000000080)=0x10)
r2 = syz_open_procfs(0x0, &(0x7f00000001c0)='net/softnet_stat\x00')
lseek(r2, 0x20000, 0x0)
ioctl$SIOCGIFHWADDR(r2, 0x8927, &(0x7f0000000000))

[ 1104.041499] binder: 517:522 ioctl c0306201 20000140 returned -22
[ 1104.051454] binder: BINDER_SET_CONTEXT_MGR already set
[ 1104.064205] binder: 517:522 ioctl 40046207 0 returned -16
[ 1104.076149] binder: 504:535 BC_INCREFS_DONE node 1002 has no pending increfs request
15:06:23 executing program 5:
r0 = socket$inet_udplite(0x2, 0x2, 0x88)
ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f3188b070")
syz_open_procfs(0x0, &(0x7f0000000940)='syscall\x00')
r1 = syz_open_procfs(0x0, &(0x7f0000000040)='fd\x00')
recvmmsg(0xffffffffffffffff, &(0x7f0000003840)=[{{0x0, 0x0, 0x0}}], 0x1, 0x0, 0x0)
syz_emit_ethernet(0x3e, &(0x7f0000000000)={@link_local, @dev, [], {@ipv4={0x800, {{0x6, 0x4, 0x0, 0x0, 0x30, 0x0, 0x100, 0x0, 0x0, 0x0, @empty, @multicast1, {[@generic={0x82, 0x2}]}}, @tipc=@payload_conn={{{0x18, 0x0, 0x0, 0x0, 0x0, 0x6}}}}}}}, &(0x7f0000000080)={0x1, 0x2, [0x0, 0x0, 0xd80, 0x3c2]})
perf_event_open(&(0x7f0000940000)={0x2, 0x70, 0xee6a, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x100, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0xff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x10001, 0x1}, 0x0, 0x400000000000000}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
mlock(&(0x7f00005b8000/0x3000)=nil, 0x3000)
ioctl$SNDRV_TIMER_IOCTL_SELECT(0xffffffffffffffff, 0x40345410, 0x0)
openat$uinput(0xffffffffffffff9c, &(0x7f0000000080)='/dev/uinput\x00', 0x2, 0x0)
mmap(&(0x7f000060b000/0x1000)=nil, 0x1000, 0x5, 0x8000400200000033, r1, 0x0)
unshare(0xfffffffffffffffd)
r2 = getpid()
sched_setscheduler(r2, 0x5, &(0x7f00000000c0))
open$dir(&(0x7f0000000400)='./file0\x00', 0x0, 0x0)
perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f00000004c0), 0x2}, 0x0, 0x0, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r3 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000340)='memory.current\x00', 0x0, 0x0)
ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, 0x0)
socketpair(0x1, 0x20000000000001, 0x0, &(0x7f0000000100)={<r4=>0xffffffffffffffff, <r5=>0xffffffffffffffff})
ioctl$PERF_EVENT_IOC_SET_FILTER(r5, 0x8914, &(0x7f0000000300)='lo\x00\x96o\xd6Q\xb9Y\xa9\xc8J,\x00\xd2\x97\x04\x03\xdc\r')
close(r3)
rt_sigprocmask(0x2, &(0x7f0000000240)={0x6}, &(0x7f00000002c0), 0x8)
ioctl$PERF_EVENT_IOC_SET_FILTER(r5, 0x8923, &(0x7f00000008c0)='lo\x00\x96o8\x0fd\xa1\xe3\xd7]b}\x1f\xa1Y\xad4\x90\x9d`\xd2\x98\x00\x00\x00 \'Y\x17]\x15c\xcaR\xdd\x98OC\x89\x1b\xe7\x84\xe2\x05\x80w\xd2|D\x8dK\x14Bx\xcbuH\xc2\xeec\xbf<>Y\x1a\xfc\x1f9OB\x81\x89\x186\xc5q@n\xb4\xb6s\xb0\x00\x00\xfc\x00\x00\b\x00\x00\xda\xef\xecE\xec\xd5I\xb2\x9b\xfe\x8d\x90?\x00\xe9\xe4~g:\xc1\xb2aj\x96\xbb\xa7\xe2\xc0\xdc\xf9Q\b\xeb\x16\x7fT\x11\xd3\r7\xe6\"f\xcf\x8e\xabd\x0ftp\x82\xae\xd2\x15\x8e+c\xf6\xbf\xe14>\xa6-\xa5c\xde\xd7\xab\xea\x1f\xf8s2\x9cVF\xd5\x18\xfe\x0e\x8f \x01\x00\x00y.\xfc*\x82\xa5\xa1p5\xc8{\xf7\xef\xab\xe8\x99\xebw#\x8at\x1c\x80\xfc\xb0\x95\xa2\xa7\xd7,Y]E8\x83X\xf5F\xdc\x88-\xf5\xb0\xb5^\xdb\x1a\xb6\xaa\x14\xe2\xb9\rh^J-\xd1\xbaUn\x04\'l\x1b\xe0o\xdb\xc8\x91%\x1c\xb5\xbf\xb6\x90\xb4\xc2\x7f]/\xb3\xe7\xc9\'\x94\xcfIo\xdf\x04\x95\xb5\x06\x84\x1fH>\xda\xc5\x04 \x94\x88\xeb\'\xd4;6\x7f\xd9\x99-\x1b|G\x8d\xd4\xb9%\xaaQ\xa0K\x10\x03\x93\xe1\xcc\xe7m\x80\'\xf0\xa5\xed(\r\xa8\x0f&\xb1\xf3\xff0\f\x82%_\x92\x8bD\xb9\xd9\xe7\xf2\xe4\xc1i#\xdc\x87A\xb9\xc7\r\x92\xfa\x11\x11\xb5\x1f\x03\x9d\xdd\x1bj\xdf\xacg\xe3\xa0S\xd3\x8a\xe1n\x97\xea\xf5\xa0\'\v\xe9\xa0\xf1 f\xaan\xcf\xb5i\xb6d\xbc\x92\v\xd58\x16\b\xb3_:\xa4!\ny\xc4&\nWMM\xa8\xc4\v\x9f\x01o\xf4\xab&\xb6\x17\x02P\xc3!N\xf4\b\x1a~\x91V1s\xe9\xbe\x9e\x9b\'\xcde\xb3\xa1\x86\"\xd7\x04\xf1\xc0!\xed\xff\xee$\xc89\x8cB0\xd1dD\xe0IP\x88\xa2\xf2Y\x9af$$\xf1cO\xf7P\xac\xca\x80:!\xb4\x94#\xcb^\x9f\'\x03\xe3\x93\xb9\x82\xbf\xcf\xc4\xe3\xf7\x03Oh\xf2r\xca\x8ff\xbb/\x9f*\xaf\x1a \xa5\xa0?%M\xa5\x86\x98\xf24\'1\xc7\f<\xcc@\xe8\x8a\xac.\xde\xe4\xc7\xf5\x9ck\xa40!\xe9\x14$\xb3\x05m\xb5m\xed\ft\x93\xd8\xa3\x80\'Y\xb9\x05\xbbt|\xbe\xbcz\n\xf3\xf5p\xf8\x9f~\x1b\xd0\v\x1cQ')
getsockopt$inet_IP_IPSEC_POLICY(r1, 0x0, 0x10, &(0x7f00000006c0)={{{@in6=@loopback}}, {{@in6=@initdev}}}, &(0x7f0000000500)=0xe8)
socketpair(0x2, 0x2000000080003, 0x100, &(0x7f0000000480))
syz_genetlink_get_family_id$SEG6(&(0x7f00000003c0)='SEG6\x00')
sendmsg$SEG6_CMD_DUMPHMAC(r4, &(0x7f0000000580)={&(0x7f0000000380)={0x10, 0x0, 0x0, 0x1000000}, 0xc, &(0x7f0000000440)={&(0x7f00000005c0)=ANY=[@ANYBLOB="2300260109447a0000000000000000660000001400001a0065a455e04ea56d0a47018c8e973bcac914471474a7e0d50a000eadd66d2e49a2ed40dcafa1e046ab6aacc2097d8f75bd9c8b8a220bdde116904efa3f9600f22ab388644f66c2d5baec4079a81bae1927e49e91a4964656d7b227702926af5be846f3de49fad39048633fd9161123894d9427f854a30cb0532c8f31f663380e40ce7f6cb15ec8baab3b7c6f"], 0x1}, 0x1, 0x0, 0x0, 0x8000}, 0x804)
r6 = creat(&(0x7f0000000280)='./bus\x00', 0x0)
arch_prctl$ARCH_MAP_VDSO_32(0x2002, 0x7e)
ftruncate(r6, 0x2008200)

15:06:23 executing program 2:
r0 = syz_open_procfs(0x0, &(0x7f0000000280)='net/fib_triestat\x00')
getsockopt$IP_VS_SO_GET_INFO(r0, 0x0, 0x481, &(0x7f0000000000), &(0x7f0000000040)=0xf7)
lseek(r0, 0x20000, 0x0)
ioctl$UI_GET_VERSION(r0, 0x8004552d, &(0x7f0000000080))

15:06:23 executing program 0:
bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000180)={<r0=>0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x3, &(0x7f0000000140)='\xaf$\x00'}, 0x30)
r1 = syz_open_procfs(r0, &(0x7f0000000480)='net/ip_tables_names\x00')
writev(r1, &(0x7f0000000380)=[{&(0x7f0000000000)="6dfd57bbc4e23b3d", 0x8}], 0x1)

15:06:23 executing program 4:
r0 = syz_open_procfs(0x0, &(0x7f00000001c0)='net/softnet_stat\x00')
openat$random(0xffffffffffffff9c, &(0x7f0000000000)='/dev/urandom\x00', 0x40001, 0x0)
lseek(r0, 0x20000, 0x1)
ioctl$LOOP_CHANGE_FD(r0, 0x4c06, r0)

15:06:23 executing program 1:
r0 = socket$inet_udplite(0x2, 0x2, 0x88)
ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f3188b070")
syz_open_procfs(0x0, &(0x7f0000000940)='syscall\x00')
r1 = syz_open_procfs(0x0, &(0x7f0000000040)='fd\x00')
recvmmsg(0xffffffffffffffff, &(0x7f0000003840)=[{{0x0, 0x0, 0x0}}], 0x1, 0x0, 0x0)
perf_event_open(&(0x7f0000940000)={0x2, 0x70, 0xee6a, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x100, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0xff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x10001, 0x1}, 0x0, 0x400000000000000}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
mlock(&(0x7f00005b8000/0x3000)=nil, 0x3000)
ioctl$SNDRV_TIMER_IOCTL_SELECT(0xffffffffffffffff, 0x40345410, 0x0)
openat$uinput(0xffffffffffffff9c, &(0x7f0000000080)='/dev/uinput\x00', 0x2, 0x0)
mmap(&(0x7f000060b000/0x1000)=nil, 0x1000, 0x5, 0x8000400200000033, r1, 0x0)
perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x2, 0x9, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2000000, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x4000000, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8)
r2 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)={0x10b, 0x6, 0x209e1e, 0x3, 0x1}, 0x2c)
bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000b40)={r2, &(0x7f0000000040), 0x0, 0x1}, 0x20)
r3 = creat(&(0x7f0000000640)='./file0\x00', 0x100)
setsockopt$inet6_tcp_TCP_REPAIR_QUEUE(r3, 0x6, 0x14, &(0x7f0000000980), 0x4)
unlink(&(0x7f0000000940)='./file0\x00')
r4 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r5 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r5, 0x0)
ioctl$BINDER_GET_NODE_DEBUG_INFO(r4, 0xc018620b, &(0x7f0000000100))
ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f00000000c0)=ANY=[@ANYBLOB="bb8f0000"], 0x0, 0x0, 0x0})
ioctl$BINDER_SET_CONTEXT_MGR(r5, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)})
ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0x0, 0x0, &(0x7f0000000780)})

15:06:23 executing program 0:
r0 = syz_open_procfs(0x0, &(0x7f0000000200)='setgroups\x00\xb5\xd7[\xb6\x7f\xd1+\xcd\xbd\"\xaaE$\x8a+\xeb\x87\"W\xdfL\xe6\x93\x06\xe9>\xec \xc2\x83\xa2#\xceu\xd32<n\xfcJ]O\x8c&\x87i_\xee\xbb\x99(8P\x1bj\xcdy\x9a\x11\xb6\x1f\xa3W\xdb\xd0*D\x9e\xcf\xe2I3]\t\xf6\x1f\f\x06\xf5R\xa5D\b}5\xa3\xed\x14=\x90\x9c \x12\xe5\x8c\xb8n\xa5T\x8a\x0f\x1c\xa3')
sendfile(r0, r0, &(0x7f0000000040), 0x8)
writev(r0, &(0x7f0000000080)=[{&(0x7f0000000000)="6dfd57bbc4e23b3d", 0x8}], 0x1)
socket$packet(0x11, 0x0, 0x300)

15:06:23 executing program 2:
r0 = syz_open_procfs(0x0, &(0x7f0000000280)='net/fib_triestat\x00')
lseek(r0, 0x0, 0x0)
dup2(r0, r0)
open$dir(&(0x7f0000000000)='./file0\x00', 0x100, 0x84)

15:06:23 executing program 4:
r0 = syz_open_procfs(0x0, &(0x7f0000000200)='net/softnet_stat\x00')
timerfd_settime(r0, 0x1, &(0x7f00000002c0)={{0x0, 0x989680}}, &(0x7f0000000300))
r1 = syz_genetlink_get_family_id$tipc(&(0x7f0000000040)='TIPC\x00')
sendmsg$TIPC_CMD_GET_LINKS(r0, &(0x7f0000000100)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x4}, 0xc, &(0x7f00000000c0)={&(0x7f0000000080)={0x24, r1, 0x100, 0x70bd2c, 0x25dfdbfb, {{}, 0x0, 0x4, 0x0, {0x8, 0x11, 0x1}}, ["", "", "", "", ""]}, 0x24}, 0x1, 0x0, 0x0, 0x10}, 0x40c4)
ioctl$sock_SIOCGPGRP(r0, 0x8904, &(0x7f00000001c0)=<r2=>0x0)
ioctl$sock_inet_SIOCGIFBRDADDR(r0, 0x8919, &(0x7f0000000280)={'irlan0\x00', {0x2, 0x4e23, @broadcast}})
ptrace$PTRACE_SECCOMP_GET_METADATA(0x420d, r2, 0x10, &(0x7f0000000240)={0x2})
poll(&(0x7f0000000140)=[{r0}, {r0, 0x10}, {r0, 0x400}, {r0, 0x1}], 0x4, 0x9)
setsockopt$packet_rx_ring(r0, 0x107, 0x5, &(0x7f0000000180)=@req3={0x10000, 0x4, 0x9, 0x81, 0x0, 0x3, 0x1000}, 0x1c)
lseek(r0, 0x0, 0x0)

15:06:23 executing program 3:
r0 = socket$inet_udplite(0x2, 0x2, 0x88)
ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f3188b070")
syz_open_procfs(0x0, &(0x7f0000000940)='syscall\x00')
r1 = syz_open_procfs(0x0, &(0x7f0000000040)='fd\x00')
recvmmsg(0xffffffffffffffff, &(0x7f0000003840)=[{{0x0, 0x0, 0x0}}], 0x1, 0x0, 0x0)
perf_event_open(&(0x7f0000940000)={0x2, 0x70, 0xee6a, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x100, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0xff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x10001, 0x1}, 0x0, 0x400000000000000}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
mlock(&(0x7f00005b8000/0x3000)=nil, 0x3000)
ioctl$SNDRV_TIMER_IOCTL_SELECT(0xffffffffffffffff, 0x40345410, 0x0)
openat$uinput(0xffffffffffffff9c, &(0x7f0000000080)='/dev/uinput\x00', 0x2, 0x0)
mmap(&(0x7f000060b000/0x1000)=nil, 0x1000, 0x5, 0x8000400200000033, r1, 0x0)
perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x2, 0x9, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2000000, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x4000000, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8)
r2 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)={0x10b, 0x6, 0x209e1e, 0x3, 0x1}, 0x2c)
bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000b40)={r2, &(0x7f0000000040), 0x0, 0x1}, 0x20)
r3 = creat(&(0x7f0000000640)='./file0\x00', 0x100)
setsockopt$inet6_tcp_TCP_REPAIR_QUEUE(r3, 0x6, 0x14, &(0x7f0000000980), 0x4)
unlink(&(0x7f0000000940)='./file0\x00')
r4 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r5 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r5, 0x0)
ioctl$BINDER_GET_NODE_DEBUG_INFO(r4, 0xc018620b, &(0x7f0000000100))
ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f00000000c0)=ANY=[@ANYBLOB="bb8f0000"], 0x0, 0x0, 0x0})
ioctl$BINDER_SET_CONTEXT_MGR(r5, 0x40046207, 0x0)
shutdown(0xffffffffffffffff, 0x1)
prctl$PR_SET_NAME(0xf, &(0x7f0000000380)='/group.stat\x00')
ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)})

15:06:23 executing program 5:
r0 = socket$inet_udplite(0x2, 0x2, 0x88)
ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f3188b070")
syz_open_procfs(0x0, &(0x7f0000000940)='syscall\x00')
r1 = syz_open_procfs(0x0, &(0x7f0000000040)='fd\x00')
recvmmsg(0xffffffffffffffff, &(0x7f0000003840)=[{{0x0, 0x0, 0x0}}], 0x1, 0x0, 0x0)
perf_event_open(&(0x7f0000940000)={0x2, 0x70, 0xee6a, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x100, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0xff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x10001, 0x1}, 0x0, 0x400000000000000}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
mlock(&(0x7f00005b8000/0x3000)=nil, 0x3000)
ioctl$SNDRV_TIMER_IOCTL_SELECT(0xffffffffffffffff, 0x40345410, 0x0)
openat$uinput(0xffffffffffffff9c, &(0x7f0000000080)='/dev/uinput\x00', 0x2, 0x0)
mmap(&(0x7f000060b000/0x1000)=nil, 0x1000, 0x5, 0x8000400200000033, r1, 0x0)
unshare(0xfffffffffffffffd)
r2 = getpid()
sched_setscheduler(r2, 0x5, &(0x7f00000000c0))
open$dir(&(0x7f0000000400)='./file0\x00', 0x0, 0x0)
perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f00000004c0), 0x2}, 0x0, 0x0, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r3 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000340)='memory.current\x00', 0x0, 0x0)
ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, 0x0)
socketpair(0x1, 0x20000000000001, 0x0, &(0x7f0000000100)={<r4=>0xffffffffffffffff, <r5=>0xffffffffffffffff})
ioctl$PERF_EVENT_IOC_SET_FILTER(r5, 0x8914, &(0x7f0000000300)='lo\x00\x96o\xd6Q\xb9Y\xa9\xc8J,\x00\xd2\x97\x04\x03\xdc\r')
close(r3)
rt_sigprocmask(0x2, &(0x7f0000000240)={0x6}, &(0x7f00000002c0), 0x8)
ioctl$PERF_EVENT_IOC_SET_FILTER(r5, 0x8923, &(0x7f00000008c0)='lo\x00\x96o8\x0fd\xa1\xe3\xd7]b}\x1f\xa1Y\xad4\x90\x9d`\xd2\x98\x00\x00\x00 \'Y\x17]\x15c\xcaR\xdd\x98OC\x89\x1b\xe7\x84\xe2\x05\x80w\xd2|D\x8dK\x14Bx\xcbuH\xc2\xeec\xbf<>Y\x1a\xfc\x1f9OB\x81\x89\x186\xc5q@n\xb4\xb6s\xb0\x00\x00\xfc\x00\x00\b\x00\x00\xda\xef\xecE\xec\xd5I\xb2\x9b\xfe\x8d\x90?\x00\xe9\xe4~g:\xc1\xb2aj\x96\xbb\xa7\xe2\xc0\xdc\xf9Q\b\xeb\x16\x7fT\x11\xd3\r7\xe6\"f\xcf\x8e\xabd\x0ftp\x82\xae\xd2\x15\x8e+c\xf6\xbf\xe14>\xa6-\xa5c\xde\xd7\xab\xea\x1f\xf8s2\x9cVF\xd5\x18\xfe\x0e\x8f \x01\x00\x00y.\xfc*\x82\xa5\xa1p5\xc8{\xf7\xef\xab\xe8\x99\xebw#\x8at\x1c\x80\xfc\xb0\x95\xa2\xa7\xd7,Y]E8\x83X\xf5F\xdc\x88-\xf5\xb0\xb5^\xdb\x1a\xb6\xaa\x14\xe2\xb9\rh^J-\xd1\xbaUn\x04\'l\x1b\xe0o\xdb\xc8\x91%\x1c\xb5\xbf\xb6\x90\xb4\xc2\x7f]/\xb3\xe7\xc9\'\x94\xcfIo\xdf\x04\x95\xb5\x06\x84\x1fH>\xda\xc5\x04 \x94\x88\xeb\'\xd4;6\x7f\xd9\x99-\x1b|G\x8d\xd4\xb9%\xaaQ\xa0K\x10\x03\x93\xe1\xcc\xe7m\x80\'\xf0\xa5\xed(\r\xa8\x0f&\xb1\xf3\xff0\f\x82%_\x92\x8bD\xb9\xd9\xe7\xf2\xe4\xc1i#\xdc\x87A\xb9\xc7\r\x92\xfa\x11\x11\xb5\x1f\x03\x9d\xdd\x1bj\xdf\xacg\xe3\xa0S\xd3\x8a\xe1n\x97\xea\xf5\xa0\'\v\xe9\xa0\xf1 f\xaan\xcf\xb5i\xb6d\xbc\x92\v\xd58\x16\b\xb3_:\xa4!\ny\xc4&\nWMM\xa8\xc4\v\x9f\x01o\xf4\xab&\xb6\x17\x02P\xc3!N\xf4\b\x1a~\x91V1s\xe9\xbe\x9e\x9b\'\xcde\xb3\xa1\x86\"\xd7\x04\xf1\xc0!\xed\xff\xee$\xc89\x8cB0\xd1dD\xe0IP\x88\xa2\xf2Y\x9af$$\xf1cO\xf7P\xac\xca\x80:!\xb4\x94#\xcb^\x9f\'\x03\xe3\x93\xb9\x82\xbf\xcf\xc4\xe3\xf7\x03Oh\xf2r\xca\x8ff\xbb/\x9f*\xaf\x1a \xa5\xa0?%M\xa5\x86\x98\xf24\'1\xc7\f<\xcc@\xe8\x8a\xac.\xde\xe4\xc7\xf5\x9ck\xa40!\xe9\x14$\xb3\x05m\xb5m\xed\ft\x93\xd8\xa3\x80\'Y\xb9\x05\xbbt|\xbe\xbcz\n\xf3\xf5p\xf8\x9f~\x1b\xd0\v\x1cQ')
getsockopt$inet_IP_IPSEC_POLICY(r1, 0x0, 0x10, &(0x7f00000006c0)={{{@in6=@loopback}}, {{@in6=@initdev}}}, &(0x7f0000000500)=0xe8)
socketpair(0x2, 0x2000000080003, 0x100, &(0x7f0000000480))
syz_genetlink_get_family_id$SEG6(&(0x7f0000000200)='SEG6\x00')
sendmsg$SEG6_CMD_DUMPHMAC(r4, &(0x7f0000000580)={&(0x7f0000000380)={0x10, 0x0, 0x0, 0x1000000}, 0xc, &(0x7f0000000440)={&(0x7f00000007c0)=ANY=[@ANYBLOB="2300260109447a0000000000000000000000001400001a0065a455e04ea56d0a47018c8e973bcac914471474a7e0d50a000eadd66d2e49a2ed40dcafa1e046ab6aacc2097d8f000000008a220bdde116904efa3f9600f22ab388644f66c2d5baec4079a81bae19273407daef6b1d1fee4a9664e49e91a4964656d7b227702926af5be846f3de49fad39048633fd9161123894d9427f854a30cb0532c8f31f663380e40ce7f6cb15ec8baab3b7c6f"], 0x1}, 0x1, 0x0, 0x0, 0x8000}, 0x804)
r6 = creat(&(0x7f0000000280)='./bus\x00', 0x0)
arch_prctl$ARCH_MAP_VDSO_32(0x2002, 0x7e)
ftruncate(r6, 0x2008200)
open(&(0x7f0000000140)='./bus\x00', 0x4000, 0x0)

[ 1104.709248] binder: release 504:513 transaction 1001 out, still active
[ 1104.719107] binder: send failed reply for transaction 1001, target dead
[ 1104.726041] binder: send failed reply for transaction 1004 to 517:522
15:06:23 executing program 0:
ioctl$TCSETAW(0xffffffffffffffff, 0x5407, &(0x7f0000000040)={0x1, 0x3ef0, 0x2, 0xb26, 0x10, 0x1, 0x6, 0x2, 0x20, 0x7})
ioctl$sock_SIOCGPGRP(0xffffffffffffffff, 0x8904, &(0x7f0000000780)=<r0=>0x0)
r1 = geteuid()
lstat(&(0x7f0000000240)='./file0\x00', &(0x7f0000005740)={0x0, 0x0, 0x0, 0x0, 0x0, <r2=>0x0})
r3 = socket$unix(0x1, 0x5, 0x0)
getsockopt$sock_cred(r3, 0x1, 0x11, &(0x7f0000000880)={<r4=>0x0}, &(0x7f00000008c0)=0xc)
lstat(&(0x7f0000000900)='./file0\x00', &(0x7f0000000940)={0x0, 0x0, 0x0, 0x0, <r5=>0x0})
stat(&(0x7f00000009c0)='./file0\x00', &(0x7f0000000a00)={0x0, 0x0, 0x0, 0x0, 0x0, <r6=>0x0})
getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000001ec0)={<r7=>0x0}, &(0x7f0000001f00)=0xc)
r8 = getuid()
stat(&(0x7f0000001f40)='./file0\x00', &(0x7f0000001f80)={0x0, 0x0, 0x0, 0x0, 0x0, <r9=>0x0})
r10 = openat$ppp(0xffffffffffffff9c, &(0x7f0000002000)='/dev/ppp\x00', 0x100, 0x0)
r11 = fcntl$getown(0xffffffffffffffff, 0x9)
getsockopt$inet6_IPV6_IPSEC_POLICY(0xffffffffffffffff, 0x29, 0x22, &(0x7f00000028c0)={{{@in6=@dev, @in=@empty, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, <r12=>0x0}}, {{@in6=@empty}, 0x0, @in6=@local}}, &(0x7f00000029c0)=0xe8)
lstat(&(0x7f0000002a00)='./file0\x00', &(0x7f0000002a40)={0x0, 0x0, 0x0, 0x0, 0x0, <r13=>0x0})
ioctl$sock_FIOGETOWN(0xffffffffffffffff, 0x8903, &(0x7f0000002ac0)=<r14=>0x0)
stat(&(0x7f0000002b00)='./file0\x00', &(0x7f0000002b40)={0x0, 0x0, 0x0, 0x0, <r15=>0x0})
getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000002bc0)={0x0, 0x0, <r16=>0x0}, &(0x7f0000002c00)=0xc)
fcntl$getownex(0xffffffffffffffff, 0x10, &(0x7f0000002c40)={0x0, <r17=>0x0})
lstat(&(0x7f0000002c80)='./file0\x00', &(0x7f0000002cc0)={0x0, 0x0, 0x0, 0x0, <r18=>0x0})
r19 = getegid()
ioctl$TIOCGPGRP(0xffffffffffffffff, 0x540f, &(0x7f00000046c0)=<r20=>0x0)
getsockopt$inet_IP_IPSEC_POLICY(0xffffffffffffffff, 0x0, 0x10, &(0x7f0000004700)={{{@in6=@mcast2, @in6=@empty, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, <r21=>0x0}}, {{@in=@remote}, 0x0, @in=@local}}, &(0x7f0000004800)=0xe8)
getresgid(&(0x7f0000004840), &(0x7f0000004880), &(0x7f00000048c0)=<r22=>0x0)
ioctl$sock_FIOGETOWN(0xffffffffffffffff, 0x8903, &(0x7f0000004900)=<r23=>0x0)
stat(&(0x7f0000004940)='./file0\x00', &(0x7f0000004980)={0x0, 0x0, 0x0, 0x0, <r24=>0x0})
stat(&(0x7f0000004a00)='./file0\x00', &(0x7f0000004a40)={0x0, 0x0, 0x0, 0x0, 0x0, <r25=>0x0})
ioctl$TIOCGSID(0xffffffffffffffff, 0x5429, &(0x7f0000004ac0)=<r26=>0x0)
getsockopt$inet_IP_IPSEC_POLICY(0xffffffffffffffff, 0x0, 0x10, &(0x7f0000004b00)={{{@in6=@mcast2, @in6=@empty, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, <r27=>0x0}}, {{@in=@local}, 0x0, @in=@multicast2}}, &(0x7f0000004c00)=0xe8)
getgroups(0x4, &(0x7f0000004c40)=[0x0, <r28=>0xee01, 0xffffffffffffffff, 0xffffffffffffffff])
r29 = getpid()
getsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffffff, 0x29, 0x23, &(0x7f0000005280)={{{@in6=@ipv4={[], [], @local}, @in=@initdev, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, <r30=>0x0}}, {{@in6=@remote}, 0x0, @in6=@local}}, &(0x7f0000005380)=0xe8)
getgroups(0xa, &(0x7f00000053c0)=[0x0, 0xee01, 0xffffffffffffffff, 0x0, <r31=>0xee00, 0xee01, 0x0, 0xee00, 0x0, 0xee00])
sendmmsg$unix(0xffffffffffffffff, &(0x7f0000005440)=[{&(0x7f0000000080)=@file={0x1, './file0\x00'}, 0x6e, &(0x7f0000000600)=[{&(0x7f0000000100)="24c4604d92440679f7b4cb241a4dc88aeff7fcda290711e8172669617a7a376c1d25e07ea316a652bb3b181ddee801bfa40a85460d32c5add619af6b14fe156c637dc3e7679769e9a6df07fbfae2cdc7db3ce7125cc207c68d3287473ea1c30c3521392fe5a4de2ca8141b5c22483cfa1f6f36de20aa2c13e0aaab8c547feba330f37dce08003e37b029a8fe19a78ce71a6089ebef274443c7091bb93f20ba5abceb39972a16d562386733a6299d11fa52ed4188a930edc4d3550bb17577e895f50b80c429d6cdea7fed427060ebe158aaafd8f859b32e7321c60d3bf05baebfc67bc68d69dde93ab427c8", 0xeb}, {&(0x7f0000000280)="a7de22f47de7105a093cfe861ced5d4f5c052123432673eaac3b58843a3a33793f131d99fd49d6f97649eef144c1161a3b06a270f283adccffba7b3159", 0x3d}, {&(0x7f00000003c0)="246a31329e46d7106916649ed458852eb97efd73a5036ee99c71af33845be9c11e90fdf18c1734d16ff6464b05f76e74fec28de5d6bbf2d6292969afa03898f273a9a5ad5a80b87689690b2e0303c3974586763ff77f2a1729fec34690df406faddf10bd0bff0479517e69c6907e2650df144fd9a5e5292ea2abbbff15684e6a4847303fe4f2ff1b96f28c1beffe5e91c2da0498d17f87610f16f9f2f9be29e7aa94bf3eff14d650428c7b6bf2555b6bb48180db258b7e174cce60c5aa1826e8ea837dc9d340f7cf760e893a939013e397fcfd", 0xd3}, {&(0x7f00000002c0)="4674836b7c7fb0fcc415bd79a7eb50387ffc4322539262eb187405a4ad817d667105f9322e9f86e82faa925ea0fb8ef1e87a", 0x32}, {&(0x7f00000004c0)="1b9c86b3760d2e2937c5702fd4fba86fb9c9df3374a47641382a64cffcf46b12a78e273e35ad43555e3f1f5b3a4b66aa126f1f4536ffeeb98abfffc303bf414fd2111ab3d05e91cf852bfe965ec844a5234ce1ecc456e991fb8505b1f0c4001772b2a5de56dc105cd3a472976e63f85d71c18a60f318ba5136eb02a831f42fde4246540a11777e686a6ec997dd473e06a87712469b8ce1493a77f12ab375f0c0a47e4d3e158bdb873c0d07151487f2b5246a0cfce752cfe20ac714b3c35a13d87c7ee938e042a76fb761fd56cc31af75bce1bc2d25dde9e93e526062343857c088", 0xe1}, {&(0x7f0000000300)="acaab28528b0790f4ce6c30f9503c2d6facdaf548679d61a9f791bf93cdb7643de6959da6789f8cfd2b4f75da96c19c45a542f23a61fd5cb3811fa2f8ba6262f9079c599855f9d4e7b384def4ce2c2a17e49cadd53a71518d1843957efd3853a803da25fac0d6dcbc3be3a72a9c2eaedd83a90c3", 0x74}, {&(0x7f00000005c0)="0e00", 0x2}], 0x7, &(0x7f0000000680)=[@rights={0x18, 0x1, 0x1, [0xffffffffffffffff]}], 0x18, 0x800}, {&(0x7f00000006c0)=@file={0x1, './file0\x00'}, 0x6e, &(0x7f0000000740), 0x0, &(0x7f0000000a80)=[@cred={0x20, 0x1, 0x2, r0, r1, r2}, @rights={0x30, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff]}, @cred={0x20, 0x1, 0x2, r4, r5, r6}, @rights={0x20, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff]}], 0x90, 0x404c010}, {&(0x7f0000000b40)=@abs={0x1, 0x0, 0x4e24}, 0x6e, &(0x7f0000001e80)=[{&(0x7f0000000bc0)="c2724a3149ba475b0d1e406af1843c86c951d8612e02ea5e2e8b7c4e8a7911f8ee666edae1a355015f2e62e722ada780c745e03d32f03980fd5b5652f9dad865494fa48e7adf886b3ced0921b1e9bede99919d8ce05237fb36a622f64b5ab9191b1104b3d8ded70330cddfdd9eed9ef6e70ef99f560e2f7560fb0763c788defbd70aa8e4e6ac5aaf46b51c848c879acef0e4b9731bc2c40cd114403c37410846148f6d0fbcb383ae66ff4d6f305f27b6e09713a930f0992faea50e8aa156c181850764ec76b9eb98ff0075b3ffa5456c92ce54c9abe8f76215", 0xd9}, {&(0x7f0000000cc0)="6f3d05d37fe45ff1627bd1038474974dd8948a992236844d585942efdecbff90dc541d403e602bc565427700dbdbd0481dfaace88d37630bd6c808857198f9c8a6fe8b529a50448e85990ee745805b5e58518dc4bb487a4657608d8ee2a1d5d19e84abfe4df9f455f913ad67a5db453f914c3b3b9a81a66416ab05fc17e69f8f496262cd2b7f55ad21e3150ef50356767dc531d3b8952dfdf0b4551be19926b94527e56dc89b065749c328f4cfb52a2a0ae65eaa34e904d8708cd2893fbf7bb50aeb24e94a2931a8c0fe84658a1adf1d8fdf56201798c9c5fe9039bd2fa3a1ac1c3eccf2799fd28652f3da8707e936d2f86d59d081fa344766f28bfc3e4354d2eafe9934baf442886679855e5ffc73fe3c5a1649dae38fa354cbabd063391a3774cb71636b7c9463ccd338896d99e82b54c77b5d6085b398cf117d208cfddef189d79cb63c3e70995d5a87c5716634915ae30f0db92e42fdd428296ac3412204e74942cf192a5e8d343c2de10f0a14bb2448e5c5eb0bb6bebab454fc57a5bdc7fa4f25fdaee5b3f01e5e07121a5850911385e92c1e04e183af0c42439a7151e0ef8fbd1f3a266f0ea145b6b44943814967eca8adb3a8d939478244254f26082404e34ca7f9d8777fb7f8f70f7649e02c9fc8cabd7be8b511fbf8f9bb0cac112b7849f871321c4ca1a3d593698b0f813f9aba34b401733e299482683b820e4dfd5bd76931da2adf1bf3c0a1d1b15ac8e05985cd8a1873675e4a2a8556739f39ab3f44a02ad847f24c56d87a11cfb1a94a969c8252fb7f26c5536503e72e7c248a8116480164c5712952bbaa7d2101b1dd96ce432f8491081b8254bd9d5f6eb8a3cf5fb78ef1181fa478a52caddf5a8efb9972e264069e78b6e6762c0bad0f9bf1104289232616d11c0031b42fd728eedbc2a638b23411f089b926e478ab1421f78f9fd8837d6293671dbdf487c4f5d0aa327c547868b46dc66e2ed398551f1520cd13eaf5a6a7fed24df5eaea0194659970401ee729a03d8e2abcf50ff516d92a8f0295f63dd095d7f41006eebe62228ff0a91db1065f193c56f8f17503b1c8c6678028fd4f08ca87ecbd7638f1ac3957e4b9829d1bdf024fa7c64ae1912c10d2cc7d6e17b3491c285ccf900f7153bdc88b9665b8c3a10df0dc8f96aab5715ec588638efcf1cd0579b82eec0bd0644f1df7dbe6cafb990cd81bddb7e8c075d39bdc2f03fd23c61a6e9407b31d9ad36cf4fde5a8917281bb737024768fe7f99103c60ad54de19b01458a1fff99a5953aefb88c9feaa9d9aea02e7e52402db61977b25f5c75f1a5ab4de441ec55dee0a67bda9fac91b2bf6067904728b7c9e6fab7f3754c6ea3c641a1029c0fe3a36adb3969b3d8d5015d66b986a1f1428fbe5c5fe8963dccccdc905bed32cf0f6846a7ecb0782eb4fb1f5445e33654a1601043121eaec957d8766eba820cac3bb884fb30b30f2ddba62941120a30e2c65ef9d03d3a31607b76925eb9489fd5c02b7259af9a973be900685b1820558a9cbc827f3511840798d41043b0c66ff821b937b1f880bd17906f30f79afb206a6e1a1d62aaf5610dc1f4dbb5ff98bdaf684388562c21a9b91c718b2465991a5e26bcd37fac399e1081d965cd124bea3646409044289f495dd0cc076055aa8d062e16ca1fbc06018d04af1a03005bd8fb7341df94b046f58ee106fac02da2a2de4cc3978475db922e9eaad164d90dbcf5071258e19329d5da520c1c7d28182fa7bcf23f5beb7cf2d7feebd27967eb3bd0c96a7d991f06204872debc664982d1aa7a24893d378c88fcab168e877103d7be189631bb768f7226310b453ddce956a5025acda5c8439d05d383a4fc8f07f51ae35bc493417d5918891cb32189763daecad6049ce8b12f8e79ba963f4f29274449ffdf116fde2e350ef8ed4d99a9b8e4fbd281fe1878a9ba679939b8e35772595b1b5375476377fe28a0f62b5cc6e29e4195535b22aa8fc16d668eb380342929cf7a799c0a429f56d423e756a9a1e195ebb89f56cc8c2e454f9ed28018839799d69265e71797eccb899dbcf31fde13c1bbe9147a70e049f3b1a82169553555bf791f308c815b8424a01f6645d4fd844cdc01a45ba89eff23bbed0d61084717c84d522d2f14781bdc80d89a72a7e53d7bfe7f84f44c7e63963a17890a4a8a6f27895bca0418d63819ae6b76f517b92b8f88ff91e9afecdce1caf84ce74078f839486c35070e7c1c720631e95e8330f837aaa2b8237bd7bb26e566ad0f0ebb454d16117ef14c61dfe389980edb23867dc8a55a43f1301ea8860d8566a8cfa655f39d80cdb2b128a6846190db4bc3143a38b755ec90b079c4f374baffb073fc9ba3cab4ee02f5bae679c2d5c1a6d4d6bfc6e652f9afad8e4a372ae467971d199a034e236997d68aa4bfb480966c7c38ee06b3f4f50fdd78a5adc06453bb8bdc8e7b05443f419c1a9966653ccc86026f937c7b4c9edcc5206b06fe05ed7891bf33ca8d6d45cdfbf1fbd0f0c34e630c964d45df1771e93516051f8c9bdb9bce80e0b1bddd14353a410c449d35d8b6acec69bbea21df40e0aa04d6c47fcf5003d4ae33a2e0e1241385c62eede67675ff6f20b52c88c7218300531b5ed9aa5149be01c2a2273cd72a9c202d04a1ccf792df66c071a04eb57dd55d8bfa171f80dffa45965fd615b981a344d99153c24291264b574d6b2596f54e2e7a08058d6a53b82f1e947be82d0e09924d1028dc8926b1aa667acf50d6b425485f33581511cffb1a08c6c563698edcc3593018310140d5fe96d5d02182107f450c58ee3879c3ee924a22066a3c735576cd4eb68faf826e7bcf10589f62ec2bdb07ccf3f04dbb2c9963f6f5e8a91f65763f29e55b971973541f822cc3115a2a374a6fc24366e7a32f24d844ff888121e28ebd488efa7ae1419b9bd25884158435beecbe9e2dec02ace2db1bad619b64cea5f62ac4a44d87208b34473b89c312a8821cfb487fbc16386e085ab7db999fddd3f3f84c5236873aff41271c88558e335b458eac16820106f01b3ca4678cb6ef0bf6710d37390b8acd95f0bfc5a55d840fd2de3a02bb8a5f94c38373331212c135abf263109a4bf0d9c14c9f6404ca2f77b3bd37ea456cffc177f9c09d379309d2f8423438984dc4bf6209b694873662d1de96c000a796c89b16a382d2aab704a69d333afb8efe274a9f0e971ab63748eb884e6603ab1d124583ff5b941dd2a59edc8e9ac4237af27fb5f0a49637699da124907d78b0b376a242ecc49a9cfee9ecca052ec09fd5aae218ce54dd0027cfa2f210041ad7085d46e0da13f49fafeb9afbb945a09d807e272f7af87381076acdaae4a256638051aef87914377bbee398466a5e5415095c17867944ecf19ebe6a6ecf941ad31639f7dd565c57ca62d3d0901d455903ebbdf111fa7c8512918cb38bc6c1100be73e2cad7615d34a6c8c72f648533971dc408c1c8aa4f734662d1f0e5643adce9b0d9301fd23ca0125f734187fb4c9caab2d7161c6ae3d73951f04e918c21333dee4239678c23837cc10f425a1d95226f2ed16073c3a7820d9310dac2a9e8db4bd1cbbc6883ca5234885581464d78db556848c14d4d60fba6632d8f6f2a06ac03e82b94519593273fbc3cdb95591bd4eae494c73636ed419e10a41da037ff2ae311fcce9820bc83277f41e5882c0868852d86e9f7f3dff207ab6b78eeb0701cc37e3751d182317d8f74794b2067bbcc9b8a0d4dabc8b6e61b209525a8ad145f8452d355c8502c60ed32d7cb2fcca0efc15b2d4ca35da72dc0021bf8e2e4b315bafce990dbf5c17e9e13683dd506a0f982c727373e900d8e5f2efa96d3ec70f50aa4a48e7d3663e96123921185aa97934099b4fba1e86795834803dc2c59636cbd19c49ad062d3bf362a11675f750fb1ebdab7a14563d6895bbdbe2d260a394dd8686b1997a6f4d8ae10eddff103a38d9a497dd0766ed417053bf38164b4f1cf9b418fc85d5720da3c3382b1b2b2a38b884fee5c2fbade168d5cda1637a553854164a60eff536198b1e88a77514ff0df0d67bbedb809dc1ff7a637c6cbf866ca49a985c6dfb145ad2c519934628b02b7bbfb69965c2ae5b8176986b242f7f2b703f5be2c09e56276d4b9ed458894a701ba2284604b16203eddd75208cb616a1175a5c92afdd2a7921c79b1c79d4cfe8b1dad7fe130532dd1e54aee06780a6ce8feada6bec88217c97c98b3514cc92dd19adc1d0c22bc058dd557ca8f0ac757c906d0078a6177651dc2b04105b071e992288c2ad44298b40cc80152cdc37085ce35dea59f12a2987d5212dd12b259915711e13a33c3e71a4b3b7011c3342bd08d4e63799db2b30ee666888d8b8ca1419c8272579c23413e5a3c2c72143dd3f5e169ca8945d8534e5ad79c9f2433ccd7c2b422d519c2a6d56f2bd2b34d114a1b3cb0c9141471826c00984d377e1434d3bc22827ad31430bcec0049e1085e6937069fe78fbb3bff42256444352c0b6edcddaba8bce462e736f09778c79d7d77bf9a13a6f11c90f79947be1fbcea24d3d9ff4efc9fb12ecdd4af4d77f290780d59c20954ff516371d0bd565e860e7e23c6f8730beb52777f7832fa01be6bfe5128b2347e31e56c5f1ce2c0ad12ea4babb72914341cbad80895252fdeb933fa6397a49f022cf6ca04175210204f37d4746a08856d05e43f1030f7ac4ca9b10f235eabfbb66fa76a27d07b6ecd81977ddbcf1116f36f2b762a58923e6a54a9d4e01dfea6470d37ff06f074844d93d1894d95e1bc216bdea9bedc9a0895b9c52e7d1aa03b2f3c6cc0c77f838009a2a440b4d7a5863ea99a734599614c8bde9c3306047f0da25ac82a351ae91f82fb93bb01f4bf567e43af761a05df723e6a7cc16ef41e3251a7bc37d48ff8d921f028ed7e56bcf1cf94b9166d0790fde5e678e29b9e13a8c4b36f72647af0f0e6ac552b8ab515bd62fb5b7c5929e816ed00d8f660eacaee2137f547d9f64cece75746f09552d2d4b8de7cfb9c8deaba22a5ee5bb5cd2cceed5f0a8d7faaa19ed1965680f8fea5421ee35d59f7d60c9cfe36c732416d68a63c1bce7646e9ad806f9de68a3d04e98818c292637fb5a5d3294c9c6ed5a4d5e12e7dc092eb381b528f70052bce82368ad12b4fd0b303c885d71b57420f0bcbb061c08e71323c2eace5b86c2ecfc42c817552f053db02baf3a1cce6d0114216190fcc5c5d823c0fe9ca175b4d849286e1654e7e09589f571591a73977b0e35e89efc41bf2b464ed6c11629e499931b831177b6a531d33abcb8c6f117308ab078615e4063b727dafee3563fabdb657c0a61397c7a02f408b4ad1ef0ace529154fd4d2e274ace7e9e3c4c091c37c33e9663ab159aec7eda9dc5b474d4bea02f6689d5c57f6494e43c0a771cdac235b50c196eae8dd8621ef82991621e63dabaf80a416056df2aa52c6b130ca4fb0939d074919e934dee79d3bf4ecb9c47a2ef3967b9fe2ee170527642f613984815fec909fdd955d9280057ea0bc37a78b3632148a7d7f543e80523f8c51eefdbbc178138c645ffaea239d87b56a6b79f8d7bcfe2f11ccd282456718885494ab2af326919882b4276a6146a7a3e73fc4b5b8348ddee9d4d8509dd2394a96330770d929f8fe5be7ddadf5e6d7325e6910b54496cd77d743c31d290c3a56e30bfd64aae31462fa0675bd4e3ba3bbcc1a700b235557300dbc20ccb08601e46759a0cb311e7d330fca43150adf0cc96b8da7b3be170e81b574d6f6c77b3bfb5dd5243056d21361e8eebdc7c25d22", 0x1000}, {&(0x7f0000001cc0)="f6650595dc0dcce10e243631fded5f69d9928e0786af59cdca00912bc097bec0315d5d427f1ac96d67d442b56bb0685bc319a85b3e24636f9bb7f6b1c98e8d47f5e0542cda6690866d583d9af39806244636768a5303c0521ed19f492222f9c51213924cdcd4494bc46885fba48094d20e49476f3e8a583803cedca299ad521a810577513979758ce2dbeb166e9ea439fbadd820e19f92e6df098d252faa000b54f72d952f140643fb0070e0b532b820550df80cae23a7dd817348d9475725500d11850c731127c0de987d4cd8443180f2ba34916cac17ee51aac122df1b58fed4ae0119bd7a75cff68963e0a123f34f273ace412885385aa6aa30833402ec", 0xff}, {&(0x7f0000001dc0)="e1ce3372a24ba6e5a1c041795ebbdb5be210f6168a47e3032cebdf1bdd0b4f02a7dedb5992ce7ab1e974f08128823c6447c47c30747735547e1f10b3feb345c61010f99b7b5ab8e9fab7583a5b3a6a503016c2c44e6d0d8f48bf3309baec61f1e6f62f69082e45c92465fb52ed4875a6b09996f5bd7d29ac05c1ef903a584d3c3cddebde6c474f09f541d1fbe7d69ce1f108f1170ed31f63e16ab72bd54bc432dfedab5e1fe725605bccb28199fdc6", 0xaf}], 0x4, &(0x7f0000002040)=[@cred={0x20, 0x1, 0x2, r7, r8, r9}, @rights={0x30, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff]}, @rights={0x20, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff, r10]}, @rights={0x18, 0x1, 0x1, [0xffffffffffffffff]}], 0x88}, {&(0x7f0000002100)=@file={0x0, './file0\x00'}, 0x6e, &(0x7f0000002240)=[{&(0x7f0000002180)="03056bd19cb900c9fb78d0b76bda170ee9d9b092f6302e781808f421447b0d93cfc6feb1394004d2ab14948a2dcf46757dd780212512ea23d6e48490f63e5c0ecf36fb7c554531a54b6efcd0ba1a6e8923e49b982472e18a39217a471dd6673a529f6fe50d238fa55d9243c045ac9273937ef0f86ca68837d32ed6f5e4fcba121ea6d3e82fb35f6324526c62", 0x8c}], 0x1, 0x0, 0x0, 0x4004004}, {&(0x7f0000002280)=@abs={0x0, 0x0, 0x4e23}, 0x6e, &(0x7f0000002480)=[{&(0x7f0000002300)="cc6e819d7c2c5cfdd403bd4f1c", 0xd}, {&(0x7f0000002340)="32f06cb13eb8c4aa7deeab46ac1159614d156ae03869b41942772af2ad7b5f9c088094f7f3483d69740eb4b66dd6f25171901b82a92a16564ec394f97ea30fcbd061023c60f9cc14aca66c81a3589c43080e1f5c5c52eccc266ecb20e210fe787fbf60de4a6fc1a9ffc3ff681bfb5ebd060758ee56b08641f989ad8e8589fb901de557f22455d6b66a4928454a2bd89ade9f87ba19604764321931ac3609043da4db7e8c4bf69f8004bc07e38fd2c66acb96152c311ec33b8897352216", 0xbd}, {&(0x7f0000002400)="dc23add78961bf2e9f618a9ec29626ced4c53957b184184be666243d4f82ed97656027d79979d08c7325700b31c3820591177ca805f1f9fd12fa2b99ad2de707d090bdefaa0b741c31debdaab10d6831ec9cf99af607dc29a5d0dcf4bb52c1f2f843d3e809e56f7509d2b2823fe9b83d88e7eddc47fc3e7e3b70f58b524ec8", 0x7f}], 0x3, 0x0, 0x0, 0x200088c0}, {&(0x7f00000024c0)=@file={0x1, './file0\x00'}, 0x6e, &(0x7f0000002840)=[{&(0x7f0000002540)="2d3f6a48b9c9dd649c821f8a7af1e362460dfd390fdbf4b43fafda3e104a220c9aafd0e31b337663fccda819968fab31b90ca3c53078bd007366483112d2d123e09988b4f804d2b2f700da3605d0837831a634b2a1daa1f6a5a479041cad0a5a1ccaf1bc4065bc9afa0f2d35263f07b7962a04e9155fbbbfe0f558eb1eebedfee6d7077543b84be0bfe90f3b35150f894274f3734aff43dd9605724596498ba7e2ae93f0cd5ca67872a2b5ca803917d37a357d391c12f42a60361a81eecbbac9c3515128a106", 0xc6}, {&(0x7f0000002640)="d4ccc9ccfdc1265fe2fa9b8e3bf1a657a7f83b7647e0e760beb0f43482343ed734f5db8eb6fe4e9bb3d141435c9569c4261b1bfe0adf84cbc8b563f96eb5ede2dfbfa2266ad2877273eb7ba21b16f3cf7cbb893e94335b8c38ba7899ace4754937a2237b7abf30c0501ca7d66da5067e7f76d330", 0x74}, {&(0x7f00000026c0)}, {&(0x7f0000002700)="46d4fb481f03afc641fe277e7790623ce1513c0ce1d1535d2c23d2f6f243528845b01959605683eee9c6c5accd5a84e6ec1bfd6bc4f3e965ddbb6739916425b08de5a57ca117d219aec1d55536272b22334edd96eb6879036f839a4729bbefaafd7887a31e5b235168e4164e47aec53d66b638283d8d9fd3d48dbbc1ae089d4b2bbb9cee17d837c07c411d", 0x8b}, {&(0x7f00000027c0)="6214e74f70db9b11cb8551e118e3274a9c327d8926a052ce2e40710c03bb05576cf074773a144bbb8039e7d48bc9f9793560fe284a2c2527b4d1268f1b3bbd427579c3cb2b5a51e67dd6c77f4f10a263662f3e", 0x53}], 0x5, &(0x7f0000002d40)=[@cred={0x20, 0x1, 0x2, r11, r12, r13}, @cred={0x20, 0x1, 0x2, r14, r15, r16}, @cred={0x20, 0x1, 0x2, r17, r18, r19}], 0x60, 0x20040000}, {&(0x7f0000002dc0)=@file={0x1, './file0\x00'}, 0x6e, &(0x7f0000002e80)=[{&(0x7f0000002e40)="a3a6ef075f04", 0x6}], 0x1, &(0x7f0000002ec0)=[@rights={0x28, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff]}, @rights={0x20, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff]}, @rights={0x20, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff]}, @rights={0x30, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff]}, @rights={0x18, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff]}], 0xb0, 0x8040}, {&(0x7f0000002f80)=@abs={0x1, 0x0, 0x4e22}, 0x6e, &(0x7f0000004600)=[{&(0x7f0000003000)="2006bb67f0a2269c3e107c7ccc0337584074d6bb97aa9db4eb5dbed01eb387ee714aba20eb5f442ef76e7c111d758c5c4236c0f24ae4ff0f939d1bc9a103cf25b346a3c441766f855e01be792f3b6a00bef2fde9d89bfec4be04ac2665140cff57000c555f4750e2f88de7c7053b7554c1881f8dbe36c41fbe0a6bab7dbe5456609037f1", 0x84}, {&(0x7f00000030c0)="20a3764d11c02270251f7a1d6c5162c175b9ba2444051a17d0b1543d79f219929899d33d6fc598dee7086e32e84bd55fa72a4dbfdb4ec3a99fcea10253ff0a88990c903157430161e1486fd3db37f856cb583551663279d4cdb0beee33c3bd", 0x5f}, {&(0x7f0000003140)="8c9e7b3737c60bb29890604e26d77d899a6d06061873a126dfe4b4bd65437d158e25353685b81487908a55af195d15473c880420eb5e5baaa959ed09de5863f25113f6f85b4026c145d776e19a67e17a222a1900344dc31cbe77dd5e663761237bed8ba53c149aab0528bba769c00cb7db8be41a810999412ffe00a4def26ab5327be73ab0cf8c393ed5981f59c18642f7b632f32b622926e8183ac87c78399982d69605cfa5d22c271087020b82c64fe1b4e2241ae828acc172d1095770d1ed5debfb78d07c3d4e50b6372e213fde3b04430f1ff43f4c088b4de4e1a2de06196716904dc56497b055379a41acc28344023b60f8ec6553c0", 0xf8}, {&(0x7f0000003240)="0f74f89756f057f634cb89068faff1d6050a3af656f9ac30dba0c9620eae05f7f942c4df6869a010acf620d3a5526078acf435f35d30c646c6c471fbc490d0906828e94db79314a28269ad348318c0485e73f0f8e66f1c87c91ba8fafbbb5a6ce83a737469dbaca274cf417ee7fb25a6f9b15a92397b1b87db3fc035a1666c195dcd06ff1d345857e752d94a0e18eb95aa4292ddc77302999ac19e41d6f35fc1f76387b8f4bf08d3a78087a460e6db621fc78b0cd7b44c779ad4f45918cfec52fd7191e1c80d5be31d8f1ba71aa9aa4b6c071c2ed59983501084", 0xda}, {&(0x7f0000003340)="5ba6167f7f04376c23cb494a944800d428180c1ba6c29d108412944ea21cc427e847a0b8a1cc65fa9113fb82691285cddd8cde3cd0e9b1517b345c104c9b3b5bcc28e4ef98a2d3c9946972c8ba87d1d1419650cd59e9ef2c2745efd35695ee74a8a56083358d42848e88094827a6ba6a986b0889bef4418309fa471c57365ef2724b84052962e98484eb54be8f275b928c1ba893c0b7fc0fd6e2b3bae870675dccafe30b3d2e70215fb1520d945448c62cbb1c33bbe34d3ba539784246ad83f46705f47403a6852fdb6afbf5dae86086ae69405b5f4502db1fd80908f544a462d7c43ac95629af88c53ff1b4af6f9f5e418b93bbbe7e49bd53f1766427285cd719aa4f2a5f72d1605180be01e011091313f4c56f4105462e2355be74acbe6fe9ed63e18894e05b1fe61b1763f37448ec386f49ac3b671c46af7338166b91be4640ae9635ada1d70e3d77ad2c8d89ea8b110457052f76ded70da388660707905c1e2578f3ac5f035643b793b437ee4643ac42e70c45b9d144bfee81f6ad7b66dbf7727a7c81564b31daff2e13a55dc50ee448518f4020b8e330b4c6f488f23609988315eb589f2066b0e78faadbbc16b9bd445cd741308ca1e7a577167f8f19d897bc24441c089ae15048bbe2f07a319bb4af646865fb8cf44c6333179ed5e41be11b527bced4aedd88c14dd849732ba0887dbeeb24e9622ba34d1b3174e41106cb5ae861c1bd9b7e15abd9c83d713675c2af5591bc3d3a4563eb1b80a021e7fd72d5ec29f7fafa0637f6fd3ffc501e55c55082a814a0b8106c5eb5ec584c8d18d88a6dbb3e1c3029a29291c73112ac68f18b1b9d52db7770928d8732fc61c746322883d70a66e301a356ed1daf08dbb9752a411eb549708868d70536d0fc162e8b4dfb88d9aab46358ba71ea0933484368d5af4b6632a8c66636107aafe0b89236c838e93213ea4c4ca37d817c59c377a0e9506ed547cc47ab9fbbe63fc931bf5f1dc7926583b41b2af1ee9fbc3af9b1439f46e2385e8ba4db976412194e6da3e738b58dca4e7f10dfa022c33ef968703789ae1233cbe385c03b7c3648b0d0f7506c89fb1a950ac1dcf55ab085bcab3dc2e78da3450ff841b78eee2076c1659d7bb6235837426c15b05ee0f56901a79567b3314b6ef9d51ade40fef283a1b3f619ff19d8d2c4287d505d12655bf7abcfa36c452b3a87d9831b18f7b8f08ee9c51340b57b0f233cc8f1518f67430574da3af897c4dc5095065762cb99db1ef2c91c56b3d5ff116957a3803bf9ab19e84e9ed4fa37f0f5f163d790d0dc7bc77a88f2fe0b5ced3d41e53d13639d03996cca978ece676010ebf7efd40985880db6e19d18dcfcced89d0fff3f54f3d4860ddd02462a0c4c36c77309abe79c1a2315f024be1cc838839066a309ab096fdf5c51eb38c7f5ae8231b0c5a694aab5740300f44d7507b25331946d4fe557f25e698e3bad43ca2ba636f167530cda409f9542fae62baaace0f0488a7270de9aa75c1a4ddf1f8954c436b879e4757ecb4e1c88b0b92e001f1dd75ddb2c184865ae423c73d7eb3ec234efccca6b8e87496dfe76298cce07e9d505ef2ff5e1352a2703ab7568d272b849699fb30dd130882a02e6af27218ebed757ccfc54a1c8eafa74b7199effc875b721d5b5596c93463832c1d80c8f3854201f93f6695802ee28306b140e9b5d3864aed473c5455fffcae09ef21a65d8ce43128e4eddf2b88e64c62c0cde3792463e6006e7057525efeab4982bfdcf03b7009a202e7a95f0cf63667dc6d40983fbe04af69cb4845ae92872931a2422f90998cf7d534328110479eca3e945bb4a4f7e9bdd3428352521231ec9ab033fa84de0c160e256f3c9143951d8e140c864083884cbe0ee858a2d084a4453036de9d7d3d416599ba7b47833be54125fcc61cb03a29799586261f836a692a8fdd305d3ccf6cbc2251c1444f4aac05db7301316e117bd7d1d1557f68fc57e6298c10ab4255f1afe94033b3130c0699ae072908894f1360cfb4624699ef08db73277d28c9e347233c8bec88bf108d52d1e37cac02ea43baced214890d7ed43acca89ab81742da025022c886574a51b9789df4229634969f01976ced7802de383c0b336a3af95048622ff203fd838536c2635bff8a96471b1ff5611b84aec597cd130f7c13cc68809005288f355f20922e88c820af490be525cc9b11eba5a89bcc6418a22ec8e9b1d881b09ac2e01200fd5108bdf1554cb0bcaf20dec2a2a7697fe0901e8999e28d58bf7f4698a5a367c1bf91b6b09849abdee455d297b34b3a188667eb5fd9710e67faf55c062c5e13febc7ffac09be5e1fcfff5cb3d937a5a68961dcf3062aa12feefbb0fe53aa125e812115ceebddd9fe7413ce894db87123c8e092ad5ff2cd622544acd3abda6465a2703a077c6bfeddc14f083589673162fb26209fc61dd4308d224b6f948362ac7f3c42f5eb13e1adf632b4b3685b5542b9189e19803046bd91e161c84b384782838929edc5854b5ef2b545597199115ffc5e89e0173c5ada09024539e9b60067182e695c7010394d4f5f5153d4f4e42487c15bc61c82de9c44155716e5e66768f35888c882f375a092ae0bf460c62c1edfd9c78c79358346a1bbc27053a7f14aa18104e2338f3bdc59e6e11ddb1d745b9f1502b43a86d7dee6ff49d6151e1ef85cd2b5fd50dacb381ca5d178de2b71e57e9414df6d6aa1b41298149605b219e66fee6a1478d20b90b47929b94897fd16cb6af9e9a3023774a5288b0248a1cbd0f029ac9550f68b25c5863ce37a3e826238a74406fd472d23fad693fde049c5e8920f3d02b7839bf146e418db3413e5fb6e89f16755051276b03163e474d2f536b449a0320bb63c4204b64bffb9d9ef7af95516c82237b8131dbb40366147c73097c61fb78552e947fc52931c272d62caf1c3b0dd8a10363c7ad7c5c5f8ef8c6e04c9eabf0f8573f81212ecd844c86a281c2afc385e8779979fb3eee42db43352539fd170f0ebe7839db2740c5cad24c27b984240a9bc983b2ee1d9370fe53f5de7211ff644f9d934a7981d04319fdbe43ae6f5a28bebf854542651ff79fe3b47f50a742a3439766ca720853ec07b4917ef71d603b3a0a79788a9e2b3137f14180fe7d6026e3ec025ba03510637fb4253376fdea92c60dd0bd51a469fa85c7d6e2937534dc55c67fc23568a6c3486ef4f4a6f02442d59b389edf7e36b854771671d8458dc452e0386897fbbb19de5f5bd1746f7ff25d8196286b18af7d91e3e92ea345c923321157a6225f1c99e93a9c257b866e5d55983766948c227a08adae20733b89bf16bbe2c6f2e8b2d214e314587a2e36aef564305d974db38118b4aedb14518c1bda9e56c4de40d5f7d3e1330b1dd7fe9ad4ac6f085e2ec5dc25d153cf1e4f5b251e20ae79a8035ae2cf409c71e43e83c7922961e4afeae03eb9907cf3dc2af7795008c8b03601ab2c6a61c1a20bd96ee60b77f17286991d9e5b2c5ea99f3540a93ee7c007d6ac7bed088dab32d119b1189461ca62404da672555f39f26ed6c2f84f899f9b1a69224ca1941fc033e17c1b866117a9537ec8f1f4d6c5e3db5847a1638ea680316b02c03825e3dd2166efcdf7ca2a9af1481035369b5e6e7c3dc47f6b0fddee8c39404355c8077392f3a5ada61450f50f623d112647c3cd194ba1e68704bca5b8223f73b8685486cf89b0ea003e26e5ed213ffff1685e68f27d5ee212b9848bb2573951101054442c70e3af976bd02278d1b6fa7446fabf7d094053c9691c34318ff138a242806ffa2c17fc3871e84bf5f462e9db8620d910802f7c2ec1aa83137d7f2cb55c123f939fb0dff0f982b3ef1444767faf96fbaf12d86d9473b1dca9c75ee8609754183dc34fdc62b29abe257a1d6a410e5c2d54d08df0b627bc33e42090c06003a2e861b90f71b7c4ced2002a60c230660360777684cfa2ed3b89b1a75ad0a68655bd014b9371abdd07211e5c9c4ab179b6d24a818dc3a9fa15dac011bb8fe96bded55c66d09a8d3bcd3f82f623d60b3caa9af8d7c00b7415d6866da63585702b3c7abd4d8e7781bfa38c23feea83eadeda3cdc4d5e13ca38a6bee1a84b1e4f5d39c2d8727fac73a8e1ff9461d4db34f93f0789f59425c0ff020281857ba025107c6635eb56a5ebf0dfa0b05409f9e65072f3ab83db3eb81b48db34a8d677ccffee9b07473f14e05f1f41d0c6fe87e1642726912fab9b7e47be5104c51c2867a2baa4c39dadbd0a038c0ffb7fa374b9b466625788f86dfd113c42c1705cecaadd70305bd898202a181c5c2ed45f4a60ed077f1359326f8a7074f4d3bb56cb23f2180f39d65c9047a46fb212cf45b5fd053fe4e241e4c2597be4ddcd8a49a4c86cbc87fbfbaa2225645c6618768400ef235e3dbc1f5f20141cd6d7a8b542d57a2b0cee8c74f3567c8bcf3a0526a82a5c461f17c2f4fee206283fd4e726bf12b9ceac0b93bc0b45ddf4c397f6f1dd71a9adbbb6009cf1eabc51877e28e4b52aa34c7cd1fb3f933a3a11f41164cea6a1f7f8dd85a1d7d1edaa98a697d2efc7b2524ad7327d5c6ddb6cdf01360c74a8c7d01b58e118663941de64ead1a90a281ea835b853a784df42f75e7a2732cbbf806f626227be13f167262637bd8ffcb855c73a24508e6f7520dfe55d3247245a2862dbb680c07b54b6e1c4ab2fd99e0114a6731c9b0ec43923591d3464092821c67acafdb7221243f103f971197961a7a65d411d6da8321e5784f43a1a47eaf48aa3148a015879fc5059e1a84086a946f414821bcfe6bb9116e4d2fed7020977734b7d8b74551134a643a81570d150075eb0b1f310536666aacf0d595e318371709c60a0e68d218fa53ff3cf93b9a281b6dd8883081ce1277f1689811a645cbac0675dd765a9cb3b175010a851c79a4426cd24639ad3305f53ad5e24ca86bd73b2813c77a37fcb602804138df2de5782f81519ee21539802aceab0647f337de55d17d73d32593baa904209510bacae7be490ebc8981314b9dd67f5d6f81199f69ea63a3dcfe469ae2d4c28c091eb1dac27185176cdd80f80351601167bf6d825e278dda9bdcaba5fb77b076e493925409979257fb154dfdf5e048ff97c891cd6616ab3b364e690901b68b136fb9aa4c7af682354d5e9f09a1678663dc714e5f3a7d11bf12f29291b2b9769d7d28258d4ab75538cc54aa1a17c4aa35a28302715f453e096e5524828c016b3db26e87b2839dd48f89ce23753a5199c59e80a3db360ea3bb63f177c013b9bed5129cfa72224eb643c63da9d11b7932f4aad887fc4a06cdc4c368fc222558bdd330bf135c02d813d380b6f8b114e2cd7bb84f4abd93c95c0cfeece4572cefe722e8d53f8a8889984a93871ec75d4b2362ab5ca434063dd6e617a6fe4f264761e8da9d7e94c58d98d6cab2c42350b0c5d6edd0683d58c4271329f2401416ea9f0e2bf861ee6ce183121413299fd5705e53ea114e8a5b00bdb5d2dd54646f5743c4d89693172adab8f1441d46bc17ff0c5e37e2ff4dd3a7b2ea425513eb78beb1386176525fa9a1afdb6fff3624c7438cbcde0fab42f4f66631abed79ea2a565cbccd399e7cd6345714e3f1770afbdb450ce2311ed05db5e574a5106de97ad86b1dce0915121c7f2f60baceab882e61e8ab46333472a6da266d881751f43555fa8902bfd8fce75526ffcaf9cf66ce152d53b649f62a65c9e2213c53cef304141ec6b65377662b6b518d8eccff5c499487f8c92da1eb90fd670fa52f3bcf3d5f55a97f2500e6a1d98410", 0x1000}, {&(0x7f0000004340)="f38afc29ad914575b9bdd854130dc769c7a491e8a403d24997bfa9620a2863736ae3c1f1e70262d7b7bfea555737a8ced3a3f6056e0db5f80dd469bc46360429f23aefb4b246f135fc018d7d95ef8ab72991d98c157ce9bcc1be58bf1ec8c24e173dd9cf19f7cef8b087367c4bb71aa5319b77ba714f7064b5d9874e6246f8eb6eca7356f4845f070593816f8e634dfb78c186efb4c58c7d98c7dfea33d3441a0e50003c478f1c684f902d3e", 0xac}, {&(0x7f0000004400)="605d41a5ff66d46bc07f29fc13f3c2333268b8e08b9d0d04303842265e9455ee7c5c683953e0c23efb7ac83a586cef60c809449dd9bc47592eae75ce27b47e058d131507699a95c4a0c33947", 0x4c}, {&(0x7f0000004480)="4f0156496f53ff8106214aed6f9d4778906dd14b47cf5a6da4a27792d0acd5c905787ea9720da1f44e8fdc611cb661f60dbb9f5acbe4d9bc41ed60405834e8de566f2b1ec759b1cbb2eaff4b", 0x4c}, {&(0x7f0000004500)="ed3454503a9bd88f50c486fa8a99634847b4ae08d956af79e6e5271485e66be81108d76402dde7fb1259bd65920a49905ee1ba7aa2facaa4829efabfb5973d203f9b5c5ac60e382e8a187631df4b72b3aca9091277cde52796c4d9504079ca2c88e73093cc02399ebee17c11f13f08ad40887127a0ce62dd757faeb5768f2dbee13c1d5cbf159c59d6ab81076c9a3a4286ccf97737ae463511e00f592faeaefe7c5d4942e2b0bba8c55c6c4b2da42ee2832a8ebc74feb3afcdc936469e60b5c9459e4336ac44f856bf5a02099f136e674148f73b", 0xd4}], 0x9, &(0x7f0000004c80)=[@cred={0x20, 0x1, 0x2, r20, r21, r22}, @cred={0x20, 0x1, 0x2, r23, r24, r25}, @cred={0x20, 0x1, 0x2, r26, r27, r28}, @rights={0x30, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff]}], 0x90}, {&(0x7f0000004d40)=@file={0x1, './file0\x00'}, 0x6e, &(0x7f0000005200)=[{&(0x7f0000004dc0)="eb04e36210538698a9009892eed6fe6d6c9c1c306db79203486d8ac0c8e5ba0d9f5a3fb24dd934873dc4f274b7ccaae8d0150921b9ddb01489db289e908144bafe27620bc28e79d63819e18243976b9a431ff84bc42dacfd796ce6812fe387cf617364871b8e496042b15378fc7806fc1738e1055aef92452ffea8c456bda460753a5a5dc49fde98429ae0e248f1a13d1a6b84801d241a2a8970", 0x9a}, {&(0x7f0000004e80)="bb087e0c9d7c5971a82165c59ed6b42a19706f1cde73f2def81586fb761733758d6b74261bbeb70e773d10157fb47577882f26c5a763ef02dc0cde037549e6a10723ce8609cd812b4b49", 0x4a}, {&(0x7f0000004f00)="d040d7a958d325ca59348b447af7797846cca878b9c83322091242a7bb9f1122a52816ed6dacf19b7dc94838670c7f15e9a99bc63b014a53972e892a1c240e91fee9a282605d086affc2514899e91f7ae53110142770f70844943a300e905ffc8fd5489994bc88e44ef9d09cdfb94f02466a69732a389c7cbdb62d403f9d3d821a270aa1", 0x84}, {&(0x7f0000004fc0)="c350da07ca44bff0706f34b41ad4c611b492b7b1dbf7fedf6a402f905035dc0ebb706b3ed3f80d46f1985d3f923483eed6134add896f47cfb853ea52d8777d7dbf4d4a23a7eebfc67a681c526d501db41434324ce102b59a6add597c6cc952eec1a1621bdd7f7f840868dd0d7005c1eefe6a595bb7975591acba77dc0b0c57b04ab7d5df58c9a7f93c5fe85afe56e34795a2300024d053c7355c6666d0", 0x9d}, {&(0x7f0000005080)="7d8bded7c0ec8f7ebe93b5da9240076fed4fcaf8c51f26f46fa9352e0f8160f50e3df51899a76c0b70123716", 0x2c}, {&(0x7f00000050c0)="057142593efd17c15bfded0a9b9eab71ebb88665544fa8cded405ece391b3480c06b465f4c573589b9e895354168e196d5b8ad2a6dbf44880bc842e20dc4aeab82dd759eb43b518183e2e427005f03a5dc1bd54b9462ef80da0808d0b0d40a330371c733fab7a931272873dbf5ab2c78a2e621d8788a87e8b3b53a82ced9a7d8f0e14769d96c08317019f26494596a6855951a8f22de2632b4422e341720cd3e8d481f6502f975c11965eab1cfaeae1f2d737f877d75e221c6f8d50433e58a18f52da4287d01be8e46d0f08902cb6e72c2bb", 0xd2}, {&(0x7f00000051c0)="16abcbc9df68d1f3d1447d20eb34995515d0010f32330b3d09b905afd2dd52a605a3229b3e564b3c52", 0x29}], 0x7, &(0x7f0000005400)=[@cred={0x20, 0x1, 0x2, r29, r30, r31}], 0x20, 0xc885}], 0x9, 0x4004010)
writev(0xffffffffffffffff, &(0x7f0000000380)=[{&(0x7f0000000000)="6dfd57bbc4e23b3d", 0x8}], 0x1)
prctl$PR_MCE_KILL_GET(0x22)

15:06:23 executing program 2:
r0 = syz_open_procfs(0x0, &(0x7f0000000280)='net/fib_triestat\x00')
pwrite64(r0, &(0x7f00000002c0)="5a4177e11aa84522c8710fcc59e2d9ea5684fd5b405929acf11f346d982846fc058f88ee6db048680cac91fb97c158bd83ec0b12fa87b1e8730b415b7801d24ef297957458bd4d996076ec01c743fb68b67badb49cbac33da0c85913dc3a5705513c481e8c2247a3ad431a83318b3cbca14e380fe644a78b66ce97ffcbe25c88e09153a7a6b24e228f1f4e19354ca39f9a56a04083a2d5d901845ac4c12fc9d5d2da0e61e3781379bcde9b2c5e78e4deafca4cfc4aecf5bc63c8f9963f5503a8d43e563a678004ef900732d0c0e323993abbb47f6e", 0xd5, 0x0)
r1 = socket$inet(0x10, 0x3, 0x40000000000000c)
sendmsg(r1, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000000c0)=[{&(0x7f0000000040)="24000000020107081dfffd946fa2830020200a000900120000090000000000000000ff7e", 0x24}], 0x1}, 0x0)
lseek(r0, 0x20000, 0x0)
getsockopt$inet6_IPV6_IPSEC_POLICY(r0, 0x29, 0x22, &(0x7f0000000000)={{{@in=@local, @in=@loopback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, <r2=>0x0}}, {{@in6=@initdev}, 0x0, @in=@multicast1}}, &(0x7f0000000100)=0xe8)
setsockopt$inet6_mreq(r0, 0x29, 0x1b, &(0x7f0000000180)={@dev={0xfe, 0x80, [], 0x28}, r2}, 0x14)

15:06:23 executing program 4:
r0 = syz_open_procfs(0x0, &(0x7f00000001c0)='net/softnet_stat\x00')
lseek(r0, 0x20000, 0x0)
openat$smack_task_current(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/attr/current\x00', 0x2, 0x0)

15:06:23 executing program 0:
perf_event_open(&(0x7f0000000740)={0x2, 0x70, 0xee6a, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
mkdir(0x0, 0x0)
futex(0x0, 0x8b, 0x1, &(0x7f0000000040), &(0x7f0000000080), 0x0)
openat$selinux_user(0xffffffffffffff9c, 0x0, 0x2, 0x0)
socket$inet_udplite(0x2, 0x2, 0x88)
clone(0x13102001ffe, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
nanosleep(&(0x7f0000000140), 0x0)
r0 = gettid()
wait4(0x0, 0x0, 0x80000002, 0x0)
ptrace$setopts(0x4206, r0, 0x0, 0x0)
tkill(r0, 0x17)
ptrace$cont(0x18, r0, 0x0, 0x0)
ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f00000000c0)={[], 0x0, 0x0, 0x0, 0x3, 0x2a})
ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080))
ptrace$cont(0x1f, r0, 0x0, 0x0)
r1 = syz_open_procfs(0x0, &(0x7f0000000200)='net\x00')
writev(r1, &(0x7f0000000380)=[{&(0x7f0000000000)="6dfd57bbc4e23b3d", 0x8}], 0x1)

[ 1104.878810] netlink: 4 bytes leftover after parsing attributes in process `syz-executor.2'.
[ 1104.917562] netlink: 4 bytes leftover after parsing attributes in process `syz-executor.2'.
[ 1104.937506] binder: 586:592 unknown command 36795
15:06:23 executing program 2:
r0 = syz_open_procfs(0x0, &(0x7f0000000280)='net/fib_triestat\x00')
preadv(r0, &(0x7f0000002640)=[{&(0x7f00000002c0)=""/4096, 0x1000}, {&(0x7f0000000000)=""/34, 0x22}, {&(0x7f0000000040)=""/205, 0xcd}, {&(0x7f0000000140)=""/229, 0xe5}, {&(0x7f00000012c0)=""/120, 0x78}, {&(0x7f0000001340)=""/227, 0xe3}, {&(0x7f0000001440)=""/252, 0xfc}, {&(0x7f0000001540)=""/229, 0xe5}, {&(0x7f0000001640)=""/4096, 0x1000}], 0x9, 0x0)
lseek(r0, 0x20000, 0x0)

15:06:23 executing program 4:
r0 = syz_open_procfs(0x0, &(0x7f0000000040)='net/softnet_stat\x00')
r1 = openat$zero(0xffffffffffffff9c, &(0x7f0000000080)='/dev/zero\x00', 0x1fffff, 0x0)
openat$cgroup_int(r1, &(0x7f0000000000)='cpuset.sched_load_balance\x00', 0x2, 0x0)
lseek(r0, 0x20000, 0x0)

[ 1104.960761] binder: 586:592 ioctl c0306201 20000140 returned -22
[ 1104.965607] binder: 588:595 unknown command 36795
[ 1104.985988] binder: 588:595 ioctl c0306201 20000140 returned -22
[ 1104.998294] binder: BINDER_SET_CONTEXT_MGR already set
[ 1105.008951] binder: 588:595 ioctl 40046207 0 returned -16
[ 1105.064145] binder: 588:605 BC_INCREFS_DONE node 1012 has no pending increfs request
15:06:24 executing program 1:
r0 = socket$inet_udplite(0x2, 0x2, 0x88)
ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f3188b070")
syz_open_procfs(0x0, &(0x7f0000000940)='syscall\x00')
r1 = syz_open_procfs(0x0, &(0x7f0000000040)='fd\x00')
recvmmsg(0xffffffffffffffff, &(0x7f0000003840)=[{{0x0, 0x0, 0x0}}], 0x1, 0x0, 0x0)
perf_event_open(&(0x7f0000940000)={0x2, 0x70, 0xee6a, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x100, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0xff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x10001, 0x1}, 0x0, 0x400000000000000}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
mlock(&(0x7f00005b8000/0x3000)=nil, 0x3000)
ioctl$SNDRV_TIMER_IOCTL_SELECT(0xffffffffffffffff, 0x40345410, 0x0)
openat$uinput(0xffffffffffffff9c, &(0x7f0000000080)='/dev/uinput\x00', 0x2, 0x0)
mmap(&(0x7f000060b000/0x1000)=nil, 0x1000, 0x5, 0x8000400200000033, r1, 0x0)
perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x2, 0x9, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2000000, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x4000000, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8)
r2 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)={0x10b, 0x6, 0x209e1e, 0x3, 0x1}, 0x2c)
bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000b40)={r2, &(0x7f0000000040), 0x0, 0x1}, 0x20)
r3 = creat(&(0x7f0000000640)='./file0\x00', 0x100)
setsockopt$inet6_tcp_TCP_REPAIR_QUEUE(r3, 0x6, 0x14, &(0x7f0000000980), 0x4)
unlink(&(0x7f0000000940)='./file0\x00')
r4 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r5 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r5, 0x0)
ioctl$BINDER_GET_NODE_DEBUG_INFO(r4, 0xc018620b, &(0x7f0000000100))
ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f00000000c0)=ANY=[@ANYBLOB="bb8f0000"], 0x0, 0x0, 0x0})
ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)})
ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0x0, 0x0, &(0x7f0000000780)})

15:06:24 executing program 3:
r0 = socket$inet_udplite(0x2, 0x2, 0x88)
ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f3188b070")
syz_open_procfs(0x0, &(0x7f0000000940)='syscall\x00')
r1 = syz_open_procfs(0x0, &(0x7f0000000040)='fd\x00')
recvmmsg(0xffffffffffffffff, &(0x7f0000003840)=[{{0x0, 0x0, 0x0}}], 0x1, 0x0, 0x0)
perf_event_open(&(0x7f0000940000)={0x2, 0x70, 0xee6a, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x100, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0xff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x10001, 0x1}, 0x0, 0x400000000000000}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
mlock(&(0x7f00005b8000/0x3000)=nil, 0x3000)
ioctl$SNDRV_TIMER_IOCTL_SELECT(0xffffffffffffffff, 0x40345410, 0x0)
openat$uinput(0xffffffffffffff9c, &(0x7f0000000080)='/dev/uinput\x00', 0x2, 0x0)
mmap(&(0x7f000060b000/0x1000)=nil, 0x1000, 0x5, 0x8000400200000033, r1, 0x0)
perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x2, 0x9, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2000000, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x4000000, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8)
r2 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)={0x10b, 0x6, 0x209e1e, 0x3, 0x1}, 0x2c)
bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000b40)={r2, &(0x7f0000000040), 0x0, 0x1}, 0x20)
r3 = creat(&(0x7f0000000640)='./file0\x00', 0x100)
setsockopt$inet6_tcp_TCP_REPAIR_QUEUE(r3, 0x6, 0x14, &(0x7f0000000980), 0x4)
unlink(&(0x7f0000000940)='./file0\x00')
r4 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r5 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r5, 0x0)
ioctl$BINDER_GET_NODE_DEBUG_INFO(r4, 0xc018620b, &(0x7f0000000100))
ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f00000000c0)=ANY=[@ANYBLOB="bb8f0000"], 0x0, 0x0, 0x0})
ioctl$BINDER_SET_CONTEXT_MGR(r5, 0x40046207, 0x0)
shutdown(0xffffffffffffffff, 0x1)
ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)})

15:06:24 executing program 2:
r0 = openat$selinux_status(0xffffffffffffff9c, &(0x7f0000000100)='/selinux/status\x00', 0x0, 0x0)
socket$nl_route(0x10, 0x3, 0x0)
r1 = accept$inet(r0, &(0x7f0000000140)={0x2, 0x0, @multicast2}, &(0x7f0000000040)=0x4b)
ioctl$sock_inet_SIOCSARP(r1, 0x8955, &(0x7f0000000080)={{0x2, 0x4e22, @remote}, {0x1, @link_local}, 0x28, {0x2, 0x4e21, @local}, 'teql0\x00'})
r2 = syz_open_procfs(0x0, &(0x7f0000000280)='net/fib_triestat\x00')
flock(r1, 0x8)
lseek(r2, 0x20000, 0x0)

15:06:24 executing program 4:
r0 = getpid()
r1 = syz_open_procfs(r0, &(0x7f0000000080)='net/icmp\x00')
lseek(r1, 0x20000, 0x0)

15:06:24 executing program 5:
r0 = socket$inet_udplite(0x2, 0x2, 0x88)
ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f3188b070")
syz_open_procfs(0x0, &(0x7f0000000940)='syscall\x00')
r1 = syz_open_procfs(0x0, &(0x7f0000000040)='fd\x00')
recvmmsg(0xffffffffffffffff, &(0x7f0000003840)=[{{0x0, 0x0, 0x0}}], 0x1, 0x0, 0x0)
perf_event_open(&(0x7f0000940000)={0x2, 0x70, 0xee6a, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x100, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0xff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x10001, 0x1}, 0x0, 0x400000000000000}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
mlock(&(0x7f00005b8000/0x3000)=nil, 0x3000)
ioctl$SNDRV_TIMER_IOCTL_SELECT(0xffffffffffffffff, 0x40345410, 0x0)
openat$uinput(0xffffffffffffff9c, &(0x7f0000000080)='/dev/uinput\x00', 0x2, 0x0)
mmap(&(0x7f000060b000/0x1000)=nil, 0x1000, 0x5, 0x8000400200000033, r1, 0x0)
unshare(0xfffffffffffffffd)
r2 = getpid()
sched_setscheduler(r2, 0x5, &(0x7f00000000c0))
open$dir(&(0x7f0000000400)='./file0\x00', 0x0, 0x0)
perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f00000004c0), 0x2}, 0x0, 0x0, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r3 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000340)='memory.current\x00', 0x0, 0x0)
ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, 0x0)
socketpair(0x1, 0x20000000000001, 0x0, &(0x7f0000000100)={<r4=>0xffffffffffffffff, <r5=>0xffffffffffffffff})
ioctl$PERF_EVENT_IOC_SET_FILTER(r5, 0x8914, &(0x7f0000000300)='lo\x00\x96o\xd6Q\xb9Y\xa9\xc8J,\x00\xd2\x97\x04\x03\xdc\r')
close(r3)
rt_sigprocmask(0x2, &(0x7f0000000240)={0x6}, &(0x7f00000002c0), 0x8)
ioctl$PERF_EVENT_IOC_SET_FILTER(r5, 0x8923, &(0x7f00000008c0)='lo\x00\x96o8\x0fd\xa1\xe3\xd7]b}\x1f\xa1Y\xad4\x90\x9d`\xd2\x98\x00\x00\x00 \'Y\x17]\x15c\xcaR\xdd\x98OC\x89\x1b\xe7\x84\xe2\x05\x80w\xd2|D\x8dK\x14Bx\xcbuH\xc2\xeec\xbf<>Y\x1a\xfc\x1f9OB\x81\x89\x186\xc5q@n\xb4\xb6s\xb0\x00\x00\xfc\x00\x00\b\x00\x00\xda\xef\xecE\xec\xd5I\xb2\x9b\xfe\x8d\x90?\x00\xe9\xe4~g:\xc1\xb2aj\x96\xbb\xa7\xe2\xc0\xdc\xf9Q\b\xeb\x16\x7fT\x11\xd3\r7\xe6\"f\xcf\x8e\xabd\x0ftp\x82\xae\xd2\x15\x8e+c\xf6\xbf\xe14>\xa6-\xa5c\xde\xd7\xab\xea\x1f\xf8s2\x9cVF\xd5\x18\xfe\x0e\x8f \x01\x00\x00y.\xfc*\x82\xa5\xa1p5\xc8{\xf7\xef\xab\xe8\x99\xebw#\x8at\x1c\x80\xfc\xb0\x95\xa2\xa7\xd7,Y]E8\x83X\xf5F\xdc\x88-\xf5\xb0\xb5^\xdb\x1a\xb6\xaa\x14\xe2\xb9\rh^J-\xd1\xbaUn\x04\'l\x1b\xe0o\xdb\xc8\x91%\x1c\xb5\xbf\xb6\x90\xb4\xc2\x7f]/\xb3\xe7\xc9\'\x94\xcfIo\xdf\x04\x95\xb5\x06\x84\x1fH>\xda\xc5\x04 \x94\x88\xeb\'\xd4;6\x7f\xd9\x99-\x1b|G\x8d\xd4\xb9%\xaaQ\xa0K\x10\x03\x93\xe1\xcc\xe7m\x80\'\xf0\xa5\xed(\r\xa8\x0f&\xb1\xf3\xff0\f\x82%_\x92\x8bD\xb9\xd9\xe7\xf2\xe4\xc1i#\xdc\x87A\xb9\xc7\r\x92\xfa\x11\x11\xb5\x1f\x03\x9d\xdd\x1bj\xdf\xacg\xe3\xa0S\xd3\x8a\xe1n\x97\xea\xf5\xa0\'\v\xe9\xa0\xf1 f\xaan\xcf\xb5i\xb6d\xbc\x92\v\xd58\x16\b\xb3_:\xa4!\ny\xc4&\nWMM\xa8\xc4\v\x9f\x01o\xf4\xab&\xb6\x17\x02P\xc3!N\xf4\b\x1a~\x91V1s\xe9\xbe\x9e\x9b\'\xcde\xb3\xa1\x86\"\xd7\x04\xf1\xc0!\xed\xff\xee$\xc89\x8cB0\xd1dD\xe0IP\x88\xa2\xf2Y\x9af$$\xf1cO\xf7P\xac\xca\x80:!\xb4\x94#\xcb^\x9f\'\x03\xe3\x93\xb9\x82\xbf\xcf\xc4\xe3\xf7\x03Oh\xf2r\xca\x8ff\xbb/\x9f*\xaf\x1a \xa5\xa0?%M\xa5\x86\x98\xf24\'1\xc7\f<\xcc@\xe8\x8a\xac.\xde\xe4\xc7\xf5\x9ck\xa40!\xe9\x14$\xb3\x05m\xb5m\xed\ft\x93\xd8\xa3\x80\'Y\xb9\x05\xbbt|\xbe\xbcz\n\xf3\xf5p\xf8\x9f~\x1b\xd0\v\x1cQ')
getsockopt$inet_IP_IPSEC_POLICY(r1, 0x0, 0x10, &(0x7f00000006c0)={{{@in6=@loopback}}, {{@in6=@initdev}}}, &(0x7f0000000500)=0xe8)
socketpair(0x2, 0x2000000080003, 0x100, &(0x7f0000000480))
syz_genetlink_get_family_id$SEG6(&(0x7f00000003c0)='SEG6\x00')
sendmsg$SEG6_CMD_DUMPHMAC(r4, &(0x7f0000000580)={&(0x7f0000000380)={0x10, 0x0, 0x0, 0x1000000}, 0xc, &(0x7f0000000440)={&(0x7f00000005c0)=ANY=[@ANYBLOB="2300260109447a0000000000000000660000001400001a0065a455e04ea56d0a47018c8e973bcac914471474a7e0d50a000eadd66d2e49a2ed40dcafa1e046ab6aacc2097d8f75bd9c8b8a220bdde116904efa3f9600f22ab388644f66c2d5baec4079a81bae1927e49e91a4964656d7b227702926af5be846f3de49fad39048633fd9161123894d9427f854a30cb0532c8f31f663380e40ce7f6cb15ec8baab3b7c6f"], 0x1}, 0x1, 0x0, 0x0, 0x8000}, 0x804)
r6 = creat(&(0x7f0000000280)='./bus\x00', 0x0)
arch_prctl$ARCH_MAP_VDSO_32(0x2002, 0x7e)
ftruncate(r6, 0x2008200)
open(&(0x7f0000000140)='./bus\x00', 0x4000, 0x0)

[ 1105.610267] binder: release 586:592 transaction 1008 out, still active
[ 1105.617148] binder: send failed reply for transaction 1008, target dead
[ 1105.624180] binder: send failed reply for transaction 1011 to 588:595
[ 1105.630999] binder: undelivered TRANSACTION_COMPLETE
[ 1105.636388] binder: undelivered TRANSACTION_ERROR: 29189
15:06:24 executing program 2:
r0 = syz_open_procfs(0x0, &(0x7f0000000280)='net/protocols\x00')
lseek(r0, 0x20000, 0x0)
r1 = geteuid()
lstat(&(0x7f0000000040)='./file0\x00', &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, <r2=>0x0})
getsockopt$inet6_IPV6_XFRM_POLICY(r0, 0x29, 0x23, &(0x7f0000000100)={{{@in=@loopback, @in6=@local, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, <r3=>0x0}}, {{@in6=@dev}, 0x0, @in=@broadcast}}, &(0x7f0000000200)=0xe8)
epoll_ctl$EPOLL_CTL_MOD(r0, 0x3, r0, &(0x7f0000000740)={0x2004})
getsockopt$inet_IP_IPSEC_POLICY(r0, 0x0, 0x10, &(0x7f00000002c0)={{{@in=@initdev, @in=@broadcast, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, <r4=>0x0}}, {{@in6=@mcast2}, 0x0, @in6=@dev}}, &(0x7f0000000240)=0xe8)
getsockopt$sock_cred(r0, 0x1, 0x11, &(0x7f00000003c0)={0x0, 0x0, <r5=>0x0}, &(0x7f0000000400)=0xc)
getresgid(&(0x7f0000000440), &(0x7f0000000480)=<r6=>0x0, &(0x7f00000004c0))
lstat(&(0x7f0000000500)='./file0\x00', &(0x7f0000000540)={0x0, 0x0, 0x0, 0x0, 0x0, <r7=>0x0})
getgroups(0x0, &(0x7f0000000780))
getresgid(&(0x7f0000000600), &(0x7f0000000640)=<r8=>0x0, &(0x7f0000000680))
fsetxattr$system_posix_acl(r0, &(0x7f0000000000)='system.posix_acl_default\x00', &(0x7f00000006c0)={{}, {0x1, 0x1}, [{0x2, 0x2, r1}, {0x2, 0x7, r2}, {0x2, 0x2, r3}, {0x2, 0x0, r4}], {0x4, 0x2}, [{0x8, 0x6, r5}, {0x8, 0x3, r6}, {0x8, 0x0, r7}, {0x8, 0x1}, {0x8, 0x4, r8}], {}, {0x20, 0x7}}, 0x6c, 0x2)

15:06:24 executing program 4:
r0 = syz_open_procfs(0x0, &(0x7f00000001c0)='net/softnet_stat\x00')
lseek(r0, 0x23, 0x1)
ioctl$PIO_FONTRESET(r0, 0x4b6d, 0x0)
ioctl$EXT4_IOC_SWAP_BOOT(r0, 0x6611)

15:06:24 executing program 2:
r0 = syz_open_procfs(0x0, &(0x7f0000000280)='net/fib_triestat\x00')
lseek(r0, 0x20000, 0x0)
setsockopt$inet6_tcp_TCP_REPAIR_QUEUE(r0, 0x6, 0x14, &(0x7f0000000080)=0x2, 0x4)
fsetxattr$security_smack_transmute(r0, &(0x7f0000000000)='security.SMACK64TRANSMUTE\x00', &(0x7f0000000040)='TRUE', 0x4, 0x3)

15:06:24 executing program 4:
r0 = syz_open_procfs(0x0, &(0x7f00000001c0)='net/softnet_stat\x00')
lseek(r0, 0x20000, 0x0)
ioctl$TIOCMSET(r0, 0x5418, &(0x7f0000000000)=0x1)

[ 1105.748757] binder: 639:643 unknown command 36795
[ 1105.758151] binder: 644:648 unknown command 36795
[ 1105.760736] binder: 639:643 ioctl c0306201 20000140 returned -22
[ 1105.768548] binder: 644:648 ioctl c0306201 20000140 returned -22
[ 1105.833477] binder: 644:663 BC_INCREFS_DONE node 1019 has no pending increfs request
[ 1106.475267] binder: send failed reply for transaction 1015 to 639:643
[ 1106.482123] binder: send failed reply for transaction 1018 to 644:648
[ 1106.489123] binder: undelivered TRANSACTION_COMPLETE
[ 1106.494623] binder: undelivered TRANSACTION_ERROR: 29189
15:06:26 executing program 0:
r0 = socket$inet_udplite(0x2, 0x2, 0x88)
ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f3188b070")
r1 = syz_open_procfs(0x0, &(0x7f0000000080)='net/dev_mcast\x00')
lseek(r1, 0x20000, 0x0)

15:06:26 executing program 2:
lseek(0xffffffffffffffff, 0x20000, 0x0)

15:06:26 executing program 4:
r0 = syz_open_procfs(0x0, &(0x7f00000001c0)='net/softnet_stat\x00')
lseek(r0, 0x20000, 0x0)
ioctl$sock_SIOCOUTQ(r0, 0x5411, &(0x7f0000000000))

15:06:26 executing program 5:
r0 = socket$inet_udplite(0x2, 0x2, 0x88)
ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f3188b070")
syz_open_procfs(0x0, &(0x7f0000000940)='syscall\x00')
r1 = syz_open_procfs(0x0, &(0x7f0000000040)='fd\x00')
recvmmsg(0xffffffffffffffff, &(0x7f0000003840)=[{{0x0, 0x0, 0x0}}], 0x1, 0x0, 0x0)
perf_event_open(&(0x7f0000940000)={0x2, 0x70, 0xee6a, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x100, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0xff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x10001, 0x1}, 0x0, 0x400000000000000}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
mlock(&(0x7f00005b8000/0x3000)=nil, 0x3000)
ioctl$SNDRV_TIMER_IOCTL_SELECT(0xffffffffffffffff, 0x40345410, 0x0)
openat$uinput(0xffffffffffffff9c, &(0x7f0000000080)='/dev/uinput\x00', 0x2, 0x0)
mmap(&(0x7f000060b000/0x1000)=nil, 0x1000, 0x5, 0x8000400200000033, r1, 0x0)
unshare(0xfffffffffffffffd)
r2 = getpid()
sched_setscheduler(r2, 0x5, &(0x7f00000000c0))
open$dir(&(0x7f0000000400)='./file0\x00', 0x0, 0x0)
perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f00000004c0), 0x2}, 0x0, 0x0, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r3 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000340)='memory.current\x00', 0x0, 0x0)
ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, 0x0)
socketpair(0x1, 0x20000000000001, 0x0, &(0x7f0000000100)={<r4=>0xffffffffffffffff, <r5=>0xffffffffffffffff})
ioctl$PERF_EVENT_IOC_SET_FILTER(r5, 0x8914, &(0x7f0000000300)='lo\x00\x96o\xd6Q\xb9Y\xa9\xc8J,\x00\xd2\x97\x04\x03\xdc\r')
close(r3)
rt_sigprocmask(0x2, &(0x7f0000000240)={0x6}, &(0x7f00000002c0), 0x8)
ioctl$PERF_EVENT_IOC_SET_FILTER(r5, 0x8923, &(0x7f00000008c0)='lo\x00\x96o8\x0fd\xa1\xe3\xd7]b}\x1f\xa1Y\xad4\x90\x9d`\xd2\x98\x00\x00\x00 \'Y\x17]\x15c\xcaR\xdd\x98OC\x89\x1b\xe7\x84\xe2\x05\x80w\xd2|D\x8dK\x14Bx\xcbuH\xc2\xeec\xbf<>Y\x1a\xfc\x1f9OB\x81\x89\x186\xc5q@n\xb4\xb6s\xb0\x00\x00\xfc\x00\x00\b\x00\x00\xda\xef\xecE\xec\xd5I\xb2\x9b\xfe\x8d\x90?\x00\xe9\xe4~g:\xc1\xb2aj\x96\xbb\xa7\xe2\xc0\xdc\xf9Q\b\xeb\x16\x7fT\x11\xd3\r7\xe6\"f\xcf\x8e\xabd\x0ftp\x82\xae\xd2\x15\x8e+c\xf6\xbf\xe14>\xa6-\xa5c\xde\xd7\xab\xea\x1f\xf8s2\x9cVF\xd5\x18\xfe\x0e\x8f \x01\x00\x00y.\xfc*\x82\xa5\xa1p5\xc8{\xf7\xef\xab\xe8\x99\xebw#\x8at\x1c\x80\xfc\xb0\x95\xa2\xa7\xd7,Y]E8\x83X\xf5F\xdc\x88-\xf5\xb0\xb5^\xdb\x1a\xb6\xaa\x14\xe2\xb9\rh^J-\xd1\xbaUn\x04\'l\x1b\xe0o\xdb\xc8\x91%\x1c\xb5\xbf\xb6\x90\xb4\xc2\x7f]/\xb3\xe7\xc9\'\x94\xcfIo\xdf\x04\x95\xb5\x06\x84\x1fH>\xda\xc5\x04 \x94\x88\xeb\'\xd4;6\x7f\xd9\x99-\x1b|G\x8d\xd4\xb9%\xaaQ\xa0K\x10\x03\x93\xe1\xcc\xe7m\x80\'\xf0\xa5\xed(\r\xa8\x0f&\xb1\xf3\xff0\f\x82%_\x92\x8bD\xb9\xd9\xe7\xf2\xe4\xc1i#\xdc\x87A\xb9\xc7\r\x92\xfa\x11\x11\xb5\x1f\x03\x9d\xdd\x1bj\xdf\xacg\xe3\xa0S\xd3\x8a\xe1n\x97\xea\xf5\xa0\'\v\xe9\xa0\xf1 f\xaan\xcf\xb5i\xb6d\xbc\x92\v\xd58\x16\b\xb3_:\xa4!\ny\xc4&\nWMM\xa8\xc4\v\x9f\x01o\xf4\xab&\xb6\x17\x02P\xc3!N\xf4\b\x1a~\x91V1s\xe9\xbe\x9e\x9b\'\xcde\xb3\xa1\x86\"\xd7\x04\xf1\xc0!\xed\xff\xee$\xc89\x8cB0\xd1dD\xe0IP\x88\xa2\xf2Y\x9af$$\xf1cO\xf7P\xac\xca\x80:!\xb4\x94#\xcb^\x9f\'\x03\xe3\x93\xb9\x82\xbf\xcf\xc4\xe3\xf7\x03Oh\xf2r\xca\x8ff\xbb/\x9f*\xaf\x1a \xa5\xa0?%M\xa5\x86\x98\xf24\'1\xc7\f<\xcc@\xe8\x8a\xac.\xde\xe4\xc7\xf5\x9ck\xa40!\xe9\x14$\xb3\x05m\xb5m\xed\ft\x93\xd8\xa3\x80\'Y\xb9\x05\xbbt|\xbe\xbcz\n\xf3\xf5p\xf8\x9f~\x1b\xd0\v\x1cQ')
getsockopt$inet_IP_IPSEC_POLICY(r1, 0x0, 0x10, &(0x7f00000006c0)={{{@in6=@loopback}}, {{@in6=@initdev}}}, &(0x7f0000000500)=0xe8)
socketpair(0x2, 0x2000000080003, 0x100, &(0x7f0000000480))
syz_genetlink_get_family_id$SEG6(&(0x7f00000003c0)='SEG6\x00')
sendmsg$SEG6_CMD_DUMPHMAC(r4, &(0x7f0000000580)={&(0x7f0000000380)={0x10, 0x0, 0x0, 0x1000000}, 0xc, &(0x7f0000000440)={&(0x7f00000005c0)=ANY=[@ANYBLOB="2300260109447a0000000000000000668500001400001a0065a455e04ea56d0a47018c8e973bcac914471474a7e0d546ab6aacc2097d8f75bd9c8b8a220bdde116904efa3f9600f22ab388644f66c2d5baec4079a81bae1927e49e91a4964656d7b227702926af5be846f3de4984be97bd633fd9161123894d9427f854a30cb0532c8f31f663380e40ce7f6cb104c8baab3b7c6f000000000000000000000000000000"], 0x1}, 0x1, 0x0, 0x0, 0x8000}, 0x804)
r6 = creat(&(0x7f0000000280)='./bus\x00', 0x0)
arch_prctl$ARCH_MAP_VDSO_32(0x2002, 0x7e)
ftruncate(r6, 0x2008200)
open(&(0x7f0000000140)='./bus\x00', 0x4000, 0x0)

15:06:26 executing program 3:
r0 = socket$inet_udplite(0x2, 0x2, 0x88)
ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f3188b070")
syz_open_procfs(0x0, &(0x7f0000000940)='syscall\x00')
r1 = syz_open_procfs(0x0, &(0x7f0000000040)='fd\x00')
recvmmsg(0xffffffffffffffff, &(0x7f0000003840)=[{{0x0, 0x0, 0x0}}], 0x1, 0x0, 0x0)
perf_event_open(&(0x7f0000940000)={0x2, 0x70, 0xee6a, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x100, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0xff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x10001, 0x1}, 0x0, 0x400000000000000}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
mlock(&(0x7f00005b8000/0x3000)=nil, 0x3000)
ioctl$SNDRV_TIMER_IOCTL_SELECT(0xffffffffffffffff, 0x40345410, 0x0)
openat$uinput(0xffffffffffffff9c, &(0x7f0000000080)='/dev/uinput\x00', 0x2, 0x0)
mmap(&(0x7f000060b000/0x1000)=nil, 0x1000, 0x5, 0x8000400200000033, r1, 0x0)
perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x2, 0x9, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2000000, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x4000000, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8)
r2 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)={0x10b, 0x6, 0x209e1e, 0x3, 0x1}, 0x2c)
bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000b40)={r2, &(0x7f0000000040), 0x0, 0x1}, 0x20)
r3 = creat(&(0x7f0000000640)='./file0\x00', 0x100)
setsockopt$inet6_tcp_TCP_REPAIR_QUEUE(r3, 0x6, 0x14, &(0x7f0000000980), 0x4)
unlink(&(0x7f0000000940)='./file0\x00')
r4 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r5 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r5, 0x0)
ioctl$BINDER_GET_NODE_DEBUG_INFO(r4, 0xc018620b, &(0x7f0000000100))
ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f00000000c0)=ANY=[@ANYBLOB="bb8f0000"], 0x0, 0x0, 0x0})
ioctl$BINDER_SET_CONTEXT_MGR(r5, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)})

15:06:26 executing program 1:
r0 = socket$inet_udplite(0x2, 0x2, 0x88)
ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f3188b070")
syz_open_procfs(0x0, &(0x7f0000000940)='syscall\x00')
r1 = syz_open_procfs(0x0, &(0x7f0000000040)='fd\x00')
recvmmsg(0xffffffffffffffff, &(0x7f0000003840)=[{{0x0, 0x0, 0x0}}], 0x1, 0x0, 0x0)
perf_event_open(&(0x7f0000940000)={0x2, 0x70, 0xee6a, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x100, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0xff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x10001, 0x1}, 0x0, 0x400000000000000}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
mlock(&(0x7f00005b8000/0x3000)=nil, 0x3000)
ioctl$SNDRV_TIMER_IOCTL_SELECT(0xffffffffffffffff, 0x40345410, 0x0)
openat$uinput(0xffffffffffffff9c, &(0x7f0000000080)='/dev/uinput\x00', 0x2, 0x0)
mmap(&(0x7f000060b000/0x1000)=nil, 0x1000, 0x5, 0x8000400200000033, r1, 0x0)
perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x2, 0x9, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2000000, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x4000000, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8)
r2 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)={0x10b, 0x6, 0x209e1e, 0x3, 0x1}, 0x2c)
bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000b40)={r2, &(0x7f0000000040), 0x0, 0x1}, 0x20)
r3 = creat(&(0x7f0000000640)='./file0\x00', 0x100)
setsockopt$inet6_tcp_TCP_REPAIR_QUEUE(r3, 0x6, 0x14, &(0x7f0000000980), 0x4)
unlink(&(0x7f0000000940)='./file0\x00')
r4 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r5 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r5, 0x0)
ioctl$BINDER_GET_NODE_DEBUG_INFO(r4, 0xc018620b, &(0x7f0000000100))
ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)})
ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0x0, 0x0, &(0x7f0000000780)})

15:06:26 executing program 2:
bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f00000000c0)={0x0, 0xffffffffffffff9c, 0x0, 0x6, &(0x7f0000000080)='nsD\xa4t\x00', 0xffffffffffffffff}, 0x30)
gettid()
gettid()
r0 = gettid()
r1 = syz_open_procfs(r0, &(0x7f0000000100)='nsD\xa4t\x00')
mmap(&(0x7f0000ffb000/0x4000)=nil, 0x4000, 0x2000000, 0x110, r1, 0x0)
lseek(r1, 0x20000, 0x0)
ioctl$KDSIGACCEPT(r1, 0x4b4e, 0x22)
ioctl$PPPIOCATTACH(r1, 0x4004743d, &(0x7f0000000000)=0x1)

15:06:26 executing program 4:
gettid()
fcntl$getownex(0xffffffffffffff9c, 0x10, &(0x7f0000006900))
r0 = getpid()
r1 = syz_open_procfs(r0, &(0x7f0000006940)='net/softnet_stat\x00')
r2 = accept4$packet(r1, &(0x7f0000000040)={0x11, 0x0, <r3=>0x0, 0x1, 0x0, 0x6, @local}, &(0x7f0000000080)=0x14, 0x80800)
setsockopt$inet6_mreq(r1, 0x29, 0x1f, &(0x7f00000000c0)={@initdev={0xfe, 0x88, [], 0x1, 0x0}, r3}, 0x14)
lseek(r1, 0x20000, 0x0)
recvmmsg(r2, &(0x7f0000006680)=[{{&(0x7f0000000100)=@ll, 0x80, &(0x7f0000000900)=[{&(0x7f0000000200)=""/150, 0x96}, {&(0x7f00000002c0)=""/171, 0xab}, {&(0x7f0000000380)=""/136, 0x88}, {&(0x7f0000000440)=""/88, 0x58}, {&(0x7f00000004c0)=""/199, 0xc7}, {&(0x7f00000005c0)=""/191, 0xbf}, {&(0x7f0000000680)=""/203, 0xcb}, {&(0x7f0000000780)=""/243, 0xf3}, {&(0x7f0000000000)=""/42, 0x2a}, {&(0x7f0000000880)=""/103, 0x67}], 0xa, &(0x7f00000009c0)=""/109, 0x6d}, 0x1}, {{&(0x7f0000000a40)=@nfc_llcp, 0x80, &(0x7f0000000180)=[{&(0x7f0000000ac0)=""/227, 0xe3}, {&(0x7f0000000bc0)=""/97, 0x61}], 0x2, &(0x7f0000000c40)=""/199, 0xc7}, 0x9}, {{0x0, 0x0, &(0x7f0000001040)=[{&(0x7f0000000d40)=""/252, 0xfc}, {&(0x7f0000000e40)=""/226, 0xe2}, {&(0x7f0000000f40)=""/240, 0xf0}], 0x3, &(0x7f0000001080)=""/107, 0x6b}, 0x7ff}, {{&(0x7f0000001100)=@un=@abs, 0x80, &(0x7f0000003380)=[{&(0x7f0000001180)=""/33, 0x21}, {&(0x7f00000011c0)=""/4096, 0x1000}, {&(0x7f00000021c0)=""/118, 0x76}, {&(0x7f0000002240)=""/4096, 0x1000}, {&(0x7f0000003240)=""/124, 0x7c}, {&(0x7f00000032c0)=""/151, 0x97}], 0x6, &(0x7f0000003400)=""/156, 0x9c}, 0x40}, {{&(0x7f00000034c0)=@xdp, 0x80, &(0x7f00000037c0)=[{&(0x7f0000003540)=""/84, 0x54}, {&(0x7f00000035c0)=""/52, 0x34}, {&(0x7f0000003600)=""/193, 0xc1}, {&(0x7f0000003700)=""/4, 0x4}, {&(0x7f0000003740)=""/54, 0x36}, {&(0x7f0000003780)=""/43, 0x2b}], 0x6, &(0x7f0000003840)=""/221, 0xdd}, 0x5}, {{&(0x7f0000003940)=@vsock={0x28, 0x0, 0x0, @host}, 0x80, &(0x7f0000003c80)=[{&(0x7f00000039c0)=""/113, 0x71}, {&(0x7f0000003a40)=""/6, 0x6}, {&(0x7f0000003a80)=""/128, 0x80}, {&(0x7f0000003b00)=""/69, 0x45}, {&(0x7f0000003b80)=""/223, 0xdf}], 0x5, &(0x7f0000003d00)=""/58, 0x3a}, 0x3}, {{&(0x7f0000003d40)=@llc, 0x80, &(0x7f0000003e80)=[{&(0x7f0000003dc0)=""/130, 0x82}], 0x1, &(0x7f0000003ec0)=""/92, 0x5c}, 0x1f}, {{&(0x7f0000003f40)=@nl=@unspec, 0x80, &(0x7f00000052c0)=[{&(0x7f0000003fc0)=""/3, 0x3}, {&(0x7f0000004000)=""/4096, 0x1000}, {&(0x7f0000005000)=""/160, 0xa0}, {&(0x7f00000050c0)=""/77, 0x4d}, {&(0x7f0000005140)=""/222, 0xde}, {&(0x7f0000005240)=""/96, 0x60}], 0x6, &(0x7f0000005340)=""/231, 0xe7}, 0x6}, {{&(0x7f0000005440)=@generic, 0x80, &(0x7f00000065c0)=[{&(0x7f00000054c0)=""/4096, 0x1000}, {&(0x7f00000064c0)=""/213, 0xd5}], 0x2, &(0x7f0000006600)=""/73, 0x49}, 0xcd4}], 0x9, 0x10002, &(0x7f00000068c0))
pipe2(&(0x7f00000001c0), 0x80000)

15:06:26 executing program 0:
r0 = socket$inet_udplite(0x2, 0x2, 0x88)
ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f3188b070")
r1 = syz_open_procfs(0x0, &(0x7f0000000080)='net/dev_mcast\x00')
lseek(r1, 0x20000, 0x0)

15:06:26 executing program 2:
r0 = syz_open_procfs(0x0, &(0x7f0000000280)='net/fib_triestat\x00')
ioctl$UI_BEGIN_FF_UPLOAD(r0, 0xc06855c8, &(0x7f0000000000)={0x9, 0x1d, {0x57, 0x101, 0x2, {0xe9f7}, {0x5, 0x3}, @cond=[{0x8000, 0x8, 0x1, 0x4, 0x2, 0x8}, {0xfffffffffffffc00, 0x9, 0xc3db, 0xfffffffffffffbff, 0x2d, 0x101}]}, {0x57, 0x4, 0x80, {0x4, 0x100000000}, {0x1, 0xc7}, @cond=[{0x8, 0x7, 0x2, 0x0, 0x7, 0x3}, {0xaf, 0xffffffff, 0x1ff, 0x4, 0x6, 0x77f2000}]}})
ioctl$TCXONC(r0, 0x540a, 0x100000001)
ioctl$EXT4_IOC_PRECACHE_EXTENTS(r0, 0x6612)
lseek(r0, 0x20000, 0x0)

[ 1108.049698] binder: 681:687 unknown command 36795
[ 1108.058404] binder: 681:687 ioctl c0306201 20000140 returned -22
15:06:26 executing program 4:
ioctl$TIOCGPGRP(0xffffffffffffff9c, 0x540f, &(0x7f0000000140)=<r0=>0x0)
r1 = syz_open_procfs(r0, &(0x7f0000000100)='net/sof\x00\x00\xafyg\x0etat\x00')
lseek(r1, 0x20000, 0x0)
ioctl$TIOCGPGRP(r1, 0x540f, &(0x7f0000000080)=<r2=>0x0)
syz_open_procfs(r2, &(0x7f0000000040)='net/raw6\x00')

15:06:26 executing program 0:
r0 = socket$inet_udplite(0x2, 0x2, 0x88)
ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f3188b070")
r1 = syz_open_procfs(0x0, &(0x7f0000000080)='net/dev_mcast\x00')
lseek(r1, 0x20000, 0x0)

15:06:27 executing program 2:
gettid()
getpgrp(0xffffffffffffffff)
ioctl$TIOCGSID(0xffffffffffffffff, 0x5429, &(0x7f0000000100)=<r0=>0x0)
r1 = syz_open_procfs(r0, &(0x7f0000000140)='attr/keycreate\x00')
getsockopt$EBT_SO_GET_INIT_INFO(r1, 0x0, 0x82, &(0x7f0000000040)={'broute\x00'}, &(0x7f00000000c0)=0x78)
syz_open_procfs(0x0, &(0x7f0000000280)='net/fib_triestat\x00')
ioctl$sock_FIOSETOWN(r1, 0x8901, &(0x7f0000000000)=r0)
lseek(r1, 0x8000000000000, 0x40000000000)
ioctl$FS_IOC_SET_ENCRYPTION_POLICY(r1, 0x800c6613, &(0x7f0000000180)={0x0, @speck128, 0x0, "b1bbb17e6b82e92b"})

[ 1108.128901] binder: 678:694 BC_INCREFS_DONE node 1026 has no pending increfs request
15:06:27 executing program 4:
r0 = getpgrp(0x0)
r1 = syz_open_procfs(r0, &(0x7f00000001c0)='net/softnet_stat\x00')
lseek(r1, 0x20000, 0x0)

15:06:27 executing program 0:
r0 = socket$inet_udplite(0x2, 0x2, 0x88)
ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f3188b070")
r1 = syz_open_procfs(0x0, &(0x7f0000000080)='net/dev_mcast\x00')
lseek(r1, 0x20000, 0x0)

15:06:27 executing program 2:
r0 = syz_open_procfs(0x0, &(0x7f0000000280)='net/fib_triestat\x00')
lseek(r0, 0x20000, 0x0)
getsockopt$inet_IP_IPSEC_POLICY(r0, 0x0, 0x10, &(0x7f0000000000)={{{@in=@local, @in=@initdev, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, <r1=>0x0}}, {{@in6=@mcast1}, 0x0, @in6=@mcast2}}, &(0x7f0000000100)=0xe8)
bpf$BPF_GET_MAP_INFO(0xf, &(0x7f0000000300)={r0, 0x28, &(0x7f00000002c0)}, 0x10)
getgroups(0x5, &(0x7f0000000140)=[0xffffffffffffffff, 0x0, <r2=>0xffffffffffffffff, 0xee00, 0xffffffffffffffff])
getsockopt$sock_cred(r0, 0x1, 0x11, &(0x7f0000000180)={0x0, <r3=>0x0}, &(0x7f00000001c0)=0xc)
ioctl$FS_IOC_SETFSLABEL(r0, 0x41009432, &(0x7f0000000340)="9b6645bd4c398b51ddd534c42080d2e7d3a3986749dcc9cf645e856b82b69ec66573b45ed640d77eaae535dab58b5ea0fb956bc1c96d5bd78a2c3623ba5585302a7540933a705003812ae0451682d69b915e6ebe5a26a4753ba9a4c5924415415e430326bf06da48ff1ef9a4b14b46d35458f336deb31650f89699c9e0a54687864e4aa8ff29266a28daeb55961d37c23a0bf342805493e3643e3ee68ca66e275199645c07d2044bbb1177f7603b86bab43df9ee864bde58d755ddc2cd2d59c17ec902e5d30e6314c3c10282ec16dd24ef3a170297c91ba1e57b055e9244f82f2abe6d604a5dea240a6bf9644b06f399de41e496a76c20d19e9315280e1476be")
write$P9_RSTATu(r0, &(0x7f0000000200)={0x7c, 0x7d, 0x2, {{0x0, 0x56, 0x0, 0x9, {0x24, 0x0, 0x1}, 0x8000000, 0x2, 0x891, 0x4, 0x0, '', 0x11, 'net/fib_triestat\x00', 0x11, 'net/fib_triestat\x00', 0x1, '-'}, 0x11, 'net/fib_triestat\x00', r1, r2, r3}}, 0x7c)
read(r0, &(0x7f00000032c0)=""/4096, 0x12c7)

15:06:27 executing program 5:
r0 = socket$inet_udplite(0x2, 0x2, 0x88)
ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f3188b070")
syz_open_procfs(0x0, &(0x7f0000000940)='syscall\x00')
r1 = syz_open_procfs(0x0, &(0x7f0000000040)='fd\x00')
recvmmsg(0xffffffffffffffff, &(0x7f0000003840)=[{{0x0, 0x0, 0x0}}], 0x1, 0x0, 0x0)
perf_event_open(&(0x7f0000940000)={0x2, 0x70, 0xee6a, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x100, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0xff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x10001, 0x1}, 0x0, 0x400000000000000}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
mlock(&(0x7f00005b8000/0x3000)=nil, 0x3000)
ioctl$SNDRV_TIMER_IOCTL_SELECT(0xffffffffffffffff, 0x40345410, 0x0)
openat$uinput(0xffffffffffffff9c, &(0x7f0000000080)='/dev/uinput\x00', 0x2, 0x0)
mmap(&(0x7f000060b000/0x1000)=nil, 0x1000, 0x5, 0x8000400200000033, r1, 0x0)
unshare(0xfffffffffffffffd)
r2 = getpid()
sched_setscheduler(r2, 0x5, &(0x7f00000000c0))
open$dir(&(0x7f0000000400)='./file0\x00', 0x0, 0x0)
perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f00000004c0), 0x2}, 0x0, 0x0, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r3 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000340)='memory.current\x00', 0x0, 0x0)
ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, 0x0)
socketpair(0x1, 0x20000000000001, 0x0, &(0x7f0000000100)={<r4=>0xffffffffffffffff, <r5=>0xffffffffffffffff})
ioctl$PERF_EVENT_IOC_SET_FILTER(r5, 0x8914, &(0x7f0000000300)='lo\x00\x96o\xd6Q\xb9Y\xa9\xc8J,\x00\xd2\x97\x04\x03\xdc\r')
close(r3)
rt_sigprocmask(0x2, &(0x7f0000000240), &(0x7f00000002c0), 0xffffffffffffff4a)
ioctl$PERF_EVENT_IOC_SET_FILTER(r5, 0x8923, &(0x7f00000008c0)='lo\x00\x96o8\x0fd\xa1\xe3\xd7]b}\x1f\xa1Y\xad4\x90\x9d`\xd2\x98\x00\x00\x00 \'Y\x17]\x15c\xcaR\xdd\x98OC\x89\x1b\xe7\x84\xe2\x05\x80w\xd2|D\x8dK\x14Bx\xcbuH\xc2\xeec\xbf<>Y\x1a\xfc\x1f9OB\x81\x89\x186\xc5q@n\xb4\xb6s\xb0\x00\x00\xfc\x00\x00\b\x00\x00\xda\xef\xecE\xec\xd5I\xb2\x9b\xfe\x8d\x90?\x00\xe9\xe4~g:\xc1\xb2aj\x96\xbb\xa7\xe2\xc0\xdc\xf9Q\b\xeb\x16\x7fT\x11\xd3\r7\xe6\"f\xcf\x8e\xabd\x0ftp\x82\xae\xd2\x15\x8e+c\xf6\xbf\xe14>\xa6-\xa5c\xde\xd7\xab\xea\x1f\xf8s2\x9cVF\xd5\x18\xfe\x0e\x8f \x01\x00\x00y.\xfc*\x82\xa5\xa1p5\xc8{\xf7\xef\xab\xe8\x99\xebw#\x8at\x1c\x80\xfc\xb0\x95\xa2\xa7\xd7,Y]E8\x83X\xf5F\xdc\x88-\xf5\xb0\xb5^\xdb\x1a\xb6\xaa\x14\xe2\xb9\rh^J-\xd1\xbaUn\x04\'l\x1b\xe0o\xdb\xc8\x91%\x1c\xb5\xbf\xb6\x90\xb4\xc2\x7f]/\xb3\xe7\xc9\'\x94\xcfIo\xdf\x04\x95\xb5\x06\x84\x1fH>\xda\xc5\x04 \x94\x88\xeb\'\xd4;6\x7f\xd9\x99-\x1b|G\x8d\xd4\xb9%\xaaQ\xa0K\x10\x03\x93\xe1\xcc\xe7m\x80\'\xf0\xa5\xed(\r\xa8\x0f&\xb1\xf3\xff0\f\x82%_\x92\x8bD\xb9\xd9\xe7\xf2\xe4\xc1i#\xdc\x87A\xb9\xc7\r\x92\xfa\x11\x11\xb5\x1f\x03\x9d\xdd\x1bj\xdf\xacg\xe3\xa0S\xd3\x8a\xe1n\x97\xea\xf5\xa0\'\v\xe9\xa0\xf1 f\xaan\xcf\xb5i\xb6d\xbc\x92\v\xd58\x16\b\xb3_:\xa4!\ny\xc4&\nWMM\xa8\xc4\v\x9f\x01o\xf4\xab&\xb6\x17\x02P\xc3!N\xf4\b\x1a~\x91V1s\xe9\xbe\x9e\x9b\'\xcde\xb3\xa1\x86\"\xd7\x04\xf1\xc0!\xed\xff\xee$\xc89\x8cB0\xd1dD\xe0IP\x88\xa2\xf2Y\x9af$$\xf1cO\xf7P\xac\xca\x80:!\xb4\x94#\xcb^\x9f\'\x03\xe3\x93\xb9\x82\xbf\xcf\xc4\xe3\xf7\x03Oh\xf2r\xca\x8ff\xbb/\x9f*\xaf\x1a \xa5\xa0?%M\xa5\x86\x98\xf24\'1\xc7\f<\xcc@\xe8\x8a\xac.\xde\xe4\xc7\xf5\x9ck\xa40!\xe9\x14$\xb3\x05m\xb5m\xed\ft\x93\xd8\xa3\x80\'Y\xb9\x05\xbbt|\xbe\xbcz\n\xf3\xf5p\xf8\x9f~\x1b\xd0\v\x1cQ')
getsockopt$inet_IP_IPSEC_POLICY(r1, 0x0, 0x10, &(0x7f00000006c0)={{{@in6=@loopback}}, {{@in6=@initdev}}}, &(0x7f0000000500)=0xe8)
socketpair(0x2, 0x2000000080003, 0x100, &(0x7f0000000480))
syz_genetlink_get_family_id$SEG6(&(0x7f00000003c0)='SEG6\x00')
sendmsg$SEG6_CMD_DUMPHMAC(r4, &(0x7f0000000580)={&(0x7f0000000380)={0x10, 0x0, 0x0, 0x1000000}, 0xc, &(0x7f0000000440)={&(0x7f00000007c0)=ANY=[@ANYBLOB="2300260109447a00000000000000006600000f1400001a0065a455e04ea56d0a47018c8e973bcac914471474a7e0d50a000eadd66d2e49a2ed40dcafa1e046ab6aacc2097d8f75bd9c8b8a220bdde116904efa3f9600f22ab388644f66c2d5baec407ab4f9c7cefdd379a81bae1927e49e91a4964656d7b227702926af5be846f3de49fad39048633fd9161123894d9427f854a30cb0532c8f31f663380e40ce7f6cb15ec8baab3b7c374ddac81840f3a6a5e1ab3a6f"], 0x1}, 0x1, 0x0, 0x0, 0x8000}, 0x804)
r6 = creat(&(0x7f0000000280)='./bus\x00', 0x0)
arch_prctl$ARCH_MAP_VDSO_32(0x2002, 0x7e)
ftruncate(r6, 0x2008200)
open(&(0x7f0000000140)='./bus\x00', 0x4000, 0x0)

