@broadcast}, @igmp={0x11, 0x0, 0x0, @multicast1}}}}}, &(0x7f0000000140)={0x0, 0x0, [0xffffffff00000000]}) 01:55:58 executing program 3: r0 = socket$inet(0x2, 0x3, 0x2) connect$inet(0xffffffffffffffff, &(0x7f0000000000)={0x2, 0x0, @local}, 0x10) setsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x23, &(0x7f0000000000)={{{@in=@multicast2, @in=@multicast1}}, {{@in6}, 0x0, @in6=@loopback}}, 0xe8) syz_emit_ethernet(0x2a, &(0x7f0000000640)={@random="b100485caa2a", @link_local={0x1, 0x80, 0xc2, 0x0, 0x2000}, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x1c, 0x0, 0x0, 0x0, 0x2, 0x0, @rand_addr, @broadcast}, @igmp={0x11, 0xffffffffffffffff, 0x0, @multicast1}}}}}, &(0x7f0000000140)) [ 644.316578] binder: 11218:11258 Acquire 1 refcount change on invalid ref 0 ret -22 [ 644.436130] binder: 11218:11258 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 01:55:58 executing program 6: r0 = syz_open_dev$sndseq(&(0x7f0000000100)='/dev/snd/seq\x00', 0x0, 0x0) read(r0, &(0x7f0000fb6000)=""/28, 0x3f0) ioctl$SNDRV_SEQ_IOCTL_REMOVE_EVENTS(r0, 0x4040534e, &(0x7f00000001c0)={0xbf}) ioctl$SNDRV_SEQ_IOCTL_QUERY_SUBS(r0, 0xc058534f, &(0x7f00000002c0)={{}, 0x1, 0x0, 0x0, {}, 0x0, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xe000000]}) r1 = gettid() timer_create(0x0, &(0x7f0000044000)={0x0, 0x12}, &(0x7f0000000040)) r2 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r2, 0x8912, &(0x7f00000001c0)="0a5cc80700315f85715070") timer_settime(0x0, 0x0, &(0x7f0000000080)={{0x0, 0x989680}, {0x0, 0x9}}, &(0x7f0000040000)) tkill(r1, 0x1000000000014) 01:55:58 executing program 5: perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1f}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000340)={&(0x7f0000000000), 0xc, &(0x7f0000000300)={&(0x7f0000000240)=@newlink={0x50, 0x10, 0x721, 0x0, 0x0, {0x0, 0xfffffffffffff000}, [@IFLA_LINKINFO={0x28, 0x12, @veth={{0xc, 0x1, 'veth\x00'}, {0x18, 0x2, @VETH_INFO_PEER={0x14}}}}, @IFLA_NET_NS_FD={0x8}]}, 0x50}}, 0x0) 01:55:58 executing program 4: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) ioctl$sock_SIOCETHTOOL(r0, 0x8946, &(0x7f0000000040)={'bond0\x00', &(0x7f0000000240)=ANY=[@ANYBLOB="1c000000000023000000000000000002"]}) 01:55:58 executing program 1: r0 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000040)='/dev/vcs\x00', 0x20000, 0x0) ioctl$RTC_SET_TIME(r0, 0x4024700a, &(0x7f0000000080)={0xa, 0x33, 0xf, 0x6, 0xa, 0x1, 0x0, 0x160, 0xffffffffffffffff}) ioctl$SG_SET_KEEP_ORPHAN(r0, 0x2287, &(0x7f00000000c0)=0x8) syz_emit_ethernet(0x2a, &(0x7f0000000000)=ANY=[@ANYBLOB="b100485caa2aaaaaaaaaaabb08004500001c000000000002907800000000fffbffff12009078e0000001"], &(0x7f00003b5000)) getsockopt$inet_sctp_SCTP_GET_PEER_ADDRS(r0, 0x84, 0x6c, &(0x7f0000000100)={0x0, 0xc4, "6f1108f4cbc5bfd844b9d151e127274f84a8998e3af657659be5ab4d17b72a7e983e69a2ad30a47ab6261fa0338fc351d3f4c87a04831a6699233a6bdf5a3be37fdbc785b16093d9f5bb7fd2c1b5d63312576297cd4e50c5832296b23919fe796c9982a063b8db2f5aac8b436ac5ec75b6011511ec8a422e02b25e3deac50f49c425893a8e10f2e75c696bf67272c1532fc07f33ab62fe5e49bc9ba2e36a03e7340b478f1aab410b606626d056ad5dff7d2b33050ca1a00c62b6c5561663aca00b53c39d"}, &(0x7f0000000200)=0xcc) setsockopt$inet_sctp_SCTP_AUTH_DELETE_KEY(r0, 0x84, 0x19, &(0x7f0000000240)={r1, 0x3ff}, 0x8) 01:55:58 executing program 0: socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000001f80)={0xffffffffffffffff, 0xffffffffffffffff}) setsockopt$SO_ATTACH_FILTER(r2, 0x1, 0x1a, &(0x7f0000ab9ff0)={0x2, &(0x7f000039a000)=[{0x20, 0x0, 0x0, 0xfffffffffffff010}, {0x6}]}, 0x10) sendmmsg(r1, &(0x7f0000001e80)=[{{&(0x7f0000000700)=@l2={0x1f, 0x0, {}, 0x300}, 0x80, &(0x7f0000001dc0)}}], 0x1, 0x0) 01:55:58 executing program 2: r0 = socket$inet(0x2, 0x3, 0x2) connect$inet(0xffffffffffffffff, &(0x7f0000000000)={0x2, 0x0, @local}, 0x10) setsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x23, &(0x7f0000000000)={{{@in=@multicast2, @in=@multicast1}}, {{@in6}, 0x0, @in6=@loopback}}, 0xe8) syz_emit_ethernet(0x2a, &(0x7f0000000640)={@random="b100485caa2a", @link_local, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x1c, 0x0, 0x0, 0x0, 0x2, 0x0, @rand_addr, @broadcast}, @igmp={0x11, 0x0, 0x0, @multicast1}}}}}, &(0x7f0000000140)={0x0, 0x0, [0xe0000000]}) 01:55:58 executing program 3: r0 = socket$inet(0x2, 0x3, 0x2) connect$inet(0xffffffffffffffff, &(0x7f0000000000)={0x2, 0x0, @local}, 0x10) setsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x23, &(0x7f0000000000)={{{@in=@multicast2, @in=@multicast1}}, {{@in6}, 0x0, @in6=@loopback}}, 0xe8) syz_emit_ethernet(0x2a, &(0x7f0000000640)={@random="b100485caa2a", @link_local={0x1, 0x80, 0xc2, 0x0, 0x300}, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x1c, 0x0, 0x0, 0x0, 0x2, 0x0, @rand_addr, @broadcast}, @igmp={0x11, 0xffffffffffffffff, 0x0, @multicast1}}}}}, &(0x7f0000000140)) 01:55:58 executing program 7: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000180)='/dev/sequencer\x00', 0x10002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000080)="0a5cc80700315f85715070") r1 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000001c0)={0x2, 0x0, &(0x7f0000000140)=ANY=[@ANYBLOB='\fc'], 0x0, 0x0, &(0x7f0000000080)}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, &(0x7f00000001c0)}) ioctl$BINDER_WRITE_READ(r1, 0xc018620b, &(0x7f0000000040)={0x8, 0x0, &(0x7f00000000c0)=[@release={0x400c630f}], 0x1, 0x0, &(0x7f0000000100)='V'}) fstat(r0, &(0x7f00000002c0)) 01:55:58 executing program 1: perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x23}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = openat$ipvs(0xffffffffffffff9c, &(0x7f0000000040)='/proc/sys/net/ipv4/vs/conn_reuse_mode\x00', 0x2, 0x0) setsockopt$inet_sctp_SCTP_SOCKOPT_CONNECTX_OLD(r0, 0x84, 0x6b, &(0x7f0000000080)=[@in={0x2, 0x4e22, @multicast2}, @in6={0xa, 0x4e21, 0x9, @dev={0xfe, 0x80, [], 0x13}, 0x4}], 0x2c) alarm(0x7) 01:55:58 executing program 4: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) ioctl$sock_SIOCETHTOOL(r0, 0x8946, &(0x7f0000000040)={'bond0\x00', &(0x7f0000000240)=ANY=[@ANYBLOB="1d000000000023000000000000000002"]}) 01:55:58 executing program 5: perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1f}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000340)={&(0x7f0000000000), 0xc, &(0x7f0000000300)={&(0x7f0000000240)=@newlink={0x50, 0x10, 0x721, 0x0, 0x0, {0x0, 0x400000000000000}, [@IFLA_LINKINFO={0x28, 0x12, @veth={{0xc, 0x1, 'veth\x00'}, {0x18, 0x2, @VETH_INFO_PEER={0x14}}}}, @IFLA_NET_NS_FD={0x8}]}, 0x50}}, 0x0) 01:55:58 executing program 3: r0 = socket$inet(0x2, 0x3, 0x2) connect$inet(0xffffffffffffffff, &(0x7f0000000000)={0x2, 0x0, @local}, 0x10) setsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x23, &(0x7f0000000000)={{{@in=@multicast2, @in=@multicast1}}, {{@in6}, 0x0, @in6=@loopback}}, 0xe8) syz_emit_ethernet(0x2a, &(0x7f0000000640)={@random="b100485caa2a", @link_local={0x1, 0x80, 0xc2, 0x0, 0x1c}, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x1c, 0x0, 0x0, 0x0, 0x2, 0x0, @rand_addr, @broadcast}, @igmp={0x11, 0xffffffffffffffff, 0x0, @multicast1}}}}}, &(0x7f0000000140)) 01:55:58 executing program 2: r0 = socket$inet(0x2, 0x3, 0x2) connect$inet(0xffffffffffffffff, &(0x7f0000000000)={0x2, 0x0, @local}, 0x10) setsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x23, &(0x7f0000000000)={{{@in=@multicast2, @in=@multicast1}}, {{@in6}, 0x0, @in6=@loopback}}, 0xe8) syz_emit_ethernet(0x2a, &(0x7f0000000640)={@random="b100485caa2a", @link_local, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x1c, 0x0, 0x0, 0x0, 0x2, 0x0, @rand_addr, @broadcast}, @igmp={0x11, 0x0, 0x0, @multicast1}}}}}, &(0x7f0000000140)={0x0, 0x0, [0x40000000]}) [ 645.069719] binder: 11298:11299 Acquire 1 refcount change on invalid ref 0 ret -22 01:55:59 executing program 4: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) ioctl$sock_SIOCETHTOOL(r0, 0x8946, &(0x7f0000000040)={'bond0\x00', &(0x7f0000000240)=ANY=[@ANYBLOB="23000000000023000000000000000002"]}) 01:55:59 executing program 5: perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1f}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000340)={&(0x7f0000000000), 0xc, &(0x7f0000000300)={&(0x7f0000000240)=@newlink={0x50, 0x10, 0x721, 0x0, 0x0, {0x0, 0xf0ffffffffffff}, [@IFLA_LINKINFO={0x28, 0x12, @veth={{0xc, 0x1, 'veth\x00'}, {0x18, 0x2, @VETH_INFO_PEER={0x14}}}}, @IFLA_NET_NS_FD={0x8}]}, 0x50}}, 0x0) 01:55:59 executing program 3: r0 = socket$inet(0x2, 0x3, 0x2) connect$inet(0xffffffffffffffff, &(0x7f0000000000)={0x2, 0x0, @local}, 0x10) setsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x23, &(0x7f0000000000)={{{@in=@multicast2, @in=@multicast1}}, {{@in6}, 0x0, @in6=@loopback}}, 0xe8) syz_emit_ethernet(0x2a, &(0x7f0000000640)={@random="b100485caa2a", @link_local={0x1, 0x80, 0xc2, 0x0, 0x6000000000000000}, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x1c, 0x0, 0x0, 0x0, 0x2, 0x0, @rand_addr, @broadcast}, @igmp={0x11, 0xffffffffffffffff, 0x0, @multicast1}}}}}, &(0x7f0000000140)) [ 645.234297] binder: 11298:11299 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 645.317421] binder: 11298:11334 Acquire 1 refcount change on invalid ref 0 ret -22 [ 645.330780] binder: 11298:11334 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 01:55:59 executing program 6: r0 = syz_open_dev$sndseq(&(0x7f0000000100)='/dev/snd/seq\x00', 0x0, 0x0) read(r0, &(0x7f0000fb6000)=""/28, 0x3f0) ioctl$SNDRV_SEQ_IOCTL_REMOVE_EVENTS(r0, 0x4040534e, &(0x7f00000001c0)={0xbf}) ioctl$SNDRV_SEQ_IOCTL_QUERY_SUBS(r0, 0xc058534f, &(0x7f00000002c0)={{}, 0x1, 0x0, 0x0, {}, 0x0, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xe00000000000000]}) r1 = gettid() timer_create(0x0, &(0x7f0000044000)={0x0, 0x12}, &(0x7f0000000040)) r2 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r2, 0x8912, &(0x7f00000001c0)="0a5cc80700315f85715070") timer_settime(0x0, 0x0, &(0x7f0000000080)={{0x0, 0x989680}, {0x0, 0x9}}, &(0x7f0000040000)) tkill(r1, 0x1000000000014) 01:55:59 executing program 2: r0 = socket$inet(0x2, 0x3, 0x2) connect$inet(0xffffffffffffffff, &(0x7f0000000000)={0x2, 0x0, @local}, 0x10) setsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x23, &(0x7f0000000000)={{{@in=@multicast2, @in=@multicast1}}, {{@in6}, 0x0, @in6=@loopback}}, 0xe8) syz_emit_ethernet(0x2a, &(0x7f0000000640)={@random="b100485caa2a", @link_local, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x1c, 0x0, 0x0, 0x0, 0x2, 0x0, @rand_addr, @broadcast}, @igmp={0x11, 0x0, 0x0, @multicast1}}}}}, &(0x7f0000000140)={0x0, 0x0, [0x3000000]}) 01:55:59 executing program 1: r0 = socket$inet6(0xa, 0x1000000000005, 0x0) ioctl(r0, 0x8912, &(0x7f0000000080)="0a5cc80700315f85715070") r1 = openat$dsp(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dsp\x00', 0x8c0, 0x0) getsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER(r0, 0x84, 0x7b, &(0x7f0000000040)={0x0, 0x7650}, &(0x7f00000000c0)=0x8) getsockopt$inet_sctp_SCTP_RESET_STREAMS(r1, 0x84, 0x77, &(0x7f0000000100)={r2, 0xc2, 0x3, [0x7fff, 0x8, 0x7]}, &(0x7f0000000140)=0xe) ioctl$sock_ifreq(r0, 0x89f3, &(0x7f0000000080)={'ip6tnl0\x00', @ifru_ivalue=0x907000}) 01:55:59 executing program 0: socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000001f80)={0xffffffffffffffff, 0xffffffffffffffff}) setsockopt$SO_ATTACH_FILTER(r2, 0x1, 0x1a, &(0x7f0000ab9ff0)={0x2, &(0x7f000039a000)=[{0x20, 0x0, 0x0, 0xfffffffffffff010}, {0x6}]}, 0x10) sendmmsg(r1, &(0x7f0000001e80)=[{{&(0x7f0000000700)=@l2={0x1f, 0x0, {}, 0x300000000000000}, 0x80, &(0x7f0000001dc0)}}], 0x1, 0x0) 01:55:59 executing program 5: perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1f}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000340)={&(0x7f0000000000), 0xc, &(0x7f0000000300)={&(0x7f0000000240)=@newlink={0x50, 0x10, 0x721, 0x0, 0x0, {0x0, 0x4000000}, [@IFLA_LINKINFO={0x28, 0x12, @veth={{0xc, 0x1, 'veth\x00'}, {0x18, 0x2, @VETH_INFO_PEER={0x14}}}}, @IFLA_NET_NS_FD={0x8}]}, 0x50}}, 0x0) 01:55:59 executing program 4: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) ioctl$sock_SIOCETHTOOL(r0, 0x8946, &(0x7f0000000040)={'bond0\x00', &(0x7f0000000240)=ANY=[@ANYBLOB="05000000000023000000000000000002"]}) 01:55:59 executing program 3: r0 = socket$inet(0x2, 0x3, 0x2) connect$inet(0xffffffffffffffff, &(0x7f0000000000)={0x2, 0x0, @local}, 0x10) setsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x23, &(0x7f0000000000)={{{@in=@multicast2, @in=@multicast1}}, {{@in6}, 0x0, @in6=@loopback}}, 0xe8) syz_emit_ethernet(0x2a, &(0x7f0000000640)={@random="b100485caa2a", @link_local={0x1, 0x80, 0xc2, 0x0, 0x60000000}, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x1c, 0x0, 0x0, 0x0, 0x2, 0x0, @rand_addr, @broadcast}, @igmp={0x11, 0xffffffffffffffff, 0x0, @multicast1}}}}}, &(0x7f0000000140)) 01:55:59 executing program 7: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000180)='/dev/sequencer\x00', 0x10002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000080)="0a5cc80700315f85715070") r1 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000001c0)={0x2, 0x0, &(0x7f0000000140)=ANY=[@ANYBLOB='\fc'], 0x0, 0x0, &(0x7f0000000080)}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, &(0x7f00000001c0)}) ioctl$BINDER_WRITE_READ(r1, 0x5452, &(0x7f0000000040)={0x8, 0x0, &(0x7f00000000c0)=[@release={0x400c630f}], 0x1, 0x0, &(0x7f0000000100)='V'}) fstat(r0, &(0x7f00000002c0)) 01:55:59 executing program 4: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) ioctl$sock_SIOCETHTOOL(r0, 0x8946, &(0x7f0000000040)={'bond0\x00', &(0x7f0000000240)=ANY=[@ANYBLOB="09000000000023000000000000000002"]}) 01:55:59 executing program 5: perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1f}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000340)={&(0x7f0000000000), 0xc, &(0x7f0000000300)={&(0x7f0000000240)=@newlink={0x50, 0x10, 0x721, 0x0, 0x0, {0x0, 0x9000000}, [@IFLA_LINKINFO={0x28, 0x12, @veth={{0xc, 0x1, 'veth\x00'}, {0x18, 0x2, @VETH_INFO_PEER={0x14}}}}, @IFLA_NET_NS_FD={0x8}]}, 0x50}}, 0x0) 01:55:59 executing program 2: r0 = socket$inet(0x2, 0x3, 0x2) connect$inet(0xffffffffffffffff, &(0x7f0000000000)={0x2, 0x0, @local}, 0x10) setsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x23, &(0x7f0000000000)={{{@in=@multicast2, @in=@multicast1}}, {{@in6}, 0x0, @in6=@loopback}}, 0xe8) syz_emit_ethernet(0x2a, &(0x7f0000000640)={@random="b100485caa2a", @link_local, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x1c, 0x0, 0x0, 0x0, 0x2, 0x0, @rand_addr, @broadcast}, @igmp={0x11, 0x0, 0x0, @multicast1}}}}}, &(0x7f0000000140)={0x0, 0x0, [0x4000]}) 01:55:59 executing program 1: pipe(&(0x7f0000000100)={0xffffffffffffffff}) ioctl$RTC_AIE_OFF(r0, 0x7002) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) tee(r0, r1, 0xfffffffffffffff9, 0x2) 01:55:59 executing program 3: r0 = socket$inet(0x2, 0x3, 0x2) connect$inet(0xffffffffffffffff, &(0x7f0000000000)={0x2, 0x0, @local}, 0x10) setsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x23, &(0x7f0000000000)={{{@in=@multicast2, @in=@multicast1}}, {{@in6}, 0x0, @in6=@loopback}}, 0xe8) syz_emit_ethernet(0x2a, &(0x7f0000000640)={@random="b100485caa2a", @link_local={0x1, 0x80, 0xc2, 0x0, 0xf0}, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x1c, 0x0, 0x0, 0x0, 0x2, 0x0, @rand_addr, @broadcast}, @igmp={0x11, 0xffffffffffffffff, 0x0, @multicast1}}}}}, &(0x7f0000000140)) [ 645.910436] binder: 11363:11365 Acquire 1 refcount change on invalid ref 0 ret -22 [ 645.943017] binder: 11363:11365 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 01:55:59 executing program 1: r0 = syz_open_dev$usbmon(&(0x7f00000000c0)='/dev/usbmon#\x00', 0x8, 0x2) write$P9_RRENAME(r0, &(0x7f0000000100)={0x7, 0x15, 0x2}, 0x7) syslog(0x3, &(0x7f0000000000)=""/138, 0x8a) recvfrom$inet(r0, &(0x7f0000000140)=""/4096, 0x1000, 0x1, &(0x7f0000001140)={0x2, 0x4e20}, 0x10) 01:55:59 executing program 4: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) ioctl$sock_SIOCETHTOOL(r0, 0x8946, &(0x7f0000000040)={'bond0\x00', &(0x7f0000000240)=ANY=[@ANYBLOB="2a000000000023000000000000000002"]}) 01:55:59 executing program 0: socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000001f80)={0xffffffffffffffff, 0xffffffffffffffff}) setsockopt$SO_ATTACH_FILTER(r2, 0x1, 0x1a, &(0x7f0000ab9ff0)={0x2, &(0x7f000039a000)=[{0x20, 0x0, 0x0, 0xfffffffffffff010}, {0x6}]}, 0x10) sendmmsg(r1, &(0x7f0000001e80)=[{{&(0x7f0000000700)=@l2={0x1f, 0x0, {}, 0xffffff7f}, 0x80, &(0x7f0000001dc0)}}], 0x1, 0x0) [ 646.062304] binder: 11363:11388 Acquire 1 refcount change on invalid ref 0 ret -22 [ 646.173351] binder: 11363:11388 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 01:56:00 executing program 6: r0 = syz_open_dev$sndseq(&(0x7f0000000100)='/dev/snd/seq\x00', 0x0, 0x0) read(r0, &(0x7f0000fb6000)=""/28, 0x3f0) ioctl$SNDRV_SEQ_IOCTL_REMOVE_EVENTS(r0, 0x4040534e, &(0x7f00000001c0)={0xbf}) ioctl$SNDRV_SEQ_IOCTL_QUERY_SUBS(r0, 0xc058534f, &(0x7f00000002c0)={{}, 0x1, 0x0, 0x0, {}, 0x0, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xbf000000]}) r1 = gettid() timer_create(0x0, &(0x7f0000044000)={0x0, 0x12}, &(0x7f0000000040)) r2 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r2, 0x8912, &(0x7f00000001c0)="0a5cc80700315f85715070") timer_settime(0x0, 0x0, &(0x7f0000000080)={{0x0, 0x989680}, {0x0, 0x9}}, &(0x7f0000040000)) tkill(r1, 0x1000000000014) 01:56:00 executing program 2: r0 = socket$inet(0x2, 0x3, 0x2) connect$inet(0xffffffffffffffff, &(0x7f0000000000)={0x2, 0x0, @local}, 0x10) setsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x23, &(0x7f0000000000)={{{@in=@multicast2, @in=@multicast1}}, {{@in6}, 0x0, @in6=@loopback}}, 0xe8) syz_emit_ethernet(0x2a, &(0x7f0000000640)={@random="b100485caa2a", @link_local, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x1c, 0x0, 0x0, 0x0, 0x2, 0x0, @rand_addr, @broadcast}, @igmp={0x11, 0x0, 0x0, @multicast1}}}}}, &(0x7f0000000140)={0x0, 0x0, [0x8]}) 01:56:00 executing program 3: r0 = socket$inet(0x2, 0x3, 0x2) connect$inet(0xffffffffffffffff, &(0x7f0000000000)={0x2, 0x0, @local}, 0x10) setsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x23, &(0x7f0000000000)={{{@in=@multicast2, @in=@multicast1}}, {{@in6}, 0x0, @in6=@loopback}}, 0xe8) syz_emit_ethernet(0x2a, &(0x7f0000000640)={@random="b100485caa2a", @link_local={0x1, 0x80, 0xc2, 0x0, 0xe000}, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x1c, 0x0, 0x0, 0x0, 0x2, 0x0, @rand_addr, @broadcast}, @igmp={0x11, 0xffffffffffffffff, 0x0, @multicast1}}}}}, &(0x7f0000000140)) 01:56:00 executing program 5: perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1f}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000340)={&(0x7f0000000000), 0xc, &(0x7f0000000300)={&(0x7f0000000240)=@newlink={0x50, 0x10, 0x721, 0x0, 0x0, {0x0, 0x6000000}, [@IFLA_LINKINFO={0x28, 0x12, @veth={{0xc, 0x1, 'veth\x00'}, {0x18, 0x2, @VETH_INFO_PEER={0x14}}}}, @IFLA_NET_NS_FD={0x8}]}, 0x50}}, 0x0) 01:56:00 executing program 4: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) ioctl$sock_SIOCETHTOOL(r0, 0x8946, &(0x7f0000000040)={'bond0\x00', &(0x7f0000000240)=ANY=[@ANYBLOB="47000000000023000000000000000002"]}) 01:56:00 executing program 7: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000180)='/dev/sequencer\x00', 0x10002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000080)="0a5cc80700315f85715070") r1 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000001c0)={0x2, 0x0, &(0x7f0000000140)=ANY=[@ANYBLOB='\fc'], 0x0, 0x0, &(0x7f0000000080)}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, &(0x7f00000001c0)}) ioctl$BINDER_WRITE_READ(r1, 0x40049409, &(0x7f0000000040)={0x8, 0x0, &(0x7f00000000c0)=[@release={0x400c630f}], 0x1, 0x0, &(0x7f0000000100)='V'}) fstat(r0, &(0x7f00000002c0)) 01:56:00 executing program 0: socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000001f80)={0xffffffffffffffff, 0xffffffffffffffff}) setsockopt$SO_ATTACH_FILTER(r2, 0x1, 0x1a, &(0x7f0000ab9ff0)={0x2, &(0x7f000039a000)=[{0x20, 0x0, 0x0, 0xfffffffffffff010}, {0x6}]}, 0x10) sendmmsg(r1, &(0x7f0000001e80)=[{{&(0x7f0000000700)=@l2={0x1f, 0x0, {}, 0xc000}, 0x80, &(0x7f0000001dc0)}}], 0x1, 0x0) 01:56:00 executing program 1: r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000300)={0x26, 'aead\x00', 0x0, 0x0, 'morus1280-generic\x00'}, 0x58) r1 = socket$inet6(0xa, 0x1000000000002, 0x0) r2 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vga_arbiter\x00', 0x400000, 0x0) ioctl$SNDRV_RAWMIDI_IOCTL_DRAIN(r2, 0x40045731, &(0x7f0000000080)=0x2e) ioctl(r1, 0x8912, &(0x7f0000000040)="0a5cc80700315f85715070") close(r0) 01:56:00 executing program 2: r0 = socket$inet(0x2, 0x3, 0x2) connect$inet(0xffffffffffffffff, &(0x7f0000000000)={0x2, 0x0, @local}, 0x10) setsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x23, &(0x7f0000000000)={{{@in=@multicast2, @in=@multicast1}}, {{@in6}, 0x0, @in6=@loopback}}, 0xe8) syz_emit_ethernet(0x2a, &(0x7f0000000640)={@random="b100485caa2a", @link_local, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x1c, 0x0, 0x0, 0x0, 0x2, 0x0, @rand_addr, @broadcast}, @igmp={0x11, 0x0, 0x0, @multicast1}}}}}, &(0x7f0000000140)={0x0, 0x0, [0x3]}) 01:56:00 executing program 5: perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1f}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000340)={&(0x7f0000000000), 0xc, &(0x7f0000000300)={&(0x7f0000000240)=@newlink={0x50, 0x10, 0x721, 0x0, 0x0, {0x0, 0xab4}, [@IFLA_LINKINFO={0x28, 0x12, @veth={{0xc, 0x1, 'veth\x00'}, {0x18, 0x2, @VETH_INFO_PEER={0x14}}}}, @IFLA_NET_NS_FD={0x8}]}, 0x50}}, 0x0) 01:56:00 executing program 4: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) ioctl$sock_SIOCETHTOOL(r0, 0x8946, &(0x7f0000000040)={'bond0\x00', &(0x7f0000000240)=ANY=[@ANYBLOB="0f000000000023000000000000000002"]}) 01:56:00 executing program 1: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000080)="0a5cc80700315f85715070") r1 = openat$userio(0xffffffffffffff9c, &(0x7f0000000000)='/dev/userio\x00', 0x8040, 0x0) r2 = socket(0x40000000002, 0x3, 0x2) ioctl$sock_FIOGETOWN(r1, 0x8903, &(0x7f00000000c0)) setsockopt$SO_BINDTODEVICE(r2, 0x1, 0x19, &(0x7f0000000040)='syz_tun\x00', 0xfcda) sendto$unix(r2, &(0x7f0000000080), 0x7272, 0x0, &(0x7f0000000d00)=@abs={0x0, 0x0, 0x10000e0}, 0x6e) recvfrom(r2, &(0x7f0000000200)=""/35, 0x23, 0x40000020, &(0x7f0000000240)=@generic={0x0, "e71105e32f4aeeb20c9603dc8b7566783b839d7ea76cab1a58d5f3923a2fb7455221e9db43bc1c9326466190a73f65fe71be504a9a3b856a602fd0e9b88a6797e62570a9173f4ca6f5a94decaf3af8240a40291f266661fe74d309904335c552e13640023f905beb9490b789f67dadc804f589a1614f77800948be1bb30c"}, 0x704000) 01:56:00 executing program 3: r0 = socket$inet(0x2, 0x3, 0x2) connect$inet(0xffffffffffffffff, &(0x7f0000000000)={0x2, 0x0, @local}, 0x10) setsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x23, &(0x7f0000000000)={{{@in=@multicast2, @in=@multicast1}}, {{@in6}, 0x0, @in6=@loopback}}, 0xe8) syz_emit_ethernet(0x2a, &(0x7f0000000640)={@random="b100485caa2a", @link_local={0x1, 0x80, 0xc2, 0x0, 0x600}, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x1c, 0x0, 0x0, 0x0, 0x2, 0x0, @rand_addr, @broadcast}, @igmp={0x11, 0xffffffffffffffff, 0x0, @multicast1}}}}}, &(0x7f0000000140)) [ 646.808449] binder: 11428:11429 Acquire 1 refcount change on invalid ref 0 ret -22 01:56:00 executing program 4: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) ioctl$sock_SIOCETHTOOL(r0, 0x8946, &(0x7f0000000040)={'bond0\x00', &(0x7f0000000240)=ANY=[@ANYBLOB="1b000000000023000000000000000002"]}) 01:56:00 executing program 2: r0 = socket$inet(0x2, 0x3, 0x2) connect$inet(0xffffffffffffffff, &(0x7f0000000000)={0x2, 0x0, @local}, 0x10) setsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x23, &(0x7f0000000000)={{{@in=@multicast2, @in=@multicast1}}, {{@in6}, 0x0, @in6=@loopback}}, 0xe8) syz_emit_ethernet(0x2a, &(0x7f0000000640)={@random="b100485caa2a", @link_local, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x1c, 0x0, 0x0, 0x0, 0x2, 0x0, @rand_addr, @broadcast}, @igmp={0x11, 0x0, 0x0, @multicast1}}}}}, &(0x7f0000000140)={0x0, 0x0, [0x2000000000000000]}) 01:56:00 executing program 5: perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1f}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000340)={&(0x7f0000000000), 0xc, &(0x7f0000000300)={&(0x7f0000000240)=@newlink={0x50, 0x10, 0x721, 0x0, 0x0, {0x0, 0xa00000000000000}, [@IFLA_LINKINFO={0x28, 0x12, @veth={{0xc, 0x1, 'veth\x00'}, {0x18, 0x2, @VETH_INFO_PEER={0x14}}}}, @IFLA_NET_NS_FD={0x8}]}, 0x50}}, 0x0) [ 646.952817] binder: 11428:11429 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 647.063279] binder: 11428:11455 Acquire 1 refcount change on invalid ref 0 ret -22 [ 647.085211] binder: 11428:11455 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 01:56:01 executing program 6: r0 = syz_open_dev$sndseq(&(0x7f0000000100)='/dev/snd/seq\x00', 0x0, 0x0) read(r0, &(0x7f0000fb6000)=""/28, 0x3f0) ioctl$SNDRV_SEQ_IOCTL_REMOVE_EVENTS(r0, 0x4040534e, &(0x7f00000001c0)={0xbf}) ioctl$SNDRV_SEQ_IOCTL_QUERY_SUBS(r0, 0xc058534f, &(0x7f00000002c0)={{}, 0x1, 0x0, 0x0, {}, 0x0, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xe00]}) r1 = gettid() timer_create(0x0, &(0x7f0000044000)={0x0, 0x12}, &(0x7f0000000040)) r2 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r2, 0x8912, &(0x7f00000001c0)="0a5cc80700315f85715070") timer_settime(0x0, 0x0, &(0x7f0000000080)={{0x0, 0x989680}, {0x0, 0x9}}, &(0x7f0000040000)) tkill(r1, 0x1000000000014) 01:56:01 executing program 0: socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000001f80)={0xffffffffffffffff, 0xffffffffffffffff}) setsockopt$SO_ATTACH_FILTER(r2, 0x1, 0x1a, &(0x7f0000ab9ff0)={0x2, &(0x7f000039a000)=[{0x20, 0x0, 0x0, 0xfffffffffffff010}, {0x6}]}, 0x10) sendmmsg(r1, &(0x7f0000001e80)=[{{&(0x7f0000000700)=@l2={0x1f, 0x0, {}, 0x100000000000000}, 0x80, &(0x7f0000001dc0)}}], 0x1, 0x0) 01:56:01 executing program 1: pipe(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$KVM_GET_IRQCHIP(r0, 0xc208ae62, &(0x7f0000000040)) ioctl$KVM_GET_PIT(r0, 0xc048ae65, &(0x7f0000000140)) ioctl$TIOCGPGRP(r1, 0x540f, &(0x7f0000000200)) getpgrp(0xffffffffffffffff) fcntl$getown(r1, 0x9) r2 = gettid() r3 = getpgrp(r2) ioctl$TIOCSPGRP(r1, 0x5410, &(0x7f00000001c0)=r3) ioctl$KVM_CREATE_IRQCHIP(r0, 0xae60) perf_event_open(&(0x7f0000000300)={0x0, 0x70, 0x4, 0x1f, 0x6, 0x9, 0x0, 0x4, 0x22026, 0xa, 0x0, 0x100000001, 0x0, 0x9, 0x2, 0x1, 0x1ff, 0x9, 0x81, 0x1, 0x7fff, 0x6, 0x480af637, 0x7, 0x8, 0xfffffffff2d4d500, 0xfffffffffffff550, 0x7, 0x0, 0x5, 0x6913, 0x2, 0x8, 0x3, 0x6, 0x4, 0xff, 0x3f, 0x0, 0x5, 0x6, @perf_config_ext={0x1, 0x3ff}, 0x0, 0x7f, 0xffffffffffffcc25, 0x0, 0x6, 0x40, 0x401}, r3, 0x9, r1, 0x1) syz_open_dev$vcsa(&(0x7f0000000380)='/dev/vcsa#\x00', 0x7fff, 0x400000) r4 = syz_open_dev$dspn(&(0x7f00000003c0)='/dev/dsp#\x00', 0x200, 0x2) ioctl$BLKRRPART(r4, 0x125f, 0x0) ioctl$GIO_FONTX(r1, 0x4b6b, &(0x7f00000007c0)=""/116) getsockopt$ARPT_SO_GET_REVISION_TARGET(r1, 0x0, 0x63, &(0x7f0000000240)={'NETMAP\x00'}, &(0x7f0000000280)=0x1e) clock_nanosleep(0x2, 0x0, &(0x7f0000000140)={0x0, 0x1c9c380}, &(0x7f0000000180)) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x7, 0x8031, 0xffffffffffffffff, 0x0) mlock2(&(0x7f00009b5000/0x3000)=nil, 0xd5ff438933b6e90a, 0x0) io_setup(0x0, &(0x7f0000000600)) name_to_handle_at(r4, &(0x7f0000000840)='./file0\x00', &(0x7f0000000400)=ANY=[@ANYBLOB="c400000001000000562d61b2195b803fb8ad39f5f50900000021e87745ba256835c48d133fce8b02dac4db9c0086226a794b799455912c93b7d920936dccb8a6eb44f1bac426c522c1c46bb5110cb8f385ef0d9b3cd2e4db539d00000000ddf526b280e1beadb9f3fd650f9338103053e5e5556d08cb7f8eeb11134eae79a938f920bc3894071a00886409b5033a5961c43cd0ad69e832a73878f21dcf38f026cd2e41b3e4a4d3c65fc738dbd222d9a99b4177e1f83917e721b0bd5edc9392515258eaa10edc172c6211a0657db5071c6b14cbec03d7666e74ed86dee63caa7a55fa1e899d04065c7076a3bd8659dba20d"], &(0x7f0000000980), 0x400) prctl$setptracer(0x59616d61, r3) getsockopt$inet_sctp6_SCTP_PEER_ADDR_THLDS(r1, 0x84, 0x1f, &(0x7f00000009c0)={0x0, @in6={{0xa, 0x4e22, 0x56b, @local, 0x8000}}, 0xbff}, &(0x7f0000000a80)=0x90) 01:56:01 executing program 3: r0 = socket$inet(0x2, 0x3, 0x2) connect$inet(0xffffffffffffffff, &(0x7f0000000000)={0x2, 0x0, @local}, 0x10) setsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x23, &(0x7f0000000000)={{{@in=@multicast2, @in=@multicast1}}, {{@in6}, 0x0, @in6=@loopback}}, 0xe8) syz_emit_ethernet(0x2a, &(0x7f0000000640)={@random="b100485caa2a", @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x7}, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x1c, 0x0, 0x0, 0x0, 0x2, 0x0, @rand_addr, @broadcast}, @igmp={0x11, 0xffffffffffffffff, 0x0, @multicast1}}}}}, &(0x7f0000000140)) 01:56:01 executing program 4: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) ioctl$sock_SIOCETHTOOL(r0, 0x8946, &(0x7f0000000040)={'bond0\x00', &(0x7f0000000240)=ANY=[@ANYBLOB="37000000000023000000000000000002"]}) 01:56:01 executing program 5: perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1f}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000340)={&(0x7f0000000000), 0xc, &(0x7f0000000300)={&(0x7f0000000240)=@newlink={0x50, 0x10, 0x721, 0x0, 0x0, {0x0, 0xfffff000}, [@IFLA_LINKINFO={0x28, 0x12, @veth={{0xc, 0x1, 'veth\x00'}, {0x18, 0x2, @VETH_INFO_PEER={0x14}}}}, @IFLA_NET_NS_FD={0x8}]}, 0x50}}, 0x0) 01:56:01 executing program 2: r0 = socket$inet(0x2, 0x3, 0x2) connect$inet(0xffffffffffffffff, &(0x7f0000000000)={0x2, 0x0, @local}, 0x10) setsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x23, &(0x7f0000000000)={{{@in=@multicast2, @in=@multicast1}}, {{@in6}, 0x0, @in6=@loopback}}, 0xe8) syz_emit_ethernet(0x2a, &(0x7f0000000640)={@random="b100485caa2a", @link_local, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x1c, 0x0, 0x0, 0x0, 0x2, 0x0, @rand_addr, @broadcast}, @igmp={0x11, 0x0, 0x0, @multicast1}}}}}, &(0x7f0000000140)={0x0, 0x0, [0x400000000000000]}) 01:56:01 executing program 7: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000180)='/dev/sequencer\x00', 0x10002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000080)="0a5cc80700315f85715070") r1 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000001c0)={0x2, 0x0, &(0x7f0000000140)=ANY=[@ANYBLOB='\fc'], 0x0, 0x0, &(0x7f0000000080)}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, &(0x7f00000001c0)}) ioctl$BINDER_WRITE_READ(r1, 0xc0045878, &(0x7f0000000040)={0x8, 0x0, &(0x7f00000000c0)=[@release={0x400c630f}], 0x1, 0x0, &(0x7f0000000100)='V'}) fstat(r0, &(0x7f00000002c0)) 01:56:01 executing program 3: r0 = socket$inet(0x2, 0x3, 0x2) connect$inet(0xffffffffffffffff, &(0x7f0000000000)={0x2, 0x0, @local}, 0x10) setsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x23, &(0x7f0000000000)={{{@in=@multicast2, @in=@multicast1}}, {{@in6}, 0x0, @in6=@loopback}}, 0xe8) syz_emit_ethernet(0x2a, &(0x7f0000000640)={@random="b100485caa2a", @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x6000000000000000}, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x1c, 0x0, 0x0, 0x0, 0x2, 0x0, @rand_addr, @broadcast}, @igmp={0x11, 0xffffffffffffffff, 0x0, @multicast1}}}}}, &(0x7f0000000140)) 01:56:01 executing program 4: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) ioctl$sock_SIOCETHTOOL(r0, 0x8946, &(0x7f0000000040)={'bond0\x00', &(0x7f0000000240)=ANY=[@ANYBLOB="39000000000023000000000000000002"]}) 01:56:01 executing program 5: perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1f}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000340)={&(0x7f0000000000), 0xc, &(0x7f0000000300)={&(0x7f0000000240)=@newlink={0x50, 0x10, 0x721, 0x0, 0x0, {0x0, 0x300}, [@IFLA_LINKINFO={0x28, 0x12, @veth={{0xc, 0x1, 'veth\x00'}, {0x18, 0x2, @VETH_INFO_PEER={0x14}}}}, @IFLA_NET_NS_FD={0x8}]}, 0x50}}, 0x0) [ 647.683975] binder: 11491:11492 Acquire 1 refcount change on invalid ref 0 ret -22 [ 647.696321] binder: 11491:11492 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 01:56:01 executing program 2: r0 = socket$inet(0x2, 0x3, 0x2) connect$inet(0xffffffffffffffff, &(0x7f0000000000)={0x2, 0x0, @local}, 0x10) setsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x23, &(0x7f0000000000)={{{@in=@multicast2, @in=@multicast1}}, {{@in6}, 0x0, @in6=@loopback}}, 0xe8) syz_emit_ethernet(0x2a, &(0x7f0000000640)={@random="b100485caa2a", @link_local, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x1c, 0x0, 0x0, 0x0, 0x2, 0x0, @rand_addr, @broadcast}, @igmp={0x11, 0x0, 0x0, @multicast1}}}}}, &(0x7f0000000140)={0x0, 0x0, [0x1000000]}) 01:56:01 executing program 0: socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000001f80)={0xffffffffffffffff, 0xffffffffffffffff}) setsockopt$SO_ATTACH_FILTER(r2, 0x1, 0x1a, &(0x7f0000ab9ff0)={0x2, &(0x7f000039a000)=[{0x20, 0x0, 0x0, 0xfffffffffffff010}, {0x6}]}, 0x10) sendmmsg(r1, &(0x7f0000001e80)=[{{&(0x7f0000000700)=@l2={0x1f, 0x0, {}, 0x400300}, 0x80, &(0x7f0000001dc0)}}], 0x1, 0x0) [ 647.780268] binder: 11491:11502 Acquire 1 refcount change on invalid ref 0 ret -22 [ 647.806713] binder: 11491:11502 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 01:56:01 executing program 5: perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1f}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000340)={&(0x7f0000000000), 0xc, &(0x7f0000000300)={&(0x7f0000000240)=@newlink={0x50, 0x10, 0x721, 0x0, 0x0, {0x0, 0x3}, [@IFLA_LINKINFO={0x28, 0x12, @veth={{0xc, 0x1, 'veth\x00'}, {0x18, 0x2, @VETH_INFO_PEER={0x14}}}}, @IFLA_NET_NS_FD={0x8}]}, 0x50}}, 0x0) 01:56:01 executing program 4: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) ioctl$sock_SIOCETHTOOL(r0, 0x8946, &(0x7f0000000040)={'bond0\x00', &(0x7f0000000240)=ANY=[@ANYBLOB="16000000000023000000000000000002"]}) 01:56:01 executing program 2: r0 = socket$inet(0x2, 0x3, 0x2) connect$inet(0xffffffffffffffff, &(0x7f0000000000)={0x2, 0x0, @local}, 0x10) setsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x23, &(0x7f0000000000)={{{@in=@multicast2, @in=@multicast1}}, {{@in6}, 0x0, @in6=@loopback}}, 0xe8) syz_emit_ethernet(0x2a, &(0x7f0000000640)={@random="b100485caa2a", @link_local, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x1c, 0x0, 0x0, 0x0, 0x2, 0x0, @rand_addr, @broadcast}, @igmp={0x11, 0x0, 0x0, @multicast1}}}}}, &(0x7f0000000140)={0x0, 0x0, [0x20000000]}) 01:56:02 executing program 6: r0 = syz_open_dev$sndseq(&(0x7f0000000100)='/dev/snd/seq\x00', 0x0, 0x0) read(r0, &(0x7f0000fb6000)=""/28, 0x3f0) ioctl$SNDRV_SEQ_IOCTL_REMOVE_EVENTS(r0, 0x4040534e, &(0x7f00000001c0)={0xbf}) ioctl$SNDRV_SEQ_IOCTL_QUERY_SUBS(r0, 0xc058534f, &(0x7f00000002c0)={{}, 0x1, 0x0, 0x0, {}, 0x0, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xbf00000000000000]}) r1 = gettid() timer_create(0x0, &(0x7f0000044000)={0x0, 0x12}, &(0x7f0000000040)) r2 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r2, 0x8912, &(0x7f00000001c0)="0a5cc80700315f85715070") timer_settime(0x0, 0x0, &(0x7f0000000080)={{0x0, 0x989680}, {0x0, 0x9}}, &(0x7f0000040000)) tkill(r1, 0x1000000000014) 01:56:02 executing program 3: r0 = socket$inet(0x2, 0x3, 0x2) connect$inet(0xffffffffffffffff, &(0x7f0000000000)={0x2, 0x0, @local}, 0x10) setsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x23, &(0x7f0000000000)={{{@in=@multicast2, @in=@multicast1}}, {{@in6}, 0x0, @in6=@loopback}}, 0xe8) syz_emit_ethernet(0x2a, &(0x7f0000000640)={@random="b100485caa2a", @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x1c00000000000000}, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x1c, 0x0, 0x0, 0x0, 0x2, 0x0, @rand_addr, @broadcast}, @igmp={0x11, 0xffffffffffffffff, 0x0, @multicast1}}}}}, &(0x7f0000000140)) 01:56:02 executing program 4: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) ioctl$sock_SIOCETHTOOL(r0, 0x8946, &(0x7f0000000040)={'bond0\x00', &(0x7f0000000240)=ANY=[@ANYBLOB="38000000000023000000000000000002"]}) 01:56:02 executing program 0: socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000001f80)={0xffffffffffffffff, 0xffffffffffffffff}) setsockopt$SO_ATTACH_FILTER(r2, 0x1, 0x1a, &(0x7f0000ab9ff0)={0x2, &(0x7f000039a000)=[{0x20, 0x0, 0x0, 0xfffffffffffff010}, {0x6}]}, 0x10) sendmmsg(r1, &(0x7f0000001e80)=[{{&(0x7f0000000700)=@l2={0x1f, 0x0, {}, 0x11000000}, 0x80, &(0x7f0000001dc0)}}], 0x1, 0x0) 01:56:02 executing program 5: perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1f}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000340)={&(0x7f0000000000), 0xc, &(0x7f0000000300)={&(0x7f0000000240)=@newlink={0x50, 0x10, 0x721, 0x0, 0x0, {0x0, 0x2000000}, [@IFLA_LINKINFO={0x28, 0x12, @veth={{0xc, 0x1, 'veth\x00'}, {0x18, 0x2, @VETH_INFO_PEER={0x14}}}}, @IFLA_NET_NS_FD={0x8}]}, 0x50}}, 0x0) 01:56:02 executing program 7: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000180)='/dev/sequencer\x00', 0x10002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000080)="0a5cc80700315f85715070") r1 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000001c0)={0x2, 0x0, &(0x7f0000000140)=ANY=[@ANYBLOB='\fc'], 0x0, 0x0, &(0x7f0000000080)}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, &(0x7f00000001c0)}) ioctl$BINDER_WRITE_READ(r1, 0xc0306263, &(0x7f0000000040)={0x8, 0x0, &(0x7f00000000c0)=[@release={0x400c630f}], 0x1, 0x0, &(0x7f0000000100)='V'}) fstat(r0, &(0x7f00000002c0)) 01:56:02 executing program 2: r0 = socket$inet(0x2, 0x3, 0x2) connect$inet(0xffffffffffffffff, &(0x7f0000000000)={0x2, 0x0, @local}, 0x10) setsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x23, &(0x7f0000000000)={{{@in=@multicast2, @in=@multicast1}}, {{@in6}, 0x0, @in6=@loopback}}, 0xe8) syz_emit_ethernet(0x2a, &(0x7f0000000640)={@random="b100485caa2a", @link_local, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x1c, 0x0, 0x0, 0x0, 0x2, 0x0, @rand_addr, @broadcast}, @igmp={0x11, 0x0, 0x0, @multicast1}}}}}, &(0x7f0000000140)={0x0, 0x0, [0x60]}) 01:56:02 executing program 1: dup(0xffffffffffffff9c) r0 = accept$packet(0xffffffffffffff9c, &(0x7f0000000540)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @local}, &(0x7f0000000580)=0x14) r2 = accept4(r0, &(0x7f0000000200)=@sco, &(0x7f0000000280)=0x80, 0x80800) ioctl$sock_bt(r2, 0x541b, &(0x7f00000002c0)="d28dba22802aa831946044685f4ca5865645f5e0bc074dc341750215a7516d35d6f5f3d45e2ef38706d0e8f6bec8607be89661c1415372c3e749c8adf384354bd200460d3034863121bf24a7b1effa88b3fb396922d3643007452d699a97cc9722207d54f3") setsockopt$IP_VS_SO_SET_TIMEOUT(r2, 0x0, 0x48a, &(0x7f0000000500)={0x5308, 0x200}, 0xc) r3 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCBRADDBR(r3, 0x89a0, &(0x7f0000000000)='tunl0\x00') ioctl$sock_inet6_SIOCSIFADDR(r2, 0x8916, &(0x7f0000000040)={@ipv4={[], [], @dev={0xac, 0x14, 0x14, 0x11}}, 0x73, r1}) sendmsg$nl_route(r3, &(0x7f0000000140)={&(0x7f00000000c0), 0xc, &(0x7f00000001c0)={&(0x7f0000000340)=ANY=[@ANYBLOB="2800000010025fba000000000000000000000000d14766b5d690cff7e10e9dec383212f5c8712e16d603046fac553944bbb79d7dbb6f917c7eb85424cf3eae7d4b9d9cde5e1b2a0cb041d36d2de1668e26806e124352a17a42f099ecbc0c554ef2bcd4f2718e08e0fbd10e4b48b4695ace93c8b1ecadf46c0e2e9df703a4edfdb5923e520557b472dcccbbf00445b972e7a82cc9a71b9a804a0ec566479c0f0b8451da4fb824630b27f6ed071fe7d96acb553485dc3974ec531a7f052d2e0d8b78a87675c7384b07638f3e1b55e7e148d52d882d25a16f18ca782b79478ce70a8790bbaa83246f4945ea7a76a49afb7d36b0ba43e87635d4e20b52c68116c624f52f827808c04410d4ca75bd6aed034ffac2eac6b6dabbf5d8e1bd6f2b2e29c0ab1c67215714587afc621e12677a00204e1cca1012075e2dd314125f2520af482230cc20bf2f8698d0dab9b83b996748a2d0db822f2d4941ee8e75f5098f32257d2c17c3d5293a7fc83ab1b74cf8bb48016ce7b8f2482870d5c80e9d5f43751b25eb0695df71e2385883ea3e", @ANYRES32=0x0, @ANYBLOB="000000000000000900001b0000000000"], 0x28}}, 0x0) r4 = openat$userio(0xffffffffffffff9c, &(0x7f0000000600)='/dev/userio\x00', 0x8082, 0x0) getsockopt$inet_sctp_SCTP_PR_ASSOC_STATUS(0xffffffffffffffff, 0x84, 0x73, &(0x7f0000000080)={0x0, 0x9, 0x30, 0x1, 0x10000}, &(0x7f0000000100)=0x18) setsockopt$inet_sctp6_SCTP_AUTH_DELETE_KEY(r4, 0x84, 0x19, &(0x7f0000000180)={r5, 0x5}, 0x8) 01:56:02 executing program 4: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) ioctl$sock_SIOCETHTOOL(r0, 0x8946, &(0x7f0000000040)={'bond0\x00', &(0x7f0000000240)=ANY=[@ANYBLOB="12000000000023000000000000000002"]}) 01:56:02 executing program 2: r0 = socket$inet(0x2, 0x3, 0x2) connect$inet(0xffffffffffffffff, &(0x7f0000000000)={0x2, 0x0, @local}, 0x10) setsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x23, &(0x7f0000000000)={{{@in=@multicast2, @in=@multicast1}}, {{@in6}, 0x0, @in6=@loopback}}, 0xe8) syz_emit_ethernet(0x2a, &(0x7f0000000640)={@random="b100485caa2a", @link_local, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x1c, 0x0, 0x0, 0x0, 0x2, 0x0, @rand_addr, @broadcast}, @igmp={0x11, 0x0, 0x0, @multicast1}}}}}, &(0x7f0000000140)={0x0, 0x0, [0x40030000000000]}) 01:56:02 executing program 5: perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1f}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000340)={&(0x7f0000000000), 0xc, &(0x7f0000000300)={&(0x7f0000000240)=@newlink={0x50, 0x10, 0x721, 0x0, 0x0, {0x0, 0x9effffff}, [@IFLA_LINKINFO={0x28, 0x12, @veth={{0xc, 0x1, 'veth\x00'}, {0x18, 0x2, @VETH_INFO_PEER={0x14}}}}, @IFLA_NET_NS_FD={0x8}]}, 0x50}}, 0x0) 01:56:02 executing program 3: r0 = socket$inet(0x2, 0x3, 0x2) connect$inet(0xffffffffffffffff, &(0x7f0000000000)={0x2, 0x0, @local}, 0x10) setsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x23, &(0x7f0000000000)={{{@in=@multicast2, @in=@multicast1}}, {{@in6}, 0x0, @in6=@loopback}}, 0xe8) syz_emit_ethernet(0x2a, &(0x7f0000000640)={@random="b100485caa2a", @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0xe000000000000000}, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x1c, 0x0, 0x0, 0x0, 0x2, 0x0, @rand_addr, @broadcast}, @igmp={0x11, 0xffffffffffffffff, 0x0, @multicast1}}}}}, &(0x7f0000000140)) 01:56:02 executing program 1: r0 = syz_open_dev$vcsn(&(0x7f00000000c0)='/dev/vcs#\x00', 0x2, 0x8180) ioctl$SG_GET_SG_TABLESIZE(r0, 0x227f, &(0x7f0000000100)) socket$inet(0x2, 0x3, 0x4) syz_emit_ethernet(0x7e, &(0x7f0000000040)={@local, @link_local={0x5}, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x70, 0x0, 0x0, 0x0, 0x1, 0x0, @remote, @dev={0xac, 0x14, 0x14, 0x11}}, @icmp=@parameter_prob={0x3, 0x4, 0x0, 0x0, 0x0, 0x0, {0x15, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x104, 0x0, @local, @dev, {[@timestamp={0x44, 0x40, 0x0, 0x0, 0x0, [{[@rand_addr]}, {[@multicast2]}, {[@multicast1]}, {}, {[@loopback]}, {[@broadcast]}, {[@multicast1]}, {[@dev]}]}]}}}}}}}, &(0x7f0000000000)) [ 648.640894] binder: 11557:11558 Acquire 1 refcount change on invalid ref 0 ret -22 01:56:02 executing program 4: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) ioctl$sock_SIOCETHTOOL(r0, 0x8946, &(0x7f0000000040)={'bond0\x00', &(0x7f0000000240)=ANY=[@ANYBLOB="49000000000023000000000000000002"]}) 01:56:02 executing program 0: socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000001f80)={0xffffffffffffffff, 0xffffffffffffffff}) setsockopt$SO_ATTACH_FILTER(r2, 0x1, 0x1a, &(0x7f0000ab9ff0)={0x2, &(0x7f000039a000)=[{0x20, 0x0, 0x0, 0xfffffffffffff010}, {0x6}]}, 0x10) sendmmsg(r1, &(0x7f0000001e80)=[{{&(0x7f0000000700)=@l2={0x1f, 0x0, {}, 0xc03e}, 0x80, &(0x7f0000001dc0)}}], 0x1, 0x0) 01:56:02 executing program 5: perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1f}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000340)={&(0x7f0000000000), 0xc, &(0x7f0000000300)={&(0x7f0000000240)=@newlink={0x50, 0x10, 0x721, 0x0, 0x0, {0x0, 0x700}, [@IFLA_LINKINFO={0x28, 0x12, @veth={{0xc, 0x1, 'veth\x00'}, {0x18, 0x2, @VETH_INFO_PEER={0x14}}}}, @IFLA_NET_NS_FD={0x8}]}, 0x50}}, 0x0) [ 648.747518] binder: 11557:11558 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 648.843269] binder: 11557:11584 ioctl c0306263 20000040 returned -22 [ 648.915104] binder: 11557:11601 Acquire 1 refcount change on invalid ref 0 ret -22 [ 648.927246] binder: 11557:11601 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 648.952427] binder: 11557:11558 ioctl c0306263 20000040 returned -22 01:56:03 executing program 6: r0 = syz_open_dev$sndseq(&(0x7f0000000100)='/dev/snd/seq\x00', 0x0, 0x0) read(r0, &(0x7f0000fb6000)=""/28, 0x3f0) ioctl$SNDRV_SEQ_IOCTL_REMOVE_EVENTS(r0, 0x4040534e, &(0x7f00000001c0)={0xbf}) ioctl$SNDRV_SEQ_IOCTL_QUERY_SUBS(r0, 0xc058534f, &(0x7f00000002c0)={{}, 0x1, 0x0, 0x0, {}, 0x0, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xbf]}) r1 = gettid() timer_create(0x0, &(0x7f0000044000)={0x0, 0x12}, &(0x7f0000000040)) r2 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r2, 0x8912, &(0x7f00000001c0)="0a5cc80700315f85715070") timer_settime(0x0, 0x0, &(0x7f0000000080)={{0x0, 0x989680}, {0x0, 0x9}}, &(0x7f0000040000)) tkill(r1, 0x1000000000014) 01:56:03 executing program 1: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x2) perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff7ffffffffffb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$KVM_ENABLE_CAP_CPU(r2, 0xc008ae88, &(0x7f0000000140)={0x7b, 0x0, [0x40000100]}) r3 = msgget$private(0x0, 0x80) msgctl$IPC_INFO(r3, 0x3, &(0x7f0000000040)=""/128) 01:56:03 executing program 2: r0 = socket$inet(0x2, 0x3, 0x2) connect$inet(0xffffffffffffffff, &(0x7f0000000000)={0x2, 0x0, @local}, 0x10) setsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x23, &(0x7f0000000000)={{{@in=@multicast2, @in=@multicast1}}, {{@in6}, 0x0, @in6=@loopback}}, 0xe8) syz_emit_ethernet(0x2a, &(0x7f0000000640)={@random="b100485caa2a", @link_local, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x1c, 0x0, 0x0, 0x0, 0x2, 0x0, @rand_addr, @broadcast}, @igmp={0x11, 0x0, 0x0, @multicast1}}}}}, &(0x7f0000000140)={0x0, 0x0, [0x100000000000000]}) 01:56:03 executing program 3: r0 = socket$inet(0x2, 0x3, 0x2) connect$inet(0xffffffffffffffff, &(0x7f0000000000)={0x2, 0x0, @local}, 0x10) setsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x23, &(0x7f0000000000)={{{@in=@multicast2, @in=@multicast1}}, {{@in6}, 0x0, @in6=@loopback}}, 0xe8) syz_emit_ethernet(0x2a, &(0x7f0000000640)={@random="b100485caa2a", @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x400300}, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x1c, 0x0, 0x0, 0x0, 0x2, 0x0, @rand_addr, @broadcast}, @igmp={0x11, 0xffffffffffffffff, 0x0, @multicast1}}}}}, &(0x7f0000000140)) 01:56:03 executing program 4: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) ioctl$sock_SIOCETHTOOL(r0, 0x8946, &(0x7f0000000040)={'bond0\x00', &(0x7f0000000240)=ANY=[@ANYBLOB="25000000000023000000000000000002"]}) 01:56:03 executing program 0: socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000001f80)={0xffffffffffffffff, 0xffffffffffffffff}) setsockopt$SO_ATTACH_FILTER(r2, 0x1, 0x1a, &(0x7f0000ab9ff0)={0x2, &(0x7f000039a000)=[{0x20, 0x0, 0x0, 0xfffffffffffff010}, {0x6}]}, 0x10) sendmmsg(r1, &(0x7f0000001e80)=[{{&(0x7f0000000700)=@l2={0x1f, 0x0, {}, 0x3000000}, 0x80, &(0x7f0000001dc0)}}], 0x1, 0x0) 01:56:03 executing program 5: perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1f}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000340)={&(0x7f0000000000), 0xc, &(0x7f0000000300)={&(0x7f0000000240)=@newlink={0x50, 0x10, 0x721, 0x0, 0x0, {0x0, 0x40030000000000}, [@IFLA_LINKINFO={0x28, 0x12, @veth={{0xc, 0x1, 'veth\x00'}, {0x18, 0x2, @VETH_INFO_PEER={0x14}}}}, @IFLA_NET_NS_FD={0x8}]}, 0x50}}, 0x0) 01:56:03 executing program 7: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000180)='/dev/sequencer\x00', 0x10002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000080)="0a5cc80700315f85715070") r1 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000001c0)={0x2, 0x0, &(0x7f0000000140)=ANY=[@ANYBLOB='\fc'], 0x0, 0x0, &(0x7f0000000080)}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, &(0x7f00000001c0)}) ioctl$BINDER_WRITE_READ(r1, 0xc0306225, &(0x7f0000000040)={0x8, 0x0, &(0x7f00000000c0)=[@release={0x400c630f}], 0x1, 0x0, &(0x7f0000000100)='V'}) fstat(r0, &(0x7f00000002c0)) 01:56:03 executing program 4: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) ioctl$sock_SIOCETHTOOL(r0, 0x8946, &(0x7f0000000040)={'bond0\x00', &(0x7f0000000240)=ANY=[@ANYBLOB="26000000000023000000000000000002"]}) 01:56:03 executing program 2: r0 = socket$inet(0x2, 0x3, 0x2) connect$inet(0xffffffffffffffff, &(0x7f0000000000)={0x2, 0x0, @local}, 0x10) setsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x23, &(0x7f0000000000)={{{@in=@multicast2, @in=@multicast1}}, {{@in6}, 0x0, @in6=@loopback}}, 0xe8) syz_emit_ethernet(0x2a, &(0x7f0000000640)={@random="b100485caa2a", @link_local, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x1c, 0x0, 0x0, 0x0, 0x2, 0x0, @rand_addr, @broadcast}, @igmp={0x11, 0x0, 0x0, @multicast1}}}}}, &(0x7f0000000140)={0x0, 0x0, [0xe000000000000000]}) 01:56:03 executing program 5: perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1f}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000340)={&(0x7f0000000000), 0xc, &(0x7f0000000300)={&(0x7f0000000240)=@newlink={0x50, 0x10, 0x721, 0x0, 0x0, {0x0, 0x5000000}, [@IFLA_LINKINFO={0x28, 0x12, @veth={{0xc, 0x1, 'veth\x00'}, {0x18, 0x2, @VETH_INFO_PEER={0x14}}}}, @IFLA_NET_NS_FD={0x8}]}, 0x50}}, 0x0) 01:56:03 executing program 3: r0 = socket$inet(0x2, 0x3, 0x2) connect$inet(0xffffffffffffffff, &(0x7f0000000000)={0x2, 0x0, @local}, 0x10) setsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x23, &(0x7f0000000000)={{{@in=@multicast2, @in=@multicast1}}, {{@in6}, 0x0, @in6=@loopback}}, 0xe8) syz_emit_ethernet(0x2a, &(0x7f0000000640)={@random="b100485caa2a", @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x6}, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x1c, 0x0, 0x0, 0x0, 0x2, 0x0, @rand_addr, @broadcast}, @igmp={0x11, 0xffffffffffffffff, 0x0, @multicast1}}}}}, &(0x7f0000000140)) [ 649.531447] binder: 11620:11626 Acquire 1 refcount change on invalid ref 0 ret -22 01:56:03 executing program 1: r0 = memfd_create(&(0x7f00000003c0)="ce2cc8bae5fefaf12873085e0324a3b63cb39a3197e2c24e6e01f037c044b18b3dc961154e6a6e191a248074074dd1dde1b0c90df21c0a93ac7e00e5f0c5d2ea2d3609e7ed93ae97d1ad04a8af59e2f68da7055f1ec6aebc750e8cc68bfe5b5766f1d09614ac9390f630f551bb75898ed384251dd2013354c2b3a5edfdac6f3a9e75ebb6925cd42d29707d25a546f211ad8aa2f0008d2aa5a2df34446dc2ad4551ef5d0e20515861fca578c3", 0x2) getsockopt$inet_sctp_SCTP_SOCKOPT_CONNECTX3(0xffffffffffffff9c, 0x84, 0x6f, &(0x7f0000000100)={0x0, 0x3c, &(0x7f00000000c0)=[@in={0x2, 0x4e21, @remote}, @in={0x2, 0x4e20, @dev={0xac, 0x14, 0x14, 0x14}}, @in6={0xa, 0x4e20, 0x8, @local, 0x66a1}]}, &(0x7f0000000140)=0x10) getsockname$netlink(r0, &(0x7f0000000240), &(0x7f0000000280)=0xc) setsockopt$inet_sctp6_SCTP_AUTH_ACTIVE_KEY(r0, 0x84, 0x18, &(0x7f0000000200)={r1, 0x401}, 0x8) perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1f}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r2 = syz_open_dev$usbmon(&(0x7f0000000040)='/dev/usbmon#\x00', 0x0, 0x0) ioctl$KVM_SET_NR_MMU_PAGES(r2, 0x9208, 0x0) 01:56:03 executing program 0: socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000001f80)={0xffffffffffffffff, 0xffffffffffffffff}) setsockopt$SO_ATTACH_FILTER(r2, 0x1, 0x1a, &(0x7f0000ab9ff0)={0x2, &(0x7f000039a000)=[{0x20, 0x0, 0x0, 0xfffffffffffff010}, {0x6}]}, 0x10) sendmmsg(r1, &(0x7f0000001e80)=[{{&(0x7f0000000700)=@l2={0x1f, 0x0, {}, 0xeffdffff}, 0x80, &(0x7f0000001dc0)}}], 0x1, 0x0) 01:56:03 executing program 4: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) ioctl$sock_SIOCETHTOOL(r0, 0x8946, &(0x7f0000000040)={'bond0\x00', &(0x7f0000000240)=ANY=[@ANYBLOB="0e000000000023000000000000000002"]}) 01:56:03 executing program 5: perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1f}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000340)={&(0x7f0000000000), 0xc, &(0x7f0000000300)={&(0x7f0000000240)=@newlink={0x50, 0x10, 0x721, 0x0, 0x0, {0x0, 0x8000000}, [@IFLA_LINKINFO={0x28, 0x12, @veth={{0xc, 0x1, 'veth\x00'}, {0x18, 0x2, @VETH_INFO_PEER={0x14}}}}, @IFLA_NET_NS_FD={0x8}]}, 0x50}}, 0x0) [ 649.701755] binder: 11620:11626 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 649.702212] binder: 11620:11650 ioctl c0306225 20000040 returned -22 [ 649.854614] binder: 11620:11650 Acquire 1 refcount change on invalid ref 0 ret -22 [ 649.893642] binder: 11620:11650 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 649.901103] binder: 11620:11626 ioctl c0306225 20000040 returned -22 01:56:04 executing program 6: r0 = syz_open_dev$sndseq(&(0x7f0000000100)='/dev/snd/seq\x00', 0x0, 0x0) read(r0, &(0x7f0000fb6000)=""/28, 0x3f0) ioctl$SNDRV_SEQ_IOCTL_REMOVE_EVENTS(r0, 0x4040534e, &(0x7f00000001c0)={0xbf}) ioctl$SNDRV_SEQ_IOCTL_QUERY_SUBS(r0, 0xc058534f, &(0x7f00000002c0)={{}, 0x1, 0x0, 0x0, {}, 0x0, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffff00000000]}) r1 = gettid() timer_create(0x0, &(0x7f0000044000)={0x0, 0x12}, &(0x7f0000000040)) r2 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r2, 0x8912, &(0x7f00000001c0)="0a5cc80700315f85715070") timer_settime(0x0, 0x0, &(0x7f0000000080)={{0x0, 0x989680}, {0x0, 0x9}}, &(0x7f0000040000)) tkill(r1, 0x1000000000014) 01:56:04 executing program 3: r0 = socket$inet(0x2, 0x3, 0x2) connect$inet(0xffffffffffffffff, &(0x7f0000000000)={0x2, 0x0, @local}, 0x10) setsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x23, &(0x7f0000000000)={{{@in=@multicast2, @in=@multicast1}}, {{@in6}, 0x0, @in6=@loopback}}, 0xe8) syz_emit_ethernet(0x2a, &(0x7f0000000640)={@random="b100485caa2a", @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x8}, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x1c, 0x0, 0x0, 0x0, 0x2, 0x0, @rand_addr, @broadcast}, @igmp={0x11, 0xffffffffffffffff, 0x0, @multicast1}}}}}, &(0x7f0000000140)) 01:56:04 executing program 2: r0 = socket$inet(0x2, 0x3, 0x2) connect$inet(0xffffffffffffffff, &(0x7f0000000000)={0x2, 0x0, @local}, 0x10) setsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x23, &(0x7f0000000000)={{{@in=@multicast2, @in=@multicast1}}, {{@in6}, 0x0, @in6=@loopback}}, 0xe8) syz_emit_ethernet(0x2a, &(0x7f0000000640)={@random="b100485caa2a", @link_local, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x1c, 0x0, 0x0, 0x0, 0x2, 0x0, @rand_addr, @broadcast}, @igmp={0x11, 0x0, 0x0, @multicast1}}}}}, &(0x7f0000000140)={0x0, 0x0, [0x60000000]}) 01:56:04 executing program 4: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) ioctl$sock_SIOCETHTOOL(r0, 0x8946, &(0x7f0000000040)={'bond0\x00', &(0x7f0000000240)=ANY=[@ANYBLOB="2d000000000023000000000000000002"]}) 01:56:04 executing program 1: r0 = socket$inet6(0xa, 0x40000000000003, 0xff) connect$inet6(r0, &(0x7f0000000080)={0xa, 0x4004, 0x6, @ipv4={[], [], @loopback}, 0xd3}, 0x1c) r1 = memfd_create(&(0x7f0000000180)='keyringeth0bdev.