15:06:27 executing program 4:
r0 = syz_open_procfs(0x0, &(0x7f00000001c0)='net/softnet_stat\x00')
lseek(r0, 0x0, 0x0)

15:06:27 executing program 0:
r0 = socket$inet_udplite(0x2, 0x2, 0x88)
ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f3188b070")
lseek(0xffffffffffffffff, 0x20000, 0x0)

15:06:27 executing program 2:
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0xfffffffffffffffc}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x400000000000000)
r0 = perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x400}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r1 = socket$unix(0x1, 0x0, 0x0)
write$binfmt_elf32(0xffffffffffffffff, 0x0, 0xa25125a27d7e5f6d)
r2 = socket$inet(0x2, 0x4000000000000001, 0x0)
setsockopt$inet_tcp_int(r2, 0x6, 0x80000000000002, &(0x7f0000000200)=0x78, 0x4)
setsockopt$ARPT_SO_SET_ADD_COUNTERS(r2, 0x0, 0x61, &(0x7f00000004c0)={'filter\x00', 0x4}, 0x68)
bind$inet(r2, &(0x7f0000000100)={0x2, 0x4e23, @broadcast}, 0x10)
write$UHID_GET_REPORT_REPLY(r1, &(0x7f0000000180)={0xa, 0x6, 0x8df, 0xfffffffffffffffd}, 0xa)
setsockopt$SO_ATTACH_FILTER(r2, 0x1, 0x1a, &(0x7f0000b86000)={0x1, &(0x7f00000000c0)=[{0x6, 0x0, 0x0, 0xe8}]}, 0x10)
bind$inet(0xffffffffffffffff, &(0x7f0000000340)={0x2, 0x4e22, @broadcast}, 0x10)
keyctl$update(0x2, 0x0, 0x0, 0xfffffffffffffdae)
sendto$inet(r2, 0x0, 0x0, 0x200007fd, &(0x7f0000e68000)={0x2, 0x4e23, @loopback}, 0x10)
recvmsg(r2, &(0x7f0000000240)={0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f0000003ac0)=""/4096, 0x1000}], 0x1}, 0x100)
readv(r0, &(0x7f0000000940)=[{&(0x7f00000005c0)=""/223, 0xdf}, {&(0x7f00000006c0)=""/199, 0xc7}, {&(0x7f00000007c0)=""/152, 0x98}], 0x3)
write$binfmt_elf64(r2, &(0x7f0000001640)=ANY=[], 0xf5aab446)

15:06:27 executing program 1:
r0 = socket$inet_udplite(0x2, 0x2, 0x88)
ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f3188b070")
syz_open_procfs(0x0, &(0x7f0000000940)='syscall\x00')
r1 = syz_open_procfs(0x0, &(0x7f0000000040)='fd\x00')
recvmmsg(0xffffffffffffffff, &(0x7f0000003840)=[{{0x0, 0x0, 0x0}}], 0x1, 0x0, 0x0)
perf_event_open(&(0x7f0000940000)={0x2, 0x70, 0xee6a, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x100, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0xff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x10001, 0x1}, 0x0, 0x400000000000000}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
mlock(&(0x7f00005b8000/0x3000)=nil, 0x3000)
ioctl$SNDRV_TIMER_IOCTL_SELECT(0xffffffffffffffff, 0x40345410, 0x0)
openat$uinput(0xffffffffffffff9c, &(0x7f0000000080)='/dev/uinput\x00', 0x2, 0x0)
mmap(&(0x7f000060b000/0x1000)=nil, 0x1000, 0x5, 0x8000400200000033, r1, 0x0)
perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x2, 0x9, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2000000, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x4000000, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8)
r2 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)={0x10b, 0x6, 0x209e1e, 0x3, 0x1}, 0x2c)
bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000b40)={r2, &(0x7f0000000040), 0x0, 0x1}, 0x20)
r3 = creat(&(0x7f0000000640)='./file0\x00', 0x100)
setsockopt$inet6_tcp_TCP_REPAIR_QUEUE(r3, 0x6, 0x14, &(0x7f0000000980), 0x4)
unlink(&(0x7f0000000940)='./file0\x00')
r4 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r5 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r5, 0x0)
ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)})
ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0x0, 0x0, &(0x7f0000000780)})

15:06:27 executing program 3:
r0 = socket$inet_udplite(0x2, 0x2, 0x88)
ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f3188b070")
syz_open_procfs(0x0, &(0x7f0000000940)='syscall\x00')
r1 = syz_open_procfs(0x0, &(0x7f0000000040)='fd\x00')
recvmmsg(0xffffffffffffffff, &(0x7f0000003840)=[{{0x0, 0x0, 0x0}}], 0x1, 0x0, 0x0)
perf_event_open(&(0x7f0000940000)={0x2, 0x70, 0xee6a, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x100, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0xff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x10001, 0x1}, 0x0, 0x400000000000000}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
mlock(&(0x7f00005b8000/0x3000)=nil, 0x3000)
ioctl$SNDRV_TIMER_IOCTL_SELECT(0xffffffffffffffff, 0x40345410, 0x0)
openat$uinput(0xffffffffffffff9c, &(0x7f0000000080)='/dev/uinput\x00', 0x2, 0x0)
mmap(&(0x7f000060b000/0x1000)=nil, 0x1000, 0x5, 0x8000400200000033, r1, 0x0)
perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x2, 0x9, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2000000, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x4000000, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8)
r2 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)={0x10b, 0x6, 0x209e1e, 0x3, 0x1}, 0x2c)
bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000b40)={r2, &(0x7f0000000040), 0x0, 0x1}, 0x20)
r3 = creat(&(0x7f0000000640)='./file0\x00', 0x100)
setsockopt$inet6_tcp_TCP_REPAIR_QUEUE(r3, 0x6, 0x14, &(0x7f0000000980), 0x4)
unlink(&(0x7f0000000940)='./file0\x00')
r4 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r5 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r5, 0x0)
ioctl$BINDER_GET_NODE_DEBUG_INFO(r4, 0xc018620b, &(0x7f0000000100))
ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f00000000c0)=ANY=[@ANYBLOB="bb8f0000"], 0x0, 0x0, 0x0})
ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)})

[ 1108.769655] binder: release 678:686 transaction 1025 out, still active
[ 1108.787590] binder: release 681:687 transaction 1022 out, still active
[ 1108.794955] binder: unexpected work type, 4, not freed
[ 1108.807360] binder: undelivered TRANSACTION_COMPLETE
15:06:27 executing program 4:
r0 = syz_open_procfs(0x0, &(0x7f00000001c0)='net/softnet_stat\x00')
dup3(r0, r0, 0x80000)
lseek(r0, 0x20000, 0x0)

15:06:27 executing program 0:
r0 = socket$inet_udplite(0x2, 0x2, 0x88)
ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f3188b070")
lseek(0xffffffffffffffff, 0x20000, 0x0)

[ 1108.814831] binder: send failed reply for transaction 1022, target dead
[ 1108.823943] binder: send failed reply for transaction 1025, target dead
[ 1108.902665] binder: 747:750 transaction failed 29189/-22, size 24-8 line 3117
[ 1108.919229] binder: 747:750 BC_INCREFS_DONE u0000000000000000 no match
[ 1108.944514] binder: 745:751 unknown command 36795
15:06:27 executing program 0:
r0 = socket$inet_udplite(0x2, 0x2, 0x88)
ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f3188b070")
lseek(0xffffffffffffffff, 0x20000, 0x0)

15:06:27 executing program 1:
r0 = socket$inet_udplite(0x2, 0x2, 0x88)
ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f3188b070")
syz_open_procfs(0x0, &(0x7f0000000940)='syscall\x00')
r1 = syz_open_procfs(0x0, &(0x7f0000000040)='fd\x00')
recvmmsg(0xffffffffffffffff, &(0x7f0000003840)=[{{0x0, 0x0, 0x0}}], 0x1, 0x0, 0x0)
perf_event_open(&(0x7f0000940000)={0x2, 0x70, 0xee6a, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x100, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0xff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x10001, 0x1}, 0x0, 0x400000000000000}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
mlock(&(0x7f00005b8000/0x3000)=nil, 0x3000)
ioctl$SNDRV_TIMER_IOCTL_SELECT(0xffffffffffffffff, 0x40345410, 0x0)
openat$uinput(0xffffffffffffff9c, &(0x7f0000000080)='/dev/uinput\x00', 0x2, 0x0)
mmap(&(0x7f000060b000/0x1000)=nil, 0x1000, 0x5, 0x8000400200000033, r1, 0x0)
perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x2, 0x9, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2000000, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x4000000, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8)
r2 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)={0x10b, 0x6, 0x209e1e, 0x3, 0x1}, 0x2c)
bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000b40)={r2, &(0x7f0000000040), 0x0, 0x1}, 0x20)
r3 = creat(&(0x7f0000000640)='./file0\x00', 0x100)
setsockopt$inet6_tcp_TCP_REPAIR_QUEUE(r3, 0x6, 0x14, &(0x7f0000000980), 0x4)
unlink(&(0x7f0000000940)='./file0\x00')
r4 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r5 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r5, 0x0)
ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)})
ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0x0, 0x0, &(0x7f0000000780)})

15:06:27 executing program 4:
lseek(0xffffffffffffffff, 0x20000, 0x0)

[ 1108.959096] binder: 745:751 ioctl c0306201 20000140 returned -22
[ 1108.975839] binder: 745:751 transaction failed 29189/-22, size 24-8 line 3117
15:06:27 executing program 3:
r0 = socket$inet_udplite(0x2, 0x2, 0x88)
ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f3188b070")
syz_open_procfs(0x0, &(0x7f0000000940)='syscall\x00')
r1 = syz_open_procfs(0x0, &(0x7f0000000040)='fd\x00')
recvmmsg(0xffffffffffffffff, &(0x7f0000003840)=[{{0x0, 0x0, 0x0}}], 0x1, 0x0, 0x0)
perf_event_open(&(0x7f0000940000)={0x2, 0x70, 0xee6a, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x100, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0xff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x10001, 0x1}, 0x0, 0x400000000000000}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
mlock(&(0x7f00005b8000/0x3000)=nil, 0x3000)
ioctl$SNDRV_TIMER_IOCTL_SELECT(0xffffffffffffffff, 0x40345410, 0x0)
openat$uinput(0xffffffffffffff9c, &(0x7f0000000080)='/dev/uinput\x00', 0x2, 0x0)
mmap(&(0x7f000060b000/0x1000)=nil, 0x1000, 0x5, 0x8000400200000033, r1, 0x0)
perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x2, 0x9, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2000000, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x4000000, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8)
r2 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)={0x10b, 0x6, 0x209e1e, 0x3, 0x1}, 0x2c)
bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000b40)={r2, &(0x7f0000000040), 0x0, 0x1}, 0x20)
r3 = creat(&(0x7f0000000640)='./file0\x00', 0x100)
setsockopt$inet6_tcp_TCP_REPAIR_QUEUE(r3, 0x6, 0x14, &(0x7f0000000980), 0x4)
unlink(&(0x7f0000000940)='./file0\x00')
r4 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r5 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r5, 0x0)
ioctl$BINDER_GET_NODE_DEBUG_INFO(r4, 0xc018620b, &(0x7f0000000100))
ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f00000000c0)=ANY=[@ANYBLOB="bb8f0000"], 0x0, 0x0, 0x0})
ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)})

[ 1109.175833] binder: 762:776 transaction failed 29189/-22, size 24-8 line 3117
[ 1109.181545] binder: 768:770 unknown command 36795
[ 1109.192711] binder: 768:770 ioctl c0306201 20000140 returned -22
[ 1109.203965] binder: 762:767 BC_INCREFS_DONE u0000000000000000 no match
[ 1109.213061] binder: 768:770 transaction failed 29189/-22, size 24-8 line 3117
15:06:28 executing program 5:
r0 = socket$inet_udplite(0x2, 0x2, 0x88)
ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f3188b070")
syz_open_procfs(0x0, &(0x7f0000000940)='syscall\x00')
r1 = syz_open_procfs(0x0, &(0x7f0000000040)='fd\x00')
recvmmsg(0xffffffffffffffff, &(0x7f0000003840)=[{{0x0, 0x0, 0x0}}], 0x1, 0x0, 0x0)
perf_event_open(&(0x7f0000940000)={0x2, 0x70, 0xee6a, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x100, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0xff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x10001, 0x1}, 0x0, 0x400000000000000}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
mlock(&(0x7f00005ba000/0x2000)=nil, 0x2000)
ioctl$SNDRV_TIMER_IOCTL_SELECT(0xffffffffffffffff, 0x40345410, 0x0)
openat$uinput(0xffffffffffffff9c, &(0x7f0000000080)='/dev/uinput\x00', 0x2, 0x0)
mmap(&(0x7f000060b000/0x1000)=nil, 0x1000, 0x5, 0x8000400200000033, r1, 0x0)
unshare(0xfffffffffffffffd)
r2 = getpid()
sched_setscheduler(r2, 0x5, &(0x7f00000000c0))
open$dir(&(0x7f0000000400)='./file0\x00', 0x0, 0x0)
perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f00000004c0), 0x2}, 0x0, 0x0, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r3 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000340)='memory.current\x00', 0x0, 0x0)
ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, 0x0)
socketpair(0x1, 0x20000000000001, 0x0, &(0x7f0000000100)={<r4=>0xffffffffffffffff, <r5=>0xffffffffffffffff})
ioctl$PERF_EVENT_IOC_SET_FILTER(r5, 0x8914, &(0x7f0000000300)='lo\x00\x96o\xd6Q\xb9Y\xa9\xc8J,\x00\xd2\x97\x04\x03\xdc\r')
close(r3)
rt_sigprocmask(0x2, &(0x7f0000000240)={0x6}, &(0x7f00000002c0), 0x8)
ioctl$PERF_EVENT_IOC_SET_FILTER(r5, 0x8923, &(0x7f00000008c0)='lo\x00\x96o8\x0fd\xa1\xe3\xd7]b}\x1f\xa1Y\xad4\x90\x9d`\xd2\x98\x00\x00\x00 \'Y\x17]\x15c\xcaR\xdd\x98OC\x89\x1b\xe7\x84\xe2\x05\x80w\xd2|D\x8dK\x14Bx\xcbuH\xc2\xeec\xbf<>Y\x1a\xfc\x1f9OB\x81\x89\x186\xc5q@n\xb4\xb6s\xb0\x00\x00\xfc\x00\x00\b\x00\x00\xda\xef\xecE\xec\xd5I\xb2\x9b\xfe\x8d\x90?\x00\xe9\xe4~g:\xc1\xb2aj\x96\xbb\xa7\xe2\xc0\xdc\xf9Q\b\xeb\x16\x7fT\x11\xd3\r7\xe6\"f\xcf\x8e\xabd\x0ftp\x82\xae\xd2\x15\x8e+c\xf6\xbf\xe14>\xa6-\xa5c\xde\xd7\xab\xea\x1f\xf8s2\x9cVF\xd5\x18\xfe\x0e\x8f \x01\x00\x00y.\xfc*\x82\xa5\xa1p5\xc8{\xf7\xef\xab\xe8\x99\xebw#\x8at\x1c\x80\xfc\xb0\x95\xa2\xa7\xd7,Y]E8\x83X\xf5F\xdc\x88-\xf5\xb0\xb5^\xdb\x1a\xb6\xaa\x14\xe2\xb9\rh^J-\xd1\xbaUn\x04\'l\x1b\xe0o\xdb\xc8\x91%\x1c\xb5\xbf\xb6\x90\xb4\xc2\x7f]/\xb3\xe7\xc9\'\x94\xcfIo\xdf\x04\x95\xb5\x06\x84\x1fH>\xda\xc5\x04 \x94\x88\xeb\'\xd4;6\x7f\xd9\x99-\x1b|G\x8d\xd4\xb9%\xaaQ\xa0K\x10\x03\x93\xe1\xcc\xe7m\x80\'\xf0\xa5\xed(\r\xa8\x0f&\xb1\xf3\xff0\f\x82%_\x92\x8bD\xb9\xd9\xe7\xf2\xe4\xc1i#\xdc\x87A\xb9\xc7\r\x92\xfa\x11\x11\xb5\x1f\x03\x9d\xdd\x1bj\xdf\xacg\xe3\xa0S\xd3\x8a\xe1n\x97\xea\xf5\xa0\'\v\xe9\xa0\xf1 f\xaan\xcf\xb5i\xb6d\xbc\x92\v\xd58\x16\b\xb3_:\xa4!\ny\xc4&\nWMM\xa8\xc4\v\x9f\x01o\xf4\xab&\xb6\x17\x02P\xc3!N\xf4\b\x1a~\x91V1s\xe9\xbe\x9e\x9b\'\xcde\xb3\xa1\x86\"\xd7\x04\xf1\xc0!\xed\xff\xee$\xc89\x8cB0\xd1dD\xe0IP\x88\xa2\xf2Y\x9af$$\xf1cO\xf7P\xac\xca\x80:!\xb4\x94#\xcb^\x9f\'\x03\xe3\x93\xb9\x82\xbf\xcf\xc4\xe3\xf7\x03Oh\xf2r\xca\x8ff\xbb/\x9f*\xaf\x1a \xa5\xa0?%M\xa5\x86\x98\xf24\'1\xc7\f<\xcc@\xe8\x8a\xac.\xde\xe4\xc7\xf5\x9ck\xa40!\xe9\x14$\xb3\x05m\xb5m\xed\ft\x93\xd8\xa3\x80\'Y\xb9\x05\xbbt|\xbe\xbcz\n\xf3\xf5p\xf8\x9f~\x1b\xd0\v\x1cQ')
getsockopt$inet_IP_IPSEC_POLICY(r1, 0x0, 0x10, &(0x7f00000006c0)={{{@in6=@loopback}}, {{@in6=@initdev}}}, &(0x7f0000000500)=0xe8)
socketpair(0x2, 0x2000000080003, 0x100, &(0x7f0000000480))
syz_genetlink_get_family_id$SEG6(&(0x7f00000003c0)='SEG6\x00')
sendmsg$SEG6_CMD_DUMPHMAC(r4, &(0x7f0000000580)={&(0x7f0000000380)={0x10, 0x0, 0x0, 0x1000000}, 0xc, &(0x7f0000000440)={&(0x7f00000005c0)=ANY=[@ANYBLOB="2300260109447a0000000000000000660000001400001a0065a455e04ea56d0a47018c8e973bcac914471474a7e0d50a000eadd66d2a41a2ed409caf020046ab6aacc2097d8f35bd9c8b8a220bdde116904efa3f9600f22ab388644f66c2d5baec4079a81bae1927e49e91a4964656d7b227702926af5be846f30700fad39048633fd9161123894d9427f854a30cb0532c8f31f663380e40ce7f6cb15ec8baab3b7c6fd995adbc394f8f76c60190001854cac043c7e7dc2dab76b9003ef964989c0f921cc82f3f4b32038ea77fc8f1d2e329e83cc1bdded352"], 0x1}, 0x1, 0x0, 0x0, 0x8000}, 0x804)
r6 = creat(&(0x7f0000000200)='./file0\x00', 0xc)
arch_prctl$ARCH_MAP_VDSO_32(0x2002, 0x400000000000001)
ftruncate(r6, 0x2008200)
open(&(0x7f0000000140)='./bus\x00', 0x4000, 0x0)

15:06:28 executing program 4:
r0 = syz_open_procfs(0x0, &(0x7f00000001c0)='net/softnet_stat\x00')
fsetxattr$security_smack_transmute(r0, &(0x7f0000000000)='security.SMACK64TRANSMUTE\x00', &(0x7f0000000040)='TRUE', 0x4, 0x1)
dup3(r0, r0, 0x80000)
dup(r0)
lseek(r0, 0x20000, 0x0)

15:06:28 executing program 0:
socket$inet_udplite(0x2, 0x2, 0x88)
r0 = syz_open_procfs(0x0, &(0x7f0000000080)='net/dev_mcast\x00')
lseek(r0, 0x20000, 0x0)

15:06:28 executing program 1:
r0 = socket$inet_udplite(0x2, 0x2, 0x88)
ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f3188b070")
syz_open_procfs(0x0, &(0x7f0000000940)='syscall\x00')
r1 = syz_open_procfs(0x0, &(0x7f0000000040)='fd\x00')
recvmmsg(0xffffffffffffffff, &(0x7f0000003840)=[{{0x0, 0x0, 0x0}}], 0x1, 0x0, 0x0)
perf_event_open(&(0x7f0000940000)={0x2, 0x70, 0xee6a, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x100, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0xff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x10001, 0x1}, 0x0, 0x400000000000000}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
mlock(&(0x7f00005b8000/0x3000)=nil, 0x3000)
ioctl$SNDRV_TIMER_IOCTL_SELECT(0xffffffffffffffff, 0x40345410, 0x0)
openat$uinput(0xffffffffffffff9c, &(0x7f0000000080)='/dev/uinput\x00', 0x2, 0x0)
mmap(&(0x7f000060b000/0x1000)=nil, 0x1000, 0x5, 0x8000400200000033, r1, 0x0)
perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x2, 0x9, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2000000, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x4000000, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8)
r2 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)={0x10b, 0x6, 0x209e1e, 0x3, 0x1}, 0x2c)
bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000b40)={r2, &(0x7f0000000040), 0x0, 0x1}, 0x20)
r3 = creat(&(0x7f0000000640)='./file0\x00', 0x100)
setsockopt$inet6_tcp_TCP_REPAIR_QUEUE(r3, 0x6, 0x14, &(0x7f0000000980), 0x4)
unlink(&(0x7f0000000940)='./file0\x00')
r4 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r5 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r5, 0x0)
ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)})
ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0x0, 0x0, &(0x7f0000000780)})

15:06:28 executing program 2:
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0xfffffffffffffffc}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x400000000000000)
r0 = perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x400}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r1 = socket$unix(0x1, 0x0, 0x0)
write$binfmt_elf32(0xffffffffffffffff, 0x0, 0xa25125a27d7e5f6d)
r2 = socket$inet(0x2, 0x4000000000000001, 0x0)
setsockopt$inet_tcp_int(r2, 0x6, 0x80000000000002, &(0x7f0000000200)=0x78, 0x4)
setsockopt$ARPT_SO_SET_ADD_COUNTERS(r2, 0x0, 0x61, &(0x7f00000004c0)={'filter\x00', 0x4}, 0x68)
bind$inet(r2, &(0x7f0000000100)={0x2, 0x4e23, @broadcast}, 0x10)
write$UHID_GET_REPORT_REPLY(r1, &(0x7f0000000180)={0xa, 0x6, 0x8df, 0xfffffffffffffffd}, 0xa)
setsockopt$SO_ATTACH_FILTER(r2, 0x1, 0x1a, &(0x7f0000b86000)={0x1, &(0x7f00000000c0)=[{0x6, 0x0, 0x0, 0xe8}]}, 0x10)
bind$inet(0xffffffffffffffff, &(0x7f0000000340)={0x2, 0x4e22, @broadcast}, 0x10)
keyctl$update(0x2, 0x0, 0x0, 0xfffffffffffffdae)
sendto$inet(r2, 0x0, 0x0, 0x200007fd, &(0x7f0000e68000)={0x2, 0x4e23, @loopback}, 0x10)
recvmsg(r2, &(0x7f0000000240)={0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f0000003ac0)=""/4096, 0x1000}], 0x1}, 0x100)
readv(r0, &(0x7f0000000940)=[{&(0x7f00000005c0)=""/223, 0xdf}, {&(0x7f00000006c0)=""/199, 0xc7}, {&(0x7f00000007c0)=""/152, 0x98}], 0x3)
write$binfmt_elf64(r2, &(0x7f0000001640)=ANY=[], 0xf5aab446)

15:06:28 executing program 3:
r0 = socket$inet_udplite(0x2, 0x2, 0x88)
ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f3188b070")
syz_open_procfs(0x0, &(0x7f0000000940)='syscall\x00')
r1 = syz_open_procfs(0x0, &(0x7f0000000040)='fd\x00')
recvmmsg(0xffffffffffffffff, &(0x7f0000003840)=[{{0x0, 0x0, 0x0}}], 0x1, 0x0, 0x0)
perf_event_open(&(0x7f0000940000)={0x2, 0x70, 0xee6a, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x100, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0xff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x10001, 0x1}, 0x0, 0x400000000000000}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
mlock(&(0x7f00005b8000/0x3000)=nil, 0x3000)
ioctl$SNDRV_TIMER_IOCTL_SELECT(0xffffffffffffffff, 0x40345410, 0x0)
openat$uinput(0xffffffffffffff9c, &(0x7f0000000080)='/dev/uinput\x00', 0x2, 0x0)
mmap(&(0x7f000060b000/0x1000)=nil, 0x1000, 0x5, 0x8000400200000033, r1, 0x0)
perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x2, 0x9, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2000000, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x4000000, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8)
r2 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)={0x10b, 0x6, 0x209e1e, 0x3, 0x1}, 0x2c)
bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000b40)={r2, &(0x7f0000000040), 0x0, 0x1}, 0x20)
r3 = creat(&(0x7f0000000640)='./file0\x00', 0x100)
setsockopt$inet6_tcp_TCP_REPAIR_QUEUE(r3, 0x6, 0x14, &(0x7f0000000980), 0x4)
unlink(&(0x7f0000000940)='./file0\x00')
r4 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r5 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r5, 0x0)
ioctl$BINDER_GET_NODE_DEBUG_INFO(r4, 0xc018620b, &(0x7f0000000100))
ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f00000000c0)=ANY=[@ANYBLOB="bb8f0000"], 0x0, 0x0, 0x0})
ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)})

15:06:28 executing program 0:
socket$inet_udplite(0x2, 0x2, 0x88)
r0 = syz_open_procfs(0x0, &(0x7f0000000080)='net/dev_mcast\x00')
lseek(r0, 0x20000, 0x0)

15:06:28 executing program 4:
r0 = syz_open_procfs(0x0, &(0x7f00000001c0)='net/softnet_stat\x00')
accept$inet6(r0, &(0x7f0000000040)={0xa, 0x0, 0x0, @empty}, &(0x7f0000000080)=0x1c)
lseek(r0, 0x20000, 0x0)
pipe2(&(0x7f0000000000), 0x4000)

15:06:28 executing program 0:
socket$inet_udplite(0x2, 0x2, 0x88)
r0 = syz_open_procfs(0x0, &(0x7f0000000080)='net/dev_mcast\x00')
lseek(r0, 0x20000, 0x0)

15:06:28 executing program 4:
r0 = openat$selinux_checkreqprot(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/checkreqprot\x00', 0x4000, 0x0)
ioctl$BLKIOOPT(r0, 0x1279, &(0x7f0000000040))
r1 = syz_open_procfs(0x0, &(0x7f00000001c0)='net/softnet_stat\x00')
lseek(r1, 0x20000, 0x0)

[ 1109.804064] binder: 803:806 unknown command 36795
15:06:28 executing program 0:
ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f3188b070")
r0 = syz_open_procfs(0x0, &(0x7f0000000080)='net/dev_mcast\x00')
lseek(r0, 0x20000, 0x0)

[ 1109.838081] binder: 803:806 ioctl c0306201 20000140 returned -22
[ 1109.843858] binder: 802:810 transaction failed 29189/-22, size 24-8 line 3117
[ 1109.851112] binder: 803:813 transaction failed 29189/-22, size 24-8 line 3117
[ 1109.881131] binder: 802:810 BC_INCREFS_DONE u0000000000000000 no match
15:06:28 executing program 3:
r0 = socket$inet_udplite(0x2, 0x2, 0x88)
ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f3188b070")
syz_open_procfs(0x0, &(0x7f0000000940)='syscall\x00')
r1 = syz_open_procfs(0x0, &(0x7f0000000040)='fd\x00')
recvmmsg(0xffffffffffffffff, &(0x7f0000003840)=[{{0x0, 0x0, 0x0}}], 0x1, 0x0, 0x0)
perf_event_open(&(0x7f0000940000)={0x2, 0x70, 0xee6a, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x100, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0xff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x10001, 0x1}, 0x0, 0x400000000000000}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
mlock(&(0x7f00005b8000/0x3000)=nil, 0x3000)
ioctl$SNDRV_TIMER_IOCTL_SELECT(0xffffffffffffffff, 0x40345410, 0x0)
openat$uinput(0xffffffffffffff9c, &(0x7f0000000080)='/dev/uinput\x00', 0x2, 0x0)
mmap(&(0x7f000060b000/0x1000)=nil, 0x1000, 0x5, 0x8000400200000033, r1, 0x0)
perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x2, 0x9, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2000000, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x4000000, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8)
r2 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)={0x10b, 0x6, 0x209e1e, 0x3, 0x1}, 0x2c)
bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000b40)={r2, &(0x7f0000000040), 0x0, 0x1}, 0x20)
r3 = creat(&(0x7f0000000640)='./file0\x00', 0x100)
setsockopt$inet6_tcp_TCP_REPAIR_QUEUE(r3, 0x6, 0x14, &(0x7f0000000980), 0x4)
unlink(&(0x7f0000000940)='./file0\x00')
r4 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r5 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r5, 0x0)
ioctl$BINDER_GET_NODE_DEBUG_INFO(r4, 0xc018620b, &(0x7f0000000100))
ioctl$BINDER_SET_CONTEXT_MGR(r5, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)})

15:06:28 executing program 5:
r0 = socket$inet_udplite(0x2, 0x2, 0x88)
ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f3188b070")
r1 = syz_open_procfs(0x0, &(0x7f0000000940)='syscall\x00')
r2 = syz_open_procfs(0x0, &(0x7f0000000040)='fd\x00')
recvmmsg(0xffffffffffffffff, &(0x7f0000003840)=[{{0x0, 0x0, 0x0}}], 0x1, 0x0, 0x0)
perf_event_open(&(0x7f0000940000)={0x2, 0x70, 0xee6c, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1000, 0x0, 0x0, 0x100, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x400, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0xff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x10001, 0x1}, 0x0, 0x400000000000000}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
mlock(&(0x7f00005b8000/0x3000)=nil, 0x3000)
ioctl$SNDRV_TIMER_IOCTL_SELECT(0xffffffffffffffff, 0x40345410, 0x0)
openat$uinput(0xffffffffffffff9c, &(0x7f0000000080)='/dev/uinput\x00', 0x2, 0x0)
mmap(&(0x7f00005b8000/0x4000)=nil, 0x4000, 0x5, 0x8000400200000036, r1, 0x0)
unshare(0xfffffffffffffffd)
r3 = getpid()
sched_setscheduler(r3, 0x5, &(0x7f00000000c0))
open$dir(&(0x7f0000000400)='./file0\x00', 0x0, 0x0)
perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f00000004c0), 0x2}, 0x0, 0x0, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r4 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000340)='memory.current\x00', 0x0, 0x0)
ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, 0x0)
socketpair(0x1, 0x20000000000001, 0x0, &(0x7f0000000100)={<r5=>0xffffffffffffffff, <r6=>0xffffffffffffffff})
ioctl$PERF_EVENT_IOC_SET_FILTER(r6, 0x8914, &(0x7f0000000300)='lo\x00\x96o\xd6Q\xb9Y\xa9\xc8J,\x00\xd2\x97\x04\x03\xdc\r')
close(r4)
rt_sigprocmask(0x2, &(0x7f0000000240)={0x6}, &(0x7f00000002c0), 0x8)
ioctl$PERF_EVENT_IOC_SET_FILTER(r6, 0x8923, &(0x7f00000008c0)='lo\x00\x96o8\x0fd\xa1\xe3\xd7]b}\x1f\xa1Y\xad4\x90\x9d`\xd2\x98\x00\x00\x00 \'Y\x17]\x15c\xcaR\xdd\x98OC\x89\x1b\xe7\x84\xe2\x05\x80w\xd2|D\x8dK\x14Bx\xcbuH\xc2\xeec\xbf<>Y\x1a\xfc\x1f9OB\x81\x89\x186\xc5q@n\xb4\xb6s\xb0\x00\x00\xfc\x00\x00\b\x00\x00\xda\xef\xecE\xec\xd5I\xb2\x9b\xfe\x8d\x90?\x00\xe9\xe4~g:\xc1\xb2aj\x96\xbb\xa7\xe2\xc0\xdc\xf9Q\b\xeb\x16\x7fT\x11\xd3\r7\xe6\"f\xcf\x8e\xabd\x0ftp\x82\xae\xd2\x15\x8e+c\xf6\xbf\xe14>\xa6-\xa5c\xde\xd7\xab\xea\x1f\xf8s2\x9cVF\xd5\x18\xfe\x0e\x8f \x01\x00\x00y.\xfc*\x82\xa5\xa1p5\xc8{\xf7\xef\xab\xe8\x99\xebw#\x8at\x1c\x80\xfc\xb0\x95\xa2\xa7\xd7,Y]E8\x83X\xf5F\xdc\x88-\xf5\xb0\xb5^\xdb\x1a\xb6\xaa\x14\xe2\xb9\rh^J-\xd1\xbaUn\x04\'l\x1b\xe0o\xdb\xc8\x91%\x1c\xb5\xbf\xb6\x90\xb4\xc2\x7f]/\xb3\xe7\xc9\'\x94\xcfIo\xdf\x04\x95\xb5\x06\x84\x1fH>\xda\xc5\x04 \x94\x88\xeb\'\xd4;6\x7f\xd9\x99-\x1b|G\x8d\xd4\xb9%\xaaQ\xa0K\x10\x03\x93\xe1\xcc\xe7m\x80\'\xf0\xa5\xed(\r\xa8\x0f&\xb1\xf3\xff0\f\x82%_\x92\x8bD\xb9\xd9\xe7\xf2\xe4\xc1i#\xdc\x87A\xb9\xc7\r\x92\xfa\x11\x11\xb5\x1f\x03\x9d\xdd\x1bj\xdf\xacg\xe3\xa0S\xd3\x8a\xe1n\x97\xea\xf5\xa0\'\v\xe9\xa0\xf1 f\xaan\xcf\xb5i\xb6d\xbc\x92\v\xd58\x16\b\xb3_:\xa4!\ny\xc4&\nWMM\xa8\xc4\v\x9f\x01o\xf4\xab&\xb6\x17\x02P\xc3!N\xf4\b\x1a~\x91V1s\xe9\xbe\x9e\x9b\'\xcde\xb3\xa1\x86\"\xd7\x04\xf1\xc0!\xed\xff\xee$\xc89\x8cB0\xd1dD\xe0IP\x88\xa2\xf2Y\x9af$$\xf1cO\xf7P\xac\xca\x80:!\xb4\x94#\xcb^\x9f\'\x03\xe3\x93\xb9\x82\xbf\xcf\xc4\xe3\xf7\x03Oh\xf2r\xca\x8ff\xbb/\x9f*\xaf\x1a \xa5\xa0?%M\xa5\x86\x98\xf24\'1\xc7\f<\xcc@\xe8\x8a\xac.\xde\xe4\xc7\xf5\x9ck\xa40!\xe9\x14$\xb3\x05m\xb5m\xed\ft\x93\xd8\xa3\x80\'Y\xb9\x05\xbbt|\xbe\xbcz\n\xf3\xf5p\xf8\x9f~\x1b\xd0\v\x1cQ')
getsockopt$inet_IP_IPSEC_POLICY(r2, 0x0, 0x10, &(0x7f00000006c0)={{{@in6=@loopback}}, {{@in6=@initdev}}}, &(0x7f0000000500)=0xe8)
socketpair(0x2, 0x2000000080003, 0x100, &(0x7f0000000480))
syz_genetlink_get_family_id$SEG6(&(0x7f00000003c0)='SEG6\x00')
sendmsg$SEG6_CMD_DUMPHMAC(r5, &(0x7f0000000580)={&(0x7f0000000380)={0x10, 0x0, 0x0, 0x1000000}, 0xc, &(0x7f0000000440)={&(0x7f0000000b00)=ANY=[@ANYBLOB="2300260109447a0000000000000400660000001400001a0065a455e04effff0000018c8e973bcac914471474a7e0d50a000eadd66d2e49a2ed097d8f75bd9c8b8a220bdde116904efa3f9600f22ab388644fc566c2d5baec4079a81bae1927e49e91a4964656d7b227702926af5be846f3de49fad39048633fd9161123894d9427f854a30cb0532c8f31f663380e40ce7f6cb15ec8baab3b7c90adda0bcd011ff69f1716585408be478169fa00cd7f8c0d52399d21e1bc25680fbb2727a5e11641aece58fd9de817efe631a764cd0700699423be3a1e6fce269f8d1e882242d5dc2bc76d358ab8c7ea754e6d14c34d05193b0d026d5204b1b3c62c9ea73b6b5fdb9621a907b577773ab0f699975a7f74c6c209f94435ba307040707a87e1310ac0fdaf9e68ed894f45bbbe8bf8c48dcac54f57ce956a163176ddfc26f8e3b5ae9d03f7537dc961a1e9ef478d6ac2ad9ca26bf711eea3350c4822216fbfc9a493bda7a09d7550ae8c50f9da556c0000"], 0x1}, 0x1, 0x0, 0x0, 0x8000}, 0x804)
r7 = creat(&(0x7f0000000540)='./file1\x00', 0x0)
ftruncate(r7, 0x2008200)
open(&(0x7f0000000140)='./bus\x00', 0x4000, 0x0)

15:06:28 executing program 1:
r0 = socket$inet_udplite(0x2, 0x2, 0x88)
ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f3188b070")
syz_open_procfs(0x0, &(0x7f0000000940)='syscall\x00')
r1 = syz_open_procfs(0x0, &(0x7f0000000040)='fd\x00')
recvmmsg(0xffffffffffffffff, &(0x7f0000003840)=[{{0x0, 0x0, 0x0}}], 0x1, 0x0, 0x0)
perf_event_open(&(0x7f0000940000)={0x2, 0x70, 0xee6a, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x100, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0xff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x10001, 0x1}, 0x0, 0x400000000000000}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
mlock(&(0x7f00005b8000/0x3000)=nil, 0x3000)
ioctl$SNDRV_TIMER_IOCTL_SELECT(0xffffffffffffffff, 0x40345410, 0x0)
openat$uinput(0xffffffffffffff9c, &(0x7f0000000080)='/dev/uinput\x00', 0x2, 0x0)
mmap(&(0x7f000060b000/0x1000)=nil, 0x1000, 0x5, 0x8000400200000033, r1, 0x0)
perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x2, 0x9, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2000000, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x4000000, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8)
r2 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)={0x10b, 0x6, 0x209e1e, 0x3, 0x1}, 0x2c)
bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000b40)={r2, &(0x7f0000000040), 0x0, 0x1}, 0x20)
r3 = creat(&(0x7f0000000640)='./file0\x00', 0x100)
setsockopt$inet6_tcp_TCP_REPAIR_QUEUE(r3, 0x6, 0x14, &(0x7f0000000980), 0x4)
unlink(&(0x7f0000000940)='./file0\x00')
r4 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_GET_NODE_DEBUG_INFO(r4, 0xc018620b, &(0x7f0000000100))
ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)})
ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0x0, 0x0, &(0x7f0000000780)})

15:06:28 executing program 0:
ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f3188b070")
r0 = syz_open_procfs(0x0, &(0x7f0000000080)='net/dev_mcast\x00')
lseek(r0, 0x20000, 0x0)

15:06:28 executing program 4:
r0 = syz_open_procfs(0x0, &(0x7f0000000040)='net/softnet_stat\x00')
bpf$BPF_GET_BTF_INFO(0xf, &(0x7f0000000100)={r0, 0x10, &(0x7f00000000c0)={&(0x7f0000000080)=""/31, 0x1f}}, 0x10)
setsockopt$sock_void(r0, 0x1, 0x1b, 0x0, 0x0)
lseek(r0, 0x20000, 0x0)
poll(&(0x7f0000000000)=[{r0, 0x340}, {r0, 0x76a75c2a24192fb4}], 0x2, 0x7)

[ 1110.321815] binder: 834:841 BC_INCREFS_DONE node 1039 has no pending increfs request
15:06:29 executing program 0:
ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f3188b070")
r0 = syz_open_procfs(0x0, &(0x7f0000000080)='net/dev_mcast\x00')
lseek(r0, 0x20000, 0x0)

15:06:29 executing program 2:
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0xfffffffffffffffc}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x400000000000000)
r0 = perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x400}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r1 = socket$unix(0x1, 0x0, 0x0)
write$binfmt_elf32(0xffffffffffffffff, 0x0, 0xa25125a27d7e5f6d)
r2 = socket$inet(0x2, 0x4000000000000001, 0x0)
setsockopt$inet_tcp_int(r2, 0x6, 0x80000000000002, &(0x7f0000000200)=0x78, 0x4)
setsockopt$ARPT_SO_SET_ADD_COUNTERS(r2, 0x0, 0x61, &(0x7f00000004c0)={'filter\x00', 0x4}, 0x68)
bind$inet(r2, &(0x7f0000000100)={0x2, 0x4e23, @broadcast}, 0x10)
write$UHID_GET_REPORT_REPLY(r1, &(0x7f0000000180)={0xa, 0x6, 0x8df, 0xfffffffffffffffd}, 0xa)
setsockopt$SO_ATTACH_FILTER(r2, 0x1, 0x1a, &(0x7f0000b86000)={0x1, &(0x7f00000000c0)=[{0x6, 0x0, 0x0, 0xe8}]}, 0x10)
bind$inet(0xffffffffffffffff, &(0x7f0000000340)={0x2, 0x4e22, @broadcast}, 0x10)
keyctl$update(0x2, 0x0, 0x0, 0xfffffffffffffdae)
sendto$inet(r2, 0x0, 0x0, 0x200007fd, &(0x7f0000e68000)={0x2, 0x4e23, @loopback}, 0x10)
recvmsg(r2, &(0x7f0000000240)={0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f0000003ac0)=""/4096, 0x1000}], 0x1}, 0x100)
readv(r0, &(0x7f0000000940)=[{&(0x7f00000005c0)=""/223, 0xdf}, {&(0x7f00000006c0)=""/199, 0xc7}, {&(0x7f00000007c0)=""/152, 0x98}], 0x3)
write$binfmt_elf64(r2, &(0x7f0000001640)=ANY=[], 0xf5aab446)

15:06:29 executing program 4:
r0 = syz_open_procfs(0x0, &(0x7f00000001c0)='net/softnet_stat\x00')
read(r0, &(0x7f0000000200)=""/223, 0xdf)
lseek(r0, 0x20000, 0x0)
ioctl$BLKRAGET(r0, 0x1263, &(0x7f0000000040))
ioctl$UI_END_FF_UPLOAD(r0, 0x406855c9, &(0x7f0000000400)={0xa, 0x7, {0x53, 0x9, 0x6, {0xac97, 0x2}, {0x0, 0x9}, @rumble={0x8, 0x6c3dbadb}}, {0x54, 0x800, 0x1, {0xb7d, 0x4}, {0x0, 0x80fb}, @period={0x5f, 0x3, 0x7f, 0x1, 0x8000, {0x8, 0x7, 0x9, 0x8f2}, 0x1, &(0x7f00000003c0)=[0x9]}}})
ioctl$VT_WAITACTIVE(r0, 0x5607)
getsockopt$sock_cred(r0, 0x1, 0x11, &(0x7f0000001840)={0x0, <r1=>0x0}, &(0x7f0000001880)=0xc)
getsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x11, &(0x7f00000018c0)={{{@in, @in=@local, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, <r2=>0x0}}, {{@in=@local}, 0x0, @in6=@empty}}, &(0x7f00000019c0)=0xe8)
getresuid(&(0x7f0000001a00)=<r3=>0x0, &(0x7f0000001a40), &(0x7f0000001a80))
getsockopt$IP_VS_SO_GET_VERSION(r0, 0x0, 0x480, &(0x7f0000001d40), &(0x7f0000001d80)=0x40)
r4 = syz_genetlink_get_family_id$ipvs(&(0x7f0000001c00)='IPVS\x00')
sendmsg$IPVS_CMD_GET_CONFIG(r0, &(0x7f0000001d00)={&(0x7f0000001bc0)={0x10, 0x0, 0x0, 0x81001800}, 0xc, &(0x7f0000001cc0)={&(0x7f0000001c40)={0x68, r4, 0x100, 0x70bd27, 0x25dfdbfc, {}, [@IPVS_CMD_ATTR_DEST={0x44, 0x2, [@IPVS_DEST_ATTR_ACTIVE_CONNS={0x8, 0x7, 0xd339}, @IPVS_DEST_ATTR_INACT_CONNS={0x8, 0x8, 0x99}, @IPVS_DEST_ATTR_ACTIVE_CONNS={0x8, 0x7, 0x4}, @IPVS_DEST_ATTR_U_THRESH={0x8}, @IPVS_DEST_ATTR_INACT_CONNS={0x8}, @IPVS_DEST_ATTR_WEIGHT={0x8, 0x4, 0x2fc}, @IPVS_DEST_ATTR_U_THRESH={0x8, 0x5, 0x8}, @IPVS_DEST_ATTR_PERSIST_CONNS={0x8, 0x9, 0x3}]}, @IPVS_CMD_ATTR_TIMEOUT_TCP_FIN={0x8, 0x5, 0xde}, @IPVS_CMD_ATTR_TIMEOUT_TCP_FIN={0x8}]}, 0x68}, 0x1, 0x0, 0x0, 0x10}, 0x40)
syz_mount_image$msdos(&(0x7f0000000480)='msdos\x00', &(0x7f00000004c0)='./file0\x00', 0x6, 0x6, &(0x7f0000001780)=[{&(0x7f0000000500)="8cd78e0ab0158f4eda4b63da3ba5143a4c75f3fc1d31696dfb990e41a62e321b7583d589680a8120cdd05a3d4e09d430d613c0b6402daa8003c131bd81ef9f9c20776cce0bfb92c9682d7d1209c0f6b10b2893c10d8309168ed811ebef0498a56b0aa8388c27af52176fa68c8242c2aa13cf1db6f286fd81976f1506e7b2bf0c642ac4b714ce2a255a43fc641dcdbc6dd694ab2d9e9b03c57b86cd26fdd267e5d6e91781cc29c2a13f9cb5ce7342b2eef598ba59d03dcb757efcd4a4b63bda43593defa160a3293b60584d38653ea225a2cabeb80081e043f1a85c5e06a6036feb8d7d7219881ba3b2abefdeb5779e6bdf98488ac0470c78475158629fdb7c8865ab6d7205a454ff1d1e2465cfd0ea86f74f03a82d15540be6b9a85beb06e354bd4a26dcaba31379bfe31e05ec56c785aaaa250ea0db135132eca5b5a46d5c30a250746a75063707beba0317b3e21ae27fc003e0216f6cd2b1bdb2e6c7df48e1bbad23424ff5dde03e62d333b8b36a5e6d427e26c7ab474c334b1568a323e936d37b2ebc0ae751fdcd9ed6425d800684d81954a7b7f730bbca9dd26c6d98e96cfe4b8c308e74b6597415f36564a3b4ac669a5ad908a1257a25b4e19e8bd5cc9bcdb92c8543ee01c4088f62d0584d695883ee54a65efd25b4acf1dc48caabc52df781f3fedad443659689056c8749281c9d7b738e3ed6b8b8cb238c223b91aac8ec18a996bdd6a6db16db3381165154c36e05db5edc64b82ca20d657ceafd9d74f9cbd24e11b57c5588f0fc592b497dfccf538c1276d9aa6efbebd32a61ee26b6f6dfefa067f1774ec86c87f5da820ac7a30304d45d0e3e105616d14ca733bfa7ba0ecab3f5b1bd471d1498ee8cdc199456aea94174b962d87a4da37a61eacfe0e243cce63148cc141c8d8964727854c04994326feab46754beff5c5831fd1c27fc45e75fa24ac098e947afdc2c644af494920d9ab3988b44328500e26afc4920b70fd2e600b7f33ceacc4163e14d7fe06aeb701e0b417098331e9649821759ce8247a56875892280f7a855f91587189cc1a2af929ade9abfeb63af033fef2ffe05b4fc40b80077f85480f2ff65ee7fa060a6727ad3884c24d8eb7feabdf094ad015ea63c01059f1885ef45cbba8c22403eb783d3cff1f86efee44e02002eb8688a4dc5a69a927c5d1aebca89a2005a064f3f6aafe77469bfa020cf26d0560b707311760978b20d5b2f7b7ca01c91b9b7f6bdb6f7c949bca301c57083f46f30d7de7d8a55e4883321bc98538fd02970798a08526cc2449afe00c2432dd1cea8f710beffa77622bc250ec2160f3a4ce09be7ff2509cf0f1c72569c2d77bc744505a1b7d45d8f9178c9a706b9b996d45ab66336369992470427870035e587ca84535c99a87a055c3e3d370a60f3ca889c32e7d7ee5d5fa545ec1dca15c392fff317e84ed33e0750370fd4dfc913a6f49c96995f8d05e1dd7b9dad351f7ed432894c5a8d2cb569d44c54b33bbcd8372648189c5505053927b94c096137107680ba1ac132b65da713568ff70350d54c284a56e3fddb037c534a4780a60e061a4cc8461ff8d527868e50809ad3a2e577251a7a754f6f526e30dfaf6894f8669dba06b382c90bc8ac469f4494fd1f9bcc716c002b6b90012f8ef62f0d90c3b47ef7df665879a8b95d3a92626b87b71db0dc954cfb14925db6b433123ce00ebd42faf39aa9b1b31bbb8d563a86ef8bb954d6089cb34bf84917f269f2174a801aa465b53df92f1c67e25f5c21b51065a75ddc8acee88e08932f6cb1fd3c936291f1e7af9877cf3791a7203e2e34cda74228ddf387a9f5e886d692956a95d5c23310ef1453a56b468ebdd519656aee9900cc5413f438caab38f6da6d807249843eef91f5cb6042bd7a8e5ca7b1f45f5b4d978f1c7bbd70c5503b41d242f3a70690c47b27500ae03d9304f44b9ec873a573f499ed29ec9173a9afd2b3296c1abd5fd50cd21bd91c8b70580d48649fae5fb3f3c0fa456a059cdbb9a5b59d28e2001fc985daf64df0112b93abec101bd81965b4d8fd2ea5c229902ec7f933823bae8774bb4d095d711e0b0fc410628db8812b4ffcb1e95760a97c6478315700f672802984ade71a3ea1ddd14a14268b6ada504314df40454c9cdfac7c5e5ce3f83e377506d49b8ce7367fb5eb92c0bf53a39dddd28397989cd906a1c49295cb624463b66de2953f7e5378174e5c3c704e8f58086aa67789db05d8d6c1fca1669fd421ca50a86f8ee145b1953518a58ad33d4fc78cc3dda24f9f1d20d449c57c0a23ee4c8ba604c990aecca07351a721bcbaad846012c0af98e51f718092f9d4e7f17aa57de647b61947dc7efc26666428f2f4861e256f70de22c598115a52c5d7bed633addbbc78206343ef0f35ada179b84c4814dbbdf428f48e7fdef36db629de34b17c1e1d277be9b01e7e479406252026ac8f35c258ccc48c3cee7479f6851f1fe556af33b2632956c304bdc55420913ff29684d953aa40d06cc77a22b74e1e5948237b38baee05f9193fdec9e49a15ee130b52cfb01f45ed33e8fecfa1ce11e697d16c2d484bb79494f7ff1984561c9939bf0a96e138c76a6b81417386f06933bebea8a0a7a643e73732e2b1b2cb4631fe551e90fe9774741e47325539ed642f3677253aaddae1473e5e037d92234c4bcb401350fab217845e35dee67ce4f0ca9d99b4b72bf526a2f48be5fce76de7bdcfb9721f1262523eb7ec7c99b0e967e2857be985b12e59b12140c34fb1202555665029982d3d709f85c1522854a80a7cc86f64e69e32bcf983ca7cbbe05c9dd2cd9fa60baf9a259982d1a7b3afc485f6337fab0fdfe33c1c9a85521327563813dfe09b19394e3fe2fb78a2e6a8543f5bc5cc8cd2c965d6d47c58d895fad0b3d231465220fae47e33c11372610493228aa96014af40ce2b54b1444a8c8722f960e349bac48ef1c81c0dc54eff0ff7d6461de7a724d5831699b580a8ccde6141ac479dfeeeec4386ef64958ec5a9f002bc38d2f1aa783516295fb108f2a8dc8a4201ba0ebdd786e1820cd1f4cee0d78602b8aed653cf4e2b2fd3bb714e340c3cf93544103e9331cefd64f02c4c9bbc8fb20e772800005714e774cf91076cee382e6f49598cd5514c79856a053f59d40e71e00c55f229db091013d76974e40f568eddda2f147f83512e7915c350a3d2d74350b4e65d25f677a396a8380bdca2b90b1459ef1cee01a9d52ef4d718ebe52d6cc0bb9c133a9c922ef23126436060a1886fa18981fabef355b26fc58fbed805654f50637a9ce4949db208a7788625b9cf1adf236c7b055b674226bd4112a741dfb7927c6d28b7478b21ca8aa320a137c8dca2c0facf1554826130a25f1afdba89d0c3d5b8dcf23d9f2e425f7360bfdf16c78ba1a1cabd2249125e80a9c1b9c322146ee757088e1b75790bea7924fc70c0c2c344b88b96b897b1152ff83f9d3ffab7dee5b8e5d718062f47a2df17e2ee8d082c08279775cb322ea624caf5d11e6fa694830667b6998ad888e89763a520dab2f45d4fa540606846f1bde658d5daf32892925b09a62645b95f12abbe8b90a6fcc2d3f9bf77352e8f1342e9f543853f87fedfa04b47b2ca15f1448938103b93bde953c950aa3c18f044597aec6add69f8d38827b3b7b7771f2f2ba5eb5babd204f65c1215c17e166f59bc563c0c1bed4fc5ee0350b821f6ec9539e4984bba21bf52acb6bc67994304c3b033f860fcfc9468748a5fa5e9d0da39c59c30ced0ecd022e3d09c5b26feb2a0a36406824a8977dc3be26ff512d48d5dea08cbba1aa66bce337549d1ab283ac80bf970fb428ea769e71a3ba22f6e1759e20d5a814a8798b6ccd2fb6bc77d9cbd0c4bd01a9e2660f9d7815cad9e2be33799cda77f142029b5515a8c4838a55bcd57c86feaa8d98889472c9ed1703423b740f2f294cf103838d0258cd8a38b36e5abae674e3d9e1e24c3d350d35ea9fe211aaed82d72f488e08bb4f297c137351a319d5e47811ba012dc7da55abb4fef59b83e8a42f9bb4328e707ab04e5308de380cf78c39ffb86eb5381098c6514bfa86598f9f51730463ee2dd04f98e4febc4ad24c9c5b77adc5b66e6524f958b742a07109399e86b9e1ee96f4853fa9c409fc8847535331f3d339c7fb530f8d8075a192a89c05164689a49b6e7cb5d55fa4b9efcaf0c99d139e83c5b2c905dccf2c56b2b9aa8c41f306864b72f9024909eb9b9fd0b140a1a4a6e6fa8c4390af5bffb306c0baf3066b1029aa13f7ff7b18a64e05a866aa2288e110c5ae9a7bdb1b145467bc5e0aa6b9ccd41d3c35768214a53b07f90328f87ee1df1b5fda5ded2d2d8c5c29055db46ca274c5a481c068d5023eb0f7ff69d19880be7f26a8b219ac01db294437e22340ffd6282bd05c20140ad3f10136436214dd583f1aed24a9e8f9f8f3f5a086a9bbd59e412f83ebbf52701915adc7e349f2f26de2d24b7c4a3412f4de634045875643025b7918e6785d0cea5f47b7102e03f26469d2700ca1acb6b45b4e0200737169945b14133476831c3b15636a5aea02a579e996f09c14aea342f3748692e5924e59ef8c2c6d46290a2f8648b96a55987a5f2c45c1961feca6456e9cbdb01da3d2e3e0c04ea37bd96635f37ef5538a842ece40a975154850e756cab15a1100df6c186552c94cff87abd3fb777086e51d584e87d75f3c57f7a2c600a00dab9283dbbefed20c4227b90df2495dd2f7c3b40a2a9a908e748eac4e9f0928f9316c7ceda66733aa2317d6717e6227fec57abbd562900532e3ae6b8819f32a5e3746f5a1efb10ca515e80843a4ef78d98a688c0802d35e657e8ba1642af6a884f72bd80badad1c4e6eff9be72cdac2eb620f88741adca114cde57df880c2f36742c4608262ef2a10c3058fe4c3abd787f1c8e22691a4e3ea6480610975caa4c4ed6f4de0c34a292fd58ad0f9859f9fc00e40ab58accf1475752498c97b38cfd7402437771143a1757b5a19e93e8cc1efefb3e0edaaef33dfdc33e17b08ee9f741baa1438ba3ccd6f5a64fd0ad711bb8af7249f5331db3e68960c2bee6e9d95f3b279eb9393b170e9983643933296c1f0bf50496ad64b4262bb9e276c14c2f440e952e3ddb43e8290099d34ea44377fc31bca5d8db354f1bf854e3c2ad93ab022957f379ff2aec57bb4f843969012f64356a638c4bd3f8b6a924305949fddf4d69de71b00cdb7652ede438dd01522f612668fbc867ac445ce580af177107102a51eb30f6eac36bd0d44d1f041f9920946d95791c8c18dcc5ebabc0f88d8b95c5e21ad9e8077c138dfa9b6f07a2f2392881ee051abd39595956a199dc5d7e8efd5575493bda415e80afdd2217328b2efd00554169be0e3b3ae271810de347c9ed263511d8538cef278465f402c806c58ea5e2e4f9e12513d6983f908300e4ba85e708972f942bdf79bbebf064b74a74700494af43acfd98316f984ec9901df44720e63332d4b9689f5ee85046d6f83b857cb6d81a22e5db397d85a748bb5059180c3fb3675e3061e3ebf1cfa002640bb3707b2c77617d9fdf1d3bcab09a73020a1d5da71e7c38f4bcd824b50f7ddfdb0ec9a51e1359b5e45e9bd7a922cd94e2c378ed37d52fdbe7e78e62e7c7fd9386fc81fca98720ea16990aba06a0a3513f0309dcf098189ce22e236c30fb4685182d6b6bdb5a163d626a76b4b1b2b60c7a889b3e6ec0f58efd3f4950600ca909ad441e4efc8ae9a452aa5e06bcab2362c2a22a465d6897b0b0486b3a6fcd48a0bf4809b5587af3a2cb", 0x1000, 0x7fff}, {&(0x7f0000001500)="649ac1f02e84b8112e454e28dcf9e1ba6af1bd", 0x13, 0x714}, {0x0, 0x0, 0x6}, {&(0x7f0000001540)="2058e715efe61036e1b25d3c", 0xc, 0x6}, {&(0x7f0000001580)="f665629d0000d4c0f07c3f1efa64beefbcd1dfcc5654bad609088b5635e6841217ea44adafb589dbc446db0f3565b3798b38638274feda06920eff22f45482315e2076bb9b765cad23e9a4f7e2f95741dee4f76e264e664491147f1dc5120a7ef7e03c7225955aa996b0537575a8b10c42d1e98ff46fa1d3b5746d6d693b6b10538b5354c57af825d2810cdd1be7368c8f4f4fae92b304e66ea1f19607d66d3aebe3c0f867d114ba33fe304f44e74e557527f87d0adb4444f62f38a463ea8073769cf42b33fd58dd", 0xc8}, {&(0x7f0000001680)="0630c531df92187e979bd4026ab57e2a87de0eb2c821aba76af7362fb32d97635a052215ee1baa144641483eb4b0ca2f9421f760681d19297b4a62285437489ad0f07bca579fc807994e965e2417db89d2c554106f505639745cf0102285c911648bd2d535126700fe4cc8db8a53e1634baafad0b24b051bce4eb2f53354c80eebd0bd09c701726f9732a0a07c1205df327a5c6a9eb6e19ebf5d9e53328524436c62e2d10b1227fa655d062b80edd72550ec600cb3408ee3a4ddd3d2158be57460cd2bb008644259d4349b262af0759d1aea2b27f8d15f47e6a9e68e286b36b255217a46a8c065659bb6b5fbd9d664d164ef7fe1ff1eae", 0xf7, 0x3}], 0x1355fa7b2c7dc4cf, &(0x7f0000001ac0)={[{@dots='dots'}, {@fat=@umask={'umask', 0x3d, 0x3}}, {@fat=@umask={'umask'}}, {@nodots='nodots'}], [{@fowner_gt={'fowner>', r1}}, {@hash='hash'}, {@smackfshat={'smackfshat', 0x3d, '/dev/input/event#\x00'}}, {@uid_lt={'uid<', r2}}, {@seclabel='seclabel'}, {@seclabel='seclabel'}, {@dont_hash='dont_hash'}, {@uid_gt={'uid>', r3}}, {@obj_role={'obj_role', 0x3d, 'cgroup\x00'}}]})
pselect6(0x40, &(0x7f0000000100)={0x3, 0x6, 0x8, 0x53e1, 0xd2, 0x5, 0x4, 0x9}, &(0x7f0000000140)={0x5, 0x4, 0x1, 0x9, 0x2, 0x8, 0x7}, &(0x7f0000000180)={0xccf, 0x3, 0xfffffffffffffffe, 0xce, 0x98, 0x8, 0x100000000}, &(0x7f0000000300)={0x77359400}, &(0x7f0000000380)={&(0x7f0000000340)={0xa8aa}, 0x8})
fcntl$getflags(r0, 0x3)
syz_open_dev$evdev(&(0x7f0000000000)='/dev/input/event#\x00', 0xffffffff, 0x8000)
ioctl$sock_FIOGETOWN(r0, 0x8903, &(0x7f0000000080)=<r5=>0x0)
syz_open_procfs(r5, &(0x7f00000000c0)='cgroup\x00')

15:06:29 executing program 5:
ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f3188b070")
r0 = syz_open_procfs(0x0, &(0x7f0000000940)='syscall\x00')
r1 = syz_open_procfs(0x0, &(0x7f0000000040)='fd\x00')
recvmmsg(0xffffffffffffffff, &(0x7f0000003840)=[{{0x0, 0x0, 0x0}}], 0x1, 0x0, 0x0)
perf_event_open(&(0x7f0000940000)={0x2, 0x70, 0xee6a, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x100, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0xff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x10001, 0x1}, 0x0, 0x400000000000000}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
mlock(&(0x7f00005b8000/0x3000)=nil, 0x3000)
ioctl$SNDRV_TIMER_IOCTL_SELECT(0xffffffffffffffff, 0x40345410, 0x0)
openat$uinput(0xffffffffffffff9c, &(0x7f0000000080)='/dev/uinput\x00', 0x2, 0x0)
mmap(&(0x7f000060b000/0x1000)=nil, 0x1000, 0x5, 0x8000400200000033, r1, 0x0)
unshare(0xfffffffffffffffd)
ioctl$ASHMEM_SET_PROT_MASK(r0, 0x40087705, &(0x7f0000000380)={0x7, 0xfffffffffffffffc})
r2 = getpid()
sched_setscheduler(r2, 0x5, &(0x7f00000000c0))
open$dir(&(0x7f0000000400)='./file0\x00', 0x0, 0x0)
perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f00000004c0), 0x2}, 0x0, 0x0, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r3 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000340)='memory.current\x00', 0x0, 0x0)
ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, 0x0)
socketpair(0x1, 0x20000000000001, 0x0, &(0x7f0000000100)={<r4=>0xffffffffffffffff, <r5=>0xffffffffffffffff})
ioctl$PERF_EVENT_IOC_SET_FILTER(r5, 0x8914, &(0x7f0000000300)='lo\x00\x96o\xd6Q\xb9Y\xa9\xc8J,\x00\xd2\x97\x04\x03\xdc\r')
close(r3)
rt_sigprocmask(0x2, &(0x7f0000000240)={0x6}, &(0x7f00000002c0), 0x8)
ioctl$PERF_EVENT_IOC_SET_FILTER(r5, 0x8923, &(0x7f00000008c0)='lo\x00\x96o8\x0fd\xa1\xe3\xd7]b}\x1f\xa1Y\xad4\x90\x9d`\xd2\x98\x00\x00\x00 \'Y\x17]\x15c\xcaR\xdd\x98OC\x89\x1b\xe7\x84\xe2\x05\x80w\xd2|D\x8dK\x14Bx\xcbuH\xc2\xeec\xbf<>Y\x1a\xfc\x1f9OB\x81\x89\x186\xc5q@n\xb4\xb6s\xb0\x00\x00\xfc\x00\x00\b\x00\x00\xda\xef\xecE\xec\xd5I\xb2\x9b\xfe\x8d\x90?\x00\xe9\xe4~g:\xc1\xb2aj\x96\xbb\xa7\xe2\xc0\xdc\xf9Q\b\xeb\x16\x7fT\x11\xd3\r7\xe6\"f\xcf\x8e\xabd\x0ftp\x82\xae\xd2\x15\x8e+c\xf6\xbf\xe14>\xa6-\xa5c\xde\xd7\xab\xea\x1f\xf8s2\x9cVF\xd5\x18\xfe\x0e\x8f \x01\x00\x00y.\xfc*\x82\xa5\xa1p5\xc8{\xf7\xef\xab\xe8\x99\xebw#\x8at\x1c\x80\xfc\xb0\x95\xa2\xa7\xd7,Y]E8\x83X\xf5F\xdc\x88-\xf5\xb0\xb5^\xdb\x1a\xb6\xaa\x14\xe2\xb9\rh^J-\xd1\xbaUn\x04\'l\x1b\xe0o\xdb\xc8\x91%\x1c\xb5\xbf\xb6\x90\xb4\xc2\x7f]/\xb3\xe7\xc9\'\x94\xcfIo\xdf\x04\x95\xb5\x06\x84\x1fH>\xda\xc5\x04 \x94\x88\xeb\'\xd4;6\x7f\xd9\x99-\x1b|G\x8d\xd4\xb9%\xaaQ\xa0K\x10\x03\x93\xe1\xcc\xe7m\x80\'\xf0\xa5\xed(\r\xa8\x0f&\xb1\xf3\xff0\f\x82%_\x92\x8bD\xb9\xd9\xe7\xf2\xe4\xc1i#\xdc\x87A\xb9\xc7\r\x92\xfa\x11\x11\xb5\x1f\x03\x9d\xdd\x1bj\xdf\xacg\xe3\xa0S\xd3\x8a\xe1n\x97\xea\xf5\xa0\'\v\xe9\xa0\xf1 f\xaan\xcf\xb5i\xb6d\xbc\x92\v\xd58\x16\b\xb3_:\xa4!\ny\xc4&\nWMM\xa8\xc4\v\x9f\x01o\xf4\xab&\xb6\x17\x02P\xc3!N\xf4\b\x1a~\x91V1s\xe9\xbe\x9e\x9b\'\xcde\xb3\xa1\x86\"\xd7\x04\xf1\xc0!\xed\xff\xee$\xc89\x8cB0\xd1dD\xe0IP\x88\xa2\xf2Y\x9af$$\xf1cO\xf7P\xac\xca\x80:!\xb4\x94#\xcb^\x9f\'\x03\xe3\x93\xb9\x82\xbf\xcf\xc4\xe3\xf7\x03Oh\xf2r\xca\x8ff\xbb/\x9f*\xaf\x1a \xa5\xa0?%M\xa5\x86\x98\xf24\'1\xc7\f<\xcc@\xe8\x8a\xac.\xde\xe4\xc7\xf5\x9ck\xa40!\xe9\x14$\xb3\x05m\xb5m\xed\ft\x93\xd8\xa3\x80\'Y\xb9\x05\xbbt|\xbe\xbcz\n\xf3\xf5p\xf8\x9f~\x1b\xd0\v\x1cQ')
getsockopt$inet_IP_IPSEC_POLICY(r1, 0x0, 0x10, &(0x7f00000006c0)={{{@in6=@loopback}}, {{@in6=@initdev}}}, &(0x7f0000000500)=0xe8)
socketpair(0x2, 0x2000000080003, 0x100, &(0x7f0000000480))
syz_genetlink_get_family_id$SEG6(&(0x7f00000003c0)='SEG6\x00')
sendmsg$SEG6_CMD_DUMPHMAC(r4, &(0x7f0000000580)={&(0x7f0000000200)={0x10, 0x0, 0x0, 0x1000000}, 0xfffffffffffffea9, &(0x7f0000000440)={&(0x7f00000005c0)=ANY=[], 0x1}, 0x1, 0x0, 0x0, 0x8001}, 0x804)
r6 = creat(&(0x7f0000000280)='./bus\x00', 0x0)
ftruncate(r6, 0x2008200)
open(&(0x7f0000000140)='./bus\x00', 0x4000, 0x0)

15:06:29 executing program 0:
socket$inet_udplite(0x2, 0x2, 0x88)
ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f3188b070")
r0 = syz_open_procfs(0x0, &(0x7f0000000080)='net/dev_mcast\x00')
lseek(r0, 0x20000, 0x0)

15:06:29 executing program 4:
r0 = getpgid(0x0)
ioctl$sock_FIOGETOWN(0xffffffffffffff9c, 0x8903, &(0x7f0000000000))
r1 = syz_open_procfs(r0, &(0x7f00000000c0)='net/softnet_stat\x00')
lseek(r1, 0x20000, 0x0)
getpid()

15:06:29 executing program 0:
socket$inet_udplite(0x2, 0x2, 0x88)
ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f3188b070")
r0 = syz_open_procfs(0x0, &(0x7f0000000080)='net/dev_mcast\x00')
lseek(r0, 0x20000, 0x0)

15:06:29 executing program 3:
r0 = socket$inet_udplite(0x2, 0x2, 0x88)
ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f3188b070")
syz_open_procfs(0x0, &(0x7f0000000940)='syscall\x00')
r1 = syz_open_procfs(0x0, &(0x7f0000000040)='fd\x00')
recvmmsg(0xffffffffffffffff, &(0x7f0000003840)=[{{0x0, 0x0, 0x0}}], 0x1, 0x0, 0x0)
perf_event_open(&(0x7f0000940000)={0x2, 0x70, 0xee6a, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x100, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0xff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x10001, 0x1}, 0x0, 0x400000000000000}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
mlock(&(0x7f00005b8000/0x3000)=nil, 0x3000)
ioctl$SNDRV_TIMER_IOCTL_SELECT(0xffffffffffffffff, 0x40345410, 0x0)
openat$uinput(0xffffffffffffff9c, &(0x7f0000000080)='/dev/uinput\x00', 0x2, 0x0)
mmap(&(0x7f000060b000/0x1000)=nil, 0x1000, 0x5, 0x8000400200000033, r1, 0x0)
perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x2, 0x9, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2000000, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x4000000, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8)
r2 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)={0x10b, 0x6, 0x209e1e, 0x3, 0x1}, 0x2c)
bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000b40)={r2, &(0x7f0000000040), 0x0, 0x1}, 0x20)
r3 = creat(&(0x7f0000000640)='./file0\x00', 0x100)
setsockopt$inet6_tcp_TCP_REPAIR_QUEUE(r3, 0x6, 0x14, &(0x7f0000000980), 0x4)
unlink(&(0x7f0000000940)='./file0\x00')
r4 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r5 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r5, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r5, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)})

15:06:29 executing program 4:
r0 = syz_open_procfs(0x0, &(0x7f0000000000)='net/softnet_stat\x00')
ioctl$LOOP_GET_STATUS(r0, 0x4c03, &(0x7f0000000040))
lseek(r0, 0x20000, 0x0)

15:06:29 executing program 1:
r0 = socket$inet_udplite(0x2, 0x2, 0x88)
ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f3188b070")
syz_open_procfs(0x0, &(0x7f0000000940)='syscall\x00')
r1 = syz_open_procfs(0x0, &(0x7f0000000040)='fd\x00')
recvmmsg(0xffffffffffffffff, &(0x7f0000003840)=[{{0x0, 0x0, 0x0}}], 0x1, 0x0, 0x0)
perf_event_open(&(0x7f0000940000)={0x2, 0x70, 0xee6a, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x100, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0xff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x10001, 0x1}, 0x0, 0x400000000000000}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
mlock(&(0x7f00005b8000/0x3000)=nil, 0x3000)
ioctl$SNDRV_TIMER_IOCTL_SELECT(0xffffffffffffffff, 0x40345410, 0x0)
openat$uinput(0xffffffffffffff9c, &(0x7f0000000080)='/dev/uinput\x00', 0x2, 0x0)
mmap(&(0x7f000060b000/0x1000)=nil, 0x1000, 0x5, 0x8000400200000033, r1, 0x0)
perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x2, 0x9, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2000000, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x4000000, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8)
r2 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)={0x10b, 0x6, 0x209e1e, 0x3, 0x1}, 0x2c)
bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000b40)={r2, &(0x7f0000000040), 0x0, 0x1}, 0x20)
r3 = creat(&(0x7f0000000640)='./file0\x00', 0x100)
setsockopt$inet6_tcp_TCP_REPAIR_QUEUE(r3, 0x6, 0x14, &(0x7f0000000980), 0x4)
unlink(&(0x7f0000000940)='./file0\x00')
r4 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_GET_NODE_DEBUG_INFO(r4, 0xc018620b, &(0x7f0000000100))
ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)})
ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0x0, 0x0, &(0x7f0000000780)})

15:06:29 executing program 0:
socket$inet_udplite(0x2, 0x2, 0x88)
ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f3188b070")
r0 = syz_open_procfs(0x0, &(0x7f0000000080)='net/dev_mcast\x00')
lseek(r0, 0x20000, 0x0)

15:06:29 executing program 5:
r0 = socket$inet_udplite(0x2, 0x2, 0x88)
ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f3188b070")
r1 = syz_open_procfs(0x0, &(0x7f0000000940)='syscall\x00')
ioctl$sock_FIOGETOWN(r1, 0x8903, &(0x7f0000000280)=<r2=>0x0)
r3 = syz_open_procfs(r2, &(0x7f00000005c0)='fd\x00[w\xb8Q\x9c\xe9@\x19-\xa2Z\xbfU\x9a\xb5TvK\x01\xdfw\xc4\x84\x1f\x11\xeb\x86]Y8\xd9\xe5\x0f\x91\xb4\x1d7\x93\x97j*\xe01\xd0\x8aQ\x87\x1c\x8f\xc8\xc3\xb3k\x94!\xf0Kid\xbc\x84?\xf4N\xd4)\xa3Gr\x1bY\x0fC\x93\xf682M\x1b\x1as\xcf\xed\xd3\xb8\xe6\x9c\x90\xcb~\x91\xbf\xdb\xa1/rvMm\xfd\x94\xdf\n\xe8\x1b\xec\xc1\x11l;\xc9\x834\xf2\x11\x06n\a\x00\xf9U\xdd-\xfc;\xe5\x8b\a\xc4\v\n\x9bf\x7f\x04')
recvmmsg(0xffffffffffffffff, &(0x7f0000003840)=[{{0x0, 0x0, 0x0}}], 0x1, 0x0, 0x0)
perf_event_open(&(0x7f0000940000)={0x2, 0x70, 0xee6a, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x100, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0xff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x10001, 0x1}, 0x0, 0x400000000000000}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
mlock(&(0x7f00005b8000/0x3000)=nil, 0x3000)
ioctl$SNDRV_TIMER_IOCTL_SELECT(0xffffffffffffffff, 0x40345410, 0x0)
openat$uinput(0xffffffffffffff9c, &(0x7f0000000080)='/dev/uinput\x00', 0x2, 0x0)
mmap(&(0x7f000060b000/0x1000)=nil, 0x1000, 0x5, 0x8000400200000033, r3, 0x0)
unshare(0xc000000)
r4 = getpid()
sched_setscheduler(r4, 0x5, &(0x7f00000000c0))
open$dir(&(0x7f0000000400)='./file0\x00', 0x0, 0x0)
perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f00000004c0), 0x2}, 0x0, 0x0, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000340)='memory.current\x00', 0x0, 0x0)
ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, 0x0)
socketpair(0x1, 0x20000000000001, 0x0, &(0x7f0000000100)={<r5=>0xffffffffffffffff, <r6=>0xffffffffffffffff})
ioctl$PERF_EVENT_IOC_SET_FILTER(r6, 0x8914, &(0x7f0000000300)='lo\x00\x96o\xd6Q\xb9Y\xa9\xc8J,\x00\xd2\x97\x04\x03\xdc\r')
close(r5)
rt_sigprocmask(0x2, &(0x7f0000000240)={0x6}, &(0x7f00000002c0), 0x8)
ioctl$PERF_EVENT_IOC_SET_FILTER(r6, 0x8923, &(0x7f00000008c0)='lo\x00\x96o8\x0fd\xa1\xe3\xd7]b}\x1f\xa1Y\xad4\x90\x9d`\xd2\x98\x00\x00\x00 \'Y\x17]\x15c\xcaR\xdd\x98OC\x89\x1b\xe7\x84\xe2\x05\x80w\xd2|D\x8dK\x14Bx\xcbuH\xc2\xeec\xbf<>Y\x1a\xfc\x1f9OB\x81\x89\x186\xc5q@n\xb4\xb6s\xb0\x00\x00\xfc\x00\x00\b\x00\x00\xda\xef\xecE\xec\xd5I\xb2\x9b\xfe\x8d\x90?\x00\xe9\xe4~g:\xc1\xb2aj\x96\xbb\xa7\xe2\xc0\xdc\xf9Q\b\xeb\x16\x7fT\x11\xd3\r7\xe6\"f\xcf\x8e\xabd\x0ftp\x82\xae\xd2\x15\x8e+c\xf6\xbf\xe14>\xa6-\xa5c\xde\xd7\xab\xea\x1f\xf8s2\x9cVF\xd5\x18\xfe\x0e\x8f \x01\x00\x00y.\xfc*\x82\xa5\xa1p5\xc8{\xf7\xef\xab\xe8\x99\xebw#\x8at\x1c\x80\xfc\xb0\x95\xa2\xa7\xd7,Y]E8\x83X\xf5F\xdc\x88-\xf5\xb0\xb5^\xdb\x1a\xb6\xaa\x14\xe2\xb9\rh^J-\xd1\xbaUn\x04\'l\x1b\xe0o\xdb\xc8\x91%\x1c\xb5\xbf\xb6\x90\xb4\xc2\x7f]/\xb3\xe7\xc9\'\x94\xcfIo\xdf\x04\x95\xb5\x06\x84\x1fH>\xda\xc5\x04 \x94\x88\xeb\'\xd4;6\x7f\xd9\x99-\x1b|G\x8d\xd4\xb9%\xaaQ\xa0K\x10\x03\x93\xe1\xcc\xe7m\x80\'\xf0\xa5\xed(\r\xa8\x0f&\xb1\xf3\xff0\f\x82%_\x92\x8bD\xb9\xd9\xe7\xf2\xe4\xc1i#\xdc\x87A\xb9\xc7\r\x92\xfa\x11\x11\xb5\x1f\x03\x9d\xdd\x1bj\xdf\xacg\xe3\xa0S\xd3\x8a\xe1n\x97\xea\xf5\xa0\'\v\xe9\xa0\xf1 f\xaan\xcf\xb5i\xb6d\xbc\x92\v\xd58\x16\b\xb3_:\xa4!\ny\xc4&\nWMM\xa8\xc4\v\x9f\x01o\xf4\xab&\xb6\x17\x02P\xc3!N\xf4\b\x1a~\x91V1s\xe9\xbe\x9e\x9b\'\xcde\xb3\xa1\x86\"\xd7\x04\xf1\xc0!\xed\xff\xee$\xc89\x8cB0\xd1dD\xe0IP\x88\xa2\xf2Y\x9af$$\xf1cO\xf7P\xac\xca\x80:!\xb4\x94#\xcb^\x9f\'\x03\xe3\x93\xb9\x82\xbf\xcf\xc4\xe3\xf7\x03Oh\xf2r\xca\x8ff\xbb/\x9f*\xaf\x1a \xa5\xa0?%M\xa5\x86\x98\xf24\'1\xc7\f<\xcc@\xe8\x8a\xac.\xde\xe4\xc7\xf5\x9ck\xa40!\xe9\x14$\xb3\x05m\xb5m\xed\ft\x93\xd8\xa3\x80\'Y\xb9\x05\xbbt|\xbe\xbcz\n\xf3\xf5p\xf8\x9f~\x1b\xd0\v\x1cQ')
getsockopt$inet_IP_IPSEC_POLICY(r3, 0x0, 0x10, &(0x7f00000006c0)={{{@in6=@loopback}}, {{@in6=@initdev}}}, &(0x7f0000000500)=0xe8)
socketpair(0x2, 0x2000000080003, 0x100, &(0x7f0000000480))
syz_genetlink_get_family_id$SEG6(&(0x7f00000003c0)='SEG6\x00')
sendmsg$SEG6_CMD_DUMPHMAC(r5, &(0x7f0000000580)={&(0x7f0000000380)={0x10, 0x0, 0x0, 0x1000000}, 0xc, &(0x7f0000000440)={&(0x7f0000000dc0)=ANY=[@ANYBLOB="2300260109447a0000000000000000660000001400001a0065a455e04ea56d0a47018c8e973bcac914471474a7e0d50a000eadd66d2e49a2ed40dcaf85e0a0776aacc2097d8f75bd9c8b8a220bdde116904efa3f9600f22ab388640000010000000000a81bae1927e49e91a4964656d7b227702926af5be846f3de49fad390a848f0d9d7f9cb7e1687afc07e0148633fd9161123894d9427f854a30cb0532c8f31f663380e40ce7f6cb15ebdbaab3bfad1bd5d5a88e55f061723f17c6f646a21e7ecc97a3cb81ad0a54ebef72caacbd23145021f77b9c254bce1e7dc3103c12408dabd30e2f6530a1dc21dc7d7d691ec43f15dd240c63eae52aeae7d57fb3d4129bff9af869be2618b0228afb1281c854d7d2afd7fec11ea4dafdb2896433e5db0ad8f5e8ff402e6767c41aec2f48e02bf157f03ee5a82a4e681e6cb140cc4f6ba0bb1192a17bf9e0e51429a974a87eda6cc7c2ff2fc2cca1d6ba1a7afe8453312e1a2eb833f5802698a3256c7834a909795ef125d2d37137e33d4876e43a1f137930392e0e9af4a7c04dabee26fd801586fb9fed5f9b93d9ab8d0a7747d3c866cbaca8fac04d0c0b8339c7556dd0c5666b19a93defb21ca3eeb665e3f67ec9e57afebce6b37285a3b0ce21f0d17b0aa6f190b8d3981c53134d78cb661cb7098dab388e6c0b572f39ec96cc45196d77b665d10b5b304df7d78a76c2272d1d231adc86bb61f44f73a739a264b7bde7793d2fad163a3d862461ede8c3aab3b7e8cf0e7365d794b329102629b7021c7a40a45330097f574a5f49c85028a69b57e6607abbad552420588ad96f761cf4137792e0e5267b30aa7e9d06fd521efe2544a11cb3eb14f74727b891a2022a8ad9533c4b8467404e904a6fe7555e768cc10af10013cab051314539422f0a96595a8195906a7a102810000000000000000"], 0x1}, 0x1, 0x0, 0x0, 0x8000}, 0x804)
r7 = creat(&(0x7f0000000840)='./file0\x00', 0x8b)
arch_prctl$ARCH_MAP_VDSO_32(0x2002, 0x8)
ftruncate(r7, 0x2008200)
open(&(0x7f0000000140)='./bus\x00', 0x4000, 0x0)

[ 1110.788363] binder: send failed reply for transaction 1035 to 828:829
[ 1110.798476] binder: send failed reply for transaction 1038 to 834:848
[ 1110.806663] binder: undelivered TRANSACTION_COMPLETE
[ 1110.819467] binder: undelivered TRANSACTION_ERROR: 29189
15:06:29 executing program 0:
r0 = socket$inet_udplite(0x2, 0x2, 0x88)
ioctl(r0, 0x0, &(0x7f0000000000)="0adc1f123c123f3188b070")
r1 = syz_open_procfs(0x0, &(0x7f0000000080)='net/dev_mcast\x00')
lseek(r1, 0x20000, 0x0)

[ 1110.960191] binder: 901:904 transaction failed 29189/-22, size 24-8 line 3117
[ 1110.966366] binder: release 896:900 transaction 1043 out, still active
[ 1110.985834] binder: 901:904 BC_INCREFS_DONE u0000000000000000 no match
[ 1111.001728] binder: send failed reply for transaction 1043, target dead
15:06:30 executing program 0:
r0 = socket$inet_udplite(0x2, 0x2, 0x88)
ioctl(r0, 0x0, &(0x7f0000000000)="0adc1f123c123f3188b070")
r1 = syz_open_procfs(0x0, &(0x7f0000000080)='net/dev_mcast\x00')
lseek(r1, 0x20000, 0x0)

15:06:30 executing program 4:
r0 = syz_open_procfs(0x0, &(0x7f00000001c0)='net/softnet_stat\x00')
lseek(r0, 0x20000, 0x3)

15:06:30 executing program 2:
r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000180)='/dev/ptmx\x00', 0x0, 0x0)
ioctl$TCSETS(r0, 0x40045431, &(0x7f0000000600))
syz_open_pts(r0, 0x101180)

15:06:30 executing program 1:
r0 = socket$inet_udplite(0x2, 0x2, 0x88)
ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f3188b070")
syz_open_procfs(0x0, &(0x7f0000000940)='syscall\x00')
r1 = syz_open_procfs(0x0, &(0x7f0000000040)='fd\x00')
recvmmsg(0xffffffffffffffff, &(0x7f0000003840)=[{{0x0, 0x0, 0x0}}], 0x1, 0x0, 0x0)
perf_event_open(&(0x7f0000940000)={0x2, 0x70, 0xee6a, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x100, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0xff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x10001, 0x1}, 0x0, 0x400000000000000}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
mlock(&(0x7f00005b8000/0x3000)=nil, 0x3000)
ioctl$SNDRV_TIMER_IOCTL_SELECT(0xffffffffffffffff, 0x40345410, 0x0)
openat$uinput(0xffffffffffffff9c, &(0x7f0000000080)='/dev/uinput\x00', 0x2, 0x0)
mmap(&(0x7f000060b000/0x1000)=nil, 0x1000, 0x5, 0x8000400200000033, r1, 0x0)
perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x2, 0x9, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2000000, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x4000000, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8)
r2 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)={0x10b, 0x6, 0x209e1e, 0x3, 0x1}, 0x2c)
bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000b40)={r2, &(0x7f0000000040), 0x0, 0x1}, 0x20)
r3 = creat(&(0x7f0000000640)='./file0\x00', 0x100)
setsockopt$inet6_tcp_TCP_REPAIR_QUEUE(r3, 0x6, 0x14, &(0x7f0000000980), 0x4)
unlink(&(0x7f0000000940)='./file0\x00')
r4 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_GET_NODE_DEBUG_INFO(r4, 0xc018620b, &(0x7f0000000100))
ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)})
ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0x0, 0x0, &(0x7f0000000780)})

15:06:30 executing program 5:
r0 = socket$inet_udplite(0x2, 0x2, 0x88)
ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f3188b070")
syz_open_procfs(0x0, &(0x7f0000000940)='syscall\x00')
r1 = syz_open_procfs(0x0, &(0x7f0000000040)='fd\x00')
recvmmsg(0xffffffffffffffff, &(0x7f0000003840)=[{{0x0, 0x0, 0x0}}], 0x1, 0x0, 0x0)
perf_event_open(&(0x7f0000940000)={0x2, 0x70, 0xee6a, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x100, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0xff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x10001, 0x1}, 0x0, 0x400000000000000}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
mlock(&(0x7f00005b8000/0x3000)=nil, 0x3000)
ioctl$SNDRV_TIMER_IOCTL_SELECT(0xffffffffffffffff, 0x40345410, 0x0)
openat$uinput(0xffffffffffffff9c, &(0x7f0000000080)='/dev/uinput\x00', 0x2, 0x0)
mmap(&(0x7f000060b000/0x1000)=nil, 0x1000, 0x5, 0x8000400200000033, r1, 0x0)
unshare(0xfffffffffffffffd)
r2 = getpid()
sched_setscheduler(r2, 0x5, &(0x7f00000000c0))
open$dir(&(0x7f0000000400)='./file0\x00', 0x0, 0x0)
perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f00000004c0), 0x2}, 0x0, 0x0, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r3 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000340)='memory.current\x00', 0x0, 0x0)
ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, 0x0)
socketpair(0x1, 0x20000000000001, 0x0, &(0x7f0000000100)={<r4=>0xffffffffffffffff, <r5=>0xffffffffffffffff})
ioctl$PERF_EVENT_IOC_SET_FILTER(r5, 0x8914, &(0x7f0000000300)='lo\x00\x96o\xd6Q\xb9Y\xa9\xc8J,\x00\xd2\x97\x04\x03\xdc\r')
close(r3)
rt_sigprocmask(0x2, &(0x7f0000000240)={0x6}, &(0x7f00000002c0), 0x8)
ioctl$PERF_EVENT_IOC_SET_FILTER(r5, 0x8923, &(0x7f00000008c0)='lo\x00\x96o8\x0fd\xa1\xe3\xd7]b}\x1f\xa1Y\xad4\x90\x9d`\xd2\x98\x00\x00\x00 \'Y\x17]\x15c\xcaR\xdd\x98OC\x89\x1b\xe7\x84\xe2\x05\x80w\xd2|D\x8dK\x14Bx\xcbuH\xc2\xeec\xbf<>Y\x1a\xfc\x1f9OB\x81\x89\x186\xc5q@n\xb4\xb6s\xb0\x00\x00\xfc\x00\x00\b\x00\x00\xda\xef\xecE\xec\xd5I\xb2\x9b\xfe\x8d\x90?\x00\xe9\xe4~g:\xc1\xb2aj\x96\xbb\xa7\xe2\xc0\xdc\xf9Q\b\xeb\x16\x7fT\x11\xd3\r7\xe6\"f\xcf\x8e\xabd\x0ftp\x82\xae\xd2\x15\x8e+c\xf6\xbf\xe14>\xa6-\xa5c\xde\xd7\xab\xea\x1f\xf8s2\x9cVF\xd5\x18\xfe\x0e\x8f \x01\x00\x00y.\xfc*\x82\xa5\xa1p5\xc8{\xf7\xef\xab\xe8\x99\xebw#\x8at\x1c\x80\xfc\xb0\x95\xa2\xa7\xd7,Y]E8\x83X\xf5F\xdc\x88-\xf5\xb0\xb5^\xdb\x1a\xb6\xaa\x14\xe2\xb9\rh^J-\xd1\xbaUn\x04\'l\x1b\xe0o\xdb\xc8\x91%\x1c\xb5\xbf\xb6\x90\xb4\xc2\x7f]/\xb3\xe7\xc9\'\x94\xcfIo\xdf\x04\x95\xb5\x06\x84\x1fH>\xda\xc5\x04 \x94\x88\xeb\'\xd4;6\x7f\xd9\x99-\x1b|G\x8d\xd4\xb9%\xaaQ\xa0K\x10\x03\x93\xe1\xcc\xe7m\x80\'\xf0\xa5\xed(\r\xa8\x0f&\xb1\xf3\xff0\f\x82%_\x92\x8bD\xb9\xd9\xe7\xf2\xe4\xc1i#\xdc\x87A\xb9\xc7\r\x92\xfa\x11\x11\xb5\x1f\x03\x9d\xdd\x1bj\xdf\xacg\xe3\xa0S\xd3\x8a\xe1n\x97\xea\xf5\xa0\'\v\xe9\xa0\xf1 f\xaan\xcf\xb5i\xb6d\xbc\x92\v\xd58\x16\b\xb3_:\xa4!\ny\xc4&\nWMM\xa8\xc4\v\x9f\x01o\xf4\xab&\xb6\x17\x02P\xc3!N\xf4\b\x1a~\x91V1s\xe9\xbe\x9e\x9b\'\xcde\xb3\xa1\x86\"\xd7\x04\xf1\xc0!\xed\xff\xee$\xc89\x8cB0\xd1dD\xe0IP\x88\xa2\xf2Y\x9af$$\xf1cO\xf7P\xac\xca\x80:!\xb4\x94#\xcb^\x9f\'\x03\xe3\x93\xb9\x82\xbf\xcf\xc4\xe3\xf7\x03Oh\xf2r\xca\x8ff\xbb/\x9f*\xaf\x1a \xa5\xa0?%M\xa5\x86\x98\xf24\'1\xc7\f<\xcc@\xe8\x8a\xac.\xde\xe4\xc7\xf5\x9ck\xa40!\xe9\x14$\xb3\x05m\xb5m\xed\ft\x93\xd8\xa3\x80\'Y\xb9\x05\xbbt|\xbe\xbcz\n\xf3\xf5p\xf8\x9f~\x1b\xd0\v\x1cQ')
getsockopt$inet_IP_IPSEC_POLICY(r1, 0x0, 0x10, &(0x7f00000006c0)={{{@in6=@loopback}}, {{@in6=@initdev}}}, &(0x7f0000000500)=0xe8)
socketpair(0x2, 0x2000000080003, 0x100, &(0x7f0000000480))
syz_genetlink_get_family_id$SEG6(&(0x7f00000003c0)='SEG6\x00')
sendmsg$SEG6_CMD_DUMPHMAC(r4, &(0x7f0000000580)={&(0x7f0000000380)={0x10, 0x0, 0x0, 0x1000000}, 0xc, &(0x7f0000000440)={&(0x7f00000005c0)=ANY=[@ANYBLOB="2300260109447a0000000000000000660000001400001a0065a455e04ea56d0a47018c8e973bcac914471474a7e0d50a000eadd66d2e49a2ed40dcafa1e046ab6aacc2097d8f75bd9c8b8a220bdde116904efa3f9600f22ab388644f66c2d5baec4079a81bae1927e49e91a4964656d7b227702926af5be846f3de49fad39048633fd9161123894d9427f854a30cb0532c8f31f663380e40ce7f6cb15ec8baab3b7c6f"], 0x1}, 0x1, 0x0, 0x0, 0x8000}, 0x804)
r6 = creat(&(0x7f0000000280)='./bus\x00', 0x0)
arch_prctl$ARCH_MAP_VDSO_32(0x2002, 0x7e)
ftruncate(r6, 0x2008200)
open(&(0x7f0000000140)='./bus\x00', 0x4000, 0x0)

15:06:30 executing program 3:
r0 = socket$inet_udplite(0x2, 0x2, 0x88)
ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f3188b070")
syz_open_procfs(0x0, &(0x7f0000000940)='syscall\x00')
r1 = syz_open_procfs(0x0, &(0x7f0000000040)='fd\x00')
recvmmsg(0xffffffffffffffff, &(0x7f0000003840)=[{{0x0, 0x0, 0x0}}], 0x1, 0x0, 0x0)
perf_event_open(&(0x7f0000940000)={0x2, 0x70, 0xee6a, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x100, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0xff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x10001, 0x1}, 0x0, 0x400000000000000}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
mlock(&(0x7f00005b8000/0x3000)=nil, 0x3000)
ioctl$SNDRV_TIMER_IOCTL_SELECT(0xffffffffffffffff, 0x40345410, 0x0)
openat$uinput(0xffffffffffffff9c, &(0x7f0000000080)='/dev/uinput\x00', 0x2, 0x0)
mmap(&(0x7f000060b000/0x1000)=nil, 0x1000, 0x5, 0x8000400200000033, r1, 0x0)
perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x2, 0x9, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2000000, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x4000000, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8)
r2 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)={0x10b, 0x6, 0x209e1e, 0x3, 0x1}, 0x2c)
bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000b40)={r2, &(0x7f0000000040), 0x0, 0x1}, 0x20)
r3 = creat(&(0x7f0000000640)='./file0\x00', 0x100)
setsockopt$inet6_tcp_TCP_REPAIR_QUEUE(r3, 0x6, 0x14, &(0x7f0000000980), 0x4)
unlink(&(0x7f0000000940)='./file0\x00')
r4 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r5 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r5, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)})

15:06:30 executing program 0:
r0 = socket$inet_udplite(0x2, 0x2, 0x88)
ioctl(r0, 0x0, &(0x7f0000000000)="0adc1f123c123f3188b070")
r1 = syz_open_procfs(0x0, &(0x7f0000000080)='net/dev_mcast\x00')
lseek(r1, 0x20000, 0x0)

15:06:30 executing program 4:
r0 = syz_open_procfs(0x0, &(0x7f00000001c0)='net/softnet_stat\x00')
lseek(r0, 0x0, 0x3)
prctl$PR_MPX_ENABLE_MANAGEMENT(0x2b)
bind$netlink(r0, &(0x7f0000000000)={0x10, 0x0, 0x25dfdbfc, 0x80000000}, 0xc)
lseek(r0, 0x20000, 0x0)

15:06:30 executing program 2:
socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000040)={0xffffffffffffffff, <r0=>0xffffffffffffffff})
ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200)
perf_event_open(&(0x7f0000c86f88)={0x0, 0x70, 0x910, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
socket$inet6(0xa, 0x1000000000002, 0x0)
mknod$loop(&(0x7f0000000100)='./file0\x00', 0xa, 0xffffffffffffffff)
clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
execve(&(0x7f00000000c0)='./file0\x00', 0x0, 0x0)

15:06:30 executing program 0:
r0 = socket$inet_udplite(0x2, 0x2, 0x88)
ioctl(r0, 0x1000008912, 0x0)
r1 = syz_open_procfs(0x0, &(0x7f0000000080)='net/dev_mcast\x00')
lseek(r1, 0x20000, 0x0)

15:06:30 executing program 1:
r0 = socket$inet_udplite(0x2, 0x2, 0x88)
ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f3188b070")
syz_open_procfs(0x0, &(0x7f0000000940)='syscall\x00')
r1 = syz_open_procfs(0x0, &(0x7f0000000040)='fd\x00')
recvmmsg(0xffffffffffffffff, &(0x7f0000003840)=[{{0x0, 0x0, 0x0}}], 0x1, 0x0, 0x0)
perf_event_open(&(0x7f0000940000)={0x2, 0x70, 0xee6a, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x100, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0xff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x10001, 0x1}, 0x0, 0x400000000000000}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
mlock(&(0x7f00005b8000/0x3000)=nil, 0x3000)
ioctl$SNDRV_TIMER_IOCTL_SELECT(0xffffffffffffffff, 0x40345410, 0x0)
openat$uinput(0xffffffffffffff9c, &(0x7f0000000080)='/dev/uinput\x00', 0x2, 0x0)
mmap(&(0x7f000060b000/0x1000)=nil, 0x1000, 0x5, 0x8000400200000033, r1, 0x0)
perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x2, 0x9, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2000000, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x4000000, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8)
r2 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)={0x10b, 0x6, 0x209e1e, 0x3, 0x1}, 0x2c)
bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000b40)={r2, &(0x7f0000000040), 0x0, 0x1}, 0x20)
r3 = creat(&(0x7f0000000640)='./file0\x00', 0x100)
setsockopt$inet6_tcp_TCP_REPAIR_QUEUE(r3, 0x6, 0x14, &(0x7f0000000980), 0x4)
unlink(&(0x7f0000000940)='./file0\x00')
r4 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_GET_NODE_DEBUG_INFO(r4, 0xc018620b, &(0x7f0000000100))
ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)})
ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0x0, 0x0, &(0x7f0000000780)})

15:06:30 executing program 3:
r0 = socket$inet_udplite(0x2, 0x2, 0x88)
ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f3188b070")
syz_open_procfs(0x0, &(0x7f0000000940)='syscall\x00')
r1 = syz_open_procfs(0x0, &(0x7f0000000040)='fd\x00')
recvmmsg(0xffffffffffffffff, &(0x7f0000003840)=[{{0x0, 0x0, 0x0}}], 0x1, 0x0, 0x0)
perf_event_open(&(0x7f0000940000)={0x2, 0x70, 0xee6a, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x100, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0xff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x10001, 0x1}, 0x0, 0x400000000000000}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
mlock(&(0x7f00005b8000/0x3000)=nil, 0x3000)
ioctl$SNDRV_TIMER_IOCTL_SELECT(0xffffffffffffffff, 0x40345410, 0x0)
openat$uinput(0xffffffffffffff9c, &(0x7f0000000080)='/dev/uinput\x00', 0x2, 0x0)
mmap(&(0x7f000060b000/0x1000)=nil, 0x1000, 0x5, 0x8000400200000033, r1, 0x0)
perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x2, 0x9, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2000000, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x4000000, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8)
r2 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)={0x10b, 0x6, 0x209e1e, 0x3, 0x1}, 0x2c)
bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000b40)={r2, &(0x7f0000000040), 0x0, 0x1}, 0x20)
r3 = creat(&(0x7f0000000640)='./file0\x00', 0x100)
setsockopt$inet6_tcp_TCP_REPAIR_QUEUE(r3, 0x6, 0x14, &(0x7f0000000980), 0x4)
unlink(&(0x7f0000000940)='./file0\x00')
r4 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r5 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r5, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)})

[ 1111.521796] binder: 926:932 transaction failed 29189/-22, size 24-8 line 3117
[ 1111.529021] binder_alloc: 927: binder_alloc_buf, no vma
[ 1111.543748] binder: 926:932 BC_INCREFS_DONE u0000000000000000 no match
[ 1111.557814] binder: 927:928 transaction failed 29189/-3, size 24-8 line 3254
15:06:30 executing program 4:
r0 = syz_open_procfs(0x0, &(0x7f00000001c0)='net/softnet_stat\x00')
lseek(r0, 0x20000, 0x0)
r1 = syz_genetlink_get_family_id$SEG6(&(0x7f0000000040)='SEG6\x00')
sendmsg$SEG6_CMD_GET_TUNSRC(r0, &(0x7f0000000180)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x20}, 0xc, &(0x7f0000000140)={&(0x7f0000000080)={0x84, r1, 0x200, 0x70bd2b, 0x25dfdbfb, {}, [@SEG6_ATTR_ALGID={0x8, 0x6, 0xffffffffffff6e3d}, @SEG6_ATTR_DST={0x14, 0x1, @empty}, @SEG6_ATTR_ALGID={0x8, 0x6, 0xffffffffffffa4f7}, @SEG6_ATTR_DST={0x14, 0x1, @ipv4={[], [], @local}}, @SEG6_ATTR_DST={0x14, 0x1, @mcast2}, @SEG6_ATTR_SECRET={0x10, 0x4, [0x5, 0x1ff, 0xe55d]}, @SEG6_ATTR_DST={0x14, 0x1, @empty}]}, 0x84}, 0x1, 0x0, 0x0, 0x2000c804}, 0x4000000)

15:06:30 executing program 0:
r0 = socket$inet_udplite(0x2, 0x2, 0x88)
ioctl(r0, 0x1000008912, 0x0)
r1 = syz_open_procfs(0x0, &(0x7f0000000080)='net/dev_mcast\x00')
lseek(r1, 0x20000, 0x0)

15:06:30 executing program 2:
r0 = add_key$keyring(&(0x7f0000000000)='keyring\x00', &(0x7f0000000040)={'syz'}, 0x0, 0x0, 0xfffffffffffffffc)
keyctl$assume_authority(0x10, r0)

[ 1111.756439] binder: 954:959 transaction failed 29189/-22, size 24-8 line 3117
[ 1111.782960] binder_alloc: 952: binder_alloc_buf, no vma
[ 1111.792181] binder: 954:959 BC_INCREFS_DONE u0000000000000000 no match
15:06:30 executing program 0:
r0 = socket$inet_udplite(0x2, 0x2, 0x88)
ioctl(r0, 0x1000008912, 0x0)
r1 = syz_open_procfs(0x0, &(0x7f0000000080)='net/dev_mcast\x00')
lseek(r1, 0x20000, 0x0)

[ 1111.800663] binder: 952:958 transaction failed 29189/-3, size 24-8 line 3254
15:06:30 executing program 3:
r0 = socket$inet_udplite(0x2, 0x2, 0x88)
ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f3188b070")
syz_open_procfs(0x0, &(0x7f0000000940)='syscall\x00')
r1 = syz_open_procfs(0x0, &(0x7f0000000040)='fd\x00')
recvmmsg(0xffffffffffffffff, &(0x7f0000003840)=[{{0x0, 0x0, 0x0}}], 0x1, 0x0, 0x0)
perf_event_open(&(0x7f0000940000)={0x2, 0x70, 0xee6a, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x100, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0xff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x10001, 0x1}, 0x0, 0x400000000000000}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
mlock(&(0x7f00005b8000/0x3000)=nil, 0x3000)
ioctl$SNDRV_TIMER_IOCTL_SELECT(0xffffffffffffffff, 0x40345410, 0x0)
openat$uinput(0xffffffffffffff9c, &(0x7f0000000080)='/dev/uinput\x00', 0x2, 0x0)
mmap(&(0x7f000060b000/0x1000)=nil, 0x1000, 0x5, 0x8000400200000033, r1, 0x0)
perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x2, 0x9, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2000000, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x4000000, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8)
r2 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)={0x10b, 0x6, 0x209e1e, 0x3, 0x1}, 0x2c)
bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000b40)={r2, &(0x7f0000000040), 0x0, 0x1}, 0x20)
r3 = creat(&(0x7f0000000640)='./file0\x00', 0x100)
setsockopt$inet6_tcp_TCP_REPAIR_QUEUE(r3, 0x6, 0x14, &(0x7f0000000980), 0x4)
unlink(&(0x7f0000000940)='./file0\x00')
r4 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r5 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r5, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)})

15:06:30 executing program 1:
r0 = socket$inet_udplite(0x2, 0x2, 0x88)
ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f3188b070")
syz_open_procfs(0x0, &(0x7f0000000940)='syscall\x00')
r1 = syz_open_procfs(0x0, &(0x7f0000000040)='fd\x00')
recvmmsg(0xffffffffffffffff, &(0x7f0000003840)=[{{0x0, 0x0, 0x0}}], 0x1, 0x0, 0x0)
perf_event_open(&(0x7f0000940000)={0x2, 0x70, 0xee6a, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x100, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0xff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x10001, 0x1}, 0x0, 0x400000000000000}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
mlock(&(0x7f00005b8000/0x3000)=nil, 0x3000)
ioctl$SNDRV_TIMER_IOCTL_SELECT(0xffffffffffffffff, 0x40345410, 0x0)
openat$uinput(0xffffffffffffff9c, &(0x7f0000000080)='/dev/uinput\x00', 0x2, 0x0)
mmap(&(0x7f000060b000/0x1000)=nil, 0x1000, 0x5, 0x8000400200000033, r1, 0x0)
perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x2, 0x9, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2000000, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x4000000, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8)
r2 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)={0x10b, 0x6, 0x209e1e, 0x3, 0x1}, 0x2c)
bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000b40)={r2, &(0x7f0000000040), 0x0, 0x1}, 0x20)
r3 = creat(&(0x7f0000000640)='./file0\x00', 0x100)
setsockopt$inet6_tcp_TCP_REPAIR_QUEUE(r3, 0x6, 0x14, &(0x7f0000000980), 0x4)
unlink(&(0x7f0000000940)='./file0\x00')
syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_GET_NODE_DEBUG_INFO(0xffffffffffffffff, 0xc018620b, &(0x7f0000000100))
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)})
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0x0, 0x0, &(0x7f0000000780)})

15:06:30 executing program 4:
r0 = syz_open_procfs(0x0, &(0x7f00000001c0)='net/softnet_stat\x00')
fsetxattr$security_ima(r0, &(0x7f0000000080)='security.ima\x00', &(0x7f00000000c0)=@md5={0x1, "f11a419f9dc38f2a58d0b9266cde7dd8"}, 0x11, 0x3)
socketpair(0x1, 0x6, 0x7fff, &(0x7f0000000000))
memfd_create(&(0x7f0000000040)='#\x00', 0x1)
lseek(r0, 0x20000, 0x0)

15:06:30 executing program 2:
clone(0x200, &(0x7f0000000040), 0x0, 0x0, 0xffffffffffffffff)

15:06:30 executing program 5:
r0 = socket$inet_udplite(0x2, 0x2, 0x88)
ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f3188b070")
syz_open_procfs(0x0, &(0x7f0000000940)='syscall\x00')
r1 = syz_open_procfs(0x0, &(0x7f0000000040)='fd\x00')
recvmmsg(0xffffffffffffffff, &(0x7f0000003840)=[{{0x0, 0x0, 0x0}}], 0x1, 0x0, 0x0)
perf_event_open(&(0x7f0000940000)={0x2, 0x70, 0xee6a, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x100, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0xff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x10001, 0x1}, 0x0, 0x400000000000000}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
mlock(&(0x7f00005b8000/0x3000)=nil, 0x3000)
ioctl$SNDRV_TIMER_IOCTL_SELECT(0xffffffffffffffff, 0x40345410, 0x0)
r2 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000080)='/dev/uinput\x00', 0x2, 0x0)
mmap(&(0x7f000060b000/0x1000)=nil, 0x1000, 0x5, 0x8000400200000033, r1, 0x0)
unshare(0xfffffffffffffffd)
r3 = getpid()
sched_setscheduler(r3, 0x5, &(0x7f00000000c0))
open$dir(&(0x7f0000000400)='./file0\x00', 0x0, 0x0)
perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f00000004c0), 0x2}, 0x0, 0x0, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r4 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000340)='memory.current\x00', 0x0, 0x0)
ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, 0x0)
socketpair(0x1, 0x20000000000001, 0x0, &(0x7f0000000100)={<r5=>0xffffffffffffffff, <r6=>0xffffffffffffffff})
ioctl$PERF_EVENT_IOC_SET_FILTER(r6, 0x8914, &(0x7f0000000300)='lo\x00\x96o\xd6Q\xb9Y\xa9\xc8J,\x00\xd2\x97\x04\x03\xdc\r')
close(r4)
rt_sigprocmask(0x2, &(0x7f0000000240)={0x6}, &(0x7f00000002c0), 0x8)
ioctl$PERF_EVENT_IOC_SET_FILTER(r6, 0x8923, &(0x7f00000008c0)='lo\x00\x96o8\x0fd\xa1\xe3\xd7]b}\x1f\xa1Y\xad4\x90\x9d`\xd2\x98\x00\x00\x00 \'Y\x17]\x15c\xcaR\xdd\x98OC\x89\x1b\xe7\x84\xe2\x05\x80w\xd2|D\x8dK\x14Bx\xcbuH\xc2\xeec\xbf<>Y\x1a\xfc\x1f9OB\x81\x89\x186\xc5q@n\xb4\xb6s\xb0\x00\x00\xfc\x00\x00\b\x00\x00\xda\xef\xecE\xec\xd5I\xb2\x9b\xfe\x8d\x90?\x00\xe9\xe4~g:\xc1\xb2aj\x96\xbb\xa7\xe2\xc0\xdc\xf9Q\b\xeb\x16\x7fT\x11\xd3\r7\xe6\"f\xcf\x8e\xabd\x0ftp\x82\xae\xd2\x15\x8e+c\xf6\xbf\xe14>\xa6-\xa5c\xde\xd7\xab\xea\x1f\xf8s2\x9cVF\xd5\x18\xfe\x0e\x8f \x01\x00\x00y.\xfc*\x82\xa5\xa1p5\xc8{\xf7\xef\xab\xe8\x99\xebw#\x8at\x1c\x80\xfc\xb0\x95\xa2\xa7\xd7,Y]E8\x83X\xf5F\xdc\x88-\xf5\xb0\xb5^\xdb\x1a\xb6\xaa\x14\xe2\xb9\rh^J-\xd1\xbaUn\x04\'l\x1b\xe0o\xdb\xc8\x91%\x1c\xb5\xbf\xb6\x90\xb4\xc2\x7f]/\xb3\xe7\xc9\'\x94\xcfIo\xdf\x04\x95\xb5\x06\x84\x1fH>\xda\xc5\x04 \x94\x88\xeb\'\xd4;6\x7f\xd9\x99-\x1b|G\x8d\xd4\xb9%\xaaQ\xa0K\x10\x03\x93\xe1\xcc\xe7m\x80\'\xf0\xa5\xed(\r\xa8\x0f&\xb1\xf3\xff0\f\x82%_\x92\x8bD\xb9\xd9\xe7\xf2\xe4\xc1i#\xdc\x87A\xb9\xc7\r\x92\xfa\x11\x11\xb5\x1f\x03\x9d\xdd\x1bj\xdf\xacg\xe3\xa0S\xd3\x8a\xe1n\x97\xea\xf5\xa0\'\v\xe9\xa0\xf1 f\xaan\xcf\xb5i\xb6d\xbc\x92\v\xd58\x16\b\xb3_:\xa4!\ny\xc4&\nWMM\xa8\xc4\v\x9f\x01o\xf4\xab&\xb6\x17\x02P\xc3!N\xf4\b\x1a~\x91V1s\xe9\xbe\x9e\x9b\'\xcde\xb3\xa1\x86\"\xd7\x04\xf1\xc0!\xed\xff\xee$\xc89\x8cB0\xd1dD\xe0IP\x88\xa2\xf2Y\x9af$$\xf1cO\xf7P\xac\xca\x80:!\xb4\x94#\xcb^\x9f\'\x03\xe3\x93\xb9\x82\xbf\xcf\xc4\xe3\xf7\x03Oh\xf2r\xca\x8ff\xbb/\x9f*\xaf\x1a \xa5\xa0?%M\xa5\x86\x98\xf24\'1\xc7\f<\xcc@\xe8\x8a\xac.\xde\xe4\xc7\xf5\x9ck\xa40!\xe9\x14$\xb3\x05m\xb5m\xed\ft\x93\xd8\xa3\x80\'Y\xb9\x05\xbbt|\xbe\xbcz\n\xf3\xf5p\xf8\x9f~\x1b\xd0\v\x1cQ')
r7 = fcntl$dupfd(r2, 0x0, r6)
getsockopt$inet_IP_IPSEC_POLICY(r7, 0x0, 0x10, &(0x7f0000000b00)={{{@in6=@loopback}}, {{@in6=@initdev}}}, &(0x7f0000000200)=0xfffffeda)
socketpair(0x2, 0x2000000080003, 0x100, &(0x7f0000000480))
syz_genetlink_get_family_id$SEG6(&(0x7f00000003c0)='SEG6\x00')
sendmsg$SEG6_CMD_DUMPHMAC(r5, &(0x7f0000000580)={&(0x7f0000000380)={0x10, 0x0, 0x0, 0x1000000}, 0xc, &(0x7f0000000440)={&(0x7f00000005c0)=ANY=[@ANYBLOB="2300260109447a0000000000000000660000001400001a0065a455e04ea56d0a47018c8e973bcac914471474a7e0d50a000eadd66d2e49a2ed40dcafa1e046ab6aacc2097d8f75bd9c8b8a220bdde116904efa3f9600f22ab388644f66c2d5baec4079a81bae1927e49e91a4964656d7b227702926af5be846f3de49fad39048633fd9161123894d9427f854a30cb0532c8f31f663380e40ce7f6cb15ec8baab3b7c6f"], 0x1}, 0x1, 0x0, 0x0, 0x8000}, 0x804)
r8 = creat(&(0x7f0000000280)='./bus\x00', 0x0)
arch_prctl$ARCH_MAP_VDSO_32(0x2002, 0x7e)
ftruncate(r8, 0x2008200)
open(&(0x7f0000000140)='./bus\x00', 0x4000, 0x0)

15:06:30 executing program 0:
r0 = socket$inet_udplite(0x2, 0x2, 0x88)
ioctl(r0, 0x1000008912, &(0x7f0000000000))
r1 = syz_open_procfs(0x0, &(0x7f0000000080)='net/dev_mcast\x00')
lseek(r1, 0x20000, 0x0)

15:06:30 executing program 0:
r0 = socket$inet_udplite(0x2, 0x2, 0x88)
ioctl(r0, 0x1000008912, &(0x7f0000000000))
r1 = syz_open_procfs(0x0, &(0x7f0000000080)='net/dev_mcast\x00')
lseek(r1, 0x20000, 0x0)

15:06:30 executing program 2:
r0 = socket$inet_udplite(0x2, 0x2, 0x88)
ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f3188b070")
syz_open_procfs(0x0, &(0x7f0000000940)='syscall\x00')
r1 = syz_open_procfs(0x0, &(0x7f0000000040)='fd\x00')
recvmmsg(0xffffffffffffffff, &(0x7f0000003840)=[{{0x0, 0x0, 0x0}}], 0x1, 0x0, 0x0)
perf_event_open(&(0x7f0000940000)={0x2, 0x70, 0xee6a, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x100, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0xff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x10001, 0x1}, 0x0, 0x400000000000000}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
mlock(&(0x7f00005b8000/0x3000)=nil, 0x3000)
ioctl$SNDRV_TIMER_IOCTL_SELECT(0xffffffffffffffff, 0x40345410, 0x0)
openat$uinput(0xffffffffffffff9c, &(0x7f0000000080)='/dev/uinput\x00', 0x2, 0x0)
mmap(&(0x7f000060b000/0x1000)=nil, 0x1000, 0x5, 0x8000400200000033, r1, 0x0)
perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x2, 0x9, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2000000, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x4000000, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8)
r2 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)={0x10b, 0x6, 0x209e1e, 0x3, 0x1}, 0x2c)
bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000b40)={r2, &(0x7f0000000040), 0x0, 0x1}, 0x20)
r3 = creat(&(0x7f0000000640)='./file0\x00', 0x100)
setsockopt$inet6_tcp_TCP_REPAIR_QUEUE(r3, 0x6, 0x14, &(0x7f0000000980), 0x4)
unlink(&(0x7f0000000940)='./file0\x00')
r4 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r5 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r5, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)})

15:06:30 executing program 4:
r0 = openat$selinux_mls(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/mls\x00', 0x0, 0x0)
getsockopt$EBT_SO_GET_INIT_INFO(r0, 0x0, 0x82, &(0x7f0000000040)={'broute\x00'}, &(0x7f00000000c0)=0x78)
ioctl$EVIOCGID(r0, 0x80084502, &(0x7f0000000100)=""/18)
r1 = syz_open_procfs(0x0, &(0x7f00000001c0)='net/softnet_stat\x00')
lseek(r1, 0x20000, 0x0)

15:06:31 executing program 1:
r0 = socket$inet_udplite(0x2, 0x2, 0x88)
ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f3188b070")
syz_open_procfs(0x0, &(0x7f0000000940)='syscall\x00')
r1 = syz_open_procfs(0x0, &(0x7f0000000040)='fd\x00')
recvmmsg(0xffffffffffffffff, &(0x7f0000003840)=[{{0x0, 0x0, 0x0}}], 0x1, 0x0, 0x0)
perf_event_open(&(0x7f0000940000)={0x2, 0x70, 0xee6a, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x100, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0xff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x10001, 0x1}, 0x0, 0x400000000000000}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
mlock(&(0x7f00005b8000/0x3000)=nil, 0x3000)
ioctl$SNDRV_TIMER_IOCTL_SELECT(0xffffffffffffffff, 0x40345410, 0x0)
openat$uinput(0xffffffffffffff9c, &(0x7f0000000080)='/dev/uinput\x00', 0x2, 0x0)
mmap(&(0x7f000060b000/0x1000)=nil, 0x1000, 0x5, 0x8000400200000033, r1, 0x0)
perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x2, 0x9, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2000000, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x4000000, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8)
r2 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)={0x10b, 0x6, 0x209e1e, 0x3, 0x1}, 0x2c)
bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000b40)={r2, &(0x7f0000000040), 0x0, 0x1}, 0x20)
r3 = creat(&(0x7f0000000640)='./file0\x00', 0x100)
setsockopt$inet6_tcp_TCP_REPAIR_QUEUE(r3, 0x6, 0x14, &(0x7f0000000980), 0x4)
unlink(&(0x7f0000000940)='./file0\x00')
syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_GET_NODE_DEBUG_INFO(0xffffffffffffffff, 0xc018620b, &(0x7f0000000100))
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)})
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0x0, 0x0, &(0x7f0000000780)})

15:06:31 executing program 0:
r0 = socket$inet_udplite(0x2, 0x2, 0x88)
ioctl(r0, 0x1000008912, &(0x7f0000000000))
r1 = syz_open_procfs(0x0, &(0x7f0000000080)='net/dev_mcast\x00')
lseek(r1, 0x20000, 0x0)

15:06:31 executing program 3:
r0 = socket$inet_udplite(0x2, 0x2, 0x88)
ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f3188b070")
syz_open_procfs(0x0, &(0x7f0000000940)='syscall\x00')
r1 = syz_open_procfs(0x0, &(0x7f0000000040)='fd\x00')
recvmmsg(0xffffffffffffffff, &(0x7f0000003840)=[{{0x0, 0x0, 0x0}}], 0x1, 0x0, 0x0)
perf_event_open(&(0x7f0000940000)={0x2, 0x70, 0xee6a, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x100, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0xff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x10001, 0x1}, 0x0, 0x400000000000000}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
mlock(&(0x7f00005b8000/0x3000)=nil, 0x3000)
ioctl$SNDRV_TIMER_IOCTL_SELECT(0xffffffffffffffff, 0x40345410, 0x0)
openat$uinput(0xffffffffffffff9c, &(0x7f0000000080)='/dev/uinput\x00', 0x2, 0x0)
mmap(&(0x7f000060b000/0x1000)=nil, 0x1000, 0x5, 0x8000400200000033, r1, 0x0)
perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x2, 0x9, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2000000, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x4000000, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8)
r2 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)={0x10b, 0x6, 0x209e1e, 0x3, 0x1}, 0x2c)
bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000b40)={r2, &(0x7f0000000040), 0x0, 0x1}, 0x20)
r3 = creat(&(0x7f0000000640)='./file0\x00', 0x100)
setsockopt$inet6_tcp_TCP_REPAIR_QUEUE(r3, 0x6, 0x14, &(0x7f0000000980), 0x4)
unlink(&(0x7f0000000940)='./file0\x00')
r4 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)})

[ 1112.120850] binder_alloc: 983: binder_alloc_buf, no vma
[ 1112.141595] binder: 983:988 transaction failed 29189/-3, size 24-8 line 3254
15:06:31 executing program 4:
ioctl$TIOCGPGRP(0xffffffffffffff9c, 0x540f, &(0x7f0000000040))
fcntl$getownex(0xffffffffffffff9c, 0x10, &(0x7f0000000080))
ioctl$sock_FIOGETOWN(0xffffffffffffffff, 0x8903, &(0x7f00000000c0)=<r0=>0x0)
r1 = syz_open_procfs(r0, &(0x7f0000000000)='net!softnet_stat\x00')
lseek(r1, 0x20000, 0x0)
ioctl$KDGETMODE(r1, 0x4b3b, &(0x7f0000000100))

15:06:31 executing program 0:
r0 = socket$inet_udplite(0x2, 0x2, 0x88)
ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c12")
r1 = syz_open_procfs(0x0, &(0x7f0000000080)='net/dev_mcast\x00')
lseek(r1, 0x20000, 0x0)

15:06:31 executing program 2:
r0 = socket$inet_udplite(0x2, 0x2, 0x88)
ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f3188b070")
syz_open_procfs(0x0, &(0x7f0000000940)='syscall\x00')
r1 = syz_open_procfs(0x0, &(0x7f0000000040)='fd\x00')
recvmmsg(0xffffffffffffffff, &(0x7f0000003840)=[{{0x0, 0x0, 0x0}}], 0x1, 0x0, 0x0)
perf_event_open(&(0x7f0000940000)={0x2, 0x70, 0xee6a, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x100, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0xff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x10001, 0x1}, 0x0, 0x400000000000000}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
mlock(&(0x7f00005b8000/0x3000)=nil, 0x3000)
ioctl$SNDRV_TIMER_IOCTL_SELECT(0xffffffffffffffff, 0x40345410, 0x0)
openat$uinput(0xffffffffffffff9c, &(0x7f0000000080)='/dev/uinput\x00', 0x2, 0x0)
mmap(&(0x7f000060b000/0x1000)=nil, 0x1000, 0x5, 0x8000400200000033, r1, 0x0)
perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x2, 0x9, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2000000, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x4000000, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8)
r2 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)={0x10b, 0x6, 0x209e1e, 0x3, 0x1}, 0x2c)
bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000b40)={r2, &(0x7f0000000040), 0x0, 0x1}, 0x20)
r3 = creat(&(0x7f0000000640)='./file0\x00', 0x100)
setsockopt$inet6_tcp_TCP_REPAIR_QUEUE(r3, 0x6, 0x14, &(0x7f0000000980), 0x4)
unlink(&(0x7f0000000940)='./file0\x00')
r4 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r5 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r5, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)})

15:06:31 executing program 1:
r0 = socket$inet_udplite(0x2, 0x2, 0x88)
ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f3188b070")
syz_open_procfs(0x0, &(0x7f0000000940)='syscall\x00')
r1 = syz_open_procfs(0x0, &(0x7f0000000040)='fd\x00')
recvmmsg(0xffffffffffffffff, &(0x7f0000003840)=[{{0x0, 0x0, 0x0}}], 0x1, 0x0, 0x0)
perf_event_open(&(0x7f0000940000)={0x2, 0x70, 0xee6a, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x100, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0xff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x10001, 0x1}, 0x0, 0x400000000000000}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
mlock(&(0x7f00005b8000/0x3000)=nil, 0x3000)
ioctl$SNDRV_TIMER_IOCTL_SELECT(0xffffffffffffffff, 0x40345410, 0x0)
openat$uinput(0xffffffffffffff9c, &(0x7f0000000080)='/dev/uinput\x00', 0x2, 0x0)
mmap(&(0x7f000060b000/0x1000)=nil, 0x1000, 0x5, 0x8000400200000033, r1, 0x0)
perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x2, 0x9, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2000000, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x4000000, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8)
r2 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)={0x10b, 0x6, 0x209e1e, 0x3, 0x1}, 0x2c)
bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000b40)={r2, &(0x7f0000000040), 0x0, 0x1}, 0x20)
r3 = creat(&(0x7f0000000640)='./file0\x00', 0x100)
setsockopt$inet6_tcp_TCP_REPAIR_QUEUE(r3, 0x6, 0x14, &(0x7f0000000980), 0x4)
unlink(&(0x7f0000000940)='./file0\x00')
syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_GET_NODE_DEBUG_INFO(0xffffffffffffffff, 0xc018620b, &(0x7f0000000100))
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)})
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0x0, 0x0, &(0x7f0000000780)})

[ 1112.342680] binder: 1011:1016 transaction failed 29189/-22, size 24-8 line 3117
15:06:31 executing program 0:
r0 = socket$inet_udplite(0x2, 0x2, 0x88)
ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c12")
r1 = syz_open_procfs(0x0, &(0x7f0000000080)='net/dev_mcast\x00')
lseek(r1, 0x20000, 0x0)

15:06:31 executing program 3:
r0 = socket$inet_udplite(0x2, 0x2, 0x88)
ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f3188b070")
syz_open_procfs(0x0, &(0x7f0000000940)='syscall\x00')
r1 = syz_open_procfs(0x0, &(0x7f0000000040)='fd\x00')
recvmmsg(0xffffffffffffffff, &(0x7f0000003840)=[{{0x0, 0x0, 0x0}}], 0x1, 0x0, 0x0)
perf_event_open(&(0x7f0000940000)={0x2, 0x70, 0xee6a, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x100, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0xff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x10001, 0x1}, 0x0, 0x400000000000000}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
mlock(&(0x7f00005b8000/0x3000)=nil, 0x3000)
ioctl$SNDRV_TIMER_IOCTL_SELECT(0xffffffffffffffff, 0x40345410, 0x0)
openat$uinput(0xffffffffffffff9c, &(0x7f0000000080)='/dev/uinput\x00', 0x2, 0x0)
mmap(&(0x7f000060b000/0x1000)=nil, 0x1000, 0x5, 0x8000400200000033, r1, 0x0)
perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x2, 0x9, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2000000, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x4000000, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8)
r2 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)={0x10b, 0x6, 0x209e1e, 0x3, 0x1}, 0x2c)
bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000b40)={r2, &(0x7f0000000040), 0x0, 0x1}, 0x20)
r3 = creat(&(0x7f0000000640)='./file0\x00', 0x100)
setsockopt$inet6_tcp_TCP_REPAIR_QUEUE(r3, 0x6, 0x14, &(0x7f0000000980), 0x4)
unlink(&(0x7f0000000940)='./file0\x00')
r4 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)})

15:06:31 executing program 4:
r0 = syz_open_procfs(0x0, &(0x7f0000000000)='net/softnet_stat\x00')
lseek(r0, 0x20000, 0x0)

15:06:31 executing program 2:
r0 = socket$inet_udplite(0x2, 0x2, 0x88)
ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f3188b070")
syz_open_procfs(0x0, &(0x7f0000000940)='syscall\x00')
r1 = syz_open_procfs(0x0, &(0x7f0000000040)='fd\x00')
recvmmsg(0xffffffffffffffff, &(0x7f0000003840)=[{{0x0, 0x0, 0x0}}], 0x1, 0x0, 0x0)
perf_event_open(&(0x7f0000940000)={0x2, 0x70, 0xee6a, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x100, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0xff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x10001, 0x1}, 0x0, 0x400000000000000}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
mlock(&(0x7f00005b8000/0x3000)=nil, 0x3000)
ioctl$SNDRV_TIMER_IOCTL_SELECT(0xffffffffffffffff, 0x40345410, 0x0)
openat$uinput(0xffffffffffffff9c, &(0x7f0000000080)='/dev/uinput\x00', 0x2, 0x0)
mmap(&(0x7f000060b000/0x1000)=nil, 0x1000, 0x5, 0x8000400200000033, r1, 0x0)
perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x2, 0x9, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2000000, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x4000000, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8)
r2 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)={0x10b, 0x6, 0x209e1e, 0x3, 0x1}, 0x2c)
bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000b40)={r2, &(0x7f0000000040), 0x0, 0x1}, 0x20)
r3 = creat(&(0x7f0000000640)='./file0\x00', 0x100)
setsockopt$inet6_tcp_TCP_REPAIR_QUEUE(r3, 0x6, 0x14, &(0x7f0000000980), 0x4)
unlink(&(0x7f0000000940)='./file0\x00')
r4 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r5 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r5, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)})

15:06:31 executing program 5:
r0 = socket$inet_udplite(0x2, 0x2, 0x88)
ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f3188b070")
syz_open_procfs(0x0, &(0x7f0000000940)='syscall\x00')
r1 = syz_open_procfs(0x0, &(0x7f0000000040)='fd\x00')
recvmmsg(0xffffffffffffffff, &(0x7f0000003840)=[{{0x0, 0x0, 0x0}}], 0x1, 0x0, 0x0)
perf_event_open(&(0x7f0000940000)={0x2, 0x70, 0xee6a, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x100, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0xff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x10001, 0x1}, 0x0, 0x400000000000000}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
mlock(&(0x7f00005b8000/0x3000)=nil, 0x3000)
ioctl$SNDRV_TIMER_IOCTL_SELECT(0xffffffffffffffff, 0x40345410, 0x0)
openat$uinput(0xffffffffffffff9c, &(0x7f0000000080)='/dev/uinput\x00', 0x2, 0x0)
mmap(&(0x7f000060b000/0x1000)=nil, 0x1000, 0x5, 0x8000400200000033, r1, 0x0)
unshare(0xfffffffffffffffd)
r2 = getpid()
sched_setscheduler(r2, 0x5, &(0x7f00000000c0))
open$dir(&(0x7f0000000400)='./file0\x00', 0x0, 0x0)
r3 = perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f00000004c0), 0x2}, 0x0, 0x0, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r4 = openat$cgroup_ro(r1, &(0x7f0000000200)='meYory.current\x00', 0x0, 0x0)
ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, 0x0)
socketpair(0x1, 0x20000000000001, 0x0, &(0x7f0000000100)={<r5=>0xffffffffffffffff, <r6=>0xffffffffffffffff})
ioctl$PERF_EVENT_IOC_SET_FILTER(r3, 0x8914, &(0x7f0000000300)='lo\x00\x96o\xd6Q\xb9Y\xa9\xc8J,\x00\xd2\x97\x04\x03\xdc\r')
close(r4)
rt_sigprocmask(0x2, &(0x7f0000000240)={0x6}, &(0x7f00000002c0), 0x8)
ioctl$PERF_EVENT_IOC_SET_FILTER(r6, 0x8923, &(0x7f00000008c0)='lo\x00\x96o8\x0fd\xa1\xe3\xd7]b}\x1f\xa1Y\xad4\x90\x9d`\xd2\x98\x00\x00\x00 \'Y\x17]\x15c\xcaR\xdd\x98OC\x89\x1b\xe7\x84\xe2\x05\x80w\xd2|D\x8dK\x14Bx\xcbuH\xc2\xeec\xbf<>Y\x1a\xfc\x1f9OB\x81\x89\x186\xc5q@n\xb4\xb6s\xb0\x00\x00\xfc\x00\x00\b\x00\x00\xda\xef\xecE\xec\xd5I\xb2\x9b\xfe\x8d\x90?\x00\xe9\xe4~g:\xc1\xb2aj\x96\xbb\xa7\xe2\xc0\xdc\xf9Q\b\xeb\x16\x7fT\x11\xd3\r7\xe6\"f\xcf\x8e\xabd\x0ftp\x82\xae\xd2\x15\x8e+c\xf6\xbf\xe14>\xa6-\xa5c\xde\xd7\xab\xea\x1f\xf8s2\x9cVF\xd5\x18\xfe\x0e\x8f \x01\x00\x00y.\xfc*\x82\xa5\xa1p5\xc8{\xf7\xef\xab\xe8\x99\xebw#\x8at\x1c\x80\xfc\xb0\x95\xa2\xa7\xd7,Y]E8\x83X\xf5F\xdc\x88-\xf5\xb0\xb5^\xdb\x1a\xb6\xaa\x14\xe2\xb9\rh^J-\xd1\xbaUn\x04\'l\x1b\xe0o\xdb\xc8\x91%\x1c\xb5\xbf\xb6\x90\xb4\xc2\x7f]/\xb3\xe7\xc9\'\x94\xcfIo\xdf\x04\x95\xb5\x06\x84\x1fH>\xda\xc5\x04 \x94\x88\xeb\'\xd4;6\x7f\xd9\x99-\x1b|G\x8d\xd4\xb9%\xaaQ\xa0K\x10\x03\x93\xe1\xcc\xe7m\x80\'\xf0\xa5\xed(\r\xa8\x0f&\xb1\xf3\xff0\f\x82%_\x92\x8bD\xb9\xd9\xe7\xf2\xe4\xc1i#\xdc\x87A\xb9\xc7\r\x92\xfa\x11\x11\xb5\x1f\x03\x9d\xdd\x1bj\xdf\xacg\xe3\xa0S\xd3\x8a\xe1n\x97\xea\xf5\xa0\'\v\xe9\xa0\xf1 f\xaan\xcf\xb5i\xb6d\xbc\x92\v\xd58\x16\b\xb3_:\xa4!\ny\xc4&\nWMM\xa8\xc4\v\x9f\x01o\xf4\xab&\xb6\x17\x02P\xc3!N\xf4\b\x1a~\x91V1s\xe9\xbe\x9e\x9b\'\xcde\xb3\xa1\x86\"\xd7\x04\xf1\xc0!\xed\xff\xee$\xc89\x8cB0\xd1dD\xe0IP\x88\xa2\xf2Y\x9af$$\xf1cO\xf7P\xac\xca\x80:!\xb4\x94#\xcb^\x9f\'\x03\xe3\x93\xb9\x82\xbf\xcf\xc4\xe3\xf7\x03Oh\xf2r\xca\x8ff\xbb/\x9f*\xaf\x1a \xa5\xa0?%M\xa5\x86\x98\xf24\'1\xc7\f<\xcc@\xe8\x8a\xac.\xde\xe4\xc7\xf5\x9ck\xa40!\xe9\x14$\xb3\x05m\xb5m\xed\ft\x93\xd8\xa3\x80\'Y\xb9\x05\xbbt|\xbe\xbcz\n\xf3\xf5p\xf8\x9f~\x1b\xd0\v\x1cQ')
getsockopt$inet_IP_IPSEC_POLICY(r1, 0x0, 0x10, &(0x7f00000006c0)={{{@in6=@loopback}}, {{@in6=@initdev}}}, &(0x7f0000000500)=0xe8)
socketpair(0x2, 0x2000000080003, 0x100, &(0x7f0000000480))
syz_genetlink_get_family_id$SEG6(&(0x7f00000003c0)='SEG6\x00')
sendmsg$SEG6_CMD_DUMPHMAC(r5, &(0x7f0000000580)={&(0x7f0000000380)={0x10, 0x0, 0x0, 0x1000000}, 0xc, &(0x7f0000000440)={&(0x7f00000005c0)=ANY=[@ANYBLOB="2300260109447a0000000000000000660000001400001a0065a455e04ea56d0a47018c8e973bcac914471474a7e0d50a000eadd66d2e49a2ed40dcafa1e046ab6aacc2097d8f75bd9c8b8a220bdde116904efa3f9600f22ab388644f66c2d5baec4079a81bae1927e49e91a4964656d7b227702926af5be846f3de49fad39048633fd9161123894d9427f854a30cb0532c8f31f663380e40ce7f6cb15ec8baab3b7c6f"], 0x1}, 0x1, 0x0, 0x0, 0x8000}, 0x804)
r7 = creat(&(0x7f0000000280)='./bus\x00', 0x0)
arch_prctl$ARCH_MAP_VDSO_32(0x2002, 0x7e)
ftruncate(r7, 0x2008200)
open(&(0x7f0000000140)='./bus\x00', 0x4000, 0x0)

15:06:31 executing program 1:
r0 = socket$inet_udplite(0x2, 0x2, 0x88)
ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f3188b070")
syz_open_procfs(0x0, &(0x7f0000000940)='syscall\x00')
r1 = syz_open_procfs(0x0, &(0x7f0000000040)='fd\x00')
recvmmsg(0xffffffffffffffff, &(0x7f0000003840)=[{{0x0, 0x0, 0x0}}], 0x1, 0x0, 0x0)
perf_event_open(&(0x7f0000940000)={0x2, 0x70, 0xee6a, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x100, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0xff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x10001, 0x1}, 0x0, 0x400000000000000}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
mlock(&(0x7f00005b8000/0x3000)=nil, 0x3000)
ioctl$SNDRV_TIMER_IOCTL_SELECT(0xffffffffffffffff, 0x40345410, 0x0)
openat$uinput(0xffffffffffffff9c, &(0x7f0000000080)='/dev/uinput\x00', 0x2, 0x0)
mmap(&(0x7f000060b000/0x1000)=nil, 0x1000, 0x5, 0x8000400200000033, r1, 0x0)
perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x2, 0x9, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2000000, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x4000000, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8)
r2 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)={0x10b, 0x6, 0x209e1e, 0x3, 0x1}, 0x2c)
bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000b40)={r2, &(0x7f0000000040), 0x0, 0x1}, 0x20)
r3 = creat(&(0x7f0000000640)='./file0\x00', 0x100)
setsockopt$inet6_tcp_TCP_REPAIR_QUEUE(r3, 0x6, 0x14, &(0x7f0000000980), 0x4)
r4 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_GET_NODE_DEBUG_INFO(r4, 0xc018620b, &(0x7f0000000100))
ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)})
ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0x0, 0x0, &(0x7f0000000780)})

15:06:31 executing program 0:
r0 = socket$inet_udplite(0x2, 0x2, 0x88)
ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c12")
r1 = syz_open_procfs(0x0, &(0x7f0000000080)='net/dev_mcast\x00')
lseek(r1, 0x20000, 0x0)

15:06:31 executing program 4:
r0 = openat$selinux_status(0xffffffffffffff9c, &(0x7f0000000080)='/selinux/status\x00', 0x0, 0x0)
r1 = bpf$OBJ_GET_PROG(0x7, &(0x7f0000000100)={&(0x7f00000000c0)='./file0\x00', 0x0, 0x8}, 0x10)
epoll_ctl$EPOLL_CTL_ADD(r0, 0x1, r1, &(0x7f0000000180)={0xa})
r2 = syz_open_procfs(0x0, &(0x7f00000001c0)='net/softnet_stat\x00')
setsockopt$IP_VS_SO_SET_STARTDAEMON(r2, 0x0, 0x48b, &(0x7f0000000000)={0x2, 'team_slave_0\x00', 0x1}, 0x18)
lseek(r2, 0x20000, 0x0)
write$P9_RFLUSH(r2, &(0x7f0000000040)={0xffffff03, 0x6d, 0x2}, 0x7)

[ 1112.687954] binder: 1046:1058 transaction failed 29189/-22, size 24-8 line 3117
[ 1112.710925] binder: 1046:1058 BC_INCREFS_DONE u0000000000000000 no match
15:06:31 executing program 1:
r0 = socket$inet_udplite(0x2, 0x2, 0x88)
ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f3188b070")
syz_open_procfs(0x0, &(0x7f0000000940)='syscall\x00')
r1 = syz_open_procfs(0x0, &(0x7f0000000040)='fd\x00')
recvmmsg(0xffffffffffffffff, &(0x7f0000003840)=[{{0x0, 0x0, 0x0}}], 0x1, 0x0, 0x0)
perf_event_open(&(0x7f0000940000)={0x2, 0x70, 0xee6a, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x100, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0xff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x10001, 0x1}, 0x0, 0x400000000000000}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
mlock(&(0x7f00005b8000/0x3000)=nil, 0x3000)
ioctl$SNDRV_TIMER_IOCTL_SELECT(0xffffffffffffffff, 0x40345410, 0x0)
openat$uinput(0xffffffffffffff9c, &(0x7f0000000080)='/dev/uinput\x00', 0x2, 0x0)
mmap(&(0x7f000060b000/0x1000)=nil, 0x1000, 0x5, 0x8000400200000033, r1, 0x0)
perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x2, 0x9, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2000000, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x4000000, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8)
r2 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)={0x10b, 0x6, 0x209e1e, 0x3, 0x1}, 0x2c)
bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000b40)={r2, &(0x7f0000000040), 0x0, 0x1}, 0x20)
r3 = creat(&(0x7f0000000640)='./file0\x00', 0x100)
setsockopt$inet6_tcp_TCP_REPAIR_QUEUE(r3, 0x6, 0x14, &(0x7f0000000980), 0x4)
r4 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_GET_NODE_DEBUG_INFO(r4, 0xc018620b, &(0x7f0000000100))
ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)})
ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0x0, 0x0, &(0x7f0000000780)})

15:06:31 executing program 0:
r0 = socket$inet_udplite(0x2, 0x2, 0x88)
ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f3188")
r1 = syz_open_procfs(0x0, &(0x7f0000000080)='net/dev_mcast\x00')
lseek(r1, 0x20000, 0x0)

15:06:31 executing program 2:
r0 = socket$inet_udplite(0x2, 0x2, 0x88)
ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f3188b070")
syz_open_procfs(0x0, &(0x7f0000000940)='syscall\x00')
r1 = syz_open_procfs(0x0, &(0x7f0000000040)='fd\x00')
recvmmsg(0xffffffffffffffff, &(0x7f0000003840)=[{{0x0, 0x0, 0x0}}], 0x1, 0x0, 0x0)
perf_event_open(&(0x7f0000940000)={0x2, 0x70, 0xee6a, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x100, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0xff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x10001, 0x1}, 0x0, 0x400000000000000}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
mlock(&(0x7f00005b8000/0x3000)=nil, 0x3000)
ioctl$SNDRV_TIMER_IOCTL_SELECT(0xffffffffffffffff, 0x40345410, 0x0)
openat$uinput(0xffffffffffffff9c, &(0x7f0000000080)='/dev/uinput\x00', 0x2, 0x0)
mmap(&(0x7f000060b000/0x1000)=nil, 0x1000, 0x5, 0x8000400200000033, r1, 0x0)
perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x2, 0x9, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2000000, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x4000000, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8)
r2 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)={0x10b, 0x6, 0x209e1e, 0x3, 0x1}, 0x2c)
bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000b40)={r2, &(0x7f0000000040), 0x0, 0x1}, 0x20)
r3 = creat(&(0x7f0000000640)='./file0\x00', 0x100)
setsockopt$inet6_tcp_TCP_REPAIR_QUEUE(r3, 0x6, 0x14, &(0x7f0000000980), 0x4)
unlink(&(0x7f0000000940)='./file0\x00')
r4 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r5 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r5, 0x0)
ioctl$BINDER_GET_NODE_DEBUG_INFO(r4, 0xc018620b, &(0x7f0000000100))
ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f00000000c0)=ANY=[@ANYBLOB="bb8f0000"], 0x0, 0x0, 0x0})
ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)})

[ 1112.749471] binder: 1047:1053 transaction failed 29189/-22, size 24-8 line 3117
15:06:31 executing program 3:
r0 = socket$inet_udplite(0x2, 0x2, 0x88)
ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f3188b070")
syz_open_procfs(0x0, &(0x7f0000000940)='syscall\x00')
r1 = syz_open_procfs(0x0, &(0x7f0000000040)='fd\x00')
recvmmsg(0xffffffffffffffff, &(0x7f0000003840)=[{{0x0, 0x0, 0x0}}], 0x1, 0x0, 0x0)
perf_event_open(&(0x7f0000940000)={0x2, 0x70, 0xee6a, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x100, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0xff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x10001, 0x1}, 0x0, 0x400000000000000}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
mlock(&(0x7f00005b8000/0x3000)=nil, 0x3000)
ioctl$SNDRV_TIMER_IOCTL_SELECT(0xffffffffffffffff, 0x40345410, 0x0)
openat$uinput(0xffffffffffffff9c, &(0x7f0000000080)='/dev/uinput\x00', 0x2, 0x0)
mmap(&(0x7f000060b000/0x1000)=nil, 0x1000, 0x5, 0x8000400200000033, r1, 0x0)
perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x2, 0x9, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2000000, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x4000000, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8)
r2 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)={0x10b, 0x6, 0x209e1e, 0x3, 0x1}, 0x2c)
bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000b40)={r2, &(0x7f0000000040), 0x0, 0x1}, 0x20)
r3 = creat(&(0x7f0000000640)='./file0\x00', 0x100)
setsockopt$inet6_tcp_TCP_REPAIR_QUEUE(r3, 0x6, 0x14, &(0x7f0000000980), 0x4)
unlink(&(0x7f0000000940)='./file0\x00')
r4 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)})

15:06:31 executing program 0:
r0 = socket$inet_udplite(0x2, 0x2, 0x88)
ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f3188")
r1 = syz_open_procfs(0x0, &(0x7f0000000080)='net/dev_mcast\x00')
lseek(r1, 0x20000, 0x0)

15:06:31 executing program 4:
r0 = syz_open_procfs(0x0, &(0x7f00000001c0))
lseek(r0, 0x20000, 0x0)

15:06:31 executing program 1:
r0 = socket$inet_udplite(0x2, 0x2, 0x88)
ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f3188b070")
syz_open_procfs(0x0, &(0x7f0000000940)='syscall\x00')
r1 = syz_open_procfs(0x0, &(0x7f0000000040)='fd\x00')
recvmmsg(0xffffffffffffffff, &(0x7f0000003840)=[{{0x0, 0x0, 0x0}}], 0x1, 0x0, 0x0)
perf_event_open(&(0x7f0000940000)={0x2, 0x70, 0xee6a, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x100, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0xff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x10001, 0x1}, 0x0, 0x400000000000000}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
mlock(&(0x7f00005b8000/0x3000)=nil, 0x3000)
ioctl$SNDRV_TIMER_IOCTL_SELECT(0xffffffffffffffff, 0x40345410, 0x0)
openat$uinput(0xffffffffffffff9c, &(0x7f0000000080)='/dev/uinput\x00', 0x2, 0x0)
mmap(&(0x7f000060b000/0x1000)=nil, 0x1000, 0x5, 0x8000400200000033, r1, 0x0)
perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x2, 0x9, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2000000, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x4000000, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8)
r2 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)={0x10b, 0x6, 0x209e1e, 0x3, 0x1}, 0x2c)
bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000b40)={r2, &(0x7f0000000040), 0x0, 0x1}, 0x20)
r3 = creat(&(0x7f0000000640)='./file0\x00', 0x100)
setsockopt$inet6_tcp_TCP_REPAIR_QUEUE(r3, 0x6, 0x14, &(0x7f0000000980), 0x4)
r4 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_GET_NODE_DEBUG_INFO(r4, 0xc018620b, &(0x7f0000000100))
ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)})
ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0x0, 0x0, &(0x7f0000000780)})

[ 1112.887423] binder: 1066:1077 transaction failed 29189/-22, size 24-8 line 3117
[ 1112.899365] binder: 1066:1068 BC_INCREFS_DONE u0000000000000000 no match
15:06:31 executing program 2:
r0 = socket$inet_udplite(0x2, 0x2, 0x88)
ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f3188b070")
syz_open_procfs(0x0, &(0x7f0000000940)='syscall\x00')
r1 = syz_open_procfs(0x0, &(0x7f0000000040)='fd\x00')
recvmmsg(0xffffffffffffffff, &(0x7f0000003840)=[{{0x0, 0x0, 0x0}}], 0x1, 0x0, 0x0)
perf_event_open(&(0x7f0000940000)={0x2, 0x70, 0xee6a, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x100, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0xff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x10001, 0x1}, 0x0, 0x400000000000000}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
mlock(&(0x7f00005b8000/0x3000)=nil, 0x3000)
ioctl$SNDRV_TIMER_IOCTL_SELECT(0xffffffffffffffff, 0x40345410, 0x0)
openat$uinput(0xffffffffffffff9c, &(0x7f0000000080)='/dev/uinput\x00', 0x2, 0x0)
mmap(&(0x7f000060b000/0x1000)=nil, 0x1000, 0x5, 0x8000400200000033, r1, 0x0)
perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x2, 0x9, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2000000, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x4000000, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8)
r2 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)={0x10b, 0x6, 0x209e1e, 0x3, 0x1}, 0x2c)
bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000b40)={r2, &(0x7f0000000040), 0x0, 0x1}, 0x20)
r3 = creat(&(0x7f0000000640)='./file0\x00', 0x100)
setsockopt$inet6_tcp_TCP_REPAIR_QUEUE(r3, 0x6, 0x14, &(0x7f0000000980), 0x4)
unlink(&(0x7f0000000940)='./file0\x00')
r4 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r5 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r5, 0x0)
ioctl$BINDER_GET_NODE_DEBUG_INFO(r4, 0xc018620b, &(0x7f0000000100))
ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f00000000c0)=ANY=[@ANYBLOB="bb8f0000"], 0x0, 0x0, 0x0})
ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)})

[ 1113.026632] binder: 1074:1078 transaction failed 29189/-22, size 24-8 line 3117
[ 1113.058420] binder: 1086:1090 transaction failed 29189/-22, size 24-8 line 3117
[ 1113.071958] binder: 1086:1090 BC_INCREFS_DONE u0000000000000000 no match
15:06:32 executing program 5:
r0 = socket$inet_udplite(0x2, 0x2, 0x88)
ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f3188b070")
syz_open_procfs(0x0, &(0x7f0000000940)='syscall\x00')
r1 = syz_open_procfs(0x0, &(0x7f0000000040)='fd\x00')
recvmmsg(0xffffffffffffffff, &(0x7f0000003840)=[{{0x0, 0x0, 0x0}}], 0x1, 0x0, 0x0)
perf_event_open(&(0x7f0000940000)={0x2, 0x70, 0xee6a, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x100, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0xff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x10001, 0x1}, 0x0, 0x400000000000000}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
mlock(&(0x7f00005b8000/0x3000)=nil, 0x3000)
ioctl$SNDRV_TIMER_IOCTL_SELECT(0xffffffffffffffff, 0x40345410, 0x0)
openat$uinput(0xffffffffffffff9c, &(0x7f0000000080)='/dev/uinput\x00', 0x2, 0x0)
mmap(&(0x7f000060b000/0x1000)=nil, 0x1000, 0x5, 0x8000400200000033, r1, 0x0)
unshare(0xfffffffffffffffd)
r2 = getpid()
sched_setscheduler(r2, 0x5, &(0x7f00000000c0))
open$dir(&(0x7f0000000400)='./file0\x00', 0x0, 0x0)
perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f00000004c0), 0x2}, 0x0, 0x0, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r3 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000340)='memory.current\x00', 0x0, 0x0)
ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, 0x0)
socketpair(0x1, 0x20000000000001, 0x0, &(0x7f0000000100)={<r4=>0xffffffffffffffff, <r5=>0xffffffffffffffff})
ioctl$PERF_EVENT_IOC_SET_FILTER(r5, 0x8914, &(0x7f0000000300)='lo\x00\x96o\xd6Q\xb9Y\xa9\xc8J,\x00\xd2\x97\x04\x03\xdc\r')
close(r3)
rt_sigprocmask(0x2, &(0x7f0000000240)={0x6}, &(0x7f00000002c0), 0x8)
ioctl$PERF_EVENT_IOC_SET_FILTER(r5, 0x8923, &(0x7f00000008c0)='lo\x00\x96o8\x0fd\xa1\xe3\xd7]b}\x1f\xa1Y\xad4\x90\x9d`\xd2\x98\x00\x00\x00 \'Y\x17]\x15c\xcaR\xdd\x98OC\x89\x1b\xe7\x84\xe2\x05\x80w\xd2|D\x8dK\x14Bx\xcbuH\xc2\xeec\xbf<>Y\x1a\xfc\x1f9OB\x81\x89\x186\xc5q@n\xb4\xb6s\xb0\x00\x00\xfc\x00\x00\b\x00\x00\xda\xef\xecE\xec\xd5I\xb2\x9b\xfe\x8d\x90?\x00\xe9\xe4~g:\xc1\xb2aj\x96\xbb\xa7\xe2\xc0\xdc\xf9Q\b\xeb\x16\x7fT\x11\xd3\r7\xe6\"f\xcf\x8e\xabd\x0ftp\x82\xae\xd2\x15\x8e+c\xf6\xbf\xe14>\xa6-\xa5c\xde\xd7\xab\xea\x1f\xf8s2\x9cVF\xd5\x18\xfe\x0e\x8f \x01\x00\x00y.\xfc*\x82\xa5\xa1p5\xc8{\xf7\xef\xab\xe8\x99\xebw#\x8at\x1c\x80\xfc\xb0\x95\xa2\xa7\xd7,Y]E8\x83X\xf5F\xdc\x88-\xf5\xb0\xb5^\xdb\x1a\xb6\xaa\x14\xe2\xb9\rh^J-\xd1\xbaUn\x04\'l\x1b\xe0o\xdb\xc8\x91%\x1c\xb5\xbf\xb6\x90\xb4\xc2\x7f]/\xb3\xe7\xc9\'\x94\xcfIo\xdf\x04\x95\xb5\x06\x84\x1fH>\xda\xc5\x04 \x94\x88\xeb\'\xd4;6\x7f\xd9\x99-\x1b|G\x8d\xd4\xb9%\xaaQ\xa0K\x10\x03\x93\xe1\xcc\xe7m\x80\'\xf0\xa5\xed(\r\xa8\x0f&\xb1\xf3\xff0\f\x82%_\x92\x8bD\xb9\xd9\xe7\xf2\xe4\xc1i#\xdc\x87A\xb9\xc7\r\x92\xfa\x11\x11\xb5\x1f\x03\x9d\xdd\x1bj\xdf\xacg\xe3\xa0S\xd3\x8a\xe1n\x97\xea\xf5\xa0\'\v\xe9\xa0\xf1 f\xaan\xcf\xb5i\xb6d\xbc\x92\v\xd58\x16\b\xb3_:\xa4!\ny\xc4&\nWMM\xa8\xc4\v\x9f\x01o\xf4\xab&\xb6\x17\x02P\xc3!N\xf4\b\x1a~\x91V1s\xe9\xbe\x9e\x9b\'\xcde\xb3\xa1\x86\"\xd7\x04\xf1\xc0!\xed\xff\xee$\xc89\x8cB0\xd1dD\xe0IP\x88\xa2\xf2Y\x9af$$\xf1cO\xf7P\xac\xca\x80:!\xb4\x94#\xcb^\x9f\'\x03\xe3\x93\xb9\x82\xbf\xcf\xc4\xe3\xf7\x03Oh\xf2r\xca\x8ff\xbb/\x9f*\xaf\x1a \xa5\xa0?%M\xa5\x86\x98\xf24\'1\xc7\f<\xcc@\xe8\x8a\xac.\xde\xe4\xc7\xf5\x9ck\xa40!\xe9\x14$\xb3\x05m\xb5m\xed\ft\x93\xd8\xa3\x80\'Y\xb9\x05\xbbt|\xbe\xbcz\n\xf3\xf5p\xf8\x9f~\x1b\xd0\v\x1cQ')
getsockopt$inet_IP_IPSEC_POLICY(r1, 0x0, 0x10, &(0x7f00000006c0)={{{@in6=@loopback}}, {{@in6=@initdev}}}, &(0x7f0000000500)=0xe8)
socketpair(0x2, 0x2000000080003, 0x100, &(0x7f0000000480))
syz_genetlink_get_family_id$SEG6(&(0x7f00000003c0)='SEG6\x00')
sendmsg$SEG6_CMD_DUMPHMAC(r4, &(0x7f0000000580)={&(0x7f0000000380)={0x10, 0x0, 0x0, 0x1000000}, 0xc, &(0x7f0000000440)={&(0x7f00000005c0)=ANY=[@ANYBLOB="2300260109447a0000000000000000660000001400001a0065a455e04ea56d0a47018c8e973bcac914471474a7e0d50a000eadd66d2e49a2ed40dcafa1e066ab6aacc2097d8f75bd9c8b8a220bdde116904efa3f9600f22ab388644f66c2d5baec4079a81bae1927e49e91a4964656d7b227702926af5be846f3de49fad39048633fd9081123894d9427f854a30cb0532c8f31f663380e40ce7f6cb15ec8baab3b7c6f"], 0x1}, 0x1, 0x0, 0x0, 0x8000}, 0x804)
r6 = creat(&(0x7f0000000280)='./bus\x00', 0x0)
arch_prctl$ARCH_MAP_VDSO_32(0x2002, 0x7e)
ftruncate(r6, 0x2008200)
open(&(0x7f0000000140)='./bus\x00', 0x4000, 0x0)

15:06:32 executing program 4:
r0 = syz_open_procfs(0x0, &(0x7f00000001c0)='net/softnet_stat\x00')
rt_sigaction(0x1, &(0x7f0000000480)={&(0x7f0000000000)="380ef30f2b1a3ef2f2f08160ff00000020470fa3a9ffefffffc4e2d9474c9700c4a27d5ab105000000c442fd34623bc4624d974e20c481196cfb66440f2d08", {0x4}, 0x80000005, &(0x7f0000000040)="c421f9d7e0c4a259acf6c42281aad445d9ea3e6726660f6b9ce577cc6cebc421fb5fd7f0215540660f3822690366407b7dc483155f19de"}, 0x0, 0x8, &(0x7f00000000c0))
lseek(r0, 0x20000, 0x0)
r1 = fcntl$dupfd(r0, 0x407, r0)
perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0xee6b, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r2 = socket$inet6(0xa, 0x2, 0x0)
setsockopt$inet6_IPV6_FLOWLABEL_MGR(r2, 0x29, 0x20, &(0x7f00000000c0)={@rand_addr="e54abf4a71642f7af1ce197dd9af46b7", 0x0, 0x0, 0x3, 0x3}, 0x20)
io_setup(0xa6, &(0x7f0000000100)=<r3=>0x0)
r4 = add_key(&(0x7f00000003c0)='syzkaller\x00', &(0x7f0000000400)={'syz', 0x1}, 0x0, 0x0, 0x0)
request_key(&(0x7f0000000300)='rxrpc\x00', &(0x7f0000000340)={'syz', 0x0}, &(0x7f0000000380)='net/softnet_stat\x00', r4)
io_cancel(r3, &(0x7f0000000140)={0x0, 0x0, 0x0, 0x6, 0x8, r1, &(0x7f0000000200)="6e6abf90fabe25c274264a6be287fe53ee9151cb668ef354980ea7415e4f78d4059a1c3d1feee6e98b1e0113ac61ce7d1ac24a65a2d700494739e0fdcf8235ee85fbda9be30d1f800ec3c6b67e573022abbde410e98cbd21eec7c9adf1ca9d47fc127ef302322b45f49aed9b9fde517c78abc6feca413a850c6ffb0eb1ad55b6af24403f277a179ad9bb6e15605102726cd72db26e5cf7e196b0fe12f7e36ef38485c114dc75cc4ba56c72d6ce444ca26f1907b821a8e9bbd7a13b45e0cb4d0e8e08e1368f05f8bcf81327d398237dca1dba1d48b0342efc5429509f77412a4c7526a87d9499b9d5b9700938a2380bde111b200106347511fd999dd09ca7ca", 0xff, 0x6, 0x0, 0x0, r1}, &(0x7f0000000180))
close(r1)

15:06:32 executing program 0:
r0 = socket$inet_udplite(0x2, 0x2, 0x88)
ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f3188")
r1 = syz_open_procfs(0x0, &(0x7f0000000080)='net/dev_mcast\x00')
lseek(r1, 0x20000, 0x0)

15:06:32 executing program 3:
r0 = socket$inet_udplite(0x2, 0x2, 0x88)
ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f3188b070")
syz_open_procfs(0x0, &(0x7f0000000940)='syscall\x00')
r1 = syz_open_procfs(0x0, &(0x7f0000000040)='fd\x00')
recvmmsg(0xffffffffffffffff, &(0x7f0000003840)=[{{0x0, 0x0, 0x0}}], 0x1, 0x0, 0x0)
perf_event_open(&(0x7f0000940000)={0x2, 0x70, 0xee6a, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x100, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0xff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x10001, 0x1}, 0x0, 0x400000000000000}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
mlock(&(0x7f00005b8000/0x3000)=nil, 0x3000)
ioctl$SNDRV_TIMER_IOCTL_SELECT(0xffffffffffffffff, 0x40345410, 0x0)
openat$uinput(0xffffffffffffff9c, &(0x7f0000000080)='/dev/uinput\x00', 0x2, 0x0)
mmap(&(0x7f000060b000/0x1000)=nil, 0x1000, 0x5, 0x8000400200000033, r1, 0x0)
perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x2, 0x9, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2000000, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x4000000, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8)
r2 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)={0x10b, 0x6, 0x209e1e, 0x3, 0x1}, 0x2c)
bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000b40)={r2, &(0x7f0000000040), 0x0, 0x1}, 0x20)
r3 = creat(&(0x7f0000000640)='./file0\x00', 0x100)
setsockopt$inet6_tcp_TCP_REPAIR_QUEUE(r3, 0x6, 0x14, &(0x7f0000000980), 0x4)
unlink(&(0x7f0000000940)='./file0\x00')
r4 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r4, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r4, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)})

15:06:32 executing program 1:
r0 = socket$inet_udplite(0x2, 0x2, 0x88)
ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f3188b070")
syz_open_procfs(0x0, &(0x7f0000000940)='syscall\x00')
r1 = syz_open_procfs(0x0, &(0x7f0000000040)='fd\x00')
recvmmsg(0xffffffffffffffff, &(0x7f0000003840)=[{{0x0, 0x0, 0x0}}], 0x1, 0x0, 0x0)
perf_event_open(&(0x7f0000940000)={0x2, 0x70, 0xee6a, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x100, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0xff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x10001, 0x1}, 0x0, 0x400000000000000}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
mlock(&(0x7f00005b8000/0x3000)=nil, 0x3000)
ioctl$SNDRV_TIMER_IOCTL_SELECT(0xffffffffffffffff, 0x40345410, 0x0)
openat$uinput(0xffffffffffffff9c, &(0x7f0000000080)='/dev/uinput\x00', 0x2, 0x0)
mmap(&(0x7f000060b000/0x1000)=nil, 0x1000, 0x5, 0x8000400200000033, r1, 0x0)
perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x2, 0x9, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2000000, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x4000000, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8)
r2 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)={0x10b, 0x6, 0x209e1e, 0x3, 0x1}, 0x2c)
bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000b40)={r2, &(0x7f0000000040), 0x0, 0x1}, 0x20)
creat(&(0x7f0000000640)='./file0\x00', 0x100)
unlink(&(0x7f0000000940)='./file0\x00')
r3 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_GET_NODE_DEBUG_INFO(r3, 0xc018620b, &(0x7f0000000100))
ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)})
ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0x0, 0x0, &(0x7f0000000780)})

15:06:32 executing program 2:
r0 = socket$inet_udplite(0x2, 0x2, 0x88)
ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f3188b070")
syz_open_procfs(0x0, &(0x7f0000000940)='syscall\x00')
r1 = syz_open_procfs(0x0, &(0x7f0000000040)='fd\x00')
recvmmsg(0xffffffffffffffff, &(0x7f0000003840)=[{{0x0, 0x0, 0x0}}], 0x1, 0x0, 0x0)
perf_event_open(&(0x7f0000940000)={0x2, 0x70, 0xee6a, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x100, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0xff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x10001, 0x1}, 0x0, 0x400000000000000}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
mlock(&(0x7f00005b8000/0x3000)=nil, 0x3000)
ioctl$SNDRV_TIMER_IOCTL_SELECT(0xffffffffffffffff, 0x40345410, 0x0)
openat$uinput(0xffffffffffffff9c, &(0x7f0000000080)='/dev/uinput\x00', 0x2, 0x0)
mmap(&(0x7f000060b000/0x1000)=nil, 0x1000, 0x5, 0x8000400200000033, r1, 0x0)
perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x2, 0x9, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2000000, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x4000000, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8)
r2 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)={0x10b, 0x6, 0x209e1e, 0x3, 0x1}, 0x2c)
bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000b40)={r2, &(0x7f0000000040), 0x0, 0x1}, 0x20)
r3 = creat(&(0x7f0000000640)='./file0\x00', 0x100)
setsockopt$inet6_tcp_TCP_REPAIR_QUEUE(r3, 0x6, 0x14, &(0x7f0000000980), 0x4)
unlink(&(0x7f0000000940)='./file0\x00')
r4 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r5 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r5, 0x0)
ioctl$BINDER_GET_NODE_DEBUG_INFO(r4, 0xc018620b, &(0x7f0000000100))
ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f00000000c0)=ANY=[@ANYBLOB="bb8f0000"], 0x0, 0x0, 0x0})
ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)})

15:06:32 executing program 0:
r0 = socket$inet_udplite(0x2, 0x2, 0x88)
ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f3188b0")
r1 = syz_open_procfs(0x0, &(0x7f0000000080)='net/dev_mcast\x00')
lseek(r1, 0x20000, 0x0)

15:06:32 executing program 4:
r0 = syz_open_procfs(0x0, &(0x7f00000001c0)='net/softnet_stat\x00')
bpf$OBJ_PIN_PROG(0x6, &(0x7f0000000040)={&(0x7f0000000000)='./file0\x00', r0}, 0x10)
lseek(r0, 0x20000, 0x0)

15:06:32 executing program 3:
r0 = socket$inet_udplite(0x2, 0x2, 0x88)
ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f3188b070")
syz_open_procfs(0x0, &(0x7f0000000940)='syscall\x00')
r1 = syz_open_procfs(0x0, &(0x7f0000000040)='fd\x00')
recvmmsg(0xffffffffffffffff, &(0x7f0000003840)=[{{0x0, 0x0, 0x0}}], 0x1, 0x0, 0x0)
perf_event_open(&(0x7f0000940000)={0x2, 0x70, 0xee6a, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x100, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0xff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x10001, 0x1}, 0x0, 0x400000000000000}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
mlock(&(0x7f00005b8000/0x3000)=nil, 0x3000)
ioctl$SNDRV_TIMER_IOCTL_SELECT(0xffffffffffffffff, 0x40345410, 0x0)
openat$uinput(0xffffffffffffff9c, &(0x7f0000000080)='/dev/uinput\x00', 0x2, 0x0)
mmap(&(0x7f000060b000/0x1000)=nil, 0x1000, 0x5, 0x8000400200000033, r1, 0x0)
perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x2, 0x9, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2000000, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x4000000, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8)
r2 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)={0x10b, 0x6, 0x209e1e, 0x3, 0x1}, 0x2c)
bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000b40)={r2, &(0x7f0000000040), 0x0, 0x1}, 0x20)
r3 = creat(&(0x7f0000000640)='./file0\x00', 0x100)
setsockopt$inet6_tcp_TCP_REPAIR_QUEUE(r3, 0x6, 0x14, &(0x7f0000000980), 0x4)
unlink(&(0x7f0000000940)='./file0\x00')
r4 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r4, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r4, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)})

15:06:32 executing program 0:
r0 = socket$inet_udplite(0x2, 0x2, 0x88)
ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f3188b0")
r1 = syz_open_procfs(0x0, &(0x7f0000000080)='net/dev_mcast\x00')
lseek(r1, 0x20000, 0x0)

[ 1113.329055] binder: 1100:1104 transaction failed 29189/-22, size 24-8 line 3117
15:06:32 executing program 1:
r0 = socket$inet_udplite(0x2, 0x2, 0x88)
ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f3188b070")
syz_open_procfs(0x0, &(0x7f0000000940)='syscall\x00')
r1 = syz_open_procfs(0x0, &(0x7f0000000040)='fd\x00')
recvmmsg(0xffffffffffffffff, &(0x7f0000003840)=[{{0x0, 0x0, 0x0}}], 0x1, 0x0, 0x0)
perf_event_open(&(0x7f0000940000)={0x2, 0x70, 0xee6a, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x100, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0xff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x10001, 0x1}, 0x0, 0x400000000000000}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
mlock(&(0x7f00005b8000/0x3000)=nil, 0x3000)
ioctl$SNDRV_TIMER_IOCTL_SELECT(0xffffffffffffffff, 0x40345410, 0x0)
openat$uinput(0xffffffffffffff9c, &(0x7f0000000080)='/dev/uinput\x00', 0x2, 0x0)
mmap(&(0x7f000060b000/0x1000)=nil, 0x1000, 0x5, 0x8000400200000033, r1, 0x0)
perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x2, 0x9, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2000000, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x4000000, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8)
r2 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)={0x10b, 0x6, 0x209e1e, 0x3, 0x1}, 0x2c)
bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000b40)={r2, &(0x7f0000000040), 0x0, 0x1}, 0x20)
creat(&(0x7f0000000640)='./file0\x00', 0x100)
unlink(&(0x7f0000000940)='./file0\x00')
r3 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_GET_NODE_DEBUG_INFO(r3, 0xc018620b, &(0x7f0000000100))
ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)})
ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0x0, 0x0, &(0x7f0000000780)})

15:06:32 executing program 2:
r0 = socket$inet_udplite(0x2, 0x2, 0x88)
ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f3188b070")
syz_open_procfs(0x0, &(0x7f0000000940)='syscall\x00')
r1 = syz_open_procfs(0x0, &(0x7f0000000040)='fd\x00')
recvmmsg(0xffffffffffffffff, &(0x7f0000003840)=[{{0x0, 0x0, 0x0}}], 0x1, 0x0, 0x0)
perf_event_open(&(0x7f0000940000)={0x2, 0x70, 0xee6a, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x100, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0xff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x10001, 0x1}, 0x0, 0x400000000000000}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
mlock(&(0x7f00005b8000/0x3000)=nil, 0x3000)
ioctl$SNDRV_TIMER_IOCTL_SELECT(0xffffffffffffffff, 0x40345410, 0x0)
openat$uinput(0xffffffffffffff9c, &(0x7f0000000080)='/dev/uinput\x00', 0x2, 0x0)
mmap(&(0x7f000060b000/0x1000)=nil, 0x1000, 0x5, 0x8000400200000033, r1, 0x0)
unshare(0xfffffffffffffffd)
r2 = getpid()
sched_setscheduler(r2, 0x5, &(0x7f00000000c0))
open$dir(&(0x7f0000000400)='./file0\x00', 0x0, 0x0)
r3 = perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f00000004c0), 0x2}, 0x0, 0x0, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r4 = openat$cgroup_ro(r1, &(0x7f0000000200)='meYory.current\x00', 0x0, 0x0)
ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, 0x0)
socketpair(0x1, 0x20000000000001, 0x0, &(0x7f0000000100)={<r5=>0xffffffffffffffff, <r6=>0xffffffffffffffff})
ioctl$PERF_EVENT_IOC_SET_FILTER(r3, 0x8914, &(0x7f0000000300)='lo\x00\x96o\xd6Q\xb9Y\xa9\xc8J,\x00\xd2\x97\x04\x03\xdc\r')
close(r4)
rt_sigprocmask(0x2, &(0x7f0000000240)={0x6}, &(0x7f00000002c0), 0x8)
ioctl$PERF_EVENT_IOC_SET_FILTER(r6, 0x8923, &(0x7f00000008c0)='lo\x00\x96o8\x0fd\xa1\xe3\xd7]b}\x1f\xa1Y\xad4\x90\x9d`\xd2\x98\x00\x00\x00 \'Y\x17]\x15c\xcaR\xdd\x98OC\x89\x1b\xe7\x84\xe2\x05\x80w\xd2|D\x8dK\x14Bx\xcbuH\xc2\xeec\xbf<>Y\x1a\xfc\x1f9OB\x81\x89\x186\xc5q@n\xb4\xb6s\xb0\x00\x00\xfc\x00\x00\b\x00\x00\xda\xef\xecE\xec\xd5I\xb2\x9b\xfe\x8d\x90?\x00\xe9\xe4~g:\xc1\xb2aj\x96\xbb\xa7\xe2\xc0\xdc\xf9Q\b\xeb\x16\x7fT\x11\xd3\r7\xe6\"f\xcf\x8e\xabd\x0ftp\x82\xae\xd2\x15\x8e+c\xf6\xbf\xe14>\xa6-\xa5c\xde\xd7\xab\xea\x1f\xf8s2\x9cVF\xd5\x18\xfe\x0e\x8f \x01\x00\x00y.\xfc*\x82\xa5\xa1p5\xc8{\xf7\xef\xab\xe8\x99\xebw#\x8at\x1c\x80\xfc\xb0\x95\xa2\xa7\xd7,Y]E8\x83X\xf5F\xdc\x88-\xf5\xb0\xb5^\xdb\x1a\xb6\xaa\x14\xe2\xb9\rh^J-\xd1\xbaUn\x04\'l\x1b\xe0o\xdb\xc8\x91%\x1c\xb5\xbf\xb6\x90\xb4\xc2\x7f]/\xb3\xe7\xc9\'\x94\xcfIo\xdf\x04\x95\xb5\x06\x84\x1fH>\xda\xc5\x04 \x94\x88\xeb\'\xd4;6\x7f\xd9\x99-\x1b|G\x8d\xd4\xb9%\xaaQ\xa0K\x10\x03\x93\xe1\xcc\xe7m\x80\'\xf0\xa5\xed(\r\xa8\x0f&\xb1\xf3\xff0\f\x82%_\x92\x8bD\xb9\xd9\xe7\xf2\xe4\xc1i#\xdc\x87A\xb9\xc7\r\x92\xfa\x11\x11\xb5\x1f\x03\x9d\xdd\x1bj\xdf\xacg\xe3\xa0S\xd3\x8a\xe1n\x97\xea\xf5\xa0\'\v\xe9\xa0\xf1 f\xaan\xcf\xb5i\xb6d\xbc\x92\v\xd58\x16\b\xb3_:\xa4!\ny\xc4&\nWMM\xa8\xc4\v\x9f\x01o\xf4\xab&\xb6\x17\x02P\xc3!N\xf4\b\x1a~\x91V1s\xe9\xbe\x9e\x9b\'\xcde\xb3\xa1\x86\"\xd7\x04\xf1\xc0!\xed\xff\xee$\xc89\x8cB0\xd1dD\xe0IP\x88\xa2\xf2Y\x9af$$\xf1cO\xf7P\xac\xca\x80:!\xb4\x94#\xcb^\x9f\'\x03\xe3\x93\xb9\x82\xbf\xcf\xc4\xe3\xf7\x03Oh\xf2r\xca\x8ff\xbb/\x9f*\xaf\x1a \xa5\xa0?%M\xa5\x86\x98\xf24\'1\xc7\f<\xcc@\xe8\x8a\xac.\xde\xe4\xc7\xf5\x9ck\xa40!\xe9\x14$\xb3\x05m\xb5m\xed\ft\x93\xd8\xa3\x80\'Y\xb9\x05\xbbt|\xbe\xbcz\n\xf3\xf5p\xf8\x9f~\x1b\xd0\v\x1cQ')
getsockopt$inet_IP_IPSEC_POLICY(r1, 0x0, 0x10, &(0x7f00000006c0)={{{@in6=@loopback}}, {{@in6=@initdev}}}, &(0x7f0000000500)=0xe8)
socketpair(0x2, 0x2000000080003, 0x100, &(0x7f0000000480))
syz_genetlink_get_family_id$SEG6(&(0x7f00000003c0)='SEG6\x00')
sendmsg$SEG6_CMD_DUMPHMAC(r5, &(0x7f0000000580)={&(0x7f0000000380)={0x10, 0x0, 0x0, 0x1000000}, 0xc, &(0x7f0000000440)={&(0x7f00000005c0)=ANY=[@ANYBLOB="2300260109447a0000000000000000660000001400001a0065a455e04ea56d0a47018c8e973bcac914471474a7e0d50a000eadd66d2e49a2ed40dcafa1e046ab6aacc2097d8f75bd9c8b8a220bdde116904efa3f9600f22ab388644f66c2d5baec4079a81bae1927e49e91a4964656d7b227702926af5be846f3de49fad39048633fd9161123894d9427f854a30cb0532c8f31f663380e40ce7f6cb15ec8baab3b7c6f"], 0x1}, 0x1, 0x0, 0x0, 0x8000}, 0x804)
r7 = creat(&(0x7f0000000280)='./bus\x00', 0x0)
arch_prctl$ARCH_MAP_VDSO_32(0x2002, 0x7e)
ftruncate(r7, 0x2008200)
open(&(0x7f0000000140)='./bus\x00', 0x4000, 0x0)

[ 1113.374141] binder: 1100:1116 BC_INCREFS_DONE u0000000000000000 no match
[ 1113.528133] binder_alloc: 1123: binder_alloc_buf failed to map pages in userspace, no vma
[ 1113.539033] binder: 1134:1136 transaction failed 29189/-3, size 24-8 line 3254
[ 1113.551479] binder: 1134:1136 BC_INCREFS_DONE u0000000000000000 no match
15:06:32 executing program 5:
r0 = socket$inet_udplite(0x2, 0x2, 0x88)
ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f3188b070")
syz_open_procfs(0x0, &(0x7f0000000940)='syscall\x00')
r1 = getpid()
r2 = syz_open_procfs(r1, &(0x7f0000000540)='net/rt_acct\x00')
recvmmsg(0xffffffffffffffff, &(0x7f0000003840)=[{{0x0, 0x0, 0x0}}], 0x1, 0x0, 0x0)
perf_event_open(&(0x7f0000940000)={0x2, 0x70, 0xee6a, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x100, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0xff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x10001, 0x1}, 0x0, 0x400000000000000}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
mlock(&(0x7f00005b8000/0x3000)=nil, 0x3000)
ioctl$SNDRV_TIMER_IOCTL_SELECT(0xffffffffffffffff, 0x40345410, 0x0)
openat$uinput(0xffffffffffffff9c, &(0x7f0000000080)='/dev/uinput\x00', 0x2, 0x0)
mmap(&(0x7f000060b000/0x1000)=nil, 0x1000, 0x5, 0x8000400200000033, r2, 0x0)
unshare(0xfffffffffffffffd)
r3 = getpid()
sched_setscheduler(r3, 0x5, &(0x7f00000000c0))
open$dir(&(0x7f0000000400)='./file0\x00', 0x0, 0x0)
perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f00000004c0), 0x2}, 0x0, 0x0, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r4 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000340)='memory.current\x00', 0x0, 0x0)
ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, 0x0)
socketpair(0x1, 0x20000000000001, 0x0, &(0x7f0000000100)={<r5=>0xffffffffffffffff, <r6=>0xffffffffffffffff})
ioctl$PERF_EVENT_IOC_SET_FILTER(r6, 0x8914, &(0x7f0000000300)='lo\x00\x96o\xd6Q\xb9Y\xa9\xc8J,\x00\xd2\x97\x04\x03\xdc\r')
close(r4)
rt_sigprocmask(0x2, &(0x7f0000000240)={0x6}, &(0x7f00000002c0), 0x8)
ioctl$PERF_EVENT_IOC_SET_FILTER(r6, 0x8923, &(0x7f00000008c0)='lo\x00\x96o8\x0fd\xa1\xe3\xd7]b}\x1f\xa1Y\xad4\x90\x9d`\xd2\x98\x00\x00\x00 \'Y\x17]\x15c\xcaR\xdd\x98OC\x89\x1b\xe7\x84\xe2\x05\x80w\xd2|D\x8dK\x14Bx\xcbuH\xc2\xeec\xbf<>Y\x1a\xfc\x1f9OB\x81\x89\x186\xc5q@n\xb4\xb6s\xb0\x00\x00\xfc\x00\x00\b\x00\x00\xda\xef\xecE\xec\xd5I\xb2\x9b\xfe\x8d\x90?\x00\xe9\xe4~g:\xc1\xb2aj\x96\xbb\xa7\xe2\xc0\xdc\xf9Q\b\xeb\x16\x7fT\x11\xd3\r7\xe6\"f\xcf\x8e\xabd\x0ftp\x82\xae\xd2\x15\x8e+c\xf6\xbf\xe14>\xa6-\xa5c\xde\xd7\xab\xea\x1f\xf8s2\x9cVF\xd5\x18\xfe\x0e\x8f \x01\x00\x00y.\xfc*\x82\xa5\xa1p5\xc8{\xf7\xef\xab\xe8\x99\xebw#\x8at\x1c\x80\xfc\xb0\x95\xa2\xa7\xd7,Y]E8\x83X\xf5F\xdc\x88-\xf5\xb0\xb5^\xdb\x1a\xb6\xaa\x14\xe2\xb9\rh^J-\xd1\xbaUn\x04\'l\x1b\xe0o\xdb\xc8\x91%\x1c\xb5\xbf\xb6\x90\xb4\xc2\x7f]/\xb3\xe7\xc9\'\x94\xcfIo\xdf\x04\x95\xb5\x06\x84\x1fH>\xda\xc5\x04 \x94\x88\xeb\'\xd4;6\x7f\xd9\x99-\x1b|G\x8d\xd4\xb9%\xaaQ\xa0K\x10\x03\x93\xe1\xcc\xe7m\x80\'\xf0\xa5\xed(\r\xa8\x0f&\xb1\xf3\xff0\f\x82%_\x92\x8bD\xb9\xd9\xe7\xf2\xe4\xc1i#\xdc\x87A\xb9\xc7\r\x92\xfa\x11\x11\xb5\x1f\x03\x9d\xdd\x1bj\xdf\xacg\xe3\xa0S\xd3\x8a\xe1n\x97\xea\xf5\xa0\'\v\xe9\xa0\xf1 f\xaan\xcf\xb5i\xb6d\xbc\x92\v\xd58\x16\b\xb3_:\xa4!\ny\xc4&\nWMM\xa8\xc4\v\x9f\x01o\xf4\xab&\xb6\x17\x02P\xc3!N\xf4\b\x1a~\x91V1s\xe9\xbe\x9e\x9b\'\xcde\xb3\xa1\x86\"\xd7\x04\xf1\xc0!\xed\xff\xee$\xc89\x8cB0\xd1dD\xe0IP\x88\xa2\xf2Y\x9af$$\xf1cO\xf7P\xac\xca\x80:!\xb4\x94#\xcb^\x9f\'\x03\xe3\x93\xb9\x82\xbf\xcf\xc4\xe3\xf7\x03Oh\xf2r\xca\x8ff\xbb/\x9f*\xaf\x1a \xa5\xa0?%M\xa5\x86\x98\xf24\'1\xc7\f<\xcc@\xe8\x8a\xac.\xde\xe4\xc7\xf5\x9ck\xa40!\xe9\x14$\xb3\x05m\xb5m\xed\ft\x93\xd8\xa3\x80\'Y\xb9\x05\xbbt|\xbe\xbcz\n\xf3\xf5p\xf8\x9f~\x1b\xd0\v\x1cQ')
getsockopt$inet_IP_IPSEC_POLICY(r2, 0x0, 0x10, &(0x7f00000006c0)={{{@in6=@loopback}}, {{@in6=@initdev}}}, &(0x7f0000000500)=0xe8)
socketpair(0x2, 0x2000000080003, 0x100, &(0x7f0000000480))
syz_genetlink_get_family_id$SEG6(&(0x7f00000003c0)='SEG6\x00')
sendmsg$SEG6_CMD_DUMPHMAC(r5, &(0x7f0000000580)={&(0x7f0000000380)={0x10, 0x0, 0x0, 0x1000000}, 0xc, &(0x7f0000000440)={&(0x7f00000005c0)=ANY=[@ANYBLOB="2300260109447a0000000000000000660000001400001a0065a455e04ea56d0a47018c8e973bcac914471474a7e0d50a000eadd66d2e49a2ed40dcafa1e046ab6aacc2097d8f75bd9c8b8a220bdde116904efa3f9600f22ab388644f66c2d5baec4079a81bae1927e49e91a4964656d7b227702926af5be846f3de49fad39048633fd9161123894d9427f854a30cb0532c8f31f663380e40ce7f6cb15ec8baab3b7c6f"], 0x1}, 0x1, 0x0, 0x0, 0x8000}, 0x804)
r7 = creat(&(0x7f0000000280)='./bus\x00', 0x0)
arch_prctl$ARCH_MAP_VDSO_32(0x2002, 0x7e)
ftruncate(r7, 0x2008200)
open(&(0x7f0000000140)='./bus\x00', 0x4000, 0x0)

15:06:32 executing program 0:
r0 = socket$inet_udplite(0x2, 0x2, 0x88)
ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f3188b0")
r1 = syz_open_procfs(0x0, &(0x7f0000000080)='net/dev_mcast\x00')
lseek(r1, 0x20000, 0x0)

15:06:32 executing program 4:
r0 = syz_open_procfs(0x0, &(0x7f00000001c0)='net/softnet_stat\x00')
ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000180)={'ip6gretap0\x00', <r1=>0x0})
ioctl$sock_inet6_SIOCSIFADDR(r0, 0x8916, &(0x7f0000000200)={@ipv4={[], [], @local}, 0x6d, r1})
lseek(r0, 0x20000, 0x0)

15:06:32 executing program 3:
r0 = socket$inet_udplite(0x2, 0x2, 0x88)
ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f3188b070")
syz_open_procfs(0x0, &(0x7f0000000940)='syscall\x00')
r1 = syz_open_procfs(0x0, &(0x7f0000000040)='fd\x00')
recvmmsg(0xffffffffffffffff, &(0x7f0000003840)=[{{0x0, 0x0, 0x0}}], 0x1, 0x0, 0x0)
perf_event_open(&(0x7f0000940000)={0x2, 0x70, 0xee6a, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x100, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0xff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x10001, 0x1}, 0x0, 0x400000000000000}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
mlock(&(0x7f00005b8000/0x3000)=nil, 0x3000)
ioctl$SNDRV_TIMER_IOCTL_SELECT(0xffffffffffffffff, 0x40345410, 0x0)
openat$uinput(0xffffffffffffff9c, &(0x7f0000000080)='/dev/uinput\x00', 0x2, 0x0)
mmap(&(0x7f000060b000/0x1000)=nil, 0x1000, 0x5, 0x8000400200000033, r1, 0x0)
perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x2, 0x9, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2000000, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x4000000, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8)
r2 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)={0x10b, 0x6, 0x209e1e, 0x3, 0x1}, 0x2c)
bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000b40)={r2, &(0x7f0000000040), 0x0, 0x1}, 0x20)
r3 = creat(&(0x7f0000000640)='./file0\x00', 0x100)
setsockopt$inet6_tcp_TCP_REPAIR_QUEUE(r3, 0x6, 0x14, &(0x7f0000000980), 0x4)
unlink(&(0x7f0000000940)='./file0\x00')
r4 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r4, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r4, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)})

15:06:32 executing program 1:
r0 = socket$inet_udplite(0x2, 0x2, 0x88)
ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f3188b070")
syz_open_procfs(0x0, &(0x7f0000000940)='syscall\x00')
r1 = syz_open_procfs(0x0, &(0x7f0000000040)='fd\x00')
recvmmsg(0xffffffffffffffff, &(0x7f0000003840)=[{{0x0, 0x0, 0x0}}], 0x1, 0x0, 0x0)
perf_event_open(&(0x7f0000940000)={0x2, 0x70, 0xee6a, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x100, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0xff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x10001, 0x1}, 0x0, 0x400000000000000}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
mlock(&(0x7f00005b8000/0x3000)=nil, 0x3000)
ioctl$SNDRV_TIMER_IOCTL_SELECT(0xffffffffffffffff, 0x40345410, 0x0)
openat$uinput(0xffffffffffffff9c, &(0x7f0000000080)='/dev/uinput\x00', 0x2, 0x0)
mmap(&(0x7f000060b000/0x1000)=nil, 0x1000, 0x5, 0x8000400200000033, r1, 0x0)
perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x2, 0x9, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2000000, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x4000000, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8)
r2 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)={0x10b, 0x6, 0x209e1e, 0x3, 0x1}, 0x2c)
bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000b40)={r2, &(0x7f0000000040), 0x0, 0x1}, 0x20)
creat(&(0x7f0000000640)='./file0\x00', 0x100)
unlink(&(0x7f0000000940)='./file0\x00')
r3 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_GET_NODE_DEBUG_INFO(r3, 0xc018620b, &(0x7f0000000100))
ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)})
ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0x0, 0x0, &(0x7f0000000780)})

15:06:32 executing program 0:
r0 = socket$inet_udplite(0x2, 0x2, 0x88)
ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f3188b070")
r1 = syz_open_procfs(0x0, 0x0)
lseek(r1, 0x20000, 0x0)

15:06:32 executing program 4:
ioctl$sock_FIOGETOWN(0xffffffffffffffff, 0x8903, &(0x7f0000000000)=<r0=>0x0)
r1 = syz_open_procfs(r0, &(0x7f00000001c0)='net/softnet_stat\x00')
lseek(r1, 0x20000, 0x0)
ftruncate(r1, 0xeb7)
connect(r1, &(0x7f0000000040)=@un=@file={0x0, './file0\x00'}, 0x80)

15:06:32 executing program 0:
r0 = socket$inet_udplite(0x2, 0x2, 0x88)
ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f3188b070")
r1 = syz_open_procfs(0x0, 0x0)
lseek(r1, 0x20000, 0x0)

15:06:32 executing program 3:
r0 = socket$inet_udplite(0x2, 0x2, 0x88)
ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f3188b070")
syz_open_procfs(0x0, &(0x7f0000000940)='syscall\x00')
r1 = syz_open_procfs(0x0, &(0x7f0000000040)='fd\x00')
recvmmsg(0xffffffffffffffff, &(0x7f0000003840)=[{{0x0, 0x0, 0x0}}], 0x1, 0x0, 0x0)
perf_event_open(&(0x7f0000940000)={0x2, 0x70, 0xee6a, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x100, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0xff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x10001, 0x1}, 0x0, 0x400000000000000}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
mlock(&(0x7f00005b8000/0x3000)=nil, 0x3000)
ioctl$SNDRV_TIMER_IOCTL_SELECT(0xffffffffffffffff, 0x40345410, 0x0)
openat$uinput(0xffffffffffffff9c, &(0x7f0000000080)='/dev/uinput\x00', 0x2, 0x0)
mmap(&(0x7f000060b000/0x1000)=nil, 0x1000, 0x5, 0x8000400200000033, r1, 0x0)
perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x2, 0x9, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2000000, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x4000000, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8)
r2 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)={0x10b, 0x6, 0x209e1e, 0x3, 0x1}, 0x2c)
bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000b40)={r2, &(0x7f0000000040), 0x0, 0x1}, 0x20)
r3 = creat(&(0x7f0000000640)='./file0\x00', 0x100)
setsockopt$inet6_tcp_TCP_REPAIR_QUEUE(r3, 0x6, 0x14, &(0x7f0000000980), 0x4)
r4 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r5 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r5, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r5, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)})

[ 1113.782613] binder: 1150:1155 transaction failed 29189/-22, size 24-8 line 3117
[ 1113.811139] binder: 1150:1155 BC_INCREFS_DONE u0000000000000000 no match
15:06:32 executing program 1:
r0 = socket$inet_udplite(0x2, 0x2, 0x88)
ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f3188b070")
syz_open_procfs(0x0, &(0x7f0000000940)='syscall\x00')
r1 = syz_open_procfs(0x0, &(0x7f0000000040)='fd\x00')
recvmmsg(0xffffffffffffffff, &(0x7f0000003840)=[{{0x0, 0x0, 0x0}}], 0x1, 0x0, 0x0)
perf_event_open(&(0x7f0000940000)={0x2, 0x70, 0xee6a, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x100, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0xff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x10001, 0x1}, 0x0, 0x400000000000000}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
mlock(&(0x7f00005b8000/0x3000)=nil, 0x3000)
ioctl$SNDRV_TIMER_IOCTL_SELECT(0xffffffffffffffff, 0x40345410, 0x0)
openat$uinput(0xffffffffffffff9c, &(0x7f0000000080)='/dev/uinput\x00', 0x2, 0x0)
mmap(&(0x7f000060b000/0x1000)=nil, 0x1000, 0x5, 0x8000400200000033, r1, 0x0)
perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x2, 0x9, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2000000, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x4000000, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8)
r2 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)={0x10b, 0x6, 0x209e1e, 0x3, 0x1}, 0x2c)
bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000b40)={r2, &(0x7f0000000040), 0x0, 0x1}, 0x20)
setsockopt$inet6_tcp_TCP_REPAIR_QUEUE(0xffffffffffffffff, 0x6, 0x14, &(0x7f0000000980), 0x4)
unlink(&(0x7f0000000940)='./file0\x00')
r3 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_GET_NODE_DEBUG_INFO(r3, 0xc018620b, &(0x7f0000000100))
ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)})
ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0x0, 0x0, &(0x7f0000000780)})

15:06:32 executing program 4:
r0 = openat$selinux_avc_cache_threshold(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/avc/cache_threshold\x00', 0x2, 0x0)
getsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffffff, 0x29, 0x23, &(0x7f0000000040)={{{@in6=@initdev, @in6=@ipv4={[], [], @multicast2}}}, {{@in6=@dev}, 0x0, @in=@loopback}}, &(0x7f0000000280)=0x24bab71b11abd36b)
ioctl$RNDADDENTROPY(r0, 0x40085203, &(0x7f0000000180)={0x3ff, 0x2, "c551"})
syz_open_procfs(0x0, &(0x7f00000001c0)='net/softnet_stat\x00')
socket$unix(0x1, 0x5, 0x0)
ioctl$RNDGETENTCNT(r0, 0x80045200, &(0x7f0000000140))
lookup_dcookie(0xd8df, &(0x7f0000000200)=""/59, 0x3b)

15:06:32 executing program 2:
r0 = socket$inet_udplite(0x2, 0x2, 0x88)
ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f3188b070")
syz_open_procfs(0x0, &(0x7f0000000940)='syscall\x00')
r1 = syz_open_procfs(0x0, &(0x7f0000000040)='fd\x00')
recvmmsg(0xffffffffffffffff, &(0x7f0000003840)=[{{0x0, 0x0, 0x0}}], 0x1, 0x0, 0x0)
perf_event_open(&(0x7f0000940000)={0x2, 0x70, 0xee6a, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x100, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0xff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x10001, 0x1}, 0x0, 0x400000000000000}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
mlock(&(0x7f00005b8000/0x3000)=nil, 0x3000)
ioctl$SNDRV_TIMER_IOCTL_SELECT(0xffffffffffffffff, 0x40345410, 0x0)
openat$uinput(0xffffffffffffff9c, &(0x7f0000000080)='/dev/uinput\x00', 0x2, 0x0)
mmap(&(0x7f000060b000/0x1000)=nil, 0x1000, 0x5, 0x8000400200000033, r1, 0x0)
perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x2, 0x9, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2000000, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x4000000, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8)
r2 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)={0x10b, 0x6, 0x209e1e, 0x3, 0x1}, 0x2c)
bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000b40)={r2, &(0x7f0000000040), 0x0, 0x1}, 0x20)
creat(&(0x7f0000000640)='./file0\x00', 0x100)
unlink(&(0x7f0000000940)='./file0\x00')
r3 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_GET_NODE_DEBUG_INFO(r3, 0xc018620b, &(0x7f0000000100))
ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)})
ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0x0, 0x0, &(0x7f0000000780)})

[ 1113.957922] binder: 1179:1181 transaction failed 29189/-22, size 24-8 line 3117
[ 1113.967014] binder: release 1177:1180 transaction 1068 out, still active
[ 1113.976829] binder: send failed reply for transaction 1068, target dead
[ 1113.984623] binder: 1179:1181 BC_INCREFS_DONE u0000000000000000 no match
15:06:32 executing program 3:
r0 = socket$inet_udplite(0x2, 0x2, 0x88)
ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f3188b070")
syz_open_procfs(0x0, &(0x7f0000000940)='syscall\x00')
r1 = syz_open_procfs(0x0, &(0x7f0000000040)='fd\x00')
recvmmsg(0xffffffffffffffff, &(0x7f0000003840)=[{{0x0, 0x0, 0x0}}], 0x1, 0x0, 0x0)
perf_event_open(&(0x7f0000940000)={0x2, 0x70, 0xee6a, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x100, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0xff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x10001, 0x1}, 0x0, 0x400000000000000}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
mlock(&(0x7f00005b8000/0x3000)=nil, 0x3000)
ioctl$SNDRV_TIMER_IOCTL_SELECT(0xffffffffffffffff, 0x40345410, 0x0)
openat$uinput(0xffffffffffffff9c, &(0x7f0000000080)='/dev/uinput\x00', 0x2, 0x0)
mmap(&(0x7f000060b000/0x1000)=nil, 0x1000, 0x5, 0x8000400200000033, r1, 0x0)
perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x2, 0x9, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2000000, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x4000000, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8)
r2 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)={0x10b, 0x6, 0x209e1e, 0x3, 0x1}, 0x2c)
bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000b40)={r2, &(0x7f0000000040), 0x0, 0x1}, 0x20)
creat(&(0x7f0000000640)='./file0\x00', 0x100)
r3 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r4 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r4, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r4, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)})

15:06:32 executing program 0:
r0 = socket$inet_udplite(0x2, 0x2, 0x88)
ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f3188b070")
r1 = syz_open_procfs(0x0, 0x0)
lseek(r1, 0x20000, 0x0)

15:06:32 executing program 4:
r0 = syz_open_procfs(0x0, &(0x7f00000001c0)='net/softnet_stat\x00')
lseek(r0, 0x20000, 0x0)
fchdir(r0)

15:06:32 executing program 1:
r0 = socket$inet_udplite(0x2, 0x2, 0x88)
ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f3188b070")
syz_open_procfs(0x0, &(0x7f0000000940)='syscall\x00')
r1 = syz_open_procfs(0x0, &(0x7f0000000040)='fd\x00')
recvmmsg(0xffffffffffffffff, &(0x7f0000003840)=[{{0x0, 0x0, 0x0}}], 0x1, 0x0, 0x0)
perf_event_open(&(0x7f0000940000)={0x2, 0x70, 0xee6a, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x100, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0xff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x10001, 0x1}, 0x0, 0x400000000000000}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
mlock(&(0x7f00005b8000/0x3000)=nil, 0x3000)
ioctl$SNDRV_TIMER_IOCTL_SELECT(0xffffffffffffffff, 0x40345410, 0x0)
openat$uinput(0xffffffffffffff9c, &(0x7f0000000080)='/dev/uinput\x00', 0x2, 0x0)
mmap(&(0x7f000060b000/0x1000)=nil, 0x1000, 0x5, 0x8000400200000033, r1, 0x0)
perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x2, 0x9, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2000000, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x4000000, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8)
r2 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)={0x10b, 0x6, 0x209e1e, 0x3, 0x1}, 0x2c)
bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000b40)={r2, &(0x7f0000000040), 0x0, 0x1}, 0x20)
setsockopt$inet6_tcp_TCP_REPAIR_QUEUE(0xffffffffffffffff, 0x6, 0x14, &(0x7f0000000980), 0x4)
unlink(&(0x7f0000000940)='./file0\x00')
r3 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_GET_NODE_DEBUG_INFO(r3, 0xc018620b, &(0x7f0000000100))
ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)})
ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0x0, 0x0, &(0x7f0000000780)})

15:06:32 executing program 5:
r0 = socket$inet_udplite(0x2, 0x2, 0x88)
ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f3188b070")
syz_open_procfs(0x0, &(0x7f0000000940)='syscall\x00')
r1 = syz_open_procfs(0x0, &(0x7f0000000040)='fd\x00')
recvmmsg(0xffffffffffffffff, &(0x7f0000003840)=[{{0x0, 0x0, 0x0}}], 0x1, 0x0, 0x0)
perf_event_open(&(0x7f0000940000)={0x2, 0x70, 0xee6a, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x100, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0xff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x10001, 0x1}, 0x0, 0x400000000000000}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
mlock(&(0x7f00005b8000/0x3000)=nil, 0x3000)
ioctl$SNDRV_TIMER_IOCTL_SELECT(0xffffffffffffffff, 0x40345410, 0x0)
openat$uinput(0xffffffffffffff9c, &(0x7f0000000080)='/dev/uinput\x00', 0x2, 0x0)
mmap(&(0x7f000060b000/0x1000)=nil, 0x1000, 0x5, 0x8000400200000033, r1, 0x0)
unshare(0xfffffffffffffffd)
r2 = getpid()
sched_setscheduler(r2, 0x5, &(0x7f0000000540))
open$dir(&(0x7f0000000400)='./file0\x00', 0x0, 0x0)
perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f00000004c0), 0x2}, 0x0, 0x0, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r3 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000340)='memory.current\x00', 0x0, 0x0)
ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, 0x0)
socketpair(0x1, 0x20000000000001, 0x0, &(0x7f0000000100)={<r4=>0xffffffffffffffff, <r5=>0xffffffffffffffff})
ioctl$PERF_EVENT_IOC_SET_FILTER(r5, 0x8914, &(0x7f0000000300)='lo\x00\x96o\xd6Q\xb9Y\xa9\xc8J,\x00\xd2\x97\x04\x03\xdc\r')
close(r3)
rt_sigprocmask(0x2, &(0x7f0000000240)={0x6}, &(0x7f00000002c0), 0x8)
ioctl$PERF_EVENT_IOC_SET_FILTER(r5, 0x8923, &(0x7f00000008c0)='lo\x00\x96o8\x0fd\xa1\xe3\xd7]b}\x1f\xa1Y\xad4\x90\x9d`\xd2\x98\x00\x00\x00 \'Y\x17]\x15c\xcaR\xdd\x98OC\x89\x1b\xe7\x84\xe2\x05\x80w\xd2|D\x8dK\x14Bx\xcbuH\xc2\xeec\xbf<>Y\x1a\xfc\x1f9OB\x81\x89\x186\xc5q@n\xb4\xb6s\xb0\x00\x00\xfc\x00\x00\b\x00\x00\xda\xef\xecE\xec\xd5I\xb2\x9b\xfe\x8d\x90?\x00\xe9\xe4~g:\xc1\xb2aj\x96\xbb\xa7\xe2\xc0\xdc\xf9Q\b\xeb\x16\x7fT\x11\xd3\r7\xe6\"f\xcf\x8e\xabd\x0ftp\x82\xae\xd2\x15\x8e+c\xf6\xbf\xe14>\xa6-\xa5c\xde\xd7\xab\xea\x1f\xf8s2\x9cVF\xd5\x18\xfe\x0e\x8f \x01\x00\x00y.\xfc*\x82\xa5\xa1p5\xc8{\xf7\xef\xab\xe8\x99\xebw#\x8at\x1c\x80\xfc\xb0\x95\xa2\xa7\xd7,Y]E8\x83X\xf5F\xdc\x88-\xf5\xb0\xb5^\xdb\x1a\xb6\xaa\x14\xe2\xb9\rh^J-\xd1\xbaUn\x04\'l\x1b\xe0o\xdb\xc8\x91%\x1c\xb5\xbf\xb6\x90\xb4\xc2\x7f]/\xb3\xe7\xc9\'\x94\xcfIo\xdf\x04\x95\xb5\x06\x84\x1fH>\xda\xc5\x04 \x94\x88\xeb\'\xd4;6\x7f\xd9\x99-\x1b|G\x8d\xd4\xb9%\xaaQ\xa0K\x10\x03\x93\xe1\xcc\xe7m\x80\'\xf0\xa5\xed(\r\xa8\x0f&\xb1\xf3\xff0\f\x82%_\x92\x8bD\xb9\xd9\xe7\xf2\xe4\xc1i#\xdc\x87A\xb9\xc7\r\x92\xfa\x11\x11\xb5\x1f\x03\x9d\xdd\x1bj\xdf\xacg\xe3\xa0S\xd3\x8a\xe1n\x97\xea\xf5\xa0\'\v\xe9\xa0\xf1 f\xaan\xcf\xb5i\xb6d\xbc\x92\v\xd58\x16\b\xb3_:\xa4!\ny\xc4&\nWMM\xa8\xc4\v\x9f\x01o\xf4\xab&\xb6\x17\x02P\xc3!N\xf4\b\x1a~\x91V1s\xe9\xbe\x9e\x9b\'\xcde\xb3\xa1\x86\"\xd7\x04\xf1\xc0!\xed\xff\xee$\xc89\x8cB0\xd1dD\xe0IP\x88\xa2\xf2Y\x9af$$\xf1cO\xf7P\xac\xca\x80:!\xb4\x94#\xcb^\x9f\'\x03\xe3\x93\xb9\x82\xbf\xcf\xc4\xe3\xf7\x03Oh\xf2r\xca\x8ff\xbb/\x9f*\xaf\x1a \xa5\xa0?%M\xa5\x86\x98\xf24\'1\xc7\f<\xcc@\xe8\x8a\xac.\xde\xe4\xc7\xf5\x9ck\xa40!\xe9\x14$\xb3\x05m\xb5m\xed\ft\x93\xd8\xa3\x80\'Y\xb9\x05\xbbt|\xbe\xbcz\n\xf3\xf5p\xf8\x9f~\x1b\xd0\v\x1cQ')
getsockopt$inet_IP_IPSEC_POLICY(r1, 0x0, 0x10, &(0x7f00000006c0)={{{@in6=@loopback}}, {{@in6=@initdev}}}, &(0x7f0000000500)=0xe8)
socketpair(0x2, 0x2000000080003, 0x100, &(0x7f0000000480))
syz_genetlink_get_family_id$SEG6(&(0x7f00000003c0)='SEG6\x00')
sendmsg$SEG6_CMD_DUMPHMAC(r4, &(0x7f0000000580)={&(0x7f0000000380)={0x10, 0x0, 0x0, 0x1000000}, 0xc, &(0x7f0000000440)={&(0x7f00000005c0)=ANY=[@ANYBLOB="2300260109447a0000000000000000660000001400001a0065a455e04ea56d0a47018c8e973bcac914471474a7e0d50a000eadd66d2e49a2ed40dcafa1e046ab6aacc2097d8f75bd9c8b8a220bdde116904efa3f9600f22ab388644f66c2d5baec4079a81bae1927e49e91a4964656d7b227702926af5be846f3de49fad39048633fd9161123894d9427f854a30cb0532c8f31f663380e40ce7f6cb15ec8baab3b7c6f"], 0x1}, 0x1, 0x0, 0x0, 0x8000}, 0x804)
r6 = creat(&(0x7f0000000280)='./bus\x00', 0x0)
arch_prctl$ARCH_MAP_VDSO_32(0x2002, 0x7e)
ftruncate(r6, 0x2008200)
open(&(0x7f0000000140)='./bus\x00', 0x4000, 0x0)

15:06:32 executing program 2:
r0 = socket$inet_udplite(0x2, 0x2, 0x88)
ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f3188b070")
syz_open_procfs(0x0, &(0x7f0000000940)='syscall\x00')
r1 = syz_open_procfs(0x0, &(0x7f0000000040)='fd\x00')
recvmmsg(0xffffffffffffffff, &(0x7f0000003840)=[{{0x0, 0x0, 0x0}}], 0x1, 0x0, 0x0)
perf_event_open(&(0x7f0000940000)={0x2, 0x70, 0xee6a, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x100, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0xff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x10001, 0x1}, 0x0, 0x400000000000000}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
mlock(&(0x7f00005b8000/0x3000)=nil, 0x3000)
ioctl$SNDRV_TIMER_IOCTL_SELECT(0xffffffffffffffff, 0x40345410, 0x0)
openat$uinput(0xffffffffffffff9c, &(0x7f0000000080)='/dev/uinput\x00', 0x2, 0x0)
mmap(&(0x7f000060b000/0x1000)=nil, 0x1000, 0x5, 0x8000400200000033, r1, 0x0)
perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x2, 0x9, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2000000, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x4000000, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8)
r2 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)={0x10b, 0x6, 0x209e1e, 0x3, 0x1}, 0x2c)
bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000b40)={r2, &(0x7f0000000040), 0x0, 0x1}, 0x20)
creat(&(0x7f0000000640)='./file0\x00', 0x100)
unlink(&(0x7f0000000940)='./file0\x00')
r3 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_GET_NODE_DEBUG_INFO(r3, 0xc018620b, &(0x7f0000000100))
ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)})
ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0x0, 0x0, &(0x7f0000000780)})

15:06:33 executing program 0:
r0 = socket$inet_udplite(0x2, 0x2, 0x88)
ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f3188b070")
syz_open_procfs(0x0, &(0x7f0000000080)='net/dev_mcast\x00')
lseek(0xffffffffffffffff, 0x20000, 0x0)

15:06:33 executing program 2:
r0 = socket$inet_udplite(0x2, 0x2, 0x88)
ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f3188b070")
syz_open_procfs(0x0, &(0x7f0000000940)='syscall\x00')
r1 = syz_open_procfs(0x0, &(0x7f0000000040)='fd\x00')
recvmmsg(0xffffffffffffffff, &(0x7f0000003840)=[{{0x0, 0x0, 0x0}}], 0x1, 0x0, 0x0)
perf_event_open(&(0x7f0000940000)={0x2, 0x70, 0xee6a, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x100, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0xff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x10001, 0x1}, 0x0, 0x400000000000000}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
mlock(&(0x7f00005b8000/0x3000)=nil, 0x3000)
ioctl$SNDRV_TIMER_IOCTL_SELECT(0xffffffffffffffff, 0x40345410, 0x0)
openat$uinput(0xffffffffffffff9c, &(0x7f0000000080)='/dev/uinput\x00', 0x2, 0x0)
mmap(&(0x7f000060b000/0x1000)=nil, 0x1000, 0x5, 0x8000400200000033, r1, 0x0)
perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x2, 0x9, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2000000, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x4000000, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8)
r2 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)={0x10b, 0x6, 0x209e1e, 0x3, 0x1}, 0x2c)
bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000b40)={r2, &(0x7f0000000040), 0x0, 0x1}, 0x20)
creat(&(0x7f0000000640)='./file0\x00', 0x100)
unlink(&(0x7f0000000940)='./file0\x00')
r3 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_GET_NODE_DEBUG_INFO(r3, 0xc018620b, &(0x7f0000000100))
ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)})
ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0x0, 0x0, &(0x7f0000000780)})

15:06:33 executing program 4:
r0 = syz_open_procfs(0x0, &(0x7f00000001c0)='net/softnet_stat\x00')
sendmsg$nl_generic(r0, &(0x7f0000000080)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x400000}, 0xc, &(0x7f0000000040)={&(0x7f0000000200)={0x1554, 0x10, 0x320, 0x70bd2d, 0x25dfdbff, {0x1d}, [@nested={0x310, 0x86, [@generic="af6a27bbf1bd255f67b5781eb8", @typed={0x8, 0x94, @u32=0x1}, @typed={0x14, 0x5c, @ipv6=@local}, @generic="daa9faaf3447289f4beb8e1a57c32496471946bff21d4507be3cea9f85674ac51d7042397800426dc318ae3b3321aa80ceaed9b9f787cdc537a68ca13b5d1daef6dd4f7f8bbe076058cc60812f33bc0b2f95cedf0ca8bfe9f13bfb9934175173bbe2ec1524a2e8d8db85a753bb3b771a059bc4a2474bb04458a88d4e96e5544b1db643514b965f14d550a4c35094be4209bfbe3528dce8d9776412c48b958d2eb207f7bbeb30bd20b45a0f3007d4ccce15d954ffb4ba913201c28f20f32402bcef7e2a0353827fa21b8dd5ef0e59c0226922c24955ba7c2ef6d754411617ea1055e91552df1225a7e4cb7ca9156d1e4313ff7a18600e973468287515", @generic="97d767506bb277584596d29f6a752c94ef9679444f7942d7d94c60b88cfe807540a1563a08caf1d32a2a3615a89721d8b15c7f13f06914a735ec8b884f560353218ef4980e8a0fe87da970a4cad37c197df871e39b5201b9537830f8d62f9ed257bd56ce166ca45dc23158b584d2de14bfafc1e6da5af8c730ea", @generic="22ef562af6d6f7a126ac64133659a7ebbd80ac35a1a7bcc55a8c37ac00014c4f8e7f47853381c7c1f3f49c16ac5d0823340698538097853ab9ba6fcd04561159c4a659b031db04cf1fe7191dfee0dd175279b172a3fafe4661e60c5b9a679d48372c5106d03417eeab9caa8ba920eb8225300461abfd91250230d12a3afe4e8edde660a41d3bc810fdc3ffc170451b0883c62985c5fd360bd511c62dd7626ebecafab44e429e76d786d900649df158f47e6830e97188db2715795cfae61cf33a07ffd750cf15889f5a7151896e4b1e45feffdc66ce2a207bff533b6f0125cc1fd32279f327f22118e27aa0043f064a5099543419710316c134b2ab1b", @typed={0x14, 0x6f, @ipv6=@mcast1}, @typed={0xc, 0x3c, @u64=0x927}, @typed={0x8, 0x6b, @u32=0x51244c12}, @generic="8362ed8f7860827b834a8a771b0261d469b2dd8d52a7f63d3a857a54356cada9dda1924a52abaacc943bc15f4bf57d4c1bd02b71c58c2e74fda7c4ce28e74c49dcc1fae1ac3f2a"]}, @nested={0x1230, 0x29, [@generic="7521efbce57717b25fb668a3b97c55c0508685492f5663aab5767e713a7ccb8ef50184ff660f2d86831904f0018a8d54b3e2baac527d178b1d1d7004e7cb920208f73cf1326e0c687885d287dbbb3a3a2140c662c509a82642ea504a2de8adf2a6bab1e46173a77897b4ce1e96d2f25899d242a090414c68120f6d6b419b5ab954ed64f89349d10f95d56fab0ce0b207dcd651", @typed={0xd8, 0x40, @binary="5216d1e7002570edfd1971de1aff11701b0b5d8ecf5f62582715f68b79493db665bf7137b21a55a247cde919cd78c6750fe6072cc81b4e452a161b4707a2a4d27db941a8ccbbeb65b8354397a3f87fe462cb6c78ebf5aadc6676e4aca6d6136efbe3f98fb96c257ba3dc8c515c3567a9217ff8df197eb005df4deedd7236c48e54dd96a3f3fdbd5ae75182405a63e4abf4e16117b988dff827140236637099b04e4957f589a96991ed5287f392683c8db2172873579e10ca248363acdeeb0c655b3f15f1a3f009cb5f25185b2aacacb31700"}, @generic="39d0fe5db205296be3b9857034b05f5a3c00b655ade342c7755a1ef1debded11b101f9065e4ad322590e02c3f34550cc8e34169d153ae23cd7c50b409e3417e50002d7bc2839edde6e3a807141d87d61f1d8557f19370e6ef3ea42f56c0ac1d0064f6e134be4aa4e8023e1742bdd4219e5bf81751c127a22a4082f1b156363c6992b103e88c533c0976a1b9d25c64fc1c6244def579d2c3008c3a3e65b66751204f69c96a63d60ba0f13f5fcc97535199ff8053b4cfb97bb14c90fe1008862382fbe1ca6ddcfce5b2b8f5571800fd615604dae210e604c13256b7b5c8e7444d27f18c3567dbcc8be25dd5d7d6efd9f8b0afec733c73ce0019e3b93eaa56e6b554ea57f49d0609526b8a1ad371766db1a6cbdea024db38fb7bf979b401d862d76e6591e275a94aed4c97d515be3102bf97a2a87cb8e39050d5c7a4fc926b94ff8f3d01f66e742228f2e7d80bc2500a7be5e98b7a5dabe0cdf36070dc212d11ac9c904e7c2ea5bd2692847d7a7edff5392df9c25debf57c45d565dfa3389ef6da0deb3bf33b8fe77eea4765b45ecfd638936872829b066e032d1078627fbb396af241e4b63e6e316756dbe28635792198f68a63e6a80bf0bd9818422db04f63e5168e4221b569302395fe646c822a8551d23957752ea7473c7da0ff121def8fbcbbf3db32506bb06222793665f551d2db1f8fabca0e3ce18fd25cfffdc754e161d3c0fde1521a5af17c62d90718048626913a98dd1cc11baf80a64958f992e1f64fa64e4fe04841700506fe6e5981210d7e0774771af4d271610572f69835768ca0a444e0a2f3a17f11ac2d68fde175c3f01be30447f436cce3ce294808912e5e18f5cf569aa0429f099bc784173712c56ca805995a62d2248c34739b564db100593d8a3832992791e6c5920ed78d9bbfbd4f550d46d9a3b4eb4afb7f97a03e3648c0d4351639d444e6d5179c7ff791587877a9e659af5510a5fb0b4946d18631fdfd6ba894f2b0e8cfc63f94db9470f2410ea593f2dd1b5a6428f015c2b856eee4833d4ff171d340a31f6ad17e82ebac2ef0d2c0ac232eb0fe5ca79c2c5ca3031a7959162dd448928101accc952ab68b616414a2a10b960c4e0d50e90f9e38192272f4f6aa19b6ce58860d6169f6f437fb1a886f35e51973c6bcccc745adde58ff0a3cec42d770c4df46ed59e6622e272c8d1781647103cb62caeac7bfe4a6daae5800801a514692570e91aace6652c519e795e431d39bbe98734fc95c8a1e812afe9a7b42a5401ecc515a21cc68fd48b301ba431bd2ea0d699bb2246a6c8d2aeccf35b3817902a69cc346cdcf921c142fc43b31e10707d7b567a148b981943df8c6f3d88c06d5e7a523757a294c1ab43bc04b579e1138865e9f797833c26e7eed7d01e123da5bf591d9dd5ed5a8f0ea575715d8465f8500511b71da9ca7edddee03b7012edd9a859ce0e2dd155de5a99d8e5001122e91d0bac32f6d0c091fcd19a395ca1be13f2c0aa279e30384e00a4289f823ade146247f57982b40f9a3a03bc65cd8cae6573becfd22b2292878edd8aac43b1924674311df44b4aed7d401e82a7e799bbf72702e3bc1f2dc460b380547252d412600d748a0579b3da06c927b6837863c734390c596e1a95a8d878c889f65a5601516b1244f57e25732e5aded07f25d46bd41fba986f4a015e0307d36dfc38db7b835e664c61b5f5eede02519ef2ac5d233a601637cebc88fcc4700e60e504e3b5e3b522c28becbc7da4c63f1c5f87de0c5a31f4be09e4105df822bbe428a58bad78f47309d4964ff13ef39ab3b9c3c121aa46bd578b7f1c22e00664587ea00b083fe3080983a39beab9fe3970936f4f3c30751a6fa680af17d0b60dbbf4788a7274ba354fac84cab6a63d49d7fc9e9a57131e943da2906ae2c95d2a10e96f90be9a7559894895f0edc3b936731b0e21f61c6e854ce9bd9ef655335660cdd2f8521bbb08d8f14c181045f3dbb0a3ddf36f7f4695d5601c18231e857bcf3c77d7b45f70a5d926e374728d68696c57bb88cd0d9e5f801994e54856a123b048956de4a78a4c6845eb484bcbaeec5475fddef0e5a9ce50660d9c5b1b30a1cafd36ca97df23e84b34648429e5d61ff707992e37b7d07b3764a8b24b5130f65ac190450dac31cab0e04f8bd82fa7eeaf3f61bc1bd7e2c0a875b18f71b380efde66d7d3319e259c386c16183666bf92d49507617866ba353f6125375c95fcba3d250c5062c5965f110629bcd6febf8dddd906b52f31ced7d22499de59c54bb2bb35800492a818304c5a4c5be9bfa83d6580fc5d6967f34467b619ebcf475c921c732d300b14271bb743b97e2ff227cd90bd6e900b45db65307622856711ea1b7a32debc07d1c63b0f57142bb35e2142e09dc8253c281d3f78044875fc006bf315b0094ece423fbb53cc648262897523ca97e150640caa6e098873b0a9ff4c025fa64a103efd5933d4c919e8a22542e6244361fdfed0eb7d5665c90c5da2ad6016525d9b80a2c91470b68a1ce1a63000768096fc192d67ca3afbe2ae8ee00314ebe81bdc407a3e2e225d6b9f6e73041ee28bc3fb0d92b55c6bf4f413dca6741f78d879bd452e887cc12b1da2dc23d41919c50319ab94ba5468f61687b5f8baa3b68365b42e23a5d7ac68748b1c4d5fff6c7ef7a2aed86670bbcb776f3bef2401bc068c049d4c6ffdc70b5104a4cd80cc258bc26a61812e96c138f2d14ee600e2c10847e105c57a2b11b441d82ca45bc21719cd36cf266604de9fc2f7f41088312c502e87c0b281a6880ef53539b536de0f24d2ff6a3cc78ca5116a5ad795e0d5f19c90346c1f15836056a184f69cdbfca63c9ab98f84932f93f0e13c0628a012239b1a165c6e76c5a439d93c9ac60b19b8d2da2ba91e024a2d059bd37282c9e0480bed7ba4a479d00f26442d793ccd578ae9c60bc2e9498e942ffac6bb9f14cf1c18555ada317b0091cf791ef8b3c56b271107b07515a9c0e16ade69f40c1a2fdaaa0a10c5dc5f6a35b881efb75ce769e3173f818b10e34e4c5df8e53e9c3d3e6543522841d3759edcd1e3add5fb81f897c468046b5782ae5fec42ae99a188bef232db252ff7e0409debf4c9cf0d74debcc8be7613d39d4c50ab929a9d785716f7981d5fdee856b25f2afbabb79d4eeeb228ae97eeb4f6e95da2f9c47d954853523c54dd1392587fcf5e909a4cff637092602d9b79488545fa82db0895e0b7562f84f9a28b56bfa286a81c959a286b81b0ebc1573e7aaeefc9ecafd63c06b921cac120a86ee9da56179187fe5ce8a69378295c52874f13825883d6ed2dc53e2cfed4f904081b1c1e58ad179cebfd8539127d16532bc6afd1655adbd6c1a614dcbe85ad87533e291a776b86bf0f240c90af70a6243e2da69a66176610cfba71d351fef47ffcc93f06acb8fd675942bb1fc9293e5fbbf630e093d1e5c053491bf9d11081ae32f4d444da7c8f1ed16ebaa284f54b87bae94c4937b472aac289b02a61227cec9ab8ab49b5c437afe8fd77c395ee3bcb384458117dd799369bdc9f0af53e2d4be45db1bdf4aea69d92fe626dde15a6b65f422819b7c22fde804de22578da413361f47497f93b5b07adf0a2ce6ffcbac8c8f15b9e4249a010a5235a97d1de738109c02136fdbf22e88b73e5c8459cc18be53675806881ec5f943cbd9730085dc9719cd273d9fa07cc8a08c2e569998e89889c4ab00f39ea1ec58c10a8d52c9373c2a28b530b3f97769ccdc0ccae98b157a65589571f133ff942d905559b9ceb4bc9b7feb6c0aa45e04c9c11fbbc1809b6684558d335a67eb9066e11d7371e84199136f6c2af0df0de7419b5420bd9c1f6c3dcb4b5aeb8e6832beb9d954d8f0611631a548101b8a32906a9f39342a0a308fd7e07f7a7aeaa754c253bdc07e8177c9fade335e361846f321dd536cf5e4398a3670c11aa365d3f3f1bbc549fba3bd5ad3f83c505ac8bffecf42b9eed36515406fe40c4438bd6f97f04079a678c5c99b01ea3bac93df558aef3120dbf7f766135ffa97ed8f6849f7ed4c637049a79d51d3db644dff81c395ef7ac50f75ea4d711f7e1ccf6b4029cad415ff169623b19df483ed1582bcf8547300ec0949683d2ed7092553fbb15d37c56ee8a8dcf411f4081aca1e9a7119ce1e86d7e7ff7ee739adc3a5639969772a68bc910d0b61c12d28563b0814d436ab78ca724554e71b0df40085c1d8be4b28488f673c8b9611435edf62c213478f5a8387b4c05f3b4443e09b4ba9868c972e4777d4592371f9fd23c84b3afa51504b8074504064647d373d08e7607c921d8b94d17a747500c768c77abe68d39552eadf9be414aeb41f6bff988ba7978564d899d1f8dc16a23eb0db147f6897a3bbef6f6c89d89a25794dd09302191627390344dfe074beccb5abfe7bd9e2d7f94169de141a54cab50d81745576e070fd69d86401d252b399105cb858fdb0851bcb08d4f10ceee232b030a3be6801bf93c74a8a1c7df9f07188d920ea78f1462a4a147611e34264e5a2655b5021423d506a6d89e809d87ddc060106c4f13504063227b687032a95e40a5ae1d3572ea6b6b08f7c7357d50e8c134526b93149cb401807f4454a40c7910086abf44153f612dbaceae8d17e9f13f7dfc3cc07564dd48150ff573395d9bee88e52a0fb9592e5e1c72cadf7c238a5fd8096a923d84f7a795f16e9022800847cf52412d599e73bd80194b8e0bd150fca510147b8a731da25df77c30622d6572216915a9efa434ef87e432d3cf85a01ff742c13f148216d2a6ae0a83cd658f846fc1cbf867d58abed3325a35e1608881fe189a0b5c1a930ec392b2df0b5c7c8e98030c4ad267de4b3bb495ea785a4abcdb22aef5afbe1051ea68bbae875f15694d8d3c8d8086980122750e9923ce9f2477640cfae10c3f0e659e85ef77fc2bb4d258f13945c853dd1163da5ada95e47820ededef8e9eb9f1b3380588ca13d4baaea5e4c0d3cfb1887ed76ecee1734d99508917602ebd51fd0ea23c2c0c0ed864d9593793f90cfc50efa1d80544f07aaec00d49db91069c9915a91aee34ca953a3f1812c7b0c968a92b1ee8e258dce11d7dbc486d4f8e166965b9959794ff85953bafc4ce13f23c9086d474c2c3994d05445dedc85994ba38a88e2937d916cd7492c7d03846dda4ee8bf3c5b1cb1e720511e66db286a02ab86ccdf09b7fcca17e40f8a05585d571e09760b13fa1757f679c494b03d34ca29d41327d33731ab2de9ae553cf871231a1863766c2fa732b6f29354adbbaff1baf9f03b7b4e6ce1e783bbdbc7a01f0e3dd95a6bbab1ab18d318058e7cc419784036b6174a848fec0e8835bd36e0a88da2e9a5500e527d22b614dbd4c74d4357353d0e0f5a2f430cd74ef068b2b8303c4f7d6ad22d9b3e9cf397445a84ae43a6f1ecc57120bafa2311f5cde43bcc5fd72a590dddf973f1c8cc98daaac266364cbe9296f728ceed2ece9883d015eadb0bcd1381346ac81853e0292776f3a33f13b519f7b48ae1f5e87d5ea6f6da72188f3d7aa726ea65a6475a67dfd5a0ebc3e843ae0f984e831d36642575214c750fa5dabd2b75cfc6dd0c9468e54732ac8a277ced81491136c06e8a1d0b1f33aa7083c298174064cb91439a9205b2468529de4d84f90bb342889f89a31f52db1b045bdefe1f93999146e4f1d90d6c9199495fea66f4786c607963f25358ca3b9331fe2c0b8014bec0392bb9c0b3150832c1bd9c497550387453c3c79ef8a4bccfa6c3796c9df791871945445d8fb006d38c31229955b9d9ad6", @typed={0x8, 0x32, @fd=r0}, @generic="b2eca0941b510c4acdd15a7fee26de9665a9aa13d73a6e726a7ff515ed49c0973e54003b6b3d739f9e2f1bffadcb74744053bb59ea175bc90b694630422af378818c9f990c48e2344afeadbe210981c460a271ef9fb5bf90c40ad724e8af58c8dcddc413f1e4ffa0c063556763c365674ff0fbf26604f55323871d0433fda34dd654adb90c2dfebe794dcf6240e4b8abace0638688cc70f0936b45f68c70cc144286529a8f09", @typed={0xc, 0x40, @u64=0x1}, @typed={0x4, 0x5}]}]}, 0x1554}, 0x1, 0x0, 0x0, 0x84}, 0x50)
lseek(r0, 0x20000, 0x0)

15:06:33 executing program 3:
r0 = socket$inet_udplite(0x2, 0x2, 0x88)
ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f3188b070")
syz_open_procfs(0x0, &(0x7f0000000940)='syscall\x00')
r1 = syz_open_procfs(0x0, &(0x7f0000000040)='fd\x00')
recvmmsg(0xffffffffffffffff, &(0x7f0000003840)=[{{0x0, 0x0, 0x0}}], 0x1, 0x0, 0x0)
perf_event_open(&(0x7f0000940000)={0x2, 0x70, 0xee6a, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x100, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0xff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x10001, 0x1}, 0x0, 0x400000000000000}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
mlock(&(0x7f00005b8000/0x3000)=nil, 0x3000)
ioctl$SNDRV_TIMER_IOCTL_SELECT(0xffffffffffffffff, 0x40345410, 0x0)
openat$uinput(0xffffffffffffff9c, &(0x7f0000000080)='/dev/uinput\x00', 0x2, 0x0)
mmap(&(0x7f000060b000/0x1000)=nil, 0x1000, 0x5, 0x8000400200000033, r1, 0x0)
perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x2, 0x9, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2000000, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x4000000, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8)
r2 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)={0x10b, 0x6, 0x209e1e, 0x3, 0x1}, 0x2c)
bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000b40)={r2, &(0x7f0000000040), 0x0, 0x1}, 0x20)
r3 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r4 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r4, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r4, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)})

[ 1114.177788] binder: release 1199:1203 transaction 1072 out, still active
[ 1114.203500] binder: send failed reply for transaction 1072, target dead
[ 1114.214443] binder: send failed reply for transaction 1074 to 1197:1205
15:06:33 executing program 1:
r0 = socket$inet_udplite(0x2, 0x2, 0x88)
ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f3188b070")
syz_open_procfs(0x0, &(0x7f0000000940)='syscall\x00')
r1 = syz_open_procfs(0x0, &(0x7f0000000040)='fd\x00')
recvmmsg(0xffffffffffffffff, &(0x7f0000003840)=[{{0x0, 0x0, 0x0}}], 0x1, 0x0, 0x0)
perf_event_open(&(0x7f0000940000)={0x2, 0x70, 0xee6a, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x100, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0xff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x10001, 0x1}, 0x0, 0x400000000000000}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
mlock(&(0x7f00005b8000/0x3000)=nil, 0x3000)
ioctl$SNDRV_TIMER_IOCTL_SELECT(0xffffffffffffffff, 0x40345410, 0x0)
openat$uinput(0xffffffffffffff9c, &(0x7f0000000080)='/dev/uinput\x00', 0x2, 0x0)
mmap(&(0x7f000060b000/0x1000)=nil, 0x1000, 0x5, 0x8000400200000033, r1, 0x0)
perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x2, 0x9, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2000000, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x4000000, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8)
r2 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)={0x10b, 0x6, 0x209e1e, 0x3, 0x1}, 0x2c)
bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000b40)={r2, &(0x7f0000000040), 0x0, 0x1}, 0x20)
setsockopt$inet6_tcp_TCP_REPAIR_QUEUE(0xffffffffffffffff, 0x6, 0x14, &(0x7f0000000980), 0x4)
unlink(&(0x7f0000000940)='./file0\x00')
r3 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_GET_NODE_DEBUG_INFO(r3, 0xc018620b, &(0x7f0000000100))
ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)})
ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0x0, 0x0, &(0x7f0000000780)})

[ 1114.224710] binder: 1197:1211 BC_INCREFS_DONE u0000000000000000 no match
15:06:33 executing program 0:
r0 = socket$inet_udplite(0x2, 0x2, 0x88)
ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f3188b070")
syz_open_procfs(0x0, &(0x7f0000000080)='net/dev_mcast\x00')
lseek(0xffffffffffffffff, 0x20000, 0x0)

15:06:33 executing program 3:
r0 = socket$inet_udplite(0x2, 0x2, 0x88)
ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f3188b070")
syz_open_procfs(0x0, &(0x7f0000000940)='syscall\x00')
r1 = syz_open_procfs(0x0, &(0x7f0000000040)='fd\x00')
recvmmsg(0xffffffffffffffff, &(0x7f0000003840)=[{{0x0, 0x0, 0x0}}], 0x1, 0x0, 0x0)
perf_event_open(&(0x7f0000940000)={0x2, 0x70, 0xee6a, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x100, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0xff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x10001, 0x1}, 0x0, 0x400000000000000}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
mlock(&(0x7f00005b8000/0x3000)=nil, 0x3000)
ioctl$SNDRV_TIMER_IOCTL_SELECT(0xffffffffffffffff, 0x40345410, 0x0)
openat$uinput(0xffffffffffffff9c, &(0x7f0000000080)='/dev/uinput\x00', 0x2, 0x0)
mmap(&(0x7f000060b000/0x1000)=nil, 0x1000, 0x5, 0x8000400200000033, r1, 0x0)
perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x2, 0x9, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2000000, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x4000000, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8)
bpf$MAP_CREATE(0x0, &(0x7f0000000000)={0x10b, 0x6, 0x209e1e, 0x3, 0x1}, 0x2c)
r2 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r3 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r3, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r3, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)})

[ 1114.323471] binder: release 1217:1224 transaction 1079 out, still active
[ 1114.352361] binder: send failed reply for transaction 1079, target dead
15:06:33 executing program 4:
r0 = syz_open_procfs(0x0, &(0x7f00000001c0)='net/softnet_stat\x00')
lseek(r0, 0x0, 0xfffffffffffffffc)
r1 = gettid()
rt_sigqueueinfo(r1, 0x1c, &(0x7f0000000000)={0x27, 0x9, 0x2})

15:06:33 executing program 2:
r0 = socket$inet_udplite(0x2, 0x2, 0x88)
ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f3188b070")
syz_open_procfs(0x0, &(0x7f0000000940)='syscall\x00')
r1 = syz_open_procfs(0x0, &(0x7f0000000040)='fd\x00')
recvmmsg(0xffffffffffffffff, &(0x7f0000003840)=[{{0x0, 0x0, 0x0}}], 0x1, 0x0, 0x0)
perf_event_open(&(0x7f0000940000)={0x2, 0x70, 0xee6a, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x100, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0xff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x10001, 0x1}, 0x0, 0x400000000000000}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
mlock(&(0x7f00005b8000/0x3000)=nil, 0x3000)
ioctl$SNDRV_TIMER_IOCTL_SELECT(0xffffffffffffffff, 0x40345410, 0x0)
openat$uinput(0xffffffffffffff9c, &(0x7f0000000080)='/dev/uinput\x00', 0x2, 0x0)
mmap(&(0x7f000060b000/0x1000)=nil, 0x1000, 0x5, 0x8000400200000033, r1, 0x0)
perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x2, 0x9, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2000000, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x4000000, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8)
r2 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)={0x10b, 0x6, 0x209e1e, 0x3, 0x1}, 0x2c)
bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000b40)={r2, &(0x7f0000000040), 0x0, 0x1}, 0x20)
creat(&(0x7f0000000640)='./file0\x00', 0x100)
r3 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r4 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r4, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r4, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)})

15:06:33 executing program 0:
r0 = socket$inet_udplite(0x2, 0x2, 0x88)
ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f3188b070")
syz_open_procfs(0x0, &(0x7f0000000080)='net/dev_mcast\x00')
lseek(0xffffffffffffffff, 0x20000, 0x0)

[ 1114.366720] binder: 1223:1226 transaction failed 29189/-22, size 24-8 line 3117
[ 1114.386708] binder: 1223:1226 BC_INCREFS_DONE u0000000000000000 no match
[ 1114.475971] binder: release 1232:1236 transaction 1084 out, still active
[ 1114.499809] binder: send failed reply for transaction 1084, target dead
15:06:33 executing program 4:
r0 = syz_open_procfs(0x0, &(0x7f00000001c0)='net/softnet_stat\x00')
lseek(r0, 0x20000, 0x0)
getsockopt$inet6_mtu(r0, 0x29, 0x17, &(0x7f0000000000), &(0x7f0000000040)=0x4)

15:06:33 executing program 1:
r0 = socket$inet_udplite(0x2, 0x2, 0x88)
ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f3188b070")
syz_open_procfs(0x0, &(0x7f0000000940)='syscall\x00')
r1 = syz_open_procfs(0x0, &(0x7f0000000040)='fd\x00')
recvmmsg(0xffffffffffffffff, &(0x7f0000003840)=[{{0x0, 0x0, 0x0}}], 0x1, 0x0, 0x0)
perf_event_open(&(0x7f0000940000)={0x2, 0x70, 0xee6a, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x100, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0xff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x10001, 0x1}, 0x0, 0x400000000000000}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
mlock(&(0x7f00005b8000/0x3000)=nil, 0x3000)
ioctl$SNDRV_TIMER_IOCTL_SELECT(0xffffffffffffffff, 0x40345410, 0x0)
openat$uinput(0xffffffffffffff9c, &(0x7f0000000080)='/dev/uinput\x00', 0x2, 0x0)
mmap(&(0x7f000060b000/0x1000)=nil, 0x1000, 0x5, 0x8000400200000033, r1, 0x0)
perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x2, 0x9, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2000000, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x4000000, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8)
bpf$MAP_CREATE(0x0, &(0x7f0000000000)={0x10b, 0x6, 0x209e1e, 0x3, 0x1}, 0x2c)
r2 = creat(&(0x7f0000000640)='./file0\x00', 0x100)
setsockopt$inet6_tcp_TCP_REPAIR_QUEUE(r2, 0x6, 0x14, &(0x7f0000000980), 0x4)
unlink(&(0x7f0000000940)='./file0\x00')
r3 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_GET_NODE_DEBUG_INFO(r3, 0xc018620b, &(0x7f0000000100))
ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)})
ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0x0, 0x0, &(0x7f0000000780)})

15:06:33 executing program 3:
r0 = socket$inet_udplite(0x2, 0x2, 0x88)
ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f3188b070")
syz_open_procfs(0x0, &(0x7f0000000940)='syscall\x00')
r1 = syz_open_procfs(0x0, &(0x7f0000000040)='fd\x00')
recvmmsg(0xffffffffffffffff, &(0x7f0000003840)=[{{0x0, 0x0, 0x0}}], 0x1, 0x0, 0x0)
perf_event_open(&(0x7f0000940000)={0x2, 0x70, 0xee6a, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x100, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0xff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x10001, 0x1}, 0x0, 0x400000000000000}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
mlock(&(0x7f00005b8000/0x3000)=nil, 0x3000)
ioctl$SNDRV_TIMER_IOCTL_SELECT(0xffffffffffffffff, 0x40345410, 0x0)
openat$uinput(0xffffffffffffff9c, &(0x7f0000000080)='/dev/uinput\x00', 0x2, 0x0)
mmap(&(0x7f000060b000/0x1000)=nil, 0x1000, 0x5, 0x8000400200000033, r1, 0x0)
perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x2, 0x9, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2000000, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x4000000, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8)
r2 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r3 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r3, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r3, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)})

15:06:33 executing program 2:
r0 = socket$inet_udplite(0x2, 0x2, 0x88)
ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f3188b070")
syz_open_procfs(0x0, &(0x7f0000000940)='syscall\x00')
r1 = syz_open_procfs(0x0, &(0x7f0000000040)='fd\x00')
recvmmsg(0xffffffffffffffff, &(0x7f0000003840)=[{{0x0, 0x0, 0x0}}], 0x1, 0x0, 0x0)
perf_event_open(&(0x7f0000940000)={0x2, 0x70, 0xee6a, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x100, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0xff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x10001, 0x1}, 0x0, 0x400000000000000}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
mlock(&(0x7f00005b8000/0x3000)=nil, 0x3000)
ioctl$SNDRV_TIMER_IOCTL_SELECT(0xffffffffffffffff, 0x40345410, 0x0)
openat$uinput(0xffffffffffffff9c, &(0x7f0000000080)='/dev/uinput\x00', 0x2, 0x0)
mmap(&(0x7f000060b000/0x1000)=nil, 0x1000, 0x5, 0x8000400200000033, r1, 0x0)
perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x2, 0x9, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2000000, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x4000000, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8)
r2 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)={0x10b, 0x6, 0x209e1e, 0x3, 0x1}, 0x2c)
bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000b40)={r2, &(0x7f0000000040), 0x0, 0x1}, 0x20)
creat(&(0x7f0000000640)='./file0\x00', 0x100)
r3 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r4 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r4, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r4, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)})