\'cgroup{&^wlan0\'\x00', 0x0) getsockopt$inet_IP_XFRM_POLICY(r1, 0x0, 0x11, &(0x7f00000001c0)={{{@in, @in=@multicast1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in=@remote}, 0x0, @in6=@mcast1}}, &(0x7f0000000040)=0xe8) ioctl$sock_inet6_SIOCSIFDSTADDR(r0, 0x8918, &(0x7f0000000100)={@remote, 0x51, r2}) bind$vsock_dgram(r1, &(0x7f00000000c0)={0x28, 0x0, 0x0, @my=0x1}, 0x10) sendto$inet6(r0, &(0x7f0000000040), 0x5dc, 0x0, &(0x7f0000000000)={0xa, 0x0, 0x0, @mcast1={0xff, 0x3}}, 0x1c) 01:56:04 executing program 0: socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000001f80)={0xffffffffffffffff, 0xffffffffffffffff}) setsockopt$SO_ATTACH_FILTER(r2, 0x1, 0x1a, &(0x7f0000ab9ff0)={0x2, &(0x7f000039a000)=[{0x20, 0x0, 0x0, 0xfffffffffffff010}, {0x6}]}, 0x10) sendmmsg(r1, &(0x7f0000001e80)=[{{&(0x7f0000000700)=@l2={0x1f, 0x0, {}, 0xfffffdef}, 0x80, &(0x7f0000001dc0)}}], 0x1, 0x0) 01:56:04 executing program 5: perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1f}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000340)={&(0x7f0000000000), 0xc, &(0x7f0000000300)={&(0x7f0000000240)=@newlink={0x50, 0x10, 0x721, 0x0, 0x0, {0x0, 0x81000000}, [@IFLA_LINKINFO={0x28, 0x12, @veth={{0xc, 0x1, 'veth\x00'}, {0x18, 0x2, @VETH_INFO_PEER={0x14}}}}, @IFLA_NET_NS_FD={0x8}]}, 0x50}}, 0x0) 01:56:04 executing program 7: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000180)='/dev/sequencer\x00', 0x10002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000080)="0a5cc80700315f85715070") r1 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000001c0)={0x2, 0x0, &(0x7f0000000140)=ANY=[@ANYBLOB='\fc'], 0x0, 0x0, &(0x7f0000000080)}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, &(0x7f00000001c0)}) ioctl$BINDER_WRITE_READ(r1, 0xc020660b, &(0x7f0000000040)={0x8, 0x0, &(0x7f00000000c0)=[@release={0x400c630f}], 0x1, 0x0, &(0x7f0000000100)='V'}) fstat(r0, &(0x7f00000002c0)) 01:56:04 executing program 2: r0 = socket$inet(0x2, 0x3, 0x2) connect$inet(0xffffffffffffffff, &(0x7f0000000000)={0x2, 0x0, @local}, 0x10) setsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x23, &(0x7f0000000000)={{{@in=@multicast2, @in=@multicast1}}, {{@in6}, 0x0, @in6=@loopback}}, 0xe8) syz_emit_ethernet(0x2a, &(0x7f0000000640)={@random="b100485caa2a", @link_local, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x1c, 0x0, 0x0, 0x0, 0x2, 0x0, @rand_addr, @broadcast}, @igmp={0x11, 0x0, 0x0, @multicast1}}}}}, &(0x7f0000000140)={0x0, 0x0, [0x7]}) [ 650.423275] binder: 11689:11692 Acquire 1 refcount change on invalid ref 0 ret -22 [ 650.436436] binder: 11689:11692 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 01:56:04 executing program 1: r0 = syz_open_dev$audion(&(0x7f0000000040)='/dev/audio#\x00', 0x3, 0x80000) ioctl$SNDRV_SEQ_IOCTL_GET_PORT_INFO(r0, 0xc0a85322, &(0x7f00000000c0)) perf_event_open(&(0x7f0000940000)={0x2, 0x70, 0xfffffffffffffffe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x3}, 0x0, 0x0, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) clone(0xa29e0dcdcdf67d6b, &(0x7f0000000300), &(0x7f0000000080), &(0x7f0000000280), &(0x7f0000000180)) 01:56:04 executing program 5: perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1f}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000340)={&(0x7f0000000000), 0xc, &(0x7f0000000300)={&(0x7f0000000240)=@newlink={0x50, 0x10, 0x721, 0x0, 0x0, {0x0, 0x7000000}, [@IFLA_LINKINFO={0x28, 0x12, @veth={{0xc, 0x1, 'veth\x00'}, {0x18, 0x2, @VETH_INFO_PEER={0x14}}}}, @IFLA_NET_NS_FD={0x8}]}, 0x50}}, 0x0) 01:56:04 executing program 4: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) ioctl$sock_SIOCETHTOOL(r0, 0x8946, &(0x7f0000000040)={'bond0\x00', &(0x7f0000000240)=ANY=[@ANYBLOB="3c000000000023000000000000000002"]}) 01:56:04 executing program 3: r0 = socket$inet(0x2, 0x3, 0x2) connect$inet(0xffffffffffffffff, &(0x7f0000000000)={0x2, 0x0, @local}, 0x10) setsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x23, &(0x7f0000000000)={{{@in=@multicast2, @in=@multicast1}}, {{@in6}, 0x0, @in6=@loopback}}, 0xe8) syz_emit_ethernet(0x2a, &(0x7f0000000640)={@random="b100485caa2a", @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x2000}, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x1c, 0x0, 0x0, 0x0, 0x2, 0x0, @rand_addr, @broadcast}, @igmp={0x11, 0xffffffffffffffff, 0x0, @multicast1}}}}}, &(0x7f0000000140)) [ 650.464578] binder: 11689:11696 Acquire 1 refcount change on invalid ref 0 ret -22 01:56:04 executing program 0: socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000001f80)={0xffffffffffffffff, 0xffffffffffffffff}) setsockopt$SO_ATTACH_FILTER(r2, 0x1, 0x1a, &(0x7f0000ab9ff0)={0x2, &(0x7f000039a000)=[{0x20, 0x0, 0x0, 0xfffffffffffff010}, {0x6}]}, 0x10) sendmmsg(r1, &(0x7f0000001e80)=[{{&(0x7f0000000700)=@l2={0x1f, 0x0, {}, 0xc0}, 0x80, &(0x7f0000001dc0)}}], 0x1, 0x0) 01:56:04 executing program 3: r0 = socket$inet(0x2, 0x3, 0x2) connect$inet(0xffffffffffffffff, &(0x7f0000000000)={0x2, 0x0, @local}, 0x10) setsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x23, &(0x7f0000000000)={{{@in=@multicast2, @in=@multicast1}}, {{@in6}, 0x0, @in6=@loopback}}, 0xe8) syz_emit_ethernet(0x2a, &(0x7f0000000640)={@random="b100485caa2a", @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x300}, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x1c, 0x0, 0x0, 0x0, 0x2, 0x0, @rand_addr, @broadcast}, @igmp={0x11, 0xffffffffffffffff, 0x0, @multicast1}}}}}, &(0x7f0000000140)) 01:56:04 executing program 2: r0 = socket$inet(0x2, 0x3, 0x2) connect$inet(0xffffffffffffffff, &(0x7f0000000000)={0x2, 0x0, @local}, 0x10) setsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x23, &(0x7f0000000000)={{{@in=@multicast2, @in=@multicast1}}, {{@in6}, 0x0, @in6=@loopback}}, 0xe8) syz_emit_ethernet(0x2a, &(0x7f0000000640)={@random="b100485caa2a", @link_local, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x1c, 0x0, 0x0, 0x0, 0x2, 0x0, @rand_addr, @broadcast}, @igmp={0x11, 0x0, 0x0, @multicast1}}}}}, &(0x7f0000000140)={0x0, 0x0, [0x2000]}) [ 650.609694] binder: 11689:11696 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 01:56:05 executing program 6: r0 = syz_open_dev$sndseq(&(0x7f0000000100)='/dev/snd/seq\x00', 0x0, 0x0) read(r0, &(0x7f0000fb6000)=""/28, 0x3f0) ioctl$SNDRV_SEQ_IOCTL_REMOVE_EVENTS(r0, 0x4040534e, &(0x7f00000001c0)={0xbf}) ioctl$SNDRV_SEQ_IOCTL_QUERY_SUBS(r0, 0xc058534f, &(0x7f00000002c0)={{}, 0x1, 0x0, 0x0, {}, 0x0, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xe000000]}) r1 = gettid() timer_create(0x0, &(0x7f0000044000)={0x0, 0x12}, &(0x7f0000000040)) r2 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r2, 0x8912, &(0x7f00000001c0)="0a5cc80700315f85715070") timer_settime(0x0, 0x0, &(0x7f0000000080)={{0x0, 0x989680}, {0x0, 0x9}}, &(0x7f0000040000)) tkill(r1, 0x1000000000014) 01:56:05 executing program 4: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) ioctl$sock_SIOCETHTOOL(r0, 0x8946, &(0x7f0000000040)={'bond0\x00', &(0x7f0000000240)=ANY=[@ANYBLOB="4f000000000023000000000000000002"]}) 01:56:05 executing program 5: perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1f}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000340)={&(0x7f0000000000), 0xc, &(0x7f0000000300)={&(0x7f0000000240)=@newlink={0x50, 0x10, 0x721, 0x0, 0x0, {0x0, 0x10}, [@IFLA_LINKINFO={0x28, 0x12, @veth={{0xc, 0x1, 'veth\x00'}, {0x18, 0x2, @VETH_INFO_PEER={0x14}}}}, @IFLA_NET_NS_FD={0x8}]}, 0x50}}, 0x0) 01:56:05 executing program 1: timer_create(0x0, &(0x7f0000adafa0)={0x0, 0x1c, 0x0, @thr={&(0x7f00003b6000), &(0x7f00001a2fa8)}}, &(0x7f000019cffc)) r0 = syz_open_procfs(0x0, &(0x7f0000337ff2)='timers\x00') preadv(r0, &(0x7f0000000040)=[{&(0x7f000036b000)=""/100, 0x64}], 0x1, 0x10000000) epoll_pwait(r0, &(0x7f0000000000)=[{}, {}, {}, {}, {}], 0x5, 0x3ff, &(0x7f0000000080)={0x1}, 0x8) 01:56:05 executing program 0: socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000001f80)={0xffffffffffffffff, 0xffffffffffffffff}) setsockopt$SO_ATTACH_FILTER(r2, 0x1, 0x1a, &(0x7f0000ab9ff0)={0x2, &(0x7f000039a000)=[{0x20, 0x0, 0x0, 0xfffffffffffff010}, {0x6}]}, 0x10) sendmmsg(r1, &(0x7f0000001e80)=[{{&(0x7f0000000700)=@l2={0x1f, 0x0, {}, 0xeffdffff00000000}, 0x80, &(0x7f0000001dc0)}}], 0x1, 0x0) 01:56:05 executing program 3: r0 = socket$inet(0x2, 0x3, 0x2) connect$inet(0xffffffffffffffff, &(0x7f0000000000)={0x2, 0x0, @local}, 0x10) setsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x23, &(0x7f0000000000)={{{@in=@multicast2, @in=@multicast1}}, {{@in6}, 0x0, @in6=@loopback}}, 0xe8) syz_emit_ethernet(0x2a, &(0x7f0000000640)={@random="b100485caa2a", @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0xfffffffffffff000}, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x1c, 0x0, 0x0, 0x0, 0x2, 0x0, @rand_addr, @broadcast}, @igmp={0x11, 0xffffffffffffffff, 0x0, @multicast1}}}}}, &(0x7f0000000140)) 01:56:05 executing program 2: r0 = socket$inet(0x2, 0x3, 0x2) connect$inet(0xffffffffffffffff, &(0x7f0000000000)={0x2, 0x0, @local}, 0x10) setsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x23, &(0x7f0000000000)={{{@in=@multicast2, @in=@multicast1}}, {{@in6}, 0x0, @in6=@loopback}}, 0xe8) syz_emit_ethernet(0x2a, &(0x7f0000000640)={@random="b100485caa2a", @link_local, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x1c, 0x0, 0x0, 0x0, 0x2, 0x0, @rand_addr, @broadcast}, @igmp={0x11, 0x0, 0x0, @multicast1}}}}}, &(0x7f0000000140)={0x0, 0x0, [0x600]}) 01:56:05 executing program 7: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000180)='/dev/sequencer\x00', 0x10002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000080)="0a5cc80700315f85715070") r1 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000001c0)={0x2, 0x0, &(0x7f0000000140)=ANY=[@ANYBLOB='\fc'], 0x0, 0x0, &(0x7f0000000080)}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, &(0x7f00000001c0)}) ioctl$BINDER_WRITE_READ(r1, 0x5451, &(0x7f0000000040)={0x8, 0x0, &(0x7f00000000c0)=[@release={0x400c630f}], 0x1, 0x0, &(0x7f0000000100)='V'}) fstat(r0, &(0x7f00000002c0)) 01:56:05 executing program 2: r0 = socket$inet(0x2, 0x3, 0x2) connect$inet(0xffffffffffffffff, &(0x7f0000000000)={0x2, 0x0, @local}, 0x10) setsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x23, &(0x7f0000000000)={{{@in=@multicast2, @in=@multicast1}}, {{@in6}, 0x0, @in6=@loopback}}, 0xe8) syz_emit_ethernet(0x2a, &(0x7f0000000640)={@random="b100485caa2a", @link_local, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x1c, 0x0, 0x0, 0x0, 0x2, 0x0, @rand_addr, @broadcast}, @igmp={0x11, 0x0, 0x0, @multicast1}}}}}, &(0x7f0000000140)={0x0, 0x0, [0x300]}) 01:56:05 executing program 4: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) ioctl$sock_SIOCETHTOOL(r0, 0x8946, &(0x7f0000000040)={'bond0\x00', &(0x7f0000000240)=ANY=[@ANYBLOB="04000000000023000000000000000002"]}) 01:56:05 executing program 3: r0 = socket$inet(0x2, 0x3, 0x2) connect$inet(0xffffffffffffffff, &(0x7f0000000000)={0x2, 0x0, @local}, 0x10) setsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x23, &(0x7f0000000000)={{{@in=@multicast2, @in=@multicast1}}, {{@in6}, 0x0, @in6=@loopback}}, 0xe8) syz_emit_ethernet(0x2a, &(0x7f0000000640)={@random="b100485caa2a", @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x4}, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x1c, 0x0, 0x0, 0x0, 0x2, 0x0, @rand_addr, @broadcast}, @igmp={0x11, 0xffffffffffffffff, 0x0, @multicast1}}}}}, &(0x7f0000000140)) 01:56:05 executing program 5: perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1f}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000340)={&(0x7f0000000000), 0xc, &(0x7f0000000300)={&(0x7f0000000240)=@newlink={0x50, 0x10, 0x721, 0x0, 0x0, {0x0, 0x1000000000000000}, [@IFLA_LINKINFO={0x28, 0x12, @veth={{0xc, 0x1, 'veth\x00'}, {0x18, 0x2, @VETH_INFO_PEER={0x14}}}}, @IFLA_NET_NS_FD={0x8}]}, 0x50}}, 0x0) 01:56:05 executing program 1: r0 = socket$inet_udp(0x2, 0x2, 0x0) r1 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r1, 0x8912, &(0x7f0000000080)="0a5cc8796c48d8a4d04fe5") connect$inet(r0, &(0x7f00000000c0)={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0x17}}, 0x10) sendto$inet(r0, &(0x7f0000762fff), 0xfdc7, 0x0, &(0x7f000057bff0)={0x2, 0x4e20, @multicast1}, 0x10) [ 651.397667] binder: 11757:11758 Acquire 1 refcount change on invalid ref 0 ret -22 01:56:05 executing program 4: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) ioctl$sock_SIOCETHTOOL(r0, 0x8946, &(0x7f0000000040)={'bond0\x00', &(0x7f0000000240)=ANY=[@ANYBLOB="32000000000023000000000000000002"]}) 01:56:05 executing program 0: socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000001f80)={0xffffffffffffffff, 0xffffffffffffffff}) setsockopt$SO_ATTACH_FILTER(r2, 0x1, 0x1a, &(0x7f0000ab9ff0)={0x2, &(0x7f000039a000)=[{0x20, 0x0, 0x0, 0xfffffffffffff010}, {0x6}]}, 0x10) sendmmsg(r1, &(0x7f0000001e80)=[{{&(0x7f0000000700)=@l2={0x1f, 0x0, {}, 0x40030000000000}, 0x80, &(0x7f0000001dc0)}}], 0x1, 0x0) 01:56:05 executing program 2: r0 = socket$inet(0x2, 0x3, 0x2) connect$inet(0xffffffffffffffff, &(0x7f0000000000)={0x2, 0x0, @local}, 0x10) setsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x23, &(0x7f0000000000)={{{@in=@multicast2, @in=@multicast1}}, {{@in6}, 0x0, @in6=@loopback}}, 0xe8) syz_emit_ethernet(0x2a, &(0x7f0000000640)={@random="b100485caa2a", @link_local, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x1c, 0x0, 0x0, 0x0, 0x2, 0x0, @rand_addr, @broadcast}, @igmp={0x11, 0x0, 0x0, @multicast1}}}}}, &(0x7f0000000140)={0x0, 0x0, [0x700]}) [ 651.585269] binder: 11757:11758 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 651.688843] binder: 11757:11789 Acquire 1 refcount change on invalid ref 0 ret -22 [ 651.697607] binder: 11757:11789 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 01:56:06 executing program 4: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) ioctl$sock_SIOCETHTOOL(r0, 0x8946, &(0x7f0000000040)={'bond0\x00', &(0x7f0000000240)=ANY=[@ANYBLOB="0c000000000023000000000000000002"]}) 01:56:06 executing program 5: perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1f}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000340)={&(0x7f0000000000), 0xc, &(0x7f0000000300)={&(0x7f0000000240)=@newlink={0x50, 0x10, 0x721, 0x0, 0x0, {0x0, 0xf0ffffff00000000}, [@IFLA_LINKINFO={0x28, 0x12, @veth={{0xc, 0x1, 'veth\x00'}, {0x18, 0x2, @VETH_INFO_PEER={0x14}}}}, @IFLA_NET_NS_FD={0x8}]}, 0x50}}, 0x0) 01:56:06 executing program 3: r0 = socket$inet(0x2, 0x3, 0x2) connect$inet(0xffffffffffffffff, &(0x7f0000000000)={0x2, 0x0, @local}, 0x10) setsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x23, &(0x7f0000000000)={{{@in=@multicast2, @in=@multicast1}}, {{@in6}, 0x0, @in6=@loopback}}, 0xe8) syz_emit_ethernet(0x2a, &(0x7f0000000640)={@random="b100485caa2a", @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x40030000000000}, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x1c, 0x0, 0x0, 0x0, 0x2, 0x0, @rand_addr, @broadcast}, @igmp={0x11, 0xffffffffffffffff, 0x0, @multicast1}}}}}, &(0x7f0000000140)) 01:56:06 executing program 6: r0 = syz_open_dev$sndseq(&(0x7f0000000100)='/dev/snd/seq\x00', 0x0, 0x0) read(r0, &(0x7f0000fb6000)=""/28, 0x3f0) ioctl$SNDRV_SEQ_IOCTL_REMOVE_EVENTS(r0, 0x4040534e, &(0x7f00000001c0)={0xbf}) ioctl$SNDRV_SEQ_IOCTL_QUERY_SUBS(r0, 0xc058534f, &(0x7f00000002c0)={{}, 0x1, 0x0, 0x0, {}, 0x0, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xbf00]}) r1 = gettid() timer_create(0x0, &(0x7f0000044000)={0x0, 0x12}, &(0x7f0000000040)) r2 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r2, 0x8912, &(0x7f00000001c0)="0a5cc80700315f85715070") timer_settime(0x0, 0x0, &(0x7f0000000080)={{0x0, 0x989680}, {0x0, 0x9}}, &(0x7f0000040000)) tkill(r1, 0x1000000000014) 01:56:06 executing program 1: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f00000002c0)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x2}, 0x8, &(0x7f0000000040)={&(0x7f0000000100)=@updpolicy={0xc4, 0x19, 0x701, 0x0, 0x0, {{@in6=@ipv4={[], [], @loopback}, @in=@rand_addr, 0x0, 0x0, 0x0, 0x0, 0xa}}, [@policy_type={0xc, 0x10, {0x1}}]}, 0xfffffffffffffe18}}, 0x0) 01:56:06 executing program 2: r0 = socket$inet(0x2, 0x3, 0x2) connect$inet(0xffffffffffffffff, &(0x7f0000000000)={0x2, 0x0, @local}, 0x10) setsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x23, &(0x7f0000000000)={{{@in=@multicast2, @in=@multicast1}}, {{@in6}, 0x0, @in6=@loopback}}, 0xe8) syz_emit_ethernet(0x2a, &(0x7f0000000640)={@random="b100485caa2a", @link_local, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x1c, 0x0, 0x0, 0x0, 0x2, 0x0, @rand_addr, @broadcast}, @igmp={0x11, 0x0, 0x0, @multicast1}}}}}, &(0x7f0000000140)={0x0, 0x0, [0x6000]}) 01:56:06 executing program 7: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000180)='/dev/sequencer\x00', 0x10002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000080)="0a5cc80700315f85715070") r1 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000001c0)={0x2, 0x0, &(0x7f0000000140)=ANY=[@ANYBLOB='\fc'], 0x0, 0x0, &(0x7f0000000080)}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, &(0x7f00000001c0)}) ioctl$BINDER_WRITE_READ(r1, 0x4020940d, &(0x7f0000000040)={0x8, 0x0, &(0x7f00000000c0)=[@release={0x400c630f}], 0x1, 0x0, &(0x7f0000000100)='V'}) fstat(r0, &(0x7f00000002c0)) 01:56:06 executing program 0: socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000001f80)={0xffffffffffffffff, 0xffffffffffffffff}) setsockopt$SO_ATTACH_FILTER(r2, 0x1, 0x1a, &(0x7f0000ab9ff0)={0x2, &(0x7f000039a000)=[{0x20, 0x0, 0x0, 0xfffffffffffff010}, {0x6}]}, 0x10) sendmmsg(r1, &(0x7f0000001e80)=[{{&(0x7f0000000700)=@l2={0x1f, 0x0, {}, 0xc0000000}, 0x80, &(0x7f0000001dc0)}}], 0x1, 0x0) 01:56:06 executing program 4: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) ioctl$sock_SIOCETHTOOL(r0, 0x8946, &(0x7f0000000040)={'bond0\x00', &(0x7f0000000240)=ANY=[@ANYBLOB="1a000000000023000000000000000002"]}) 01:56:06 executing program 2: r0 = socket$inet(0x2, 0x3, 0x2) connect$inet(0xffffffffffffffff, &(0x7f0000000000)={0x2, 0x0, @local}, 0x10) setsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x23, &(0x7f0000000000)={{{@in=@multicast2, @in=@multicast1}}, {{@in6}, 0x0, @in6=@loopback}}, 0xe8) syz_emit_ethernet(0x2a, &(0x7f0000000640)={@random="b100485caa2a", @link_local, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x1c, 0x0, 0x0, 0x0, 0x2, 0x0, @rand_addr, @broadcast}, @igmp={0x11, 0x0, 0x0, @multicast1}}}}}, &(0x7f0000000140)={0x0, 0x0, [0x3e]}) 01:56:06 executing program 1: r0 = socket$inet(0x10, 0x3, 0xc) setsockopt$inet_sctp_SCTP_DISABLE_FRAGMENTS(r0, 0x84, 0x8, &(0x7f0000000040)=0xc9, 0x4) setsockopt$inet_sctp6_SCTP_DISABLE_FRAGMENTS(0xffffffffffffffff, 0x84, 0x8, &(0x7f0000000000)=0xffffffff, 0x4) sendmsg(r0, &(0x7f0000011fc8)={0x0, 0x0, &(0x7f0000009ff0)=[{&(0x7f0000002000)="24000000100007031dfffd946fa2830020200a0009000300001d85680c1ba3a20400ff7e280000001000ffffba16a0aa1c0009b356da5a80d18bec4c8546c8243929db2406b20cd37ed01cc0", 0x4c}], 0x1}, 0x0) r1 = gettid() fcntl$setown(r0, 0x8, r1) ioctl$FICLONERANGE(r0, 0x4020940d, &(0x7f0000000080)={r0, 0x0, 0x81, 0x7ff, 0x7fff}) 01:56:06 executing program 3: r0 = socket$inet(0x2, 0x3, 0x2) connect$inet(0xffffffffffffffff, &(0x7f0000000000)={0x2, 0x0, @local}, 0x10) setsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x23, &(0x7f0000000000)={{{@in=@multicast2, @in=@multicast1}}, {{@in6}, 0x0, @in6=@loopback}}, 0xe8) syz_emit_ethernet(0x2a, &(0x7f0000000640)={@random="b100485caa2a", @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x800000000000000}, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x1c, 0x0, 0x0, 0x0, 0x2, 0x0, @rand_addr, @broadcast}, @igmp={0x11, 0xffffffffffffffff, 0x0, @multicast1}}}}}, &(0x7f0000000140)) 01:56:06 executing program 5: perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1f}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000340)={&(0x7f0000000000), 0xc, &(0x7f0000000300)={&(0x7f0000000240)=@newlink={0x50, 0x10, 0x721, 0x0, 0x0, {0x0, 0xf000000}, [@IFLA_LINKINFO={0x28, 0x12, @veth={{0xc, 0x1, 'veth\x00'}, {0x18, 0x2, @VETH_INFO_PEER={0x14}}}}, @IFLA_NET_NS_FD={0x8}]}, 0x50}}, 0x0) [ 652.311043] binder: 11820:11821 Acquire 1 refcount change on invalid ref 0 ret -22 01:56:06 executing program 4: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) ioctl$sock_SIOCETHTOOL(r0, 0x8946, &(0x7f0000000040)={'bond0\x00', &(0x7f0000000240)=ANY=[@ANYBLOB="4cfffffdfd0023000000000000000002"]}) 01:56:06 executing program 2: r0 = socket$inet(0x2, 0x3, 0x2) connect$inet(0xffffffffffffffff, &(0x7f0000000000)={0x2, 0x0, @local}, 0x10) setsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x23, &(0x7f0000000000)={{{@in=@multicast2, @in=@multicast1}}, {{@in6}, 0x0, @in6=@loopback}}, 0xe8) syz_emit_ethernet(0x2a, &(0x7f0000000640)={@random="b100485caa2a", @link_local, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x1c, 0x0, 0x0, 0x0, 0x2, 0x0, @rand_addr, @broadcast}, @igmp={0x11, 0x0, 0x0, @multicast1}}}}}, &(0x7f0000000140)={0x0, 0x0, [0x6000000000000000]}) [ 652.424680] binder: 11820:11821 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 01:56:06 executing program 0: socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000001f80)={0xffffffffffffffff, 0xffffffffffffffff}) setsockopt$SO_ATTACH_FILTER(r2, 0x1, 0x1a, &(0x7f0000ab9ff0)={0x2, &(0x7f000039a000)=[{0x20, 0x0, 0x0, 0xfffffffffffff010}, {0x6}]}, 0x10) sendmmsg(r1, &(0x7f0000001e80)=[{{&(0x7f0000000700)=@l2={0x1f, 0x0, {}, 0x3ec0}, 0x80, &(0x7f0000001dc0)}}], 0x1, 0x0) 01:56:06 executing program 5: perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1f}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000340)={&(0x7f0000000000), 0xc, &(0x7f0000000300)={&(0x7f0000000240)=@newlink={0x50, 0x10, 0x721, 0x0, 0x0, {0x0, 0xf0ffffff}, [@IFLA_LINKINFO={0x28, 0x12, @veth={{0xc, 0x1, 'veth\x00'}, {0x18, 0x2, @VETH_INFO_PEER={0x14}}}}, @IFLA_NET_NS_FD={0x8}]}, 0x50}}, 0x0) 01:56:06 executing program 3: r0 = socket$inet(0x2, 0x3, 0x2) connect$inet(0xffffffffffffffff, &(0x7f0000000000)={0x2, 0x0, @local}, 0x10) setsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x23, &(0x7f0000000000)={{{@in=@multicast2, @in=@multicast1}}, {{@in6}, 0x0, @in6=@loopback}}, 0xe8) syz_emit_ethernet(0x2a, &(0x7f0000000640)={@random="b100485caa2a", @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0xffffffff00000000}, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x1c, 0x0, 0x0, 0x0, 0x2, 0x0, @rand_addr, @broadcast}, @igmp={0x11, 0xffffffffffffffff, 0x0, @multicast1}}}}}, &(0x7f0000000140)) [ 652.471456] binder: 11820:11853 Acquire 1 refcount change on invalid ref 0 ret -22 01:56:06 executing program 1: r0 = openat$ppp(0xffffffffffffff9c, &(0x7f0000002ff7)='/dev/ppp\x00', 0x0, 0x0) ioctl(0xffffffffffffffff, 0x0, &(0x7f0000000240)="c626262c0723bf011a") ioctl$TIOCMBIC(r0, 0x5417, &(0x7f0000000000)=0x3a02) ioctl$EVIOCGPROP(r0, 0xc004743e, &(0x7f0000001000)=""/246) ioctl$EVIOCGREP(r0, 0x4010744d, &(0x7f0000000240)=""/174) [ 652.625913] binder: 11820:11853 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 01:56:07 executing program 6: r0 = syz_open_dev$sndseq(&(0x7f0000000100)='/dev/snd/seq\x00', 0x0, 0x0) read(r0, &(0x7f0000fb6000)=""/28, 0x3f0) ioctl$SNDRV_SEQ_IOCTL_REMOVE_EVENTS(r0, 0x4040534e, &(0x7f00000001c0)={0xbf}) ioctl$SNDRV_SEQ_IOCTL_QUERY_SUBS(r0, 0xc058534f, &(0x7f00000002c0)={{}, 0x1, 0x0, 0x0, {}, 0x0, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xe]}) r1 = gettid() timer_create(0x0, &(0x7f0000044000)={0x0, 0x12}, &(0x7f0000000040)) r2 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r2, 0x8912, &(0x7f00000001c0)="0a5cc80700315f85715070") timer_settime(0x0, 0x0, &(0x7f0000000080)={{0x0, 0x989680}, {0x0, 0x9}}, &(0x7f0000040000)) tkill(r1, 0x1000000000014) 01:56:07 executing program 4: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) ioctl$sock_SIOCETHTOOL(r0, 0x8946, &(0x7f0000000040)={'bond0\x00', &(0x7f0000000240)=ANY=[@ANYBLOB="4cfdfdffff0023000000000000000002"]}) 01:56:07 executing program 2: r0 = socket$inet(0x2, 0x3, 0x2) connect$inet(0xffffffffffffffff, &(0x7f0000000000)={0x2, 0x0, @local}, 0x10) setsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x23, &(0x7f0000000000)={{{@in=@multicast2, @in=@multicast1}}, {{@in6}, 0x0, @in6=@loopback}}, 0xe8) syz_emit_ethernet(0x2a, &(0x7f0000000640)={@random="b100485caa2a", @link_local, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x1c, 0x0, 0x0, 0x0, 0x2, 0x0, @rand_addr, @broadcast}, @igmp={0x11, 0x0, 0x0, @multicast1}}}}}, &(0x7f0000000140)={0x0, 0x0, [0x300000000000000]}) 01:56:07 executing program 5: perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1f}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000340)={&(0x7f0000000000), 0xc, &(0x7f0000000300)={&(0x7f0000000240)=@newlink={0x50, 0x10, 0x721, 0x0, 0x0, {0x0, 0x9}, [@IFLA_LINKINFO={0x28, 0x12, @veth={{0xc, 0x1, 'veth\x00'}, {0x18, 0x2, @VETH_INFO_PEER={0x14}}}}, @IFLA_NET_NS_FD={0x8}]}, 0x50}}, 0x0) 01:56:07 executing program 3: r0 = socket$inet(0x2, 0x3, 0x2) connect$inet(0xffffffffffffffff, &(0x7f0000000000)={0x2, 0x0, @local}, 0x10) setsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x23, &(0x7f0000000000)={{{@in=@multicast2, @in=@multicast1}}, {{@in6}, 0x0, @in6=@loopback}}, 0xe8) syz_emit_ethernet(0x2a, &(0x7f0000000640)={@random="b100485caa2a", @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0xfffff000}, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x1c, 0x0, 0x0, 0x0, 0x2, 0x0, @rand_addr, @broadcast}, @igmp={0x11, 0xffffffffffffffff, 0x0, @multicast1}}}}}, &(0x7f0000000140)) 01:56:07 executing program 1: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000040)="0a5cc80700315f85715070") mmap(&(0x7f0000011000/0x3000)=nil, 0x3000, 0x4, 0x32, 0xffffffffffffffff, 0x0) r1 = dup3(r0, r0, 0x80000) ioctl$SNDRV_SEQ_IOCTL_QUERY_NEXT_PORT(r1, 0xc0a85352, &(0x7f0000000100)={{0x0, 0x2}, 'port0\x00', 0x4, 0x40000, 0xec06, 0x3ff, 0x6, 0x9, 0x1, 0x0, 0x0, 0x3}) r2 = userfaultfd(0x0) ioctl$UFFDIO_API(r2, 0xc018aa3f, &(0x7f0000000780)) ioctl$UFFDIO_REGISTER(r2, 0xc020aa00, &(0x7f0000000040)={{&(0x7f0000011000/0x3000)=nil, 0x3000}, 0x1}) r3 = socket$inet6_sctp(0xa, 0x5, 0x84) setsockopt$inet_sctp6_SCTP_DISABLE_FRAGMENTS(r3, 0x84, 0x8, &(0x7f0000013e95), 0x4) setsockopt$inet6_MCAST_MSFILTER(r3, 0x29, 0x30, &(0x7f00000002c0), 0x90) close(r3) r4 = memfd_create(&(0x7f00000000c0)='#em1#+\x00', 0x0) openat$cuse(0xffffffffffffff9c, &(0x7f0000000000)='/dev/cuse\x00', 0x10201, 0x0) mmap(&(0x7f0000000000/0x7000)=nil, 0x7000, 0x0, 0x11, r4, 0x0) close(r2) 01:56:07 executing program 0: socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000001f80)={0xffffffffffffffff, 0xffffffffffffffff}) setsockopt$SO_ATTACH_FILTER(r2, 0x1, 0x1a, &(0x7f0000ab9ff0)={0x2, &(0x7f000039a000)=[{0x20, 0x0, 0x0, 0xfffffffffffff010}, {0x6}]}, 0x10) sendmmsg(r1, &(0x7f0000001e80)=[{{&(0x7f0000000700)=@l2={0x1f, 0x0, {}, 0x34000}, 0x80, &(0x7f0000001dc0)}}], 0x1, 0x0) 01:56:07 executing program 7: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000180)='/dev/sequencer\x00', 0x10002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000080)="0a5cc80700315f85715070") r1 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000001c0)={0x2, 0x0, &(0x7f0000000140)=ANY=[@ANYBLOB='\fc'], 0x0, 0x0, &(0x7f0000000080)}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, &(0x7f00000001c0)}) ioctl$BINDER_WRITE_READ(r1, 0xc0046209, &(0x7f0000000040)={0x8, 0x0, &(0x7f00000000c0)=[@release={0x400c630f}], 0x1, 0x0, &(0x7f0000000100)='V'}) fstat(r0, &(0x7f00000002c0)) 01:56:07 executing program 4: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) ioctl$sock_SIOCETHTOOL(r0, 0x8946, &(0x7f0000000040)={'bond0\x00', &(0x7f0000000240)=ANY=[@ANYBLOB="4c00fdfdffff23000000000000000002"]}) 01:56:07 executing program 5: perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1f}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000340)={&(0x7f0000000000), 0xc, &(0x7f0000000300)={&(0x7f0000000240)=@newlink={0x50, 0x10, 0x721, 0x0, 0x0, {0x0, 0x100000000000000}, [@IFLA_LINKINFO={0x28, 0x12, @veth={{0xc, 0x1, 'veth\x00'}, {0x18, 0x2, @VETH_INFO_PEER={0x14}}}}, @IFLA_NET_NS_FD={0x8}]}, 0x50}}, 0x0) 01:56:07 executing program 2: r0 = socket$inet(0x2, 0x3, 0x2) connect$inet(0xffffffffffffffff, &(0x7f0000000000)={0x2, 0x0, @local}, 0x10) setsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x23, &(0x7f0000000000)={{{@in=@multicast2, @in=@multicast1}}, {{@in6}, 0x0, @in6=@loopback}}, 0xe8) syz_emit_ethernet(0x2a, &(0x7f0000000640)={@random="b100485caa2a", @link_local, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x1c, 0x0, 0x0, 0x0, 0x2, 0x0, @rand_addr, @broadcast}, @igmp={0x11, 0x0, 0x0, @multicast1}}}}}, &(0x7f0000000140)={0x0, 0x0, [0x700000000000000]}) 01:56:07 executing program 3: r0 = socket$inet(0x2, 0x3, 0x2) connect$inet(0xffffffffffffffff, &(0x7f0000000000)={0x2, 0x0, @local}, 0x10) setsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x23, &(0x7f0000000000)={{{@in=@multicast2, @in=@multicast1}}, {{@in6}, 0x0, @in6=@loopback}}, 0xe8) syz_emit_ethernet(0x2a, &(0x7f0000000640)={@random="b100485caa2a", @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0xf0ffff}, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x1c, 0x0, 0x0, 0x0, 0x2, 0x0, @rand_addr, @broadcast}, @igmp={0x11, 0xffffffffffffffff, 0x0, @multicast1}}}}}, &(0x7f0000000140)) [ 653.232257] binder: 11896:11899 Acquire 1 refcount change on invalid ref 0 ret -22 01:56:07 executing program 4: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) ioctl$sock_SIOCETHTOOL(r0, 0x8946, &(0x7f0000000040)={'bond0\x00', &(0x7f0000000240)=ANY=[@ANYBLOB="4c00fffffdfd23000000000000000002"]}) 01:56:07 executing program 5: perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1f}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000340)={&(0x7f0000000000), 0xc, &(0x7f0000000300)={&(0x7f0000000240)=@newlink={0x50, 0x10, 0x721, 0x0, 0x0, {0x0, 0xb000000}, [@IFLA_LINKINFO={0x28, 0x12, @veth={{0xc, 0x1, 'veth\x00'}, {0x18, 0x2, @VETH_INFO_PEER={0x14}}}}, @IFLA_NET_NS_FD={0x8}]}, 0x50}}, 0x0) 01:56:07 executing program 1: r0 = socket$inet(0x10, 0x3, 0x0) sendmsg(r0, &(0x7f0000004fc8)={0x0, 0x0, &(0x7f0000003000)=[{&(0x7f0000005fdb)="240000001800030307fffd946fa200001c140000feffffff031d8568791ba3a2d188527e", 0x24}], 0x1}, 0x0) r1 = syz_open_dev$mice(&(0x7f0000000000)='/dev/input/mice\x00', 0x0, 0x200000) ioctl$KVM_SET_PIT(r1, 0x8048ae66, &(0x7f0000000040)={[{0x7fff, 0x6, 0x200000000000, 0x1, 0x8, 0x7, 0x10001, 0x7ff, 0x1, 0x9, 0x8, 0x5, 0x40}, {0x7, 0xfffffffffffffffc, 0xe88, 0x400, 0x9403, 0x101, 0xa6, 0x7, 0x80000001, 0xfee, 0x100000000, 0x96, 0xfffffffffffffffc}, {0x8000, 0x7, 0x632, 0x100000000, 0x7, 0xffff, 0x2, 0x4b, 0x4, 0x7, 0x0, 0x80000000, 0x6}], 0xb36}) 01:56:07 executing program 0: socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000001f80)={0xffffffffffffffff, 0xffffffffffffffff}) setsockopt$SO_ATTACH_FILTER(r2, 0x1, 0x1a, &(0x7f0000ab9ff0)={0x2, &(0x7f000039a000)=[{0x20, 0x0, 0x0, 0xfffffffffffff010}, {0x6}]}, 0x10) sendmmsg(r1, &(0x7f0000001e80)=[{{&(0x7f0000000700)=@l2={0x1f, 0x0, {}, 0xc03e000000000000}, 0x80, &(0x7f0000001dc0)}}], 0x1, 0x0) [ 653.327257] binder: 11896:11899 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 653.414698] netlink: 8 bytes leftover after parsing attributes in process `syz-executor1'. [ 653.460837] binder: 11896:11937 Acquire 1 refcount change on invalid ref 0 ret -22 [ 653.486079] netlink: 8 bytes leftover after parsing attributes in process `syz-executor1'. [ 653.520250] binder: 11896:11937 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 01:56:07 executing program 6: r0 = syz_open_dev$sndseq(&(0x7f0000000100)='/dev/snd/seq\x00', 0x0, 0x0) read(r0, &(0x7f0000fb6000)=""/28, 0x3f0) ioctl$SNDRV_SEQ_IOCTL_REMOVE_EVENTS(r0, 0x4040534e, &(0x7f00000001c0)={0xbf}) ioctl$SNDRV_SEQ_IOCTL_QUERY_SUBS(r0, 0xc058534f, &(0x7f00000002c0)={{}, 0x1, 0x0, 0x0, {}, 0x0, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xbf000000]}) r1 = gettid() timer_create(0x0, &(0x7f0000044000)={0x0, 0x12}, &(0x7f0000000040)) r2 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r2, 0x8912, &(0x7f00000001c0)="0a5cc80700315f85715070") timer_settime(0x0, 0x0, &(0x7f0000000080)={{0x0, 0x989680}, {0x0, 0x9}}, &(0x7f0000040000)) tkill(r1, 0x1000000000014) 01:56:07 executing program 3: r0 = socket$inet(0x2, 0x3, 0x2) connect$inet(0xffffffffffffffff, &(0x7f0000000000)={0x2, 0x0, @local}, 0x10) setsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x23, &(0x7f0000000000)={{{@in=@multicast2, @in=@multicast1}}, {{@in6}, 0x0, @in6=@loopback}}, 0xe8) syz_emit_ethernet(0x2a, &(0x7f0000000640)={@random="b100485caa2a", @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0xf000}, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x1c, 0x0, 0x0, 0x0, 0x2, 0x0, @rand_addr, @broadcast}, @igmp={0x11, 0xffffffffffffffff, 0x0, @multicast1}}}}}, &(0x7f0000000140)) 01:56:07 executing program 2: r0 = socket$inet(0x2, 0x3, 0x2) connect$inet(0xffffffffffffffff, &(0x7f0000000000)={0x2, 0x0, @local}, 0x10) setsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x23, &(0x7f0000000000)={{{@in=@multicast2, @in=@multicast1}}, {{@in6}, 0x0, @in6=@loopback}}, 0xe8) syz_emit_ethernet(0x2a, &(0x7f0000000640)={@random="b100485caa2a", @link_local, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x1c, 0x0, 0x0, 0x0, 0x2, 0x0, @rand_addr, @broadcast}, @igmp={0x11, 0x0, 0x0, @multicast1}}}}}, &(0x7f0000000140)={0x0, 0x0, [0x8000000]}) 01:56:07 executing program 4: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) ioctl$sock_SIOCETHTOOL(r0, 0x8946, &(0x7f0000000040)={'bond0\x00', &(0x7f0000000240)=ANY=[@ANYBLOB="4c000000000023fdfdffff0000000002"]}) 01:56:07 executing program 5: perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1f}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000340)={&(0x7f0000000000), 0xc, &(0x7f0000000300)={&(0x7f0000000240)=@newlink={0x50, 0x10, 0x721, 0x0, 0x0, {0x0, 0xb40a0000}, [@IFLA_LINKINFO={0x28, 0x12, @veth={{0xc, 0x1, 'veth\x00'}, {0x18, 0x2, @VETH_INFO_PEER={0x14}}}}, @IFLA_NET_NS_FD={0x8}]}, 0x50}}, 0x0) 01:56:07 executing program 0: socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000001f80)={0xffffffffffffffff, 0xffffffffffffffff}) setsockopt$SO_ATTACH_FILTER(r2, 0x1, 0x1a, &(0x7f0000ab9ff0)={0x2, &(0x7f000039a000)=[{0x20, 0x0, 0x0, 0xfffffffffffff010}, {0x6}]}, 0x10) sendmmsg(r1, &(0x7f0000001e80)=[{{&(0x7f0000000700)=@l2={0x1f, 0x0, {}, 0xffffff7f00000000}, 0x80, &(0x7f0000001dc0)}}], 0x1, 0x0) 01:56:07 executing program 1: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r1, 0x8912, &(0x7f0000000000)="8a5c010700315f85715070") close(r0) socket$vsock_dgram(0x28, 0x2, 0x0) io_setup(0x8, &(0x7f0000000100)=0x0) io_getevents(r2, 0x0, 0x0, &(0x7f0000000240), &(0x7f0000000000)={0x77359400}) io_submit(r2, 0x1400, &(0x7f0000000600)=[&(0x7f0000000180)={0x0, 0x0, 0x0, 0x800000000001, 0x0, r0, &(0x7f0000000140)}]) getsockopt$IP6T_SO_GET_INFO(r1, 0x29, 0x40, &(0x7f0000000040)={'raw\x00'}, &(0x7f00000000c0)=0x54) 01:56:07 executing program 7: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000180)='/dev/sequencer\x00', 0x10002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000080)="0a5cc80700315f85715070") r1 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000001c0)={0x2, 0x0, &(0x7f0000000140)=ANY=[@ANYBLOB='\fc'], 0x0, 0x0, &(0x7f0000000080)}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, &(0x7f00000001c0)}) ioctl$BINDER_WRITE_READ(r1, 0x2, &(0x7f0000000040)={0x8, 0x0, &(0x7f00000000c0)=[@release={0x400c630f}], 0x1, 0x0, &(0x7f0000000100)='V'}) fstat(r0, &(0x7f00000002c0)) 01:56:08 executing program 4: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) ioctl$sock_SIOCETHTOOL(r0, 0x8946, &(0x7f0000000040)={'bond0\x00', &(0x7f0000000240)=ANY=[@ANYBLOB="4c00000000002300000000fffffdfd02"]}) 01:56:08 executing program 1: mmap(&(0x7f0000000000/0x1000)=nil, 0x1000, 0x0, 0x32, 0xffffffffffffffff, 0x0) r0 = socket(0x2, 0x2, 0x0) r1 = epoll_create1(0x0) ioctl$sock_SIOCGPGRP(r0, 0x8904, &(0x7f0000000000)=0x0) fcntl$lock(r0, 0x6, &(0x7f0000000040)={0x0, 0x3, 0xfc2, 0x8, r2}) epoll_ctl$EPOLL_CTL_ADD(r1, 0x1, r0, &(0x7f000000eff4)) connect$pppoe(r0, &(0x7f0000000080)={0x18, 0x0, {0x0, @broadcast, 'bridge_slave_0\x00'}}, 0x1e) epoll_wait(r1, &(0x7f000000affb)=[{}], 0x1, 0xfffffffffffffef7) shutdown(r0, 0x1) shutdown(r0, 0x0) 01:56:08 executing program 5: perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1f}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000340)={&(0x7f0000000000), 0xc, &(0x7f0000000300)={&(0x7f0000000240)=@newlink={0x50, 0x10, 0x721, 0x0, 0x0, {0x0, 0x34000}, [@IFLA_LINKINFO={0x28, 0x12, @veth={{0xc, 0x1, 'veth\x00'}, {0x18, 0x2, @VETH_INFO_PEER={0x14}}}}, @IFLA_NET_NS_FD={0x8}]}, 0x50}}, 0x0) 01:56:08 executing program 2: r0 = socket$inet(0x2, 0x3, 0x2) connect$inet(0xffffffffffffffff, &(0x7f0000000000)={0x2, 0x0, @local}, 0x10) setsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x23, &(0x7f0000000000)={{{@in=@multicast2, @in=@multicast1}}, {{@in6}, 0x0, @in6=@loopback}}, 0xe8) syz_emit_ethernet(0x2a, &(0x7f0000000640)={@random="b100485caa2a", @link_local, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x1c, 0x0, 0x0, 0x0, 0x2, 0x0, @rand_addr, @broadcast}, @igmp={0x11, 0x0, 0x0, @multicast1}}}}}, &(0x7f0000000140)={0x0, 0x0, [0x1c00]}) 01:56:08 executing program 3: r0 = socket$inet(0x2, 0x3, 0x2) connect$inet(0xffffffffffffffff, &(0x7f0000000000)={0x2, 0x0, @local}, 0x10) setsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x23, &(0x7f0000000000)={{{@in=@multicast2, @in=@multicast1}}, {{@in6}, 0x0, @in6=@loopback}}, 0xe8) syz_emit_ethernet(0x2a, &(0x7f0000000640)={@random="b100485caa2a", @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0xe0}, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x1c, 0x0, 0x0, 0x0, 0x2, 0x0, @rand_addr, @broadcast}, @igmp={0x11, 0xffffffffffffffff, 0x0, @multicast1}}}}}, &(0x7f0000000140)) [ 654.127443] binder: 11961:11963 Acquire 1 refcount change on invalid ref 0 ret -22 01:56:08 executing program 4: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) ioctl$sock_SIOCETHTOOL(r0, 0x8946, &(0x7f0000000040)={'bond0\x00', &(0x7f0000000240)=ANY=[@ANYBLOB="4c000000000023fffffdfd0000000002"]}) 01:56:08 executing program 5: perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1f}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000340)={&(0x7f0000000000), 0xc, &(0x7f0000000300)={&(0x7f0000000240)=@newlink={0x50, 0x10, 0x721, 0x0, 0x0, {0x0, 0x7}, [@IFLA_LINKINFO={0x28, 0x12, @veth={{0xc, 0x1, 'veth\x00'}, {0x18, 0x2, @VETH_INFO_PEER={0x14}}}}, @IFLA_NET_NS_FD={0x8}]}, 0x50}}, 0x0) 01:56:08 executing program 1: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) syz_kvm_setup_cpu$x86(r1, 0xffffffffffffffff, &(0x7f0000005000/0x18000)=nil, &(0x7f0000000100)=[@text64={0x40, &(0x7f0000000080)="b9c70b0000b802000000ba000000000f300f21bcc42175d08cf6d66a0000c4624d93443a00b9980100000f3265f2410f0866470fe07d001d0000000043d9fe66baf80cb85cc87b8fef66bafc0ced", 0x4e}], 0x1, 0x0, &(0x7f00000002c0), 0x0) ioctl$KVM_CREATE_IRQCHIP(r1, 0xae60) ioctl$FICLONE(r1, 0x40049409, r0) ioctl$KVM_IRQ_LINE_STATUS(r1, 0xc008ae67, &(0x7f0000000280)={0xc, 0x6ce}) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000008f00)={'nr0\x00'}) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) r3 = openat$userio(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/userio\x00', 0x2000, 0x0) getsockopt$inet_sctp_SCTP_SOCKOPT_PEELOFF(r1, 0x84, 0x66, &(0x7f0000000200)={0x0, 0x20}, &(0x7f0000000240)=0x8) setsockopt$inet_sctp6_SCTP_PEER_ADDR_PARAMS(r3, 0x84, 0x9, &(0x7f00000002c0)={r4, @in={{0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0x1d}}}, 0x10000, 0x400, 0x3f, 0x0, 0x4a}, 0x98) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r2, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000000)=[@textreal={0x8, &(0x7f0000000140)="65d9f3ba2000b0e1eed9ff66b8c4b800000f23c00f21f86635000005000f23f80f01d1baf80c66b8a322e48266efbafc0cb09dee6726670f32670fb2aec1cb0000ff22c02200", 0x46}], 0x0, 0x0, &(0x7f00000000c0), 0x33e) ioctl$KVM_RUN(r2, 0xae80, 0x0) [ 654.291029] binder: 11961:11963 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 654.443933] binder: 11961:11991 Acquire 1 refcount change on invalid ref 0 ret -22 [ 654.461592] pic_ioport_write: 1 callbacks suppressed [ 654.461598] kvm: pic: level sensitive irq not supported [ 654.465365] binder: 11961:11991 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 654.469092] kvm: pic: level sensitive irq not supported [ 654.481980] kvm: pic: level sensitive irq not supported [ 654.489658] kvm: pic: level sensitive irq not supported [ 654.497349] kvm: pic: level sensitive irq not supported [ 654.505595] kvm: pic: level sensitive irq not supported [ 654.513503] kvm: pic: level sensitive irq not supported [ 654.520480] kvm: pic: level sensitive irq not supported [ 654.527503] kvm: pic: level sensitive irq not supported [ 654.595215] kvm: pic: level sensitive irq not supported [ 654.601941] kvm: pic: single mode not supported 01:56:08 executing program 6: r0 = syz_open_dev$sndseq(&(0x7f0000000100)='/dev/snd/seq\x00', 0x0, 0x0) read(r0, &(0x7f0000fb6000)=""/28, 0x3f0) ioctl$SNDRV_SEQ_IOCTL_REMOVE_EVENTS(r0, 0x4040534e, &(0x7f00000001c0)={0xbf}) ioctl$SNDRV_SEQ_IOCTL_QUERY_SUBS(r0, 0xc058534f, &(0x7f00000002c0)={{}, 0x1, 0x0, 0x0, {}, 0x0, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xe00]}) r1 = gettid() timer_create(0x0, &(0x7f0000044000)={0x0, 0x12}, &(0x7f0000000040)) r2 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r2, 0x8912, &(0x7f00000001c0)="0a5cc80700315f85715070") timer_settime(0x0, 0x0, &(0x7f0000000080)={{0x0, 0x989680}, {0x0, 0x9}}, &(0x7f0000040000)) tkill(r1, 0x1000000000014) 01:56:08 executing program 0: socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000001f80)={0xffffffffffffffff, 0xffffffffffffffff}) setsockopt$SO_ATTACH_FILTER(r2, 0x1, 0x1a, &(0x7f0000ab9ff0)={0x2, &(0x7f000039a000)=[{0x20, 0x0, 0x0, 0xfffffffffffff010}, {0x6}]}, 0x10) sendmmsg(r1, &(0x7f0000001e80)=[{{&(0x7f0000000700)=@l2={0x1f, 0x0, {}, 0x1100000000000000}, 0x80, &(0x7f0000001dc0)}}], 0x1, 0x0) 01:56:08 executing program 3: r0 = socket$inet(0x2, 0x3, 0x2) connect$inet(0xffffffffffffffff, &(0x7f0000000000)={0x2, 0x0, @local}, 0x10) setsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x23, &(0x7f0000000000)={{{@in=@multicast2, @in=@multicast1}}, {{@in6}, 0x0, @in6=@loopback}}, 0xe8) syz_emit_ethernet(0x2a, &(0x7f0000000640)={@random="b100485caa2a", @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x600}, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x1c, 0x0, 0x0, 0x0, 0x2, 0x0, @rand_addr, @broadcast}, @igmp={0x11, 0xffffffffffffffff, 0x0, @multicast1}}}}}, &(0x7f0000000140)) 01:56:08 executing program 2: r0 = socket$inet(0x2, 0x3, 0x2) connect$inet(0xffffffffffffffff, &(0x7f0000000000)={0x2, 0x0, @local}, 0x10) setsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x23, &(0x7f0000000000)={{{@in=@multicast2, @in=@multicast1}}, {{@in6}, 0x0, @in6=@loopback}}, 0xe8) syz_emit_ethernet(0x2a, &(0x7f0000000640)={@random="b100485caa2a", @link_local, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x1c, 0x0, 0x0, 0x0, 0x2, 0x0, @rand_addr, @broadcast}, @igmp={0x11, 0x0, 0x0, @multicast1}}}}}, &(0x7f0000000140)={0x0, 0x0, [0x1c]}) 01:56:08 executing program 4: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) ioctl$sock_SIOCETHTOOL(r0, 0x8946, &(0x7f0000000040)={'bond0\x00', &(0x7f0000000240)=ANY=[@ANYBLOB="4c000000000023000000000000000001"]}) 01:56:08 executing program 7: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000180)='/dev/sequencer\x00', 0x10002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000080)="0a5cc80700315f85715070") r1 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000001c0)={0x2, 0x0, &(0x7f0000000140)=ANY=[@ANYBLOB='\fc'], 0x0, 0x0, &(0x7f0000000080)}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, &(0x7f00000001c0)}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000040)={0x4d, 0x0, &(0x7f00000000c0)=[@release={0x400c630f}], 0x1, 0x0, &(0x7f0000000100)='V'}) fstat(r0, &(0x7f00000002c0)) 01:56:08 executing program 5: perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1f}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000340)={&(0x7f0000000000), 0xc, &(0x7f0000000300)={&(0x7f0000000240)=@newlink={0x50, 0x10, 0x721, 0x0, 0x0, {0x0, 0xb00000000000000}, [@IFLA_LINKINFO={0x28, 0x12, @veth={{0xc, 0x1, 'veth\x00'}, {0x18, 0x2, @VETH_INFO_PEER={0x14}}}}, @IFLA_NET_NS_FD={0x8}]}, 0x50}}, 0x0) 01:56:08 executing program 1: creat(&(0x7f0000000080)='./file0\x00', 0x3) r0 = socket$inet_sctp(0x2, 0x0, 0x84) getsockopt$inet_sctp_SCTP_RECONFIG_SUPPORTED(r0, 0x84, 0x75, &(0x7f0000000000), &(0x7f0000000040)=0x8) 01:56:08 executing program 5: perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1f}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000340)={&(0x7f0000000000), 0xc, &(0x7f0000000300)={&(0x7f0000000240)=@newlink={0x50, 0x10, 0x721, 0x0, 0x0, {0x0, 0x900000000000000}, [@IFLA_LINKINFO={0x28, 0x12, @veth={{0xc, 0x1, 'veth\x00'}, {0x18, 0x2, @VETH_INFO_PEER={0x14}}}}, @IFLA_NET_NS_FD={0x8}]}, 0x50}}, 0x0) 01:56:08 executing program 4: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) ioctl$sock_SIOCETHTOOL(r0, 0x8946, &(0x7f0000000040)={'bond0\x00', &(0x7f0000000240)=ANY=[@ANYBLOB="4c00000000002300fdfdffff00000002"]}) 01:56:08 executing program 2: r0 = socket$inet(0x2, 0x3, 0x2) connect$inet(0xffffffffffffffff, &(0x7f0000000000)={0x2, 0x0, @local}, 0x10) setsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x23, &(0x7f0000000000)={{{@in=@multicast2, @in=@multicast1}}, {{@in6}, 0x0, @in6=@loopback}}, 0xe8) syz_emit_ethernet(0x2a, &(0x7f0000000640)={@random="b100485caa2a", @link_local, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x1c, 0x0, 0x0, 0x0, 0x2, 0x0, @rand_addr, @broadcast}, @igmp={0x11, 0x0, 0x0, @multicast1}}}}}, &(0x7f0000000140)={0x0, 0x0, [0x4000000000000000]}) 01:56:08 executing program 3: r0 = socket$inet(0x2, 0x3, 0x2) connect$inet(0xffffffffffffffff, &(0x7f0000000000)={0x2, 0x0, @local}, 0x10) setsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x23, &(0x7f0000000000)={{{@in=@multicast2, @in=@multicast1}}, {{@in6}, 0x0, @in6=@loopback}}, 0xe8) syz_emit_ethernet(0x2a, &(0x7f0000000640)={@random="b100485caa2a", @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0xe000}, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x1c, 0x0, 0x0, 0x0, 0x2, 0x0, @rand_addr, @broadcast}, @igmp={0x11, 0xffffffffffffffff, 0x0, @multicast1}}}}}, &(0x7f0000000140)) [ 654.612574] kvm: pic: single mode not supported [ 655.058445] binder: 12029:12032 Acquire 1 refcount change on invalid ref 0 ret -22 01:56:09 executing program 0: socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000001f80)={0xffffffffffffffff, 0xffffffffffffffff}) setsockopt$SO_ATTACH_FILTER(r2, 0x1, 0x1a, &(0x7f0000ab9ff0)={0x2, &(0x7f000039a000)=[{0x20, 0x0, 0x0, 0xfffffffffffff010}, {0x6}]}, 0x10) sendmmsg(r1, &(0x7f0000001e80)=[{{&(0x7f0000000700)=@l2={0x1f, 0x0, {}, 0x1000000}, 0x80, &(0x7f0000001dc0)}}], 0x1, 0x0) 01:56:09 executing program 1: pipe2(&(0x7f0000000000)={0xffffffffffffffff}, 0x4000) ioctl$SNDRV_SEQ_IOCTL_SET_QUEUE_TIMER(r0, 0x40605346, &(0x7f0000000040)={0x6f4, 0x0, {0xffffffffffffffff, 0x0, 0x9d, 0x3, 0x9}}) r1 = socket$netlink(0x10, 0x3, 0x0) writev(r1, &(0x7f0000000040), 0x0) 01:56:09 executing program 4: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) ioctl$sock_SIOCETHTOOL(r0, 0x8946, &(0x7f0000000040)={'bond0\x00', &(0x7f0000000240)=ANY=[@ANYBLOB="4c00000000002300fffffdfd00000002"]}) 01:56:09 executing program 5: perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1f}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000340)={&(0x7f0000000000), 0xc, &(0x7f0000000300)={&(0x7f0000000240)=@newlink={0x50, 0x10, 0x721, 0x0, 0x0, {0x0, 0xa}, [@IFLA_LINKINFO={0x28, 0x12, @veth={{0xc, 0x1, 'veth\x00'}, {0x18, 0x2, @VETH_INFO_PEER={0x14}}}}, @IFLA_NET_NS_FD={0x8}]}, 0x50}}, 0x0) [ 655.200298] binder: 12029:12032 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 655.284119] binder: 12029:12057 BC_CLEAR_DEATH_NOTIFICATION invalid ref 0 [ 655.291265] binder: 12029:12057 unknown command 0 [ 655.393559] binder: 12029:12057 ioctl c0306201 20000040 returned -22 [ 655.413004] binder: 12029:12057 Acquire 1 refcount change on invalid ref 0 ret -22 [ 655.420982] binder: 12029:12057 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 655.428592] binder: 12029:12032 BC_CLEAR_DEATH_NOTIFICATION invalid ref 0 [ 655.435768] binder: 12029:12032 unknown command 0 [ 655.441054] binder: 12029:12032 ioctl c0306201 20000040 returned -22 01:56:09 executing program 6: r0 = syz_open_dev$sndseq(&(0x7f0000000100)='/dev/snd/seq\x00', 0x0, 0x0) read(r0, &(0x7f0000fb6000)=""/28, 0x3f0) ioctl$SNDRV_SEQ_IOCTL_REMOVE_EVENTS(r0, 0x4040534e, &(0x7f00000001c0)={0xbf}) ioctl$SNDRV_SEQ_IOCTL_QUERY_SUBS(r0, 0xc058534f, &(0x7f00000002c0)={{}, 0x1, 0x0, 0x0, {}, 0x0, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xbf00]}) r1 = gettid() timer_create(0x0, &(0x7f0000044000)={0x0, 0x12}, &(0x7f0000000040)) r2 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r2, 0x8912, &(0x7f00000001c0)="0a5cc80700315f85715070") timer_settime(0x0, 0x0, &(0x7f0000000080)={{0x0, 0x989680}, {0x0, 0x9}}, &(0x7f0000040000)) tkill(r1, 0x1000000000014) 01:56:09 executing program 2: r0 = socket$inet(0x2, 0x3, 0x2) connect$inet(0xffffffffffffffff, &(0x7f0000000000)={0x2, 0x0, @local}, 0x10) setsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x23, &(0x7f0000000000)={{{@in=@multicast2, @in=@multicast1}}, {{@in6}, 0x0, @in6=@loopback}}, 0xe8) syz_emit_ethernet(0x2a, &(0x7f0000000640)={@random="b100485caa2a", @link_local, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x1c, 0x0, 0x0, 0x0, 0x2, 0x0, @rand_addr, @broadcast}, @igmp={0x11, 0x0, 0x0, @multicast1}}}}}, &(0x7f0000000140)={0x0, 0x0, [0x4000000]}) 01:56:09 executing program 3: r0 = socket$inet(0x2, 0x3, 0x2) connect$inet(0xffffffffffffffff, &(0x7f0000000000)={0x2, 0x0, @local}, 0x10) setsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x23, &(0x7f0000000000)={{{@in=@multicast2, @in=@multicast1}}, {{@in6}, 0x0, @in6=@loopback}}, 0xe8) syz_emit_ethernet(0x2a, &(0x7f0000000640)={@random="b100485caa2a", @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x8000000}, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x1c, 0x0, 0x0, 0x0, 0x2, 0x0, @rand_addr, @broadcast}, @igmp={0x11, 0xffffffffffffffff, 0x0, @multicast1}}}}}, &(0x7f0000000140)) 01:56:09 executing program 1: r0 = syz_open_procfs(0x0, &(0x7f00000001c0)='coredump_filter\x00') sendmsg(0xffffffffffffffff, &(0x7f0000002fc8)={&(0x7f0000000080)=@nl, 0x80, &(0x7f0000000540), 0x0, &(0x7f00000002c0)=ANY=[]}, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000140)) preadv(r0, &(0x7f00000017c0), 0x1fe, 0x400000000000) 01:56:09 executing program 4: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) ioctl$sock_SIOCETHTOOL(r0, 0x8946, &(0x7f0000000040)={'bond0\x00', &(0x7f0000000240)=ANY=[@ANYBLOB="4c0000000000230000fdfdffff000002"]}) 01:56:09 executing program 5: perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1f}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000340)={&(0x7f0000000000), 0xc, &(0x7f0000000300)={&(0x7f0000000240)=@newlink={0x50, 0x10, 0x721, 0x0, 0x0, {0x0, 0xffffff9e}, [@IFLA_LINKINFO={0x28, 0x12, @veth={{0xc, 0x1, 'veth\x00'}, {0x18, 0x2, @VETH_INFO_PEER={0x14}}}}, @IFLA_NET_NS_FD={0x8}]}, 0x50}}, 0x0) 01:56:09 executing program 0: socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000001f80)={0xffffffffffffffff, 0xffffffffffffffff}) setsockopt$SO_ATTACH_FILTER(r2, 0x1, 0x1a, &(0x7f0000ab9ff0)={0x2, &(0x7f000039a000)=[{0x20, 0x0, 0x0, 0xfffffffffffff010}, {0x6}]}, 0x10) sendmmsg(r1, &(0x7f0000001e80)=[{{&(0x7f0000000700)=@l2={0x1f, 0x0, {}, 0xe03f0300}, 0x80, &(0x7f0000001dc0)}}], 0x1, 0x0) 01:56:09 executing program 7: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000180)='/dev/sequencer\x00', 0x10002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000080)="0a5cc80700315f85715070") r1 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000001c0)={0x2, 0x0, &(0x7f0000000140)=ANY=[@ANYBLOB='\fc'], 0x0, 0x0, &(0x7f0000000080)}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, &(0x7f00000001c0)}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000040)={0x2f, 0x0, &(0x7f00000000c0)=[@release={0x400c630f}], 0x1, 0x0, &(0x7f0000000100)='V'}) fstat(r0, &(0x7f00000002c0)) 01:56:09 executing program 4: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) ioctl$sock_SIOCETHTOOL(r0, 0x8946, &(0x7f0000000040)={'bond0\x00', &(0x7f0000000240)=ANY=[@ANYBLOB="4c0000000000230000fffffdfd000002"]}) 01:56:09 executing program 0: socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000001f80)={0xffffffffffffffff, 0xffffffffffffffff}) setsockopt$SO_ATTACH_FILTER(r2, 0x1, 0x1a, &(0x7f0000ab9ff0)={0x2, &(0x7f000039a000)=[{0x20, 0x0, 0x0, 0xfffffffffffff010}, {0x6}]}, 0x10) sendmmsg(r1, &(0x7f0000001e80)=[{{&(0x7f0000000700)=@l2={0x1f, 0x0, {}, 0x40000}, 0x80, &(0x7f0000001dc0)}}], 0x1, 0x0) 01:56:09 executing program 5: perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1f}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000340)={&(0x7f0000000000), 0xc, &(0x7f0000000300)={&(0x7f0000000240)=@newlink={0x50, 0x10, 0x721, 0x0, 0x0, {0x0, 0x10000000}, [@IFLA_LINKINFO={0x28, 0x12, @veth={{0xc, 0x1, 'veth\x00'}, {0x18, 0x2, @VETH_INFO_PEER={0x14}}}}, @IFLA_NET_NS_FD={0x8}]}, 0x50}}, 0x0) 01:56:09 executing program 3: r0 = socket$inet(0x2, 0x3, 0x2) connect$inet(0xffffffffffffffff, &(0x7f0000000000)={0x2, 0x0, @local}, 0x10) setsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x23, &(0x7f0000000000)={{{@in=@multicast2, @in=@multicast1}}, {{@in6}, 0x0, @in6=@loopback}}, 0xe8) syz_emit_ethernet(0x2a, &(0x7f0000000640)={@random="b100485caa2a", @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x1c00}, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x1c, 0x0, 0x0, 0x0, 0x2, 0x0, @rand_addr, @broadcast}, @igmp={0x11, 0xffffffffffffffff, 0x0, @multicast1}}}}}, &(0x7f0000000140)) 01:56:09 executing program 1: r0 = syz_open_dev$evdev(&(0x7f0000000000)='/dev/input/event#\x00', 0x0, 0x0) sysfs$1(0x1, &(0x7f0000000040)='/dev/input/event#\x00') ioctl$EVIOCSMASK(r0, 0x40104593, &(0x7f0000000100)={0x17, 0x0, &(0x7f00000000c0)}) r1 = syz_open_dev$dmmidi(&(0x7f0000000080)='/dev/dmmidi#\x00', 0x3, 0x480000) getsockopt$ARPT_SO_GET_INFO(r1, 0x0, 0x60, &(0x7f0000000200)={'filter\x00'}, &(0x7f00000001c0)=0x26) ioctl$EVIOCGLED(r1, 0x80404519, &(0x7f0000000140)=""/118) 01:56:09 executing program 2: r0 = socket$inet(0x2, 0x3, 0x2) connect$inet(0xffffffffffffffff, &(0x7f0000000000)={0x2, 0x0, @local}, 0x10) setsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x23, &(0x7f0000000000)={{{@in=@multicast2, @in=@multicast1}}, {{@in6}, 0x0, @in6=@loopback}}, 0xe8) syz_emit_ethernet(0x2a, &(0x7f0000000640)={@random="b100485caa2a", @link_local, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x1c, 0x0, 0x0, 0x0, 0x2, 0x0, @rand_addr, @broadcast}, @igmp={0x11, 0x0, 0x0, @multicast1}}}}}, &(0x7f0000000140)={0x0, 0x0, [0xe000]}) [ 655.977709] binder: 12097:12098 Acquire 1 refcount change on invalid ref 0 ret -22 [ 656.007952] binder: 12097:12098 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 01:56:10 executing program 4: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) ioctl$sock_SIOCETHTOOL(r0, 0x8946, &(0x7f0000000040)={'bond0\x00', &(0x7f0000000240)=ANY=[@ANYBLOB="4c000000000023000000fdfdffff0002"]}) [ 656.128600] binder: 12097:12121 BC_CLEAR_DEATH_NOTIFICATION invalid ref 0 [ 656.135766] binder: 12097:12121 unknown command 0 [ 656.160875] binder: 12097:12121 ioctl c0306201 20000040 returned -22 01:56:10 executing program 1: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000200)="0a5cc80700315f85715070") r1 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl$sock_SIOCETHTOOL(r1, 0x89f0, &(0x7f0000000140)={"62726964676530000000008000", &(0x7f0000000100)=@ethtool_cmd={0x6, 0x0, 0x709000}}) openat$hwrng(0xffffffffffffff9c, &(0x7f0000000000)='/dev/hwrng\x00', 0x2000, 0x0) [ 656.232234] binder: 12097:12121 Acquire 1 refcount change on invalid ref 0 ret -22 [ 656.279999] binder: 12097:12098 BC_CLEAR_DEATH_NOTIFICATION invalid ref 0 [ 656.287232] binder: 12097:12098 unknown command 0 [ 656.305976] binder: 12097:12121 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 656.345255] binder: 12097:12098 ioctl c0306201 20000040 returned -22 01:56:10 executing program 6: r0 = syz_open_dev$sndseq(&(0x7f0000000100)='/dev/snd/seq\x00', 0x0, 0x0) read(r0, &(0x7f0000fb6000)=""/28, 0x3f0) ioctl$SNDRV_SEQ_IOCTL_REMOVE_EVENTS(r0, 0x4040534e, &(0x7f00000001c0)={0xbf}) ioctl$SNDRV_SEQ_IOCTL_QUERY_SUBS(r0, 0xc058534f, &(0x7f00000002c0)={{}, 0x1, 0x0, 0x0, {}, 0x0, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xbf]}) r1 = gettid() timer_create(0x0, &(0x7f0000044000)={0x0, 0x12}, &(0x7f0000000040)) r2 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r2, 0x8912, &(0x7f00000001c0)="0a5cc80700315f85715070") timer_settime(0x0, 0x0, &(0x7f0000000080)={{0x0, 0x989680}, {0x0, 0x9}}, &(0x7f0000040000)) tkill(r1, 0x1000000000014) 01:56:10 executing program 3: r0 = socket$inet(0x2, 0x3, 0x2) connect$inet(0xffffffffffffffff, &(0x7f0000000000)={0x2, 0x0, @local}, 0x10) setsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x23, &(0x7f0000000000)={{{@in=@multicast2, @in=@multicast1}}, {{@in6}, 0x0, @in6=@loopback}}, 0xe8) syz_emit_ethernet(0x2a, &(0x7f0000000640)={@random="b100485caa2a", @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x4000}, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x1c, 0x0, 0x0, 0x0, 0x2, 0x0, @rand_addr, @broadcast}, @igmp={0x11, 0xffffffffffffffff, 0x0, @multicast1}}}}}, &(0x7f0000000140)) 01:56:10 executing program 5: perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1f}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000340)={&(0x7f0000000000), 0xc, &(0x7f0000000300)={&(0x7f0000000240)=@newlink={0x50, 0x10, 0x721, 0x0, 0x0, {0x0, 0xf0}, [@IFLA_LINKINFO={0x28, 0x12, @veth={{0xc, 0x1, 'veth\x00'}, {0x18, 0x2, @VETH_INFO_PEER={0x14}}}}, @IFLA_NET_NS_FD={0x8}]}, 0x50}}, 0x0) 01:56:10 executing program 4: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) ioctl$sock_SIOCETHTOOL(r0, 0x8946, &(0x7f0000000040)={'bond0\x00', &(0x7f0000000240)=ANY=[@ANYBLOB="4c000000000023000000fffffdfd0002"]}) 01:56:10 executing program 2: r0 = socket$inet(0x2, 0x3, 0x2) connect$inet(0xffffffffffffffff, &(0x7f0000000000)={0x2, 0x0, @local}, 0x10) setsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x23, &(0x7f0000000000)={{{@in=@multicast2, @in=@multicast1}}, {{@in6}, 0x0, @in6=@loopback}}, 0xe8) syz_emit_ethernet(0x2a, &(0x7f0000000640)={@random="b100485caa2a", @link_local, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x1c, 0x0, 0x0, 0x0, 0x2, 0x0, @rand_addr, @broadcast}, @igmp={0x11, 0x0, 0x0, @multicast1}}}}}, &(0x7f0000000140)={0x0, 0x0, [0x3e00]}) 01:56:10 executing program 1: r0 = socket$inet6(0xa, 0x80002, 0x0) connect$inet6(r0, &(0x7f0000000080)={0xa, 0x0, 0x0, @local, 0x2}, 0x1c) sendto$inet6(r0, &(0x7f0000000300), 0xfd90, 0x0, &(0x7f00000000c0)={0xa, 0x4e23, 0x0, @ipv4={[], [], @multicast2}}, 0x1c) getsockopt$IP6T_SO_GET_ENTRIES(r0, 0x29, 0x41, &(0x7f0000000100)={'nat\x00', 0xf7, "20256b713797c04dbf46dd9d65242279e0d2e61fa7673b49607394a5e36100c81f317932b2346a2025b2591ed1922086e3913bcb02abe19361afcde632d56e6ca97aa776b32c0775766abc7a680a2da3dea205221f67bd6f4da030eb7ed72733788eb3d0136caa3b0b3f1bdc247689dd9acda03ffca509d365c47e04f9c2168c69cef561f40d2eafaba192867575363aba45a272202d6abfeaf4b9cf0768ad64febf855f9aebe464c6e667ae473bf750d8df809802ca022a56591e13393a469cd44f75607df3dfe9d439764f0bd2785191e35a00ad35476902ec8f5523f0fc485fd92253f16eb3566f44cd6aa6b77e1c4fe535c3b6b9fc"}, &(0x7f0000000000)=0x11b) 01:56:10 executing program 0: socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000001f80)={0xffffffffffffffff, 0xffffffffffffffff}) setsockopt$SO_ATTACH_FILTER(r2, 0x1, 0x1a, &(0x7f0000ab9ff0)={0x2, &(0x7f000039a000)=[{0x20, 0x0, 0x0, 0xfffffffffffff010}, {0x6}]}, 0x10) sendmmsg(r1, &(0x7f0000001e80)=[{{&(0x7f0000000700)=@l2={0x1f, 0x0, {}, 0xc03e0000}, 0x80, &(0x7f0000001dc0)}}], 0x1, 0x0) 