15:06:33 executing program 5:
r0 = socket$inet_udplite(0x2, 0x2, 0x88)
ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f3188b070")
syz_open_procfs(0x0, &(0x7f0000000940)='syscall\x00')
r1 = syz_open_procfs(0x0, &(0x7f0000000040)='fd\x00')
recvmmsg(0xffffffffffffffff, &(0x7f0000003840)=[{{0x0, 0x0, 0x0}}], 0x1, 0x0, 0x0)
perf_event_open(&(0x7f0000940000)={0x2, 0x70, 0xee6a, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x100, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0xff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x10001, 0x1}, 0x0, 0x400000000000000}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
mlock(&(0x7f00005b8000/0x3000)=nil, 0x3000)
ioctl$SNDRV_TIMER_IOCTL_SELECT(0xffffffffffffffff, 0x40345410, 0x0)
openat$uinput(0xffffffffffffff9c, &(0x7f0000000080)='/dev/uinput\x00', 0x2, 0x0)
mmap(&(0x7f000060b000/0x1000)=nil, 0x1000, 0x5, 0x8000400200000033, r1, 0x0)
unshare(0xfffffffffffffffd)
r2 = getpid()
sched_setscheduler(r2, 0x5, &(0x7f00000000c0))
open$dir(&(0x7f0000000400)='./file0\x00', 0x0, 0x0)
perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f00000004c0), 0x2}, 0x0, 0x0, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r3 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000340)='memory.current\x00', 0x0, 0x0)
ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, 0x0)
socketpair(0x1, 0x20000000000001, 0x0, &(0x7f0000000100)={<r4=>0xffffffffffffffff, <r5=>0xffffffffffffffff})
ioctl$PERF_EVENT_IOC_SET_FILTER(r5, 0x8914, &(0x7f0000000300)='lo\x00\x96o\xd6Q\xb9Y\xa9\xc8J,\x00\xd2\x97\x04\x03\xdc\r')
close(r3)
rt_sigprocmask(0x2, &(0x7f0000000240)={0x6}, &(0x7f00000002c0), 0x8)
ioctl$PERF_EVENT_IOC_SET_FILTER(r5, 0x8923, &(0x7f00000008c0)='lo\x00\x96o8\x0fd\xa1\xe3\xd7]b}\x1f\xa1Y\xad4\x90\x9d`\xd2\x98\x00\x00\x00 \'Y\x17]\x15c\xcaR\xdd\x98OC\x89\x1b\xe7\x84\xe2\x05\x80w\xd2|D\x8dK\x14Bx\xcbuH\xc2\xeec\xbf<>Y\x1a\xfc\x1f9OB\x81\x89\x186\xc5q@n\xb4\xb6s\xb0\x00\x00\xfc\x00\x00\b\x00\x00\xda\xef\xecE\xec\xd5I\xb2\x9b\xfe\x8d\x90?\x00\xe9\xe4~g:\xc1\xb2aj\x96\xbb\xa7\xe2\xc0\xdc\xf9Q\b\xeb\x16\x7fT\x11\xd3\r7\xe6\"f\xcf\x8e\xabd\x0ftp\x82\xae\xd2\x15\x8e+c\xf6\xbf\xe14>\xa6-\xa5c\xde\xd7\xab\xea\x1f\xf8s2\x9cVF\xd5\x18\xfe\x0e\x8f \x01\x00\x00y.\xfc*\x82\xa5\xa1p5\xc8{\xf7\xef\xab\xe8\x99\xebw#\x8at\x1c\x80\xfc\xb0\x95\xa2\xa7\xd7,Y]E8\x83X\xf5F\xdc\x88-\xf5\xb0\xb5^\xdb\x1a\xb6\xaa\x14\xe2\xb9\rh^J-\xd1\xbaUn\x04\'l\x1b\xe0o\xdb\xc8\x91%\x1c\xb5\xbf\xb6\x90\xb4\xc2\x7f]/\xb3\xe7\xc9\'\x94\xcfIo\xdf\x04\x95\xb5\x06\x84\x1fH>\xda\xc5\x04 \x94\x88\xeb\'\xd4;6\x7f\xd9\x99-\x1b|G\x8d\xd4\xb9%\xaaQ\xa0K\x10\x03\x93\xe1\xcc\xe7m\x80\'\xf0\xa5\xed(\r\xa8\x0f&\xb1\xf3\xff0\f\x82%_\x92\x8bD\xb9\xd9\xe7\xf2\xe4\xc1i#\xdc\x87A\xb9\xc7\r\x92\xfa\x11\x11\xb5\x1f\x03\x9d\xdd\x1bj\xdf\xacg\xe3\xa0S\xd3\x8a\xe1n\x97\xea\xf5\xa0\'\v\xe9\xa0\xf1 f\xaan\xcf\xb5i\xb6d\xbc\x92\v\xd58\x16\b\xb3_:\xa4!\ny\xc4&\nWMM\xa8\xc4\v\x9f\x01o\xf4\xab&\xb6\x17\x02P\xc3!N\xf4\b\x1a~\x91V1s\xe9\xbe\x9e\x9b\'\xcde\xb3\xa1\x86\"\xd7\x04\xf1\xc0!\xed\xff\xee$\xc89\x8cB0\xd1dD\xe0IP\x88\xa2\xf2Y\x9af$$\xf1cO\xf7P\xac\xca\x80:!\xb4\x94#\xcb^\x9f\'\x03\xe3\x93\xb9\x82\xbf\xcf\xc4\xe3\xf7\x03Oh\xf2r\xca\x8ff\xbb/\x9f*\xaf\x1a \xa5\xa0?%M\xa5\x86\x98\xf24\'1\xc7\f<\xcc@\xe8\x8a\xac.\xde\xe4\xc7\xf5\x9ck\xa40!\xe9\x14$\xb3\x05m\xb5m\xed\ft\x93\xd8\xa3\x80\'Y\xb9\x05\xbbt|\xbe\xbcz\n\xf3\xf5p\xf8\x9f~\x1b\xd0\v\x1cQ')
getsockopt$inet_IP_IPSEC_POLICY(r1, 0x0, 0x10, &(0x7f00000006c0)={{{@in6=@loopback}}, {{@in6=@initdev}}}, &(0x7f0000000500)=0xfffffffffffffd58)
socketpair(0x2, 0x2000000080003, 0x100, &(0x7f0000000480))
syz_genetlink_get_family_id$SEG6(&(0x7f00000003c0)='SEG6\x00')
sendmsg$SEG6_CMD_DUMPHMAC(r4, &(0x7f0000000580)={&(0x7f0000000380)={0x10, 0x0, 0x0, 0x1000000}, 0xc, &(0x7f0000000440)={&(0x7f0000000b00)=ANY=[@ANYBLOB="2300260109447a0000000000000000660000001400001a0065a455e04ea56d0a47018c8e973bcac914471474a7e0d50a000eadd66d2e49a2ed40dcafa1e046ab6aacc2097d8f75bd9c8b8a220bdde11690a0fa3f9600f22ab388644f66c2d5baec4079a81bae1927e49e91a4964656d7b227702926af5be846f3de49fad39048633fd9161123894d9427f854a30cb0532c8f31f663380e40ce7f6cb15ec8baab3b7c6fa83e211933a7591bdb8a9a13c70a76bb473cc3ef3a801c73286c98e728f6ef05c36c7e20cd874023dde1d5e8616b736d1cb956e7264b48e328404da5fe2f50ca8483e773f86e4d43f5a083639fbb00d3ebbb3dfcedf2cd4a10ac57f8f445cdc4c5742836099628e3304cb22de45f2b896455d24799dbabfcf96fc14ab561003f5b5e58c392e555c3"], 0x1}, 0x1, 0x0, 0x0, 0x8000}, 0x804)
r6 = creat(&(0x7f0000000280)='./bus\x00', 0x0)
arch_prctl$ARCH_MAP_VDSO_32(0x2002, 0x7e)
ftruncate(r6, 0x2008200)
open(&(0x7f0000000140)='./bus\x00', 0x4000, 0x0)

15:06:33 executing program 0:
r0 = socket$inet_udplite(0x2, 0x2, 0x88)
ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f3188b070")
r1 = syz_open_procfs(0x0, &(0x7f0000000080)='net/dev_mcast\x00')
lseek(r1, 0x0, 0x0)

15:06:33 executing program 0:
r0 = socket$inet_udplite(0x2, 0x2, 0x88)
ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f3188b070")
r1 = syz_open_procfs(0x0, &(0x7f0000000080)='net/dev_mcast\x00')
lseek(r1, 0x0, 0x0)

15:06:33 executing program 2:
r0 = socket$inet_udplite(0x2, 0x2, 0x88)
ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f3188b070")
syz_open_procfs(0x0, &(0x7f0000000940)='syscall\x00')
r1 = syz_open_procfs(0x0, &(0x7f0000000040)='fd\x00')
recvmmsg(0xffffffffffffffff, &(0x7f0000003840)=[{{0x0, 0x0, 0x0}}], 0x1, 0x0, 0x0)
perf_event_open(&(0x7f0000940000)={0x2, 0x70, 0xee6a, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x100, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0xff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x10001, 0x1}, 0x0, 0x400000000000000}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
mlock(&(0x7f00005b8000/0x3000)=nil, 0x3000)
ioctl$SNDRV_TIMER_IOCTL_SELECT(0xffffffffffffffff, 0x40345410, 0x0)
openat$uinput(0xffffffffffffff9c, &(0x7f0000000080)='/dev/uinput\x00', 0x2, 0x0)
mmap(&(0x7f000060b000/0x1000)=nil, 0x1000, 0x5, 0x8000400200000033, r1, 0x0)
perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x2, 0x9, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2000000, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x4000000, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8)
r2 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)={0x10b, 0x6, 0x209e1e, 0x3, 0x1}, 0x2c)
bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000b40)={r2, &(0x7f0000000040), 0x0, 0x1}, 0x20)
creat(&(0x7f0000000640)='./file0\x00', 0x100)
r3 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r4 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r4, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r4, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)})

15:06:33 executing program 4:
r0 = syz_open_procfs(0x0, &(0x7f00000001c0)='net/softnet_stat\x00')
lseek(r0, 0x20000, 0x0)
ioctl$EVIOCRMFF(r0, 0x40044581, &(0x7f0000000000)=0xffff)

15:06:33 executing program 3:
r0 = socket$inet_udplite(0x2, 0x2, 0x88)
ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f3188b070")
syz_open_procfs(0x0, &(0x7f0000000940)='syscall\x00')
r1 = syz_open_procfs(0x0, &(0x7f0000000040)='fd\x00')
recvmmsg(0xffffffffffffffff, &(0x7f0000003840)=[{{0x0, 0x0, 0x0}}], 0x1, 0x0, 0x0)
perf_event_open(&(0x7f0000940000)={0x2, 0x70, 0xee6a, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x100, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0xff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x10001, 0x1}, 0x0, 0x400000000000000}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
mlock(&(0x7f00005b8000/0x3000)=nil, 0x3000)
ioctl$SNDRV_TIMER_IOCTL_SELECT(0xffffffffffffffff, 0x40345410, 0x0)
openat$uinput(0xffffffffffffff9c, &(0x7f0000000080)='/dev/uinput\x00', 0x2, 0x0)
mmap(&(0x7f000060b000/0x1000)=nil, 0x1000, 0x5, 0x8000400200000033, r1, 0x0)
perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r2 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r3 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r3, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r3, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)})

15:06:33 executing program 0:
r0 = socket$inet_udplite(0x2, 0x2, 0x88)
ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f3188b070")
r1 = syz_open_procfs(0x0, &(0x7f0000000080)='net/dev_mcast\x00')
lseek(r1, 0x0, 0x0)

[ 1114.665412] binder: release 1254:1260 transaction 1088 out, still active
[ 1114.687898] binder: send failed reply for transaction 1088, target dead
[ 1114.700614] binder: send failed reply for transaction 1090 to 1253:1257
[ 1114.724217] binder: 1253:1268 BC_INCREFS_DONE u0000000000000000 no match
15:06:33 executing program 1:
r0 = socket$inet_udplite(0x2, 0x2, 0x88)
ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f3188b070")
syz_open_procfs(0x0, &(0x7f0000000940)='syscall\x00')
r1 = syz_open_procfs(0x0, &(0x7f0000000040)='fd\x00')
recvmmsg(0xffffffffffffffff, &(0x7f0000003840)=[{{0x0, 0x0, 0x0}}], 0x1, 0x0, 0x0)
perf_event_open(&(0x7f0000940000)={0x2, 0x70, 0xee6a, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x100, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0xff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x10001, 0x1}, 0x0, 0x400000000000000}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
mlock(&(0x7f00005b8000/0x3000)=nil, 0x3000)
ioctl$SNDRV_TIMER_IOCTL_SELECT(0xffffffffffffffff, 0x40345410, 0x0)
openat$uinput(0xffffffffffffff9c, &(0x7f0000000080)='/dev/uinput\x00', 0x2, 0x0)
mmap(&(0x7f000060b000/0x1000)=nil, 0x1000, 0x5, 0x8000400200000033, r1, 0x0)
perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x2, 0x9, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2000000, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x4000000, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8)
bpf$MAP_CREATE(0x0, &(0x7f0000000000)={0x10b, 0x6, 0x209e1e, 0x3, 0x1}, 0x2c)
r2 = creat(&(0x7f0000000640)='./file0\x00', 0x100)
setsockopt$inet6_tcp_TCP_REPAIR_QUEUE(r2, 0x6, 0x14, &(0x7f0000000980), 0x4)
unlink(&(0x7f0000000940)='./file0\x00')
r3 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_GET_NODE_DEBUG_INFO(r3, 0xc018620b, &(0x7f0000000100))
ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)})
ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0x0, 0x0, &(0x7f0000000780)})

[ 1114.764645] binder: release 1270:1274 transaction 1095 out, still active
15:06:33 executing program 3:
r0 = socket$inet_udplite(0x2, 0x2, 0x88)
ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f3188b070")
syz_open_procfs(0x0, &(0x7f0000000940)='syscall\x00')
r1 = syz_open_procfs(0x0, &(0x7f0000000040)='fd\x00')
recvmmsg(0xffffffffffffffff, &(0x7f0000003840)=[{{0x0, 0x0, 0x0}}], 0x1, 0x0, 0x0)
perf_event_open(&(0x7f0000940000)={0x2, 0x70, 0xee6a, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x100, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0xff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x10001, 0x1}, 0x0, 0x400000000000000}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
mlock(&(0x7f00005b8000/0x3000)=nil, 0x3000)
ioctl$SNDRV_TIMER_IOCTL_SELECT(0xffffffffffffffff, 0x40345410, 0x0)
openat$uinput(0xffffffffffffff9c, &(0x7f0000000080)='/dev/uinput\x00', 0x2, 0x0)
mmap(&(0x7f000060b000/0x1000)=nil, 0x1000, 0x5, 0x8000400200000033, r1, 0x0)
r2 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r3 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r3, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r3, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)})

15:06:33 executing program 2:
r0 = socket$inet_udplite(0x2, 0x2, 0x88)
ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f3188b070")
syz_open_procfs(0x0, &(0x7f0000000940)='syscall\x00')
r1 = syz_open_procfs(0x0, &(0x7f0000000040)='fd\x00')
recvmmsg(0xffffffffffffffff, &(0x7f0000003840)=[{{0x0, 0x0, 0x0}}], 0x1, 0x0, 0x0)
perf_event_open(&(0x7f0000940000)={0x2, 0x70, 0xee6a, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x100, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0xff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x10001, 0x1}, 0x0, 0x400000000000000}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
mlock(&(0x7f00005b8000/0x3000)=nil, 0x3000)
ioctl$SNDRV_TIMER_IOCTL_SELECT(0xffffffffffffffff, 0x40345410, 0x0)
openat$uinput(0xffffffffffffff9c, &(0x7f0000000080)='/dev/uinput\x00', 0x2, 0x0)
mmap(&(0x7f000060b000/0x1000)=nil, 0x1000, 0x5, 0x8000400200000033, r1, 0x0)
perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x2, 0x9, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2000000, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x4000000, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8)
r2 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)={0x10b, 0x6, 0x209e1e, 0x3, 0x1}, 0x2c)
bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000b40)={r2, &(0x7f0000000040), 0x0, 0x1}, 0x20)
r3 = creat(&(0x7f0000000640)='./file0\x00', 0x100)
setsockopt$inet6_tcp_TCP_REPAIR_QUEUE(r3, 0x6, 0x14, &(0x7f0000000980), 0x4)
unlink(&(0x7f0000000940)='./file0\x00')
r4 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r4, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r4, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)})

15:06:33 executing program 4:
r0 = syz_open_procfs(0x0, &(0x7f00000001c0)='net/softnet_stat\x00')
lseek(r0, 0x20000, 0x0)
connect$unix(r0, &(0x7f0000000000)=@abs={0x0, 0x0, 0x4e20}, 0x6e)
ioctl$PIO_UNIMAP(r0, 0x4b67, &(0x7f00000000c0)={0x1, &(0x7f0000000080)=[{0xaa, 0x4}]})

15:06:33 executing program 0:
r0 = socket$inet_udplite(0x2, 0x2, 0x88)
ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f3188b070")
syz_open_procfs(0x0, &(0x7f0000000940)='syscall\x00')
r1 = syz_open_procfs(0x0, &(0x7f0000000040)='fd\x00')
recvmmsg(0xffffffffffffffff, &(0x7f0000003840)=[{{0x0, 0x0, 0x0}}], 0x1, 0x0, 0x0)
perf_event_open(&(0x7f0000940000)={0x2, 0x70, 0xee6a, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x100, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0xff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x10001, 0x1}, 0x0, 0x400000000000000}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
mlock(&(0x7f00005b8000/0x3000)=nil, 0x3000)
ioctl$SNDRV_TIMER_IOCTL_SELECT(0xffffffffffffffff, 0x40345410, 0x0)
openat$uinput(0xffffffffffffff9c, &(0x7f0000000080)='/dev/uinput\x00', 0x2, 0x0)
mmap(&(0x7f000060b000/0x1000)=nil, 0x1000, 0x5, 0x8000400200000033, r1, 0x0)
perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x2, 0x9, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2000000, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x4000000, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8)
r2 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)={0x10b, 0x6, 0x209e1e, 0x3, 0x1}, 0x2c)
bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000b40)={r2, &(0x7f0000000040), 0x0, 0x1}, 0x20)
r3 = creat(&(0x7f0000000640)='./file0\x00', 0x100)
setsockopt$inet6_tcp_TCP_REPAIR_QUEUE(r3, 0x6, 0x14, &(0x7f0000000980), 0x4)
unlink(&(0x7f0000000940)='./file0\x00')
r4 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r5 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r5, 0x0)
ioctl$BINDER_GET_NODE_DEBUG_INFO(r4, 0xc018620b, &(0x7f0000000100))
ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f00000000c0)=ANY=[@ANYBLOB="bb8f0000"], 0x0, 0x0, 0x0})
ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)})

[ 1114.811250] binder: send failed reply for transaction 1095, target dead
[ 1114.918284] binder: release 1288:1295 transaction 1099 out, still active
[ 1114.945339] binder: 1286:1292 unknown command 36795
[ 1114.948713] binder: send failed reply for transaction 1099, target dead
[ 1114.959391] binder: send failed reply for transaction 1102 to 1284:1289
[ 1114.964247] binder: 1286:1292 ioctl c0306201 20000140 returned -22
[ 1114.974828] binder: 1284:1289 BC_INCREFS_DONE u0000000000000000 no match
[ 1114.997065] binder: 1286:1299 transaction failed 29189/-22, size 24-8 line 3117
15:06:33 executing program 4:
getpgid(0xffffffffffffffff)
getpid()
prctl$PR_GET_CHILD_SUBREAPER(0x25)
bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f00000000c0)={<r0=>0xffffffffffffffff, 0xffffffffffffff9c, 0x0, 0x1b, &(0x7f0000000080)='ekeyring[*mime_typeselinux\x00'}, 0x30)
r1 = syz_open_procfs(r0, &(0x7f0000000180)='ne\xf4/ip\xaf\x87\x94fm\x04_vif\x00\x00\x00\x00')
lseek(r1, 0x20000, 0x0)

15:06:33 executing program 3:
r0 = socket$inet_udplite(0x2, 0x2, 0x88)
ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f3188b070")
syz_open_procfs(0x0, &(0x7f0000000940)='syscall\x00')
syz_open_procfs(0x0, &(0x7f0000000040)='fd\x00')
recvmmsg(0xffffffffffffffff, &(0x7f0000003840)=[{{0x0, 0x0, 0x0}}], 0x1, 0x0, 0x0)
perf_event_open(&(0x7f0000940000)={0x2, 0x70, 0xee6a, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x100, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0xff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x10001, 0x1}, 0x0, 0x400000000000000}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
mlock(&(0x7f00005b8000/0x3000)=nil, 0x3000)
ioctl$SNDRV_TIMER_IOCTL_SELECT(0xffffffffffffffff, 0x40345410, 0x0)
openat$uinput(0xffffffffffffff9c, &(0x7f0000000080)='/dev/uinput\x00', 0x2, 0x0)
r1 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r2 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)})

15:06:33 executing program 2:
r0 = socket$inet_udplite(0x2, 0x2, 0x88)
ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f3188b070")
syz_open_procfs(0x0, &(0x7f0000000940)='syscall\x00')
r1 = syz_open_procfs(0x0, &(0x7f0000000040)='fd\x00')
recvmmsg(0xffffffffffffffff, &(0x7f0000003840)=[{{0x0, 0x0, 0x0}}], 0x1, 0x0, 0x0)
perf_event_open(&(0x7f0000940000)={0x2, 0x70, 0xee6a, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x100, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0xff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x10001, 0x1}, 0x0, 0x400000000000000}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
mlock(&(0x7f00005b8000/0x3000)=nil, 0x3000)
ioctl$SNDRV_TIMER_IOCTL_SELECT(0xffffffffffffffff, 0x40345410, 0x0)
openat$uinput(0xffffffffffffff9c, &(0x7f0000000080)='/dev/uinput\x00', 0x2, 0x0)
mmap(&(0x7f000060b000/0x1000)=nil, 0x1000, 0x5, 0x8000400200000033, r1, 0x0)
perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x2, 0x9, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2000000, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x4000000, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8)
r2 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)={0x10b, 0x6, 0x209e1e, 0x3, 0x1}, 0x2c)
bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000b40)={r2, &(0x7f0000000040), 0x0, 0x1}, 0x20)
r3 = creat(&(0x7f0000000640)='./file0\x00', 0x100)
setsockopt$inet6_tcp_TCP_REPAIR_QUEUE(r3, 0x6, 0x14, &(0x7f0000000980), 0x4)
unlink(&(0x7f0000000940)='./file0\x00')
r4 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r4, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r4, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)})

15:06:33 executing program 1:
r0 = socket$inet_udplite(0x2, 0x2, 0x88)
ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f3188b070")
syz_open_procfs(0x0, &(0x7f0000000940)='syscall\x00')
r1 = syz_open_procfs(0x0, &(0x7f0000000040)='fd\x00')
recvmmsg(0xffffffffffffffff, &(0x7f0000003840)=[{{0x0, 0x0, 0x0}}], 0x1, 0x0, 0x0)
perf_event_open(&(0x7f0000940000)={0x2, 0x70, 0xee6a, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x100, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0xff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x10001, 0x1}, 0x0, 0x400000000000000}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
mlock(&(0x7f00005b8000/0x3000)=nil, 0x3000)
ioctl$SNDRV_TIMER_IOCTL_SELECT(0xffffffffffffffff, 0x40345410, 0x0)
openat$uinput(0xffffffffffffff9c, &(0x7f0000000080)='/dev/uinput\x00', 0x2, 0x0)
mmap(&(0x7f000060b000/0x1000)=nil, 0x1000, 0x5, 0x8000400200000033, r1, 0x0)
perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x2, 0x9, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2000000, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x4000000, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8)
bpf$MAP_CREATE(0x0, &(0x7f0000000000)={0x10b, 0x6, 0x209e1e, 0x3, 0x1}, 0x2c)
r2 = creat(&(0x7f0000000640)='./file0\x00', 0x100)
setsockopt$inet6_tcp_TCP_REPAIR_QUEUE(r2, 0x6, 0x14, &(0x7f0000000980), 0x4)
unlink(&(0x7f0000000940)='./file0\x00')
r3 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_GET_NODE_DEBUG_INFO(r3, 0xc018620b, &(0x7f0000000100))
ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)})
ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0x0, 0x0, &(0x7f0000000780)})

15:06:33 executing program 5:
r0 = socket$inet_udplite(0x2, 0x2, 0x88)
ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f3188b070")
syz_open_procfs(0x0, &(0x7f0000000940)='syscall\x00')
r1 = syz_open_procfs(0x0, &(0x7f0000000040)='fd\x00')
recvmmsg(0xffffffffffffffff, &(0x7f0000003840)=[{{0x0, 0x0, 0x0}}], 0x1, 0x0, 0x0)
perf_event_open(&(0x7f0000940000)={0x2, 0x70, 0xee6a, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x100, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0xff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x10001, 0x1}, 0x0, 0x400000000000000}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
mlock(&(0x7f00005b8000/0x3000)=nil, 0x3000)
ioctl$SNDRV_TIMER_IOCTL_SELECT(0xffffffffffffffff, 0x40345410, 0x0)
openat$uinput(0xffffffffffffff9c, &(0x7f0000000080)='/dev/uinput\x00', 0x2, 0x0)
mmap(&(0x7f000060b000/0x1000)=nil, 0x1000, 0x5, 0x8000400200000033, r1, 0x0)
unshare(0xfffffffffffffffd)
r2 = getpid()
sched_setscheduler(r2, 0x5, &(0x7f00000000c0))
open$dir(&(0x7f0000000400)='./file0\x00', 0x0, 0x0)
perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f00000004c0), 0x2}, 0x0, 0x0, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r3 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000340)='memory.current\x00', 0x0, 0x0)
ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, 0x0)
socketpair(0x1, 0x20000000000001, 0x0, &(0x7f0000000100)={<r4=>0xffffffffffffffff, <r5=>0xffffffffffffffff})
ioctl$PERF_EVENT_IOC_SET_FILTER(r5, 0x8914, &(0x7f0000000300)='lo\x00\x96o\xd6Q\xb9Y\xa9\xc8J,\x00\xd2\x97\x04\x03\xdc\r')
close(r3)
rt_sigprocmask(0x2, &(0x7f0000000240)={0x6}, &(0x7f00000002c0), 0x8)
ioctl$PERF_EVENT_IOC_SET_FILTER(r5, 0x8923, &(0x7f00000008c0)='lo\x00\x96o8\x0fd\xa1\xe3\xd7]b}\x1f\xa1Y\xad4\x90\x9d`\xd2\x98\x00\x00\x00 \'Y\x17]\x15c\xcaR\xdd\x98OC\x89\x1b\xe7\x84\xe2\x05\x80w\xd2|D\x8dK\x14Bx\xcbuH\xc2\xeec\xbf<>Y\x1a\xfc\x1f9OB\x81\x89\x186\xc5q@n\xb4\xb6s\xb0\x00\x00\xfc\x00\x00\b\x00\x00\xda\xef\xecE\xec\xd5I\xb2\x9b\xfe\x8d\x90?\x00\xe9\xe4~g:\xc1\xb2aj\x96\xbb\xa7\xe2\xc0\xdc\xf9Q\b\xeb\x16\x7fT\x11\xd3\r7\xe6\"f\xcf\x8e\xabd\x0ftp\x82\xae\xd2\x15\x8e+c\xf6\xbf\xe14>\xa6-\xa5c\xde\xd7\xab\xea\x1f\xf8s2\x9cVF\xd5\x18\xfe\x0e\x8f \x01\x00\x00y.\xfc*\x82\xa5\xa1p5\xc8{\xf7\xef\xab\xe8\x99\xebw#\x8at\x1c\x80\xfc\xb0\x95\xa2\xa7\xd7,Y]E8\x83X\xf5F\xdc\x88-\xf5\xb0\xb5^\xdb\x1a\xb6\xaa\x14\xe2\xb9\rh^J-\xd1\xbaUn\x04\'l\x1b\xe0o\xdb\xc8\x91%\x1c\xb5\xbf\xb6\x90\xb4\xc2\x7f]/\xb3\xe7\xc9\'\x94\xcfIo\xdf\x04\x95\xb5\x06\x84\x1fH>\xda\xc5\x04 \x94\x88\xeb\'\xd4;6\x7f\xd9\x99-\x1b|G\x8d\xd4\xb9%\xaaQ\xa0K\x10\x03\x93\xe1\xcc\xe7m\x80\'\xf0\xa5\xed(\r\xa8\x0f&\xb1\xf3\xff0\f\x82%_\x92\x8bD\xb9\xd9\xe7\xf2\xe4\xc1i#\xdc\x87A\xb9\xc7\r\x92\xfa\x11\x11\xb5\x1f\x03\x9d\xdd\x1bj\xdf\xacg\xe3\xa0S\xd3\x8a\xe1n\x97\xea\xf5\xa0\'\v\xe9\xa0\xf1 f\xaan\xcf\xb5i\xb6d\xbc\x92\v\xd58\x16\b\xb3_:\xa4!\ny\xc4&\nWMM\xa8\xc4\v\x9f\x01o\xf4\xab&\xb6\x17\x02P\xc3!N\xf4\b\x1a~\x91V1s\xe9\xbe\x9e\x9b\'\xcde\xb3\xa1\x86\"\xd7\x04\xf1\xc0!\xed\xff\xee$\xc89\x8cB0\xd1dD\xe0IP\x88\xa2\xf2Y\x9af$$\xf1cO\xf7P\xac\xca\x80:!\xb4\x94#\xcb^\x9f\'\x03\xe3\x93\xb9\x82\xbf\xcf\xc4\xe3\xf7\x03Oh\xf2r\xca\x8ff\xbb/\x9f*\xaf\x1a \xa5\xa0?%M\xa5\x86\x98\xf24\'1\xc7\f<\xcc@\xe8\x8a\xac.\xde\xe4\xc7\xf5\x9ck\xa40!\xe9\x14$\xb3\x05m\xb5m\xed\ft\x93\xd8\xa3\x80\'Y\xb9\x05\xbbt|\xbe\xbcz\n\xf3\xf5p\xf8\x9f~\x1b\xd0\v\x1cQ')
getsockopt$inet_IP_IPSEC_POLICY(r1, 0x0, 0x10, &(0x7f00000006c0)={{{@in6=@loopback}}, {{@in6=@initdev}}}, &(0x7f0000000500)=0xe8)
socketpair(0x2, 0x2000000080003, 0x100, &(0x7f0000000480))
syz_genetlink_get_family_id$SEG6(&(0x7f00000003c0)='SEG6\x00')
sendmsg$SEG6_CMD_DUMPHMAC(r4, &(0x7f0000000580)={&(0x7f0000000380)={0x10, 0x0, 0x0, 0x1000000}, 0xc, &(0x7f0000000440)={&(0x7f00000005c0)=ANY=[@ANYBLOB="2300260109447a0000000000000000660000001400001a0065a455e04ea56d0a018c8e973bcac914471474a7e0d50a000ead00100000a2ed40dcafa1e0469a6ded04097d8f75bd9c8b8a220bdde116904efa3f9600f22ab388644f66c2d5baec4079a81bae1927e49e91a4964656d7b227702926af9e4de888315be846f3de49fad39048633fd9161123894d9427f854a30cb0532c8f31f663380e40ce7f6cb15ec8ba"], 0x1}, 0x1, 0x0, 0x0, 0x8000}, 0x804)
r6 = creat(&(0x7f0000000280)='./bus\x00', 0x0)
arch_prctl$ARCH_MAP_VDSO_32(0x2002, 0x7e)
ftruncate(r6, 0x2008200)
open(&(0x7f00000007c0)='./file0/file0\x00', 0x0, 0x0)

15:06:33 executing program 0:
r0 = socket$inet_udplite(0x2, 0x2, 0x88)
ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f3188b070")
syz_open_procfs(0x0, &(0x7f0000000940)='syscall\x00')
r1 = syz_open_procfs(0x0, &(0x7f0000000040)='fd\x00')
recvmmsg(0xffffffffffffffff, &(0x7f0000003840)=[{{0x0, 0x0, 0x0}}], 0x1, 0x0, 0x0)
perf_event_open(&(0x7f0000940000)={0x2, 0x70, 0xee6a, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x100, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0xff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x10001, 0x1}, 0x0, 0x400000000000000}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
mlock(&(0x7f00005b8000/0x3000)=nil, 0x3000)
ioctl$SNDRV_TIMER_IOCTL_SELECT(0xffffffffffffffff, 0x40345410, 0x0)
openat$uinput(0xffffffffffffff9c, &(0x7f0000000080)='/dev/uinput\x00', 0x2, 0x0)
mmap(&(0x7f000060b000/0x1000)=nil, 0x1000, 0x5, 0x8000400200000033, r1, 0x0)
perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x2, 0x9, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2000000, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x4000000, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8)
r2 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)={0x10b, 0x6, 0x209e1e, 0x3, 0x1}, 0x2c)
bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000b40)={r2, &(0x7f0000000040), 0x0, 0x1}, 0x20)
r3 = creat(&(0x7f0000000640)='./file0\x00', 0x100)
setsockopt$inet6_tcp_TCP_REPAIR_QUEUE(r3, 0x6, 0x14, &(0x7f0000000980), 0x4)
unlink(&(0x7f0000000940)='./file0\x00')
r4 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r5 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r5, 0x0)
ioctl$BINDER_GET_NODE_DEBUG_INFO(r4, 0xc018620b, &(0x7f0000000100))
ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f00000000c0)=ANY=[@ANYBLOB="bb8f0000"], 0x0, 0x0, 0x0})
ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)})
ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0x0, 0x0, &(0x7f0000000780)})

[ 1115.143410] binder: release 1311:1316 transaction 1107 out, still active
15:06:34 executing program 3:
r0 = socket$inet_udplite(0x2, 0x2, 0x88)
ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f3188b070")
syz_open_procfs(0x0, &(0x7f0000000940)='syscall\x00')
syz_open_procfs(0x0, &(0x7f0000000040)='fd\x00')
recvmmsg(0xffffffffffffffff, &(0x7f0000003840)=[{{0x0, 0x0, 0x0}}], 0x1, 0x0, 0x0)
perf_event_open(&(0x7f0000940000)={0x2, 0x70, 0xee6a, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x100, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0xff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x10001, 0x1}, 0x0, 0x400000000000000}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
mlock(&(0x7f00005b8000/0x3000)=nil, 0x3000)
ioctl$SNDRV_TIMER_IOCTL_SELECT(0xffffffffffffffff, 0x40345410, 0x0)
r1 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r2 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)})

15:06:34 executing program 4:
r0 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vga_arbiter\x00', 0x80000, 0x0)
lseek(r0, 0x20000, 0x3)

[ 1115.184933] binder: send failed reply for transaction 1107, target dead
[ 1115.194979] binder: 1312:1314 unknown command 36795
[ 1115.211453] binder: 1312:1314 ioctl c0306201 20000140 returned -22
[ 1115.216649] binder: 1309:1315 transaction failed 29189/-22, size 24-8 line 3117
15:06:34 executing program 2:
r0 = socket$inet_udplite(0x2, 0x2, 0x88)
ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f3188b070")
syz_open_procfs(0x0, &(0x7f0000000940)='syscall\x00')
r1 = syz_open_procfs(0x0, &(0x7f0000000040)='fd\x00')
recvmmsg(0xffffffffffffffff, &(0x7f0000003840)=[{{0x0, 0x0, 0x0}}], 0x1, 0x0, 0x0)
perf_event_open(&(0x7f0000940000)={0x2, 0x70, 0xee6a, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x100, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0xff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x10001, 0x1}, 0x0, 0x400000000000000}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
mlock(&(0x7f00005b8000/0x3000)=nil, 0x3000)
ioctl$SNDRV_TIMER_IOCTL_SELECT(0xffffffffffffffff, 0x40345410, 0x0)
openat$uinput(0xffffffffffffff9c, &(0x7f0000000080)='/dev/uinput\x00', 0x2, 0x0)
mmap(&(0x7f000060b000/0x1000)=nil, 0x1000, 0x5, 0x8000400200000033, r1, 0x0)
perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x2, 0x9, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2000000, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x4000000, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8)
r2 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)={0x10b, 0x6, 0x209e1e, 0x3, 0x1}, 0x2c)
bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000b40)={r2, &(0x7f0000000040), 0x0, 0x1}, 0x20)
r3 = creat(&(0x7f0000000640)='./file0\x00', 0x100)
setsockopt$inet6_tcp_TCP_REPAIR_QUEUE(r3, 0x6, 0x14, &(0x7f0000000980), 0x4)
unlink(&(0x7f0000000940)='./file0\x00')
r4 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r4, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r4, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)})

15:06:34 executing program 1:
r0 = socket$inet_udplite(0x2, 0x2, 0x88)
ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f3188b070")
syz_open_procfs(0x0, &(0x7f0000000940)='syscall\x00')
r1 = syz_open_procfs(0x0, &(0x7f0000000040)='fd\x00')
recvmmsg(0xffffffffffffffff, &(0x7f0000003840)=[{{0x0, 0x0, 0x0}}], 0x1, 0x0, 0x0)
perf_event_open(&(0x7f0000940000)={0x2, 0x70, 0xee6a, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x100, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0xff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x10001, 0x1}, 0x0, 0x400000000000000}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
mlock(&(0x7f00005b8000/0x3000)=nil, 0x3000)
ioctl$SNDRV_TIMER_IOCTL_SELECT(0xffffffffffffffff, 0x40345410, 0x0)
openat$uinput(0xffffffffffffff9c, &(0x7f0000000080)='/dev/uinput\x00', 0x2, 0x0)
mmap(&(0x7f000060b000/0x1000)=nil, 0x1000, 0x5, 0x8000400200000033, r1, 0x0)
perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x2, 0x9, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2000000, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x4000000, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8)
bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000b40)={0xffffffffffffffff, &(0x7f0000000040), 0x0, 0x1}, 0x20)
r2 = creat(&(0x7f0000000640)='./file0\x00', 0x100)
setsockopt$inet6_tcp_TCP_REPAIR_QUEUE(r2, 0x6, 0x14, &(0x7f0000000980), 0x4)
unlink(&(0x7f0000000940)='./file0\x00')
r3 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_GET_NODE_DEBUG_INFO(r3, 0xc018620b, &(0x7f0000000100))
ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)})
ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0x0, 0x0, &(0x7f0000000780)})

[ 1115.239078] binder: 1312:1314 transaction failed 29189/-22, size 24-8 line 3117
[ 1115.249694] binder: 1309:1315 BC_INCREFS_DONE u0000000000000000 no match
[ 1115.268937] binder: release 1323:1325 transaction 1113 out, still active
15:06:34 executing program 3:
r0 = socket$inet_udplite(0x2, 0x2, 0x88)
ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f3188b070")
syz_open_procfs(0x0, &(0x7f0000000940)='syscall\x00')
syz_open_procfs(0x0, &(0x7f0000000040)='fd\x00')
recvmmsg(0xffffffffffffffff, &(0x7f0000003840)=[{{0x0, 0x0, 0x0}}], 0x1, 0x0, 0x0)
perf_event_open(&(0x7f0000940000)={0x2, 0x70, 0xee6a, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x100, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0xff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x10001, 0x1}, 0x0, 0x400000000000000}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
mlock(&(0x7f00005b8000/0x3000)=nil, 0x3000)
r1 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r2 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)})

15:06:34 executing program 0:
r0 = socket$inet_udplite(0x2, 0x2, 0x88)
ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f3188b070")
syz_open_procfs(0x0, &(0x7f0000000940)='syscall\x00')
r1 = syz_open_procfs(0x0, &(0x7f0000000040)='fd\x00')
recvmmsg(0xffffffffffffffff, &(0x7f0000003840)=[{{0x0, 0x0, 0x0}}], 0x1, 0x0, 0x0)
perf_event_open(&(0x7f0000940000)={0x2, 0x70, 0xee6a, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x100, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0xff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x10001, 0x1}, 0x0, 0x400000000000000}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
mlock(&(0x7f00005b8000/0x3000)=nil, 0x3000)
ioctl$SNDRV_TIMER_IOCTL_SELECT(0xffffffffffffffff, 0x40345410, 0x0)
openat$uinput(0xffffffffffffff9c, &(0x7f0000000080)='/dev/uinput\x00', 0x2, 0x0)
mmap(&(0x7f000060b000/0x1000)=nil, 0x1000, 0x5, 0x8000400200000033, r1, 0x0)
perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x2, 0x9, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2000000, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x4000000, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8)
r2 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)={0x10b, 0x6, 0x209e1e, 0x3, 0x1}, 0x2c)
bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000b40)={r2, &(0x7f0000000040), 0x0, 0x1}, 0x20)
r3 = creat(&(0x7f0000000640)='./file0\x00', 0x100)
setsockopt$inet6_tcp_TCP_REPAIR_QUEUE(r3, 0x6, 0x14, &(0x7f0000000980), 0x4)
unlink(&(0x7f0000000940)='./file0\x00')
r4 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r5 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r5, 0x0)
ioctl$BINDER_GET_NODE_DEBUG_INFO(r4, 0xc018620b, &(0x7f0000000100))
ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f00000000c0)=ANY=[@ANYBLOB="bb8f0000"], 0x0, 0x0, 0x0})
ioctl$BINDER_SET_CONTEXT_MGR(r5, 0x40046207, 0x0)
shutdown(0xffffffffffffffff, 0x1)
prctl$PR_SET_NAME(0xf, &(0x7f0000000380)='/group.stat\x00')
ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)})

[ 1115.290018] binder: 1312:1327 BC_INCREFS_DONE u0000000000000000 no match
[ 1115.290634] binder: send failed reply for transaction 1113, target dead
15:06:34 executing program 3:
r0 = socket$inet_udplite(0x2, 0x2, 0x88)
ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f3188b070")
syz_open_procfs(0x0, &(0x7f0000000940)='syscall\x00')
syz_open_procfs(0x0, &(0x7f0000000040)='fd\x00')
recvmmsg(0xffffffffffffffff, &(0x7f0000003840)=[{{0x0, 0x0, 0x0}}], 0x1, 0x0, 0x0)
perf_event_open(&(0x7f0000940000)={0x2, 0x70, 0xee6a, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x100, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0xff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x10001, 0x1}, 0x0, 0x400000000000000}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r1 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r2 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)})

15:06:34 executing program 4:
r0 = socket(0x2, 0x803, 0x9)
sendmsg$TIPC_NL_BEARER_DISABLE(r0, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={0x0}}, 0x20048001)
r1 = syz_open_procfs(0x0, &(0x7f00000001c0)='net/softnet_stat\x00')
ppoll(&(0x7f0000000000)=[{r1, 0x8}, {r1, 0x4000}, {r1, 0x10}], 0x3, &(0x7f0000000040), &(0x7f0000000080)={0x5}, 0x8)
lseek(r1, 0x20000, 0x0)
open(&(0x7f00000000c0)='./file0\x00', 0x40000, 0x2)
r2 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000140)='IPVS\x00')
sendmsg$IPVS_CMD_SET_CONFIG(r0, &(0x7f0000000200)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x200000}, 0xc, &(0x7f0000000180)={&(0x7f0000000300)={0x118, r2, 0x10, 0x70bd26, 0x25dfdbfb, {}, [@IPVS_CMD_ATTR_SERVICE={0x10, 0x1, [@IPVS_SVC_ATTR_FLAGS={0xc, 0x7, {0x36, 0x4}}]}, @IPVS_CMD_ATTR_DEST={0x28, 0x2, [@IPVS_DEST_ATTR_L_THRESH={0x8, 0x6, 0x4}, @IPVS_DEST_ATTR_PORT={0x8, 0x2, 0x4e24}, @IPVS_DEST_ATTR_ADDR={0x14, 0x1, @ipv4=@local}]}, @IPVS_CMD_ATTR_TIMEOUT_TCP_FIN={0x8, 0x5, 0x100000000}, @IPVS_CMD_ATTR_SERVICE={0xc, 0x1, [@IPVS_SVC_ATTR_TIMEOUT={0x8, 0x8, 0x7}]}, @IPVS_CMD_ATTR_DEST={0x2c, 0x2, [@IPVS_DEST_ATTR_PERSIST_CONNS={0x8, 0x9, 0x3}, @IPVS_DEST_ATTR_U_THRESH={0x8, 0x5, 0x5}, @IPVS_DEST_ATTR_ADDR_FAMILY={0x8, 0xb, 0xa}, @IPVS_DEST_ATTR_FWD_METHOD={0x8}, @IPVS_DEST_ATTR_FWD_METHOD={0x8}]}, @IPVS_CMD_ATTR_TIMEOUT_TCP_FIN={0x8, 0x5, 0x2}, @IPVS_CMD_ATTR_DEST={0x5c, 0x2, [@IPVS_DEST_ATTR_WEIGHT={0x8, 0x4, 0x200}, @IPVS_DEST_ATTR_PORT={0x8, 0x2, 0x4e23}, @IPVS_DEST_ATTR_PORT={0x8, 0x2, 0x4e22}, @IPVS_DEST_ATTR_WEIGHT={0x8, 0x4, 0x2}, @IPVS_DEST_ATTR_INACT_CONNS={0x8, 0x8, 0x1}, @IPVS_DEST_ATTR_FWD_METHOD={0x8, 0x3, 0x4}, @IPVS_DEST_ATTR_ADDR={0x14, 0x1, @ipv6=@rand_addr="d0931a9d100ef3ca31757d55964c68f9"}, @IPVS_DEST_ATTR_ADDR={0x14, 0x1, @ipv4=@multicast2}]}, @IPVS_CMD_ATTR_TIMEOUT_TCP={0x8, 0x4, 0x7}, @IPVS_CMD_ATTR_SERVICE={0x20, 0x1, [@IPVS_SVC_ATTR_AF={0x8, 0x1, 0x2}, @IPVS_SVC_ATTR_ADDR={0x14, 0x3, @ipv6=@empty}]}]}, 0x118}, 0x1, 0x0, 0x0, 0x800}, 0x20000010)

15:06:34 executing program 2:
r0 = socket$inet_udplite(0x2, 0x2, 0x88)
ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f3188b070")
syz_open_procfs(0x0, &(0x7f0000000940)='syscall\x00')
r1 = syz_open_procfs(0x0, &(0x7f0000000040)='fd\x00')
recvmmsg(0xffffffffffffffff, &(0x7f0000003840)=[{{0x0, 0x0, 0x0}}], 0x1, 0x0, 0x0)
perf_event_open(&(0x7f0000940000)={0x2, 0x70, 0xee6a, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x100, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0xff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x10001, 0x1}, 0x0, 0x400000000000000}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
mlock(&(0x7f00005b8000/0x3000)=nil, 0x3000)
ioctl$SNDRV_TIMER_IOCTL_SELECT(0xffffffffffffffff, 0x40345410, 0x0)
openat$uinput(0xffffffffffffff9c, &(0x7f0000000080)='/dev/uinput\x00', 0x2, 0x0)
mmap(&(0x7f000060b000/0x1000)=nil, 0x1000, 0x5, 0x8000400200000033, r1, 0x0)
perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x2, 0x9, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2000000, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x4000000, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8)
r2 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)={0x10b, 0x6, 0x209e1e, 0x3, 0x1}, 0x2c)
bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000b40)={r2, &(0x7f0000000040), 0x0, 0x1}, 0x20)
r3 = creat(&(0x7f0000000640)='./file0\x00', 0x100)
setsockopt$inet6_tcp_TCP_REPAIR_QUEUE(r3, 0x6, 0x14, &(0x7f0000000980), 0x4)
unlink(&(0x7f0000000940)='./file0\x00')
r4 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r5 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r5, 0x0)
ioctl$BINDER_GET_NODE_DEBUG_INFO(r4, 0xc018620b, &(0x7f0000000100))
ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f00000000c0)=ANY=[@ANYBLOB="bb8f0000"], 0x0, 0x0, 0x0})
ioctl$BINDER_SET_CONTEXT_MGR(r5, 0x40046207, 0x0)
shutdown(0xffffffffffffffff, 0x1)
prctl$PR_SET_NAME(0xf, &(0x7f0000000380)='/group.stat\x00')
ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)})

[ 1115.398109] binder: release 1335:1341 transaction 1117 out, still active
[ 1115.429343] binder: send failed reply for transaction 1117, target dead
[ 1115.461581] binder: 1334:1339 transaction failed 29189/-22, size 24-8 line 3117
[ 1115.472433] binder: 1334:1339 BC_INCREFS_DONE u0000000000000000 no match
[ 1115.495845] binder: 1338:1342 unknown command 36795
15:06:34 executing program 1:
r0 = socket$inet_udplite(0x2, 0x2, 0x88)
ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f3188b070")
syz_open_procfs(0x0, &(0x7f0000000940)='syscall\x00')
r1 = syz_open_procfs(0x0, &(0x7f0000000040)='fd\x00')
recvmmsg(0xffffffffffffffff, &(0x7f0000003840)=[{{0x0, 0x0, 0x0}}], 0x1, 0x0, 0x0)
perf_event_open(&(0x7f0000940000)={0x2, 0x70, 0xee6a, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x100, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0xff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x10001, 0x1}, 0x0, 0x400000000000000}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
mlock(&(0x7f00005b8000/0x3000)=nil, 0x3000)
ioctl$SNDRV_TIMER_IOCTL_SELECT(0xffffffffffffffff, 0x40345410, 0x0)
openat$uinput(0xffffffffffffff9c, &(0x7f0000000080)='/dev/uinput\x00', 0x2, 0x0)
mmap(&(0x7f000060b000/0x1000)=nil, 0x1000, 0x5, 0x8000400200000033, r1, 0x0)
perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x2, 0x9, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2000000, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x4000000, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8)
bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000b40)={0xffffffffffffffff, &(0x7f0000000040), 0x0, 0x1}, 0x20)
r2 = creat(&(0x7f0000000640)='./file0\x00', 0x100)
setsockopt$inet6_tcp_TCP_REPAIR_QUEUE(r2, 0x6, 0x14, &(0x7f0000000980), 0x4)
unlink(&(0x7f0000000940)='./file0\x00')
r3 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_GET_NODE_DEBUG_INFO(r3, 0xc018620b, &(0x7f0000000100))
ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)})
ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0x0, 0x0, &(0x7f0000000780)})

[ 1115.512100] binder: 1338:1342 ioctl c0306201 20000140 returned -22
[ 1115.513321] binder: release 1345:1348 transaction 1122 out, still active
[ 1115.525533] binder: BINDER_SET_CONTEXT_MGR already set
[ 1115.538284] binder: 1338:1342 ioctl 40046207 0 returned -16
[ 1115.546930] binder: send failed reply for transaction 1122, target dead
[ 1115.562737] binder: 1338:1342 transaction failed 29189/-22, size 24-8 line 3117
15:06:34 executing program 5:
r0 = socket$inet_udplite(0x2, 0x2, 0x88)
ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f3188b070")
syz_open_procfs(0x0, &(0x7f0000000940)='syscall\x00')
r1 = syz_open_procfs(0x0, &(0x7f0000000040)='fd\x00')
recvmmsg(0xffffffffffffffff, &(0x7f0000003840)=[{{0x0, 0x0, 0x0}}], 0x1, 0x0, 0x0)
perf_event_open(&(0x7f0000940000)={0x2, 0x70, 0xee6a, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x100, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0xff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x10001, 0x1}, 0x0, 0x400000000000000}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
mlock(&(0x7f00005b8000/0x3000)=nil, 0x3000)
ioctl$SNDRV_TIMER_IOCTL_SELECT(0xffffffffffffffff, 0x40345410, 0x0)
openat$uinput(0xffffffffffffff9c, &(0x7f0000000080)='/dev/uinput\x00', 0x2, 0x0)
mmap(&(0x7f000060b000/0x1000)=nil, 0x1000, 0x5, 0x8000400200000033, r1, 0x0)
unshare(0xfffffffffffffffd)
r2 = getpid()
sched_setscheduler(r2, 0x5, &(0x7f00000000c0))
open$dir(&(0x7f0000000400)='./file0\x00', 0x0, 0x0)
perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f00000004c0), 0x2}, 0x0, 0x0, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r3 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000340)='memory.current\x00', 0x0, 0x0)
ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, 0x0)
socketpair(0x1, 0x20000000000001, 0x0, &(0x7f0000000100)={<r4=>0xffffffffffffffff, <r5=>0xffffffffffffffff})
ioctl$PERF_EVENT_IOC_SET_FILTER(r5, 0x8914, &(0x7f0000000300)='lo\x00\x96o\xd6Q\xb9Y\xa9\xc8J,\x00\xd2\x97\x04\x03\xdc\r')
close(r3)
rt_sigprocmask(0x2, &(0x7f0000000240)={0x6}, &(0x7f00000002c0), 0x8)
ioctl$PERF_EVENT_IOC_SET_FILTER(r5, 0x8923, &(0x7f00000008c0)='lo\x00\x96o8\x0fd\xa1\xe3\xd7]b}\x1f\xa1Y\xad4\x90\x9d`\xd2\x98\x00\x00\x00 \'Y\x17]\x15c\xcaR\xdd\x98OC\x89\x1b\xe7\x84\xe2\x05\x80w\xd2|D\x8dK\x14Bx\xcbuH\xc2\xeec\xbf<>Y\x1a\xfc\x1f9OB\x81\x89\x186\xc5q@n\xb4\xb6s\xb0\x00\x00\xfc\x00\x00\b\x00\x00\xda\xef\xecE\xec\xd5I\xb2\x9b\xfe\x8d\x90?\x00\xe9\xe4~g:\xc1\xb2aj\x96\xbb\xa7\xe2\xc0\xdc\xf9Q\b\xeb\x16\x7fT\x11\xd3\r7\xe6\"f\xcf\x8e\xabd\x0ftp\x82\xae\xd2\x15\x8e+c\xf6\xbf\xe14>\xa6-\xa5c\xde\xd7\xab\xea\x1f\xf8s2\x9cVF\xd5\x18\xfe\x0e\x8f \x01\x00\x00y.\xfc*\x82\xa5\xa1p5\xc8{\xf7\xef\xab\xe8\x99\xebw#\x8at\x1c\x80\xfc\xb0\x95\xa2\xa7\xd7,Y]E8\x83X\xf5F\xdc\x88-\xf5\xb0\xb5^\xdb\x1a\xb6\xaa\x14\xe2\xb9\rh^J-\xd1\xbaUn\x04\'l\x1b\xe0o\xdb\xc8\x91%\x1c\xb5\xbf\xb6\x90\xb4\xc2\x7f]/\xb3\xe7\xc9\'\x94\xcfIo\xdf\x04\x95\xb5\x06\x84\x1fH>\xda\xc5\x04 \x94\x88\xeb\'\xd4;6\x7f\xd9\x99-\x1b|G\x8d\xd4\xb9%\xaaQ\xa0K\x10\x03\x93\xe1\xcc\xe7m\x80\'\xf0\xa5\xed(\r\xa8\x0f&\xb1\xf3\xff0\f\x82%_\x92\x8bD\xb9\xd9\xe7\xf2\xe4\xc1i#\xdc\x87A\xb9\xc7\r\x92\xfa\x11\x11\xb5\x1f\x03\x9d\xdd\x1bj\xdf\xacg\xe3\xa0S\xd3\x8a\xe1n\x97\xea\xf5\xa0\'\v\xe9\xa0\xf1 f\xaan\xcf\xb5i\xb6d\xbc\x92\v\xd58\x16\b\xb3_:\xa4!\ny\xc4&\nWMM\xa8\xc4\v\x9f\x01o\xf4\xab&\xb6\x17\x02P\xc3!N\xf4\b\x1a~\x91V1s\xe9\xbe\x9e\x9b\'\xcde\xb3\xa1\x86\"\xd7\x04\xf1\xc0!\xed\xff\xee$\xc89\x8cB0\xd1dD\xe0IP\x88\xa2\xf2Y\x9af$$\xf1cO\xf7P\xac\xca\x80:!\xb4\x94#\xcb^\x9f\'\x03\xe3\x93\xb9\x82\xbf\xcf\xc4\xe3\xf7\x03Oh\xf2r\xca\x8ff\xbb/\x9f*\xaf\x1a \xa5\xa0?%M\xa5\x86\x98\xf24\'1\xc7\f<\xcc@\xe8\x8a\xac.\xde\xe4\xc7\xf5\x9ck\xa40!\xe9\x14$\xb3\x05m\xb5m\xed\ft\x93\xd8\xa3\x80\'Y\xb9\x05\xbbt|\xbe\xbcz\n\xf3\xf5p\xf8\x9f~\x1b\xd0\v\x1cQ')
getsockopt$inet_IP_IPSEC_POLICY(r1, 0x0, 0x10, &(0x7f00000006c0)={{{@in6=@loopback}}, {{@in6=@initdev}}}, &(0x7f0000000500)=0xe8)
socketpair(0x2, 0x2000000080003, 0x100, &(0x7f0000000480))
syz_genetlink_get_family_id$SEG6(&(0x7f00000003c0)='SEG6\x00')
sendmsg$SEG6_CMD_DUMPHMAC(r4, &(0x7f0000000580)={&(0x7f0000000380)={0x10, 0x0, 0x0, 0x1000000}, 0xc, &(0x7f0000000440)={&(0x7f00000005c0)=ANY=[@ANYBLOB="2300260109447a0000000000000000660000001400001a0065a455e04ea56d0a47018c8e973bcac914471474a7e0d50a000eadd66d2e49a2ed40dcafa1e046ab6aacc2097d8f75bd9c8b8a220bdde116904efa3f9600f22ab388644f66c2d5baec4079a81bae1927e49e91a4964656d7b227702926af5be846f3de49fad39048633fd9161123894d9427f854a30cb0532c8f31f663380e40ce7f6cb15ec8baab3b7c6f"], 0x1}, 0x1, 0x0, 0x0, 0x8000}, 0x804)
r6 = creat(&(0x7f0000000280)='./bus\x00', 0x0)
arch_prctl$ARCH_MAP_VDSO_32(0x2002, 0x7e)
ftruncate(r6, 0x2008200)
open(&(0x7f0000000200)='./bus\x00', 0x4000, 0x0)

15:06:34 executing program 3:
r0 = socket$inet_udplite(0x2, 0x2, 0x88)
ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f3188b070")
syz_open_procfs(0x0, &(0x7f0000000940)='syscall\x00')
syz_open_procfs(0x0, &(0x7f0000000040)='fd\x00')
recvmmsg(0xffffffffffffffff, &(0x7f0000003840)=[{{0x0, 0x0, 0x0}}], 0x1, 0x0, 0x0)
r1 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r2 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)})

15:06:34 executing program 0:
r0 = socket$inet_udplite(0x2, 0x2, 0x88)
ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f3188b070")
syz_open_procfs(0x0, &(0x7f0000000940)='syscall\x00')
r1 = syz_open_procfs(0x0, &(0x7f0000000040)='fd\x00')
recvmmsg(0xffffffffffffffff, &(0x7f0000003840)=[{{0x0, 0x0, 0x0}}], 0x1, 0x0, 0x0)
perf_event_open(&(0x7f0000940000)={0x2, 0x70, 0xee6a, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x100, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0xff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x10001, 0x1}, 0x0, 0x400000000000000}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
mlock(&(0x7f00005b8000/0x3000)=nil, 0x3000)
ioctl$SNDRV_TIMER_IOCTL_SELECT(0xffffffffffffffff, 0x40345410, 0x0)
openat$uinput(0xffffffffffffff9c, &(0x7f0000000080)='/dev/uinput\x00', 0x2, 0x0)
mmap(&(0x7f000060b000/0x1000)=nil, 0x1000, 0x5, 0x8000400200000033, r1, 0x0)
perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x2, 0x9, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2000000, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x4000000, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8)
r2 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)={0x10b, 0x6, 0x209e1e, 0x3, 0x1}, 0x2c)
bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000b40)={r2, &(0x7f0000000040), 0x0, 0x1}, 0x20)
r3 = creat(&(0x7f0000000640)='./file0\x00', 0x100)
setsockopt$inet6_tcp_TCP_REPAIR_QUEUE(r3, 0x6, 0x14, &(0x7f0000000980), 0x4)
unlink(&(0x7f0000000940)='./file0\x00')
r4 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r5 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r5, 0x0)
ioctl$BINDER_GET_NODE_DEBUG_INFO(r4, 0xc018620b, &(0x7f0000000100))
ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f00000000c0)=ANY=[@ANYBLOB="bb8f0000"], 0x0, 0x0, 0x0})
ioctl$BINDER_SET_CONTEXT_MGR(r5, 0x40046207, 0x0)
shutdown(0xffffffffffffffff, 0x1)
prctl$PR_SET_NAME(0xf, &(0x7f0000000380)='/group.stat\x00')
ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)})
ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0x0, 0x0, &(0x7f0000000780)})

15:06:34 executing program 2:
r0 = socket$inet_udplite(0x2, 0x2, 0x88)
ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f3188b070")
syz_open_procfs(0x0, &(0x7f0000000940)='syscall\x00')
r1 = syz_open_procfs(0x0, &(0x7f0000000040)='fd\x00')
recvmmsg(0xffffffffffffffff, &(0x7f0000003840)=[{{0x0, 0x0, 0x0}}], 0x1, 0x0, 0x0)
perf_event_open(&(0x7f0000940000)={0x2, 0x70, 0xee6a, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x100, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0xff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x10001, 0x1}, 0x0, 0x400000000000000}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
mlock(&(0x7f00005b8000/0x3000)=nil, 0x3000)
ioctl$SNDRV_TIMER_IOCTL_SELECT(0xffffffffffffffff, 0x40345410, 0x0)
openat$uinput(0xffffffffffffff9c, &(0x7f0000000080)='/dev/uinput\x00', 0x2, 0x0)
mmap(&(0x7f000060b000/0x1000)=nil, 0x1000, 0x5, 0x8000400200000033, r1, 0x0)
perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x2, 0x9, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2000000, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x4000000, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8)
r2 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)={0x10b, 0x6, 0x209e1e, 0x3, 0x1}, 0x2c)
bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000b40)={r2, &(0x7f0000000040), 0x0, 0x1}, 0x20)
r3 = creat(&(0x7f0000000640)='./file0\x00', 0x100)
setsockopt$inet6_tcp_TCP_REPAIR_QUEUE(r3, 0x6, 0x14, &(0x7f0000000980), 0x4)
unlink(&(0x7f0000000940)='./file0\x00')
r4 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r5 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r5, 0x0)
ioctl$BINDER_GET_NODE_DEBUG_INFO(r4, 0xc018620b, &(0x7f0000000100))
ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f00000000c0)=ANY=[@ANYBLOB="bb8f0000"], 0x0, 0x0, 0x0})
ioctl$BINDER_SET_CONTEXT_MGR(r5, 0x40046207, 0x0)
shutdown(0xffffffffffffffff, 0x1)
prctl$PR_SET_NAME(0xf, &(0x7f0000000380)='/group.stat\x00')
ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)})

15:06:34 executing program 4:
r0 = syz_open_procfs(0x0, &(0x7f0000000000)='net/l2cap\x00')
lseek(r0, 0x20000, 0x0)

15:06:34 executing program 1:
r0 = socket$inet_udplite(0x2, 0x2, 0x88)
ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f3188b070")
syz_open_procfs(0x0, &(0x7f0000000940)='syscall\x00')
r1 = syz_open_procfs(0x0, &(0x7f0000000040)='fd\x00')
recvmmsg(0xffffffffffffffff, &(0x7f0000003840)=[{{0x0, 0x0, 0x0}}], 0x1, 0x0, 0x0)
perf_event_open(&(0x7f0000940000)={0x2, 0x70, 0xee6a, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x100, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0xff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x10001, 0x1}, 0x0, 0x400000000000000}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
mlock(&(0x7f00005b8000/0x3000)=nil, 0x3000)
ioctl$SNDRV_TIMER_IOCTL_SELECT(0xffffffffffffffff, 0x40345410, 0x0)
openat$uinput(0xffffffffffffff9c, &(0x7f0000000080)='/dev/uinput\x00', 0x2, 0x0)
mmap(&(0x7f000060b000/0x1000)=nil, 0x1000, 0x5, 0x8000400200000033, r1, 0x0)
perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x2, 0x9, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2000000, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x4000000, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8)
bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000b40)={0xffffffffffffffff, &(0x7f0000000040), 0x0, 0x1}, 0x20)
r2 = creat(&(0x7f0000000640)='./file0\x00', 0x100)
setsockopt$inet6_tcp_TCP_REPAIR_QUEUE(r2, 0x6, 0x14, &(0x7f0000000980), 0x4)
unlink(&(0x7f0000000940)='./file0\x00')
r3 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_GET_NODE_DEBUG_INFO(r3, 0xc018620b, &(0x7f0000000100))
ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)})
ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0x0, 0x0, &(0x7f0000000780)})

[ 1115.666771] binder: 1356:1358 transaction failed 29189/-22, size 24-8 line 3117
[ 1115.685440] binder: 1356:1358 BC_INCREFS_DONE u0000000000000000 no match
[ 1115.758416] binder: release 1366:1371 transaction 1128 out, still active
15:06:34 executing program 3:
r0 = socket$inet_udplite(0x2, 0x2, 0x88)
ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f3188b070")
syz_open_procfs(0x0, &(0x7f0000000940)='syscall\x00')
syz_open_procfs(0x0, &(0x7f0000000040)='fd\x00')
r1 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r2 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)})

15:06:34 executing program 4:
bpf$BPF_GET_PROG_INFO(0xf, &(0x7f0000000000)={0xffffffffffffff9c, 0x50, &(0x7f0000001180)={0x0, <r0=>0x0}}, 0x10)
bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f00000010c0)={0x0, 0xffffffffffffff9c, 0x0, 0x8, &(0x7f0000000080)='net/hci\x00', r0}, 0x31c65c39946c4329)
ioctl$TIOCGPGRP(0xffffffffffffffff, 0x540f, &(0x7f0000001100)=<r1=>0x0)
r2 = syz_open_procfs(r1, &(0x7f0000001140)='net/nfsfs\x00')
ioctl$ASHMEM_GET_NAME(r2, 0x81007702, &(0x7f00000000c0)=""/4096)
ioctl$ASHMEM_GET_PROT_MASK(r2, 0x7706, &(0x7f0000000040))
lseek(r2, 0x20000, 0x2)

15:06:34 executing program 2:
r0 = socket$inet_udplite(0x2, 0x2, 0x88)
ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f3188b070")
syz_open_procfs(0x0, &(0x7f0000000940)='syscall\x00')
r1 = syz_open_procfs(0x0, &(0x7f0000000040)='fd\x00')
recvmmsg(0xffffffffffffffff, &(0x7f0000003840)=[{{0x0, 0x0, 0x0}}], 0x1, 0x0, 0x0)
perf_event_open(&(0x7f0000940000)={0x2, 0x70, 0xee6a, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x100, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0xff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x10001, 0x1}, 0x0, 0x400000000000000}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
mlock(&(0x7f00005b8000/0x3000)=nil, 0x3000)
ioctl$SNDRV_TIMER_IOCTL_SELECT(0xffffffffffffffff, 0x40345410, 0x0)
openat$uinput(0xffffffffffffff9c, &(0x7f0000000080)='/dev/uinput\x00', 0x2, 0x0)
mmap(&(0x7f000060b000/0x1000)=nil, 0x1000, 0x5, 0x8000400200000033, r1, 0x0)
perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x2, 0x9, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2000000, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x4000000, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8)
r2 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)={0x10b, 0x6, 0x209e1e, 0x3, 0x1}, 0x2c)
bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000b40)={r2, &(0x7f0000000040), 0x0, 0x1}, 0x20)
r3 = creat(&(0x7f0000000640)='./file0\x00', 0x100)
setsockopt$inet6_tcp_TCP_REPAIR_QUEUE(r3, 0x6, 0x14, &(0x7f0000000980), 0x4)
unlink(&(0x7f0000000940)='./file0\x00')
r4 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r5 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r5, 0x0)
ioctl$BINDER_GET_NODE_DEBUG_INFO(r4, 0xc018620b, &(0x7f0000000100))
ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f00000000c0)=ANY=[@ANYBLOB="bb8f0000"], 0x0, 0x0, 0x0})
ioctl$BINDER_SET_CONTEXT_MGR(r5, 0x40046207, 0x0)
shutdown(0xffffffffffffffff, 0x1)
prctl$PR_SET_NAME(0xf, &(0x7f0000000380)='/group.stat\x00')
ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)})

[ 1115.804177] binder: send failed reply for transaction 1128, target dead
[ 1115.859989] binder: 1365:1369 unknown command 36795
[ 1115.863567] binder: 1374:1377 transaction failed 29189/-22, size 24-8 line 3117
[ 1115.882396] binder: 1365:1369 ioctl c0306201 20000140 returned -22
[ 1115.882897] binder: 1374:1377 BC_INCREFS_DONE u0000000000000000 no match
15:06:34 executing program 1:
r0 = socket$inet_udplite(0x2, 0x2, 0x88)
ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f3188b070")
syz_open_procfs(0x0, &(0x7f0000000940)='syscall\x00')
r1 = syz_open_procfs(0x0, &(0x7f0000000040)='fd\x00')
recvmmsg(0xffffffffffffffff, &(0x7f0000003840)=[{{0x0, 0x0, 0x0}}], 0x1, 0x0, 0x0)
perf_event_open(&(0x7f0000940000)={0x2, 0x70, 0xee6a, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x100, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0xff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x10001, 0x1}, 0x0, 0x400000000000000}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
mlock(&(0x7f00005b8000/0x3000)=nil, 0x3000)
ioctl$SNDRV_TIMER_IOCTL_SELECT(0xffffffffffffffff, 0x40345410, 0x0)
openat$uinput(0xffffffffffffff9c, &(0x7f0000000080)='/dev/uinput\x00', 0x2, 0x0)
mmap(&(0x7f000060b000/0x1000)=nil, 0x1000, 0x5, 0x8000400200000033, r1, 0x0)
perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r2 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)={0x10b, 0x6, 0x209e1e, 0x3, 0x1}, 0x2c)
bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000b40)={r2, &(0x7f0000000040), 0x0, 0x1}, 0x20)
r3 = creat(&(0x7f0000000640)='./file0\x00', 0x100)
setsockopt$inet6_tcp_TCP_REPAIR_QUEUE(r3, 0x6, 0x14, &(0x7f0000000980), 0x4)
unlink(&(0x7f0000000940)='./file0\x00')
r4 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_GET_NODE_DEBUG_INFO(r4, 0xc018620b, &(0x7f0000000100))
ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)})
ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0x0, 0x0, &(0x7f0000000780)})

[ 1115.920817] binder: BINDER_SET_CONTEXT_MGR already set
[ 1115.928205] binder: 1379:1384 ioctl 40046207 0 returned -16
[ 1115.938569] binder: release 1379:1384 transaction 1136 out, still active
15:06:34 executing program 3:
r0 = socket$inet_udplite(0x2, 0x2, 0x88)
ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f3188b070")
syz_open_procfs(0x0, &(0x7f0000000940)='syscall\x00')
syz_open_procfs(0x0, &(0x7f0000000040)='fd\x00')
r1 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r2 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)})

15:06:34 executing program 2:
r0 = socket$inet_udplite(0x2, 0x2, 0x88)
ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f3188b070")
syz_open_procfs(0x0, &(0x7f0000000940)='syscall\x00')
r1 = syz_open_procfs(0x0, &(0x7f0000000040)='fd\x00')
recvmmsg(0xffffffffffffffff, &(0x7f0000003840)=[{{0x0, 0x0, 0x0}}], 0x1, 0x0, 0x0)
perf_event_open(&(0x7f0000940000)={0x2, 0x70, 0xee6a, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x100, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0xff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x10001, 0x1}, 0x0, 0x400000000000000}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
mlock(&(0x7f00005b8000/0x3000)=nil, 0x3000)
ioctl$SNDRV_TIMER_IOCTL_SELECT(0xffffffffffffffff, 0x40345410, 0x0)
openat$uinput(0xffffffffffffff9c, &(0x7f0000000080)='/dev/uinput\x00', 0x2, 0x0)
mmap(&(0x7f000060b000/0x1000)=nil, 0x1000, 0x5, 0x8000400200000033, r1, 0x0)
unshare(0xfffffffffffffffd)
r2 = getpid()
sched_setscheduler(r2, 0x5, &(0x7f00000000c0))
open$dir(&(0x7f0000000400)='./file0\x00', 0x0, 0x0)
perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f00000004c0), 0x2}, 0x0, 0x0, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r3 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000340)='memory.current\x00', 0x0, 0x0)
ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, 0x0)
socketpair(0x1, 0x20000000000001, 0x0, &(0x7f0000000100)={<r4=>0xffffffffffffffff, <r5=>0xffffffffffffffff})
ioctl$PERF_EVENT_IOC_SET_FILTER(r5, 0x8914, &(0x7f0000000300)='lo\x00\x96o\xd6Q\xb9Y\xa9\xc8J,\x00\xd2\x97\x04\x03\xdc\r')
close(r3)
rt_sigprocmask(0x2, &(0x7f0000000240)={0x6}, &(0x7f00000002c0), 0x8)
ioctl$PERF_EVENT_IOC_SET_FILTER(r5, 0x8923, &(0x7f00000008c0)='lo\x00\x96o8\x0fd\xa1\xe3\xd7]b}\x1f\xa1Y\xad4\x90\x9d`\xd2\x98\x00\x00\x00 \'Y\x17]\x15c\xcaR\xdd\x98OC\x89\x1b\xe7\x84\xe2\x05\x80w\xd2|D\x8dK\x14Bx\xcbuH\xc2\xeec\xbf<>Y\x1a\xfc\x1f9OB\x81\x89\x186\xc5q@n\xb4\xb6s\xb0\x00\x00\xfc\x00\x00\b\x00\x00\xda\xef\xecE\xec\xd5I\xb2\x9b\xfe\x8d\x90?\x00\xe9\xe4~g:\xc1\xb2aj\x96\xbb\xa7\xe2\xc0\xdc\xf9Q\b\xeb\x16\x7fT\x11\xd3\r7\xe6\"f\xcf\x8e\xabd\x0ftp\x82\xae\xd2\x15\x8e+c\xf6\xbf\xe14>\xa6-\xa5c\xde\xd7\xab\xea\x1f\xf8s2\x9cVF\xd5\x18\xfe\x0e\x8f \x01\x00\x00y.\xfc*\x82\xa5\xa1p5\xc8{\xf7\xef\xab\xe8\x99\xebw#\x8at\x1c\x80\xfc\xb0\x95\xa2\xa7\xd7,Y]E8\x83X\xf5F\xdc\x88-\xf5\xb0\xb5^\xdb\x1a\xb6\xaa\x14\xe2\xb9\rh^J-\xd1\xbaUn\x04\'l\x1b\xe0o\xdb\xc8\x91%\x1c\xb5\xbf\xb6\x90\xb4\xc2\x7f]/\xb3\xe7\xc9\'\x94\xcfIo\xdf\x04\x95\xb5\x06\x84\x1fH>\xda\xc5\x04 \x94\x88\xeb\'\xd4;6\x7f\xd9\x99-\x1b|G\x8d\xd4\xb9%\xaaQ\xa0K\x10\x03\x93\xe1\xcc\xe7m\x80\'\xf0\xa5\xed(\r\xa8\x0f&\xb1\xf3\xff0\f\x82%_\x92\x8bD\xb9\xd9\xe7\xf2\xe4\xc1i#\xdc\x87A\xb9\xc7\r\x92\xfa\x11\x11\xb5\x1f\x03\x9d\xdd\x1bj\xdf\xacg\xe3\xa0S\xd3\x8a\xe1n\x97\xea\xf5\xa0\'\v\xe9\xa0\xf1 f\xaan\xcf\xb5i\xb6d\xbc\x92\v\xd58\x16\b\xb3_:\xa4!\ny\xc4&\nWMM\xa8\xc4\v\x9f\x01o\xf4\xab&\xb6\x17\x02P\xc3!N\xf4\b\x1a~\x91V1s\xe9\xbe\x9e\x9b\'\xcde\xb3\xa1\x86\"\xd7\x04\xf1\xc0!\xed\xff\xee$\xc89\x8cB0\xd1dD\xe0IP\x88\xa2\xf2Y\x9af$$\xf1cO\xf7P\xac\xca\x80:!\xb4\x94#\xcb^\x9f\'\x03\xe3\x93\xb9\x82\xbf\xcf\xc4\xe3\xf7\x03Oh\xf2r\xca\x8ff\xbb/\x9f*\xaf\x1a \xa5\xa0?%M\xa5\x86\x98\xf24\'1\xc7\f<\xcc@\xe8\x8a\xac.\xde\xe4\xc7\xf5\x9ck\xa40!\xe9\x14$\xb3\x05m\xb5m\xed\ft\x93\xd8\xa3\x80\'Y\xb9\x05\xbbt|\xbe\xbcz\n\xf3\xf5p\xf8\x9f~\x1b\xd0\v\x1cQ')
getsockopt$inet_IP_IPSEC_POLICY(r1, 0x0, 0x10, &(0x7f00000006c0)={{{@in6=@loopback}}, {{@in6=@initdev}}}, &(0x7f0000000500)=0xe8)
socketpair(0x2, 0x80807, 0x0, &(0x7f0000000480))
syz_genetlink_get_family_id$SEG6(&(0x7f0000000880)='SEG6\x00')
sendmsg$SEG6_CMD_DUMPHMAC(r4, &(0x7f0000000580)={&(0x7f0000000380)={0x10, 0x0, 0x0, 0x1000000}, 0xc, &(0x7f0000000440)={&(0x7f00000005c0)=ANY=[@ANYBLOB="2300260109447a0000000000000000660000001400001a0065a455e04ea56d0a47018c8e973bcac914471474a7e0d50a000eadd66d2e49a2ed40dcafa1e046ab6aacc2097d8f75bd9c8b8a220bdde116904efa3f9600f22ab388644f66c2d5baec4079a81bae1927e49e91a4964656d7b227702926af5be846f3de49fad39048633fd9161123894d9427f854a30cb0532c8f31f663380e40ce7f6cb15ec8baab3b7c6f"], 0x1}, 0x1, 0x0, 0x0, 0x8000}, 0x804)
r6 = creat(&(0x7f0000000200)='./bus\x00', 0x0)
arch_prctl$ARCH_MAP_VDSO_32(0x2002, 0x7e)
ftruncate(r6, 0x2008200)
open(&(0x7f0000000140)='./bus\x00', 0x4000, 0x0)

[ 1115.975404] binder: 1365:1393 BC_INCREFS_DONE node 1134 has no pending increfs request
[ 1116.058651] binder: 1394:1400 BC_INCREFS_DONE node 1140 has no pending increfs request
[ 1116.069684] binder: BINDER_SET_CONTEXT_MGR already set
[ 1116.076484] binder: 1397:1401 ioctl 40046207 0 returned -16
[ 1116.085754] binder: release 1397:1401 transaction 1142 out, still active
15:06:35 executing program 4:
r0 = syz_open_procfs(0x0, &(0x7f00000001c0)='net/softnet_stat\x00')
lseek(r0, 0x20000, 0x0)
openat$pfkey(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/net/pfkey\x00', 0x101000, 0x0)

15:06:35 executing program 5:
r0 = socket$inet_udplite(0x2, 0x2, 0x88)
ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f3188b070")
syz_open_procfs(0x0, &(0x7f0000000940)='syscall\x00')
r1 = syz_open_procfs(0x0, &(0x7f0000000040)='fd\x00')
recvmmsg(0xffffffffffffffff, &(0x7f0000003840)=[{{0x0, 0x0, 0x0}}], 0x1, 0x0, 0x0)
perf_event_open(&(0x7f0000940000)={0x2, 0x70, 0xee6a, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x100, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0xff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x10001, 0x1}, 0x0, 0x400000000000000}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
mlock(&(0x7f00005b8000/0x3000)=nil, 0x3000)
ioctl$SNDRV_TIMER_IOCTL_SELECT(0xffffffffffffffff, 0x40345410, 0x0)
openat$uinput(0xffffffffffffff9c, &(0x7f0000000080)='/dev/uinput\x00', 0x2, 0x0)
mmap(&(0x7f000060b000/0x1000)=nil, 0x1000, 0x5, 0x8000400200000033, r1, 0x0)
unshare(0xfffffffffffffffd)
r2 = getpid()
sched_setscheduler(r2, 0x5, &(0x7f00000000c0))
open$dir(&(0x7f0000000400)='./file0\x00', 0x0, 0x0)
perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f00000004c0), 0x2}, 0x0, 0x0, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r3 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000340)='memory.current\x00', 0x0, 0x0)
ioctl$TUNSETIFF(r0, 0x400454ca, 0x0)
socketpair(0x1, 0x20000000000001, 0x0, &(0x7f0000000100)={<r4=>0xffffffffffffffff, <r5=>0xffffffffffffffff})
ioctl$PERF_EVENT_IOC_SET_FILTER(r5, 0x8914, &(0x7f0000000300)='lo\x00\x96o\xd6Q\xb9Y\xa9\xc8J,\x00\xd2\x97\x04\x03\xdc\r')
close(r3)
rt_sigprocmask(0x2, &(0x7f0000000240)={0x6}, &(0x7f00000002c0), 0x8)
ioctl$PERF_EVENT_IOC_SET_FILTER(r5, 0x8923, &(0x7f00000008c0)='lo\x00\x96o8\x0fd\xa1\xe3\xd7]b}\x1f\xa1Y\xad4\x90\x9d`\xd2\x98\x00\x00\x00 \'Y\x17]\x15c\xcaR\xdd\x98OC\x89\x1b\xe7\x84\xe2\x05\x80w\xd2|D\x8dK\x14Bx\xcbuH\xc2\xeec\xbf<>Y\x1a\xfc\x1f9OB\x81\x89\x186\xc5q@n\xb4\xb6s\xb0\x00\x00\xfc\x00\x00\b\x00\x00\xda\xef\xecE\xec\xd5I\xb2\x9b\xfe\x8d\x90?\x00\xe9\xe4~g:\xc1\xb2aj\x96\xbb\xa7\xe2\xc0\xdc\xf9Q\b\xeb\x16\x7fT\x11\xd3\r7\xe6\"f\xcf\x8e\xabd\x0ftp\x82\xae\xd2\x15\x8e+c\xf6\xbf\xe14>\xa6-\xa5c\xde\xd7\xab\xea\x1f\xf8s2\x9cVF\xd5\x18\xfe\x0e\x8f \x01\x00\x00y.\xfc*\x82\xa5\xa1p5\xc8{\xf7\xef\xab\xe8\x99\xebw#\x8at\x1c\x80\xfc\xb0\x95\xa2\xa7\xd7,Y]E8\x83X\xf5F\xdc\x88-\xf5\xb0\xb5^\xdb\x1a\xb6\xaa\x14\xe2\xb9\rh^J-\xd1\xbaUn\x04\'l\x1b\xe0o\xdb\xc8\x91%\x1c\xb5\xbf\xb6\x90\xb4\xc2\x7f]/\xb3\xe7\xc9\'\x94\xcfIo\xdf\x04\x95\xb5\x06\x84\x1fH>\xda\xc5\x04 \x94\x88\xeb\'\xd4;6\x7f\xd9\x99-\x1b|G\x8d\xd4\xb9%\xaaQ\xa0K\x10\x03\x93\xe1\xcc\xe7m\x80\'\xf0\xa5\xed(\r\xa8\x0f&\xb1\xf3\xff0\f\x82%_\x92\x8bD\xb9\xd9\xe7\xf2\xe4\xc1i#\xdc\x87A\xb9\xc7\r\x92\xfa\x11\x11\xb5\x1f\x03\x9d\xdd\x1bj\xdf\xacg\xe3\xa0S\xd3\x8a\xe1n\x97\xea\xf5\xa0\'\v\xe9\xa0\xf1 f\xaan\xcf\xb5i\xb6d\xbc\x92\v\xd58\x16\b\xb3_:\xa4!\ny\xc4&\nWMM\xa8\xc4\v\x9f\x01o\xf4\xab&\xb6\x17\x02P\xc3!N\xf4\b\x1a~\x91V1s\xe9\xbe\x9e\x9b\'\xcde\xb3\xa1\x86\"\xd7\x04\xf1\xc0!\xed\xff\xee$\xc89\x8cB0\xd1dD\xe0IP\x88\xa2\xf2Y\x9af$$\xf1cO\xf7P\xac\xca\x80:!\xb4\x94#\xcb^\x9f\'\x03\xe3\x93\xb9\x82\xbf\xcf\xc4\xe3\xf7\x03Oh\xf2r\xca\x8ff\xbb/\x9f*\xaf\x1a \xa5\xa0?%M\xa5\x86\x98\xf24\'1\xc7\f<\xcc@\xe8\x8a\xac.\xde\xe4\xc7\xf5\x9ck\xa40!\xe9\x14$\xb3\x05m\xb5m\xed\ft\x93\xd8\xa3\x80\'Y\xb9\x05\xbbt|\xbe\xbcz\n\xf3\xf5p\xf8\x9f~\x1b\xd0\v\x1cQ')
getsockopt$inet_IP_IPSEC_POLICY(r1, 0x0, 0x10, &(0x7f00000006c0)={{{@in6=@loopback}}, {{@in6=@initdev}}}, &(0x7f0000000500)=0xe8)
socketpair(0x2, 0x2000000080003, 0x100, &(0x7f0000000480))
syz_genetlink_get_family_id$SEG6(&(0x7f00000003c0)='SEG6\x00')
sendmsg$SEG6_CMD_DUMPHMAC(r4, &(0x7f0000000580)={&(0x7f0000000380)={0x10, 0x0, 0x0, 0x1000000}, 0xc, &(0x7f0000000440)={&(0x7f00000005c0)=ANY=[@ANYBLOB="2300260109447a0000000000000000660000001400001a0065a455e04ea56d0affff8c8e973bcac914471474a7e0000000000000000949a2ed40dcafa1e046ab6aacc2097d8f75bd9c8b8a220bdde116904efa3f9600f22ab388644f66c2d5baec4079a81bae1927e49e91a4964656d7b227702926af5b7546f3de0002d39048633fd9161123894d94071eadad83b0532c8f31f663380e40ce7f6cb15ec8baab3b7c6f"], 0x1}, 0x1, 0x0, 0x0, 0x8000}, 0x804)
r6 = creat(&(0x7f0000000280)='./bus\x00', 0x0)
arch_prctl$ARCH_MAP_VDSO_32(0x2002, 0x7e)
ftruncate(r6, 0x2008200)
open(&(0x7f0000000140)='./bus\x00', 0x4000, 0x0)

15:06:35 executing program 0:
r0 = socket$inet_udplite(0x2, 0x2, 0x88)
ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f3188b070")
syz_open_procfs(0x0, &(0x7f0000000940)='syscall\x00')
r1 = syz_open_procfs(0x0, &(0x7f0000000040)='fd\x00')
recvmmsg(0xffffffffffffffff, &(0x7f0000003840)=[{{0x0, 0x0, 0x0}}], 0x1, 0x0, 0x0)
perf_event_open(&(0x7f0000940000)={0x2, 0x70, 0xee6a, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x100, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0xff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x10001, 0x1}, 0x0, 0x400000000000000}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
mlock(&(0x7f00005b8000/0x3000)=nil, 0x3000)
ioctl$SNDRV_TIMER_IOCTL_SELECT(0xffffffffffffffff, 0x40345410, 0x0)
openat$uinput(0xffffffffffffff9c, &(0x7f0000000080)='/dev/uinput\x00', 0x2, 0x0)
mmap(&(0x7f000060b000/0x1000)=nil, 0x1000, 0x5, 0x8000400200000033, r1, 0x0)
perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x2, 0x9, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2000000, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x4000000, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8)
r2 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)={0x10b, 0x6, 0x209e1e, 0x3, 0x1}, 0x2c)
bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000b40)={r2, &(0x7f0000000040), 0x0, 0x1}, 0x20)
r3 = creat(&(0x7f0000000640)='./file0\x00', 0x100)
setsockopt$inet6_tcp_TCP_REPAIR_QUEUE(r3, 0x6, 0x14, &(0x7f0000000980), 0x4)
unlink(&(0x7f0000000940)='./file0\x00')
r4 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r5 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r5, 0x0)
ioctl$BINDER_GET_NODE_DEBUG_INFO(r4, 0xc018620b, &(0x7f0000000100))
ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f00000000c0)=ANY=[@ANYBLOB="bb8f0000"], 0x0, 0x0, 0x0})
ioctl$BINDER_SET_CONTEXT_MGR(r5, 0x40046207, 0x0)
shutdown(0xffffffffffffffff, 0x1)
prctl$PR_SET_NAME(0xf, &(0x7f0000000380)='/group.stat\x00')
ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)})
ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0x0, 0x0, &(0x7f0000000780)})
ioctl$BINDER_WRITE_READ(r5, 0xc0306201, &(0x7f00000001c0)={0x8, 0x0, &(0x7f0000000500)=[@release={0x40046306, 0x1}], 0x0, 0x0, &(0x7f00000009c0)})
creat(&(0x7f00000000c0)='./file0\x00', 0x0)

15:06:35 executing program 3:
r0 = socket$inet_udplite(0x2, 0x2, 0x88)
ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f3188b070")
syz_open_procfs(0x0, &(0x7f0000000940)='syscall\x00')
syz_open_procfs(0x0, &(0x7f0000000040)='fd\x00')
r1 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r2 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)})

15:06:35 executing program 4:
socket$netlink(0x10, 0x3, 0x15)
getpgid(0xffffffffffffffff)
ioctl$sock_SIOCGPGRP(0xffffffffffffff9c, 0x8904, &(0x7f0000000140)=<r0=>0x0)
open(&(0x7f0000000000)='./file0\x00', 0x800, 0x4)
r1 = syz_open_procfs(r0, &(0x7f0000000040)='net/softnet_stat\x00\x97\x1b.\xe0T9\xa98\'0\xe7DU\x98B\xd6\xdd2\t_\x94\xac\\\xd7\xff\x05\xfb~\x1b\x91Y7\xa8\xfdC\x02L\x8e\xf8epX\tNQ\x03\xa4\x9a\x80\xe0.\xe5\xdc\x94\x84w\x1c\xa0\\Q^dR\xc8\xe4h]\x06\xe3N\x04\xb3]\xa7\x7f0f^\xf8 OI\x14\xe6\xcd\xe5\xa8\xfc\x0e\r\fS\xa3\xf6\xc5k\x1b\x91\x1b\x1b86\x13\xf18\xbcnN^z\xe0\xb7\xec\xfb\x12\x1dT\xca\xd1}l\xc5\x1b\xde\x91\xbf\x96\xf8\xfaK6\x8a\xb2\xacDe\xfcj\xe5\xed\x19\xae\xc7Q\xadK\x8bir\f\xf2\xdf\xdb\n\x9e\x17n`\x82\x802\x95_\xbb{\x02\xb1\x88\xa1\x01\x92s\x17l\xc6G\xbf\xe8\xb8\x19^-,\x81\xbd\xbdb}M\xae\x8a\xe5\xbc\a\xcb/\xe8O[\x95\xc0\xa6\tM\x97\xdc\xcd\v9\xf3\r\xc5\x10\xaf\x82~$\xbe\xbc\x03q\xd9q\x82h\x1cw2\xdbZ\xb4If\xdf')
lseek(r1, 0x20000, 0x0)

15:06:35 executing program 2:
r0 = socket$inet_udplite(0x2, 0x2, 0x88)
ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f3188b070")
syz_open_procfs(0x0, &(0x7f0000000940)='syscall\x00')
r1 = syz_open_procfs(0x0, &(0x7f0000000040)='fd\x00')
recvmmsg(0xffffffffffffffff, &(0x7f0000003840)=[{{0x0, 0x0, 0x0}}], 0x1, 0x0, 0x0)
perf_event_open(&(0x7f0000940000)={0x2, 0x70, 0xee6a, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x100, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0xff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x10001, 0x1}, 0x0, 0x400000000000000}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
mlock(&(0x7f00005b8000/0x3000)=nil, 0x3000)
ioctl$SNDRV_TIMER_IOCTL_SELECT(0xffffffffffffffff, 0x40345410, 0x0)
openat$uinput(0xffffffffffffff9c, &(0x7f0000000080)='/dev/uinput\x00', 0x2, 0x0)
mmap(&(0x7f000060b000/0x1000)=nil, 0x1000, 0x5, 0x8000400200000033, r1, 0x0)
perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x2, 0x9, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2000000, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x4000000, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8)
r2 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)={0x10b, 0x6, 0x209e1e, 0x3, 0x1}, 0x2c)
bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000b40)={r2, &(0x7f0000000040), 0x0, 0x1}, 0x20)
r3 = creat(&(0x7f0000000640)='./file0\x00', 0x100)
setsockopt$inet6_tcp_TCP_REPAIR_QUEUE(r3, 0x6, 0x14, &(0x7f0000000980), 0x4)
unlink(&(0x7f0000000940)='./file0\x00')
r4 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r5 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r5, 0x0)
ioctl$BINDER_GET_NODE_DEBUG_INFO(r4, 0xc018620b, &(0x7f0000000100))
ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f00000000c0)=ANY=[@ANYBLOB="bb8f0000"], 0x0, 0x0, 0x0})
ioctl$BINDER_SET_CONTEXT_MGR(r5, 0x40046207, 0x0)
shutdown(0xffffffffffffffff, 0x1)
prctl$PR_SET_NAME(0xf, &(0x7f0000000380)='/group.stat\x00')
ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)})
ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0x0, 0x0, &(0x7f0000000780)})

15:06:35 executing program 5:
r0 = socket$inet_udplite(0x2, 0x2, 0x88)
ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f3188b070")
r1 = syz_open_procfs(0x0, &(0x7f0000000940)='syscall\x00')
r2 = syz_open_procfs(0x0, &(0x7f0000000040)='fd\x00')
recvmmsg(0xffffffffffffffff, &(0x7f0000003840)=[{{0x0, 0x0, 0x0}}], 0x1, 0x0, 0x0)
perf_event_open(&(0x7f0000940000)={0x2, 0x70, 0xee6a, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x100, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0xff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x10001, 0x1}, 0x0, 0x400000000000000}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
mlock(&(0x7f00005b8000/0x3000)=nil, 0x3000)
ioctl$SNDRV_TIMER_IOCTL_SELECT(0xffffffffffffffff, 0x40345410, 0x0)
openat$uinput(0xffffffffffffff9c, &(0x7f0000000080)='/dev/uinput\x00', 0x2, 0x0)
mmap(&(0x7f000060b000/0x1000)=nil, 0x1000, 0x5, 0x8000400200000033, r2, 0x0)
unshare(0x1000000010000802)
r3 = getpid()
sched_setscheduler(r3, 0x5, &(0x7f00000000c0))
open$dir(&(0x7f0000000400)='./file0\x00', 0x0, 0x0)
perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f00000004c0), 0x2}, 0x0, 0x0, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r4 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000340)='memory.current\x00', 0x0, 0x0)
ioctl$TUNSETIFF(r1, 0x400454ca, 0x0)
socketpair(0x1, 0x20000000000001, 0x0, &(0x7f0000000100)={<r5=>0xffffffffffffffff, <r6=>0xffffffffffffffff})
ioctl$PERF_EVENT_IOC_SET_FILTER(r6, 0x8914, &(0x7f0000000300)='lo\x00\x96o\xd6Q\xb9Y\xa9\xc8J,\x00\xd2\x97\x04\x03\xdc\r')
close(r4)
rt_sigprocmask(0x2, &(0x7f0000000240)={0x6}, &(0x7f00000002c0), 0x8)
ioctl$PERF_EVENT_IOC_SET_FILTER(r6, 0x8923, &(0x7f00000008c0)='lo\x00\x96o8\x0fd\xa1\xe3\xd7]b}\x1f\xa1Y\xad4\x90\x9d`\xd2\x98\x00\x00\x00 \'Y\x17]\x15c\xcaR\xdd\x98OC\x89\x1b\xe7\x84\xe2\x05\x80w\xd2|D\x8dK\x14Bx\xcbuH\xc2\xeec\xbf<>Y\x1a\xfc\x1f9OB\x81\x89\x186\xc5q@n\xb4\xb6s\xb0\x00\x00\xfc\x00\x00\b\x00\x00\xda\xef\xecE\xec\xd5I\xb2\x9b\xfe\x8d\x90?\x00\xe9\xe4~g:\xc1\xb2aj\x96\xbb\xa7\xe2\xc0\xdc\xf9Q\b\xeb\x16\x7fT\x11\xd3\r7\xe6\"f\xcf\x8e\xabd\x0ftp\x82\xae\xd2\x15\x8e+c\xf6\xbf\xe14>\xa6-\xa5c\xde\xd7\xab\xea\x1f\xf8s2\x9cVF\xd5\x18\xfe\x0e\x8f \x01\x00\x00y.\xfc*\x82\xa5\xa1p5\xc8{\xf7\xef\xab\xe8\x99\xebw#\x8at\x1c\x80\xfc\xb0\x95\xa2\xa7\xd7,Y]E8\x83X\xf5F\xdc\x88-\xf5\xb0\xb5^\xdb\x1a\xb6\xaa\x14\xe2\xb9\rh^J-\xd1\xbaUn\x04\'l\x1b\xe0o\xdb\xc8\x91%\x1c\xb5\xbf\xb6\x90\xb4\xc2\x7f]/\xb3\xe7\xc9\'\x94\xcfIo\xdf\x04\x95\xb5\x06\x84\x1fH>\xda\xc5\x04 \x94\x88\xeb\'\xd4;6\x7f\xd9\x99-\x1b|G\x8d\xd4\xb9%\xaaQ\xa0K\x10\x03\x93\xe1\xcc\xe7m\x80\'\xf0\xa5\xed(\r\xa8\x0f&\xb1\xf3\xff0\f\x82%_\x92\x8bD\xb9\xd9\xe7\xf2\xe4\xc1i#\xdc\x87A\xb9\xc7\r\x92\xfa\x11\x11\xb5\x1f\x03\x9d\xdd\x1bj\xdf\xacg\xe3\xa0S\xd3\x8a\xe1n\x97\xea\xf5\xa0\'\v\xe9\xa0\xf1 f\xaan\xcf\xb5i\xb6d\xbc\x92\v\xd58\x16\b\xb3_:\xa4!\ny\xc4&\nWMM\xa8\xc4\v\x9f\x01o\xf4\xab&\xb6\x17\x02P\xc3!N\xf4\b\x1a~\x91V1s\xe9\xbe\x9e\x9b\'\xcde\xb3\xa1\x86\"\xd7\x04\xf1\xc0!\xed\xff\xee$\xc89\x8cB0\xd1dD\xe0IP\x88\xa2\xf2Y\x9af$$\xf1cO\xf7P\xac\xca\x80:!\xb4\x94#\xcb^\x9f\'\x03\xe3\x93\xb9\x82\xbf\xcf\xc4\xe3\xf7\x03Oh\xf2r\xca\x8ff\xbb/\x9f*\xaf\x1a \xa5\xa0?%M\xa5\x86\x98\xf24\'1\xc7\f<\xcc@\xe8\x8a\xac.\xde\xe4\xc7\xf5\x9ck\xa40!\xe9\x14$\xb3\x05m\xb5m\xed\ft\x93\xd8\xa3\x80\'Y\xb9\x05\xbbt|\xbe\xbcz\n\xf3\xf5p\xf8\x9f~\x1b\xd0\v\x1cQ')
getsockopt$inet_IP_IPSEC_POLICY(r2, 0x0, 0x10, &(0x7f00000006c0)={{{@in6=@loopback}}, {{@in6=@initdev}}}, &(0x7f0000000500)=0xe8)
socketpair(0x2, 0x2000000080003, 0x100, &(0x7f0000000480))
syz_genetlink_get_family_id$SEG6(&(0x7f00000003c0)='SEG6\x00')
sendmsg$SEG6_CMD_DUMPHMAC(r5, &(0x7f0000000580)={&(0x7f0000000380)={0x10, 0x0, 0x0, 0x1000000}, 0xc, &(0x7f0000000440)={&(0x7f0000000b00)=ANY=[@ANYBLOB="2300260109447a0000000000000000660000001400001a0065a455e04ea56d0a47018c8e973bcac914471474a7e0d50a000eadd66d2e49a2ed40dcafa1e046ab6aacc2097d8f75bd9c8b8a220bdde116904efa3f9600f22ab697fe0ca76952b1dc1f3bb388644f66c2d5baec4079a81bae1927e49e91a4964656d7b227702926af5be844f3de49fad39048633fd9161123894d9427f854a30cb0532c8f31f663380e40ce7f6cb15ec8baab3b7c6fe7f631f31452b773c9b36c492eb1e6075ccbee1f476fe16cfb00ac529e3939f6c13698d38fc423ea1708c28854697267e7bf536d8494a28197f8c766f6f972ce4db0aa7192ffafa9777c64c51d7628c7a40f3c6870d8de9cc685a9aef8ff20884d8fdc0be8df3cbb25ca375e04f5ce3b"], 0x1}, 0x1, 0x0, 0x0, 0x8000}, 0x804)
r7 = creat(&(0x7f0000000280)='./bus\x00', 0x0)
arch_prctl$ARCH_MAP_VDSO_32(0x2002, 0x7e)
ftruncate(r7, 0x2008200)
open(&(0x7f0000000140)='./bus\x00', 0x4000, 0x0)

[ 1116.540940] binder: release 1365:1369 transaction 1133 out, still active
[ 1116.549314] binder: send failed reply for transaction 1133, target dead
[ 1116.558790] binder: send failed reply for transaction 1136, target dead
[ 1116.566498] binder: send failed reply for transaction 1139 to 1394:1395
[ 1116.574848] binder: send failed reply for transaction 1142, target dead
15:06:35 executing program 3:
r0 = socket$inet_udplite(0x2, 0x2, 0x88)
ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f3188b070")
syz_open_procfs(0x0, &(0x7f0000000940)='syscall\x00')
r1 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r2 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)})

15:06:35 executing program 1:
r0 = socket$inet_udplite(0x2, 0x2, 0x88)
ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f3188b070")
syz_open_procfs(0x0, &(0x7f0000000940)='syscall\x00')
r1 = syz_open_procfs(0x0, &(0x7f0000000040)='fd\x00')
recvmmsg(0xffffffffffffffff, &(0x7f0000003840)=[{{0x0, 0x0, 0x0}}], 0x1, 0x0, 0x0)
perf_event_open(&(0x7f0000940000)={0x2, 0x70, 0xee6a, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x100, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0xff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x10001, 0x1}, 0x0, 0x400000000000000}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
mlock(&(0x7f00005b8000/0x3000)=nil, 0x3000)
ioctl$SNDRV_TIMER_IOCTL_SELECT(0xffffffffffffffff, 0x40345410, 0x0)
openat$uinput(0xffffffffffffff9c, &(0x7f0000000080)='/dev/uinput\x00', 0x2, 0x0)
mmap(&(0x7f000060b000/0x1000)=nil, 0x1000, 0x5, 0x8000400200000033, r1, 0x0)
r2 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)={0x10b, 0x6, 0x209e1e, 0x3, 0x1}, 0x2c)
bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000b40)={r2, &(0x7f0000000040), 0x0, 0x1}, 0x20)
r3 = creat(&(0x7f0000000640)='./file0\x00', 0x100)
setsockopt$inet6_tcp_TCP_REPAIR_QUEUE(r3, 0x6, 0x14, &(0x7f0000000980), 0x4)
unlink(&(0x7f0000000940)='./file0\x00')
r4 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_GET_NODE_DEBUG_INFO(r4, 0xc018620b, &(0x7f0000000100))
ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)})
ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0x0, 0x0, &(0x7f0000000780)})

[ 1116.593321] binder: release 1433:1435 transaction 1146 out, still active
[ 1116.614355] binder: send failed reply for transaction 1146, target dead
[ 1116.684667] binder: release 1445:1449 transaction 1150 out, still active
[ 1116.721670] binder: 1439:1442 unknown command 36795
15:06:35 executing program 2:
r0 = socket$inet_udplite(0x2, 0x2, 0x88)
ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f3188b070")
syz_open_procfs(0x0, &(0x7f0000000940)='syscall\x00')
r1 = syz_open_procfs(0x0, &(0x7f0000000040)='fd\x00')
recvmmsg(0xffffffffffffffff, &(0x7f0000003840)=[{{0x0, 0x0, 0x0}}], 0x1, 0x0, 0x0)
perf_event_open(&(0x7f0000940000)={0x2, 0x70, 0xee6a, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x100, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0xff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x10001, 0x1}, 0x0, 0x400000000000000}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
mlock(&(0x7f00005b8000/0x3000)=nil, 0x3000)
ioctl$SNDRV_TIMER_IOCTL_SELECT(0xffffffffffffffff, 0x40345410, 0x0)
openat$uinput(0xffffffffffffff9c, &(0x7f0000000080)='/dev/uinput\x00', 0x2, 0x0)
mmap(&(0x7f000060b000/0x1000)=nil, 0x1000, 0x5, 0x8000400200000033, r1, 0x0)
perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x2, 0x9, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2000000, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x4000000, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8)
r2 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)={0x10b, 0x6, 0x209e1e, 0x3, 0x1}, 0x2c)
bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000b40)={r2, &(0x7f0000000040), 0x0, 0x1}, 0x20)
r3 = creat(&(0x7f0000000640)='./file0\x00', 0x100)
setsockopt$inet6_tcp_TCP_REPAIR_QUEUE(r3, 0x6, 0x14, &(0x7f0000000980), 0x4)
unlink(&(0x7f0000000940)='./file0\x00')
r4 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r5 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r5, 0x0)
ioctl$BINDER_GET_NODE_DEBUG_INFO(r4, 0xc018620b, &(0x7f0000000100))
ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f00000000c0)=ANY=[@ANYBLOB="bb8f0000"], 0x0, 0x0, 0x0})
ioctl$BINDER_SET_CONTEXT_MGR(r5, 0x40046207, 0x0)
shutdown(0xffffffffffffffff, 0x1)
prctl$PR_SET_NAME(0xf, &(0x7f0000000380)='/group.stat\x00')
ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)})
ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0x0, 0x0, &(0x7f0000000780)})

15:06:35 executing program 3:
r0 = socket$inet_udplite(0x2, 0x2, 0x88)
ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f3188b070")
r1 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r2 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)})

15:06:35 executing program 4:
r0 = syz_open_procfs(0x0, &(0x7f00000001c0)='net/softnet_stat\x00')
lseek(r0, 0x20000, 0x0)
ioctl$sock_inet6_tcp_SIOCINQ(r0, 0x541b, &(0x7f0000000080))
getsockname$inet6(r0, &(0x7f0000000000)={0xa, 0x0, 0x0, @mcast1}, &(0x7f0000000040)=0x1c)

15:06:35 executing program 1:
r0 = socket$inet_udplite(0x2, 0x2, 0x88)
ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f3188b070")
syz_open_procfs(0x0, &(0x7f0000000940)='syscall\x00')
r1 = syz_open_procfs(0x0, &(0x7f0000000040)='fd\x00')
recvmmsg(0xffffffffffffffff, &(0x7f0000003840)=[{{0x0, 0x0, 0x0}}], 0x1, 0x0, 0x0)
perf_event_open(&(0x7f0000940000)={0x2, 0x70, 0xee6a, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x100, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0xff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x10001, 0x1}, 0x0, 0x400000000000000}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
mlock(&(0x7f00005b8000/0x3000)=nil, 0x3000)
ioctl$SNDRV_TIMER_IOCTL_SELECT(0xffffffffffffffff, 0x40345410, 0x0)
openat$uinput(0xffffffffffffff9c, &(0x7f0000000080)='/dev/uinput\x00', 0x2, 0x0)
mmap(&(0x7f000060b000/0x1000)=nil, 0x1000, 0x5, 0x8000400200000033, r1, 0x0)
r2 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)={0x10b, 0x6, 0x209e1e, 0x3, 0x1}, 0x2c)
bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000b40)={r2, &(0x7f0000000040), 0x0, 0x1}, 0x20)
r3 = creat(&(0x7f0000000640)='./file0\x00', 0x100)
setsockopt$inet6_tcp_TCP_REPAIR_QUEUE(r3, 0x6, 0x14, &(0x7f0000000980), 0x4)
unlink(&(0x7f0000000940)='./file0\x00')
r4 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_GET_NODE_DEBUG_INFO(r4, 0xc018620b, &(0x7f0000000100))
ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)})
ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0x0, 0x0, &(0x7f0000000780)})

[ 1116.733292] binder: send failed reply for transaction 1150, target dead
[ 1116.733355] binder: 1448:1452 transaction failed 29189/-22, size 24-8 line 3117
[ 1116.746696] binder: 1439:1442 ioctl c0306201 20000140 returned -22
[ 1116.756065] binder: 1448:1452 BC_INCREFS_DONE u0000000000000000 no match
15:06:35 executing program 3:
r0 = socket$inet_udplite(0x2, 0x2, 0x88)
ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f3188b070")
r1 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r2 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)})

[ 1116.809674] binder: 1439:1461 BC_INCREFS_DONE node 1156 has no pending increfs request
[ 1116.823287] binder: BINDER_SET_CONTEXT_MGR already set
[ 1116.830491] binder: 1457:1462 ioctl 40046207 0 returned -16
[ 1116.841249] binder: release 1457:1462 transaction 1158 out, still active
[ 1116.930265] binder: BINDER_SET_CONTEXT_MGR already set
[ 1116.936255] binder: 1469:1470 ioctl 40046207 0 returned -16
[ 1116.944506] binder: release 1469:1470 transaction 1164 out, still active
[ 1116.945374] binder: 1464:1471 BC_INCREFS_DONE node 1162 has no pending increfs request
15:06:36 executing program 0:
r0 = socket$inet_udplite(0x2, 0x2, 0x88)
ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f3188b070")
syz_open_procfs(0x0, &(0x7f0000000940)='syscall\x00')
r1 = syz_open_procfs(0x0, &(0x7f0000000040)='fd\x00')
recvmmsg(0xffffffffffffffff, &(0x7f0000003840)=[{{0x0, 0x0, 0x0}}], 0x1, 0x0, 0x0)
perf_event_open(&(0x7f0000940000)={0x2, 0x70, 0xee6a, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x100, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0xff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x10001, 0x1}, 0x0, 0x400000000000000}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
mlock(&(0x7f00005b8000/0x3000)=nil, 0x3000)
ioctl$SNDRV_TIMER_IOCTL_SELECT(0xffffffffffffffff, 0x40345410, 0x0)
openat$uinput(0xffffffffffffff9c, &(0x7f0000000080)='/dev/uinput\x00', 0x2, 0x0)
mmap(&(0x7f000060b000/0x1000)=nil, 0x1000, 0x5, 0x8000400200000033, r1, 0x0)
perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x2, 0x9, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2000000, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x4000000, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8)
r2 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)={0x10b, 0x6, 0x209e1e, 0x3, 0x1}, 0x2c)
bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000b40)={r2, &(0x7f0000000040), 0x0, 0x1}, 0x20)
r3 = creat(&(0x7f0000000640)='./file0\x00', 0x100)
setsockopt$inet6_tcp_TCP_REPAIR_QUEUE(r3, 0x6, 0x14, &(0x7f0000000980), 0x4)
unlink(&(0x7f0000000940)='./file0\x00')
r4 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r5 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r5, 0x0)
ioctl$BINDER_GET_NODE_DEBUG_INFO(r4, 0xc018620b, &(0x7f0000000100))
ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f00000000c0)=ANY=[@ANYBLOB="bb8f0000"], 0x0, 0x0, 0x0})
ioctl$BINDER_SET_CONTEXT_MGR(r5, 0x40046207, 0x0)
shutdown(0xffffffffffffffff, 0x1)
prctl$PR_SET_NAME(0xf, &(0x7f0000000380)='/group.stat\x00')
ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)})
ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0x0, 0x0, &(0x7f0000000780)})
ioctl$BINDER_WRITE_READ(r5, 0xc0306201, &(0x7f00000001c0)={0x8, 0x0, &(0x7f0000000500)=[@release={0x40046306, 0x1}], 0x0, 0x0, &(0x7f00000009c0)})

15:06:36 executing program 4:
r0 = syz_open_procfs(0x0, &(0x7f00000001c0)='net/softnet_stat\x00')
setsockopt$inet6_tcp_TCP_ULP(r0, 0x6, 0x1f, &(0x7f0000000000)='tls\x00', 0x4)
lseek(r0, 0x20000, 0x0)

15:06:36 executing program 2:
r0 = socket$inet_udplite(0x2, 0x2, 0x88)
ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f3188b070")
syz_open_procfs(0x0, &(0x7f0000000940)='syscall\x00')
r1 = syz_open_procfs(0x0, &(0x7f0000000040)='fd\x00')
recvmmsg(0xffffffffffffffff, &(0x7f0000003840)=[{{0x0, 0x0, 0x0}}], 0x1, 0x0, 0x0)
perf_event_open(&(0x7f0000940000)={0x2, 0x70, 0xee6a, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x100, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0xff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x10001, 0x1}, 0x0, 0x400000000000000}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
mlock(&(0x7f00005b8000/0x3000)=nil, 0x3000)
ioctl$SNDRV_TIMER_IOCTL_SELECT(0xffffffffffffffff, 0x40345410, 0x0)
openat$uinput(0xffffffffffffff9c, &(0x7f0000000080)='/dev/uinput\x00', 0x2, 0x0)
mmap(&(0x7f000060b000/0x1000)=nil, 0x1000, 0x5, 0x8000400200000033, r1, 0x0)
perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x2, 0x9, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2000000, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x4000000, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8)
r2 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)={0x10b, 0x6, 0x209e1e, 0x3, 0x1}, 0x2c)
bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000b40)={r2, &(0x7f0000000040), 0x0, 0x1}, 0x20)
r3 = creat(&(0x7f0000000640)='./file0\x00', 0x100)
setsockopt$inet6_tcp_TCP_REPAIR_QUEUE(r3, 0x6, 0x14, &(0x7f0000000980), 0x4)
unlink(&(0x7f0000000940)='./file0\x00')
r4 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r5 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r5, 0x0)
ioctl$BINDER_GET_NODE_DEBUG_INFO(r4, 0xc018620b, &(0x7f0000000100))
ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f00000000c0)=ANY=[@ANYBLOB="bb8f0000"], 0x0, 0x0, 0x0})
ioctl$BINDER_SET_CONTEXT_MGR(r5, 0x40046207, 0x0)
shutdown(0xffffffffffffffff, 0x1)
prctl$PR_SET_NAME(0xf, &(0x7f0000000380)='/group.stat\x00')
ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)})
ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0x0, 0x0, &(0x7f0000000780)})

15:06:36 executing program 3:
r0 = socket$inet_udplite(0x2, 0x2, 0x88)
ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f3188b070")
r1 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r2 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)})

15:06:36 executing program 5:
r0 = socket$inet_udplite(0x2, 0x2, 0x88)
ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f3188b070")
syz_open_procfs(0x0, &(0x7f0000000940)='syscall\x00')
r1 = syz_open_procfs(0x0, &(0x7f0000000040)='fd\x00')
recvmmsg(0xffffffffffffffff, &(0x7f0000003840)=[{{0x0, 0x0, 0x0}}], 0x1, 0x0, 0x0)
perf_event_open(&(0x7f0000940000)={0x2, 0x70, 0xee6a, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x100, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0xff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x10001, 0x1}, 0x0, 0x400000000000000}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
mlock(&(0x7f00005b8000/0x3000)=nil, 0x3000)
ioctl$SNDRV_TIMER_IOCTL_SELECT(0xffffffffffffffff, 0x40345410, 0x0)
openat$uinput(0xffffffffffffff9c, &(0x7f0000000080)='/dev/uinput\x00', 0x2, 0x0)
mmap(&(0x7f000060b000/0x1000)=nil, 0x1000, 0x5, 0x8000400200000033, r1, 0x0)
unshare(0xfffffffffffffffd)
r2 = getpid()
sched_setscheduler(r2, 0x5, &(0x7f00000000c0))
open$dir(&(0x7f0000000400)='./file0\x00', 0x0, 0x9)
perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f00000004c0), 0x2}, 0x0, 0x0, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r3 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000340)='memory.current\x00', 0x0, 0x0)
ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, 0x0)
socketpair(0x1, 0x20000000000001, 0x0, &(0x7f0000000100)={<r4=>0xffffffffffffffff, <r5=>0xffffffffffffffff})
ioctl$PERF_EVENT_IOC_SET_FILTER(r5, 0x8914, &(0x7f0000000300)='lo\x00\x96o\xd6Q\xb9Y\xa9\xc8J,\x00\xd2\x97\x04\x03\xdc\r')
close(r3)
rt_sigprocmask(0x2, &(0x7f0000000240)={0x6}, &(0x7f00000002c0), 0x8)
ioctl$PERF_EVENT_IOC_SET_FILTER(r5, 0x8923, &(0x7f00000008c0)='lo\x00\x96o8\x0fd\xa1\xe3\xd7]b}\x1f\xa1Y\xad4\x90\x9d`\xd2\x98\x00\x00\x00 \'Y\x17]\x15c\xcaR\xdd\x98OC\x89\x1b\xe7\x84\xe2\x05\x80w\xd2|D\x8dK\x14Bx\xcbuH\xc2\xeec\xbf<>Y\x1a\xfc\x1f9OB\x81\x89\x186\xc5q@n\xb4\xb6s\xb0\x00\x00\xfc\x00\x00\b\x00\x00\xda\xef\xecE\xec\xd5I\xb2\x9b\xfe\x8d\x90?\x00\xe9\xe4~g:\xc1\xb2aj\x96\xbb\xa7\xe2\xc0\xdc\xf9Q\b\xeb\x16\x7fT\x11\xd3\r7\xe6\"f\xcf\x8e\xabd\x0ftp\x82\xae\xd2\x15\x8e+c\xf6\xbf\xe14>\xa6-\xa5c\xde\xd7\xab\xea\x1f\xf8s2\x9cVF\xd5\x18\xfe\x0e\x8f \x01\x00\x00y.\xfc*\x82\xa5\xa1p5\xc8{\xf7\xef\xab\xe8\x99\xebw#\x8at\x1c\x80\xfc\xb0\x95\xa2\xa7\xd7,Y]E8\x83X\xf5F\xdc\x88-\xf5\xb0\xb5^\xdb\x1a\xb6\xaa\x14\xe2\xb9\rh^J-\xd1\xbaUn\x04\'l\x1b\xe0o\xdb\xc8\x91%\x1c\xb5\xbf\xb6\x90\xb4\xc2\x7f]/\xb3\xe7\xc9\'\x94\xcfIo\xdf\x04\x95\xb5\x06\x84\x1fH>\xda\xc5\x04 \x94\x88\xeb\'\xd4;6\x7f\xd9\x99-\x1b|G\x8d\xd4\xb9%\xaaQ\xa0K\x10\x03\x93\xe1\xcc\xe7m\x80\'\xf0\xa5\xed(\r\xa8\x0f&\xb1\xf3\xff0\f\x82%_\x92\x8bD\xb9\xd9\xe7\xf2\xe4\xc1i#\xdc\x87A\xb9\xc7\r\x92\xfa\x11\x11\xb5\x1f\x03\x9d\xdd\x1bj\xdf\xacg\xe3\xa0S\xd3\x8a\xe1n\x97\xea\xf5\xa0\'\v\xe9\xa0\xf1 f\xaan\xcf\xb5i\xb6d\xbc\x92\v\xd58\x16\b\xb3_:\xa4!\ny\xc4&\nWMM\xa8\xc4\v\x9f\x01o\xf4\xab&\xb6\x17\x02P\xc3!N\xf4\b\x1a~\x91V1s\xe9\xbe\x9e\x9b\'\xcde\xb3\xa1\x86\"\xd7\x04\xf1\xc0!\xed\xff\xee$\xc89\x8cB0\xd1dD\xe0IP\x88\xa2\xf2Y\x9af$$\xf1cO\xf7P\xac\xca\x80:!\xb4\x94#\xcb^\x9f\'\x03\xe3\x93\xb9\x82\xbf\xcf\xc4\xe3\xf7\x03Oh\xf2r\xca\x8ff\xbb/\x9f*\xaf\x1a \xa5\xa0?%M\xa5\x86\x98\xf24\'1\xc7\f<\xcc@\xe8\x8a\xac.\xde\xe4\xc7\xf5\x9ck\xa40!\xe9\x14$\xb3\x05m\xb5m\xed\ft\x93\xd8\xa3\x80\'Y\xb9\x05\xbbt|\xbe\xbcz\n\xf3\xf5p\xf8\x9f~\x1b\xd0\v\x1cQ')
getsockopt$inet_IP_IPSEC_POLICY(r1, 0x0, 0x10, &(0x7f00000006c0)={{{@in6=@loopback}}, {{@in6=@initdev}}}, &(0x7f0000000500)=0xe8)
socketpair(0xfb5d5eb58d1b8277, 0x2, 0x2, &(0x7f0000000480))
syz_genetlink_get_family_id$SEG6(&(0x7f00000003c0)='SEG6\x00')
sendmsg$SEG6_CMD_DUMPHMAC(r4, &(0x7f0000000580)={&(0x7f0000000380)={0x10, 0x0, 0x0, 0x1000000}, 0xc, &(0x7f0000000440)={&(0x7f00000005c0)=ANY=[@ANYBLOB="2300260109447a0000000000000000660000001400001a0065a455e04ea56d0a47018c8e973bcac914471474a7e0d50a000eadd66d2e49a2ed40dcafa1e046ab6aacc2097d8f75bd9c8b8a220bdde116904efa3f9600f22ab388644f66c2d5baec4079a81bae1927e49e91a4964656d7b227702926af5be846f3de49fad39048633fd9161123894d9427f854a30cb0532c8f31f663380e40ce7f6cb15ec8baab3b7c6f"], 0x1}, 0x1, 0x0, 0x0, 0x8000}, 0x804)
r6 = creat(&(0x7f0000000280)='./bus\x00', 0x0)
arch_prctl$ARCH_MAP_VDSO_32(0x2002, 0x7e)
ftruncate(r6, 0x2008200)
open(&(0x7f0000000140)='./bus\x00', 0x4000, 0x0)

[ 1117.438323] binder: send failed reply for transaction 1155 to 1439:1442
[ 1117.450759] binder: send failed reply for transaction 1158, target dead
[ 1117.458850] binder: send failed reply for transaction 1161 to 1464:1467
[ 1117.466455] binder: send failed reply for transaction 1164, target dead
15:06:36 executing program 4:
r0 = syz_open_procfs(0x0, &(0x7f00000001c0)='net/softnet_stat\x00')
lseek(r0, 0x20000, 0x0)
ioctl$BLKPBSZGET(r0, 0x127b, &(0x7f0000000000))

15:06:36 executing program 1:
r0 = socket$inet_udplite(0x2, 0x2, 0x88)
ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f3188b070")
syz_open_procfs(0x0, &(0x7f0000000940)='syscall\x00')
syz_open_procfs(0x0, &(0x7f0000000040)='fd\x00')
recvmmsg(0xffffffffffffffff, &(0x7f0000003840)=[{{0x0, 0x0, 0x0}}], 0x1, 0x0, 0x0)
perf_event_open(&(0x7f0000940000)={0x2, 0x70, 0xee6a, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x100, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0xff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x10001, 0x1}, 0x0, 0x400000000000000}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
mlock(&(0x7f00005b8000/0x3000)=nil, 0x3000)
ioctl$SNDRV_TIMER_IOCTL_SELECT(0xffffffffffffffff, 0x40345410, 0x0)
openat$uinput(0xffffffffffffff9c, &(0x7f0000000080)='/dev/uinput\x00', 0x2, 0x0)
r1 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)={0x10b, 0x6, 0x209e1e, 0x3, 0x1}, 0x2c)
bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000b40)={r1, &(0x7f0000000040), 0x0, 0x1}, 0x20)
r2 = creat(&(0x7f0000000640)='./file0\x00', 0x100)
setsockopt$inet6_tcp_TCP_REPAIR_QUEUE(r2, 0x6, 0x14, &(0x7f0000000980), 0x4)
unlink(&(0x7f0000000940)='./file0\x00')
r3 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_GET_NODE_DEBUG_INFO(r3, 0xc018620b, &(0x7f0000000100))
ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)})
ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0x0, 0x0, &(0x7f0000000780)})

[ 1117.486180] binder: undelivered TRANSACTION_COMPLETE
[ 1117.493998] binder: undelivered TRANSACTION_ERROR: 29189
15:06:36 executing program 2:
r0 = socket$inet_udplite(0x2, 0x2, 0x88)
ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f3188b070")
syz_open_procfs(0x0, &(0x7f0000000940)='syscall\x00')
r1 = syz_open_procfs(0x0, &(0x7f0000000040)='fd\x00')
recvmmsg(0xffffffffffffffff, &(0x7f0000003840)=[{{0x0, 0x0, 0x0}}], 0x1, 0x0, 0x0)
perf_event_open(&(0x7f0000940000)={0x2, 0x70, 0xee6a, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x100, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0xff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x10001, 0x1}, 0x0, 0x400000000000000}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
mlock(&(0x7f00005b8000/0x3000)=nil, 0x3000)
ioctl$SNDRV_TIMER_IOCTL_SELECT(0xffffffffffffffff, 0x40345410, 0x0)
openat$uinput(0xffffffffffffff9c, &(0x7f0000000080)='/dev/uinput\x00', 0x2, 0x0)
mmap(&(0x7f000060b000/0x1000)=nil, 0x1000, 0x5, 0x8000400200000033, r1, 0x0)
perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x2, 0x9, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2000000, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x4000000, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8)
r2 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)={0x10b, 0x6, 0x209e1e, 0x3, 0x1}, 0x2c)
bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000b40)={r2, &(0x7f0000000040), 0x0, 0x1}, 0x20)
r3 = creat(&(0x7f0000000640)='./file0\x00', 0x100)
setsockopt$inet6_tcp_TCP_REPAIR_QUEUE(r3, 0x6, 0x14, &(0x7f0000000980), 0x4)
unlink(&(0x7f0000000940)='./file0\x00')
r4 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r5 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r5, 0x0)
ioctl$BINDER_GET_NODE_DEBUG_INFO(r4, 0xc018620b, &(0x7f0000000100))
ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f00000000c0)=ANY=[@ANYBLOB="bb8f0000"], 0x0, 0x0, 0x0})
ioctl$BINDER_SET_CONTEXT_MGR(r5, 0x40046207, 0x0)
shutdown(0xffffffffffffffff, 0x1)
prctl$PR_SET_NAME(0xf, &(0x7f0000000380)='/group.stat\x00')
ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)})
ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0x0, 0x0, &(0x7f0000000780)})
ioctl$BINDER_WRITE_READ(r5, 0xc0306201, &(0x7f00000001c0)={0x8, 0x0, &(0x7f0000000500)=[@release={0x40046306, 0x1}], 0x0, 0x0, &(0x7f00000009c0)})
creat(&(0x7f00000000c0)='./file0\x00', 0x0)

15:06:36 executing program 3:
socket$inet_udplite(0x2, 0x2, 0x88)
r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r1 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)})

[ 1117.570808] binder: release 1482:1488 transaction 1168 out, still active
[ 1117.587170] binder: send failed reply for transaction 1168, target dead
[ 1117.602690] binder: 1490:1491 unknown command 36795
15:06:36 executing program 4:
r0 = syz_open_procfs(0x0, &(0x7f00000001c0)='net/softnet_stat\x00')
lseek(r0, 0x20000, 0x0)
fcntl$addseals(r0, 0x409, 0x8)
write$UHID_CREATE(r0, &(0x7f0000000000)={0x0, 'syz0\x00', 'syz1\x00', 'syz0\x00', &(0x7f0000000200)=""/4096, 0x1000, 0x7, 0xb4, 0x0, 0x2, 0x80000000}, 0x120)

15:06:36 executing program 1:
r0 = socket$inet_udplite(0x2, 0x2, 0x88)
ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f3188b070")
syz_open_procfs(0x0, &(0x7f0000000940)='syscall\x00')
syz_open_procfs(0x0, &(0x7f0000000040)='fd\x00')
recvmmsg(0xffffffffffffffff, &(0x7f0000003840)=[{{0x0, 0x0, 0x0}}], 0x1, 0x0, 0x0)
perf_event_open(&(0x7f0000940000)={0x2, 0x70, 0xee6a, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x100, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0xff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x10001, 0x1}, 0x0, 0x400000000000000}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
mlock(&(0x7f00005b8000/0x3000)=nil, 0x3000)
ioctl$SNDRV_TIMER_IOCTL_SELECT(0xffffffffffffffff, 0x40345410, 0x0)
openat$uinput(0xffffffffffffff9c, &(0x7f0000000080)='/dev/uinput\x00', 0x2, 0x0)
r1 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)={0x10b, 0x6, 0x209e1e, 0x3, 0x1}, 0x2c)
bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000b40)={r1, &(0x7f0000000040), 0x0, 0x1}, 0x20)
r2 = creat(&(0x7f0000000640)='./file0\x00', 0x100)
setsockopt$inet6_tcp_TCP_REPAIR_QUEUE(r2, 0x6, 0x14, &(0x7f0000000980), 0x4)
unlink(&(0x7f0000000940)='./file0\x00')
r3 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_GET_NODE_DEBUG_INFO(r3, 0xc018620b, &(0x7f0000000100))
ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)})
ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0x0, 0x0, &(0x7f0000000780)})

[ 1117.617967] binder: 1490:1491 ioctl c0306201 20000140 returned -22
[ 1117.619714] binder: 1496:1499 transaction failed 29189/-22, size 24-8 line 3117
[ 1117.643596] binder: 1496:1499 BC_INCREFS_DONE u0000000000000000 no match
[ 1117.662776] binder: BINDER_SET_CONTEXT_MGR already set
15:06:36 executing program 3:
socket$inet_udplite(0x2, 0x2, 0x88)
r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r1 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)})

[ 1117.685121] binder: 1490:1507 BC_INCREFS_DONE node 1174 has no pending increfs request
[ 1117.688813] binder: 1501:1504 ioctl 40046207 0 returned -16
[ 1117.718022] binder: release 1501:1504 transaction 1176 out, still active
[ 1117.810838] binder: BINDER_SET_CONTEXT_MGR already set
[ 1117.818965] binder: 1515:1516 ioctl 40046207 0 returned -16
[ 1117.827518] binder: release 1515:1516 transaction 1182 out, still active
[ 1117.837721] binder: 1511:1518 BC_INCREFS_DONE node 1180 has no pending increfs request
15:06:37 executing program 0:
r0 = socket$inet_udplite(0x2, 0x2, 0x88)
ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f3188b070")
syz_open_procfs(0x0, &(0x7f0000000940)='syscall\x00')
r1 = syz_open_procfs(0x0, &(0x7f0000000040)='fd\x00')
recvmmsg(0xffffffffffffffff, &(0x7f0000003840)=[{{0x0, 0x0, 0x0}}], 0x1, 0x0, 0x0)
perf_event_open(&(0x7f0000940000)={0x2, 0x70, 0xee6a, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x100, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0xff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x10001, 0x1}, 0x0, 0x400000000000000}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
mlock(&(0x7f00005b8000/0x3000)=nil, 0x3000)
ioctl$SNDRV_TIMER_IOCTL_SELECT(0xffffffffffffffff, 0x40345410, 0x0)
openat$uinput(0xffffffffffffff9c, &(0x7f0000000080)='/dev/uinput\x00', 0x2, 0x0)
mmap(&(0x7f000060b000/0x1000)=nil, 0x1000, 0x5, 0x8000400200000033, r1, 0x0)
perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x2, 0x9, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2000000, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x4000000, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8)
r2 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)={0x10b, 0x6, 0x209e1e, 0x3, 0x1}, 0x2c)
bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000b40)={r2, &(0x7f0000000040), 0x0, 0x1}, 0x20)
r3 = creat(&(0x7f0000000640)='./file0\x00', 0x100)
setsockopt$inet6_tcp_TCP_REPAIR_QUEUE(r3, 0x6, 0x14, &(0x7f0000000980), 0x4)
unlink(&(0x7f0000000940)='./file0\x00')
r4 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r5 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r5, 0x0)
ioctl$BINDER_GET_NODE_DEBUG_INFO(r4, 0xc018620b, &(0x7f0000000100))
ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f00000000c0)=ANY=[@ANYBLOB="bb8f0000"], 0x0, 0x0, 0x0})
ioctl$BINDER_SET_CONTEXT_MGR(r5, 0x40046207, 0x0)
shutdown(0xffffffffffffffff, 0x1)
prctl$PR_SET_NAME(0xf, &(0x7f0000000380)='/group.stat\x00')
ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)})
ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0x0, 0x0, &(0x7f0000000780)})
ioctl$BINDER_WRITE_READ(r5, 0xc0306201, &(0x7f00000001c0)={0x8, 0x0, &(0x7f0000000500)=[@release={0x40046306, 0x1}], 0x0, 0x0, &(0x7f00000009c0)})
creat(&(0x7f00000000c0)='./file0\x00', 0x0)

15:06:37 executing program 4:
r0 = gettid()
syz_open_procfs(r0, &(0x7f0000000000)='net/softnet_stat\x00')

15:06:37 executing program 2:
r0 = socket$inet_udplite(0x2, 0x2, 0x88)
ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f3188b070")
syz_open_procfs(0x0, &(0x7f0000000940)='syscall\x00')
r1 = syz_open_procfs(0x0, &(0x7f0000000040)='fd\x00')
recvmmsg(0xffffffffffffffff, &(0x7f0000003840)=[{{0x0, 0x0, 0x0}}], 0x1, 0x0, 0x0)
perf_event_open(&(0x7f0000940000)={0x2, 0x70, 0xee6a, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x100, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0xff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x10001, 0x1}, 0x0, 0x400000000000000}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
mlock(&(0x7f00005b8000/0x3000)=nil, 0x3000)
ioctl$SNDRV_TIMER_IOCTL_SELECT(0xffffffffffffffff, 0x40345410, 0x0)
openat$uinput(0xffffffffffffff9c, &(0x7f0000000080)='/dev/uinput\x00', 0x2, 0x0)
mmap(&(0x7f000060b000/0x1000)=nil, 0x1000, 0x5, 0x8000400200000033, r1, 0x0)
perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x2, 0x9, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2000000, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x4000000, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8)
r2 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)={0x10b, 0x6, 0x209e1e, 0x3, 0x1}, 0x2c)
bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000b40)={r2, &(0x7f0000000040), 0x0, 0x1}, 0x20)
r3 = creat(&(0x7f0000000640)='./file0\x00', 0x100)
setsockopt$inet6_tcp_TCP_REPAIR_QUEUE(r3, 0x6, 0x14, &(0x7f0000000980), 0x4)
unlink(&(0x7f0000000940)='./file0\x00')
r4 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r5 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r5, 0x0)
ioctl$BINDER_GET_NODE_DEBUG_INFO(r4, 0xc018620b, &(0x7f0000000100))
ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f00000000c0)=ANY=[@ANYBLOB="bb8f0000"], 0x0, 0x0, 0x0})
ioctl$BINDER_SET_CONTEXT_MGR(r5, 0x40046207, 0x0)
shutdown(0xffffffffffffffff, 0x1)
prctl$PR_SET_NAME(0xf, &(0x7f0000000380)='/group.stat\x00')
ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)})
ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0x0, 0x0, &(0x7f0000000780)})
ioctl$BINDER_WRITE_READ(r5, 0xc0306201, &(0x7f00000001c0)={0x8, 0x0, &(0x7f0000000500)=[@release={0x40046306, 0x1}], 0x0, 0x0, &(0x7f00000009c0)})
creat(&(0x7f00000000c0)='./file0\x00', 0x0)

15:06:37 executing program 3:
socket$inet_udplite(0x2, 0x2, 0x88)
r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r1 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)})

15:06:37 executing program 5:
r0 = socket$inet_udplite(0x2, 0x2, 0x88)
ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f3188b070")
r1 = syz_open_procfs(0x0, &(0x7f0000000940)='syscall\x00')
r2 = syz_open_procfs(0x0, &(0x7f0000000040)='fd\x00')
recvmmsg(0xffffffffffffffff, &(0x7f0000003840)=[{{0x0, 0x0, 0x0}}], 0x1, 0x0, 0x0)
perf_event_open(&(0x7f0000940000)={0x2, 0x70, 0xee6a, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x100, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0xff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x10001, 0x1}, 0x0, 0x400000000000000}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
mlock(&(0x7f00005ba000/0x3000)=nil, 0x3000)
ioctl$SNDRV_TIMER_IOCTL_SELECT(0xffffffffffffffff, 0x40345410, 0x0)
mmap(&(0x7f000060b000/0x1000)=nil, 0x1000, 0x5, 0x8000400200000033, r2, 0x0)
unshare(0xfffffffffffffffd)
r3 = getpid()
sched_setscheduler(r3, 0x5, &(0x7f00000000c0))
open$dir(&(0x7f0000000400)='./file0\x00', 0x0, 0x0)
perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f00000004c0), 0x2}, 0x0, 0x0, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r4 = openat$cgroup_ro(r1, &(0x7f0000000340)='memory.current\x00', 0x0, 0x0)
ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, 0x0)
socketpair(0x1, 0x20000000000001, 0x0, &(0x7f0000000100)={<r5=>0xffffffffffffffff, <r6=>0xffffffffffffffff})
ioctl$PERF_EVENT_IOC_SET_FILTER(r1, 0x8914, &(0x7f0000000300)='lo\x00\x96o\xd6Q\xb9Y\xa9\xc8J,\x00\xd2\x97\x04\x03\xdc\r')
close(r4)
rt_sigprocmask(0x2, &(0x7f0000000240)={0x6}, &(0x7f00000002c0), 0x8)
ioctl$PERF_EVENT_IOC_SET_FILTER(r6, 0x8923, &(0x7f00000008c0)='lo\x00\x96o8\x0fd\xa1\xe3\xd7]b}\x1f\xa1Y\xad4\x90\x9d`\xd2\x98\x00\x00\x00 \'Y\x17]\x15c\xcaR\xdd\x98OC\x89\x1b\xe7\x84\xe2\x05\x80w\xd2|D\x8dK\x14Bx\xcbuH\xc2\xeec\xbf<>Y\x1a\xfc\x1f9OB\x81\x89\x186\xc5q@n\xb4\xb6s\xb0\x00\x00\xfc\x00\x00\b\x00\x00\xda\xef\xecE\xec\xd5I\xb2\x9b\xfe\x8d\x90?\x00\xe9\xe4~g:\xc1\xb2aj\x96\xbb\xa7\xe2\xc0\xdc\xf9Q\b\xeb\x16\x7fT\x11\xd3\r7\xe6\"f\xcf\x8e\xabd\x0ftp\x82\xae\xd2\x15\x8e+c\xf6\xbf\xe14>\xa6-\xa5c\xde\xd7\xab\xea\x1f\xf8s2\x9cVF\xd5\x18\xfe\x0e\x8f \x01\x00\x00y.\xfc*\x82\xa5\xa1p5\xc8{\xf7\xef\xab\xe8\x99\xebw#\x8at\x1c\x80\xfc\xb0\x95\xa2\xa7\xd7,Y]E8\x83X\xf5F\xdc\x88-\xf5\xb0\xb5^\xdb\x1a\xb6\xaa\x14\xe2\xb9\rh^J-\xd1\xbaUn\x04\'l\x1b\xe0o\xdb\xc8\x91%\x1c\xb5\xbf\xb6\x90\xb4\xc2\x7f]/\xb3\xe7\xc9\'\x94\xcfIo\xdf\x04\x95\xb5\x06\x84\x1fH>\xda\xc5\x04 \x94\x88\xeb\'\xd4;6\x7f\xd9\x99-\x1b|G\x8d\xd4\xb9%\xaaQ\xa0K\x10\x03\x93\xe1\xcc\xe7m\x80\'\xf0\xa5\xed(\r\xa8\x0f&\xb1\xf3\xff0\f\x82%_\x92\x8bD\xb9\xd9\xe7\xf2\xe4\xc1i#\xdc\x87A\xb9\xc7\r\x92\xfa\x11\x11\xb5\x1f\x03\x9d\xdd\x1bj\xdf\xacg\xe3\xa0S\xd3\x8a\xe1n\x97\xea\xf5\xa0\'\v\xe9\xa0\xf1 f\xaan\xcf\xb5i\xb6d\xbc\x92\v\xd58\x16\b\xb3_:\xa4!\ny\xc4&\nWMM\xa8\xc4\v\x9f\x01o\xf4\xab&\xb6\x17\x02P\xc3!N\xf4\b\x1a~\x91V1s\xe9\xbe\x9e\x9b\'\xcde\xb3\xa1\x86\"\xd7\x04\xf1\xc0!\xed\xff\xee$\xc89\x8cB0\xd1dD\xe0IP\x88\xa2\xf2Y\x9af$$\xf1cO\xf7P\xac\xca\x80:!\xb4\x94#\xcb^\x9f\'\x03\xe3\x93\xb9\x82\xbf\xcf\xc4\xe3\xf7\x03Oh\xf2r\xca\x8ff\xbb/\x9f*\xaf\x1a \xa5\xa0?%M\xa5\x86\x98\xf24\'1\xc7\f<\xcc@\xe8\x8a\xac.\xde\xe4\xc7\xf5\x9ck\xa40!\xe9\x14$\xb3\x05m\xb5m\xed\ft\x93\xd8\xa3\x80\'Y\xb9\x05\xbbt|\xbe\xbcz\n\xf3\xf5p\xf8\x9f~\x1b\xd0\v\x1cQ')
getsockopt$inet_IP_IPSEC_POLICY(r2, 0x0, 0x10, &(0x7f00000006c0)={{{@in6=@loopback}}, {{@in6=@initdev}}}, &(0x7f0000000500)=0xe8)
socketpair(0x2, 0x80f, 0x100, &(0x7f0000000480))
syz_genetlink_get_family_id$SEG6(&(0x7f00000003c0)='SEG6\x00')
sendmsg$SEG6_CMD_DUMPHMAC(r5, &(0x7f0000000580)={&(0x7f0000000380)={0x10, 0x0, 0x0, 0x1000000}, 0xc, &(0x7f0000000440)={&(0x7f00000005c0)=ANY=[@ANYBLOB="2300260109447a0000000000000000660000001400001a0065a455e04ea56d001000008e7a3bcac914471474a7e0d50a000eadd66d2e49a2ed40dcafa1e046ab6aacc2097d8f75bd9c8b8a220bdde116904efa3f9600f22ab388644f66c2d5baec4079a81bae1927e49e91a4964656d7b227701f26af5be846f3de49fad39048633fd9161123894d9427f854a30cb0532c8f31f663380e40ce7f6cb15ec8baab3b7c6f"], 0x1}, 0x1, 0x0, 0x0, 0x8000}, 0x804)
r7 = creat(&(0x7f0000000280)='./bus\x00', 0x0)
arch_prctl$ARCH_MAP_VDSO_32(0x2002, 0x7e)
ftruncate(r7, 0x2008200)
open(&(0x7f0000000140)='./bus\x00', 0x4000, 0x0)

[ 1118.308568] binder: send failed reply for transaction 1173 to 1490:1491
[ 1118.318352] binder: send failed reply for transaction 1176, target dead
[ 1118.327622] binder: send failed reply for transaction 1179 to 1511:1513
[ 1118.335749] binder: send failed reply for transaction 1182, target dead
[ 1118.344134] binder: undelivered TRANSACTION_COMPLETE
15:06:37 executing program 1:
r0 = socket$inet_udplite(0x2, 0x2, 0x88)
ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f3188b070")
syz_open_procfs(0x0, &(0x7f0000000940)='syscall\x00')
syz_open_procfs(0x0, &(0x7f0000000040)='fd\x00')
recvmmsg(0xffffffffffffffff, &(0x7f0000003840)=[{{0x0, 0x0, 0x0}}], 0x1, 0x0, 0x0)
perf_event_open(&(0x7f0000940000)={0x2, 0x70, 0xee6a, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x100, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0xff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x10001, 0x1}, 0x0, 0x400000000000000}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
mlock(&(0x7f00005b8000/0x3000)=nil, 0x3000)
ioctl$SNDRV_TIMER_IOCTL_SELECT(0xffffffffffffffff, 0x40345410, 0x0)
r1 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)={0x10b, 0x6, 0x209e1e, 0x3, 0x1}, 0x2c)
bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000b40)={r1, &(0x7f0000000040), 0x0, 0x1}, 0x20)
r2 = creat(&(0x7f0000000640)='./file0\x00', 0x100)
setsockopt$inet6_tcp_TCP_REPAIR_QUEUE(r2, 0x6, 0x14, &(0x7f0000000980), 0x4)
unlink(&(0x7f0000000940)='./file0\x00')
r3 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_GET_NODE_DEBUG_INFO(r3, 0xc018620b, &(0x7f0000000100))
ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)})
ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0x0, 0x0, &(0x7f0000000780)})

[ 1118.356092] binder: undelivered TRANSACTION_ERROR: 29189
[ 1118.372612] binder: release 1530:1531 transaction 1186 out, still active
15:06:37 executing program 3:
ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f3188b070")
r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r1 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)})

15:06:37 executing program 4:
getsockopt$sock_cred(0xffffffffffffff9c, 0x1, 0x11, &(0x7f0000000000), &(0x7f0000000040)=0xc)
fcntl$getownex(0xffffffffffffff9c, 0x10, &(0x7f0000000080)={0x0, <r0=>0x0})
r1 = syz_open_procfs(r0, &(0x7f00000001c0)='net/softnet_stat\x00')
lseek(r1, 0x20000, 0x0)

[ 1118.431364] binder: 1535:1537 unknown command 36795
[ 1118.433008] binder: send failed reply for transaction 1186, target dead
[ 1118.444287] binder: 1535:1537 ioctl c0306201 20000140 returned -22
[ 1118.501148] binder: BINDER_SET_CONTEXT_MGR already set
[ 1118.517086] binder: 1542:1544 ioctl 40046207 0 returned -16
[ 1118.519200] binder: 1535:1547 BC_INCREFS_DONE node 1191 has no pending increfs request
[ 1118.529189] binder: release 1542:1544 transaction 1196 out, still active
15:06:37 executing program 2:
r0 = socket$inet_udplite(0x2, 0x2, 0x88)
ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f3188b070")
syz_open_procfs(0x0, &(0x7f0000000940)='syscall\x00')
r1 = syz_open_procfs(0x0, &(0x7f0000000040)='fd\x00')
recvmmsg(0xffffffffffffffff, &(0x7f0000003840)=[{{0x0, 0x0, 0x0}}], 0x1, 0x0, 0x0)
perf_event_open(&(0x7f0000940000)={0x2, 0x70, 0xee6a, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x100, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0xff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x10001, 0x1}, 0x0, 0x400000000000000}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
mlock(&(0x7f00005b8000/0x3000)=nil, 0x3000)
ioctl$SNDRV_TIMER_IOCTL_SELECT(0xffffffffffffffff, 0x40345410, 0x0)
openat$uinput(0xffffffffffffff9c, &(0x7f0000000080)='/dev/uinput\x00', 0x2, 0x0)
mmap(&(0x7f000060b000/0x1000)=nil, 0x1000, 0x5, 0x8000400200000033, r1, 0x0)
perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x2, 0x9, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2000000, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x4000000, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8)
r2 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)={0x10b, 0x6, 0x209e1e, 0x3, 0x1}, 0x2c)
bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000b40)={r2, &(0x7f0000000040), 0x0, 0x1}, 0x20)
r3 = creat(&(0x7f0000000640)='./file0\x00', 0x100)
setsockopt$inet6_tcp_TCP_REPAIR_QUEUE(r3, 0x6, 0x14, &(0x7f0000000980), 0x4)
unlink(&(0x7f0000000940)='./file0\x00')
r4 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r5 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r5, 0x0)
ioctl$BINDER_GET_NODE_DEBUG_INFO(r4, 0xc018620b, &(0x7f0000000100))
ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f00000000c0)=ANY=[@ANYBLOB="bb8f0000"], 0x0, 0x0, 0x0})
ioctl$BINDER_SET_CONTEXT_MGR(r5, 0x40046207, 0x0)
shutdown(0xffffffffffffffff, 0x1)
prctl$PR_SET_NAME(0xf, &(0x7f0000000380)='/group.stat\x00')
ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)})
ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0x0, 0x0, &(0x7f0000000780)})
ioctl$BINDER_WRITE_READ(r5, 0xc0306201, &(0x7f00000001c0)={0x8, 0x0, &(0x7f0000000500)=[@release={0x40046306, 0x1}], 0x0, 0x0, &(0x7f00000009c0)})
creat(&(0x7f00000000c0)='./file0\x00', 0x0)

15:06:37 executing program 3:
ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f3188b070")
r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r1 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)})

[ 1118.547543] binder: 1539:1549 BC_INCREFS_DONE node 1194 has no pending increfs request
15:06:37 executing program 4:
r0 = syz_open_procfs(0x0, &(0x7f00000001c0)='net/softnet_stat\x00')
write$selinux_user(r0, &(0x7f0000000040)={'system_u:object_r:smartcard_device_t:s0', 0x20, 'user_u\x00'}, 0x2f)
openat$selinux_enforce(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/enforce\x00', 0x8100, 0x0)
mmap(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x2000001, 0x10, r0, 0x0)
lseek(r0, 0x20000, 0x2)

15:06:37 executing program 3:
ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f3188b070")
r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r1 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)})

[ 1118.625965] binder: BINDER_SET_CONTEXT_MGR already set
[ 1118.631751] binder: 1553:1557 ioctl 40046207 0 returned -16
[ 1118.641832] binder: release 1553:1557 transaction 1199 out, still active
[ 1118.716787] binder: BINDER_SET_CONTEXT_MGR already set
[ 1118.722957] binder: 1563:1565 ioctl 40046207 0 returned -16
[ 1118.732332] binder: release 1563:1565 transaction 1202 out, still active
15:06:38 executing program 0:
r0 = socket$inet_udplite(0x2, 0x2, 0x88)
ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f3188b070")
syz_open_procfs(0x0, &(0x7f0000000940)='syscall\x00')
r1 = syz_open_procfs(0x0, &(0x7f0000000040)='fd\x00')
recvmmsg(0xffffffffffffffff, &(0x7f0000003840)=[{{0x0, 0x0, 0x0}}], 0x1, 0x0, 0x0)
perf_event_open(&(0x7f0000940000)={0x2, 0x70, 0xee6a, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x100, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0xff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x10001, 0x1}, 0x0, 0x400000000000000}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
mlock(&(0x7f00005b8000/0x3000)=nil, 0x3000)
ioctl$SNDRV_TIMER_IOCTL_SELECT(0xffffffffffffffff, 0x40345410, 0x0)
openat$uinput(0xffffffffffffff9c, &(0x7f0000000080)='/dev/uinput\x00', 0x2, 0x0)
mmap(&(0x7f000060b000/0x1000)=nil, 0x1000, 0x5, 0x8000400200000033, r1, 0x0)
perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x2, 0x9, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2000000, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x4000000, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8)
r2 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)={0x10b, 0x6, 0x209e1e, 0x3, 0x1}, 0x2c)
bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000b40)={r2, &(0x7f0000000040), 0x0, 0x1}, 0x20)
r3 = creat(&(0x7f0000000640)='./file0\x00', 0x100)
setsockopt$inet6_tcp_TCP_REPAIR_QUEUE(r3, 0x6, 0x14, &(0x7f0000000980), 0x4)
unlink(&(0x7f0000000940)='./file0\x00')
r4 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r5 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r5, 0x0)
ioctl$BINDER_GET_NODE_DEBUG_INFO(r4, 0xc018620b, &(0x7f0000000100))
ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f00000000c0)=ANY=[@ANYBLOB="bb8f0000"], 0x0, 0x0, 0x0})
ioctl$BINDER_SET_CONTEXT_MGR(r5, 0x40046207, 0x0)
shutdown(0xffffffffffffffff, 0x1)
prctl$PR_SET_NAME(0xf, &(0x7f0000000380)='/group.stat\x00')
ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)})
ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0x0, 0x0, &(0x7f0000000780)})
ioctl$BINDER_WRITE_READ(r5, 0xc0306201, &(0x7f00000001c0)={0x8, 0x0, &(0x7f0000000500)=[@release={0x40046306, 0x1}], 0x0, 0x0, &(0x7f00000009c0)})
creat(&(0x7f00000000c0)='./file0\x00', 0x0)

15:06:38 executing program 4:
perf_event_open(&(0x7f000025c000)={0x1, 0x70, 0x5, 0x0, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
pipe(&(0x7f0000000100)={<r0=>0xffffffffffffffff, <r1=>0xffffffffffffffff})
write(r1, &(0x7f0000000100), 0xfffffdbc)
read(r0, &(0x7f0000000200)=""/250, 0x50c7e3e3)
accept4$packet(r0, &(0x7f0000000080)={0x11, 0x0, <r2=>0x0, 0x1, 0x0, 0x6, @random}, &(0x7f00000000c0)=0x14, 0x0)
setxattr$trusted_overlay_nlink(&(0x7f00000003c0)='./file0\x00', &(0x7f0000000400)='trusted.overlay.nlink\x00', &(0x7f0000000440)={'U+', 0x1}, 0x28, 0x1)
setsockopt$inet_pktinfo(r1, 0x0, 0x8, &(0x7f0000000140)={r2, @multicast1, @empty}, 0xc)
ioctl$sock_inet_tcp_SIOCOUTQNSD(r0, 0x894b, &(0x7f0000000040))
r3 = syz_open_procfs(0x0, &(0x7f0000000000)='net/softnet_stat\x00')
r4 = syz_genetlink_get_family_id$tipc2(&(0x7f00000001c0)='TIPCv2\x00')
sendmsg$TIPC_NL_NET_SET(r3, &(0x7f0000000380)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x8000000}, 0xc, &(0x7f0000000340)={&(0x7f0000000300)={0x20, r4, 0x4, 0x70bd26, 0x25dfdbfc, {}, [@TIPC_NLA_MON={0xc, 0x9, [@TIPC_NLA_MON_ACTIVATION_THRESHOLD={0x8}]}]}, 0x20}, 0x1, 0x0, 0x0, 0x8000}, 0x4000)
lseek(r3, 0x20000, 0x0)

15:06:38 executing program 2:
ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f3188b070")
r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r1 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)})

15:06:38 executing program 5:
r0 = socket$inet_udplite(0x2, 0x2, 0x88)
ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f3188b070")
syz_open_procfs(0x0, &(0x7f0000000940)='syscall\x00')
r1 = syz_open_procfs(0x0, &(0x7f0000000040)='fd\x00')
recvmmsg(0xffffffffffffffff, &(0x7f0000003840)=[{{0x0, 0x0, 0x0}}], 0x1, 0x0, 0x0)
perf_event_open(&(0x7f0000940000)={0x2, 0x70, 0xee6a, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x100, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0xff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x10001, 0x1}, 0x0, 0x400000000000000}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
mlock(&(0x7f00005b8000/0x3000)=nil, 0x3000)
ioctl$SNDRV_TIMER_IOCTL_SELECT(0xffffffffffffffff, 0x40345410, 0x0)
openat$uinput(0xffffffffffffff9c, &(0x7f0000000080)='/dev/uinput\x00', 0x2, 0x0)
mmap(&(0x7f000060b000/0x1000)=nil, 0x1000, 0x5, 0x8000400200000033, r1, 0x0)
unshare(0xfffffffffffffffd)
r2 = getpid()
sched_setscheduler(r2, 0x5, &(0x7f00000000c0))
open$dir(&(0x7f0000000400)='./file0\x00', 0x0, 0x0)
perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f00000004c0), 0x2}, 0x0, 0x0, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r3 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000340)='memory.current\x00', 0x0, 0x0)
ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, 0x0)
socketpair(0xfffffffffffffffe, 0x20000000000001, 0x0, &(0x7f0000000200)={<r4=>0xffffffffffffffff, <r5=>0xffffffffffffffff})
ioctl$PERF_EVENT_IOC_SET_FILTER(r5, 0x8914, &(0x7f0000000300)='lo\x00\x96o\xd6Q\xb9Y\xa9\xc8J,\x00\xd2\x97\x04\x03\xdc\r')
close(r3)
rt_sigprocmask(0x2, &(0x7f0000000240)={0x6}, &(0x7f00000002c0), 0x8)
ioctl$PERF_EVENT_IOC_SET_FILTER(r5, 0x8923, &(0x7f00000008c0)='lo\x00\x96o8\x0fd\xa1\xe3\xd7]b}\x1f\xa1Y\xad4\x90\x9d`\xd2\x98\x00\x00\x00 \'Y\x17]\x15c\xcaR\xdd\x98OC\x89\x1b\xe7\x84\xe2\x05\x80w\xd2|D\x8dK\x14Bx\xcbuH\xc2\xeec\xbf<>Y\x1a\xfc\x1f9OB\x81\x89\x186\xc5q@n\xb4\xb6s\xb0\x00\x00\xfc\x00\x00\b\x00\x00\xda\xef\xecE\xec\xd5I\xb2\x9b\xfe\x8d\x90?\x00\xe9\xe4~g:\xc1\xb2aj\x96\xbb\xa7\xe2\xc0\xdc\xf9Q\b\xeb\x16\x7fT\x11\xd3\r7\xe6\"f\xcf\x8e\xabd\x0ftp\x82\xae\xd2\x15\x8e+c\xf6\xbf\xe14>\xa6-\xa5c\xde\xd7\xab\xea\x1f\xf8s2\x9cVF\xd5\x18\xfe\x0e\x8f \x01\x00\x00y.\xfc*\x82\xa5\xa1p5\xc8{\xf7\xef\xab\xe8\x99\xebw#\x8at\x1c\x80\xfc\xb0\x95\xa2\xa7\xd7,Y]E8\x83X\xf5F\xdc\x88-\xf5\xb0\xb5^\xdb\x1a\xb6\xaa\x14\xe2\xb9\rh^J-\xd1\xbaUn\x04\'l\x1b\xe0o\xdb\xc8\x91%\x1c\xb5\xbf\xb6\x90\xb4\xc2\x7f]/\xb3\xe7\xc9\'\x94\xcfIo\xdf\x04\x95\xb5\x06\x84\x1fH>\xda\xc5\x04 \x94\x88\xeb\'\xd4;6\x7f\xd9\x99-\x1b|G\x8d\xd4\xb9%\xaaQ\xa0K\x10\x03\x93\xe1\xcc\xe7m\x80\'\xf0\xa5\xed(\r\xa8\x0f&\xb1\xf3\xff0\f\x82%_\x92\x8bD\xb9\xd9\xe7\xf2\xe4\xc1i#\xdc\x87A\xb9\xc7\r\x92\xfa\x11\x11\xb5\x1f\x03\x9d\xdd\x1bj\xdf\xacg\xe3\xa0S\xd3\x8a\xe1n\x97\xea\xf5\xa0\'\v\xe9\xa0\xf1 f\xaan\xcf\xb5i\xb6d\xbc\x92\v\xd58\x16\b\xb3_:\xa4!\ny\xc4&\nWMM\xa8\xc4\v\x9f\x01o\xf4\xab&\xb6\x17\x02P\xc3!N\xf4\b\x1a~\x91V1s\xe9\xbe\x9e\x9b\'\xcde\xb3\xa1\x86\"\xd7\x04\xf1\xc0!\xed\xff\xee$\xc89\x8cB0\xd1dD\xe0IP\x88\xa2\xf2Y\x9af$$\xf1cO\xf7P\xac\xca\x80:!\xb4\x94#\xcb^\x9f\'\x03\xe3\x93\xb9\x82\xbf\xcf\xc4\xe3\xf7\x03Oh\xf2r\xca\x8ff\xbb/\x9f*\xaf\x1a \xa5\xa0?%M\xa5\x86\x98\xf24\'1\xc7\f<\xcc@\xe8\x8a\xac.\xde\xe4\xc7\xf5\x9ck\xa40!\xe9\x14$\xb3\x05m\xb5m\xed\ft\x93\xd8\xa3\x80\'Y\xb9\x05\xbbt|\xbe\xbcz\n\xf3\xf5p\xf8\x9f~\x1b\xd0\v\x1cQ')
getsockopt$inet_IP_IPSEC_POLICY(r1, 0x0, 0x10, &(0x7f00000006c0)={{{@in6=@loopback}}, {{@in6=@initdev}}}, &(0x7f0000000500)=0xe8)
socketpair(0x2, 0x2000000080003, 0x100, &(0x7f0000000480))
syz_genetlink_get_family_id$SEG6(&(0x7f00000003c0)='SEG6\x00')
sendmsg$SEG6_CMD_DUMPHMAC(r4, &(0x7f0000000580)={&(0x7f0000000380)={0x10, 0x0, 0x0, 0x1000000}, 0xc, &(0x7f0000000440)={&(0x7f00000005c0)=ANY=[@ANYBLOB="2300260109447a0000000000000000660000001400001a0065a455e04ea56d0a47018c8e973bcac914471474a7e0d50a000eadd66d2e49a2ed40dcafa1e046ab6aacc2097d8f75bd9c8b8a220bdde116904efa3f9600f22ab388644f66c2d5baec4079a81bae1927e49e91a4964656d7b227702926af5be846f3de49fad39048633fd9161123894d9427f854a30cb0532c8f31f663380e40ce7f6cb15ec8baab3b7c6f"], 0x1}, 0x1, 0x0, 0x0, 0x8000}, 0x804)
r6 = creat(&(0x7f0000000280)='./bus\x00', 0x0)
arch_prctl$ARCH_MAP_VDSO_32(0x2002, 0x7e)
ftruncate(r6, 0x2008200)
open(&(0x7f0000000140)='./bus\x00', 0x4000, 0x0)

15:06:38 executing program 3:
socket$inet_udplite(0x2, 0x2, 0x88)
ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f3188b070")
r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r1 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)})

15:06:38 executing program 1:
r0 = socket$inet_udplite(0x2, 0x2, 0x88)
ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f3188b070")
syz_open_procfs(0x0, &(0x7f0000000940)='syscall\x00')
syz_open_procfs(0x0, &(0x7f0000000040)='fd\x00')
recvmmsg(0xffffffffffffffff, &(0x7f0000003840)=[{{0x0, 0x0, 0x0}}], 0x1, 0x0, 0x0)
perf_event_open(&(0x7f0000940000)={0x2, 0x70, 0xee6a, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x100, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0xff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x10001, 0x1}, 0x0, 0x400000000000000}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
mlock(&(0x7f00005b8000/0x3000)=nil, 0x3000)
r1 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)={0x10b, 0x6, 0x209e1e, 0x3, 0x1}, 0x2c)
bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000b40)={r1, &(0x7f0000000040), 0x0, 0x1}, 0x20)
r2 = creat(&(0x7f0000000640)='./file0\x00', 0x100)
setsockopt$inet6_tcp_TCP_REPAIR_QUEUE(r2, 0x6, 0x14, &(0x7f0000000980), 0x4)
unlink(&(0x7f0000000940)='./file0\x00')
r3 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_GET_NODE_DEBUG_INFO(r3, 0xc018620b, &(0x7f0000000100))
ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)})
ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0x0, 0x0, &(0x7f0000000780)})

[ 1119.190677] binder: send failed reply for transaction 1190 to 1535:1537
[ 1119.198820] binder: send failed reply for transaction 1193 to 1539:1541
[ 1119.208514] binder: send failed reply for transaction 1196, target dead
[ 1119.216542] binder: send failed reply for transaction 1199, target dead
[ 1119.225247] binder: send failed reply for transaction 1202, target dead
[ 1119.234121] binder: undelivered TRANSACTION_ERROR: 29189
15:06:38 executing program 3:
socket$inet_udplite(0x2, 0x2, 0x88)
ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f3188b070")
r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r1 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)})

15:06:38 executing program 2:
ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f3188b070")
r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r1 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)})

[ 1119.250215] binder: release 1570:1574 transaction 1206 out, still active
[ 1119.266784] binder: send failed reply for transaction 1206, target dead
15:06:38 executing program 3:
socket$inet_udplite(0x2, 0x2, 0x88)
ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f3188b070")
r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r1 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)})

[ 1119.351420] binder: 1581:1585 transaction failed 29189/-22, size 24-8 line 3117
[ 1119.351543] binder: 1576:1578 unknown command 36795
[ 1119.367673] binder: 1581:1585 BC_INCREFS_DONE u0000000000000000 no match
[ 1119.379306] binder: release 1584:1587 transaction 1211 out, still active
[ 1119.389871] binder: 1576:1578 ioctl c0306201 20000140 returned -22
15:06:38 executing program 2:
ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f3188b070")
r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r1 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)})

[ 1119.392993] binder: send failed reply for transaction 1211, target dead
15:06:38 executing program 1:
r0 = socket$inet_udplite(0x2, 0x2, 0x88)
ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f3188b070")
syz_open_procfs(0x0, &(0x7f0000000940)='syscall\x00')
syz_open_procfs(0x0, &(0x7f0000000040)='fd\x00')
recvmmsg(0xffffffffffffffff, &(0x7f0000003840)=[{{0x0, 0x0, 0x0}}], 0x1, 0x0, 0x0)
perf_event_open(&(0x7f0000940000)={0x2, 0x70, 0xee6a, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x100, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0xff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x10001, 0x1}, 0x0, 0x400000000000000}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
mlock(&(0x7f00005b8000/0x3000)=nil, 0x3000)
r1 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)={0x10b, 0x6, 0x209e1e, 0x3, 0x1}, 0x2c)
bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000b40)={r1, &(0x7f0000000040), 0x0, 0x1}, 0x20)
r2 = creat(&(0x7f0000000640)='./file0\x00', 0x100)
setsockopt$inet6_tcp_TCP_REPAIR_QUEUE(r2, 0x6, 0x14, &(0x7f0000000980), 0x4)
unlink(&(0x7f0000000940)='./file0\x00')
r3 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_GET_NODE_DEBUG_INFO(r3, 0xc018620b, &(0x7f0000000100))
ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)})
ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0x0, 0x0, &(0x7f0000000780)})

15:06:38 executing program 0:
r0 = socket$inet_udplite(0x2, 0x2, 0x88)
ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f3188b070")
syz_open_procfs(0x0, &(0x7f0000000940)='syscall\x00')
r1 = syz_open_procfs(0x0, &(0x7f0000000040)='fd\x00')
recvmmsg(0xffffffffffffffff, &(0x7f0000003840)=[{{0x0, 0x0, 0x0}}], 0x1, 0x0, 0x0)
perf_event_open(&(0x7f0000940000)={0x2, 0x70, 0xee6a, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x100, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0xff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x10001, 0x1}, 0x0, 0x400000000000000}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
mlock(&(0x7f00005b8000/0x3000)=nil, 0x3000)
ioctl$SNDRV_TIMER_IOCTL_SELECT(0xffffffffffffffff, 0x40345410, 0x0)
openat$uinput(0xffffffffffffff9c, &(0x7f0000000080)='/dev/uinput\x00', 0x2, 0x0)
mmap(&(0x7f000060b000/0x1000)=nil, 0x1000, 0x5, 0x8000400200000033, r1, 0x0)
perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x2, 0x9, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2000000, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x4000000, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8)
r2 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)={0x10b, 0x6, 0x209e1e, 0x3, 0x1}, 0x2c)
bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000b40)={r2, &(0x7f0000000040), 0x0, 0x1}, 0x20)
r3 = creat(&(0x7f0000000640)='./file0\x00', 0x100)
setsockopt$inet6_tcp_TCP_REPAIR_QUEUE(r3, 0x6, 0x14, &(0x7f0000000980), 0x4)
unlink(&(0x7f0000000940)='./file0\x00')
r4 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r5 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r5, 0x0)
ioctl$BINDER_GET_NODE_DEBUG_INFO(r4, 0xc018620b, &(0x7f0000000100))
ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f00000000c0)=ANY=[@ANYBLOB="bb8f0000"], 0x0, 0x0, 0x0})
ioctl$BINDER_SET_CONTEXT_MGR(r5, 0x40046207, 0x0)
shutdown(0xffffffffffffffff, 0x1)
prctl$PR_SET_NAME(0xf, &(0x7f0000000380)='/group.stat\x00')
ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)})
ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0x0, 0x0, &(0x7f0000000780)})
ioctl$BINDER_WRITE_READ(r5, 0xc0306201, &(0x7f00000001c0)={0x8, 0x0, &(0x7f0000000500)=[@release={0x40046306, 0x1}], 0x0, 0x0, &(0x7f00000009c0)})
creat(&(0x7f00000000c0)='./file0\x00', 0x0)

[ 1119.445718] binder: release 1576:1591 transaction 1215 out, still active
[ 1119.474546] binder: BINDER_SET_CONTEXT_MGR already set
15:06:38 executing program 3:
r0 = socket$inet_udplite(0x2, 0x2, 0x88)
ioctl(r0, 0x0, &(0x7f0000000000)="0adc1f123c123f3188b070")
r1 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r2 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)})

[ 1119.490565] binder: 1593:1596 ioctl 40046207 0 returned -16
[ 1119.492399] binder: send failed reply for transaction 1215, target dead
[ 1119.499489] binder: 1593:1596 transaction failed 29189/-22, size 24-8 line 3117
[ 1119.601549] binder: 1601:1605 transaction failed 29189/-22, size 24-8 line 3117
[ 1119.613262] binder: 1602:1604 unknown command 36795
[ 1119.620909] binder: 1601:1605 BC_INCREFS_DONE u0000000000000000 no match
[ 1119.639291] binder: send failed reply for transaction 1221 to 1607:1608
[ 1119.646612] binder: 1602:1604 ioctl c0306201 20000140 returned -22
[ 1119.653910] binder: undelivered TRANSACTION_ERROR: 29189
[ 1119.727251] binder: 1602:1609 BC_INCREFS_DONE node 1226 has no pending increfs request
15:06:38 executing program 3:
r0 = socket$inet_udplite(0x2, 0x2, 0x88)
ioctl(r0, 0x0, &(0x7f0000000000)="0adc1f123c123f3188b070")
r1 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r2 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)})

15:06:38 executing program 4:
r0 = openat$selinux_avc_cache_stats(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/avc/cache_stats\x00', 0x0, 0x0)
fcntl$notify(r0, 0x402, 0xc)
r1 = syz_open_procfs(0x0, &(0x7f00000001c0)='net/softnet_stat\x00')
lseek(r1, 0x20000, 0x0)

15:06:38 executing program 2:
r0 = socket$inet_udplite(0x2, 0x2, 0x88)
ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f3188b070")
syz_open_procfs(0x0, &(0x7f0000000940)='syscall\x00')
r1 = syz_open_procfs(0x0, &(0x7f0000000040)='fd\x00')
recvmmsg(0xffffffffffffffff, &(0x7f0000003840)=[{{0x0, 0x0, 0x0}}], 0x1, 0x0, 0x0)
perf_event_open(&(0x7f0000940000)={0x2, 0x70, 0xee6a, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x100, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0xff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x10001, 0x1}, 0x0, 0x400000000000000}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
mlock(&(0x7f00005b8000/0x3000)=nil, 0x3000)
ioctl$SNDRV_TIMER_IOCTL_SELECT(0xffffffffffffffff, 0x40345410, 0x0)
openat$uinput(0xffffffffffffff9c, &(0x7f0000000080)='/dev/uinput\x00', 0x2, 0x0)
mmap(&(0x7f000060b000/0x1000)=nil, 0x1000, 0x5, 0x8000400200000033, r1, 0x0)
perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x2, 0x9, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2000000, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x4000000, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8)
r2 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)={0x10b, 0x6, 0x209e1e, 0x3, 0x1}, 0x2c)
bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000b40)={r2, &(0x7f0000000040), 0x0, 0x1}, 0x20)
r3 = creat(&(0x7f0000000640)='./file0\x00', 0x100)
setsockopt$inet6_tcp_TCP_REPAIR_QUEUE(r3, 0x6, 0x14, &(0x7f0000000980), 0x4)
unlink(&(0x7f0000000940)='./file0\x00')
r4 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r5 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r5, 0x0)
ioctl$BINDER_GET_NODE_DEBUG_INFO(r4, 0xc018620b, &(0x7f0000000100))
ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f00000000c0)=ANY=[@ANYBLOB="bb8f0000"], 0x0, 0x0, 0x0})
ioctl$BINDER_SET_CONTEXT_MGR(r5, 0x40046207, 0x0)
shutdown(0xffffffffffffffff, 0x1)
prctl$PR_SET_NAME(0xf, &(0x7f0000000380)='/group.stat\x00')
ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)})
ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0x0, 0x0, &(0x7f0000000780)})
ioctl$BINDER_WRITE_READ(r5, 0xc0306201, &(0x7f00000001c0)={0x8, 0x0, &(0x7f0000000500)=[@release={0x40046306, 0x1}], 0x0, 0x0, &(0x7f00000009c0)})
creat(&(0x7f00000000c0)='./file0\x00', 0x0)

15:06:38 executing program 1:
r0 = socket$inet_udplite(0x2, 0x2, 0x88)
ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f3188b070")
syz_open_procfs(0x0, &(0x7f0000000940)='syscall\x00')
syz_open_procfs(0x0, &(0x7f0000000040)='fd\x00')
recvmmsg(0xffffffffffffffff, &(0x7f0000003840)=[{{0x0, 0x0, 0x0}}], 0x1, 0x0, 0x0)
perf_event_open(&(0x7f0000940000)={0x2, 0x70, 0xee6a, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x100, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0xff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x10001, 0x1}, 0x0, 0x400000000000000}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
mlock(&(0x7f00005b8000/0x3000)=nil, 0x3000)
r1 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)={0x10b, 0x6, 0x209e1e, 0x3, 0x1}, 0x2c)
bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000b40)={r1, &(0x7f0000000040), 0x0, 0x1}, 0x20)
r2 = creat(&(0x7f0000000640)='./file0\x00', 0x100)
setsockopt$inet6_tcp_TCP_REPAIR_QUEUE(r2, 0x6, 0x14, &(0x7f0000000980), 0x4)
unlink(&(0x7f0000000940)='./file0\x00')
r3 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_GET_NODE_DEBUG_INFO(r3, 0xc018620b, &(0x7f0000000100))
ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)})
ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0x0, 0x0, &(0x7f0000000780)})

15:06:38 executing program 5:
r0 = socket$inet_udplite(0x2, 0x2, 0x88)
ioctl(r0, 0x1000008916, &(0x7f0000000280)="0adc1f123c123f3188b070")
syz_open_procfs(0x0, &(0x7f0000000940)='syscall\x00')
r1 = syz_open_procfs(0x0, &(0x7f0000000040)='fd\x00')
recvmmsg(0xffffffffffffffff, &(0x7f0000003840)=[{{0x0, 0x0, 0x0}}], 0x1, 0x0, 0x0)
perf_event_open(&(0x7f0000940000)={0x2, 0x70, 0xee6a, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x100, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0xff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x10001, 0x1}, 0x0, 0x400000000000000}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
mlock(&(0x7f00005b8000/0x3000)=nil, 0x3000)
ioctl$SNDRV_TIMER_IOCTL_SELECT(0xffffffffffffffff, 0x40345410, 0x0)
openat$uinput(0xffffffffffffff9c, &(0x7f0000000080)='/dev/uinput\x00', 0x2, 0x0)
mmap(&(0x7f000060b000/0x1000)=nil, 0x1000, 0x5, 0x8000400200000033, r1, 0x0)
unshare(0xfffffffffffffffd)
r2 = getpid()
sched_setscheduler(r2, 0x5, &(0x7f00000000c0))
open$dir(&(0x7f0000000400)='./file0\x00', 0x0, 0x0)
perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f00000004c0), 0x2}, 0x0, 0x0, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r3 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000340)='memory.current\x00', 0x0, 0x0)
ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, 0x0)
socketpair(0x1, 0x20000000000001, 0x0, &(0x7f0000000100)={<r4=>0xffffffffffffffff, <r5=>0xffffffffffffffff})
ioctl$PERF_EVENT_IOC_SET_FILTER(r5, 0x8914, &(0x7f0000000300)='lo\x00\x96o\xd6Q\xb9Y\xa9\xc8J,\x00\xd2\x97\x04\x03\xdc\r')
close(r3)
rt_sigprocmask(0x2, &(0x7f0000000240)={0x6}, &(0x7f00000002c0), 0x8)
ioctl$PERF_EVENT_IOC_SET_FILTER(r5, 0x8923, &(0x7f00000008c0)='lo\x00\x96o8\x0fd\xa1\xe3\xd7]b}\x1f\xa1Y\xad4\x90\x9d`\xd2\x98\x00\x00\x00 \'Y\x17]\x15c\xcaR\xdd\x98OC\x89\x1b\xe7\x84\xe2\x05\x80w\xd2|D\x8dK\x14Bx\xcbuH\xc2\xeec\xbf<>Y\x1a\xfc\x1f9OB\x81\x89\x186\xc5q@n\xb4\xb6s\xb0\x00\x00\xfc\x00\x00\b\x00\x00\xda\xef\xecE\xec\xd5I\xb2\x9b\xfe\x8d\x90?\x00\xe9\xe4~g:\xc1\xb2aj\x96\xbb\xa7\xe2\xc0\xdc\xf9Q\b\xeb\x16\x7fT\x11\xd3\r7\xe6\"f\xcf\x8e\xabd\x0ftp\x82\xae\xd2\x15\x8e+c\xf6\xbf\xe14>\xa6-\xa5c\xde\xd7\xab\xea\x1f\xf8s2\x9cVF\xd5\x18\xfe\x0e\x8f \x01\x00\x00y.\xfc*\x82\xa5\xa1p5\xc8{\xf7\xef\xab\xe8\x99\xebw#\x8at\x1c\x80\xfc\xb0\x95\xa2\xa7\xd7,Y]E8\x83X\xf5F\xdc\x88-\xf5\xb0\xb5^\xdb\x1a\xb6\xaa\x14\xe2\xb9\rh^J-\xd1\xbaUn\x04\'l\x1b\xe0o\xdb\xc8\x91%\x1c\xb5\xbf\xb6\x90\xb4\xc2\x7f]/\xb3\xe7\xc9\'\x94\xcfIo\xdf\x04\x95\xb5\x06\x84\x1fH>\xda\xc5\x04 \x94\x88\xeb\'\xd4;6\x7f\xd9\x99-\x1b|G\x8d\xd4\xb9%\xaaQ\xa0K\x10\x03\x93\xe1\xcc\xe7m\x80\'\xf0\xa5\xed(\r\xa8\x0f&\xb1\xf3\xff0\f\x82%_\x92\x8bD\xb9\xd9\xe7\xf2\xe4\xc1i#\xdc\x87A\xb9\xc7\r\x92\xfa\x11\x11\xb5\x1f\x03\x9d\xdd\x1bj\xdf\xacg\xe3\xa0S\xd3\x8a\xe1n\x97\xea\xf5\xa0\'\v\xe9\xa0\xf1 f\xaan\xcf\xb5i\xb6d\xbc\x92\v\xd58\x16\b\xb3_:\xa4!\ny\xc4&\nWMM\xa8\xc4\v\x9f\x01o\xf4\xab&\xb6\x17\x02P\xc3!N\xf4\b\x1a~\x91V1s\xe9\xbe\x9e\x9b\'\xcde\xb3\xa1\x86\"\xd7\x04\xf1\xc0!\xed\xff\xee$\xc89\x8cB0\xd1dD\xe0IP\x88\xa2\xf2Y\x9af$$\xf1cO\xf7P\xac\xca\x80:!\xb4\x94#\xcb^\x9f\'\x03\xe3\x93\xb9\x82\xbf\xcf\xc4\xe3\xf7\x03Oh\xf2r\xca\x8ff\xbb/\x9f*\xaf\x1a \xa5\xa0?%M\xa5\x86\x98\xf24\'1\xc7\f<\xcc@\xe8\x8a\xac.\xde\xe4\xc7\xf5\x9ck\xa40!\xe9\x14$\xb3\x05m\xb5m\xed\ft\x93\xd8\xa3\x80\'Y\xb9\x05\xbbt|\xbe\xbcz\n\xf3\xf5p\xf8\x9f~\x1b\xd0\v\x1cQ')
getsockopt$inet_IP_IPSEC_POLICY(r1, 0x0, 0x10, &(0x7f00000006c0)={{{@in6=@loopback}}, {{@in6=@initdev}}}, &(0x7f0000000500)=0xe8)
socketpair(0x2, 0x2000000080003, 0x100, &(0x7f0000000480))
syz_genetlink_get_family_id$SEG6(&(0x7f00000003c0)='SEG6\x00')
sendmsg$SEG6_CMD_DUMPHMAC(r4, &(0x7f0000000580)={&(0x7f0000000380)={0x10, 0x0, 0x0, 0x1000000}, 0xc, &(0x7f0000000440)={&(0x7f00000005c0)=ANY=[@ANYBLOB="260109447a0000000000000000660000001400001a0065a455e07319cc5af92505fa973bcac914471474a7e0d50a000eadd66d2e49a2ed40dcafa1e046ab6aacc2097d8f75bd9c8b8a220bdde116904efa3f9600f22ab388644f66c2d5baec4079a81bae1927e49e91a4964656d7b227702926af5be846f3de49fad39048633fd9161123894d9427f854a30cb0532c8f31f663380e40ce7f6cb15ec8baab3b7c6f0000"], 0x1}, 0x1, 0x0, 0x0, 0x8000}, 0x804)
r6 = creat(&(0x7f0000000200)='./file0\x00', 0x0)
arch_prctl$ARCH_MAP_VDSO_32(0x2002, 0x7e)
ftruncate(r6, 0x2008200)
open(&(0x7f0000000140)='./bus\x00', 0x4000, 0x0)

15:06:38 executing program 3:
r0 = socket$inet_udplite(0x2, 0x2, 0x88)
ioctl(r0, 0x0, &(0x7f0000000000)="0adc1f123c123f3188b070")
r1 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r2 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)})

[ 1119.872991] binder: BINDER_SET_CONTEXT_MGR already set
[ 1119.882047] binder: 1616:1622 ioctl 40046207 0 returned -16
[ 1119.896900] binder: release 1616:1622 transaction 1228 out, still active
15:06:38 executing program 4:
r0 = openat$selinux_mls(0xffffffffffffff9c, &(0x7f0000000100)='/selinux/mls\x00', 0x0, 0x0)
getsockopt$IP_VS_SO_GET_DAEMON(r0, 0x0, 0x487, &(0x7f00000001c0), &(0x7f0000000180)=0x30)
getsockopt$sock_cred(0xffffffffffffff9c, 0x1, 0x11, &(0x7f0000000000), &(0x7f0000000040)=0xc)
fcntl$getownex(0xffffffffffffffff, 0x10, &(0x7f0000000080)={0x0, <r1=>0x0})
r2 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000200)='IPVS\x00')
ioctl$TIOCNXCL(r0, 0x540d)
sendmsg$IPVS_CMD_DEL_DAEMON(r0, &(0x7f00000003c0)={&(0x7f0000000140)={0x10, 0x0, 0x0, 0x800}, 0xc, &(0x7f0000000380)={&(0x7f0000000500)=ANY=[@ANYBLOB="0c1100005614f73684fe71ba15c95bfa9f50f5f577b40ba1ba02eae99fcd50522130e007bec087a4b529ca87a74054b61f6860a1ce2e8e96149fcc1acce722669e2154b316a425b6b433ad4a007f10e0329a96ef5ad4a2f43ef788bc9f69b84aa71f3b5174433bacf93f7c649c17b1707872d3461c770d4f4c536807713d0fdb44820e2a61a294cc22506cfb8b5b862de4ef08bee36bea826ce662ad427ecb213bdda6850f7405f20899c6a39d57ef218afc9d3e03ed3eebd2bd62ffe843740500063f3e8b2bc5a62203f971d203729175fe91e974efad0d07bbc4d8883ed58aaa1e363f12da", @ANYRES16=r2, @ANYBLOB="00012bbd7000fedbdf250a00000040000300080007004e23000014000600ff020000000000000000000000000001080007004e230000080007004e2300000800030002000000080004000500000008000400040000006c00030008000100010000000800040006000000080007004e2100000800040009000000080003000000000014000600ff01000000000000000000000000000108000500ac1e000108000500ac1e010108000800ff00000014000600ff0100000000000000000000000000012000020014000100fe8800000000000000000000000000010800060006000000080004009b00000008000400020000000c000100080001000a0000000800050017e50000"], 0x10c}, 0x1, 0x0, 0x0, 0x40}, 0x804)
r3 = syz_open_procfs(r1, &(0x7f00000000c0)='loginuid\x00')
lseek(r3, 0x20000, 0x0)
read(r0, &(0x7f0000000240)=""/52, 0x34)
ioctl$PIO_SCRNMAP(r0, 0x4b41, &(0x7f0000000400)="7250d71d5851aac6030dde40bf4ba7b8b8f710ff8a09cdf3a156b003f8865413b18c715cfe42aef4d0212b592952bb0e39289d85d8055a580c38001cd89eacd87f13d5d744d89758e5c0e558a9a2d50cdf4373ff2c412510c9b43437cf18e34adb03ceec032756a674ac7b65369bed5014811f41b637c08e396eb7a2592784dc46fef1d204af22a68250310bad7373f4e922e07523e7abd24861152065926f7d1125758b96747ba9a42a7a6e1783ebd03351735496fd5a52f9a50bdd9e488bc683c3502db6094ee095cc32c41fc6bd757f0e9f")

15:06:38 executing program 2:
r0 = socket$inet_udplite(0x2, 0x2, 0x88)
ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f3188b070")
syz_open_procfs(0x0, &(0x7f0000000940)='syscall\x00')
r1 = syz_open_procfs(0x0, &(0x7f0000000040)='fd\x00')
recvmmsg(0xffffffffffffffff, &(0x7f0000003840)=[{{0x0, 0x0, 0x0}}], 0x1, 0x0, 0x0)
perf_event_open(&(0x7f0000940000)={0x2, 0x70, 0xee6a, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x100, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0xff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x10001, 0x1}, 0x0, 0x400000000000000}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
mlock(&(0x7f00005b8000/0x3000)=nil, 0x3000)
ioctl$SNDRV_TIMER_IOCTL_SELECT(0xffffffffffffffff, 0x40345410, 0x0)
openat$uinput(0xffffffffffffff9c, &(0x7f0000000080)='/dev/uinput\x00', 0x2, 0x0)
mmap(&(0x7f000060b000/0x1000)=nil, 0x1000, 0x5, 0x8000400200000033, r1, 0x0)
perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x2, 0x9, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2000000, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x4000000, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8)
r2 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)={0x10b, 0x6, 0x209e1e, 0x3, 0x1}, 0x2c)
bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000b40)={r2, &(0x7f0000000040), 0x0, 0x1}, 0x20)
r3 = creat(&(0x7f0000000640)='./file0\x00', 0x100)
setsockopt$inet6_tcp_TCP_REPAIR_QUEUE(r3, 0x6, 0x14, &(0x7f0000000980), 0x4)
unlink(&(0x7f0000000940)='./file0\x00')
r4 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r5 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r5, 0x0)
ioctl$BINDER_GET_NODE_DEBUG_INFO(r4, 0xc018620b, &(0x7f0000000100))
ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f00000000c0)=ANY=[@ANYBLOB="bb8f0000"], 0x0, 0x0, 0x0})
ioctl$BINDER_SET_CONTEXT_MGR(r5, 0x40046207, 0x0)
shutdown(0xffffffffffffffff, 0x1)
prctl$PR_SET_NAME(0xf, &(0x7f0000000380)='/group.stat\x00')
ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)})
ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0x0, 0x0, &(0x7f0000000780)})
ioctl$BINDER_WRITE_READ(r5, 0xc0306201, &(0x7f00000001c0)={0x8, 0x0, &(0x7f0000000500)=[@release={0x40046306, 0x1}], 0x0, 0x0, &(0x7f00000009c0)})
creat(&(0x7f00000000c0)='./file0\x00', 0x0)

[ 1119.948143] binder: 1617:1631 BC_INCREFS_DONE node 1232 has no pending increfs request
15:06:38 executing program 3:
r0 = socket$inet_udplite(0x2, 0x2, 0x88)
ioctl(r0, 0x1000008912, 0x0)
r1 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r2 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)})

[ 1120.016158] binder: BINDER_SET_CONTEXT_MGR already set
[ 1120.028258] binder: 1637:1640 ioctl 40046207 0 returned -16
[ 1120.050295] binder: release 1637:1640 transaction 1234 out, still active
15:06:38 executing program 4:
r0 = syz_open_procfs(0x0, &(0x7f00000001c0)='net/softnet_stat\x00')
getsockopt$IP6T_SO_GET_REVISION_TARGET(r0, 0x29, 0x45, &(0x7f0000000000)={'TPROXY\x00'}, &(0x7f0000000040)=0x1e)
ioctl$UI_SET_RELBIT(r0, 0x40045566, 0xb)
socket$inet6(0xa, 0x1, 0xfffffffffffffe01)
lseek(r0, 0x20000, 0x0)

[ 1120.130786] binder: BINDER_SET_CONTEXT_MGR already set
[ 1120.144388] binder: 1647:1649 ioctl 40046207 0 returned -16
[ 1120.153858] binder: release 1647:1649 transaction 1237 out, still active
15:06:39 executing program 0:
r0 = socket$inet_udplite(0x2, 0x2, 0x88)
ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f3188b070")
syz_open_procfs(0x0, &(0x7f0000000940)='syscall\x00')
r1 = syz_open_procfs(0x0, &(0x7f0000000040)='fd\x00')
recvmmsg(0xffffffffffffffff, &(0x7f0000003840)=[{{0x0, 0x0, 0x0}}], 0x1, 0x0, 0x0)
perf_event_open(&(0x7f0000940000)={0x2, 0x70, 0xee6a, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x100, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0xff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x10001, 0x1}, 0x0, 0x400000000000000}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
mlock(&(0x7f00005b8000/0x3000)=nil, 0x3000)
ioctl$SNDRV_TIMER_IOCTL_SELECT(0xffffffffffffffff, 0x40345410, 0x0)
openat$uinput(0xffffffffffffff9c, &(0x7f0000000080)='/dev/uinput\x00', 0x2, 0x0)
mmap(&(0x7f000060b000/0x1000)=nil, 0x1000, 0x5, 0x8000400200000033, r1, 0x0)
perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x2, 0x9, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2000000, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x4000000, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8)
r2 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)={0x10b, 0x6, 0x209e1e, 0x3, 0x1}, 0x2c)
bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000b40)={r2, &(0x7f0000000040), 0x0, 0x1}, 0x20)
r3 = creat(&(0x7f0000000640)='./file0\x00', 0x100)
setsockopt$inet6_tcp_TCP_REPAIR_QUEUE(r3, 0x6, 0x14, &(0x7f0000000980), 0x4)
unlink(&(0x7f0000000940)='./file0\x00')
r4 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r5 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r5, 0x0)
ioctl$BINDER_GET_NODE_DEBUG_INFO(r4, 0xc018620b, &(0x7f0000000100))
ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f00000000c0)=ANY=[@ANYBLOB="bb8f0000"], 0x0, 0x0, 0x0})
ioctl$BINDER_SET_CONTEXT_MGR(r5, 0x40046207, 0x0)
shutdown(0xffffffffffffffff, 0x1)
prctl$PR_SET_NAME(0xf, &(0x7f0000000380)='/group.stat\x00')
ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)})
ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0x0, 0x0, &(0x7f0000000780)})
ioctl$BINDER_WRITE_READ(r5, 0xc0306201, &(0x7f00000001c0)={0x8, 0x0, &(0x7f0000000500)=[@release={0x40046306, 0x1}], 0x0, 0x0, &(0x7f00000009c0)})

15:06:39 executing program 2:
perf_event_open(&(0x7f000025c000)={0x1, 0x70, 0x5, 0x0, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
pipe(&(0x7f0000000100)={<r0=>0xffffffffffffffff, <r1=>0xffffffffffffffff})
write(r1, &(0x7f0000000100), 0xfffffdbc)
read(r0, &(0x7f0000000200)=""/250, 0x50c7e3e3)
accept4$packet(r0, &(0x7f0000000080)={0x11, 0x0, <r2=>0x0, 0x1, 0x0, 0x6, @random}, &(0x7f00000000c0)=0x14, 0x0)
setxattr$trusted_overlay_nlink(&(0x7f00000003c0)='./file0\x00', &(0x7f0000000400)='trusted.overlay.nlink\x00', &(0x7f0000000440)={'U+', 0x1}, 0x28, 0x1)
setsockopt$inet_pktinfo(r1, 0x0, 0x8, &(0x7f0000000140)={r2, @multicast1, @empty}, 0xc)
ioctl$sock_inet_tcp_SIOCOUTQNSD(r0, 0x894b, &(0x7f0000000040))
r3 = syz_open_procfs(0x0, &(0x7f0000000000)='net/softnet_stat\x00')
r4 = syz_genetlink_get_family_id$tipc2(&(0x7f00000001c0)='TIPCv2\x00')
sendmsg$TIPC_NL_NET_SET(r3, &(0x7f0000000380)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x8000000}, 0xc, &(0x7f0000000340)={&(0x7f0000000300)={0x20, r4, 0x4, 0x70bd26, 0x25dfdbfc, {}, [@TIPC_NLA_MON={0xc, 0x9, [@TIPC_NLA_MON_ACTIVATION_THRESHOLD={0x8}]}]}, 0x20}, 0x1, 0x0, 0x0, 0x8000}, 0x4000)
lseek(r3, 0x20000, 0x0)

15:06:39 executing program 3:
r0 = socket$inet_udplite(0x2, 0x2, 0x88)
ioctl(r0, 0x1000008912, 0x0)
r1 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r2 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)})

15:06:39 executing program 4:
ioctl$sock_SIOCGPGRP(0xffffffffffffffff, 0x8904, &(0x7f0000000040)=<r0=>0x0)
r1 = syz_open_procfs(r0, &(0x7f0000000080)='net/rt6_stats\x00')
lseek(r1, 0x20000, 0x0)

15:06:39 executing program 5:
r0 = socket$inet_udplite(0x2, 0x2, 0x88)
ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f3188b070")
r1 = syz_open_procfs(0x0, &(0x7f0000000940)='syscall\x00')
r2 = syz_open_procfs(0x0, &(0x7f00000007c0)='fd\x00~d\x9e\x1c\x8e\x81\x1f\xc25h\x121\xacx{,}##\a\xd1\x8eB^\xa8\xce\xd6\x0e1\x9c\xd5\xac\xe6\xfc\xce\xca2\xa2v\xee`p\xe7\xb5\x8d\xc6!\x12\xa7\x82\xef\xf6UH\"\xc2\x9b\xb2;\xaf\xcd\x9dv\x9b\f\x1e\xc5\xfd\xfc\x04y\xac\x01\xa8\xad\xe1\x95\xd9\xb3\xb5{\xee\x9bj?<\xb2\'\"D\xa9\x82\x81\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xa3\xe4\'\xac%\xa2\xf3\x90l\xcb\xe4\x8b\x03\"e$m\xca\xe2{\xf6\x85p;hG\x8d\xba<u\x84+\xd0\x9eU0!\x91\x92\xa9\xba\xc3h\xa8\xa3E\x06\xad\xa7\x06N\x92z\x88\xc7\xfe\a\x9b\x9b\xf12~\xeeI\xadV\xf3\xa3\xd1\x8c\xe1\x9b\xc2\x1f\x9f\xc6wy96\xc6G\xbf\xd7t*\xfbL\x06#\xef\x8bm\xa0/R|c\x90l\x93\xc6\x16\x13g\x10\xa2c\x11\xa4\xb7%O\x131\x02P\xb0@\xf7\x066\x10&uK\xbd')
recvmmsg(0xffffffffffffffff, &(0x7f0000003840)=[{{0x0, 0x0, 0x0}}], 0x1, 0x0, 0x0)
perf_event_open(&(0x7f0000940000)={0x2, 0x70, 0xee6a, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x100, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0xff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x10001, 0x1}, 0x0, 0x400000000000000}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
mlock(&(0x7f00005b8000/0x3000)=nil, 0x3000)
ioctl$SNDRV_TIMER_IOCTL_SELECT(r1, 0x40345410, 0x0)
openat$uinput(0xffffffffffffff9c, &(0x7f0000000080)='/dev/uinput\x00', 0x2, 0x0)
mmap(&(0x7f000060b000/0x1000)=nil, 0x1000, 0x5, 0x8000400200000033, r2, 0x0)
unshare(0xfffffffffffffffd)
r3 = getpid()
sched_setscheduler(r3, 0x2, &(0x7f00000000c0))
open$dir(&(0x7f0000000400)='./file0\x00', 0x0, 0x0)
perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f00000004c0), 0x2}, 0x0, 0x0, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r4 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000340)='memory.current\x00', 0x0, 0x0)
ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, 0x0)
socketpair(0x1, 0x20000000000001, 0x0, &(0x7f0000000100)={<r5=>0xffffffffffffffff, <r6=>0xffffffffffffffff})
ioctl$PERF_EVENT_IOC_SET_FILTER(r6, 0x8914, &(0x7f0000000300)='lo\x00\x96o\xd6Q\xb9Y\xa9\xc8J,\x00\xd2\x97\x04\x03\xdc\r')
close(r4)
rt_sigprocmask(0x2, &(0x7f0000000240)={0x6}, &(0x7f00000002c0), 0x8)
ioctl$PERF_EVENT_IOC_SET_FILTER(r6, 0x8923, &(0x7f00000008c0)='lo\x00\x96o8\x0fd\xa1\xe3\xd7]b}\x1f\xa1Y\xad4\x90\x9d`\xd2\x98\x00\x00\x00 \'Y\x17]\x15c\xcaR\xdd\x98OC\x89\x1b\xe7\x84\xe2\x05\x80w\xd2|D\x8dK\x14Bx\xcbuH\xc2\xeec\xbf<>Y\x1a\xfc\x1f9OB\x81\x89\x186\xc5q@n\xb4\xb6s\xb0\x00\x00\xfc\x00\x00\b\x00\x00\xda\xef\xecE\xec\xd5I\xb2\x9b\xfe\x8d\x90?\x00\xe9\xe4~g:\xc1\xb2aj\x96\xbb\xa7\xe2\xc0\xdc\xf9Q\b\xeb\x16\x7fT\x11\xd3\r7\xe6\"f\xcf\x8e\xabd\x0ftp\x82\xae\xd2\x15\x8e+c\xf6\xbf\xe14>\xa6-\xa5c\xde\xd7\xab\xea\x1f\xf8s2\x9cVF\xd5\x18\xfe\x0e\x8f \x01\x00\x00y.\xfc*\x82\xa5\xa1p5\xc8{\xf7\xef\xab\xe8\x99\xebw#\x8at\x1c\x80\xfc\xb0\x95\xa2\xa7\xd7,Y]E8\x83X\xf5F\xdc\x88-\xf5\xb0\xb5^\xdb\x1a\xb6\xaa\x14\xe2\xb9\rh^J-\xd1\xbaUn\x04\'l\x1b\xe0o\xdb\xc8\x91%\x1c\xb5\xbf\xb6\x90\xb4\xc2\x7f]/\xb3\xe7\xc9\'\x94\xcfIo\xdf\x04\x95\xb5\x06\x84\x1fH>\xda\xc5\x04 \x94\x88\xeb\'\xd4;6\x7f\xd9\x99-\x1b|G\x8d\xd4\xb9%\xaaQ\xa0K\x10\x03\x93\xe1\xcc\xe7m\x80\'\xf0\xa5\xed(\r\xa8\x0f&\xb1\xf3\xff0\f\x82%_\x92\x8bD\xb9\xd9\xe7\xf2\xe4\xc1i#\xdc\x87A\xb9\xc7\r\x92\xfa\x11\x11\xb5\x1f\x03\x9d\xdd\x1bj\xdf\xacg\xe3\xa0S\xd3\x8a\xe1n\x97\xea\xf5\xa0\'\v\xe9\xa0\xf1 f\xaan\xcf\xb5i\xb6d\xbc\x92\v\xd58\x16\b\xb3_:\xa4!\ny\xc4&\nWMM\xa8\xc4\v\x9f\x01o\xf4\xab&\xb6\x17\x02P\xc3!N\xf4\b\x1a~\x91V1s\xe9\xbe\x9e\x9b\'\xcde\xb3\xa1\x86\"\xd7\x04\xf1\xc0!\xed\xff\xee$\xc89\x8cB0\xd1dD\xe0IP\x88\xa2\xf2Y\x9af$$\xf1cO\xf7P\xac\xca\x80:!\xb4\x94#\xcb^\x9f\'\x03\xe3\x93\xb9\x82\xbf\xcf\xc4\xe3\xf7\x03Oh\xf2r\xca\x8ff\xbb/\x9f*\xaf\x1a \xa5\xa0?%M\xa5\x86\x98\xf24\'1\xc7\f<\xcc@\xe8\x8a\xac.\xde\xe4\xc7\xf5\x9ck\xa40!\xe9\x14$\xb3\x05m\xb5m\xed\ft\x93\xd8\xa3\x80\'Y\xb9\x05\xbbt|\xbe\xbcz\n\xf3\xf5p\xf8\x9f~\x1b\xd0\v\x1cQ')
getsockopt$inet_IP_IPSEC_POLICY(r2, 0x0, 0x10, &(0x7f00000006c0)={{{@in6=@loopback}}, {{@in6=@initdev}}}, &(0x7f0000000500)=0xe8)
socketpair(0x2, 0x2000000080003, 0xfffffffffffffffe, &(0x7f0000000200))
syz_genetlink_get_family_id$SEG6(&(0x7f00000003c0)='SEG6\x00')
sendmsg$SEG6_CMD_DUMPHMAC(r5, &(0x7f0000000580)={&(0x7f0000000380)={0x10, 0x0, 0x0, 0x1000000}, 0xc, &(0x7f0000000440)={&(0x7f00000005c0)=ANY=[@ANYBLOB="2300260109447a0000000000000000660000001400001a0065a455e04ea56d0a47018c8e973bcac914471474a7e0d50a000eadd66d2e49a2ed40dcafa1e046ab6aacc2097d8f75bd9c8b8a220bdde116904efa3f9600f22ab388644f66c2d5baec4079a81bae1927e49e91a4964656d7b227702926af5be846f3de49fad39048633fd9161123894d9427f854a30cb0532c8f31f663380e40ce7f6cb15ec8baab3b7c6f"], 0x1}, 0x1, 0x0, 0x0, 0x8000}, 0x804)
r7 = creat(&(0x7f0000000280)='./bus\x00', 0x0)
arch_prctl$ARCH_MAP_VDSO_32(0x2002, 0x7e)
ftruncate(r7, 0x2008200)
open(&(0x7f0000000140)='./bus\x00', 0x4000, 0x0)

[ 1120.354822] binder: release 1602:1604 transaction 1225 out, still active
[ 1120.368192] binder: send failed reply for transaction 1225, target dead
[ 1120.380930] binder: send failed reply for transaction 1228, target dead
[ 1120.388334] binder: send failed reply for transaction 1231 to 1617:1619
[ 1120.396505] binder: send failed reply for transaction 1234, target dead
[ 1120.403934] binder: send failed reply for transaction 1237, target dead
[ 1120.420990] binder: release 1665:1669 transaction 1241 out, still active
15:06:39 executing program 1:
r0 = socket$inet_udplite(0x2, 0x2, 0x88)
ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f3188b070")
syz_open_procfs(0x0, &(0x7f0000000940)='syscall\x00')
syz_open_procfs(0x0, &(0x7f0000000040)='fd\x00')
recvmmsg(0xffffffffffffffff, &(0x7f0000003840)=[{{0x0, 0x0, 0x0}}], 0x1, 0x0, 0x0)
perf_event_open(&(0x7f0000940000)={0x2, 0x70, 0xee6a, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x100, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0xff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x10001, 0x1}, 0x0, 0x400000000000000}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r1 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)={0x10b, 0x6, 0x209e1e, 0x3, 0x1}, 0x2c)
bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000b40)={r1, &(0x7f0000000040), 0x0, 0x1}, 0x20)
r2 = creat(&(0x7f0000000640)='./file0\x00', 0x100)
setsockopt$inet6_tcp_TCP_REPAIR_QUEUE(r2, 0x6, 0x14, &(0x7f0000000980), 0x4)
unlink(&(0x7f0000000940)='./file0\x00')
r3 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_GET_NODE_DEBUG_INFO(r3, 0xc018620b, &(0x7f0000000100))
ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)})
ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0x0, 0x0, &(0x7f0000000780)})

15:06:39 executing program 4:
r0 = syz_open_procfs(0x0, &(0x7f00000001c0)='net/softnet_stat\x00')
fsetxattr$trusted_overlay_nlink(r0, &(0x7f0000000000)='trusted.overlay.nlink\x00', &(0x7f0000000040)={'L+', 0x101}, 0x28, 0x2)
lseek(r0, 0x20000, 0x0)

15:06:39 executing program 3:
r0 = socket$inet_udplite(0x2, 0x2, 0x88)
ioctl(r0, 0x1000008912, 0x0)
r1 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r2 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)})

[ 1120.446814] binder: send failed reply for transaction 1241, target dead
[ 1120.530454] binder: release 1681:1686 transaction 1245 out, still active
15:06:39 executing program 3:
r0 = socket$inet_udplite(0x2, 0x2, 0x88)
ioctl(r0, 0x1000008912, &(0x7f0000000000))
r1 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r2 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)})

15:06:39 executing program 4:
r0 = socket$inet_udplite(0x2, 0x2, 0x88)
r1 = openat$selinux_commit_pending_bools(0xffffffffffffff9c, &(0x7f0000000040)='/selinux/commit_pending_bools\x00', 0x1, 0x0)
setsockopt$inet6_tcp_TCP_FASTOPEN_KEY(r1, 0x6, 0x21, &(0x7f00000000c0)="c97ffddddee8e88e12f71d76f4c8e5a5", 0x10)
ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f3188b070")
r2 = syz_open_procfs(0x0, &(0x7f0000000080)='net/dev_mcast\x00')
getsockname(r0, &(0x7f0000000100)=@ll={0x11, 0x0, <r3=>0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f0000000180)=0x80)
setsockopt$inet6_tcp_TCP_FASTOPEN_KEY(r2, 0x6, 0x21, &(0x7f0000000200)="303a96e2cd26c6accda9cdbecab0dbf4", 0x10)
setsockopt$inet6_mreq(r1, 0x29, 0x15, &(0x7f00000001c0)={@empty, r3}, 0x14)
lseek(r2, 0x20000, 0x0)

[ 1120.585533] binder: 1674:1676 unknown command 36795
[ 1120.595463] binder: send failed reply for transaction 1245, target dead
[ 1120.607681] binder: send failed reply for transaction 1248 to 1680:1688
[ 1120.619831] binder: 1680:1694 BC_INCREFS_DONE u0000000000000000 no match
[ 1120.626758] binder: 1674:1676 ioctl c0306201 20000140 returned -22
15:06:39 executing program 5:
r0 = socket$inet_udplite(0x2, 0x2, 0x88)
ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f3188b070")
syz_open_procfs(0x0, &(0x7f0000000940)='syscall\x00')
r1 = syz_open_procfs(0x0, &(0x7f0000000040)='fd\x00')
recvmmsg(0xffffffffffffffff, &(0x7f0000003840)=[{{0x0, 0x0, 0x0}}], 0x1, 0x0, 0x0)
perf_event_open(&(0x7f0000940000)={0x2, 0x70, 0xee6a, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x100, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0xff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x10001, 0x1}, 0x0, 0x400000000000000}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
mlock(&(0x7f00005b8000/0x3000)=nil, 0x3000)
ioctl$SNDRV_TIMER_IOCTL_SELECT(0xffffffffffffffff, 0x40345410, 0x0)
openat$uinput(0xffffffffffffff9c, &(0x7f0000000080)='/dev/uinput\x00', 0x2, 0x0)
mmap(&(0x7f000060b000/0x1000)=nil, 0x1000, 0x5, 0x8000400200000033, r1, 0x0)
unshare(0xfffffffffffffffd)
r2 = getpid()
sched_setscheduler(r2, 0x5, &(0x7f00000000c0))
open$dir(&(0x7f0000000400)='./file0\x00', 0x0, 0x0)
perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f00000004c0), 0x2}, 0x0, 0x0, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r3 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000340)='memory.current\x00', 0x0, 0x0)
ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, 0x0)
socketpair(0x1, 0x20000000000001, 0x0, &(0x7f0000000100)={<r4=>0xffffffffffffffff, <r5=>0xffffffffffffffff})
ioctl$PERF_EVENT_IOC_SET_FILTER(r5, 0x8914, &(0x7f0000000300)='lo\x00\x96o\xd6Q\xb9Y\xa9\xc8J,\x00\xd2\x97\x04\x03\xdc\r')
close(r3)
rt_sigprocmask(0x2, &(0x7f0000000240)={0x6}, &(0x7f00000002c0), 0x8)
ioctl$PERF_EVENT_IOC_SET_FILTER(r5, 0x8923, &(0x7f00000008c0)='lo\x00\x96o8\x0fd\xa1\xe3\xd7]b}\x1f\xa1Y\xad4\x90\x9d`\xd2\x98\x00\x00\x00 \'Y\x17]\x15c\xcaR\xdd\x98OC\x89\x1b\xe7\x84\xe2\x05\x80w\xd2|D\x8dK\x14Bx\xcbuH\xc2\xeec\xbf<>Y\x1a\xfc\x1f9OB\x81\x89\x186\xc5q@n\xb4\xb6s\xb0\x00\x00\xfc\x00\x00\b\x00\x00\xda\xef\xecE\xec\xd5I\xb2\x9b\xfe\x8d\x90?\x00\xe9\xe4~g:\xc1\xb2aj\x96\xbb\xa7\xe2\xc0\xdc\xf9Q\b\xeb\x16\x7fT\x11\xd3\r7\xe6\"f\xcf\x8e\xabd\x0ftp\x82\xae\xd2\x15\x8e+c\xf6\xbf\xe14>\xa6-\xa5c\xde\xd7\xab\xea\x1f\xf8s2\x9cVF\xd5\x18\xfe\x0e\x8f \x01\x00\x00y.\xfc*\x82\xa5\xa1p5\xc8{\xf7\xef\xab\xe8\x99\xebw#\x8at\x1c\x80\xfc\xb0\x95\xa2\xa7\xd7,Y]E8\x83X\xf5F\xdc\x88-\xf5\xb0\xb5^\xdb\x1a\xb6\xaa\x14\xe2\xb9\rh^J-\xd1\xbaUn\x04\'l\x1b\xe0o\xdb\xc8\x91%\x1c\xb5\xbf\xb6\x90\xb4\xc2\x7f]/\xb3\xe7\xc9\'\x94\xcfIo\xdf\x04\x95\xb5\x06\x84\x1fH>\xda\xc5\x04 \x94\x88\xeb\'\xd4;6\x7f\xd9\x99-\x1b|G\x8d\xd4\xb9%\xaaQ\xa0K\x10\x03\x93\xe1\xcc\xe7m\x80\'\xf0\xa5\xed(\r\xa8\x0f&\xb1\xf3\xff0\f\x82%_\x92\x8bD\xb9\xd9\xe7\xf2\xe4\xc1i#\xdc\x87A\xb9\xc7\r\x92\xfa\x11\x11\xb5\x1f\x03\x9d\xdd\x1bj\xdf\xacg\xe3\xa0S\xd3\x8a\xe1n\x97\xea\xf5\xa0\'\v\xe9\xa0\xf1 f\xaan\xcf\xb5i\xb6d\xbc\x92\v\xd58\x16\b\xb3_:\xa4!\ny\xc4&\nWMM\xa8\xc4\v\x9f\x01o\xf4\xab&\xb6\x17\x02P\xc3!N\xf4\b\x1a~\x91V1s\xe9\xbe\x9e\x9b\'\xcde\xb3\xa1\x86\"\xd7\x04\xf1\xc0!\xed\xff\xee$\xc89\x8cB0\xd1dD\xe0IP\x88\xa2\xf2Y\x9af$$\xf1cO\xf7P\xac\xca\x80:!\xb4\x94#\xcb^\x9f\'\x03\xe3\x93\xb9\x82\xbf\xcf\xc4\xe3\xf7\x03Oh\xf2r\xca\x8ff\xbb/\x9f*\xaf\x1a \xa5\xa0?%M\xa5\x86\x98\xf24\'1\xc7\f<\xcc@\xe8\x8a\xac.\xde\xe4\xc7\xf5\x9ck\xa40!\xe9\x14$\xb3\x05m\xb5m\xed\ft\x93\xd8\xa3\x80\'Y\xb9\x05\xbbt|\xbe\xbcz\n\xf3\xf5p\xf8\x9f~\x1b\xd0\v\x1cQ')
getsockopt$inet_IP_IPSEC_POLICY(r1, 0x0, 0x10, &(0x7f00000006c0)={{{@in6=@loopback}}, {{@in6=@initdev}}}, &(0x7f0000000500)=0xe8)
socketpair(0x2, 0x2000000080003, 0x100, &(0x7f0000000480))
syz_genetlink_get_family_id$SEG6(&(0x7f00000003c0)='SEG6\x00')
sendmsg$SEG6_CMD_DUMPHMAC(r4, &(0x7f0000000580)={&(0x7f0000000380)={0x10, 0x0, 0x0, 0x1000000}, 0xc, &(0x7f0000000440)={&(0x7f00000007c0)=ANY=[@ANYBLOB="2300260109447a0010000000000000660000001400001a0065a455e04e00000000000000003bcac914471474a7e0d50a000eadd66d2e49a2ed40dcafa1e056ab6aacc2097d8f01bd9c8b8a220bdde116904efa3f9600f20800000000000000baec4079a81bae1927e49e91a4964656d7b249060000af5be84602de49fad39048633fd9161123894d9427f873e7cdde9c89a6580c54a30cb0532c8f31f663380e40ce7f6cb15ec8baab3b7c6f"], 0x1}, 0x1, 0x0, 0x0, 0x8000}, 0x804)
r6 = creat(&(0x7f0000000280)='./bus\x00', 0x0)
arch_prctl$ARCH_MAP_VDSO_32(0x2002, 0x7e)
ftruncate(r6, 0x2008200)
open(&(0x7f0000000140)='./bus\x00', 0x4000, 0x0)

15:06:39 executing program 1:
r0 = socket$inet_udplite(0x2, 0x2, 0x88)
ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f3188b070")
syz_open_procfs(0x0, &(0x7f0000000940)='syscall\x00')
syz_open_procfs(0x0, &(0x7f0000000040)='fd\x00')
recvmmsg(0xffffffffffffffff, &(0x7f0000003840)=[{{0x0, 0x0, 0x0}}], 0x1, 0x0, 0x0)
perf_event_open(&(0x7f0000940000)={0x2, 0x70, 0xee6a, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x100, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0xff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x10001, 0x1}, 0x0, 0x400000000000000}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r1 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)={0x10b, 0x6, 0x209e1e, 0x3, 0x1}, 0x2c)
bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000b40)={r1, &(0x7f0000000040), 0x0, 0x1}, 0x20)
r2 = creat(&(0x7f0000000640)='./file0\x00', 0x100)
setsockopt$inet6_tcp_TCP_REPAIR_QUEUE(r2, 0x6, 0x14, &(0x7f0000000980), 0x4)
unlink(&(0x7f0000000940)='./file0\x00')
r3 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_GET_NODE_DEBUG_INFO(r3, 0xc018620b, &(0x7f0000000100))
ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)})
ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0x0, 0x0, &(0x7f0000000780)})

[ 1120.694919] binder: release 1674:1689 transaction 1252 out, still active
[ 1120.698917] binder: BINDER_SET_CONTEXT_MGR already set
15:06:39 executing program 0:
r0 = socket$inet_udplite(0x2, 0x2, 0x88)
ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f3188b070")
syz_open_procfs(0x0, &(0x7f0000000940)='syscall\x00')
r1 = syz_open_procfs(0x0, &(0x7f0000000040)='fd\x00')
recvmmsg(0xffffffffffffffff, &(0x7f0000003840)=[{{0x0, 0x0, 0x0}}], 0x1, 0x0, 0x0)
perf_event_open(&(0x7f0000940000)={0x2, 0x70, 0xee6a, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x100, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0xff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x10001, 0x1}, 0x0, 0x400000000000000}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
mlock(&(0x7f00005b8000/0x3000)=nil, 0x3000)
ioctl$SNDRV_TIMER_IOCTL_SELECT(0xffffffffffffffff, 0x40345410, 0x0)
openat$uinput(0xffffffffffffff9c, &(0x7f0000000080)='/dev/uinput\x00', 0x2, 0x0)
mmap(&(0x7f000060b000/0x1000)=nil, 0x1000, 0x5, 0x8000400200000033, r1, 0x0)
perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x2, 0x9, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2000000, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x4000000, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8)
r2 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)={0x10b, 0x6, 0x209e1e, 0x3, 0x1}, 0x2c)
bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000b40)={r2, &(0x7f0000000040), 0x0, 0x1}, 0x20)
r3 = creat(&(0x7f0000000640)='./file0\x00', 0x100)
setsockopt$inet6_tcp_TCP_REPAIR_QUEUE(r3, 0x6, 0x14, &(0x7f0000000980), 0x4)
unlink(&(0x7f0000000940)='./file0\x00')
r4 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r5 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r5, 0x0)
ioctl$BINDER_GET_NODE_DEBUG_INFO(r4, 0xc018620b, &(0x7f0000000100))
ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f00000000c0)=ANY=[@ANYBLOB="bb8f0000"], 0x0, 0x0, 0x0})
ioctl$BINDER_SET_CONTEXT_MGR(r5, 0x40046207, 0x0)
shutdown(0xffffffffffffffff, 0x1)
prctl$PR_SET_NAME(0xf, &(0x7f0000000380)='/group.stat\x00')
ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)})
ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0x0, 0x0, &(0x7f0000000780)})
ioctl$BINDER_WRITE_READ(r5, 0xc0306201, &(0x7f00000001c0)={0x8, 0x0, &(0x7f0000000500)=[@release={0x40046306, 0x1}], 0x0, 0x0, &(0x7f00000009c0)})

[ 1120.738131] binder: 1701:1702 ioctl 40046207 0 returned -16
[ 1120.769883] binder: release 1701:1709 transaction 1255 out, still active
[ 1120.797022] binder: send failed reply for transaction 1252, target dead
[ 1120.803221] binder: 1708:1711 transaction failed 29189/-22, size 24-8 line 3117
[ 1120.815530] binder: send failed reply for transaction 1255, target dead
[ 1120.818689] binder: 1708:1711 BC_INCREFS_DONE u0000000000000000 no match
[ 1120.929844] binder: 1715:1717 unknown command 36795
[ 1120.935732] binder: 1715:1717 ioctl c0306201 20000140 returned -22
[ 1120.998072] binder: 1715:1722 BC_INCREFS_DONE node 1261 has no pending increfs request
15:06:40 executing program 2:
perf_event_open(&(0x7f000025c000)={0x1, 0x70, 0x5, 0x0, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
pipe(&(0x7f0000000100)={<r0=>0xffffffffffffffff, <r1=>0xffffffffffffffff})
write(r1, &(0x7f0000000100), 0xfffffdbc)
read(r0, &(0x7f0000000200)=""/250, 0x50c7e3e3)
accept4$packet(r0, &(0x7f0000000080)={0x11, 0x0, <r2=>0x0, 0x1, 0x0, 0x6, @random}, &(0x7f00000000c0)=0x14, 0x0)
setxattr$trusted_overlay_nlink(&(0x7f00000003c0)='./file0\x00', &(0x7f0000000400)='trusted.overlay.nlink\x00', &(0x7f0000000440)={'U+', 0x1}, 0x28, 0x1)
setsockopt$inet_pktinfo(r1, 0x0, 0x8, &(0x7f0000000140)={r2, @multicast1, @empty}, 0xc)
ioctl$sock_inet_tcp_SIOCOUTQNSD(r0, 0x894b, &(0x7f0000000040))
r3 = syz_open_procfs(0x0, &(0x7f0000000000)='net/softnet_stat\x00')
r4 = syz_genetlink_get_family_id$tipc2(&(0x7f00000001c0)='TIPCv2\x00')
sendmsg$TIPC_NL_NET_SET(r3, &(0x7f0000000380)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x8000000}, 0xc, &(0x7f0000000340)={&(0x7f0000000300)={0x20, r4, 0x4, 0x70bd26, 0x25dfdbfc, {}, [@TIPC_NLA_MON={0xc, 0x9, [@TIPC_NLA_MON_ACTIVATION_THRESHOLD={0x8}]}]}, 0x20}, 0x1, 0x0, 0x0, 0x8000}, 0x4000)
lseek(r3, 0x20000, 0x0)

15:06:40 executing program 3:
r0 = socket$inet_udplite(0x2, 0x2, 0x88)
ioctl(r0, 0x1000008912, &(0x7f0000000000))
r1 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r2 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)})

15:06:40 executing program 4:
r0 = socket$inet_udplite(0x2, 0x2, 0x88)
ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f3188b070")
bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f00000000c0)={<r1=>0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x4, &(0x7f0000000040)='#{.\x00', 0xffffffffffffffff}, 0x30)
r2 = syz_open_procfs(r1, &(0x7f0000000080)='net/dev_mcast\x00')
lseek(r2, 0x20000, 0x0)

15:06:40 executing program 1:
r0 = socket$inet_udplite(0x2, 0x2, 0x88)
ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f3188b070")
syz_open_procfs(0x0, &(0x7f0000000940)='syscall\x00')
syz_open_procfs(0x0, &(0x7f0000000040)='fd\x00')
recvmmsg(0xffffffffffffffff, &(0x7f0000003840)=[{{0x0, 0x0, 0x0}}], 0x1, 0x0, 0x0)
perf_event_open(&(0x7f0000940000)={0x2, 0x70, 0xee6a, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x100, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0xff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x10001, 0x1}, 0x0, 0x400000000000000}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r1 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)={0x10b, 0x6, 0x209e1e, 0x3, 0x1}, 0x2c)
bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000b40)={r1, &(0x7f0000000040), 0x0, 0x1}, 0x20)
r2 = creat(&(0x7f0000000640)='./file0\x00', 0x100)
setsockopt$inet6_tcp_TCP_REPAIR_QUEUE(r2, 0x6, 0x14, &(0x7f0000000980), 0x4)
unlink(&(0x7f0000000940)='./file0\x00')
r3 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_GET_NODE_DEBUG_INFO(r3, 0xc018620b, &(0x7f0000000100))
ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)})
ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0x0, 0x0, &(0x7f0000000780)})

15:06:40 executing program 5:
r0 = socket$inet_udplite(0x2, 0x2, 0x88)
ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f3188b070")
syz_open_procfs(0x0, &(0x7f0000000940)='syscall\x00')
r1 = syz_open_procfs(0x0, &(0x7f0000000040)='fd\x00')
recvmmsg(0xffffffffffffffff, &(0x7f0000003840)=[{{0x0, 0x0, 0x0}}], 0x1, 0x0, 0x0)
perf_event_open(&(0x7f0000940000)={0x2, 0x70, 0xee6a, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x100, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0xff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x10001, 0x1}, 0x0, 0x400000000000000}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
mlock(&(0x7f00005b8000/0x3000)=nil, 0x3000)
ioctl$SNDRV_TIMER_IOCTL_SELECT(0xffffffffffffffff, 0x40345410, 0x0)
openat$uinput(0xffffffffffffff9c, &(0x7f0000000080)='/dev/uinput\x00', 0x2, 0x0)
mmap(&(0x7f000060b000/0x1000)=nil, 0x1000, 0x5, 0x8000400200000033, r1, 0x0)
unshare(0xfffffffffffffffd)
r2 = getpid()
sched_setscheduler(r2, 0x5, &(0x7f00000000c0))
open$dir(&(0x7f0000000400)='./file0\x00', 0x0, 0x0)
perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f00000004c0), 0x2}, 0x0, 0x0, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r3 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000340)='memory.current\x00', 0x0, 0x0)
ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, 0x0)
socketpair(0x1, 0x20000000000001, 0x0, &(0x7f0000000100)={<r4=>0xffffffffffffffff, <r5=>0xffffffffffffffff})
ioctl$PERF_EVENT_IOC_SET_FILTER(r5, 0x8914, &(0x7f0000000300)='lo\x00\x96o\xd6Q\xb9Y\xa9\xc8J,\x00\xd2\x97\x04\x03\xdc\r')
close(r3)
rt_sigprocmask(0x2, &(0x7f0000000240)={0x6}, &(0x7f00000002c0), 0x8)
ioctl$PERF_EVENT_IOC_SET_FILTER(r5, 0x8923, &(0x7f00000008c0)='lo\x00\x96o8\x0fd\xa1\xe3\xd7]b}\x1f\xa1Y\xad4\x90\x9d`\xd2\x98\x00\x00\x00 \'Y\x17]\x15c\xcaR\xdd\x98OC\x89\x1b\xe7\x84\xe2\x05\x80w\xd2|D\x8dK\x14Bx\xcbuH\xc2\xeec\xbf<>Y\x1a\xfc\x1f9OB\x81\x89\x186\xc5q@n\xb4\xb6s\xb0\x00\x00\xfc\x00\x00\b\x00\x00\xda\xef\xecE\xec\xd5I\xb2\x9b\xfe\x8d\x90?\x00\xe9\xe4~g:\xc1\xb2aj\x96\xbb\xa7\xe2\xc0\xdc\xf9Q\b\xeb\x16\x7fT\x11\xd3\r7\xe6\"f\xcf\x8e\xabd\x0ftp\x82\xae\xd2\x15\x8e+c\xf6\xbf\xe14>\xa6-\xa5c\xde\xd7\xab\xea\x1f\xf8s2\x9cVF\xd5\x18\xfe\x0e\x8f \x01\x00\x00y.\xfc*\x82\xa5\xa1p5\xc8{\xf7\xef\xab\xe8\x99\xebw#\x8at\x1c\x80\xfc\xb0\x95\xa2\xa7\xd7,Y]E8\x83X\xf5F\xdc\x88-\xf5\xb0\xb5^\xdb\x1a\xb6\xaa\x14\xe2\xb9\rh^J-\xd1\xbaUn\x04\'l\x1b\xe0o\xdb\xc8\x91%\x1c\xb5\xbf\xb6\x90\xb4\xc2\x7f]/\xb3\xe7\xc9\'\x94\xcfIo\xdf\x04\x95\xb5\x06\x84\x1fH>\xda\xc5\x04 \x94\x88\xeb\'\xd4;6\x7f\xd9\x99-\x1b|G\x8d\xd4\xb9%\xaaQ\xa0K\x10\x03\x93\xe1\xcc\xe7m\x80\'\xf0\xa5\xed(\r\xa8\x0f&\xb1\xf3\xff0\f\x82%_\x92\x8bD\xb9\xd9\xe7\xf2\xe4\xc1i#\xdc\x87A\xb9\xc7\r\x92\xfa\x11\x11\xb5\x1f\x03\x9d\xdd\x1bj\xdf\xacg\xe3\xa0S\xd3\x8a\xe1n\x97\xea\xf5\xa0\'\v\xe9\xa0\xf1 f\xaan\xcf\xb5i\xb6d\xbc\x92\v\xd58\x16\b\xb3_:\xa4!\ny\xc4&\nWMM\xa8\xc4\v\x9f\x01o\xf4\xab&\xb6\x17\x02P\xc3!N\xf4\b\x1a~\x91V1s\xe9\xbe\x9e\x9b\'\xcde\xb3\xa1\x86\"\xd7\x04\xf1\xc0!\xed\xff\xee$\xc89\x8cB0\xd1dD\xe0IP\x88\xa2\xf2Y\x9af$$\xf1cO\xf7P\xac\xca\x80:!\xb4\x94#\xcb^\x9f\'\x03\xe3\x93\xb9\x82\xbf\xcf\xc4\xe3\xf7\x03Oh\xf2r\xca\x8ff\xbb/\x9f*\xaf\x1a \xa5\xa0?%M\xa5\x86\x98\xf24\'1\xc7\f<\xcc@\xe8\x8a\xac.\xde\xe4\xc7\xf5\x9ck\xa40!\xe9\x14$\xb3\x05m\xb5m\xed\ft\x93\xd8\xa3\x80\'Y\xb9\x05\xbbt|\xbe\xbcz\n\xf3\xf5p\xf8\x9f~\x1b\xd0\v\x1cQ')
getsockopt$inet_IP_IPSEC_POLICY(r1, 0x0, 0x10, &(0x7f00000006c0)={{{@in6=@loopback}}, {{@in6=@initdev}}}, &(0x7f0000000500)=0xe8)
socketpair(0x2, 0x2000000080003, 0x100, &(0x7f0000000480))
syz_genetlink_get_family_id$SEG6(&(0x7f00000003c0)='SEG6\x00')
sendmsg$SEG6_CMD_DUMPHMAC(r4, &(0x7f0000000580)={&(0x7f0000000380)={0x10, 0x0, 0x0, 0x1000000}, 0xc, &(0x7f0000000440)={&(0x7f00000005c0)=ANY=[@ANYBLOB="2300260109447a0000000000000000660000001400001a0065a455e04e35fbdf3e018c010000000000000074a7e0d50a000ead95dfc391c2295873f7fec6ea2adfafd66d2e49a2ed40dcafa1e146ab6aacc2097d8f20bd9c8b8ac505fafff000d4923f9600d02ab388644f66c2d5baec4079a81bae1927e49e91a4964656d7b227702926af5be846f3de49fad39048633fd9161123894d9427f854a30cb0532c8f31f6"], 0x1}, 0x1, 0x0, 0x0, 0x8000}, 0x804)
r6 = creat(&(0x7f0000000280)='./bus\x00', 0x0)
arch_prctl$ARCH_MAP_VDSO_32(0x2002, 0x7e)
ftruncate(r6, 0x2008200)
open(&(0x7f0000000140)='./bus\x00', 0x4000, 0x0)

15:06:40 executing program 4:
r0 = socket$inet_udplite(0x2, 0x2, 0x88)
ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f3188b070")
r1 = syz_open_procfs(0x0, &(0x7f0000000080)='net/dev_mcast\x00')
sendfile(r1, r1, &(0x7f00000001c0), 0x7f)
getsockopt$inet_IP_IPSEC_POLICY(r1, 0x0, 0x10, &(0x7f00000000c0)={{{@in6=@ipv4={[], [], @dev}, @in=@broadcast}}, {{@in6}, 0x0, @in6=@remote}}, &(0x7f0000000040)=0xe8)
lseek(r1, 0x20000, 0x0)

15:06:40 executing program 3:
r0 = socket$inet_udplite(0x2, 0x2, 0x88)
ioctl(r0, 0x1000008912, &(0x7f0000000000))
r1 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r2 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)})

[ 1121.257988] binder: BINDER_SET_CONTEXT_MGR already set
[ 1121.265073] binder: 1734:1737 ioctl 40046207 0 returned -16
[ 1121.273793] binder: release 1734:1737 transaction 1263 out, still active
15:06:40 executing program 4:
r0 = socket$inet_udplite(0x2, 0x2, 0x88)
ioctl(r0, 0x4, &(0x7f0000000040)="0adc1f123c123f3188b070")
syz_open_procfs(0x0, &(0x7f0000000080)='net/dev_mcast\x00')
lseek(r0, 0x20000, 0x0)

[ 1121.328775] binder: 1732:1746 BC_INCREFS_DONE node 1267 has no pending increfs request
[ 1121.357311] binder: BINDER_SET_CONTEXT_MGR already set
[ 1121.365020] binder: 1747:1752 ioctl 40046207 0 returned -16
15:06:40 executing program 3:
r0 = socket$inet_udplite(0x2, 0x2, 0x88)
ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c12")
r1 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r2 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)})

[ 1121.376450] binder: release 1747:1752 transaction 1269 out, still active
15:06:40 executing program 4:
r0 = socket$inet_udplite(0x2, 0x2, 0x88)
ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f3188b070")
pipe(&(0x7f0000000040)={<r1=>0xffffffffffffffff})
ioctl$TCSETA(r1, 0x5406, &(0x7f00000000c0)={0xa1, 0x9, 0x0, 0xc7f, 0x13, 0x2, 0xffffffff7fffffff, 0xffffffffffffff00, 0x9, 0x200})
r2 = syz_open_procfs(0x0, &(0x7f0000000080)='net/dev_mcast\x00')
lseek(r2, 0x20000, 0x0)
fcntl$F_SET_FILE_RW_HINT(r1, 0x40e, &(0x7f0000000100))

15:06:40 executing program 3:
r0 = socket$inet_udplite(0x2, 0x2, 0x88)
ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c12")
r1 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r2 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)})

[ 1121.465446] binder: BINDER_SET_CONTEXT_MGR already set
[ 1121.475297] binder: 1761:1763 ioctl 40046207 0 returned -16
[ 1121.490379] binder: release 1761:1763 transaction 1272 out, still active
[ 1121.587587] binder: BINDER_SET_CONTEXT_MGR already set
[ 1121.594073] binder: 1768:1769 ioctl 40046207 0 returned -16
[ 1121.609295] binder: release 1768:1769 transaction 1275 out, still active
15:06:40 executing program 0:
r0 = socket$inet_udplite(0x2, 0x2, 0x88)
ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f3188b070")
syz_open_procfs(0x0, &(0x7f0000000940)='syscall\x00')
r1 = syz_open_procfs(0x0, &(0x7f0000000040)='fd\x00')
recvmmsg(0xffffffffffffffff, &(0x7f0000003840)=[{{0x0, 0x0, 0x0}}], 0x1, 0x0, 0x0)
perf_event_open(&(0x7f0000940000)={0x2, 0x70, 0xee6a, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x100, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0xff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x10001, 0x1}, 0x0, 0x400000000000000}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
mlock(&(0x7f00005b8000/0x3000)=nil, 0x3000)
ioctl$SNDRV_TIMER_IOCTL_SELECT(0xffffffffffffffff, 0x40345410, 0x0)
openat$uinput(0xffffffffffffff9c, &(0x7f0000000080)='/dev/uinput\x00', 0x2, 0x0)
mmap(&(0x7f000060b000/0x1000)=nil, 0x1000, 0x5, 0x8000400200000033, r1, 0x0)
perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x2, 0x9, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2000000, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x4000000, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8)
r2 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)={0x10b, 0x6, 0x209e1e, 0x3, 0x1}, 0x2c)
bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000b40)={r2, &(0x7f0000000040), 0x0, 0x1}, 0x20)
r3 = creat(&(0x7f0000000640)='./file0\x00', 0x100)
setsockopt$inet6_tcp_TCP_REPAIR_QUEUE(r3, 0x6, 0x14, &(0x7f0000000980), 0x4)
unlink(&(0x7f0000000940)='./file0\x00')
r4 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r5 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r5, 0x0)
ioctl$BINDER_GET_NODE_DEBUG_INFO(r4, 0xc018620b, &(0x7f0000000100))
ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f00000000c0)=ANY=[@ANYBLOB="bb8f0000"], 0x0, 0x0, 0x0})
ioctl$BINDER_SET_CONTEXT_MGR(r5, 0x40046207, 0x0)
shutdown(0xffffffffffffffff, 0x1)
prctl$PR_SET_NAME(0xf, &(0x7f0000000380)='/group.stat\x00')
ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)})
ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0x0, 0x0, &(0x7f0000000780)})
ioctl$BINDER_WRITE_READ(r5, 0xc0306201, &(0x7f00000001c0)={0x8, 0x0, &(0x7f0000000500)=[@release={0x40046306, 0x1}], 0x0, 0x0, &(0x7f00000009c0)})

[ 1121.668244] binder: release 1715:1717 transaction 1260 out, still active
[ 1121.677816] binder: undelivered TRANSACTION_COMPLETE
[ 1121.692048] binder: send failed reply for transaction 1260, target dead
[ 1121.711439] binder: send failed reply for transaction 1263, target dead
[ 1121.728160] binder: send failed reply for transaction 1266 to 1732:1739
[ 1121.752654] binder: send failed reply for transaction 1269, target dead
[ 1121.771391] binder: send failed reply for transaction 1272, target dead
[ 1121.781568] binder: send failed reply for transaction 1275, target dead
[ 1121.836781] binder: 1773:1775 unknown command 36795
[ 1121.845388] binder: 1773:1775 ioctl c0306201 20000140 returned -22
15:06:40 executing program 2:
r0 = syz_open_procfs(0x0, &(0x7f00000000c0)='maps\x00')
write$P9_RRENAMEAT(r0, &(0x7f0000000140)={0x1d7, 0x4b, 0x2}, 0x7)
lseek(r0, 0x20000, 0x0)
readv(r0, &(0x7f0000000640)=[{&(0x7f0000000000)=""/96, 0x60}], 0x1)

15:06:40 executing program 4:
r0 = socket$inet_udplite(0x2, 0x2, 0x88)
ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f3188b070")
r1 = syz_open_procfs(0x0, &(0x7f0000000080)='net/dev_mcast\x00')
lseek(r1, 0x20000, 0x0)
ioctl$FS_IOC_ENABLE_VERITY(r0, 0x6685)

15:06:40 executing program 3:
r0 = socket$inet_udplite(0x2, 0x2, 0x88)
ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c12")
r1 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r2 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)})

15:06:40 executing program 1:
r0 = socket$inet_udplite(0x2, 0x2, 0x88)
ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f3188b070")
syz_open_procfs(0x0, &(0x7f0000000940)='syscall\x00')
syz_open_procfs(0x0, &(0x7f0000000040)='fd\x00')
recvmmsg(0xffffffffffffffff, &(0x7f0000003840)=[{{0x0, 0x0, 0x0}}], 0x1, 0x0, 0x0)
r1 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)={0x10b, 0x6, 0x209e1e, 0x3, 0x1}, 0x2c)
bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000b40)={r1, &(0x7f0000000040), 0x0, 0x1}, 0x20)
r2 = creat(&(0x7f0000000640)='./file0\x00', 0x100)
setsockopt$inet6_tcp_TCP_REPAIR_QUEUE(r2, 0x6, 0x14, &(0x7f0000000980), 0x4)
unlink(&(0x7f0000000940)='./file0\x00')
r3 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_GET_NODE_DEBUG_INFO(r3, 0xc018620b, &(0x7f0000000100))
ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)})
ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0x0, 0x0, &(0x7f0000000780)})

15:06:40 executing program 5:
r0 = socket$inet_udplite(0x2, 0x2, 0x88)
ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f3188b070")
syz_open_procfs(0x0, &(0x7f0000000940)='syscall\x00')
r1 = syz_open_procfs(0x0, &(0x7f0000000040)='fd\x00')
recvmmsg(0xffffffffffffffff, &(0x7f0000003840)=[{{0x0, 0x0, 0x0}}], 0x1, 0x0, 0x0)
perf_event_open(&(0x7f0000940000)={0x2, 0x70, 0xee6a, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x100, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0xff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x10001, 0x1}, 0x0, 0x400000000000000}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
ioctl$SNDRV_TIMER_IOCTL_SELECT(0xffffffffffffffff, 0x40345410, 0x0)
openat$uinput(0xffffffffffffff9c, &(0x7f0000000080)='/dev/uinput\x00', 0x2, 0x0)
mmap(&(0x7f000060b000/0x1000)=nil, 0x1000, 0x5, 0x8000400200000033, r1, 0x0)
unshare(0xfffffffffffffffd)
r2 = getpid()
sched_setscheduler(r2, 0x5, &(0x7f00000000c0))
open$dir(&(0x7f0000000400)='./file0\x00', 0x0, 0x0)
perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f00000004c0), 0x2}, 0x0, 0x0, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r3 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000340)='memory.current\x00', 0x0, 0x0)
ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, 0x0)
socketpair(0x1, 0x20000000000001, 0x0, &(0x7f0000000100)={<r4=>0xffffffffffffffff, <r5=>0xffffffffffffffff})
ioctl$PERF_EVENT_IOC_SET_FILTER(r5, 0x8914, &(0x7f0000000300)='lo\x00\x96o\xd6Q\xb9Y\xa9\xc8J,\x00\xd2\x97\x04\x03\xdc\r')
close(r3)
rt_sigprocmask(0x2, &(0x7f0000000240)={0x6}, &(0x7f00000002c0), 0x8)
ioctl$PERF_EVENT_IOC_SET_FILTER(r5, 0x8923, &(0x7f00000008c0)='lo\x00\x96o8\x0fd\xa1\xe3\xd7]b}\x1f\xa1Y\xad4\x90\x9d`\xd2\x98\x00\x00\x00 \'Y\x17]\x15c\xcaR\xdd\x98OC\x89\x1b\xe7\x84\xe2\x05\x80w\xd2|D\x8dK\x14Bx\xcbuH\xc2\xeec\xbf<>Y\x1a\xfc\x1f9OB\x81\x89\x186\xc5q@n\xb4\xb6s\xb0\x00\x00\xfc\x00\x00\b\x00\x00\xda\xef\xecE\xec\xd5I\xb2\x9b\xfe\x8d\x90?\x00\xe9\xe4~g:\xc1\xb2aj\x96\xbb\xa7\xe2\xc0\xdc\xf9Q\b\xeb\x16\x7fT\x11\xd3\r7\xe6\"f\xcf\x8e\xabd\x0ftp\x82\xae\xd2\x15\x8e+c\xf6\xbf\xe14>\xa6-\xa5c\xde\xd7\xab\xea\x1f\xf8s2\x9cVF\xd5\x18\xfe\x0e\x8f \x01\x00\x00y.\xfc*\x82\xa5\xa1p5\xc8{\xf7\xef\xab\xe8\x99\xebw#\x8at\x1c\x80\xfc\xb0\x95\xa2\xa7\xd7,Y]E8\x83X\xf5F\xdc\x88-\xf5\xb0\xb5^\xdb\x1a\xb6\xaa\x14\xe2\xb9\rh^J-\xd1\xbaUn\x04\'l\x1b\xe0o\xdb\xc8\x91%\x1c\xb5\xbf\xb6\x90\xb4\xc2\x7f]/\xb3\xe7\xc9\'\x94\xcfIo\xdf\x04\x95\xb5\x06\x84\x1fH>\xda\xc5\x04 \x94\x88\xeb\'\xd4;6\x7f\xd9\x99-\x1b|G\x8d\xd4\xb9%\xaaQ\xa0K\x10\x03\x93\xe1\xcc\xe7m\x80\'\xf0\xa5\xed(\r\xa8\x0f&\xb1\xf3\xff0\f\x82%_\x92\x8bD\xb9\xd9\xe7\xf2\xe4\xc1i#\xdc\x87A\xb9\xc7\r\x92\xfa\x11\x11\xb5\x1f\x03\x9d\xdd\x1bj\xdf\xacg\xe3\xa0S\xd3\x8a\xe1n\x97\xea\xf5\xa0\'\v\xe9\xa0\xf1 f\xaan\xcf\xb5i\xb6d\xbc\x92\v\xd58\x16\b\xb3_:\xa4!\ny\xc4&\nWMM\xa8\xc4\v\x9f\x01o\xf4\xab&\xb6\x17\x02P\xc3!N\xf4\b\x1a~\x91V1s\xe9\xbe\x9e\x9b\'\xcde\xb3\xa1\x86\"\xd7\x04\xf1\xc0!\xed\xff\xee$\xc89\x8cB0\xd1dD\xe0IP\x88\xa2\xf2Y\x9af$$\xf1cO\xf7P\xac\xca\x80:!\xb4\x94#\xcb^\x9f\'\x03\xe3\x93\xb9\x82\xbf\xcf\xc4\xe3\xf7\x03Oh\xf2r\xca\x8ff\xbb/\x9f*\xaf\x1a \xa5\xa0?%M\xa5\x86\x98\xf24\'1\xc7\f<\xcc@\xe8\x8a\xac.\xde\xe4\xc7\xf5\x9ck\xa40!\xe9\x14$\xb3\x05m\xb5m\xed\ft\x93\xd8\xa3\x80\'Y\xb9\x05\xbbt|\xbe\xbcz\n\xf3\xf5p\xf8\x9f~\x1b\xd0\v\x1cQ')
getsockopt$inet_IP_IPSEC_POLICY(r1, 0x0, 0x10, &(0x7f00000006c0)={{{@in6=@loopback}}, {{@in6=@initdev}}}, &(0x7f0000000500)=0xe8)
socketpair(0x2, 0x2000000080003, 0x100, &(0x7f0000000480))
syz_genetlink_get_family_id$SEG6(&(0x7f00000003c0)='SEG6\x00')
sendmsg$SEG6_CMD_DUMPHMAC(r4, &(0x7f0000000580)={&(0x7f0000000380)={0x10, 0x0, 0x0, 0x1000000}, 0xc, &(0x7f0000000440)={&(0x7f00000007c0)=ANY=[@ANYBLOB="2300260109447a0000000000000000660000001400001a0065a455e04ea56d0a47018c8e973bcac914471474a7e0d50a000eadd66d2e49a2ed40dcafa1e046ab6aacc2097d8f75bd9c8b8a220bdde116904efa3f9600f22ab388644f66c2d5baec40790000010000000000a4964656d7b227702926af5be846f3de49fad39048633fd9161123894d9427f854a30cb0532c8f31f663380e40ce7fc10a9360c68fb676238c86037c23439d4e43ad37927e8e9f705816dbbada6c487980849fbcad4ee82b4be04e911860ee003ba8fddbab82d8bbbd05e7ec445a"], 0x1}, 0x1, 0x0, 0x0, 0x8000}, 0x804)
r6 = creat(&(0x7f0000000280)='./bus\x00', 0x0)
arch_prctl$ARCH_MAP_VDSO_32(0x2002, 0x7e)
ftruncate(r6, 0x2008200)
open(&(0x7f0000000140)='./bus\x00', 0x4000, 0x0)

[ 1121.902530] binder: 1773:1780 BC_INCREFS_DONE node 1280 has no pending increfs request
15:06:40 executing program 4:
r0 = socket$inet_udplite(0x2, 0x2, 0x88)
r1 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000140)='net/ip6_mr_vif\x00')
ioctl$EVIOCGABS20(r1, 0x80184560, &(0x7f0000000180)=""/113)
r2 = syz_open_procfs(0x0, &(0x7f00000000c0)='net/netfilter\x00')
ioctl$RTC_WKALM_SET(r2, 0x4028700f, &(0x7f0000000100)={0x1, 0x0, {0x2b, 0x1b, 0x17, 0x19, 0xb, 0x5, 0x4, 0x7b, 0xffffffffffffffff}})
ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f3188b070")
ioctl$sock_FIOGETOWN(r0, 0x8903, &(0x7f0000000040)=<r3=>0x0)
r4 = syz_open_procfs(r3, &(0x7f0000000080)='fdinfo/3\x00')
lseek(r4, 0x20000, 0x0)

15:06:40 executing program 3:
r0 = socket$inet_udplite(0x2, 0x2, 0x88)
ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f3188")
r1 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r2 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)})

15:06:40 executing program 2:
r0 = openat$selinux_enforce(0xffffffffffffff9c, &(0x7f0000000080)='/selinux/enforce\x00', 0x2000, 0x0)
openat$cgroup_type(r0, &(0x7f0000000100)='cgroup.type\x00', 0x2, 0x0)
r1 = syz_open_procfs(0x0, &(0x7f00000000c0)='maps\x00')
lseek(r1, 0x20000, 0x0)
readv(r1, &(0x7f0000000640)=[{&(0x7f0000000000)=""/96, 0x60}], 0x1)

[ 1121.975511] binder: BINDER_SET_CONTEXT_MGR already set
[ 1121.982525] binder: 1782:1796 ioctl 40046207 0 returned -16
[ 1121.995228] binder: release 1782:1796 transaction 1282 out, still active
15:06:40 executing program 4:
r0 = socket$inet_udplite(0x2, 0x2, 0x88)
ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f3188b070")
r1 = syz_open_procfs(0x0, &(0x7f0000000080)='net/dev_mcast\x00')
lseek(r1, 0x20000, 0x0)
setsockopt$inet_MCAST_LEAVE_GROUP(r0, 0x0, 0x2d, &(0x7f0000000b80)={0x0, {{0x2, 0x4e22, @remote}}}, 0x88)
getsockname(r0, &(0x7f0000000c40)=@pptp={0x18, 0x2, {0x0, @broadcast}}, &(0x7f0000000040)=0x80)
write$binfmt_elf32(r1, &(0x7f00000000c0)={{0x7f, 0x45, 0x4c, 0x46, 0x3, 0x0, 0x1f, 0x39, 0x8, 0x3, 0x3f, 0x1000, 0x3cd, 0x38, 0x2dd, 0x80, 0x9, 0x20, 0x2, 0x40, 0x2000000000000000, 0x100}, [{0x70000007, 0x81, 0xacd, 0xfba, 0xffff, 0x8001, 0x9, 0x9}], "8f6edf22e19d57522351e462abb8c3d5f2f953552cde33425034fce63b94faed9afe5c7da8322e36fe7ce3fe38bae79e8267a4d783f45fe6846daea4aee4b9cc3769cd7b53416b4150f0489c0567a69e8906c42def195aac0211cd780dab559758641564725e4c49", [[], [], [], [], [], [], [], [], [], []]}, 0xac0)

[ 1122.059202] binder: 1791:1814 BC_INCREFS_DONE node 1286 has no pending increfs request
[ 1122.089528] binder: BINDER_SET_CONTEXT_MGR already set
[ 1122.101226] binder: 1811:1816 ioctl 40046207 0 returned -16
15:06:41 executing program 3:
r0 = socket$inet_udplite(0x2, 0x2, 0x88)
ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f3188")
r1 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r2 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)})

15:06:41 executing program 2:
r0 = syz_open_procfs(0x0, &(0x7f00000000c0)='maps\x00')
lseek(r0, 0x20000, 0x0)
r1 = syz_genetlink_get_family_id$tipc(&(0x7f0000000140)='TIPC\x00')
sendmsg$TIPC_CMD_DISABLE_BEARER(r0, &(0x7f0000000240)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x10000}, 0xc, &(0x7f00000001c0)={&(0x7f0000000300)=ANY=[@ANYBLOB='0\x00\x00\x00', @ANYRES16=r1, @ANYBLOB="000029bd7000fcdadf25010000000000000002410000fe0200136574683a6970365f7674693000000000e7e6ce8549c3754842fe94c8a726b185684228a912e9b8d68f99371fa4843967b95bfb9c230182c7193adccdfa345166d66ca5be52066939679cebe258d57d7dea589e02f14e643ce471adc0089b54017d12a560626ae450acd88a02b2274e6e888486d7"], 0x30}, 0x1, 0x0, 0x0, 0x20000810}, 0x44005)
write$binfmt_misc(r0, &(0x7f0000000080)=ANY=[@ANYBLOB="73797a31c9b1090000005e64b9702e281420663fffcd63218922ff3075c10021"], 0x20)
readv(r0, &(0x7f0000000640)=[{&(0x7f0000000280)=""/96, 0x60}], 0x1)