01:56:10 executing program 7: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000180)='/dev/sequencer\x00', 0x10002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000080)="0a5cc80700315f85715070") r1 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000001c0)={0x2, 0x0, &(0x7f0000000140)=ANY=[@ANYBLOB='\fc'], 0x0, 0x0, &(0x7f0000000080)}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, &(0x7f00000001c0)}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000040)={0x8, 0x7, &(0x7f00000000c0)=[@release={0x400c630f}], 0x1, 0x0, &(0x7f0000000100)='V'}) fstat(r0, &(0x7f00000002c0)) 01:56:10 executing program 3: r0 = socket$inet(0x2, 0x3, 0x2) connect$inet(0xffffffffffffffff, &(0x7f0000000000)={0x2, 0x0, @local}, 0x10) setsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x23, &(0x7f0000000000)={{{@in=@multicast2, @in=@multicast1}}, {{@in6}, 0x0, @in6=@loopback}}, 0xe8) syz_emit_ethernet(0x2a, &(0x7f0000000640)={@random="b100485caa2a", @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x34000}, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x1c, 0x0, 0x0, 0x0, 0x2, 0x0, @rand_addr, @broadcast}, @igmp={0x11, 0xffffffffffffffff, 0x0, @multicast1}}}}}, &(0x7f0000000140)) 01:56:10 executing program 4: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) ioctl$sock_SIOCETHTOOL(r0, 0x8946, &(0x7f0000000040)={'bond0\x00', &(0x7f0000000240)=ANY=[@ANYBLOB="4c00000000002300000000fdfdffff02"]}) 01:56:10 executing program 5: perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1f}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000340)={&(0x7f0000000000), 0xc, &(0x7f0000000300)={&(0x7f0000000240)=@newlink={0x50, 0x10, 0x721, 0x0, 0x0, {0x0, 0x600}, [@IFLA_LINKINFO={0x28, 0x12, @veth={{0xc, 0x1, 'veth\x00'}, {0x18, 0x2, @VETH_INFO_PEER={0x14}}}}, @IFLA_NET_NS_FD={0x8}]}, 0x50}}, 0x0) 01:56:10 executing program 1: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) socket$inet6(0xa, 0x7, 0xe000) ioctl(r0, 0x8912, &(0x7f0000000180)="0a5cc80700315f85715070") r1 = memfd_create(&(0x7f00000000c0)="70726f63ae6d6e6f64657600", 0x0) r2 = socket$inet6(0xa, 0x1001000000002, 0x0) ioctl(r2, 0x8912, &(0x7f0000000280)="025cc80700145f8f764070") socketpair$inet_dccp(0x2, 0x6, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) ppoll(&(0x7f0000000080)=[{r3, 0x2}, {0xffffffffffffffff, 0x8}], 0x2, &(0x7f00000000c0), &(0x7f0000000100)={0x800}, 0x8) perf_event_open(&(0x7f0000000000)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x3, 0x2000000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000100)}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r4 = socket$inet6_udp(0xa, 0x2, 0x0) ioctl$sock_inet6_SIOCADDRT(r4, 0x890b, &(0x7f0000000000)={@remote, @dev, @mcast2, 0x0, 0x0, 0x8b7}) fallocate(r1, 0xb, 0xebc, 0x40) socket$inet6(0xa, 0x80000, 0xaa56) openat$kvm(0xffffffffffffff9c, &(0x7f00000002c0)='/dev/kvm\x00', 0x0, 0x0) perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) getsockopt$inet_int(0xffffffffffffffff, 0x0, 0x0, &(0x7f0000000140), &(0x7f00000000c0)=0x4) ioctl$sock_SIOCSIFBR(0xffffffffffffffff, 0x8941, &(0x7f0000000300)=@get={0x1, &(0x7f0000000200)=""/182}) r5 = socket$vsock_dgram(0x28, 0x2, 0x0) getsockname(r5, &(0x7f0000000400)=@xdp, &(0x7f00000003c0)=0x80) setsockopt$inet_sctp_SCTP_SOCKOPT_CONNECTX_OLD(r1, 0x84, 0x6b, &(0x7f0000000480)=[@in6={0xa, 0x4e21, 0x9, @mcast1, 0xffff}, @in6={0xa, 0x4e23, 0x9, @ipv4={[], [], @dev={0xac, 0x14, 0x14, 0x14}}, 0x8000}, @in={0x2, 0x4e20}], 0x48) sendmsg$kcm(0xffffffffffffffff, &(0x7f0000000580)={&(0x7f0000000080)=@in6={0xa, 0x0, 0x0, @mcast2}, 0x80, &(0x7f0000000000), 0x0, &(0x7f0000000800)}, 0x0) socketpair(0x1, 0x1, 0x0, &(0x7f0000000740)={0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_SET_FILTER(r6, 0x89f1, &(0x7f0000000580)='ip6_vti0\x00') socketpair(0x1, 0x1, 0x0, &(0x7f0000000740)={0xffffffffffffffff}) r8 = socket$inet6(0xa, 0x1000000000000, 0x0) ioctl(r8, 0x8912, &(0x7f0000000280)="0a5cc80700315f85714070") r9 = msgget(0x2, 0x2c4) msgctl$MSG_STAT(r9, 0xd, &(0x7f00000002c0)=""/149) fallocate(r1, 0x8, 0x0, 0xeb96) ioctl$KVM_GET_NR_MMU_PAGES(r7, 0xae45, 0x6) 01:56:10 executing program 2: r0 = socket$inet(0x2, 0x3, 0x2) connect$inet(0xffffffffffffffff, &(0x7f0000000000)={0x2, 0x0, @local}, 0x10) setsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x23, &(0x7f0000000000)={{{@in=@multicast2, @in=@multicast1}}, {{@in6}, 0x0, @in6=@loopback}}, 0xe8) syz_emit_ethernet(0x2a, &(0x7f0000000640)={@random="b100485caa2a", @link_local, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x1c, 0x0, 0x0, 0x0, 0x2, 0x0, @rand_addr, @broadcast}, @igmp={0x11, 0x0, 0x0, @multicast1}}}}}, &(0x7f0000000140)={0x0, 0x0, [0x6]}) [ 656.940377] binder: 12167:12168 Acquire 1 refcount change on invalid ref 0 ret -22 01:56:10 executing program 0: socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000001f80)={0xffffffffffffffff, 0xffffffffffffffff}) setsockopt$SO_ATTACH_FILTER(r2, 0x1, 0x1a, &(0x7f0000ab9ff0)={0x2, &(0x7f000039a000)=[{0x20, 0x0, 0x0, 0xfffffffffffff010}, {0x6}]}, 0x10) sendmmsg(r1, &(0x7f0000001e80)=[{{&(0x7f0000000700)=@l2={0x1f, 0x0, {}, 0x803e}, 0x80, &(0x7f0000001dc0)}}], 0x1, 0x0) 01:56:10 executing program 4: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) ioctl$sock_SIOCETHTOOL(r0, 0x8946, &(0x7f0000000040)={'bond0\x00', &(0x7f0000000240)=ANY=[@ANYBLOB="4c00000000002300000000fffffdfd02"]}) 01:56:11 executing program 3: r0 = socket$inet(0x2, 0x3, 0x2) connect$inet(0xffffffffffffffff, &(0x7f0000000000)={0x2, 0x0, @local}, 0x10) setsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x23, &(0x7f0000000000)={{{@in=@multicast2, @in=@multicast1}}, {{@in6}, 0x0, @in6=@loopback}}, 0xe8) syz_emit_ethernet(0x2a, &(0x7f0000000640)={@random="b100485caa2a", @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x700000000000000}, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x1c, 0x0, 0x0, 0x0, 0x2, 0x0, @rand_addr, @broadcast}, @igmp={0x11, 0xffffffffffffffff, 0x0, @multicast1}}}}}, &(0x7f0000000140)) [ 657.058835] binder: 12167:12168 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 657.123427] binder: 12167:12191 unknown command 0 [ 657.141149] binder: 12167:12191 ioctl c0306201 20000040 returned -22 [ 657.223956] binder: 12167:12191 Acquire 1 refcount change on invalid ref 0 ret -22 [ 657.250272] binder: 12167:12191 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 657.263488] binder: 12167:12168 unknown command 0 [ 657.279852] binder: 12167:12168 ioctl c0306201 20000040 returned -22 01:56:11 executing program 4: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) ioctl$sock_SIOCETHTOOL(r0, 0x8946, &(0x7f0000000040)={'bond0\x00', &(0x7f0000000240)=ANY=[@ANYBLOB="4c000000000023000000000000000001"]}) 01:56:11 executing program 2: r0 = socket$inet(0x2, 0x3, 0x2) connect$inet(0xffffffffffffffff, &(0x7f0000000000)={0x2, 0x0, @local}, 0x10) setsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x23, &(0x7f0000000000)={{{@in=@multicast2, @in=@multicast1}}, {{@in6}, 0x0, @in6=@loopback}}, 0xe8) syz_emit_ethernet(0x2a, &(0x7f0000000640)={@random="b100485caa2a", @link_local, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x1c, 0x0, 0x0, 0x0, 0x2, 0x0, @rand_addr, @broadcast}, @igmp={0x11, 0x0, 0x0, @multicast1}}}}}, &(0x7f0000000140)={0x0, 0x0, [0x6000000]}) 01:56:11 executing program 6: r0 = syz_open_dev$sndseq(&(0x7f0000000100)='/dev/snd/seq\x00', 0x0, 0x0) read(r0, &(0x7f0000fb6000)=""/28, 0x3f0) ioctl$SNDRV_SEQ_IOCTL_REMOVE_EVENTS(r0, 0x4040534e, &(0x7f00000001c0)={0xbf}) ioctl$SNDRV_SEQ_IOCTL_QUERY_SUBS(r0, 0xc058534f, &(0x7f00000002c0)={{}, 0x1, 0x0, 0x0, {}, 0x0, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffff00000000]}) r1 = gettid() timer_create(0x0, &(0x7f0000044000)={0x0, 0x12}, &(0x7f0000000040)) r2 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r2, 0x8912, &(0x7f00000001c0)="0a5cc80700315f85715070") timer_settime(0x0, 0x0, &(0x7f0000000080)={{0x0, 0x989680}, {0x0, 0x9}}, &(0x7f0000040000)) tkill(r1, 0x1000000000014) 01:56:11 executing program 3: r0 = socket$inet(0x2, 0x3, 0x2) connect$inet(0xffffffffffffffff, &(0x7f0000000000)={0x2, 0x0, @local}, 0x10) setsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x23, &(0x7f0000000000)={{{@in=@multicast2, @in=@multicast1}}, {{@in6}, 0x0, @in6=@loopback}}, 0xe8) syz_emit_ethernet(0x2a, &(0x7f0000000640)={@random="b100485caa2a", @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x2000000000000000}, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x1c, 0x0, 0x0, 0x0, 0x2, 0x0, @rand_addr, @broadcast}, @igmp={0x11, 0xffffffffffffffff, 0x0, @multicast1}}}}}, &(0x7f0000000140)) 01:56:11 executing program 0: socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000001f80)={0xffffffffffffffff, 0xffffffffffffffff}) setsockopt$SO_ATTACH_FILTER(r2, 0x1, 0x1a, &(0x7f0000ab9ff0)={0x2, &(0x7f000039a000)=[{0x20, 0x0, 0x0, 0xfffffffffffff010}, {0x6}]}, 0x10) sendmmsg(r1, &(0x7f0000001e80)=[{{&(0x7f0000000700)=@l2={0x1f, 0x0, {}, 0x0, 0x3e80}, 0x80, &(0x7f0000001dc0)}}], 0x1, 0x0) 01:56:11 executing program 1: open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) r0 = memfd_create(&(0x7f0000033ff3)='\x00', 0x0) r1 = syz_open_dev$sndseq(&(0x7f0000000000)='/dev/snd/seq\x00', 0x0, 0x20005) dup2(r1, r0) write$sndseq(r0, &(0x7f000000a000)=[{0x7, 0x21, 0x0, 0x0, @time={0x77359400}, {}, {}, @ext={0x0, &(0x7f0000038ffe)}}], 0x30) ioctl$SNDRV_SEQ_IOCTL_REMOVE_EVENTS(r1, 0x4040534e, &(0x7f0000000080)={0x3f}) 01:56:11 executing program 7: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000180)='/dev/sequencer\x00', 0x10002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000080)="0a5cc80700315f85715070") r1 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000001c0)={0x2, 0x0, &(0x7f0000000140)=ANY=[@ANYBLOB='\fc'], 0x0, 0x0, &(0x7f0000000080)}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, &(0x7f00000001c0)}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000040)={0x8, 0x700000000000000, &(0x7f00000000c0)=[@release={0x400c630f}], 0x1, 0x0, &(0x7f0000000100)='V'}) fstat(r0, &(0x7f00000002c0)) 01:56:11 executing program 5: perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1f}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000340)={&(0x7f0000000000), 0xc, &(0x7f0000000300)={&(0x7f0000000240)=@newlink={0x50, 0x10, 0x721, 0x0, 0x0, {0x0, 0xb00}, [@IFLA_LINKINFO={0x28, 0x12, @veth={{0xc, 0x1, 'veth\x00'}, {0x18, 0x2, @VETH_INFO_PEER={0x14}}}}, @IFLA_NET_NS_FD={0x8}]}, 0x50}}, 0x0) 01:56:11 executing program 5: perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1f}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000340)={&(0x7f0000000000), 0xc, &(0x7f0000000300)={&(0x7f0000000240)=@newlink={0x50, 0x10, 0x721, 0x0, 0x0, {0x0, 0xf}, [@IFLA_LINKINFO={0x28, 0x12, @veth={{0xc, 0x1, 'veth\x00'}, {0x18, 0x2, @VETH_INFO_PEER={0x14}}}}, @IFLA_NET_NS_FD={0x8}]}, 0x50}}, 0x0) 01:56:11 executing program 4: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) ioctl$sock_SIOCETHTOOL(r0, 0x8946, &(0x7f0000000040)={'bond0\x00', &(0x7f0000000240)=ANY=[@ANYBLOB="4c000000000023000000000000000002"]}) 01:56:11 executing program 2: r0 = socket$inet(0x2, 0x3, 0x2) connect$inet(0xffffffffffffffff, &(0x7f0000000000)={0x2, 0x0, @local}, 0x10) setsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x23, &(0x7f0000000000)={{{@in=@multicast2, @in=@multicast1}}, {{@in6}, 0x0, @in6=@loopback}}, 0xe8) syz_emit_ethernet(0x2a, &(0x7f0000000640)={@random="b100485caa2a", @link_local, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x1c, 0x0, 0x0, 0x0, 0x2, 0x0, @rand_addr, @broadcast}, @igmp={0x11, 0x0, 0x0, @multicast1}}}}}, &(0x7f0000000140)={0x0, 0x0, [0x400300]}) 01:56:11 executing program 1: r0 = socket$inet6(0xa, 0x1000000000002, 0xfffffffffffffffc) ioctl(r0, 0x8912, &(0x7f0000000280)="0a5cc80700315f85714070") ioctl$sock_inet6_SIOCDELRT(r0, 0x890c, &(0x7f0000000080)={@dev={0xfe, 0x80, [], 0x10}, @empty, @dev={0xfe, 0x80, [], 0x1b}, 0x0, 0x40, 0x2, 0x100, 0x6, 0x40010000}) timer_delete(0x0) 01:56:11 executing program 3: r0 = socket$inet(0x2, 0x3, 0x2) connect$inet(0xffffffffffffffff, &(0x7f0000000000)={0x2, 0x0, @local}, 0x10) setsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x23, &(0x7f0000000000)={{{@in=@multicast2, @in=@multicast1}}, {{@in6}, 0x0, @in6=@loopback}}, 0xe8) syz_emit_ethernet(0x2a, &(0x7f0000000640)={@random="b100485caa2a", @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x60000000}, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x1c, 0x0, 0x0, 0x0, 0x2, 0x0, @rand_addr, @broadcast}, @igmp={0x11, 0xffffffffffffffff, 0x0, @multicast1}}}}}, &(0x7f0000000140)) [ 657.791151] binder: 12233:12235 Acquire 1 refcount change on invalid ref 0 ret -22 01:56:11 executing program 5: perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1f}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000340)={&(0x7f0000000000), 0xc, &(0x7f0000000300)={&(0x7f0000000240)=@newlink={0x50, 0x10, 0x721, 0x0, 0x0, {0x0, 0xf0ffff}, [@IFLA_LINKINFO={0x28, 0x12, @veth={{0xc, 0x1, 'veth\x00'}, {0x18, 0x2, @VETH_INFO_PEER={0x14}}}}, @IFLA_NET_NS_FD={0x8}]}, 0x50}}, 0x0) 01:56:11 executing program 0: socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000001f80)={0xffffffffffffffff, 0xffffffffffffffff}) setsockopt$SO_ATTACH_FILTER(r2, 0x1, 0x1a, &(0x7f0000ab9ff0)={0x2, &(0x7f000039a000)=[{0x20, 0x0, 0x0, 0xfffffffffffff010}, {0x6}]}, 0x10) sendmmsg(r1, &(0x7f0000001e80)=[{{&(0x7f0000000700)=@l2={0x1f, 0x0, {}, 0x0, 0x803e000000000000}, 0x80, &(0x7f0000001dc0)}}], 0x1, 0x0) 01:56:11 executing program 4: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) ioctl$sock_SIOCETHTOOL(r0, 0x8946, &(0x7f0000000040)={'bond0\x00', &(0x7f0000000240)=ANY=[@ANYBLOB="4c000000000023000000000000000002"]}) [ 657.909470] binder: 12233:12235 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 01:56:11 executing program 1: r0 = socket$inet6(0xa, 0x3, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc80700145f8f764070") socketpair$unix(0x1, 0x2, 0x0, &(0x7f00006ffff8)={0xffffffffffffffff, 0xffffffffffffffff}) recvmmsg(r1, &(0x7f0000000200), 0x366b03e7bec5d4de, 0x7ce9cd0214bbc626, 0x0) sendmmsg(r2, &(0x7f00000009c0)=[{{0x0, 0x342, &(0x7f0000000000), 0xfc, &(0x7f0000000300), 0x0, 0xfffffffffffffffe}}, {{0x0, 0xffffffffffffff52, &(0x7f0000000680), 0x59, &(0x7f0000000a40)=[{0xfffffdb0, 0x111, 0x9b, "5f11cf590f64ec2d3c84487c9c62b2cfcbb7e929316cfb911ef86f6eb4c47a348c6cd2b6198d2a2225e4dabf1c56a926f7f49b7ff33f8082d9592459004d2a23242fef6f5e53042a56080324dac9aefcb1c943611d802aa5f15f2609740b1a86747bd325139918f364419408a1c2379d712e183664501a502f0b89831e063f5b3c679edf167681e83fb16e819ddf5988997232bae656a92cf7e615c9edd1d8bfef7e54337e68373a9c1d8634750055175214bbc96b450588ccbdce372270d48fc6f852659eddc6ba644a427894c8ec6b3958786eebe8139a631a01b569f6e2505e4cf081aca46ad459083988ace97a1f1b"}, {0x0, 0x100000000000113, 0x6, "782c020e10b6672a858c274c71ecdb065591f5f55c7f3781b22e357e4ec268d9b767645db15f1999f7179ed1ff8aa2ea152b77a63b02e33d7294f53550c9c37cc53f7510e367423bafdfbd57a90dd2b30cd06097ce5f3b2e8a3b787ab434a2d1c41ac65306852f07df217aedbb7ec9f5fed60028b4242674b89a0f8d2a9ffbdaaa14e2640830180def335883"}, {0x0, 0x10e, 0xfffffffffffeffff, "46c4bdbde08f8a4e0135e2248ac3c88bd8fa90e47293bb653f4e4ecb9fd9528ea9cd7409b3eeae6a8f75ae8a5fbb16a858c168f584151da75a756243431d67973208847d39809a28ad577fa6677ba51768c46c78fc120d7bd29e20cd79e5d2459ac7422aa2ad596932ac7a6c0fd271f28eb220e910547c7aedc3db2c2abe7f77d407f68ba456b396be8c54394c5c1ce7f995b0eca6a57f81b133ddf4f2c974e0796304afea62cb192d9d86c34498506c4e56aab52c095bd0d66d15e2179a5829809a4fe1147ee930f5cec2c0a89db84a927768b4fefcb03e3376e9920befae6074dbb298e62bec7db9780a8d9587da4001e3bc3572045f1731533ada59a4b00c4c70b531dd22ed0b9632a1c55a2f0f8bd94bef14c5e4b46418af3293edce25e50b039f8244999c307159d4c24772ff6628c1c1d84b47f74f2dc7131fb877f17af8731198010e983bae99d19eaae1fc7d0db4f1c32fa702370706e0181899368c6e11f0635f12dcfb4caa5d0f4bce1951add101de4729e2ce6987c4cc80ca9cdc38933aeda7de8c9febc153a2247d231e559ac25bd5e6ce475eabf88e92c5cb07cf0c2f1407a75ae97793833b41e24a2184e4385db824eb7702a7bca25ca13b7b92c55ee1ef0395d3fcd97c25997ec4ddb6a8e6c1cdf0853fc2eac31e40e01f6b78c7f6b67666d567a698d39bf12489a67812acb223881602a8311f468f78c44dd5f7180cfe35802457a7641e419be060eb0ac85f3eafd5fadcf7ca6f25955d9ac651c5a44867b5787ede0338181cd6050785f15b000d8e9b06718288e76ee6b700384feb774622a163102c1b50d184e1ad51f70e2c0c57a1b84fc4113fd7674342cb71d252baf5036dea2a6bdbe0250e87fef663f71b771b499a76fde99e5dc21f22dbb4cdf6947144171223889772f59da089be03c485e7154d0596c08c145527d918fbdc700f7c9fde51600a37dd33cc3b852b2614222c879760fd211327e5e8c60eda0a118e1d247d13cc75cd94c92eb3ae6e366b7e8296d805a6e419f699e5ac338b17818643cc1724107a5cc7180028b49c5bf5e8879b838dc664660403097dc29715eea1439f2ef464dedfe412a37fac4416590557916c8a7bb899c460fa3bebdddd28e0cac99fb8730cdddff0122f05c4a0f8a6e9ef68710e28c77d4ae0ba1ed787ec8a481411fe170fc2aee79abd6dc2f0d65e53f59eea85c000ddd1526382d4301917eed45a141e404f63408f32df37b7071e0db39f7e183901c6301227813afc944be8741d5dbe6fe8048584e0fa27fcc445c1395737ca9b79116b68ae388acd9b003381e6ecaf78bd09220a189d48a3dea716827ff669fa40c34b45bd9fe43e020f6fd7e5a7accc3a65d5b7eaa45604ece0f8a5e849949611aacc5d68a0564cc30b6944ea7b2a2407384c34a8070972e5c9e5eec4a5b6d645649624303dbb44b6de601a1fbfcea8af8888e741db7abc0065a4ea5cd050051a5b77d702619b47ac2d02300d9223fa7d777a08e1fcb9cd6267a2b58cbdf8532c4958b808e67b2b76604d82c3046333b16df55d8d6c415f9def337934578e8fd30f83deb2ca6bf870fbb5fa5abc2c21a060c9db1ac2c1840514f4e69ec939b49eea2a9154d6279e6c7f9decb7d797340f06ceb6038281478b30525af7a5442c55a004bdd4cc726d1e66a9d26573879c205bbfbc60bd6497243db88245f72b87df014ced7bebf00298e21501adead24a1f4f4b493b2096ffb51e58094ee2904a29fc84f8939e724d985e2410b80cd12b0906476de727a41bd2aa20b74a803bb6385d5f264da3e479816168c33f24b0eeb37930d2aa5c63cf67e266f87b1ce0e2d095704ff51ce68b4a1e8a21fe28451e9ae4892b86719707c52ec4db35b4763df0165c273c6d133a53a633bad99d38551a444a816ca5427114fdfbd00f8969c937b477731f25822f01e08e616d98366e74e6b3038bf7e0c5fec78c2284d574c5e6005b05c7f7a0e964d0dd939e11d617938ffc599619771f45566f065dc5ff5eb259e788d4da0a6ed2d34463590eb406da3d3ac22b96bc49cc715b47bdeb33877af1ad223f35ed7eae1311139764387bea1f907ecdb2a2f721a696b47fc623d311506172ca761d2b4b9e9276670c51794faf8165f3ba9a369359987c4783a74b3d756ff6a672f4401b062c07a3f9f8f8c05b6777c39546c22198e4e8b9a91ff0b2febeed718e9a66dfd6b94b9f28e81a47a64c5af34c20d36c43c4736b92bf57c86642f2ccddbd5a122f73ae5660d87d753c4a042f45dff9043894f75f8f737eb9b1697abe27eaf85074171a8fde321852c09bb94e99e18295a6cbea32be9d50caecbdb564273e8cf201f89ab4a8cff13c61093c0181c5025007856a5197650261ec47053f1244ed8092d8320ac0f9b1cca8b674f5153aa75d054c78bbe79e88165e1ced8c968f2d44826bb504e90cd4e843cdc8e501b9f393a3f9afdcd118d66514b1e455f4510e77bf934d8c16fb33d9df0665f44cbda85b9df98a1bab38a719546d55316528b89c3c2cfdf0cf1fc8a7fc32cfb30b09197dd48971fecf80d8f90c48e363b398dfa5369992d38cf43e3ffd48f90e088e4f8438e0072d30721217cc9ee0f9669ab83291537c7f3dbec85d0fd3291a70f8900533e6be2e921711dad56297a813bf615b6dfcd41c0f7d27f7e98413d622f751dab66c933770c103aec30f91d534252ca11fc7c91378dc373453184426fb2e04bbb6dc2e4e2ae6c008998845a915bc18a883c15e088aec8047ab6eb3ab818458eb7c63e7bb738a3066441bd59977453c88ec67ba10f156136ec962a7e56d5b8df5d0a4f08b78aef2d5434895c085ea1dc4713698c1b2e9ac65626e48fdcc149765e6c5f1138b75ad8cc168db3fffbb907b9f015298d0b213e4541698ebeeaef429f884e9e8235799ba541f7105a18ab82c8ee720d6374a6bf8898a159505aaba863beb1859f75f058ea16f136f2b33daee17ae47147faac1c19831919a939c2d12ca0d9bff2789fb3ecd067a9b0eb01396313a89b7278ad76c424d252deed6e0f94055b67e3b002f26b5d6f5a27089d72894010cbb208a08a9fa1e03def507916f6692335cd2d0a49e7646e421e45641342f64338e27a85bfc539eb78b880fc0513d7b21ed7c08a531b0252cdb9579d4cd0397f3c5ee8cdcf102fd6a6f7bfadae253d69a78ae4220002c7fc6ce24f94e8eed6a58985b6aeb53de7f4a1685883b2549dc882f26b54a99ad68ad5a42b994293d18d0b10c3d415543355df17aa71895c818bc3a3659c8720142a22f7b1cf37795ad88d2f5f83fdd871d0473be951d5b253ec3f2ee0eb07fa96ee00ae71421791989772f542a39e4950664602dd38e78e7a1caf24c26c3162eee63f7c34c38693ec7fe6a1fef30f7709db985a5272de71fa3395938ff84e3b525b0d9c5ce7b1792d32942727a402d6eafe5fd31c00e0f089b2f3d2e32a2d548db176978ae3923c2e212701a9b2db472a060541a755c751aed92c6a53983305fea46cb4aea6a2d4d1298316ba3008eb6c3fb4fd3e6548a3996ce6386f13aa00194d29e94a79bfaaa1dea1354e677741871a6c2fd28b5046b1bb9837e1b7384dc24295fd29d30bfe7a7e4121ba6fcf50761132fde9aa4118d24d3433c3da3857118cfd536b72f04fd8229ad904ac892d4a8270f8b0812c41b86390181e8cd83261cdd8a5ddc598f92beff76db9b7313edf26cac1f7f79073f0a9c03a402b7fa4c7046631bbe4f2e793a3a9ba5600b182cc7da52a6b77631ee28b022c2b8a98517e2a25b0f5d53bccf407970a4a3f80e6ecbbbb5838054b602ab2c20a17708e19c821f10310bae25be4fafafe7f0f33a06da75ab06a6c004315ee23af916d9fbbaec3c6f042e0b8eb0a4a5ba507ca6c57e851835a12be3ab830490d4319bc9b665ab666cd9ab0ee88c4651eeed8f9b35be0472c8a62616018ddd7abce3f985edbafc938a183f5de4689faae12bda17c62394afb26e92ef6e3b0895601bc0d8ac1a343da8a9b367a7a880eac1d0192fa582db884bd0119a83db97fbd8f0b04af4119a774b09d997ff2f741e946c6c3cab03703263129901a26b1bed262c2534217b9b4cae65b4a8b61f10bca940e657fa30aa61c10a33541747357471f56ed20c5acff6556e992f0cdf76fba61a029631a21c5560f02db979fa9333687e5423a27c4ed6a3c9a5fa6d4079da804bdb5c9ee800e24de3c08496c78942fcd5ab0622296ad139f73f10ffcc2fc90129290e4a997471e19632152b32e9fddebad5605cea2e5ede031d42767eac46024e72c838664aa9972ce7ba1784bc837f208f65e410d56eeb76e049d9e4a04e955811adf78e1b51adff75b477d2fb65501aae0b77b16960fa9cd9c03d80d33a01041c4f8e701683108ffd3da13e77e371b30ab93039557a1cf26c0c44a1c5aa50be67256265b75c7574bedd031be8f79dafdff118d02cd005014358e84a502d08cd281a3b828fcb2b490ac536dbf354f8e7e36bc913008098783a38519a70e305bbbd00a6b482df825d805d4a9218787c8ee785bc4e80a6b23d49bc4b37fa0a0e04f2681194e8faf52243ac3977dd7c7e8302d5a90e2f64fd0b33effdd00225e85ce0c332ea03bc77f16e70fe277c518bbad3ae252c3bcf803feaeee46cab5aa181b2e3cf27a6e3e25e57d34421abcde87a575465ba855bdba3db0d7967346b6a7014ca6cbe8681749136e57a37c7da47ab320c68e3ca8a55db0b03641b77b5b6ccc07489fcc99e01257f84434110a76c9dced2b53ad6835cbb9ee6cae79066d1014e3f7734ac1d2143086e99221b828d494355df5ff94275b4d1a346a2c5c92278c7a515ad80de3e98f0b193f1dfb149c9a5d5356fbf3874dfb0b26db6c6b524121688eea59b4b50a912bd14e99548d3b605b111412ccde85bf5808cbeb0ace4e9ca93882c81e3b94c3fec2866252036343814e4ace19660a9cbf9cc4a3486bd64dafc065470f06e315f4a363345731a562eec1e01e1582b11207a4f7522236b8d50055141819cc0adf864e9789f14d9f6a5545f1dfe49ad8758c414befc2c19c3d7f53d659cd23e9b2771d503aa3041167637f3d690bf79b3a236b1a900c90470b97ca5dc55ac2188f137354d19556f8b2d1c5fb75aa7a21e68f603f08813f6de65063800e36eb04476b56a876b1087616732504da39893028ce2523970b1db9ef73be3fbb0a642ea684875410815e4d1833e567e0d7b7b18582e31672be1b6651934464cf3d0c7721d52f0e59938692fcc46c2441fb73ebcb5575ed993e5073adb6817c99da142a739f89c75b64e5cc3dbe363b4fc86e4fca4283679942dee5f4f749673780de06b6e01d5c09e2d6da0d0a41006d40868a969b0e4a7174b2ed756d5a1a0e163b6ac6f6a0c67ed9fb152120d53d1e834d90a6a439ce382ae18cb5eb6e94818f36bf134923cf13b7aaf1b9980046cca99de718b2442d728928c21d9a821f79308b0e723a05e2dfa8b83d71fdfa9e1acd6eb0b76d6a4e1a8bad7226ffc44059b3c06f9f2ad17aebe718e4d32cbc0be5bbf118b51f01c9ef2d5809b2bd3f1d6cf172acae706191a14b85d0dab5f1fae8506824eeecc64ecf7bfe2a4450d3a201d0ea0fb9d9c6f420e987e8438ce6e1dd0508c6559e73a804b6b39b76e447b6e6141fb472b4f7a7a5c212f4a90bbc7100b1355134a7f9b623fd8c62368f090e4933b1ed5ae3819162adef7933584e456abecec901ddcb79b76c23f8429bf49ab5125b17b667d9a7aefea0134896816ce6d"}, {0x0, 0x0, 0x7}, {0x0, 0x12f, 0x1, "c104b8e251df4263cadf799d37eb01dc7077f8df8a189fd4755c39ca3ebcc158874a43e8bb0ef7aa024fbf19d061721581506618d4dc70202a7e6c84e3705f4e44f681b07d77cf1a424f49c45fbe066b13dad73565436f305d919a5a38fd26f3c7cf33ebf6d21faa819648cbcc0098b019e31828168a513c745ba68e7485241a7d42674a10c1a4c595c8c02d09f1a18df8550576e48a71ce528c8095031ac36ea591d2cca1eabf921e06"}], 0x0, 0x20000010}, 0x8}], 0x2, 0x0) [ 657.965554] binder: 12233:12256 Acquire 1 refcount change on invalid ref 0 ret -22 01:56:11 executing program 2: r0 = socket$inet(0x2, 0x3, 0x2) connect$inet(0xffffffffffffffff, &(0x7f0000000000)={0x2, 0x0, @local}, 0x10) setsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x23, &(0x7f0000000000)={{{@in=@multicast2, @in=@multicast1}}, {{@in6}, 0x0, @in6=@loopback}}, 0xe8) syz_emit_ethernet(0x2a, &(0x7f0000000640)={@random="b100485caa2a", @link_local, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x1c, 0x0, 0x0, 0x0, 0x2, 0x0, @rand_addr, @broadcast}, @igmp={0x11, 0x0, 0x0, @multicast1}}}}}, &(0x7f0000000140)={0x0, 0x0, [0x600000000000000]}) [ 658.009572] binder: 12233:12256 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 658.128074] binder: 12235 RLIMIT_NICE not set 01:56:12 executing program 6: r0 = syz_open_dev$sndseq(&(0x7f0000000100)='/dev/snd/seq\x00', 0x0, 0x0) read(r0, &(0x7f0000fb6000)=""/28, 0x3f0) ioctl$SNDRV_SEQ_IOCTL_REMOVE_EVENTS(r0, 0x4040534e, &(0x7f00000001c0)={0xbf}) ioctl$SNDRV_SEQ_IOCTL_QUERY_SUBS(r0, 0xc058534f, &(0x7f00000002c0)={{}, 0x1, 0x0, 0x0, {}, 0x0, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xe000000]}) r1 = gettid() timer_create(0x0, &(0x7f0000044000)={0x0, 0x12}, &(0x7f0000000040)) r2 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r2, 0x8912, &(0x7f00000001c0)="0a5cc80700315f85715070") timer_settime(0x0, 0x0, &(0x7f0000000080)={{0x0, 0x989680}, {0x0, 0x9}}, &(0x7f0000040000)) tkill(r1, 0x1000000000014) 01:56:12 executing program 3: r0 = socket$inet(0x2, 0x3, 0x2) connect$inet(0xffffffffffffffff, &(0x7f0000000000)={0x2, 0x0, @local}, 0x10) setsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x23, &(0x7f0000000000)={{{@in=@multicast2, @in=@multicast1}}, {{@in6}, 0x0, @in6=@loopback}}, 0xe8) syz_emit_ethernet(0x2a, &(0x7f0000000640)={@random="b100485caa2a", @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x700}, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x1c, 0x0, 0x0, 0x0, 0x2, 0x0, @rand_addr, @broadcast}, @igmp={0x11, 0xffffffffffffffff, 0x0, @multicast1}}}}}, &(0x7f0000000140)) 01:56:12 executing program 5: perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1f}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000340)={&(0x7f0000000000), 0xc, &(0x7f0000000300)={&(0x7f0000000240)=@newlink={0x50, 0x10, 0x721, 0x0, 0x0, {0x0, 0x500}, [@IFLA_LINKINFO={0x28, 0x12, @veth={{0xc, 0x1, 'veth\x00'}, {0x18, 0x2, @VETH_INFO_PEER={0x14}}}}, @IFLA_NET_NS_FD={0x8}]}, 0x50}}, 0x0) 01:56:12 executing program 4: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) ioctl$sock_SIOCETHTOOL(r0, 0x8946, &(0x7f0000000040)={'bond0\x00', &(0x7f0000000240)=ANY=[@ANYBLOB="4c000000000023000000000000000002"]}) 01:56:12 executing program 0: socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000001f80)={0xffffffffffffffff, 0xffffffffffffffff}) setsockopt$SO_ATTACH_FILTER(r2, 0x1, 0x1a, &(0x7f0000ab9ff0)={0x2, &(0x7f000039a000)=[{0x20, 0x0, 0x0, 0xfffffffffffff010}, {0x6}]}, 0x10) sendmmsg(r1, &(0x7f0000001e80)=[{{&(0x7f0000000700)=@l2={0x1f, 0x0, {}, 0x0, 0xffffff7f00000000}, 0x80, &(0x7f0000001dc0)}}], 0x1, 0x0) 01:56:12 executing program 2: r0 = socket$inet(0x2, 0x3, 0x2) connect$inet(0xffffffffffffffff, &(0x7f0000000000)={0x2, 0x0, @local}, 0x10) setsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x23, &(0x7f0000000000)={{{@in=@multicast2, @in=@multicast1}}, {{@in6}, 0x0, @in6=@loopback}}, 0xe8) syz_emit_ethernet(0x2a, &(0x7f0000000640)={@random="b100485caa2a", @link_local, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x1c, 0x0, 0x0, 0x0, 0x2, 0x0, @rand_addr, @broadcast}, @igmp={0x11, 0x0, 0x0, @multicast1}}}}}, &(0x7f0000000140)={0x0, 0x0, [0x0, 0x2000000000000000]}) 01:56:12 executing program 7: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000180)='/dev/sequencer\x00', 0x10002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000080)="0a5cc80700315f85715070") r1 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000001c0)={0x2, 0x0, &(0x7f0000000140)=ANY=[@ANYBLOB='\fc'], 0x0, 0x0, &(0x7f0000000080)}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, &(0x7f00000001c0)}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000040)={0x8, 0xffffff7f, &(0x7f00000000c0)=[@release={0x400c630f}], 0x1, 0x0, &(0x7f0000000100)='V'}) fstat(r0, &(0x7f00000002c0)) 01:56:12 executing program 0: socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000001f80)={0xffffffffffffffff, 0xffffffffffffffff}) setsockopt$SO_ATTACH_FILTER(r2, 0x1, 0x1a, &(0x7f0000ab9ff0)={0x2, &(0x7f000039a000)=[{0x20, 0x0, 0x0, 0xfffffffffffff010}, {0x6}]}, 0x10) sendmmsg(r1, &(0x7f0000001e80)=[{{&(0x7f0000000700)=@l2={0x1f, 0x0, {}, 0x0, 0x400300}, 0x80, &(0x7f0000001dc0)}}], 0x1, 0x0) 01:56:12 executing program 4: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) ioctl$sock_SIOCETHTOOL(r0, 0x8946, &(0x7f0000000040)={'team0\x00', &(0x7f0000000000)=ANY=[@ANYBLOB="01e483615c0000230081f7ffc78f2e519eb9c62e00000000"]}) 01:56:12 executing program 5: perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1f}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000340)={&(0x7f0000000000), 0xc, &(0x7f0000000300)={&(0x7f0000000240)=@newlink={0x50, 0x10, 0x721, 0x0, 0x0, {0x0, 0xb40a}, [@IFLA_LINKINFO={0x28, 0x12, @veth={{0xc, 0x1, 'veth\x00'}, {0x18, 0x2, @VETH_INFO_PEER={0x14}}}}, @IFLA_NET_NS_FD={0x8}]}, 0x50}}, 0x0) [ 658.650407] binder: 12300:12302 Acquire 1 refcount change on invalid ref 0 ret -22 01:56:12 executing program 3: r0 = socket$inet(0x2, 0x3, 0x2) connect$inet(0xffffffffffffffff, &(0x7f0000000000)={0x2, 0x0, @local}, 0x10) setsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x23, &(0x7f0000000000)={{{@in=@multicast2, @in=@multicast1}}, {{@in6}, 0x0, @in6=@loopback}}, 0xe8) syz_emit_ethernet(0x2a, &(0x7f0000000640)={@random="b100485caa2a", @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x60}, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x1c, 0x0, 0x0, 0x0, 0x2, 0x0, @rand_addr, @broadcast}, @igmp={0x11, 0xffffffffffffffff, 0x0, @multicast1}}}}}, &(0x7f0000000140)) 01:56:12 executing program 2: r0 = socket$inet(0x2, 0x3, 0x2) connect$inet(0xffffffffffffffff, &(0x7f0000000000)={0x2, 0x0, @local}, 0x10) setsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x23, &(0x7f0000000000)={{{@in=@multicast2, @in=@multicast1}}, {{@in6}, 0x0, @in6=@loopback}}, 0xe8) syz_emit_ethernet(0x2a, &(0x7f0000000640)={@random="b100485caa2a", @link_local, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x1c, 0x0, 0x0, 0x0, 0x2, 0x0, @rand_addr, @broadcast}, @igmp={0x11, 0x0, 0x0, @multicast1}}}}}, &(0x7f0000000140)={0x0, 0x0, [0x0, 0x800000000000000]}) [ 658.699433] binder: 12300:12302 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 01:56:12 executing program 4: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) ioctl$sock_SIOCETHTOOL(r0, 0x8946, &(0x7f0000000040)={'bond0\x00', &(0x7f0000000240)=ANY=[@ANYBLOB="4c000000000023000000000000000002"]}) r1 = syz_open_dev$midi(&(0x7f0000000000)='/dev/midi#\x00', 0x4, 0x600040) ioctl$SCSI_IOCTL_GET_IDLUN(r1, 0x5382, &(0x7f0000000080)) 01:56:12 executing program 5: perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1f}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000340)={&(0x7f0000000000), 0xc, &(0x7f0000000300)={&(0x7f0000000240)=@newlink={0x50, 0x10, 0x721, 0x0, 0x0, {0x0, 0x4}, [@IFLA_LINKINFO={0x28, 0x12, @veth={{0xc, 0x1, 'veth\x00'}, {0x18, 0x2, @VETH_INFO_PEER={0x14}}}}, @IFLA_NET_NS_FD={0x8}]}, 0x50}}, 0x0) [ 658.816335] binder: 12300:12328 Acquire 1 refcount change on invalid ref 0 ret -22 01:56:12 executing program 1: syz_emit_ethernet(0x3e, &(0x7f0000000080)=ANY=[@ANYBLOB="ffffffffffff0180c200000086dd6050a09c00082b00fe8000000000000000000000000000bbfe80000000000000000000638fe26700000000aa0000000000089078"], &(0x7f0000000040)) 01:56:12 executing program 3: r0 = socket$inet(0x2, 0x3, 0x2) connect$inet(0xffffffffffffffff, &(0x7f0000000000)={0x2, 0x0, @local}, 0x10) setsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x23, &(0x7f0000000000)={{{@in=@multicast2, @in=@multicast1}}, {{@in6}, 0x0, @in6=@loopback}}, 0xe8) syz_emit_ethernet(0x2a, &(0x7f0000000640)={@random="b100485caa2a", @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x4000000000000000}, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x1c, 0x0, 0x0, 0x0, 0x2, 0x0, @rand_addr, @broadcast}, @igmp={0x11, 0xffffffffffffffff, 0x0, @multicast1}}}}}, &(0x7f0000000140)) [ 658.927355] binder: 12300:12328 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 01:56:13 executing program 6: r0 = syz_open_dev$sndseq(&(0x7f0000000100)='/dev/snd/seq\x00', 0x0, 0x0) read(r0, &(0x7f0000fb6000)=""/28, 0x3f0) ioctl$SNDRV_SEQ_IOCTL_REMOVE_EVENTS(r0, 0x4040534e, &(0x7f00000001c0)={0xbf}) ioctl$SNDRV_SEQ_IOCTL_QUERY_SUBS(r0, 0xc058534f, &(0x7f00000002c0)={{}, 0x1, 0x0, 0x0, {}, 0x0, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xe]}) r1 = gettid() timer_create(0x0, &(0x7f0000044000)={0x0, 0x12}, &(0x7f0000000040)) r2 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r2, 0x8912, &(0x7f00000001c0)="0a5cc80700315f85715070") timer_settime(0x0, 0x0, &(0x7f0000000080)={{0x0, 0x989680}, {0x0, 0x9}}, &(0x7f0000040000)) tkill(r1, 0x1000000000014) 01:56:13 executing program 2: r0 = socket$inet(0x2, 0x3, 0x2) connect$inet(0xffffffffffffffff, &(0x7f0000000000)={0x2, 0x0, @local}, 0x10) setsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x23, &(0x7f0000000000)={{{@in=@multicast2, @in=@multicast1}}, {{@in6}, 0x0, @in6=@loopback}}, 0xe8) syz_emit_ethernet(0x2a, &(0x7f0000000640)={@random="b100485caa2a", @link_local, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x1c, 0x0, 0x0, 0x0, 0x2, 0x0, @rand_addr, @broadcast}, @igmp={0x11, 0x0, 0x0, @multicast1}}}}}, &(0x7f0000000140)={0x0, 0x0, [0x0, 0x600000000000000]}) 01:56:13 executing program 0: socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000001f80)={0xffffffffffffffff, 0xffffffffffffffff}) setsockopt$SO_ATTACH_FILTER(r2, 0x1, 0x1a, &(0x7f0000ab9ff0)={0x2, &(0x7f000039a000)=[{0x20, 0x0, 0x0, 0xfffffffffffff010}, {0x6}]}, 0x10) sendmmsg(r1, &(0x7f0000001e80)=[{{&(0x7f0000000700)=@l2={0x1f, 0x0, {}, 0x0, 0x4}, 0x80, &(0x7f0000001dc0)}}], 0x1, 0x0) 01:56:13 executing program 4: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) ioctl$sock_SIOCETHTOOL(r0, 0x8946, &(0x7f0000000040)={'bond0\x00', &(0x7f0000000240)=ANY=[]}) 01:56:13 executing program 5: perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1f}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000340)={&(0x7f0000000000), 0xc, &(0x7f0000000300)={&(0x7f0000000240)=@newlink={0x50, 0x10, 0x721, 0x0, 0x0, {0x0, 0x6}, [@IFLA_LINKINFO={0x28, 0x12, @veth={{0xc, 0x1, 'veth\x00'}, {0x18, 0x2, @VETH_INFO_PEER={0x14}}}}, @IFLA_NET_NS_FD={0x8}]}, 0x50}}, 0x0) 01:56:13 executing program 3: r0 = socket$inet(0x2, 0x3, 0x2) connect$inet(0xffffffffffffffff, &(0x7f0000000000)={0x2, 0x0, @local}, 0x10) setsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x23, &(0x7f0000000000)={{{@in=@multicast2, @in=@multicast1}}, {{@in6}, 0x0, @in6=@loopback}}, 0xe8) syz_emit_ethernet(0x2a, &(0x7f0000000640)={@random="b100485caa2a", @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x300000000000000}, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x1c, 0x0, 0x0, 0x0, 0x2, 0x0, @rand_addr, @broadcast}, @igmp={0x11, 0xffffffffffffffff, 0x0, @multicast1}}}}}, &(0x7f0000000140)) 01:56:13 executing program 1: clone(0x906570047f0000, &(0x7f0000000000), &(0x7f00000000c0), &(0x7f0000000100), &(0x7f0000000140)) socketpair(0xf, 0x3, 0x3, &(0x7f0000000000)={0xffffffffffffffff}) ioctl$KVM_DEASSIGN_PCI_DEVICE(r0, 0x4040ae72, &(0x7f0000000040)={0x8001, 0x1ff, 0x3, 0x2, 0x401}) 01:56:13 executing program 7: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000180)='/dev/sequencer\x00', 0x10002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000080)="0a5cc80700315f85715070") r1 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000001c0)={0x2, 0x0, &(0x7f0000000140)=ANY=[@ANYBLOB='\fc'], 0x0, 0x0, &(0x7f0000000080)}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, &(0x7f00000001c0)}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000040)={0x8, 0x300000000000000, &(0x7f00000000c0)=[@release={0x400c630f}], 0x1, 0x0, &(0x7f0000000100)='V'}) fstat(r0, &(0x7f00000002c0)) 01:56:13 executing program 5: perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1f}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000340)={&(0x7f0000000000), 0xc, &(0x7f0000000300)={&(0x7f0000000240)=@newlink={0x50, 0x10, 0x721, 0x0, 0x0, {0x0, 0x700000000000000}, [@IFLA_LINKINFO={0x28, 0x12, @veth={{0xc, 0x1, 'veth\x00'}, {0x18, 0x2, @VETH_INFO_PEER={0x14}}}}, @IFLA_NET_NS_FD={0x8}]}, 0x50}}, 0x0) 01:56:13 executing program 4: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) ioctl$sock_SIOCETHTOOL(r0, 0x8946, &(0x7f0000000040)={'vcan0\x00', &(0x7f0000000000)=ANY=[@ANYRES32=r0, @ANYRES16=0x0]}) 01:56:13 executing program 2: r0 = socket$inet(0x2, 0x3, 0x2) connect$inet(0xffffffffffffffff, &(0x7f0000000000)={0x2, 0x0, @local}, 0x10) setsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x23, &(0x7f0000000000)={{{@in=@multicast2, @in=@multicast1}}, {{@in6}, 0x0, @in6=@loopback}}, 0xe8) syz_emit_ethernet(0x2a, &(0x7f0000000640)={@random="b100485caa2a", @link_local, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x1c, 0x0, 0x0, 0x0, 0x2, 0x0, @rand_addr, @broadcast}, @igmp={0x11, 0x0, 0x0, @multicast1}}}}}, &(0x7f0000000140)={0x0, 0x0, [0x0, 0x600]}) 01:56:13 executing program 3: r0 = socket$inet(0x2, 0x3, 0x2) connect$inet(0xffffffffffffffff, &(0x7f0000000000)={0x2, 0x0, @local}, 0x10) setsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x23, &(0x7f0000000000)={{{@in=@multicast2, @in=@multicast1}}, {{@in6}, 0x0, @in6=@loopback}}, 0xe8) syz_emit_ethernet(0x2a, &(0x7f0000000640)={@random="b100485caa2a", @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x4000000}, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x1c, 0x0, 0x0, 0x0, 0x2, 0x0, @rand_addr, @broadcast}, @igmp={0x11, 0xffffffffffffffff, 0x0, @multicast1}}}}}, &(0x7f0000000140)) 01:56:13 executing program 1: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000380)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) syz_kvm_setup_cpu$x86(r1, r2, &(0x7f0000fe8000/0x18000)=nil, &(0x7f0000000140)=[@textreal={0x8, &(0x7f0000000000)="baf80c66b868436c8e66efbafc0c66b80080000066ef3e0f22a53e0f01dff20f38f0d62e360f01cbb800008ed866b9800000c00f326635002000000f303e270f01c9f75eee", 0x45}], 0x174, 0x0, &(0x7f00000000c0)=[@dstype3={0x7, 0xe}], 0x1) r3 = socket$vsock_dgram(0x28, 0x2, 0x0) ioctl$sock_SIOCOUTQ(r3, 0x5411, &(0x7f0000000080)) ioctl$KVM_RUN(r2, 0xae80, 0x0) [ 659.579668] binder: 12377:12380 Acquire 1 refcount change on invalid ref 0 ret -22 [ 659.597529] binder: 12377:12380 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 01:56:13 executing program 0: socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000001f80)={0xffffffffffffffff, 0xffffffffffffffff}) setsockopt$SO_ATTACH_FILTER(r2, 0x1, 0x1a, &(0x7f0000ab9ff0)={0x2, &(0x7f000039a000)=[{0x20, 0x0, 0x0, 0xfffffffffffff010}, {0x6}]}, 0x10) sendmmsg(r1, &(0x7f0000001e80)=[{{&(0x7f0000000700)=@l2={0x1f, 0x0, {}, 0x0, 0xc000}, 0x80, &(0x7f0000001dc0)}}], 0x1, 0x0) 01:56:13 executing program 3: r0 = socket$inet(0x2, 0x3, 0x2) connect$inet(0xffffffffffffffff, &(0x7f0000000000)={0x2, 0x0, @local}, 0x10) setsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x23, &(0x7f0000000000)={{{@in=@multicast2, @in=@multicast1}}, {{@in6}, 0x0, @in6=@loopback}}, 0xe8) syz_emit_ethernet(0x2a, &(0x7f0000000640)={@random="b100485caa2a", @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0xe0000000}, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x1c, 0x0, 0x0, 0x0, 0x2, 0x0, @rand_addr, @broadcast}, @igmp={0x11, 0xffffffffffffffff, 0x0, @multicast1}}}}}, &(0x7f0000000140)) 01:56:13 executing program 5: perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1f}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000340)={&(0x7f0000000000), 0xc, &(0x7f0000000300)={&(0x7f0000000240)=@newlink={0x50, 0x10, 0x721, 0x0, 0x0, {0x0, 0x800000000000000}, [@IFLA_LINKINFO={0x28, 0x12, @veth={{0xc, 0x1, 'veth\x00'}, {0x18, 0x2, @VETH_INFO_PEER={0x14}}}}, @IFLA_NET_NS_FD={0x8}]}, 0x50}}, 0x0) [ 659.826778] binder: 12377:12402 Acquire 1 refcount change on invalid ref 0 ret -22 [ 659.898397] binder: 12377:12402 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 659.916502] binder: 12380 RLIMIT_NICE not set 01:56:14 executing program 6: r0 = syz_open_dev$sndseq(&(0x7f0000000100)='/dev/snd/seq\x00', 0x0, 0x0) read(r0, &(0x7f0000fb6000)=""/28, 0x3f0) ioctl$SNDRV_SEQ_IOCTL_REMOVE_EVENTS(r0, 0x4040534e, &(0x7f00000001c0)={0xbf}) ioctl$SNDRV_SEQ_IOCTL_QUERY_SUBS(r0, 0xc058534f, &(0x7f00000002c0)={{}, 0x1, 0x0, 0x0, {}, 0x0, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xe00000000000000]}) r1 = gettid() timer_create(0x0, &(0x7f0000044000)={0x0, 0x12}, &(0x7f0000000040)) r2 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r2, 0x8912, &(0x7f00000001c0)="0a5cc80700315f85715070") timer_settime(0x0, 0x0, &(0x7f0000000080)={{0x0, 0x989680}, {0x0, 0x9}}, &(0x7f0000040000)) tkill(r1, 0x1000000000014) 01:56:14 executing program 4: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) openat$ipvs(0xffffffffffffff9c, &(0x7f0000000000)='/proc/sys/net/ipv4/vs/amemthresh\x00', 0x2, 0x0) ioctl$sock_SIOCETHTOOL(r0, 0x8946, &(0x7f0000000040)={'bond0\x00', &(0x7f0000000240)=ANY=[@ANYBLOB="4c000000000023000000000000000002"]}) 01:56:14 executing program 2: r0 = socket$inet(0x2, 0x3, 0x2) connect$inet(0xffffffffffffffff, &(0x7f0000000000)={0x2, 0x0, @local}, 0x10) setsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x23, &(0x7f0000000000)={{{@in=@multicast2, @in=@multicast1}}, {{@in6}, 0x0, @in6=@loopback}}, 0xe8) syz_emit_ethernet(0x2a, &(0x7f0000000640)={@random="b100485caa2a", @link_local, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x1c, 0x0, 0x0, 0x0, 0x2, 0x0, @rand_addr, @broadcast}, @igmp={0x11, 0x0, 0x0, @multicast1}}}}}, &(0x7f0000000140)={0x0, 0x0, [0x0, 0x4]}) 01:56:14 executing program 3: r0 = socket$inet(0x2, 0x3, 0x2) connect$inet(0xffffffffffffffff, &(0x7f0000000000)={0x2, 0x0, @local}, 0x10) setsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x23, &(0x7f0000000000)={{{@in=@multicast2, @in=@multicast1}}, {{@in6}, 0x0, @in6=@loopback}}, 0xe8) syz_emit_ethernet(0x2a, &(0x7f0000000640)={@random="b100485caa2a", @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x7000000}, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x1c, 0x0, 0x0, 0x0, 0x2, 0x0, @rand_addr, @broadcast}, @igmp={0x11, 0xffffffffffffffff, 0x0, @multicast1}}}}}, &(0x7f0000000140)) 01:56:14 executing program 5: perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1f}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000340)={&(0x7f0000000000), 0xc, &(0x7f0000000300)={&(0x7f0000000240)=@newlink={0x50, 0x10, 0x721, 0x0, 0x0, {0x0, 0x400300}, [@IFLA_LINKINFO={0x28, 0x12, @veth={{0xc, 0x1, 'veth\x00'}, {0x18, 0x2, @VETH_INFO_PEER={0x14}}}}, @IFLA_NET_NS_FD={0x8}]}, 0x50}}, 0x0) 01:56:14 executing program 1: socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = socket$inet(0x10, 0x2, 0x40000000000010) sendmsg(r2, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000017000)=[{&(0x7f0000004000)="240000001d0003ffff3cc0023da2830101faffffff86c436271d8568b51ba3a2d188737e", 0x24}], 0x1}, 0x0) recvmmsg(r2, &(0x7f0000009040)=[{{&(0x7f0000000040)=@pppol2tpv3in6={0x18, 0x1, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, {0xa, 0x0, 0x0, @mcast1}}}, 0x57, &(0x7f0000003e00), 0x0, &(0x7f0000000100)=""/124, 0x2c}}], 0x400000000000207, 0x2, &(0x7f00000000c0)={0x77359400}) fcntl$F_SET_RW_HINT(r0, 0x40c, &(0x7f0000000000)) 01:56:14 executing program 0: socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000001f80)={0xffffffffffffffff, 0xffffffffffffffff}) setsockopt$SO_ATTACH_FILTER(r2, 0x1, 0x1a, &(0x7f0000ab9ff0)={0x2, &(0x7f000039a000)=[{0x20, 0x0, 0x0, 0xfffffffffffff010}, {0x6}]}, 0x10) sendmmsg(r1, &(0x7f0000001e80)=[{{&(0x7f0000000700)=@l2={0x1f, 0x0, {}, 0x0, 0x4000000000000}, 0x80, &(0x7f0000001dc0)}}], 0x1, 0x0) 01:56:14 executing program 7: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000180)='/dev/sequencer\x00', 0x10002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000080)="0a5cc80700315f85715070") r1 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000001c0)={0x2, 0x0, &(0x7f0000000140)=ANY=[@ANYBLOB='\fc'], 0x0, 0x0, &(0x7f0000000080)}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, &(0x7f00000001c0)}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000040)={0x8, 0x4800000000000000, &(0x7f00000000c0)=[@release={0x400c630f}], 0x1, 0x0, &(0x7f0000000100)='V'}) fstat(r0, &(0x7f00000002c0)) 01:56:14 executing program 5: perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1f}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000340)={&(0x7f0000000000), 0xc, &(0x7f0000000300)={&(0x7f0000000240)=@newlink={0x50, 0x10, 0x721, 0x0, 0x0, {0x0, 0xfffffff0}, [@IFLA_LINKINFO={0x28, 0x12, @veth={{0xc, 0x1, 'veth\x00'}, {0x18, 0x2, @VETH_INFO_PEER={0x14}}}}, @IFLA_NET_NS_FD={0x8}]}, 0x50}}, 0x0) [ 660.444457] netlink: 16 bytes leftover after parsing attributes in process `syz-executor1'. 01:56:14 executing program 4: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) r1 = dup2(r0, r0) setsockopt$inet_mreqsrc(r1, 0x0, 0x2f, &(0x7f0000000000)={@empty, @local, @multicast1}, 0xc) getsockopt$inet_sctp6_SCTP_I_WANT_MAPPED_V4_ADDR(r1, 0x84, 0xc, &(0x7f0000000080), &(0x7f00000000c0)=0x4) sendto$inet(r1, &(0x7f0000000100)="8bfd042b7143185a3eb9383963a4b1d8961a868e1cb4324b61bde1a38821e05cc127cae45cc02f178f892f5a94d9e81b4b5bd2a0ba3b", 0x36, 0x80, &(0x7f0000000140)={0x2, 0x4e24, @remote}, 0x10) ioctl$sock_SIOCETHTOOL(r1, 0x8946, &(0x7f0000000040)={'bond0\x00', &(0x7f0000000240)=ANY=[@ANYBLOB="4c000000000023000000000000000002"]}) getsockopt$inet_IP_IPSEC_POLICY(r1, 0x0, 0x10, &(0x7f0000000280)={{{@in6, @in6=@local}}, {{@in6=@local}, 0x0, @in6=@ipv4={[], [], @dev}}}, &(0x7f0000000180)=0xe8) 01:56:14 executing program 2: r0 = socket$inet(0x2, 0x3, 0x2) connect$inet(0xffffffffffffffff, &(0x7f0000000000)={0x2, 0x0, @local}, 0x10) setsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x23, &(0x7f0000000000)={{{@in=@multicast2, @in=@multicast1}}, {{@in6}, 0x0, @in6=@loopback}}, 0xe8) syz_emit_ethernet(0x2a, &(0x7f0000000640)={@random="b100485caa2a", @link_local, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x1c, 0x0, 0x0, 0x0, 0x2, 0x0, @rand_addr, @broadcast}, @igmp={0x11, 0x0, 0x0, @multicast1}}}}}, &(0x7f0000000140)={0x0, 0x0, [0x0, 0x6]}) 01:56:14 executing program 3: r0 = socket$inet(0x2, 0x3, 0x2) connect$inet(0xffffffffffffffff, &(0x7f0000000000)={0x2, 0x0, @local}, 0x10) setsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x23, &(0x7f0000000000)={{{@in=@multicast2, @in=@multicast1}}, {{@in6}, 0x0, @in6=@loopback}}, 0xe8) syz_emit_ethernet(0x2a, &(0x7f0000000640)={@random="b100485caa2a", @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x40000000}, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x1c, 0x0, 0x0, 0x0, 0x2, 0x0, @rand_addr, @broadcast}, @igmp={0x11, 0xffffffffffffffff, 0x0, @multicast1}}}}}, &(0x7f0000000140)) [ 660.514656] netlink: 16 bytes leftover after parsing attributes in process `syz-executor1'. [ 660.516321] binder: 12444:12445 Acquire 1 refcount change on invalid ref 0 ret -22 01:56:14 executing program 5: perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1f}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000340)={&(0x7f0000000000), 0xc, &(0x7f0000000300)={&(0x7f0000000240)=@newlink={0x50, 0x10, 0x721, 0x0, 0x0, {0x0, 0x9effffff00000000}, [@IFLA_LINKINFO={0x28, 0x12, @veth={{0xc, 0x1, 'veth\x00'}, {0x18, 0x2, @VETH_INFO_PEER={0x14}}}}, @IFLA_NET_NS_FD={0x8}]}, 0x50}}, 0x0) 01:56:14 executing program 1: r0 = socket$inet6(0xa, 0x5, 0x7) ioctl(r0, 0x8000008912, &(0x7f0000000400)="025c3f0a00145f8f764070") r1 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r1, 0x6, 0x13, &(0x7f00000000c0)=0x100000001, 0x1d4) connect$inet6(r1, &(0x7f0000000080), 0x1c) setsockopt$inet6_tcp_TCP_ULP(r1, 0x6, 0x1f, &(0x7f0000006580)='tls\x00', 0x95d59845436eab44) setsockopt$inet6_tcp_TLS_TX(r1, 0x11a, 0x1, &(0x7f0000000100), 0x28) sendto$inet6(r1, &(0x7f00000002c0)="b7", 0x1, 0x8000, &(0x7f0000000340)={0xa, 0x0, 0x0, @mcast1}, 0x1c) sendto(r1, &(0x7f0000000040)="f19854f687e485e533c79e7de55106360e", 0x11, 0x0, &(0x7f0000000380)=@rc, 0x80) [ 660.596528] binder: 12444:12445 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 01:56:14 executing program 0: socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000001f80)={0xffffffffffffffff, 0xffffffffffffffff}) setsockopt$SO_ATTACH_FILTER(r2, 0x1, 0x1a, &(0x7f0000ab9ff0)={0x2, &(0x7f000039a000)=[{0x20, 0x0, 0x0, 0xfffffffffffff010}, {0x6}]}, 0x10) sendmmsg(r1, &(0x7f0000001e80)=[{{&(0x7f0000000700)=@l2={0x1f, 0x0, {}, 0x0, 0xc03e000000000000}, 0x80, &(0x7f0000001dc0)}}], 0x1, 0x0) 01:56:14 executing program 4: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) ioctl$sock_SIOCETHTOOL(r0, 0x8946, &(0x7f0000000040)={'bond0\x00', &(0x7f0000000000)=ANY=[@ANYBLOB="4c00000000002300073e9b4b69fa320000000000000002756bf81aefd03ccca46ff156122d3b2d80f1a392a304fa6610d757dc8b2b8bc0d24f2347611affb53f"]}) prctl$getname(0x10, &(0x7f00000000c0)=""/162) r1 = semget(0x1, 0x2, 0x0) r2 = openat$pfkey(0xffffffffffffff9c, &(0x7f0000000180)='/proc/self/net/pfkey\x00', 0x2, 0x0) ioctl$KVM_SIGNAL_MSI(r2, 0x4020aea5, &(0x7f00000001c0)={0x103000, 0x1, 0x401, 0xeb5a, 0xffffffff}) semctl$SEM_INFO(r1, 0x0, 0x13, &(0x7f0000000080)=""/57) [ 660.678121] binder: 12444:12460 Acquire 1 refcount change on invalid ref 0 ret -22 [ 660.775600] binder: 12445 RLIMIT_NICE not set [ 660.808670] binder: 12444:12460 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 01:56:15 executing program 5: perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1f}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000340)={&(0x7f0000000000), 0xc, &(0x7f0000000300)={&(0x7f0000000240)=@newlink={0x50, 0x10, 0x721, 0x0, 0x0, {0x0, 0x8}, [@IFLA_LINKINFO={0x28, 0x12, @veth={{0xc, 0x1, 'veth\x00'}, {0x18, 0x2, @VETH_INFO_PEER={0x14}}}}, @IFLA_NET_NS_FD={0x8}]}, 0x50}}, 0x0) 01:56:15 executing program 2: r0 = socket$inet(0x2, 0x3, 0x2) connect$inet(0xffffffffffffffff, &(0x7f0000000000)={0x2, 0x0, @local}, 0x10) setsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x23, &(0x7f0000000000)={{{@in=@multicast2, @in=@multicast1}}, {{@in6}, 0x0, @in6=@loopback}}, 0xe8) syz_emit_ethernet(0x2a, &(0x7f0000000640)={@random="b100485caa2a", @link_local, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x1c, 0x0, 0x0, 0x0, 0x2, 0x0, @rand_addr, @broadcast}, @igmp={0x11, 0x0, 0x0, @multicast1}}}}}, &(0x7f0000000140)={0x0, 0x0, [0x0, 0x6000000000000000]}) 01:56:15 executing program 6: r0 = syz_open_dev$sndseq(&(0x7f0000000100)='/dev/snd/seq\x00', 0x0, 0x0) read(r0, &(0x7f0000fb6000)=""/28, 0x3f0) ioctl$SNDRV_SEQ_IOCTL_REMOVE_EVENTS(r0, 0x4040534e, &(0x7f00000001c0)={0xbf}) ioctl$SNDRV_SEQ_IOCTL_QUERY_SUBS(r0, 0xc058534f, &(0x7f00000002c0)={{}, 0x1, 0x0, 0x0, {}, 0x0, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xbf00000000000000]}) r1 = gettid() timer_create(0x0, &(0x7f0000044000)={0x0, 0x12}, &(0x7f0000000040)) r2 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r2, 0x8912, &(0x7f00000001c0)="0a5cc80700315f85715070") timer_settime(0x0, 0x0, &(0x7f0000000080)={{0x0, 0x989680}, {0x0, 0x9}}, &(0x7f0000040000)) tkill(r1, 0x1000000000014) 01:56:15 executing program 3: r0 = socket$inet(0x2, 0x3, 0x2) connect$inet(0xffffffffffffffff, &(0x7f0000000000)={0x2, 0x0, @local}, 0x10) setsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x23, &(0x7f0000000000)={{{@in=@multicast2, @in=@multicast1}}, {{@in6}, 0x0, @in6=@loopback}}, 0xe8) syz_emit_ethernet(0x2a, &(0x7f0000000640)={@random="b100485caa2a", @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0xf0}, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x1c, 0x0, 0x0, 0x0, 0x2, 0x0, @rand_addr, @broadcast}, @igmp={0x11, 0xffffffffffffffff, 0x0, @multicast1}}}}}, &(0x7f0000000140)) 01:56:15 executing program 4: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) r1 = syz_open_dev$dmmidi(&(0x7f0000000100)='/dev/dmmidi#\x00', 0x20, 0x2040) getsockopt$inet_sctp_SCTP_SOCKOPT_CONNECTX3(0xffffffffffffffff, 0x84, 0x6f, &(0x7f0000000180)={0x0, 0x1c, &(0x7f0000000140)=[@in6={0xa, 0x4e20, 0x3ff, @ipv4={[], [], @broadcast}, 0x9}]}, &(0x7f00000001c0)=0x10) setsockopt$inet_sctp6_SCTP_DEFAULT_PRINFO(r1, 0x84, 0x72, &(0x7f0000000200)={r2, 0x9, 0x30}, 0xc) ioctl$sock_SIOCETHTOOL(r0, 0x8946, &(0x7f0000000040)={'bond0\x00', &(0x7f0000000240)=ANY=[@ANYBLOB="4c000000000023000000000000000002"]}) 01:56:15 executing program 0: socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000001f80)={0xffffffffffffffff, 0xffffffffffffffff}) setsockopt$SO_ATTACH_FILTER(r2, 0x1, 0x1a, &(0x7f0000ab9ff0)={0x2, &(0x7f000039a000)=[{0x20, 0x0, 0x0, 0xfffffffffffff010}, {0x6}]}, 0x10) sendmmsg(r1, &(0x7f0000001e80)=[{{&(0x7f0000000700)=@l2={0x1f, 0x0, {}, 0x0, 0xc000000000000000}, 0x80, &(0x7f0000001dc0)}}], 0x1, 0x0) 01:56:15 executing program 7: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000180)='/dev/sequencer\x00', 0x10002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000080)="0a5cc80700315f85715070") r1 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000001c0)={0x2, 0x0, &(0x7f0000000140)=ANY=[@ANYBLOB='\fc'], 0x0, 0x0, &(0x7f0000000080)}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, &(0x7f00000001c0)}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000040)={0x8, 0x48000000, &(0x7f00000000c0)=[@release={0x400c630f}], 0x1, 0x0, &(0x7f0000000100)='V'}) fstat(r0, &(0x7f00000002c0)) 01:56:15 executing program 1: io_setup(0x8000000100000086, &(0x7f0000000800)) mkdir(&(0x7f0000000700)='./file0\x00', 0x0) mount(&(0x7f00000000c0)='./file0//ile0\x00', &(0x7f0000000080)='./file0\x00', &(0x7f0000000200)='cgroup2\x00', 0x0, 0x0) r0 = openat$autofs(0xffffffffffffff9c, &(0x7f0000000240)='/dev/autofs\x00', 0x40, 0x0) r1 = open(&(0x7f0000000380)='./file0\x00', 0x0, 0x0) r2 = openat$cgroup_procs(r1, &(0x7f0000000180)='cgroup.procs\x00', 0x2, 0x0) ioctl$EVIOCSMASK(r1, 0x40104593, &(0x7f00000001c0)={0x15, 0xb6, &(0x7f00000002c0)="a9cc61c8c45001e8f05b383ddd6ac26f77d4f8ce2f4048b2891b5859d4aea5a8a87f065624b09985642ceed3a97e9fc61b04f8abdf706c82d2ce4789d5602c51972bf7abd3f126f9ce6b6fa06d140c6ebabd3834c1aec8a7b5c74860421764bd4af666fda217916181e01711be3bccb9175eb055cf2a2365996efd44e89701892648f9aa962d7826211c2a229e499619e0a8c1c36cd6090de7fe3195660740181e5c2ca901fcc0c33e5c7bb5cca0d0bcc2197de30cae"}) write$cgroup_pid(r2, &(0x7f0000000100), 0x12) r3 = syz_open_dev$sndseq(&(0x7f0000000100)='/dev/snd/seq\x00', 0x0, 0x0) r4 = openat$sequencer(0xffffffffffffff9c, &(0x7f0000000140)='/dev/sequencer\x00', 0x0, 0x0) getsockopt$inet_sctp6_SCTP_RECVNXTINFO(r4, 0x84, 0x21, &(0x7f0000000940), &(0x7f0000000980)=0x4) fcntl$getownex(r0, 0x10, &(0x7f0000000880)={0x0, 0x0}) timer_create(0x0, &(0x7f00000008c0)={0x0, 0x31, 0x0, @tid=r5}, &(0x7f0000000900)) read(r3, &(0x7f0000000200)=""/28, 0x1c) setsockopt$l2tp_PPPOL2TP_SO_REORDERTO(r1, 0x111, 0x5, 0x538f9490, 0x4) ioctl$SNDRV_SEQ_IOCTL_REMOVE_EVENTS(r3, 0x4040534e, &(0x7f00000003c0)={0xbf}) ioctl$SNDRV_SEQ_IOCTL_CREATE_QUEUE(r3, 0xc05c5340, &(0x7f0000000480)={0x0, 0x0, 0x0, "717565756531000000000000001f0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000004000"}) r6 = gettid() clock_gettime(0x0, &(0x7f0000000740)={0x0, 0x0}) clock_gettime(0x3, &(0x7f0000000780)={0x0, 0x0}) utimensat(r1, &(0x7f0000000000)='./file0\x00', &(0x7f00000007c0)={{r7, r8/1000+30000}, {r9, r10/1000+30000}}, 0x0) timer_create(0x9, &(0x7f0000044000)={0x0, 0x12}, &(0x7f0000000040)) ioctl$UFFDIO_UNREGISTER(r1, 0x8010aa01, &(0x7f00000009c0)={&(0x7f0000ffe000/0x1000)=nil, 0x1000}) timer_settime(0x0, 0x0, &(0x7f0000000080)={{0x0, 0x989680}, {0x0, 0x9}}, &(0x7f0000040000)) tkill(r6, 0x1000000000013) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000280)='/dev/sequencer\x00', 0x0, 0x0) clock_gettime(0x0, &(0x7f0000000540)={0x0, 0x0}) bind$pptp(r1, &(0x7f0000000840)={0x18, 0x2, {0x0, @remote}}, 0x1e) write$sndseq(r4, &(0x7f00000005c0)=[{0x1, 0x80000001, 0xa80, 0x200, @time={0x77359400}, {0x5, 0x7}, {0x3, 0x7ff}, @quote={{0x8, 0x40}, 0xf47c, &(0x7f0000000440)={0x8001, 0x5, 0xffffffffffffae43, 0x400000000000000, @tick=0x7, {0xffffffff, 0x101}, {0xfffffffffffffff9, 0x5e4}, @result={0x0, 0xffffffffffff379f}}}}, {0x4, 0x80, 0x7, 0x1, @tick=0x10001, {0x6, 0xc6c}, {0x101, 0xcf7}, @control={0xff, 0x7, 0x365}}, {0x1000, 0x3, 0x1, 0x101, @time={0x77359400}, {0x8, 0x40}, {0x8, 0x10000}, @queue={0x40, {0x6}}}, {0x9, 0x4, 0x3, 0x4, @time={0x77359400}, {0x4, 0x8}, {0x3f, 0x40}, @connect={{0x6, 0x9840}, {0x9, 0xfffffffffffffffc}}}, {0xff, 0x7, 0xb5ef, 0x1, @time={r11, r12+10000000}, {0x0, 0x4}, {0x2, 0x3ff}, @ext={0x1a, &(0x7f0000000580)="42f487e7bffb8cba090c316b3e5fa72685687e6e71202a50945b"}}, {0x0, 0x95db, 0x7fffffff, 0x0, @time, {0x80000001, 0x4}, {0x4, 0x3}, @queue={0x4, {0x3, 0x4}}}], 0x120) 01:56:15 executing program 4: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) ioctl$sock_SIOCETHTOOL(r0, 0x8946, &(0x7f0000000040)={'bond0\x00', &(0x7f0000000540)=ANY=[@ANYBLOB="4c00000000002300000b00000000000000c526b69749453e94b54c1e22c40faf464648d23f18f3f6a9483bdc12cc3885f602cd66f8517779917058b2f651cdb1187a9f120d0e19e35f8833f59d30ed2c86d9444943ac65ba30f1bb7c24f155e29191e3a88e7d4f133e046cf1d3fde549b20f8ad233119923db0d5b08ec0df3fa618918db11991296530f5f9c90641a198ccaa3eb027602af52b8ec467db20dad72ee36e5e3b695db7166e8ade49dc7430828b41adf1d8eddaade78caa983afffcb420d1ec4db716b3951535d242f11c8775ce74f7f093572c0dec54f36e7da4f97be89bc65d07e42d194a5830840fca071"]}) gettid() r1 = getpgid(0x0) ioctl$TIOCGSID(0xffffffffffffffff, 0x5429, &(0x7f0000000200)) r2 = openat$zero(0xffffffffffffff9c, &(0x7f00000002c0)='/dev/zero\x00', 0x140, 0x0) linkat(r2, &(0x7f0000000380)='./file0\x00', r2, &(0x7f0000000500)='./file0\x00', 0x1000) r3 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000340)='IPVS\x00') sendmsg$IPVS_CMD_ZERO(r2, &(0x7f0000000400)={&(0x7f0000000300)={0x10, 0x0, 0x0, 0x20008018}, 0xc, &(0x7f00000003c0)={&(0x7f0000000440)=ANY=[@ANYBLOB=' \x00\x00\x00', @ANYRES16=r3, @ANYBLOB="010027bd7000fddbdf25100000000c0001000800020073000000a9dd70"], 0x20}, 0x1, 0x0, 0x0, 0x1}, 0x800) fcntl$getownex(r0, 0x10, &(0x7f0000000240)) gettid() ioctl$sock_SIOCGPGRP(r0, 0x8904, &(0x7f0000000280)=0x0) openat$mixer(0xffffffffffffff9c, &(0x7f0000000080)='/dev/mixer\x00', 0x200, 0x0) r5 = getpgid(r4) ptrace$PTRACE_SECCOMP_GET_METADATA(0x420d, r5, 0x10, &(0x7f0000000000)={0xa0a8}) r6 = syz_open_dev$dmmidi(&(0x7f0000000100)='/dev/dmmidi#\x00', 0x2000000000f577, 0x400000) perf_event_open(&(0x7f0000000480)={0x7, 0x70, 0x8, 0xffff, 0xea, 0x0, 0x0, 0x6, 0x8, 0x4, 0x5, 0x0, 0xfffffffffffffffa, 0x191d, 0x100, 0x6, 0x3, 0x1f, 0x9, 0x28, 0x2, 0x1, 0x9, 0x0, 0x73, 0x5, 0x10000, 0x0, 0x100000001, 0x7, 0x1, 0x93, 0x68dc, 0x100000000, 0x55c4, 0x4, 0xa7, 0x0, 0x0, 0x1, 0x1, @perf_config_ext={0xdd27, 0x9}, 0x804, 0x3, 0x2, 0x0, 0x1, 0x8000000, 0x1400000}, r1, 0xf, r6, 0x8) getpgid(r4) ioctl$TIOCSPGRP(r6, 0x5410, &(0x7f00000000c0)=r5) 01:56:15 executing program 2: r0 = socket$inet(0x2, 0x3, 0x2) connect$inet(0xffffffffffffffff, &(0x7f0000000000)={0x2, 0x0, @local}, 0x10) setsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x23, &(0x7f0000000000)={{{@in=@multicast2, @in=@multicast1}}, {{@in6}, 0x0, @in6=@loopback}}, 0xe8) syz_emit_ethernet(0x2a, &(0x7f0000000640)={@random="b100485caa2a", @link_local, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x1c, 0x0, 0x0, 0x0, 0x2, 0x0, @rand_addr, @broadcast}, @igmp={0x11, 0x0, 0x0, @multicast1}}}}}, &(0x7f0000000140)={0x0, 0x0, [0x0, 0x60000000]}) 01:56:15 executing program 5: perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1f}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000340)={&(0x7f0000000000), 0xc, &(0x7f0000000300)={&(0x7f0000000240)=@newlink={0x50, 0x10, 0x721, 0x0, 0x0, {0x0, 0x600000000000000}, [@IFLA_LINKINFO={0x28, 0x12, @veth={{0xc, 0x1, 'veth\x00'}, {0x18, 0x2, @VETH_INFO_PEER={0x14}}}}, @IFLA_NET_NS_FD={0x8}]}, 0x50}}, 0x0) 01:56:15 executing program 3: r0 = socket$inet(0x2, 0x3, 0x2) connect$inet(0xffffffffffffffff, &(0x7f0000000000)={0x2, 0x0, @local}, 0x10) setsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x23, &(0x7f0000000000)={{{@in=@multicast2, @in=@multicast1}}, {{@in6}, 0x0, @in6=@loopback}}, 0xe8) syz_emit_ethernet(0x2a, &(0x7f0000000640)={@random="b100485caa2a", @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x1c}, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x1c, 0x0, 0x0, 0x0, 0x2, 0x0, @rand_addr, @broadcast}, @igmp={0x11, 0xffffffffffffffff, 0x0, @multicast1}}}}}, &(0x7f0000000140)) [ 661.394967] binder: 12509:12516 Acquire 1 refcount change on invalid ref 0 ret -22 01:56:15 executing program 0: socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000001f80)={0xffffffffffffffff, 0xffffffffffffffff}) setsockopt$SO_ATTACH_FILTER(r2, 0x1, 0x1a, &(0x7f0000ab9ff0)={0x2, &(0x7f000039a000)=[{0x20, 0x0, 0x0, 0xfffffffffffff010}, {0x6}]}, 0x10) sendmmsg(r1, &(0x7f0000001e80)=[{{&(0x7f0000000700)=@l2={0x1f, 0x0, {}, 0x0, 0xc03e0000}, 0x80, &(0x7f0000001dc0)}}], 0x1, 0x0) 01:56:15 executing program 1: perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x3e3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10000003, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$l2tp(0x18, 0x1, 0x1) connect$l2tp(r0, &(0x7f0000000000)=@pppol2tpv3in6={0x18, 0x1, {0x0, r0, 0x3, 0x0, 0x2, 0x0, {0xa, 0x4e23, 0x1, @dev={0xfe, 0x80, [], 0x12}, 0x1}}}, 0x3a) r1 = open(&(0x7f0000000040)='./file0\x00', 0x80, 0x120) write$P9_RSTATFS(r1, &(0x7f0000000080)={0x43, 0x9, 0x2, {0xfffffffffffff801, 0x7f80000, 0x220, 0x8, 0x560f, 0x189, 0x100000000, 0x0, 0x5}}, 0x43) 01:56:15 executing program 4: ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000040)={'bond0\x00', &(0x7f0000000240)=ANY=[@ANYBLOB="4c000000000023000000000000000002"]}) 01:56:15 executing program 2: r0 = socket$inet(0x2, 0x3, 0x2) connect$inet(0xffffffffffffffff, &(0x7f0000000000)={0x2, 0x0, @local}, 0x10) setsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x23, &(0x7f0000000000)={{{@in=@multicast2, @in=@multicast1}}, {{@in6}, 0x0, @in6=@loopback}}, 0xe8) syz_emit_ethernet(0x2a, &(0x7f0000000640)={@random="b100485caa2a", @link_local, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x1c, 0x0, 0x0, 0x0, 0x2, 0x0, @rand_addr, @broadcast}, @igmp={0x11, 0x0, 0x0, @multicast1}}}}}, &(0x7f0000000140)={0x0, 0x0, [0x0, 0xe0000000]}) 01:56:15 executing program 5: perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1f}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000340)={&(0x7f0000000000), 0xc, &(0x7f0000000300)={&(0x7f0000000240)=@newlink={0x50, 0x10, 0x721, 0x0, 0x0, {0x0, 0xf00000000000000}, [@IFLA_LINKINFO={0x28, 0x12, @veth={{0xc, 0x1, 'veth\x00'}, {0x18, 0x2, @VETH_INFO_PEER={0x14}}}}, @IFLA_NET_NS_FD={0x8}]}, 0x50}}, 0x0) 01:56:15 executing program 3: r0 = socket$inet(0x2, 0x3, 0x2) connect$inet(0xffffffffffffffff, &(0x7f0000000000)={0x2, 0x0, @local}, 0x10) setsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x23, &(0x7f0000000000)={{{@in=@multicast2, @in=@multicast1}}, {{@in6}, 0x0, @in6=@loopback}}, 0xe8) syz_emit_ethernet(0x2a, &(0x7f0000000640)={@random="b100485caa2a", @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x600000000000000}, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x1c, 0x0, 0x0, 0x0, 0x2, 0x0, @rand_addr, @broadcast}, @igmp={0x11, 0xffffffffffffffff, 0x0, @multicast1}}}}}, &(0x7f0000000140)) [ 661.647260] binder: 12509:12516 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 661.763139] binder: 12509:12554 Acquire 1 refcount change on invalid ref 0 ret -22 [ 661.811445] binder: 12509:12554 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 661.832522] binder: 12516 RLIMIT_NICE not set 01:56:16 executing program 6: r0 = syz_open_dev$sndseq(&(0x7f0000000100)='/dev/snd/seq\x00', 0x0, 0x0) read(r0, &(0x7f0000fb6000)=""/28, 0x3f0) ioctl$SNDRV_SEQ_IOCTL_REMOVE_EVENTS(r0, 0x4040534e, &(0x7f00000001c0)={0xbf}) ioctl$SNDRV_SEQ_IOCTL_QUERY_SUBS(r0, 0xc058534f, &(0x7f00000002c0)={{}, 0x1, 0x0, 0x0, {}, 0x0, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xbf00000000000000]}) r1 = gettid() timer_create(0x0, &(0x7f0000044000)={0x0, 0x12}, &(0x7f0000000040)) r2 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r2, 0x8912, &(0x7f00000001c0)="0a5cc80700315f85715070") timer_settime(0x0, 0x0, &(0x7f0000000080)={{0x0, 0x989680}, {0x0, 0x9}}, &(0x7f0000040000)) tkill(r1, 0x1000000000014) 01:56:16 executing program 1: r0 = socket$key(0xf, 0x3, 0x2) r1 = openat$userio(0xffffffffffffff9c, &(0x7f0000000080)='/dev/userio\x00', 0x400000, 0x0) ioctl$KIOCSOUND(r1, 0x4b2f, 0xfff) sendmsg$key(r0, &(0x7f0000f56000)={0x0, 0x0, &(0x7f00008feff0)={&(0x7f0000000000)=ANY=[@ANYBLOB="020300000a0000000000000000000000030006000000577d010a0ea917df1d4d643fc700000200005de0000001000000000000000002000100000000000000ff00000000000300050000000000020000"], 0x50}}, 0x0) sendmsg$key(r1, &(0x7f00000011c0)={0x0, 0x0, &(0x7f0000001180)={&(0x7f00000000c0)={0x2, 0x14, 0x5, 0x8, 0x212, 0x0, 0x70bd26, 0x25dfdbff, [@sadb_x_nat_t_type={0x1, 0x14, 0x3}, @sadb_x_sec_ctx={0x1, 0x18, 0xffffffff80000000, 0x3f}, @sadb_x_sec_ctx={0x201, 0x18, 0x0, 0x100000000, 0x1000, "07784b96de1e9722bb5ce2b4270dc9bca50e55fb2f92282466d116abeb5aad4b790c06c93bde51f1e7090e8f655f7bf84d91efa16e6976aedb91fac6aa29e608cca04a7b28c1bd3117b19a7cc0779532e645ce5c140c2bcc5c6f72951a70fb0be944528c412c5baebc450a70b0d725d6f3a150b4bb6fe30948336b6c611dd33a8b773304f34ff6707c261c446bbf513888ae0437b0946663ea82fb63d0b914595626fbeb3439bfd0a49fc1c561fd7f456b86ffa387728c188800489ef99bf4071dc4649499b7c8ad54315a7470bd9abc21053165ea10ee528ffba0d19c2afeab9319b4b2d0ce14e38b47bebf1a3bd5e6f10256b78f12f91c4290bad1ee5df628e033dee2fb089960a0a98ad869c7ab1e7bc1f0dd51f4cbf6c4674e818d60356561242f361c3da19cca04e90091cbf5b6e5b0be98f14b34f52b76a25049474d1885286ea1400efb1e43ddc9f94d739a4d5a1666009b41d3b19b3d992a410616a9c8de9174aedb6cfed9cc3cf5a6a2bc636888a1709f01c5e39aedf5265017099e5152ecdd4e7519f9c8a29207f8c5c1c0752577037a26ca5497664a439f10aade02fd7364e3cb72f700fa3a41b435f778ed91c86f48a64575a19948c05fa2916248bef3b081872a8b3944684d4c7dade8a58d290b8fff418966ca852001d143b15e4cd7009ba83a838f225cf1a92d7993dd640bf8eab9b3b819969fae0cf368fb3d6e0460c53929d83a8ff5f999755eb9dcbd9f6c52fdc3600bdb1953a6896f7710bbac10d96d16084e3275e079e54d429025166fe1e7ffc67ea081f6c516dd5f12b3307b2d73e876c60b3a6aede89c14a47d23d43fe19032db6ee4f1a33800a1c6a5ad451e32648f0e7df2c0380bc3bbb71ed9c007d6ffd3cff078285053ee366f6f51dc4ff1f3aceca97d5a86cb0f573040f45a47c524f48bc3683c30decd8d60bfa1a0c43757e20632e20bbb34429123d05987710f97cf67728f54b1b040e0bd401d099ba35501bbac09f897857885039872af1f649173bea4b0ca6a20b73860d9911d5a856fbeaf820ff1df5209cb5f62838894010b25058a852dabbd86cfbad9503f32aa895757da5c01ab8b38d3813c118bd35251b1d9832eef948e7d7b7d405239241baa179265508a114145907c42219720c7c0a504ee04110b7790e15b44d8e73df5cb8b0e3d609b329bfdce62686abf8d268f2a0780dd29c8e4117d4783601fdcd84230dc65474db84e577b63b682ff3aea2928f65cfe7f216d7125dfe654f5fda873cad7b8f009f4450ad3e72d07432784e61e238ff9c6a1d3e3957f9ee2356842e467d255bdb6b0ca2c27a3c7c03ce198e9f2209f5d2411d1dd0b6fb4450862de0d719ba46836f76e13a8695eb1bd0b6187efefb0d25910a124c9d7f076c125395e5a1551aca98f2be02c5ed7dc0c4325da0724fac6ae0189300bc9d2c7675406f90b1f40cc3a62a2357460824898e5771f2af0a09bbba33ded809175ed9213fedd8af542d07b6d41762208a74ce23865a411e21885515b55f2a3dc5442bd3f5b4b4fc860e0ad3f840b6e46673dc3a0f0aee422aeec6c8e9a963a3c66c830f8b6ffcabafc79779f269eed3be7f0b21ca0394d0cf6b9eed628c6683710c65b6d50f2775b6b3c78646fb0014bf55536ddfd6ff26a58afb620d1a41c8617a934b610faad2a5efae7af3ee88812a3732117f975bfd6b64660eeb06cf2cd510ddf6e4528f77012609530d58c942948754cde62b1dc6114ccb88ae5a58217ba3a00aefe0e74996c0a59251ff8540acc4abd86492de91d7e8ddd885db841ecff77a1449b08e039070581e3441a54dc235a3876ebd6607eaf947deaa283f2b57d8ce43b3a79dad6f99933411cc2f11903250df7a4729c2fa60c3b9b257ad6fb9ac5a768a8245493f10965a46521520660ddd6bf4b8150da4e8d8b6ac654c54796a66f6d2a4805bf7eb097f8c66d18774ef29b834a68d84de9ec0e051ca11b2e8d2114cdc7b7cbb35c80cb2f1cb943aa58a7e7232df6f6665f7d48f0f5500c4623dc922ba8887e2fcaf3e1511da00684f1d7365a463b012d0787c2ccc0bb300c72c250f9592952251e04ffaf462cd0a8505047c9986e1e536e918103a1fa6c7b7e3e72f4522c8895511dc0fd94b98cb01ffd6285951c31039232ab2d09b478f3ec01b3006ab1003eda343ea8b4845c08ad3c593a2d8e2880962c1652c04f8a09212bbc16835c7204e7e68cecfe4aec51673a9745c22a688aa953a9d465e69ae190c54a4656fe88eddc509b677b51d9aed8a709cd42af484e599f0befd570ea25cdc731ddb857a190a688ef2ea03ab447902e8ce68d5438a55b3a53d5e646ff8e65e1059a61d55e1a1d6459507b3eaac37b6f5a7a72d89ae338aedb2022c09697ec15e6436e7cbe57460cbccdfb63977383e77d83da8daa2c1b37817be858dd6d4c22cfed5910f5fea77e27e96aadf618fc25def032a73548df0cdb2776ae63e06facbd97bc0fc98a90e7f6f0b3a34561d0b41b70634497e144083d92a2b040a45953b4727f424690fe7ae2ea1591c61c660e18ad762a88b7853b23ee14a652ad158caa9f6225fe3ae02c5decdf5578d37e6d0a1fc760bd86d09f7072918162a68b68e9965337c3d5940379c8cdbaf0662c4e4c9474401c067bb9d8f820bc3ed82679eba4d623e95053db834f09294d0d7f053d1db318d55125247392b193f032d4746ac760672b323e8e7b6f97d76003b472d9a90cfd05042759ff7eca523a458822d7029ec66c8bed9e52404175c7f675c3d431c4bf570ce4d2778221c0ab2d19f255a7cbdf4c29dcb32f48e901d02b5fe8a51a56325edeebb584438b86dc843910f3a5a8fe5a92c8aa3cf8e0b959bc8757d0ea8eb2752907d8d7eb41c0e9693e63e0c4f9e17462d5255a5b32a934327b90aefaad81704e18c146a2a5469e39deb70872d6c84fa6bb84eb6a1ae44fa2fd5d55430d81786dcc612fffe64bd0f711f1615c4c50f50fa4919d042c1e3182a4eeed7eb3853a56084030827c46addd68e04eb746747ff73bb9618c7d7cc5eb1480b41932fea37f7d6a2d449e94326e393c1cc179261cbd37b21071dd9de4576d6cba2cf1c9f2d586e863e15632b9f0c8ffb92fa894ebe154c2c07bd0a30113ec91f01ab2e714c52bf88d27b12c9a94bda6a08d896650fd95d40018bdd5083b5ba6d9e2fc0485a8633088168fe990350d658207efb44d7c424405ff82364957f4948a657e42e29340a4ca5eb9765145d26e9a3f674c0abc36c3a5d24fd8336c51bbe7ba51a30e8f9956a143b30f1681544b7e080ba38017cd3faab1509c5e9a5ebda83b1a0c102fb397ab61187ec5be4fbbf51152d70b0954c352e3a22caca1ab2d61c5a1e4323a18e1233fb56cc28bd659616dc1f91638d0ea2b4614436214eb818dc4e1cf2c04325ea87632d02adb78bf1f163e303983acda560c991767b1db435ce42137aced5ca824a2f23f4470c056020d63b59e87d8ffb0319c4698e63e14932d6fc49a669b2dbbe0380f7c278cd836c63d9b3767a0ae489751fe3a1a9afac454a55fb776210866b2abad08dcafc56d394a2737c436dea020eeefec44a8e60e8f04f5b974d542c3d052bd7bd279cc96282beacecf3193e40cd3806dc608a7a05ffebe59ef8eae46c792fa054d5fa663b2999ecceb43c99f8b44833b766af965d43b69826bcd518335372c2098ab51635039759ed8d9ef8f8c1b713b4d151fa583c4c70113e22baf93a38c95eb048bf15aa71546075f733d56e8ea9e3e1c85540eef31482efa178dd08cb27c41cbf4f4648d3175e8881ec8c35b81732838cd022c97b79e06e5dcd93c576a0e78a23da0a8351747507ffaac50c024c2e95eadd5b5939e0ca7c808812d77492400c68dcbdaa2eebbd620fcb9395dfefb91a741f268c5e01ab4d1cef2e62b836d7357b6bb3d7ac21cef28327a43508f05754869f25e033cfdbdac99c0f652a8e0b4436116b723f0d60e3795be937453d068646ae6480f40b0f9c8bfba96386e142a6da93429c54fbcefc38fc6039d9a3661f339885fb71f46301bccdf2e74d5b949dbed01558988e6c5b0d351056c8183142c35b7e1931c09df7da34d49036cb70dbbb05e0dd0ce8337d788fdff6cd6f8e6a7eb4643feb6a5e05e01b6f065ff6bf2899b8d5fb26f48156da4c8dd6deb4cdbfe742f0e719d60297f3480e1422040c2e32ddf5504a3c1f2ca37bf7c69040cbaa60403418c67516032a33962bd83af9842bf1a96afa9d7dc92f34f9570da5e0f815452ada9cff3ee35c872eb0a87d97351c7573099ff64c78f28da8cfe923548b6b39bdd7527b078974dd46c8394ffc5cc4a775614a1c3d5bc5dca5c3deb8e1ec9d68f867bbe56713bf375f6a3f17b5d419a3024e347a751a710560b957288af2531fdda887dc6def72a4272b1a577e5276072d287eee37d0fbcecce1d6019612fea7c054a42fdbb0773a3a3c3e853fde0c35ee2cb61ec3b7261af21c97033c0b45c0f5dcc29bd12e51d4f90f97124588d0a9ee0e2cba1e8a9fd8cfb74a175d6ecef70c9c934db1667f1da00098d84f72c62c56984107639180fc19b537d6e56e189b0a31c05b7a31e79cb6308feef1145975fab56d36fb1d36ff9224c5bc1cc1d96ce09c8f7d8d1f41fc4db48ed1b2a0475b9dfde1fb77c0cfd8cce6d7daf124053f3efe8370549a3686532f70c0bd786575cd0f4bd783073449e9590467e5e73a1000bf520498bde3e8a42a661ec55ac94b132753794776ef42dd3f59e82239e3302f605fefc791f9af7818f02e6e066e16f789da46cef10726e9201b61abf4f1abf750f84ab9017cfb23f76fd155cc346a19ff521503451c60718f79350b767c70c6e227b5bb4fa2df8e88fde9ba069e986d5ad881881a1ac20ec2a2fd31791166a55ff29fbbdb4892b01d02dea51c3ed45f951affa8be9b8f746818da2b02de44458858deff3dd6658c4070b8a2a0640968072a03d8e2b1c78373a01e597fd8bdb5e61fcb3cdb289605f21b74e4b67abf68079110d4676bdfc31c794c81a9e33842a7d3f4836b08cdfceefad40933f1fa9f892a92acf8163e4ce3703c6b1dc8998e938461daad3ada65b1840dec01d8d38afb5cdfddb7f2dd4fa1d05716ea9ff415a016825c93fe1e0375ace11d3eaf5649cf569c68ba2fa26f514c44b9d9301bee5a04d1d033ce5def227017ce70ac771d317d25a68ede22cef2b041cde3352cd1d5e4c928b27c6bdaa0973f0915198ebf0b6cacc02c550398d5a188dc0d267c40e53736610ace31ed191a115fa7804e8f144e3a60a79a1574962e98f1a3b40f3903b4e6a01fe8d5cba2ed58a83748cc60fba71c862558d8822353acb3f86169d62aa30b222ac7aac72a95e5973a19b6cbd2a02e45dca3f84d500978d3b3ad874bfb55427753750be06bf4b8cf57d639c083af47861467228334b5d04221cf0c3c5fd494d49494dc6eccd27140c493b34efbca7f7f01acccff2b6d90dfc57eb9700a78d9ef2fa43091ce7392f75e463de2079b8e432c7ccaf4eb50ae05227dee54cd4fbb36af4072c1e021f9cd1f4f0d1b3a2187d9047da7a6f38a55fef880ad366f4615e38a77724d250175ac973e4854254f2c30180559ab2488b968fc5548ef1efb244ec9cbcd2c98f41f9f4a142e061b3c06277821a762088ac616515377af876ef74bdda2be0ce4777455260dde0e9b18b83bbc805a6544d7f8df14a81fbe98b1526c28f4e751801d0db35290cec4aebc2b154cecd67d7a27c76ea890bf16be625c098e6f6415502ebe8"}, @sadb_ident={0x2, 0xb, 0x6, 0x0, 0xdd}, @sadb_x_nat_t_port={0x1, 0x16, 0x4e20}, @sadb_x_policy={0x8, 0x12, 0x3, 0x0, 0x0, 0x6e6bb8, 0x169, {0x6, 0x3e, 0x7a5f, 0xffff000000000, 0x0, 0x1, 0x0, @in=@rand_addr=0x3}}, @sadb_sa={0x2, 0x1, 0x4d2, 0x7fffffff, 0x200, 0xc7, 0x2, 0x20000001}]}, 0x1090}}, 0x4000800) 01:56:16 executing program 4: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) open(&(0x7f0000000000)='./file0\x00', 0x20000, 0x1) ioctl$sock_SIOCETHTOOL(r0, 0x8946, &(0x7f0000000040)={'bond0\x00', &(0x7f0000000240)=ANY=[@ANYBLOB="4c000000000023000000000000000002"]}) 01:56:16 executing program 2: r0 = socket$inet(0x2, 0x3, 0x2) connect$inet(0xffffffffffffffff, &(0x7f0000000000)={0x2, 0x0, @local}, 0x10) setsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x23, &(0x7f0000000000)={{{@in=@multicast2, @in=@multicast1}}, {{@in6}, 0x0, @in6=@loopback}}, 0xe8) syz_emit_ethernet(0x2a, &(0x7f0000000640)={@random="b100485caa2a", @link_local, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x1c, 0x0, 0x0, 0x0, 0x2, 0x0, @rand_addr, @broadcast}, @igmp={0x11, 0x0, 0x0, @multicast1}}}}}, &(0x7f0000000140)={0x0, 0x0, [0x0, 0xe000]}) 01:56:16 executing program 5: perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1f}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000340)={&(0x7f0000000000), 0xc, &(0x7f0000000300)={&(0x7f0000000240)=@newlink={0x50, 0x10, 0x721, 0x0, 0x0, {0x0, 0x1000000}, [@IFLA_LINKINFO={0x28, 0x12, @veth={{0xc, 0x1, 'veth\x00'}, {0x18, 0x2, @VETH_INFO_PEER={0x14}}}}, @IFLA_NET_NS_FD={0x8}]}, 0x50}}, 0x0) 01:56:16 executing program 3: r0 = socket$inet(0x2, 0x3, 0x2) connect$inet(0xffffffffffffffff, &(0x7f0000000000)={0x2, 0x0, @local}, 0x10) setsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x23, &(0x7f0000000000)={{{@in=@multicast2, @in=@multicast1}}, {{@in6}, 0x0, @in6=@loopback}}, 0xe8) syz_emit_ethernet(0x2a, &(0x7f0000000640)={@random="b100485caa2a", @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x100000000000000}, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x1c, 0x0, 0x0, 0x0, 0x2, 0x0, @rand_addr, @broadcast}, @igmp={0x11, 0xffffffffffffffff, 0x0, @multicast1}}}}}, &(0x7f0000000140)) 01:56:16 executing program 0: socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000001f80)={0xffffffffffffffff, 0xffffffffffffffff}) setsockopt$SO_ATTACH_FILTER(r2, 0x1, 0x1a, &(0x7f0000ab9ff0)={0x2, &(0x7f000039a000)=[{0x20, 0x0, 0x0, 0xfffffffffffff010}, {0x6}]}, 0x10) sendmmsg(r1, &(0x7f0000001e80)=[{{&(0x7f0000000700)=@l2={0x1f, 0x0, {}, 0x0, 0xc03e}, 0x80, &(0x7f0000001dc0)}}], 0x1, 0x0) 01:56:16 executing program 7: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000180)='/dev/sequencer\x00', 0x10002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000080)="0a5cc80700315f85715070") r1 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000001c0)={0x2, 0x0, &(0x7f0000000140)=ANY=[@ANYBLOB='\fc'], 0x0, 0x0, &(0x7f0000000080)}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, &(0x7f00000001c0)}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000040)={0x8, 0x6800, &(0x7f00000000c0)=[@release={0x400c630f}], 0x1, 0x0, &(0x7f0000000100)='V'}) fstat(r0, &(0x7f00000002c0)) 01:56:16 executing program 3: r0 = socket$inet(0x2, 0x3, 0x2) connect$inet(0xffffffffffffffff, &(0x7f0000000000)={0x2, 0x0, @local}, 0x10) setsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x23, &(0x7f0000000000)={{{@in=@multicast2, @in=@multicast1}}, {{@in6}, 0x0, @in6=@loopback}}, 0xe8) syz_emit_ethernet(0x2a, &(0x7f0000000640)={@random="b100485caa2a", @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x400000000000000}, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x1c, 0x0, 0x0, 0x0, 0x2, 0x0, @rand_addr, @broadcast}, @igmp={0x11, 0xffffffffffffffff, 0x0, @multicast1}}}}}, &(0x7f0000000140)) 01:56:16 executing program 4: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) ioctl$sock_SIOCETHTOOL(r0, 0x8946, &(0x7f0000000040)={'bond0\x00', &(0x7f0000000240)=ANY=[@ANYBLOB="4c000000000023000000000000000002"]}) socketpair$inet_tcp(0x2, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff}) sendto$inet(r1, &(0x7f0000000080)="1ebfadc9b3fb8b1d75e815d7872483cd0bd19674f131ba2ebd8478f4180e8a08ded5ada60b4ab3358fd2a988e1889fe1ec66a44134732398ac123307a1219aacb57e223d3aede49c127812685ac3ef7de4db302d0effc562b2590421e74161a05f2fd3d86a0533b3e958221dee057c78b13c7e361682c6b2cf2f1e7c4c92a7e433d2b06deaaeaf92afb9aaba4c93e3c8abcd66761f9250a9c0499fc842f9c1e7f37102f0b5d30abdb517be0074bc72f0b89acfa0861dba7da3532a539a8fc9a69ebc8c36c351527bfb140f1a5404dd0ed6be82397b739f754b028e65e50ceaa3ccc1af9a40", 0xe5, 0x4004, &(0x7f0000000180)={0x2, 0x4e23}, 0x10) 01:56:16 executing program 2: r0 = socket$inet(0x2, 0x3, 0x2) connect$inet(0xffffffffffffffff, &(0x7f0000000000)={0x2, 0x0, @local}, 0x10) setsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x23, &(0x7f0000000000)={{{@in=@multicast2, @in=@multicast1}}, {{@in6}, 0x0, @in6=@loopback}}, 0xe8) syz_emit_ethernet(0x2a, &(0x7f0000000640)={@random="b100485caa2a", @link_local, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x1c, 0x0, 0x0, 0x0, 0x2, 0x0, @rand_addr, @broadcast}, @igmp={0x11, 0x0, 0x0, @multicast1}}}}}, &(0x7f0000000140)={0x0, 0x0, [0x0, 0x700]}) 01:56:16 executing program 5: perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1f}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000340)={&(0x7f0000000000), 0xc, &(0x7f0000000300)={&(0x7f0000000240)=@newlink={0x50, 0x10, 0x721, 0x0, 0x0, {0x0, 0xa00}, [@IFLA_LINKINFO={0x28, 0x12, @veth={{0xc, 0x1, 'veth\x00'}, {0x18, 0x2, @VETH_INFO_PEER={0x14}}}}, @IFLA_NET_NS_FD={0x8}]}, 0x50}}, 0x0) 01:56:16 executing program 1: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="0a5cc80700315f85714070") gettid() timer_create(0x0, &(0x7f0000044000), &(0x7f0000044000)) pipe(&(0x7f0000000080)={0xffffffffffffffff}) r2 = getpgrp(0x0) r3 = perf_event_open(&(0x7f0000c86f88)={0x2, 0x70, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x9d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, r2, 0x0, 0xffffffffffffffff, 0x0) read(r1, &(0x7f0000000040)=""/35, 0x23) getsockopt$IP_VS_SO_GET_VERSION(r1, 0x0, 0x480, &(0x7f0000000000), &(0x7f00000000c0)=0x40) getsockopt$inet6_IPV6_XFRM_POLICY(r1, 0x29, 0x23, &(0x7f0000000340)={{{@in6=@ipv4={[], [], @dev}, @in6=@local, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@ipv4={[], [], @loopback}}, 0x0, @in6=@ipv4={[], [], @multicast1}}}, &(0x7f0000000440)=0xe8) sendmsg$can_raw(r1, &(0x7f0000000300)={&(0x7f00000001c0)={0x1d, r4}, 0x10, &(0x7f00000002c0)={&(0x7f0000000200)=@canfd={{0x3, 0x0, 0x0, 0xfffffffffffffba1}, 0x4, 0x1, 0x0, 0x0, "c9dbd0308f91ae9ded1b3fbe52d35d38ed9ff879b877eeef72fd354f8c30393a3e3fa33e910524911d100d15dab1de9e8be9c6151de57047a0d177935e8c3de4"}, 0x48}}, 0x4) ioctl(r0, 0x8, &(0x7f0000000100)="71c750d8233607e7dae6fb0018b9103596d4c14348148293c5a38b36d61ab4907c97b1f1afdd1d0de0ec6cbd13bd6915c26016d3e337206f985a7b07376967a7d6b94090ac") close(r3) [ 662.352498] binder: 12593:12594 Acquire 1 refcount change on invalid ref 0 ret -22 01:56:16 executing program 0: socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000001f80)={0xffffffffffffffff, 0xffffffffffffffff}) setsockopt$SO_ATTACH_FILTER(r2, 0x1, 0x1a, &(0x7f0000ab9ff0)={0x2, &(0x7f000039a000)=[{0x20, 0x0, 0x0, 0xfffffffffffff010}, {0x6}]}, 0x10) sendmmsg(r1, &(0x7f0000001e80)=[{{&(0x7f0000000700)=@l2={0x1f, 0x0, {}, 0x0, 0x300}, 0x80, &(0x7f0000001dc0)}}], 0x1, 0x0) 01:56:16 executing program 4: r0 = syz_open_dev$vcsn(&(0x7f0000000000)='/dev/vcs#\x00', 0x3, 0x100) getsockopt$sock_buf(r0, 0x1, 0x0, &(0x7f0000000080)=""/62, &(0x7f00000000c0)=0x3e) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) ioctl$sock_SIOCETHTOOL(r1, 0x8946, &(0x7f0000000040)={'bond0\x00', &(0x7f0000000240)=ANY=[@ANYBLOB="4c000000000023000000000000000002"]}) 01:56:16 executing program 3: r0 = socket$inet(0x2, 0x3, 0x2) connect$inet(0xffffffffffffffff, &(0x7f0000000000)={0x2, 0x0, @local}, 0x10) setsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x23, &(0x7f0000000000)={{{@in=@multicast2, @in=@multicast1}}, {{@in6}, 0x0, @in6=@loopback}}, 0xe8) syz_emit_ethernet(0x2a, &(0x7f0000000640)={@random="b100485caa2a", @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x1c000000}, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x1c, 0x0, 0x0, 0x0, 0x2, 0x0, @rand_addr, @broadcast}, @igmp={0x11, 0xffffffffffffffff, 0x0, @multicast1}}}}}, &(0x7f0000000140)) [ 662.473463] binder: 12593:12594 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 662.534915] binder: 12593:12625 Acquire 1 refcount change on invalid ref 0 ret -22 [ 662.623310] binder: 12619 RLIMIT_NICE not set [ 662.666184] binder: 12593:12625 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 01:56:17 executing program 6: r0 = syz_open_dev$sndseq(&(0x7f0000000100)='/dev/snd/seq\x00', 0x0, 0x0) read(r0, &(0x7f0000fb6000)=""/28, 0x3f0) ioctl$SNDRV_SEQ_IOCTL_REMOVE_EVENTS(r0, 0x4040534e, &(0x7f00000001c0)={0xbf}) ioctl$SNDRV_SEQ_IOCTL_QUERY_SUBS(r0, 0xc058534f, &(0x7f00000002c0)={{}, 0x1, 0x0, 0x0, {}, 0x0, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffff00000000]}) r1 = gettid() timer_create(0x0, &(0x7f0000044000)={0x0, 0x12}, &(0x7f0000000040)) r2 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r2, 0x8912, &(0x7f00000001c0)="0a5cc80700315f85715070") timer_settime(0x0, 0x0, &(0x7f0000000080)={{0x0, 0x989680}, {0x0, 0x9}}, &(0x7f0000040000)) tkill(r1, 0x1000000000014) 01:56:17 executing program 5: perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1f}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000340)={&(0x7f0000000000), 0xc, &(0x7f0000000300)={&(0x7f0000000240)=@newlink={0x50, 0x10, 0x721, 0x0, 0x0, {0x0, 0x5}, [@IFLA_LINKINFO={0x28, 0x12, @veth={{0xc, 0x1, 'veth\x00'}, {0x18, 0x2, @VETH_INFO_PEER={0x14}}}}, @IFLA_NET_NS_FD={0x8}]}, 0x50}}, 0x0) 01:56:17 executing program 2: r0 = socket$inet(0x2, 0x3, 0x2) connect$inet(0xffffffffffffffff, &(0x7f0000000000)={0x2, 0x0, @local}, 0x10) setsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x23, &(0x7f0000000000)={{{@in=@multicast2, @in=@multicast1}}, {{@in6}, 0x0, @in6=@loopback}}, 0xe8) syz_emit_ethernet(0x2a, &(0x7f0000000640)={@random="b100485caa2a", @link_local, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x1c, 0x0, 0x0, 0x0, 0x2, 0x0, @rand_addr, @broadcast}, @igmp={0x11, 0x0, 0x0, @multicast1}}}}}, &(0x7f0000000140)={0x0, 0x0, [0x0, 0x3e]}) 01:56:17 executing program 4: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) close(r0) ioctl$sock_SIOCGSKNS(r0, 0x894c, &(0x7f0000000000)=0x5) ioctl$sock_SIOCETHTOOL(r0, 0x8946, &(0x7f0000000040)={'bond0\x00', &(0x7f0000000080)=ANY=[@ANYBLOB="9aa37545e0e561a477850d206202f1db64eae3f7974cd3f192e158b66fd5d80d9bd621ba5fd5e49c0ef0f0d98420dbb4fb29ec6391a56f9408481cc5e83fadf3ec596e9f2d87901a88dd6f7dfcff1358764ff445680be2563da8cb7544b8aee1f4dd2f3554c3d5d1362bcdbb68be70f3cac61e386252130854bf88a0044e0f1f46e41b2bf7918d11f468d9aad9e801b4f84ecdd754a0e2c683bcf4d3997b89ac29f07ee67ce82892a921a762e584d4af340968a8331ad3925d102d94ded6a5dd9e891a38567c3a7bf180151cb22989c0d8d12de397"]}) 01:56:17 executing program 3: r0 = socket$inet(0x2, 0x3, 0x2) connect$inet(0xffffffffffffffff, &(0x7f0000000000)={0x2, 0x0, @local}, 0x10) setsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x23, &(0x7f0000000000)={{{@in=@multicast2, @in=@multicast1}}, {{@in6}, 0x0, @in6=@loopback}}, 0xe8) syz_emit_ethernet(0x2a, &(0x7f0000000640)={@random="b100485caa2a", @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x6000000}, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x1c, 0x0, 0x0, 0x0, 0x2, 0x0, @rand_addr, @broadcast}, @igmp={0x11, 0xffffffffffffffff, 0x0, @multicast1}}}}}, &(0x7f0000000140)) 01:56:17 executing program 0: socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000001f80)={0xffffffffffffffff, 0xffffffffffffffff}) setsockopt$SO_ATTACH_FILTER(r2, 0x1, 0x1a, &(0x7f0000ab9ff0)={0x2, &(0x7f000039a000)=[{0x20, 0x0, 0x0, 0xfffffffffffff010}, {0x6}]}, 0x10) sendmmsg(r1, &(0x7f0000001e80)=[{{&(0x7f0000000700)=@l2={0x1f, 0x0, {}, 0x0, 0x3}, 0x80, &(0x7f0000001dc0)}}], 0x1, 0x0) 01:56:17 executing program 7: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000180)='/dev/sequencer\x00', 0x10002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000080)="0a5cc80700315f85715070") r1 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000001c0)={0x2, 0x0, &(0x7f0000000140)=ANY=[@ANYBLOB='\fc'], 0x0, 0x0, &(0x7f0000000080)}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, &(0x7f00000001c0)}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000040)={0x8, 0x74, &(0x7f00000000c0)=[@release={0x400c630f}], 0x1, 0x0, &(0x7f0000000100)='V'}) fstat(r0, &(0x7f00000002c0)) 01:56:17 executing program 5: perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1f}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000340)={&(0x7f0000000000), 0xc, &(0x7f0000000300)={&(0x7f0000000240)=@newlink={0x50, 0x10, 0x721, 0x0, 0x0, {0x0, 0xb}, [@IFLA_LINKINFO={0x28, 0x12, @veth={{0xc, 0x1, 'veth\x00'}, {0x18, 0x2, @VETH_INFO_PEER={0x14}}}}, @IFLA_NET_NS_FD={0x8}]}, 0x50}}, 0x0) 01:56:17 executing program 3: r0 = socket$inet(0x2, 0x3, 0x2) connect$inet(0xffffffffffffffff, &(0x7f0000000000)={0x2, 0x0, @local}, 0x10) setsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x23, &(0x7f0000000000)={{{@in=@multicast2, @in=@multicast1}}, {{@in6}, 0x0, @in6=@loopback}}, 0xe8) syz_emit_ethernet(0x2a, &(0x7f0000000640)={@random="b100485caa2a", @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x6000}, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x1c, 0x0, 0x0, 0x0, 0x2, 0x0, @rand_addr, @broadcast}, @igmp={0x11, 0xffffffffffffffff, 0x0, @multicast1}}}}}, &(0x7f0000000140)) 01:56:17 executing program 2: r0 = socket$inet(0x2, 0x3, 0x2) connect$inet(0xffffffffffffffff, &(0x7f0000000000)={0x2, 0x0, @local}, 0x10) setsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x23, &(0x7f0000000000)={{{@in=@multicast2, @in=@multicast1}}, {{@in6}, 0x0, @in6=@loopback}}, 0xe8) syz_emit_ethernet(0x2a, &(0x7f0000000640)={@random="b100485caa2a", @link_local, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x1c, 0x0, 0x0, 0x0, 0x2, 0x0, @rand_addr, @broadcast}, @igmp={0x11, 0x0, 0x0, @multicast1}}}}}, &(0x7f0000000140)={0x0, 0x0, [0x0, 0x1c]}) 01:56:17 executing program 4: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) ioctl$sock_SIOCETHTOOL(r0, 0x8946, &(0x7f0000000040)={'bond0\x00', &(0x7f0000000080)=ANY=[@ANYBLOB="837b00008002700e345d1d866838978d7681728480df1ac2a10b85f20624dd3f1977c183a990c14b475f0f08c96d8df7fa5bdba6a8b82f50079fcacb7569ce9c2e65bcd9ff990a9cf023c9971ac64dc9c84dd4d8c012e061fbb3b235f0a3849e21ae042ccd1682a2f9c6f34f21dddd9f7c9e5fd8b9606262c39a34e885d1dd4f00d19329"]}) [ 663.290362] binder: 12661:12662 Acquire 1 refcount change on invalid ref 0 ret -22 01:56:17 executing program 1: ioctl(0xffffffffffffffff, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") r0 = socket(0x15, 0x80005, 0x0) ioctl$SIOCSIFMTU(r0, 0x8922, &(0x7f0000000240)={'bridge_slave_1\x00', 0xffff}) r1 = openat$cuse(0xffffffffffffff9c, &(0x7f0000000040)='/dev/cuse\x00', 0x40000, 0x0) connect$l2tp(r0, &(0x7f0000000080)=@pppol2tpin6={0x18, 0x1, {0x0, r1, 0x0, 0x3, 0x4, 0x1, {0xa, 0x4e24, 0x6, @loopback, 0x925}}}, 0x32) ioctl$SIOCSIFMTU(r0, 0x8922, &(0x7f0000000000)={'team0\x00', 0x95}) ioctl$KVM_SET_GUEST_DEBUG(r1, 0x4048ae9b, &(0x7f0000000180)={0x2, 0x0, [0x40, 0x4000000, 0x0, 0x7, 0x9, 0x3, 0x5, 0x856c]}) getuid() bpf$MAP_CREATE(0x0, &(0x7f0000000200)={0xb, 0x1ff, 0xd7, 0x2, 0x28, 0xffffffffffffff9c, 0x7fffffff}, 0x2c) r2 = syz_open_dev$dmmidi(&(0x7f00000000c0)='/dev/dmmidi#\x00', 0x1000, 0x200000) ioctl$SNDRV_TIMER_IOCTL_GSTATUS(r2, 0xc0505405, &(0x7f0000000100)={{0x3, 0x2, 0x3, 0x0, 0x4}, 0xbc6, 0x7, 0x7}) [ 663.358227] binder: 12661:12662 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 01:56:17 executing program 0: socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000001f80)={0xffffffffffffffff, 0xffffffffffffffff}) setsockopt$SO_ATTACH_FILTER(r2, 0x1, 0x1a, &(0x7f0000ab9ff0)={0x2, &(0x7f000039a000)=[{0x20, 0x0, 0x0, 0xfffffffffffff010}, {0x6}]}, 0x10) sendmmsg(r1, &(0x7f0000001e80)=[{{&(0x7f0000000700)=@l2={0x1f, 0x0, {}, 0x0, 0xfffffdef}, 0x80, &(0x7f0000001dc0)}}], 0x1, 0x0) 01:56:17 executing program 2: r0 = socket$inet(0x2, 0x3, 0x2) connect$inet(0xffffffffffffffff, &(0x7f0000000000)={0x2, 0x0, @local}, 0x10) setsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x23, &(0x7f0000000000)={{{@in=@multicast2, @in=@multicast1}}, {{@in6}, 0x0, @in6=@loopback}}, 0xe8) syz_emit_ethernet(0x2a, &(0x7f0000000640)={@random="b100485caa2a", @link_local, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x1c, 0x0, 0x0, 0x0, 0x2, 0x0, @rand_addr, @broadcast}, @igmp={0x11, 0x0, 0x0, @multicast1}}}}}, &(0x7f0000000140)={0x0, 0x0, [0x0, 0x40030000000000]}) 01:56:17 executing program 5: perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1f}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000340)={&(0x7f0000000000), 0xc, &(0x7f0000000300)={&(0x7f0000000240)=@newlink={0x50, 0x10, 0x721, 0x0, 0x0, {0x0, 0x2}, [@IFLA_LINKINFO={0x28, 0x12, @veth={{0xc, 0x1, 'veth\x00'}, {0x18, 0x2, @VETH_INFO_PEER={0x14}}}}, @IFLA_NET_NS_FD={0x8}]}, 0x50}}, 0x0) 01:56:17 executing program 4: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) r1 = openat$mixer(0xffffffffffffff9c, &(0x7f0000000000)='/dev/mixer\x00', 0x101000, 0x0) getsockopt$inet_sctp6_SCTP_RTOINFO(0xffffffffffffffff, 0x84, 0x0, &(0x7f0000000080)={0x0, 0x9, 0xfffffffffffffff9, 0x80}, &(0x7f00000000c0)=0x10) getsockopt$inet_sctp6_SCTP_PEER_ADDR_THLDS(r1, 0x84, 0x1f, &(0x7f0000000100)={r2, @in6={{0xa, 0x4e20, 0xffffffffffffffc0, @dev={0xfe, 0x80, [], 0x21}, 0x100000000}}, 0x2, 0x101}, &(0x7f00000001c0)=0x90) ioctl$sock_SIOCETHTOOL(r0, 0x8946, &(0x7f0000000040)={'bond0\x00', &(0x7f0000000240)=ANY=[@ANYBLOB="4c000002000000000000000000000000"]}) getsockopt$sock_cred(r0, 0x1, 0x11, &(0x7f0000000540)={0x0}, &(0x7f0000000580)=0xc) r5 = geteuid() getsockopt$sock_cred(r0, 0x1, 0x11, &(0x7f00000005c0)={0x0, 0x0, 0x0}, &(0x7f0000000600)=0xc) ioctl$TIOCGSID(r0, 0x5429, &(0x7f0000000640)=0x0) getsockopt$inet_IP_XFRM_POLICY(r1, 0x0, 0x11, &(0x7f0000000680)={{{@in6=@loopback, @in6=@local, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in=@dev}, 0x0, @in6=@dev}}, &(0x7f0000000780)=0xe8) r9 = getegid() getsockopt$sock_cred(r0, 0x1, 0x11, &(0x7f00000007c0)={0x0}, &(0x7f0000000800)=0xc) r11 = getuid() r12 = getegid() fcntl$getownex(r0, 0x10, &(0x7f0000000840)={0x0, 0x0}) lstat(&(0x7f0000000880)='./file0\x00', &(0x7f00000008c0)={0x0, 0x0, 0x0, 0x0, 0x0}) getresgid(&(0x7f0000000940)=0x0, &(0x7f0000000980), &(0x7f00000009c0)) r16 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000a00)='/dev/vhost-net\x00', 0x2, 0x0) sendmsg$unix(r1, &(0x7f0000000b80)={&(0x7f0000000280)=@file={0x1, './file0\x00'}, 0x6e, &(0x7f00000004c0)=[{&(0x7f0000000300)="1df78835c52eae8e6b0502b34447c5507fd0d30e89f0", 0x16}, {&(0x7f0000000340)="e7353673ba92c7f7", 0x8}, {&(0x7f0000000380)="47e4fb62249e8db3e1e0322fbf9f21498832d92c1229145026a488b16e4b480a063726cec789f84f39c4fc141260f13f0e2db93a658a666e1b15333f07d776798699e824656356948ca84b0591b2b6ac17748192183547ffd18b24c209f1b804fbfb7f8d87968061608fd70300ea6ae540e606974e21", 0x76}, {&(0x7f0000000400)="9d31334093f73b7ef2f78d71888a27968c3a23a8ba563dc70249a50911a8336eb1a50925d3059b1a", 0x28}, {&(0x7f0000000440)="b560dcbdacf1429ed8b22b3aa471dafce9821b7c66ee8e5cd13fad297100b2a0344ee259fc21b2a6b9089a2a863c32b465cbf1c719636d0e0857fc343fe60febe041ebc0dee09b2155202ac6bcfa96124ffe842bc8e6f783c960f9eeda", 0x5d}], 0x5, &(0x7f0000000a40)=[@cred={0x20, 0x1, 0x2, r4, r5, r6}, @rights={0x20, 0x1, 0x1, [r0, r1, r1, r1]}, @cred={0x20, 0x1, 0x2, r7, r8, r9}, @rights={0x38, 0x1, 0x1, [r1, r1, r0, r0, r0, r1, r1, r0, r1, r1]}, @cred={0x20, 0x1, 0x2, r10, r11, r12}, @cred={0x20, 0x1, 0x2, r13, r14, r15}, @rights={0x28, 0x1, 0x1, [r0, r0, r16, r1, r1, r0]}, @rights={0x18, 0x1, 0x1, [r1]}, @rights={0x20, 0x1, 0x1, [r1, r1, r1]}], 0x138, 0x4000004}, 0x8001) setsockopt$inet_sctp6_SCTP_RECONFIG_SUPPORTED(r1, 0x84, 0x75, &(0x7f0000000200)={r3, 0x2}, 0x8) [ 663.525976] binder: 12661:12694 Acquire 1 refcount change on invalid ref 0 ret -22 [ 663.597344] binder: 12661:12694 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 01:56:17 executing program 6: r0 = syz_open_dev$sndseq(&(0x7f0000000100)='/dev/snd/seq\x00', 0x0, 0x0) read(r0, &(0x7f0000fb6000)=""/28, 0x3f0) ioctl$SNDRV_SEQ_IOCTL_REMOVE_EVENTS(r0, 0x4040534e, &(0x7f00000001c0)={0xbf}) ioctl$SNDRV_SEQ_IOCTL_QUERY_SUBS(r0, 0xc058534f, &(0x7f00000002c0)={{}, 0x1, 0x0, 0x0, {}, 0x0, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xe000000]}) r1 = gettid() timer_create(0x0, &(0x7f0000044000)={0x0, 0x12}, &(0x7f0000000040)) r2 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r2, 0x8912, &(0x7f00000001c0)="0a5cc80700315f85715070") timer_settime(0x0, 0x0, &(0x7f0000000080)={{0x0, 0x989680}, {0x0, 0x9}}, &(0x7f0000040000)) tkill(r1, 0x1000000000014) 01:56:17 executing program 3: r0 = socket$inet(0x2, 0x3, 0x2) connect$inet(0xffffffffffffffff, &(0x7f0000000000)={0x2, 0x0, @local}, 0x10) setsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x23, &(0x7f0000000000)={{{@in=@multicast2, @in=@multicast1}}, {{@in6}, 0x0, @in6=@loopback}}, 0xe8) syz_emit_ethernet(0x2a, &(0x7f0000000640)={@random="b100485caa2a", @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x3}, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x1c, 0x0, 0x0, 0x0, 0x2, 0x0, @rand_addr, @broadcast}, @igmp={0x11, 0xffffffffffffffff, 0x0, @multicast1}}}}}, &(0x7f0000000140)) 01:56:17 executing program 1: perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1f}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$sndpcmc(&(0x7f00000000c0)='/dev/snd/pcmC#D#c\x00', 0xffff, 0x500) ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f0000000100)={0xaa, 0x40}) r1 = syz_open_dev$loop(&(0x7f0000000200)='/dev/loop#\x00', 0x0, 0x0) openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000040)='/dev/vga_arbiter\x00', 0x0, 0x0) r2 = memfd_create(&(0x7f0000000080)="74086e750000000000000000008c00", 0x0) ioctl$LOOP_CHANGE_FD(r1, 0x4c00, r2) ioctl$LOOP_GET_STATUS64(r1, 0x4c05, &(0x7f0000000340)) 01:56:17 executing program 2: r0 = socket$inet(0x2, 0x3, 0x2) connect$inet(0xffffffffffffffff, &(0x7f0000000000)={0x2, 0x0, @local}, 0x10) setsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x23, &(0x7f0000000000)={{{@in=@multicast2, @in=@multicast1}}, {{@in6}, 0x0, @in6=@loopback}}, 0xe8) syz_emit_ethernet(0x2a, &(0x7f0000000640)={@random="b100485caa2a", @link_local, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x1c, 0x0, 0x0, 0x0, 0x2, 0x0, @rand_addr, @broadcast}, @igmp={0x11, 0x0, 0x0, @multicast1}}}}}, &(0x7f0000000140)={0x0, 0x0, [0x0, 0x8000000]}) 01:56:17 executing program 5: perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1f}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000340)={&(0x7f0000000000), 0xc, &(0x7f0000000300)={&(0x7f0000000240)=@newlink={0x50, 0x10, 0x721, 0x0, 0x0, {0x0, 0x500000000000000}, [@IFLA_LINKINFO={0x28, 0x12, @veth={{0xc, 0x1, 'veth\x00'}, {0x18, 0x2, @VETH_INFO_PEER={0x14}}}}, @IFLA_NET_NS_FD={0x8}]}, 0x50}}, 0x0) 01:56:17 executing program 4: r0 = openat$cuse(0xffffffffffffff9c, &(0x7f0000000200)='/dev/cuse\x00', 0x0, 0x0) ioctl$PIO_UNIMAPCLR(r0, 0x4b68, &(0x7f00000001c0)={0x60e28629, 0x3, 0x6}) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) ioctl$sock_SIOCETHTOOL(r1, 0x8946, &(0x7f0000000040)={'bond0\x00', &(0x7f0000000240)=ANY=[@ANYBLOB="4c000000000023000000000000000002"]}) r2 = gettid() r3 = bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000140)={&(0x7f0000000100)='bond0\x00', 0xffffffffffffff9c}, 0x10) perf_event_open(&(0x7f0000000080)={0x1, 0x70, 0x4, 0x9, 0x80000001, 0x2, 0x0, 0x40, 0x3c002, 0x4, 0x8001, 0x20, 0x0, 0xd89c, 0x5, 0x1ff, 0x6, 0xba32, 0x4, 0x0, 0x80aa, 0x3f, 0x3, 0x75f, 0x7, 0x9, 0x7f, 0x7, 0x0, 0xffffffff, 0x400, 0x0, 0x4, 0x9, 0x6, 0xffffffffffffffff, 0xffff, 0x5, 0x0, 0x4dc2, 0x2, @perf_bp={&(0x7f0000000000), 0xf}, 0xa00, 0x1, 0x6, 0x6, 0x1, 0xe27b, 0x3}, r2, 0x6, r3, 0x1) 01:56:17 executing program 0: socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000001f80)={0xffffffffffffffff, 0xffffffffffffffff}) setsockopt$SO_ATTACH_FILTER(r2, 0x1, 0x1a, &(0x7f0000ab9ff0)={0x2, &(0x7f000039a000)=[{0x20, 0x0, 0x0, 0xfffffffffffff010}, {0x6}]}, 0x10) sendmmsg(r1, &(0x7f0000001e80)=[{{&(0x7f0000000700)=@l2={0x1f, 0x0, {}, 0x0, 0x34000}, 0x80, &(0x7f0000001dc0)}}], 0x1, 0x0) 01:56:17 executing program 7: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000180)='/dev/sequencer\x00', 0x10002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000080)="0a5cc80700315f85715070") r1 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000001c0)={0x2, 0x0, &(0x7f0000000140)=ANY=[@ANYBLOB='\fc'], 0x0, 0x0, &(0x7f0000000080)}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, &(0x7f00000001c0)}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000040)={0x8, 0x3, &(0x7f00000000c0)=[@release={0x400c630f}], 0x1, 0x0, &(0x7f0000000100)='V'}) fstat(r0, &(0x7f00000002c0)) 01:56:18 executing program 4: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) ioctl$sock_SIOCETHTOOL(r0, 0x8946, &(0x7f0000000040)={'bond0\x00', &(0x7f0000000240)=ANY=[@ANYBLOB="4c0000000000ee9d5b83e71c5b740002"]}) 01:56:18 executing program 2: r0 = socket$inet(0x2, 0x3, 0x2) connect$inet(0xffffffffffffffff, &(0x7f0000000000)={0x2, 0x0, @local}, 0x10) setsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x23, &(0x7f0000000000)={{{@in=@multicast2, @in=@multicast1}}, {{@in6}, 0x0, @in6=@loopback}}, 0xe8) syz_emit_ethernet(0x2a, &(0x7f0000000640)={@random="b100485caa2a", @link_local, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x1c, 0x0, 0x0, 0x0, 0x2, 0x0, @rand_addr, @broadcast}, @igmp={0x11, 0x0, 0x0, @multicast1}}}}}, &(0x7f0000000140)={0x0, 0x0, [0x0, 0xffffffffffffffff]}) 01:56:18 executing program 3: r0 = socket$inet(0x2, 0x3, 0x2) connect$inet(0xffffffffffffffff, &(0x7f0000000000)={0x2, 0x0, @local}, 0x10) setsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x23, &(0x7f0000000000)={{{@in=@multicast2, @in=@multicast1}}, {{@in6}, 0x0, @in6=@loopback}}, 0xe8) syz_emit_ethernet(0x2a, &(0x7f0000000640)={@random="b100485caa2a", @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0xf0ffffffffffff}, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x1c, 0x0, 0x0, 0x0, 0x2, 0x0, @rand_addr, @broadcast}, @igmp={0x11, 0xffffffffffffffff, 0x0, @multicast1}}}}}, &(0x7f0000000140)) 01:56:18 executing program 5: perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1f}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000340)={&(0x7f0000000000), 0xc, &(0x7f0000000300)={&(0x7f0000000240)=@newlink={0x50, 0x10, 0x721, 0x0, 0x0, {0x0, 0xb40a000000000000}, [@IFLA_LINKINFO={0x28, 0x12, @veth={{0xc, 0x1, 'veth\x00'}, {0x18, 0x2, @VETH_INFO_PEER={0x14}}}}, @IFLA_NET_NS_FD={0x8}]}, 0x50}}, 0x0) 01:56:18 executing program 1: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(0xffffffffffffffff, 0xc018620b, &(0x7f0000000100)={0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000180)={0x38, 0x0, &(0x7f0000000140)=[@clear_death={0x400c630f, 0x0, 0x2}, @exit_looper, @release={0x40046306, 0x2}, @acquire={0x40046305, 0x2}, @acquire_done={0x40106309, r1, 0x3}], 0xcf, 0x0, &(0x7f0000000280)="d6e0d2f403357b30256b296b30aa389b811d5736e16cc44944ed0bc377037ed8a3075f57d00c895c7ea0fab06b815ca9ff72de2f8921f030076e7c4c06b22ea830f67f9db21cc9ecfd27f88d11b8519adf5200249c8316a3df2b785acd2046efb6789217fffda0c4c027b7854c2f2d39464a1231fc35447e25ea128026dfeb72fe8994fdb03c06b04419ff94f4a7755781996663f53eb5a4a434e5682b9852cff4dd2d354d0852b175a61af153629021c3212169d5bf551a92a3f376cf92e41d961b87f02cf7568323e9e323c3c3ae"}) ioctl(r0, 0x8912, &(0x7f0000000480)="0a5cc80700315f85715070") r2 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000240)={0x58, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="0b630000ac795bf20000aad532af6c9f70c8ea0050496340401f00a2ad32e90d113af80000000000000000000000000000000000000000000000000000000000000000000000000000af0d28a5da1d8c26696a7325c34a0b651a0c871b84e466027206c299989679e444df3745a20f19f143895d8cb9211b", @ANYPTR=&(0x7f0000000080)=ANY=[], @ANYPTR=&(0x7f0000000100)=ANY=[]], 0x0, 0x0, &(0x7f00000001c0)}) [ 664.220127] binder: 12731:12740 Acquire 1 refcount change on invalid ref 0 ret -22 01:56:18 executing program 4: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) fremovexattr(r0, &(0x7f0000000080)=@known='security.selinux\x00') ioctl$sock_SIOCETHTOOL(r0, 0x8946, &(0x7f0000000040)={'bond0\x00', &(0x7f0000000000)=ANY=[@ANYBLOB="4c00000000002300000000005e0000020692fa5572683f533af09762651afbe680b014a47be23d121c40cf312d29561dcc322fbf4236"]}) r1 = syz_open_dev$dspn(&(0x7f00000000c0)='/dev/dsp#\x00', 0x9, 0x20000) getsockopt$inet_sctp6_SCTP_ENABLE_STREAM_RESET(0xffffffffffffffff, 0x84, 0x76, &(0x7f0000000100)={0x0, 0x4}, &(0x7f0000000140)=0x8) getsockopt$inet_sctp6_SCTP_PARTIAL_DELIVERY_POINT(r1, 0x84, 0x13, &(0x7f0000000180)={r2, 0xb64a}, &(0x7f00000001c0)=0x8) 01:56:18 executing program 2: r0 = socket$inet(0x2, 0x3, 0x2) connect$inet(0xffffffffffffffff, &(0x7f0000000000)={0x2, 0x0, @local}, 0x10) setsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x23, &(0x7f0000000000)={{{@in=@multicast2, @in=@multicast1}}, {{@in6}, 0x0, @in6=@loopback}}, 0xe8) syz_emit_ethernet(0x2a, &(0x7f0000000640)={@random="b100485caa2a", @link_local, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x1c, 0x0, 0x0, 0x0, 0x2, 0x0, @rand_addr, @broadcast}, @igmp={0x11, 0x0, 0x0, @multicast1}}}}}, &(0x7f0000000140)={0x0, 0x0, [0x0, 0x40000000]}) 01:56:18 executing program 5: perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1f}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000340)={&(0x7f0000000000), 0xc, &(0x7f0000000300)={&(0x7f0000000240)=@newlink={0x50, 0x10, 0x721, 0x0, 0x0, {0x0, 0x300000000000000}, [@IFLA_LINKINFO={0x28, 0x12, @veth={{0xc, 0x1, 'veth\x00'}, {0x18, 0x2, @VETH_INFO_PEER={0x14}}}}, @IFLA_NET_NS_FD={0x8}]}, 0x50}}, 0x0) [ 664.328382] binder: 12760:12762 ERROR: BC_REGISTER_LOOPER called without request [ 664.336044] binder: 12760:12762 unknown command -228886100 [ 664.345083] binder: 12731:12740 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 664.402141] binder: 12731:12771 unknown command 64 [ 664.427052] binder: 12760:12762 ioctl c0306201 20000240 returned -22 [ 664.516337] binder: 12731:12771 ioctl c0306201 20000040 returned -22 [ 664.538560] binder: 12731:12771 Acquire 1 refcount change on invalid ref 0 ret -22 [ 664.559371] binder: 12731:12771 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 01:56:18 executing program 6: r0 = syz_open_dev$sndseq(&(0x7f0000000100)='/dev/snd/seq\x00', 0x0, 0x0) read(r0, &(0x7f0000fb6000)=""/28, 0x3f0) ioctl$SNDRV_SEQ_IOCTL_REMOVE_EVENTS(r0, 0x4040534e, &(0x7f00000001c0)={0xbf}) ioctl$SNDRV_SEQ_IOCTL_QUERY_SUBS(r0, 0xc058534f, &(0x7f00000002c0)={{}, 0x1, 0x0, 0x0, {}, 0x0, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xe00]}) r1 = gettid() timer_create(0x0, &(0x7f0000044000)={0x0, 0x12}, &(0x7f0000000040)) r2 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r2, 0x8912, &(0x7f00000001c0)="0a5cc80700315f85715070") timer_settime(0x0, 0x0, &(0x7f0000000080)={{0x0, 0x989680}, {0x0, 0x9}}, &(0x7f0000040000)) tkill(r1, 0x1000000000014) 01:56:18 executing program 3: r0 = socket$inet(0x2, 0x3, 0x2) connect$inet(0xffffffffffffffff, &(0x7f0000000000)={0x2, 0x0, @local}, 0x10) setsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x23, &(0x7f0000000000)={{{@in=@multicast2, @in=@multicast1}}, {{@in6}, 0x0, @in6=@loopback}}, 0xe8) syz_emit_ethernet(0x2a, &(0x7f0000000640)={@random="b100485caa2a", @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x3000000}, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x1c, 0x0, 0x0, 0x0, 0x2, 0x0, @rand_addr, @broadcast}, @igmp={0x11, 0xffffffffffffffff, 0x0, @multicast1}}}}}, &(0x7f0000000140)) 01:56:18 executing program 0: socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000001f80)={0xffffffffffffffff, 0xffffffffffffffff}) setsockopt$SO_ATTACH_FILTER(r2, 0x1, 0x1a, &(0x7f0000ab9ff0)={0x2, &(0x7f000039a000)=[{0x20, 0x0, 0x0, 0xfffffffffffff010}, {0x6}]}, 0x10) sendmmsg(r1, &(0x7f0000001e80)=[{{&(0x7f0000000700)=@l2={0x1f, 0x0, {}, 0x0, 0x300000000000000}, 0x80, &(0x7f0000001dc0)}}], 0x1, 0x0) 01:56:18 executing program 4: r0 = dup2(0xffffffffffffffff, 0xffffffffffffff9c) getsockopt$inet_sctp_SCTP_PEER_ADDR_PARAMS(r0, 0x84, 0x9, &(0x7f00000002c0)={0x0, @in6={{0xa, 0x4e22, 0xefa, @mcast2, 0xfffffffffffffff8}}, 0x4, 0x2, 0x4, 0x7fffffff, 0x41}, &(0x7f0000000380)=0x98) getsockopt$inet_sctp6_SCTP_GET_PEER_ADDRS(r0, 0x84, 0x6c, &(0x7f0000000400)={r1, 0xb6, "c638414b9c163299fe835926d14d18b72a07d3e2aea9338fab17dbc4158f47b2fb24691a98ea3d00b0fc8261f2cc35b4e831fd82956330f73199cf413b88e54a5590a736cafb05c86d537af364a2beb8b12cd8fd1e132efa9b413e973b6938e627489793f1949e45063ddc259029cb2fc58c142ed07a25eb297086fd5b7ae721168ae178323bc9ccc039f9343dfe9a000000000000f801d19034d13e17f0145251386b0015855a98316c9d8466ea974ebc985af31b6f"}, &(0x7f00000004c0)=0xfeba) getsockopt$inet_sctp6_SCTP_DELAYED_SACK(r0, 0x84, 0x10, &(0x7f0000000180)=@assoc_value={r2, 0x1}, &(0x7f00000001c0)=0x8) r3 = socket$nl_netfilter(0x10, 0x3, 0xc) ioctl$sock_SIOCETHTOOL(r3, 0x8946, &(0x7f0000000040)={'by\x00', &(0x7f0000000000)=ANY=[@ANYRES16=r3]}) socket$inet_tcp(0x2, 0x1, 0x0) socket$l2tp(0x18, 0x1, 0x1) 01:56:18 executing program 1: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000080)={'irlan0\x00', 0x1}) r1 = openat$cuse(0xffffffffffffff9c, &(0x7f0000000040)='/dev/cuse\x00', 0x0, 0x0) ioctl$KDGKBMETA(r1, 0x4b62, &(0x7f00000000c0)) ioctl$TUNSETVNETBE(r0, 0x401054d5, &(0x7f0000000100)) ioctl$TUNSETNOCSUM(r0, 0x400454c8, 0x0) 01:56:18 executing program 2: r0 = socket$inet(0x2, 0x3, 0x2) connect$inet(0xffffffffffffffff, &(0x7f0000000000)={0x2, 0x0, @local}, 0x10) setsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x23, &(0x7f0000000000)={{{@in=@multicast2, @in=@multicast1}}, {{@in6}, 0x0, @in6=@loopback}}, 0xe8) syz_emit_ethernet(0x2a, &(0x7f0000000640)={@random="b100485caa2a", @link_local, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x1c, 0x0, 0x0, 0x0, 0x2, 0x0, @rand_addr, @broadcast}, @igmp={0x11, 0x0, 0x0, @multicast1}}}}}, &(0x7f0000000140)={0x0, 0x0, [0x0, 0x400300]}) 01:56:18 executing program 5: perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1f}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000340)={&(0x7f0000000000), 0xc, &(0x7f0000000300)={&(0x7f0000000240)=@newlink={0x50, 0x10, 0x721, 0x0, 0x0, {0x0, 0x900}, [@IFLA_LINKINFO={0x28, 0x12, @veth={{0xc, 0x1, 'veth\x00'}, {0x18, 0x2, @VETH_INFO_PEER={0x14}}}}, @IFLA_NET_NS_FD={0x8}]}, 0x50}}, 0x0) 01:56:18 executing program 7: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000180)='/dev/sequencer\x00', 0x10002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000080)="0a5cc80700315f85715070") r1 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000001c0)={0x2, 0x0, &(0x7f0000000140)=ANY=[@ANYBLOB='\fc'], 0x0, 0x0, &(0x7f0000000080)}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, &(0x7f00000001c0)}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000040)={0x8, 0x600000000000000, &(0x7f00000000c0)=[@release={0x400c630f}], 0x1, 0x0, &(0x7f0000000100)='V'}) fstat(r0, &(0x7f00000002c0)) 01:56:18 executing program 4: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) getsockopt$inet_sctp6_SCTP_AUTOCLOSE(r0, 0x84, 0x4, &(0x7f00000001c0), &(0x7f0000000200)=0x4) ioctl$sock_SIOCETHTOOL(r0, 0x8946, &(0x7f0000000040)={'bond0\x00', &(0x7f00000000c0)=ANY=[@ANYBLOB="4c00002300000073dc1845979e80a449816ef1e8706f0e1108360bfd8603c12e4aadf6d5d2314b019cba13300fcccd8d09b521d657cdc299f92f5023382587416c6ba58b4bb04853cca75e406f1d9d8da542a60cbd4c1ed52320de8491987646a5648ab3a0c7146df6b6de11caaa77df704a4a50c267626263085fdc912c00271ac9481a3e54c15e30537599a1fd77f4a88e4e125f002443d0cd4e8c65313d02ba7f5635c8f2798d019e4626e68faaedb57d1fddd65a03742650fac0cb2fa05b2f0208761d6a268b05216b7763f2af7a6ced511052eccc9eb50e637930"]}) 01:56:19 executing program 3: r0 = socket$inet(0x2, 0x3, 0x2) connect$inet(0xffffffffffffffff, &(0x7f0000000000)={0x2, 0x0, @local}, 0x10) setsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x23, &(0x7f0000000000)={{{@in=@multicast2, @in=@multicast1}}, {{@in6}, 0x0, @in6=@loopback}}, 0xe8) syz_emit_ethernet(0x2a, &(0x7f0000000640)={@random="b100485caa2a", @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x1000000}, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x1c, 0x0, 0x0, 0x0, 0x2, 0x0, @rand_addr, @broadcast}, @igmp={0x11, 0xffffffffffffffff, 0x0, @multicast1}}}}}, &(0x7f0000000140)) 01:56:19 executing program 2: r0 = socket$inet(0x2, 0x3, 0x2) connect$inet(0xffffffffffffffff, &(0x7f0000000000)={0x2, 0x0, @local}, 0x10) setsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x23, &(0x7f0000000000)={{{@in=@multicast2, @in=@multicast1}}, {{@in6}, 0x0, @in6=@loopback}}, 0xe8) syz_emit_ethernet(0x2a, &(0x7f0000000640)={@random="b100485caa2a", @link_local, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x1c, 0x0, 0x0, 0x0, 0x2, 0x0, @rand_addr, @broadcast}, @igmp={0x11, 0x0, 0x0, @multicast1}}}}}, &(0x7f0000000140)={0x0, 0x0, [0x0, 0x400000000000000]}) 01:56:19 executing program 1: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1f}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r2 = add_key(&(0x7f0000000440)='big_key\x00', &(0x7f0000000480), &(0x7f00000004c0)="72f35301a28f8e", 0x7, 0xfffffffffffffffb) keyctl$read(0xb, r2, &(0x7f00000014c0)=""/4096, 0x1000) r3 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000100)='/dev/hwrng\x00', 0x2, 0x0) ioctl$EVIOCGSND(r3, 0x8040451a, &(0x7f0000000140)=""/63) r4 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f00000002c0)={0x0, 0x0, 0x0, 0x2000, &(0x7f0000001000/0x2000)=nil}) ioctl$KVM_REGISTER_COALESCED_MMIO(r1, 0x4010ae67, &(0x7f00000003c0)={0x0, 0xffffffffffffffff}) ioctl$KVM_SET_REGS(r4, 0x4090ae82, &(0x7f0000000000)={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x100]}) ioctl$KVM_NMI(r4, 0xae9a) r5 = fcntl$dupfd(r4, 0x0, r4) ioctl$KVM_RUN(r5, 0xae80, 0x0) ioctl$KVM_RUN(r4, 0xae80, 0x0) 01:56:19 executing program 5: perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1f}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000340)={&(0x7f0000000000), 0xc, &(0x7f0000000300)={&(0x7f0000000240)=@newlink={0x50, 0x10, 0x721, 0x0, 0x0, {0x0, 0x0, 0x1000000000000000}, [@IFLA_LINKINFO={0x28, 0x12, @veth={{0xc, 0x1, 'veth\x00'}, {0x18, 0x2, @VETH_INFO_PEER={0x14}}}}, @IFLA_NET_NS_FD={0x8}]}, 0x50}}, 0x0) [ 665.119388] binder: 12806:12808 Acquire 1 refcount change on invalid ref 0 ret -22 [ 665.172383] binder: 12806:12808 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 01:56:19 executing program 2: r0 = socket$inet(0x2, 0x3, 0x2) connect$inet(0xffffffffffffffff, &(0x7f0000000000)={0x2, 0x0, @local}, 0x10) setsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x23, &(0x7f0000000000)={{{@in=@multicast2, @in=@multicast1}}, {{@in6}, 0x0, @in6=@loopback}}, 0xe8) syz_emit_ethernet(0x2a, &(0x7f0000000640)={@random="b100485caa2a", @link_local, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x1c, 0x0, 0x0, 0x0, 0x2, 0x0, @rand_addr, @broadcast}, @igmp={0x11, 0x0, 0x0, @multicast1}}}}}, &(0x7f0000000140)={0x0, 0x0, [0x0, 0x4000]}) 01:56:19 executing program 3: r0 = socket$inet(0x2, 0x3, 0x2) connect$inet(0xffffffffffffffff, &(0x7f0000000000)={0x2, 0x0, @local}, 0x10) setsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x23, &(0x7f0000000000)={{{@in=@multicast2, @in=@multicast1}}, {{@in6}, 0x0, @in6=@loopback}}, 0xe8) syz_emit_ethernet(0x2a, &(0x7f0000000640)={@random="b100485caa2a", @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x20000000}, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x1c, 0x0, 0x0, 0x0, 0x2, 0x0, @rand_addr, @broadcast}, @igmp={0x11, 0xffffffffffffffff, 0x0, @multicast1}}}}}, &(0x7f0000000140)) 01:56:19 executing program 5: perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1f}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000340)={&(0x7f0000000000), 0xc, &(0x7f0000000300)={&(0x7f0000000240)=@newlink={0x50, 0x10, 0x721, 0x0, 0x0, {0x0, 0x0, 0xfffff000}, [@IFLA_LINKINFO={0x28, 0x12, @veth={{0xc, 0x1, 'veth\x00'}, {0x18, 0x2, @VETH_INFO_PEER={0x14}}}}, @IFLA_NET_NS_FD={0x8}]}, 0x50}}, 0x0) [ 665.280093] binder: 12806:12837 Acquire 1 refcount change on invalid ref 0 ret -22 [ 665.392379] binder: 12806:12837 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 01:56:19 executing program 1: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000000)="8a5c010700315f85715070") r1 = dup2(r0, r0) ioctl$TIOCLINUX7(r1, 0x541c, &(0x7f0000000040)={0x7, 0x100000001}) write$eventfd(r1, &(0x7f00000000c0)=0x6, 0x8) msync(&(0x7f0000d5c000/0x2000)=nil, 0xfffffffffffffef1, 0x0) setsockopt$inet_sctp_SCTP_PARTIAL_DELIVERY_POINT(r1, 0x84, 0x13, &(0x7f0000000080)=0x40, 0x4) setsockopt$bt_BT_CHANNEL_POLICY(r1, 0x112, 0xa, &(0x7f0000000140)=0x3, 0x4) write(r1, &(0x7f0000000100)="1afd213fbc76ea1b9236d5cd3f5a0f", 0xf) 01:56:19 