[ 1122.111391] binder: release 1811:1816 transaction 1288 out, still active
[ 1122.238785] binder: BINDER_SET_CONTEXT_MGR already set
[ 1122.244654] binder: 1828:1833 ioctl 40046207 0 returned -16
[ 1122.258243] binder: release 1828:1833 transaction 1291 out, still active
15:06:41 executing program 0:
r0 = socket$inet_udplite(0x2, 0x2, 0x88)
ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f3188b070")
syz_open_procfs(0x0, &(0x7f0000000940)='syscall\x00')
r1 = syz_open_procfs(0x0, &(0x7f0000000040)='fd\x00')
recvmmsg(0xffffffffffffffff, &(0x7f0000003840)=[{{0x0, 0x0, 0x0}}], 0x1, 0x0, 0x0)
perf_event_open(&(0x7f0000940000)={0x2, 0x70, 0xee6a, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x100, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0xff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x10001, 0x1}, 0x0, 0x400000000000000}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
mlock(&(0x7f00005b8000/0x3000)=nil, 0x3000)
ioctl$SNDRV_TIMER_IOCTL_SELECT(0xffffffffffffffff, 0x40345410, 0x0)
openat$uinput(0xffffffffffffff9c, &(0x7f0000000080)='/dev/uinput\x00', 0x2, 0x0)
mmap(&(0x7f000060b000/0x1000)=nil, 0x1000, 0x5, 0x8000400200000033, r1, 0x0)
perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x2, 0x9, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2000000, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x4000000, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8)
r2 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)={0x10b, 0x6, 0x209e1e, 0x3, 0x1}, 0x2c)
bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000b40)={r2, &(0x7f0000000040), 0x0, 0x1}, 0x20)
r3 = creat(&(0x7f0000000640)='./file0\x00', 0x100)
setsockopt$inet6_tcp_TCP_REPAIR_QUEUE(r3, 0x6, 0x14, &(0x7f0000000980), 0x4)
unlink(&(0x7f0000000940)='./file0\x00')
r4 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r5 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r5, 0x0)
ioctl$BINDER_GET_NODE_DEBUG_INFO(r4, 0xc018620b, &(0x7f0000000100))
ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f00000000c0)=ANY=[@ANYBLOB="bb8f0000"], 0x0, 0x0, 0x0})
ioctl$BINDER_SET_CONTEXT_MGR(r5, 0x40046207, 0x0)
shutdown(0xffffffffffffffff, 0x1)
prctl$PR_SET_NAME(0xf, &(0x7f0000000380)='/group.stat\x00')
ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)})
ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0x0, 0x0, &(0x7f0000000780)})
creat(&(0x7f00000000c0)='./file0\x00', 0x0)

15:06:41 executing program 4:
r0 = socket$inet_udplite(0x2, 0x2, 0x88)
ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f3188b070")
r1 = syz_open_procfs(0x0, &(0x7f0000000080)='net/dev_mcast\x00')
lseek(r1, 0x20000, 0x0)
statx(r1, &(0x7f0000000040)='./file0\x00', 0x0, 0x14, &(0x7f00000000c0))

15:06:41 executing program 2:
r0 = syz_open_procfs(0x0, &(0x7f00000000c0)='maps\x00')
lseek(r0, 0x20000, 0x0)
ioctl$TCSBRKP(r0, 0x5425, 0x80)
readv(r0, &(0x7f0000000640)=[{&(0x7f0000000000)=""/96, 0x60}], 0x1)

15:06:41 executing program 3:
r0 = socket$inet_udplite(0x2, 0x2, 0x88)
ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f3188")
r1 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r2 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)})

[ 1122.549791] binder: release 1773:1775 transaction 1279 out, still active
[ 1122.563754] binder: send failed reply for transaction 1279, target dead
[ 1122.580388] binder: send failed reply for transaction 1282, target dead
[ 1122.589275] binder: send failed reply for transaction 1285 to 1791:1797
15:06:41 executing program 1:
r0 = socket$inet_udplite(0x2, 0x2, 0x88)
ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f3188b070")
syz_open_procfs(0x0, &(0x7f0000000940)='syscall\x00')
syz_open_procfs(0x0, &(0x7f0000000040)='fd\x00')
r1 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)={0x10b, 0x6, 0x209e1e, 0x3, 0x1}, 0x2c)
bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000b40)={r1, &(0x7f0000000040), 0x0, 0x1}, 0x20)
r2 = creat(&(0x7f0000000640)='./file0\x00', 0x100)
setsockopt$inet6_tcp_TCP_REPAIR_QUEUE(r2, 0x6, 0x14, &(0x7f0000000980), 0x4)
unlink(&(0x7f0000000940)='./file0\x00')
r3 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_GET_NODE_DEBUG_INFO(r3, 0xc018620b, &(0x7f0000000100))
ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)})
ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0x0, 0x0, &(0x7f0000000780)})

15:06:41 executing program 5:
r0 = socket$inet_udplite(0x2, 0x2, 0x88)
ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f3188b070")
r1 = syz_open_procfs(0x0, &(0x7f0000000940)='syscall\x00')
ioctl$TIOCGSID(r1, 0x5429, &(0x7f0000000200))
getsockopt$sock_cred(r0, 0x1, 0x11, &(0x7f0000000540)={<r2=>0x0}, &(0x7f0000000680)=0xc)
r3 = syz_open_procfs(r2, &(0x7f0000000b00)='\xffd\x00\xbb\xc8xu\x17\xccNt\xcc\x91\a\xde\xb6TIy7\xb8\xad\x11~\x12G\xed\xc8`\x00_\xdc\xe4\xe7\xbbtM\xdc\xf9\x15\r\x1b\xdd\x1e\xc4\x1eDd\xe5\x05\xd6\x1e\xfd\xc2{Gn\x92T\xce\xe7_J\xd1\x7f\x9a\xb6\xb0?41l&E7\x18\xb1!T\xf7\xd25\xa2&\xdc\xa6#\x11\xc6\xbd\aI\xadh\r\x01\x16\xef\xaez\tr\x0et|\x95PX\xe3<\xff\xf5\xe7\xf4\x1c\xde\xcf\xa1J\a\xfb\x84S\x1aZ\"o\n\xabB=`\x15\xd1\xb6\xad\xefg\xed\xbf\xe9\xda\xd0\xf6ca\xfb-\xac\xb4<]\x0e\x10\xe0\xa0]T\xe7\xfb\xf1\xcb\xdb\x1e\x11\xf1G8Tl\xca\xa0\xb0\x1d\x9e\xf1\'\xd4\xe3\xb8 \x810\xdc#\xfaf\xbe\xfc\xd1m\xe6Jg\x1a\xb23\xe5\x19\xd1\xda\xfe-\xfc=\x15\x82u\x81n\x8f\x8f\x89a/\x8aT\xea\x96k|\n\xa1\x11~.\xc8\x12\xc0r,\xf1\xf0\xff\xff\xff\xff\xff\xffB\xb2\\UXl$\'\xaa\xb8\xbft\x02\xfe\xc1\xf8+\x89\xb6\xb2\xf0\xcf\x10K7P+\x98>\x15\xdf\xa6/\x14k\x1e\xeb\xbb#fu\xcf-)m\tA\x0e\xbc\xbet\xc0\xc6<[')
recvmmsg(0xffffffffffffffff, &(0x7f0000003840)=[{{0x0, 0x0, 0x0}}], 0x1, 0x0, 0x0)
perf_event_open(&(0x7f0000940000)={0x2, 0x70, 0xee6a, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x100, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0xff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x10001, 0x1}, 0x0, 0x400000000000000}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
mlock(&(0x7f00005b8000/0x3000)=nil, 0x3000)
ioctl$SNDRV_TIMER_IOCTL_SELECT(0xffffffffffffffff, 0x40345410, 0x0)
openat$uinput(0xffffffffffffff9c, &(0x7f0000000080)='/dev/uinput\x00', 0x2, 0x0)
mmap(&(0x7f000060b000/0x1000)=nil, 0x1000, 0x5, 0x8000400200000033, r3, 0x0)
unshare(0xfffffffffffffffd)
r4 = getpid()
sched_setscheduler(r4, 0x5, &(0x7f00000000c0))
open$dir(&(0x7f0000000400)='./file0\x00', 0x0, 0x0)
perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f00000004c0), 0x2}, 0x0, 0x0, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r5 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000340)='memory.current\x00', 0x0, 0x0)
ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, 0x0)
socketpair(0x1, 0x20000000000001, 0x0, &(0x7f0000000100)={<r6=>0xffffffffffffffff, <r7=>0xffffffffffffffff})
ioctl$PERF_EVENT_IOC_SET_FILTER(r7, 0x8914, &(0x7f0000000300)='lo\x00\x96o\xd6Q\xb9Y\xa9\xc8J,\x00\xd2\x97\x04\x03\xdc\r')
close(r5)
rt_sigprocmask(0x2, &(0x7f0000000240)={0x6}, &(0x7f00000002c0), 0x8)
ioctl$PERF_EVENT_IOC_SET_FILTER(r7, 0x8923, &(0x7f00000008c0)='lo\x00\x96o8\x0fd\xa1\xe3\xd7]b}\x1f\xa1Y\xad4\x90\x9d`\xd2\x98\x00\x00\x00 \'Y\x17]\x15c\xcaR\xdd\x98OC\x89\x1b\xe7\x84\xe2\x05\x80w\xd2|D\x8dK\x14Bx\xcbuH\xc2\xeec\xbf<>Y\x1a\xfc\x1f9OB\x81\x89\x186\xc5q@n\xb4\xb6s\xb0\x00\x00\xfc\x00\x00\b\x00\x00\xda\xef\xecE\xec\xd5I\xb2\x9b\xfe\x8d\x90?\x00\xe9\xe4~g:\xc1\xb2aj\x96\xbb\xa7\xe2\xc0\xdc\xf9Q\b\xeb\x16\x7fT\x11\xd3\r7\xe6\"f\xcf\x8e\xabd\x0ftp\x82\xae\xd2\x15\x8e+c\xf6\xbf\xe14>\xa6-\xa5c\xde\xd7\xab\xea\x1f\xf8s2\x9cVF\xd5\x18\xfe\x0e\x8f \x01\x00\x00y.\xfc*\x82\xa5\xa1p5\xc8{\xf7\xef\xab\xe8\x99\xebw#\x8at\x1c\x80\xfc\xb0\x95\xa2\xa7\xd7,Y]E8\x83X\xf5F\xdc\x88-\xf5\xb0\xb5^\xdb\x1a\xb6\xaa\x14\xe2\xb9\rh^J-\xd1\xbaUn\x04\'l\x1b\xe0o\xdb\xc8\x91%\x1c\xb5\xbf\xb6\x90\xb4\xc2\x7f]/\xb3\xe7\xc9\'\x94\xcfIo\xdf\x04\x95\xb5\x06\x84\x1fH>\xda\xc5\x04 \x94\x88\xeb\'\xd4;6\x7f\xd9\x99-\x1b|G\x8d\xd4\xb9%\xaaQ\xa0K\x10\x03\x93\xe1\xcc\xe7m\x80\'\xf0\xa5\xed(\r\xa8\x0f&\xb1\xf3\xff0\f\x82%_\x92\x8bD\xb9\xd9\xe7\xf2\xe4\xc1i#\xdc\x87A\xb9\xc7\r\x92\xfa\x11\x11\xb5\x1f\x03\x9d\xdd\x1bj\xdf\xacg\xe3\xa0S\xd3\x8a\xe1n\x97\xea\xf5\xa0\'\v\xe9\xa0\xf1 f\xaan\xcf\xb5i\xb6d\xbc\x92\v\xd58\x16\b\xb3_:\xa4!\ny\xc4&\nWMM\xa8\xc4\v\x9f\x01o\xf4\xab&\xb6\x17\x02P\xc3!N\xf4\b\x1a~\x91V1s\xe9\xbe\x9e\x9b\'\xcde\xb3\xa1\x86\"\xd7\x04\xf1\xc0!\xed\xff\xee$\xc89\x8cB0\xd1dD\xe0IP\x88\xa2\xf2Y\x9af$$\xf1cO\xf7P\xac\xca\x80:!\xb4\x94#\xcb^\x9f\'\x03\xe3\x93\xb9\x82\xbf\xcf\xc4\xe3\xf7\x03Oh\xf2r\xca\x8ff\xbb/\x9f*\xaf\x1a \xa5\xa0?%M\xa5\x86\x98\xf24\'1\xc7\f<\xcc@\xe8\x8a\xac.\xde\xe4\xc7\xf5\x9ck\xa40!\xe9\x14$\xb3\x05m\xb5m\xed\ft\x93\xd8\xa3\x80\'Y\xb9\x05\xbbt|\xbe\xbcz\n\xf3\xf5p\xf8\x9f~\x1b\xd0\v\x1cQ')
getsockopt$inet_IP_IPSEC_POLICY(r3, 0x0, 0x10, &(0x7f00000006c0)={{{@in6=@loopback}}, {{@in6=@initdev}}}, &(0x7f0000000500)=0xe8)
socketpair(0x2, 0x2000000080003, 0x100, &(0x7f0000000480))
syz_genetlink_get_family_id$SEG6(&(0x7f00000003c0)='SEG6\x00')
sendmsg$SEG6_CMD_DUMPHMAC(r6, &(0x7f0000000580)={&(0x7f0000000380)={0x10, 0x0, 0x0, 0x1000000}, 0xc, &(0x7f0000000440)={&(0x7f00000005c0)=ANY=[@ANYBLOB="2300260109447a0000000000000000660000001400001a0065a455e04ea56d0a47018c8e973bcac914471474a7e0d50a000eadd66d2e49a2ed40dcafa1e046ab6aacc2097d8f75bd9c8b8a220bdde116904efa3f9600f22ab388644f66c2d5baec4079a81bae1927e49e91a4964656d7b227702926af5be846f3de49fad39048633fd9161123894d9427f854a30cb0532c8f31f663380e40ce7f6cb15ec8baab3b7c6f"], 0x1}, 0x1, 0x0, 0x0, 0x8000}, 0x804)
r8 = creat(&(0x7f0000000280)='./bus\x00', 0x0)
arch_prctl$ARCH_MAP_VDSO_32(0x2002, 0x7e)
ftruncate(r8, 0x2008200)
open(&(0x7f0000000140)='./bus\x00', 0x4000, 0x0)

[ 1122.597480] binder: send failed reply for transaction 1288, target dead
[ 1122.605694] binder: send failed reply for transaction 1291, target dead
15:06:41 executing program 4:
r0 = socket$inet_udplite(0x2, 0x2, 0x88)
ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f3188b070")
r1 = syz_open_procfs(0x0, &(0x7f0000000080)='net/dev_mcast\x00')
lseek(r1, 0x20000, 0x0)
bind(r1, &(0x7f00000000c0)=@nl=@kern={0x10, 0x0, 0x0, 0x24045}, 0x80)
ioctl(r1, 0x1, &(0x7f0000000140)="50b1f86ea8d04e58d9379f9e2812da5fc14eb53a93c291f647bbb956284226c1f168531f81e5032ef9deeee4032e942a1d497cf6cbe511f6e4679c5546a9c98637499802e32b52524dfeeef2cebe10f1c09ac472627341c032948e9bb38300f112b9b1f32769e3e1534e9cccf2777b915414c053c2255b81747ffa116b0263c04322d55d970d1948d55447b43320cd64961c5d6b65c3152a1cb395e387da600d2ff57e84250c8132512ba6d26c85a9f8230e26e40b75f7c7bde091da08646ec34cbf26816e0ecb4bba6ddfbf4a170fff7cdd845f7b52d5e4d4af5aeff4e1cd7aa2fccf3c3ba4c7")

15:06:41 executing program 2:
r0 = syz_open_procfs(0x0, &(0x7f00000000c0)='maps\x00')
lseek(r0, 0x1fffc, 0xffffffffffffffff)
readv(r0, &(0x7f0000000640)=[{&(0x7f0000000000)=""/96, 0xffffffffffffff7c}], 0x1)

15:06:41 executing program 3:
r0 = socket$inet_udplite(0x2, 0x2, 0x88)
ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f3188b0")
r1 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r2 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)})

[ 1122.640541] binder: release 1849:1851 transaction 1295 out, still active
[ 1122.676999] binder: send failed reply for transaction 1295, target dead
[ 1122.691653] binder: 1864:1866 transaction failed 29189/-22, size 24-8 line 3117
[ 1122.706527] binder: 1864:1866 BC_INCREFS_DONE u0000000000000000 no match
[ 1122.728798] binder: 1861:1865 unknown command 36795
15:06:41 executing program 1:
r0 = socket$inet_udplite(0x2, 0x2, 0x88)
ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f3188b070")
syz_open_procfs(0x0, &(0x7f0000000940)='syscall\x00')
syz_open_procfs(0x0, &(0x7f0000000040)='fd\x00')
r1 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)={0x10b, 0x6, 0x209e1e, 0x3, 0x1}, 0x2c)
bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000b40)={r1, &(0x7f0000000040), 0x0, 0x1}, 0x20)
r2 = creat(&(0x7f0000000640)='./file0\x00', 0x100)
setsockopt$inet6_tcp_TCP_REPAIR_QUEUE(r2, 0x6, 0x14, &(0x7f0000000980), 0x4)
unlink(&(0x7f0000000940)='./file0\x00')
r3 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_GET_NODE_DEBUG_INFO(r3, 0xc018620b, &(0x7f0000000100))
ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)})
ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0x0, 0x0, &(0x7f0000000780)})

[ 1122.742703] binder: 1861:1865 ioctl c0306201 20000140 returned -22
[ 1122.750428] binder: release 1867:1871 transaction 1300 out, still active
[ 1122.757191] binder: BINDER_SET_CONTEXT_MGR already set
[ 1122.765026] binder: 1861:1865 ioctl 40046207 0 returned -16
15:06:41 executing program 4:
r0 = socket$inet_udplite(0x2, 0x2, 0x88)
ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f3188b070")
r1 = syz_open_procfs(0x0, &(0x7f0000000080)='net/dev_mcast\x00')
setsockopt$IP_VS_SO_SET_STOPDAEMON(r1, 0x0, 0x48c, &(0x7f0000000040)={0x3, 'bond_slave_0\x00', 0x4}, 0x18)
ioctl$PIO_FONTRESET(r1, 0x4b6d, 0x0)
lseek(r1, 0x20000, 0x0)

15:06:41 executing program 3:
r0 = socket$inet_udplite(0x2, 0x2, 0x88)
ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f3188b0")
r1 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r2 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)})

[ 1122.793876] binder: send failed reply for transaction 1300, target dead
[ 1122.807644] binder: send failed reply for transaction 1303 to 1861:1865
[ 1122.818390] binder: 1861:1865 BC_INCREFS_DONE u0000000000000000 no match
15:06:41 executing program 2:
r0 = syz_open_procfs(0x0, &(0x7f00000000c0)='maps\x00')
bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000100)={&(0x7f0000000080)='maps\x00', r0}, 0x10)
lseek(r0, 0x20000, 0x0)
ioctl$EVIOCSREP(r0, 0x40084503, &(0x7f0000000140)=[0x3, 0x40])
readv(r0, &(0x7f0000000640)=[{&(0x7f0000000000)=""/96, 0x60}], 0x1)

15:06:41 executing program 0:
r0 = socket$inet_udplite(0x2, 0x2, 0x88)
ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f3188b070")
syz_open_procfs(0x0, &(0x7f0000000940)='syscall\x00')
r1 = syz_open_procfs(0x0, &(0x7f0000000040)='fd\x00')
recvmmsg(0xffffffffffffffff, &(0x7f0000003840)=[{{0x0, 0x0, 0x0}}], 0x1, 0x0, 0x0)
perf_event_open(&(0x7f0000940000)={0x2, 0x70, 0xee6a, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x100, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0xff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x10001, 0x1}, 0x0, 0x400000000000000}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
mlock(&(0x7f00005b8000/0x3000)=nil, 0x3000)
ioctl$SNDRV_TIMER_IOCTL_SELECT(0xffffffffffffffff, 0x40345410, 0x0)
openat$uinput(0xffffffffffffff9c, &(0x7f0000000080)='/dev/uinput\x00', 0x2, 0x0)
mmap(&(0x7f000060b000/0x1000)=nil, 0x1000, 0x5, 0x8000400200000033, r1, 0x0)
perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x2, 0x9, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2000000, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x4000000, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8)
r2 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)={0x10b, 0x6, 0x209e1e, 0x3, 0x1}, 0x2c)
bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000b40)={r2, &(0x7f0000000040), 0x0, 0x1}, 0x20)
r3 = creat(&(0x7f0000000640)='./file0\x00', 0x100)
setsockopt$inet6_tcp_TCP_REPAIR_QUEUE(r3, 0x6, 0x14, &(0x7f0000000980), 0x4)
unlink(&(0x7f0000000940)='./file0\x00')
r4 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r5 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r5, 0x0)
ioctl$BINDER_GET_NODE_DEBUG_INFO(r4, 0xc018620b, &(0x7f0000000100))
ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f00000000c0)=ANY=[@ANYBLOB="bb8f0000"], 0x0, 0x0, 0x0})
ioctl$BINDER_SET_CONTEXT_MGR(r5, 0x40046207, 0x0)
shutdown(0xffffffffffffffff, 0x1)
prctl$PR_SET_NAME(0xf, &(0x7f0000000380)='/group.stat\x00')
ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)})
creat(&(0x7f00000000c0)='./file0\x00', 0x0)

[ 1122.858283] binder: 1877:1878 transaction failed 29189/-22, size 24-8 line 3117
[ 1122.878320] binder: 1877:1878 BC_INCREFS_DONE u0000000000000000 no match
15:06:41 executing program 1:
r0 = socket$inet_udplite(0x2, 0x2, 0x88)
ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f3188b070")
syz_open_procfs(0x0, &(0x7f0000000940)='syscall\x00')
syz_open_procfs(0x0, &(0x7f0000000040)='fd\x00')
r1 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)={0x10b, 0x6, 0x209e1e, 0x3, 0x1}, 0x2c)
bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000b40)={r1, &(0x7f0000000040), 0x0, 0x1}, 0x20)
r2 = creat(&(0x7f0000000640)='./file0\x00', 0x100)
setsockopt$inet6_tcp_TCP_REPAIR_QUEUE(r2, 0x6, 0x14, &(0x7f0000000980), 0x4)
unlink(&(0x7f0000000940)='./file0\x00')
r3 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_GET_NODE_DEBUG_INFO(r3, 0xc018620b, &(0x7f0000000100))
ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)})
ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0x0, 0x0, &(0x7f0000000780)})

15:06:41 executing program 3:
r0 = socket$inet_udplite(0x2, 0x2, 0x88)
ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f3188b0")
r1 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r2 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)})

15:06:41 executing program 2:
rt_sigprocmask(0x0, &(0x7f0000000080)={0x6}, 0x0, 0x8)
r0 = syz_open_procfs(0x0, &(0x7f00000000c0)='maps\x00')
lseek(r0, 0x20000, 0x0)
readv(r0, &(0x7f0000000640)=[{&(0x7f0000000000)=""/96, 0x60}], 0x1)

[ 1122.909253] binder: release 1885:1888 transaction 1308 out, still active
[ 1122.941746] binder: send failed reply for transaction 1308, target dead
[ 1123.005932] binder: 1894:1899 transaction failed 29189/-22, size 24-8 line 3117
[ 1123.022377] binder: 1894:1899 BC_INCREFS_DONE u0000000000000000 no match
[ 1123.043296] binder: release 1898:1901 transaction 1313 out, still active
[ 1123.054617] binder: 1891:1896 unknown command 36795
[ 1123.063421] binder: 1891:1896 ioctl c0306201 20000140 returned -22
[ 1123.065173] binder: send failed reply for transaction 1313, target dead
15:06:42 executing program 5:
r0 = socket$inet_udplite(0x2, 0x2, 0x88)
ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f3188b070")
syz_open_procfs(0x0, &(0x7f0000000940)='syscall\x00')
r1 = syz_open_procfs(0x0, &(0x7f0000000040)='fd\x00')
recvmmsg(0xffffffffffffffff, &(0x7f0000003840)=[{{0x0, 0x0, 0x0}}], 0x1, 0x0, 0x0)
perf_event_open(&(0x7f0000940000)={0x2, 0x70, 0xee6a, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x100, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0xff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x10001, 0x1}, 0x0, 0x400000000000000}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
mlock(&(0x7f00005b8000/0x3000)=nil, 0x3000)
ioctl$SNDRV_TIMER_IOCTL_SELECT(0xffffffffffffffff, 0x40345410, 0x0)
openat$uinput(0xffffffffffffff9c, &(0x7f0000000080)='/dev/uinput\x00', 0x2, 0x0)
mmap(&(0x7f000060b000/0x1000)=nil, 0x1000, 0x5, 0x8000400200000033, r1, 0x0)
unshare(0xfffffffffffffffd)
r2 = getpid()
sched_setscheduler(r2, 0x5, &(0x7f00000000c0))
open$dir(&(0x7f0000000400)='./file0\x00', 0x0, 0x0)
perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f00000004c0), 0x2}, 0x0, 0x0, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r3 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000340)='memory.current\x00', 0x0, 0x0)
ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, 0x0)
socketpair(0x1, 0x20000000000001, 0x0, &(0x7f0000000100)={<r4=>0xffffffffffffffff, <r5=>0xffffffffffffffff})
ioctl$PERF_EVENT_IOC_SET_FILTER(r5, 0x8914, &(0x7f0000000300)='lo\x00\x96o\xd6Q\xb9Y\xa9\xc8J,\x00\xd2\x97\x04\x03\xdc\r')
close(r3)
rt_sigprocmask(0x2, &(0x7f0000000240)={0x6}, &(0x7f00000002c0), 0x8)
ioctl$PERF_EVENT_IOC_SET_FILTER(r5, 0x8923, &(0x7f00000008c0)='lo\x00\x96o8\x0fd\xa1\xe3\xd7]b}\x1f\xa1Y\xad4\x90\x9d`\xd2\x98\x00\x00\x00 \'Y\x17]\x15c\xcaR\xdd\x98OC\x89\x1b\xe7\x84\xe2\x05\x80w\xd2|D\x8dK\x14Bx\xcbuH\xc2\xeec\xbf<>Y\x1a\xfc\x1f9OB\x81\x89\x186\xc5q@n\xb4\xb6s\xb0\x00\x00\xfc\x00\x00\b\x00\x00\xda\xef\xecE\xec\xd5I\xb2\x9b\xfe\x8d\x90?\x00\xe9\xe4~g:\xc1\xb2aj\x96\xbb\xa7\xe2\xc0\xdc\xf9Q\b\xeb\x16\x7fT\x11\xd3\r7\xe6\"f\xcf\x8e\xabd\x0ftp\x82\xae\xd2\x15\x8e+c\xf6\xbf\xe14>\xa6-\xa5c\xde\xd7\xab\xea\x1f\xf8s2\x9cVF\xd5\x18\xfe\x0e\x8f \x01\x00\x00y.\xfc*\x82\xa5\xa1p5\xc8{\xf7\xef\xab\xe8\x99\xebw#\x8at\x1c\x80\xfc\xb0\x95\xa2\xa7\xd7,Y]E8\x83X\xf5F\xdc\x88-\xf5\xb0\xb5^\xdb\x1a\xb6\xaa\x14\xe2\xb9\rh^J-\xd1\xbaUn\x04\'l\x1b\xe0o\xdb\xc8\x91%\x1c\xb5\xbf\xb6\x90\xb4\xc2\x7f]/\xb3\xe7\xc9\'\x94\xcfIo\xdf\x04\x95\xb5\x06\x84\x1fH>\xda\xc5\x04 \x94\x88\xeb\'\xd4;6\x7f\xd9\x99-\x1b|G\x8d\xd4\xb9%\xaaQ\xa0K\x10\x03\x93\xe1\xcc\xe7m\x80\'\xf0\xa5\xed(\r\xa8\x0f&\xb1\xf3\xff0\f\x82%_\x92\x8bD\xb9\xd9\xe7\xf2\xe4\xc1i#\xdc\x87A\xb9\xc7\r\x92\xfa\x11\x11\xb5\x1f\x03\x9d\xdd\x1bj\xdf\xacg\xe3\xa0S\xd3\x8a\xe1n\x97\xea\xf5\xa0\'\v\xe9\xa0\xf1 f\xaan\xcf\xb5i\xb6d\xbc\x92\v\xd58\x16\b\xb3_:\xa4!\ny\xc4&\nWMM\xa8\xc4\v\x9f\x01o\xf4\xab&\xb6\x17\x02P\xc3!N\xf4\b\x1a~\x91V1s\xe9\xbe\x9e\x9b\'\xcde\xb3\xa1\x86\"\xd7\x04\xf1\xc0!\xed\xff\xee$\xc89\x8cB0\xd1dD\xe0IP\x88\xa2\xf2Y\x9af$$\xf1cO\xf7P\xac\xca\x80:!\xb4\x94#\xcb^\x9f\'\x03\xe3\x93\xb9\x82\xbf\xcf\xc4\xe3\xf7\x03Oh\xf2r\xca\x8ff\xbb/\x9f*\xaf\x1a \xa5\xa0?%M\xa5\x86\x98\xf24\'1\xc7\f<\xcc@\xe8\x8a\xac.\xde\xe4\xc7\xf5\x9ck\xa40!\xe9\x14$\xb3\x05m\xb5m\xed\ft\x93\xd8\xa3\x80\'Y\xb9\x05\xbbt|\xbe\xbcz\n\xf3\xf5p\xf8\x9f~\x1b\xd0\v\x1cQ')
getsockopt$inet_IP_IPSEC_POLICY(r1, 0x0, 0x10, &(0x7f00000006c0)={{{@in6=@loopback}}, {{@in6=@initdev}}}, &(0x7f0000000500)=0xe8)
socketpair(0x2, 0x2000000080003, 0x100, &(0x7f0000000480))
syz_genetlink_get_family_id$SEG6(&(0x7f00000003c0)='SEG6\x00')
sendmsg$SEG6_CMD_DUMPHMAC(r4, &(0x7f0000000580)={&(0x7f0000000380)={0x10, 0x0, 0x0, 0x1000000}, 0xc, &(0x7f0000000440)={&(0x7f0000000b00)=ANY=[@ANYBLOB="2300260109447a0000000000000000660000001400001a0065a455e04e2ff4e8050000000000000031a56d0a47018c8e9730cac914471474a7e0d50a000eadd66d2e49a2ed40dcafa1e046ab16904efa3f9600f22ab388644f66c2d5baec4079a81bae1927e49e91a4964656d7b227702926af5be846f3de49fad39048633fd9161123894d9427f854a30cb0532c8f31f663380e40ce7f6cb15ec8baab3b7c6f2a8e95dea1e32c287e32883461c67dbdf529f652697c9d88fec7fbfb43a8f0a4eb33bbd9a1f5e9ed37a19c8ee6fceeba4b6bc3ea1a794de1a0972914fa510baf0eb6d9d21378ea1706d1bb1d6d36c1a1e5a5ac49756dc3eb2a0cd8791bcebe34d9c2ac4a1905338568dbbf038da2860cfc1c8ca178f2d7fc98d9df268e8963064a670b512474798b80f28a9ad2df9ee2b3814bd5deff5fea3a466d01eda4769c8cfe2ebbe8143014bcd2ca8436e9d7938bcf6b8ffab0bde7d8295456c893fe77d662e22c836941"], 0x1}, 0x1, 0x0, 0x0, 0x8000}, 0x804)
r6 = socket$inet_icmp_raw(0x2, 0x3, 0x1)
ioctl$PERF_EVENT_IOC_ENABLE(r6, 0x8912, 0x400200)
futex(&(0x7f000000cffc)=0x200000004, 0x80, 0x4, 0x0, 0x0, 0x0)
futex(&(0x7f000000cffc), 0x85, 0x0, 0x0, &(0x7f0000000080), 0x2fffffc)

15:06:42 executing program 2:
r0 = syz_open_procfs(0x0, &(0x7f0000000080)='maps\x00')
lseek(r0, 0x8020002, 0xffffffffffffffff)
readv(r0, &(0x7f0000000640)=[{&(0x7f0000000000)=""/96, 0x60}], 0x1)
ioctl$LOOP_SET_DIRECT_IO(r0, 0x4c08, 0xffff)

15:06:42 executing program 4:
r0 = socket$inet_udplite(0x2, 0x2, 0x88)
ioctl$FIBMAP(r0, 0x1, &(0x7f0000000040)=0x1f)
ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f3188b070")
r1 = syz_open_procfs(0x0, &(0x7f0000000080)='net/dev_mcast\x00')
lseek(r1, 0x20000, 0x0)

15:06:42 executing program 3:
r0 = socket$inet_udplite(0x2, 0x2, 0x88)
ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f3188b070")
r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0)
r2 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)})

15:06:42 executing program 1:
r0 = socket$inet_udplite(0x2, 0x2, 0x88)
ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f3188b070")
syz_open_procfs(0x0, &(0x7f0000000940)='syscall\x00')
recvmmsg(0xffffffffffffffff, &(0x7f0000003840)=[{{0x0, 0x0, 0x0}}], 0x1, 0x0, 0x0)
r1 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)={0x10b, 0x6, 0x209e1e, 0x3, 0x1}, 0x2c)
bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000b40)={r1, &(0x7f0000000040), 0x0, 0x1}, 0x20)
r2 = creat(&(0x7f0000000640)='./file0\x00', 0x100)
setsockopt$inet6_tcp_TCP_REPAIR_QUEUE(r2, 0x6, 0x14, &(0x7f0000000980), 0x4)
unlink(&(0x7f0000000940)='./file0\x00')
r3 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_GET_NODE_DEBUG_INFO(r3, 0xc018620b, &(0x7f0000000100))
ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)})
ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0x0, 0x0, &(0x7f0000000780)})

15:06:42 executing program 2:
r0 = syz_open_procfs(0x0, &(0x7f00000000c0)='maps\x00')
lseek(r0, 0x200000000000, 0x1)
readv(r0, &(0x7f0000000640)=[{&(0x7f0000000000)=""/96, 0x60}], 0x1)
pipe2(&(0x7f0000000180)={<r1=>0xffffffffffffffff}, 0x80000)
fcntl$dupfd(r0, 0x0, r1)
readlink(&(0x7f0000000080)='./file0\x00', &(0x7f0000000100)=""/123, 0x7b)

15:06:42 executing program 3:
r0 = socket$inet_udplite(0x2, 0x2, 0x88)
ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f3188b070")
r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0)
r2 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)})

15:06:42 executing program 4:
r0 = socket$inet_udplite(0x2, 0x2, 0x88)
ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f3188b070")
r1 = syz_open_procfs(0x0, &(0x7f0000000080)='net/dev_mcast\x00')
ioctl$LOOP_SET_CAPACITY(r1, 0x4c07)
lseek(r1, 0x0, 0x0)

[ 1123.174864] binder: BINDER_SET_CONTEXT_MGR already set
[ 1123.183248] binder: 1916:1918 ioctl 40046207 0 returned -16
[ 1123.266167] binder: 1917:1932 BC_INCREFS_DONE node 1321 has no pending increfs request
[ 1123.285089] binder: BINDER_SET_CONTEXT_MGR already set
[ 1123.291430] binder: 1928:1933 ioctl 40046207 0 returned -16
15:06:42 executing program 0:
r0 = socket$inet_udplite(0x2, 0x2, 0x88)
ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f3188b070")
syz_open_procfs(0x0, &(0x7f0000000940)='syscall\x00')
r1 = syz_open_procfs(0x0, &(0x7f0000000040)='fd\x00')
recvmmsg(0xffffffffffffffff, &(0x7f0000003840)=[{{0x0, 0x0, 0x0}}], 0x1, 0x0, 0x0)
perf_event_open(&(0x7f0000940000)={0x2, 0x70, 0xee6a, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x100, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0xff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x10001, 0x1}, 0x0, 0x400000000000000}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
mlock(&(0x7f00005b8000/0x3000)=nil, 0x3000)
ioctl$SNDRV_TIMER_IOCTL_SELECT(0xffffffffffffffff, 0x40345410, 0x0)
openat$uinput(0xffffffffffffff9c, &(0x7f0000000080)='/dev/uinput\x00', 0x2, 0x0)
mmap(&(0x7f000060b000/0x1000)=nil, 0x1000, 0x5, 0x8000400200000033, r1, 0x0)
perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x2, 0x9, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2000000, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x4000000, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8)
r2 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)={0x10b, 0x6, 0x209e1e, 0x3, 0x1}, 0x2c)
bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000b40)={r2, &(0x7f0000000040), 0x0, 0x1}, 0x20)
r3 = creat(&(0x7f0000000640)='./file0\x00', 0x100)
setsockopt$inet6_tcp_TCP_REPAIR_QUEUE(r3, 0x6, 0x14, &(0x7f0000000980), 0x4)
unlink(&(0x7f0000000940)='./file0\x00')
r4 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r5 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r5, 0x0)
ioctl$BINDER_GET_NODE_DEBUG_INFO(r4, 0xc018620b, &(0x7f0000000100))
ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f00000000c0)=ANY=[@ANYBLOB="bb8f0000"], 0x0, 0x0, 0x0})
ioctl$BINDER_SET_CONTEXT_MGR(r5, 0x40046207, 0x0)
shutdown(0xffffffffffffffff, 0x1)
prctl$PR_SET_NAME(0xf, &(0x7f0000000380)='/group.stat\x00')
ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)})
creat(&(0x7f00000000c0)='./file0\x00', 0x0)

15:06:42 executing program 2:
r0 = syz_open_procfs(0x0, &(0x7f0000000080)='net/rfcomm\x00')
lseek(r0, 0x20000, 0x0)
readv(r0, &(0x7f0000000640)=[{&(0x7f0000000000)=""/96, 0x60}], 0x1)

15:06:42 executing program 4:
r0 = socket$inet_udplite(0x2, 0x2, 0x88)
ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f3188b070")
r1 = syz_open_procfs(0x0, &(0x7f0000000080)='net/dev_mcast\x00')
ioctl$TUNSETSTEERINGEBPF(r1, 0x800454e0, &(0x7f0000000040)=r1)
ioctl$sock_SIOCGPGRP(r0, 0x8904, &(0x7f0000000440)=<r2=>0x0)
getsockopt$sock_cred(r1, 0x1, 0x11, &(0x7f0000000480)={0x0, <r3=>0x0}, &(0x7f00000004c0)=0xc)
lstat(&(0x7f0000000500)='./file0\x00', &(0x7f0000000540)={0x0, 0x0, 0x0, 0x0, 0x0, <r4=>0x0})
sendmsg$netlink(r1, &(0x7f0000000640)={&(0x7f00000000c0)=@proc={0x10, 0x0, 0x25dfdbfc, 0x40000}, 0xc, &(0x7f0000000400)=[{&(0x7f0000000100)={0x2c, 0x1f, 0x400, 0x70bd2d, 0x25dfdbfb, "", [@typed={0x4, 0x13}, @generic="f7c857eb6246", @nested={0x10, 0x1d, [@generic="f86ac241be5c4aea945f"]}]}, 0x2c}, {&(0x7f0000000140)={0x7c, 0x12, 0x400, 0x70bd29, 0x25dfdbfd, "", [@generic='t', @generic="b088333bba64151ae2d1178f1caad174ddc490b6484320f8924d9716720bc676465827c49d0f234f0a774cceeb03e3acf6ce6c0e68e61f264e5c0b940729f305f28f8386f7a0157fb22a34df43a5e0937bff6a2bf3431560be5f385e3af3", @typed={0xc, 0x2d, @u64=0x7}]}, 0x7c}, {&(0x7f00000001c0)={0x1dc, 0x22, 0x210, 0x70bd25, 0x25dfdbfe, "", [@generic="3cece412b67fb66ab40e3d69f7acdd2c054c33c52caa8dd0ac3c2d8636e434cc0020d08f9c0ad3d371121872962de94935d3982ca4bb2118c72cd79c571109dbf3aa3db04415fc6456f821c7a3bd036c6bab827452ebe59d17605ceb52790bbb6acfaa3752c37d05a2bbab7e6c9d309c83a95a66ca033a8de42e1244960050f6bda17b110eacc94e029e7c2539083cd9a0dabad2fbd904806caea54668894a9b52d95916c8b5f6bc902045f1fa29c7b86cc634cb4978fa2fb3cbcfe0c7507474005acf416580d5c9c939335b202a40", @typed={0x14, 0x5, @ipv6=@initdev={0xfe, 0x88, [], 0x1, 0x0}}, @typed={0x8, 0x67, @ipv4=@broadcast}, @generic="814ca6f7a4c05f1a3706ab374cdcddc8550ca7471dfaf7249d35563c7346c1335f6b4b96c2ee18aa359a8752c76597696b4259d3feae0f66352c34fd4250fb4297ce5fb13c2f9de84553480fe7bb3e2f8a59dfda0260d2f0898960ec4d51264da97e7da6682c291dc886b73043fea0176a3c00beaae91b73abfa55fb09ac2eedff9c94275d008dc6262206fbf3f7095d71eaedf13dcbe679329c219dde493d8b4b8dc8a7e120e7a21aa544b27e09a675b64400a69be298171de56d64eb45476d5dfc8b366536dd80c7dbe036d6ba7721ced48715915e113df46b5ac581b53ffa"]}, 0x1dc}, {&(0x7f00000003c0)={0x18, 0x41, 0x110, 0x70bd2c, 0x25dfdbff, "", [@typed={0x8, 0x6c, @ipv4=@empty}]}, 0x18}], 0x4, &(0x7f00000005c0)=[@rights={0x28, 0x1, 0x1, [r1, r0, r1, r0, r1]}, @cred={0x20, 0x1, 0x2, r2, r3, r4}], 0x48, 0x20000000}, 0x20000000)
lseek(r1, 0x20000, 0x0)

15:06:42 executing program 3:
r0 = socket$inet_udplite(0x2, 0x2, 0x88)
ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f3188b070")
r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0)
r2 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)})

15:06:42 executing program 5:
r0 = socket$inet_udplite(0x2, 0x2, 0x88)
ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f3188b070")
r1 = syz_open_procfs(0x0, &(0x7f0000000940)='syscall\x00')
r2 = syz_open_procfs(0x0, &(0x7f0000000040)='fd\x00')
recvmmsg(0xffffffffffffffff, &(0x7f0000003840)=[{{0x0, 0x0, 0x0}}], 0x1, 0x0, 0x0)
perf_event_open(&(0x7f0000940000)={0x2, 0x70, 0xee6a, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x100, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0xff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x10001, 0x1}, 0x0, 0x400000000000000}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
mlock(&(0x7f0000ffe000/0x2000)=nil, 0x2000)
ioctl$SNDRV_TIMER_IOCTL_SELECT(0xffffffffffffffff, 0x40345410, 0x0)
openat$uinput(0xffffffffffffff9c, &(0x7f0000000080)='/dev/uinput\x00', 0x2, 0x0)
mmap(&(0x7f000060b000/0x1000)=nil, 0x1000, 0x5, 0x8000400200000033, r2, 0x0)
unshare(0xfffffffffffffffd)
r3 = getpid()
sched_setscheduler(r3, 0x5, &(0x7f00000000c0))
open$dir(&(0x7f0000000400)='./file0\x00', 0x0, 0x0)
perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f00000004c0), 0x2}, 0x0, 0x0, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r4 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000340)='memory.current\x00', 0x0, 0x0)
ioctl$TUNSETIFF(r1, 0x400454ca, 0x0)
socketpair(0x1, 0x20000000000001, 0x0, &(0x7f0000000100)={<r5=>0xffffffffffffffff, <r6=>0xffffffffffffffff})
ioctl$PERF_EVENT_IOC_SET_FILTER(r6, 0x8914, &(0x7f0000000300)='lo\x00\x96o\xd6Q\xb9Y\xa9\xc8J,\x00\xd2\x97\x04\x03\xdc\r')
close(r4)
rt_sigprocmask(0x2, &(0x7f0000000240)={0x6}, &(0x7f00000002c0), 0x8)
ioctl$PERF_EVENT_IOC_SET_FILTER(r6, 0x8923, &(0x7f00000008c0)='lo\x00\x96o8\x0fd\xa1\xe3\xd7]b}\x1f\xa1Y\xad4\x90\x9d`\xd2\x98\x00\x00\x00 \'Y\x17]\x15c\xcaR\xdd\x98OC\x89\x1b\xe7\x84\xe2\x05\x80w\xd2|D\x8dK\x14Bx\xcbuH\xc2\xeec\xbf<>Y\x1a\xfc\x1f9OB\x81\x89\x186\xc5q@n\xb4\xb6s\xb0\x00\x00\xfc\x00\x00\b\x00\x00\xda\xef\xecE\xec\xd5I\xb2\x9b\xfe\x8d\x90?\x00\xe9\xe4~g:\xc1\xb2aj\x96\xbb\xa7\xe2\xc0\xdc\xf9Q\b\xeb\x16\x7fT\x11\xd3\r7\xe6\"f\xcf\x8e\xabd\x0ftp\x82\xae\xd2\x15\x8e+c\xf6\xbf\xe14>\xa6-\xa5c\xde\xd7\xab\xea\x1f\xf8s2\x9cVF\xd5\x18\xfe\x0e\x8f \x01\x00\x00y.\xfc*\x82\xa5\xa1p5\xc8{\xf7\xef\xab\xe8\x99\xebw#\x8at\x1c\x80\xfc\xb0\x95\xa2\xa7\xd7,Y]E8\x83X\xf5F\xdc\x88-\xf5\xb0\xb5^\xdb\x1a\xb6\xaa\x14\xe2\xb9\rh^J-\xd1\xbaUn\x04\'l\x1b\xe0o\xdb\xc8\x91%\x1c\xb5\xbf\xb6\x90\xb4\xc2\x7f]/\xb3\xe7\xc9\'\x94\xcfIo\xdf\x04\x95\xb5\x06\x84\x1fH>\xda\xc5\x04 \x94\x88\xeb\'\xd4;6\x7f\xd9\x99-\x1b|G\x8d\xd4\xb9%\xaaQ\xa0K\x10\x03\x93\xe1\xcc\xe7m\x80\'\xf0\xa5\xed(\r\xa8\x0f&\xb1\xf3\xff0\f\x82%_\x92\x8bD\xb9\xd9\xe7\xf2\xe4\xc1i#\xdc\x87A\xb9\xc7\r\x92\xfa\x11\x11\xb5\x1f\x03\x9d\xdd\x1bj\xdf\xacg\xe3\xa0S\xd3\x8a\xe1n\x97\xea\xf5\xa0\'\v\xe9\xa0\xf1 f\xaan\xcf\xb5i\xb6d\xbc\x92\v\xd58\x16\b\xb3_:\xa4!\ny\xc4&\nWMM\xa8\xc4\v\x9f\x01o\xf4\xab&\xb6\x17\x02P\xc3!N\xf4\b\x1a~\x91V1s\xe9\xbe\x9e\x9b\'\xcde\xb3\xa1\x86\"\xd7\x04\xf1\xc0!\xed\xff\xee$\xc89\x8cB0\xd1dD\xe0IP\x88\xa2\xf2Y\x9af$$\xf1cO\xf7P\xac\xca\x80:!\xb4\x94#\xcb^\x9f\'\x03\xe3\x93\xb9\x82\xbf\xcf\xc4\xe3\xf7\x03Oh\xf2r\xca\x8ff\xbb/\x9f*\xaf\x1a \xa5\xa0?%M\xa5\x86\x98\xf24\'1\xc7\f<\xcc@\xe8\x8a\xac.\xde\xe4\xc7\xf5\x9ck\xa40!\xe9\x14$\xb3\x05m\xb5m\xed\ft\x93\xd8\xa3\x80\'Y\xb9\x05\xbbt|\xbe\xbcz\n\xf3\xf5p\xf8\x9f~\x1b\xd0\v\x1cQ')
getsockopt$inet_IP_IPSEC_POLICY(r2, 0x0, 0x10, &(0x7f00000006c0)={{{@in6=@loopback}}, {{@in6=@initdev}}}, &(0x7f0000000500)=0xe8)
socketpair(0x2, 0x2000000080003, 0x100, &(0x7f0000000480))
syz_genetlink_get_family_id$SEG6(&(0x7f00000003c0)='SEG6\x00')
sendmsg$SEG6_CMD_DUMPHMAC(r5, &(0x7f0000000580)={&(0x7f0000000380)={0x10, 0x0, 0x0, 0x1000000}, 0xc, &(0x7f0000000440)={&(0x7f00000005c0)=ANY=[@ANYBLOB="23e0250109447a0000000000000000660000001400001a0065a455e04ea56d0a47018c8e973bcac914471474a7e0d50a000eadd66d2e49a2ed40dcafa1e046ab6aacc2097d8f75bd9c8b8a220bdde116904efa3f9600f22ab388644f66c2d5baec4079a81bae1927e49e91a4964656d7b227702926af5be846f3de49fad39048633fd9161123894d9427f854a30cb0530b452800b189714d4ebed64f2c8f31f663380e"], 0x1}, 0x1, 0x0, 0x0, 0x8000}, 0x804)
r7 = creat(&(0x7f0000000280)='./bus\x00', 0x0)
arch_prctl$ARCH_MAP_VDSO_32(0x2002, 0x7e)
ftruncate(r7, 0x2008200)
open(&(0x7f0000000140)='./bus\x00', 0x4000, 0x0)

15:06:42 executing program 1:
r0 = socket$inet_udplite(0x2, 0x2, 0x88)
ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f3188b070")
recvmmsg(0xffffffffffffffff, &(0x7f0000003840)=[{{0x0, 0x0, 0x0}}], 0x1, 0x0, 0x0)
r1 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)={0x10b, 0x6, 0x209e1e, 0x3, 0x1}, 0x2c)
bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000b40)={r1, &(0x7f0000000040), 0x0, 0x1}, 0x20)
r2 = creat(&(0x7f0000000640)='./file0\x00', 0x100)
setsockopt$inet6_tcp_TCP_REPAIR_QUEUE(r2, 0x6, 0x14, &(0x7f0000000980), 0x4)
unlink(&(0x7f0000000940)='./file0\x00')
r3 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_GET_NODE_DEBUG_INFO(r3, 0xc018620b, &(0x7f0000000100))
ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)})
ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0x0, 0x0, &(0x7f0000000780)})

[ 1123.774095] binder: send failed reply for transaction 1317 to 1891:1896
[ 1123.785711] binder: send failed reply for transaction 1320 to 1917:1921
[ 1123.793422] binder: undelivered TRANSACTION_ERROR: 29189
15:06:42 executing program 3:
r0 = socket$inet_udplite(0x2, 0x2, 0x88)
ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f3188b070")
r1 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)})

15:06:42 executing program 2:
r0 = syz_open_procfs(0x0, &(0x7f00000000c0)='maps\x00')
renameat2(r0, &(0x7f0000000200)='./file0\x00', r0, &(0x7f0000000240)='./file0\x00', 0x0)
setxattr$security_smack_entry(&(0x7f0000000080)='./file0\x00', &(0x7f0000000100)='security.SMACK64MMAP\x00', &(0x7f0000000140)='maps\x00', 0x5, 0x3)
lseek(r0, 0x20000, 0x0)
ioctl$TIOCGSID(r0, 0x5429, &(0x7f0000000600))
ioctl$LOOP_GET_STATUS64(r0, 0x4c05, &(0x7f00000003c0))
ftruncate(r0, 0x0)
readv(r0, &(0x7f0000000640)=[{&(0x7f0000000000)=""/96, 0x60}], 0x1)
r1 = openat$selinux_commit_pending_bools(0xffffffffffffff9c, &(0x7f00000001c0)='/selinux/commit_pending_bools\x00', 0x1, 0x0)
r2 = syz_open_dev$evdev(&(0x7f0000000180)='/dev/input/event#\x00', 0x6, 0x2000)
r3 = syz_genetlink_get_family_id$tipc(&(0x7f0000000500)='TIPC\x00')
sendmsg$TIPC_CMD_GET_LINKS(r1, &(0x7f00000005c0)={&(0x7f00000004c0)={0x10, 0x0, 0x0, 0x20400000}, 0xc, &(0x7f0000000580)={&(0x7f0000000540)={0x24, r3, 0x800, 0x70bd27, 0x25dfdbfd, {{}, 0x0, 0x4, 0x0, {0x8, 0x11, 0x7fffffff}}, ["", "", "", "", ""]}, 0x24}, 0x1, 0x0, 0x0, 0x20000000}, 0x840)
dup(r1)
ioctl$EVIOCGABS0(r2, 0x80184540, &(0x7f0000000280)=""/238)
ioctl$EXT4_IOC_ALLOC_DA_BLKS(r2, 0x660c)
creat(&(0x7f0000000380)='./file0\x00', 0x8)

15:06:42 executing program 4:
ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f3188b070")
r0 = openat$pfkey(0xffffffffffffff9c, &(0x7f0000000040)='/proc/self/net/pfkey\x00', 0x20000, 0x0)
ioctl$RNDADDENTROPY(r0, 0x40085203, &(0x7f00000000c0)={0x7ed8, 0x97, "4dbb8c5abd2ff0348a00b26b70e0692cd2bc254db9934d3ee09c7ff06b3f816897c44768060bddaf471d39cb0138373364d2336895482e8f2ad1faf5780d0c6a9f8a5b3423c5d5f88b3554b5e9cab5e5959d5469bc521fd02cb7160a9bab9fd14a32b9b16c521d56eb02028384c4483099e669b7f506106e304344e083f28238e4befe710abeebc4dc402ef93ef493fad5fa231bbe9e22"})
r1 = syz_open_procfs(0x0, &(0x7f0000000080)='net/dev_mcast\x00')
lseek(r1, 0x20000, 0x0)

[ 1123.899744] binder: release 1966:1969 transaction 1325 out, still active
[ 1123.927113] binder: 1960:1963 unknown command 36795
[ 1123.929464] binder: send failed reply for transaction 1325, target dead
[ 1123.940258] binder: send failed reply for transaction 1328 to 1962:1965
15:06:42 executing program 3:
r0 = socket$inet_udplite(0x2, 0x2, 0x88)
ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f3188b070")
r1 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x10, r2, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)})

15:06:42 executing program 1:
r0 = socket$inet_udplite(0x2, 0x2, 0x88)
ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f3188b070")
recvmmsg(0xffffffffffffffff, &(0x7f0000003840)=[{{0x0, 0x0, 0x0}}], 0x1, 0x0, 0x0)
r1 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)={0x10b, 0x6, 0x209e1e, 0x3, 0x1}, 0x2c)
bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000b40)={r1, &(0x7f0000000040), 0x0, 0x1}, 0x20)
r2 = creat(&(0x7f0000000640)='./file0\x00', 0x100)
setsockopt$inet6_tcp_TCP_REPAIR_QUEUE(r2, 0x6, 0x14, &(0x7f0000000980), 0x4)
unlink(&(0x7f0000000940)='./file0\x00')
r3 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_GET_NODE_DEBUG_INFO(r3, 0xc018620b, &(0x7f0000000100))
ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)})
ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0x0, 0x0, &(0x7f0000000780)})

[ 1123.940943] binder: 1960:1963 ioctl c0306201 20000140 returned -22
[ 1123.955971] binder: 1962:1965 BC_INCREFS_DONE u0000000000000000 no match
15:06:42 executing program 4:
r0 = socket$inet_udplite(0x2, 0x2, 0x88)
ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188b070")
r1 = syz_open_procfs(0x0, &(0x7f0000000080)='net/dev_mcast\x00')
ioctl$SNDRV_TIMER_IOCTL_TREAD(r1, 0x40045402, &(0x7f0000000200))
lseek(r1, 0x20000, 0x0)
r2 = add_key(&(0x7f0000000000)='cifs.idmap\x00', &(0x7f00000000c0)={'syz', 0x3}, &(0x7f0000000100)="bd0dd3d7005b4da6e78be6af3b977d72be348d09d412c0ab5831cffe919be557190fe6b1b9a4aeaa915401b32051ee84fa", 0x31, 0xfffffffffffffff9)
add_key(&(0x7f0000000140)='encrypted\x00', &(0x7f0000000180)={'syz', 0x2}, &(0x7f00000001c0)="84410cadd7733e73ba8d2e320496b0ed5962d478b82715d2bf57eedfb6a19d8b", 0x20, r2)
keyctl$assume_authority(0x10, r2)

[ 1124.036329] binder: BINDER_SET_CONTEXT_MGR already set
[ 1124.047707] binder: 1982:1985 ioctl 40046207 0 returned -16
[ 1124.059925] binder: release 1982:1985 transaction 1335 out, still active
[ 1124.122416] binder: 1984:1991 BC_INCREFS_DONE node 1339 has no pending increfs request
15:06:43 executing program 0:
r0 = socket$inet_udplite(0x2, 0x2, 0x88)
ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f3188b070")
syz_open_procfs(0x0, &(0x7f0000000940)='syscall\x00')
r1 = syz_open_procfs(0x0, &(0x7f0000000040)='fd\x00')
recvmmsg(0xffffffffffffffff, &(0x7f0000003840)=[{{0x0, 0x0, 0x0}}], 0x1, 0x0, 0x0)
perf_event_open(&(0x7f0000940000)={0x2, 0x70, 0xee6a, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x100, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0xff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x10001, 0x1}, 0x0, 0x400000000000000}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
mlock(&(0x7f00005b8000/0x3000)=nil, 0x3000)
ioctl$SNDRV_TIMER_IOCTL_SELECT(0xffffffffffffffff, 0x40345410, 0x0)
openat$uinput(0xffffffffffffff9c, &(0x7f0000000080)='/dev/uinput\x00', 0x2, 0x0)
mmap(&(0x7f000060b000/0x1000)=nil, 0x1000, 0x5, 0x8000400200000033, r1, 0x0)
perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x2, 0x9, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2000000, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x4000000, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8)
r2 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)={0x10b, 0x6, 0x209e1e, 0x3, 0x1}, 0x2c)
bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000b40)={r2, &(0x7f0000000040), 0x0, 0x1}, 0x20)
r3 = creat(&(0x7f0000000640)='./file0\x00', 0x100)
setsockopt$inet6_tcp_TCP_REPAIR_QUEUE(r3, 0x6, 0x14, &(0x7f0000000980), 0x4)
unlink(&(0x7f0000000940)='./file0\x00')
r4 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r5 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r5, 0x0)
ioctl$BINDER_GET_NODE_DEBUG_INFO(r4, 0xc018620b, &(0x7f0000000100))
ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f00000000c0)=ANY=[@ANYBLOB="bb8f0000"], 0x0, 0x0, 0x0})
ioctl$BINDER_SET_CONTEXT_MGR(r5, 0x40046207, 0x0)
shutdown(0xffffffffffffffff, 0x1)
prctl$PR_SET_NAME(0xf, &(0x7f0000000380)='/group.stat\x00')
ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)})
creat(&(0x7f00000000c0)='./file0\x00', 0x0)

15:06:43 executing program 2:
r0 = syz_open_procfs(0x0, &(0x7f00000000c0)='maps\x00')
lseek(r0, 0x20000, 0x0)
r1 = fcntl$dupfd(r0, 0x0, r0)
ioctl$sock_FIOGETOWN(r1, 0x8903, &(0x7f0000000080)=<r2=>0x0)
r3 = gettid()
rt_tgsigqueueinfo(r2, r3, 0x0, &(0x7f0000000100)={0x27, 0x0, 0x5})
readv(r0, &(0x7f0000000640)=[{&(0x7f0000000000)=""/96, 0x60}], 0x1)
ptrace$setsig(0x4203, r2, 0x8, &(0x7f0000000200)={0x17, 0x65e, 0x9})
write$9p(r0, &(0x7f0000000180)="0fb65e0f1482fd8328731bd3e7c4581cf299d50eeea472370642acaf58897562604d48ba4f88acf03a1fb9c30421f3eb276befcc7312fb2fae40857382d34128d60bb09f95", 0x45)

15:06:43 executing program 4:
r0 = socket$inet_udplite(0x2, 0x2, 0x88)
ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f3188b070")
r1 = syz_open_procfs(0x0, &(0x7f00000000c0)='net/anycast6\x00')
lseek(r1, 0x20000, 0x0)

15:06:43 executing program 3:
r0 = socket$inet_udplite(0x2, 0x2, 0x88)
ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f3188b070")
r1 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x10, r2, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)})

15:06:43 executing program 5:
r0 = socket$inet_udplite(0x2, 0x2, 0x88)
ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f3188b070")
syz_open_procfs(0x0, &(0x7f0000000940)='syscall\x00')
r1 = syz_open_procfs(0x0, &(0x7f0000000040)='fd\x00')
recvmmsg(0xffffffffffffffff, &(0x7f0000003840)=[{{0x0, 0x0, 0x0}}], 0x1, 0x0, 0x0)
perf_event_open(&(0x7f0000940000)={0x2, 0x70, 0xee6a, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x100, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0xff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x10001, 0x1}, 0x0, 0x400000000000000}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
mlock(&(0x7f00005b8000/0x3000)=nil, 0x3000)
ioctl$SNDRV_TIMER_IOCTL_SELECT(0xffffffffffffffff, 0x40345410, 0x0)
openat$uinput(0xffffffffffffff9c, &(0x7f0000000080)='/dev/uinput\x00', 0x2, 0x0)
mmap(&(0x7f000060b000/0x1000)=nil, 0x1000, 0x5, 0x8000400200000033, r1, 0x0)
unshare(0xfffffffffffffffd)
r2 = getpid()
sched_setscheduler(r2, 0x5, &(0x7f00000000c0))
open$dir(&(0x7f0000000400)='./file0\x00', 0x0, 0x0)
perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f00000004c0), 0x2}, 0x0, 0x0, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r3 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000340)='memory.current\x00', 0x0, 0x0)
ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, 0x0)
socketpair(0xb, 0x20000000000001, 0x0, &(0x7f0000000800)={<r4=>0xffffffffffffffff, <r5=>0xffffffffffffffff})
ioctl$PERF_EVENT_IOC_SET_FILTER(r5, 0x8914, &(0x7f0000000300)='lo\x00\x96o\xd6Q\xb9Y\xa9\xc8J,\x00\xd2\x97\x04\x03\xdc\r')
close(r3)
rt_sigprocmask(0x2, &(0x7f0000000240)={0x6}, &(0x7f00000002c0), 0x8)
ioctl$PERF_EVENT_IOC_SET_FILTER(r5, 0x8923, &(0x7f00000008c0)='lo\x00\x96o8\x0fd\xa1\xe3\xd7]b}\x1f\xa1Y\xad4\x90\x9d`\xd2\x98\x00\x00\x00 \'Y\x17]\x15c\xcaR\xdd\x98OC\x89\x1b\xe7\x84\xe2\x05\x80w\xd2|D\x8dK\x14Bx\xcbuH\xc2\xeec\xbf<>Y\x1a\xfc\x1f9OB\x81\x89\x186\xc5q@n\xb4\xb6s\xb0\x00\x00\xfc\x00\x00\b\x00\x00\xda\xef\xecE\xec\xd5I\xb2\x9b\xfe\x8d\x90?\x00\xe9\xe4~g:\xc1\xb2aj\x96\xbb\xa7\xe2\xc0\xdc\xf9Q\b\xeb\x16\x7fT\x11\xd3\r7\xe6\"f\xcf\x8e\xabd\x0ftp\x82\xae\xd2\x15\x8e+c\xf6\xbf\xe14>\xa6-\xa5c\xde\xd7\xab\xea\x1f\xf8s2\x9cVF\xd5\x18\xfe\x0e\x8f \x01\x00\x00y.\xfc*\x82\xa5\xa1p5\xc8{\xf7\xef\xab\xe8\x99\xebw#\x8at\x1c\x80\xfc\xb0\x95\xa2\xa7\xd7,Y]E8\x83X\xf5F\xdc\x88-\xf5\xb0\xb5^\xdb\x1a\xb6\xaa\x14\xe2\xb9\rh^J-\xd1\xbaUn\x04\'l\x1b\xe0o\xdb\xc8\x91%\x1c\xb5\xbf\xb6\x90\xb4\xc2\x7f]/\xb3\xe7\xc9\'\x94\xcfIo\xdf\x04\x95\xb5\x06\x84\x1fH>\xda\xc5\x04 \x94\x88\xeb\'\xd4;6\x7f\xd9\x99-\x1b|G\x8d\xd4\xb9%\xaaQ\xa0K\x10\x03\x93\xe1\xcc\xe7m\x80\'\xf0\xa5\xed(\r\xa8\x0f&\xb1\xf3\xff0\f\x82%_\x92\x8bD\xb9\xd9\xe7\xf2\xe4\xc1i#\xdc\x87A\xb9\xc7\r\x92\xfa\x11\x11\xb5\x1f\x03\x9d\xdd\x1bj\xdf\xacg\xe3\xa0S\xd3\x8a\xe1n\x97\xea\xf5\xa0\'\v\xe9\xa0\xf1 f\xaan\xcf\xb5i\xb6d\xbc\x92\v\xd58\x16\b\xb3_:\xa4!\ny\xc4&\nWMM\xa8\xc4\v\x9f\x01o\xf4\xab&\xb6\x17\x02P\xc3!N\xf4\b\x1a~\x91V1s\xe9\xbe\x9e\x9b\'\xcde\xb3\xa1\x86\"\xd7\x04\xf1\xc0!\xed\xff\xee$\xc89\x8cB0\xd1dD\xe0IP\x88\xa2\xf2Y\x9af$$\xf1cO\xf7P\xac\xca\x80:!\xb4\x94#\xcb^\x9f\'\x03\xe3\x93\xb9\x82\xbf\xcf\xc4\xe3\xf7\x03Oh\xf2r\xca\x8ff\xbb/\x9f*\xaf\x1a \xa5\xa0?%M\xa5\x86\x98\xf24\'1\xc7\f<\xcc@\xe8\x8a\xac.\xde\xe4\xc7\xf5\x9ck\xa40!\xe9\x14$\xb3\x05m\xb5m\xed\ft\x93\xd8\xa3\x80\'Y\xb9\x05\xbbt|\xbe\xbcz\n\xf3\xf5p\xf8\x9f~\x1b\xd0\v\x1cQ')
getsockopt$inet_IP_IPSEC_POLICY(r1, 0x0, 0x10, &(0x7f00000006c0)={{{@in6=@loopback}}, {{@in6=@initdev}}}, &(0x7f0000000500)=0xe8)
socketpair(0x2, 0x2000000080003, 0x100, &(0x7f0000000480))
syz_genetlink_get_family_id$SEG6(&(0x7f00000003c0)='SEG6\x00')
sendmsg$SEG6_CMD_DUMPHMAC(r4, &(0x7f0000000580)={&(0x7f0000000380)={0x10, 0x0, 0x0, 0x1000000}, 0xc, &(0x7f0000000440)={&(0x7f00000005c0)=ANY=[@ANYBLOB="2300260109447a0000000000000000660000001400001a0065a455e04ea56d0a47018c8e973bcac914471474a7e0d50a000eadd66d2e49a2ed40dcafa1e046ab6aacc2097d8f75bd9c8b8a220bdde116904efa3f9600f22ab388644f66c2d5baec4079a81bae1927e49e91a4964656d7b227702926af5be846f3de49fad39048633fd9161123894d9427f854a30cb0532c8f31f663380e40ce7f6cb15ec8baab3b7c6f"], 0x1}, 0x1, 0x0, 0x0, 0x8000}, 0x804)
r6 = creat(&(0x7f0000000280)='./bus\x00', 0x0)
arch_prctl$ARCH_MAP_VDSO_32(0x2002, 0x7e)
ftruncate(r6, 0x2008200)
open(&(0x7f0000000140)='./bus\x00', 0x4000, 0x0)

[ 1124.653056] binder: release 1960:1963 transaction 1332 out, still active
[ 1124.665857] binder: unexpected work type, 4, not freed
[ 1124.671315] binder: undelivered TRANSACTION_COMPLETE
[ 1124.680973] binder: send failed reply for transaction 1332, target dead
[ 1124.688787] binder: send failed reply for transaction 1335, target dead
15:06:43 executing program 1:
socket$inet_udplite(0x2, 0x2, 0x88)
recvmmsg(0xffffffffffffffff, &(0x7f0000003840)=[{{0x0, 0x0, 0x0}}], 0x1, 0x0, 0x0)
r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)={0x10b, 0x6, 0x209e1e, 0x3, 0x1}, 0x2c)
bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000b40)={r0, &(0x7f0000000040), 0x0, 0x1}, 0x20)
r1 = creat(&(0x7f0000000640)='./file0\x00', 0x100)
setsockopt$inet6_tcp_TCP_REPAIR_QUEUE(r1, 0x6, 0x14, &(0x7f0000000980), 0x4)
unlink(&(0x7f0000000940)='./file0\x00')
r2 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_GET_NODE_DEBUG_INFO(r2, 0xc018620b, &(0x7f0000000100))
ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)})
ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0x0, 0x0, &(0x7f0000000780)})

15:06:43 executing program 2:
r0 = syz_open_procfs(0x0, &(0x7f00000000c0)='maps\x00')
lseek(r0, 0x0, 0xfffffffffffffffc)
readv(r0, &(0x7f0000000640)=[{&(0x7f0000000000)=""/96, 0x60}], 0x1)

15:06:43 executing program 3:
r0 = socket$inet_udplite(0x2, 0x2, 0x88)
ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f3188b070")
r1 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x10, r2, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)})

[ 1124.698052] binder: send failed reply for transaction 1338 to 1984:1988
[ 1124.717268] binder_alloc: 2005: binder_alloc_buf, no vma
[ 1124.727948] binder: 2005:2008 transaction failed 29189/-3, size 24-8 line 3254
15:06:43 executing program 4:
r0 = socket$inet_udplite(0x2, 0x2, 0x88)
ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f3188b070")
r1 = syz_open_procfs(0x0, &(0x7f0000000080)='net/dev_mcast\x00')
dup3(r0, r1, 0x80000)
lseek(r1, 0x20000, 0x0)

15:06:43 executing program 2:
r0 = syz_open_procfs(0x0, &(0x7f00000000c0)='maps\x00')
lseek(r0, 0x20000, 0x0)
getpeername$packet(r0, &(0x7f0000000100)={0x11, 0x0, <r1=>0x0, 0x1, 0x0, 0x6, @local}, &(0x7f0000000140)=0x14)
ioctl$ifreq_SIOCGIFINDEX_team(r0, 0x8933, &(0x7f0000000080)={'team0\x00', r1})
readv(r0, &(0x7f0000000640)=[{&(0x7f0000000000)=""/96, 0x60}], 0x1)

[ 1124.805129] binder: 2010:2014 unknown command 36795
[ 1124.808661] binder: 2017:2019 transaction failed 29189/-22, size 24-8 line 3117
[ 1124.814135] binder: 2010:2014 ioctl c0306201 20000140 returned -22
[ 1124.820922] binder: 2017:2019 BC_INCREFS_DONE u0000000000000000 no match
15:06:43 executing program 1:
socket$inet_udplite(0x2, 0x2, 0x88)
recvmmsg(0xffffffffffffffff, &(0x7f0000003840)=[{{0x0, 0x0, 0x0}}], 0x1, 0x0, 0x0)
r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)={0x10b, 0x6, 0x209e1e, 0x3, 0x1}, 0x2c)
bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000b40)={r0, &(0x7f0000000040), 0x0, 0x1}, 0x20)
r1 = creat(&(0x7f0000000640)='./file0\x00', 0x100)
setsockopt$inet6_tcp_TCP_REPAIR_QUEUE(r1, 0x6, 0x14, &(0x7f0000000980), 0x4)
unlink(&(0x7f0000000940)='./file0\x00')
r2 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_GET_NODE_DEBUG_INFO(r2, 0xc018620b, &(0x7f0000000100))
ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)})
ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0x0, 0x0, &(0x7f0000000780)})

15:06:43 executing program 3:
r0 = socket$inet_udplite(0x2, 0x2, 0x88)
ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f3188b070")
r1 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)})

[ 1124.855500] binder: BINDER_SET_CONTEXT_MGR already set
[ 1124.869284] binder: 2022:2024 ioctl 40046207 0 returned -16
[ 1124.877990] binder: release 2022:2024 transaction 1348 out, still active
[ 1124.969327] binder: BINDER_SET_CONTEXT_MGR already set
[ 1124.976620] binder: 2035:2037 ioctl 40046207 0 returned -16
[ 1124.987317] binder: release 2035:2037 transaction 1354 out, still active
[ 1125.031105] binder: 2031:2042 BC_INCREFS_DONE node 1352 has no pending increfs request
15:06:44 executing program 0:
r0 = socket$inet_udplite(0x2, 0x2, 0x88)
ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f3188b070")
syz_open_procfs(0x0, &(0x7f0000000940)='syscall\x00')
r1 = syz_open_procfs(0x0, &(0x7f0000000040)='fd\x00')
recvmmsg(0xffffffffffffffff, &(0x7f0000003840)=[{{0x0, 0x0, 0x0}}], 0x1, 0x0, 0x0)
perf_event_open(&(0x7f0000940000)={0x2, 0x70, 0xee6a, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x100, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0xff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x10001, 0x1}, 0x0, 0x400000000000000}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
mlock(&(0x7f00005b8000/0x3000)=nil, 0x3000)
ioctl$SNDRV_TIMER_IOCTL_SELECT(0xffffffffffffffff, 0x40345410, 0x0)
openat$uinput(0xffffffffffffff9c, &(0x7f0000000080)='/dev/uinput\x00', 0x2, 0x0)
mmap(&(0x7f000060b000/0x1000)=nil, 0x1000, 0x5, 0x8000400200000033, r1, 0x0)
perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x2, 0x9, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2000000, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x4000000, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8)
r2 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)={0x10b, 0x6, 0x209e1e, 0x3, 0x1}, 0x2c)
bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000b40)={r2, &(0x7f0000000040), 0x0, 0x1}, 0x20)
r3 = creat(&(0x7f0000000640)='./file0\x00', 0x100)
setsockopt$inet6_tcp_TCP_REPAIR_QUEUE(r3, 0x6, 0x14, &(0x7f0000000980), 0x4)
unlink(&(0x7f0000000940)='./file0\x00')
r4 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r5 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r5, 0x0)
ioctl$BINDER_GET_NODE_DEBUG_INFO(r4, 0xc018620b, &(0x7f0000000100))
ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f00000000c0)=ANY=[@ANYBLOB="bb8f0000"], 0x0, 0x0, 0x0})
ioctl$BINDER_SET_CONTEXT_MGR(r5, 0x40046207, 0x0)
shutdown(0xffffffffffffffff, 0x1)
ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)})
ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0x0, 0x0, &(0x7f0000000780)})
creat(&(0x7f00000000c0)='./file0\x00', 0x0)

15:06:44 executing program 2:
r0 = syz_open_procfs(0x0, &(0x7f00000000c0)='maps\x00')
ioctl$LOOP_GET_STATUS64(r0, 0x4c05, &(0x7f0000000100))
lseek(r0, 0x20000, 0x0)
readv(r0, &(0x7f0000000640)=[{&(0x7f0000000000)=""/96, 0x60}], 0x1)

15:06:44 executing program 4:
r0 = socket$inet_udplite(0x2, 0x2, 0x88)
ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f3188b070")
r1 = getpgrp(0xffffffffffffffff)
r2 = syz_open_procfs(r1, &(0x7f0000000100)='net/dev_mcast\x00')
open$dir(&(0x7f0000000080)='./file0\x00', 0x2, 0x0)
lseek(r2, 0xfffffffffffffffe, 0x40000000006)
getsockopt$IPT_SO_GET_INFO(r2, 0x0, 0x40, &(0x7f0000000140)={'mangle\x00'}, &(0x7f00000001c0)=0x54)
getsockopt$inet_udp_int(r2, 0x11, 0x6f, &(0x7f0000000040), &(0x7f00000000c0)=0x4)

15:06:44 executing program 3:
r0 = socket$inet_udplite(0x2, 0x2, 0x88)
ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f3188b070")
r1 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)})

15:06:44 executing program 5:
r0 = socket$inet_udplite(0x2, 0x2, 0x88)
ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f3188b070")
syz_open_procfs(0x0, &(0x7f0000000940)='syscall\x00')
r1 = syz_open_procfs(0x0, &(0x7f0000000040)='fd\x00')
recvmmsg(0xffffffffffffffff, &(0x7f0000003840)=[{{0x0, 0x0, 0x0}}], 0x1, 0x0, 0x0)
perf_event_open(&(0x7f0000940000)={0x2, 0x70, 0xee6a, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x100, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0xff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x10001, 0x1}, 0x0, 0x400000000000000}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
mlock(&(0x7f00005b8000/0x3000)=nil, 0x3000)
ioctl$SNDRV_TIMER_IOCTL_SELECT(0xffffffffffffffff, 0x40345410, 0x0)
openat$uinput(0xffffffffffffff9c, &(0x7f0000000080)='/dev/uinput\x00', 0x2, 0x0)
mmap(&(0x7f000060b000/0x1000)=nil, 0x1000, 0x5, 0x8000400200000033, r1, 0x0)
unshare(0xfffffffffffffffd)
r2 = getpid()
sched_setscheduler(r2, 0x5, &(0x7f00000000c0))
open$dir(&(0x7f0000000400)='./file0\x00', 0x0, 0x0)
perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f00000004c0), 0x2}, 0x0, 0x0, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r3 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000340)='memory.current\x00', 0x0, 0x0)
ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, 0x0)
socketpair(0x1, 0x20000000000001, 0x0, &(0x7f0000000100)={<r4=>0xffffffffffffffff, <r5=>0xffffffffffffffff})
ioctl$PERF_EVENT_IOC_SET_FILTER(r5, 0x8914, &(0x7f0000000300)='lo\x00\x96o\xd6Q\xb9Y\xa9\xc8J,\x00\xd2\x97\x04\x03\xdc\r')
close(r3)
rt_sigprocmask(0x2, &(0x7f0000000240)={0x6}, &(0x7f00000002c0), 0x8)
ioctl$PERF_EVENT_IOC_SET_FILTER(r5, 0x8923, &(0x7f00000008c0)='lo\x00\x96o8\x0fd\xa1\xe3\xd7]b}\x1f\xa1Y\xad4\x90\x9d`\xd2\x98\x00\x00\x00 \'Y\x17]\x15c\xcaR\xdd\x98OC\x89\x1b\xe7\x84\xe2\x05\x80w\xd2|D\x8dK\x14Bx\xcbuH\xc2\xeec\xbf<>Y\x1a\xfc\x1f9OB\x81\x89\x186\xc5q@n\xb4\xb6s\xb0\x00\x00\xfc\x00\x00\b\x00\x00\xda\xef\xecE\xec\xd5I\xb2\x9b\xfe\x8d\x90?\x00\xe9\xe4~g:\xc1\xb2aj\x96\xbb\xa7\xe2\xc0\xdc\xf9Q\b\xeb\x16\x7fT\x11\xd3\r7\xe6\"f\xcf\x8e\xabd\x0ftp\x82\xae\xd2\x15\x8e+c\xf6\xbf\xe14>\xa6-\xa5c\xde\xd7\xab\xea\x1f\xf8s2\x9cVF\xd5\x18\xfe\x0e\x8f \x01\x00\x00y.\xfc*\x82\xa5\xa1p5\xc8{\xf7\xef\xab\xe8\x99\xebw#\x8at\x1c\x80\xfc\xb0\x95\xa2\xa7\xd7,Y]E8\x83X\xf5F\xdc\x88-\xf5\xb0\xb5^\xdb\x1a\xb6\xaa\x14\xe2\xb9\rh^J-\xd1\xbaUn\x04\'l\x1b\xe0o\xdb\xc8\x91%\x1c\xb5\xbf\xb6\x90\xb4\xc2\x7f]/\xb3\xe7\xc9\'\x94\xcfIo\xdf\x04\x95\xb5\x06\x84\x1fH>\xda\xc5\x04 \x94\x88\xeb\'\xd4;6\x7f\xd9\x99-\x1b|G\x8d\xd4\xb9%\xaaQ\xa0K\x10\x03\x93\xe1\xcc\xe7m\x80\'\xf0\xa5\xed(\r\xa8\x0f&\xb1\xf3\xff0\f\x82%_\x92\x8bD\xb9\xd9\xe7\xf2\xe4\xc1i#\xdc\x87A\xb9\xc7\r\x92\xfa\x11\x11\xb5\x1f\x03\x9d\xdd\x1bj\xdf\xacg\xe3\xa0S\xd3\x8a\xe1n\x97\xea\xf5\xa0\'\v\xe9\xa0\xf1 f\xaan\xcf\xb5i\xb6d\xbc\x92\v\xd58\x16\b\xb3_:\xa4!\ny\xc4&\nWMM\xa8\xc4\v\x9f\x01o\xf4\xab&\xb6\x17\x02P\xc3!N\xf4\b\x1a~\x91V1s\xe9\xbe\x9e\x9b\'\xcde\xb3\xa1\x86\"\xd7\x04\xf1\xc0!\xed\xff\xee$\xc89\x8cB0\xd1dD\xe0IP\x88\xa2\xf2Y\x9af$$\xf1cO\xf7P\xac\xca\x80:!\xb4\x94#\xcb^\x9f\'\x03\xe3\x93\xb9\x82\xbf\xcf\xc4\xe3\xf7\x03Oh\xf2r\xca\x8ff\xbb/\x9f*\xaf\x1a \xa5\xa0?%M\xa5\x86\x98\xf24\'1\xc7\f<\xcc@\xe8\x8a\xac.\xde\xe4\xc7\xf5\x9ck\xa40!\xe9\x14$\xb3\x05m\xb5m\xed\ft\x93\xd8\xa3\x80\'Y\xb9\x05\xbbt|\xbe\xbcz\n\xf3\xf5p\xf8\x9f~\x1b\xd0\v\x1cQ')
getsockopt$inet_IP_IPSEC_POLICY(r1, 0x0, 0x10, &(0x7f00000006c0)={{{@in6=@loopback}}, {{@in6=@initdev}}}, &(0x7f0000000500)=0xe8)
socketpair(0x2, 0x2000000080003, 0x100, &(0x7f0000000480))
syz_genetlink_get_family_id$SEG6(&(0x7f00000003c0)='SEG6\x00')
sendmsg$SEG6_CMD_DUMPHMAC(r4, &(0x7f0000000580)={&(0x7f0000000380)={0x10, 0x0, 0x0, 0x1000000}, 0xc, &(0x7f0000000440)={&(0x7f00000005c0)=ANY=[@ANYBLOB="2300260109447a0000000000000000660000001400001a0065a455e04ea56d0a47018c8e973bcac914471474a7e0d50a000eadd66d2e49a2ed40dcafa1e046ab6aacc2097d8f75bd9c8b8a220bdde116904efa3f9600f22ab388644f66c2d5baec4079a81bae1927e49e91a4964656d7b227702926af5be846f3de49fad39048633fd9161123894d9427f854a30cb0532c8f31f663380e40ce7f6cb15ec8baab3b7c6f"], 0x1}, 0x1, 0x0, 0x0, 0x8000}, 0x804)
r6 = creat(&(0x7f0000000280)='./bus\x00', 0x0)
arch_prctl$ARCH_MAP_VDSO_32(0x2002, 0x7e)
ftruncate(r6, 0x2008200)
open(&(0x7f0000000140)='./bus\x00', 0x4000, 0x0)

[ 1125.544591] binder: release 2010:2014 transaction 1345 out, still active
[ 1125.553319] binder: send failed reply for transaction 1345, target dead
[ 1125.560717] binder: send failed reply for transaction 1348, target dead
[ 1125.575659] binder: send failed reply for transaction 1351 to 2031:2036
[ 1125.584301] binder: send failed reply for transaction 1354, target dead
15:06:44 executing program 1:
socket$inet_udplite(0x2, 0x2, 0x88)
recvmmsg(0xffffffffffffffff, &(0x7f0000003840)=[{{0x0, 0x0, 0x0}}], 0x1, 0x0, 0x0)
r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)={0x10b, 0x6, 0x209e1e, 0x3, 0x1}, 0x2c)
bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000b40)={r0, &(0x7f0000000040), 0x0, 0x1}, 0x20)
r1 = creat(&(0x7f0000000640)='./file0\x00', 0x100)
setsockopt$inet6_tcp_TCP_REPAIR_QUEUE(r1, 0x6, 0x14, &(0x7f0000000980), 0x4)
unlink(&(0x7f0000000940)='./file0\x00')
r2 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_GET_NODE_DEBUG_INFO(r2, 0xc018620b, &(0x7f0000000100))
ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)})
ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0x0, 0x0, &(0x7f0000000780)})

15:06:44 executing program 2:
r0 = syz_open_procfs(0x0, &(0x7f00000000c0)='maps\x00')
lseek(r0, 0x20000, 0x0)
getsockopt$inet_mreqn(r0, 0x0, 0x6f54369aa82b9ff4, &(0x7f0000000080)={@empty, @remote, <r1=>0x0}, &(0x7f0000000100)=0xc)
openat$null(0xffffffffffffff9c, &(0x7f0000000180)='/dev/null\x00', 0x84000, 0x0)
setsockopt$packet_add_memb(r0, 0x107, 0x1, &(0x7f0000000140)={r1, 0x1, 0x6, @broadcast}, 0x10)
readv(r0, &(0x7f0000000640)=[{&(0x7f0000000000)=""/96, 0x60}], 0x1)
fcntl$setpipe(r0, 0x407, 0x401)

15:06:44 executing program 4:
r0 = socket$inet_udplite(0x2, 0x2, 0x88)
ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f3188b070")
r1 = syz_open_procfs(0x0, &(0x7f0000000080)='net/dev_mcast\x00')
lseek(r1, 0x20000, 0x0)
socket$inet_icmp_raw(0x2, 0x3, 0x1)
pipe2(&(0x7f0000000040), 0x80000)

15:06:44 executing program 3:
r0 = socket$inet_udplite(0x2, 0x2, 0x88)
ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f3188b070")
r1 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)})

[ 1125.597640] binder_alloc: 2045: binder_alloc_buf, no vma
[ 1125.604505] binder: 2045:2049 transaction failed 29189/-3, size 24-8 line 3254
[ 1125.708965] binder: 2058:2062 transaction failed 29189/-22, size 24-8 line 3117
[ 1125.722540] binder_alloc: 2064: binder_alloc_buf, no vma
[ 1125.736232] binder: 2058:2062 BC_INCREFS_DONE u0000000000000000 no match
[ 1125.739616] binder: 2055:2057 unknown command 36795
[ 1125.750560] binder: 2064:2070 transaction failed 29189/-3, size 24-8 line 3254
15:06:44 executing program 2:
ioctl$sock_SIOCGPGRP(0xffffffffffffffff, 0x8904, &(0x7f0000000100))
fcntl$getownex(0xffffffffffffff9c, 0x10, &(0x7f00000001c0))
ioctl$TIOCGSID(0xffffffffffffffff, 0x5429, &(0x7f0000000200)=<r0=>0x0)
r1 = syz_open_procfs(r0, &(0x7f0000000180)='\xd4\xab\x00\x00\x00\x00')
readv(r1, &(0x7f0000000640)=[{&(0x7f0000000000)=""/96, 0x60}], 0x1)

15:06:44 executing program 1:
ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f3188b070")
recvmmsg(0xffffffffffffffff, &(0x7f0000003840)=[{{0x0, 0x0, 0x0}}], 0x1, 0x0, 0x0)
r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)={0x10b, 0x6, 0x209e1e, 0x3, 0x1}, 0x2c)
bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000b40)={r0, &(0x7f0000000040), 0x0, 0x1}, 0x20)
r1 = creat(&(0x7f0000000640)='./file0\x00', 0x100)
setsockopt$inet6_tcp_TCP_REPAIR_QUEUE(r1, 0x6, 0x14, &(0x7f0000000980), 0x4)
unlink(&(0x7f0000000940)='./file0\x00')
r2 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_GET_NODE_DEBUG_INFO(r2, 0xc018620b, &(0x7f0000000100))
ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)})
ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0x0, 0x0, &(0x7f0000000780)})

15:06:44 executing program 3:
r0 = socket$inet_udplite(0x2, 0x2, 0x88)
ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f3188b070")
r1 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)})

[ 1125.754122] binder: 2055:2057 ioctl c0306201 20000140 returned -22
15:06:44 executing program 4:
r0 = socket$inet_udplite(0x2, 0x2, 0x88)
r1 = fcntl$dupfd(r0, 0x0, r0)
ioctl$LOOP_GET_STATUS(r1, 0x4c03, &(0x7f00000000c0))
ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f3188b070")
r2 = syz_open_procfs(0x0, &(0x7f0000000080)='net/dev_mcast\x00')
lseek(r2, 0x20000, 0x0)

15:06:44 executing program 0:
r0 = socket$inet_udplite(0x2, 0x2, 0x88)
ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f3188b070")
syz_open_procfs(0x0, &(0x7f0000000940)='syscall\x00')
r1 = syz_open_procfs(0x0, &(0x7f0000000040)='fd\x00')
recvmmsg(0xffffffffffffffff, &(0x7f0000003840)=[{{0x0, 0x0, 0x0}}], 0x1, 0x0, 0x0)
perf_event_open(&(0x7f0000940000)={0x2, 0x70, 0xee6a, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x100, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0xff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x10001, 0x1}, 0x0, 0x400000000000000}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
mlock(&(0x7f00005b8000/0x3000)=nil, 0x3000)
ioctl$SNDRV_TIMER_IOCTL_SELECT(0xffffffffffffffff, 0x40345410, 0x0)
openat$uinput(0xffffffffffffff9c, &(0x7f0000000080)='/dev/uinput\x00', 0x2, 0x0)
mmap(&(0x7f000060b000/0x1000)=nil, 0x1000, 0x5, 0x8000400200000033, r1, 0x0)
perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x2, 0x9, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2000000, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x4000000, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8)
r2 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)={0x10b, 0x6, 0x209e1e, 0x3, 0x1}, 0x2c)
bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000b40)={r2, &(0x7f0000000040), 0x0, 0x1}, 0x20)
r3 = creat(&(0x7f0000000640)='./file0\x00', 0x100)
setsockopt$inet6_tcp_TCP_REPAIR_QUEUE(r3, 0x6, 0x14, &(0x7f0000000980), 0x4)
unlink(&(0x7f0000000940)='./file0\x00')
r4 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r5 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r5, 0x0)
ioctl$BINDER_GET_NODE_DEBUG_INFO(r4, 0xc018620b, &(0x7f0000000100))
ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f00000000c0)=ANY=[@ANYBLOB="bb8f0000"], 0x0, 0x0, 0x0})
ioctl$BINDER_SET_CONTEXT_MGR(r5, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)})
ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0x0, 0x0, &(0x7f0000000780)})
creat(&(0x7f00000000c0)='./file0\x00', 0x0)

15:06:44 executing program 2:
r0 = syz_open_procfs(0x0, &(0x7f00000000c0)='maps\x00')
tee(r0, r0, 0x3, 0x4)
lseek(r0, 0x20000, 0x0)
bpf$BPF_PROG_DETACH(0x9, &(0x7f0000000080)={0x0, r0, 0x1, 0x2}, 0x14)
readv(r0, &(0x7f0000000640)=[{&(0x7f0000000000)=""/96, 0x60}], 0x1)

[ 1125.803008] binder: release 2055:2076 transaction 1363 out, still active
[ 1125.840418] binder: send failed reply for transaction 1363, target dead
15:06:44 executing program 1:
ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f3188b070")
recvmmsg(0xffffffffffffffff, &(0x7f0000003840)=[{{0x0, 0x0, 0x0}}], 0x1, 0x0, 0x0)
r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)={0x10b, 0x6, 0x209e1e, 0x3, 0x1}, 0x2c)
bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000b40)={r0, &(0x7f0000000040), 0x0, 0x1}, 0x20)
r1 = creat(&(0x7f0000000640)='./file0\x00', 0x100)
setsockopt$inet6_tcp_TCP_REPAIR_QUEUE(r1, 0x6, 0x14, &(0x7f0000000980), 0x4)
unlink(&(0x7f0000000940)='./file0\x00')
r2 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_GET_NODE_DEBUG_INFO(r2, 0xc018620b, &(0x7f0000000100))
ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)})
ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0x0, 0x0, &(0x7f0000000780)})

[ 1125.875947] binder: 2081:2086 transaction failed 29189/-22, size 24-8 line 3117
[ 1125.883367] binder: 2083:2089 transaction failed 29189/-22, size 24-8 line 3117
[ 1125.899174] binder: 2081:2086 BC_INCREFS_DONE u0000000000000000 no match
[ 1125.971309] binder: 2084:2090 unknown command 36795
[ 1125.982838] binder: 2084:2090 ioctl c0306201 20000140 returned -22
15:06:44 executing program 2:
r0 = syz_open_procfs(0x0, &(0x7f00000000c0)='maps\x00')
lseek(r0, 0x20000, 0x0)
readv(r0, &(0x7f0000000440)=[{&(0x7f0000000080)=""/49}, {&(0x7f0000000100)=""/113}, {&(0x7f0000000180)=""/17}, {&(0x7f00000004c0)=""/137}, {&(0x7f0000000280)=""/76}, {&(0x7f0000000300)=""/203}, {&(0x7f0000000400)=""/50}], 0x265)
flock(r0, 0x8)

15:06:44 executing program 4:
r0 = socket$inet_udplite(0x2, 0x2, 0x88)
ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f3188b070")
r1 = syz_open_procfs(0x0, &(0x7f0000000080)='net/dev_mcast\x00')
lseek(r1, 0x20000, 0x0)
ioctl$TCGETS(r1, 0x5401, &(0x7f0000000040))

15:06:44 executing program 5:
r0 = socket$inet_udplite(0x2, 0x2, 0x88)
ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f3188b070")
syz_open_procfs(0x0, &(0x7f0000000940)='syscall\x00')
r1 = syz_open_procfs(0x0, &(0x7f0000000040)='fd\x00')
recvmmsg(0xffffffffffffffff, &(0x7f0000003840)=[{{0x0, 0x0, 0x0}}], 0x1, 0x0, 0x0)
perf_event_open(&(0x7f0000940000)={0x2, 0x70, 0xee6a, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x100, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0xff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x10001, 0x1}, 0x0, 0x400000000000000}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
mlock(&(0x7f00005b8000/0x3000)=nil, 0x3000)
ioctl$SNDRV_TIMER_IOCTL_SELECT(0xffffffffffffffff, 0x40345410, 0x0)
openat$uinput(0xffffffffffffff9c, &(0x7f0000000080)='/dev/uinput\x00', 0x2, 0x0)
mmap(&(0x7f000060b000/0x1000)=nil, 0x1000, 0x5, 0x8000400200000033, r1, 0x0)
unshare(0xfffffffffffffffd)
r2 = getpid()
sched_setscheduler(r2, 0x5, &(0x7f00000000c0))
open$dir(&(0x7f0000000400)='./file0\x00', 0x0, 0x0)
perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f00000004c0), 0x2}, 0x0, 0x0, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r3 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000340)='memory.current\x00', 0x0, 0x0)
ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, 0x0)
socketpair(0x1, 0x20000000000001, 0x0, &(0x7f0000000100)={<r4=>0xffffffffffffffff, <r5=>0xffffffffffffffff})
ioctl$PERF_EVENT_IOC_SET_FILTER(r5, 0x8914, &(0x7f0000000300)='lo\x00\x96o\xd6Q\xb9Y\xa9\x01\xc2,\x00\xd2\x97\x04\x03\xdc\r')
close(r3)
rt_sigprocmask(0x2, &(0x7f0000000240)={0x6}, &(0x7f00000002c0), 0x8)
ioctl$PERF_EVENT_IOC_SET_FILTER(r5, 0x8923, &(0x7f00000008c0)='lo\x00\x96o8\x0fd\xa1\xe3\xd7]b}\x1f\xa1Y\xad4\x90\x9d`\xd2\x98\x00\x00\x00 \'Y\x17]\x15c\xcaR\xdd\x98OC\x89\x1b\xe7\x84\xe2\x05\x80w\xd2|D\x8dK\x14Bx\xcbuH\xc2\xeec\xbf<>Y\x1a\xfc\x1f9OB\x81\x89\x186\xc5q@n\xb4\xb6s\xb0\x00\x00\xfc\x00\x00\b\x00\x00\xda\xef\xecE\xec\xd5I\xb2\x9b\xfe\x8d\x90?\x00\xe9\xe4~g:\xc1\xb2aj\x96\xbb\xa7\xe2\xc0\xdc\xf9Q\b\xeb\x16\x7fT\x11\xd3\r7\xe6\"f\xcf\x8e\xabd\x0ftp\x82\xae\xd2\x15\x8e+c\xf6\xbf\xe14>\xa6-\xa5c\xde\xd7\xab\xea\x1f\xf8s2\x9cVF\xd5\x18\xfe\x0e\x8f \x01\x00\x00y.\xfc*\x82\xa5\xa1p5\xc8{\xf7\xef\xab\xe8\x99\xebw#\x8at\x1c\x80\xfc\xb0\x95\xa2\xa7\xd7,Y]E8\x83X\xf5F\xdc\x88-\xf5\xb0\xb5^\xdb\x1a\xb6\xaa\x14\xe2\xb9\rh^J-\xd1\xbaUn\x04\'l\x1b\xe0o\xdb\xc8\x91%\x1c\xb5\xbf\xb6\x90\xb4\xc2\x7f]/\xb3\xe7\xc9\'\x94\xcfIo\xdf\x04\x95\xb5\x06\x84\x1fH>\xda\xc5\x04 \x94\x88\xeb\'\xd4;6\x7f\xd9\x99-\x1b|G\x8d\xd4\xb9%\xaaQ\xa0K\x10\x03\x93\xe1\xcc\xe7m\x80\'\xf0\xa5\xed(\r\xa8\x0f&\xb1\xf3\xff0\f\x82%_\x92\x8bD\xb9\xd9\xe7\xf2\xe4\xc1i#\xdc\x87A\xb9\xc7\r\x92\xfa\x11\x11\xb5\x1f\x03\x9d\xdd\x1bj\xdf\xacg\xe3\xa0S\xd3\x8a\xe1n\x97\xea\xf5\xa0\'\v\xe9\xa0\xf1 f\xaan\xcf\xb5i\xb6d\xbc\x92\v\xd58\x16\b\xb3_:\xa4!\ny\xc4&\nWMM\xa8\xc4\v\x9f\x01o\xf4\xab&\xb6\x17\x02P\xc3!N\xf4\b\x1a~\x91V1s\xe9\xbe\x9e\x9b\'\xcde\xb3\xa1\x86\"\xd7\x04\xf1\xc0!\xed\xff\xee$\xc89\x8cB0\xd1dD\xe0IP\x88\xa2\xf2Y\x9af$$\xf1cO\xf7P\xac\xca\x80:!\xb4\x94#\xcb^\x9f\'\x03\xe3\x93\xb9\x82\xbf\xcf\xc4\xe3\xf7\x03Oh\xf2r\xca\x8ff\xbb/\x9f*\xaf\x1a \xa5\xa0?%M\xa5\x86\x98\xf24\'1\xc7\f<\xcc@\xe8\x8a\xac.\xde\xe4\xc7\xf5\x9ck\xa40!\xe9\x14$\xb3\x05m\xb5m\xed\ft\x93\xd8\xa3\x80\'Y\xb9\x05\xbbt|\xbe\xbcz\n\xf3\xf5p\xf8\x9f~\x1b\xd0\v\x1cQ')
getsockopt$inet_IP_IPSEC_POLICY(r1, 0x0, 0x10, &(0x7f00000006c0)={{{@in6=@loopback}}, {{@in6=@initdev}}}, &(0x7f0000000500)=0xe8)
socketpair(0x2, 0x2000000080003, 0x100, &(0x7f0000000480))
syz_genetlink_get_family_id$SEG6(&(0x7f00000003c0)='SEG6\x00')
sendmsg$SEG6_CMD_DUMPHMAC(r4, &(0x7f0000000580)={&(0x7f0000000380)={0x10, 0x0, 0x0, 0x1000000}, 0xc, &(0x7f0000000440)={&(0x7f00000005c0)=ANY=[@ANYBLOB="2300260109447a0000000000000000660000001400001a0065a455e04ea56d0a47018c8e973bcac914471474a7e0d50a000eadd66d2e49a2ed40dcafa1e046ab6aacc2097d8f75bd9c8b8a220bdde116904efa3f9600f22ab388644f66c2d5baec4079a81bae1927e49e91a4964656d7b227702926af5be846f3de49fad39048633fd9161123894d9427f854a30cb0532c8f31f663380e40ce7f6cb15ec8baab3b7c6f"], 0x1}, 0x1, 0x0, 0x0, 0x8000}, 0x804)
r6 = creat(&(0x7f0000000280)='./bus\x00', 0x0)
arch_prctl$ARCH_MAP_VDSO_32(0x2002, 0x7e)
ftruncate(r6, 0x2008200)
open(&(0x7f0000000140)='./bus\x00', 0x4000, 0x0)

15:06:44 executing program 3:
r0 = socket$inet_udplite(0x2, 0x2, 0x88)
ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f3188b070")
r1 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)})

[ 1126.050426] binder: 2084:2109 BC_INCREFS_DONE node 1370 has no pending increfs request
[ 1126.075812] binder: 2096:2116 BC_INCREFS_DONE node 1373 has no pending increfs request
15:06:44 executing program 4:
r0 = socket$inet_udplite(0x2, 0x2, 0x88)
socketpair$unix(0x1, 0x7, 0x0, &(0x7f0000000040)={0xffffffffffffffff, <r1=>0xffffffffffffffff})
ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f3188b070")
ioctl$sock_SIOCETHTOOL(r1, 0x8946, &(0x7f00000000c0)={'\x00', &(0x7f0000000080)=@ethtool_cmd={0x57, 0x6, 0x0, 0x37, 0x1, 0x7fffffff, 0x1eb, 0x1, 0x6, 0x94, 0xff, 0x68, 0x434, 0x9, 0x3, 0x2, [0xfffffffffffffffb, 0xe4]}})
r2 = syz_open_procfs(0x0, &(0x7f0000000100)='net/dev_mcast\x00')
lseek(r2, 0x20000, 0x0)

15:06:44 executing program 2:
r0 = syz_open_procfs(0x0, &(0x7f00000000c0)='maps\x00')
lseek(r0, 0x20000, 0x0)
readv(r0, &(0x7f0000000640)=[{&(0x7f0000000000)=""/96, 0x60}], 0x1)
ioctl$FS_IOC_SETFSLABEL(r0, 0x41009432, &(0x7f0000000100)="fde1b34783bdc071724a0b58c75507211698cc303b226f6bc6474a366c7e5c9bb3283afdf18078834a4c4c4c049bf78df2f7f944cfaf41e997c3121a2d12684ba90c66f48d2b725abb028a2fa32fc49cf095796b145daf56dae042c6a7b2a0f6e6b5ad930a31ef553aa6c15939c3f5825dc0ac3481bf66a927f7fd30b33126942632549cdeb00e10abb496b2a12b3b811ef04a0378446b26640e3ef5403fc38a6bef11b4380777fc0cfdd90d5b4c4d69999b1e7ddd48d9980243a89f2ebdd6f8b4996a3cf5f785229e5bc08d1c211260f263434f98edc393e6fd93265b0a9a3a18028c53cdeb0891637c7d5b7481bc438a114e4bb7a71ad819486acc6e9ec338")
ioctl$SNDRV_TIMER_IOCTL_STATUS(r0, 0x80605414, &(0x7f0000000200)=""/191)

15:06:44 executing program 3:
r0 = socket$inet_udplite(0x2, 0x2, 0x88)
ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f3188b070")
r1 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)})

[ 1126.100340] binder: release 2107:2117 transaction 1375 out, still active
15:06:45 executing program 2:
r0 = gettid()
r1 = syz_open_procfs(r0, &(0x7f0000000080)='maps\x00')
lseek(r1, 0x20000, 0x1)
readv(r1, &(0x7f0000000640)=[{&(0x7f0000000000)=""/96, 0x60}], 0x1)

[ 1126.185577] binder: release 2124:2131 transaction 1378 out, still active
15:06:45 executing program 0:
r0 = socket$inet_udplite(0x2, 0x2, 0x88)
ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f3188b070")
syz_open_procfs(0x0, &(0x7f0000000940)='syscall\x00')
r1 = syz_open_procfs(0x0, &(0x7f0000000040)='fd\x00')
recvmmsg(0xffffffffffffffff, &(0x7f0000003840)=[{{0x0, 0x0, 0x0}}], 0x1, 0x0, 0x0)
perf_event_open(&(0x7f0000940000)={0x2, 0x70, 0xee6a, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x100, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0xff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x10001, 0x1}, 0x0, 0x400000000000000}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
mlock(&(0x7f00005b8000/0x3000)=nil, 0x3000)
ioctl$SNDRV_TIMER_IOCTL_SELECT(0xffffffffffffffff, 0x40345410, 0x0)
openat$uinput(0xffffffffffffff9c, &(0x7f0000000080)='/dev/uinput\x00', 0x2, 0x0)
mmap(&(0x7f000060b000/0x1000)=nil, 0x1000, 0x5, 0x8000400200000033, r1, 0x0)
perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x2, 0x9, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2000000, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x4000000, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8)
r2 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)={0x10b, 0x6, 0x209e1e, 0x3, 0x1}, 0x2c)
bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000b40)={r2, &(0x7f0000000040), 0x0, 0x1}, 0x20)
r3 = creat(&(0x7f0000000640)='./file0\x00', 0x100)
setsockopt$inet6_tcp_TCP_REPAIR_QUEUE(r3, 0x6, 0x14, &(0x7f0000000980), 0x4)
unlink(&(0x7f0000000940)='./file0\x00')
r4 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r5 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r5, 0x0)
ioctl$BINDER_GET_NODE_DEBUG_INFO(r4, 0xc018620b, &(0x7f0000000100))
ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f00000000c0)=ANY=[@ANYBLOB="bb8f0000"], 0x0, 0x0, 0x0})
ioctl$BINDER_SET_CONTEXT_MGR(r5, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)})
ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0x0, 0x0, &(0x7f0000000780)})
creat(&(0x7f00000000c0)='./file0\x00', 0x0)

15:06:45 executing program 4:
r0 = socket$inet_udplite(0x2, 0x2, 0x88)
ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f3188b070")
syz_open_procfs(0x0, &(0x7f0000000080)='net/dev_mcast\x00')
lseek(r0, 0x20000, 0x0)

15:06:45 executing program 3:
r0 = socket$inet_udplite(0x2, 0x2, 0x88)
ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f3188b070")
syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)})

15:06:45 executing program 1:
ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f3188b070")
recvmmsg(0xffffffffffffffff, &(0x7f0000003840)=[{{0x0, 0x0, 0x0}}], 0x1, 0x0, 0x0)
r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)={0x10b, 0x6, 0x209e1e, 0x3, 0x1}, 0x2c)
bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000b40)={r0, &(0x7f0000000040), 0x0, 0x1}, 0x20)
r1 = creat(&(0x7f0000000640)='./file0\x00', 0x100)
setsockopt$inet6_tcp_TCP_REPAIR_QUEUE(r1, 0x6, 0x14, &(0x7f0000000980), 0x4)
unlink(&(0x7f0000000940)='./file0\x00')
r2 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_GET_NODE_DEBUG_INFO(r2, 0xc018620b, &(0x7f0000000100))
ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)})
ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0x0, 0x0, &(0x7f0000000780)})

15:06:45 executing program 2:
r0 = syz_open_procfs(0x0, &(0x7f00000000c0)='maps\x00')
lseek(r0, 0x20000, 0x0)
readv(r0, &(0x7f0000000640)=[{&(0x7f0000000000)=""/96, 0xfffffffffffffce5}], 0x1)

15:06:45 executing program 5:
r0 = socket$inet_udplite(0x2, 0x2, 0x88)
ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f3188b070")
syz_open_procfs(0x0, &(0x7f0000000940)='syscall\x00')
r1 = syz_open_procfs(0x0, &(0x7f0000000040)='fd\x00')
recvmmsg(0xffffffffffffffff, &(0x7f0000003840)=[{{0x0, 0x0, 0x0}}], 0x1, 0x0, 0x0)
perf_event_open(&(0x7f0000940000)={0x2, 0x70, 0xee6a, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x100, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0xff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x10001, 0x1}, 0x0, 0x400000000000000}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
mlock(&(0x7f00005b8000/0x3000)=nil, 0x3000)
ioctl$SNDRV_TIMER_IOCTL_SELECT(0xffffffffffffffff, 0x40345410, 0x0)
openat$uinput(0xffffffffffffff9c, &(0x7f0000000080)='/dev/uinput\x00', 0x2, 0x0)
mmap(&(0x7f000060b000/0x1000)=nil, 0x1000, 0x5, 0x8000400200000033, r1, 0x0)
unshare(0xfffffffffffffffd)
r2 = getpid()
sched_setscheduler(r2, 0x5, &(0x7f00000000c0))
open$dir(&(0x7f0000000400)='./file0\x00', 0x0, 0x0)
perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f00000004c0), 0x2}, 0x0, 0x0, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r3 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000340)='memory.current\x00', 0x0, 0x0)
ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, 0x0)
socketpair(0x1, 0x20000000000001, 0x0, &(0x7f0000000100)={<r4=>0xffffffffffffffff, <r5=>0xffffffffffffffff})
ioctl$PERF_EVENT_IOC_SET_FILTER(r5, 0x8914, &(0x7f0000000300)='lo\x00\x96o\xd6Q\xb9Y\xa9\xc8J,\x00\xd2\x97\x04\x03\xdc\r')
close(r3)
rt_sigprocmask(0x2, &(0x7f0000000240)={0x6}, &(0x7f00000002c0), 0x8)
ioctl$PERF_EVENT_IOC_SET_FILTER(r5, 0x8923, &(0x7f00000008c0)='lo\x00\x96o8\x0fd\xa1\xe3\xd7]b}\x1f\xa1Y\xad4\x90\x9d`\xd2\x98\x00\x00\x00 \'Y\x17]\x15c\xcaR\xdd\x98OC\x89\x1b\xe7\x84\xe2\x05\x80w\xd2|D\x8dK\x14Bx\xcbuH\xc2\xeec\xbf<>Y\x1a\xfc\x1f9OB\x81\x89\x186\xc5q@n\xb4\xb6s\xb0\x00\x00\xfc\x00\x00\b\x00\x00\xda\xef\xecE\xec\xd5I\xb2\x9b\xfe\x8d\x90?\x00\xe9\xe4~g:\xc1\xb2aj\x96\xbb\xa7\xe2\xc0\xdc\xf9Q\b\xeb\x16\x7fT\x11\xd3\r7\xe6\"f\xcf\x8e\xabd\x0ftp\x82\xae\xd2\x15\x8e+c\xf6\xbf\xe14>\xa6-\xa5c\xde\xd7\xab\xea\x1f\xf8s2\x9cVF\xd5\x18\xfe\x0e\x8f \x01\x00\x00y.\xfc*\x82\xa5\xa1p5\xc8{\xf7\xef\xab\xe8\x99\xebw#\x8at\x1c\x80\xfc\xb0\x95\xa2\xa7\xd7,Y]E8\x83X\xf5F\xdc\x88-\xf5\xb0\xb5^\xdb\x1a\xb6\xaa\x14\xe2\xb9\rh^J-\xd1\xbaUn\x04\'l\x1b\xe0o\xdb\xc8\x91%\x1c\xb5\xbf\xb6\x90\xb4\xc2\x7f]/\xb3\xe7\xc9\'\x94\xcfIo\xdf\x04\x95\xb5\x06\x84\x1fH>\xda\xc5\x04 \x94\x88\xeb\'\xd4;6\x7f\xd9\x99-\x1b|G\x8d\xd4\xb9%\xaaQ\xa0K\x10\x03\x93\xe1\xcc\xe7m\x80\'\xf0\xa5\xed(\r\xa8\x0f&\xb1\xf3\xff0\f\x82%_\x92\x8bD\xb9\xd9\xe7\xf2\xe4\xc1i#\xdc\x87A\xb9\xc7\r\x92\xfa\x11\x11\xb5\x1f\x03\x9d\xdd\x1bj\xdf\xacg\xe3\xa0S\xd3\x8a\xe1n\x97\xea\xf5\xa0\'\v\xe9\xa0\xf1 f\xaan\xcf\xb5i\xb6d\xbc\x92\v\xd58\x16\b\xb3_:\xa4!\ny\xc4&\nWMM\xa8\xc4\v\x9f\x01o\xf4\xab&\xb6\x17\x02P\xc3!N\xf4\b\x1a~\x91V1s\xe9\xbe\x9e\x9b\'\xcde\xb3\xa1\x86\"\xd7\x04\xf1\xc0!\xed\xff\xee$\xc89\x8cB0\xd1dD\xe0IP\x88\xa2\xf2Y\x9af$$\xf1cO\xf7P\xac\xca\x80:!\xb4\x94#\xcb^\x9f\'\x03\xe3\x93\xb9\x82\xbf\xcf\xc4\xe3\xf7\x03Oh\xf2r\xca\x8ff\xbb/\x9f*\xaf\x1a \xa5\xa0?%M\xa5\x86\x98\xf24\'1\xc7\f<\xcc@\xe8\x8a\xac.\xde\xe4\xc7\xf5\x9ck\xa40!\xe9\x14$\xb3\x05m\xb5m\xed\ft\x93\xd8\xa3\x80\'Y\xb9\x05\xbbt|\xbe\xbcz\n\xf3\xf5p\xf8\x9f~\x1b\xd0\v\x1cQ')
getsockopt$inet_IP_IPSEC_POLICY(r1, 0x0, 0x10, &(0x7f00000006c0)={{{@in6=@loopback}}, {{@in6=@initdev}}}, &(0x7f0000000500)=0xe8)
socketpair(0x2, 0x2000000080003, 0x100, &(0x7f0000000480))
syz_genetlink_get_family_id$SEG6(&(0x7f00000003c0)='SEG6\x00')
sendmsg$SEG6_CMD_DUMPHMAC(r4, &(0x7f0000000580)={&(0x7f0000000380)={0x10, 0x0, 0x0, 0x1000000}, 0xc, &(0x7f0000000440)={&(0x7f00000005c0)=ANY=[@ANYBLOB="2300260109447a0000000000000000660000001400001a0065a455e04ea56d0a47018c8e973bcac914471474a7e0d50a000eadd66d2e49a2ed40dcafa1e046ab6aacc2097d8f75bd9c8b8a220bdde116904efa3f9600f22ab388644f66c2d5baec4079a81bae1927e49e91a4964656d7b227702926af5be846f3de49fad39048633fd9161123894d9427f8540d0cb0532c8f31f663380e40ce7f6cb15ec8baab3b7c6f"], 0x1}, 0x1, 0x0, 0x0, 0x8000}, 0x804)
r6 = creat(&(0x7f0000000280)='./bus\x00', 0x0)
arch_prctl$ARCH_MAP_VDSO_32(0x2002, 0x7e)
ftruncate(r6, 0x2008200)
open(&(0x7f0000000140)='./bus\x00', 0x4000, 0x0)

[ 1126.679450] binder: release 2084:2090 transaction 1369 out, still active
[ 1126.689523] binder: send failed reply for transaction 1369, target dead
[ 1126.696861] binder: send failed reply for transaction 1372 to 2096:2098
[ 1126.703801] binder: send failed reply for transaction 1375, target dead
[ 1126.710962] binder: send failed reply for transaction 1378, target dead
15:06:45 executing program 4:
r0 = socket$nl_netfilter(0x10, 0x3, 0xc)
preadv(r0, &(0x7f0000000080)=[{&(0x7f0000000100)=""/169, 0xa9}, {&(0x7f00000002c0)=""/4096, 0x1000}, {&(0x7f00000012c0)=""/236, 0xec}, {&(0x7f0000000040)=""/16, 0x10}], 0x4, 0x0)
r1 = socket$inet_udplite(0x2, 0x2, 0x88)
ioctl(r1, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f3188b070")
ioctl$PERF_EVENT_IOC_RESET(r0, 0x2403, 0x7)
ioctl$sock_SIOCGPGRP(r1, 0x8904, &(0x7f0000000280)=<r2=>0x0)
r3 = syz_open_procfs(r2, &(0x7f00000000c0)='net/dev_mcast\x00')
getsockopt$inet6_tcp_TCP_ZEROCOPY_RECEIVE(r3, 0x6, 0x23, &(0x7f00000001c0)={&(0x7f0000ffb000/0x2000)=nil, 0x2000}, &(0x7f0000000200)=0x10)
lseek(r3, 0x0, 0x0)

15:06:45 executing program 3:
r0 = socket$inet_udplite(0x2, 0x2, 0x88)
ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f3188b070")
syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)})

15:06:45 executing program 2:
r0 = syz_open_procfs(0x0, &(0x7f00000000c0)='maps\x00')
lseek(r0, 0x20000, 0x0)
readv(r0, &(0x7f0000000640)=[{&(0x7f0000000000)=""/96, 0x60}], 0x1)
write$selinux_validatetrans(r0, &(0x7f0000000100)={'system_u:object_r:init_var_run_t:s0', 0x20, 'system_u:object_r:dhcpc_var_run_t:s0', 0x20, 0x1ff, 0x20, '/usr/sbin/ntpd\x00'}, 0x6d)
accept4$inet6(r0, &(0x7f0000000080)={0xa, 0x0, 0x0, @mcast2}, &(0x7f0000000180)=0x1c, 0x80000)

[ 1126.818796] binder: 2155:2158 transaction failed 29189/-22, size 24-8 line 3117
[ 1126.844776] binder: 2148:2157 unknown command 36795
[ 1126.846850] binder: 2155:2158 BC_INCREFS_DONE u0000000000000000 no match
[ 1126.858431] binder: 2148:2157 ioctl c0306201 20000140 returned -22
15:06:45 executing program 3:
r0 = socket$inet_udplite(0x2, 0x2, 0x88)
ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f3188b070")
syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)})

15:06:45 executing program 4:
r0 = socket$inet_udplite(0x2, 0x2, 0x88)
ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f3188b070")
r1 = openat$null(0xffffffffffffff9c, &(0x7f0000000040)='/dev/null\x00', 0x4000, 0x0)
write$P9_RCLUNK(r1, &(0x7f00000000c0)={0x7, 0x79, 0x1}, 0x7)
r2 = syz_open_procfs(0x0, &(0x7f0000000080)='net/dev_mcast\x00')
lseek(r2, 0x20000, 0x0)

[ 1126.869461] binder: BINDER_SET_CONTEXT_MGR already set
[ 1126.876099] binder: 2161:2166 ioctl 40046207 0 returned -16
[ 1126.887089] audit: type=1400 audit(1553699205.739:119): avc:  denied  { ioctl } for  pid=2163 comm="syz-executor.4" path="socket:[195331]" dev="sockfs" ino=195331 ioctlcmd=0x2403 scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tclass=netlink_netfilter_socket permissive=1
15:06:45 executing program 1:
socket$inet_udplite(0x2, 0x2, 0x88)
ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f3188b070")
recvmmsg(0xffffffffffffffff, &(0x7f0000003840)=[{{0x0, 0x0, 0x0}}], 0x1, 0x0, 0x0)
r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)={0x10b, 0x6, 0x209e1e, 0x3, 0x1}, 0x2c)
bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000b40)={r0, &(0x7f0000000040), 0x0, 0x1}, 0x20)
r1 = creat(&(0x7f0000000640)='./file0\x00', 0x100)
setsockopt$inet6_tcp_TCP_REPAIR_QUEUE(r1, 0x6, 0x14, &(0x7f0000000980), 0x4)
unlink(&(0x7f0000000940)='./file0\x00')
r2 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_GET_NODE_DEBUG_INFO(r2, 0xc018620b, &(0x7f0000000100))
ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)})
ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0x0, 0x0, &(0x7f0000000780)})

[ 1126.929352] binder: 2148:2172 BC_INCREFS_DONE node 1385 has no pending increfs request
[ 1126.982701] binder: BINDER_SET_CONTEXT_MGR already set
[ 1126.994412] binder: 2173:2177 ioctl 40046207 0 returned -16
[ 1127.055285] binder: 2176:2187 BC_INCREFS_DONE node 1388 has no pending increfs request
15:06:46 executing program 3:
r0 = socket$inet_udplite(0x2, 0x2, 0x88)
ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f3188b070")
r1 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, 0x0)

15:06:46 executing program 2:
r0 = syz_open_procfs(0x0, &(0x7f00000000c0)='maps\x00')
lseek(r0, 0x20000, 0x7)
readv(r0, &(0x7f0000000640)=[{&(0x7f0000000000)=""/96, 0x60}], 0x1)
symlink(&(0x7f0000000080)='./file0\x00', &(0x7f0000000100)='./file0\x00')
r1 = gettid()
fcntl$setown(r0, 0x8, r1)
lsetxattr$trusted_overlay_origin(&(0x7f0000000140)='./file0\x00', &(0x7f0000000180)='trusted.overlay.origin\x00', &(0x7f00000001c0)='y\x00', 0x2, 0x1)

15:06:46 executing program 4:
r0 = socket$inet_udplite(0x2, 0x2, 0x88)
ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f3188b070")
r1 = syz_open_procfs(0x0, &(0x7f0000000080)='net/dev_mcast\x00')
lseek(r1, 0x20000, 0x0)
fcntl$getflags(r1, 0x0)
prctl$PR_SET_FPEXC(0xc, 0x10083)

15:06:46 executing program 5:
r0 = socket$inet_udplite(0x2, 0x2, 0x88)
ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f3188b070")
syz_open_procfs(0x0, &(0x7f0000000940)='syscall\x00')
r1 = syz_open_procfs(0x0, &(0x7f0000000040)='fd\x00')
recvmmsg(0xffffffffffffffff, &(0x7f0000003840)=[{{0x0, 0x0, 0x0}}], 0x1, 0x0, 0x0)
perf_event_open(&(0x7f0000940000)={0x2, 0x70, 0xee6a, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x100, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0xff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x10001, 0x1}, 0x0, 0x400000000000000}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
mlock(&(0x7f00005b8000/0x3000)=nil, 0x3000)
ioctl$SNDRV_TIMER_IOCTL_SELECT(0xffffffffffffffff, 0x40345410, 0x0)
openat$uinput(0xffffffffffffff9c, &(0x7f0000000080)='/dev/uinput\x00', 0x2, 0x0)
mmap(&(0x7f000060b000/0x1000)=nil, 0x1000, 0x5, 0x8000400200000033, r1, 0x0)
unshare(0xfffffffffffffffd)
r2 = getpid()
sched_setscheduler(r2, 0x5, &(0x7f0000000200))
open$dir(&(0x7f0000000400)='./file0\x00', 0x0, 0x0)
r3 = perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f00000004c0), 0x2}, 0x0, 0x0, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r4 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000340)='memory.current\x00', 0x0, 0x0)
ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, 0x0)
socketpair(0x1, 0x20000000000001, 0x0, &(0x7f0000000100)={<r5=>0xffffffffffffffff, <r6=>0xffffffffffffffff})
ioctl$PERF_EVENT_IOC_SET_FILTER(r6, 0x8914, &(0x7f0000000300)='lo\x00\x96o\xd6Q\xb9Y\xa9\xc8J,\x00\xd2\x97\x04\x03\xdc\r')
close(r4)
rt_sigprocmask(0x2, &(0x7f0000000240)={0x6}, &(0x7f00000002c0), 0x8)
ioctl$PERF_EVENT_IOC_SET_FILTER(r3, 0x8923, &(0x7f00000008c0)='lo\x00\x96o8\x0fd\xa1\xe3\xd7]b}\x1f\xa1Y\xad4\x90\x9d`\xd2\x98\x00\x00\x00 \'Y\x17]\x15c\xcaR\xdd\x98OC\x89\x1b\xe7\x84\xe2\x05\x80w\xd2|D\x8dK\x14Bx\xcbuH\xc2\xeec\xbf<>Y\x1a\xfc\x1f9OB\x81\x89\x186\xc5q@n\xb4\xb6s\xb0\x00\x00\xfc\x00\x00\b\x00\x00\xda\xef\xecE\xec\xd5I\xb2\x9b\xfe\x8d\x90?\x00\xe9\xe4~g:\xc1\xb2aj\x96\xbb\xa7\xe2\xc0\xdc\xf9Q\b\xeb\x16\x7fT\x11\xd3\r7\xe6\"f\xcf\x8e\xabd\x0ftp\x82\xae\xd2\x15\x8e+c\xf6\xbf\xe14>\xa6-\xa5c\xde\xd7\xab\xea\x1f\xf8s2\x9cVF\xd5\x18\xfe\x0e\x8f \x01\x00\x00y.\xfc*\x82\xa5\xa1p5\xc8{\xf7\xef\xab\xe8\x99\xebw#\x8at\x1c\x80\xfc\xb0\x95\xa2\xa7\xd7,Y]E8\x83X\xf5F\xdc\x88-\xf5\xb0\xb5^\xdb\x1a\xb6\xaa\x14\xe2\xb9\rh^J-\xd1\xbaUn\x04\'l\x1b\xe0o\xdb\xc8\x91%\x1c\xb5\xbf\xb6\x90\xb4\xc2\x7f]/\xb3\xe7\xc9\'\x94\xcfIo\xdf\x04\x95\xb5\x06\x84\x1fH>\xda\xc5\x04 \x94\x88\xeb\'\xd4;6\x7f\xd9\x99-\x1b|G\x8d\xd4\xb9%\xaaQ\xa0K\x10\x03\x93\xe1\xe6\xe7m\x80\'\xf0\xa5\xed(\r\xa8\x0f&\xb1\xf3\xff0\f\x82%_\x92\x8bD\xb9\xd9\xe7\xf2\xe4\xc1i#\xdc\x87A\xb9\xc7\r\x92\xfa\x11\x11\xb52\x03\x9d\xdd\x1bj\xdf\xacg\xe3\xa0S\xd3\x8a\xe1n\x97\xea\xf5\xa0\'\v\xe9\xa0\xf1 f\xaan\xcf\xb5i\xb6d\xbc\x92\v\xd58\x16\b\xb3_:\xa4!\ny\xc4&\nWMM\xa8\xc4\v\x9f\x01o\xf4\xab&\xb6\x17\x02P\xc3!N\xf4\b\x1a~\x91V1s\xe9\xbe\x9e\x9b\'\xcde\xee$\xc89\x8cB0\xd1dD\xe0IP\x88\xa2\xf2Y\x9af$$\xf1cO\xf7P\xac\xca\x80:!\xb4\x94#\xcb^\x9f\'\x03\xe3\x93\xb9\x82\xbf\xcf\xc4\xe3\xf7\x03Oh\xf2r\xca\x8ff\xbb/\x9f*\xaf\x1a \xa5\xa0?%M\xa5\x86\x98\xf24\'1\xc7\f<\xcc@\xe8\x8a\xac.\xde\xe4\xc7\xf5\x9ck\xa40!\xe9\x14$\xb3\x05m\xb5m\xed\ft\x93\xd8\xa3\x80\'Y\xb9\x05\xbbt|\xbe\xbcz\n\xf3\xf5p\xf8\x9f~\x1b\xd0\v\x1cQ\xe1\xd4')
getsockopt$inet_IP_IPSEC_POLICY(r1, 0x0, 0x10, &(0x7f00000006c0)={{{@in6=@loopback}}, {{@in6=@initdev}}}, &(0x7f0000000500)=0xe8)
socketpair(0x2, 0x2000000080003, 0x100, &(0x7f0000000480))
syz_genetlink_get_family_id$SEG6(&(0x7f00000003c0)='SEG6\x00')
sendmsg$SEG6_CMD_DUMPHMAC(r5, &(0x7f0000000580)={&(0x7f0000000380)={0x10, 0x0, 0x0, 0x1000000}, 0xc, &(0x7f0000000440)={&(0x7f00000005c0)=ANY=[@ANYBLOB="2300260109447a0000000000000000660000001400001a0065a455e04ea56d0a47018c8e973bcac914471474a7e0d50a000eadd66d2e49a2ed40dcafa1e046ab6aacc2097d8f75bd9c8b8a220bdde116904efa3f9600f22ab388644f66c2d5baec4079a31bae1927cb9e91a4964656d7b227702926af5be846f3de49fad390d916ef22894d9427f854a30cb0532c8f31f663380e40ce7f6cb15ec8baab3b7c6f000000"], 0x1}, 0x1, 0x0, 0x0, 0x8000}, 0x804)
r7 = creat(&(0x7f0000000280)='./bus\x00', 0x0)
arch_prctl$ARCH_MAP_VDSO_32(0x2002, 0x7e)
ftruncate(r7, 0x2008200)
open(&(0x7f0000000140)='./bus\x00', 0x4000, 0x3e)