executing program 4: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) ioctl$sock_SIOCETHTOOL(r0, 0x8946, &(0x7f0000000080)={'bond0\x00', &(0x7f0000000240)=ANY=[@ANYBLOB="4c000000000023000000000000000002"]}) getsockopt$inet_IP_IPSEC_POLICY(0xffffffffffffffff, 0x0, 0x10, &(0x7f00000002c0)={{{@in6, @in6=@local, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@local}, 0x0, @in=@broadcast}}, &(0x7f00000003c0)=0xe8) sendmsg(r0, &(0x7f0000000540)={&(0x7f0000000400)=@ll={0x11, 0x2, r1, 0x1, 0x10001, 0x6, @dev={[], 0xd}}, 0x80, &(0x7f00000004c0)=[{&(0x7f0000000480)="b8a80a3cbd1bedef3ba0abeb9cff4fc452ab7c4e31d0638e887b0f3be0d3fbb786fc28fc13af93d53b8a2b1422b38a6e401d45a2", 0x34}], 0x1, &(0x7f0000000500), 0x0, 0x800}, 0x0) 01:56:19 executing program 6: r0 = syz_open_dev$sndseq(&(0x7f0000000100)='/dev/snd/seq\x00', 0x0, 0x0) read(r0, &(0x7f0000fb6000)=""/28, 0x3f0) ioctl$SNDRV_SEQ_IOCTL_REMOVE_EVENTS(r0, 0x4040534e, &(0x7f00000001c0)={0xbf}) ioctl$SNDRV_SEQ_IOCTL_QUERY_SUBS(r0, 0xc058534f, &(0x7f00000002c0)={{}, 0x1, 0x0, 0x0, {}, 0x0, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xe]}) r1 = gettid() timer_create(0x0, &(0x7f0000044000)={0x0, 0x12}, &(0x7f0000000040)) r2 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r2, 0x8912, &(0x7f00000001c0)="0a5cc80700315f85715070") timer_settime(0x0, 0x0, &(0x7f0000000080)={{0x0, 0x989680}, {0x0, 0x9}}, &(0x7f0000040000)) tkill(r1, 0x1000000000014) 01:56:19 executing program 7: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000180)='/dev/sequencer\x00', 0x10002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000080)="0a5cc80700315f85715070") r1 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000001c0)={0x2, 0x0, &(0x7f0000000140)=ANY=[@ANYBLOB='\fc'], 0x0, 0x0, &(0x7f0000000080)}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, &(0x7f00000001c0)}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000040)={0x8, 0x4c000000, &(0x7f00000000c0)=[@release={0x400c630f}], 0x1, 0x0, &(0x7f0000000100)='V'}) fstat(r0, &(0x7f00000002c0)) 01:56:19 executing program 2: r0 = socket$inet(0x2, 0x3, 0x2) connect$inet(0xffffffffffffffff, &(0x7f0000000000)={0x2, 0x0, @local}, 0x10) setsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x23, &(0x7f0000000000)={{{@in=@multicast2, @in=@multicast1}}, {{@in6}, 0x0, @in6=@loopback}}, 0xe8) syz_emit_ethernet(0x2a, &(0x7f0000000640)={@random="b100485caa2a", @link_local, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x1c, 0x0, 0x0, 0x0, 0x2, 0x0, @rand_addr, @broadcast}, @igmp={0x11, 0x0, 0x0, @multicast1}}}}}, &(0x7f0000000140)={0x0, 0x0, [0x0, 0x300]}) 01:56:19 executing program 5: perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1f}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000340)={&(0x7f0000000000), 0xc, &(0x7f0000000300)={&(0x7f0000000240)=@newlink={0x50, 0x10, 0x721, 0x0, 0x0, {0x0, 0x0, 0x1000000}, [@IFLA_LINKINFO={0x28, 0x12, @veth={{0xc, 0x1, 'veth\x00'}, {0x18, 0x2, @VETH_INFO_PEER={0x14}}}}, @IFLA_NET_NS_FD={0x8}]}, 0x50}}, 0x0) 01:56:19 executing program 0: socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000001f80)={0xffffffffffffffff, 0xffffffffffffffff}) setsockopt$SO_ATTACH_FILTER(r2, 0x1, 0x1a, &(0x7f0000ab9ff0)={0x2, &(0x7f000039a000)=[{0x20, 0x0, 0x0, 0xfffffffffffff010}, {0x6}]}, 0x10) sendmmsg(r1, &(0x7f0000001e80)=[{{&(0x7f0000000700)=@l2={0x1f, 0x0, {}, 0x0, 0xeffdffff00000000}, 0x80, &(0x7f0000001dc0)}}], 0x1, 0x0) 01:56:19 executing program 3: r0 = socket$inet(0x2, 0x3, 0x2) connect$inet(0xffffffffffffffff, &(0x7f0000000000)={0x2, 0x0, @local}, 0x10) setsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x23, &(0x7f0000000000)={{{@in=@multicast2, @in=@multicast1}}, {{@in6}, 0x0, @in6=@loopback}}, 0xe8) syz_emit_ethernet(0x2a, &(0x7f0000000640)={@random="b100485caa2a", @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0xffffffffffffffff}, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x1c, 0x0, 0x0, 0x0, 0x2, 0x0, @rand_addr, @broadcast}, @igmp={0x11, 0xffffffffffffffff, 0x0, @multicast1}}}}}, &(0x7f0000000140)) 01:56:19 executing program 2: r0 = socket$inet(0x2, 0x3, 0x2) connect$inet(0xffffffffffffffff, &(0x7f0000000000)={0x2, 0x0, @local}, 0x10) setsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x23, &(0x7f0000000000)={{{@in=@multicast2, @in=@multicast1}}, {{@in6}, 0x0, @in6=@loopback}}, 0xe8) syz_emit_ethernet(0x2a, &(0x7f0000000640)={@random="b100485caa2a", @link_local, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x1c, 0x0, 0x0, 0x0, 0x2, 0x0, @rand_addr, @broadcast}, @igmp={0x11, 0x0, 0x0, @multicast1}}}}}, &(0x7f0000000140)={0x0, 0x0, [0x0, 0x1c00]}) 01:56:19 executing program 4: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) ioctl$sock_SIOCETHTOOL(r0, 0x8946, &(0x7f0000000040)={'bond0\x00', &(0x7f0000000240)=ANY=[@ANYBLOB="4c000000000023000000000000000002"]}) r1 = syz_open_dev$adsp(&(0x7f0000004480)='/dev/adsp#\x00', 0xb436, 0x2000) getpeername$unix(r1, &(0x7f00000044c0), &(0x7f0000004540)=0x6e) 01:56:19 executing program 1: r0 = socket(0x40000000001e, 0x1, 0x0) setsockopt(r0, 0x7402, 0x81, &(0x7f0000000440)="9ee3af65d723e191b65e8eaeeffa218c10336af5a9a4caeb6a09b59e1bf13d0fbcf8662115cd337440d247efdecae6962ed94f1251c5d517ec3fe43ee24744dafd1625d3a7e9981a2d794e94fc5b79a612ea43be72a257463383f8c01a87c12179a88a3878e4dfe95e155217953edbb9ffffffff9c216bd161e65711dd79e6779757bc7e6b983baeb8bd4041e088cfd52d5e2bb4625e0a75008c4e4e7f6ca43f18ab447c12820ee1ab906625000000000000000000000000000068c18878e961f1976b2748f69a7189ff339d8a15fd58012e6f66814294bcc39da5b3f8b998e2a14792fc7b92b1a22f4552a588424997a1191ed57b7415f6868f990ff238588103d5ad124f58cd8a3c012ee7a2570adceb2553a5c36aa411d3e3652db7bee30eefae8d3bddf4a4a9e32543463d330869893f44bf4b76206ef7040000002dec029b7106", 0x121) getsockopt$inet_sctp_SCTP_MAXSEG(r0, 0x84, 0xd, &(0x7f0000000000)=@assoc_id=0x0, &(0x7f0000000040)=0x4) setsockopt$inet_sctp6_SCTP_AUTH_DEACTIVATE_KEY(r0, 0x84, 0x23, &(0x7f0000000200)={r1, 0x2}, 0x8) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r0, 0x84, 0x6f, &(0x7f0000000180)={r1, 0xe8, &(0x7f0000000080)=[@in6={0xa, 0x4e22, 0x800, @loopback, 0x7}, @in6={0xa, 0x4e21, 0x2, @loopback}, @in6={0xa, 0x4e23, 0x101, @dev={0xfe, 0x80, [], 0x16}, 0x8}, @in={0x2, 0x4e23}, @in6={0xa, 0x4e22, 0x5, @dev={0xfe, 0x80, [], 0xe}, 0xc94f}, @in6={0xa, 0x4e22, 0x100000000, @empty, 0xac28}, @in={0x2, 0x4e23, @broadcast}, @in={0x2, 0x4e22, @loopback}, @in={0x2, 0x4e22, @local}, @in6={0xa, 0x4e23, 0x8, @dev={0xfe, 0x80, [], 0xd6f}, 0x40}]}, &(0x7f00000001c0)=0x10) 01:56:19 executing program 3: r0 = socket$inet(0x2, 0x3, 0x2) connect$inet(0xffffffffffffffff, &(0x7f0000000000)={0x2, 0x0, @local}, 0x10) setsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x23, &(0x7f0000000000)={{{@in=@multicast2, @in=@multicast1}}, {{@in6}, 0x0, @in6=@loopback}}, 0xe8) syz_emit_ethernet(0x2a, &(0x7f0000000640)={@random="b100485caa2a", @link_local, [], {@ipv4={0x600, {{0x5, 0x4, 0x0, 0x0, 0x1c, 0x0, 0x0, 0x0, 0x2, 0x0, @rand_addr, @broadcast}, @igmp={0x11, 0xffffffffffffffff, 0x0, @multicast1}}}}}, &(0x7f0000000140)) 01:56:19 executing program 5: perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1f}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000340)={&(0x7f0000000000), 0xc, &(0x7f0000000300)={&(0x7f0000000240)=@newlink={0x50, 0x10, 0x721, 0x0, 0x0, {0x0, 0x0, 0xffffff7f}, [@IFLA_LINKINFO={0x28, 0x12, @veth={{0xc, 0x1, 'veth\x00'}, {0x18, 0x2, @VETH_INFO_PEER={0x14}}}}, @IFLA_NET_NS_FD={0x8}]}, 0x50}}, 0x0) [ 665.971960] binder: 12873:12875 Acquire 1 refcount change on invalid ref 0 ret -22 01:56:20 executing program 2: r0 = socket$inet(0x2, 0x3, 0x2) connect$inet(0xffffffffffffffff, &(0x7f0000000000)={0x2, 0x0, @local}, 0x10) setsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x23, &(0x7f0000000000)={{{@in=@multicast2, @in=@multicast1}}, {{@in6}, 0x0, @in6=@loopback}}, 0xe8) syz_emit_ethernet(0x2a, &(0x7f0000000640)={@random="b100485caa2a", @link_local, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x1c, 0x0, 0x0, 0x0, 0x2, 0x0, @rand_addr, @broadcast}, @igmp={0x11, 0x0, 0x0, @multicast1}}}}}, &(0x7f0000000140)={0x0, 0x0, [0x0, 0x8]}) 01:56:20 executing program 4: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) ioctl$sock_SIOCETHTOOL(r0, 0x8946, &(0x7f00000000c0)={'bridge0\x00', &(0x7f0000000100)=ANY=[]}) socketpair(0x4, 0xb, 0x100000001, &(0x7f0000000000)={0xffffffffffffffff}) ioctl$TIOCGSID(r1, 0x5429, &(0x7f0000000080)) 01:56:20 executing program 1: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_opts(r0, 0x29, 0x37, &(0x7f0000000100)=ANY=[@ANYBLOB="e91d0d0000000000000000"], 0x8) r1 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r1, 0x8912, &(0x7f0000000280)="0a5cc80700315f85714070") bpf$OBJ_GET_PROG(0x7, &(0x7f00000002c0)={&(0x7f0000000240)='./file0\x00', 0x0, 0x8}, 0x10) getsockopt$inet6_opts(r0, 0x29, 0x36, &(0x7f0000000000)=""/221, &(0x7f0000000d80)=0xdd) getsockopt$inet_sctp_SCTP_MAXSEG(0xffffffffffffffff, 0x84, 0xd, &(0x7f0000000140)=@assoc_value={0x0, 0x1}, &(0x7f0000000180)=0x8) getsockopt$inet_sctp6_SCTP_RESET_STREAMS(r1, 0x84, 0x77, &(0x7f00000001c0)={r2, 0x6, 0x2, [0x3, 0x4]}, &(0x7f0000000200)=0xc) 01:56:20 executing program 3: r0 = socket$inet(0x2, 0x3, 0x2) connect$inet(0xffffffffffffffff, &(0x7f0000000000)={0x2, 0x0, @local}, 0x10) setsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x23, &(0x7f0000000000)={{{@in=@multicast2, @in=@multicast1}}, {{@in6}, 0x0, @in6=@loopback}}, 0xe8) syz_emit_ethernet(0x2a, &(0x7f0000000640)={@random="b100485caa2a", @link_local, [], {@ipv4={0x8035, {{0x5, 0x4, 0x0, 0x0, 0x1c, 0x0, 0x0, 0x0, 0x2, 0x0, @rand_addr, @broadcast}, @igmp={0x11, 0xffffffffffffffff, 0x0, @multicast1}}}}}, &(0x7f0000000140)) 01:56:20 executing program 0: socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000001f80)={0xffffffffffffffff, 0xffffffffffffffff}) setsockopt$SO_ATTACH_FILTER(r2, 0x1, 0x1a, &(0x7f0000ab9ff0)={0x2, &(0x7f000039a000)=[{0x20, 0x0, 0x0, 0xfffffffffffff010}, {0x6}]}, 0x10) sendmmsg(r1, &(0x7f0000001e80)=[{{&(0x7f0000000700)=@l2={0x1f, 0x0, {}, 0x0, 0x1000000}, 0x80, &(0x7f0000001dc0)}}], 0x1, 0x0) [ 666.122590] binder: 12873:12875 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 666.270053] binder: 12873:12899 Acquire 1 refcount change on invalid ref 0 ret -22 [ 666.332460] binder: 12873:12899 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 01:56:20 executing program 6: r0 = syz_open_dev$sndseq(&(0x7f0000000100)='/dev/snd/seq\x00', 0x0, 0x0) read(r0, &(0x7f0000fb6000)=""/28, 0x3f0) ioctl$SNDRV_SEQ_IOCTL_REMOVE_EVENTS(r0, 0x4040534e, &(0x7f00000001c0)={0xbf}) ioctl$SNDRV_SEQ_IOCTL_QUERY_SUBS(r0, 0xc058534f, &(0x7f00000002c0)={{}, 0x1, 0x0, 0x0, {}, 0x0, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xbf]}) r1 = gettid() timer_create(0x0, &(0x7f0000044000)={0x0, 0x12}, &(0x7f0000000040)) r2 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r2, 0x8912, &(0x7f00000001c0)="0a5cc80700315f85715070") timer_settime(0x0, 0x0, &(0x7f0000000080)={{0x0, 0x989680}, {0x0, 0x9}}, &(0x7f0000040000)) tkill(r1, 0x1000000000014) 01:56:20 executing program 5: perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1f}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000340)={&(0x7f0000000000), 0xc, &(0x7f0000000300)={&(0x7f0000000240)=@newlink={0x50, 0x10, 0x721, 0x0, 0x0, {0x0, 0x0, 0x400300}, [@IFLA_LINKINFO={0x28, 0x12, @veth={{0xc, 0x1, 'veth\x00'}, {0x18, 0x2, @VETH_INFO_PEER={0x14}}}}, @IFLA_NET_NS_FD={0x8}]}, 0x50}}, 0x0) 01:56:20 executing program 3: r0 = socket$inet(0x2, 0x3, 0x2) connect$inet(0xffffffffffffffff, &(0x7f0000000000)={0x2, 0x0, @local}, 0x10) setsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x23, &(0x7f0000000000)={{{@in=@multicast2, @in=@multicast1}}, {{@in6}, 0x0, @in6=@loopback}}, 0xe8) syz_emit_ethernet(0x2a, &(0x7f0000000640)={@random="b100485caa2a", @link_local, [], {@ipv4={0x300, {{0x5, 0x4, 0x0, 0x0, 0x1c, 0x0, 0x0, 0x0, 0x2, 0x0, @rand_addr, @broadcast}, @igmp={0x11, 0xffffffffffffffff, 0x0, @multicast1}}}}}, &(0x7f0000000140)) 01:56:20 executing program 4: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) r1 = openat$sequencer(0xffffffffffffff9c, &(0x7f0000000000)='/dev/sequencer\x00', 0x240, 0x0) ioctl$EVIOCGBITSND(r1, 0x80404532, &(0x7f0000000040)=""/107) ioctl$sock_SIOCETHTOOL(r0, 0x8946, &(0x7f0000000280)={'bond0\x00', &(0x7f00000002c0)=ANY=[@ANYRESDEC=r0]}) 01:56:20 executing program 2: r0 = socket$inet(0x2, 0x3, 0x2) connect$inet(0xffffffffffffffff, &(0x7f0000000000)={0x2, 0x0, @local}, 0x10) setsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x23, &(0x7f0000000000)={{{@in=@multicast2, @in=@multicast1}}, {{@in6}, 0x0, @in6=@loopback}}, 0xe8) syz_emit_ethernet(0x2a, &(0x7f0000000640)={@random="b100485caa2a", @link_local, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x1c, 0x0, 0x0, 0x0, 0x2, 0x0, @rand_addr, @broadcast}, @igmp={0x11, 0x0, 0x0, @multicast1}}}}}, &(0x7f0000000140)={0x0, 0x0, [0x0, 0x1c00000000000000]}) 01:56:20 executing program 1: socket(0x40000000002, 0x3, 0x2) syz_emit_ethernet(0x58, &(0x7f0000000140)={@local, @empty, [], {@llc={0x4, {@llc={0x8e, 0xfe, "9e", "ea4d4dad10ae50646db9ffbe2b19e16d96872af1f3f0c3801f2a12576a6c3ef7ec357affed8223071b57abbe7459b27cd03497c44cc08e5a0277d34e9ff7368be8e335f3be2433"}}}}}, &(0x7f0000000040)={0x0, 0x0, [0x800000000, 0x1000000]}) r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0xd2001, 0x80) ioctl$BLKGETSIZE(r0, 0x1260, &(0x7f00000000c0)) ioctl$BLKRESETZONE(r0, 0x40101283, &(0x7f0000000100)={0x9, 0x1000}) 01:56:20 executing program 0: socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000001f80)={0xffffffffffffffff, 0xffffffffffffffff}) setsockopt$SO_ATTACH_FILTER(r2, 0x1, 0x1a, &(0x7f0000ab9ff0)={0x2, &(0x7f000039a000)=[{0x20, 0x0, 0x0, 0xfffffffffffff010}, {0x6}]}, 0x10) sendmmsg(r1, &(0x7f0000001e80)=[{{&(0x7f0000000700)=@l2={0x1f, 0x0, {}, 0x0, 0x3ec0}, 0x80, &(0x7f0000001dc0)}}], 0x1, 0x0) 01:56:20 executing program 7: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000180)='/dev/sequencer\x00', 0x10002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000080)="0a5cc80700315f85715070") r1 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000001c0)={0x2, 0x0, &(0x7f0000000140)=ANY=[@ANYBLOB='\fc'], 0x0, 0x0, &(0x7f0000000080)}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, &(0x7f00000001c0)}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000040)={0x8, 0x3000000, &(0x7f00000000c0)=[@release={0x400c630f}], 0x1, 0x0, &(0x7f0000000100)='V'}) fstat(r0, &(0x7f00000002c0)) 01:56:20 executing program 5: perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1f}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000340)={&(0x7f0000000000), 0xc, &(0x7f0000000300)={&(0x7f0000000240)=@newlink={0x50, 0x10, 0x721, 0x0, 0x0, {0x0, 0x0, 0x3000000}, [@IFLA_LINKINFO={0x28, 0x12, @veth={{0xc, 0x1, 'veth\x00'}, {0x18, 0x2, @VETH_INFO_PEER={0x14}}}}, @IFLA_NET_NS_FD={0x8}]}, 0x50}}, 0x0) 01:56:20 executing program 2: r0 = socket$inet(0x2, 0x3, 0x2) connect$inet(0xffffffffffffffff, &(0x7f0000000000)={0x2, 0x0, @local}, 0x10) setsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x23, &(0x7f0000000000)={{{@in=@multicast2, @in=@multicast1}}, {{@in6}, 0x0, @in6=@loopback}}, 0xe8) syz_emit_ethernet(0x2a, &(0x7f0000000640)={@random="b100485caa2a", @link_local, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x1c, 0x0, 0x0, 0x0, 0x2, 0x0, @rand_addr, @broadcast}, @igmp={0x11, 0x0, 0x0, @multicast1}}}}}, &(0x7f0000000140)={0x0, 0x0, [0x0, 0xffffffff00000000]}) 01:56:20 executing program 4: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) r1 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000000)='/dev/rtc0\x00', 0x101000, 0x0) ioctl$KVM_SET_PIT2(r1, 0x4070aea0, &(0x7f0000000080)={[{0xfffffffffffffffa, 0x5, 0x8e8c, 0x3f, 0x1, 0x7, 0x2, 0x2, 0x1, 0xfa24, 0x3ff, 0x6, 0x8}, {0xdd, 0x10000, 0x3ff, 0x3f, 0x91, 0x1, 0x8, 0x3f, 0x10000, 0xce, 0x1, 0x1, 0x1}, {0x6, 0x9, 0x6e03, 0x4, 0x8, 0x8, 0xfffffffffffffffe, 0x8000, 0x4, 0x8001, 0x0, 0x8, 0x7}], 0x3}) ioctl$sock_SIOCETHTOOL(r0, 0x8946, &(0x7f0000000040)={'bond0\x00', &(0x7f0000000240)=ANY=[@ANYBLOB="4c000000000023000000000000000002"]}) 01:56:20 executing program 3: r0 = socket$inet(0x2, 0x3, 0x2) connect$inet(0xffffffffffffffff, &(0x7f0000000000)={0x2, 0x0, @local}, 0x10) setsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x23, &(0x7f0000000000)={{{@in=@multicast2, @in=@multicast1}}, {{@in6}, 0x0, @in6=@loopback}}, 0xe8) syz_emit_ethernet(0x2a, &(0x7f0000000640)={@random="b100485caa2a", @link_local, [], {@ipv4={0x8848, {{0x5, 0x4, 0x0, 0x0, 0x1c, 0x0, 0x0, 0x0, 0x2, 0x0, @rand_addr, @broadcast}, @igmp={0x11, 0xffffffffffffffff, 0x0, @multicast1}}}}}, &(0x7f0000000140)) 01:56:20 executing program 1: r0 = getpid() sched_setaffinity(r0, 0x40, &(0x7f0000000080)=0x2) r1 = userfaultfd(0x0) ioctl$UFFDIO_API(r1, 0xc018aa3f, &(0x7f0000000140)={0xaa, 0x40}) r2 = openat$zero(0xffffffffffffff9c, &(0x7f0000006440)='/dev/zero\x00', 0x40000, 0x0) connect$pptp(r2, &(0x7f0000006480)={0x18, 0x2, {0x2, @rand_addr=0x6cec}}, 0x1e) read(r1, &(0x7f0000000000)=""/128, 0x80) ioctl$UFFDIO_REGISTER(r1, 0xc020aa00, &(0x7f0000004fe0)={{&(0x7f0000011000/0x3000)=nil, 0x3000}, 0x1}) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x1e, 0x8031, 0xffffffffffffffff, 0x0) ioctl$UFFDIO_REGISTER(r1, 0xc020aa00, &(0x7f00000001c0)={{&(0x7f0000ffb000/0x3000)=nil, 0x3000}, 0x1}) add_key$keyring(&(0x7f0000000100)='keyring\x00', &(0x7f0000000180), 0x0, 0x0, 0xffffffffffffffff) wait4(r0, 0x0, 0x1, &(0x7f0000000200)) [ 666.828229] binder: 12949:12950 Acquire 1 refcount change on invalid ref 0 ret -22 01:56:20 executing program 0: socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000001f80)={0xffffffffffffffff, 0xffffffffffffffff}) setsockopt$SO_ATTACH_FILTER(r2, 0x1, 0x1a, &(0x7f0000ab9ff0)={0x2, &(0x7f000039a000)=[{0x20, 0x0, 0x0, 0xfffffffffffff010}, {0x6}]}, 0x10) sendmmsg(r1, &(0x7f0000001e80)=[{{&(0x7f0000000700)=@l2={0x1f, 0x0, {}, 0x0, 0x40030000000000}, 0x80, &(0x7f0000001dc0)}}], 0x1, 0x0) 01:56:20 executing program 5: perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1f}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000340)={&(0x7f0000000000), 0xc, &(0x7f0000000300)={&(0x7f0000000240)=@newlink={0x50, 0x10, 0x721, 0x0, 0x0, {0x0, 0x0, 0x900}, [@IFLA_LINKINFO={0x28, 0x12, @veth={{0xc, 0x1, 'veth\x00'}, {0x18, 0x2, @VETH_INFO_PEER={0x14}}}}, @IFLA_NET_NS_FD={0x8}]}, 0x50}}, 0x0) [ 666.967176] binder: 12949:12950 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 01:56:20 executing program 2: r0 = socket$inet(0x2, 0x3, 0x2) connect$inet(0xffffffffffffffff, &(0x7f0000000000)={0x2, 0x0, @local}, 0x10) setsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x23, &(0x7f0000000000)={{{@in=@multicast2, @in=@multicast1}}, {{@in6}, 0x0, @in6=@loopback}}, 0xe8) syz_emit_ethernet(0x2a, &(0x7f0000000640)={@random="b100485caa2a", @link_local, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x1c, 0x0, 0x0, 0x0, 0x2, 0x0, @rand_addr, @broadcast}, @igmp={0x11, 0x0, 0x0, @multicast1}}}}}, &(0x7f0000000140)={0x0, 0x0, [0x0, 0xe000000000000000]}) [ 667.050227] binder: 12949:12974 Acquire 1 refcount change on invalid ref 0 ret -22 [ 667.119451] binder: 12950 RLIMIT_NICE not set [ 667.178558] binder: 12949:12974 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 01:56:21 executing program 5: perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1f}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000340)={&(0x7f0000000000), 0xc, &(0x7f0000000300)={&(0x7f0000000240)=@newlink={0x50, 0x10, 0x721, 0x0, 0x0, {0x0, 0x0, 0xf00}, [@IFLA_LINKINFO={0x28, 0x12, @veth={{0xc, 0x1, 'veth\x00'}, {0x18, 0x2, @VETH_INFO_PEER={0x14}}}}, @IFLA_NET_NS_FD={0x8}]}, 0x50}}, 0x0) 01:56:21 executing program 3: r0 = socket$inet(0x2, 0x3, 0x2) connect$inet(0xffffffffffffffff, &(0x7f0000000000)={0x2, 0x0, @local}, 0x10) setsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x23, &(0x7f0000000000)={{{@in=@multicast2, @in=@multicast1}}, {{@in6}, 0x0, @in6=@loopback}}, 0xe8) syz_emit_ethernet(0x2a, &(0x7f0000000640)={@random="b100485caa2a", @link_local, [], {@ipv4={0x8864, {{0x5, 0x4, 0x0, 0x0, 0x1c, 0x0, 0x0, 0x0, 0x2, 0x0, @rand_addr, @broadcast}, @igmp={0x11, 0xffffffffffffffff, 0x0, @multicast1}}}}}, &(0x7f0000000140)) 01:56:21 executing program 6: r0 = syz_open_dev$sndseq(&(0x7f0000000100)='/dev/snd/seq\x00', 0x0, 0x0) read(r0, &(0x7f0000fb6000)=""/28, 0x3f0) ioctl$SNDRV_SEQ_IOCTL_REMOVE_EVENTS(r0, 0x4040534e, &(0x7f00000001c0)={0xbf}) ioctl$SNDRV_SEQ_IOCTL_QUERY_SUBS(r0, 0xc058534f, &(0x7f00000002c0)={{}, 0x1, 0x0, 0x0, {}, 0x0, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xe00000000000000]}) r1 = gettid() timer_create(0x0, &(0x7f0000044000)={0x0, 0x12}, &(0x7f0000000040)) r2 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r2, 0x8912, &(0x7f00000001c0)="0a5cc80700315f85715070") timer_settime(0x0, 0x0, &(0x7f0000000080)={{0x0, 0x989680}, {0x0, 0x9}}, &(0x7f0000040000)) tkill(r1, 0x1000000000014) 01:56:21 executing program 4: r0 = syz_open_dev$dspn(&(0x7f0000000180)='/dev/dsp#\x00', 0x5, 0x1) r1 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000100)='IPVS\x00') sendmsg$IPVS_CMD_SET_INFO(r0, &(0x7f0000000240)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x1180}, 0xc, &(0x7f0000000200)={&(0x7f0000000540)=ANY=[@ANYBLOB="1c010000", @ANYRES16=r1, @ANYBLOB="20002abd7000ffdbdf250e00000008000600810000002400020008000800040000000800070000100000080002004e200000080002004e23000058000100080004004e200000080009001100000008000b0073697000080006006f7666000800090005000000080009005a0000001400030000000000000000000000ffffac14140d080004004e23000008000500010000001800010014000300ffffffff000000000000000000000000080006000000008008000400ffff00005400020008832a1cee0bdfee32000b000a000000080002004e220000080009000000000008000900300000000800070000010000080006000500000008000900000000800800030007000000080002004e24000008000600018000006bc282aecdb1cbdb82d73c2254bc3abb7710ecd221ff6b8b70643ec0bba5c82582371ba2c7ba72fd489d299c270a925043e6d6f9de4bc0800ab00e2759d157f4bc4d4439467de38924d033687eec3a927c1faee47e858dadc0082be08c99a3c710d623f8df47b22d323809c4"], 0x11c}, 0x1, 0x0, 0x0, 0x40800}, 0x1) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) timer_create(0x0, &(0x7f0000000080)={0x0, 0x33}, &(0x7f00000001c0)=0x0) clock_gettime(0x0, &(0x7f0000000280)={0x0, 0x0}) timer_settime(r3, 0x1, &(0x7f00000002c0)={{0x0, 0x1c9c380}, {r4, r5+30000000}}, 0x0) ioctl$sock_SIOCETHTOOL(r2, 0x8946, &(0x7f0000000040)={'bond0\x00', &(0x7f0000000000)=ANY=[@ANYPTR=&(0x7f0000000140)=ANY=[@ANYRESHEX]]}) 01:56:21 executing program 2: r0 = socket$inet(0x2, 0x3, 0x2) connect$inet(0xffffffffffffffff, &(0x7f0000000000)={0x2, 0x0, @local}, 0x10) setsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x23, &(0x7f0000000000)={{{@in=@multicast2, @in=@multicast1}}, {{@in6}, 0x0, @in6=@loopback}}, 0xe8) syz_emit_ethernet(0x2a, &(0x7f0000000640)={@random="b100485caa2a", @link_local, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x1c, 0x0, 0x0, 0x0, 0x2, 0x0, @rand_addr, @broadcast}, @igmp={0x11, 0x0, 0x0, @multicast1}}}}}, &(0x7f0000000140)={0x0, 0x0, [0x0, 0x300000000000000]}) 01:56:21 executing program 7: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000180)='/dev/sequencer\x00', 0x10002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000080)="0a5cc80700315f85715070") r1 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000001c0)={0x2, 0x0, &(0x7f0000000140)=ANY=[@ANYBLOB='\fc'], 0x0, 0x0, &(0x7f0000000080)}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, &(0x7f00000001c0)}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000040)={0x8, 0x6c00, &(0x7f00000000c0)=[@release={0x400c630f}], 0x1, 0x0, &(0x7f0000000100)='V'}) fstat(r0, &(0x7f00000002c0)) 01:56:21 executing program 1: r0 = add_key$keyring(&(0x7f00000002c0)='keyring\x00', &(0x7f0000000300), 0x0, 0x0, 0xfffffffffffffffe) r1 = add_key$keyring(&(0x7f0000000400)='keyring\x00', &(0x7f0000000000), 0x0, 0x0, r0) r2 = add_key$keyring(&(0x7f00000000c0)='keyring\x00', &(0x7f0000000180), 0x0, 0x0, r1) r3 = add_key$user(&(0x7f00003bd000)='user\x00', &(0x7f0000000b00), &(0x7f0000000680)='\x00', 0x1, r2) r4 = add_key$user(&(0x7f0000002cc0)='user\x00', &(0x7f0000000040), &(0x7f0000000280), 0x182, r0) set_thread_area(&(0x7f0000000080)={0x81, 0xffffffffffffffff, 0x5000, 0x0, 0xb11e, 0x8, 0x5, 0x3, 0x7f8f, 0x9}) r5 = add_key$user(&(0x7f0000000140)='user\x00', &(0x7f00000001c0)={0x73, 0x79, 0x7a, 0x0}, &(0x7f0000000280)='u', 0x1, r0) fcntl$getownex(0xffffffffffffffff, 0x10, &(0x7f0000000340)={0x0, 0x0}) getpgid(r6) keyctl$dh_compute(0x17, &(0x7f0000000100)={r3, r4, r5}, &(0x7f0000000200)=""/5, 0x4, &(0x7f0000000240)={&(0x7f0000a3dffa)={'sha224-avx\x00'}}) 01:56:21 executing program 0: socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000001f80)={0xffffffffffffffff, 0xffffffffffffffff}) setsockopt$SO_ATTACH_FILTER(r2, 0x1, 0x1a, &(0x7f0000ab9ff0)={0x2, &(0x7f000039a000)=[{0x20, 0x0, 0x0, 0xfffffffffffff010}, {0x6}]}, 0x10) sendmmsg(r1, &(0x7f0000001e80)=[{{&(0x7f0000000700)=@l2={0x1f, 0x0, {}, 0x0, 0x1100000000000000}, 0x80, &(0x7f0000001dc0)}}], 0x1, 0x0) 01:56:21 executing program 4: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) ioctl$sock_SIOCETHTOOL(r0, 0x8946, &(0x7f0000000040)={'bond0\x00', &(0x7f0000000240)=ANY=[@ANYBLOB="4c000000000023000000000000000002"]}) pipe(&(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$RTC_PLL_SET(r1, 0x40207012, &(0x7f00000000c0)={0x2, 0x4, 0x3, 0x8, 0x0, 0x1, 0x7fffffff}) ioctl$PPPOEIOCSFWD(r2, 0x4008b100, &(0x7f0000000000)={0x18, 0x0, {0x2, @link_local, 'teql0\x00'}}) ioctl$RTC_EPOCH_READ(r2, 0x8008700d, &(0x7f0000000080)) 01:56:21 executing program 5: perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1f}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000340)={&(0x7f0000000000), 0xc, &(0x7f0000000300)={&(0x7f0000000240)=@newlink={0x50, 0x10, 0x721, 0x0, 0x0, {0x0, 0x0, 0xf0}, [@IFLA_LINKINFO={0x28, 0x12, @veth={{0xc, 0x1, 'veth\x00'}, {0x18, 0x2, @VETH_INFO_PEER={0x14}}}}, @IFLA_NET_NS_FD={0x8}]}, 0x50}}, 0x0) [ 667.735662] binder: 13000:13014 Acquire 1 refcount change on invalid ref 0 ret -22 [ 667.753228] binder: 13000:13014 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 01:56:21 executing program 2: r0 = socket$inet(0x2, 0x3, 0x2) connect$inet(0xffffffffffffffff, &(0x7f0000000000)={0x2, 0x0, @local}, 0x10) setsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x23, &(0x7f0000000000)={{{@in=@multicast2, @in=@multicast1}}, {{@in6}, 0x0, @in6=@loopback}}, 0xe8) syz_emit_ethernet(0x2a, &(0x7f0000000640)={@random="b100485caa2a", @link_local, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x1c, 0x0, 0x0, 0x0, 0x2, 0x0, @rand_addr, @broadcast}, @igmp={0x11, 0x0, 0x0, @multicast1}}}}}, &(0x7f0000000140)={0x0, 0x0, [0x0, 0x6000000]}) 01:56:21 executing program 3: r0 = socket$inet(0x2, 0x3, 0x2) connect$inet(0xffffffffffffffff, &(0x7f0000000000)={0x2, 0x0, @local}, 0x10) setsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x23, &(0x7f0000000000)={{{@in=@multicast2, @in=@multicast1}}, {{@in6}, 0x0, @in6=@loopback}}, 0xe8) syz_emit_ethernet(0x2a, &(0x7f0000000640)={@random="b100485caa2a", @link_local, [], {@ipv4={0x803, {{0x5, 0x4, 0x0, 0x0, 0x1c, 0x0, 0x0, 0x0, 0x2, 0x0, @rand_addr, @broadcast}, @igmp={0x11, 0xffffffffffffffff, 0x0, @multicast1}}}}}, &(0x7f0000000140)) 01:56:21 executing program 1: r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f00000004c0)={0x26, 'rng\x00', 0x0, 0x0, 'drbg_pr_sha1\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000ff8000), 0x0) r1 = accept$alg(r0, 0x0, 0x0) r2 = socket$inet6(0xa, 0xa, 0x9) ioctl(r2, 0x8912, &(0x7f0000000080)="0a5cc80700315f85715070") recvmsg(r1, &(0x7f00000000c0)={&(0x7f0000000340)=@alg, 0x80, &(0x7f0000000140)=[{&(0x7f0000002840)=""/4096, 0x1000}], 0x1, &(0x7f0000fb3fa9)=""/87, 0x57}, 0x0) 01:56:21 executing program 0: socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000001f80)={0xffffffffffffffff, 0xffffffffffffffff}) setsockopt$SO_ATTACH_FILTER(r2, 0x1, 0x1a, &(0x7f0000ab9ff0)={0x2, &(0x7f000039a000)=[{0x20, 0x0, 0x0, 0xfffffffffffff010}, {0x6}]}, 0x10) sendmmsg(r1, &(0x7f0000001e80)=[{{&(0x7f0000000700)=@l2={0x1f, 0x0, {}, 0x0, 0x40000}, 0x80, &(0x7f0000001dc0)}}], 0x1, 0x0) 01:56:21 executing program 4: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) setsockopt$netlink_NETLINK_LISTEN_ALL_NSID(r0, 0x10e, 0x8, &(0x7f0000000000)=0x80000, 0x4) ioctl$sock_SIOCETHTOOL(r0, 0x8946, &(0x7f0000000040)={'bond0\x00', &(0x7f0000000240)=ANY=[@ANYBLOB="4c000000000023000000000000000002"]}) 01:56:21 executing program 5: perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1f}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000340)={&(0x7f0000000000), 0xc, &(0x7f0000000300)={&(0x7f0000000240)=@newlink={0x50, 0x10, 0x721, 0x0, 0x0, {0x0, 0x0, 0x600}, [@IFLA_LINKINFO={0x28, 0x12, @veth={{0xc, 0x1, 'veth\x00'}, {0x18, 0x2, @VETH_INFO_PEER={0x14}}}}, @IFLA_NET_NS_FD={0x8}]}, 0x50}}, 0x0) [ 667.882742] binder: 13000:13032 Acquire 1 refcount change on invalid ref 0 ret -22 [ 667.921505] binder: 13000:13032 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 01:56:21 executing program 2: r0 = socket$inet(0x2, 0x3, 0x2) connect$inet(0xffffffffffffffff, &(0x7f0000000000)={0x2, 0x0, @local}, 0x10) setsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x23, &(0x7f0000000000)={{{@in=@multicast2, @in=@multicast1}}, {{@in6}, 0x0, @in6=@loopback}}, 0xe8) syz_emit_ethernet(0x2a, &(0x7f0000000640)={@random="b100485caa2a", @link_local, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x1c, 0x0, 0x0, 0x0, 0x2, 0x0, @rand_addr, @broadcast}, @igmp={0x11, 0x0, 0x0, @multicast1}}}}}, &(0x7f0000000140)={0x0, 0x0, [0x0, 0x1000000]}) 01:56:21 executing program 3: r0 = socket$inet(0x2, 0x3, 0x2) connect$inet(0xffffffffffffffff, &(0x7f0000000000)={0x2, 0x0, @local}, 0x10) setsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x23, &(0x7f0000000000)={{{@in=@multicast2, @in=@multicast1}}, {{@in6}, 0x0, @in6=@loopback}}, 0xe8) syz_emit_ethernet(0x2a, &(0x7f0000000640)={@random="b100485caa2a", @link_local, [], {@ipv4={0x81c, {{0x5, 0x4, 0x0, 0x0, 0x1c, 0x0, 0x0, 0x0, 0x2, 0x0, @rand_addr, @broadcast}, @igmp={0x11, 0xffffffffffffffff, 0x0, @multicast1}}}}}, &(0x7f0000000140)) [ 668.002581] binder: 13014 RLIMIT_NICE not set 01:56:22 executing program 0: socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000001f80)={0xffffffffffffffff, 0xffffffffffffffff}) setsockopt$SO_ATTACH_FILTER(r2, 0x1, 0x1a, &(0x7f0000ab9ff0)={0x2, &(0x7f000039a000)=[{0x20, 0x0, 0x0, 0xfffffffffffff010}, {0x6}]}, 0x10) sendmmsg(r1, &(0x7f0000001e80)=[{{&(0x7f0000000700)=@l2={0x1f, 0x0, {}, 0x0, 0x1100}, 0x80, &(0x7f0000001dc0)}}], 0x1, 0x0) 01:56:22 executing program 4: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) ioctl$sock_SIOCETHTOOL(r0, 0x8946, &(0x7f0000000040)={'bond0\x00', &(0x7f0000000240)=ANY=[@ANYBLOB="4c000000000023000000000000000002"]}) r1 = openat$pfkey(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/net/pfkey\x00', 0x200, 0x0) setsockopt$inet6_MRT6_DEL_MFC(r1, 0x29, 0xcd, &(0x7f0000000080)={{0xa, 0x4e23, 0x4, @local, 0xffff}, {0xa, 0x4e24, 0x80000000000000, @ipv4={[], [], @loopback}, 0x5}, 0x1, [0x5, 0x0, 0x5f, 0x43, 0x5, 0x6, 0xffffffff, 0x8]}, 0x5c) 01:56:22 executing program 1: r0 = openat$autofs(0xffffffffffffff9c, &(0x7f0000000000)='/dev/autofs\x00', 0x180, 0x0) ioctl$EVIOCSABS3F(r0, 0x401845ff, &(0x7f0000000040)={0x4, 0x0, 0x5, 0x4, 0x1}) r1 = syz_open_dev$sndseq(&(0x7f0000000280)='/dev/snd/seq\x00', 0x0, 0x0) perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10000003, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$SNDRV_SEQ_IOCTL_QUERY_SUBS(r1, 0xc058534f, &(0x7f0000000080)) 01:56:22 executing program 6: r0 = syz_open_dev$sndseq(&(0x7f0000000100)='/dev/snd/seq\x00', 0x0, 0x0) read(r0, &(0x7f0000fb6000)=""/28, 0x3f0) ioctl$SNDRV_SEQ_IOCTL_REMOVE_EVENTS(r0, 0x4040534e, &(0x7f00000001c0)={0xbf}) ioctl$SNDRV_SEQ_IOCTL_QUERY_SUBS(r0, 0xc058534f, &(0x7f00000002c0)={{}, 0x1, 0x0, 0x0, {}, 0x0, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xbf000000]}) r1 = gettid() timer_create(0x0, &(0x7f0000044000)={0x0, 0x12}, &(0x7f0000000040)) r2 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r2, 0x8912, &(0x7f00000001c0)="0a5cc80700315f85715070") timer_settime(0x0, 0x0, &(0x7f0000000080)={{0x0, 0x989680}, {0x0, 0x9}}, &(0x7f0000040000)) tkill(r1, 0x1000000000014) 01:56:22 executing program 2: r0 = socket$inet(0x2, 0x3, 0x2) connect$inet(0xffffffffffffffff, &(0x7f0000000000)={0x2, 0x0, @local}, 0x10) setsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x23, &(0x7f0000000000)={{{@in=@multicast2, @in=@multicast1}}, {{@in6}, 0x0, @in6=@loopback}}, 0xe8) syz_emit_ethernet(0x2a, &(0x7f0000000640)={@random="b100485caa2a", @link_local, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x1c, 0x0, 0x0, 0x0, 0x2, 0x0, @rand_addr, @broadcast}, @igmp={0x11, 0x0, 0x0, @multicast1}}}}}, &(0x7f0000000140)={0x0, 0x0, [0x0, 0x60]}) 01:56:22 executing program 3: r0 = socket$inet(0x2, 0x3, 0x2) connect$inet(0xffffffffffffffff, &(0x7f0000000000)={0x2, 0x0, @local}, 0x10) setsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x23, &(0x7f0000000000)={{{@in=@multicast2, @in=@multicast1}}, {{@in6}, 0x0, @in6=@loopback}}, 0xe8) syz_emit_ethernet(0x2a, &(0x7f0000000640)={@random="b100485caa2a", @link_local, [], {@ipv4={0x860, {{0x5, 0x4, 0x0, 0x0, 0x1c, 0x0, 0x0, 0x0, 0x2, 0x0, @rand_addr, @broadcast}, @igmp={0x11, 0xffffffffffffffff, 0x0, @multicast1}}}}}, &(0x7f0000000140)) 01:56:22 executing program 7: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000180)='/dev/sequencer\x00', 0x10002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000080)="0a5cc80700315f85715070") r1 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000001c0)={0x2, 0x0, &(0x7f0000000140)=ANY=[@ANYBLOB='\fc'], 0x0, 0x0, &(0x7f0000000080)}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, &(0x7f00000001c0)}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000040)={0x8, 0xa, &(0x7f00000000c0)=[@release={0x400c630f}], 0x1, 0x0, &(0x7f0000000100)='V'}) fstat(r0, &(0x7f00000002c0)) 01:56:22 executing program 5: perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1f}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000340)={&(0x7f0000000000), 0xc, &(0x7f0000000300)={&(0x7f0000000240)=@newlink={0x50, 0x10, 0x721, 0x0, 0x0, {0x0, 0x0, 0xa}, [@IFLA_LINKINFO={0x28, 0x12, @veth={{0xc, 0x1, 'veth\x00'}, {0x18, 0x2, @VETH_INFO_PEER={0x14}}}}, @IFLA_NET_NS_FD={0x8}]}, 0x50}}, 0x0) 01:56:22 executing program 3: r0 = socket$inet(0x2, 0x3, 0x2) connect$inet(0xffffffffffffffff, &(0x7f0000000000)={0x2, 0x0, @local}, 0x10) setsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x23, &(0x7f0000000000)={{{@in=@multicast2, @in=@multicast1}}, {{@in6}, 0x0, @in6=@loopback}}, 0xe8) syz_emit_ethernet(0x2a, &(0x7f0000000640)={@random="b100485caa2a", @link_local, [], {@ipv4={0x8847, {{0x5, 0x4, 0x0, 0x0, 0x1c, 0x0, 0x0, 0x0, 0x2, 0x0, @rand_addr, @broadcast}, @igmp={0x11, 0xffffffffffffffff, 0x0, @multicast1}}}}}, &(0x7f0000000140)) 01:56:22 executing program 4: r0 = openat$qat_adf_ctl(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/qat_adf_ctl\x00', 0x218042, 0x0) getsockopt$inet_sctp_SCTP_SOCKOPT_PEELOFF(0xffffffffffffffff, 0x84, 0x66, &(0x7f0000000200)={0x0, 0x5}, &(0x7f0000000280)=0x8) getsockopt$inet_sctp_SCTP_GET_PEER_ADDRS(r0, 0x84, 0x6c, &(0x7f00000002c0)={r1, 0xc, "723f3413e4f76131090f41b6"}, &(0x7f0000000300)=0x14) write$FUSE_WRITE(0xffffffffffffff9c, &(0x7f0000000000)={0x18, 0x0, 0x7, {0xa05}}, 0x18) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) r3 = openat$mixer(0xffffffffffffff9c, &(0x7f0000000080)='/dev/mixer\x00', 0x105100, 0x0) ioctl$KVM_GET_IRQCHIP(r3, 0xc208ae62, &(0x7f00000000c0)={0x0, 0x0, @ioapic}) ioctl$sock_SIOCETHTOOL(r2, 0x8946, &(0x7f0000000040)={'bond0\x00', &(0x7f0000000240)=ANY=[@ANYBLOB="000000000000000600"]}) bpf$MAP_CREATE(0x0, &(0x7f0000000340)={0xd, 0x3, 0xdcb, 0x20000000000000, 0x10, 0xffffffffffffff9c, 0x360}, 0x2c) 01:56:22 executing program 2: r0 = socket$inet(0x2, 0x3, 0x2) connect$inet(0xffffffffffffffff, &(0x7f0000000000)={0x2, 0x0, @local}, 0x10) setsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x23, &(0x7f0000000000)={{{@in=@multicast2, @in=@multicast1}}, {{@in6}, 0x0, @in6=@loopback}}, 0xe8) syz_emit_ethernet(0x2a, &(0x7f0000000640)={@random="b100485caa2a", @link_local, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x1c, 0x0, 0x0, 0x0, 0x2, 0x0, @rand_addr, @broadcast}, @igmp={0x11, 0x0, 0x0, @multicast1}}}}}, &(0x7f0000000140)={0x0, 0x0, [0x0, 0x3e00000000000000]}) [ 668.656064] binder: 13084:13097 Acquire 1 refcount change on invalid ref 0 ret -22 01:56:22 executing program 1: r0 = syz_open_dev$sndpcmc(&(0x7f0000000100)='/dev/snd/pcmC#D#c\x00', 0x0, 0x0) r1 = bpf$MAP_CREATE(0x0, &(0x7f0000000140)={0x5, 0x9, 0x7, 0x1}, 0x2c) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000180)={r1, &(0x7f00000000c0), &(0x7f0000000140)}, 0x20) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f00000001c0)={r1, &(0x7f0000000100), &(0x7f0000000440)}, 0x20) fstat(r0, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) ioctl$TUNSETGROUP(r0, 0x400454ce, r2) 01:56:22 executing program 5: perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1f}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000340)={&(0x7f0000000000), 0xc, &(0x7f0000000300)={&(0x7f0000000240)=@newlink={0x50, 0x10, 0x721, 0x0, 0x0, {0x0, 0x0, 0xf}, [@IFLA_LINKINFO={0x28, 0x12, @veth={{0xc, 0x1, 'veth\x00'}, {0x18, 0x2, @VETH_INFO_PEER={0x14}}}}, @IFLA_NET_NS_FD={0x8}]}, 0x50}}, 0x0) 01:56:22 executing program 3: r0 = socket$inet(0x2, 0x3, 0x2) connect$inet(0xffffffffffffffff, &(0x7f0000000000)={0x2, 0x0, @local}, 0x10) setsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x23, &(0x7f0000000000)={{{@in=@multicast2, @in=@multicast1}}, {{@in6}, 0x0, @in6=@loopback}}, 0xe8) syz_emit_ethernet(0x2a, &(0x7f0000000640)={@random="b100485caa2a", @link_local, [], {@ipv4={0x700, {{0x5, 0x4, 0x0, 0x0, 0x1c, 0x0, 0x0, 0x0, 0x2, 0x0, @rand_addr, @broadcast}, @igmp={0x11, 0xffffffffffffffff, 0x0, @multicast1}}}}}, &(0x7f0000000140)) 01:56:22 executing program 0: socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000001f80)={0xffffffffffffffff, 0xffffffffffffffff}) setsockopt$SO_ATTACH_FILTER(r2, 0x1, 0x1a, &(0x7f0000ab9ff0)={0x2, &(0x7f000039a000)=[{0x20, 0x0, 0x0, 0xfffffffffffff010}, {0x6}]}, 0x10) sendmmsg(r1, &(0x7f0000001e80)=[{{&(0x7f0000000700)=@l2={0x1f, 0x0, {}, 0x0, 0xc0}, 0x80, &(0x7f0000001dc0)}}], 0x1, 0x0) 01:56:22 executing program 4: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) ioctl$sock_SIOCETHTOOL(r0, 0x8946, &(0x7f0000000040)={'bond0\x00', &(0x7f0000000240)=ANY=[@ANYBLOB="4c000000000023000000000000000002"]}) r1 = syz_open_dev$mouse(&(0x7f0000000000)='/dev/input/mouse#\x00', 0x3, 0x200) write$RDMA_USER_CM_CMD_CREATE_ID(0xffffffffffffff9c, &(0x7f00000000c0)={0x0, 0x18, 0xfa00, {0x1, &(0x7f0000000080)={0xffffffffffffffff}, 0x111, 0x2}}, 0x20) write$RDMA_USER_CM_CMD_NOTIFY(r1, &(0x7f0000000100)={0xf, 0x8, 0xfa00, {r2, 0x2}}, 0x10) [ 668.794589] binder: 13084:13097 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 01:56:22 executing program 1: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000080)="0a5cc80700315f85715070") r1 = socket$inet6(0xa, 0x1, 0x0) r2 = userfaultfd(0x0) ioctl$UFFDIO_API(r2, 0xc018aa3f, &(0x7f0000002000)) ioctl$UFFDIO_REGISTER(r2, 0xc020aa00, &(0x7f0000001000)={{&(0x7f0000011000/0x3000)=nil, 0x3000}, 0x1}) r3 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_mreqsrc(r3, 0x0, 0x2000000000000004, &(0x7f0000013ff4)={@local, @rand_addr}, 0xc) getsockopt$inet_tcp_TCP_ZEROCOPY_RECEIVE(r3, 0x6, 0xb, &(0x7f0000000040)={&(0x7f0000012000/0x1000)=nil, 0x1000, 0xe0ffffff}, &(0x7f00000000c0)=0x10) close(r3) r4 = syz_open_dev$amidi(&(0x7f0000000000)='/dev/amidi#\x00', 0x7, 0x800) ioctl$VHOST_SET_MEM_TABLE(r4, 0x4008af03, &(0x7f0000000380)={0x5, 0x0, [{0x100001, 0x99, &(0x7f0000000100)=""/153}, {0x1f000, 0x66, &(0x7f00000001c0)=""/102}, {0x1f002, 0x17, &(0x7f0000000240)=""/23}, {0x0, 0x2c, &(0x7f0000000280)=""/44}, {0x2, 0x82, &(0x7f00000002c0)=""/130}]}) ioctl$TIOCGPGRP(r4, 0x540f, &(0x7f0000000440)) dup3(r1, r2, 0x0) 01:56:22 executing program 2: r0 = socket$inet(0x2, 0x3, 0x2) connect$inet(0xffffffffffffffff, &(0x7f0000000000)={0x2, 0x0, @local}, 0x10) setsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x23, &(0x7f0000000000)={{{@in=@multicast2, @in=@multicast1}}, {{@in6}, 0x0, @in6=@loopback}}, 0xe8) syz_emit_ethernet(0x2a, &(0x7f0000000640)={@random="b100485caa2a", @link_local, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x1c, 0x0, 0x0, 0x0, 0x2, 0x0, @rand_addr, @broadcast}, @igmp={0x11, 0x0, 0x0, @multicast1}}}}}, &(0x7f0000000140)={0x0, 0x0, [0x0, 0x100000000000000]}) 01:56:22 executing program 5: perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1f}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000340)={&(0x7f0000000000), 0xc, &(0x7f0000000300)={&(0x7f0000000240)=@newlink={0x50, 0x10, 0x721, 0x0, 0x0, {0x0, 0x0, 0xffffff7f00000000}, [@IFLA_LINKINFO={0x28, 0x12, @veth={{0xc, 0x1, 'veth\x00'}, {0x18, 0x2, @VETH_INFO_PEER={0x14}}}}, @IFLA_NET_NS_FD={0x8}]}, 0x50}}, 0x0) [ 668.921678] binder: 13084:13121 Acquire 1 refcount change on invalid ref 0 ret -22 [ 668.968064] binder: 13084:13121 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 669.030142] binder: 13097 RLIMIT_NICE not set 01:56:23 executing program 1: r0 = socket$inet(0x2, 0x100000000805, 0x0) r1 = socket$inet6(0xa, 0x1000000000002, 0x0) sendmsg$inet_sctp(r0, &(0x7f00000002c0)={&(0x7f0000000000)=@in6={0xa, 0x4e20}, 0x1c, &(0x7f00000001c0)=[{&(0x7f00000000c0)="4551280340caac3db37dafb659576b7d12851fdbc83e0133f5600c9125b6", 0x1e}, {&(0x7f0000000100)="a83761b296aa5109287bc2199de9bde116ca793b1b68468001f5755ef9a6a4c1503b4d658fc826dbf48195d00e546ae0903b96ca", 0x34}, {&(0x7f0000000140)="5812d6d8aa0bb4bb0764b4577edc46d68d8aa30480bcbaf2aecc0e07891839aac8912e83fc180d52436d434b8e7333ee583fe2a9433437240ad928ec9fc0f9eea372f95e0d0f152f18aef0ba22cdb119245bd2c84866db0706ae8b", 0x5b}], 0x3, &(0x7f0000000200)=[@dstaddrv4={0x18, 0x84, 0x7, @multicast1}, @prinfo={0x18, 0x84, 0x5, {0x20, 0x4}}, @prinfo={0x18, 0x84, 0x5, {0x20, 0x3cc1}}, @dstaddrv6={0x20, 0x84, 0x8, @ipv4={[], [], @broadcast}}, @authinfo={0x18, 0x84, 0x6, {0x6}}, @prinfo={0x18, 0x84, 0x5, {0x10, 0x40}}], 0x98, 0x1}, 0x4000850) ioctl(r1, 0x8912, &(0x7f0000000080)="0a5cc80700315f85715070") listen(r0, 0x3c) setsockopt$inet_sctp_SCTP_AUTO_ASCONF(r0, 0x84, 0x1e, &(0x7f0000000040)=0xfffffffffffffff9, 0x4) getsockopt$inet_sctp_SCTP_AUTO_ASCONF(r0, 0x84, 0x1e, &(0x7f0000745ffc), &(0x7f0000b96000)=0x4) 01:56:23 executing program 3: r0 = socket$inet(0x2, 0x3, 0x2) connect$inet(0xffffffffffffffff, &(0x7f0000000000)={0x2, 0x0, @local}, 0x10) setsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x23, &(0x7f0000000000)={{{@in=@multicast2, @in=@multicast1}}, {{@in6}, 0x0, @in6=@loopback}}, 0xe8) syz_emit_ethernet(0x2a, &(0x7f0000000640)={@random="b100485caa2a", @link_local, [], {@ipv4={0x500, {{0x5, 0x4, 0x0, 0x0, 0x1c, 0x0, 0x0, 0x0, 0x2, 0x0, @rand_addr, @broadcast}, @igmp={0x11, 0xffffffffffffffff, 0x0, @multicast1}}}}}, &(0x7f0000000140)) 01:56:23 executing program 6: r0 = syz_open_dev$sndseq(&(0x7f0000000100)='/dev/snd/seq\x00', 0x0, 0x0) read(r0, &(0x7f0000fb6000)=""/28, 0x3f0) ioctl$SNDRV_SEQ_IOCTL_REMOVE_EVENTS(r0, 0x4040534e, &(0x7f00000001c0)={0xbf}) ioctl$SNDRV_SEQ_IOCTL_QUERY_SUBS(r0, 0xc058534f, &(0x7f00000002c0)={{}, 0x1, 0x0, 0x0, {}, 0x0, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xbf00]}) r1 = gettid() timer_create(0x0, &(0x7f0000044000)={0x0, 0x12}, &(0x7f0000000040)) r2 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r2, 0x8912, &(0x7f00000001c0)="0a5cc80700315f85715070") timer_settime(0x0, 0x0, &(0x7f0000000080)={{0x0, 0x989680}, {0x0, 0x9}}, &(0x7f0000040000)) tkill(r1, 0x1000000000014) 01:56:23 executing program 4: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) set_tid_address(&(0x7f0000000000)) ioctl$sock_SIOCETHTOOL(r0, 0x8946, &(0x7f0000000040)={'bond0\x00', &(0x7f0000000240)=ANY=[@ANYBLOB="4c000000000023000000000000000002"]}) 01:56:23 executing program 5: perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1f}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000340)={&(0x7f0000000000), 0xc, &(0x7f0000000300)={&(0x7f0000000240)=@newlink={0x50, 0x10, 0x721, 0x0, 0x0, {0x0, 0x0, 0x400000000000000}, [@IFLA_LINKINFO={0x28, 0x12, @veth={{0xc, 0x1, 'veth\x00'}, {0x18, 0x2, @VETH_INFO_PEER={0x14}}}}, @IFLA_NET_NS_FD={0x8}]}, 0x50}}, 0x0) 01:56:23 executing program 2: r0 = socket$inet(0x2, 0x3, 0x2) connect$inet(0xffffffffffffffff, &(0x7f0000000000)={0x2, 0x0, @local}, 0x10) setsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x23, &(0x7f0000000000)={{{@in=@multicast2, @in=@multicast1}}, {{@in6}, 0x0, @in6=@loopback}}, 0xe8) syz_emit_ethernet(0x2a, &(0x7f0000000640)={@random="b100485caa2a", @link_local, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x1c, 0x0, 0x0, 0x0, 0x2, 0x0, @rand_addr, @broadcast}, @igmp={0x11, 0x0, 0x0, @multicast1}}}}}, &(0x7f0000000140)={0x0, 0x0, [0x0, 0x2000]}) 01:56:23 executing program 7: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000180)='/dev/sequencer\x00', 0x10002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000080)="0a5cc80700315f85715070") r1 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000001c0)={0x2, 0x0, &(0x7f0000000140)=ANY=[@ANYBLOB='\fc'], 0x0, 0x0, &(0x7f0000000080)}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, &(0x7f00000001c0)}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000040)={0x8, 0x7a, &(0x7f00000000c0)=[@release={0x400c630f}], 0x1, 0x0, &(0x7f0000000100)='V'}) fstat(r0, &(0x7f00000002c0)) 01:56:23 executing program 0: socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000001f80)={0xffffffffffffffff, 0xffffffffffffffff}) setsockopt$SO_ATTACH_FILTER(r2, 0x1, 0x1a, &(0x7f0000ab9ff0)={0x2, &(0x7f000039a000)=[{0x20, 0x0, 0x0, 0xfffffffffffff010}, {0x6}]}, 0x10) sendmmsg(r1, &(0x7f0000001e80)=[{{&(0x7f0000000700)=@l2={0x1f, 0x0, {}, 0x0, 0x100000000000000}, 0x80, &(0x7f0000001dc0)}}], 0x1, 0x0) 01:56:23 executing program 2: r0 = socket$inet(0x2, 0x3, 0x2) connect$inet(0xffffffffffffffff, &(0x7f0000000000)={0x2, 0x0, @local}, 0x10) setsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x23, &(0x7f0000000000)={{{@in=@multicast2, @in=@multicast1}}, {{@in6}, 0x0, @in6=@loopback}}, 0xe8) syz_emit_ethernet(0x2a, &(0x7f0000000640)={@random="b100485caa2a", @link_local, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x1c, 0x0, 0x0, 0x0, 0x2, 0x0, @rand_addr, @broadcast}, @igmp={0x11, 0x0, 0x0, @multicast1}}}}}, &(0x7f0000000140)={0x0, 0x0, [0x0, 0x34000]}) 01:56:23 executing program 4: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) ioctl$sock_SIOCETHTOOL(r0, 0x8946, &(0x7f0000000040)={'bond0\x00', &(0x7f0000000240)=ANY=[@ANYBLOB="4c000000000023000000000000000002"]}) r1 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000000)='statm\x00') accept(r0, &(0x7f0000000080)=@can={0x1d, 0x0}, &(0x7f0000000100)=0x80) bind$can_raw(r1, &(0x7f0000000140)={0x1d, r2}, 0x10) 01:56:23 executing program 1: r0 = socket$inet_smc(0x2b, 0x1, 0x0) listen(r0, 0x0) r1 = perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1f}, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$UFFDIO_UNREGISTER(0xffffffffffffffff, 0xc020aa04, &(0x7f0000007ffc)={&(0x7f0000000000/0x2000)=nil, 0x2000}) r2 = socket$inet6_sctp(0xa, 0x1, 0x84) r3 = dup3(r0, r2, 0x80000) fchdir(r1) ioctl$KDGKBTYPE(r3, 0x4b33, &(0x7f0000000080)) setsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX(r2, 0x84, 0x6e, &(0x7f0000000040)=[@in={0x2, 0x4e23, @remote}, @in={0x2, 0x4e23, @remote}], 0x20) ioctl$sock_SIOCOUTQ(r0, 0x8905, &(0x7f0000001080)) 01:56:23 executing program 5: perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1f}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000340)={&(0x7f0000000000), 0xc, &(0x7f0000000300)={&(0x7f0000000240)=@newlink={0x50, 0x10, 0x721, 0x0, 0x0, {0x0, 0x0, 0xa00000000000000}, [@IFLA_LINKINFO={0x28, 0x12, @veth={{0xc, 0x1, 'veth\x00'}, {0x18, 0x2, @VETH_INFO_PEER={0x14}}}}, @IFLA_NET_NS_FD={0x8}]}, 0x50}}, 0x0) 01:56:23 executing program 3: r0 = socket$inet(0x2, 0x3, 0x2) connect$inet(0xffffffffffffffff, &(0x7f0000000000)={0x2, 0x0, @local}, 0x10) setsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x23, &(0x7f0000000000)={{{@in=@multicast2, @in=@multicast1}}, {{@in6}, 0x0, @in6=@loopback}}, 0xe8) syz_emit_ethernet(0x2a, &(0x7f0000000640)={@random="b100485caa2a", @link_local, [], {@ipv4={0x4305, {{0x5, 0x4, 0x0, 0x0, 0x1c, 0x0, 0x0, 0x0, 0x2, 0x0, @rand_addr, @broadcast}, @igmp={0x11, 0xffffffffffffffff, 0x0, @multicast1}}}}}, &(0x7f0000000140)) [ 669.626427] binder: 13178:13180 Acquire 1 refcount change on invalid ref 0 ret -22 [ 669.662013] binder: 13178:13180 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 01:56:23 executing program 0: socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000001f80)={0xffffffffffffffff, 0xffffffffffffffff}) setsockopt$SO_ATTACH_FILTER(r2, 0x1, 0x1a, &(0x7f0000ab9ff0)={0x2, &(0x7f000039a000)=[{0x20, 0x0, 0x0, 0xfffffffffffff010}, {0x6}]}, 0x10) sendmmsg(r1, &(0x7f0000001e80)=[{{&(0x7f0000000700)=@l2={0x1f, 0x0, {}, 0x0, 0xe03f030000000000}, 0x80, &(0x7f0000001dc0)}}], 0x1, 0x0) 01:56:23 executing program 2: r0 = socket$inet(0x2, 0x3, 0x2) connect$inet(0xffffffffffffffff, &(0x7f0000000000)={0x2, 0x0, @local}, 0x10) setsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x23, &(0x7f0000000000)={{{@in=@multicast2, @in=@multicast1}}, {{@in6}, 0x0, @in6=@loopback}}, 0xe8) syz_emit_ethernet(0x2a, &(0x7f0000000640)={@random="b100485caa2a", @link_local, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x1c, 0x0, 0x0, 0x0, 0x2, 0x0, @rand_addr, @broadcast}, @igmp={0x11, 0x0, 0x0, @multicast1}}}}}, &(0x7f0000000140)={0x0, 0x0, [0x0, 0x7]}) 01:56:23 executing program 4: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) ioctl$sock_SIOCETHTOOL(r0, 0x8946, &(0x7f0000000040)={'bond0\x00', &(0x7f0000000000)=ANY=[@ANYBLOB="4c000000000023000000000000000002"]}) socket$inet6_sctp(0xa, 0x5, 0x84) [ 669.799498] binder: 13180 RLIMIT_NICE not set 01:56:23 executing program 5: perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1f}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000340)={&(0x7f0000000000), 0xc, &(0x7f0000000300)={&(0x7f0000000240)=@newlink={0x50, 0x10, 0x721, 0x0, 0x0, {0x0, 0x0, 0x700000000000000}, [@IFLA_LINKINFO={0x28, 0x12, @veth={{0xc, 0x1, 'veth\x00'}, {0x18, 0x2, @VETH_INFO_PEER={0x14}}}}, @IFLA_NET_NS_FD={0x8}]}, 0x50}}, 0x0) 01:56:23 executing program 3: r0 = socket$inet(0x2, 0x3, 0x2) connect$inet(0xffffffffffffffff, &(0x7f0000000000)={0x2, 0x0, @local}, 0x10) setsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x23, &(0x7f0000000000)={{{@in=@multicast2, @in=@multicast1}}, {{@in6}, 0x0, @in6=@loopback}}, 0xe8) syz_emit_ethernet(0x2a, &(0x7f0000000640)={@random="b100485caa2a", @link_local, [], {@ipv4={0x804, {{0x5, 0x4, 0x0, 0x0, 0x1c, 0x0, 0x0, 0x0, 0x2, 0x0, @rand_addr, @broadcast}, @igmp={0x11, 0xffffffffffffffff, 0x0, @multicast1}}}}}, &(0x7f0000000140)) [ 670.390933] binder: 13178:13232 Acquire 1 refcount change on invalid ref 0 ret -22 [ 670.398865] binder: 13178:13232 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 670.406479] binder: 13211 RLIMIT_NICE not set 01:56:24 executing program 6: r0 = syz_open_dev$sndseq(&(0x7f0000000100)='/dev/snd/seq\x00', 0x0, 0x0) read(r0, &(0x7f0000fb6000)=""/28, 0x3f0) ioctl$SNDRV_SEQ_IOCTL_REMOVE_EVENTS(r0, 0x4040534e, &(0x7f00000001c0)={0xbf}) ioctl$SNDRV_SEQ_IOCTL_QUERY_SUBS(r0, 0xc058534f, &(0x7f00000002c0)={{}, 0x1, 0x0, 0x0, {}, 0x0, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xe]}) r1 = gettid() timer_create(0x0, &(0x7f0000044000)={0x0, 0x12}, &(0x7f0000000040)) r2 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r2, 0x8912, &(0x7f00000001c0)="0a5cc80700315f85715070") timer_settime(0x0, 0x0, &(0x7f0000000080)={{0x0, 0x989680}, {0x0, 0x9}}, &(0x7f0000040000)) tkill(r1, 0x1000000000014) 01:56:24 executing program 1: openat$rfkill(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/rfkill\x00', 0x0, 0x0) perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x45d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1f}, 0x0, 0x0, 0xffffffffffffffff, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000200), 0x0, 0x4}}, 0x20) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000180)='/dev/kvm\x00', 0x0, 0x0) openat$kvm(0xffffffffffffff9c, &(0x7f0000000080)='/dev/kvm\x00', 0x280, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000bf7000)={0x0, 0x3, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) syz_open_procfs$namespace(0x0, &(0x7f0000000300)='ns/cgroup\x00') ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000040)={0x0, 0x3, 0x1f000, 0x2000, &(0x7f0000000000/0x2000)=nil}) 01:56:24 executing program 0: socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000001f80)={0xffffffffffffffff, 0xffffffffffffffff}) setsockopt$SO_ATTACH_FILTER(r2, 0x1, 0x1a, &(0x7f0000ab9ff0)={0x2, &(0x7f000039a000)=[{0x20, 0x0, 0x0, 0xfffffffffffff010}, {0x6}]}, 0x10) sendmmsg(r1, &(0x7f0000001e80)=[{{&(0x7f0000000700)=@l2={0x1f, 0x0, {}, 0x0, 0xeffdffff}, 0x80, &(0x7f0000001dc0)}}], 0x1, 0x0) 01:56:24 executing program 4: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) r1 = openat$autofs(0xffffffffffffff9c, &(0x7f0000000100)='/dev/autofs\x00', 0x200000, 0x0) getsockopt$inet_sctp6_SCTP_PR_SUPPORTED(0xffffffffffffffff, 0x84, 0x71, &(0x7f0000000140)={0x0, 0x5}, &(0x7f0000000180)=0x8) ioctl$EVIOCGUNIQ(r1, 0x80404508, &(0x7f00000000c0)=""/40) setsockopt$inet_sctp6_SCTP_AUTH_DELETE_KEY(r1, 0x84, 0x19, &(0x7f00000001c0)={r2, 0x8}, 0xfffffffffffffea7) ioctl$sock_SIOCETHTOOL(r0, 0x8946, &(0x7f0000000040)={"8a65716c3000", &(0x7f0000000240)=ANY=[@ANYBLOB="03000000000002"]}) accept4(r0, 0x0, &(0x7f0000000000), 0x80800) 01:56:24 executing program 2: r0 = socket$inet(0x2, 0x3, 0x2) connect$inet(0xffffffffffffffff, &(0x7f0000000000)={0x2, 0x0, @local}, 0x10) setsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x23, &(0x7f0000000000)={{{@in=@multicast2, @in=@multicast1}}, {{@in6}, 0x0, @in6=@loopback}}, 0xe8) syz_emit_ethernet(0x2a, &(0x7f0000000640)={@random="b100485caa2a", @link_local, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x1c, 0x0, 0x0, 0x0, 0x2, 0x0, @rand_addr, @broadcast}, @igmp={0x11, 0x0, 0x0, @multicast1}}}}}, &(0x7f0000000140)={0x0, 0x0, [0x0, 0x4000000000000000]}) 01:56:24 executing program 3: r0 = socket$inet(0x2, 0x3, 0x2) connect$inet(0xffffffffffffffff, &(0x7f0000000000)={0x2, 0x0, @local}, 0x10) setsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x23, &(0x7f0000000000)={{{@in=@multicast2, @in=@multicast1}}, {{@in6}, 0x0, @in6=@loopback}}, 0xe8) syz_emit_ethernet(0x2a, &(0x7f0000000640)={@random="b100485caa2a", @link_local, [], {@ipv4={0x808, {{0x5, 0x4, 0x0, 0x0, 0x1c, 0x0, 0x0, 0x0, 0x2, 0x0, @rand_addr, @broadcast}, @igmp={0x11, 0xffffffffffffffff, 0x0, @multicast1}}}}}, &(0x7f0000000140)) 01:56:24 executing program 5: perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1f}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000340)={&(0x7f0000000000), 0xc, &(0x7f0000000300)={&(0x7f0000000240)=@newlink={0x50, 0x10, 0x721, 0x0, 0x0, {0x0, 0x0, 0x500}, [@IFLA_LINKINFO={0x28, 0x12, @veth={{0xc, 0x1, 'veth\x00'}, {0x18, 0x2, @VETH_INFO_PEER={0x14}}}}, @IFLA_NET_NS_FD={0x8}]}, 0x50}}, 0x0) 01:56:24 executing program 7: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000180)='/dev/sequencer\x00', 0x10002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000080)="0a5cc80700315f85715070") r1 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000001c0)={0x2, 0x0, &(0x7f0000000140)=ANY=[@ANYBLOB='\fc'], 0x0, 0x0, &(0x7f0000000080)}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, &(0x7f00000001c0)}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000040)={0x8, 0x6800000000000000, &(0x7f00000000c0)=[@release={0x400c630f}], 0x1, 0x0, &(0x7f0000000100)='V'}) fstat(r0, &(0x7f00000002c0)) 01:56:24 executing program 3: r0 = socket$inet(0x2, 0x3, 0x2) connect$inet(0xffffffffffffffff, &(0x7f0000000000)={0x2, 0x0, @local}, 0x10) setsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x23, &(0x7f0000000000)={{{@in=@multicast2, @in=@multicast1}}, {{@in6}, 0x0, @in6=@loopback}}, 0xe8) syz_emit_ethernet(0x2a, &(0x7f0000000640)={@random="b100485caa2a", @link_local, [], {@ipv4={0x8100, {{0x5, 0x4, 0x0, 0x0, 0x1c, 0x0, 0x0, 0x0, 0x2, 0x0, @rand_addr, @broadcast}, @igmp={0x11, 0xffffffffffffffff, 0x0, @multicast1}}}}}, &(0x7f0000000140)) 01:56:24 executing program 4: socket$nl_netfilter(0x10, 0x3, 0xc) r0 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000280)='/dev/vga_arbiter\x00', 0x40000, 0x0) ioctl$RTC_WKALM_RD(r0, 0x80287010, &(0x7f00000002c0)) getsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x11, &(0x7f0000000440)={{{@in=@broadcast, @in=@remote}}, {{@in6=@local}, 0x0, @in=@dev}}, &(0x7f0000000540)=0xe8) r1 = syz_open_dev$amidi(&(0x7f0000000000)='/dev/amidi#\x00', 0x8, 0x30880) getsockopt$bt_BT_RCVMTU(r1, 0x112, 0xd, &(0x7f00000001c0)=0x8, &(0x7f0000000240)=0x2) r2 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000300)='IPVS\x00') sendmsg$IPVS_CMD_FLUSH(r0, &(0x7f0000000400)={&(0x7f0000000200)={0x10, 0x0, 0x0, 0x28200000}, 0xc, &(0x7f00000003c0)={&(0x7f0000000340)={0x70, r2, 0x100, 0x70bd26, 0x25dfdbfd, {}, [@IPVS_CMD_ATTR_SERVICE={0x14, 0x1, [@IPVS_SVC_ATTR_FWMARK={0x8, 0x5, 0x4}, @IPVS_SVC_ATTR_FWMARK={0x8, 0x5, 0x2}]}, @IPVS_CMD_ATTR_DAEMON={0x48, 0x3, [@IPVS_DAEMON_ATTR_SYNC_MAXLEN={0x8, 0x4, 0x7fffffff}, @IPVS_DAEMON_ATTR_MCAST_GROUP={0x8, 0x5, @local}, @IPVS_DAEMON_ATTR_SYNC_MAXLEN={0x8, 0x4, 0x7}, @IPVS_DAEMON_ATTR_MCAST_GROUP={0x8, 0x5, @dev={0xac, 0x14, 0x14, 0x1b}}, @IPVS_DAEMON_ATTR_MCAST_PORT={0x8, 0x7, 0x4e22}, @IPVS_DAEMON_ATTR_MCAST_GROUP6={0x14, 0x6, @remote}, @IPVS_DAEMON_ATTR_MCAST_PORT={0x8, 0x7, 0x4e23}]}]}, 0x70}, 0x1, 0x0, 0x0, 0x11}, 0x80) r3 = syz_genetlink_get_family_id$ipvs(&(0x7f00000000c0)='IPVS\x00') sendmsg$IPVS_CMD_GET_DEST(r1, &(0x7f0000000180)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x40000}, 0xc, &(0x7f0000000140)={&(0x7f0000000100)=ANY=[@ANYBLOB='0\x00\x00\x00', @ANYRES16=r3, @ANYBLOB="240328bd7000fbdbdf2508000000080005001a9a00000c000100080001000a0000000800050004000000"], 0x30}, 0x1, 0x0, 0x0, 0x20000015}, 0x20000000) setsockopt$sock_int(r1, 0x1, 0x6, &(0x7f0000000040)=0x7, 0x4) 01:56:24 executing program 5: perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1f}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000340)={&(0x7f0000000000), 0xc, &(0x7f0000000300)={&(0x7f0000000240)=@newlink={0x50, 0x10, 0x721, 0x0, 0x0, {0x0, 0x0, 0xab4}, [@IFLA_LINKINFO={0x28, 0x12, @veth={{0xc, 0x1, 'veth\x00'}, {0x18, 0x2, @VETH_INFO_PEER={0x14}}}}, @IFLA_NET_NS_FD={0x8}]}, 0x50}}, 0x0) 01:56:24 executing program 2: r0 = socket$inet(0x2, 0x3, 0x2) connect$inet(0xffffffffffffffff, &(0x7f0000000000)={0x2, 0x0, @local}, 0x10) setsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x23, &(0x7f0000000000)={{{@in=@multicast2, @in=@multicast1}}, {{@in6}, 0x0, @in6=@loopback}}, 0xe8) syz_emit_ethernet(0x2a, &(0x7f0000000640)={@random="b100485caa2a", @link_local, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x1c, 0x0, 0x0, 0x0, 0x2, 0x0, @rand_addr, @broadcast}, @igmp={0x11, 0x0, 0x0, @multicast1}}}}}, &(0x7f0000000140)={0x0, 0x0, [0x0, 0x3000000]}) 01:56:24 executing program 1: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = syz_open_dev$dspn(&(0x7f0000000040)='/dev/dsp#\x00', 0xb, 0x0) read(r1, &(0x7f0000000100)=""/158, 0x9e) ioctl$GIO_SCRNMAP(r1, 0x4b40, &(0x7f0000000080)=""/52) ioctl$int_in(r1, 0x800000c0045005, &(0x7f00000000c0)=0x40000) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) 01:56:24 executing program 3: r0 = socket$inet(0x2, 0x3, 0x2) connect$inet(0xffffffffffffffff, &(0x7f0000000000)={0x2, 0x0, @local}, 0x10) setsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x23, &(0x7f0000000000)={{{@in=@multicast2, @in=@multicast1}}, {{@in6}, 0x0, @in6=@loopback}}, 0xe8) syz_emit_ethernet(0x2a, &(0x7f0000000640)={@random="b100485caa2a", @link_local, [], {@ipv4={0x8906, {{0x5, 0x4, 0x0, 0x0, 0x1c, 0x0, 0x0, 0x0, 0x2, 0x0, @rand_addr, @broadcast}, @igmp={0x11, 0xffffffffffffffff, 0x0, @multicast1}}}}}, &(0x7f0000000140)) 01:56:24 executing program 0: socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000001f80)={0xffffffffffffffff, 0xffffffffffffffff}) setsockopt$SO_ATTACH_FILTER(r2, 0x1, 0x1a, &(0x7f0000ab9ff0)={0x2, &(0x7f000039a000)=[{0x20, 0x0, 0x0, 0xfffffffffffff010}, {0x6}]}, 0x10) sendmmsg(r1, &(0x7f0000001e80)=[{{&(0x7f0000000700)=@l2={0x1f, 0x0, {}, 0x0, 0x803e}, 0x80, &(0x7f0000001dc0)}}], 0x1, 0x0) [ 670.659432] binder: 13256:13260 Acquire 1 refcount change on invalid ref 0 ret -22 01:56:24 executing program 5: perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1f}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000340)={&(0x7f0000000000), 0xc, &(0x7f0000000300)={&(0x7f0000000240)=@newlink={0x50, 0x10, 0x721, 0x0, 0x0, {0x0, 0x0, 0xffffff9e}, [@IFLA_LINKINFO={0x28, 0x12, @veth={{0xc, 0x1, 'veth\x00'}, {0x18, 0x2, @VETH_INFO_PEER={0x14}}}}, @IFLA_NET_NS_FD={0x8}]}, 0x50}}, 0x0) [ 670.811356] binder: 13256:13260 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 670.889093] binder: 13256:13301 Acquire 1 refcount change on invalid ref 0 ret -22 [ 670.898596] binder: 13256:13301 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 01:56:25 executing program 6: r0 = syz_open_dev$sndseq(&(0x7f0000000100)='/dev/snd/seq\x00', 0x0, 0x0) read(r0, &(0x7f0000fb6000)=""/28, 0x3f0) ioctl$SNDRV_SEQ_IOCTL_REMOVE_EVENTS(r0, 0x4040534e, &(0x7f00000001c0)={0xbf}) ioctl$SNDRV_SEQ_IOCTL_QUERY_SUBS(r0, 0xc058534f, &(0x7f00000002c0)={{}, 0x1, 0x0, 0x0, {}, 0x0, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xbf]}) r1 = gettid() timer_create(0x0, &(0x7f0000044000)={0x0, 0x12}, &(0x7f0000000040)) r2 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r2, 0x8912, &(0x7f00000001c0)="0a5cc80700315f85715070") timer_settime(0x0, 0x0, &(0x7f0000000080)={{0x0, 0x989680}, {0x0, 0x9}}, &(0x7f0000040000)) tkill(r1, 0x1000000000014) 01:56:25 executing program 2: r0 = socket$inet(0x2, 0x3, 0x2) connect$inet(0xffffffffffffffff, &(0x7f0000000000)={0x2, 0x0, @local}, 0x10) setsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x23, &(0x7f0000000000)={{{@in=@multicast2, @in=@multicast1}}, {{@in6}, 0x0, @in6=@loopback}}, 0xe8) syz_emit_ethernet(0x2a, &(0x7f0000000640)={@random="b100485caa2a", @link_local, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x1c, 0x0, 0x0, 0x0, 0x2, 0x0, @rand_addr, @broadcast}, @igmp={0x11, 0x0, 0x0, @multicast1}}}}}, &(0x7f0000000140)={0x0, 0x0, [0x0, 0x1c000000]}) 01:56:25 executing program 4: r0 = openat$vsock(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vsock\x00', 0x0, 0x0) ioctl$SCSI_IOCTL_DOORUNLOCK(r0, 0x5381) r1 = syz_genetlink_get_family_id$ipvs(&(0x7f00000000c0)='IPVS\x00') sendmsg$IPVS_CMD_SET_SERVICE(r0, &(0x7f00000002c0)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x200000}, 0xc, &(0x7f0000000280)={&(0x7f0000000440)=ANY=[@ANYBLOB="38010000", @ANYRES16=r1, @ANYBLOB="10fb2abd7000fcdbdf25020000001400030008000800016499a0520000000800040000000000080006000700000040000200080002004e21000008000900030000000800060000000000080004001f0000000800070000000000140001000000000000000000000000000000000044000300080005000000000514000600ff0200000000000000000000000000011400020076657468305f746f5f62726964676500080003000300000008000500ac1414bb1c00020008000b000a000000080004000200000008000800ffff66b1980ff3287a210361f4ffff08000600060000005000010008000b00736970000800080002000000080002002c00000008000200840000000800090000000000080002003e00000014000300fe80000000000000000000000000001a080004004e2200000800040006cb0f8168104a"], 0x138}, 0x1, 0x0, 0x0, 0x20008040}, 0x40000) setsockopt$inet6_buf(r0, 0x29, 0x2d, &(0x7f0000000180)="081efe879f1f07dd84f4f72c65fd894798720b29d21c03b429dd0f6fe411f595393c0a4212a2d14e61048de5624134951e9ad9ad7ce16eefe4d5c15ecaaf717d89f9a30f605be8d5f0bfc542583bdc0087b8bd12b571f60390ef9c52dc0453db8623a0cd9844221641cfbbb45dbd3b", 0x6f) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) setsockopt$inet6_MRT6_ADD_MFC(r0, 0x29, 0xcc, &(0x7f0000000100)={{0xa, 0x4e22, 0x1, @dev={0xfe, 0x80, [], 0x15}, 0x4}, {0xa, 0x4e24, 0x5, @loopback, 0x5}, 0x7f, [0x9ef, 0x7, 0x6, 0x6, 0x804, 0x101, 0x7, 0x1]}, 0x5c) ioctl$sock_SIOCETHTOOL(r2, 0x8946, &(0x7f0000000040)={"00000000b3d1d16c7a85c7e400", &(0x7f0000000240)=ANY=[@ANYRES64=r0]}) getsockopt$inet6_IPV6_XFRM_POLICY(r0, 0x29, 0x23, &(0x7f0000000300)={{{@in=@remote, @in=@dev, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@mcast1}}}, &(0x7f0000000400)=0xe8) ioprio_set$uid(0x3, r3, 0x1) 01:56:25 executing program 3: r0 = socket$inet(0x2, 0x3, 0x2) connect$inet(0xffffffffffffffff, &(0x7f0000000000)={0x2, 0x0, @local}, 0x10) setsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x23, &(0x7f0000000000)={{{@in=@multicast2, @in=@multicast1}}, {{@in6}, 0x0, @in6=@loopback}}, 0xe8) syz_emit_ethernet(0x2a, &(0x7f0000000640)={@random="b100485caa2a", @link_local, [], {@ipv4={0x806, {{0x5, 0x4, 0x0, 0x0, 0x1c, 0x0, 0x0, 0x0, 0x2, 0x0, @rand_addr, @broadcast}, @igmp={0x11, 0xffffffffffffffff, 0x0, @multicast1}}}}}, &(0x7f0000000140)) 01:56:25 executing program 0: socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000001f80)={0xffffffffffffffff, 0xffffffffffffffff}) setsockopt$SO_ATTACH_FILTER(r2, 0x1, 0x1a, &(0x7f0000ab9ff0)={0x2, &(0x7f000039a000)=[{0x20, 0x0, 0x0, 0xfffffffffffff010}, {0x6}]}, 0x10) sendmmsg(r1, &(0x7f0000001e80)=[{{&(0x7f0000000700)=@l2={0x1f, 0x0, {}, 0x0, 0x11}, 0x80, &(0x7f0000001dc0)}}], 0x1, 0x0) 01:56:25 executing program 5: perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1f}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000340)={&(0x7f0000000000), 0xc, &(0x7f0000000300)={&(0x7f0000000240)=@newlink={0x50, 0x10, 0x721, 0x0, 0x0, {0x0, 0x0, 0xb40a0000}, [@IFLA_LINKINFO={0x28, 0x12, @veth={{0xc, 0x1, 'veth\x00'}, {0x18, 0x2, @VETH_INFO_PEER={0x14}}}}, @IFLA_NET_NS_FD={0x8}]}, 0x50}}, 0x0) 01:56:25 executing program 7: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000180)='/dev/sequencer\x00', 0x10002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000080)="0a5cc80700315f85715070") r1 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000001c0)={0x2, 0x0, &(0x7f0000000140)=ANY=[@ANYBLOB='\fc'], 0x0, 0x0, &(0x7f0000000080)}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, &(0x7f00000001c0)}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000040)={0x8, 0xfdfdffff, &(0x7f00000000c0)=[@release={0x400c630f}], 0x1, 0x0, &(0x7f0000000100)='V'}) fstat(r0, &(0x7f00000002c0)) 01:56:25 executing program 1: r0 = openat$autofs(0xffffffffffffff9c, &(0x7f00000012c0)='/dev/autofs\x00', 0x0, 0x0) unshare(0x8020000) r1 = syz_open_procfs$namespace(0x0, &(0x7f0000000140)='ns/mnt\x00') getpeername$inet6(r0, &(0x7f0000000000)={0xa, 0x0, 0x0, @mcast1}, &(0x7f0000000040)=0x1c) setns(r1, 0x0) ioctl(r0, 0x800000000000937e, &(0x7f00000000c0)="01000000000000001804000007ff01000000000000d849832f") [ 671.437193] Unknown ioctl 21377 [ 671.468380] Unknown ioctl 21377 01:56:25 executing program 5: perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1f}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000340)={&(0x7f0000000000), 0xc, &(0x7f0000000300)={&(0x7f0000000240)=@newlink={0x50, 0x10, 0x721, 0x0, 0x0, {0x0, 0x0, 0x3}, [@IFLA_LINKINFO={0x28, 0x12, @veth={{0xc, 0x1, 'veth\x00'}, {0x18, 0x2, @VETH_INFO_PEER={0x14}}}}, @IFLA_NET_NS_FD={0x8}]}, 0x50}}, 0x0) 01:56:25 executing program 2: r0 = socket$inet(0x2, 0x3, 0x2) connect$inet(0xffffffffffffffff, &(0x7f0000000000)={0x2, 0x0, @local}, 0x10) setsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x23, &(0x7f0000000000)={{{@in=@multicast2, @in=@multicast1}}, {{@in6}, 0x0, @in6=@loopback}}, 0xe8) syz_emit_ethernet(0x2a, &(0x7f0000000640)={@random="b100485caa2a", @link_local, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x1c, 0x0, 0x0, 0x0, 0x2, 0x0, @rand_addr, @broadcast}, @igmp={0x11, 0x0, 0x0, @multicast1}}}}}, &(0x7f0000000140)={0x0, 0x0, [0x0, 0x3e00]}) 01:56:25 executing program 1: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000200)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r1, 0x5423, &(0x7f0000000100)=0x3) syz_open_pts(r1, 0x40000) ioctl$TCSETS(r1, 0x5402, &(0x7f0000000000)={0x0, 0x0, 0x8000}) socket$kcm(0x29, 0x5, 0x0) syz_open_pts(r1, 0x10000) dup3(0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$TCSETA(0xffffffffffffffff, 0x5406, &(0x7f0000000140)) 01:56:25 executing program 3: r0 = socket$inet(0x2, 0x3, 0x2) connect$inet(0xffffffffffffffff, &(0x7f0000000000)={0x2, 0x0, @local}, 0x10) setsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x23, &(0x7f0000000000)={{{@in=@multicast2, @in=@multicast1}}, {{@in6}, 0x0, @in6=@loopback}}, 0xe8) syz_emit_ethernet(0x2a, &(0x7f0000000640)={@random="b100485caa2a", @link_local, [], {@ipv4={0x8e0, {{0x5, 0x4, 0x0, 0x0, 0x1c, 0x0, 0x0, 0x0, 0x2, 0x0, @rand_addr, @broadcast}, @igmp={0x11, 0xffffffffffffffff, 0x0, @multicast1}}}}}, &(0x7f0000000140)) 01:56:25 executing program 4: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) ioctl$sock_SIOCETHTOOL(r0, 0x8946, &(0x7f0000000040)={'bond0\x00', &(0x7f0000000240)=ANY=[@ANYBLOB="4c000000000023000000000000000002"]}) r1 = openat$zero(0xffffffffffffff9c, &(0x7f0000000000)='/dev/zero\x00', 0x0, 0x0) ioctl$KVM_HAS_DEVICE_ATTR(r1, 0x4018aee3, &(0x7f0000000100)={0x0, 0xefb3, 0x9, &(0x7f00000000c0)=0x1}) openat(r1, &(0x7f0000000080)='./file0\x00', 0x40, 0x1) [ 671.496479] binder: 13324:13325 Acquire 1 refcount change on invalid ref 0 ret -22 [ 671.525956] binder: 13324:13325 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 01:56:25 executing program 0: socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000001f80)={0xffffffffffffffff, 0xffffffffffffffff}) setsockopt$SO_ATTACH_FILTER(r2, 0x1, 0x1a, &(0x7f0000ab9ff0)={0x2, &(0x7f000039a000)=[{0x20, 0x0, 0x0, 0xfffffffffffff010}, {0x6}]}, 0x10) sendmmsg(r1, &(0x7f0000001e80)=[{{&(0x7f0000000700)=@l2={0x1f, 0x0, {}, 0x0, 0xc0000000}, 0x80, &(0x7f0000001dc0)}}], 0x1, 0x0) 01:56:25 executing program 5: perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1f}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000340)={&(0x7f0000000000), 0xc, &(0x7f0000000300)={&(0x7f0000000240)=@newlink={0x50, 0x10, 0x721, 0x0, 0x0, {0x0, 0x0, 0x9effffff00000000}, [@IFLA_LINKINFO={0x28, 0x12, @veth={{0xc, 0x1, 'veth\x00'}, {0x18, 0x2, @VETH_INFO_PEER={0x14}}}}, @IFLA_NET_NS_FD={0x8}]}, 0x50}}, 0x0) 01:56:25 executing program 1: r0 = socket$inet6(0xa, 0xfffffffffffffffc, 0x800) setsockopt$inet6_int(r0, 0x29, 0x1000000000000019, &(0x7f0000548000)=0x4001, 0x4) sendto$inet6(r0, &(0x7f0000000440), 0xfffffffffffffeda, 0x0, &(0x7f0000000100)={0xa, 0x4e24, 0x0, @loopback}, 0x1c) connect$inet6(r0, &(0x7f0000000240)={0xa, 0x4e22, 0x8, @remote}, 0x1c) setsockopt$IP6T_SO_SET_REPLACE(0xffffffffffffffff, 0x29, 0x40, &(0x7f0000000780)=ANY=[@ANYBLOB="7261770000000000000000000000dd00000000000000000000000000000000000900000003000008c802000078010000000000007801000000000000000000008802000088020900880200008802000088020000030000000ceb5dd3d9bf49b8fc80594e5faa78902c", @ANYPTR=&(0x7f00000001c0)=ANY=[@ANYBLOB="00000000000000000000000000000000004000000000000000000000611cc90000000000000000000000000000000000000400"], @ANYBLOB="00000000000000000000000000000000fe8000000000000000000000000000bb0000000000000000000000000000000000000000000000000000000000000000626f6e645f736c6176655f30000000007465616d5f736c6176655f310000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000c800e80000000000000000000000000000000000000000000000000020004e4f545241434b000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000c80010010000000000000000000000000000000000000000000000004800435400000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000a800d0000000000000000000000000000000000000000000000000002800000000000000000000000000000000000000000000000000000000000000feffffff00000000"], 0x328) setsockopt$inet6_IPV6_ADDRFORM(r0, 0x29, 0x1, &(0x7f00000000c0), 0x4) r1 = openat$qat_adf_ctl(0xffffffffffffff9c, &(0x7f0000000140)='/dev/qat_adf_ctl\x00', 0xc0000, 0x0) write$P9_RWSTAT(r1, &(0x7f0000000180)={0x7, 0x7f, 0x2}, 0x7) getsockopt$IP6T_SO_GET_REVISION_MATCH(r0, 0x29, 0x44, &(0x7f0000000040)={'HL\x00'}, &(0x7f0000000200)=0xb) recvmsg(r0, &(0x7f0000000000)={&(0x7f00000002c0)=@nl=@proc, 0xfffffffffffffd6b, &(0x7f0000000040), 0x37b, &(0x7f0000000080)=""/36, 0x24}, 0x2000) [ 671.650751] binder: 13325 RLIMIT_NICE not set 01:56:26 executing program 6: r0 = syz_open_dev$sndseq(&(0x7f0000000100)='/dev/snd/seq\x00', 0x0, 0x0) read(r0, &(0x7f0000fb6000)=""/28, 0x3f0) ioctl$SNDRV_SEQ_IOCTL_REMOVE_EVENTS(r0, 0x4040534e, &(0x7f00000001c0)={0xbf}) ioctl$SNDRV_SEQ_IOCTL_QUERY_SUBS(r0, 0xc058534f, &(0x7f00000002c0)={{}, 0x1, 0x0, 0x0, {}, 0x0, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xe00000000000000]}) r1 = gettid() timer_create(0x0, &(0x7f0000044000)={0x0, 0x12}, &(0x7f0000000040)) r2 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r2, 0x8912, &(0x7f00000001c0)="0a5cc80700315f85715070") timer_settime(0x0, 0x0, &(0x7f0000000080)={{0x0, 0x989680}, {0x0, 0x9}}, &(0x7f0000040000)) tkill(r1, 0x1000000000014) 01:56:26 executing program 2: r0 = socket$inet(0x2, 0x3, 0x2) connect$inet(0xffffffffffffffff, &(0x7f0000000000)={0x2, 0x0, @local}, 0x10) setsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x23, &(0x7f0000000000)={{{@in=@multicast2, @in=@multicast1}}, {{@in6}, 0x0, @in6=@loopback}}, 0xe8) syz_emit_ethernet(0x2a, &(0x7f0000000640)={@random="b100485caa2a", @link_local, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x1c, 0x0, 0x0, 0x0, 0x2, 0x0, @rand_addr, @broadcast}, @igmp={0x11, 0x0, 0x0, @multicast1}}}}}, &(0x7f0000000140)={0x0, 0x0, [0x0, 0xe0]}) 01:56:26 executing program 4: r0 = bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000000c0)={&(0x7f0000000080)='bond0\x00'}, 0x10) setsockopt$inet6_opts(r0, 0x29, 0x3f, &(0x7f0000000100)=@routing={0x2f, 0x4, 0x2, 0x4, 0x0, [@mcast2, @loopback]}, 0x28) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) ioctl$sock_SIOCETHTOOL(r1, 0x8946, &(0x7f0000000040)={'bond0\x00', &(0x7f0000000140)=ANY=[@ANYBLOB="4c00000200002300000000ff00000000000020010000e3fbae90e29376533b27adab63624bc4ef4c000000000000000000000000000000000077a6a3e80724ce4891db859e6638aa5d7d8c869715cb9620d9b200065434070b5d0456cb396c63e6f8270d8b3527ab1ea5042f88be201126af487c3ab8777e544e864e3246548daccddebd8ce3e155492ab6af5988371025e6224187ed5f4a84e0a51f675597e1b0212539923651a06a28212ac40cd36e83b24a8c7029ae5ebef7a86f72f38c20"]}) ioctl$sock_SIOCETHTOOL(r0, 0x8946, &(0x7f0000000200)={'bpq0\x00', &(0x7f0000000000)=@ethtool_stats={0x1d, 0x7, [0x5, 0x3, 0xb612, 0x9, 0xa32, 0x3, 0x0]}}) clock_gettime(0x0, &(0x7f0000000240)={0x0, 0x0}) write$sndseq(r0, &(0x7f00000002c0)=[{0x6, 0x8001, 0xfffffffffffffffb, 0x3, @time={r2, r3+10000000}, {0x3, 0x1}, {0x87}, @control={0x2, 0x3, 0x8}}, {0x8001, 0x9, 0xa5, 0x7fffffff, @time, {0xab, 0x1}, {0x2, 0x7f}, @addr={0x100}}, {0x39b, 0xffff, 0xacc8, 0x0, @tick=0x10001, {0x7fffffff, 0x3}, {0x2, 0x10001}, @addr={0x3, 0x7ff}}, {0xdd5, 0x4, 0x666, 0x5, @tick=0x6, {0x8, 0x7}, {0xffff, 0x2}, @connect={{0x80000000, 0x80}, {0x200000000, 0x8}}}, {0xe7, 0x2, 0x100000001, 0x7ff, @tick=0xad, {0x1, 0x4}, {0x7, 0x38dc}, @note={0x3, 0x385e000000000, 0x2, 0x6b, 0x20}}, {0x40, 0x2, 0x8000, 0x6, @tick=0x1, {0x400, 0x100000001}, {0x5, 0xfffffffffffffffa}, @quote={{0x2b, 0x400}, 0x6, &(0x7f0000000280)={0x6, 0x7fff, 0x8, 0x5, @tick=0x81, {0x6, 0x4}, {0x5}, @control={0x6, 0x4, 0xfffffffeffffffff}}}}, {0x3, 0x7f, 0x4, 0x6, @tick=0x848d, {0x4, 0x5}, {0x8, 0x6}, @result={0x101, 0x100000000}}], 0x150) 01:56:26 executing program 3: r0 = socket$inet(0x2, 0x3, 0x2) connect$inet(0xffffffffffffffff, &(0x7f0000000000)={0x2, 0x0, @local}, 0x10) setsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x23, &(0x7f0000000000)={{{@in=@multicast2, @in=@multicast1}}, {{@in6}, 0x0, @in6=@loopback}}, 0xe8) syz_emit_ethernet(0x2a, &(0x7f0000000640)={@random="b100485caa2a", @link_local, [], {@ipv4={0x807, {{0x5, 0x4, 0x0, 0x0, 0x1c, 0x0, 0x0, 0x0, 0x2, 0x0, @rand_addr, @broadcast}, @igmp={0x11, 0xffffffffffffffff, 0x0, @multicast1}}}}}, &(0x7f0000000140)) 01:56:26 executing program 1: r0 = socket$inet(0x10, 0x3, 0x0) sendmsg(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f00000000c0)="240000002e0007031dfffd946fa2830020200a0009000000001d85680c1ba3a20400ff7e280000005e00ffffba16a0aa1c0009b3ebea8653b1cc7e63975c0ac47b6268e3966cf055d90f15a3", 0x4c}], 0x1}, 0x0) recvmmsg(r0, &(0x7f0000000140), 0x400000000000152, 0x40001ffc, 0x0) 01:56:26 executing program 5: perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1f}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000340)={&(0x7f0000000000), 0xc, &(0x7f0000000300)={&(0x7f0000000240)=@newlink={0x50, 0x10, 0x721, 0x0, 0x0, {0x0, 0x0, 0xf0ffff}, [@IFLA_LINKINFO={0x28, 0x12, @veth={{0xc, 0x1, 'veth\x00'}, {0x18, 0x2, @VETH_INFO_PEER={0x14}}}}, @IFLA_NET_NS_FD={0x8}]}, 0x50}}, 0x0) 01:56:26 executing program 7: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000180)='/dev/sequencer\x00', 0x10002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000080)="0a5cc80700315f85715070") r1 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000001c0)={0x2, 0x0, &(0x7f0000000140)=ANY=[@ANYBLOB='\fc'], 0x0, 0x0, &(0x7f0000000080)}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, &(0x7f00000001c0)}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000040)={0x8, 0x7400, &(0x7f00000000c0)=[@release={0x400c630f}], 0x1, 0x0, &(0x7f0000000100)='V'}) fstat(r0, &(0x7f00000002c0)) 01:56:26 executing program 0: socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000001f80)={0xffffffffffffffff, 0xffffffffffffffff}) setsockopt$SO_ATTACH_FILTER(r2, 0x1, 0x1a, &(0x7f0000ab9ff0)={0x2, &(0x7f000039a000)=[{0x20, 0x0, 0x0, 0xfffffffffffff010}, {0x6}]}, 0x10) sendmmsg(r1, &(0x7f0000001e80)=[{{&(0x7f0000000700)=@l2={0x1f, 0x0, {}, 0x0, 0xe03f0300}, 0x80, &(0x7f0000001dc0)}}], 0x1, 0x0) [ 672.266340] binder: 13324:13374 Acquire 1 refcount change on invalid ref 0 ret -22 [ 672.274331] binder: 13324:13374 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 672.281632] binder: 13358 RLIMIT_NICE not set 01:56:26 executing program 4: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) ioctl$sock_SIOCETHTOOL(r0, 0x8946, &(0x7f0000000040)={'bond0\x00', &(0x7f0000000240)=ANY=[@ANYBLOB="4c000000000023000000000000000002"]}) r1 = dup(r0) getsockopt$inet_sctp6_SCTP_PEER_ADDR_PARAMS(0xffffffffffffff9c, 0x84, 0x9, &(0x7f0000000080)={0x0, @in={{0x2, 0x4e23, @multicast2}}, 0x0, 0x1000, 0x6d, 0x9, 0x2}, &(0x7f0000000000)=0x98) setsockopt$inet_sctp_SCTP_RTOINFO(r1, 0x84, 0x0, &(0x7f0000000140)={r2, 0x8, 0xffffffffcfb068d1, 0x4}, 0x10) 01:56:26 executing program 1: r0 = socket$inet6(0xa, 0x1, 0x8010000000000084) bind$inet6(r0, &(0x7f00002aafe4)={0xa, 0x4e23, 0x0, @ipv4}, 0x1c) r1 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r1, 0x8000000008912, &(0x7f0000000080)="0a5cc80700315f85715070") r2 = openat$mixer(0xffffffffffffff9c, &(0x7f00000018c0)='/dev/mixer\x00', 0x81, 0x0) getsockopt$inet_sctp6_SCTP_DEFAULT_SEND_PARAM(r0, 0x84, 0xa, &(0x7f0000001900)={0x3, 0x0, 0x0, 0x1000, 0x3f, 0xffffffff80000001, 0x9, 0x7, 0x0}, &(0x7f0000001940)=0x20) getsockopt$inet_sctp_SCTP_RECONFIG_SUPPORTED(r2, 0x84, 0x75, &(0x7f0000001980)={r3, 0x7}, &(0x7f00000019c0)=0x8) listen(r0, 0x40) r4 = socket$inet6_sctp(0xa, 0x5, 0x84) shutdown(r4, 0x1) sendto$inet6(r4, &(0x7f0000000180)='F', 0x1, 0x0, &(0x7f000005ffe4)={0xa, 0x4e23, 0x0, @loopback}, 0x1c) ioctl$FS_IOC_FSGETXATTR(r0, 0x801c581f, &(0x7f0000000000)={0x4, 0x8c, 0x0, 0xffffffff, 0x3}) sendmsg(r4, &(0x7f0000000280)={&(0x7f00000000c0)=@in={0x2, 0x4e24, @rand_addr=0xb60}, 0x80, &(0x7f0000000700)=[{&(0x7f00000001c0)="ec5a7e99b0ae25f56ea4f7fbdef903046ea004cb79e22e7719b5a59adb92032627334acda34154228864016423ccddaf43f1dbf534b3c7dca429e815788d7e6b9b44e20fb555be413a07874a34efc00289e7d7a1e20d61be04f9e2b92cbdd9cbd0045f50164ca8451a411eda1d83b76238bfc0e2beafd4d80f6aaafb4bfbbadd948833daed7077ae336d8572f1133e4a0de48295470c9bf5b53c4c1abf037b8cfbf76108c2b57ba586451a6f319ad2abf001853ba6fc63", 0xb7}, {&(0x7f0000000040)="bbd97d", 0x3}, {&(0x7f0000000380)="ed98f23cb15211e6b0f7969258af06da88a5799179f387616c7fc9aa317e7771739a144025f1e7a2bd273d154db4bea6fb9d8abfb6f90c1901bbfafaa3e2bfb0ac8278987c3f8e5935d84297f6f231be7ad6e6b32ec29825fb2d50bce7946353f0c892977096f1129049cb14c3fd667d24e36a8fdd0ca5f1322c4b071a749984e8a69484cd43ef90f061df43f662d8a2ef35e6b438d642fbf85331accd47a270", 0xa0}, {&(0x7f0000000140)="825749ad7d16bad3180f6140cefaa62a6d5b7369802ffbe35ae0a4f0c92953afdf20e45d7a82a50d0601158661923b2bf65b", 0x32}, {&(0x7f0000000440)="9029fcf3daa0d621747797cfafe09bbec458f32ce91abc5d80bd267bfb0ce2a808c6cfb27d8ad5171a5a5d6f2e3a7403ae789b9c7cc14af48ad698fa8590fde0bdd7c57f4c9d5fe8915e2374024d6a383c405eedd81809dcf7089d478200ea349be2ff0dc78fe53219ff854c59cac04d887323af5cc043bb2aa6e1246a960ee9e5e8af83a259ee5020f0233d3c913d1aa48156284b7584654d330f688f14359d21bd4fffb55c5d36e4fb4591b82f", 0xae}, {&(0x7f0000000500)="dcd2ab0494ae1d9bda2a3e18455270b560a6f492af3a60a0227159db90654ee98568f067f829a7ab40a6753cd38622c28fac8dd389bea93cd3d221cd5db72817aad45283485b44c7bda6d897a1ba151810415f4a36ef168d", 0x58}, {&(0x7f0000000580)="fed770d86b8b034e6a37fb62ea0a11347a20b787827ecc2617f725cbd4e91b5989f7805b5df9f4b00be9f49b64f39ad2bd962fef1c32b28350aa0727bd95f044b32d82b86aeb513586f9edd11050fcd0a9305885e2b245d73514292533c9df7295993ee408adea16878553e2fe16ccebab764ede066749eb08276a353d5f5b173ed4601ce81fd096df4615fa08f42ba9959cceb684c57c110120d37df3fbd6c0cd24a9b5061d40dfe48c1502101bdddf99d0516f299a71de8ea5ff3891dd4b87acb7b0c191fe0f967e3729a62d915e9c48408fbe28e70e80964024dfbd0aff", 0xdf}, {&(0x7f0000000680)="07d3431d13d51ff659e74cbb10b9f7b68b5d3bc4ce09dd009d8b62cfde4ca64d6d1b6ffe05a901a23f8d2d51ee2f0315e48ca8aeae87fca29be3c8a98d7bde67fc780034009486fa3007860ca3e3c183f652f4c4dd28ef9465c9988c2d1cee829cb6144d96b5589156ac1dae1e272c", 0x6f}], 0x8, &(0x7f0000001a00)=ANY=[@ANYBLOB="b0000000000000001100000006000000c3f284c8939f5810f443a60a38041e2fe682b38606ee90a6218d1073b9c9051028fa19702a5adab1c2e1b4dfe58785e9b42ac835f311c4645efda6f795162be374e39a534e1d98e938eec105dbfed938dd59ea047407502494e9a1ff3fedac1bfa35291b632cf29a12bcb10d948dea6542f3bc832dab174dbfab77e6bf19209017f64e8181d985d2ccd9cc6865a9e2b6a8440a3e0f99fe1c090000000000000060000000000000008f010000ffffff7fa9fdaa088bbe92bf8b245eab9d93527aedce736089dea649da91331777639ac48a74ea33f01a3b839ac3c3ac215a83eeb1c3df76058ee1ae7b0b6fb27a73dcc10e604ad4f5862357cc2c5dd7000000001010000000000000110000002bffffff6a497f8424c383ce04b942b457df937210cd223029ea04cf9e0d10fd6fec031b81c17ea2bda1741b95ec2ec18ac9cdf5943830908faca74a1b0de821947ccf4a4edb7e8e03fcf4c5df6afc7e761dccea34993bf028ff6ca6395d990d46352c41d3b807c5408f1a100214c6da7bd1a07a069c16bcf820a3a14ed3c2010c3336df7b0ec6052e1b990c21f7171ea83b579155dd69857c5fa9a41bca0c3342b32226211eb6b034aec660607fa4cfdbdee384047f2f5ae1cedd864931b5426f54518a34f42ad5bdf8a77e2c0fa8ca6e6472c1a0b4aeb8877a8295731ca2f7ee7ea1ae98e3a27a41cfaac17dd72c90ec1c7349144cb318ff3e91edadf02162a19256d1d65f7a532ff597b1dac6140a8f8931a36c66ec1a68ec6c1049e2213f2c5713930696c75238aff6a7b35f90074f64b1e1437155e46c562ea238836eca789e1663aaecc9873dac5bc571477d92aaede3ca5f9b04df28c7ef798d730a558f6a6172f56c9d5a200e821f2d3f4b2ab467c23db58c9497c1388934812c6fa08b3eb35559ec249ba5ac4b6cd742e587666b30dcd71124f1e8a2ff33607015af08e02a189731dc43be59b994a88fd25c58d79dc326600b62cc2fe3f07cc3ac9769ed9b9492990d1abf24c1990a77ddcc902e00c870f30e4a65d4eff600aee92e9c3a3e3e2a055d906e2fbe8dd383b6a114f75fe07fbc024e30865349cd7c619c4bd6af14eac92e4864a83c3bf539afb4212db7b47d74f3ccce1cc30b1164a5ba546a1b65bbe4c987dff261574439fd5cc3c71ad74028f14a41e973d51eb8ed72b6cb702093bee532a57bb778772d0a912244cb743bbe8e91cdff571ec4974b5e159fd24d13de2028a2ab95f332d028613422dd7140189dc74424dd202c3d3cbb16b78244fe342f3f2d49841e20afeefa6a5833478d8a7db3484cf76679bf63790335b67fb7559f28eedc68df9e5dee8ccdd4cb5eb1d32105432afff2f1419d18928518717bad254cf1e740e505429d27690a67a231a956053b63c5106dcd78ea00c60e7cd636f83c66ffe111ee17cc9169f3cc941c948bd9f018d4da57dfb6f955361e80ff356d37fcf6e7b3c9714b3c7b2f5bb39319231016422f866dab7c1e0972b7eba9a749b0c5759bf01aba2e131fc62cbb196a9c51016187d573e731ecdb6475b2bae2a2321aebabf0ad4a48da8e2914856c46d6e471366865699890ab247816a2d3b612be8665b132e4d8a2dbe846433eb400f888150fbcded6541055b848b6e408076ad5773bcc917fbd458c1fc798c6b554189c955becbda28e7a679980bcdd345611ba60a31269aef7520e67e7ff151abc34c8efdd55f553a8b27df62e47c1cb4f2e4213c54a2c313d6c518054c2cdfdfd3afab57b1bc21275e329651c60c18f5544fbb286cf9c535354df5530a2e58dfb28e0df6632418103c6d472930b64c5f8d74a33a9ac7c692a3c0fd0f2fa44e10b983966e0e663777509b52916c4ee4da033e334d8dc39fd4a770c4d0a3b28dfb7f2af85b46c9b9e04e8ca4e5d0456c176fb0b81c0ee5b58298845e33b45f56fbd30d2b96d35786c0ee794b03d3dfe4e9b8f3b8dad725e9e184db2d8dc2d9416c783e0db4a70c3968a93f64503abfe227e87d87b77660118d4b1d31cd31ff60cf952acbfea10ea496d2ffb578fe72b859b86be174dd463ebac209dab65f5f89cc3e8debab7c2d700f95667ad393513f43be5d67384d188c67b09e7a0d4a087d969167366f1e6776a6ef982090399c1022d3c67443a993b72016f4d819964ee4b0c088d48a9ed495cb7cc58140caf5a3a2d2316bd4745d09f6f8f93a93ef2bd37e7fd1a75329c9ebe0642ce94e86476f106578920a7c5eba6159c72c091b9f597a3a66f46f9e94906753577d25b86125fd7f459ae66c65ab26a9552be1bf120ea4c50eb24559a463b0f22de7c01bc442adcf52dc9a121fee9b84a62c30cf1d11871aba67dbc33df091a3756258fc8d73c5f774856763a8b7dc49db3bc72bfc469bfcf8839034cdae84ac08c389286dad9af2c6c976adabe359247be256c1554725b80f8f47fb33dfc7b584416c207c9aeaf816e436ce9a7afa3d53eadf078e913ecc3fbe53063a8ddd6d1c22f56b8a98e443e8dae33826535affb184aa1ca4e151ac9d2c330f73ccaec6808ce3e7698455dc769315b129c40aec5343f1421ca176ef513f4133d987951ed86c2f0ffbd0d652911e0c05fcddc2a58c32357b661732b000c043c69d860893e028e2052484adc9f58f516963c9c5a558ba87441140e87b8d4bfe0a8475e793f07e5c97fb719c2978495d0d10470771ef3d177469d50c2165c0eaf059974f36e747987fa3e724c55df7e59f6302a8126856160b8a78f2e0ffcfdc211d88f668feb11c1c8803b64cb5049285ea4047090a3c87e87f6970a82e6dacde247cc1c26f8fb636b63f001960da567de5156492d302143571d90318f5cb8b42f7f3143991b4159ef9b689ac53e724c317b7c8eaaed964f4dc5a3e1f0fe78bf1dccd364ab52a832cd4fea9cd9e1209894e2e8ea8a146dc336135b2d3b8220f33213969615736e74271505fc456998c69c031483388e5b6378d82623d88f03c637c93cd5ac61c6bc18b88fb09345479e77dbd9d0d7c09bf20f9e555369e801e35ff3f469b3699758cf7b41329e751c05b147b7ed0de945d887b69e17dd0db6316f900ab346b3db35ed37a3a74c3703d39babae11652e05327c92e218bb9bd967a3fca65ff9f8e0e773177e8488bd63c31dc44324b84d0603e2b3cd8c50efa6e36e99b3274e0ca584c3b2d28d374b88fbcbccff167eea04ed3583d59ca814cad946e76c8da052c0e91b937d077ae6d3f33fad44cef7568d011e585a3823fe41be2719c53c1be2801d292674d04d8868527d525e1b22d1bfbd8640ab6a94cd60d3d5905e402fa0d6758de5c2dd9b7fee0a9ae2b66bd4c363e65e3b02c9f72a9afb6e79dae54568e5130d061d65b187c2862c6c7937eef703910b2dd3588257753eda41c841d9a6fe128b54fb1cbc9a43147fa0a1ba9ef27db923e6e937459289599e2a99a474d0d94595941cc728becd16ff4bba63776a0a92966163a4b451736dacfc35ed13f44f587ac76e8171b1b270a44057fbeaa16d21fb819e3658479e0b0b7b3d832c9e1786bafb756510e5c077e7df11d11a1f84eb211374e9e945fb8d9440c06e8af771ff2ba7d02a7b266dc00a7168921301b37890aac28d0478a9e4cbce13d4ba0818558159bc26896c26a0622b8a55e0e4610713c130f6b728554b9a496f85131e342a21774142783a343f242cda8b7150e42e921d17523954331d8acc265086161c5282c6d6c7076977cb77ea0884d3dcb732d9b1e70d642946e052ffd1248a9729d0e0f5caac3aa2ef0921c22c5355476a3525e681379edd8d75271537b72d0c67a5ce29e32ea0de58255db3add133cf33521ebcb8f5572c8404df3b2167c43e27224b2612f7e9fbefeb4885cc0dadaee75ef6cf1bd7697294126399a90a6581fa3d9d3db33cac744d5053c2694a6c72769f3d59135372c7162f07f2935884f6547223c4bac120ec1996394351259c902aee920ec08bc6558e11bdb1d0618bf3e8268f0e2e4a4a673cc6a90ff2cc22c10cfa094fe60c152f50953a1553d962866824bae54e68423f2321189960ed6f180b69aef613e95642147b2690ba7ade3239ffc1102591380c4772cace9b1da613173aabddfef9c649289ee53d27246754f9e1584d813595cd7cc333b11af3f54955b0108b5f5f7a9b76c59a7f035bf42cbcf71ae7c41db68ce72858dd810c7b90f3c5e0d1f2da593ad9c79f3798f33a18e340583b216a7c1ab2b17058730f5ec7cf32501f7f954f5e3aca2d11c7a5b3acc172b2f2ecd772ad8614b2055347fde33a1e248774f9cf35cdeb7bec67dd1a46b70c345a213b113f02007bc2560ac28f88ebd387686f129459c6936f30641aece8a5b60090313d79c5335114adbb03f915e4a82e458792e9724741e6921f6b3948c7f67fb4f7f2d5a738744be76df9e67289372ecf38ae3dcdb861d808eae5e01737117e218f10c4031eec8f23cd7b91abc9aa839d2909e1f11341dea35526be69999468038766ede98aca70930808c85b0ca38944395dea18160da2362e122a74762752cdd899afda9af2740b75acd85a4f15313afd72eaa971f47e2e072398e3758bb699fa44d10651b2a8bb6cd0f24abcf140498694c3fa04b1417dfda78798af281bccb9383f685b8d59641cec1de2e65934298ab40023ae2aeabc80546489094707b615d7285b2b9e29be9aad4e98d5c9ed4f78679643bd519d291a48eab1d411e67f516b027fa24c5f7cde13014adf74d1d8faa4d18b29ccfb1f133dfe37b3215b6bf1fbdf3ac609aa31ff91e2d9852009d226bf0905ae2b08a46c634d58954ef2f0f025c8d407fcb2fea47b0fcfaa45d10ae7e59fd5c0d0bdf1afc164b83ad8d9cee89045a79a2334abc51733b972e87b7418b6b78223a01d49f58e71ec15f2f2f18678810b31b06d90a5461d93226d3a3c241aad2b002baceee9a7e6d81b603ac3720ab95d7440909cd41b3ad38e538ab060436c6fec8ed9cd22c0c9d4a30a7376de5311862eb6cc357347fc37a83a887a4654ae0403db90b55849a915fcce1d51e0179c297b8cabf63811472969db39e21050b1effa62371cf8b2918ff111ea57cc931a47b416c5ad88e2171d02f3907bceb0a5ccadb31305308ad474fdd161a84aa72ae63e2e1f431cf6781c5b3a96543b26c9cbb5b270874c4648ef0ddf4245e4659d1f8071811266fbec392c1db76102847e8e67762d16189063b485aad6034760abd227d57d79f5a9d74960691d6060d2038de881b55317ff5ffaaff29d7266ee5deff76f878b42dc00fa2344c12aa0c4463a6c09b85876865e55a4a08eca4de81ecc18904f7a6a7b52af839ffd63cd54fccd9e53e3e5c29385d467f65611174d2df73a5c21e1d5ea1cd6772d4facd4c96b2793d0ecfa489ebb735ffb086013f62e48f777e6056131a3f82a2e081bc3cac10d1efabab319d0f4bdb520743326e15602a1a31da4edebfc4e81325a71ec8f8e1ff8f594c2540f7ac6451dbf49b30e19015a06182ff24e6dbbcd31faec5d4bcbd81028eba0978080826362f0ab2c6382f46ade700a359bde1eb8fa2fbbad7aa95b711e9a9c5b51adc14b129d09cc050421dac7f20b2a19db42295683d0a718ecd49f22f491b6f3e08a6abbd50e5b400cc99693b3b5e4f9d8e41bb9c4c33170f30c1bff13f4ef903496481534b24f68984d361f075dd38655089b76aa76afecbede9dd581ff3bcf338d885c6de6f413fb96f0d2fea9fdf54cf8bde26b6fc8cfcf519757a5176f46d632c96a1fd62556d59c9b5f0ad2d8016192416631dde099372c7bc1212e74a366d0ad480abf5864f27b257d28364eae968ece54a383103fd1d477935142917b704064b7bfa059f4a939c4fd16bcd5c42b080a51472301ce97069e61121ddcebbc71789b636a8aeb82da03fa744664bb1e23b1deaae95d9d4400fbdd537d56a1fb69bcc62ad02fa352fb4ec7c25d7136cb237f726eafb4dc8e6bb972d2b1d5edcd2396fe8dd8138bffce77d2ff2a02bf6511882f103bc400101035250bc17c061b00fb2de9e5c45dfea929ce8f747e9c127aefdcc961b300773736cef700c363351fee373adab37179f1d75abee5b41b4e76a8121893f6a5bcceb8f8a0e418a62615a85df0fcea5a55d25d26bfc7c11fe2e7f37041fa778b94bf9a6c9042a69159d718a0bbd67e6f64"], 0x1120, 0x20000050}, 0x4040001) setsockopt$inet_sctp6_SCTP_PEER_ADDR_PARAMS(r0, 0x84, 0x9, &(0x7f00000002c0)={0x0, @in6={{0xa, 0x4e20, 0x9, @empty, 0x401}}, 0x4, 0x0, 0x4, 0x7, 0x14}, 0x98) 01:56:26 executing program 5: perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1f}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000340)={&(0x7f0000000000), 0xc, &(0x7f0000000300)={&(0x7f0000000240)=@newlink={0x50, 0x10, 0x721, 0x0, 0x0, {0x0, 0x0, 0x7000000}, [@IFLA_LINKINFO={0x28, 0x12, @veth={{0xc, 0x1, 'veth\x00'}, {0x18, 0x2, @VETH_INFO_PEER={0x14}}}}, @IFLA_NET_NS_FD={0x8}]}, 0x50}}, 0x0) 01:56:26 executing program 2: r0 = socket$inet(0x2, 0x3, 0x2) connect$inet(0xffffffffffffffff, &(0x7f0000000000)={0x2, 0x0, @local}, 0x10) setsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x23, &(0x7f0000000000)={{{@in=@multicast2, @in=@multicast1}}, {{@in6}, 0x0, @in6=@loopback}}, 0xe8) syz_emit_ethernet(0x2a, &(0x7f0000000640)={@random="b100485caa2a", @link_local, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x1c, 0x0, 0x0, 0x0, 0x2, 0x0, @rand_addr, @broadcast}, @igmp={0x11, 0x0, 0x0, @multicast1}}}}}, &(0x7f0000000140)={0x0, 0x0, [0x0, 0x3]}) 01:56:26 executing program 3: r0 = socket$inet(0x2, 0x3, 0x2) connect$inet(0xffffffffffffffff, &(0x7f0000000000)={0x2, 0x0, @local}, 0x10) setsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x23, &(0x7f0000000000)={{{@in=@multicast2, @in=@multicast1}}, {{@in6}, 0x0, @in6=@loopback}}, 0xe8) syz_emit_ethernet(0x2a, &(0x7f0000000640)={@random="b100485caa2a", @link_local, [], {@ipv4={0x800, {{0x4, 0x4, 0x0, 0x0, 0x1c, 0x0, 0x0, 0x0, 0x2, 0x0, @rand_addr, @broadcast}, @igmp={0x11, 0xffffffffffffffff, 0x0, @multicast1}}}}}, &(0x7f0000000140)) 01:56:26 executing program 0: socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000001f80)={0xffffffffffffffff, 0xffffffffffffffff}) setsockopt$SO_ATTACH_FILTER(r2, 0x1, 0x1a, &(0x7f0000ab9ff0)={0x2, &(0x7f000039a000)=[{0x20, 0x0, 0x0, 0xfffffffffffff010}, {0x6}]}, 0x10) sendmmsg(r1, &(0x7f0000001e80)=[{{&(0x7f0000000700)=@l2={0x1f, 0x0, {}, 0x0, 0x11000000}, 0x80, &(0x7f0000001dc0)}}], 0x1, 0x0) [ 672.484756] binder: 13402:13404 Acquire 1 refcount change on invalid ref 0 ret -22 01:56:26 executing program 4: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) ioctl$sock_SIOCETHTOOL(r0, 0x8946, &(0x7f0000000040)={'bond0\x00', &(0x7f0000000240)=ANY=[@ANYBLOB="4c0000314673da02"]}) getsockopt$sock_linger(r0, 0x1, 0xd, &(0x7f0000000000), &(0x7f0000000080)=0x8) 01:56:26 executing program 2: r0 = socket$inet(0x2, 0x3, 0x2) connect$inet(0xffffffffffffffff, &(0x7f0000000000)={0x2, 0x0, @local}, 0x10) setsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x23, &(0x7f0000000000)={{{@in=@multicast2, @in=@multicast1}}, {{@in6}, 0x0, @in6=@loopback}}, 0xe8) syz_emit_ethernet(0x2a, &(0x7f0000000640)={@random="b100485caa2a", @link_local, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x1c, 0x0, 0x0, 0x0, 0x2, 0x0, @rand_addr, @broadcast}, @igmp={0x11, 0x0, 0x0, @multicast1}}}}}, &(0x7f0000000140)={0x0, 0x0, [0x0, 0x700000000000000]}) [ 672.546430] binder: 13402:13404 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 672.668999] binder: 13402:13437 Acquire 1 refcount change on invalid ref 0 ret -22 [ 672.683368] binder: 13402:13437 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 01:56:27 executing program 6: r0 = syz_open_dev$sndseq(&(0x7f0000000100)='/dev/snd/seq\x00', 0x0, 0x0) read(r0, &(0x7f0000fb6000)=""/28, 0x3f0) ioctl$SNDRV_SEQ_IOCTL_REMOVE_EVENTS(r0, 0x4040534e, &(0x7f00000001c0)={0xbf}) ioctl$SNDRV_SEQ_IOCTL_QUERY_SUBS(r0, 0xc058534f, &(0x7f00000002c0)={{}, 0x1, 0x0, 0x0, {}, 0x0, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xbf00000000000000]}) r1 = gettid() timer_create(0x0, &(0x7f0000044000)={0x0, 0x12}, &(0x7f0000000040)) r2 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r2, 0x8912, &(0x7f00000001c0)="0a5cc80700315f85715070") timer_settime(0x0, 0x0, &(0x7f0000000080)={{0x0, 0x989680}, {0x0, 0x9}}, &(0x7f0000040000)) tkill(r1, 0x1000000000014) 01:56:27 executing program 5: perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1f}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000340)={&(0x7f0000000000), 0xc, &(0x7f0000000300)={&(0x7f0000000240)=@newlink={0x50, 0x10, 0x721, 0x0, 0x0, {0x0, 0x0, 0x6}, [@IFLA_LINKINFO={0x28, 0x12, @veth={{0xc, 0x1, 'veth\x00'}, {0x18, 0x2, @VETH_INFO_PEER={0x14}}}}, @IFLA_NET_NS_FD={0x8}]}, 0x50}}, 0x0) 01:56:27 executing program 3: r0 = socket$inet(0x2, 0x3, 0x2) connect$inet(0xffffffffffffffff, &(0x7f0000000000)={0x2, 0x0, @local}, 0x10) setsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x23, &(0x7f0000000000)={{{@in=@multicast2, @in=@multicast1}}, {{@in6}, 0x0, @in6=@loopback}}, 0xe8) syz_emit_ethernet(0x2a, &(0x7f0000000640)={@random="b100485caa2a", @link_local, [], {@ipv4={0x800, {{0x6, 0x4, 0x0, 0x0, 0x1c, 0x0, 0x0, 0x0, 0x2, 0x0, @rand_addr, @broadcast}, @igmp={0x11, 0xffffffffffffffff, 0x0, @multicast1}}}}}, &(0x7f0000000140)) 01:56:27 executing program 0: socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000001f80)={0xffffffffffffffff, 0xffffffffffffffff}) setsockopt$SO_ATTACH_FILTER(r2, 0x1, 0x1a, &(0x7f0000ab9ff0)={0x2, &(0x7f000039a000)=[{0x20, 0x0, 0x0, 0xfffffffffffff010}, {0x6}]}, 0x10) sendmmsg(r1, &(0x7f0000001e80)=[{{&(0x7f0000000700)=@l2={0x1f, 0x0, {}, 0x0, 0x3000000}, 0x80, &(0x7f0000001dc0)}}], 0x1, 0x0) 01:56:27 executing program 2: r0 = socket$inet(0x2, 0x3, 0x2) connect$inet(0xffffffffffffffff, &(0x7f0000000000)={0x2, 0x0, @local}, 0x10) setsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x23, &(0x7f0000000000)={{{@in=@multicast2, @in=@multicast1}}, {{@in6}, 0x0, @in6=@loopback}}, 0xe8) syz_emit_ethernet(0x2a, &(0x7f0000000640)={@random="b100485caa2a", @link_local, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x1c, 0x0, 0x0, 0x0, 0x2, 0x0, @rand_addr, @broadcast}, @igmp={0x11, 0x0, 0x0, @multicast1}}}}}, &(0x7f0000000140)={0x0, 0x0, [0x0, 0x20000000]}) 01:56:27 executing program 4: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) ioctl$sock_SIOCDELDLCI(r0, 0x8981, &(0x7f0000000000)={'irlan0\x00', 0xe024}) ioctl$sock_SIOCETHTOOL(r0, 0x8946, &(0x7f0000000040)={'bond0\x00', &(0x7f0000000240)=ANY=[@ANYBLOB="4c000000000023000000000000000002"]}) 01:56:27 executing program 7: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000180)='/dev/sequencer\x00', 0x10002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000080)="0a5cc80700315f85715070") r1 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000001c0)={0x2, 0x0, &(0x7f0000000140)=ANY=[@ANYBLOB='\fc'], 0x0, 0x0, &(0x7f0000000080)}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, &(0x7f00000001c0)}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000040)={0x8, 0x7a00000000000000, &(0x7f00000000c0)=[@release={0x400c630f}], 0x1, 0x0, &(0x7f0000000100)='V'}) fstat(r0, &(0x7f00000002c0)) 01:56:27 executing program 2: r0 = socket$inet(0x2, 0x3, 0x2) connect$inet(0xffffffffffffffff, &(0x7f0000000000)={0x2, 0x0, @local}, 0x10) setsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x23, &(0x7f0000000000)={{{@in=@multicast2, @in=@multicast1}}, {{@in6}, 0x0, @in6=@loopback}}, 0xe8) syz_emit_ethernet(0x2a, &(0x7f0000000640)={@random="b100485caa2a", @link_local, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x1c, 0x0, 0x0, 0x0, 0x2, 0x0, @rand_addr, @broadcast}, @igmp={0x11, 0x0, 0x0, @multicast1}}}}}, &(0x7f0000000140)={0x0, 0x0, [0x0, 0x6000]}) 01:56:27 executing program 4: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) ioctl$sock_SIOCETHTOOL(r0, 0x8946, &(0x7f0000000140)={'bond0\x00', &(0x7f00000001c0)=ANY=[@ANYBLOB="3e3457cfc4a5f405c23e29a666f5b775deb9fcf238f33b7d94b1a9da5de37e17855744f4183ee2716c36e2af4b4969a99d07b301dca18240d23a8132f2a9ce35a3ffff99f3432f51c8c45cd40f465db57cd875044f44db0a5c96084e3ed62b6ff037e9b37c410ea33758f2c6ec0d98d33442d06a"]}) ioctl$sock_netdev_private(r0, 0x89fb, &(0x7f0000000080)="93ac1327dcbf24133f33dfc1379b9c73acf90d2945a9dfc0cab9fb99067ceb9352cecc63efd6413550db2aaf5e92263f04a6871a588ef7d4c7bb273a44d516e48b069a65d65a34081a3edd1b1e6d4fc568b081348dab87dea23a31896d5e1615fe70c9391d02d75131cd6580a1574c239be2ec6f17a5dc41bf") r1 = openat$autofs(0xffffffffffffff9c, &(0x7f0000000000)='/dev/autofs\x00', 0x800, 0x0) ioctl$sock_bt_bnep_BNEPGETCONNINFO(r1, 0x800442d3, &(0x7f0000000100)={0x9, 0x0, 0x3, @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x3}, 'nr0\x00'}) [ 673.264681] binder: 13457:13458 Acquire 1 refcount change on invalid ref 0 ret -22 01:56:27 executing program 1: perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10000003, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000080)='/dev/vhost-net\x00', 0x2, 0x0) ioctl$int_in(r0, 0x40000000af01, &(0x7f0000000300)) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000480)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000300)={'bctf0\x00\x00\x00\x00\x00\x00"\x00', 0x6}) ioctl$VHOST_SET_VRING_ADDR(r0, 0x4028af11, &(0x7f0000000240)={0x1, 0x0, &(0x7f0000000100)=""/163, &(0x7f00000019c0)=""/246, &(0x7f00000004c0)=""/4096}) ioctl$VHOST_SET_MEM_TABLE(r0, 0x4008af03, &(0x7f00000007c0)=ANY=[]) ioctl$VHOST_NET_SET_BACKEND(r0, 0x4008af30, &(0x7f0000000000)={0x200000000001, r1}) close(r0) 01:56:27 executing program 5: perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1f}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000340)={&(0x7f0000000000), 0xc, &(0x7f0000000300)={&(0x7f0000000240)=@newlink={0x50, 0x10, 0x721, 0x0, 0x0, {0x0, 0x0, 0x200000000000000}, [@IFLA_LINKINFO={0x28, 0x12, @veth={{0xc, 0x1, 'veth\x00'}, {0x18, 0x2, @VETH_INFO_PEER={0x14}}}}, @IFLA_NET_NS_FD={0x8}]}, 0x50}}, 0x0) 01:56:27 executing program 3: r0 = socket$inet(0x2, 0x3, 0x2) connect$inet(0xffffffffffffffff, &(0x7f0000000000)={0x2, 0x0, @local}, 0x10) setsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x23, &(0x7f0000000000)={{{@in=@multicast2, @in=@multicast1}}, {{@in6}, 0x0, @in6=@loopback}}, 0xe8) syz_emit_ethernet(0x2a, &(0x7f0000000640)={@random="b100485caa2a", @link_local, [], {@ipv4={0x800, {{0x8, 0x4, 0x0, 0x0, 0x1c, 0x0, 0x0, 0x0, 0x2, 0x0, @rand_addr, @broadcast}, @igmp={0x11, 0xffffffffffffffff, 0x0, @multicast1}}}}}, &(0x7f0000000140)) 01:56:27 executing program 0: socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000001f80)={0xffffffffffffffff, 0xffffffffffffffff}) setsockopt$SO_ATTACH_FILTER(r2, 0x1, 0x1a, &(0x7f0000ab9ff0)={0x2, &(0x7f000039a000)=[{0x20, 0x0, 0x0, 0xfffffffffffff010}, {0x6}]}, 0x10) sendmmsg(r1, &(0x7f0000001e80)=[{{&(0x7f0000000700)=@l2={0x1f, 0x0, {}, 0x0, 0x33fe0}, 0x80, &(0x7f0000001dc0)}}], 0x1, 0x0) 01:56:27 executing program 2: r0 = socket$inet(0x2, 0x3, 0x2) connect$inet(0xffffffffffffffff, &(0x7f0000000000)={0x2, 0x0, @local}, 0x10) setsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x23, &(0x7f0000000000)={{{@in=@multicast2, @in=@multicast1}}, {{@in6}, 0x0, @in6=@loopback}}, 0xe8) syz_emit_ethernet(0x2a, &(0x7f0000000640)={@random="b100485caa2a", @link_local, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x1c, 0x0, 0x0, 0x0, 0x2, 0x0, @rand_addr, @broadcast}, @igmp={0x11, 0x0, 0x0, @multicast1}}}}}, &(0x7f0000000140)={0x0, 0x0, [0x0, 0x4000000]}) 01:56:27 executing program 4: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) ioctl$sock_SIOCETHTOOL(r0, 0x8946, &(0x7f0000000040)={'irlan0\x00', &(0x7f00000001c0)=ANY=[]}) pipe(&(0x7f0000000200)={0xffffffffffffffff}) getsockopt$inet6_IPV6_IPSEC_POLICY(r1, 0x29, 0x22, &(0x7f0000000080)={{{@in6=@mcast1, @in=@remote, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@mcast2}, 0x0, @in=@rand_addr}}, &(0x7f00000001c0)=0xfffffeba) creat(&(0x7f0000000180)='./file0\x00', 0x14) ioctl$TUNSETOWNER(r1, 0x400454cc, r2) [ 673.388135] binder: 13457:13458 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 01:56:27 executing program 5: perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1f}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000340)={&(0x7f0000000000), 0xc, &(0x7f0000000300)={&(0x7f0000000240)=@newlink={0x50, 0x10, 0x721, 0x0, 0x0, {0x0, 0x0, 0x8100000000000000}, [@IFLA_LINKINFO={0x28, 0x12, @veth={{0xc, 0x1, 'veth\x00'}, {0x18, 0x2, @VETH_INFO_PEER={0x14}}}}, @IFLA_NET_NS_FD={0x8}]}, 0x50}}, 0x0) [ 673.458603] binder: 13457:13479 Acquire 1 refcount change on invalid ref 0 ret -22 [ 673.486593] binder: 13457:13479 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 673.595256] binder: 13458 RLIMIT_NICE not set 01:56:28 executing program 2: r0 = socket$inet(0x2, 0x3, 0x2) connect$inet(0xffffffffffffffff, &(0x7f0000000000)={0x2, 0x0, @local}, 0x10) setsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x23, &(0x7f0000000000)={{{@in=@multicast2, @in=@multicast1}}, {{@in6}, 0x0, @in6=@loopback}}, 0xe8) syz_emit_ethernet(0x2a, &(0x7f0000000640)={@random="b100485caa2a", @link_local, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x1c, 0x0, 0x0, 0x0, 0x2, 0x0, @rand_addr, @broadcast}, @igmp={0x11, 0x0, 0x0, @multicast1}}}}}, &(0x7f0000000140)={0x0, 0x0, [0x0, 0x7000000]}) 01:56:28 executing program 4: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) r1 = openat$audio(0xffffffffffffff9c, &(0x7f0000000000)='/dev/audio\x00', 0x4000, 0x0) sendmsg$alg(r1, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000200)=[{&(0x7f0000000080)="bbebff4ccbb3f57a6b0651f33160f85dcd34fa8660fdf9f3371a9a566a34149ec822203d267b3129e08507cc5682b4ea68fdb1b731a643f4aa0d03c0c66f6d4e286b0b38f83ba46cbada8b3fee7a8d", 0x4f}, {&(0x7f0000000100)="4298d8168acc273f19ed7899d48b131ed29a812af05a0efb7cdb3df4fd089cc31dd7b7934b2048a984c249a22e9b670a75acf29761e407ecbbda714c8c3c6d41cc9900c57fbbc79cb5b003b6509010e746ee904e7eddbff90f1ea8638dbcce6b4e036d7bec6f02d0c321c6da1e2899245996a93af9f054103e206ca59a890a56ba1eff43ed36a7", 0x87}, {&(0x7f00000001c0)="a2aba598ff057e3ee90cf6", 0xb}, {&(0x7f0000000280)="da68993ada1f56e9f0f4140a7cef219cd8e20e182fc219872ad08424dd4731c2b52d4821a5bc7ff9368a707a4f91a6bd8b82ba45281fa05030476d20db39dd3e07966e738d0351ad4b825a6421ca145150bf5ccc48e76d426cf40abe4413d7604d41207200403a6a34", 0x69}], 0x4, 0x0, 0x0, 0x40010}, 0x4000800) ioctl$sock_SIOCETHTOOL(r0, 0x8946, &(0x7f0000000040)={'bond0\x00', &(0x7f0000000240)=ANY=[@ANYBLOB="4c000000000023000000000000000002"]}) 01:56:28 executing program 6: r0 = syz_open_dev$sndseq(&(0x7f0000000100)='/dev/snd/seq\x00', 0x0, 0x0) read(r0, &(0x7f0000fb6000)=""/28, 0x3f0) ioctl$SNDRV_SEQ_IOCTL_REMOVE_EVENTS(r0, 0x4040534e, &(0x7f00000001c0)={0xbf}) ioctl$SNDRV_SEQ_IOCTL_QUERY_SUBS(r0, 0xc058534f, &(0x7f00000002c0)={{}, 0x1, 0x0, 0x0, {}, 0x0, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xe000000]}) r1 = gettid() timer_create(0x0, &(0x7f0000044000)={0x0, 0x12}, &(0x7f0000000040)) r2 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r2, 0x8912, &(0x7f00000001c0)="0a5cc80700315f85715070") timer_settime(0x0, 0x0, &(0x7f0000000080)={{0x0, 0x989680}, {0x0, 0x9}}, &(0x7f0000040000)) tkill(r1, 0x1000000000014) 01:56:28 executing program 3: r0 = socket$inet(0x2, 0x3, 0x2) connect$inet(0xffffffffffffffff, &(0x7f0000000000)={0x2, 0x0, @local}, 0x10) setsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x23, &(0x7f0000000000)={{{@in=@multicast2, @in=@multicast1}}, {{@in6}, 0x0, @in6=@loopback}}, 0xe8) syz_emit_ethernet(0x2a, &(0x7f0000000640)={@random="b100485caa2a", @link_local, [], {@ipv4={0x800, {{0x5, 0x6, 0x0, 0x0, 0x1c, 0x0, 0x0, 0x0, 0x2, 0x0, @rand_addr, @broadcast}, @igmp={0x11, 0xffffffffffffffff, 0x0, @multicast1}}}}}, &(0x7f0000000140)) 01:56:28 executing program 1: mkdir(&(0x7f0000000040)='./file1\x00', 0x0) r0 = open(&(0x7f0000000000)='.