15:06:46 executing program 0:
r0 = socket$inet_udplite(0x2, 0x2, 0x88)
ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f3188b070")
syz_open_procfs(0x0, &(0x7f0000000940)='syscall\x00')
r1 = syz_open_procfs(0x0, &(0x7f0000000040)='fd\x00')
recvmmsg(0xffffffffffffffff, &(0x7f0000003840)=[{{0x0, 0x0, 0x0}}], 0x1, 0x0, 0x0)
perf_event_open(&(0x7f0000940000)={0x2, 0x70, 0xee6a, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x100, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0xff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x10001, 0x1}, 0x0, 0x400000000000000}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
mlock(&(0x7f00005b8000/0x3000)=nil, 0x3000)
ioctl$SNDRV_TIMER_IOCTL_SELECT(0xffffffffffffffff, 0x40345410, 0x0)
openat$uinput(0xffffffffffffff9c, &(0x7f0000000080)='/dev/uinput\x00', 0x2, 0x0)
mmap(&(0x7f000060b000/0x1000)=nil, 0x1000, 0x5, 0x8000400200000033, r1, 0x0)
perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x2, 0x9, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2000000, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x4000000, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8)
r2 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)={0x10b, 0x6, 0x209e1e, 0x3, 0x1}, 0x2c)
bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000b40)={r2, &(0x7f0000000040), 0x0, 0x1}, 0x20)
r3 = creat(&(0x7f0000000640)='./file0\x00', 0x100)
setsockopt$inet6_tcp_TCP_REPAIR_QUEUE(r3, 0x6, 0x14, &(0x7f0000000980), 0x4)
unlink(&(0x7f0000000940)='./file0\x00')
r4 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r5 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r5, 0x0)
ioctl$BINDER_GET_NODE_DEBUG_INFO(r4, 0xc018620b, &(0x7f0000000100))
ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f00000000c0)=ANY=[@ANYBLOB="bb8f0000"], 0x0, 0x0, 0x0})
ioctl$BINDER_SET_CONTEXT_MGR(r5, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)})
ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0x0, 0x0, &(0x7f0000000780)})
creat(&(0x7f00000000c0)='./file0\x00', 0x0)

15:06:46 executing program 1:
socket$inet_udplite(0x2, 0x2, 0x88)
ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f3188b070")
recvmmsg(0xffffffffffffffff, &(0x7f0000003840)=[{{0x0, 0x0, 0x0}}], 0x1, 0x0, 0x0)
r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)={0x10b, 0x6, 0x209e1e, 0x3, 0x1}, 0x2c)
bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000b40)={r0, &(0x7f0000000040), 0x0, 0x1}, 0x20)
r1 = creat(&(0x7f0000000640)='./file0\x00', 0x100)
setsockopt$inet6_tcp_TCP_REPAIR_QUEUE(r1, 0x6, 0x14, &(0x7f0000000980), 0x4)
unlink(&(0x7f0000000940)='./file0\x00')
r2 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_GET_NODE_DEBUG_INFO(r2, 0xc018620b, &(0x7f0000000100))
ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)})
ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0x0, 0x0, &(0x7f0000000780)})

[ 1127.573593] binder: release 2148:2157 transaction 1384 out, still active
[ 1127.582574] binder: send failed reply for transaction 1384, target dead
[ 1127.589360] binder: send failed reply for transaction 1387 to 2176:2179
15:06:46 executing program 3:
r0 = socket$inet_udplite(0x2, 0x2, 0x88)
ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f3188b070")
r1 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, 0x0)

15:06:46 executing program 2:
r0 = dup3(0xffffffffffffff9c, 0xffffffffffffffff, 0x80000)
write$apparmor_current(r0, &(0x7f0000000180)=@profile={'stack ', 'TIPCv2\x00'}, 0xd)
r1 = syz_genetlink_get_family_id$tipc2(&(0x7f0000000140)='TIPCv2\x00')
sendmsg$TIPC_NL_BEARER_ADD(r0, &(0x7f0000000280)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x900}, 0xc, &(0x7f0000000240)={&(0x7f00000003c0)=ANY=[@ANYBLOB="a01703192284cf3b69beb578822432e3a1bbd8ee1d89ed647554274076d3eee8624fc4d779553830898b769c5a007358e29103000000705ec531e00dc9cb440827ef78aea9448ecf9e94a163c3ad918b913f4b9000000000000000ba1cd35a000000005fc0f57b94d72b80af761e760f2a4d05a707549c72d74fd93004d529e9de6ad1cc41a71e1f853a3e138726466143b7f91703fe92bbb9ee1d19cfd5f0c038962180bb93fbb9733f856b2817d6d77317e5a5581bfe2926aca888d5b5fc008fb7eb66d57fc20100000072b73bbae4733466bb4751d054e82598b66439a3633bf076781680e435ada408c1fe5f59fd223a15d8d62fa055e5ea01b1a979ab282dc6b956934e03779efb50125913102d84b571aef4621e1093c3dceb57ecaeb61967ea83bd7fbde370d2bdb595b8e68179e075122f8157a36c29d4c4e7bebccd34102f9ff80bc612676907884e56dcf2547fc992bb7fdbc105beaf761605c6a3ff9748ee8a5619149f66a9d519c68d77c5ac5cecbc134a65427913af3df9fecdf82880abaf692b096bf5d6725b76a395d634028e5923c5ef4d19", @ANYRES16=r1, @ANYBLOB="00022dbd7000fbdbdf25150000002c000200040004000400040008000200faffffff0800010001040000080001007f00000008000200040000003c0009000800020024e3b95d0800020003000000080002000500000008000200010400000800010001000000080001004000000008000100070000002c00070008000100010001000c00030009000000000000000c00030001000000000000000800020038500000"], 0xa8}, 0x1, 0x0, 0x0, 0x20000000}, 0x8000)
setsockopt$inet_udp_int(r0, 0x11, 0x6f, &(0x7f0000000080)=0x9, 0x4)
r2 = syz_open_procfs(0x0, &(0x7f00000000c0)='maps\x00')
lseek(r2, 0x20000, 0x0)
readv(r2, &(0x7f0000000640)=[{&(0x7f0000000000)=""/96, 0x60}], 0x1)

15:06:46 executing program 4:
r0 = socket$inet_udplite(0x2, 0x2, 0x88)
ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f3188b070")
r1 = getpid()
r2 = syz_open_procfs(r1, &(0x7f0000000080)='net/dev_mcast\x00')
lseek(r2, 0x20000, 0x0)

[ 1127.635221] binder: 2191:2195 ioctl c0306201 0 returned -14
[ 1127.722134] binder: 2201:2203 unknown command 36795
[ 1127.733962] binder: 2205:2209 transaction failed 29189/-22, size 24-8 line 3117
[ 1127.737224] binder: 2201:2203 ioctl c0306201 20000140 returned -22
[ 1127.746043] binder: 2205:2209 BC_INCREFS_DONE u0000000000000000 no match
[ 1127.759881] binder: 2206:2210 ioctl c0306201 0 returned -14
[ 1127.760035] binder: BINDER_SET_CONTEXT_MGR already set
15:06:46 executing program 1:
socket$inet_udplite(0x2, 0x2, 0x88)
ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f3188b070")
recvmmsg(0xffffffffffffffff, &(0x7f0000003840)=[{{0x0, 0x0, 0x0}}], 0x1, 0x0, 0x0)
r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)={0x10b, 0x6, 0x209e1e, 0x3, 0x1}, 0x2c)
bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000b40)={r0, &(0x7f0000000040), 0x0, 0x1}, 0x20)
r1 = creat(&(0x7f0000000640)='./file0\x00', 0x100)
setsockopt$inet6_tcp_TCP_REPAIR_QUEUE(r1, 0x6, 0x14, &(0x7f0000000980), 0x4)
unlink(&(0x7f0000000940)='./file0\x00')
r2 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_GET_NODE_DEBUG_INFO(r2, 0xc018620b, &(0x7f0000000100))
ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)})
ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0x0, 0x0, &(0x7f0000000780)})

15:06:46 executing program 3:
r0 = socket$inet_udplite(0x2, 0x2, 0x88)
ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f3188b070")
r1 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, 0x0)

15:06:46 executing program 4:
r0 = socket$inet_udplite(0x2, 0x2, 0x88)
ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f3188b070")
r1 = syz_open_procfs(0x0, &(0x7f0000000080)='net/dev_mcast\x00')
ioctl$FS_IOC_SET_ENCRYPTION_POLICY(r1, 0x800c6613, &(0x7f00000000c0)={0x0, @speck128, 0x1, "c9a3796bb0df1fc0"})
lseek(r1, 0x20000, 0x0)
ioctl$sock_inet_SIOCSIFNETMASK(r1, 0x891c, &(0x7f0000000100)={'ip6erspan0\x00', {0x2, 0x4e21, @loopback}})

[ 1127.792647] binder: 2201:2203 ioctl 40046207 0 returned -16
[ 1127.808483] binder_alloc: 2206: binder_alloc_buf failed to map pages in userspace, no vma
[ 1127.824287] binder: 2201:2219 transaction failed 29189/-3, size 24-8 line 3254
15:06:46 executing program 2:
r0 = syz_open_procfs(0x0, &(0x7f00000000c0)='maps\x00')
lseek(r0, 0x20000, 0x0)
readv(r0, &(0x7f0000000640)=[{&(0x7f0000000000)=""/96, 0x60}], 0x1)
fsetxattr$security_evm(r0, &(0x7f0000000080)='security.evm\x00', &(0x7f0000000100)=@ng={0x4, 0x4, "dd666e51366b7945"}, 0xa, 0x3)

[ 1127.842056] binder: 2201:2203 BC_INCREFS_DONE u0000000000000000 no match
15:06:46 executing program 0:
r0 = socket$inet_udplite(0x2, 0x2, 0x88)
ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f3188b070")
syz_open_procfs(0x0, &(0x7f0000000940)='syscall\x00')
r1 = syz_open_procfs(0x0, &(0x7f0000000040)='fd\x00')
recvmmsg(0xffffffffffffffff, &(0x7f0000003840)=[{{0x0, 0x0, 0x0}}], 0x1, 0x0, 0x0)
perf_event_open(&(0x7f0000940000)={0x2, 0x70, 0xee6a, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x100, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0xff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x10001, 0x1}, 0x0, 0x400000000000000}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
mlock(&(0x7f00005b8000/0x3000)=nil, 0x3000)
ioctl$SNDRV_TIMER_IOCTL_SELECT(0xffffffffffffffff, 0x40345410, 0x0)
openat$uinput(0xffffffffffffff9c, &(0x7f0000000080)='/dev/uinput\x00', 0x2, 0x0)
mmap(&(0x7f000060b000/0x1000)=nil, 0x1000, 0x5, 0x8000400200000033, r1, 0x0)
perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x2, 0x9, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2000000, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x4000000, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8)
r2 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)={0x10b, 0x6, 0x209e1e, 0x3, 0x1}, 0x2c)
bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000b40)={r2, &(0x7f0000000040), 0x0, 0x1}, 0x20)
r3 = creat(&(0x7f0000000640)='./file0\x00', 0x100)
setsockopt$inet6_tcp_TCP_REPAIR_QUEUE(r3, 0x6, 0x14, &(0x7f0000000980), 0x4)
unlink(&(0x7f0000000940)='./file0\x00')
r4 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r5 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r5, 0x0)
ioctl$BINDER_GET_NODE_DEBUG_INFO(r4, 0xc018620b, &(0x7f0000000100))
ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f00000000c0)=ANY=[@ANYBLOB="bb8f0000"], 0x0, 0x0, 0x0})
shutdown(0xffffffffffffffff, 0x1)
ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)})
ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0x0, 0x0, &(0x7f0000000780)})
creat(&(0x7f00000000c0)='./file0\x00', 0x0)

[ 1127.902295] binder: 2222:2227 ioctl c0306201 0 returned -14
[ 1127.930581] binder_alloc: 2222: binder_alloc_buf failed to map pages in userspace, no vma
[ 1127.940186] binder: 2221:2228 transaction failed 29189/-3, size 24-8 line 3254
15:06:46 executing program 3:
r0 = socket$inet_udplite(0x2, 0x2, 0x88)
ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f3188b070")
r1 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f00000003c0)})

[ 1127.955863] binder: 2221:2228 BC_INCREFS_DONE u0000000000000000 no match
[ 1128.069840] binder: 2233:2237 unknown command 36795
[ 1128.075806] binder: 2233:2237 ioctl c0306201 20000140 returned -22
[ 1128.089118] binder: 2233:2237 transaction failed 29189/-22, size 24-8 line 3117
[ 1128.099123] binder: 2233:2237 BC_INCREFS_DONE u0000000000000000 no match
15:06:47 executing program 4:
r0 = socket$inet_udplite(0x2, 0x2, 0x88)
ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f3188b070")
r1 = openat$selinux_avc_cache_threshold(0xffffffffffffff9c, &(0x7f0000000040)='/selinux/avc/cache_threshold\x00', 0x2, 0x0)
setsockopt$inet_icmp_ICMP_FILTER(r1, 0x1, 0x1, &(0x7f00000000c0)={0xfffffffffffffe01}, 0x4)
r2 = syz_open_procfs(0x0, &(0x7f0000000080)='net/dev_mcast\x00')
lseek(r2, 0x20000, 0x0)

15:06:47 executing program 2:
r0 = syz_open_procfs(0x0, &(0x7f00000000c0)='maps\x00')
lseek(r0, 0x20000, 0x0)
ioctl$TIOCGSID(r0, 0x5429, &(0x7f0000000080)=<r1=>0x0)
syz_open_procfs(r1, &(0x7f0000000100)='net/ip_mr_vif\x00')
readv(r0, &(0x7f0000000640)=[{&(0x7f0000000000)=""/96, 0x60}], 0x1)

15:06:47 executing program 1:
r0 = socket$inet_udplite(0x2, 0x2, 0x88)
ioctl(r0, 0x0, &(0x7f0000000000)="0adc1f123c123f3188b070")
recvmmsg(0xffffffffffffffff, &(0x7f0000003840)=[{{0x0, 0x0, 0x0}}], 0x1, 0x0, 0x0)
r1 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)={0x10b, 0x6, 0x209e1e, 0x3, 0x1}, 0x2c)
bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000b40)={r1, &(0x7f0000000040), 0x0, 0x1}, 0x20)
r2 = creat(&(0x7f0000000640)='./file0\x00', 0x100)
setsockopt$inet6_tcp_TCP_REPAIR_QUEUE(r2, 0x6, 0x14, &(0x7f0000000980), 0x4)
unlink(&(0x7f0000000940)='./file0\x00')
r3 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_GET_NODE_DEBUG_INFO(r3, 0xc018620b, &(0x7f0000000100))
ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)})
ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0x0, 0x0, &(0x7f0000000780)})

15:06:47 executing program 3:
r0 = socket$inet_udplite(0x2, 0x2, 0x88)
ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f3188b070")
r1 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f00000003c0)})

15:06:47 executing program 5:
r0 = socket$inet_udplite(0x2, 0x2, 0x88)
ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f3188b070")
syz_open_procfs(0x0, &(0x7f0000000940)='syscall\x00')
r1 = syz_open_procfs(0x0, &(0x7f0000000040)='fd\x00')
recvmmsg(0xffffffffffffffff, &(0x7f0000003840)=[{{0x0, 0x0, 0x0}}], 0x1, 0x0, 0x0)
r2 = perf_event_open(&(0x7f0000940000)={0x2, 0x70, 0xee6a, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x100, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0xff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x10001, 0x1}, 0x0, 0x400000000000000}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
mlock(&(0x7f00005b8000/0x3000)=nil, 0x3000)
ioctl$SNDRV_TIMER_IOCTL_SELECT(r2, 0x40345410, 0x0)
openat$uinput(0xffffffffffffff9c, &(0x7f0000000080)='/dev/uinput\x00', 0x2, 0x0)
mmap(&(0x7f000060b000/0x1000)=nil, 0x1000, 0x5, 0x8000400200000033, r1, 0x0)
unshare(0xfffffffffffffffd)
r3 = getpid()
sched_setscheduler(r3, 0x5, &(0x7f00000000c0))
open$dir(&(0x7f0000000400)='./file0\x00', 0x0, 0x0)
perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f00000004c0), 0x2}, 0x0, 0x0, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r4 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000340)='memory.current\x00', 0x0, 0x0)
ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, 0x0)
socketpair(0x1f, 0x20000000000004, 0x0, &(0x7f0000000440)={<r5=>0xffffffffffffffff, <r6=>0xffffffffffffffff})
ioctl$PERF_EVENT_IOC_SET_FILTER(r6, 0x8914, &(0x7f0000000300)='lo\x00\x96o\xd6Q\xb9Y\xa9\xc8J,\x00\xd2\x97\x04\x03\xdc\r')
close(r4)
rt_sigprocmask(0x2, &(0x7f0000000240)={0x6}, &(0x7f00000002c0), 0x8)
ioctl$PERF_EVENT_IOC_SET_FILTER(r6, 0x8923, &(0x7f00000008c0)='lo\x00\x96o8\x0fd\xa1\xe3\xd7]b}\x1f\xa1Y\xad4\x90\x9d`\xd2\x98\x00\x00\x00 \'Y\x17]\x15c\xcaR\xdd\x98OC\x89\x1b\xe7\x84\xe2\x05\x80w\xd2|D\x8dK\x14Bx\xcbuH\xc2\xeec\xbf<>Y\x1a\xfc\x1f9OB\x81\x89\x186\xc5q@n\xb4\xb6s\xb0\x00\x00\xfc\x00\x00\b\x00\x00\xda\xef\xecE\xec\xd5I\xb2\x9b\xfe\x8d\x90?\x00\xe9\xe4~g:\xc1\xb2aj\x96\xbb\xa7\xe2\xc0\xdc\xf9Q\b\xeb\x16\x7fT\x11\xd3\r7\xe6\"f\xcf\x8e\xabd\x0ftp\x82\xae\xd2\x15\x8e+c\xf6\xbf\xe14>\xa6-\xa5c\xde\xd7\xab\xea\x1f\xf8s2\x9cVF\xd5\x18\xfe\x0e\x8f \x01\x00\x00y.\xfc*\x82\xa5\xa1p5\xc8{\xf7\xef\xab\xe8\x99\xebw#\x8at\x1c\x80\xfc\xb0\x95\xa2\xa7\xd7,Y]E8\x83X\xf5F\xdc\x88-\xf5\xb0\xb5^\xdb\x1a\xb6\xaa\x14\xe2\xb9\rh^J-\xd1\xbaUn\x04\'l\x1b\xe0o\xdb\xc8\x91%\x1c\xb5\xbf\xb6\x90\xb4\xc2\x7f]/\xb3\xe7\xc9\'\x94\xcfIo\xdf\x04\x95\xb5\x06\x84\x1fH>\xda\xc5\x04 \x94\x88\xeb\'\xd4;6\x7f\xd9\x99-\x1b|G\x8d\xd4\xb9%\xaaQ\xa0K\x10\x03\x93\xe1\xcc\xe7m\x80\'\xf0\xa5\xed(\r\xa8\x0f&\xb1\xf3\xff0\f\x82%_\x92\x8bD\xb9\xd9\xe7\xf2\xe4\xc1i#\xdc\x87A\xb9\xc7\r\x92\xfa\x11\x11\xb5\x1f\x03\x9d\xdd\x1bj\xdf\xacg\xe3\xa0S\xd3\x8a\xe1n\x97\xea\xf5\xa0\'\v\xe9\xa0\xf1 f\xaan\xcf\xb5i\xb6d\xbc\x92\v\xd58\x16\b\xb3_:\xa4!\ny\xc4&\nWMM\xa8\xc4\v\x9f\x01o\xf4\xab&\xb6\x17\x02P\xc3!N\xf4\b\x1a~\x91V1s\xe9\xbe\x9e\x9b\'\xcde\xb3\xa1\x86\"\xd7\x04\xf1\xc0!\xed\xff\xee$\xc89\x8cB0\xd1dD\xe0IP\x88\xa2\xf2Y\x9af$$\xf1cO\xf7P\xac\xca\x80:!\xb4\x94#\xcb^\x9f\'\x03\xe3\x93\xb9\x82\xbf\xcf\xc4\xe3\xf7\x03Oh\xf2r\xca\x8ff\xbb/\x9f*\xaf\x1a \xa5\xa0?%M\xa5\x86\x98\xf24\'1\xc7\f<\xcc@\xe8\x8a\xac.\xde\xe4\xc7\xf5\x9ck\xa40!\xe9\x14$\xb3\x05m\xb5m\xed\ft\x93\xd8\xa3\x80\'Y\xb9\x05\xbbt|\xbe\xbcz\n\xf3\xf5p\xf8\x9f~\x1b\xd0\v\x1cQ')
getsockopt$inet_IP_IPSEC_POLICY(r1, 0x0, 0x10, &(0x7f00000006c0)={{{@in6=@loopback}}, {{@in6=@initdev}}}, &(0x7f0000000500)=0xe8)
socketpair(0x2, 0x2000000080003, 0x100, &(0x7f0000000480))
syz_genetlink_get_family_id$SEG6(&(0x7f00000003c0)='SEG6\x00')
sendmsg$SEG6_CMD_DUMPHMAC(r5, &(0x7f0000000580)={&(0x7f0000000380)={0x10, 0x0, 0x0, 0x1000000}, 0xc, &(0x7f0000000200)={&(0x7f00000005c0)=ANY=[@ANYBLOB="2300260109447a0000000000000000660000001400001a0065a455e04ea56d0a47018c8e973bcac914471474a7e0d50a000eadd66d2e49a2ed40dcafa1e044ab6aacc2097d8f75bd9c8b8a220bdde116904efa3f9600f22ab388644f66c2d5baec4079a81bae1927e49e91a4964656d7b227702926af5be846f3de49fad39048633fd9161123894d9427f854a30cb0532c8f31f663380e40ce7f6cb15ec8baab3b7c6f"], 0x1}, 0x1, 0x0, 0x0, 0x8000}, 0x804)
r7 = creat(&(0x7f0000000280)='./bus\x00', 0x0)
arch_prctl$ARCH_MAP_VDSO_32(0x2002, 0x7e)
ftruncate(r7, 0x2008200)
open(&(0x7f0000000140)='./bus\x00', 0x4000, 0x0)

15:06:47 executing program 0:
r0 = socket$inet_udplite(0x2, 0x2, 0x88)
ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f3188b070")
syz_open_procfs(0x0, &(0x7f0000000940)='syscall\x00')
r1 = syz_open_procfs(0x0, &(0x7f0000000040)='fd\x00')
recvmmsg(0xffffffffffffffff, &(0x7f0000003840)=[{{0x0, 0x0, 0x0}}], 0x1, 0x0, 0x0)
perf_event_open(&(0x7f0000940000)={0x2, 0x70, 0xee6a, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x100, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0xff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x10001, 0x1}, 0x0, 0x400000000000000}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
mlock(&(0x7f00005b8000/0x3000)=nil, 0x3000)
ioctl$SNDRV_TIMER_IOCTL_SELECT(0xffffffffffffffff, 0x40345410, 0x0)
openat$uinput(0xffffffffffffff9c, &(0x7f0000000080)='/dev/uinput\x00', 0x2, 0x0)
mmap(&(0x7f000060b000/0x1000)=nil, 0x1000, 0x5, 0x8000400200000033, r1, 0x0)
perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x2, 0x9, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2000000, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x4000000, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8)
r2 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)={0x10b, 0x6, 0x209e1e, 0x3, 0x1}, 0x2c)
bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000b40)={r2, &(0x7f0000000040), 0x0, 0x1}, 0x20)
r3 = creat(&(0x7f0000000640)='./file0\x00', 0x100)
setsockopt$inet6_tcp_TCP_REPAIR_QUEUE(r3, 0x6, 0x14, &(0x7f0000000980), 0x4)
unlink(&(0x7f0000000940)='./file0\x00')
r4 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r5 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r5, 0x0)
ioctl$BINDER_GET_NODE_DEBUG_INFO(r4, 0xc018620b, &(0x7f0000000100))
ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f00000000c0)=ANY=[@ANYBLOB="bb8f0000"], 0x0, 0x0, 0x0})
shutdown(0xffffffffffffffff, 0x1)
ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)})
ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0x0, 0x0, &(0x7f0000000780)})
creat(&(0x7f00000000c0)='./file0\x00', 0x0)

15:06:47 executing program 3:
r0 = socket$inet_udplite(0x2, 0x2, 0x88)
ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f3188b070")
r1 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f00000003c0)})

15:06:47 executing program 2:
r0 = syz_open_procfs(0x0, &(0x7f00000000c0)='maps\x00')
lseek(r0, 0x1ffff, 0x0)
readv(r0, &(0x7f0000000640)=[{&(0x7f0000000000)=""/96, 0x60}], 0x1)
ioctl$sock_inet_tcp_SIOCOUTQ(r0, 0x5411, &(0x7f0000000080))

[ 1128.222266] binder_alloc: 2246: binder_alloc_buf failed to map pages in userspace, no vma
[ 1128.254818] binder: 2247:2256 transaction failed 29189/-3, size 24-8 line 3254
15:06:47 executing program 2:
r0 = syz_open_procfs(0x0, &(0x7f00000000c0)='maps\x00')
lseek(r0, 0x20000, 0x0)
readv(r0, &(0x7f0000000640)=[{&(0x7f0000000000)=""/96, 0x60}], 0x1)
syz_genetlink_get_family_id$team(&(0x7f0000001d00)='team\x00')
readv(r0, &(0x7f0000001cc0)=[{&(0x7f0000001b40)=""/69, 0x45}, {&(0x7f0000001bc0)=""/47, 0x2f}, {&(0x7f0000001c00)=""/154, 0x9a}], 0x3)
clock_gettime(0x0, &(0x7f0000001a40)={<r1=>0x0, <r2=>0x0})
recvmmsg(r0, &(0x7f0000001940)=[{{&(0x7f0000000140)=@ax25={{}, [@default, @remote, @null, @null, @bcast, @default, @null, @bcast]}, 0x80, &(0x7f0000000480)=[{&(0x7f00000001c0)=""/208, 0xd0}, {&(0x7f00000002c0)=""/74, 0x4a}, {&(0x7f0000000340)=""/70, 0x46}, {&(0x7f00000003c0)=""/177, 0xb1}], 0x4, &(0x7f00000004c0)=""/98, 0x62}, 0x3}, {{0x0, 0x0, &(0x7f00000005c0)=[{&(0x7f0000000540)=""/79, 0x4f}], 0x1, &(0x7f0000000680)=""/188, 0xbc}, 0x10001}, {{&(0x7f0000000740)=@pppol2tpv3in6={0x18, 0x1, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, {0xa, 0x0, 0x0, @loopback}}}, 0x80, &(0x7f0000000600)=[{&(0x7f00000007c0)=""/4096, 0x1000}], 0x1, &(0x7f00000017c0)=""/150, 0x96}, 0x1}, {{&(0x7f0000001880)=@nfc_llcp, 0x80, &(0x7f0000001900)}, 0x38}], 0x4, 0x40000120, &(0x7f0000001a80)={r1, r2+30000000})
r3 = getpgid(0xffffffffffffffff)
perf_event_open(&(0x7f0000001ac0)={0x5, 0x70, 0x21, 0x40, 0x3, 0x2d9, 0x0, 0xffff, 0x0, 0x0, 0x928, 0x5, 0x4c, 0x40, 0x0, 0x4, 0x1, 0x7fffffff, 0x9, 0x7, 0x7ff, 0x8, 0x178, 0x20, 0x7ff, 0x5, 0x5, 0x0, 0xece, 0x80000001, 0x400, 0xb323, 0xe4, 0x2, 0x9c, 0xc4c, 0x2, 0x0, 0x0, 0x4, 0x0, @perf_bp={&(0x7f0000001900), 0x4}, 0x4, 0x4, 0x0, 0x0, 0x100000000, 0x6, 0x9c}, r3, 0xc, r0, 0x2)
ioctl$BLKGETSIZE(r0, 0x1260, &(0x7f0000000100))

15:06:47 executing program 4:
r0 = socket$inet_udplite(0x2, 0x2, 0x88)
ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f3188b070")
r1 = syz_open_procfs(0x0, &(0x7f0000000080)='net/dev_mcast\x00')
lseek(r1, 0x20000, 0x0)
fcntl$setstatus(r1, 0x4, 0x400)

15:06:47 executing program 3:
r0 = socket$inet_udplite(0x2, 0x2, 0x88)
ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f3188b070")
r1 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x0, 0x0, &(0x7f0000000300), 0x0, 0x0, &(0x7f00000003c0)})

[ 1128.283125] binder: 2247:2263 BC_INCREFS_DONE u0000000000000000 no match
[ 1128.294843] binder: 2249:2257 unknown command 36795
[ 1128.309637] binder: 2249:2257 ioctl c0306201 20000140 returned -22
15:06:47 executing program 1:
r0 = socket$inet_udplite(0x2, 0x2, 0x88)
ioctl(r0, 0x0, &(0x7f0000000000)="0adc1f123c123f3188b070")
recvmmsg(0xffffffffffffffff, &(0x7f0000003840)=[{{0x0, 0x0, 0x0}}], 0x1, 0x0, 0x0)
r1 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)={0x10b, 0x6, 0x209e1e, 0x3, 0x1}, 0x2c)
bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000b40)={r1, &(0x7f0000000040), 0x0, 0x1}, 0x20)
r2 = creat(&(0x7f0000000640)='./file0\x00', 0x100)
setsockopt$inet6_tcp_TCP_REPAIR_QUEUE(r2, 0x6, 0x14, &(0x7f0000000980), 0x4)
unlink(&(0x7f0000000940)='./file0\x00')
r3 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_GET_NODE_DEBUG_INFO(r3, 0xc018620b, &(0x7f0000000100))
ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)})
ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0x0, 0x0, &(0x7f0000000780)})

[ 1128.326848] binder: 2249:2257 transaction failed 29189/-22, size 24-8 line 3117
[ 1128.337968] binder: 2249:2257 BC_INCREFS_DONE u0000000000000000 no match
15:06:47 executing program 3:
r0 = socket$inet_udplite(0x2, 0x2, 0x88)
ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f3188b070")
r1 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x0, 0x0, &(0x7f0000000300), 0x0, 0x0, &(0x7f00000003c0)})

[ 1128.392794] binder_alloc: 2269: binder_alloc_buf failed to map pages in userspace, no vma
[ 1128.409260] binder: 2270:2274 transaction failed 29189/-3, size 24-8 line 3254
15:06:47 executing program 0:
r0 = socket$inet_udplite(0x2, 0x2, 0x88)
ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f3188b070")
syz_open_procfs(0x0, &(0x7f0000000940)='syscall\x00')
r1 = syz_open_procfs(0x0, &(0x7f0000000040)='fd\x00')
recvmmsg(0xffffffffffffffff, &(0x7f0000003840)=[{{0x0, 0x0, 0x0}}], 0x1, 0x0, 0x0)
perf_event_open(&(0x7f0000940000)={0x2, 0x70, 0xee6a, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x100, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0xff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x10001, 0x1}, 0x0, 0x400000000000000}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
mlock(&(0x7f00005b8000/0x3000)=nil, 0x3000)
ioctl$SNDRV_TIMER_IOCTL_SELECT(0xffffffffffffffff, 0x40345410, 0x0)
openat$uinput(0xffffffffffffff9c, &(0x7f0000000080)='/dev/uinput\x00', 0x2, 0x0)
mmap(&(0x7f000060b000/0x1000)=nil, 0x1000, 0x5, 0x8000400200000033, r1, 0x0)
perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x2, 0x9, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2000000, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x4000000, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8)
r2 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)={0x10b, 0x6, 0x209e1e, 0x3, 0x1}, 0x2c)
bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000b40)={r2, &(0x7f0000000040), 0x0, 0x1}, 0x20)
r3 = creat(&(0x7f0000000640)='./file0\x00', 0x100)
setsockopt$inet6_tcp_TCP_REPAIR_QUEUE(r3, 0x6, 0x14, &(0x7f0000000980), 0x4)
unlink(&(0x7f0000000940)='./file0\x00')
r4 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r5 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r5, 0x0)
ioctl$BINDER_GET_NODE_DEBUG_INFO(r4, 0xc018620b, &(0x7f0000000100))
ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f00000000c0)=ANY=[@ANYBLOB="bb8f0000"], 0x0, 0x0, 0x0})
shutdown(0xffffffffffffffff, 0x1)
ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)})
ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0x0, 0x0, &(0x7f0000000780)})
creat(&(0x7f00000000c0)='./file0\x00', 0x0)

15:06:47 executing program 1:
r0 = socket$inet_udplite(0x2, 0x2, 0x88)
ioctl(r0, 0x0, &(0x7f0000000000)="0adc1f123c123f3188b070")
recvmmsg(0xffffffffffffffff, &(0x7f0000003840)=[{{0x0, 0x0, 0x0}}], 0x1, 0x0, 0x0)
r1 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)={0x10b, 0x6, 0x209e1e, 0x3, 0x1}, 0x2c)
bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000b40)={r1, &(0x7f0000000040), 0x0, 0x1}, 0x20)
r2 = creat(&(0x7f0000000640)='./file0\x00', 0x100)
setsockopt$inet6_tcp_TCP_REPAIR_QUEUE(r2, 0x6, 0x14, &(0x7f0000000980), 0x4)
unlink(&(0x7f0000000940)='./file0\x00')
r3 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_GET_NODE_DEBUG_INFO(r3, 0xc018620b, &(0x7f0000000100))
ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)})
ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0x0, 0x0, &(0x7f0000000780)})

15:06:47 executing program 2:
r0 = syz_open_procfs(0x0, &(0x7f00000000c0)='maps\x00')
lseek(r0, 0x20000, 0x0)
readv(r0, &(0x7f0000000640)=[{&(0x7f0000000000)=""/96, 0x60}], 0x1)
fcntl$getownex(r0, 0x10, &(0x7f0000000080)={0x0, <r1=>0x0})
ioctl$BLKTRACESETUP(r0, 0xc0481273, &(0x7f0000000100)={[], 0x9, 0x2, 0x401, 0x4, 0x3f1c, r1})
setsockopt$IP6T_SO_SET_REPLACE(r0, 0x29, 0x40, &(0x7f0000000680)=@security={'security\x00', 0xe, 0x4, 0x4b8, 0x160, 0x2b0, 0x0, 0x2b0, 0x0, 0x3e8, 0x3e8, 0x3e8, 0x3e8, 0x3e8, 0x4, &(0x7f0000000180), {[{{@uncond, 0x0, 0x138, 0x160, 0x0, {}, [@common=@icmp6={0x28, 'icmp6\x00', 0x0, {0xe, 0x7fffffff, 0x10001, 0x1}}, @common=@hbh={0x48, 'hbh\x00', 0x0, {0xe9, 0x1, 0x1, [0x3, 0x277c, 0x6d3, 0x4, 0xfe64, 0xfff, 0x12b2, 0xd2dd, 0x3, 0x4, 0x0, 0x4, 0x65, 0x9, 0x6291]}}]}, @common=@unspec=@NFQUEUE2={0x28, 'NFQUEUE\x00', 0x2, {0x8, 0xffffffffffffffb2, 0x1}}}, {{@ipv6={@mcast1, @rand_addr="bb5257343dc22991f8c13513a33de59b", [0xffffffff, 0xff0000ff, 0xffffffff, 0xffffff00], [0xff000000, 0xffffffff, 0xff], 'nlmon0\x00', 'nlmon0\x00', {0xff}, {0xff}, 0x0, 0x9, 0x3, 0x54}, 0x0, 0x128, 0x150, 0x0, {}, [@common=@unspec=@realm={0x30, 'realm\x00', 0x0, {0x8, 0x81}}, @common=@ah={0x30, 'ah\x00', 0x0, {0x4d5, 0x4d3, 0x5d, 0xfffffffffffffe01, 0x3}}]}, @common=@unspec=@AUDIT={0x28, 'AUDIT\x00'}}, {{@uncond, 0x0, 0xc8, 0x138}, @common=@unspec=@NFLOG={0x70, 'NFLOG\x00', 0x0, {0x2, 0x10001, 0x26, 0x0, 0x0, "d09620ac6d2884735c352f805222f1ed0bb546b37ad529471665e8d046f363961d51a451452e65d2fa43afec1c82125267d805969927bbd77175638b85726340"}}}], {{[], 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x518)

[ 1128.438082] binder: 2270:2274 BC_INCREFS_DONE u0000000000000000 no match
[ 1128.563632] binder: 2289:2292 transaction failed 29189/-22, size 24-8 line 3117
[ 1128.578279] binder: 2289:2292 BC_INCREFS_DONE u0000000000000000 no match
15:06:47 executing program 3:
r0 = socket$inet_udplite(0x2, 0x2, 0x88)
ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f3188b070")
r1 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x0, 0x0, &(0x7f0000000300), 0x0, 0x0, &(0x7f00000003c0)})

15:06:47 executing program 4:
r0 = accept4$inet6(0xffffffffffffffff, &(0x7f00000000c0)={0xa, 0x0, 0x0, @mcast2}, &(0x7f0000000100)=0x1c, 0x80800)
fcntl$F_SET_RW_HINT(r0, 0x40c, &(0x7f0000000140)=0x7)
r1 = socket$inet_udplite(0x2, 0x2, 0x88)
ioctl(r1, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f3188b070")
r2 = syz_open_procfs(0x0, &(0x7f0000000080)='net/dev_mcast\x00')
lseek(r2, 0x20000, 0x0)
openat$cgroup_ro(r2, &(0x7f0000000040)='cpuacct.usage_percpu\x00', 0x0, 0x0)

15:06:47 executing program 2:
r0 = syz_open_procfs(0x0, &(0x7f00000000c0)='maps\x00')
setsockopt$SO_ATTACH_FILTER(r0, 0x1, 0x1a, &(0x7f0000000100)={0x2, &(0x7f0000000080)=[{0x5, 0xea2, 0x2, 0x5565}, {0x0, 0x9, 0xa9, 0x80000000}]}, 0x10)
lseek(r0, 0x20004, 0x0)
readv(r0, &(0x7f0000000640)=[{&(0x7f0000000000)=""/96, 0x60}], 0x1)

15:06:47 executing program 5:
r0 = socket$inet_udplite(0x2, 0x2, 0x88)
ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f3188b070")
syz_open_procfs(0x0, &(0x7f0000000940)='syscall\x00')
r1 = syz_open_procfs(0x0, &(0x7f0000000040)='fd\x00')
recvmmsg(0xffffffffffffffff, &(0x7f0000003840)=[{{0x0, 0x0, 0x0}}], 0x1, 0x0, 0x0)
perf_event_open(&(0x7f0000940000)={0x2, 0x70, 0xee6a, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x100, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0xff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x10001, 0x1}, 0x0, 0x400000000000000}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
mlock(&(0x7f00005b8000/0x3000)=nil, 0x3000)
ioctl$SNDRV_TIMER_IOCTL_SELECT(0xffffffffffffffff, 0x40345410, 0x0)
openat$uinput(0xffffffffffffff9c, &(0x7f0000000080)='/dev/uinput\x00', 0x2, 0x0)
mmap(&(0x7f000060b000/0x1000)=nil, 0x1000, 0x5, 0x8000400200000033, r1, 0x0)
unshare(0xfffffffffffffffd)
r2 = getpid()
sched_setscheduler(r2, 0x5, &(0x7f00000000c0))
open$dir(&(0x7f0000000400)='./file0\x00', 0x0, 0x0)
perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f00000004c0), 0x2}, 0x0, 0x0, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r3 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000340)='memory.current\x00', 0x0, 0x0)
ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, 0x0)
socketpair(0x2000000000001, 0x80010, 0x7d, &(0x7f0000000100)={<r4=>0xffffffffffffffff, <r5=>0xffffffffffffffff})
ioctl$PERF_EVENT_IOC_SET_FILTER(r5, 0x8914, &(0x7f0000000300)='lo\x00\x96o\xd6Q\xb9Y\xa9\xc8J,\x00\xd2\x97\x04\x03\xdc\r')
close(r3)
rt_sigprocmask(0x2, &(0x7f0000000240)={0x6}, &(0x7f00000002c0), 0x8)
ioctl$PERF_EVENT_IOC_SET_FILTER(r5, 0x8923, &(0x7f00000008c0)='lo\x00\x96o8\x0fd\xa1\xe3\xd7]b}\x1f\xa1Y\xad4\x90\x9d`\xd2\x98\x00\x00\x00 \'Y\x17]\x15c\xcaR\xdd\x98OC\x89\x1b\xe7\x84\xe2\x05\x80w\xd2|D\x8dK\x14Bx\xcbuH\xc2\xeec\xbf<>Y\x1a\xfc\x1f9OB\x81\x89\x186\xc5q@n\xb4\xb6s\xb0\x00\x00\xfc\x00\x00\b\x00\x00\xda\xef\xecE\xec\xd5I\xb2\x9b\xfe\x8d\x90?\x00\xe9\xe4~g:\xc1\xb2aj\x96\xbb\xa7\xe2\xc0\xdc\xf9Q\b\xeb\x16\x7fT\x11\xd3\r7\xe6\"f\xcf\x8e\xabd\x0ftp\x82\xae\xd2\x15\x8e+c\xf6\xbf\xe14>\xa6-\xa5c\xde\xd7\xab\xea\x1f\xf8s2\x9cVF\xd5\x18\xfe\x0e\x8f \x01\x00\x00y.\xfc*\x82\xa5\xa1p5\xc8{\xf7\xef\xab\xe8\x99\xebw#\x8at\x1c\x80\xfc\xb0\x95\xa2\xa7\xd7,Y]E8\x83X\xf5F\xdc\x88-\xf5\xb0\xb5^\xdb\x1a\xb6\xaa\x14\xe2\xb9\rh^J-\xd1\xbaUn\x04\'l\x1b\xe0o\xdb\xc8\x91%\x1c\xb5\xbf\xb6\x90\xb4\xc2\x7f]/\xb3\xe7\xc9\'\x94\xcfIo\xdf\x04\x95\xb5\x06\x84\x1fH>\xda\xc5\x04 \x94\x88\xeb\'\xd4;6\x7f\xd9\x99-\x1b|G\x8d\xd4\xb9%\xaaQ\xa0K\x10\x03\x93\xe1\xcc\xe7m\x80\'\xf0\xa5\xed(\r\xa8\x0f&\xb1\xf3\xff0\f\x82%_\x92\x8bD\xb9\xd9\xe7\xf2\xe4\xc1i#\xdc\x87A\xb9\xc7\r\x92\xfa\x11\x11\xb5\x1f\x03\x9d\xdd\x1bj\xdf\xacg\xe3\xa0S\xd3\x8a\xe1n\x97\xea\xf5\xa0\'\v\xe9\xa0\xf1 f\xaan\xcf\xb5i\xb6d\xbc\x92\v\xd58\x16\b\xb3_:\xa4!\ny\xc4&\nWMM\xa8\xc4\v\x9f\x01o\xf4\xab&\xb6\x17\x02P\xc3!N\xf4\b\x1a~\x91V1s\xe9\xbe\x9e\x9b\'\xcde\xb3\xa1\x86\"\xd7\x04\xf1\xc0!\xed\xff\xee$\xc89\x8cB0\xd1dD\xe0IP\x88\xa2\xf2Y\x9af$$\xf1cO\xf7P\xac\xca\x80:!\xb4\x94#\xcb^\x9f\'\x03\xe3\x93\xb9\x82\xbf\xcf\xc4\xe3\xf7\x03Oh\xf2r\xca\x8ff\xbb/\x9f*\xaf\x1a \xa5\xa0?%M\xa5\x86\x98\xf24\'1\xc7\f<\xcc@\xe8\x8a\xac.\xde\xe4\xc7\xf5\x9ck\xa40!\xe9\x14$\xb3\x05m\xb5m\xed\ft\x93\xd8\xa3\x80\'Y\xb9\x05\xbbt|\xbe\xbcz\n\xf3\xf5p\xf8\x9f~\x1b\xd0\v\x1cQ')
getsockopt$inet_IP_IPSEC_POLICY(r1, 0x0, 0x10, &(0x7f00000006c0)={{{@in6=@loopback}}, {{@in6=@initdev}}}, &(0x7f0000000500)=0xe8)
socketpair(0x2, 0x2000000080003, 0x100, &(0x7f0000000480))
syz_genetlink_get_family_id$SEG6(&(0x7f00000003c0)='SEG6\x00')
sendmsg$SEG6_CMD_DUMPHMAC(r4, &(0x7f0000000580)={&(0x7f0000000380)={0x10, 0x0, 0x0, 0x1000000}, 0xc, &(0x7f0000000440)={&(0x7f00000005c0)=ANY=[@ANYBLOB="2300260109447a0000000000000000660000001400001a0065a455e04ea56d0a47018c8e973bcac914471474a7e0d50a000eadd66d2e49a2ed40dcafa1e046ab6aacc2097d8f75bd9c8b8a220bdde116904efa3f9600f22ab388644f66c2d5baec4079a81bae1927e49e91a4964656d7b227702926af5be846f3de49fad39048633fd9161123894d9427f854a30cb0532c8f31f663380e40ce7f6cb15ec8baab3b7c6f"], 0x1}, 0x1, 0x0, 0x0, 0x8000}, 0x804)
r6 = creat(&(0x7f0000000280)='./bus\x00', 0x0)
arch_prctl$ARCH_MAP_VDSO_32(0x2002, 0x7e)
ftruncate(r6, 0x2008200)
open(&(0x7f0000000140)='./bus\x00', 0x4000, 0x0)

15:06:47 executing program 1:
r0 = socket$inet_udplite(0x2, 0x2, 0x88)
ioctl(r0, 0x1000008912, 0x0)
recvmmsg(0xffffffffffffffff, &(0x7f0000003840)=[{{0x0, 0x0, 0x0}}], 0x1, 0x0, 0x0)
r1 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)={0x10b, 0x6, 0x209e1e, 0x3, 0x1}, 0x2c)
bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000b40)={r1, &(0x7f0000000040), 0x0, 0x1}, 0x20)
r2 = creat(&(0x7f0000000640)='./file0\x00', 0x100)
setsockopt$inet6_tcp_TCP_REPAIR_QUEUE(r2, 0x6, 0x14, &(0x7f0000000980), 0x4)
unlink(&(0x7f0000000940)='./file0\x00')
r3 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_GET_NODE_DEBUG_INFO(r3, 0xc018620b, &(0x7f0000000100))
ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)})
ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0x0, 0x0, &(0x7f0000000780)})

15:06:47 executing program 0:
r0 = socket$inet_udplite(0x2, 0x2, 0x88)
ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f3188b070")
syz_open_procfs(0x0, &(0x7f0000000940)='syscall\x00')
r1 = syz_open_procfs(0x0, &(0x7f0000000040)='fd\x00')
recvmmsg(0xffffffffffffffff, &(0x7f0000003840)=[{{0x0, 0x0, 0x0}}], 0x1, 0x0, 0x0)
perf_event_open(&(0x7f0000940000)={0x2, 0x70, 0xee6a, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x100, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0xff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x10001, 0x1}, 0x0, 0x400000000000000}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
mlock(&(0x7f00005b8000/0x3000)=nil, 0x3000)
ioctl$SNDRV_TIMER_IOCTL_SELECT(0xffffffffffffffff, 0x40345410, 0x0)
openat$uinput(0xffffffffffffff9c, &(0x7f0000000080)='/dev/uinput\x00', 0x2, 0x0)
mmap(&(0x7f000060b000/0x1000)=nil, 0x1000, 0x5, 0x8000400200000033, r1, 0x0)
perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x2, 0x9, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2000000, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x4000000, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8)
r2 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)={0x10b, 0x6, 0x209e1e, 0x3, 0x1}, 0x2c)
bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000b40)={r2, &(0x7f0000000040), 0x0, 0x1}, 0x20)
r3 = creat(&(0x7f0000000640)='./file0\x00', 0x100)
setsockopt$inet6_tcp_TCP_REPAIR_QUEUE(r3, 0x6, 0x14, &(0x7f0000000980), 0x4)
unlink(&(0x7f0000000940)='./file0\x00')
r4 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r5 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r5, 0x0)
ioctl$BINDER_GET_NODE_DEBUG_INFO(r4, 0xc018620b, &(0x7f0000000100))
ioctl$BINDER_SET_CONTEXT_MGR(r5, 0x40046207, 0x0)
shutdown(0xffffffffffffffff, 0x1)
ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)})
ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0x0, 0x0, &(0x7f0000000780)})
creat(&(0x7f00000000c0)='./file0\x00', 0x0)

[ 1128.641416] binder: 2286:2290 unknown command 36795
[ 1128.649733] binder: 2286:2290 ioctl c0306201 20000140 returned -22
[ 1128.662972] binder: 2286:2290 transaction failed 29189/-22, size 24-8 line 3117
[ 1128.674651] binder: 2286:2290 BC_INCREFS_DONE u0000000000000000 no match
15:06:47 executing program 3:
r0 = socket$inet_udplite(0x2, 0x2, 0x88)
ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f3188b070")
r1 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, &(0x7f00000003c0)})

[ 1128.752769] binder_alloc: 2301: binder_alloc_buf failed to map pages in userspace, no vma
[ 1128.783423] binder: 2303:2306 transaction failed 29189/-3, size 24-8 line 3254
15:06:47 executing program 2:
r0 = syz_open_procfs(0x0, &(0x7f00000000c0)='maps\x00')
lseek(r0, 0x20000, 0x0)
r1 = syz_genetlink_get_family_id$tipc(&(0x7f0000000380)='TIPC\x00')
sendmsg$TIPC_CMD_GET_MAX_PORTS(r0, &(0x7f00000001c0)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x10000}, 0xc, &(0x7f0000000180)={&(0x7f0000000140)={0x1c, r1, 0x400, 0x70bd2d, 0x25dfdbfd, {}, ["", ""]}, 0x1c}, 0x1, 0x0, 0x0, 0x40040}, 0x8004)
ioctl$UI_SET_PROPBIT(r0, 0x4004556e, 0x1c)
readv(r0, &(0x7f0000000640)=[{&(0x7f0000000000)=""/96, 0x60}], 0x1)

15:06:47 executing program 4:
r0 = socket$inet_udplite(0x2, 0x2, 0x88)
ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f3188b070")
ioctl(r0, 0x0, &(0x7f00000000c0)="0d5e4822268044641e6ca830f7e1024af2f7e78c4d8c798af58193fcccbb6f241b2d6f0541cda5aa0a473a1cbfad37d914246554d909fa1bbff35d9bd85210c685430cd65854249f055beac133135ce7fda1610b701283c637ae9ded4951b03baa25bd8ef6326108c64cf15dad1effab74eb19b088671ffb24add4f3978ea8b6742e1344a13e25b7ae17a183cc777a2db8c0221d376415d1c5003e4ce67b9b194a9e06a606db6e6897abdd8f1b01aff8a5bae0ae14de79")
r1 = syz_open_procfs(0x0, &(0x7f0000000080)='net/dev_mcast\x00')
mmap(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x2, 0x1030, r0, 0x1f)
fsetxattr$security_selinux(r0, &(0x7f0000000040)='security.selinux\x00', &(0x7f0000000180)='system_u:object_r:crontab_exec_t:s0\x00', 0x24, 0x3)
lseek(r1, 0x20000, 0x0)

15:06:47 executing program 1:
r0 = socket$inet_udplite(0x2, 0x2, 0x88)
ioctl(r0, 0x1000008912, 0x0)
recvmmsg(0xffffffffffffffff, &(0x7f0000003840)=[{{0x0, 0x0, 0x0}}], 0x1, 0x0, 0x0)
r1 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)={0x10b, 0x6, 0x209e1e, 0x3, 0x1}, 0x2c)
bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000b40)={r1, &(0x7f0000000040), 0x0, 0x1}, 0x20)
r2 = creat(&(0x7f0000000640)='./file0\x00', 0x100)
setsockopt$inet6_tcp_TCP_REPAIR_QUEUE(r2, 0x6, 0x14, &(0x7f0000000980), 0x4)
unlink(&(0x7f0000000940)='./file0\x00')
r3 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_GET_NODE_DEBUG_INFO(r3, 0xc018620b, &(0x7f0000000100))
ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)})
ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0x0, 0x0, &(0x7f0000000780)})

15:06:47 executing program 3:
r0 = socket$inet_udplite(0x2, 0x2, 0x88)
ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f3188b070")
r1 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, &(0x7f00000003c0)})

[ 1128.808202] binder: 2303:2319 BC_INCREFS_DONE u0000000000000000 no match
[ 1128.827291] binder: 2317:2320 got transaction with invalid offset (0, min 0 max 0) or object.
[ 1128.837214] binder: 2317:2320 transaction failed 29201/-22, size 0-8 line 3348
[ 1128.850581] binder: undelivered TRANSACTION_ERROR: 29201
[ 1128.899711] audit: type=1400 audit(1553699207.749:120): avc:  denied  { relabelto } for  pid=2323 comm="syz-executor.4" name="UDP-Lite" dev="sockfs" ino=196609 scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=system_u:object_r:crontab_exec_t:s0 tclass=rawip_socket permissive=1
15:06:47 executing program 2:
getresgid(&(0x7f0000000100)=<r0=>0x0, &(0x7f0000000140), &(0x7f0000000180))
getsockopt$sock_cred(0xffffffffffffff9c, 0x1, 0x11, &(0x7f00000001c0)={0x0, 0x0, <r1=>0x0}, &(0x7f0000000200)=0xc)
getresgid(&(0x7f0000000240), &(0x7f0000000280)=<r2=>0x0, &(0x7f00000002c0))
stat(&(0x7f0000000300)='./file0\x00', &(0x7f0000000340)={0x0, 0x0, 0x0, 0x0, 0x0, <r3=>0x0})
getgroups(0x9, &(0x7f00000003c0)=[0x0, <r4=>0xffffffffffffffff, 0xee00, 0xee01, 0x0, 0xee01, 0xee00, 0xffffffffffffffff, 0x0])
getgroups(0x5, &(0x7f0000000400)=[r0, r1, r2, r3, r4])
r5 = syz_open_procfs(0x0, &(0x7f00000000c0)='maps\x00')
lseek(r5, 0x20000, 0x0)
readv(r5, &(0x7f0000000640)=[{&(0x7f0000000000)=""/96, 0x60}], 0x1)
write$P9_RUNLINKAT(r5, &(0x7f0000000080)={0x7, 0x4d, 0x1}, 0x7)

15:06:47 executing program 4:
r0 = socket$inet_udplite(0x2, 0x2, 0x88)
ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f3188b070")
r1 = syz_open_procfs(0x0, &(0x7f0000000080)='net/dev_mcast\x00')
vmsplice(r0, &(0x7f0000000040)=[{&(0x7f00000000c0)="1f1d06f6791cccb664731647f6ff932eff6625959d2ea37e89f07bc5ed7e1aa11d32e88e26ea4fe3868475e766c1effc8f3c5c1242489c762ae33f646e8788d5b70b0e307048fc16ac7b6aacc8a8feb0a7b01349acdb1e344db45f7b266db3b2de2e9e955330a526f472a7df4a1920ad255fd329cd304b6472aaaa326cb89e02638a969bb26792bbcf1a122221c9f2fa4aed6e9edc01bddda4b1bd5e604cb6660b0e6d6c7d95a2024b87cf49c05131b7b2385fef6bc7358af374", 0xba}], 0x1, 0xf)
ioctl$FS_IOC_GETFLAGS(r1, 0x80086601, &(0x7f0000000180))
lseek(r1, 0x20000, 0x0)

15:06:47 executing program 3:
r0 = socket$inet_udplite(0x2, 0x2, 0x88)
ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f3188b070")
r1 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, &(0x7f00000003c0)})

[ 1128.945089] binder: 2314:2321 BC_INCREFS_DONE node 1413 has no pending increfs request
[ 1128.962215] binder: BINDER_SET_CONTEXT_MGR already set
[ 1128.968239] binder: 2330:2335 ioctl 40046207 0 returned -16
[ 1128.977558] binder: release 2330:2335 transaction 1415 out, still active
[ 1128.987593] binder: undelivered TRANSACTION_COMPLETE
15:06:47 executing program 2:
r0 = syz_open_procfs(0x0, &(0x7f00000000c0)='maps\x00')
lseek(r0, 0x20000, 0x0)
socket$inet_tcp(0x2, 0x1, 0x0)
getsockopt$inet_mreq(r0, 0x0, 0x24, &(0x7f0000000080)={@local, @local}, &(0x7f0000000100)=0x8)
readv(r0, &(0x7f0000000640)=[{&(0x7f0000000000)=""/96, 0x60}], 0x1)

[ 1129.047512] binder: 2328:2342 BC_INCREFS_DONE node 1417 has no pending increfs request
[ 1129.072340] binder: BINDER_SET_CONTEXT_MGR already set
[ 1129.078286] binder: 2341:2345 ioctl 40046207 0 returned -16
[ 1129.086779] binder: release 2341:2345 transaction 1419 out, still active
[ 1129.097071] binder: undelivered TRANSACTION_COMPLETE
15:06:48 executing program 5:
r0 = socket$inet_udplite(0x2, 0x2, 0x88)
ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f3188b070")
syz_open_procfs(0x0, &(0x7f0000000940)='syscall\x00')
r1 = syz_open_procfs(0x0, &(0x7f0000000040)='fd\x00')
recvmmsg(0xffffffffffffffff, &(0x7f0000003840)=[{{0x0, 0x0, 0x0}}], 0x1, 0x0, 0x0)
perf_event_open(&(0x7f0000940000)={0x2, 0x70, 0xee6a, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x100, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0xff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x10001, 0x1}, 0x0, 0x400000000000000}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
mlock(&(0x7f00005b8000/0x3000)=nil, 0x3000)
ioctl$SNDRV_TIMER_IOCTL_SELECT(0xffffffffffffffff, 0x40345410, 0x0)
openat$uinput(0xffffffffffffff9c, &(0x7f0000000080)='/dev/uinput\x00', 0x2, 0x0)
mmap(&(0x7f000060b000/0x1000)=nil, 0x1000, 0x5, 0x8000400200000033, r1, 0x0)
unshare(0xfffffffffffffffd)
r2 = getpid()
sched_setscheduler(r2, 0x5, &(0x7f00000000c0))
open$dir(&(0x7f0000000400)='./file0\x00', 0x0, 0x0)
perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f00000004c0), 0x2}, 0x0, 0x0, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000340)='memory.current\x00', 0x0, 0x0)
ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, 0x0)
socketpair(0x1, 0x20000000000001, 0x0, &(0x7f0000000100)={<r3=>0xffffffffffffffff, <r4=>0xffffffffffffffff})
ioctl$PERF_EVENT_IOC_SET_FILTER(r4, 0x8914, &(0x7f0000000300)='lo\x00\x96o\xd6Q\xb9Y\xa9\xc8J,\x00\xd2\x97\x04\x03\xdc\r')
close(r4)
rt_sigprocmask(0x2, &(0x7f0000000240)={0x6}, &(0x7f00000002c0), 0x8)
ioctl$PERF_EVENT_IOC_SET_FILTER(r4, 0x8923, &(0x7f00000008c0)='lo\x00\x96o8\x0fd\xa1\xe3\xd7]b}\x1f\xa1Y\xad4\x90\x9d`\xd2\x98\x00\x00\x00 \'Y\x17]\x15c\xcaR\xdd\x98OC\x89\x1b\xe7\x84\xe2\x05\x80w\xd2|D\x8dK\x14Bx\xcbuH\xc2\xeec\xbf<>Y\x1a\xfc\x1f9OB\x81\x89\x186\xc5q@n\xb4\xb6s\xb0\x00\x00\xfc\x00\x00\b\x00\x00\xda\xef\xecE\xec\xd5I\xb2\x9b\xfe\x8d\x90?\x00\xe9\xe4~g:\xc1\xb2aj\x96\xbb\xa7\xe2\xc0\xdc\xf9Q\b\xeb\x16\x7fT\x11\xd3\r7\xe6\"f\xcf\x8e\xabd\x0ftp\x82\xae\xd2\x15\x8e+c\xf6\xbf\xe14>\xa6-\xa5c\xde\xd7\xab\xea\x1f\xf8s2\x9cVF\xd5\x18\xfe\x0e\x8f \x01\x00\x00y.\xfc*\x82\xa5\xa1p5\xc8{\xf7\xef\xab\xe8\x99\xebw#\x8at\x1c\x80\xfc\xb0\x95\xa2\xa7\xd7,Y]E8\x83X\xf5F\xdc\x88-\xf5\xb0\xb5^\xdb\x1a\xb6\xaa\x14\xe2\xb9\rh^J-\xd1\xbaUn\x04\'l\x1b\xe0o\xdb\xc8\x91%\x1c\xb5\xbf\xb6\x90\xb4\xc2\x7f]/\xb3\xe7\xc9\'\x94\xcfIo\xdf\x04\x95\xb5\x06\x84\x1fH>\xda\xc5\x04 \x94\x88\xeb\'\xd4;6\x7f\xd9\x99-\x1b|G\x8d\xd4\xb9%\xaaQ\xa0K\x10\x03\x93\xe1\xcc\xe7m\x80\'\xf0\xa5\xed(\r\xa8\x0f&\xb1\xf3\xff0\f\x82%_\x92\x8bD\xb9\xd9\xe7\xf2\xe4\xc1i#\xdc\x87A\xb9\xc7\r\x92\xfa\x11\x11\xb5\x1f\x03\x9d\xdd\x1bj\xdf\xacg\xe3\xa0S\xd3\x8a\xe1n\x97\xea\xf5\xa0\'\v\xe9\xa0\xf1 f\xaan\xcf\xb5i\xb6d\xbc\x92\v\xd58\x16\b\xb3_:\xa4!\ny\xc4&\nWMM\xa8\xc4\v\x9f\x01o\xf4\xab&\xb6\x17\x02P\xc3!N\xf4\b\x1a~\x91V1s\xe9\xbe\x9e\x9b\'\xcde\xb3\xa1\x86\"\xd7\x04\xf1\xc0!\xed\xff\xee$\xc89\x8cB0\xd1dD\xe0IP\x88\xa2\xf2Y\x9af$$\xf1cO\xf7P\xac\xca\x80:!\xb4\x94#\xcb^\x9f\'\x03\xe3\x93\xb9\x82\xbf\xcf\xc4\xe3\xf7\x03Oh\xf2r\xca\x8ff\xbb/\x9f*\xaf\x1a \xa5\xa0?%M\xa5\x86\x98\xf24\'1\xc7\f<\xcc@\xe8\x8a\xac.\xde\xe4\xc7\xf5\x9ck\xa40!\xe9\x14$\xb3\x05m\xb5m\xed\ft\x93\xd8\xa3\x80\'Y\xb9\x05\xbbt|\xbe\xbcz\n\xf3\xf5p\xf8\x9f~\x1b\xd0\v\x1cQ')
getsockopt$inet_IP_IPSEC_POLICY(r1, 0x0, 0x10, &(0x7f00000006c0)={{{@in6=@loopback}}, {{@in6=@initdev}}}, &(0x7f0000000500)=0xe8)
socketpair(0x2, 0x2000000080003, 0x100, &(0x7f0000000480))
syz_genetlink_get_family_id$SEG6(&(0x7f00000003c0)='SEG6\x00')
sendmsg$SEG6_CMD_DUMPHMAC(r3, &(0x7f0000000580)={&(0x7f0000000380)={0x10, 0x0, 0x0, 0x1000000}, 0xc, &(0x7f0000000440)={&(0x7f00000005c0)=ANY=[@ANYBLOB="2300260109447a0000000000000000660000001400001a0065a455e04ea56d0a47018c8e973bcac914471474a7e0d50a000eadd66d2e49a2ed40dcafa1e046ab6aacc2097d8f75bd9c8b8a220bdde116904efa3f9600f22ab388644f66c2d5baec4079a81bae1927e49e91a4964656d7b227702926af5be846f3de49fad39048633fd9161123894d9427f854a30cb0532c8f31f663380e40ce7f6cb15ec8baab3b7c6f"], 0x1}, 0x1, 0x0, 0x0, 0x8000}, 0x804)
r5 = creat(&(0x7f0000000280)='./bus\x00', 0x0)
arch_prctl$ARCH_MAP_VDSO_32(0x2002, 0x7e)
ftruncate(r5, 0x2008200)
open(&(0x7f0000000140)='./bus\x00', 0x4000, 0x0)

15:06:48 executing program 4:
r0 = socket$inet_udplite(0x2, 0x2, 0x88)
ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f3188b070")
r1 = syz_open_procfs(0x0, &(0x7f0000000080)='net/dev_mcast\x00')
write$UHID_DESTROY(r1, &(0x7f0000000040), 0x4)
lseek(r1, 0x20000, 0x0)

15:06:48 executing program 0:
r0 = socket$inet_udplite(0x2, 0x2, 0x88)
ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f3188b070")
syz_open_procfs(0x0, &(0x7f0000000940)='syscall\x00')
r1 = syz_open_procfs(0x0, &(0x7f0000000040)='fd\x00')
recvmmsg(0xffffffffffffffff, &(0x7f0000003840)=[{{0x0, 0x0, 0x0}}], 0x1, 0x0, 0x0)
perf_event_open(&(0x7f0000940000)={0x2, 0x70, 0xee6a, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x100, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0xff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x10001, 0x1}, 0x0, 0x400000000000000}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
mlock(&(0x7f00005b8000/0x3000)=nil, 0x3000)
ioctl$SNDRV_TIMER_IOCTL_SELECT(0xffffffffffffffff, 0x40345410, 0x0)
openat$uinput(0xffffffffffffff9c, &(0x7f0000000080)='/dev/uinput\x00', 0x2, 0x0)
mmap(&(0x7f000060b000/0x1000)=nil, 0x1000, 0x5, 0x8000400200000033, r1, 0x0)
perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x2, 0x9, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2000000, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x4000000, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8)
r2 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)={0x10b, 0x6, 0x209e1e, 0x3, 0x1}, 0x2c)
bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000b40)={r2, &(0x7f0000000040), 0x0, 0x1}, 0x20)
r3 = creat(&(0x7f0000000640)='./file0\x00', 0x100)
setsockopt$inet6_tcp_TCP_REPAIR_QUEUE(r3, 0x6, 0x14, &(0x7f0000000980), 0x4)
unlink(&(0x7f0000000940)='./file0\x00')
r4 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r5 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r5, 0x0)
ioctl$BINDER_GET_NODE_DEBUG_INFO(r4, 0xc018620b, &(0x7f0000000100))
ioctl$BINDER_SET_CONTEXT_MGR(r5, 0x40046207, 0x0)
shutdown(0xffffffffffffffff, 0x1)
ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)})
ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0x0, 0x0, &(0x7f0000000780)})
creat(&(0x7f00000000c0)='./file0\x00', 0x0)

15:06:48 executing program 3:
r0 = socket$inet_udplite(0x2, 0x2, 0x88)
ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f3188b070")
r1 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, &(0x7f00000003c0)})

15:06:48 executing program 2:
r0 = syz_open_procfs(0x0, &(0x7f00000000c0)='maps\x00')
lseek(r0, 0x20000, 0x0)
readv(r0, &(0x7f0000000080)=[{&(0x7f0000000180)=""/96, 0xfffffffffffffff7}], 0x100000000000009f)

15:06:48 executing program 4:
socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000040)={<r0=>0xffffffffffffffff})
r1 = socket$inet_udplite(0x2, 0x2, 0x88)
ioctl(r1, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f3188b070")
r2 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000180)='/dev/vga_arbiter\x00', 0x800, 0x0)
r3 = syz_genetlink_get_family_id$tipc(&(0x7f0000000200)='TIPC\x00')
ioctl$TIOCCBRK(r2, 0x5428)
sendmsg$TIPC_CMD_GET_NETID(r2, &(0x7f00000002c0)={&(0x7f00000001c0), 0xc, &(0x7f0000000280)={&(0x7f0000000240)={0x1c, r3, 0x0, 0x70bd28, 0x25dfdbfe, {}, ["", "", "", "", ""]}, 0x1c}, 0x1, 0x0, 0x0, 0x20000000}, 0x4000004)
r4 = getpid()
r5 = syz_open_procfs(r4, &(0x7f00000000c0)='cmdline\x00')
accept4(r0, &(0x7f0000000100)=@pppol2tp={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @dev}}}, &(0x7f0000000080)=0x80, 0x800)
exit_group(0x8)
lseek(r5, 0x20000, 0x3)

[ 1129.570733] binder: release 2314:2315 transaction 1412 out, still active
[ 1129.584492] binder: send failed reply for transaction 1412, target dead
[ 1129.595610] binder: send failed reply for transaction 1415, target dead
[ 1129.602999] binder: send failed reply for transaction 1416 to 2328:2334
[ 1129.610206] binder: send failed reply for transaction 1419, target dead
15:06:48 executing program 1:
r0 = socket$inet_udplite(0x2, 0x2, 0x88)
ioctl(r0, 0x1000008912, 0x0)
recvmmsg(0xffffffffffffffff, &(0x7f0000003840)=[{{0x0, 0x0, 0x0}}], 0x1, 0x0, 0x0)
r1 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)={0x10b, 0x6, 0x209e1e, 0x3, 0x1}, 0x2c)
bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000b40)={r1, &(0x7f0000000040), 0x0, 0x1}, 0x20)
r2 = creat(&(0x7f0000000640)='./file0\x00', 0x100)
setsockopt$inet6_tcp_TCP_REPAIR_QUEUE(r2, 0x6, 0x14, &(0x7f0000000980), 0x4)
unlink(&(0x7f0000000940)='./file0\x00')
r3 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_GET_NODE_DEBUG_INFO(r3, 0xc018620b, &(0x7f0000000100))
ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)})
ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0x0, 0x0, &(0x7f0000000780)})

15:06:48 executing program 5:
r0 = socket$inet_udplite(0x2, 0x2, 0x88)
ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f3188b070")
syz_open_procfs(0x0, &(0x7f0000000940)='syscall\x00')
r1 = syz_open_procfs(0x0, &(0x7f0000000040)='fd\x00')
recvmmsg(0xffffffffffffffff, &(0x7f0000003840)=[{{0x0, 0x0, 0x0}}], 0x1, 0x0, 0x0)
perf_event_open(&(0x7f0000940000)={0x2, 0x70, 0xee6a, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x100, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0xff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x10001, 0x1}, 0x0, 0x400000000000000}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
mlock(&(0x7f00005b8000/0x3000)=nil, 0x3000)
ioctl$SNDRV_TIMER_IOCTL_SELECT(0xffffffffffffffff, 0x40345410, 0x0)
openat$uinput(0xffffffffffffff9c, &(0x7f0000000080)='/dev/uinput\x00', 0x2, 0x0)
mmap(&(0x7f000060b000/0x1000)=nil, 0x1000, 0x5, 0x8000400200000033, r1, 0x0)
unshare(0xfffffffffffffffd)
r2 = getpid()
sched_setscheduler(r2, 0x5, &(0x7f00000000c0))
open$dir(&(0x7f0000000400)='./file0\x00', 0x0, 0x0)
perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f00000004c0), 0x2}, 0x0, 0x0, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r3 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000340)='memory.current\x00', 0x0, 0x0)
ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, 0x0)
socketpair(0x1, 0x20000000000001, 0x0, &(0x7f0000000100)={<r4=>0xffffffffffffffff, <r5=>0xffffffffffffffff})
ioctl$PERF_EVENT_IOC_SET_FILTER(r5, 0x8914, &(0x7f0000000300)='lo\x00\x96o\xd6Q\xb9Y\xa9\xc8J,\x00\xd2\x97\x04\x03\xdc\r')
close(r3)
rt_sigprocmask(0x2, &(0x7f0000000240)={0x6}, &(0x7f00000002c0), 0x8)
ioctl$PERF_EVENT_IOC_SET_FILTER(r5, 0x8923, &(0x7f00000008c0)='lo\x00\x96o8\x0fd\xa1\xe3\xd7]b}\x1f\xa1Y\xad4\x90\x9d`\xd2\x98\x00\x00\x00 \'Y\x17]\x15c\xcaR\xdd\x98OC\x89\x1b\xe7\x84\xe2\x05\x80w\xd2|D\x8dK\x14Bx\xcbuH\xc2\xeec\xbf<>Y\x1a\xfc\x1f9OB\x81\x89\x186\xc5q@n\xb4\xb6s\xb0\x00\x00\xfc\x00\x00\b\x00\x00\xda\xef\xecE\xec\xd5I\xb2\x9b\xfe\x8d\x90?\x00\xe9\xe4~g:\xc1\xb2aj\x96\xbb\xa7\xe2\xc0\xdc\xf9Q\b\xeb\x16\x7fT\x11\xd3\r7\xe6\"f\xcf\x8e\xabd\x0ftp\x82\xae\xd2\x15\x8e+c\xf6\xbf\xe14>\xa6-\xa5c\xde\xd7\xab\xea\x1f\xf8s2\x9cVF\xd5\x18\xfe\x0e\x8f \x01\x00\x00y.\xfc*\x82\xa5\xa1p5\xc8{\xf7\xef\xab\xe8\x99\xebw#\x8at\x1c\x80\xfc\xb0\x95\xa2\xa7\xd7,Y]E8\x83X\xf5F\xdc\x88-\xf5\xb0\xb5^\xdb\x1a\xb6\xaa\x14\xe2\xb9\rh^J-\xd1\xbaUn\x04\'l\x1b\xe0o\xdb\xc8\x91%\x1c\xb5\xbf\xb6\x90\xb4\xc2\x7f]/\xb3\xe7\xc9\'\x94\xcfIo\xdf\x04\x95\xb5\x06\x84\x1fH>\xda\xc5\x04 \x94\x88\xeb\'\xd4;6\x7f\xd9\x99-\x1b|G\x8d\xd4\xb9%\xaaQ\xa0K\x10\x03\x93\xe1\xcc\xe7m\x80\'\xf0\xa5\xed(\r\xa8\x0f&\xb1\xf3\xff0\f\x82%_\x92\x8bD\xb9\xd9\xe7\xf2\xe4\xc1i#\xdc\x87A\xb9\xc7\r\x92\xfa\x11\x11\xb5\x1f\x03\x9d\xdd\x1bj\xdf\xacg\xe3\xa0S\xd3\x8a\xe1n\x97\xea\xf5\xa0\'\v\xe9\xa0\xf1 f\xaan\xcf\xb5i\xb6d\xbc\x92\v\xd58\x16\b\xb3_:\xa4!\ny\xc4&\nWMM\xa8\xc4\v\x9f\x01o\xf4\xab&\xb6\x17\x02P\xc3!N\xf4\b\x1a~\x91V1s\xe9\xbe\x9e\x9b\'\xcde\xb3\xa1\x86\"\xd7\x04\xf1\xc0!\xed\xff\xee$\xc89\x8cB0\xd1dD\xe0IP\x88\xa2\xf2Y\x9af$$\xf1cO\xf7P\xac\xca\x80:!\xb4\x94#\xcb^\x9f\'\x03\xe3\x93\xb9\x82\xbf\xcf\xc4\xe3\xf7\x03Oh\xf2r\xca\x8ff\xbb/\x9f*\xaf\x1a \xa5\xa0?%M\xa5\x86\x98\xf24\'1\xc7\f<\xcc@\xe8\x8a\xac.\xde\xe4\xc7\xf5\x9ck\xa40!\xe9\x14$\xb3\x05m\xb5m\xed\ft\x93\xd8\xa3\x80\'Y\xb9\x05\xbbt|\xbe\xbcz\n\xf3\xf5p\xf8\x9f~\x1b\xd0\v\x1cQ')
getsockopt$inet_IP_IPSEC_POLICY(r1, 0x0, 0x10, &(0x7f00000006c0)={{{@in6=@loopback}}, {{@in6=@initdev}}}, &(0x7f0000000500)=0xe8)
socketpair(0x2, 0x2000000080003, 0x100, &(0x7f0000000480))
syz_genetlink_get_family_id$SEG6(&(0x7f00000003c0)='SEG6\x00')
sendmsg$SEG6_CMD_DUMPHMAC(r4, &(0x7f0000000580)={&(0x7f0000000380)={0x10, 0x0, 0x0, 0x1000000}, 0xc, &(0x7f0000000440)={&(0x7f00000005c0)=ANY=[@ANYBLOB="2300260109447a0000000000000000660000001400001a0065a455e04ea56d0a47018c8e973bcac914471474a7e0d50a000eadd66d2e49a2ed40dcafa1e046ab6aacc2097d8f75bd9c8b8a220bdde116904efa3f9600f22ab388644f66c2d5baec4079a81bae1927e49e91a4964656d7b227702926af5be846f3de49fad39048633fd9161123894d9427f854a30cb0532c8f31f663380e40ce7f6cb15ec8baab3b7c6f"], 0x1}, 0x1, 0x0, 0x0, 0x8000}, 0x804)
r6 = creat(&(0x7f0000000280)='./bus\x00', 0x0)
arch_prctl$ARCH_MAP_VDSO_32(0x2002, 0x20)
ftruncate(r6, 0x2008200)
open(&(0x7f0000000140)='./bus\x00', 0x4000, 0x0)

15:06:48 executing program 3:
r0 = socket$inet_udplite(0x2, 0x2, 0x88)
ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f3188b070")
r1 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)})

[ 1129.630870] binder: release 2367:2370 transaction 1421 out, still active
[ 1129.661823] binder: undelivered TRANSACTION_COMPLETE
15:06:48 executing program 2:
r0 = syz_open_procfs(0x0, &(0x7f00000000c0)='maps\x00')
syz_open_dev$evdev(&(0x7f0000000080)='/dev/input/event#\x00', 0x80000000, 0x200400)
lseek(r0, 0x20000, 0x0)
readv(r0, &(0x7f0000000640)=[{&(0x7f0000000000)=""/96, 0x60}], 0x1)

15:06:48 executing program 4:
r0 = socket$inet_udplite(0x2, 0x2, 0x88)
ioctl(r0, 0x1000008912, &(0x7f00000000c0)="0adc1fa039d020f9fcfb569e74412e915073123ca97a55fad52e72f91400b259ce9dbd0be4aaab102f4b5ae8160d0159f5711d0939bcc6c1c1b5a701fd3d35df325a17139c4b2ecead3e4304f264789829714f150fc15eaae71470ef5c644c67fafb435f4e05f2c0e1c54b46682d9f7f285c109ada77d12da620500aaa38630f136d20ea701a007da4e2d44b89f9bee8b20cb33766fc36ea0fb82aa9497588aa6387ad168a5f1ec72f")
r1 = syz_open_procfs(0x0, &(0x7f0000000080)='net/dev_mcast\x00')
lseek(r1, 0x20000, 0x0)
ioctl$KDGKBLED(r1, 0x4b64, &(0x7f0000000040))

[ 1129.695142] binder: send failed reply for transaction 1421, target dead
[ 1129.717361] binder: 2378:2382 transaction failed 29189/-22, size 24-8 line 3117
15:06:48 executing program 1:
r0 = socket$inet_udplite(0x2, 0x2, 0x88)
ioctl(r0, 0x1000008912, &(0x7f0000000000))
recvmmsg(0xffffffffffffffff, &(0x7f0000003840)=[{{0x0, 0x0, 0x0}}], 0x1, 0x0, 0x0)
r1 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)={0x10b, 0x6, 0x209e1e, 0x3, 0x1}, 0x2c)
bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000b40)={r1, &(0x7f0000000040), 0x0, 0x1}, 0x20)
r2 = creat(&(0x7f0000000640)='./file0\x00', 0x100)
setsockopt$inet6_tcp_TCP_REPAIR_QUEUE(r2, 0x6, 0x14, &(0x7f0000000980), 0x4)
unlink(&(0x7f0000000940)='./file0\x00')
r3 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_GET_NODE_DEBUG_INFO(r3, 0xc018620b, &(0x7f0000000100))
ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)})
ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0x0, 0x0, &(0x7f0000000780)})

[ 1129.743766] binder: 2378:2382 BC_INCREFS_DONE u0000000000000000 no match
[ 1129.744999] binder: release 2383:2385 transaction 1424 out, still active
[ 1129.759380] binder: undelivered TRANSACTION_COMPLETE
15:06:48 executing program 3:
r0 = socket$inet_udplite(0x2, 0x2, 0x88)
ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f3188b070")
r1 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)})

15:06:48 executing program 2:
r0 = syz_open_procfs(0x0, &(0x7f00000000c0)='maps\x00')
lseek(r0, 0x20000, 0x0)
readv(r0, &(0x7f0000000640)=[{&(0x7f0000000000)=""/96, 0x60}], 0x1)
getsockname(r0, &(0x7f0000000100)=@xdp={0x2c, 0x0, <r1=>0x0}, &(0x7f0000000180)=0x80)
getsockopt$inet_IP_IPSEC_POLICY(r0, 0x0, 0x10, &(0x7f00000001c0)={{{@in6=@initdev, @in6=@loopback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, <r2=>0x0}}, {{@in6=@empty}, 0x0, @in6=@local}}, &(0x7f00000002c0)=0xe8)
sendmsg$nl_xfrm(r0, &(0x7f0000000480)={&(0x7f0000000080), 0xc, &(0x7f0000000440)={&(0x7f0000000300)=@newsa={0x11c, 0x10, 0x224, 0x70bd2d, 0x25dfdbfb, {{@in6=@ipv4={[], [], @local}, @in6=@rand_addr="7561f9bd2a5e6467e77426c36a7b8647", 0x4e21, 0x0, 0x4e24, 0x3ff, 0xa, 0x20, 0xa0, 0xa05dee272b380e90, r1, r2}, {@in=@rand_addr=0x2, 0x4d3, 0x32}, @in6=@dev={0xfe, 0x80, [], 0x27}, {0x5, 0x1, 0xffffffffffff53bb, 0xff, 0x7f, 0x2, 0x4}, {0x5, 0x81b, 0x6, 0x100000000}, {0xfffffffffffffeed, 0x4, 0x112}, 0x70bd27, 0x3507, 0xa, 0x3, 0xffff, 0x9}, [@srcaddr={0x14, 0xd, @in=@loopback}, @replay_val={0x10, 0xa, {0x70bd25, 0x70bd2d, 0x5}}, @output_mark={0x8, 0x1d, 0x1000}]}, 0x11c}, 0x1, 0x0, 0x0, 0x8000}, 0x880)

[ 1129.786866] binder: send failed reply for transaction 1424, target dead
[ 1129.851099] binder: BINDER_SET_CONTEXT_MGR already set
[ 1129.867700] binder: 2395:2397 ioctl 40046207 0 returned -16
[ 1129.869458] binder: 2372:2388 BC_INCREFS_DONE node 1427 has no pending increfs request
[ 1129.882499] binder: release 2395:2397 transaction 1429 out, still active
[ 1129.896118] binder: undelivered TRANSACTION_COMPLETE
[ 1129.944110] binder: 2394:2407 BC_INCREFS_DONE node 1431 has no pending increfs request
15:06:49 executing program 0:
r0 = socket$inet_udplite(0x2, 0x2, 0x88)
ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f3188b070")
syz_open_procfs(0x0, &(0x7f0000000940)='syscall\x00')
r1 = syz_open_procfs(0x0, &(0x7f0000000040)='fd\x00')
recvmmsg(0xffffffffffffffff, &(0x7f0000003840)=[{{0x0, 0x0, 0x0}}], 0x1, 0x0, 0x0)
perf_event_open(&(0x7f0000940000)={0x2, 0x70, 0xee6a, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x100, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0xff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x10001, 0x1}, 0x0, 0x400000000000000}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
mlock(&(0x7f00005b8000/0x3000)=nil, 0x3000)
ioctl$SNDRV_TIMER_IOCTL_SELECT(0xffffffffffffffff, 0x40345410, 0x0)
openat$uinput(0xffffffffffffff9c, &(0x7f0000000080)='/dev/uinput\x00', 0x2, 0x0)
mmap(&(0x7f000060b000/0x1000)=nil, 0x1000, 0x5, 0x8000400200000033, r1, 0x0)
perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x2, 0x9, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2000000, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x4000000, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8)
r2 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)={0x10b, 0x6, 0x209e1e, 0x3, 0x1}, 0x2c)
bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000b40)={r2, &(0x7f0000000040), 0x0, 0x1}, 0x20)
r3 = creat(&(0x7f0000000640)='./file0\x00', 0x100)
setsockopt$inet6_tcp_TCP_REPAIR_QUEUE(r3, 0x6, 0x14, &(0x7f0000000980), 0x4)
unlink(&(0x7f0000000940)='./file0\x00')
r4 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r5 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r5, 0x0)
ioctl$BINDER_GET_NODE_DEBUG_INFO(r4, 0xc018620b, &(0x7f0000000100))
ioctl$BINDER_SET_CONTEXT_MGR(r5, 0x40046207, 0x0)
shutdown(0xffffffffffffffff, 0x1)
ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)})
ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0x0, 0x0, &(0x7f0000000780)})
creat(&(0x7f00000000c0)='./file0\x00', 0x0)

15:06:49 executing program 4:
r0 = socket$inet_udplite(0x2, 0x2, 0x88)
ioctl(r0, 0x14, &(0x7f00000000c0)="0adc1f127c123f3188b070f21b84ce76d0d3e892e5d301821898f6e61a6af29ee1b055cd26e20b3e6efa278766acd2b0956ac1c3480001391aa921b6486afcc29ce857a9")
r1 = dup3(r0, r0, 0x80000)
r2 = syz_open_procfs(0x0, &(0x7f0000000080)='net/dev_mcast\x00')
lseek(r2, 0x20000, 0x0)
ioctl$FIDEDUPERANGE(r2, 0xc0189436, &(0x7f0000000140)={0x7, 0x101, 0x9, 0x0, 0x0, [{r1, 0x0, 0x1}, {r0, 0x0, 0x3ff}, {r2, 0x0, 0x892}, {r2}, {r2}, {r2, 0x0, 0x8001}, {r0, 0x0, 0xfffffffffffffff7}, {r1, 0x0, 0x2}, {r1, 0x0, 0x2efdd705}]})

15:06:49 executing program 3:
r0 = socket$inet_udplite(0x2, 0x2, 0x88)
ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f3188b070")
r1 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)})

15:06:49 executing program 2:
r0 = syz_open_procfs(0x0, &(0x7f00000000c0)='maps\x00')
lseek(r0, 0x20000, 0x0)
readv(r0, &(0x7f0000000640)=[{&(0x7f0000000000)=""/96, 0x60}], 0x1)
write$P9_RSTATFS(r0, &(0x7f0000000100)={0x43, 0x9, 0x1, {0x180000000, 0x0, 0x9, 0x8, 0x1f, 0x101, 0x3d, 0x4, 0x9}}, 0x43)
fchmod(r0, 0x85)
ioctl$EVIOCGID(r0, 0x80084502, &(0x7f0000000080)=""/34)

15:06:49 executing program 5:
r0 = socket$inet_udplite(0x2, 0x2, 0x88)
ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f3188b070")
syz_open_procfs(0x0, &(0x7f0000000940)='syscall\x00')
r1 = syz_open_procfs(0x0, &(0x7f0000000040)='fd\x00')
recvmmsg(0xffffffffffffffff, &(0x7f0000003840)=[{{0x0, 0x0, 0x0}}], 0x1, 0x0, 0x0)
perf_event_open(&(0x7f0000940000)={0x2, 0x70, 0xee6a, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x100, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0xff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x10001, 0x1}, 0x0, 0x400000000000000}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
mlock(&(0x7f00005b8000/0x3000)=nil, 0x3000)
ioctl$SNDRV_TIMER_IOCTL_SELECT(0xffffffffffffffff, 0x40345410, 0x0)
openat$uinput(0xffffffffffffff9c, &(0x7f0000000080)='/dev/uinput\x00', 0x2, 0x0)
mmap(&(0x7f000060b000/0x1000)=nil, 0x1000, 0x5, 0x8000400200000033, r1, 0x0)
unshare(0xfffffffffffffffd)
r2 = getpid()
sched_setscheduler(r2, 0x5, &(0x7f00000000c0))
open$dir(&(0x7f0000000400)='./file0\x00', 0x0, 0x0)
perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f00000004c0), 0x2}, 0x0, 0x0, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r3 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000340)='memory.current\x00', 0x0, 0x0)
ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, 0x0)
socketpair(0x1, 0x20000000000001, 0x0, &(0x7f0000000100)={<r4=>0xffffffffffffffff, <r5=>0xffffffffffffffff})
ioctl$PERF_EVENT_IOC_SET_FILTER(r5, 0x8914, &(0x7f0000000300)='lo\x00\x96o\xd6Q\xb9Y\xa9\xc8J,\x00\xd2\x97\x04\x03\xdc\r')
close(r3)
rt_sigprocmask(0x2, &(0x7f0000000240)={0x6}, &(0x7f00000002c0), 0x8)
ioctl$PERF_EVENT_IOC_SET_FILTER(r5, 0x8923, &(0x7f00000008c0)='lo\x00\x96o8\x0fd\xa1\xe3\xd7]b}\x1f\xa1Y\xad4\x90\x9d`\xd2\x98\x00\x00\x00 \'Y\x17]\x15c\xcaR\xdd\x98OC\x89\x1b\xe7\x84\xe2\x05\x80w\xd2|D\x8dK\x14Bx\xcbuH\xc2\xeec\xbf<>Y\x1a\xfc\x1f9OB\x81\x89\x186\xc5q@n\xb4\xb6s\xb0\x00\x00\xfc\x00\x00\b\x00\x00\xda\xef\xecE\xec\xd5I\xb2\x9b\xfe\x8d\x90?\x00\xe9\xe4~g:\xc1\xb2aj\x96\xbb\xa7\xe2\xc0\xdc\xf9Q\b\xeb\x16\x7fT\x11\xd3\r7\xe6\"f\xcf\x8e\xabd\x0ftp\x82\xae\xd2\x15\x8e+c\xf6\xbf\xe14>\xa6-\xa5c\xde\xd7\xab\xea\x1f\xf8s2\x9cVF\xd5\x18\xfe\x0e\x8f \x01\x00\x00y.\xfc*\x82\xa5\xa1p5\xc8{\xf7\xef\xab\xe8\x99\xebw#\x8at\x1c\x80\xfc\xb0\x95\xa2\xa7\xd7,Y]E8\x83X\xf5F\xdc\x88-\xf5\xb0\xb5^\xdb\x1a\xb6\xaa\x14\xe2\xb9\rh^J-\xd1\xbaUn\x04\'l\x1b\xe0o\xdb\xc8\x91%\x1c\xb5\xbf\xb6\x90\xb4\xc2\x7f]/\xb3\xe7\xc9\'\x94\xcfIo\xdf\x04\x95\xb5\x06\x84\x1fH>\xda\xc5\x04 \x94\x88\xeb\'\xd4;6\x7f\xd9\x99-\x1b|G\x8d\xd4\xb9%\xaaQ\xa0K\x10\x03\x93\xe1\xcc\xe7m\x80\'\xf0\xa5\xed(\r\xa8\x0f&\xb1\xf3\xff0\f\x82%_\x92\x8bD\xb9\xd9\xe7\xf2\xe4\xc1i#\xdc\x87A\xb9\xc7\r\x92\xfa\x11\x11\xb5\x1f\x03\x9d\xdd\x1bj\xdf\xacg\xe3\xa0S\xd3\x8a\xe1n\x97\xea\xf5\xa0\'\v\xe9\xa0\xf1 f\xaan\xcf\xb5i\xb6d\xbc\x92\v\xd58\x16\b\xb3_:\xa4!\ny\xc4&\nWMM\xa8\xc4\v\x9f\x01o\xf4\xab&\xb6\x17\x02P\xc3!N\xf4\b\x1a~\x91V1s\xe9\xbe\x9e\x9b\'\xcde\xb3\xa1\x86\"\xd7\x04\xf1\xc0!\xed\xff\xee$\xc89\x8cB0\xd1dD\xe0IP\x88\xa2\xf2Y\x9af$$\xf1cO\xf7P\xac\xca\x80:!\xb4\x94#\xcb^\x9f\'\x03\xe3\x93\xb9\x82\xbf\xcf\xc4\xe3\xf7\x03Oh\xf2r\xca\x8ff\xbb/\x9f*\xaf\x1a \xa5\xa0?%M\xa5\x86\x98\xf24\'1\xc7\f<\xcc@\xe8\x8a\xac.\xde\xe4\xc7\xf5\x9ck\xa40!\xe9\x14$\xb3\x05m\xb5m\xed\ft\x93\xd8\xa3\x80\'Y\xb9\x05\xbbt|\xbe\xbcz\n\xf3\xf5p\xf8\x9f~\x1b\xd0\v\x1cQ')
getsockopt$inet_IP_IPSEC_POLICY(r1, 0x0, 0x10, &(0x7f00000006c0)={{{@in6=@loopback}}, {{@in6=@initdev}}}, &(0x7f0000000500)=0xe8)
socketpair(0x2, 0x2000000080003, 0x100, &(0x7f0000000480))
syz_genetlink_get_family_id$SEG6(&(0x7f00000003c0)='SEG6\x00')
sendmsg$SEG6_CMD_DUMPHMAC(r4, &(0x7f0000000580)={&(0x7f0000000380)={0x10, 0x0, 0x0, 0x1000000}, 0xc, &(0x7f0000000440)={&(0x7f00000005c0)=ANY=[@ANYBLOB="2300260109447a0000000000000000660000001400001a0065a455e04ea56d0a47018c8e973bcac914471474a7e0d50a000eadd66d2e49a2ed40dcafa1e046ab6aacc2097d8f75bd9c8b8a220bdde116904efa3f9600f22ab388644f66c2d5baec4079a81bae1927e49e91a4964656d7b2703c26cfd575f5ee27702926af5be846f3de49fad39048633fd9161123894d9427f854a30cb0532c8f31f663380e40ce7f6c"], 0x1}, 0x1, 0x0, 0x0, 0x8000}, 0x804)
r6 = creat(&(0x7f0000000280)='./bus\x00', 0x0)
arch_prctl$ARCH_MAP_VDSO_32(0x2002, 0x7e)
ftruncate(r6, 0x2008200)
open(&(0x7f0000000140)='./bus\x00', 0x4000, 0x0)

15:06:49 executing program 1:
r0 = socket$inet_udplite(0x2, 0x2, 0x88)
ioctl(r0, 0x1000008912, &(0x7f0000000000))
recvmmsg(0xffffffffffffffff, &(0x7f0000003840)=[{{0x0, 0x0, 0x0}}], 0x1, 0x0, 0x0)
r1 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)={0x10b, 0x6, 0x209e1e, 0x3, 0x1}, 0x2c)
bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000b40)={r1, &(0x7f0000000040), 0x0, 0x1}, 0x20)
r2 = creat(&(0x7f0000000640)='./file0\x00', 0x100)
setsockopt$inet6_tcp_TCP_REPAIR_QUEUE(r2, 0x6, 0x14, &(0x7f0000000980), 0x4)
unlink(&(0x7f0000000940)='./file0\x00')
r3 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_GET_NODE_DEBUG_INFO(r3, 0xc018620b, &(0x7f0000000100))
ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)})
ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0x0, 0x0, &(0x7f0000000780)})

[ 1130.455645] binder: release 2372:2379 transaction 1426 out, still active
[ 1130.465298] binder: send failed reply for transaction 1426, target dead
[ 1130.472203] binder: send failed reply for transaction 1429, target dead
[ 1130.483920] binder: send failed reply for transaction 1430 to 2394:2399
15:06:49 executing program 3:
r0 = socket$inet_udplite(0x2, 0x2, 0x88)
ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f3188b070")
r1 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, 0x0})

[ 1130.528957] binder: release 2417:2423 transaction 1434 out, still active
[ 1130.557778] binder: undelivered TRANSACTION_COMPLETE
15:06:49 executing program 2:
r0 = syz_open_procfs(0x0, &(0x7f00000000c0)='maps\x00')
lseek(r0, 0x20000, 0x0)
readv(r0, &(0x7f0000000640)=[{&(0x7f0000000000)=""/96, 0x60}], 0x1)
r1 = syz_genetlink_get_family_id$team(&(0x7f0000000100)='team\x00')
accept4$packet(r0, &(0x7f0000000140)={0x11, 0x0, <r2=>0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000180)=0x14, 0x80000)
accept$packet(r0, &(0x7f00000001c0)={0x11, 0x0, <r3=>0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14)
accept$packet(r0, &(0x7f0000000580)={0x11, 0x0, <r4=>0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f00000005c0)=0x14)
getsockopt$inet_pktinfo(r0, 0x0, 0x8, &(0x7f0000000600)={<r5=>0x0, @empty, @initdev}, &(0x7f0000000680)=0xc)
getsockopt$inet_pktinfo(r0, 0x0, 0x8, &(0x7f00000006c0)={<r6=>0x0, @local, @initdev}, &(0x7f0000000700)=0xc)
getsockname$packet(r0, &(0x7f0000000780)={0x11, 0x0, <r7=>0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f00000007c0)=0x14)
getsockopt$inet_pktinfo(r0, 0x0, 0x8, &(0x7f0000000800)={<r8=>0x0, @broadcast, @loopback}, &(0x7f0000000840)=0xc)
getsockname$packet(r0, &(0x7f0000000880)={0x11, 0x0, <r9=>0x0, 0x1, 0x0, 0x6, @link_local}, &(0x7f00000008c0)=0x14)
clock_gettime(0x0, &(0x7f00000060c0)={<r10=>0x0, <r11=>0x0})
recvmmsg(r0, &(0x7f0000005e40)=[{{&(0x7f0000000d00)=@xdp={0x2c, 0x0, <r12=>0x0}, 0x80, &(0x7f0000001100)=[{&(0x7f0000000d80)=""/109, 0x6d}, {&(0x7f0000000e00)=""/105, 0x69}, {&(0x7f0000000e80)=""/1, 0x1}, {&(0x7f0000000ec0)=""/101, 0x65}, {&(0x7f0000000f40)=""/62, 0x3e}, {&(0x7f0000000f80)=""/34, 0x22}, {&(0x7f0000000fc0)=""/66, 0x42}, {&(0x7f0000001040)=""/173, 0xad}], 0x8, &(0x7f0000001180)=""/69, 0x45}, 0xff}, {{&(0x7f0000001200)=@nfc_llcp, 0x80, &(0x7f0000001340)=[{&(0x7f0000001280)=""/171, 0xab}], 0x1, &(0x7f0000001380)=""/30, 0x1e}, 0x5}, {{&(0x7f00000013c0), 0x80, &(0x7f0000001640)=[{&(0x7f0000001440)=""/234, 0xea}, {&(0x7f0000001540)=""/193, 0xc1}], 0x2, &(0x7f0000001680)=""/207, 0xcf}, 0x1}, {{&(0x7f0000001780)=@isdn, 0x80, &(0x7f0000002a80)=[{&(0x7f0000001800)=""/4096, 0x1000}, {&(0x7f0000002800)=""/175, 0xaf}, {&(0x7f00000028c0)=""/147, 0x93}, {&(0x7f0000002980)=""/227, 0xe3}], 0x4}, 0x8}, {{&(0x7f0000002ac0)=@hci, 0x80, &(0x7f0000002c80)=[{&(0x7f0000002b40)=""/48, 0x30}, {&(0x7f0000002b80)=""/61, 0x3d}, {&(0x7f0000002bc0)=""/133, 0x85}], 0x3, &(0x7f0000002cc0)=""/193, 0xc1}, 0xd}, {{&(0x7f0000002dc0)=@rc, 0x80, &(0x7f0000003f80)=[{&(0x7f0000002e40)=""/76, 0x4c}, {&(0x7f0000002ec0)=""/114, 0x72}, {&(0x7f0000002f40)=""/4096, 0x1000}, {&(0x7f0000003f40)=""/51, 0x33}], 0x4, &(0x7f0000003fc0)=""/12, 0xc}, 0x4}, {{&(0x7f0000004000)=@pptp={0x18, 0x2, {0x0, @remote}}, 0x80, &(0x7f0000004300)=[{&(0x7f0000004080)=""/188, 0xbc}, {&(0x7f0000004140)=""/170, 0xaa}, {&(0x7f0000004200)=""/210, 0xd2}], 0x3, &(0x7f0000004340)=""/174, 0xae}, 0xbd53}, {{&(0x7f0000004400)=@un=@abs, 0x80, &(0x7f0000004840)=[{&(0x7f0000004480)=""/104, 0x68}, {&(0x7f0000004500)=""/46, 0x2e}, {&(0x7f0000004540)=""/180, 0xb4}, {&(0x7f0000004600)=""/117, 0x75}, {&(0x7f0000004680)=""/15, 0xf}, {&(0x7f00000046c0)=""/227, 0xe3}, {&(0x7f00000047c0)=""/100, 0x64}], 0x7}, 0x2}, {{0x0, 0x0, &(0x7f0000004b40)=[{&(0x7f00000048c0)=""/39, 0x27}, {&(0x7f0000004900)=""/187, 0xbb}, {&(0x7f00000049c0)=""/147, 0x93}, {&(0x7f0000004a80)}, {&(0x7f0000004ac0)=""/116, 0x74}], 0x5, &(0x7f0000004bc0)=""/4096, 0x1000}, 0x7}, {{&(0x7f0000005bc0)=@pppol2tpin6={0x18, 0x1, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, {0xa, 0x0, 0x0, @initdev}}}, 0x80, &(0x7f0000005d80)=[{&(0x7f0000005c40)=""/2, 0x2}, {&(0x7f0000005c80)=""/73, 0x49}, {&(0x7f0000005d00)=""/79, 0x4f}], 0x3, &(0x7f0000005dc0)=""/109, 0x6d}, 0xf3e}], 0xa, 0x100, &(0x7f0000006100)={r10, r11+10000000})
getsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x11, &(0x7f0000006140)={{{@in6=@remote, @in6=@ipv4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, <r13=>0x0}}, {{@in=@initdev}, 0x0, @in=@loopback}}, &(0x7f0000006240)=0xe8)
getsockopt$inet6_IPV6_XFRM_POLICY(r0, 0x29, 0x23, &(0x7f0000006280)={{{@in=@local, @in=@multicast2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, <r14=>0x0}}, {{@in=@empty}, 0x0, @in6=@local}}, &(0x7f0000006380)=0xe8)
getsockopt$inet_pktinfo(r0, 0x0, 0x8, &(0x7f0000006480)={<r15=>0x0, @remote, @dev}, &(0x7f00000064c0)=0xc)
getsockopt$inet6_IPV6_XFRM_POLICY(r0, 0x29, 0x23, &(0x7f0000006500)={{{@in6=@local, @in6=@dev, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, <r16=>0x0}}, {{@in=@loopback}, 0x0, @in=@dev}}, &(0x7f0000006600)=0xe8)
ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000006640)={'veth0_to_bridge\x00', <r17=>0x0})
accept4$packet(r0, &(0x7f0000006680)={0x11, 0x0, <r18=>0x0}, &(0x7f00000066c0)=0x14, 0x80000)
ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f000000bc40)={'lapb0\x00', <r19=>0x0})
getsockopt$inet_pktinfo(r0, 0x0, 0x8, &(0x7f000000bd00)={<r20=>0x0, @local}, &(0x7f000000bd40)=0xc)
ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f000000bd80)={'bond_slave_1\x00', <r21=>0x0})
bind$packet(r0, &(0x7f0000000240)={0x11, 0x1b, r4, 0x1, 0xff}, 0x14)
ioctl$ifreq_SIOCGIFINDEX_team(r0, 0x8933, &(0x7f000000be80)={'team0\x00', <r22=>0x0})
getsockopt$inet_IP_IPSEC_POLICY(r0, 0x0, 0x10, &(0x7f000000bec0)={{{@in6=@dev, @in=@remote, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, <r23=>0x0}}, {{@in6=@loopback}, 0x0, @in6=@initdev}}, &(0x7f000000bfc0)=0xe8)
sendmsg$TEAM_CMD_NOOP(r0, &(0x7f000000c640)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x800}, 0xc, &(0x7f000000c600)={&(0x7f000000c000)={0x5c4, r1, 0x20, 0x70bd29, 0x25dfdbfd, {}, [{{0x8, 0x1, r2}, {0xb8, 0x2, [{0x38, 0x1, @mcast_rejoin_count={{0x24, 0x1, 'mcast_rejoin_count\x00'}, {0x8}, {0x8, 0x4, 0xffffffffffffffe0}}}, {0x40, 0x1, @queue_id={{{0x24, 0x1, 'queue_id\x00'}, {0x8}, {0x8, 0x4, 0x1}}, {0x8, 0x6, r3}}}, {0x3c, 0x1, @enabled={{{0x24, 0x1, 'enabled\x00'}, {0x8}, {0x4}}, {0x8, 0x6, r4}}}]}}, {{0x8, 0x1, r5}, {0x1d8, 0x2, [{0x3c, 0x1, @user_linkup={{{0x24, 0x1, 'user_linkup\x00'}, {0x8}, {0x4}}, {0x8, 0x6, r6}}}, {0x3c, 0x1, @user_linkup={{{0x24, 0x1, 'user_linkup\x00'}, {0x8}, {0x4}}, {0x8, 0x6, r7}}}, {0x3c, 0x1, @user_linkup={{{0x24, 0x1, 'user_linkup\x00'}, {0x8}, {0x4}}, {0x8, 0x6, r8}}}, {0x3c, 0x1, @enabled={{{0x24, 0x1, 'enabled\x00'}, {0x8}, {0x4}}, {0x8, 0x6, r9}}}, {0x38, 0x1, @mcast_rejoin_interval={{0x24, 0x1, 'mcast_rejoin_interval\x00'}, {0x8}, {0x8, 0x4, 0x3}}}, {0x6c, 0x1, @bpf_hash_func={{0x24, 0x1, 'bpf_hash_func\x00'}, {0x8}, {0x3c, 0x4, [{0x1000, 0x4, 0x339e000000, 0x69e}, {0x9, 0x20, 0x0, 0x8}, {0xa176, 0x80, 0x1000, 0x4a}, {0x6, 0x1, 0x1, 0x1}, {0xfffffffffffffffe, 0x1, 0x2, 0x1}, {0x3, 0x3, 0x3, 0x8}, {0x0, 0xffffffffffffff7f, 0x3, 0xcb0}]}}}, {0x40, 0x1, @lb_port_stats={{{0x24, 0x1, 'lb_port_stats\x00'}, {0x8}, {0x8, 0x4, 0xfffc000000000000}}, {0x8, 0x6, r12}}}]}}, {{0x8, 0x1, r13}, {0x164, 0x2, [{0x38, 0x1, @activeport={{0x24, 0x1, 'activeport\x00'}, {0x8}, {0x8, 0x4, r14}}}, {0x40, 0x1, @lb_port_stats={{{0x24, 0x1, 'lb_port_stats\x00'}, {0x8}, {0x8, 0x4, 0x47}}, {0x8, 0x6, r15}}}, {0x38, 0x1, @activeport={{0x24, 0x1, 'activeport\x00'}, {0x8}, {0x8, 0x4, r16}}}, {0x38, 0x1, @notify_peers_interval={{0x24, 0x1, 'notify_peers_interval\x00'}, {0x8}, {0x8, 0x4, 0x3}}}, {0x38, 0x1, @activeport={{0x24, 0x1, 'activeport\x00'}, {0x8}, {0x8, 0x4, r17}}}, {0x40, 0x1, @priority={{{0x24, 0x1, 'priority\x00'}, {0x8}, {0x8, 0x4, 0x8}}, {0x8, 0x6, r18}}}]}}, {{0x8, 0x1, r19}, {0x19c, 0x2, [{0x3c, 0x1, @user_linkup_enabled={{{0x24, 0x1, 'user_linkup_enabled\x00'}, {0x8}, {0x4}}, {0x8, 0x6, r20}}}, {0x38, 0x1, @notify_peers_interval={{0x24, 0x1, 'notify_peers_interval\x00'}, {0x8}, {0x8}}}, {0x38, 0x1, @activeport={{0x24, 0x1, 'activeport\x00'}, {0x8}, {0x8, 0x4, r21}}}, {0x38, 0x1, @mcast_rejoin_count={{0x24, 0x1, 'mcast_rejoin_count\x00'}, {0x8}, {0x8, 0x4, 0x3}}}, {0x40, 0x1, @queue_id={{{0x24, 0x1, 'queue_id\x00'}, {0x8}, {0x8, 0x4, 0x9}}, {0x8, 0x6, r22}}}, {0x3c, 0x1, @user_linkup={{{0x24, 0x1, 'user_linkup\x00'}, {0x8}, {0x4}}, {0x8, 0x6, r23}}}, {0x38, 0x1, @mcast_rejoin_count={{0x24, 0x1, 'mcast_rejoin_count\x00'}, {0x8}, {0x8, 0x4, 0x8}}}]}}]}, 0x5c4}}, 0x40840)

15:06:49 executing program 4:
r0 = socket$inet_udplite(0x2, 0x2, 0x88)
ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f3188b070")
r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='cpuacct.usage_percpu_sys\x00', 0x0, 0x0)
ioctl$LOOP_CHANGE_FD(r1, 0x4c06, r0)
r2 = syz_open_procfs(0x0, &(0x7f0000000080)='net/dev_mcast\x00')
lseek(r2, 0x20000, 0x0)

[ 1130.585298] binder: send failed reply for transaction 1434, target dead
[ 1130.629809] binder: 2433:2437 got transaction with invalid offset (0, min 0 max 0) or object.
[ 1130.639359] binder: 2433:2437 transaction failed 29201/-22, size 0-8 line 3348
[ 1130.657413] binder: undelivered TRANSACTION_ERROR: 29201
[ 1130.673319] binder: BINDER_SET_CONTEXT_MGR already set
[ 1130.678819] binder: 2427:2429 ioctl 40046207 0 returned -16
15:06:49 executing program 1:
r0 = socket$inet_udplite(0x2, 0x2, 0x88)
ioctl(r0, 0x1000008912, &(0x7f0000000000))
recvmmsg(0xffffffffffffffff, &(0x7f0000003840)=[{{0x0, 0x0, 0x0}}], 0x1, 0x0, 0x0)
r1 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)={0x10b, 0x6, 0x209e1e, 0x3, 0x1}, 0x2c)
bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000b40)={r1, &(0x7f0000000040), 0x0, 0x1}, 0x20)
r2 = creat(&(0x7f0000000640)='./file0\x00', 0x100)
setsockopt$inet6_tcp_TCP_REPAIR_QUEUE(r2, 0x6, 0x14, &(0x7f0000000980), 0x4)
unlink(&(0x7f0000000940)='./file0\x00')
r3 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_GET_NODE_DEBUG_INFO(r3, 0xc018620b, &(0x7f0000000100))
ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)})
ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0x0, 0x0, &(0x7f0000000780)})

15:06:49 executing program 3:
r0 = socket$inet_udplite(0x2, 0x2, 0x88)
ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f3188b070")
r1 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, &(0x7f00000003c0)})

[ 1130.690181] binder: 2431:2444 BC_INCREFS_DONE node 1438 has no pending increfs request
[ 1130.698310] binder: send failed reply for transaction 1437 to 2431:2435
[ 1130.701540] binder: 2427:2429 transaction failed 29189/-22, size 24-8 line 3117
[ 1130.726540] binder: 2427:2429 BC_INCREFS_DONE u0000000000000000 no match
15:06:49 executing program 0:
r0 = socket$inet_udplite(0x2, 0x2, 0x88)
ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f3188b070")
syz_open_procfs(0x0, &(0x7f0000000940)='syscall\x00')
r1 = syz_open_procfs(0x0, &(0x7f0000000040)='fd\x00')
recvmmsg(0xffffffffffffffff, &(0x7f0000003840)=[{{0x0, 0x0, 0x0}}], 0x1, 0x0, 0x0)
perf_event_open(&(0x7f0000940000)={0x2, 0x70, 0xee6a, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x100, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0xff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x10001, 0x1}, 0x0, 0x400000000000000}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
mlock(&(0x7f00005b8000/0x3000)=nil, 0x3000)
ioctl$SNDRV_TIMER_IOCTL_SELECT(0xffffffffffffffff, 0x40345410, 0x0)
openat$uinput(0xffffffffffffff9c, &(0x7f0000000080)='/dev/uinput\x00', 0x2, 0x0)
mmap(&(0x7f000060b000/0x1000)=nil, 0x1000, 0x5, 0x8000400200000033, r1, 0x0)
perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x2, 0x9, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2000000, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x4000000, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8)
r2 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)={0x10b, 0x6, 0x209e1e, 0x3, 0x1}, 0x2c)
bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000b40)={r2, &(0x7f0000000040), 0x0, 0x1}, 0x20)
r3 = creat(&(0x7f0000000640)='./file0\x00', 0x100)
setsockopt$inet6_tcp_TCP_REPAIR_QUEUE(r3, 0x6, 0x14, &(0x7f0000000980), 0x4)
unlink(&(0x7f0000000940)='./file0\x00')
r4 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r5 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r5, 0x0)
ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f00000000c0)=ANY=[@ANYBLOB="bb8f0000"], 0x0, 0x0, 0x0})
ioctl$BINDER_SET_CONTEXT_MGR(r5, 0x40046207, 0x0)
shutdown(0xffffffffffffffff, 0x1)
ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)})
ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0x0, 0x0, &(0x7f0000000780)})
creat(&(0x7f00000000c0)='./file0\x00', 0x0)

15:06:49 executing program 4:
r0 = socket$inet_udplite(0x2, 0x2, 0x88)
ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f3188b070")
r1 = getpgid(0x0)
fcntl$lock(r0, 0x0, &(0x7f0000000040)={0x0, 0x0, 0xfffffffffffffffd, 0x552, r1})
r2 = syz_open_procfs(0x0, &(0x7f0000000080)='net/dev_mcast\x00')
lseek(r2, 0x20000, 0x0)

[ 1130.791273] binder: 2450:2453 got transaction with invalid offset (0, min 0 max 0) or object.
[ 1130.823817] binder: 2450:2453 transaction failed 29201/-22, size 0-8 line 3348
15:06:49 executing program 2:
r0 = syz_open_procfs(0x0, &(0x7f00000000c0)='maps\x00')
r1 = syz_genetlink_get_family_id$team(&(0x7f0000000080)='team\x00')
ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000180)={'veth1_to_hsr\x00', <r2=>0x0})
getsockname$packet(r0, &(0x7f0000000280)={0x11, 0x0, <r3=>0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f00000002c0)=0x14)
getsockopt$inet_pktinfo(r0, 0x0, 0x8, &(0x7f00000003c0)={<r4=>0x0, @rand_addr, @multicast2}, &(0x7f0000000400)=0xc)
getsockname$packet(r0, &(0x7f0000000440)={0x11, 0x0, <r5=>0x0, 0x1, 0x0, 0x6, @local}, &(0x7f0000000480)=0x14)
clock_gettime(0x0, &(0x7f0000000ac0)={<r6=>0x0, <r7=>0x0})
recvmmsg(r0, &(0x7f0000000600)=[{{&(0x7f0000000500)=@ll={0x11, 0x0, <r8=>0x0, 0x1, 0x0, 0x6, @link_local}, 0x80, &(0x7f0000000a40)=[{&(0x7f0000000580)}, {&(0x7f0000000680)=""/204, 0xcc}, {&(0x7f00000005c0)=""/48, 0x30}, {&(0x7f0000000780)=""/205, 0xcd}, {&(0x7f0000000880)=""/203, 0xcb}, {&(0x7f0000000980)=""/151, 0x97}], 0x6}, 0x1}], 0x1, 0x88196d8eed92f2d8, &(0x7f0000000b00)={r6, r7+10000000})
recvmmsg(r0, &(0x7f0000002e80)=[{{&(0x7f0000000d00)=@rxrpc=@in4={0x21, 0x0, 0x2, 0x10, {0x2, 0x0, @loopback}}, 0x80, &(0x7f0000001200)=[{&(0x7f0000000d80)=""/128, 0x80}, {&(0x7f0000000e00)=""/50, 0x32}, {&(0x7f0000000e40)=""/157, 0x9d}, {&(0x7f0000000f00)=""/241, 0xf1}, {&(0x7f0000001000)=""/118, 0x76}, {&(0x7f0000001080)=""/58, 0x3a}, {&(0x7f00000010c0)=""/163, 0xa3}, {&(0x7f0000001180)=""/107, 0x6b}], 0x8, &(0x7f0000001280)=""/178, 0xb2}, 0xffffffffffffffff}, {{&(0x7f0000001340)=@can={0x1d, <r9=>0x0}, 0x80, &(0x7f00000026c0)=[{&(0x7f00000013c0)=""/178, 0xb2}, {&(0x7f0000001480)=""/104, 0x68}, {&(0x7f0000001500)=""/4096, 0x1000}, {&(0x7f0000002500)=""/31, 0x1f}, {&(0x7f0000002540)=""/102, 0x66}, {&(0x7f00000025c0)=""/88, 0x58}, {&(0x7f0000002640)=""/102, 0x66}], 0x7, &(0x7f0000002740)=""/4, 0x4}, 0xfdc}, {{0x0, 0x0, &(0x7f0000002bc0)=[{&(0x7f0000002780)=""/226, 0xe2}, {&(0x7f0000002880)=""/220, 0xdc}, {&(0x7f0000002980)=""/147, 0x93}, {&(0x7f0000002a40)=""/131, 0x83}, {&(0x7f0000002b00)=""/129, 0x81}], 0x5, &(0x7f0000002c40)=""/16, 0x10}}, {{&(0x7f0000002c80)=@llc={0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, @random}, 0x80, &(0x7f0000002e40)=[{&(0x7f0000002d00)=""/175, 0xaf}, {&(0x7f0000002dc0)=""/29, 0x1d}, {&(0x7f0000002e00)=""/36, 0x24}], 0x3}, 0x1}], 0x4, 0x2002, &(0x7f0000002f80)={0x77359400})
recvmsg(r0, &(0x7f0000003140)={&(0x7f0000002fc0)=@xdp={0x2c, 0x0, <r10=>0x0}, 0x80, &(0x7f00000030c0)=[{&(0x7f0000003040)=""/41, 0x29}, {&(0x7f0000003080)=""/41, 0x29}], 0x2, &(0x7f0000003100)=""/37, 0x25}, 0x42)
fchmodat(r0, &(0x7f00000001c0)='./file0\x00', 0x8)
sendmsg$TEAM_CMD_NOOP(r0, &(0x7f00000034c0)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x1200}, 0xc, &(0x7f0000003480)={&(0x7f0000003180)={0x300, r1, 0x0, 0x70bd28, 0x25dfdbff, {}, [{{0x8, 0x1, r2}, {0x7c, 0x2, [{0x40, 0x1, @lb_tx_hash_to_port_mapping={{{0x24, 0x1, 'lb_tx_hash_to_port_mapping\x00'}, {0x8}, {0x8, 0x4, r3}}, {0x8}}}, {0x38, 0x1, @notify_peers_interval={{0x24, 0x1, 'notify_peers_interval\x00'}, {0x8}, {0x8, 0x4, 0x80000001}}}]}}, {{0x8, 0x1, r4}, {0x80, 0x2, [{0x3c, 0x1, @name={{0x24, 0x1, 'mode\x00'}, {0x8}, {0xc, 0x4, 'random\x00'}}}, {0x40, 0x1, @lb_hash_stats={{{0x24, 0x1, 'lb_hash_stats\x00'}, {0x8}, {0x8, 0x4, 0x8001}}, {0x8}}}]}}, {{0x8, 0x1, r5}, {0x1d8, 0x2, [{0x40, 0x1, @lb_port_stats={{{0x24, 0x1, 'lb_port_stats\x00'}, {0x8}, {0x8}}, {0x8, 0x6, r8}}}, {0x3c, 0x1, @bpf_hash_func={{0x24, 0x1, 'bpf_hash_func\x00'}, {0x8}, {0xc, 0x4, [{0x8e3, 0x81, 0x2, 0x4}]}}}, {0x38, 0x1, @activeport={{0x24, 0x1, 'activeport\x00'}, {0x8}, {0x8, 0x4, r9}}}, {0x4c, 0x1, @lb_tx_method={{0x24, 0x1, 'lb_tx_method\x00'}, {0x8}, {0x1c, 0x4, 'hash_to_port_mapping\x00'}}}, {0x40, 0x1, @lb_tx_hash_to_port_mapping={{{0x24, 0x1, 'lb_tx_hash_to_port_mapping\x00'}, {0x8}, {0x8, 0x4, r10}}, {0x8}}}, {0x5c, 0x1, @bpf_hash_func={{0x24, 0x1, 'bpf_hash_func\x00'}, {0x8}, {0x2c, 0x4, [{0x9, 0x101, 0x2, 0x3f}, {0x5, 0x5, 0x5, 0xd1}, {0x5, 0x8, 0x2, 0x7}, {0x80000000, 0x0, 0x4e2c, 0x1000}, {0x8, 0x8, 0x4, 0x80}]}}}, {0x38, 0x1, @mcast_rejoin_count={{0x24, 0x1, 'mcast_rejoin_count\x00'}, {0x8}, {0x8, 0x4, 0x1000}}}]}}]}, 0x300}}, 0x80)
ioctl$PPPIOCATTCHAN(r0, 0x40047438, &(0x7f0000000000)=0x4)
lseek(r0, 0x20000, 0x0)
readv(r0, &(0x7f0000000640)=[{&(0x7f0000000100)=""/96, 0xffe2}], 0x1)