\x00', 0x0, 0x0) mknodat(r0, &(0x7f00000001c0)='./file0\x00', 0x0, 0x0) renameat2(r0, &(0x7f0000000340)='./file0\x00', r0, &(0x7f0000000380)='./file1\x00', 0x1) bind$unix(0xffffffffffffffff, &(0x7f0000000080)=@abs={0x0, 0x0, 0x4e22}, 0x6e) 01:56:28 executing program 0: socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000001f80)={0xffffffffffffffff, 0xffffffffffffffff}) setsockopt$SO_ATTACH_FILTER(r2, 0x1, 0x1a, &(0x7f0000ab9ff0)={0x2, &(0x7f000039a000)=[{0x20, 0x0, 0x0, 0xfffffffffffff010}, {0x6}]}, 0x10) sendmmsg(r1, &(0x7f0000001e80)=[{{&(0x7f0000000700)=@l2={0x1f, 0x0, {}, 0x0, 0x803e0000}, 0x80, &(0x7f0000001dc0)}}], 0x1, 0x0) 01:56:28 executing program 7: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000180)='/dev/sequencer\x00', 0x10002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000080)="0a5cc80700315f85715070") r1 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000001c0)={0x2, 0x0, &(0x7f0000000140)=ANY=[@ANYBLOB='\fc'], 0x0, 0x0, &(0x7f0000000080)}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, &(0x7f00000001c0)}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000040)={0x8, 0x5000000, &(0x7f00000000c0)=[@release={0x400c630f}], 0x1, 0x0, &(0x7f0000000100)='V'}) fstat(r0, &(0x7f00000002c0)) 01:56:28 executing program 5: perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1f}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000340)={&(0x7f0000000000), 0xc, &(0x7f0000000300)={&(0x7f0000000240)=@newlink={0x50, 0x10, 0x721, 0x0, 0x0, {0x0, 0x0, 0x300}, [@IFLA_LINKINFO={0x28, 0x12, @veth={{0xc, 0x1, 'veth\x00'}, {0x18, 0x2, @VETH_INFO_PEER={0x14}}}}, @IFLA_NET_NS_FD={0x8}]}, 0x50}}, 0x0) 01:56:28 executing program 4: r0 = socket$bt_hidp(0x1f, 0x3, 0x6) clock_gettime(0x0, &(0x7f0000000000)={0x0, 0x0}) setsockopt$sock_timeval(r0, 0x1, 0x15, &(0x7f0000000080)={r1, r2/1000+30000}, 0x10) r3 = socket$nl_netfilter(0x10, 0x3, 0xc) ioctl$sock_SIOCETHTOOL(r3, 0x8946, &(0x7f0000000040)={'bond0\x00', &(0x7f0000000240)=ANY=[@ANYBLOB="4c000000fdffffff0000000000000002"]}) 01:56:28 executing program 1: perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff7ffffffffffb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)={0x8, 0x800000000004, 0x4, 0xfff}, 0x2c) r1 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000100)='./cgroup.cpu/syz1\x00', 0x200002, 0x0) bpf$BPF_PROG_QUERY(0x10, &(0x7f00000000c0)={r1}, 0x20) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f00000001c0)={r0, &(0x7f0000000400), &(0x7f00000000c0)}, 0x20) r2 = syz_open_dev$midi(&(0x7f0000000040)='/dev/midi#\x00', 0x722a192e, 0x102) setsockopt$inet_sctp_SCTP_I_WANT_MAPPED_V4_ADDR(r2, 0x84, 0xc, &(0x7f0000000080)=0xbe4, 0x4) 01:56:28 executing program 2: r0 = socket$inet(0x2, 0x3, 0x2) connect$inet(0xffffffffffffffff, &(0x7f0000000000)={0x2, 0x0, @local}, 0x10) setsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x23, &(0x7f0000000000)={{{@in=@multicast2, @in=@multicast1}}, {{@in6}, 0x0, @in6=@loopback}}, 0xe8) syz_emit_ethernet(0x2a, &(0x7f0000000640)={@random="b100485caa2a", @link_local, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x1c, 0x0, 0x0, 0x0, 0x2, 0x0, @rand_addr, @broadcast}, @igmp={0x11, 0x0, 0x0, @multicast1}}}}}, &(0x7f0000000140)={0x0, 0x0, [0x0, 0x3e000000]}) 01:56:28 executing program 5: perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1f}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000340)={&(0x7f0000000000), 0xc, &(0x7f0000000300)={&(0x7f0000000240)=@newlink={0x50, 0x10, 0x721, 0x0, 0x0, {0x0, 0x0, 0x10}, [@IFLA_LINKINFO={0x28, 0x12, @veth={{0xc, 0x1, 'veth\x00'}, {0x18, 0x2, @VETH_INFO_PEER={0x14}}}}, @IFLA_NET_NS_FD={0x8}]}, 0x50}}, 0x0) 01:56:28 executing program 3: r0 = socket$inet(0x2, 0x3, 0x2) connect$inet(0xffffffffffffffff, &(0x7f0000000000)={0x2, 0x0, @local}, 0x10) setsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x23, &(0x7f0000000000)={{{@in=@multicast2, @in=@multicast1}}, {{@in6}, 0x0, @in6=@loopback}}, 0xe8) syz_emit_ethernet(0x2a, &(0x7f0000000640)={@random="b100485caa2a", @link_local, [], {@ipv4={0x800, {{0x5, 0x8, 0x0, 0x0, 0x1c, 0x0, 0x0, 0x0, 0x2, 0x0, @rand_addr, @broadcast}, @igmp={0x11, 0xffffffffffffffff, 0x0, @multicast1}}}}}, &(0x7f0000000140)) [ 674.189609] binder: 13536:13538 Acquire 1 refcount change on invalid ref 0 ret -22 [ 674.217883] binder: 13536:13538 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 01:56:28 executing program 0: socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000001f80)={0xffffffffffffffff, 0xffffffffffffffff}) setsockopt$SO_ATTACH_FILTER(r2, 0x1, 0x1a, &(0x7f0000ab9ff0)={0x2, &(0x7f000039a000)=[{0x20, 0x0, 0x0, 0xfffffffffffff010}, {0x6}]}, 0x10) sendmmsg(r1, &(0x7f0000001e80)=[{{&(0x7f0000000700)=@l2={0x1f, 0x0, {}, 0x0, 0xffffff7f}, 0x80, &(0x7f0000001dc0)}}], 0x1, 0x0) 01:56:28 executing program 3: r0 = socket$inet(0x2, 0x3, 0x2) connect$inet(0xffffffffffffffff, &(0x7f0000000000)={0x2, 0x0, @local}, 0x10) setsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x23, &(0x7f0000000000)={{{@in=@multicast2, @in=@multicast1}}, {{@in6}, 0x0, @in6=@loopback}}, 0xe8) syz_emit_ethernet(0x2a, &(0x7f0000000640)={@random="b100485caa2a", @link_local, [], {@ipv4={0x800, {{0x5, 0x2, 0x0, 0x0, 0x1c, 0x0, 0x0, 0x0, 0x2, 0x0, @rand_addr, @broadcast}, @igmp={0x11, 0xffffffffffffffff, 0x0, @multicast1}}}}}, &(0x7f0000000140)) [ 674.324268] binder: 13538 RLIMIT_NICE not set 01:56:28 executing program 2: r0 = socket$inet(0x2, 0x3, 0x2) connect$inet(0xffffffffffffffff, &(0x7f0000000000)={0x2, 0x0, @local}, 0x10) setsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x23, &(0x7f0000000000)={{{@in=@multicast2, @in=@multicast1}}, {{@in6}, 0x0, @in6=@loopback}}, 0xe8) syz_emit_ethernet(0x2a, &(0x7f0000000640)={@random="b100485caa2a", @link_local, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x1c, 0x0, 0x0, 0x0, 0x2, 0x0, @rand_addr, @broadcast}, @igmp={0x11, 0x0, 0x0, @multicast1}}}}}, &(0x7f0000000140)={0x0, 0x0, [0x0, 0x0, 0x4]}) 01:56:28 executing program 5: perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1f}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000340)={&(0x7f0000000000), 0xc, &(0x7f0000000300)={&(0x7f0000000240)=@newlink={0x50, 0x10, 0x721, 0x0, 0x0, {0x0, 0x0, 0x5}, [@IFLA_LINKINFO={0x28, 0x12, @veth={{0xc, 0x1, 'veth\x00'}, {0x18, 0x2, @VETH_INFO_PEER={0x14}}}}, @IFLA_NET_NS_FD={0x8}]}, 0x50}}, 0x0) 01:56:28 executing program 4: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) membarrier(0x61, 0x0) socket$inet6(0xa, 0xf, 0xc11) ioctl$sock_SIOCETHTOOL(r0, 0x8946, &(0x7f0000000080)={'bond0\x00', &(0x7f0000000000)=ANY=[@ANYBLOB="4c0000f9d3cae068f72777a8f1437f60"]}) 01:56:28 executing program 6: r0 = syz_open_dev$sndseq(&(0x7f0000000100)='/dev/snd/seq\x00', 0x0, 0x0) read(r0, &(0x7f0000fb6000)=""/28, 0x3f0) ioctl$SNDRV_SEQ_IOCTL_REMOVE_EVENTS(r0, 0x4040534e, &(0x7f00000001c0)={0xbf}) ioctl$SNDRV_SEQ_IOCTL_QUERY_SUBS(r0, 0xc058534f, &(0x7f00000002c0)={{}, 0x1, 0x0, 0x0, {}, 0x0, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xbf000000]}) r1 = gettid() timer_create(0x0, &(0x7f0000044000)={0x0, 0x12}, &(0x7f0000000040)) r2 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r2, 0x8912, &(0x7f00000001c0)="0a5cc80700315f85715070") timer_settime(0x0, 0x0, &(0x7f0000000080)={{0x0, 0x989680}, {0x0, 0x9}}, &(0x7f0000040000)) tkill(r1, 0x1000000000014) 01:56:28 executing program 1: ioctl$TIOCGSID(0xffffffffffffffff, 0x5429, &(0x7f0000000000)=0x0) ioprio_get$pid(0x0, r0) socketpair$inet6_sctp(0xa, 0x5, 0x84, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) getsockopt$inet_sctp_SCTP_PARTIAL_DELIVERY_POINT(0xffffffffffffff9c, 0x84, 0x13, &(0x7f0000000080)={0x0, 0x7}, &(0x7f00000000c0)=0x8) setsockopt$inet_sctp6_SCTP_DEFAULT_PRINFO(r2, 0x84, 0x72, &(0x7f0000000100)={r3, 0x1}, 0xc) r4 = syz_open_dev$vcsn(&(0x7f0000000140)='/dev/vcs#\x00', 0x6, 0x8002) ioctl$EVIOCGBITSND(r4, 0x80404532, &(0x7f0000000180)=""/112) ptrace(0x11, r0) socket$inet6_udp(0xa, 0x2, 0x0) ioctl$VHOST_SET_VRING_BUSYLOOP_TIMEOUT(r4, 0x4008af23, &(0x7f0000000200)={0x3, 0xe71}) ioctl$EVIOCGKEYCODE_V2(r4, 0x80284504, &(0x7f0000000240)=""/141) ioctl$RTC_EPOCH_SET(r4, 0x4008700e, 0xffffffffffffbc8e) ioctl$KVM_ENABLE_CAP_CPU(r4, 0x4068aea3, &(0x7f0000000300)={0x7b, 0x0, [0x2, 0x4, 0x0, 0x7f]}) r5 = syz_open_dev$dspn(&(0x7f0000000380)='/dev/dsp#\x00', 0x8, 0x416000) syz_genetlink_get_family_id$fou(&(0x7f00000003c0)='fou\x00') ioctl$sock_bt_hidp_HIDPGETCONNINFO(r4, 0x800448d3, &(0x7f0000000400)={{0x6, 0x0, 0x2, 0x7fffffff, 0x7ff, 0x1f}, 0x8, 0x3, 0x6, 0x8, 0x8, "30b82c465eb76c6cba128326a79af5b573afd1e1c09d83ee3f6b374043b8324077b9b842c52cbe3ccefb2ae235ac1933651a738f05c66ca095af2214a4db4b44fa57bae3cbcdde9d5e3a3a42bb4bdd4e0e958588d430cf91b5a2a312f1c4c9ee89be3323cdd7df2b2d4a2816422ac608624b267d3ff2b5c935203d45b10f7790"}) setsockopt$inet_sctp_SCTP_MAX_BURST(r4, 0x84, 0x14, &(0x7f00000004c0)=@assoc_value={r3, 0x7}, 0x8) connect$bt_rfcomm(r4, &(0x7f0000000500)={0x1f, {0x0, 0x6, 0x800, 0x2, 0xeb7}, 0x100000000}, 0xa) setsockopt$inet_sctp6_SCTP_SOCKOPT_BINDX_ADD(r1, 0x84, 0x64, &(0x7f0000000540)=[@in={0x2, 0x4e20, @local}, @in6={0xa, 0x4e20, 0x8, @mcast2, 0x4}, @in={0x2, 0x4e20, @broadcast}], 0x3c) mlockall(0x2) getsockopt$IPT_SO_GET_REVISION_TARGET(r5, 0x0, 0x43, &(0x7f0000000580)={'TPROXY\x00'}, &(0x7f00000005c0)=0x1e) getsockopt$SO_TIMESTAMPING(r2, 0x1, 0x25, &(0x7f0000000600), &(0x7f0000000640)=0x4) ioctl$SNDRV_CTL_IOCTL_PVERSION(r5, 0x80045500, &(0x7f0000000680)) r6 = msgget$private(0x0, 0x442) msgctl$MSG_INFO(r6, 0xc, &(0x7f00000006c0)=""/61) ioctl$EVIOCGPHYS(r4, 0x80404507, &(0x7f0000000700)=""/115) ioctl$TUNSETVNETHDRSZ(r4, 0x400454d8, &(0x7f0000000780)=0x529) ioctl$TIOCSWINSZ(r5, 0x5414, &(0x7f00000007c0)={0x7fff8000, 0xffffffffffffff07, 0x5, 0x1}) getsockopt$inet_tcp_TCP_ZEROCOPY_RECEIVE(r5, 0x6, 0x23, &(0x7f0000000800)={&(0x7f0000ffb000/0x2000)=nil, 0x2000}, &(0x7f0000000840)=0x10) open(&(0x7f0000000880)='./file0\x00', 0x800, 0x9c) 01:56:28 executing program 3: r0 = socket$inet(0x2, 0x3, 0x2) connect$inet(0xffffffffffffffff, &(0x7f0000000000)={0x2, 0x0, @local}, 0x10) setsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x23, &(0x7f0000000000)={{{@in=@multicast2, @in=@multicast1}}, {{@in6}, 0x0, @in6=@loopback}}, 0xe8) syz_emit_ethernet(0x2a, &(0x7f0000000640)={@random="b100485caa2a", @link_local, [], {@ipv4={0x800, {{0x5, 0x3, 0x0, 0x0, 0x1c, 0x0, 0x0, 0x0, 0x2, 0x0, @rand_addr, @broadcast}, @igmp={0x11, 0xffffffffffffffff, 0x0, @multicast1}}}}}, &(0x7f0000000140)) 01:56:28 executing program 4: r0 = socket$vsock_stream(0x28, 0x1, 0x0) ioctl$sock_SIOCETHTOOL(r0, 0x8946, &(0x7f0000000180)={'syzkaller1\x00', &(0x7f0000000280)=ANY=[@ANYPTR=&(0x7f0000000240)=ANY=[@ANYPTR64=&(0x7f0000000200)=ANY=[@ANYRESDEC, @ANYPTR, @ANYPTR64]]]}) r1 = syz_open_dev$mice(&(0x7f0000000080)='/dev/input/mice\x00', 0x0, 0xa0980) ioctl$sock_SIOCBRDELBR(r1, 0x89a1, &(0x7f0000000140)='vcan0\x00') 01:56:28 executing program 2: r0 = socket$inet(0x2, 0x3, 0x2) connect$inet(0xffffffffffffffff, &(0x7f0000000000)={0x2, 0x0, @local}, 0x10) setsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x23, &(0x7f0000000000)={{{@in=@multicast2, @in=@multicast1}}, {{@in6}, 0x0, @in6=@loopback}}, 0xe8) syz_emit_ethernet(0x2a, &(0x7f0000000640)={@random="b100485caa2a", @link_local, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x1c, 0x0, 0x0, 0x0, 0x2, 0x0, @rand_addr, @broadcast}, @igmp={0x11, 0x0, 0x0, @multicast1}}}}}, &(0x7f0000000140)={0x0, 0x0, [0x0, 0x0, 0x4000000000000000]}) 01:56:28 executing program 0: socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000001f80)={0xffffffffffffffff, 0xffffffffffffffff}) setsockopt$SO_ATTACH_FILTER(r2, 0x1, 0x1a, &(0x7f0000ab9ff0)={0x2, &(0x7f000039a000)=[{0x20, 0x0, 0x0, 0xfffffffffffff010}, {0x6}]}, 0x10) sendmmsg(r1, &(0x7f0000001e80)=[{{&(0x7f0000000700)=@l2={0x1f, 0x0, {}, 0x0, 0x0}, 0x80, &(0x7f0000001dc0)}}], 0x1, 0x0) 01:56:28 executing program 7: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000180)='/dev/sequencer\x00', 0x10002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000080)="0a5cc80700315f85715070") r1 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000001c0)={0x2, 0x0, &(0x7f0000000140)=ANY=[@ANYBLOB='\fc'], 0x0, 0x0, &(0x7f0000000080)}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, &(0x7f00000001c0)}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000040)={0x8, 0x300, &(0x7f00000000c0)=[@release={0x400c630f}], 0x1, 0x0, &(0x7f0000000100)='V'}) fstat(r0, &(0x7f00000002c0)) [ 674.966058] binder: 13536:13588 Acquire 1 refcount change on invalid ref 0 ret -22 [ 674.973955] binder: 13536:13588 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 674.981370] binder: 13563 RLIMIT_NICE not set 01:56:28 executing program 5: perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1f}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000340)={&(0x7f0000000000), 0xc, &(0x7f0000000300)={&(0x7f0000000240)=@newlink={0x50, 0x10, 0x721, 0x0, 0x0, {0x0, 0x0, 0x9effffff}, [@IFLA_LINKINFO={0x28, 0x12, @veth={{0xc, 0x1, 'veth\x00'}, {0x18, 0x2, @VETH_INFO_PEER={0x14}}}}, @IFLA_NET_NS_FD={0x8}]}, 0x50}}, 0x0) 01:56:29 executing program 1: r0 = socket$inet(0x2, 0x4000000000000001, 0x0) r1 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r1, 0x8912, &(0x7f0000000280)="0a5cc80700315f85714070") r2 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000380)='/dev/kvm\x00', 0x0, 0x0) r3 = ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0) r4 = eventfd(0x0) r5 = eventfd(0x84e2) ioctl$KVM_IRQFD(r3, 0x4020ae76, &(0x7f00000015c0)={r5, 0x0, 0x2, r4}) r6 = eventfd(0x4) ioctl$KVM_IRQFD(r3, 0x4020ae76, &(0x7f0000000180)={r6, 0x0, 0x2, r4}) r7 = bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000000c0)={&(0x7f0000000080)='team_slave_0\x00'}, 0x10) write$UHID_INPUT2(r7, &(0x7f0000000100)={0xc, 0xcb, "5509aa94f48aaf25ce0e3cd6e527f4130ce8b6ec873b24e66df722b79210c133b32f95e6925561d928cd32ec68df21d2c72e4e3ef5bc62f50698d12f18c2f19397ad5c5e0e324b92cfff6af951fb4dfebc9de3cd737676477562aa26781b540540615367851d5e50c0335af978531c014de50d62139774eb5ae9d24b078d5392db8d01809b9b8060032537f7b4b21f743d260e744d95467c2d0c82e3298dfb6f8e75769e1553c63c474fe6fce31af18ee51106bb1f3d0ee8aeb2fc1dd4c3e1bd7c1024802f88f079f77abd"}, 0xd1) ioctl$sock_SIOCETHTOOL(r0, 0x8946, &(0x7f0000000040)={'team_slave_0\x00', &(0x7f0000000380)=@ethtool_dump={0x3f, 0x4, 0x6, 0x1000, "2202b133efe9d054717e41dce7c38878531a1173af20765d683984e3e5ab85ade3b3318d44872ff4ff46ced7b719d8c8a6c3811dfb2ede01df7be8e9d5644a1b09b406682656ee9d4901c856812f9c68b0910ea055ce496bedab98c2d92e70ceab2d8f27989bba6bc2c32cc5fec242b6e7bb6a9504a66a37b5d63fa520cc4824c859dd5945e670fde393ba93cdf4806b5813ee5a96bc24a6b3c365b8267dd7e96dc4b213912970ad05cba1752e9258d82bf0abe754bfaa15dad4401a4bf3749dee67a4acd733dc096621c1ae3e63b848effcdb3ee0613d8fee0570c8a077ed46500f4f834358e7c91d12ddc4c7a6f1c13e34d2ac08eb3f82342c9d5119d68ac18efcbe783351090ab15685903a1267039461f466fc240a0d9a228db96c355a0e8b5bae12269d837d35b50d122444cb50dc1d5d3643bb232bd6e19467d1b1d72eac04472ba428a18c0739ee632d2f06cdbd3932751a3f4407646045feedab6b411b8de659a96ef1f5075539b6bd7747b2ee2896db647e891e83f2607d6855526ae1369fd2c88941b1313738bdc0a19e9fee78a0f9fb913e6f08775fda4270e47d9ff20af60174b99e39bcaa8a3ac30b98bf6028d3089b67d3fce08b4a30a63c807668bc58eb850acbfc399e3b9ebe45f52a44ff48921a8ce8df853c96fa2c9035696d2efe192a4c3adae8bebde75d9d5440f735bee16d370bcf9c8bfc6dcef021cfa29952ebe786cf0b1c371a0dfe822c397c97235912d5f51f4661842e0f725e1865a1c0f56afe6ba1177e094ff8a29e903001a8c0b578d90f1b2ea56f60fa2af2b99494d323dd5f045e0de1335f1b0615460c6bea86c2b5e7d16b9e7e094528cf6e6c215eeb94b586a63c2cc27524be5c2d01957920cb5a2f8c381e6243252b661fb6db629373896452ca1896401df92e62539a01a68a202d1a210d210abca854f4e1c64fe92e8770d1cee10aded8950ead925fc44ae0a64ad27e84b9ab92b7c54f87c16fc3072a9628a5890d735d243be0fec0ff55bdbfa23cdebf08e6e30d4f079e452f0318707c9918098a7b97e84858c8c5ba3dd1fffe40a1e43abf470a18f30bc7e8511a3cd77111ba8ec6a71b127a89ee1195fc61a34c37830e829b7193dd296e56361b3b17e1f49fe7e757625bf3a4822233f9ed7111df1e803d3ef2aee0b34501a87e95ebecdff64b6122385ec5659d7f12a5118ca1b027b7be21aa02d4bf3fbcf391740b6c61a5b0e60dda8ac4d5694668f82fd8145fa9621c84af1a0a402833fd9d000f3d9e5c632d930149c456fa9686bf496bf8b99cc96d6ecafd758ef8c2a332925a1b7d4f3c27d87ae18769fc0694f192e8b6cfbb8c7520f422f5073cceb640e8fb83883bfc015d80e05c2aec3ff9e18b1df7a60edf5fdd3e5bdbb3c64a4007eef7daf99f60a785d186ef0099d66d7321e7db745b796ff837db534ec93a74dc0abba9cbdba84657066a41c614635024161c62bb4161ca461d84ced274741c61f99a4287d5415377c6b59326bb89e31ffbc15377efcb781cc1cf89f2bdac6f6dd4d62fcec77c1e917feae39f94b238b44e3176e84cc43b83f1dbf817508406e2b02ec3bbbd253aea5b269af7195192e8b0ba6cf090b4234525402b85cad345d39946571dafa204bb14df1bb200ddabd6ac1c3ee20ebd5d5885badd582a1d74e6c3a878d9ecfce473841109e1787f85581a64c5b9fc588250a8e94da8c8e79a4a773824e39231b1347c21238a805c99106f7433a2ea7f212dc4a097378d7fb38246dde80f3d4efd580ba1ae75b56cd561340919e71aa91d4fd9c667b54f8205f4e3f2b5bc7e39520407e46eb213141a1a26dd3a2d85863afe1d56f20236d76a7abb3fc2ecc8b4beee82fe828fd2c931db0335790290bb2560c6cd54d855bfa2539c95da5c026b62606519984fadfa7d6f6c1577140987c329aa72f6ab87e6cc758bbf433177126b57956b64e729e6806785fc6547c940c1ab7e394f094e4f6dcdff91af0cd8770c85a018e4aea7fdcd3244aa26769eece0f769f49360b4a95c40c299fb342e6fdf96b74a207ad83cc2857265589f91ab1e8e7658d0499e6b10fa6487c66a6ae2665cda6dbfb7ef30dfca228b98ce45aeb5604e86614bbd7dfa9a1fad1390051812237688f791cd143efced3f9684d8abbdc856812fa738589f67bb4f87682441829830603063bbe37397dc9ac27149f4594627fcecaa80c9540316aa65752a87e4bbdf7980de422fb9f597b3e6d0cb2892fc495db249d912d120d3de2e18633741f6e6b5ceeeaec332c33b770a35d67264993bb868618921d7882b15e053bd4fdfca94eb390a0ed70be391ee7b8592415989db633ed85b45477901c8843a881db7886111600b92326f688e53099ed75094cd552a0ba15a176ba2097479edf2bd7d60e24d932813ec5daa72398248f969f3d171b06271fede1e73b4362116c5cb967ab51050e99a3054c1b4d178561f8d278b9c06f28a8a340379117aa94770496aca406a3962296854a6b65e8f214d637098dd53e121ae41fa02a566198381bd1e41d96063a727beb0b9cc800983c1a7922a817e09f84b562eebd0017d54a2fa29d6684b876c071ad9c4774a4d50f54bb4a85c76b00d5ef5b200d27fc2231fc8819e9ef8d367b6ae74052aecc648c280861bbd4e6b1e71b3b816b6f134886f29766b7ea96b7b76a43cfe65654366d9f74efc2087ed6fe27851c72354da4439502fdc875ef311a28d204bae7bca15f6ad7d7e56b5e9b6cb35850bfe68b00b093ab1f9e7ed79b89cd886d7b780888275b5e627d2d8f81b0fdf61e96ab66af95a65c0883dd6978b577f46a470197deb56877614b3051a9e3907fd545263dd50ce2c13c8a481b49a885867482437f048345141d3bfd4cbed0b85a91740b192be912dfa27e2feceb95d71c76d67fd05aa2e9f4c9599aaa9011238b8144192eb736627046d974135f9282a21507668d0c203585b775cc99644ea01b5f9718ada5368076f2a3153077e219df2a03f69049bcedc90d81fcda00cbf55162f55b154eb8a4419b77cedb22602e54b95b178637d7dc9709e686a54ec45caa753a8cbdb6dedbeb32e75a0662f9f9b6ee97a0924a56ccc4d793a3aa8cc2373aef429dc932e4c37a4643424a49879fef8c183089d867e6dd4edb24f4f02d97461b1ec98d345d2547f7b130be206f21ac3f3d7e53bfc3bb4ee9cec7caef3d09ff9486cf55306080e0fd7261411acd0a9708ca75c02b5a162fa68f2af230fb1f3fa71bc9d25e205b2b1232153fddeda68301c50c3fa8c2784fe6cd7446fcc987ce57ba38813ca75c41902a6e994433166f96ce5b9e80b018eb2a1738acbc02e2ca432ca1fb0400c6e229ce1962bc0ad3fa86b5701ac28b6d99f4d7e1274b5c01c9f970658ed8558ed1d6a388274c7ca6f0fe2b05e3516921c6f9b3586e5fd7d30d01b962ecd0678a69fd8e9efd75b061f8f1e9df51cd0b9a1660fa426aec425529c41683c2d436eee6aeb720da15e7b9879d8e0f02555afd35361b39f42154b3115afb3b7910db0f4d952961dcbc5a71672c7162ffead3d21509f02007bc47f44e2e747b129754d6b9076fadf8d5181f1eba8c3370a49b4868c658d0fcadde156b56ff557680cef535ce1566c67c0e838cbb2f245209a98ecda83fb1a6e0cbe3c519ad2bbbd54f1e80d3c426fcfc74bde20559521736a51ecd9cd08c088cd4b2fba4cd0c30ab73715565622282553189674c869bb68e5924d41e170ac8436455756e81deabf3e55b100824b4cccd227878906940c031b24a582b614e1838700828450749cd29b3d978906dc6b7f0d289e80478467f0d15ed31efca18034c25cbb1801a9784985d728cc9863aca4d06117f2dbab6dd8fc20ffc689b8121960b491c8ce8a35dbaf99c88acf4e65c644fb97c7c62816350fd6209342bdeb0911904e691a93f19deb6bf14fc64068301a60ee2d5cf16c5796419ae4cbb0a3acb1c52fe514845666578159ebc08932a843dbda18387892dee67ac4400e31a56e41344ae9b84bc68af2ee1867ed8fde216127812f287f0eb8f809df85f9b8f162a06744268d4be8287b7861c4ffe1196d5877bcbb62a8d378ac19317e48064637d747130731658f9d6e97437063346e8a5e9f7674a7ac1777e7c2541dd7c7bb19644e0c032d8ea8d779e03ea729a0a825b5edf9ef6a0a5da7d429f039fd91a82bad3accd04b6735a8fc3f8170ff92cd40e2020427700355a0ff5e77754aaad76264ec01aff93498f230e93d69fe0c2ddae4d0c474792dbf4c6ecc0863c05534634374ccb25df4f51cadb575f87c32954610301f6c0610afc1568dd201f4ecef2c566dfc2f96991eb0c585ab8656d8510127493e08c605aaab152ad4ba9e5fcc48f375f08acbf009a08edb5417d72bfc6a1657a61100e84973c8143fb869ee0aa3a0a5096877daa98305649a5680d94542e39152ece9c55532dc0104c6520facf64faf2c2cb0b911e068ff7513d4b46d06200f12c6f9768529355a72c76c7da37a499af1104763696c68d0d0905f46978364436f62984f02122965ba0cafe9287670e4a846c02d1415dfe980475b25b6fb4444af943a06cf1b3a498162e1ac1704863a59ed455bc393f6b15efac19776aa89ec7607440637b417d66cf47ddf90b4da665514e915ff5b8905550f402bd5418ce2f51337c5e5c77b81d3719afd6657a3cc4921167f5935997f596b64a090bf8e6e60d8da03711ad0c54b353f69f2b2b5b8110d92fbe05945ddb5a309042610438b3cb7b2e2251876ae6e96d4c2350dfb64c0c1a5f18535dfb96305f8d11f25038fd2665ae4323fc4a04865062385f60813766771402badb435ecc55084b7f0d22ac764a44397f75a2c3f84447923ae3a6af8cb11bf0178184dc25f564a9e04a2caca1a8f551b62754755c94850a937eaa969fdad81777d8b8a2ab9eec95781ed2da00bef94a6c02e1167c84da25d8d43584be0fac9a43db27dbae4974f3776a3fcaf00995cd2aa564ace36c17cb0dbf995f0a496edddb094557d9595260545a2d356bf1f46bdd4847a3e53a1e857837c59b2417a6d6de206fcf2d304673d4959a8f3b9246b20599311f4a4153c02f5ac8f1d5a0c73f5a2040e2e4a426c43d682792c8a3a52484e254e4176f93d6869850f3e9aaba7fed3ceeba7ebc86909453e1bd1c7d255b3dcc2b2ba57f1e7fe759300bf69ff7894f8c470269f3d5824ac3f461c3c6c1cec40d788f08b251cccab65c3b49354aee325d3ae4316af41e43906e17cf8b35b33c98c58062c4e61ed3fa9ac3342f438d820c60f9ed5a28d938dc83c9653c303b3537f8f507cc89ac0a6301a5a51c400740fc0a4243c7dbaa87d9c551f455780f3da98244426623bca8011950cf66403c83a7b26da2d7d58ff151e69f788f399ff06164e612c7fbd9c762a4a1a16ed335b9dbd05c19a7857e49bc72beeec474a88a72c885fd3801c6cc484b2953814e7ff160af20bb53c8ce68be12397616044270d787003ab2ad2201d3dd88e15a039add1547b5e82a2ce7ff44b7a22755f916f7955a25d42e82fc1ac11873ce7472c8a4d5b1c1d1ef782a78de3f3d8996c709365bd10a66608300ada655153af384c75321e8d2cfa8f4b2d0f36a27a66757ac65ad4414418d9e44ee09ec7a221ea39911382ef5dfefe6d87f1ce7c128d2627789dc10f74a4f827849ba13fa40894eeb067896c54a000808a92d0f87efe955cf7ce3b002869b6a169e3e79520300558f80c285a849b71013f6c4bdbaf9c4b7f663e82d1f0237e27"}}) setsockopt$IP_VS_SO_SET_TIMEOUT(r0, 0x0, 0x48a, &(0x7f0000000000)={0x83}, 0xc) 01:56:29 executing program 3: r0 = socket$inet(0x2, 0x3, 0x2) connect$inet(0xffffffffffffffff, &(0x7f0000000000)={0x2, 0x0, @local}, 0x10) setsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x23, &(0x7f0000000000)={{{@in=@multicast2, @in=@multicast1}}, {{@in6}, 0x0, @in6=@loopback}}, 0xe8) syz_emit_ethernet(0x2a, &(0x7f0000000640)={@random="b100485caa2a", @link_local, [], {@ipv4={0x800, {{0x5, 0x4, 0xffffffffffffffff, 0x0, 0x1c, 0x0, 0x0, 0x0, 0x2, 0x0, @rand_addr, @broadcast}, @igmp={0x11, 0xffffffffffffffff, 0x0, @multicast1}}}}}, &(0x7f0000000140)) 01:56:29 executing program 2: r0 = socket$inet(0x2, 0x3, 0x2) connect$inet(0xffffffffffffffff, &(0x7f0000000000)={0x2, 0x0, @local}, 0x10) setsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x23, &(0x7f0000000000)={{{@in=@multicast2, @in=@multicast1}}, {{@in6}, 0x0, @in6=@loopback}}, 0xe8) syz_emit_ethernet(0x2a, &(0x7f0000000640)={@random="b100485caa2a", @link_local, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x1c, 0x0, 0x0, 0x0, 0x2, 0x0, @rand_addr, @broadcast}, @igmp={0x11, 0x0, 0x0, @multicast1}}}}}, &(0x7f0000000140)={0x0, 0x0, [0x0, 0x0, 0x1c00000000000000]}) 01:56:29 executing program 5: perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1f}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000340)={&(0x7f0000000000), 0xc, &(0x7f0000000300)={&(0x7f0000000240)=@newlink={0x50, 0x10, 0x721, 0x0, 0x0, {0x0, 0x0, 0x700}, [@IFLA_LINKINFO={0x28, 0x12, @veth={{0xc, 0x1, 'veth\x00'}, {0x18, 0x2, @VETH_INFO_PEER={0x14}}}}, @IFLA_NET_NS_FD={0x8}]}, 0x50}}, 0x0) 01:56:29 executing program 4: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) ioctl$sock_SIOCETHTOOL(r0, 0x8946, &(0x7f0000000040)={'bond0\x00', &(0x7f0000000080)=ANY=[@ANYBLOB="4c000000008e4570878152db6afcde770e002300004bff643c4ae7d9e1b0266e4b37298f7589fd307fb94cb52e9d9e42f377718251041a3e4d542cf67c22f60fa545890f481cef8ecdff64b7b84634225f9e902419a99feb4f2b373121980f4c1cbc56f178b66e95baade7030a1f1496000000000000000000000000000000000000"]}) fcntl$getflags(r0, 0x408) [ 675.141783] binder: 13610:13612 Acquire 1 refcount change on invalid ref 0 ret -22 [ 675.214365] binder: 13610:13612 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 01:56:29 executing program 0: socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000001f80)={0xffffffffffffffff, 0xffffffffffffffff}) setsockopt$SO_ATTACH_FILTER(r2, 0x1, 0x1a, &(0x7f0000ab9ff0)={0x2, &(0x7f000039a000)=[{0x20, 0x0, 0x0, 0xfffffffffffff010}, {0x6}]}, 0x10) sendmmsg(r1, &(0x7f0000001e80)=[{{&(0x7f0000000700)=@l2={0x1f, 0x0, {}, 0x0, 0x0}, 0x80, &(0x7f0000001dc0)}}], 0x1, 0x0) 01:56:29 executing program 4: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) getpeername(r0, &(0x7f0000000080)=@pptp={0x18, 0x2, {0x0, @rand_addr}}, &(0x7f0000000100)=0x80) ioctl$sock_SIOCETHTOOL(r0, 0x8946, &(0x7f0000000040)={'bond0\x00', &(0x7f0000000000)=ANY=[@ANYBLOB="4c4e89ae025d3d28f7e25a887bdebcc4a87ea0e0b72ab09c042d9ac00c0000000a"]}) 01:56:29 executing program 3: r0 = socket$inet(0x2, 0x3, 0x2) connect$inet(0xffffffffffffffff, &(0x7f0000000000)={0x2, 0x0, @local}, 0x10) setsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x23, &(0x7f0000000000)={{{@in=@multicast2, @in=@multicast1}}, {{@in6}, 0x0, @in6=@loopback}}, 0xe8) syz_emit_ethernet(0x2a, &(0x7f0000000640)={@random="b100485caa2a", @link_local, [], {@ipv4={0x800, {{0x5, 0x4, 0x60, 0x0, 0x1c, 0x0, 0x0, 0x0, 0x2, 0x0, @rand_addr, @broadcast}, @igmp={0x11, 0xffffffffffffffff, 0x0, @multicast1}}}}}, &(0x7f0000000140)) [ 675.326002] binder: 13610:13627 Acquire 1 refcount change on invalid ref 0 ret -22 [ 675.342235] binder: 13610:13627 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 675.420295] binder: 13612 RLIMIT_NICE not set 01:56:29 executing program 6: r0 = syz_open_dev$sndseq(&(0x7f0000000100)='/dev/snd/seq\x00', 0x0, 0x0) read(r0, &(0x7f0000fb6000)=""/28, 0x3f0) ioctl$SNDRV_SEQ_IOCTL_REMOVE_EVENTS(r0, 0x4040534e, &(0x7f00000001c0)={0xbf}) ioctl$SNDRV_SEQ_IOCTL_QUERY_SUBS(r0, 0xc058534f, &(0x7f00000002c0)={{}, 0x1, 0x0, 0x0, {}, 0x0, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xe00]}) r1 = gettid() timer_create(0x0, &(0x7f0000044000)={0x0, 0x12}, &(0x7f0000000040)) r2 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r2, 0x8912, &(0x7f00000001c0)="0a5cc80700315f85715070") timer_settime(0x0, 0x0, &(0x7f0000000080)={{0x0, 0x989680}, {0x0, 0x9}}, &(0x7f0000040000)) tkill(r1, 0x1000000000014) 01:56:29 executing program 5: perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1f}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000340)={&(0x7f0000000000), 0xc, &(0x7f0000000300)={&(0x7f0000000240)=@newlink={0x50, 0x10, 0x721, 0x0, 0x0, {0x0, 0x0, 0xfffffff0}, [@IFLA_LINKINFO={0x28, 0x12, @veth={{0xc, 0x1, 'veth\x00'}, {0x18, 0x2, @VETH_INFO_PEER={0x14}}}}, @IFLA_NET_NS_FD={0x8}]}, 0x50}}, 0x0) 01:56:29 executing program 2: r0 = socket$inet(0x2, 0x3, 0x2) connect$inet(0xffffffffffffffff, &(0x7f0000000000)={0x2, 0x0, @local}, 0x10) setsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x23, &(0x7f0000000000)={{{@in=@multicast2, @in=@multicast1}}, {{@in6}, 0x0, @in6=@loopback}}, 0xe8) syz_emit_ethernet(0x2a, &(0x7f0000000640)={@random="b100485caa2a", @link_local, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x1c, 0x0, 0x0, 0x0, 0x2, 0x0, @rand_addr, @broadcast}, @igmp={0x11, 0x0, 0x0, @multicast1}}}}}, &(0x7f0000000140)={0x0, 0x0, [0x0, 0x0, 0x60000000]}) 01:56:29 executing program 1: r0 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.cpu\x00', 0x200002, 0x0) r1 = openat$cgroup_int(r0, &(0x7f00000001c0)='cpuset.mems\x00', 0x2, 0x0) r2 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000040)='/dev/hwrng\x00', 0x80, 0x0) ioctl$KVM_GET_XSAVE(r2, 0x9000aea4, &(0x7f0000000200)) sendfile(r1, r1, &(0x7f0000000080), 0x3) 01:56:29 executing program 3: r0 = socket$inet(0x2, 0x3, 0x2) connect$inet(0xffffffffffffffff, &(0x7f0000000000)={0x2, 0x0, @local}, 0x10) setsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x23, &(0x7f0000000000)={{{@in=@multicast2, @in=@multicast1}}, {{@in6}, 0x0, @in6=@loopback}}, 0xe8) syz_emit_ethernet(0x2a, &(0x7f0000000640)={@random="b100485caa2a", @link_local, [], {@ipv4={0x800, {{0x5, 0x4, 0x40000000, 0x0, 0x1c, 0x0, 0x0, 0x0, 0x2, 0x0, @rand_addr, @broadcast}, @igmp={0x11, 0xffffffffffffffff, 0x0, @multicast1}}}}}, &(0x7f0000000140)) 01:56:29 executing program 7: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000180)='/dev/sequencer\x00', 0x10002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000080)="0a5cc80700315f85715070") r1 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000001c0)={0x2, 0x0, &(0x7f0000000140)=ANY=[@ANYBLOB='\fc'], 0x0, 0x0, &(0x7f0000000080)}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, &(0x7f00000001c0)}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000040)={0x8, 0x4c, &(0x7f00000000c0)=[@release={0x400c630f}], 0x1, 0x0, &(0x7f0000000100)='V'}) fstat(r0, &(0x7f00000002c0)) 01:56:29 executing program 4: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) ioctl$sock_SIOCETHTOOL(r0, 0x8946, &(0x7f0000000040)={'bond0\x00', &(0x7f0000000240)=ANY=[@ANYBLOB="4c000000000023000000000000000002"]}) socket$nl_netfilter(0x10, 0x3, 0xc) 01:56:29 executing program 0: socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000001f80)={0xffffffffffffffff, 0xffffffffffffffff}) setsockopt$SO_ATTACH_FILTER(r2, 0x1, 0x1a, &(0x7f0000ab9ff0)={0x2, &(0x7f000039a000)=[{0x20, 0x0, 0x0, 0xfffffffffffff010}, {0x6}]}, 0x10) sendmmsg(r1, &(0x7f0000001e80)=[{{&(0x7f0000000700)=@l2={0x1f, 0x0, {}, 0x0, 0x0}, 0x80, &(0x7f0000001dc0)}}], 0x1, 0x0) 01:56:29 executing program 4: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) ioctl$sock_SIOCETHTOOL(r0, 0x8946, &(0x7f0000000040)={'bond0\x00', &(0x7f0000000240)=ANY=[@ANYBLOB="4c000000000023000000000000000002"]}) ioctl(r0, 0x0, &(0x7f0000000280)="91f652641238c51a1a3727131e4a02e09892c9d82725688c1f754dc144ffd5b150280a5efb41650100db7d6edc231c9fce2c3ced68317cab4165c988018ec08dc6cb10eb5865b6976f04a30f1425d45e1e580e2c6935f2aa5726c9e085eb91ea4f533a978ac566468530f450e5a18dbe66d020c2836656c791b89b704208aeb9d3b2aada5de7fecc04ab36cccab12feb26f2b145dd8c93f5bde31595bbdbef22c0e52d62f044588b267edbaaea82151a7cc9cf9714ddda11e73116c946365ea0741954564fb1fe6cf2b9b73c239e7cad6bf3a7e5dbdcdcbf44f0e4c6bd7f6f39823c0e44652b8d7190dfb59b0e433e6d16e47000ebefe6dd42a364f240b30b52a7a333349ae3a6de7b12f5aa4356f053af73b6dcc205f29384e002449e7223180ee21739f36340a23ef1e70cdebcd2c3922a3766e6ed4793dd856ac2de63a56f7a38281a6476ef4c55ee8e158765ca0a759f84110df815329e74aa52f1c47c7e7cf81ad0ef8fa43ee180b53f6a83fe11a39c0969661124ba6a3e5f076635422b5ca9c3933405b75ae1d005f09c3884d0b0e258ef646d2f1bbb412eae5b98b194a3de38e5673c2a2c19d68cb5810a062753e27e3daf0c01ae7c9e34493fa430fc1d87e9e32eae66ee8737204dfaa0fa71830451002e85e20394c9f14327aef61820a27c11d0ce1cef18fb75c341c8a5e6291d35748e309b0c0cee302e85a6af1eb388d813582d43b53f94d3ff5c9dea1d4293dd8f68bc3d2e9f3c1eca8dd138a71306c073703de3ae582d5ea325559dd3b4133c175ca0f71c1f0fdac0ab40ccf7cb6ed8b1ea9ceac9a5677bc6ca48bef1a2be994c718476f09c5f59577764865c01c804974ad213306ac587c99cf4a5141046d041f5571cc3b32e42fa3e3f344e39aefb05aacc132496e7ad3b2b83d4115798962bc4b0b1f9c0ab59077e5cc64b9bc1ceb0541a059e1f5f5142d430f6cfecb10ba21a5ae68252e3b611a112f4567b8e790802155386de70ee1aebcc6397cc3d496c498575f8a722a76255a85ace242edeafe72d52e7aecb96bcf5579a1c0bd1e75a9e63c3dad32e91319e31eb66cc568025b9e6bbc28ae7981ab19ac02be88220edf0333f2ae7565d1936ba3d5f3696e92c41672930e7577942690a7fa39abbeb9c504dfd289f3cf31c22948f1f10c357a242e91288fbd4aae904eaade2db3b6ec3a0d17a2c6c0a59bb7ad69b6695d6f3342f1762f103920a9cae68b836cfb7a4c79c3c6698106c0a263cbf0cb4f7287fc4a436fa5ab59b3b21b71003c6797015e1f2f15ff0a901a98b9ed1f34f4a80b3faa1b3fd06e74fc1e16d48673bea1fd2dba96a4da313cab2420750ae72c80681fa32bf99c803082221959f2398f284f7e01a26cfbdc53d78554f2ef8bf408fd17e7100e057c9ac12449ada780bb07c1d421c16480d29dc79f254a7eb3dfb44b64f96c88fddb060e4123ba5583f484b942f32ba953860bf31d8bfe297deb3d1664e9c5722c76207a458ba302cc163889617b1246abdf9d99aa0f160229f4517cdbc6a6c3d152414ff35e4c77bb83d4537e6d2def61e762b03308fb308616ab44fc7f1e486bac14009b65964f3def972665bf16d46022d225d986ee60fcb3c902a150480ebbec56f0f307cd993c1c7333fdb649c521969905ce7618307cf355122007edcbb055725c774d45cc2950ee4cc257e17a4996541a63946f3a46803efb61daebc9bb7699b934e37ac64beb8994777524e824df645026160c9ee5d47ed8aa1ac2d4b65a57278a4d9233f4f58d6ba962e22faa00323b390a0612514cc7e2d725d21b5676d7a1f4d224b77d8ee07e6d1aa7d4be2c06772852430fbd3cec1539644854174a94fd91ca42279641cfd3dafd31150c9e90a69fa0115fe51ef41377e44030c1989909690f88b7c2e702d716b1f2e461144b5459e66d02d480fbd6af0cd8ea080060f45b5cb50dff0e38aa13ffb300f6d101e5a3f7197c42a75e29ea8c31a9d2e59a764c7a2ed8aaa86282d7b6201a88afab98b31c50cf9a3841fd582c576244eee137960d10f65e30aa415c2d1f809270fb1e1424b70c2586c0118fb3ce109a72c70de55a1fe29741fa8b6535a1455ab2374c1d00e44615be7385decae4ca837e83166b971649068cd5ccf7c930b1ef5674ffe1775cc7389cf0cd15c492c28e1efc40520d9089c10349f5ad6dcaac5c9321fbd269dd0bd3fde7001189043454eeae388072548c9ee58c5a26ebd134306b122a5284a9ce2baf3ed7bafb0b3691a76fc4e04d57a20afce0d8353958d1135f60282eb37e4c87872277d0834af0bf77128c78143be107693a3ed9cab62c7014037e70497622e93c249d83d971df77175b57615709d5827b30bf950cc2dd89707f4475627c58cd0c153e498e7a017cd9ffaee70f940c436e9bc06a860bb959b79f1440914da70cf975a6c06a658b2ca6818673aa73f4ebbcad25d096882e437c989084c3bb0c965044abdbbd445d31a1b32a43ea9a106298e2613c289016612c84418c73c7933c6baf05c4d584e10751a2ec4d3743862816d9b315074eec68e2296fd4b147d70a000ebbc089278612e64c56ef4d3018f76d926e8536613903c93ec44e9d114a510dce2674e9c0979e8792ac77e4c89ec3b91ae83aad1aa546c3d2a8def65fb8eec2efb7fe0754af57faf154fa436aebcb77f58f827867f91cc5fe3aeecb13f92de37e63a3121ecd770511a538c2711c64b90fff9ac4fe7e6e17bdfaf782b6fef4868ea8a3e54d84761279e8440e1a3f3fcfd33be03c62eb15c82e49854412788d4f453add337013c9babbfa60f59f4ca545a39996837b5c6c3e8c358d8d16b6ac39e697b202306b13dde2e51aa39c55a508d32c520bd7dcfced4a764694aa3458b4864a8d839ad4f542641a5ead7a25d3e6bcfb22d4662762026fb710f443790ce8385976e317d95f2fe00eb9e493df28f48b73e161de72485a226957c39345d76ae371396a00f4b796efaa6b64d617d736cab5efb59bafee03778423c4ac013bc47620bcdd6fa8c4330424b66f7020cc28b89d15c8b3a13279e6d3bed75f4ee9b288071896bcbcd7cafe7ead4347a2deba3da55f84565f28893f6429e2909cbba380bafa95fb9025ddecae485f24b1fbd55ec3e1fcc660e3d63a989bb24aa1c66237b3bf3b3d22622844a66dc13519d1b78e1f05836fe037cd293c43e7188878d9e327731852f273b785fd9c9762a921dcf98b9474efc9db83226847870c5961ba371caadc0d54a6ec8c2175daa0ed92e474e0c0994ce48c8466a4bbac44772f498d7d65985f92cdf398d36184e92f35aa1e18ffff115b45f7c074d274e12a2f6da0572135bf0023fb847643f1e3f5deb9dc2f99c97062213bd86c2e33080283763c9f9b74a6a2f180ffc4bb675ad42805779b27fbb9c89aeda2e8d5fe467a20cad489164d4ec6978ec0d610eef056bc8c210d4d89dfb086069f4d0bbe8da8b09cd0b28f101bf4d6cb35a758f2816445c69bcb68054b3253f876cb94a8080384eb9d5cdb46ac1e5bd52b34ec06ae1619bbf1ca3c272459f85053336181ca62fd502b21312440d6f5496261feb4f38d3178c97dec7196c11a21a28d704386673fb075ad70e20965ec557b666661c64c2944f627590dc7231cd536117598433e3ce82f422440ad069f488ed79a5ae8f9bcc2e323f0e0f4cbd15a291660883b85691c41c01b205a253928ecdb286eda96230289f2630902bbed7e61cb1aee264caa650459b3249e75b4855637199858dbf930716f74019c08a5614800b8fed057cc506efe8e4fc518f88afc6cdd69cd7f7ebc4ec5fae4cf8710c9e828a9a434c7c1affd5a774e8e974765a0faa1e1d654ef8b52c0682abffa085e4f697c0503bd28bbf748a8c7be0f75682d2d3b14c8c42c4d78a3258ee7de8842a8ea1c3b5587c8a1c30a60e8e3fc14f6cf0076b924991d3af58ab58773796024bd9c549f41bf30c233b413e801bc9f06dfeadc9505724c9e74679a3742ed3c26ee0728b1038cae60f8a5528630295b617b93e2baa224f5bb0734d58430e4d3c874d2beb2e351c3affa563c53e368736747c5add3215d626297e6450afa35b85b91345224b83c506a2f34de705db9a8699fe7a5bbdbc9311f55c4f2f0192b0a1b2a11d35e0f882576ade707d3946a0c4e34a985a22e1601ea695eed9fab1b10b8ffcee1ce93fcdd2f036ffbb9f4f38295303c2a9daa13819dcf8713f7b0afd32fd1cf3db9f459db2c1aee450eddb18af8130ad0c6d92bc2a0571f34529048fd2851031b819ef99f00c68ef074458f6d5928c9c90c920213e9bf108440a96a02a433dacef451e535eded749ac18c5a3495dc069ed5f39775cc9d9bc95f1a55b515c27492e4a88a6dd9eb5fae3645aec2675bca1dc6c72d48903b24dc86e03879be94dd15ad1daf7520dc3859165b262e463a7387b23014da9d1de6c7c3150d9a25e4c809343a611de80008c85e60d68b23c1f7961860e1714691784295937a8ede8b158ff8ea18b150617a159006a87388e2c46cbc47cc4b089aaec7fc9f75b43554a521c137972243ba848f47c4d4440d94183dbc54c6ff672176790e65d261f4604b2a50da447885f772bbb27d65252956eb678685ed8a4c8b8effe1178312c308dc09b11e958c319ed56f097b88c3e9852e7ce8f11da5ddc6b173b00b66494581c27e0dc453a20134366f12d7f0cfb3aee5cc9559416088be55af5acb84a8840f480b92931c536d053663876e9fcdd232fd895bb8c4c7d68d00de9614cdf17b417805635e8fcf0b9a9c1db072f52f48bf0b964a462ada6aab91cfdc8fbb5aebe29f02d96160e70e5131cec98fb4046a10c16d0eb676ff924faa301b3bacfd793aeaa899a50f4269fbe40e72cefedbfa726dc0221ddfc3b885370e4674da70e85ba177401e0b6c456ed6f2bb6502dd0bfb0278532e9a09ca29ff9f898d8d3fd531f64ce5e8a5311eabffe6d6b80e4bf1ec0607062a1b63de5aea62c4ed77805f3b3a39771eab5438338352944b23c1576c9e7e27c7207fe5907c750a149c41b3b866ed00d5de3cb94dc26b68a38e0b8971ac50181155f16198582e1fb2ab109182dc9fb0ff246d7b76f3647d0c567ccb9ed00ed4ce65bcaa8c499903c05bb81ed55e7f284557d59e557d85241572171a351a74976562797e2c2eecb71a75a963237e0fe83f7c18c7ef36534c26c45136e281650660d73d84aa1a90e92f34c9c6eea3b605991440dae1fdd075ca0e04594348b17fb6edaf7d9ec87aeeab48ad60d7980addc182f0aff0ee5d697ca320bb5be353a764e8988a2c26aa17b90f38c1d40446a2b43c7219d2f25e005008a0f1ccd81ebdd759ebc296ee958a4146ecc7176bfee11edb7bc558608a697d50f07313a7f6713359b3fed70b8fe209ff5915fc9e5fa5cee9743a7a2fc449ee5899d5dbe61331d7d5455e2fc6c0d13b05826bd4abfd3a6c99dbe8d4441aab84d7d4777cea6325ae7970e90a66e48bf01f19859798812d7a4aa74b8ffb43148c94454d3d42377035eb359c5fc93d808a6ec798dcb31848fb1763bda48b31b4a7da395848f01359399004c71d8e812ec0df58507eee140812b44432cb1d91ff88fd070cc4680f7eda60eaddebb083f543bb7955c158ac0fff85f93a19ac78ede3da915c7c6de24108abfdac31b0badd24d78f034a6ebcb5184bf6e9bbfaf029cbbd7959933102fd29a3cec1b4031d99bd5d81ebec7571b3bd19c3e7b6956164791d316f24d79e1cc0d283f10c56b70f43fe395c148ae8048cafaf1") 01:56:29 executing program 5: perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1f}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000340)={&(0x7f0000000000), 0xc, &(0x7f0000000300)={&(0x7f0000000240)=@newlink={0x50, 0x10, 0x721, 0x0, 0x0, {0x0, 0x0, 0xfffffffffffff000}, [@IFLA_LINKINFO={0x28, 0x12, @veth={{0xc, 0x1, 'veth\x00'}, {0x18, 0x2, @VETH_INFO_PEER={0x14}}}}, @IFLA_NET_NS_FD={0x8}]}, 0x50}}, 0x0) [ 675.967335] binder: 13675:13677 Acquire 1 refcount change on invalid ref 0 ret -22 01:56:29 executing program 1: mmap(&(0x7f0000011000/0x3000)=nil, 0x3000, 0x1, 0x32, 0xffffffffffffffff, 0x0) r0 = userfaultfd(0x0) ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f0000000080)) ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f00000000c0)={{&(0x7f0000012000/0x2000)=nil, 0x2000}, 0x1}) r1 = syz_open_dev$sndtimer(&(0x7f0000f85ff1)='/dev/snd/timer\x00', 0x0, 0x0) ioctl$SNDRV_TIMER_IOCTL_NEXT_DEVICE(r1, 0xc0145401, &(0x7f0000013000)) ioctl$SNDRV_TIMER_IOCTL_NEXT_DEVICE(r1, 0xc0145401, &(0x7f0000000040)) clone(0x0, &(0x7f00000000c0), &(0x7f0000000240), &(0x7f00000001c0), &(0x7f0000000180)) syz_open_dev$sndtimer(&(0x7f0000000140)='/dev/snd/timer\x00', 0x0, 0x180) r2 = openat$full(0xffffffffffffff9c, &(0x7f0000000180)='/dev/full\x00', 0x20000, 0x0) write$P9_ROPEN(r2, &(0x7f0000000100)={0x18, 0x71, 0x2, {{0x28, 0x3, 0x3}, 0x4}}, 0x18) 01:56:29 executing program 2: r0 = socket$inet(0x2, 0x3, 0x2) connect$inet(0xffffffffffffffff, &(0x7f0000000000)={0x2, 0x0, @local}, 0x10) setsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x23, &(0x7f0000000000)={{{@in=@multicast2, @in=@multicast1}}, {{@in6}, 0x0, @in6=@loopback}}, 0xe8) syz_emit_ethernet(0x2a, &(0x7f0000000640)={@random="b100485caa2a", @link_local, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x1c, 0x0, 0x0, 0x0, 0x2, 0x0, @rand_addr, @broadcast}, @igmp={0x11, 0x0, 0x0, @multicast1}}}}}, &(0x7f0000000140)={0x0, 0x0, [0x0, 0x0, 0x300000000000000]}) 01:56:29 executing program 3: r0 = socket$inet(0x2, 0x3, 0x2) connect$inet(0xffffffffffffffff, &(0x7f0000000000)={0x2, 0x0, @local}, 0x10) setsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x23, &(0x7f0000000000)={{{@in=@multicast2, @in=@multicast1}}, {{@in6}, 0x0, @in6=@loopback}}, 0xe8) syz_emit_ethernet(0x2a, &(0x7f0000000640)={@random="b100485caa2a", @link_local, [], {@ipv4={0x800, {{0x5, 0x4, 0x7000000, 0x0, 0x1c, 0x0, 0x0, 0x0, 0x2, 0x0, @rand_addr, @broadcast}, @igmp={0x11, 0xffffffffffffffff, 0x0, @multicast1}}}}}, &(0x7f0000000140)) [ 676.012418] binder: 13675:13677 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 01:56:30 executing program 4: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) ioctl$sock_SIOCETHTOOL(r0, 0x8946, &(0x7f0000000040)={"226f6e6430000000e5ffffff00", &(0x7f0000000000)=ANY=[]}) r1 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000080)='/dev/rtc0\x00', 0x2, 0x0) getpeername$packet(r1, &(0x7f0000000240)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @local}, &(0x7f0000000280)=0x14) ioctl$sock_SIOCBRADDBR(r1, 0x89a0, &(0x7f0000000000)='ip6tnl0\x00') write$RDMA_USER_CM_CMD_CREATE_ID(0xffffffffffffffff, &(0x7f0000000100)={0x0, 0x18, 0xfa00, {0x2, &(0x7f00000000c0)={0xffffffffffffffff}, 0x13f, 0xa}}, 0x20) socketpair$inet6_tcp(0xa, 0x1, 0x0, &(0x7f0000000180)={0xffffffffffffffff}) getsockopt$IP_VS_SO_GET_DAEMON(r3, 0x0, 0x487, &(0x7f00000001c0), &(0x7f0000000200)=0x30) write$RDMA_USER_CM_CMD_NOTIFY(r1, &(0x7f0000000140)={0xf, 0xfffffffffffffeda, 0xfa00, {r2, 0x10}}, 0x10) 01:56:30 executing program 5: perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1f}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000340)={&(0x7f0000000000), 0xc, &(0x7f0000000300)={&(0x7f0000000240)=@newlink={0x50, 0x10, 0x721, 0x0, 0x0, {0x0, 0x0, 0x600000000000000}, [@IFLA_LINKINFO={0x28, 0x12, @veth={{0xc, 0x1, 'veth\x00'}, {0x18, 0x2, @VETH_INFO_PEER={0x14}}}}, @IFLA_NET_NS_FD={0x8}]}, 0x50}}, 0x0) 01:56:30 executing program 0: socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000001f80)={0xffffffffffffffff, 0xffffffffffffffff}) setsockopt$SO_ATTACH_FILTER(r2, 0x1, 0x1a, &(0x7f0000ab9ff0)={0x2, &(0x7f000039a000)=[{0x20, 0x0, 0x0, 0xfffffffffffff010}, {0x6}]}, 0x10) sendmmsg(r1, &(0x7f0000001e80)=[{{&(0x7f0000000700)=@l2={0x1f, 0x0, {}, 0x0, 0x0}, 0x80, &(0x7f0000001dc0)}}], 0x1, 0x0) [ 676.133302] binder: 13675:13700 Acquire 1 refcount change on invalid ref 0 ret -22 [ 676.217278] binder: 13677 RLIMIT_NICE not set [ 676.288937] binder: 13675:13700 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 01:56:30 executing program 6: r0 = syz_open_dev$sndseq(&(0x7f0000000100)='/dev/snd/seq\x00', 0x0, 0x0) read(r0, &(0x7f0000fb6000)=""/28, 0x3f0) ioctl$SNDRV_SEQ_IOCTL_REMOVE_EVENTS(r0, 0x4040534e, &(0x7f00000001c0)={0xbf}) ioctl$SNDRV_SEQ_IOCTL_QUERY_SUBS(r0, 0xc058534f, &(0x7f00000002c0)={{}, 0x1, 0x0, 0x0, {}, 0x0, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xbf00]}) r1 = gettid() timer_create(0x0, &(0x7f0000044000)={0x0, 0x12}, &(0x7f0000000040)) r2 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r2, 0x8912, &(0x7f00000001c0)="0a5cc80700315f85715070") timer_settime(0x0, 0x0, &(0x7f0000000080)={{0x0, 0x989680}, {0x0, 0x9}}, &(0x7f0000040000)) tkill(r1, 0x1000000000014) 01:56:30 executing program 3: r0 = socket$inet(0x2, 0x3, 0x2) connect$inet(0xffffffffffffffff, &(0x7f0000000000)={0x2, 0x0, @local}, 0x10) setsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x23, &(0x7f0000000000)={{{@in=@multicast2, @in=@multicast1}}, {{@in6}, 0x0, @in6=@loopback}}, 0xe8) syz_emit_ethernet(0x2a, &(0x7f0000000640)={@random="b100485caa2a", @link_local, [], {@ipv4={0x800, {{0x5, 0x4, 0x4000, 0x0, 0x1c, 0x0, 0x0, 0x0, 0x2, 0x0, @rand_addr, @broadcast}, @igmp={0x11, 0xffffffffffffffff, 0x0, @multicast1}}}}}, &(0x7f0000000140)) 01:56:30 executing program 2: r0 = socket$inet(0x2, 0x3, 0x2) connect$inet(0xffffffffffffffff, &(0x7f0000000000)={0x2, 0x0, @local}, 0x10) setsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x23, &(0x7f0000000000)={{{@in=@multicast2, @in=@multicast1}}, {{@in6}, 0x0, @in6=@loopback}}, 0xe8) syz_emit_ethernet(0x2a, &(0x7f0000000640)={@random="b100485caa2a", @link_local, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x1c, 0x0, 0x0, 0x0, 0x2, 0x0, @rand_addr, @broadcast}, @igmp={0x11, 0x0, 0x0, @multicast1}}}}}, &(0x7f0000000140)={0x0, 0x0, [0x0, 0x0, 0x700000000000000]}) 01:56:30 executing program 4: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) r1 = dup(r0) ioctl$RTC_SET_TIME(r1, 0x4024700a, &(0x7f0000000000)={0x9, 0x37, 0xe, 0x7, 0x1, 0x5, 0x5, 0x167, 0xffffffffffffffff}) ioctl$sock_SIOCETHTOOL(r0, 0x8946, &(0x7f0000000040)={'bond0\x00', &(0x7f0000000240)=ANY=[@ANYBLOB="4c000000000023c5611cd2163dcd2950"]}) 01:56:30 executing program 5: perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1f}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000340)={&(0x7f0000000000), 0xc, &(0x7f0000000300)={&(0x7f0000000240)=@newlink={0x50, 0x10, 0x721, 0x0, 0x0, {0x0, 0x0, 0x500000000000000}, [@IFLA_LINKINFO={0x28, 0x12, @veth={{0xc, 0x1, 'veth\x00'}, {0x18, 0x2, @VETH_INFO_PEER={0x14}}}}, @IFLA_NET_NS_FD={0x8}]}, 0x50}}, 0x0) 01:56:30 executing program 7: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000180)='/dev/sequencer\x00', 0x10002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000080)="0a5cc80700315f85715070") r1 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000001c0)={0x2, 0x0, &(0x7f0000000140)=ANY=[@ANYBLOB='\fc'], 0x0, 0x0, &(0x7f0000000080)}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, &(0x7f00000001c0)}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000040)={0x8, 0x68, &(0x7f00000000c0)=[@release={0x400c630f}], 0x1, 0x0, &(0x7f0000000100)='V'}) fstat(r0, &(0x7f00000002c0)) 01:56:30 executing program 0: socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000001f80)={0xffffffffffffffff, 0xffffffffffffffff}) setsockopt$SO_ATTACH_FILTER(r2, 0x1, 0x1a, &(0x7f0000ab9ff0)={0x2, &(0x7f000039a000)=[{0x20, 0x0, 0x0, 0xfffffffffffff010}, {0x6}]}, 0x10) sendmmsg(r1, &(0x7f0000001e80)=[{{&(0x7f0000000700)=@l2={0x1f, 0x0, {}, 0x0, 0x0}, 0x80, &(0x7f0000001dc0)}}], 0x1, 0x0) 01:56:30 executing program 0: socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000001f80)={0xffffffffffffffff, 0xffffffffffffffff}) setsockopt$SO_ATTACH_FILTER(r2, 0x1, 0x1a, &(0x7f0000ab9ff0)={0x2, &(0x7f000039a000)=[{0x20, 0x0, 0x0, 0xfffffffffffff010}, {0x6}]}, 0x10) sendmmsg(r1, &(0x7f0000001e80)=[{{&(0x7f0000000700)=@l2={0x1f, 0x0, {}, 0x0, 0x0}, 0x80, &(0x7f0000001dc0)}}], 0x1, 0x0) 01:56:30 executing program 4: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) ioctl$sock_SIOCETHTOOL(r0, 0x8946, &(0x7f0000000040)={'bond0\x00', &(0x7f0000000240)=ANY=[@ANYBLOB="4c0000000000230000f0000000000002"]}) 01:56:30 executing program 5: perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1f}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000340)={&(0x7f0000000000), 0xc, &(0x7f0000000300)={&(0x7f0000000240)=@newlink={0x50, 0x10, 0x721, 0x0, 0x0, {0x0, 0x0, 0xf0ffffff}, [@IFLA_LINKINFO={0x28, 0x12, @veth={{0xc, 0x1, 'veth\x00'}, {0x18, 0x2, @VETH_INFO_PEER={0x14}}}}, @IFLA_NET_NS_FD={0x8}]}, 0x50}}, 0x0) [ 676.851126] binder: 13741:13742 Acquire 1 refcount change on invalid ref 0 ret -22 [ 676.863208] binder: 13741:13742 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 676.886267] binder: 13742 RLIMIT_NICE not set 01:56:30 executing program 1: r0 = socket$inet6(0xa, 0x2, 0x0) ioctl(r0, 0x8912, &(0x7f0000000080)="0a51c83916ebfdceea3e630ceb03912b23") openat$cuse(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/cuse\x00', 0x0, 0x0) getsockopt$inet6_IPV6_IPSEC_POLICY(r0, 0x29, 0x22, &(0x7f0000000240)={{{@in=@loopback, @in6=@remote}}, {{@in6=@loopback}, 0x0, @in=@dev}}, &(0x7f0000000140)=0xe8) r1 = socket(0x10, 0x3, 0x0) ioctl$sock_ifreq(r1, 0x89f0, &(0x7f0000000000)={'ip6tnl0\x00', @ifru_names='team_slave_1\x00'}) 01:56:30 executing program 2: r0 = socket$inet(0x2, 0x3, 0x2) connect$inet(0xffffffffffffffff, &(0x7f0000000000)={0x2, 0x0, @local}, 0x10) setsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x23, &(0x7f0000000000)={{{@in=@multicast2, @in=@multicast1}}, {{@in6}, 0x0, @in6=@loopback}}, 0xe8) syz_emit_ethernet(0x2a, &(0x7f0000000640)={@random="b100485caa2a", @link_local, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x1c, 0x0, 0x0, 0x0, 0x2, 0x0, @rand_addr, @broadcast}, @igmp={0x11, 0x0, 0x0, @multicast1}}}}}, &(0x7f0000000140)={0x0, 0x0, [0x0, 0x0, 0x6000000]}) 01:56:30 executing program 3: r0 = socket$inet(0x2, 0x3, 0x2) connect$inet(0xffffffffffffffff, &(0x7f0000000000)={0x2, 0x0, @local}, 0x10) setsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x23, &(0x7f0000000000)={{{@in=@multicast2, @in=@multicast1}}, {{@in6}, 0x0, @in6=@loopback}}, 0xe8) syz_emit_ethernet(0x2a, &(0x7f0000000640)={@random="b100485caa2a", @link_local, [], {@ipv4={0x800, {{0x5, 0x4, 0xe0000000, 0x0, 0x1c, 0x0, 0x0, 0x0, 0x2, 0x0, @rand_addr, @broadcast}, @igmp={0x11, 0xffffffffffffffff, 0x0, @multicast1}}}}}, &(0x7f0000000140)) 01:56:30 executing program 5: perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1f}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000340)={&(0x7f0000000000), 0xc, &(0x7f0000000300)={&(0x7f0000000240)=@newlink={0x50, 0x10, 0x721, 0x0, 0x0, {0x0, 0x0, 0x8000000}, [@IFLA_LINKINFO={0x28, 0x12, @veth={{0xc, 0x1, 'veth\x00'}, {0x18, 0x2, @VETH_INFO_PEER={0x14}}}}, @IFLA_NET_NS_FD={0x8}]}, 0x50}}, 0x0) 01:56:30 executing program 4: rt_sigprocmask(0x2, &(0x7f0000000000)={0x9}, &(0x7f0000000080), 0x8) r0 = socket$nl_netfilter(0x10, 0x3, 0xc) ioctl$sock_SIOCETHTOOL(r0, 0x8946, &(0x7f0000000040)={'bond0\x00', &(0x7f0000000240)=ANY=[@ANYBLOB="4c000000000023000000000000000002"]}) 01:56:30 executing program 0: socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000001f80)={0xffffffffffffffff, 0xffffffffffffffff}) setsockopt$SO_ATTACH_FILTER(r2, 0x1, 0x1a, &(0x7f0000ab9ff0)={0x2, &(0x7f000039a000)=[{0x20, 0x0, 0x0, 0xfffffffffffff010}, {0x6}]}, 0x10) sendmmsg(r1, &(0x7f0000001e80)=[{{&(0x7f0000000700)=@l2={0x1f, 0x0, {}, 0x0, 0x0}, 0x80, &(0x7f0000001dc0)}}], 0x1, 0x0) [ 677.609545] binder: 13741:13762 Acquire 1 refcount change on invalid ref 0 ret -22 [ 677.617436] binder: 13741:13762 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 677.625350] binder: 13762 RLIMIT_NICE not set 01:56:31 executing program 6: r0 = syz_open_dev$sndseq(&(0x7f0000000100)='/dev/snd/seq\x00', 0x0, 0x0) read(r0, &(0x7f0000fb6000)=""/28, 0x3f0) ioctl$SNDRV_SEQ_IOCTL_REMOVE_EVENTS(r0, 0x4040534e, &(0x7f00000001c0)={0xbf}) ioctl$SNDRV_SEQ_IOCTL_QUERY_SUBS(r0, 0xc058534f, &(0x7f00000002c0)={{}, 0x1, 0x0, 0x0, {}, 0x0, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffff00000000]}) r1 = gettid() timer_create(0x0, &(0x7f0000044000)={0x0, 0x12}, &(0x7f0000000040)) r2 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r2, 0x8912, &(0x7f00000001c0)="0a5cc80700315f85715070") timer_settime(0x0, 0x0, &(0x7f0000000080)={{0x0, 0x989680}, {0x0, 0x9}}, &(0x7f0000040000)) tkill(r1, 0x1000000000014) 01:56:31 executing program 2: r0 = socket$inet(0x2, 0x3, 0x2) connect$inet(0xffffffffffffffff, &(0x7f0000000000)={0x2, 0x0, @local}, 0x10) setsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x23, &(0x7f0000000000)={{{@in=@multicast2, @in=@multicast1}}, {{@in6}, 0x0, @in6=@loopback}}, 0xe8) syz_emit_ethernet(0x2a, &(0x7f0000000640)={@random="b100485caa2a", @link_local, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x1c, 0x0, 0x0, 0x0, 0x2, 0x0, @rand_addr, @broadcast}, @igmp={0x11, 0x0, 0x0, @multicast1}}}}}, &(0x7f0000000140)={0x0, 0x0, [0x0, 0x0, 0x4000]}) 01:56:31 executing program 3: r0 = socket$inet(0x2, 0x3, 0x2) connect$inet(0xffffffffffffffff, &(0x7f0000000000)={0x2, 0x0, @local}, 0x10) setsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x23, &(0x7f0000000000)={{{@in=@multicast2, @in=@multicast1}}, {{@in6}, 0x0, @in6=@loopback}}, 0xe8) syz_emit_ethernet(0x2a, &(0x7f0000000640)={@random="b100485caa2a", @link_local, [], {@ipv4={0x800, {{0x5, 0x4, 0x7, 0x0, 0x1c, 0x0, 0x0, 0x0, 0x2, 0x0, @rand_addr, @broadcast}, @igmp={0x11, 0xffffffffffffffff, 0x0, @multicast1}}}}}, &(0x7f0000000140)) 01:56:31 executing program 5: perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1f}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000340)={&(0x7f0000000000), 0xc, &(0x7f0000000300)={&(0x7f0000000240)=@newlink={0x50, 0x10, 0x721, 0x0, 0x0, {0x0, 0x0, 0xb40a}, [@IFLA_LINKINFO={0x28, 0x12, @veth={{0xc, 0x1, 'veth\x00'}, {0x18, 0x2, @VETH_INFO_PEER={0x14}}}}, @IFLA_NET_NS_FD={0x8}]}, 0x50}}, 0x0) 01:56:31 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000180)={&(0x7f0000000000), 0xc, &(0x7f0000000140)={&(0x7f0000000480)=@newlink={0x38, 0x10, 0xf0b, 0x0, 0x0, {}, [@IFLA_LINKINFO={0xc, 0x12, @gre={{0x8, 0x1, 'gre\x00'}, {0xc, 0x2, [@IFLA_GRE_LOCAL={0x8, 0x6, @rand_addr}]}}}]}, 0x38}}, 0x0) r1 = syz_open_dev$admmidi(&(0x7f0000000040)='/dev/admmidi#\x00', 0x3f, 0x80) write$P9_RUNLINKAT(r1, &(0x7f0000000080)={0x7, 0x4d, 0x1}, 0x7) 01:56:31 executing program 4: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) ioctl$sock_SIOCETHTOOL(r0, 0x8946, &(0x7f0000000040)={'bond0\x00', &(0x7f0000000240)=ANY=[@ANYBLOB="4c00000000000ccb0f2c195c0975db08"]}) 01:56:31 executing program 0: socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000001f80)={0xffffffffffffffff, 0xffffffffffffffff}) setsockopt$SO_ATTACH_FILTER(r2, 0x1, 0x1a, &(0x7f0000ab9ff0)={0x2, &(0x7f000039a000)=[{0x20, 0x0, 0x0, 0xfffffffffffff010}, {0x6}]}, 0x10) sendmmsg(r1, &(0x7f0000001e80)=[{{&(0x7f0000000700)=@l2={0x1f, 0x0, {}, 0x0, 0x0}, 0x80, &(0x7f0000001dc0)}}], 0x1, 0x0) 01:56:31 executing program 7: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000180)='/dev/sequencer\x00', 0x10002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000080)="0a5cc80700315f85715070") r1 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000001c0)={0x2, 0x0, &(0x7f0000000140)=ANY=[@ANYBLOB='\fc'], 0x0, 0x0, &(0x7f0000000080)}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, &(0x7f00000001c0)}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000040)={0x8, 0x7400000000000000, &(0x7f00000000c0)=[@release={0x400c630f}], 0x1, 0x0, &(0x7f0000000100)='V'}) fstat(r0, &(0x7f00000002c0)) 01:56:31 executing program 1: r0 = syz_open_dev$sndpcmp(&(0x7f0000000000)='/dev/snd/pcmC#D#p\x00', 0x0, 0x0) ioctl$int_out(r0, 0x400440fe, &(0x7f00000000c0)) 01:56:31 executing program 5: perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1f}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000340)={&(0x7f0000000000), 0xc, &(0x7f0000000300)={&(0x7f0000000240)=@newlink={0x50, 0x10, 0x721, 0x0, 0x0, {0x0, 0x0, 0x8}, [@IFLA_LINKINFO={0x28, 0x12, @veth={{0xc, 0x1, 'veth\x00'}, {0x18, 0x2, @VETH_INFO_PEER={0x14}}}}, @IFLA_NET_NS_FD={0x8}]}, 0x50}}, 0x0) 01:56:31 executing program 4: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) ioctl$sock_SIOCETHTOOL(r0, 0x8946, &(0x7f0000000040)={'bond0\x00', &(0x7f0000000240)=ANY=[@ANYBLOB="4c000a00000023000000000000000002"]}) 01:56:31 executing program 2: r0 = socket$inet(0x2, 0x3, 0x2) connect$inet(0xffffffffffffffff, &(0x7f0000000000)={0x2, 0x0, @local}, 0x10) setsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x23, &(0x7f0000000000)={{{@in=@multicast2, @in=@multicast1}}, {{@in6}, 0x0, @in6=@loopback}}, 0xe8) syz_emit_ethernet(0x2a, &(0x7f0000000640)={@random="b100485caa2a", @link_local, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x1c, 0x0, 0x0, 0x0, 0x2, 0x0, @rand_addr, @broadcast}, @igmp={0x11, 0x0, 0x0, @multicast1}}}}}, &(0x7f0000000140)={0x0, 0x0, [0x0, 0x0, 0x3e00]}) 01:56:31 executing program 3: r0 = socket$inet(0x2, 0x3, 0x2) connect$inet(0xffffffffffffffff, &(0x7f0000000000)={0x2, 0x0, @local}, 0x10) setsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x23, &(0x7f0000000000)={{{@in=@multicast2, @in=@multicast1}}, {{@in6}, 0x0, @in6=@loopback}}, 0xe8) syz_emit_ethernet(0x2a, &(0x7f0000000640)={@random="b100485caa2a", @link_local, [], {@ipv4={0x800, {{0x5, 0x4, 0x4, 0x0, 0x1c, 0x0, 0x0, 0x0, 0x2, 0x0, @rand_addr, @broadcast}, @igmp={0x11, 0xffffffffffffffff, 0x0, @multicast1}}}}}, &(0x7f0000000140)) [ 677.789521] binder: 13812:13813 Acquire 1 refcount change on invalid ref 0 ret -22 01:56:31 executing program 1: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = creat(&(0x7f0000000000)='./file0\x00', 0x4) setsockopt$inet6_mtu(r1, 0x29, 0x17, &(0x7f0000000080)=0x4, 0x4) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r2 = socket$inet6(0xa, 0x1, 0x0) mmap(&(0x7f0000011000/0x3000)=nil, 0x3000, 0x1, 0x32, 0xffffffffffffffff, 0x0) r3 = userfaultfd(0x0) ioctl$UFFDIO_API(r3, 0xc018aa3f, &(0x7f0000002000)) ioctl$UFFDIO_REGISTER(r3, 0xc020aa00, &(0x7f0000001000)={{&(0x7f0000011000/0x3000)=nil, 0x3000}, 0x1}) r4 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_int(r4, 0x6, 0x10000000013, &(0x7f0000d06000)=0x1, 0x4) r5 = openat$ptmx(0xffffffffffffff9c, &(0x7f00003e0000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r5, 0x40045431, &(0x7f00003b9fdc)) r6 = syz_open_pts(r5, 0x0) ioctl$TIOCSETD(r6, 0x5423, &(0x7f0000fd0ffc)=0x3) perf_event_open(&(0x7f000001d000)={0x0, 0x70}, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$FIONREAD(r6, 0x80047437, &(0x7f0000000040)) setsockopt$inet_tcp_int(r4, 0x6, 0x4000000000014, &(0x7f00000000c0)=0x80400000001, 0x240) connect$inet(r4, &(0x7f0000000200)={0x2, 0x0, @remote}, 0x10) sendto$inet(r4, &(0x7f0000000100), 0xffffffffffffff1f, 0x0, 0x0, 0x56c3) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r4, 0x6, 0x1d, &(0x7f0000000040), 0x14) close(r4) dup3(r2, r3, 0x0) 01:56:31 executing program 0: socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000001f80)={0xffffffffffffffff, 0xffffffffffffffff}) setsockopt$SO_ATTACH_FILTER(r2, 0x1, 0x1a, &(0x7f0000ab9ff0)={0x2, &(0x7f000039a000)=[{0x20, 0x0, 0x0, 0xfffffffffffff010}, {0x6}]}, 0x10) sendmmsg(r1, &(0x7f0000001e80)=[{{&(0x7f0000000700)=@l2={0x1f, 0x0, {}, 0x0, 0x0}, 0x80, &(0x7f0000001dc0)}}], 0x1, 0x0) [ 677.884313] binder: 13812:13813 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 01:56:31 executing program 5: perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1f}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000340)={&(0x7f0000000000), 0xc, &(0x7f0000000300)={&(0x7f0000000240)=@newlink={0x50, 0x10, 0x721, 0x0, 0x0, {0x0, 0x0, 0x2}, [@IFLA_LINKINFO={0x28, 0x12, @veth={{0xc, 0x1, 'veth\x00'}, {0x18, 0x2, @VETH_INFO_PEER={0x14}}}}, @IFLA_NET_NS_FD={0x8}]}, 0x50}}, 0x0) [ 677.993734] binder: 13812:13833 Acquire 1 refcount change on invalid ref 0 ret -22 [ 678.049371] binder: 13812:13833 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 01:56:32 executing program 3: r0 = socket$inet(0x2, 0x3, 0x2) connect$inet(0xffffffffffffffff, &(0x7f0000000000)={0x2, 0x0, @local}, 0x10) setsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x23, &(0x7f0000000000)={{{@in=@multicast2, @in=@multicast1}}, {{@in6}, 0x0, @in6=@loopback}}, 0xe8) syz_emit_ethernet(0x2a, &(0x7f0000000640)={@random="b100485caa2a", @link_local, [], {@ipv4={0x800, {{0x5, 0x4, 0x4000000000000000, 0x0, 0x1c, 0x0, 0x0, 0x0, 0x2, 0x0, @rand_addr, @broadcast}, @igmp={0x11, 0xffffffffffffffff, 0x0, @multicast1}}}}}, &(0x7f0000000140)) 01:56:32 executing program 6: r0 = syz_open_dev$sndseq(&(0x7f0000000100)='/dev/snd/seq\x00', 0x0, 0x0) read(r0, &(0x7f0000fb6000)=""/28, 0x3f0) ioctl$SNDRV_SEQ_IOCTL_REMOVE_EVENTS(r0, 0x4040534e, &(0x7f00000001c0)={0xbf}) ioctl$SNDRV_SEQ_IOCTL_QUERY_SUBS(r0, 0xc058534f, &(0x7f00000002c0)={{}, 0x1, 0x0, 0x0, {}, 0x0, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xbf00000000000000]}) r1 = gettid() timer_create(0x0, &(0x7f0000044000)={0x0, 0x12}, &(0x7f0000000040)) r2 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r2, 0x8912, &(0x7f00000001c0)="0a5cc80700315f85715070") timer_settime(0x0, 0x0, &(0x7f0000000080)={{0x0, 0x989680}, {0x0, 0x9}}, &(0x7f0000040000)) tkill(r1, 0x1000000000014) 01:56:32 executing program 4: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) syz_open_dev$sndctrl(&(0x7f00000001c0)='/dev/snd/controlC#\x00', 0x1800000000000, 0x6480) ioctl$sock_SIOCETHTOOL(r0, 0x8946, &(0x7f0000000040)={'bond0\x00', &(0x7f0000000240)=ANY=[@ANYBLOB="4c0000003d7823000000000000000002"]}) r1 = openat$audio(0xffffffffffffff9c, &(0x7f0000000000)='/dev/audio\x00', 0x0, 0x0) ioctl$SNDRV_CTL_IOCTL_PCM_INFO(r1, 0xc1205531, &(0x7f0000000080)={0x3, 0xfffffffffffffffd, 0x7, 0xffff, [], [], [], 0xfffffffffffffffb, 0x3, 0x7, 0x8000, "bac9ec3227fb1ab4d2d152aeecbcf78a"}) 01:56:32 executing program 7: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000180)='/dev/sequencer\x00', 0x10002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000080)="0a5cc80700315f85715070") r1 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000001c0)={0x2, 0x0, &(0x7f0000000140)=ANY=[@ANYBLOB='\fc'], 0x0, 0x0, &(0x7f0000000080)}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, &(0x7f00000001c0)}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000040)={0x8, 0x68000000, &(0x7f00000000c0)=[@release={0x400c630f}], 0x1, 0x0, &(0x7f0000000100)='V'}) fstat(r0, &(0x7f00000002c0)) 01:56:32 executing program 2: r0 = socket$inet(0x2, 0x3, 0x2) connect$inet(0xffffffffffffffff, &(0x7f0000000000)={0x2, 0x0, @local}, 0x10) setsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x23, &(0x7f0000000000)={{{@in=@multicast2, @in=@multicast1}}, {{@in6}, 0x0, @in6=@loopback}}, 0xe8) syz_emit_ethernet(0x2a, &(0x7f0000000640)={@random="b100485caa2a", @link_local, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x1c, 0x0, 0x0, 0x0, 0x2, 0x0, @rand_addr, @broadcast}, @igmp={0x11, 0x0, 0x0, @multicast1}}}}}, &(0x7f0000000140)={0x0, 0x0, [0x0, 0x0, 0x60]}) 01:56:32 executing program 5: perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1f}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000340)={&(0x7f0000000000), 0xc, &(0x7f0000000300)={&(0x7f0000000240)=@newlink={0x50, 0x10, 0x721, 0x0, 0x0, {0x0, 0x0, 0xa000000}, [@IFLA_LINKINFO={0x28, 0x12, @veth={{0xc, 0x1, 'veth\x00'}, {0x18, 0x2, @VETH_INFO_PEER={0x14}}}}, @IFLA_NET_NS_FD={0x8}]}, 0x50}}, 0x0) 01:56:32 executing program 0: socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000001f80)={0xffffffffffffffff, 0xffffffffffffffff}) setsockopt$SO_ATTACH_FILTER(r2, 0x1, 0x1a, &(0x7f0000ab9ff0)={0x2, &(0x7f000039a000)=[{0x20, 0x0, 0x0, 0xfffffffffffff010}, {0x6}]}, 0x10) sendmmsg(r1, &(0x7f0000001e80)=[{{&(0x7f0000000700)=@l2={0x1f, 0x0, {}, 0x0, 0x0}, 0x80, &(0x7f0000001dc0)}}], 0x1, 0x0) 01:56:32 executing program 1: sendmsg$nl_netfilter(0xffffffffffffffff, &(0x7f0000289000)={&(0x7f0000000040), 0xc, &(0x7f0000058000)={&(0x7f000023f000)=ANY=[@ANYBLOB="840008000000000000bd7000ffffffff0000dffc0c00000000000000000000005b659a62290ffc380c2dbfdc5e9f13e1a04810d464fbc3f4c1b4e2bf501fb1bb949869c2984d914d9f04005e4fcd4dd3050bc1700612dbc3080c91745fa158cf0d70309f7f1969136edfd73294c0356675ffff000044f2a432a15b4ce56aa166b5040d"], 0x83}}, 0x0) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r0, 0x6, 0x2000000000000020, &(0x7f000023f000)=0xa, 0x263) setsockopt$inet6_tcp_int(r0, 0x6, 0x13, &(0x7f0000000000)=0x1, 0x4) connect$inet6(r0, &(0x7f0000000100)={0xa, 0x0, 0x0, @local, 0x3}, 0xfffffffffffffe62) 01:56:32 executing program 3: r0 = socket$inet(0x2, 0x3, 0x2) connect$inet(0xffffffffffffffff, &(0x7f0000000000)={0x2, 0x0, @local}, 0x10) setsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x23, &(0x7f0000000000)={{{@in=@multicast2, @in=@multicast1}}, {{@in6}, 0x0, @in6=@loopback}}, 0xe8) syz_emit_ethernet(0x2a, &(0x7f0000000640)={@random="b100485caa2a", @link_local, [], {@ipv4={0x800, {{0x5, 0x4, 0x800000000000000, 0x0, 0x1c, 0x0, 0x0, 0x0, 0x2, 0x0, @rand_addr, @broadcast}, @igmp={0x11, 0xffffffffffffffff, 0x0, @multicast1}}}}}, &(0x7f0000000140)) 01:56:32 executing program 2: r0 = socket$inet(0x2, 0x3, 0x2) connect$inet(0xffffffffffffffff, &(0x7f0000000000)={0x2, 0x0, @local}, 0x10) setsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x23, &(0x7f0000000000)={{{@in=@multicast2, @in=@multicast1}}, {{@in6}, 0x0, @in6=@loopback}}, 0xe8) syz_emit_ethernet(0x2a, &(0x7f0000000640)={@random="b100485caa2a", @link_local, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x1c, 0x0, 0x0, 0x0, 0x2, 0x0, @rand_addr, @broadcast}, @igmp={0x11, 0x0, 0x0, @multicast1}}}}}, &(0x7f0000000140)={0x0, 0x0, [0x0, 0x0, 0x2000000000000000]}) 01:56:32 executing program 4: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) r1 = syz_open_dev$adsp(&(0x7f0000000000)='/dev/adsp#\x00', 0x485c60fd, 0x200) timerfd_gettime(r1, &(0x7f0000000080)) ioctl$sock_SIOCETHTOOL(r0, 