15:06:49 executing program 3:
r0 = socket$inet_udplite(0x2, 0x2, 0x88)
ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f3188b070")
r1 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, &(0x7f00000003c0)})

15:06:49 executing program 4:
r0 = socket$inet_udplite(0x2, 0x2, 0x88)
r1 = openat$selinux_enforce(0xffffffffffffff9c, &(0x7f0000000080)='/selinux/enforce\x00', 0x40, 0x0)
ioctl$BLKALIGNOFF(r1, 0x127a, &(0x7f00000000c0))
r2 = openat$selinux_policy(0xffffffffffffff9c, &(0x7f0000000040)='/selinux/policy\x00', 0x0, 0x0)
ioctl$LOOP_CHANGE_FD(r2, 0x4c06, r0)
ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f3188b070")
lseek(0xffffffffffffffff, 0x20000, 0x0)
sendmsg$unix(r2, &(0x7f0000000340)={&(0x7f0000000100)=@abs={0x0, 0x0, 0x4e22}, 0x6e, &(0x7f0000000300)=[{&(0x7f0000000180)="69896e68c64c56e83875fd2f768f957debd3246ceccaf02a30958fca2c0aab3360eec3d3119b7f8b496f16d8fe0007ac23e252d5f0e343955ebda02982b7b207555998b7fba1a53444d1ba2f9e6c076e2c69ac797735b40a3414dda7de1e2c090fb8ef5a616d51282565696a18b80311ad30427d5b8be3676197d71800edbf3bacf42bdefd07c1c2cd51b4f6a94d0f3445c325a4eb415d1564e1e0739d63e16032943d1725763c6fcd263d", 0xab}, {&(0x7f0000000240)="ca4b462c742a2f6c9f3ef754b40662d0fb183ceb7aeb1890f513674bd120004039b299d44ffd79204e2f5a28b54b85f6ec542dea7df9b053520168ecdf8119eb0284d7c4ea784fb01e307128911ae8e6161225f8901cf6188ba6a619708366548ba8d1a8f532f3408a39d1a26463a654836d5cdeeea83a62b3c313c37a63ccae2266419187b9b92b0572292b206ca625e313eb91dc7a5c578f1546f32862eccad1cd416f03b96d430ba1f7e1a8ba5bc4ee94c5d6eebe0601d07b7278287b", 0xbe}], 0x2, 0x0, 0x0, 0x800}, 0x40000)

[ 1130.849625] binder: undelivered TRANSACTION_ERROR: 29201
[ 1130.877528] binder: send failed reply for transaction 1443 to 2451:2457
[ 1130.884864] binder: 2451:2457 BC_INCREFS_DONE u0000000000000000 no match
[ 1130.928384] binder: 2455:2459 unknown command 36795
[ 1130.953872] binder: 2455:2459 ioctl c0306201 20000140 returned -22
[ 1130.987797] binder: release 2455:2463 transaction 1447 out, still active
[ 1130.995251] binder: BINDER_SET_CONTEXT_MGR already set
[ 1131.008495] binder: send failed reply for transaction 1447, target dead
[ 1131.017893] binder: 2467:2475 ioctl 40046207 0 returned -16
[ 1131.030783] binder: 2467:2479 transaction failed 29189/-22, size 0-8 line 3117
[ 1131.046233] binder: undelivered TRANSACTION_ERROR: 29189
15:06:49 executing program 0:
r0 = socket$inet_udplite(0x2, 0x2, 0x88)
ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f3188b070")
syz_open_procfs(0x0, &(0x7f0000000940)='syscall\x00')
r1 = syz_open_procfs(0x0, &(0x7f0000000040)='fd\x00')
recvmmsg(0xffffffffffffffff, &(0x7f0000003840)=[{{0x0, 0x0, 0x0}}], 0x1, 0x0, 0x0)
perf_event_open(&(0x7f0000940000)={0x2, 0x70, 0xee6a, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x100, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0xff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x10001, 0x1}, 0x0, 0x400000000000000}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
mlock(&(0x7f00005b8000/0x3000)=nil, 0x3000)
ioctl$SNDRV_TIMER_IOCTL_SELECT(0xffffffffffffffff, 0x40345410, 0x0)
openat$uinput(0xffffffffffffff9c, &(0x7f0000000080)='/dev/uinput\x00', 0x2, 0x0)
mmap(&(0x7f000060b000/0x1000)=nil, 0x1000, 0x5, 0x8000400200000033, r1, 0x0)
perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x2, 0x9, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2000000, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x4000000, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8)
r2 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)={0x10b, 0x6, 0x209e1e, 0x3, 0x1}, 0x2c)
bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000b40)={r2, &(0x7f0000000040), 0x0, 0x1}, 0x20)
r3 = creat(&(0x7f0000000640)='./file0\x00', 0x100)
setsockopt$inet6_tcp_TCP_REPAIR_QUEUE(r3, 0x6, 0x14, &(0x7f0000000980), 0x4)
unlink(&(0x7f0000000940)='./file0\x00')
r4 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r5 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f00000000c0)=ANY=[@ANYBLOB="bb8f0000"], 0x0, 0x0, 0x0})
ioctl$BINDER_SET_CONTEXT_MGR(r5, 0x40046207, 0x0)
shutdown(0xffffffffffffffff, 0x1)
ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)})
ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0x0, 0x0, &(0x7f0000000780)})
creat(&(0x7f00000000c0)='./file0\x00', 0x0)

15:06:49 executing program 1:
r0 = socket$inet_udplite(0x2, 0x2, 0x88)
ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c12")
recvmmsg(0xffffffffffffffff, &(0x7f0000003840)=[{{0x0, 0x0, 0x0}}], 0x1, 0x0, 0x0)
r1 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)={0x10b, 0x6, 0x209e1e, 0x3, 0x1}, 0x2c)
bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000b40)={r1, &(0x7f0000000040), 0x0, 0x1}, 0x20)
r2 = creat(&(0x7f0000000640)='./file0\x00', 0x100)
setsockopt$inet6_tcp_TCP_REPAIR_QUEUE(r2, 0x6, 0x14, &(0x7f0000000980), 0x4)
unlink(&(0x7f0000000940)='./file0\x00')
r3 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_GET_NODE_DEBUG_INFO(r3, 0xc018620b, &(0x7f0000000100))
ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)})
ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0x0, 0x0, &(0x7f0000000780)})

15:06:49 executing program 2:
getpgrp(0x0)
getsockopt$sock_cred(0xffffffffffffff9c, 0x1, 0x11, &(0x7f0000000140)={<r0=>0x0}, &(0x7f0000000180)=0xc)
r1 = syz_open_procfs(r0, &(0x7f0000000100)='\x00\x10\x00\xaf')
lseek(r1, 0x20000, 0x0)
readv(r1, &(0x7f0000000640)=[{&(0x7f0000000000)=""/96, 0x60}], 0x1)

15:06:49 executing program 4:
r0 = socket$inet_udplite(0x2, 0x2, 0x88)
ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f3188b070")
r1 = openat$selinux_commit_pending_bools(0xffffffffffffff9c, &(0x7f0000000100)='/selinux/commit_pending_bools\x00', 0x1, 0x0)
r2 = open$dir(&(0x7f0000000180)='./file0\x00', 0x40, 0x100)
linkat(r1, &(0x7f0000000140)='./file0\x00', r2, &(0x7f00000001c0)='./file0\x00', 0x400)
r3 = syz_open_procfs(0x0, &(0x7f0000000080)='net/dev_mcast\x00')
lseek(r3, 0x20000, 0x0)
fsetxattr$security_ima(r0, &(0x7f0000000040)='security.ima\x00', &(0x7f00000000c0)=@v2={0x3, 0x1, 0xc, 0x7, 0xe, "e0ff11599758e3b43d8f29524d21"}, 0x18, 0x3)
dup3(r1, r3, 0x80000)
mmap(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x6, 0x109012, r3, 0x0)
r4 = geteuid()
getsockopt$inet6_IPV6_IPSEC_POLICY(r1, 0x29, 0x22, &(0x7f0000000240)={{{@in6=@mcast2, @in=@initdev, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, <r5=>0x0}}, {{@in=@remote}, 0x0, @in6=@loopback}}, &(0x7f0000000340)=0xe8)
getsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x11, &(0x7f0000000380)={{{@in6=@loopback, @in6=@loopback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, <r6=>0x0}}, {{@in6=@loopback}, 0x0, @in=@broadcast}}, &(0x7f0000000480)=0xe8)
stat(&(0x7f00000004c0)='./file0\x00', &(0x7f0000000500)={0x0, 0x0, 0x0, 0x0, <r7=>0x0})
lstat(&(0x7f0000000580)='./file0\x00', &(0x7f00000009c0)={0x0, 0x0, 0x0, 0x0, <r8=>0x0})
getsockopt$inet_IP_IPSEC_POLICY(r3, 0x0, 0x10, &(0x7f0000000640)={{{@in6=@mcast2, @in6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, <r9=>0x0}}, {{@in6=@dev}, 0x0, @in=@broadcast}}, &(0x7f0000000740)=0xe8)
fstat(r2, &(0x7f0000000780)={0x0, 0x0, 0x0, 0x0, <r10=>0x0})
getgroups(0x2, &(0x7f0000000800)=[0xee01, <r11=>0xffffffffffffffff])
getgroups(0x5, &(0x7f0000000840)=[0x0, <r12=>0xee00, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff])
lstat(&(0x7f0000000880)='.\x00', &(0x7f00000008c0)={0x0, 0x0, 0x0, 0x0, 0x0, <r13=>0x0})
fsetxattr$system_posix_acl(r0, &(0x7f0000000200)='system.posix_acl_default\x00', &(0x7f0000000940)={{}, {0x1, 0x2}, [{0x2, 0x4, r4}, {0x2, 0x2493be08b463d2a2, r5}, {0x2, 0x1, r6}, {0x2, 0x1, r7}, {0x2, 0x5, r8}, {0x2, 0x4, r9}, {0x2, 0x5, r10}], {0x4, 0x1}, [{0x8, 0x2, r11}, {0x8, 0x1, r12}, {0x8, 0x1, r13}], {0x10, 0x671fcd5b472e8d19}, {0x20, 0x3}}, 0x74, 0x2)

15:06:49 executing program 5:
r0 = socket$inet_udplite(0x2, 0x2, 0x88)
ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f3188b070")
r1 = fcntl$getown(r0, 0x9)
r2 = syz_open_procfs(r1, &(0x7f0000000940)='syscall\x00')
r3 = syz_open_procfs(0x0, &(0x7f0000000040)='fd\x00')
recvmmsg(0xffffffffffffffff, &(0x7f0000003840)=[{{0x0, 0x0, 0x0}}], 0x1, 0x0, 0x0)
perf_event_open(&(0x7f0000940000)={0x2, 0x70, 0xee6a, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x100, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0xff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x10001, 0x1}, 0x0, 0x400000000000000}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
mlock(&(0x7f00005b8000/0x3000)=nil, 0x3000)
ioctl$SNDRV_TIMER_IOCTL_SELECT(0xffffffffffffffff, 0x40345410, 0x0)
openat$uinput(0xffffffffffffff9c, &(0x7f0000000080)='/dev/uinput\x00', 0x2, 0x0)
mmap(&(0x7f000060b000/0x1000)=nil, 0x1000, 0x5, 0x8000400200000033, r3, 0x0)
unshare(0xfffffffffffffffd)
r4 = getpid()
sched_setscheduler(r4, 0x5, &(0x7f00000000c0))
open$dir(&(0x7f0000000400)='./file0\x00', 0x0, 0x0)
perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f00000004c0), 0x2}, 0x0, 0x0, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r5 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000340)='memory.current\x00', 0x0, 0x0)
ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, 0x0)
socketpair(0x1, 0x20000000000001, 0x0, &(0x7f0000000100)={<r6=>0xffffffffffffffff, <r7=>0xffffffffffffffff})
ioctl$PERF_EVENT_IOC_SET_FILTER(r7, 0x8914, &(0x7f0000000300)='lo\x00\x96o\xd6Q\xb9Y\xa9\xc8J,\x00\xd2\x97\x04\x03\xdc\r')
close(r5)
rt_sigprocmask(0x2, &(0x7f0000000240)={0x6}, &(0x7f00000002c0), 0x8)
ioctl$PERF_EVENT_IOC_SET_FILTER(r2, 0x8923, &(0x7f0000000f80))
getsockopt$inet_IP_IPSEC_POLICY(r3, 0x0, 0x10, &(0x7f00000006c0)={{{@in6=@loopback}}, {{@in6=@initdev}}}, &(0x7f0000000500)=0xe8)
socketpair(0x2, 0x2000000080003, 0x100, &(0x7f0000000480))
syz_genetlink_get_family_id$SEG6(&(0x7f00000003c0)='SEG6\x00')
sendmsg$SEG6_CMD_DUMPHMAC(r6, &(0x7f0000000580)={&(0x7f0000000380)={0x10, 0x0, 0x0, 0x1000000}, 0xc, &(0x7f0000000440)={&(0x7f00000005c0)=ANY=[@ANYBLOB="2300260109447a0000000010000000660000001400001a0065a455e04ea56d0a47018c8e74a7e0d50a000eadd66d2e49a2ed40dcafa1e046ab6aacc2097d8f75bd9c8b8a220bdde116904efa3f9600f22ab388644f66c2d5baec4079061bae1927e49e91a4964656d7b227702926af5be846f3de49fad39048633f1123894d9427f854a30cb0532c8f31f663380e405ec8baab531d3a9d3899320fce"], 0x1}, 0x1, 0x0, 0x0, 0x8000}, 0x804)
r8 = creat(&(0x7f0000000280)='./bus\x00', 0x0)
arch_prctl$ARCH_MAP_VDSO_32(0x2002, 0x7e)
ftruncate(r8, 0x2008200)
open(&(0x7f0000000140)='./bus\x00', 0x4000, 0x0)

15:06:49 executing program 3:
r0 = socket$inet_udplite(0x2, 0x2, 0x88)
ioctl(r0, 0x1000008912, &(0x7f0000000000))
recvmmsg(0xffffffffffffffff, &(0x7f0000003840)=[{{0x0, 0x0, 0x0}}], 0x1, 0x0, 0x0)
r1 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)={0x10b, 0x6, 0x209e1e, 0x3, 0x1}, 0x2c)
bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000b40)={r1, &(0x7f0000000040), 0x0, 0x1}, 0x20)
r2 = creat(&(0x7f0000000640)='./file0\x00', 0x100)
setsockopt$inet6_tcp_TCP_REPAIR_QUEUE(r2, 0x6, 0x14, &(0x7f0000000980), 0x4)
unlink(&(0x7f0000000940)='./file0\x00')
r3 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_GET_NODE_DEBUG_INFO(r3, 0xc018620b, &(0x7f0000000100))
ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)})
ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0x0, 0x0, &(0x7f0000000780)})

15:06:50 executing program 2:
openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000004c0)='cpu.stat\x00', 0x0, 0x0)
r0 = openat$selinux_checkreqprot(0xffffffffffffff9c, &(0x7f0000000540)='/selinux/checkreqprot\x00', 0x400, 0x0)
r1 = openat(r0, &(0x7f0000000500)='./file0\x00', 0x141001, 0x60)
getresuid(&(0x7f0000000140), &(0x7f0000000180), &(0x7f00000001c0)=<r2=>0x0)
sendmsg$nl_netfilter(r1, &(0x7f0000000480)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x10000000}, 0xc, &(0x7f0000000440)={&(0x7f0000000200)=ANY=[@ANYBLOB="0c0200000c0b080227bd7000a4e9df250f00000053011d61ce75113035e87aa2739491d1aa5b09cd90d40841a557fb09fbc4f65de9d4f6455e276d438ab222c8169b9927899ea19c84c0b043381035e515c24bbb707109a3b4c0bb08005f00e000000108000000", @ANYRES32=r2, @ANYBLOB="2762dd521e7e3bf4d13c2ef24a07d6b71e32945c5b7f407d980c773ec4e53021349615863780bee9997a406b2aa2856fdcd1ec89b455d60ebb6f8e6cfa91bce594ab84055162ddb44e77294be6d178268f35e4a753b466e035ec74261d1c96a0bf8f133beae3ce635fd598bdc02cb10eaa0fd6219e8ef6f03e581cad69f03714ae3c20e2b79f2bf8699feb09badb5f9fca772d8cfbbd6d7003a45d4247e66392e8cf5da7072afa1ba4a4a1058eecdb4e3be0279ef7205e146c21990e9ff09459115fa279a6ce33a6b2b8a6c7a4f4c0b7f49e09bf5c06d826beccfdc9b8182b4a93b37c5e98c9e418edad935679035237e81a3e27040bee3586d6264511bb0a858c6cc780f5a7c39aace8b62f2590e6778efe7d7f562c011e220aa20abb3becc42a8e4b915ff32c6a3a9488b1f121f3164bc3a8b8a5ae80d8a2fe1d8643cea55832cf40ad69d5bcab806ae92d413ffca1b7b2a9792a6de38deba86809dcfde754775934e881291708cf47441483a25c463757426e89ad57f43e0056a2c1c08862b9b397f90c000b00050000000000000010001300248cb19dddbe11c02b00000000"], 0x20c}, 0x1, 0x0, 0x0, 0x40800}, 0x40000)
r3 = syz_open_procfs(0x0, &(0x7f00000000c0)='maps\x00')
lseek(r3, 0x20000, 0x0)
readv(r3, &(0x7f0000000640)=[{&(0x7f0000000000)=""/96, 0x60}], 0x1)

15:06:50 executing program 4:
r0 = socket$inet_udplite(0x2, 0x2, 0x88)
getresuid(&(0x7f00000000c0)=<r1=>0x0, &(0x7f00000004c0), &(0x7f00000001c0))
r2 = add_key$keyring(&(0x7f0000000200)='keyring\x00', &(0x7f0000000240)={'syz', 0x0}, 0x0, 0x0, 0xfffffffffffffff9)
keyctl$get_persistent(0x16, r1, r2)
setsockopt$inet_mtu(r0, 0x0, 0xa, &(0x7f0000000100)=0x7, 0x4)
r3 = openat$selinux_status(0xffffffffffffff9c, &(0x7f0000000040)='/selinux/status\x00', 0x0, 0x0)
request_key(&(0x7f0000000400)='rxrpc_s\x00', &(0x7f0000000440)={'syz', 0x3}, &(0x7f0000000480)='net/dev_mcast\x00', r2)
write$apparmor_exec(r3, &(0x7f00000002c0)=ANY=[@ANYRES16=r1], 0x1)
ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f3188b070")
ioctl$EXT4_IOC_PRECACHE_EXTENTS(r0, 0x6612)
ioctl$VT_DISALLOCATE(r3, 0x5608)
ioctl$TIOCLINUX3(r3, 0x541c, &(0x7f0000000300))
ioctl$sock_SIOCOUTQNSD(r0, 0x894b, &(0x7f0000000140))
syz_genetlink_get_family_id$net_dm(&(0x7f0000000180)='NET_DM\x00')
ioctl$EXT4_IOC_GROUP_ADD(r3, 0x40286608, &(0x7f0000000280)={0x100000000, 0x200, 0x6, 0x1000, 0x3, 0x3})
ioctl$PERF_EVENT_IOC_RESET(r3, 0x2403, 0x101)
syz_open_procfs(0x0, &(0x7f0000000080)='net/dev_mcast\x00')
lseek(r0, 0x20000, 0x2)
lseek(r3, 0x0, 0x0)
preadv(r3, &(0x7f00000003c0)=[{&(0x7f0000000340)=""/73, 0x49}], 0x1, 0x0)

[ 1131.167432] binder: 2489:2496 transaction failed 29189/-22, size 24-8 line 3117
[ 1131.190630] binder: 2492:2499 transaction failed 29189/-22, size 24-8 line 3117
[ 1131.207782] binder: 2489:2496 BC_INCREFS_DONE u0000000000000000 no match
[ 1131.219926] binder: 2492:2499 BC_INCREFS_DONE u0000000000000000 no match
15:06:50 executing program 3:
r0 = socket$inet_udplite(0x2, 0x2, 0x88)
ioctl(r0, 0x1000008912, 0x0)
recvmmsg(0xffffffffffffffff, &(0x7f0000003840)=[{{0x0, 0x0, 0x0}}], 0x1, 0x0, 0x0)
r1 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)={0x10b, 0x6, 0x209e1e, 0x3, 0x1}, 0x2c)
bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000b40)={r1, &(0x7f0000000040), 0x0, 0x1}, 0x20)
r2 = creat(&(0x7f0000000640)='./file0\x00', 0x100)
setsockopt$inet6_tcp_TCP_REPAIR_QUEUE(r2, 0x6, 0x14, &(0x7f0000000980), 0x4)
unlink(&(0x7f0000000940)='./file0\x00')
r3 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_GET_NODE_DEBUG_INFO(r3, 0xc018620b, &(0x7f0000000100))
ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)})
ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0x0, 0x0, &(0x7f0000000780)})

15:06:50 executing program 1:
r0 = socket$inet_udplite(0x2, 0x2, 0x88)
ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c12")
recvmmsg(0xffffffffffffffff, &(0x7f0000003840)=[{{0x0, 0x0, 0x0}}], 0x1, 0x0, 0x0)
r1 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)={0x10b, 0x6, 0x209e1e, 0x3, 0x1}, 0x2c)
bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000b40)={r1, &(0x7f0000000040), 0x0, 0x1}, 0x20)
r2 = creat(&(0x7f0000000640)='./file0\x00', 0x100)
setsockopt$inet6_tcp_TCP_REPAIR_QUEUE(r2, 0x6, 0x14, &(0x7f0000000980), 0x4)
unlink(&(0x7f0000000940)='./file0\x00')
r3 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_GET_NODE_DEBUG_INFO(r3, 0xc018620b, &(0x7f0000000100))
ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)})
ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0x0, 0x0, &(0x7f0000000780)})

15:06:50 executing program 2:
r0 = syz_open_procfs(0x0, &(0x7f00000000c0)='maps\x00')
lseek(r0, 0x20000, 0x0)
readv(r0, &(0x7f0000000640)=[{&(0x7f0000000000)=""/96, 0x60}], 0x1)
fstatfs(r0, &(0x7f0000000100)=""/143)
fcntl$F_GET_FILE_RW_HINT(r0, 0x40d, &(0x7f0000000080))

[ 1131.267134] binder: 2490:2495 unknown command 36795
[ 1131.282769] binder: 2490:2495 ioctl c0306201 20000140 returned -22
[ 1131.294405] binder_alloc: 2490: binder_alloc_buf, no vma
[ 1131.314433] binder: 2490:2495 transaction failed 29189/-3, size 24-8 line 3254
[ 1131.332634] binder: 2490:2495 BC_INCREFS_DONE u0000000000000000 no match
[ 1131.353077] binder_alloc: 2490: binder_alloc_buf, no vma
15:06:50 executing program 2:
r0 = openat$pfkey(0xffffffffffffff9c, &(0x7f0000000180)='/proc/self/net/pfkey\x00', 0x101080, 0x0)
fsetxattr$trusted_overlay_origin(r0, &(0x7f0000000300)='trusted.overlay.origin\x00', &(0x7f0000000340)='y\x00', 0x2, 0x2)
r1 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000200)='IPVS\x00')
sendmsg$IPVS_CMD_SET_INFO(r0, &(0x7f00000002c0)={&(0x7f00000001c0)={0x10, 0x0, 0x0, 0x10}, 0xc, &(0x7f0000000280)={&(0x7f0000000240)={0x1c, r1, 0xc10, 0x70bd29, 0x25dfdbfb, {}, [@IPVS_CMD_ATTR_TIMEOUT_TCP={0x8, 0x4, 0x173ffaa9}]}, 0x1c}, 0x1, 0x0, 0x0, 0x4000}, 0x45)
r2 = openat$smack_task_current(0xffffffffffffff9c, &(0x7f0000000080)='/proc/self/attr/current\x00', 0x2, 0x0)
fstat(r2, &(0x7f0000000100))
r3 = syz_open_procfs(0x0, &(0x7f00000000c0)='maps\x00')
lseek(r3, 0x20000, 0x0)
readv(r3, &(0x7f0000000640)=[{&(0x7f0000000000)=""/96, 0x60}], 0x1)

[ 1131.372907] binder: 2514:2518 transaction failed 29189/-3, size 24-8 line 3254
[ 1131.385827] binder: 2514:2518 BC_INCREFS_DONE u0000000000000000 no match
[ 1131.395330] binder_alloc: 2490: binder_alloc_buf, no vma
[ 1131.408780] binder: 2515:2520 transaction failed 29189/-3, size 24-8 line 3254
15:06:50 executing program 4:
r0 = open(&(0x7f0000000100)='./file0\x00', 0x800, 0x44)
ioctl$PPPIOCATTCHAN(r0, 0x40047438, &(0x7f0000000140)=0x4)
r1 = creat(&(0x7f0000000040)='./file0\x00', 0x1)
ioctl$UI_BEGIN_FF_ERASE(r1, 0xc00c55ca, &(0x7f00000000c0)={0x9, 0x7, 0x8000})
r2 = socket$inet_udplite(0x2, 0x2, 0x88)
ioctl(r2, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f3188b070")
r3 = syz_open_procfs(0x0, &(0x7f0000000080)='net/dev_mcast\x00')
lseek(r3, 0x20000, 0x0)

15:06:50 executing program 0:
r0 = socket$inet_udplite(0x2, 0x2, 0x88)
ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f3188b070")
syz_open_procfs(0x0, &(0x7f0000000940)='syscall\x00')
r1 = syz_open_procfs(0x0, &(0x7f0000000040)='fd\x00')
recvmmsg(0xffffffffffffffff, &(0x7f0000003840)=[{{0x0, 0x0, 0x0}}], 0x1, 0x0, 0x0)
perf_event_open(&(0x7f0000940000)={0x2, 0x70, 0xee6a, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x100, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0xff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x10001, 0x1}, 0x0, 0x400000000000000}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
mlock(&(0x7f00005b8000/0x3000)=nil, 0x3000)
ioctl$SNDRV_TIMER_IOCTL_SELECT(0xffffffffffffffff, 0x40345410, 0x0)
openat$uinput(0xffffffffffffff9c, &(0x7f0000000080)='/dev/uinput\x00', 0x2, 0x0)
mmap(&(0x7f000060b000/0x1000)=nil, 0x1000, 0x5, 0x8000400200000033, r1, 0x0)
perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x2, 0x9, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2000000, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x4000000, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8)
r2 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)={0x10b, 0x6, 0x209e1e, 0x3, 0x1}, 0x2c)
bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000b40)={r2, &(0x7f0000000040), 0x0, 0x1}, 0x20)
r3 = creat(&(0x7f0000000640)='./file0\x00', 0x100)
setsockopt$inet6_tcp_TCP_REPAIR_QUEUE(r3, 0x6, 0x14, &(0x7f0000000980), 0x4)
unlink(&(0x7f0000000940)='./file0\x00')
r4 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r5 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f00000000c0)=ANY=[@ANYBLOB="bb8f0000"], 0x0, 0x0, 0x0})
ioctl$BINDER_SET_CONTEXT_MGR(r5, 0x40046207, 0x0)
shutdown(0xffffffffffffffff, 0x1)
ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)})
ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0x0, 0x0, &(0x7f0000000780)})
creat(&(0x7f00000000c0)='./file0\x00', 0x0)

15:06:50 executing program 3:
r0 = socket$inet_udplite(0x2, 0x2, 0x88)
ioctl(r0, 0x0, &(0x7f0000000000)="0adc1f123c123f3188b070")
recvmmsg(0xffffffffffffffff, &(0x7f0000003840)=[{{0x0, 0x0, 0x0}}], 0x1, 0x0, 0x0)
r1 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)={0x10b, 0x6, 0x209e1e, 0x3, 0x1}, 0x2c)
bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000b40)={r1, &(0x7f0000000040), 0x0, 0x1}, 0x20)
r2 = creat(&(0x7f0000000640)='./file0\x00', 0x100)
setsockopt$inet6_tcp_TCP_REPAIR_QUEUE(r2, 0x6, 0x14, &(0x7f0000000980), 0x4)
unlink(&(0x7f0000000940)='./file0\x00')
r3 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_GET_NODE_DEBUG_INFO(r3, 0xc018620b, &(0x7f0000000100))
ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)})
ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0x0, 0x0, &(0x7f0000000780)})

[ 1131.419724] binder: 2515:2520 BC_INCREFS_DONE u0000000000000000 no match
15:06:50 executing program 1:
r0 = socket$inet_udplite(0x2, 0x2, 0x88)
ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c12")
recvmmsg(0xffffffffffffffff, &(0x7f0000003840)=[{{0x0, 0x0, 0x0}}], 0x1, 0x0, 0x0)
r1 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)={0x10b, 0x6, 0x209e1e, 0x3, 0x1}, 0x2c)
bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000b40)={r1, &(0x7f0000000040), 0x0, 0x1}, 0x20)
r2 = creat(&(0x7f0000000640)='./file0\x00', 0x100)
setsockopt$inet6_tcp_TCP_REPAIR_QUEUE(r2, 0x6, 0x14, &(0x7f0000000980), 0x4)
unlink(&(0x7f0000000940)='./file0\x00')
r3 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_GET_NODE_DEBUG_INFO(r3, 0xc018620b, &(0x7f0000000100))
ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)})
ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0x0, 0x0, &(0x7f0000000780)})

[ 1131.533514] binder: 2527:2533 transaction failed 29189/-22, size 24-8 line 3117
[ 1131.569952] binder: 2527:2533 BC_INCREFS_DONE u0000000000000000 no match
[ 1131.578968] binder: 2534:2539 transaction failed 29189/-22, size 24-8 line 3117
[ 1131.627272] binder: 2534:2544 BC_INCREFS_DONE u0000000000000000 no match
[ 1131.669917] binder: 2530:2546 unknown command 36795
[ 1131.677418] binder: 2530:2546 ioctl c0306201 20000140 returned -22
[ 1131.687829] binder_alloc: 2530: binder_alloc_buf, no vma
[ 1131.696706] binder: 2530:2538 transaction failed 29189/-3, size 24-8 line 3254
15:06:50 executing program 3:
r0 = socket$inet_udplite(0x2, 0x2, 0x88)
ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c12")
recvmmsg(0xffffffffffffffff, &(0x7f0000003840)=[{{0x0, 0x0, 0x0}}], 0x1, 0x0, 0x0)
r1 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)={0x10b, 0x6, 0x209e1e, 0x3, 0x1}, 0x2c)
bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000b40)={r1, &(0x7f0000000040), 0x0, 0x1}, 0x20)
r2 = creat(&(0x7f0000000640)='./file0\x00', 0x100)
setsockopt$inet6_tcp_TCP_REPAIR_QUEUE(r2, 0x6, 0x14, &(0x7f0000000980), 0x4)
unlink(&(0x7f0000000940)='./file0\x00')
r3 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_GET_NODE_DEBUG_INFO(r3, 0xc018620b, &(0x7f0000000100))
ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)})
ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0x0, 0x0, &(0x7f0000000780)})

15:06:50 executing program 4:
r0 = socket$inet_udplite(0x2, 0x2, 0x88)
ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f3188b070")
r1 = getpgrp(0xffffffffffffffff)
r2 = syz_open_procfs(r1, &(0x7f0000000080)='net/connector\x00')
lseek(r2, 0x20000, 0x0)

15:06:50 executing program 2:
pipe2(&(0x7f0000000080)={<r0=>0xffffffffffffffff}, 0x80800)
getsockopt$inet6_opts(r0, 0x29, 0x39, &(0x7f0000000100)=""/35, &(0x7f0000000140)=0x23)
r1 = syz_open_procfs(0x0, &(0x7f00000000c0)='maps\x00')
lseek(r1, 0x20000, 0x0)
readv(r1, &(0x7f0000000640)=[{&(0x7f0000000000)=""/96, 0x60}], 0x1)

15:06:50 executing program 5:
r0 = socket$inet_udplite(0x2, 0x2, 0x88)
ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f3188b070")
syz_open_procfs(0x0, &(0x7f0000000940)='syscall\x00')
r1 = syz_open_procfs(0x0, &(0x7f0000000040)='fd\x00')
recvmmsg(0xffffffffffffffff, &(0x7f0000003840)=[{{0x0, 0x0, 0x0}}], 0x1, 0x0, 0x0)
perf_event_open(&(0x7f0000940000)={0x2, 0x70, 0xee6a, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x100, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0xff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x10001, 0x1}, 0x0, 0x400000000000000}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
mlock(&(0x7f00005b8000/0x3000)=nil, 0x3000)
ioctl$SNDRV_TIMER_IOCTL_SELECT(0xffffffffffffffff, 0x40345410, 0x0)
openat$uinput(0xffffffffffffff9c, &(0x7f0000000080)='/dev/uinput\x00', 0x2, 0x0)
getrusage(0xffffffffffffffff, &(0x7f00000007c0))
mmap(&(0x7f000060b000/0x1000)=nil, 0x1000, 0x5, 0x8000400200000033, r1, 0x0)
unshare(0xfffffffffffffffd)
r2 = getpid()
sched_setscheduler(r2, 0x5, &(0x7f00000000c0))
perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f00000004c0), 0x2}, 0x0, 0x0, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r3 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000340)='memory.current\x00', 0x0, 0x0)
ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, 0x0)
socketpair(0x1, 0x20000000000001, 0x0, &(0x7f0000000100)={<r4=>0xffffffffffffffff, <r5=>0xffffffffffffffff})
ioctl$PERF_EVENT_IOC_SET_FILTER(r5, 0x8914, &(0x7f0000000300)='lo\x00\x96o\xd6Q\xb9Y\xa9\xc8J,\x00\xd2\x97\x04\x03\xdc\r')
close(r3)
rt_sigprocmask(0x2, &(0x7f0000000240)={0x6}, &(0x7f00000002c0), 0x8)
ioctl$PERF_EVENT_IOC_SET_FILTER(r5, 0x8923, &(0x7f00000008c0)='lo\x00\x96o8\x0fd\xa1\xe3\xd7]b}\x1f\xa1Y\xad4\x90\x9d`\xd2\x98\x00\x00\x00 \'Y\x17]\x15c\xcaR\xdd\x98OC\x89\x1b\xe7\x84\xe2\x05\x80w\xd2|D\x8dK\x14Bx\xcbuH\xc2\xeec\xbf<>Y\x1a\xfc\x1f9OB\x81\x89\x186\xc5q@n\xb4\xb6s\xb0\x00\x00\xfc\x00\x00\b\x00\x00\xda\xef\xecE\xec\xd5I\xb2\x9b\xfe\x8d\x90?\x00\xe9\xe4~g:\xc1\xb2aj\x96\xbb\xa7\xe2\xc0\xdc\xf9Q\b\xeb\x16\x7fT\x11\xd3\r7\xe6\"f\xcf\x8e\xabd\x0ftp\x82\xae\xd2\x15\x8e+c\xf6\xbf\xe14>\xa6-\xa5c\xde\xd7\xab\xea\x1f\xf8s2\x9cVF\xd5\x18\xfe\x0e\x8f \x01\x00\x00y.\xfc*\x82\xa5\xa1p5\xc8{\xf7\xef\xab\xe8\x99\xebw#\x8at\x1c\x80\xfc\xb0\x95\xa2\xa7\xd7,Y]E8\x83X\xf5F\xdc\x88-\xf5\xb0\xb5^\xdb\x1a\xb6\xaa\x14\xe2\xb9\rh^J-\xd1\xbaUn\x04\'l\x1b\xe0o\xdb\xc8\x91%\x1c\xb5\xbf\xb6\x90\xb4\xc2\x7f]/\xb3\xe7\xc9\'\x94\xcfIo\xdf\x04\x95\xb5\x06\x84\x1fH>\xda\xc5\x04 \x94\x88\xeb\'\xd4;6\x7f\xd9\x99-\x1b|G\x8d\xd4\xb9%\xaaQ\xa0K\x10\x03\x93\xe1\xcc\xe7m\x80\'\xf0\xa5\xed(\r\xa8\x0f&\xb1\xf3\xff0\f\x82%_\x92\x8bD\xb9\xd9\xe7\xf2\xe4\xc1i#\xdc\x87A\xb9\xc7\r\x92\xfa\x11\x11\xb5\x1f\x03\x9d\xdd\x1bj\xdf\xacg\xe3\xa0S\xd3\x8a\xe1n\x97\xea\xf5\xa0\'\v\xe9\xa0\xf1 f\xaan\xcf\xb5i\xb6d\xbc\x92\v\xd58\x16\b\xb3_:\xa4!\ny\xc4&\nWMM\xa8\xc4\v\x9f\x01o\xf4\xab&\xb6\x17\x02P\xc3!N\xf4\b\x1a~\x91V1s\xe9\xbe\x9e\x9b\'\xcde\xb3\xa1\x86\"\xd7\x04\xf1\xc0!\xed\xff\xee$\xc89\x8cB0\xd1dD\xe0IP\x88\xa2\xf2Y\x9af$$\xf1cO\xf7P\xac\xca\x80:!\xb4\x94#\xcb^\x9f\'\x03\xe3\x93\xb9\x82\xbf\xcf\xc4\xe3\xf7\x03Oh\xf2r\xca\x8ff\xbb/\x9f*\xaf\x1a \xa5\xa0?%M\xa5\x86\x98\xf24\'1\xc7\f<\xcc@\xe8\x8a\xac.\xde\xe4\xc7\xf5\x9ck\xa40!\xe9\x14$\xb3\x05m\xb5m\xed\ft\x93\xd8\xa3\x80\'Y\xb9\x05\xbbt|\xbe\xbcz\n\xf3\xf5p\xf8\x9f~\x1b\xd0\v\x1cQ')
getsockopt$inet_IP_IPSEC_POLICY(r1, 0x0, 0x10, &(0x7f00000006c0)={{{@in6=@loopback}}, {{@in6=@initdev}}}, &(0x7f0000000500)=0xe8)
socketpair(0x2, 0x2000000080003, 0x100, &(0x7f0000000480))
syz_genetlink_get_family_id$SEG6(&(0x7f00000003c0)='SEG6\x00')
sendmsg$SEG6_CMD_DUMPHMAC(r4, &(0x7f0000000580)={&(0x7f0000000380)={0x10, 0x0, 0x0, 0x1000000}, 0xc, &(0x7f0000000440)={&(0x7f00000005c0)=ANY=[@ANYBLOB="2300260109447a0000000000000000660000001400001a0065a455e04ea56d0a47018c8e973bcac914471474a7e0d50a000eadd66d2e49a2ed40dcafa1e046ab6aacc2097d8f75bd9c8b8a220bdde116904efa3f9600f22ab388644f66c2d5baec4079a81bae1927e49e91a4964656d7b227702926af5be846f3de49fad39048633fd9161123894d9427f854a30cb0532c8f31f663380e40ce7f6cb15ec8baab3b7c6f"], 0x1}, 0x1, 0x0, 0x0, 0x8000}, 0x804)
creat(&(0x7f0000000280)='./bus\x00', 0x0)
arch_prctl$ARCH_MAP_VDSO_32(0x2002, 0x7e)
ftruncate(r4, 0x2008200)
open(&(0x7f0000000140)='./bus\x00', 0x4000, 0x0)

15:06:50 executing program 1:
r0 = socket$inet_udplite(0x2, 0x2, 0x88)
ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f3188")
recvmmsg(0xffffffffffffffff, &(0x7f0000003840)=[{{0x0, 0x0, 0x0}}], 0x1, 0x0, 0x0)
r1 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)={0x10b, 0x6, 0x209e1e, 0x3, 0x1}, 0x2c)
bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000b40)={r1, &(0x7f0000000040), 0x0, 0x1}, 0x20)
r2 = creat(&(0x7f0000000640)='./file0\x00', 0x100)
setsockopt$inet6_tcp_TCP_REPAIR_QUEUE(r2, 0x6, 0x14, &(0x7f0000000980), 0x4)
unlink(&(0x7f0000000940)='./file0\x00')
r3 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_GET_NODE_DEBUG_INFO(r3, 0xc018620b, &(0x7f0000000100))
ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)})
ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0x0, 0x0, &(0x7f0000000780)})

[ 1131.718641] binder: 2530:2538 BC_INCREFS_DONE u0000000000000000 no match
15:06:50 executing program 0:
r0 = socket$inet_udplite(0x2, 0x2, 0x88)
ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f3188b070")
syz_open_procfs(0x0, &(0x7f0000000940)='syscall\x00')
r1 = syz_open_procfs(0x0, &(0x7f0000000040)='fd\x00')
recvmmsg(0xffffffffffffffff, &(0x7f0000003840)=[{{0x0, 0x0, 0x0}}], 0x1, 0x0, 0x0)
perf_event_open(&(0x7f0000940000)={0x2, 0x70, 0xee6a, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x100, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0xff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x10001, 0x1}, 0x0, 0x400000000000000}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
mlock(&(0x7f00005b8000/0x3000)=nil, 0x3000)
ioctl$SNDRV_TIMER_IOCTL_SELECT(0xffffffffffffffff, 0x40345410, 0x0)
openat$uinput(0xffffffffffffff9c, &(0x7f0000000080)='/dev/uinput\x00', 0x2, 0x0)
mmap(&(0x7f000060b000/0x1000)=nil, 0x1000, 0x5, 0x8000400200000033, r1, 0x0)
perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x2, 0x9, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2000000, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x4000000, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8)
r2 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)={0x10b, 0x6, 0x209e1e, 0x3, 0x1}, 0x2c)
bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000b40)={r2, &(0x7f0000000040), 0x0, 0x1}, 0x20)
r3 = creat(&(0x7f0000000640)='./file0\x00', 0x100)
setsockopt$inet6_tcp_TCP_REPAIR_QUEUE(r3, 0x6, 0x14, &(0x7f0000000980), 0x4)
unlink(&(0x7f0000000940)='./file0\x00')
r4 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r5 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f00000000c0)=ANY=[@ANYBLOB="bb8f0000"], 0x0, 0x0, 0x0})
ioctl$BINDER_SET_CONTEXT_MGR(r5, 0x40046207, 0x0)
shutdown(0xffffffffffffffff, 0x1)
ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)})
ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0x0, 0x0, &(0x7f0000000780)})
creat(&(0x7f00000000c0)='./file0\x00', 0x0)

[ 1131.775775] binder: 2553:2558 transaction failed 29189/-22, size 24-8 line 3117
[ 1131.793844] binder: 2554:2562 transaction failed 29189/-22, size 24-8 line 3117
[ 1131.805909] binder: 2553:2558 BC_INCREFS_DONE u0000000000000000 no match
15:06:50 executing program 2:
r0 = syz_open_procfs(0x0, &(0x7f00000000c0)='maps\x00')
lseek(r0, 0x20000, 0x0)
ioctl$TIOCGPGRP(r0, 0x540f, &(0x7f0000000180)=<r1=>0x0)
fstat(r0, &(0x7f00000001c0)={0x0, 0x0, 0x0, 0x0, <r2=>0x0})
openat$uinput(0xffffffffffffff9c, &(0x7f0000000500)='/dev/uinput\x00', 0x802, 0x0)
eventfd(0x5)
getresgid(&(0x7f0000000240)=<r3=>0x0, &(0x7f0000000280), &(0x7f00000002c0))
r4 = getpgrp(0xffffffffffffffff)
getresuid(&(0x7f0000000300), &(0x7f0000000340)=<r5=>0x0, &(0x7f0000000380))
bpf$MAP_LOOKUP_ELEM(0x1, &(0x7f0000000600)={r0, &(0x7f0000000540)="8c2e1bab1ad648d294593bc73c9a87a14458458f63525f2da6ba2ef40c9d7b0a034a1211d2a9702a15ffe993467f2533ac852b9303cd51d9400057440397ef70ac4b776805b9496324a7afa42150b73c05a593875c70d2133923245554638ea12895b0cc8c49639ba50f7e5ae2ec7acfa4b80d8dc78a6b33846a1e2f4332", &(0x7f00000005c0)=""/56}, 0x18)
fstat(r0, &(0x7f00000003c0)={0x0, 0x0, 0x0, 0x0, 0x0, <r6=>0x0})
sendmsg$netlink(r0, &(0x7f00000004c0)={&(0x7f0000000080)=@proc={0x10, 0x0, 0x25dfdbff, 0x4000010}, 0xc, &(0x7f0000000140)=[{&(0x7f0000000c00)=ANY=[@ANYBLOB="1c0000000000000000000008c84455745c5331ccf719faa52dbd7000fc"], 0x1c}, {&(0x7f0000000680)={0x55c, 0x30, 0xa04, 0x70bd2b, 0x25dfdbfe, "", [@nested={0xc8, 0x30, [@generic="5b887c1724ec1113138a3fd121a8fba0ea8121cd1bf3", @typed={0x8, 0x26, @u32=0x1}, @generic="209386674276615cd28a905083c1374a5b8da325ba017e94a7ddc9c936570bc86bc6193a983c25a35b8c2488ea9f5a1c360b7b67bbbfa9f78e44557ddc3d8ec28b0dfa76167f7680f69f27f4830e87c53cd1e6bccebf3a4af6f4a55e63dbc1df51a925d8d1d5203294b789d2ce492db1218dfa2271eae5ee570689e525e09d2a73dc3f0d44f4d051fe05fee422b5c939ab1f3a1ce4fd9e108ee66677d80a2d49154dd30c3e8f"]}, @generic="d53894547c4ed081cb2880edf85e578e6454a5b43f3bb065d8f8c94cd878efa674f4c0598ebb63aa0b7dc565ee7387511c4dcd09fce3207cefe5d93da8209fd7eba3baa3d1234a385184209086353ed7d8f075f8a08ba22ac4860ea426df9ecc6f7f4a47bbe81b6813e0c3aacc1c627b31158bc8648456e600eee4d46ab8c60c0b45e7ccee228469ebcd496cc94fc733e56bccaf375fa452f003112568342dafe12bd52e7c85fb8a", @generic="1f5a26b67d94a689920485fc7bb3f791c25f14e12ca5ecd5641f575272b51b1becb92627cab0dba83843bc9e80a0918ba6d792b2b6d765471dbb6a8c01df50b4c789feac4e653d7b0cf4c52fe5d26549640d007c6b29a1899209dbfeccef0122e9a2abbbb1d44b4ff2c4f171f5e79092fcf32224a176e87d8f3538ed828f9000f234cea1f0a24132305f515975afe7aa1c3168d64c6bae1fa310a3a746313935c255ae3517e3", @nested={0x9c, 0x5b, [@typed={0x88, 0x43, @binary="7500289464444ef9947677d90983a481540d8835876d4d1463803f92c14298ca815be9eb1888343b00d25750352267ce63e3120e967cff57893eeaf8c2d4d0edee7c5253933961a26f86096a685cd31c143b22a68e108d951c81b6f9410de42a4bc94ee18a1fd8b19341f4bbbff56e222d70e8c3198befb357115d82b3ef39c6479360f2"}, @typed={0x10, 0x40, @str='userkeyring\x00'}]}, @nested={0x298, 0x5b, [@typed={0x14, 0x7b, @ipv6=@initdev={0xfe, 0x88, [], 0x1, 0x0}}, @generic="3f733ba61998207612fef00a017de1e27a2b2b5c0e5e2c5fabcac19cd4f4c386cda6ef8664e7fa98fc79b0cbcba7bb42f6bdb2e28629d059b9f41a3d77c5abc4560a507732e4a3acdbeec37a0de0c378c0cb211474c3b0b08e6d5c0e9bd20d651e4dfe44fe100f7133410433b302d60890ae0e0fa1c6657c65dafd6171e321712e3cd9dd0a9f872d4b5f1b9d8fdebe7dc1d1b349c88e791e7d171a4806c94f25d5d9e7a61ad7fc578bba6ed3386238e4312b5699ad8ecf2035e17803ad1c4b0700c704dd3a104ff551aee6d55c7da7d891681ebc", @generic="37b2e3ad0d2db57f7d7d0221e183bf0ba7081beda276c15af58789f100ebc40f9136b5f85d51931d80859c5ce6ec24bca65ae2c20cb38c1f319ff04ee3de5d54bef6b3907cb1d90f949852907379cac9b9618b1b75645ef26fd532e36b9359ad2a7ecedef930d9a837ad1f5e3c758f04cf25a8f63c27197066762a559f6af6d515a2c27f56760002e81937b49fa4aafc9e321dfd5c00d0a0ae56c18f31755d6169e7e229af50e4", @generic="fc5d2eb3b26a0cc396133323c7925689111a4032e7f9abc8457f0202b011254a319138bec9b60e82c16613dd7c40282f597e68fa285f32def8078336b8a2caa674c3201b0877ba38bd15b4037f739c3d232ed241", @generic="8ccead3e5e9b679f9b65380caa644ffbcbec444f7cb4bfe9e6dad53df5bfe2b13619a883bef7785336956e1c4bb513f01b558daaf09287d93f7a0b7e145d0d7fc0e5d17664c5eaa1e58e2a142b72be4768f2bbddc601a7308aa3a7d3f825", @generic="5de182a9a268e7ba4b8ba3f52813ae2b4a5d1103d0329fa8bea762a0c97831761670c93431eeb0d9b1d16f378a6ce81493cd81d358e27d134593c3fed10aa868f4bad151c3566d554648f4196ff65de297aef5"]}]}, 0x55c}], 0x2, &(0x7f0000000440)=ANY=[@ANYBLOB="20000000000000000100000002000000", @ANYRES32=r1, @ANYRES32=r2, @ANYRES32=r3, @ANYBLOB="0000000000010000000100000000000000000000", @ANYRES32=r0, @ANYRES32=r0, @ANYRES32=r0, @ANYBLOB="0000000020000000000000000100000002000000", @ANYRES32=r4, @ANYRES32=r5, @ANYRES32=r6, @ANYBLOB='\x00\x00\x00\x00'], 0x41, 0x40c1}, 0x24040090)
ioctl$EVIOCSKEYCODE_V2(r0, 0x40284504, &(0x7f0000000100)={0x20, 0xf, 0x80000001, 0x2, "1630d7e23717518c4873a969434e297b7ab3f45634216b7414b43da96eed2e42"})
readv(r0, &(0x7f0000000640)=[{&(0x7f0000000000)=""/96, 0x60}], 0x1)
fcntl$setpipe(r0, 0x407, 0xc7)
ioctl$sock_FIOGETOWN(r0, 0x8903, &(0x7f0000000c40))

15:06:50 executing program 4:
r0 = socket$inet_udplite(0x2, 0x2, 0x88)
ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f3188b070")
r1 = syz_open_procfs(0x0, &(0x7f0000000080)='net/dev_mcast\x00')
io_setup(0x1, &(0x7f0000000040)=<r2=>0x0)
getsockname$packet(r1, &(0x7f0000000280)={0x11, 0x0, <r3=>0x0}, &(0x7f00000002c0)=0x14)
stat(&(0x7f0000000300)='./file0\x00', &(0x7f0000000340)={0x0, 0x0, 0x0, 0x0, <r4=>0x0})
ioctl$EXT4_IOC_ALLOC_DA_BLKS(r1, 0x660c)
getsockopt$inet_IP_XFRM_POLICY(r1, 0x0, 0x11, &(0x7f00000004c0)={{{@in=@broadcast, @in6=@dev, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, <r5=>0x0}}, {{@in=@local}, 0x0, @in=@initdev}}, &(0x7f00000005c0)=0xe8)
sendmsg$nl_xfrm(r1, &(0x7f0000000780)={&(0x7f0000000240)={0x10, 0x0, 0x0, 0x810}, 0xc, &(0x7f0000000740)={&(0x7f0000000600)=@report={0x13c, 0x20, 0x2, 0x70bd27, 0x25dfdbfc, {0xff, {@in6=@mcast2, @in6=@empty, 0x4e24, 0x0, 0x4e21, 0x81, 0xa, 0x20, 0x0, 0x5c, r3, r4}}, [@coaddr={0x14, 0xe, @in=@empty}, @extra_flags={0x8, 0x18, 0xfffffffffffffffe}, @offload={0xc, 0x1c, {r5, 0x2}}, @algo_aead={0xa4, 0x12, {{'rfc7539(ecb-cipher_null,sha1-avx)\x00'}, 0x2b8, 0x1e0, "c52d0a85ebe2bfd0e41d451c4cdd7650dfa5b099aa18cef2852ba9864838680f53251d7f84f42345ee26ea097c69f0bf1d459eed611475066bea98a9221d96a45f762c4149d5bec4d74e0af603f4cd902f80749e524e92"}}, @lifetime_val={0x24, 0x9, {0x7ff, 0xffffffff7fffffff, 0xfffffffffffffff9, 0x6}}]}, 0x13c}, 0x1, 0x0, 0x0, 0x4004000}, 0x4000)
io_cancel(r2, &(0x7f00000001c0)={0x0, 0x0, 0x0, 0x6, 0x100000001, r1, &(0x7f00000000c0)="fdc3b2a8e6e42233dc61911b5ed3d75499dc6583a30df4e2c84d5802a63d90eb7b160675362245e303acaa2ba9359e320ff6d664ea79c044845a582a159768a307fee6eb292ca33cb8f7bc565d7956495e0661e03d0534d185f0fbcd8488b9408e68cad96c5ec812bdf14fb8a782ecf8beb0e05dd23aad14a37f5be2f94d615dd293a8d9998a9d04210a4a68c526fa9384e83e204ac97ec337436e45e27756398c6fe77ec7ebec42f5044a6c2525aa798d919809d17bbe7ffbe7ca2bd2e3dc53ecd3a40f8e60fb4100448c0856e1d7d8dd2d6a587b78c4ef383a02ed6c119aafd517e7dae87e4c73eb678c9b03bbaaa234f1b091c35ccdf4a54bf36734715f", 0xff, 0x40, 0x0, 0x1}, &(0x7f0000000200))
setsockopt$inet_MCAST_MSFILTER(r0, 0x0, 0x30, &(0x7f00000007c0)={0x1, {{0x2, 0x4e21, @dev={0xac, 0x14, 0x14, 0x1c}}}, 0x1, 0x6, [{{0x2, 0x4e23, @initdev={0xac, 0x1e, 0x1, 0x0}}}, {{0x2, 0x4e21, @rand_addr=0x4}}, {{0x2, 0x4e22, @multicast2}}, {{0x2, 0x4e21, @multicast1}}, {{0x2, 0x4e23, @multicast2}}, {{0x2, 0x4e20, @multicast2}}]}, 0x390)
lseek(r1, 0x20000, 0x0)

[ 1131.822126] binder: 2554:2562 BC_INCREFS_DONE u0000000000000000 no match
15:06:50 executing program 3:
socket$inet_udplite(0x2, 0x2, 0x88)
ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f3188b070")
recvmmsg(0xffffffffffffffff, &(0x7f0000003840)=[{{0x0, 0x0, 0x0}}], 0x1, 0x0, 0x0)
r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)={0x10b, 0x6, 0x209e1e, 0x3, 0x1}, 0x2c)
bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000b40)={r0, &(0x7f0000000040), 0x0, 0x1}, 0x20)
r1 = creat(&(0x7f0000000640)='./file0\x00', 0x100)
setsockopt$inet6_tcp_TCP_REPAIR_QUEUE(r1, 0x6, 0x14, &(0x7f0000000980), 0x4)
unlink(&(0x7f0000000940)='./file0\x00')
r2 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_GET_NODE_DEBUG_INFO(r2, 0xc018620b, &(0x7f0000000100))
ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)})
ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0x0, 0x0, &(0x7f0000000780)})

15:06:50 executing program 1:
r0 = socket$inet_udplite(0x2, 0x2, 0x88)
ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f3188")
recvmmsg(0xffffffffffffffff, &(0x7f0000003840)=[{{0x0, 0x0, 0x0}}], 0x1, 0x0, 0x0)
r1 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)={0x10b, 0x6, 0x209e1e, 0x3, 0x1}, 0x2c)
bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000b40)={r1, &(0x7f0000000040), 0x0, 0x1}, 0x20)
r2 = creat(&(0x7f0000000640)='./file0\x00', 0x100)
setsockopt$inet6_tcp_TCP_REPAIR_QUEUE(r2, 0x6, 0x14, &(0x7f0000000980), 0x4)
unlink(&(0x7f0000000940)='./file0\x00')
r3 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_GET_NODE_DEBUG_INFO(r3, 0xc018620b, &(0x7f0000000100))
ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)})
ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0x0, 0x0, &(0x7f0000000780)})

15:06:50 executing program 2:
openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000080)='/dev/vga_arbiter\x00', 0x270001, 0x0)
r0 = syz_open_procfs(0x0, &(0x7f00000000c0)='maps\x00')
lseek(r0, 0x20000, 0x0)
readv(r0, &(0x7f0000000640)=[{&(0x7f0000000000)=""/96, 0x60}], 0x1)
creat(&(0x7f0000000100)='./file0\x00', 0x131)

[ 1131.901331] binder: 2563:2567 unknown command 36795
[ 1131.912122] binder: 2563:2567 ioctl c0306201 20000140 returned -22
[ 1131.946450] binder_alloc: 2563: binder_alloc_buf, no vma
[ 1131.966596] binder_alloc: 2563: binder_alloc_buf, no vma
[ 1131.972795] binder_alloc: 2563: binder_alloc_buf, no vma
[ 1131.972806] binder: 2577:2582 transaction failed 29189/-3, size 24-8 line 3254
[ 1131.973264] binder: 2577:2582 BC_INCREFS_DONE u0000000000000000 no match
15:06:50 executing program 4:
r0 = socket$inet_udplite(0x2, 0x2, 0x88)
ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f3188b070")
r1 = syz_open_procfs(0x0, &(0x7f0000000080)='net/dev_mcast\x00')
ioctl$SIOCGSTAMP(r1, 0x8906, &(0x7f0000000040))
r2 = getpgid(0xffffffffffffffff)
getpgrp(r2)
ioctl$sock_SIOCGIFCONF(r1, 0x8912, &(0x7f0000000100)=@req={0x28, &(0x7f00000000c0)={'vxcan1\x00', @ifru_ivalue=0x71cf}})
openat$selinux_status(0xffffffffffffff9c, &(0x7f0000000140)='/selinux/status\x00', 0x0, 0x0)
lseek(r1, 0x20000, 0x0)

15:06:50 executing program 1:
r0 = socket$inet_udplite(0x2, 0x2, 0x88)
ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f3188")
recvmmsg(0xffffffffffffffff, &(0x7f0000003840)=[{{0x0, 0x0, 0x0}}], 0x1, 0x0, 0x0)
r1 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)={0x10b, 0x6, 0x209e1e, 0x3, 0x1}, 0x2c)
bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000b40)={r1, &(0x7f0000000040), 0x0, 0x1}, 0x20)
r2 = creat(&(0x7f0000000640)='./file0\x00', 0x100)
setsockopt$inet6_tcp_TCP_REPAIR_QUEUE(r2, 0x6, 0x14, &(0x7f0000000980), 0x4)
unlink(&(0x7f0000000940)='./file0\x00')
r3 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_GET_NODE_DEBUG_INFO(r3, 0xc018620b, &(0x7f0000000100))
ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)})
ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0x0, 0x0, &(0x7f0000000780)})

[ 1131.984471] binder: 2575:2583 transaction failed 29189/-3, size 24-8 line 3254
[ 1131.986699] binder: 2563:2567 transaction failed 29189/-3, size 24-8 line 3254
[ 1132.019590] binder: 2563:2586 BC_INCREFS_DONE u0000000000000000 no match
[ 1132.020848] binder: 2575:2583 BC_INCREFS_DONE u0000000000000000 no match
15:06:50 executing program 3:
r0 = socket$inet_udplite(0x2, 0x2, 0x88)
ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f3188b070")
syz_open_procfs(0x0, &(0x7f0000000940)='syscall\x00')
r1 = syz_open_procfs(0x0, &(0x7f0000000040)='fd\x00')
recvmmsg(0xffffffffffffffff, &(0x7f0000003840)=[{{0x0, 0x0, 0x0}}], 0x1, 0x0, 0x0)
perf_event_open(&(0x7f0000940000)={0x2, 0x70, 0xee6a, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x100, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0xff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x10001, 0x1}, 0x0, 0x400000000000000}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
mlock(&(0x7f00005b8000/0x3000)=nil, 0x3000)
ioctl$SNDRV_TIMER_IOCTL_SELECT(0xffffffffffffffff, 0x40345410, 0x0)
openat$uinput(0xffffffffffffff9c, &(0x7f0000000080)='/dev/uinput\x00', 0x2, 0x0)
mmap(&(0x7f000060b000/0x1000)=nil, 0x1000, 0x5, 0x8000400200000033, r1, 0x0)
perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x2, 0x9, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2000000, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x4000000, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8)
r2 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)={0x10b, 0x6, 0x209e1e, 0x3, 0x1}, 0x2c)
bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000b40)={r2, &(0x7f0000000040), 0x0, 0x1}, 0x20)
r3 = creat(&(0x7f0000000640)='./file0\x00', 0x100)
setsockopt$inet6_tcp_TCP_REPAIR_QUEUE(r3, 0x6, 0x14, &(0x7f0000000980), 0x4)
unlink(&(0x7f0000000940)='./file0\x00')
r4 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r5 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r5, 0x0)
ioctl$BINDER_GET_NODE_DEBUG_INFO(r4, 0xc018620b, &(0x7f0000000100))
ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f00000000c0)=ANY=[@ANYBLOB="bb8f0000"], 0x0, 0x0, 0x0})
ioctl$BINDER_SET_CONTEXT_MGR(r5, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)})
ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0x0, 0x0, &(0x7f0000000780)})
creat(&(0x7f00000000c0)='./file0\x00', 0x0)

15:06:50 executing program 0:
r0 = socket$inet_udplite(0x2, 0x2, 0x88)
ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f3188b070")
syz_open_procfs(0x0, &(0x7f0000000940)='syscall\x00')
r1 = syz_open_procfs(0x0, &(0x7f0000000040)='fd\x00')
recvmmsg(0xffffffffffffffff, &(0x7f0000003840)=[{{0x0, 0x0, 0x0}}], 0x1, 0x0, 0x0)
perf_event_open(&(0x7f0000940000)={0x2, 0x70, 0xee6a, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x100, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0xff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x10001, 0x1}, 0x0, 0x400000000000000}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
mlock(&(0x7f00005b8000/0x3000)=nil, 0x3000)
ioctl$SNDRV_TIMER_IOCTL_SELECT(0xffffffffffffffff, 0x40345410, 0x0)
openat$uinput(0xffffffffffffff9c, &(0x7f0000000080)='/dev/uinput\x00', 0x2, 0x0)
mmap(&(0x7f000060b000/0x1000)=nil, 0x1000, 0x5, 0x8000400200000033, r1, 0x0)
perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x2, 0x9, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2000000, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x4000000, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8)
r2 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)={0x10b, 0x6, 0x209e1e, 0x3, 0x1}, 0x2c)
bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000b40)={r2, &(0x7f0000000040), 0x0, 0x1}, 0x20)
r3 = creat(&(0x7f0000000640)='./file0\x00', 0x100)
setsockopt$inet6_tcp_TCP_REPAIR_QUEUE(r3, 0x6, 0x14, &(0x7f0000000980), 0x4)
unlink(&(0x7f0000000940)='./file0\x00')
r4 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0)
ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f00000000c0)=ANY=[@ANYBLOB="bb8f0000"], 0x0, 0x0, 0x0})
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
shutdown(0xffffffffffffffff, 0x1)
ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)})
ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0x0, 0x0, &(0x7f0000000780)})
creat(&(0x7f00000000c0)='./file0\x00', 0x0)

[ 1132.121641] binder: 2591:2594 transaction failed 29189/-22, size 24-8 line 3117
[ 1132.140520] binder: 2591:2594 BC_INCREFS_DONE u0000000000000000 no match
[ 1132.198873] binder: 2598:2600 unknown command 36795
[ 1132.208890] binder: 2598:2600 ioctl c0306201 20000140 returned -22
[ 1132.223574] binder: 2599:2601 unknown command 36795
[ 1132.223626] binder: 2598:2600 transaction failed 29189/-22, size 24-8 line 3117
[ 1132.224259] binder: 2598:2600 BC_INCREFS_DONE u0000000000000000 no match
[ 1132.236939] binder: 2599:2601 ioctl c0306201 20000140 returned -22
15:06:51 executing program 5:
r0 = socket$inet_udplite(0x2, 0x2, 0x88)
ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f3188b070")
r1 = syz_open_procfs(0x0, &(0x7f0000000940)='syscall\x00')
r2 = syz_open_procfs(0x0, &(0x7f0000000040)='fd\x00')
recvmmsg(0xffffffffffffffff, &(0x7f0000003840)=[{{0x0, 0x0, 0x0}}], 0x1, 0x0, 0x0)
perf_event_open(&(0x7f0000940000)={0x2, 0x70, 0xee6a, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x100, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0xff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x10001, 0x1}, 0x0, 0x400000000000000}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
mlock(&(0x7f00005b8000/0x3000)=nil, 0x3000)
ioctl$SNDRV_TIMER_IOCTL_SELECT(r1, 0x40345410, 0x0)
openat$uinput(0xffffffffffffff9c, &(0x7f0000000080)='/dev/uinput\x00', 0x2, 0x0)
mmap(&(0x7f000060b000/0x1000)=nil, 0x1000, 0x5, 0x8000400200000033, r2, 0x0)
unshare(0xfffffffffffffffd)
r3 = getpid()
sched_setscheduler(r3, 0x7, &(0x7f0000000540)=0xffffffffffffffff)
open$dir(&(0x7f0000000400)='./file0\x00', 0x0, 0x0)
perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f00000004c0), 0x2}, 0x0, 0x0, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r4 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000340)='memory.current\x00', 0x0, 0x0)
ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, 0x0)
socketpair(0x1, 0x20000000000001, 0x0, &(0x7f0000000100)={<r5=>0xffffffffffffffff, <r6=>0xffffffffffffffff})
ioctl$PERF_EVENT_IOC_SET_FILTER(r6, 0x8914, &(0x7f0000000300)='lo\x00\x96o\xd6Q\xb9Y\xa9\xc8J,\x00\xd2\x97\x04\x03\xdc\r')
close(r4)
rt_sigprocmask(0x2, &(0x7f0000000240)={0x6}, &(0x7f00000002c0), 0x8)
ioctl$PERF_EVENT_IOC_SET_FILTER(r6, 0x8923, &(0x7f00000008c0)='lo\x00\x96o8\x0fd\xa1\xe3\xd7]b}\x1f\xa1Y\xad4\x90\x9d`\xd2\x98\x00\x00\x00 \'Y\x17]\x15c\xcaR\xdd\x98OC\x89\x1b\xe7\x84\xe2\x05\x80w\xd2|D\x8dK\x14Bx\xcbuH\xc2\xeec\xbf<>Y\x1a\xfc\x1f9OB\x81\x89\x186\xc5q@n\xb4\xb6s\xb0\x00\x00\xfc\x00\x00\b\x00\x00\xda\xef\xecE\xec\xd5I\xb2\x9b\xfe\x8d\x90?\x00\xe9\xe4~g:\xc1\xb2aj\x96\xbb\xa7\xe2\xc0\xdc\xf9Q\b\xeb\x16\x7fT\x11\xd3\r7\xe6\"f\xcf\x8e\xabd\x0ftp\x82\xae\xd2\x15\x8e+c\xf6\xbf\xe14>\xa6-\xa5c\xde\xd7\xab\xea\x1f\xf8s2\x9cVF\xd5\x18\xfe\x0e\x8f \x01\x00\x00y.\xfc*\x82\xa5\xa1p5\xc8{\xf7\xef\xab\xe8\x99\xebw#\x8at\x1c\x80\xfc\xb0\x95\xa2\xa7\xd7,Y]E8\x83X\xf5F\xdc\x88-\xf5\xb0\xb5^\xdb\x1a\xb6\xaa\x14\xe2\xb9\rh^J-\xd1\xbaUn\x04\'l\x1b\xe0o\xdb\xc8\x91%\x1c\xb5\xbf\xb6\x90\xb4\xc2\x7f]/\xb3\xe7\xc9\'\x94\xcfIo\xdf\x04\x95\xb5\x06\x84\x1fH>\xda\xc5\x04 \x94\x88\xeb\'\xd4;6\x7f\xd9\x99-\x1b|G\x8d\xd4\xb9%\xaaQ\xa0K\x10\x03\x93\xe1\xcc\xe7m\x80\'\xf0\xa5\xed(\r\xa8\x0f&\xb1\xf3\xff0\f\x82%_\x92\x8bD\xb9\xd9\xe7\xf2\xe4\xc1i#\xdc\x87A\xb9\xc7\r\x92\xfa\x11\x11\xb5\x1f\x03\x9d\xdd\x1bj\xdf\xacg\xe3\xa0S\xd3\x8a\xe1n\x97\xea\xf5\xa0\'\v\xe9\xa0\xf1 f\xaan\xcf\xb5i\xb6d\xbc\x92\v\xd58\x16\b\xb3_:\xa4!\ny\xc4&\nWMM\xa8\xc4\v\x9f\x01o\xf4\xab&\xb6\x17\x02P\xc3!N\xf4\b\x1a~\x91V1s\xe9\xbe\x9e\x9b\'\xcde\xb3\xa1\x86\"\xd7\x04\xf1\xc0!\xed\xff\xee$\xc89\x8cB0\xd1dD\xe0IP\x88\xa2\xf2Y\x9af$$\xf1cO\xf7P\xac\xca\x80:!\xb4\x94#\xcb^\x9f\'\x03\xe3\x93\xb9\x82\xbf\xcf\xc4\xe3\xf7\x03Oh\xf2r\xca\x8ff\xbb/\x9f*\xaf\x1a \xa5\xa0?%M\xa5\x86\x98\xf24\'1\xc7\f<\xcc@\xe8\x8a\xac.\xde\xe4\xc7\xf5\x9ck\xa40!\xe9\x14$\xb3\x05m\xb5m\xed\ft\x93\xd8\xa3\x80\'Y\xb9\x05\xbbt|\xbe\xbcz\n\xf3\xf5p\xf8\x9f~\x1b\xd0\v\x1cQ')
getsockopt$inet_IP_IPSEC_POLICY(r2, 0x0, 0x10, &(0x7f00000006c0)={{{@in6=@loopback}}, {{@in6=@initdev}}}, &(0x7f0000000500)=0xe8)
socketpair(0x2, 0x2000000080003, 0x100, &(0x7f0000000480))
syz_genetlink_get_family_id$SEG6(&(0x7f00000003c0)='SEG6\x00')
sendmsg$SEG6_CMD_DUMPHMAC(r5, &(0x7f0000000580)={&(0x7f0000000380)={0x10, 0x0, 0x0, 0x1000000}, 0xc, &(0x7f0000000440)={&(0x7f00000005c0)=ANY=[@ANYBLOB="2300260109447a0000000000000000660000001400001a0065a455e04ea56d0a47018c8e973bcac914471474a7e0d50a000eadd66d2e49a2ed40dcafa1e046ab6aacc2097d8f75bd9c8b8a220bdde116904efa3f9600f22ab388644f66c2d5baec4079a81bae1927e49e91a4964656d7b227702926af5be846f3de49fad39048633fd9161123894d9427f854a30cb0530bd71890dbe7cc012c8f31f663380e40ce7f6c"], 0x1}, 0x1, 0x0, 0x0, 0x8000}, 0x804)
r7 = creat(&(0x7f0000000280)='./bus\x00', 0x0)
arch_prctl$ARCH_MAP_VDSO_32(0x2002, 0x7e)
ftruncate(r7, 0x2008200)
open(&(0x7f0000000140)='./bus\x00', 0x4000, 0x0)

15:06:51 executing program 2:
r0 = socket$inet6_udp(0xa, 0x2, 0x0)
r1 = inotify_init1(0x80800)
r2 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000080)='rdma.current\x00', 0x0, 0x0)
ioctl$LOOP_CHANGE_FD(r2, 0x4c06, r2)
ioctl$ION_IOC_ALLOC(r2, 0xc0184900, &(0x7f0000000100)={0x3, 0x0, 0x1})
setsockopt$IP6T_SO_SET_REPLACE(r0, 0x29, 0x40, &(0x7f0000000680)=@nat={'nat\x00', 0x1b, 0x5, 0x550, 0x208, 0x208, 0x208, 0x348, 0x0, 0x480, 0x480, 0x480, 0x480, 0x480, 0x5, &(0x7f0000000140), {[{{@ipv6={@mcast1, @dev={0xfe, 0x80, [], 0xd}, [0x0, 0xffffff00, 0xff000000, 0xffffffff], [0xff000000, 0xffffffff, 0xffffffff, 0xff000000], 'bcsh0\x00', 'ip6gretap0\x00', {0xff}, {0xff}, 0x0, 0x4, 0x1, 0x8}, 0x0, 0xf0, 0x118, 0x0, {}, [@common=@ipv6header={0x28, 'ipv6header\x00', 0x0, {0x30, 0x51}}]}, @common=@inet=@SYNPROXY={0x28, 'SYNPROXY\x00', 0x0, {0x1, 0x7, 0x1ff}}}, {{@ipv6={@ipv4={[], [], @local}, @initdev={0xfe, 0x88, [], 0x1, 0x0}, [0xff, 0xffffff00, 0xffffffff], [0xffffffff, 0xffffffff, 0xffffff00], 'netdevsim0\x00', 'syzkaller1\x00', {0xff}, {}, 0x7f, 0xfffffffffffffffb, 0x2, 0x8}, 0x0, 0xc8, 0xf0}, @common=@unspec=@AUDIT={0x28, 'AUDIT\x00', 0x0, {0x2}}}, {{@ipv6={@remote, @ipv4={[], [], @rand_addr=0x7}, [0xffffffff, 0x0, 0xffffff00], [0xffffff00, 0xff000000, 0x0, 0xffffffff], 'ifb0\x00', 'team_slave_0\x00', {}, {0xff}, 0x2f, 0x3d2b, 0x7, 0x40}, 0x0, 0xf8, 0x140, 0x0, {}, [@common=@ah={0x30, 'ah\x00', 0x0, {0x4d2, 0x4d4, 0x93, 0x577122e3, 0x2}}]}, @unspec=@DNAT1={0x48, 'DNAT\x00', 0x1, {0xc, @ipv4=@initdev={0xac, 0x1e, 0x1, 0x0}, @ipv4=@multicast1, @port=0x4e22, @gre_key=0x100000}}}, {{@ipv6={@empty, @remote, [0x0, 0xff, 0x0, 0xffffff00], [0xff, 0xffffff00, 0xffffffff, 0xff], 'caif0\x00', 'ip6erspan0\x00', {0xff}, {0xff}, 0x7f, 0x7fff, 0x7, 0x40}, 0x0, 0xc8, 0x138}, @common=@unspec=@NFLOG={0x70, 'NFLOG\x00', 0x0, {0x516, 0x8, 0x2, 0x1, 0x0, "7686b5f34b5699d83e85740ab87d0f7969d428b162f6abf407a9def2dccd5823f0e9001efc12fcb4cac003da47a8b5e304eeeb3eb2628bb82efc1a46841b24da"}}}], {{[], 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x5b0)
dup3(r1, r0, 0x80000)
r3 = syz_open_procfs(0x0, &(0x7f00000000c0)='maps\x00')
lseek(r3, 0x20000, 0x0)
readv(r3, &(0x7f0000000640)=[{&(0x7f0000000000)=""/96, 0x60}], 0x1)
fcntl$setpipe(r1, 0x407, 0x7)

15:06:51 executing program 1:
r0 = socket$inet_udplite(0x2, 0x2, 0x88)
ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f3188b0")
recvmmsg(0xffffffffffffffff, &(0x7f0000003840)=[{{0x0, 0x0, 0x0}}], 0x1, 0x0, 0x0)
r1 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)={0x10b, 0x6, 0x209e1e, 0x3, 0x1}, 0x2c)
bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000b40)={r1, &(0x7f0000000040), 0x0, 0x1}, 0x20)
r2 = creat(&(0x7f0000000640)='./file0\x00', 0x100)
setsockopt$inet6_tcp_TCP_REPAIR_QUEUE(r2, 0x6, 0x14, &(0x7f0000000980), 0x4)
unlink(&(0x7f0000000940)='./file0\x00')
r3 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_GET_NODE_DEBUG_INFO(r3, 0xc018620b, &(0x7f0000000100))
ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)})
ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0x0, 0x0, &(0x7f0000000780)})

15:06:51 executing program 4:
r0 = socket$inet_udplite(0x2, 0x2, 0x88)
ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f3188b070")
r1 = syz_open_procfs(0x0, &(0x7f0000000080)='net/dev_mcast\x00')
ioctl(r0, 0x3, &(0x7f00000000c0)="4f5ee146f9a9b5856c2800624960eee3154842401eec08c44b1b517d44d336d421d6d8a9e31c5418aee0ae8e1f757700644dcce7b8c53ff04661075679f93a08489246f4e2f4d44eb9a0713e8ddeecd72e3a0e5ac06173ef")
lseek(r1, 0x20000, 0x0)

15:06:51 executing program 0:
r0 = socket$inet_udplite(0x2, 0x2, 0x88)
ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f3188b070")
syz_open_procfs(0x0, &(0x7f0000000940)='syscall\x00')
r1 = syz_open_procfs(0x0, &(0x7f0000000040)='fd\x00')
recvmmsg(0xffffffffffffffff, &(0x7f0000003840)=[{{0x0, 0x0, 0x0}}], 0x1, 0x0, 0x0)
perf_event_open(&(0x7f0000940000)={0x2, 0x70, 0xee6a, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x100, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0xff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x10001, 0x1}, 0x0, 0x400000000000000}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
mlock(&(0x7f00005b8000/0x3000)=nil, 0x3000)
ioctl$SNDRV_TIMER_IOCTL_SELECT(0xffffffffffffffff, 0x40345410, 0x0)
openat$uinput(0xffffffffffffff9c, &(0x7f0000000080)='/dev/uinput\x00', 0x2, 0x0)
mmap(&(0x7f000060b000/0x1000)=nil, 0x1000, 0x5, 0x8000400200000033, r1, 0x0)
perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x2, 0x9, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2000000, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x4000000, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8)
r2 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)={0x10b, 0x6, 0x209e1e, 0x3, 0x1}, 0x2c)
bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000b40)={r2, &(0x7f0000000040), 0x0, 0x1}, 0x20)
r3 = creat(&(0x7f0000000640)='./file0\x00', 0x100)
setsockopt$inet6_tcp_TCP_REPAIR_QUEUE(r3, 0x6, 0x14, &(0x7f0000000980), 0x4)
unlink(&(0x7f0000000940)='./file0\x00')
r4 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0)
ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f00000000c0)=ANY=[@ANYBLOB="bb8f0000"], 0x0, 0x0, 0x0})
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
shutdown(0xffffffffffffffff, 0x1)
ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)})
ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0x0, 0x0, &(0x7f0000000780)})
creat(&(0x7f00000000c0)='./file0\x00', 0x0)

15:06:51 executing program 4:
r0 = socket$inet_udplite(0x2, 0x2, 0x88)
ioctl(r0, 0x7, &(0x7f0000000040)="0a95")
r1 = syz_open_procfs(0x0, &(0x7f0000000080)='net/dev_mcast\x00')
lseek(r1, 0x20000, 0x0)

15:06:51 executing program 2:
r0 = syz_open_procfs(0x0, &(0x7f00000000c0)='maps\x00')
lseek(r0, 0x20000, 0x0)
readv(r0, &(0x7f0000000640)=[{&(0x7f0000000000)=""/96, 0x60}], 0x1)
ioctl$TIOCLINUX7(r0, 0x541c, &(0x7f0000000080)={0x7, 0x5})

[ 1132.322145] binder: 2599:2609 BC_INCREFS_DONE node 1471 has no pending increfs request
15:06:51 executing program 2:
r0 = syz_open_procfs(0x0, &(0x7f00000000c0)='maps\x00')
lseek(r0, 0x80000020000, 0x8001000007)
r1 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000140)='IPVS\x00')
sendmsg$IPVS_CMD_NEW_DAEMON(r0, &(0x7f0000000280)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0xa18141}, 0xc, &(0x7f0000000240)={&(0x7f0000000180)={0xc0, r1, 0x2c, 0x70bd27, 0x25dfdbff, {}, [@IPVS_CMD_ATTR_SERVICE={0x28, 0x1, [@IPVS_SVC_ATTR_PORT={0x8, 0x4, 0x4e23}, @IPVS_SVC_ATTR_FWMARK={0x8, 0x5, 0x1}, @IPVS_SVC_ATTR_FLAGS={0xc, 0x7, {0x10, 0x5}}, @IPVS_SVC_ATTR_FWMARK={0x8, 0x5, 0x2}]}, @IPVS_CMD_ATTR_TIMEOUT_TCP_FIN={0x8, 0x5, 0x6}, @IPVS_CMD_ATTR_SERVICE={0x48, 0x1, [@IPVS_SVC_ATTR_ADDR={0x14, 0x3, @ipv4=@empty}, @IPVS_SVC_ATTR_ADDR={0x14, 0x3, @ipv4=@remote}, @IPVS_SVC_ATTR_SCHED_NAME={0x8, 0x6, 'rr\x00'}, @IPVS_SVC_ATTR_PORT={0x8, 0x4, 0x4e23}, @IPVS_SVC_ATTR_FLAGS={0xc, 0x7, {0x1}}]}, @IPVS_CMD_ATTR_TIMEOUT_UDP={0x8, 0x6, 0x5}, @IPVS_CMD_ATTR_TIMEOUT_UDP={0x8, 0x6, 0x7}, @IPVS_CMD_ATTR_TIMEOUT_UDP={0x8, 0x6, 0x5}, @IPVS_CMD_ATTR_DEST={0x1c, 0x2, [@IPVS_DEST_ATTR_PORT={0x8, 0x2, 0x4e24}, @IPVS_DEST_ATTR_ADDR_FAMILY={0x8, 0xb, 0xa}, @IPVS_DEST_ATTR_INACT_CONNS={0x8}]}]}, 0xc0}, 0x1, 0x0, 0x0, 0x40001}, 0x40000)
readv(r0, &(0x7f0000000640)=[{&(0x7f0000000000)=""/96, 0x60}], 0x1)
ioctl$TUNGETVNETHDRSZ(r0, 0x800454d7, &(0x7f0000000080))

15:06:51 executing program 4:
getrandom(&(0x7f0000000040)=""/55, 0x37, 0x2)
r0 = socket$inet_udplite(0x2, 0x2, 0x88)
ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f3188b070")
r1 = syz_open_procfs(0x0, &(0x7f0000000080)='net/dev_mcast\x00')
lseek(r1, 0x20000, 0x0)

[ 1132.425608] binder: 2613:2618 unknown command 36795
[ 1132.431735] binder: 2611:2627 BC_INCREFS_DONE node 1474 has no pending increfs request
[ 1132.440779] binder: 2613:2618 ioctl c0306201 20000140 returned -22
[ 1132.497117] binder: 2613:2625 BC_INCREFS_DONE node 1477 has no pending increfs request
15:06:51 executing program 2:
r0 = syz_open_procfs(0x0, &(0x7f00000000c0)='maps\x00')
lseek(r0, 0x20000, 0x0)
readv(r0, &(0x7f0000000640)=[{&(0x7f0000000000)=""/96, 0x60}], 0x1)
r1 = syz_genetlink_get_family_id$tipc(&(0x7f0000000100)='TIPC\x00')
sendmsg$TIPC_CMD_SET_LINK_TOL(r0, &(0x7f00000001c0)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x3}, 0xc, &(0x7f0000000180)={&(0x7f0000000140)={0x30, r1, 0x500, 0x70bd29, 0x25dfdbfb, {{}, 0x0, 0x4107, 0x0, {0x14, 0x18, {0x9, @bearer=@udp='udp:syz1\x00'}}}, ["", "", "", ""]}, 0x30}, 0x1, 0x0, 0x0, 0x14}, 0x20000000)

15:06:51 executing program 3:
r0 = socket$inet_udplite(0x2, 0x2, 0x88)
ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f3188b070")
syz_open_procfs(0x0, &(0x7f0000000940)='syscall\x00')
r1 = syz_open_procfs(0x0, &(0x7f0000000040)='fd\x00')
recvmmsg(0xffffffffffffffff, &(0x7f0000003840)=[{{0x0, 0x0, 0x0}}], 0x1, 0x0, 0x0)
perf_event_open(&(0x7f0000940000)={0x2, 0x70, 0xee6a, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x100, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0xff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x10001, 0x1}, 0x0, 0x400000000000000}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
mlock(&(0x7f00005b8000/0x3000)=nil, 0x3000)
ioctl$SNDRV_TIMER_IOCTL_SELECT(0xffffffffffffffff, 0x40345410, 0x0)
openat$uinput(0xffffffffffffff9c, &(0x7f0000000080)='/dev/uinput\x00', 0x2, 0x0)
mmap(&(0x7f000060b000/0x1000)=nil, 0x1000, 0x5, 0x8000400200000033, r1, 0x0)
perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x2, 0x9, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2000000, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x4000000, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8)
r2 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)={0x10b, 0x6, 0x209e1e, 0x3, 0x1}, 0x2c)
bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000b40)={r2, &(0x7f0000000040), 0x0, 0x1}, 0x20)
r3 = creat(&(0x7f0000000640)='./file0\x00', 0x100)
setsockopt$inet6_tcp_TCP_REPAIR_QUEUE(r3, 0x6, 0x14, &(0x7f0000000980), 0x4)
unlink(&(0x7f0000000940)='./file0\x00')
r4 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r5 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r5, 0x0)
ioctl$BINDER_GET_NODE_DEBUG_INFO(r4, 0xc018620b, &(0x7f0000000100))
ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f00000000c0)=ANY=[@ANYBLOB="bb8f0000"], 0x0, 0x0, 0x0})
ioctl$BINDER_SET_CONTEXT_MGR(r5, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)})
ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0x0, 0x0, &(0x7f0000000780)})
creat(&(0x7f00000000c0)='./file0\x00', 0x0)

15:06:51 executing program 5:
r0 = socket$inet_udplite(0x2, 0x2, 0x88)
ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f3188b070")
syz_open_procfs(0x0, &(0x7f0000000940)='syscall\x00')
r1 = syz_open_procfs(0x0, &(0x7f0000000040)='fd\x00')
recvmmsg(0xffffffffffffffff, &(0x7f0000003840)=[{{0x0, 0x0, 0x0}}], 0x1, 0x0, 0x0)
perf_event_open(&(0x7f0000940000)={0x2, 0x70, 0xee6a, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x100, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0xff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x10001, 0x1}, 0x0, 0x400000000000000}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
mlock(&(0x7f00005b8000/0x3000)=nil, 0x3000)
ioctl$SNDRV_TIMER_IOCTL_SELECT(0xffffffffffffffff, 0x40345410, 0x0)
openat$uinput(0xffffffffffffff9c, &(0x7f0000000080)='/dev/uinput\x00', 0x2, 0x0)
mmap(&(0x7f000060b000/0x1000)=nil, 0x1000, 0x5, 0x8000400200000033, r1, 0x0)
unshare(0xfffffffffffffffd)
r2 = getpid()
sched_setscheduler(r2, 0x5, &(0x7f00000000c0))
open$dir(&(0x7f0000000400)='./file0\x00', 0x0, 0x0)
perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f00000004c0), 0x2}, 0x0, 0x0, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r3 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000340)='memory.current\x00', 0x0, 0x0)
ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, 0x0)
socketpair(0x1, 0x20000000000001, 0x0, &(0x7f0000000100)={<r4=>0xffffffffffffffff, <r5=>0xffffffffffffffff})
ioctl$PERF_EVENT_IOC_SET_FILTER(r5, 0x8914, &(0x7f0000000300)='lo\x00\x96o\xd6Q\xb9Y\xa9\xc8J,\x00\xd2\x97\x04\x03\xdc\r')
close(r3)
rt_sigprocmask(0x2000000, &(0x7f00000007c0)={0x6}, &(0x7f0000000800), 0x8)
ioctl$PERF_EVENT_IOC_SET_FILTER(r5, 0x8923, &(0x7f0000000b00)='lo\xb0E\xeb_X\x87\x13\xbcix\xe9^\x00\x96o\xd6a\xb9Y\xa9\xc8J,\x00\xd2\x97\x04\x03\xf2\rC\x90\x03WR\x1c\xf9\xd2\xd6a1\x92F\n\x0e\xed\xef\xb9;\xd5C`Q\xdek1WG\xff8\x007\xedCIo\xe34;@w\xe8.\xbdS*nb\xb5l\xd96\x93\x88\x15\xd3U\xd5\n\x9c\xe7\xbef;\xd07\xfa\xd0#\b\x95(\xd6\xa4d.\xba\x9cx\x88\xcb\x0e\x88\xf6\xa5>A>Fppoq\x85\x9a\x97\xfdrJ\xd4\xc5r\xc9\xe6\xf0\xf7or\b\xf8\xbdy\x89z\xd9X\xb9?7\x7f8X\xc9\xfa0\xd9\x8a\v\x06U\xde?\xab\x8eK\xf8<C\xd8q\xbc\x7f\xcf\x84\xe1x\xee9:\xdb\x9b+U\xf88\xb2\xc4s5\t\a')
getsockopt$inet_IP_IPSEC_POLICY(r1, 0x0, 0x10, &(0x7f00000006c0)={{{@in6=@loopback}}, {{@in6=@initdev}}}, &(0x7f0000000500)=0xe8)
socketpair(0x2, 0x2000000080003, 0x100, &(0x7f0000000480))
syz_genetlink_get_family_id$SEG6(&(0x7f00000003c0)='SEG6\x00')
sendmsg$SEG6_CMD_DUMPHMAC(r4, &(0x7f0000000580)={&(0x7f0000000380)={0x10, 0x0, 0x0, 0x1000000}, 0xc, &(0x7f0000000440)={&(0x7f0000000980)=ANY=[@ANYBLOB="00000000660000001400001a00652355e04ea56d0a4701758bd97e0a271b138c8e973bcac91447146d2e49a275bd9c8b8aacb9a7e716904afa3f9600f22ab35472a7504f5ac2d5baec4079a81bae192729ea571bc34026af5be846f3de49fad39048633fd9161123894d9427f854a30cb053aa6a3e012bfbfa782843c159c8aaf0652c8f31f663380e4000000000000000000000000000000000000000000000000000000000000000000000000000008761b396d918773424b6dc13e0db79d778803e026bdadd8e4491a91541ca011e412a8f84b25054af38409a5df34bd99c09f82263ea4853210a51d2fa4df489487f1fd5c8858aa79d7154d6063c3e6f7a17ae390eba0fa3d9f17433d5e991d214d66bff910c63805bd99002bf9574560f51bb4bb5717207140d14f5dd1a59f8ea2bc2"], 0x1}, 0x1, 0x0, 0x0, 0x8000}, 0x804)
r6 = creat(&(0x7f0000000280)='./bus\x00', 0x0)
arch_prctl$ARCH_MAP_VDSO_32(0x2002, 0x7e)
ftruncate(r6, 0x2008200)
open(&(0x7f0000000140)='./bus\x00', 0x4000, 0x0)

15:06:51 executing program 4:
r0 = socket$inet_udplite(0x2, 0x2, 0x88)
ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f3188b070")
r1 = syz_open_procfs(0x0, &(0x7f0000000080)='net/dev_mcast\x00')
fsetxattr(r0, &(0x7f0000000040)=@random={'os2.', 'net/dev_mcast\x00'}, &(0x7f00000000c0)='net/dev_mcast\x00', 0xe, 0x3)
lseek(r1, 0x20000, 0x0)

15:06:51 executing program 2:
r0 = syz_open_procfs(0x0, &(0x7f00000000c0)='maps\x00')
lseek(r0, 0x20000, 0x0)
readv(r0, &(0x7f0000000640)=[{&(0x7f0000000000)=""/96, 0x60}], 0x1)
epoll_ctl$EPOLL_CTL_MOD(r0, 0x3, r0, &(0x7f0000000300))
ioctl$TUNSETSTEERINGEBPF(r0, 0x800454e0, &(0x7f0000000100)=r0)
setsockopt$inet_mreq(r0, 0x0, 0x27, &(0x7f0000000080)={@multicast2, @rand_addr=0xa0}, 0x8)
io_setup(0x56c, &(0x7f0000000140)=<r1=>0x0)
io_cancel(r1, &(0x7f0000000280)={0x0, 0x0, 0x0, 0x8, 0x9, r0, &(0x7f0000000180)="c6ff007d841fb90b07085bde9cd4b93d06e3eda06c5e64be1ed7c405f23a04677e56289806c4519d9ef18ca98157d5267402a658821f86af217c6744bfb695f15b8bbf946d91e74f1cad97de1f8009b7b9519ca051ee145c0d5474785bc993addd8203b97201c6d07b6b91f2a71bc6464227cad76b12e0899b25431151a37da814b0e434072c969d588669a208a442078a20576713a5d3504c94fc2bb2cad7cf2408e45928c8f0b2aac5467fad7aafb4afec162b0911af8dda5bbc4ffc7a4093aeae70cc580422b5125633588dce1b5ebf1b38e4180f81d31b", 0xd9, 0x10001, 0x0, 0x2, r0}, &(0x7f00000002c0))

15:06:51 executing program 1:
r0 = socket$inet_udplite(0x2, 0x2, 0x88)
ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f3188b0")
recvmmsg(0xffffffffffffffff, &(0x7f0000003840)=[{{0x0, 0x0, 0x0}}], 0x1, 0x0, 0x0)
r1 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)={0x10b, 0x6, 0x209e1e, 0x3, 0x1}, 0x2c)
bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000b40)={r1, &(0x7f0000000040), 0x0, 0x1}, 0x20)
r2 = creat(&(0x7f0000000640)='./file0\x00', 0x100)
setsockopt$inet6_tcp_TCP_REPAIR_QUEUE(r2, 0x6, 0x14, &(0x7f0000000980), 0x4)
unlink(&(0x7f0000000940)='./file0\x00')
r3 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_GET_NODE_DEBUG_INFO(r3, 0xc018620b, &(0x7f0000000100))
ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)})
ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0x0, 0x0, &(0x7f0000000780)})

15:06:51 executing program 0:
r0 = socket$inet_udplite(0x2, 0x2, 0x88)
ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f3188b070")
syz_open_procfs(0x0, &(0x7f0000000940)='syscall\x00')
r1 = syz_open_procfs(0x0, &(0x7f0000000040)='fd\x00')
recvmmsg(0xffffffffffffffff, &(0x7f0000003840)=[{{0x0, 0x0, 0x0}}], 0x1, 0x0, 0x0)
perf_event_open(&(0x7f0000940000)={0x2, 0x70, 0xee6a, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x100, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0xff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x10001, 0x1}, 0x0, 0x400000000000000}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
mlock(&(0x7f00005b8000/0x3000)=nil, 0x3000)
ioctl$SNDRV_TIMER_IOCTL_SELECT(0xffffffffffffffff, 0x40345410, 0x0)
openat$uinput(0xffffffffffffff9c, &(0x7f0000000080)='/dev/uinput\x00', 0x2, 0x0)
mmap(&(0x7f000060b000/0x1000)=nil, 0x1000, 0x5, 0x8000400200000033, r1, 0x0)
perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x2, 0x9, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2000000, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x4000000, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8)
r2 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)={0x10b, 0x6, 0x209e1e, 0x3, 0x1}, 0x2c)
bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000b40)={r2, &(0x7f0000000040), 0x0, 0x1}, 0x20)
r3 = creat(&(0x7f0000000640)='./file0\x00', 0x100)
setsockopt$inet6_tcp_TCP_REPAIR_QUEUE(r3, 0x6, 0x14, &(0x7f0000000980), 0x4)
unlink(&(0x7f0000000940)='./file0\x00')
r4 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0)
ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f00000000c0)=ANY=[@ANYBLOB="bb8f0000"], 0x0, 0x0, 0x0})
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
shutdown(0xffffffffffffffff, 0x1)
ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)})
ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0x0, 0x0, &(0x7f0000000780)})
creat(&(0x7f00000000c0)='./file0\x00', 0x0)

[ 1132.964046] binder: release 2599:2601 transaction 1470 out, still active
[ 1132.977488] binder: send failed reply for transaction 1470, target dead
[ 1132.986877] binder: send failed reply for transaction 1473 to 2611:2617
[ 1132.993907] binder: send failed reply for transaction 1476 to 2613:2618
15:06:51 executing program 4:
r0 = socket$inet_udplite(0x2, 0x2, 0x88)
ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f3188b070")
r1 = syz_open_procfs(0x0, &(0x7f0000000080)='net/dev_mcast\x00')
lseek(r1, 0x800000001fffe, 0x3)
r2 = openat(r1, &(0x7f0000000040)='./file0\x00', 0x2300, 0x170)
setsockopt$inet_tcp_TCP_CONGESTION(r2, 0x6, 0xd, &(0x7f00000000c0)='cdg\x00', 0x4)

15:06:51 executing program 2:
fcntl$getownex(0xffffffffffffff9c, 0x10, &(0x7f0000000080)={0x0, <r0=>0x0})
r1 = syz_open_procfs(r0, &(0x7f00000000c0)='maps\x00')
lseek(r1, 0x20000, 0x0)
readv(r1, &(0x7f0000000640)=[{&(0x7f0000000000)=""/96, 0x60}], 0x1)

[ 1133.089180] binder: 2670:2672 transaction failed 29189/-22, size 24-8 line 3117
[ 1133.116529] binder: 2670:2672 BC_INCREFS_DONE u0000000000000000 no match
15:06:52 executing program 1:
r0 = socket$inet_udplite(0x2, 0x2, 0x88)
ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f3188b0")
recvmmsg(0xffffffffffffffff, &(0x7f0000003840)=[{{0x0, 0x0, 0x0}}], 0x1, 0x0, 0x0)
r1 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)={0x10b, 0x6, 0x209e1e, 0x3, 0x1}, 0x2c)
bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000b40)={r1, &(0x7f0000000040), 0x0, 0x1}, 0x20)
r2 = creat(&(0x7f0000000640)='./file0\x00', 0x100)
setsockopt$inet6_tcp_TCP_REPAIR_QUEUE(r2, 0x6, 0x14, &(0x7f0000000980), 0x4)
unlink(&(0x7f0000000940)='./file0\x00')
r3 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_GET_NODE_DEBUG_INFO(r3, 0xc018620b, &(0x7f0000000100))
ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)})
ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0x0, 0x0, &(0x7f0000000780)})

15:06:52 executing program 4:
r0 = socket$inet_udplite(0x2, 0x2, 0x88)
ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f3188b070")
r1 = syz_open_procfs(0x0, &(0x7f0000000080)='net/dev_mcast\x00')
lseek(r1, 0x20000, 0x0)
setsockopt$inet_udp_encap(r1, 0x11, 0x64, &(0x7f0000000040)=0x4, 0x4)
ioctl$PPPIOCGNPMODE(r1, 0xc008744c, &(0x7f00000000c0)={0x8057, 0x3})

[ 1133.186820] binder: 2663:2668 unknown command 36795
[ 1133.194216] binder: 2663:2668 ioctl c0306201 20000140 returned -22
[ 1133.208076] binder: 2673:2676 unknown command 36795
[ 1133.217991] binder: 2673:2676 ioctl c0306201 20000140 returned -22
15:06:52 executing program 2:
r0 = syz_open_procfs(0x0, &(0x7f00000000c0)='maps\x00')
lseek(r0, 0x20000, 0x0)
readv(r0, &(0x7f0000000640)=[{&(0x7f0000000000)=""/96, 0x60}], 0x1)

15:06:52 executing program 2:
r0 = syz_open_procfs(0x0, &(0x7f00000000c0)='maps\x00')
lseek(r0, 0x20000, 0x0)
readv(r0, &(0x7f0000000640)=[{&(0x7f0000000000)=""/96, 0x60}], 0x1)
setsockopt$IPT_SO_SET_REPLACE(r0, 0x0, 0x40, &(0x7f0000000100)=@security={'security\x00', 0xe, 0x4, 0x360, 0xc0, 0xc0, 0x1d8, 0xc0, 0x0, 0x2c8, 0x2c8, 0x2c8, 0x2c8, 0x2c8, 0x4, &(0x7f0000000080), {[{{@ip={@multicast1, @broadcast, 0xffffffff, 0x0, 'veth1_to_hsr\x00', 'bond_slave_1\x00', {0xff}, {}, 0x7f, 0x2}, 0x0, 0x98, 0xc0}, @common=@unspec=@CONNSECMARK={0x28, 'CONNSECMARK\x00', 0x0, {0x1}}}, {{@uncond, 0x0, 0xb8, 0x118, 0x0, {}, [@common=@socket0={0x20, 'socket\x00'}]}, @common=@CLUSTERIP={0x60, 'CLUSTERIP\x00', 0x0, {0x0, @random="170b153638e1", 0x94ac, 0x7, [0x4, 0x1f, 0xf, 0x27, 0x17, 0x1d, 0x1f, 0x12, 0x1b, 0x2f, 0x11, 0x24, 0x15, 0x1d, 0x3d, 0x3], 0x2, 0xffffffffffffffff}}}, {{@uncond, 0x0, 0xc8, 0xf0, 0x0, {}, [@common=@ah={0x30, 'ah\x00', 0x0, {0x400, 0x100000000}}]}, @common=@inet=@SET1={0x28, 'SET\x00', 0x1, {{0x9, 0x7, 0x6}, {0x4, 0x81, 0xfffffffffffffffe}}}}], {{[], 0x0, 0x70, 0x98}, {0x28}}}}, 0x3c0)
ioctl$RNDZAPENTCNT(r0, 0x5204, &(0x7f00000004c0)=0x81)

[ 1133.269875] binder: 2663:2675 BC_INCREFS_DONE node 1482 has no pending increfs request
[ 1133.288384] binder: 2673:2691 BC_INCREFS_DONE node 1485 has no pending increfs request
[ 1133.311326] binder: 2686:2694 BC_INCREFS_DONE node 1488 has no pending increfs request
15:06:52 executing program 3:
r0 = socket$inet_udplite(0x2, 0x2, 0x88)
ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f3188b070")
r1 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB='\x00c@@\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\b\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00', @ANYPTR=&(0x7f0000000040)=ANY=[@ANYBLOB="0000000000210000ad097f335cb0d4215fdf1ba61fbed0ca260d0324c3c99c70c9637ee19ad1df71a3456d45aaf2e663626fc5d19068b466dee1c25142601bb110ef379048e3499d73b44158e1bf861cdd8e71df72742e537604334120cdbe698dddb6537a0e6008a99bd85baa801ce18a50a36b3ade45b95e18b161eb856c1f9278786b8748d52c8a8056eb97ca29faa321ea270c4fd68f65ef651af211d167f550d36dc5dd51ba60dd1da4"]], 0x0, 0x0, 0x0})

15:06:52 executing program 4:
r0 = socket$inet_udplite(0x2, 0x2, 0x88)
ioctl(r0, 0x1000008812, &(0x7f0000000180)="0adc1f123c123f31ffff70ab2db572f9bb6adbcb768834349f0ca47d89bea55907376c91a167a37869d73e26a51b381ec4f5096b13e5525ffe9f523acb52b892419663c62a2d3913924e45e8296276360a857fb28627a3ea065c5df4351a45c5e21832dd1de6b765c00c71c73c6b5d79e40be8bcc82986dff5b30e7ecbc3f42cfe572fc4e0e4da06459cedc1bbf7349e543730b60910908c8b43110fd989bb0e17e38cd4b5e160f9ab9cafa206919d09a39dd16dc4e8cadaf0bceacd972ffff91932e393a40baf1ae6bd5215537f4b0def074e5e6491f03d17099c573705fd5ad9b1eed816c155b78759906f8f55f994c711694b8a5a96fdac35035a716441d7e54a4e9974e71b60de817e967baaa1c43e372dda61948bb42c82c6e370c8a4a5cfd570d38ddaae7f8fc4431e92b2486bb7a374053487093497a2e12fd88190f4696f8c7f6d42f3519b905e24da8adc95efde7f6034b41e1001df8ffb8ab32500d8749c5d48b0992a6b6e8f8f5567a2bb05374adc40f56a9b1941676845acfa6ff6648121b08e30c4d81753f1")
r1 = syz_open_procfs(0x0, &(0x7f0000000080)='net/dev_mcast\x00')
lseek(r1, 0x20000, 0x0)

15:06:52 executing program 2:
ioctl$sock_FIOGETOWN(0xffffffffffffffff, 0x8903, &(0x7f0000000080)=<r0=>0x0)
r1 = syz_open_procfs(r0, &(0x7f00000000c0)='maps\x00')
fallocate(r1, 0x11, 0x200, 0x9)
ioctl$sock_SIOCGIFBR(r1, 0x8940, &(0x7f0000000200)=@get={0x1, &(0x7f0000000140)=""/139, 0x2})
lseek(r1, 0x20000, 0x0)
readv(r1, &(0x7f0000000640)=[{&(0x7f0000000000)=""/96, 0x60}], 0x1)
ioctl$sock_inet_SIOCGIFPFLAGS(r1, 0x8935, &(0x7f0000000100)={'rose0\x00', 0xfffffffffffffffb})

15:06:52 executing program 5:
r0 = socket$inet_udplite(0x2, 0x2, 0x88)
ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f3188b070")
fcntl$getownex(r0, 0x10, &(0x7f0000000540)={0x0, <r1=>0x0})
syz_open_procfs(r1, &(0x7f0000000680)='net/igmp6\x00')
r2 = syz_open_procfs(0x0, &(0x7f0000000040)='fd\x00')
recvmmsg(0xffffffffffffffff, &(0x7f0000003840)=[{{0x0, 0x0, 0x0}}], 0x1, 0x0, 0x0)
perf_event_open(&(0x7f0000940000)={0x2, 0x70, 0xee6a, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x100, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0xff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x10001, 0x1}, 0x0, 0x400000000000000}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
mlock(&(0x7f00005b8000/0x3000)=nil, 0x3000)
ioctl$SNDRV_TIMER_IOCTL_SELECT(0xffffffffffffffff, 0x40345410, 0x0)
openat$uinput(0xffffffffffffff9c, &(0x7f0000000080)='/dev/uinput\x00', 0x2, 0x0)
mmap(&(0x7f000060b000/0x1000)=nil, 0x1000, 0x5, 0x8000400200000033, r2, 0x0)
unshare(0xfffffffffffffffd)
r3 = getpid()
sched_setscheduler(r3, 0x5, &(0x7f00000000c0))
open$dir(&(0x7f0000000400)='./file0\x00', 0x0, 0x0)
perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f00000004c0), 0x2}, 0x0, 0x0, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r4 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000340)='memory.current\x00', 0x0, 0x0)
ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, 0x0)
socketpair(0x1, 0x20000000000001, 0x0, &(0x7f0000000100)={<r5=>0xffffffffffffffff, <r6=>0xffffffffffffffff})
ioctl$PERF_EVENT_IOC_SET_FILTER(r6, 0x8914, &(0x7f0000000300)='lo\x00\x96o\xd6Q\xb9Y\xa9\xc8J,\x00\xd2\x97\x04\x03\xdc\r')
close(r4)
rt_sigprocmask(0x2, &(0x7f0000000240)={0x6}, &(0x7f00000002c0), 0x8)
ioctl$PERF_EVENT_IOC_SET_FILTER(r6, 0x8923, &(0x7f00000008c0)='lo\x00\x96o8\x0fd\xa1\xe3\xd7]b}\x1f\xa1Y\xad4\x90\x9d`\xd2\x98\x00\x00\x00 \'Y\x17]\x15c\xcaR\xdd\x98OC\x89\x1b\xe7\x84\xe2\x05\x80w\xd2|D\x8dK\x14Bx\xcbuH\xc2\xeec\xbf<>Y\x1a\xfc\x1f9OB\x81\x89\x186\xc5q@n\xb4\xb6s\xb0\x00\x00\xfc\x00\x00\b\x00\x00\xda\xef\xecE\xec\xd5I\xb2\x9b\xfe\x8d\x90?\x00\xe9\xe4~g:\xc1\xb2aj\x96\xbb\xa7\xe2\xc0\xdc\xf9Q\b\xeb\x16\x7fT\x11\xd3\r7\xe6\"f\xcf\x8e\xabd\x0ftp\x82\xae\xd2\x15\x8e+c\xf6\xbf\xe14>\xa6-\xa5c\xde\xd7\xab\xea\x1f\xf8s2\x9cVF\xd5\x18\xfe\x0e\x8f \x01\x00\x00y.\xfc*\x82\xa5\xa1p5\xc8{\xf7\xef\xab\xe8\x99\xebw#\x8at\x1c\x80\xfc\xb0\x95\xa2\xa7\xd7,Y]E8\x83X\xf5F\xdc\x88-\xf5\xb0\xb5^\xdb\x1a\xb6\xaa\x14\xe2\xb9\rh^J-\xd1\xbaUn\x04\'l\x1b\xe0o\xdb\xc8\x91%\x1c\xb5\xbf\xb6\x90\xb4\xc2\x7f]/\xb3\xe7\xc9\'\x94\xcfIo\xdf\x04\x95\xb5\x06\x84\x1fH>\xda\xc5\x04 \x94\x88\xeb\'\xd4;6\x7f\xd9\x99-\x1b|G\x8d\xd4\xb9%\xaaQ\xa0K\x10\x03\x93\xe1\xcc\xe7m\x80\'\xf0\xa5\xed(\r\xa8\x0f&\xb1\xf3\xff0\f\x82%_\x92\x8bD\xb9\xd9\xe7\xf2\xe4\xc1i#\xdc\x87A\xb9\xc7\r\x92\xfa\x11\x11\xb5\x1f\x03\x9d\xdd\x1bj\xdf\xacg\xe3\xa0S\xd3\x8a\xe1n\x97\xea\xf5\xa0\'\v\xe9\xa0\xf1 f\xaan\xcf\xb5i\xb6d\xbc\x92\v\xd58\x16\b\xb3_:\xa4!\ny\xc4&\nWMM\xa8\xc4\v\x9f\x01o\xf4\xab&\xb6\x17\x02P\xc3!N\xf4\b\x1a~\x91V1s\xe9\xbe\x9e\x9b\'\xcde\xb3\xa1\x86\"\xd7\x04\xf1\xc0!\xed\xff\xee$\xc89\x8cB0\xd1dD\xe0IP\x88\xa2\xf2Y\x9af$$\xf1cO\xf7P\xac\xca\x80:!\xb4\x94#\xcb^\x9f\'\x03\xe3\x93\xb9\x82\xbf\xcf\xc4\xe3\xf7\x03Oh\xf2r\xca\x8ff\xbb/\x9f*\xaf\x1a \xa5\xa0?%M\xa5\x86\x98\xf24\'1\xc7\f<\xcc@\xe8\x8a\xac.\xde\xe4\xc7\xf5\x9ck\xa40!\xe9\x14$\xb3\x05m\xb5m\xed\ft\x93\xd8\xa3\x80\'Y\xb9\x05\xbbt|\xbe\xbcz\n\xf3\xf5p\xf8\x9f~\x1b\xd0\v\x1cQ')
getsockopt$inet_IP_IPSEC_POLICY(r2, 0x0, 0x10, &(0x7f00000006c0)={{{@in6=@loopback}}, {{@in6=@initdev}}}, &(0x7f0000000500)=0xe8)
socketpair(0x2, 0x2000000080003, 0x100, &(0x7f0000000480))
syz_genetlink_get_family_id$SEG6(&(0x7f00000003c0)='SEG6\x00')
sendmsg$SEG6_CMD_DUMPHMAC(r5, &(0x7f0000000580)={&(0x7f0000000380)={0x10, 0x0, 0x0, 0x1000000}, 0xc, &(0x7f0000000440)={&(0x7f00000005c0)=ANY=[@ANYBLOB="2300260109447a0000000000000000660000001400001a0065a455e04ea56d0a47018c8e973bcac914471474a7e0d50a000eadd66d2e49a2ed40dcafa1e046ab6aacc2097d8f75bd9c8b8a220bdde116904efa3f9600f22ab388644f66c2d5baec4079a81bae1927e49e91a4964656d7b227702926af5be846f3de49fad39048633fd9161123894d9427f854a30cb0532c8f31f663380e40ce7f6cb15ec8baab3b7c6f"], 0x1}, 0x1, 0x0, 0x0, 0x8000}, 0x804)
r7 = creat(&(0x7f0000000280)='./bus\x00', 0x0)
arch_prctl$ARCH_MAP_VDSO_32(0x2002, 0x7e)
ftruncate(r7, 0x2008200)
open(&(0x7f0000000140)='./bus\x00', 0x4000, 0x0)

15:06:52 executing program 1:
r0 = socket$inet_udplite(0x2, 0x2, 0x88)
ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f3188b070")
recvmmsg(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0)
r1 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)={0x10b, 0x6, 0x209e1e, 0x3, 0x1}, 0x2c)
bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000b40)={r1, &(0x7f0000000040), 0x0, 0x1}, 0x20)
r2 = creat(&(0x7f0000000640)='./file0\x00', 0x100)
setsockopt$inet6_tcp_TCP_REPAIR_QUEUE(r2, 0x6, 0x14, &(0x7f0000000980), 0x4)
unlink(&(0x7f0000000940)='./file0\x00')
r3 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_GET_NODE_DEBUG_INFO(r3, 0xc018620b, &(0x7f0000000100))
ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)})
ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0x0, 0x0, &(0x7f0000000780)})

15:06:52 executing program 0:
r0 = socket$inet_udplite(0x2, 0x2, 0x88)
ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f3188b070")
syz_open_procfs(0x0, &(0x7f0000000940)='syscall\x00')
r1 = syz_open_procfs(0x0, &(0x7f0000000040)='fd\x00')
recvmmsg(0xffffffffffffffff, &(0x7f0000003840)=[{{0x0, 0x0, 0x0}}], 0x1, 0x0, 0x0)
perf_event_open(&(0x7f0000940000)={0x2, 0x70, 0xee6a, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x100, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0xff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x10001, 0x1}, 0x0, 0x400000000000000}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
mlock(&(0x7f00005b8000/0x3000)=nil, 0x3000)
ioctl$SNDRV_TIMER_IOCTL_SELECT(0xffffffffffffffff, 0x40345410, 0x0)
openat$uinput(0xffffffffffffff9c, &(0x7f0000000080)='/dev/uinput\x00', 0x2, 0x0)
mmap(&(0x7f000060b000/0x1000)=nil, 0x1000, 0x5, 0x8000400200000033, r1, 0x0)
perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x2, 0x9, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2000000, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x4000000, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8)
r2 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)={0x10b, 0x6, 0x209e1e, 0x3, 0x1}, 0x2c)
bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000b40)={r2, &(0x7f0000000040), 0x0, 0x1}, 0x20)
r3 = creat(&(0x7f0000000640)='./file0\x00', 0x100)
setsockopt$inet6_tcp_TCP_REPAIR_QUEUE(r3, 0x6, 0x14, &(0x7f0000000980), 0x4)
unlink(&(0x7f0000000940)='./file0\x00')
r4 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r4, 0x0)
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f00000000c0)=ANY=[@ANYBLOB="bb8f0000"], 0x0, 0x0, 0x0})
ioctl$BINDER_SET_CONTEXT_MGR(r4, 0x40046207, 0x0)
shutdown(0xffffffffffffffff, 0x1)
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)})
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0x0, 0x0, &(0x7f0000000780)})
creat(&(0x7f00000000c0)='./file0\x00', 0x0)

[ 1133.838929] binder: release 2663:2668 transaction 1481 out, still active
[ 1133.852529] binder: send failed reply for transaction 1481, target dead
[ 1133.861847] binder: send failed reply for transaction 1484 to 2673:2676
[ 1133.869379] binder: send failed reply for transaction 1487 to 2686:2689
15:06:52 executing program 2:
pipe(&(0x7f00000000c0)={<r0=>0xffffffffffffffff, <r1=>0xffffffffffffffff})
write$P9_RRENAME(r0, &(0x7f0000000100)={0x7, 0x15, 0x2}, 0x7)
fchmodat(r1, &(0x7f0000000080)='./file0\x00', 0x0)
dup(r1)
lseek(0xffffffffffffffff, 0x20000, 0x0)
readv(0xffffffffffffffff, &(0x7f0000000640)=[{&(0x7f0000000000)=""/96, 0x60}], 0x1)

[ 1133.954721] ------------[ cut here ]------------
[ 1133.959530] kernel BUG at drivers/android/binder_alloc.c:1130!
[ 1133.993674] invalid opcode: 0000 [#1] PREEMPT SMP KASAN NOPTI
[ 1133.999602] Modules linked in:
[ 1134.002815] CPU: 1 PID: 2721 Comm: syz-executor.3 Not tainted 4.14.108+ #39
[ 1134.009922] task: ffff8881a187de00 task.stack: ffff888195748000
[ 1134.015996] RIP: 0010:binder_alloc_do_buffer_copy+0xc7/0x500
[ 1134.021804] RSP: 0018:ffff88819574f5d0 EFLAGS: 00010212
[ 1134.027180] RAX: 0000000000040000 RBX: 0000000020001000 RCX: 0000000000000376
[ 1134.034459] RDX: ffffffff82237477 RSI: ffffc9000412f000 RDI: ffff8881c96e7bd8
[ 1134.041739] RBP: 0000000000000008 R08: ffff88819574f8b0 R09: 0000000000000028
[ 1134.049010] R10: ffffed1032ae9f06 R11: ffff88819574f837 R12: ffff888193a91498
[ 1134.056315] R13: 0000000000000028 R14: 0000210000000000 R15: ffff88819574f8b0
[ 1134.060829] binder: BINDER_SET_CONTEXT_MGR already set
[ 1134.064199] FS:  00007fde9ac94700(0000) GS:ffff8881dbb00000(0000) knlGS:0000000000000000
[ 1134.064206] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[ 1134.064212] CR2: 00000000200000c0 CR3: 00000001c883a006 CR4: 00000000001606a0
[ 1134.064224] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
[ 1134.069551] binder: 2720:2735 ioctl 40046207 0 returned -16
[ 1134.077740] DR3: 0000000000000000 DR6: 00000000ffff0ff0 DR7: 0000000000000600
[ 1134.077746] Call Trace:
[ 1134.077772]  ? binder_alloc_do_buffer_copy+0x1ef/0x500
[ 1134.077790]  binder_get_object+0x90/0x190
[ 1134.077808]  binder_transaction+0x1e2d/0x5640
[ 1134.128139]  ? check_preemption_disabled+0x35/0x1f0
[ 1134.133166]  ? binder_inc_ref_for_node+0xba0/0xba0
[ 1134.133397] binder: 2724:2738 BC_INCREFS_DONE node 1493 has no pending increfs request
[ 1134.138148]  ? perf_trace_lock+0x11e/0x4e0
[ 1134.138166]  ? perf_trace_lock_acquire+0x4e0/0x4e0
[ 1134.138186]  ? HARDIRQ_verbose+0x10/0x10
[ 1134.159529]  ? __might_fault+0x104/0x1b0
[ 1134.163651]  ? lock_downgrade+0x5d0/0x5d0
[ 1134.167800]  ? lock_acquire+0x10f/0x380
[ 1134.171800]  ? __might_fault+0xd4/0x1b0
[ 1134.175777]  ? __might_fault+0x177/0x1b0
[ 1134.179843]  ? binder_thread_write+0x512/0x1f90
[ 1134.184547]  ? perf_trace_lock_acquire+0x4e0/0x4e0
[ 1134.189626]  ? binder_transaction+0x5640/0x5640
[ 1134.194295]  ? HARDIRQ_verbose+0x10/0x10
[ 1134.198376]  ? lock_downgrade+0x5d0/0x5d0
[ 1134.202513]  ? lock_acquire+0x10f/0x380
[ 1134.206486]  ? __might_fault+0xd4/0x1b0
[ 1134.210456]  ? __might_fault+0x177/0x1b0
[ 1134.214525]  ? binder_ioctl+0xd48/0x14ea
[ 1134.218628]  ? binder_poll+0x230/0x230
[ 1134.222512]  ? __lock_acquire+0x56a/0x3fa0
[ 1134.226745]  ? perf_trace_lock+0x11e/0x4e0
[ 1134.230985]  ? check_preemption_disabled+0x35/0x1f0
[ 1134.236070]  ? perf_trace_lock_acquire+0x4e0/0x4e0
[ 1134.241019]  ? check_preemption_disabled+0x35/0x1f0
[ 1134.246069]  ? binder_poll+0x230/0x230
[ 1134.249976]  ? do_vfs_ioctl+0xabe/0x1040
[ 1134.254032]  ? selinux_file_ioctl+0x426/0x590
[ 1134.258549]  ? selinux_file_ioctl+0x116/0x590
[ 1134.263070]  ? ioctl_preallocate+0x1e0/0x1e0
[ 1134.267946]  ? selinux_parse_skb.constprop.0+0x16b0/0x16b0
[ 1134.273580]  ? __fget+0x1ff/0x360
[ 1134.277024]  ? lock_downgrade+0x5d0/0x5d0
[ 1134.281188]  ? lock_acquire+0x10f/0x380
[ 1134.285156]  ? __fget+0x44/0x360
[ 1134.288512]  ? check_preemption_disabled+0x35/0x1f0
[ 1134.293594]  ? security_file_ioctl+0x7c/0xb0
[ 1134.298011]  ? SyS_ioctl+0x7f/0xb0
[ 1134.301547]  ? do_vfs_ioctl+0x1040/0x1040
15:06:53 executing program 2:
r0 = syz_open_procfs(0x0, &(0x7f00000000c0)='maps\x00')
lseek(r0, 0x20000, 0x0)
readv(r0, &(0x7f0000000640)=[{&(0x7f0000000000)=""/96, 0x60}], 0x1)
fsetxattr$security_smack_transmute(r0, &(0x7f0000000080)='security.SMACK64TRANSMUTE\x00', &(0x7f0000000100)='TRUE', 0x4, 0x3)

15:06:53 executing program 4:
r0 = socket$inet_udplite(0x2, 0x2, 0x88)
ioctl$sock_TIOCINQ(r0, 0x541b, &(0x7f0000000040))
ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f3188b070")
fcntl$setflags(r0, 0x2, 0x1)
r1 = syz_open_procfs(0x0, &(0x7f0000000080)='net/dev_mcast\x00')
ioctl$KDSKBMETA(r1, 0x4b63, &(0x7f00000000c0)=0x1c)
lseek(r1, 0x20000, 0x0)
openat$urandom(0xffffffffffffff9c, &(0x7f0000000100)='/dev/urandom\x00', 0x0, 0x0)

[ 1134.305713]  ? do_syscall_64+0x19b/0x4b0
[ 1134.309806]  ? entry_SYSCALL_64_after_hwframe+0x42/0xb7
[ 1134.315281] Code: 00 fc ff df 48 89 fa 48 c1 ea 03 80 3c 02 00 0f 85 0d 04 00 00 48 8b 6d 58 48 29 dd e8 33 33 0d ff 49 39 ed 76 07 e8 29 33 0d ff <0f> 0b e8 22 33 0d ff 4c 29 ed 49 39 ee 77 ec e8 15 33 0d ff 41 
[ 1134.334526] RIP: binder_alloc_do_buffer_copy+0xc7/0x500 RSP: ffff88819574f5d0
[ 1134.345437] ---[ end trace ca279b6b6cf38ce7 ]---
[ 1134.351595] Kernel panic - not syncing: Fatal exception
[ 1134.357358] Kernel Offset: 0x32c00000 from 0xffffffff81000000 (relocation range: 0xffffffff80000000-0xffffffffbfffffff)
[ 1134.368285] Rebooting in 86400 seconds..