0x8946, &(0x7f0000000040)={'bond0\x00', &(0x7f0000000240)=ANY=[@ANYBLOB="4c000000000023000000000000000002"]}) 01:56:32 executing program 1: socketpair(0x1e, 0x1, 0x0, &(0x7f0000000140)={0x0, 0x0}) write$UHID_CREATE(r1, &(0x7f0000000200)={0x0, 'syz1\x00', 'syz0\x00', 'syz1\x00', &(0x7f0000000040)=""/13, 0xd}, 0x120) getsockopt$inet_sctp6_SCTP_RECVRCVINFO(r0, 0x84, 0x20, &(0x7f0000000080), &(0x7f00000000c0)=0x4) perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1f}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$sock_SIOCETHTOOL(r0, 0x8946, &(0x7f0000000340)={'bond_slave_1\x00', &(0x7f0000000100)=@ethtool_wolinfo={0x7, 0x7, 0x20, "35ac5598cb5e"}}) close(r0) 01:56:32 executing program 5: perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1f}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000340)={&(0x7f0000000000), 0xc, &(0x7f0000000300)={&(0x7f0000000240)=@newlink={0x50, 0x10, 0x721, 0x0, 0x0, {0x0, 0x0, 0x5000000}, [@IFLA_LINKINFO={0x28, 0x12, @veth={{0xc, 0x1, 'veth\x00'}, {0x18, 0x2, @VETH_INFO_PEER={0x14}}}}, @IFLA_NET_NS_FD={0x8}]}, 0x50}}, 0x0) [ 678.744147] binder: 13883:13884 Acquire 1 refcount change on invalid ref 0 ret -22 01:56:32 executing program 0: socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000001f80)={0xffffffffffffffff, 0xffffffffffffffff}) setsockopt$SO_ATTACH_FILTER(r2, 0x1, 0x1a, &(0x7f0000ab9ff0)={0x2, &(0x7f000039a000)=[{0x20, 0x0, 0x0, 0xfffffffffffff010}, {0x6}]}, 0x10) sendmmsg(r1, &(0x7f0000001e80)=[{{&(0x7f0000000700)=@l2={0x1f, 0x0, {}, 0x0, 0x0}, 0x80, &(0x7f0000001dc0)}}], 0x1, 0x0) 01:56:32 executing program 3: r0 = socket$inet(0x2, 0x3, 0x2) connect$inet(0xffffffffffffffff, &(0x7f0000000000)={0x2, 0x0, @local}, 0x10) setsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x23, &(0x7f0000000000)={{{@in=@multicast2, @in=@multicast1}}, {{@in6}, 0x0, @in6=@loopback}}, 0xe8) syz_emit_ethernet(0x2a, &(0x7f0000000640)={@random="b100485caa2a", @link_local, [], {@ipv4={0x800, {{0x5, 0x4, 0xffffffff00000000, 0x0, 0x1c, 0x0, 0x0, 0x0, 0x2, 0x0, @rand_addr, @broadcast}, @igmp={0x11, 0xffffffffffffffff, 0x0, @multicast1}}}}}, &(0x7f0000000140)) [ 678.865278] binder: 13883:13884 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 01:56:32 executing program 5: perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1f}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000340)={&(0x7f0000000000), 0xc, &(0x7f0000000300)={&(0x7f0000000240)=@newlink={0x50, 0x10, 0x721, 0x0, 0x0, {0x0, 0x0, 0x10000000}, [@IFLA_LINKINFO={0x28, 0x12, @veth={{0xc, 0x1, 'veth\x00'}, {0x18, 0x2, @VETH_INFO_PEER={0x14}}}}, @IFLA_NET_NS_FD={0x8}]}, 0x50}}, 0x0) 01:56:32 executing program 2: r0 = socket$inet(0x2, 0x3, 0x2) connect$inet(0xffffffffffffffff, &(0x7f0000000000)={0x2, 0x0, @local}, 0x10) setsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x23, &(0x7f0000000000)={{{@in=@multicast2, @in=@multicast1}}, {{@in6}, 0x0, @in6=@loopback}}, 0xe8) syz_emit_ethernet(0x2a, &(0x7f0000000640)={@random="b100485caa2a", @link_local, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x1c, 0x0, 0x0, 0x0, 0x2, 0x0, @rand_addr, @broadcast}, @igmp={0x11, 0x0, 0x0, @multicast1}}}}}, &(0x7f0000000140)={0x0, 0x0, [0x0, 0x0, 0x3e00000000000000]}) [ 678.954614] binder: 13883:13919 Acquire 1 refcount change on invalid ref 0 ret -22 [ 679.038456] binder: 13883:13919 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 01:56:33 executing program 6: r0 = syz_open_dev$sndseq(&(0x7f0000000100)='/dev/snd/seq\x00', 0x0, 0x0) read(r0, &(0x7f0000fb6000)=""/28, 0x3f0) ioctl$SNDRV_SEQ_IOCTL_REMOVE_EVENTS(r0, 0x4040534e, &(0x7f00000001c0)={0xbf}) ioctl$SNDRV_SEQ_IOCTL_QUERY_SUBS(r0, 0xc058534f, &(0x7f00000002c0)={{}, 0x1, 0x0, 0x0, {}, 0x0, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xe000000]}) r1 = gettid() timer_create(0x0, &(0x7f0000044000)={0x0, 0x12}, &(0x7f0000000040)) r2 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r2, 0x8912, &(0x7f00000001c0)="0a5cc80700315f85715070") timer_settime(0x0, 0x0, &(0x7f0000000080)={{0x0, 0x989680}, {0x0, 0x9}}, &(0x7f0000040000)) tkill(r1, 0x1000000000014) 01:56:33 executing program 4: ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000040)={'bond0\x00', &(0x7f0000000240)=ANY=[@ANYBLOB="4c0000000000230000000000000000ff"]}) pipe(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) getegid() ioctl$sock_inet_SIOCGIFBRDADDR(r0, 0x8919, &(0x7f0000000080)={'veth0_to_team\x00', {0x2, 0x4e24, @local}}) io_setup(0xb9a, &(0x7f00000000c0)=0x0) io_cancel(r2, &(0x7f0000000140)={0x0, 0x0, 0x0, 0x7, 0x400, r0, &(0x7f0000000100)="689ae11c756ec53fc60159e83cd39ba7210214809fc012b72f6688d8d8376b292274e5cf474826f9cc5afbcb4447a97b74266f133dc2a6d0fd80", 0x3a, 0x81, 0x0, 0x0, r1}, &(0x7f0000000180)) 01:56:33 executing program 1: r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000100)={0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x105f}, 0xfffffffffffffdc0) recvmmsg(0xffffffffffffff9c, &(0x7f00000065c0)=[{{&(0x7f0000000040)=@ipx, 0x80, &(0x7f00000034c0)=[{&(0x7f0000000140)=""/156, 0x9c}, {&(0x7f0000000200)=""/4096, 0x1000}, {&(0x7f0000001200)=""/4096, 0x1000}, {&(0x7f0000002200)=""/205, 0xcd}, {&(0x7f00000000c0)=""/28, 0x1c}, {&(0x7f0000002300)=""/15, 0xf}, {&(0x7f0000002340)=""/4096, 0x1000}, {&(0x7f0000003340)=""/38, 0x26}, {&(0x7f0000003380)=""/217, 0xd9}, {&(0x7f0000003480)}], 0xa, &(0x7f0000003580)=""/24, 0x18, 0x5}, 0x7ff}, {{&(0x7f00000035c0)=@nfc, 0x80, &(0x7f0000003740)=[{&(0x7f0000003640)=""/27, 0x1b}, {&(0x7f0000003680)=""/30, 0x1e}, {&(0x7f00000036c0)=""/118, 0x76}], 0x3, &(0x7f0000003780)=""/50, 0x32}, 0x6b4c}, {{&(0x7f00000037c0)=@ll={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @remote}, 0x80, &(0x7f0000003b00)=[{&(0x7f0000003840)=""/219, 0xdb}, {&(0x7f0000003940)=""/223, 0xdf}, {&(0x7f0000003a40)=""/56, 0x38}, {&(0x7f0000003a80)=""/56, 0x38}, {&(0x7f0000003ac0)=""/40, 0x28}], 0x5, 0x0, 0x0, 0x101}, 0x6}, {{0x0, 0x0, &(0x7f0000003c40)=[{&(0x7f0000003b80)=""/179, 0xb3}], 0x1, &(0x7f0000003c80)=""/90, 0x5a, 0x100000001}, 0x401}, {{&(0x7f0000003d00)=@ethernet={0x0, @broadcast}, 0x80, &(0x7f0000003f00)=[{&(0x7f0000003d80)=""/223, 0xdf}, {&(0x7f0000003e80)=""/106, 0x6a}], 0x2, &(0x7f0000003f40)=""/100, 0x64, 0xcc3d}, 0x3}, {{&(0x7f0000004000)=@vsock={0x28, 0x0, 0x0, @host}, 0x80, &(0x7f0000005380)=[{&(0x7f0000004080)=""/49, 0x31}, {&(0x7f00000040c0)=""/181, 0xb5}, {&(0x7f0000004180)=""/74, 0x4a}, {&(0x7f0000004200)=""/166, 0xa6}, {&(0x7f00000042c0)=""/91, 0x5b}, {&(0x7f0000004340)=""/53, 0x35}, {&(0x7f0000004380)=""/4096, 0x1000}], 0x7, 0x0, 0x0, 0xffffffff}, 0x9}, {{&(0x7f0000005400)=@ipx, 0x80, &(0x7f0000006500)=[{&(0x7f0000005480)=""/4096, 0x1000}, {&(0x7f0000006480)=""/66, 0x42}], 0x2, &(0x7f0000006540)=""/122, 0x7a, 0xfff}, 0x8}], 0x7, 0x40, 0x0) bpf$PROG_LOAD(0x5, &(0x7f000000e000)={0x1, 0x5, &(0x7f0000000000)=@framed={{0xffffffb4, 0x0, 0x0, 0x0, 0x0, 0xffffffbd, 0x0, 0x2}, [@ldst={0x7, 0x18d1fb}]}, &(0x7f0000003ff6)='syzkaller\x00', 0x4000000000001, 0xc3, &(0x7f000000cf3d)=""/195, 0x0, 0x0, [], r1}, 0x48) bpf$BPF_GET_MAP_INFO(0xf, &(0x7f0000006780)={r0, 0x28, &(0x7f0000003480)}, 0x10) 01:56:33 executing program 3: r0 = socket$inet(0x2, 0x3, 0x2) connect$inet(0xffffffffffffffff, &(0x7f0000000000)={0x2, 0x0, @local}, 0x10) setsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x23, &(0x7f0000000000)={{{@in=@multicast2, @in=@multicast1}}, {{@in6}, 0x0, @in6=@loopback}}, 0xe8) syz_emit_ethernet(0x2a, &(0x7f0000000640)={@random="b100485caa2a", @link_local, [], {@ipv4={0x800, {{0x5, 0x4, 0xe000000000000000, 0x0, 0x1c, 0x0, 0x0, 0x0, 0x2, 0x0, @rand_addr, @broadcast}, @igmp={0x11, 0xffffffffffffffff, 0x0, @multicast1}}}}}, &(0x7f0000000140)) 01:56:33 executing program 0: socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000001f80)={0xffffffffffffffff, 0xffffffffffffffff}) setsockopt$SO_ATTACH_FILTER(r2, 0x1, 0x1a, &(0x7f0000ab9ff0)={0x2, &(0x7f000039a000)=[{0x20, 0x0, 0x0, 0xfffffffffffff010}, {0x6}]}, 0x10) sendmmsg(r1, &(0x7f0000001e80)=[{{&(0x7f0000000700)=@l2={0x1f, 0x0, {}, 0x0, 0x0}, 0x80, &(0x7f0000001dc0)}}], 0x1, 0x0) 01:56:33 executing program 5: perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1f}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000340)={&(0x7f0000000000), 0xc, &(0x7f0000000300)={&(0x7f0000000240)=@newlink={0x50, 0x10, 0x721, 0x0, 0x0, {0x0, 0x0, 0xa00}, [@IFLA_LINKINFO={0x28, 0x12, @veth={{0xc, 0x1, 'veth\x00'}, {0x18, 0x2, @VETH_INFO_PEER={0x14}}}}, @IFLA_NET_NS_FD={0x8}]}, 0x50}}, 0x0) 01:56:33 executing program 2: r0 = socket$inet(0x2, 0x3, 0x2) connect$inet(0xffffffffffffffff, &(0x7f0000000000)={0x2, 0x0, @local}, 0x10) setsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x23, &(0x7f0000000000)={{{@in=@multicast2, @in=@multicast1}}, {{@in6}, 0x0, @in6=@loopback}}, 0xe8) syz_emit_ethernet(0x2a, &(0x7f0000000640)={@random="b100485caa2a", @link_local, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x1c, 0x0, 0x0, 0x0, 0x2, 0x0, @rand_addr, @broadcast}, @igmp={0x11, 0x0, 0x0, @multicast1}}}}}, &(0x7f0000000140)={0x0, 0x0, [0x0, 0x0, 0x3e000000]}) 01:56:33 executing program 7: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000180)='/dev/sequencer\x00', 0x10002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000080)="0a5cc80700315f85715070") r1 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000001c0)={0x2, 0x0, &(0x7f0000000140)=ANY=[@ANYBLOB='\fc'], 0x0, 0x0, &(0x7f0000000080)}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, &(0x7f00000001c0)}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000040)={0x8, 0x600, &(0x7f00000000c0)=[@release={0x400c630f}], 0x1, 0x0, &(0x7f0000000100)='V'}) fstat(r0, &(0x7f00000002c0)) 01:56:33 executing program 5: perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1f}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000340)={&(0x7f0000000000), 0xc, &(0x7f0000000300)={&(0x7f0000000240)=@newlink={0x50, 0x10, 0x721, 0x0, 0x0, {0x0, 0x0, 0x7}, [@IFLA_LINKINFO={0x28, 0x12, @veth={{0xc, 0x1, 'veth\x00'}, {0x18, 0x2, @VETH_INFO_PEER={0x14}}}}, @IFLA_NET_NS_FD={0x8}]}, 0x50}}, 0x0) 01:56:33 executing program 1: syz_emit_ethernet(0xfdef, &(0x7f00000000c0)={@local, @broadcast, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x30, 0x0, 0x0, 0x0, 0x11, 0x0, @remote, @dev}, @icmp=@parameter_prob={0x8, 0x8, 0x0, 0x0, 0x14, 0x0, {0x5, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @local={0xac, 0x70}, @dev}}}}}}, &(0x7f0000000080)) r0 = openat$zero(0xffffffffffffff9c, &(0x7f0000000000)='/dev/zero\x00', 0x400000, 0x0) setsockopt$inet6_tcp_TCP_MD5SIG(r0, 0x6, 0xe, &(0x7f0000000100)={@in={{0x2, 0x4e21, @dev={0xac, 0x14, 0x14, 0x18}}}, 0x0, 0x81, 0x20, "f9409837c6eac486ff1096810f4317ebd96723e575f4b70ae4fecfda049c462b7d1e73bc8c727e5251e54f71bff39d84968c4cb7900703933bfe2ae5b4cc7a5a9a4d325dea251c70de5d6aebaf6ac087"}, 0xd8) ioctl$PPPOEIOCSFWD(r0, 0x4008b100, &(0x7f0000000040)={0x18, 0x0, {0x0, @remote, 'teql0\x00'}}) 01:56:33 executing program 4: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) ioctl$sock_SIOCETHTOOL(r0, 0x8946, &(0x7f0000000040)={'bond0\x00', &(0x7f0000000240)=ANY=[@ANYBLOB="4c000000000023000000000000000002"]}) r1 = openat$snapshot(0xffffffffffffff9c, &(0x7f0000000000)='/dev/snapshot\x00', 0x40, 0x0) accept4(r0, &(0x7f0000000080)=@xdp={0x2c, 0x0, 0x0}, &(0x7f0000000100)=0x80, 0x800) ioctl$sock_inet6_SIOCADDRT(r1, 0x890b, &(0x7f0000000140)={@mcast2, @local, @ipv4={[], [], @remote}, 0x1, 0x3, 0x1, 0x100, 0xe362, 0x1, r2}) 01:56:33 executing program 3: r0 = socket$inet(0x2, 0x3, 0x2) connect$inet(0xffffffffffffffff, &(0x7f0000000000)={0x2, 0x0, @local}, 0x10) setsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x23, &(0x7f0000000000)={{{@in=@multicast2, @in=@multicast1}}, {{@in6}, 0x0, @in6=@loopback}}, 0xe8) syz_emit_ethernet(0x2a, &(0x7f0000000640)={@random="b100485caa2a", @link_local, [], {@ipv4={0x800, {{0x5, 0x4, 0xfffff000, 0x0, 0x1c, 0x0, 0x0, 0x0, 0x2, 0x0, @rand_addr, @broadcast}, @igmp={0x11, 0xffffffffffffffff, 0x0, @multicast1}}}}}, &(0x7f0000000140)) [ 679.639524] binder: 13953:13956 Acquire 1 refcount change on invalid ref 0 ret -22 [ 679.649662] binder: 13953:13956 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 01:56:33 executing program 2: r0 = socket$inet(0x2, 0x3, 0x2) connect$inet(0xffffffffffffffff, &(0x7f0000000000)={0x2, 0x0, @local}, 0x10) setsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x23, &(0x7f0000000000)={{{@in=@multicast2, @in=@multicast1}}, {{@in6}, 0x0, @in6=@loopback}}, 0xe8) syz_emit_ethernet(0x2a, &(0x7f0000000640)={@random="b100485caa2a", @link_local, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x1c, 0x0, 0x0, 0x0, 0x2, 0x0, @rand_addr, @broadcast}, @igmp={0x11, 0x0, 0x0, @multicast1}}}}}, &(0x7f0000000140)={0x0, 0x0, [0x0, 0x0, 0x1000000]}) 01:56:33 executing program 0: socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000001f80)={0xffffffffffffffff, 0xffffffffffffffff}) setsockopt$SO_ATTACH_FILTER(r2, 0x1, 0x1a, &(0x7f0000ab9ff0)={0x2, &(0x7f000039a000)=[{0x20, 0x0, 0x0, 0xfffffffffffff010}, {0x6}]}, 0x10) sendmmsg(r1, &(0x7f0000001e80)=[{{&(0x7f0000000700)=@l2={0x1f, 0x0, {}, 0x0, 0x0}, 0x80, &(0x7f0000001dc0)}}], 0x1, 0x0) 01:56:33 executing program 5: perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1f}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000340)={&(0x7f0000000000), 0xc, &(0x7f0000000300)={&(0x7f0000000240)=@newlink={0x50, 0x10, 0x721, 0x0, 0x0, {0x0, 0x0, 0xf0ffffff00000000}, [@IFLA_LINKINFO={0x28, 0x12, @veth={{0xc, 0x1, 'veth\x00'}, {0x18, 0x2, @VETH_INFO_PEER={0x14}}}}, @IFLA_NET_NS_FD={0x8}]}, 0x50}}, 0x0) 01:56:33 executing program 1: r0 = socket$inet6(0xa, 0x5, 0x0) ioctl(r0, 0x8912, &(0x7f0000000080)="0a5cc80700315f85715070") mq_open(&(0x7f0000000000)='\x00', 0x800, 0x0, &(0x7f0000000040)={0x3d, 0x2, 0xf47, 0x20, 0x4, 0x4, 0x1f, 0x2}) socketpair$unix(0x1, 0x5, 0x0, &(0x7f000001a000)={0xffffffffffffffff, 0xffffffffffffffff}) setsockopt$SO_ATTACH_FILTER(r2, 0x1, 0x1a, &(0x7f0000ab9ff0)={0x2, &(0x7f000039a000)=[{0x20, 0x0, 0x0, 0xfffff038}, {0x6}]}, 0x10) openat(0xffffffffffffff9c, &(0x7f00000000c0)='./file0\x00', 0x90000, 0x1) sendmmsg(r1, &(0x7f0000000000), 0x4000000000000fe, 0x0) [ 679.806094] binder: 13953:13980 Acquire 1 refcount change on invalid ref 0 ret -22 [ 679.927749] binder: 13956 RLIMIT_NICE not set [ 679.974315] binder: 13953:13980 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 01:56:34 executing program 4: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) ioctl$sock_SIOCETHTOOL(r0, 0x8946, &(0x7f0000000040)={'bond0\x00', &(0x7f0000000240)=ANY=[@ANYBLOB="4c000087000023000000000000000002"]}) r1 = accept(r0, &(0x7f0000000080)=@llc={0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, @local}, &(0x7f0000000000)=0x80) getsockopt$inet_sctp_SCTP_PEER_AUTH_CHUNKS(0xffffffffffffffff, 0x84, 0x1a, &(0x7f0000000100)={0x0, 0xb4, "b8f2ad3d9590a6f66005316bd5db3137701391b4be116fb328b355740a104ffd018979e28520dac40418ec10c3c83db45ecf13758cf87be0df2106da2cfffa772bc72f515035d66ccfb4def7f7a4049428bd85af9b30cb35929a98079951342aa68f842b1c5847557076dabc83a334b1285b9890da1888a554e4fe0549c5aa3943de5107a1a22a2bbc82d5f05fba1ebe7620f692e17af04f7fcb9c97e45d12723d6f56174f9b56effabbcbd5a6bf0d6ee1a487e1"}, &(0x7f00000001c0)=0xbc) setsockopt$inet_sctp6_SCTP_RESET_STREAMS(r1, 0x84, 0x77, &(0x7f0000000280)=ANY=[@ANYRES32=r2, @ANYBLOB="060002000000000000000800a5a706002f"], 0x14) getsockopt$inet6_IPV6_XFRM_POLICY(r1, 0x29, 0x23, &(0x7f00000002c0)={{{@in, @in6=@ipv4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@remote}, 0x0, @in=@remote}}, &(0x7f00000003c0)=0xe8) quotactl(0x30, &(0x7f0000000200)='./file0\x00', r3, &(0x7f00000004c0)="b5b6f23c1efa27db58c5196d350622172bdc7ee7e60c8a67fb85a823f6cd4687e1f281c6180a06006818b0d5b560cccb4f5202afb31204cf91b06944b609a628e1a1fda9bb84b3c5cad1fd800e5a3fd103cd2317712a57ad10b8a090543b99f17756de51a85813d781469e4329b76c4ff08caa075cf692839fcea8705ab83b30c25239364911c2379d3babcaa314c2c6d40e1121ba") 01:56:34 executing program 2: r0 = socket$inet(0x2, 0x3, 0x2) connect$inet(0xffffffffffffffff, &(0x7f0000000000)={0x2, 0x0, @local}, 0x10) setsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x23, &(0x7f0000000000)={{{@in=@multicast2, @in=@multicast1}}, {{@in6}, 0x0, @in6=@loopback}}, 0xe8) syz_emit_ethernet(0x2a, &(0x7f0000000640)={@random="b100485caa2a", @link_local, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x1c, 0x0, 0x0, 0x0, 0x2, 0x0, @rand_addr, @broadcast}, @igmp={0x11, 0x0, 0x0, @multicast1}}}}}, &(0x7f0000000140)={0x0, 0x0, [0x0, 0x0, 0x1c000000]}) 01:56:34 executing program 6: r0 = syz_open_dev$sndseq(&(0x7f0000000100)='/dev/snd/seq\x00', 0x0, 0x0) read(r0, &(0x7f0000fb6000)=""/28, 0x3f0) ioctl$SNDRV_SEQ_IOCTL_REMOVE_EVENTS(r0, 0x4040534e, &(0x7f00000001c0)={0xbf}) ioctl$SNDRV_SEQ_IOCTL_QUERY_SUBS(r0, 0xc058534f, &(0x7f00000002c0)={{}, 0x1, 0x0, 0x0, {}, 0x0, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xbf00]}) r1 = gettid() timer_create(0x0, &(0x7f0000044000)={0x0, 0x12}, &(0x7f0000000040)) r2 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r2, 0x8912, &(0x7f00000001c0)="0a5cc80700315f85715070") timer_settime(0x0, 0x0, &(0x7f0000000080)={{0x0, 0x989680}, {0x0, 0x9}}, &(0x7f0000040000)) tkill(r1, 0x1000000000014) 01:56:34 executing program 3: r0 = socket$inet(0x2, 0x3, 0x2) connect$inet(0xffffffffffffffff, &(0x7f0000000000)={0x2, 0x0, @local}, 0x10) setsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x23, &(0x7f0000000000)={{{@in=@multicast2, @in=@multicast1}}, {{@in6}, 0x0, @in6=@loopback}}, 0xe8) syz_emit_ethernet(0x2a, &(0x7f0000000640)={@random="b100485caa2a", @link_local, [], {@ipv4={0x800, {{0x5, 0x4, 0x3000000, 0x0, 0x1c, 0x0, 0x0, 0x0, 0x2, 0x0, @rand_addr, @broadcast}, @igmp={0x11, 0xffffffffffffffff, 0x0, @multicast1}}}}}, &(0x7f0000000140)) 01:56:34 executing program 1: perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x23}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$inet(0x2b, 0x80006, 0x40000000000000) bind$inet(r0, &(0x7f0000000600)={0x2, 0x44e23, @multicast2}, 0x10) getsockopt$inet_sctp6_SCTP_ASSOCINFO(0xffffffffffffffff, 0x84, 0x1, &(0x7f00000000c0)={0x0, 0x9, 0x100000001, 0x4, 0x8000, 0x9}, &(0x7f0000000100)=0x14) getsockopt$inet_sctp_SCTP_PEER_AUTH_CHUNKS(r0, 0x84, 0x1a, &(0x7f0000000200)={r1, 0xf7, "70bef5441cfd4fd82cf6bcede12d41daf5251f7feee38159dc4a87f6872d22bf9e0fe1c48e589902ac8925b94543d7a80e765cf1c0492d78643ac7357318286cbf43dcf41f619b41cbbc6a3e1818add791e1e252ed02a60beb08110d7084693321e5cf31e6ce01c9917bf5ab1386adbf197fec2089da07780eabbdf0facfa226257ad79b490181921fc7194c7412be8a0c988cdd36e078505e07425095a6d3e3b0e854e7bea79c2067ecfe17001865d1963edcf5f959f8a3481dc9e12fc7c706f7be784861ff276b34f2dd5e7d15a47ab31c8dd7da6ac929edc3fb8bbfbe4863ef47ead9a41d4d54120ef1322e82b1b209bcfb5355e0b6"}, &(0x7f0000000140)=0xff) connect$inet(r0, &(0x7f0000000080)={0x2, 0x4e23}, 0x10) shutdown(r0, 0x2) openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000040)='./cgroup/syz0\x00', 0x200002, 0x0) 01:56:34 executing program 5: perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1f}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000340)={&(0x7f0000000000), 0xc, &(0x7f0000000300)={&(0x7f0000000240)=@newlink={0x50, 0x10, 0x721, 0x0, 0x0, {0x0, 0x0, 0xf0ffffffffffff}, [@IFLA_LINKINFO={0x28, 0x12, @veth={{0xc, 0x1, 'veth\x00'}, {0x18, 0x2, @VETH_INFO_PEER={0x14}}}}, @IFLA_NET_NS_FD={0x8}]}, 0x50}}, 0x0) 01:56:34 executing program 0: socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000001f80)={0xffffffffffffffff, 0xffffffffffffffff}) setsockopt$SO_ATTACH_FILTER(r2, 0x1, 0x1a, &(0x7f0000ab9ff0)={0x2, &(0x7f000039a000)=[{0x20, 0x0, 0x0, 0xfffffffffffff010}, {0x6}]}, 0x10) sendmmsg(r1, &(0x7f0000001e80)=[{{&(0x7f0000000700)=@l2={0x1f, 0x0, {}, 0x0, 0x0}, 0x80, &(0x7f0000001dc0)}}], 0x1, 0x0) 01:56:34 executing program 7: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000180)='/dev/sequencer\x00', 0x10002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000080)="0a5cc80700315f85715070") r1 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000001c0)={0x2, 0x0, &(0x7f0000000140)=ANY=[@ANYBLOB='\fc'], 0x0, 0x0, &(0x7f0000000080)}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, &(0x7f00000001c0)}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000040)={0x8, 0xfffffdfd, &(0x7f00000000c0)=[@release={0x400c630f}], 0x1, 0x0, &(0x7f0000000100)='V'}) fstat(r0, &(0x7f00000002c0)) 01:56:34 executing program 4: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) ioctl$sock_SIOCETHTOOL(r0, 0x8946, &(0x7f0000000040)={'bond0\x00', &(0x7f0000000080)=ANY=[@ANYBLOB="4c00044000e7ffbeaf8c9f9e5df1823b45e5f52200e402000000000000bbaebc5707006a58ab0cf41cce2d078fad873a223029c3e805a45e4d5037cc15a35a38b857aa05ec32550d7bc5d07ca0493365e30ef4fc0fcc5a6a0c2afa725a775232e0b91fa5db63eccb9f5a863ca7de27ab0cce8d0b6ac298d51f368e50b2e5b9f636a7d8b145cb5363b88c34872585c2b1df513d226a59dcfe2b6d5c2cc4910a6681de153c626518a3833dd5b48979fba86bd1e3026014a26e0cdbe0771594324fcf383c80b1756f3edd564c4cbc31f32fbb6b673b903c6287d26612838dccd60643c1824a23e7ed65aa88e2e5997950f1b2505a41f861c838657cefa7f21c1cee31c0af942c"]}) 01:56:34 executing program 2: r0 = socket$inet(0x2, 0x3, 0x2) connect$inet(0xffffffffffffffff, &(0x7f0000000000)={0x2, 0x0, @local}, 0x10) setsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x23, &(0x7f0000000000)={{{@in=@multicast2, @in=@multicast1}}, {{@in6}, 0x0, @in6=@loopback}}, 0xe8) syz_emit_ethernet(0x2a, &(0x7f0000000640)={@random="b100485caa2a", @link_local, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x1c, 0x0, 0x0, 0x0, 0x2, 0x0, @rand_addr, @broadcast}, @igmp={0x11, 0x0, 0x0, @multicast1}}}}}, &(0x7f0000000140)={0x0, 0x0, [0x0, 0x0, 0x34000]}) 01:56:34 executing program 3: r0 = socket$inet(0x2, 0x3, 0x2) connect$inet(0xffffffffffffffff, &(0x7f0000000000)={0x2, 0x0, @local}, 0x10) setsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x23, &(0x7f0000000000)={{{@in=@multicast2, @in=@multicast1}}, {{@in6}, 0x0, @in6=@loopback}}, 0xe8) syz_emit_ethernet(0x2a, &(0x7f0000000640)={@random="b100485caa2a", @link_local, [], {@ipv4={0x800, {{0x5, 0x4, 0x2000, 0x0, 0x1c, 0x0, 0x0, 0x0, 0x2, 0x0, @rand_addr, @broadcast}, @igmp={0x11, 0xffffffffffffffff, 0x0, @multicast1}}}}}, &(0x7f0000000140)) [ 680.568396] binder: 14020:14022 Acquire 1 refcount change on invalid ref 0 ret -22 01:56:34 executing program 5: perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1f}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000340)={&(0x7f0000000000), 0xc, &(0x7f0000000300)={&(0x7f0000000240)=@newlink={0x50, 0x10, 0x721, 0x0, 0x0, {0x0, 0x0, 0x40030000000000}, [@IFLA_LINKINFO={0x28, 0x12, @veth={{0xc, 0x1, 'veth\x00'}, {0x18, 0x2, @VETH_INFO_PEER={0x14}}}}, @IFLA_NET_NS_FD={0x8}]}, 0x50}}, 0x0) 01:56:34 executing program 1: socket$inet(0x2, 0x805, 0x0) connect$inet6(0xffffffffffffffff, &(0x7f000004bfe4)={0xa, 0x0, 0x0, @dev}, 0x1c) perf_event_open(&(0x7f0000000000)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x309, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) [ 680.611977] binder: 14020:14022 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 01:56:34 executing program 0: socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000001f80)={0xffffffffffffffff, 0xffffffffffffffff}) setsockopt$SO_ATTACH_FILTER(r2, 0x1, 0x1a, &(0x7f0000ab9ff0)={0x2, &(0x7f000039a000)=[{0x20, 0x0, 0x0, 0xfffffffffffff010}, {0x6}]}, 0x10) sendmmsg(r1, &(0x7f0000001e80)=[{{&(0x7f0000000700)=@l2={0x1f, 0x0, {}, 0x0, 0x0}, 0x80, &(0x7f0000001dc0)}}], 0x1, 0x0) [ 680.673091] binder: 14022 RLIMIT_NICE not set 01:56:34 executing program 4: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) ioctl$sock_SIOCETHTOOL(r0, 0x8946, &(0x7f0000000040)={'bond0\x00', &(0x7f0000000240)=ANY=[@ANYBLOB="4c000000000023000000000000000002"]}) r1 = fcntl$getown(r0, 0x9) ptrace$getsig(0x4202, r1, 0x4800000000000000, &(0x7f0000000000)) 01:56:34 executing program 1: syz_emit_ethernet(0x56, &(0x7f0000000000)={@dev={[], 0x10}, @random="cf2bb43c40b8", [], {@canfd={0xd, {{0x2, 0x163f7677, 0x7, 0xb82}, 0x38, 0x0, 0x0, 0x0, "ccf90dfba31d07bba54d7d03b2792fd21cc30ea20aee1fcaf86cd01a266769adb9c64f918b8b2d23c9c4aaf2e60f05ffcebf82f2aa8ccaff6ce851a2984b58d5"}}}}, 0x0) 01:56:34 executing program 5: perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1f}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000340)={&(0x7f0000000000), 0xc, &(0x7f0000000300)={&(0x7f0000000240)=@newlink={0x50, 0x10, 0x721, 0x0, 0x0, {0x0, 0x0, 0xf000000}, [@IFLA_LINKINFO={0x28, 0x12, @veth={{0xc, 0x1, 'veth\x00'}, {0x18, 0x2, @VETH_INFO_PEER={0x14}}}}, @IFLA_NET_NS_FD={0x8}]}, 0x50}}, 0x0) 01:56:34 executing program 3: r0 = socket$inet(0x2, 0x3, 0x2) connect$inet(0xffffffffffffffff, &(0x7f0000000000)={0x2, 0x0, @local}, 0x10) setsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x23, &(0x7f0000000000)={{{@in=@multicast2, @in=@multicast1}}, {{@in6}, 0x0, @in6=@loopback}}, 0xe8) syz_emit_ethernet(0x2a, &(0x7f0000000640)={@random="b100485caa2a", @link_local, [], {@ipv4={0x800, {{0x5, 0x4, 0x1c, 0x0, 0x1c, 0x0, 0x0, 0x0, 0x2, 0x0, @rand_addr, @broadcast}, @igmp={0x11, 0xffffffffffffffff, 0x0, @multicast1}}}}}, &(0x7f0000000140)) [ 681.343143] binder: 14020:14073 Acquire 1 refcount change on invalid ref 0 ret -22 [ 681.351096] binder: 14020:14073 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 681.358733] binder: 14048 RLIMIT_NICE not set 01:56:35 executing program 6: r0 = syz_open_dev$sndseq(&(0x7f0000000100)='/dev/snd/seq\x00', 0x0, 0x0) read(r0, &(0x7f0000fb6000)=""/28, 0x3f0) ioctl$SNDRV_SEQ_IOCTL_REMOVE_EVENTS(r0, 0x4040534e, &(0x7f00000001c0)={0xbf}) ioctl$SNDRV_SEQ_IOCTL_QUERY_SUBS(r0, 0xc058534f, &(0x7f00000002c0)={{}, 0x1, 0x0, 0x0, {}, 0x0, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffff00000000]}) r1 = gettid() timer_create(0x0, &(0x7f0000044000)={0x0, 0x12}, &(0x7f0000000040)) r2 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r2, 0x8912, &(0x7f00000001c0)="0a5cc80700315f85715070") timer_settime(0x0, 0x0, &(0x7f0000000080)={{0x0, 0x989680}, {0x0, 0x9}}, &(0x7f0000040000)) tkill(r1, 0x1000000000014) 01:56:35 executing program 2: r0 = socket$inet(0x2, 0x3, 0x2) connect$inet(0xffffffffffffffff, &(0x7f0000000000)={0x2, 0x0, @local}, 0x10) setsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x23, &(0x7f0000000000)={{{@in=@multicast2, @in=@multicast1}}, {{@in6}, 0x0, @in6=@loopback}}, 0xe8) syz_emit_ethernet(0x2a, &(0x7f0000000640)={@random="b100485caa2a", @link_local, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x1c, 0x0, 0x0, 0x0, 0x2, 0x0, @rand_addr, @broadcast}, @igmp={0x11, 0x0, 0x0, @multicast1}}}}}, &(0x7f0000000140)={0x0, 0x0, [0x0, 0x0, 0xe000000000000000]}) 01:56:35 executing program 4: r0 = bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000080)={&(0x7f0000000000)='bond0\x00'}, 0x10) sendmsg(r0, &(0x7f00000005c0)={&(0x7f00000000c0)=@ax25={0x3, {"4a1b13b70679be"}, 0x800}, 0x80, &(0x7f0000000540)=[{&(0x7f0000000140)="ffe6b033d6bf465d2d2f62ad0483874bf02f8090ed4630c49a74db0a305ef10f278235dcc1b3da01774ec85b5488778e3d7f10a3ddded45df630e19f7241118c4f90aba8b97f26d81e14ec20f409316dc5457567bfc74daa658f6514cbb5880c6764f3beb1b112f9c4a45ebd5ef3c07bab49131541aa0e09404dd58de16834045d055dc1476a545cde926e8d0adfe63d93ca2b1000beb01073d6ceef4a5b3d0c82b441eaaaa9ed", 0xa7}, {&(0x7f0000000200)="943197114928b38ce39ee7c003f3ec75683a394174e715e6dbe2cb3b", 0x1c}, {&(0x7f0000000280)="2eda54240052c09ee7ee04fed8262cb8a7f40da98e6a7353589f578a9512b95e544fa34ae835e7c807de904d33ae11a7f51aedb03b7b0aa35922611bd26792185de3046d9a895858d99b70f86ce292161be897880eb9f89f5679f7bf2d18275c61ee5e5ce1ae8eac4147f497d837f96b31ac7d3afab162043d5eb91f", 0x7c}, {&(0x7f0000000300)="42c1e251f23faefadc4d3c87c1eb22fbec5fdff8c4f0500c452f3890bca51fed19ddb97604e9ec517394b0b8733380c91c74aacfe4daec0e11d87a72e2f1ebc78675626cf8d90a1406bc3f07e2c80ea199a877c7386e6db9773c130125d59291ded4ed72d9ee71728731f196fcafea567b8cf0e130369fa4c72aa0c92116edb6f940739debd8791698c134d117ce1186a785b8bf16b6acd3b8d32274bbda051be8ae02cbdbfb0f38f35639f118a77c476213a04cb16b834eb2d670f9faad3b656ec13b22420d6b716cc7245e655c78a3895c265258458c", 0xd7}, {&(0x7f0000000400)="3809736387c935fe2f1277541e6e617724f0b507f36229c61cd9159b43118498407f5b68a1710bf77f1aa2a25709e7a3d84f58727126d295c7d4cdb137b31104844c2238f5c1e242498c0f5a71f4d393911f68104d93661edd782e510e194a4282bc32ed4ff434a31eebf9973f2f75859f15f98286ceca9be36b924e984c4b26920cd0b38b818dc772c68cb3586276ebe50158778c9459df89397cd8eeba26fa94985689ba609c687451943fee95926542d6e9dc365798c50280c17378b9", 0xbe}, {&(0x7f00000004c0)="9d1e392ed8167cdb03644a2ea4c18bbaf567eda0cbdac3ccf822d999cb456b75ffd8ed3302522534e430347e497dcd7765625398e26d3f595a37a45d7b4fdf5881ad004030989720b8367b", 0x4b}], 0x6, 0x0, 0x0, 0x4000000}, 0x1) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) ioctl$sock_SIOCETHTOOL(r1, 0x8946, &(0x7f0000000040)={'bond0\x00', &(0x7f0000000240)=ANY=[@ANYBLOB="4c000000000023000000000000000002"]}) 01:56:35 executing program 0: socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000001f80)={0xffffffffffffffff, 0xffffffffffffffff}) setsockopt$SO_ATTACH_FILTER(r2, 0x1, 0x1a, &(0x7f0000ab9ff0)={0x2, &(0x7f000039a000)=[{0x20, 0x0, 0x0, 0xfffffffffffff010}, {0x6}]}, 0x10) sendmmsg(r1, &(0x7f0000001e80)=[{{&(0x7f0000000700)=@l2={0x1f, 0x0, {}, 0x0, 0x0}, 0x80, &(0x7f0000001dc0)}}], 0x1, 0x0) 01:56:35 executing program 3: r0 = socket$inet(0x2, 0x3, 0x2) connect$inet(0xffffffffffffffff, &(0x7f0000000000)={0x2, 0x0, @local}, 0x10) setsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x23, &(0x7f0000000000)={{{@in=@multicast2, @in=@multicast1}}, {{@in6}, 0x0, @in6=@loopback}}, 0xe8) syz_emit_ethernet(0x2a, &(0x7f0000000640)={@random="b100485caa2a", @link_local, [], {@ipv4={0x800, {{0x5, 0x4, 0x700000000000000, 0x0, 0x1c, 0x0, 0x0, 0x0, 0x2, 0x0, @rand_addr, @broadcast}, @igmp={0x11, 0xffffffffffffffff, 0x0, @multicast1}}}}}, &(0x7f0000000140)) 01:56:35 executing program 1: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000080)="0a5cc80700315f85715070") r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000fafff7)='/dev/kvm\x00', 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) syz_kvm_setup_cpu$x86(r2, 0xffffffffffffffff, &(0x7f0000a5e000/0x18000)=nil, &(0x7f0000000000)=[@text32={0x20, &(0x7f0000000080)="0f21e066baf80cb89ce89b85ef66bafc0cb8329c0000efb9800000c00f3235000400000f300f0766baf80cb88014c580ef66bafc0cb8f7ff0000ef66baf80cb8ff57098cef66bafc0cb076eef30f07f2f3670f01390faf6fb6660f388224a3", 0x5f}], 0x1, 0x0, &(0x7f0000000100), 0x0) r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) ioctl$KVM_SET_MSRS(r3, 0x4008ae89, &(0x7f0000000040)=ANY=[@ANYBLOB="0100010000010000034d564b0000000001"]) ioctl$KVM_SET_MSRS(r3, 0x4008ae89, &(0x7f0000000100)={0x1, 0x0, [{0x34}]}) ioctl$KVM_GET_VCPU_MMAP_SIZE(r1, 0xae04) 01:56:35 executing program 5: perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1f}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000340)={&(0x7f0000000000), 0xc, &(0x7f0000000300)={&(0x7f0000000240)=@newlink={0x50, 0x10, 0x721, 0x0, 0x0, {0x0, 0x0, 0xf000}, [@IFLA_LINKINFO={0x28, 0x12, @veth={{0xc, 0x1, 'veth\x00'}, {0x18, 0x2, @VETH_INFO_PEER={0x14}}}}, @IFLA_NET_NS_FD={0x8}]}, 0x50}}, 0x0) 01:56:35 executing program 7: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000180)='/dev/sequencer\x00', 0x10002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000080)="0a5cc80700315f85715070") r1 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000001c0)={0x2, 0x0, &(0x7f0000000140)=ANY=[@ANYBLOB='\fc'], 0x0, 0x0, &(0x7f0000000080)}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, &(0x7f00000001c0)}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000040)={0x8, 0x6c00000000000000, &(0x7f00000000c0)=[@release={0x400c630f}], 0x1, 0x0, &(0x7f0000000100)='V'}) fstat(r0, &(0x7f00000002c0)) 01:56:35 executing program 2: r0 = socket$inet(0x2, 0x3, 0x2) connect$inet(0xffffffffffffffff, &(0x7f0000000000)={0x2, 0x0, @local}, 0x10) setsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x23, &(0x7f0000000000)={{{@in=@multicast2, @in=@multicast1}}, {{@in6}, 0x0, @in6=@loopback}}, 0xe8) syz_emit_ethernet(0x2a, &(0x7f0000000640)={@random="b100485caa2a", @link_local, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x1c, 0x0, 0x0, 0x0, 0x2, 0x0, @rand_addr, @broadcast}, @igmp={0x11, 0x0, 0x0, @multicast1}}}}}, &(0x7f0000000140)={0x0, 0x0, [0x0, 0x0, 0x40030000000000]}) 01:56:35 executing program 3: r0 = socket$inet(0x2, 0x3, 0x2) connect$inet(0xffffffffffffffff, &(0x7f0000000000)={0x2, 0x0, @local}, 0x10) setsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x23, &(0x7f0000000000)={{{@in=@multicast2, @in=@multicast1}}, {{@in6}, 0x0, @in6=@loopback}}, 0xe8) syz_emit_ethernet(0x2a, &(0x7f0000000640)={@random="b100485caa2a", @link_local, [], {@ipv4={0x800, {{0x5, 0x4, 0x100000000000000, 0x0, 0x1c, 0x0, 0x0, 0x0, 0x2, 0x0, @rand_addr, @broadcast}, @igmp={0x11, 0xffffffffffffffff, 0x0, @multicast1}}}}}, &(0x7f0000000140)) 01:56:35 executing program 5: perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1f}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000340)={&(0x7f0000000000), 0xc, &(0x7f0000000300)={&(0x7f0000000240)=@newlink={0x50, 0x10, 0x721, 0x0, 0x0, {0x0, 0x0, 0xb00}, [@IFLA_LINKINFO={0x28, 0x12, @veth={{0xc, 0x1, 'veth\x00'}, {0x18, 0x2, @VETH_INFO_PEER={0x14}}}}, @IFLA_NET_NS_FD={0x8}]}, 0x50}}, 0x0) 01:56:35 executing program 4: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) ioctl$sock_SIOCETHTOOL(r0, 0x8946, &(0x7f0000000040)={'bond0\x00', &(0x7f0000000240)=ANY=[@ANYBLOB="4c000000000023000000000000000002"]}) r1 = memfd_create(&(0x7f0000000000)='wlan1\x00', 0x1) accept4$inet(r1, &(0x7f0000000080)={0x2, 0x0, @multicast1}, &(0x7f00000000c0)=0x10, 0x80000) 01:56:35 executing program 0: socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000001f80)={0xffffffffffffffff, 0xffffffffffffffff}) setsockopt$SO_ATTACH_FILTER(r2, 0x1, 0x1a, &(0x7f0000ab9ff0)={0x2, &(0x7f000039a000)=[{0x20, 0x0, 0x0, 0xfffffffffffff010}, {0x6}]}, 0x10) sendmmsg(r1, &(0x7f0000001e80)=[{{&(0x7f0000000700)=@l2={0x1f, 0x0, {}, 0x0, 0x0}, 0x80, &(0x7f0000001dc0)}}], 0x1, 0x0) [ 681.535084] binder: 14096:14097 Acquire 1 refcount change on invalid ref 0 ret -22 [ 681.601693] binder: 14096:14097 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 01:56:35 executing program 2: r0 = socket$inet(0x2, 0x3, 0x2) connect$inet(0xffffffffffffffff, &(0x7f0000000000)={0x2, 0x0, @local}, 0x10) setsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x23, &(0x7f0000000000)={{{@in=@multicast2, @in=@multicast1}}, {{@in6}, 0x0, @in6=@loopback}}, 0xe8) syz_emit_ethernet(0x2a, &(0x7f0000000640)={@random="b100485caa2a", @link_local, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x1c, 0x0, 0x0, 0x0, 0x2, 0x0, @rand_addr, @broadcast}, @igmp={0x11, 0x0, 0x0, @multicast1}}}}}, &(0x7f0000000140)={0x0, 0x0, [0x0, 0x0, 0xffffffff00000000]}) 01:56:35 executing program 5: perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1f}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000340)={&(0x7f0000000000), 0xc, &(0x7f0000000300)={&(0x7f0000000240)=@newlink={0x50, 0x10, 0x721, 0x0, 0x0, {0x0, 0x0, 0x300000000000000}, [@IFLA_LINKINFO={0x28, 0x12, @veth={{0xc, 0x1, 'veth\x00'}, {0x18, 0x2, @VETH_INFO_PEER={0x14}}}}, @IFLA_NET_NS_FD={0x8}]}, 0x50}}, 0x0) 01:56:35 executing program 1: r0 = perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff7ffffffffffb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$sock_inet_SIOCADDRT(r0, 0x890b, &(0x7f0000000080)={0x100000001, {0x2, 0x4e21, @multicast1}, {0x2, 0x4e20, @dev={0xac, 0x14, 0x14, 0xc}}, {0x2, 0x4e21, @local}, 0x200, 0x9, 0x6, 0x1, 0xe9a5, &(0x7f0000000040)='bpq0\x00', 0x5, 0xffffffff, 0x1}) r1 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r1, &(0x7f0000018000)={&(0x7f0000000000), 0xc, &(0x7f000000e000)={&(0x7f00000016c0)={0x14, 0x1d, 0xffffffffffffffff, 0x0, 0x0, {0x1}}, 0x14}}, 0x0) [ 681.728965] binder: 14096:14123 Acquire 1 refcount change on invalid ref 0 ret -22 [ 681.795683] binder: 14114 RLIMIT_NICE not set [ 681.803679] binder: 14096:14123 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 01:56:36 executing program 6: r0 = syz_open_dev$sndseq(&(0x7f0000000100)='/dev/snd/seq\x00', 0x0, 0x0) read(r0, &(0x7f0000fb6000)=""/28, 0x3f0) ioctl$SNDRV_SEQ_IOCTL_REMOVE_EVENTS(r0, 0x4040534e, &(0x7f00000001c0)={0xbf}) ioctl$SNDRV_SEQ_IOCTL_QUERY_SUBS(r0, 0xc058534f, &(0x7f00000002c0)={{}, 0x1, 0x0, 0x0, {}, 0x0, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xbf000000]}) r1 = gettid() timer_create(0x0, &(0x7f0000044000)={0x0, 0x12}, &(0x7f0000000040)) r2 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r2, 0x8912, &(0x7f00000001c0)="0a5cc80700315f85715070") timer_settime(0x0, 0x0, &(0x7f0000000080)={{0x0, 0x989680}, {0x0, 0x9}}, &(0x7f0000040000)) tkill(r1, 0x1000000000014) 01:56:36 executing program 4: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) ioctl$sock_SIOCETHTOOL(r0, 0x8946, &(0x7f0000000040)={'bond0\x00', &(0x7f0000000240)=ANY=[@ANYBLOB="000002"]}) 01:56:36 executing program 3: r0 = socket$inet(0x2, 0x3, 0x2) connect$inet(0xffffffffffffffff, &(0x7f0000000000)={0x2, 0x0, @local}, 0x10) setsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x23, &(0x7f0000000000)={{{@in=@multicast2, @in=@multicast1}}, {{@in6}, 0x0, @in6=@loopback}}, 0xe8) syz_emit_ethernet(0x2a, &(0x7f0000000640)={@random="b100485caa2a", @link_local, [], {@ipv4={0x800, {{0x5, 0x4, 0x400000000000000, 0x0, 0x1c, 0x0, 0x0, 0x0, 0x2, 0x0, @rand_addr, @broadcast}, @igmp={0x11, 0xffffffffffffffff, 0x0, @multicast1}}}}}, &(0x7f0000000140)) 01:56:36 executing program 7: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000180)='/dev/sequencer\x00', 0x10002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000080)="0a5cc80700315f85715070") r1 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000001c0)={0x2, 0x0, &(0x7f0000000140)=ANY=[@ANYBLOB='\fc'], 0x0, 0x0, &(0x7f0000000080)}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, &(0x7f00000001c0)}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000040)={0x8, 0x7a000000, &(0x7f00000000c0)=[@release={0x400c630f}], 0x1, 0x0, &(0x7f0000000100)='V'}) fstat(r0, &(0x7f00000002c0)) 01:56:36 executing program 5: perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1f}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000340)={&(0x7f0000000000), 0xc, &(0x7f0000000300)={&(0x7f0000000240)=@newlink={0x50, 0x10, 0x721, 0x0, 0x0, {0x0, 0x0, 0xb40a000000000000}, [@IFLA_LINKINFO={0x28, 0x12, @veth={{0xc, 0x1, 'veth\x00'}, {0x18, 0x2, @VETH_INFO_PEER={0x14}}}}, @IFLA_NET_NS_FD={0x8}]}, 0x50}}, 0x0) 01:56:36 executing program 0: socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000001f80)={0xffffffffffffffff, 0xffffffffffffffff}) setsockopt$SO_ATTACH_FILTER(r2, 0x1, 0x1a, &(0x7f0000ab9ff0)={0x2, &(0x7f000039a000)=[{0x20, 0x0, 0x0, 0xfffffffffffff010}, {0x6}]}, 0x10) sendmmsg(r1, &(0x7f0000001e80)=[{{&(0x7f0000000700)=@l2={0x1f, 0x0, {}, 0x0, 0x0}, 0x80, &(0x7f0000001dc0)}}], 0x1, 0x0) 01:56:36 executing program 2: r0 = socket$inet(0x2, 0x3, 0x2) connect$inet(0xffffffffffffffff, &(0x7f0000000000)={0x2, 0x0, @local}, 0x10) setsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x23, &(0x7f0000000000)={{{@in=@multicast2, @in=@multicast1}}, {{@in6}, 0x0, @in6=@loopback}}, 0xe8) syz_emit_ethernet(0x2a, &(0x7f0000000640)={@random="b100485caa2a", @link_local, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x1c, 0x0, 0x0, 0x0, 0x2, 0x0, @rand_addr, @broadcast}, @igmp={0x11, 0x0, 0x0, @multicast1}}}}}, &(0x7f0000000140)={0x0, 0x0, [0x0, 0x0, 0x8000000]}) 01:56:36 executing program 1: r0 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r0, &(0x7f0000000000)={0x2, 0x4e20, @broadcast}, 0x10) connect$inet(r0, &(0x7f0000000100)={0x2, 0x4e20, @loopback}, 0x10) setsockopt$SO_TIMESTAMPING(r0, 0x1, 0x25, &(0x7f0000000080)=0x100, 0x9d44786b16c8a630) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) sendto$inet(r0, &(0x7f0000000040)='$', 0x1, 0x0, &(0x7f0000257ff0)={0x2, 0x0, @multicast2}, 0x10) recvfrom$inet(r0, &(0x7f0000000140)=""/176, 0xe5, 0x40012021, &(0x7f0000000400)={0x2, 0x0, @dev}, 0x70c000) 01:56:36 executing program 3: r0 = socket$inet(0x2, 0x3, 0x2) connect$inet(0xffffffffffffffff, &(0x7f0000000000)={0x2, 0x0, @local}, 0x10) setsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x23, &(0x7f0000000000)={{{@in=@multicast2, @in=@multicast1}}, {{@in6}, 0x0, @in6=@loopback}}, 0xe8) syz_emit_ethernet(0x2a, &(0x7f0000000640)={@random="b100485caa2a", @link_local, [], {@ipv4={0x800, {{0x5, 0x4, 0x400300, 0x0, 0x1c, 0x0, 0x0, 0x0, 0x2, 0x0, @rand_addr, @broadcast}, @igmp={0x11, 0xffffffffffffffff, 0x0, @multicast1}}}}}, &(0x7f0000000140)) 01:56:36 executing program 5: perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1f}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000340)={&(0x7f0000000000), 0xc, &(0x7f0000000300)={&(0x7f0000000240)=@newlink={0x50, 0x10, 0x721, 0x0, 0x0, {0x0, 0x0, 0xb00000000000000}, [@IFLA_LINKINFO={0x28, 0x12, @veth={{0xc, 0x1, 'veth\x00'}, {0x18, 0x2, @VETH_INFO_PEER={0x14}}}}, @IFLA_NET_NS_FD={0x8}]}, 0x50}}, 0x0) 01:56:36 executing program 4: ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000040)={'bond0\x00', &(0x7f0000000240)=ANY=[@ANYBLOB="4c000000000023000000000000000002"]}) r0 = openat$sequencer(0xffffffffffffff9c, &(0x7f0000000000)='/dev/sequencer\x00', 0x4020c0, 0x0) getpeername$inet6(r0, &(0x7f00000000c0)={0xa, 0x0, 0x0, @ipv4={[], [], @remote}}, &(0x7f0000000100)=0x1c) ioctl$sock_bt(r0, 0x541b, &(0x7f0000000080)="ed73ea0b17273e65bac27fcbd78a32bda8f784c9b0cac686eea0d5ca683491f19279c2fdcf19dc5d108c7e") 01:56:36 executing program 2: r0 = socket$inet(0x2, 0x3, 0x2) connect$inet(0xffffffffffffffff, &(0x7f0000000000)={0x2, 0x0, @local}, 0x10) setsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x23, &(0x7f0000000000)={{{@in=@multicast2, @in=@multicast1}}, {{@in6}, 0x0, @in6=@loopback}}, 0xe8) syz_emit_ethernet(0x2a, &(0x7f0000000640)={@random="b100485caa2a", @link_local, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x1c, 0x0, 0x0, 0x0, 0x2, 0x0, @rand_addr, @broadcast}, @igmp={0x11, 0x0, 0x0, @multicast1}}}}}, &(0x7f0000000140)={0x0, 0x0, [0x0, 0x0, 0x6000]}) [ 682.453961] binder: 14164:14165 Acquire 1 refcount change on invalid ref 0 ret -22 01:56:36 executing program 5: perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1f}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000340)={&(0x7f0000000000), 0xc, &(0x7f0000000300)={&(0x7f0000000240)=@newlink={0x50, 0x10, 0x721, 0x0, 0x0, {0x0, 0x0, 0x81000000}, [@IFLA_LINKINFO={0x28, 0x12, @veth={{0xc, 0x1, 'veth\x00'}, {0x18, 0x2, @VETH_INFO_PEER={0x14}}}}, @IFLA_NET_NS_FD={0x8}]}, 0x50}}, 0x0) 01:56:36 executing program 3: r0 = socket$inet(0x2, 0x3, 0x2) connect$inet(0xffffffffffffffff, &(0x7f0000000000)={0x2, 0x0, @local}, 0x10) setsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x23, &(0x7f0000000000)={{{@in=@multicast2, @in=@multicast1}}, {{@in6}, 0x0, @in6=@loopback}}, 0xe8) syz_emit_ethernet(0x2a, &(0x7f0000000640)={@random="b100485caa2a", @link_local, [], {@ipv4={0x800, {{0x5, 0x4, 0x6000, 0x0, 0x1c, 0x0, 0x0, 0x0, 0x2, 0x0, @rand_addr, @broadcast}, @igmp={0x11, 0xffffffffffffffff, 0x0, @multicast1}}}}}, &(0x7f0000000140)) 01:56:36 executing program 4: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) r1 = openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000000)='/dev/sequencer2\x00', 0x0, 0x0) ioctl$TIOCSSOFTCAR(r1, 0x541a, &(0x7f0000000100)=0xffffffff7fffffff) ioctl$KVM_TRANSLATE(r1, 0xc018ae85, &(0x7f0000000080)={0x106002, 0x0, 0x3, 0x3, 0x4}) ioctl$sock_SIOCETHTOOL(r0, 0x8946, &(0x7f0000000040)={'bond0\x00', &(0x7f0000000240)=ANY=[@ANYBLOB="4c000000000023000000000000000002"]}) getsockopt$inet_sctp_SCTP_GET_PEER_ADDR_INFO(r1, 0x84, 0xf, &(0x7f0000000140)={0x0, @in6={{0xa, 0x4e22, 0x6, @dev={0xfe, 0x80, [], 0xe}, 0xffff}}, 0x5, 0x1, 0x8, 0x7d0, 0x7}, &(0x7f0000000200)=0x98) getsockopt$inet_sctp_SCTP_LOCAL_AUTH_CHUNKS(r1, 0x84, 0x1b, &(0x7f0000000280)={r2, 0x71, "001b301c7c37eec1dbefbce4693028671de8e2d22bcebd9919bce401bf44ee0fdb15be4f3fdbaf5b600dece862151145031dc7787f4373518344e4d9d6840bd5864306cba211639f120a8a682cd69c94661b9bb755e877df32523bd27e6dba776dc03d79956ac81b70413faef3d8604ce7"}, &(0x7f0000000300)=0x79) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f00000000c0)='./cgroup.cpu/syz1\x00', 0x1ff) [ 682.539781] binder: 14164:14165 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 01:56:36 executing program 2: r0 = socket$inet(0x2, 0x3, 0x2) connect$inet(0xffffffffffffffff, &(0x7f0000000000)={0x2, 0x0, @local}, 0x10) setsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x23, &(0x7f0000000000)={{{@in=@multicast2, @in=@multicast1}}, {{@in6}, 0x0, @in6=@loopback}}, 0xe8) syz_emit_ethernet(0x2a, &(0x7f0000000640)={@random="b100485caa2a", @link_local, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x1c, 0x0, 0x0, 0x0, 0x2, 0x0, @rand_addr, @broadcast}, @igmp={0x11, 0x0, 0x0, @multicast1}}}}}, &(0x7f0000000140)={0x0, 0x0, [0x0, 0x0, 0x6]}) [ 682.595149] binder: 14164:14191 Acquire 1 refcount change on invalid ref 0 ret -22 [ 682.694720] binder: 14188 RLIMIT_NICE not set [ 682.727097] binder: 14164:14191 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 01:56:37 executing program 6: r0 = syz_open_dev$sndseq(&(0x7f0000000100)='/dev/snd/seq\x00', 0x0, 0x0) read(r0, &(0x7f0000fb6000)=""/28, 0x3f0) ioctl$SNDRV_SEQ_IOCTL_REMOVE_EVENTS(r0, 0x4040534e, &(0x7f00000001c0)={0xbf}) ioctl$SNDRV_SEQ_IOCTL_QUERY_SUBS(r0, 0xc058534f, &(0x7f00000002c0)={{}, 0x1, 0x0, 0x0, {}, 0x0, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xe00]}) r1 = gettid() timer_create(0x0, &(0x7f0000044000)={0x0, 0x12}, &(0x7f0000000040)) r2 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r2, 0x8912, &(0x7f00000001c0)="0a5cc80700315f85715070") timer_settime(0x0, 0x0, &(0x7f0000000080)={{0x0, 0x989680}, {0x0, 0x9}}, &(0x7f0000040000)) tkill(r1, 0x1000000000014) 01:56:37 executing program 5: perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1f}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000340)={&(0x7f0000000000), 0xc, &(0x7f0000000300)={&(0x7f0000000240)=@newlink={0x50, 0x10, 0x721, 0x0, 0x0, {0x0, 0x0, 0x2000000}, [@IFLA_LINKINFO={0x28, 0x12, @veth={{0xc, 0x1, 'veth\x00'}, {0x18, 0x2, @VETH_INFO_PEER={0x14}}}}, @IFLA_NET_NS_FD={0x8}]}, 0x50}}, 0x0) 01:56:37 executing program 0: socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000001f80)={0xffffffffffffffff, 0xffffffffffffffff}) setsockopt$SO_ATTACH_FILTER(r2, 0x1, 0x1a, &(0x7f0000ab9ff0)={0x2, &(0x7f000039a000)=[{0x20, 0x0, 0x0, 0xfffffffffffff010}, {0x6}]}, 0x10) sendmmsg(r1, &(0x7f0000001e80)=[{{&(0x7f0000000700)=@l2={0x1f, 0x0, {}, 0x0, 0x0}, 0x80, &(0x7f0000001dc0)}}], 0x1, 0x0) 01:56:37 executing program 2: r0 = socket$inet(0x2, 0x3, 0x2) connect$inet(0xffffffffffffffff, &(0x7f0000000000)={0x2, 0x0, @local}, 0x10) setsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x23, &(0x7f0000000000)={{{@in=@multicast2, @in=@multicast1}}, {{@in6}, 0x0, @in6=@loopback}}, 0xe8) syz_emit_ethernet(0x2a, &(0x7f0000000640)={@random="b100485caa2a", @link_local, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x1c, 0x0, 0x0, 0x0, 0x2, 0x0, @rand_addr, @broadcast}, @igmp={0x11, 0x0, 0x0, @multicast1}}}}}, &(0x7f0000000140)={0x0, 0x0, [0x0, 0x0, 0x3e]}) 01:56:37 executing program 4: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) socketpair$inet(0x2, 0x80006, 0x7, &(0x7f0000000000)={0xffffffffffffffff}) setsockopt$inet_group_source_req(r1, 0x0, 0x2e, &(0x7f0000000080)={0x6, {{0x2, 0x4e24, @remote}}, {{0x2, 0x4e24, @rand_addr=0x200}}}, 0x108) ioctl$sock_SIOCETHTOOL(r0, 0x8946, &(0x7f0000000040)={'bond0\x00', &(0x7f0000000240)=ANY=[@ANYBLOB="4c000000000023000000000000000002"]}) 01:56:37 executing program 3: r0 = socket$inet(0x2, 0x3, 0x2) connect$inet(0xffffffffffffffff, &(0x7f0000000000)={0x2, 0x0, @local}, 0x10) setsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x23, &(0x7f0000000000)={{{@in=@multicast2, @in=@multicast1}}, {{@in6}, 0x0, @in6=@loopback}}, 0xe8) syz_emit_ethernet(0x2a, &(0x7f0000000640)={@random="b100485caa2a", @link_local, [], {@ipv4={0x800, {{0x5, 0x4, 0x1c000000, 0x0, 0x1c, 0x0, 0x0, 0x0, 0x2, 0x0, @rand_addr, @broadcast}, @igmp={0x11, 0xffffffffffffffff, 0x0, @multicast1}}}}}, &(0x7f0000000140)) 01:56:37 executing program 7: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000180)='/dev/sequencer\x00', 0x10002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000080)="0a5cc80700315f85715070") r1 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000001c0)={0x2, 0x0, &(0x7f0000000140)=ANY=[@ANYBLOB='\fc'], 0x0, 0x0, &(0x7f0000000080)}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, &(0x7f00000001c0)}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000040)={0x8, 0x6c, &(0x7f00000000c0)=[@release={0x400c630f}], 0x1, 0x0, &(0x7f0000000100)='V'}) fstat(r0, &(0x7f00000002c0)) 01:56:37 executing program 1: r0 = bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000100)={&(0x7f00000000c0)='\x00'}, 0x10) fchmodat(r0, &(0x7f0000000140)='./file0\x00', 0x0) r1 = perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1f}, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$TIOCGPGRP(r0, 0x540f, &(0x7f00000002c0)=0x0) perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0xd09, 0x4, 0x9, 0x4, 0x0, 0x1, 0x10000, 0xb, 0xaf8, 0x8, 0xffffffffffff0000, 0x7fff, 0x3, 0x5, 0x6, 0x101, 0x6, 0x6c, 0x200, 0x9, 0x8, 0x96, 0x7fff, 0x7, 0x4, 0x9, 0x1000, 0xffffffffffffff01, 0x2, 0x9, 0x3, 0x9, 0x3ff, 0x9, 0x9, 0x5, 0x0, 0x4, 0x2, @perf_config_ext={0x5, 0x7}, 0x8, 0xff, 0x0, 0x7, 0x1, 0xed80, 0x6}, r2, 0xe, r1, 0x9) r3 = socket$netlink(0x10, 0x3, 0x0) perf_event_open(&(0x7f0000000040)={0x2000000005, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, @perf_bp={&(0x7f0000000000), 0x1}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) openat$tun(0xffffffffffffff9c, &(0x7f0000000280)='/dev/net/tun\x00', 0x400000000000800, 0x0) getsockopt$netlink(r3, 0x10e, 0x4, &(0x7f0000000640)=""/4, &(0x7f0000000000)=0x4096c6150de78d62) 01:56:37 executing program 3: r0 = socket$inet(0x2, 0x3, 0x2) connect$inet(0xffffffffffffffff, &(0x7f0000000000)={0x2, 0x0, @local}, 0x10) setsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x23, &(0x7f0000000000)={{{@in=@multicast2, @in=@multicast1}}, {{@in6}, 0x0, @in6=@loopback}}, 0xe8) syz_emit_ethernet(0x2a, &(0x7f0000000640)={@random="b100485caa2a", @link_local, [], {@ipv4={0x800, {{0x5, 0x4, 0x6, 0x0, 0x1c, 0x0, 0x0, 0x0, 0x2, 0x0, @rand_addr, @broadcast}, @igmp={0x11, 0xffffffffffffffff, 0x0, @multicast1}}}}}, &(0x7f0000000140)) 01:56:37 executing program 1: perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1f}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) epoll_ctl$EPOLL_CTL_ADD(0xffffffffffffffff, 0x1, 0xffffffffffffffff, &(0x7f0000b82000)) lstat(&(0x7f0000000500)='./file0\x00', &(0x7f0000000540)={0x0, 0x0, 0x0, 0x0, 0x0}) r1 = getegid() chown(&(0x7f00000004c0)='./file0\x00', r0, r1) r2 = socket$nl_generic(0x10, 0x3, 0x10) r3 = fcntl$dupfd(0xffffffffffffffff, 0x0, 0xffffffffffffffff) write$RDMA_USER_CM_CMD_CREATE_ID(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x18, 0xfa00, {0x3, &(0x7f0000000040)}}, 0x20) write$RDMA_USER_CM_CMD_RESOLVE_ROUTE(0xffffffffffffffff, &(0x7f00000000c0)={0x4, 0x8}, 0x10) ioctl$SNDRV_SEQ_IOCTL_GET_PORT_INFO(r3, 0xc0a85322, &(0x7f0000000200)) timer_create(0x6, &(0x7f0000000140)={0x0, 0xf, 0x6, @thr={&(0x7f00000002c0)="fee0768ee3c641ea0b4fae5a75e6ca0e0dc1efbf121e80b9751a8f8d55b67285ec2056e592967dddc5c05140aa6e4faaa07ba9479c6fd291ac769fd6c913e18faad95611dd172893d394e936bec68f5cea0ef938825c98847eff0035972eb51301633e655acdf21c07fec81db4d3782383a13b072ac007492882e49fc7c198f69e76e5df2a9f381a533d8cc23fac50898aa494e27733d45bd392f2cfe57667cd7cf92a49fd4a29c9c5aab83262127210b5e97ab74861caf9b8b6cba8a192fa95ef1439fa6e4fb2ef40df72bcb5105c4140b050b76cb4b69005873f0b729407c693602fffaeeea45c385810e54d47eee34b46e07d17536a", &(0x7f00000003c0)="a921dc203abf6871dbef22e5b80015c12c271f91c7d611ef0d761021fe08cb8087018d1035e97a735c363a90e1234c91b0227434ade9eab8e56a7e03378ae808f1eee8f8576165e95ccb590c1ddbdd28ea6795e9a34eb3622ecefe87cfb7a72707a26653130d01bb1e94eb96720c07212444b1a84e5b52763c690be3caab60cbaf5ede"}}, &(0x7f0000000480)=0x0) timer_delete(r4) sendmsg$nl_generic(r2, &(0x7f0000018000)={&(0x7f0000000000), 0xc, &(0x7f000000e000)={&(0x7f00000016c0)={0x20, 0x1d, 0xffffffff0000000d, 0x0, 0x0, {0x2}, [@nested={0xc, 0x3, [@typed={0x8, 0x0, @pid}]}]}, 0x20}}, 0x0) modify_ldt$write2(0x11, &(0x7f0000000100)={0x5, 0x20001000, 0x6000, 0x101, 0x9, 0x1, 0x3, 0x0, 0x40, 0x6}, 0x10) 01:56:37 executing program 5: perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1f}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000340)={&(0x7f0000000000), 0xc, &(0x7f0000000300)={&(0x7f0000000240)=@newlink={0x50, 0x10, 0x721, 0x0, 0x0, {0x0, 0x0, 0x4000000}, [@IFLA_LINKINFO={0x28, 0x12, @veth={{0xc, 0x1, 'veth\x00'}, {0x18, 0x2, @VETH_INFO_PEER={0x14}}}}, @IFLA_NET_NS_FD={0x8}]}, 0x50}}, 0x0) 01:56:37 executing program 2: r0 = socket$inet(0x2, 0x3, 0x2) connect$inet(0xffffffffffffffff, &(0x7f0000000000)={0x2, 0x0, @local}, 0x10) setsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x23, &(0x7f0000000000)={{{@in=@multicast2, @in=@multicast1}}, {{@in6}, 0x0, @in6=@loopback}}, 0xe8) syz_emit_ethernet(0x2a, &(0x7f0000000640)={@random="b100485caa2a", @link_local, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x1c, 0x0, 0x0, 0x0, 0x2, 0x0, @rand_addr, @broadcast}, @igmp={0x11, 0x0, 0x0, @multicast1}}}}}, &(0x7f0000000140)={0x0, 0x0, [0x0, 0x0, 0x100000000000000]}) [ 683.322713] binder: 14235:14237 Acquire 1 refcount change on invalid ref 0 ret -22 01:56:37 executing program 4: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) syz_open_dev$rtc(&(0x7f0000000000)='/dev/rtc#\x00', 0xff, 0x541300) ioctl$sock_SIOCETHTOOL(r0, 0x8946, &(0x7f0000000040)={'bond0\x00', &(0x7f0000000240)=ANY=[@ANYBLOB="4c000000000023000000000000000002"]}) 01:56:37 executing program 0: socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000001f80)={0xffffffffffffffff, 0xffffffffffffffff}) setsockopt$SO_ATTACH_FILTER(r2, 0x1, 0x1a, &(0x7f0000ab9ff0)={0x2, &(0x7f000039a000)=[{0x20, 0x0, 0x0, 0xfffffffffffff010}, {0x6}]}, 0x10) sendmmsg(r1, &(0x7f0000001e80)=[{{&(0x7f0000000700)=@l2={0x1f, 0x0, {}, 0x0, 0x0}, 0x80, &(0x7f0000001dc0)}}], 0x1, 0x0) 01:56:37 executing program 3: r0 = socket$inet(0x2, 0x3, 0x2) connect$inet(0xffffffffffffffff, &(0x7f0000000000)={0x2, 0x0, @local}, 0x10) setsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x23, &(0x7f0000000000)={{{@in=@multicast2, @in=@multicast1}}, {{@in6}, 0x0, @in6=@loopback}}, 0xe8) syz_emit_ethernet(0x2a, &(0x7f0000000640)={@random="b100485caa2a", @link_local, [], {@ipv4={0x800, {{0x5, 0x4, 0x34000, 0x0, 0x1c, 0x0, 0x0, 0x0, 0x2, 0x0, @rand_addr, @broadcast}, @igmp={0x11, 0xffffffffffffffff, 0x0, @multicast1}}}}}, &(0x7f0000000140)) [ 683.430645] netlink: 'syz-executor1': attribute type 3 has an invalid length. [ 683.441458] binder: 14235:14237 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 01:56:37 executing program 2: r0 = socket$inet(0x2, 0x3, 0x2) connect$inet(0xffffffffffffffff, &(0x7f0000000000)={0x2, 0x0, @local}, 0x10) setsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x23, &(0x7f0000000000)={{{@in=@multicast2, @in=@multicast1}}, {{@in6}, 0x0, @in6=@loopback}}, 0xe8) syz_emit_ethernet(0x2a, &(0x7f0000000640)={@random="b100485caa2a", @link_local, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x1c, 0x0, 0x0, 0x0, 0x2, 0x0, @rand_addr, @broadcast}, @igmp={0x11, 0x0, 0x0, @multicast1}}}}}, &(0x7f0000000140)={0x0, 0x0, [0x0, 0x0, 0x3000000]}) [ 683.532190] netlink: 'syz-executor1': attribute type 3 has an invalid length. [ 683.538514] binder: 14235:14257 Acquire 1 refcount change on invalid ref 0 ret -22 [ 683.623001] binder: 14235:14257 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 01:56:38 executing program 6: r0 = syz_open_dev$sndseq(&(0x7f0000000100)='/dev/snd/seq\x00', 0x0, 0x0) read(r0, &(0x7f0000fb6000)=""/28, 0x3f0) ioctl$SNDRV_SEQ_IOCTL_REMOVE_EVENTS(r0, 0x4040534e, &(0x7f00000001c0)={0xbf}) ioctl$SNDRV_SEQ_IOCTL_QUERY_SUBS(r0, 0xc058534f, &(0x7f00000002c0)={{}, 0x1, 0x0, 0x0, {}, 0x0, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xe]}) r1 = gettid() timer_create(0x0, &(0x7f0000044000)={0x0, 0x12}, &(0x7f0000000040)) r2 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r2, 0x8912, &(0x7f00000001c0)="0a5cc80700315f85715070") timer_settime(0x0, 0x0, &(0x7f0000000080)={{0x0, 0x989680}, {0x0, 0x9}}, &(0x7f0000040000)) tkill(r1, 0x1000000000014) 01:56:38 executing program 4: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) ioctl$SNDRV_SEQ_IOCTL_SET_QUEUE_CLIENT(r0, 0x404c534a, &(0x7f0000000080)={0xffff, 0x80000000, 0xfff}) r1 = openat$dsp(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dsp\x00', 0x40000, 0x0) write$FUSE_IOCTL(r1, &(0x7f0000000100)={0x20, 0xfffffffffffffff5, 0x8, {0x1, 0x0, 0x1000, 0xbb3}}, 0x20) ioctl$sock_SIOCETHTOOL(r0, 0x8946, &(0x7f0000000040)={'bond0\x00', &(0x7f0000000240)=ANY=[@ANYBLOB="4c000000000023000000000000000002"]}) 01:56:38 executing program 5: perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1f}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000340)={&(0x7f0000000000), 0xc, &(0x7f0000000300)={&(0x7f0000000240)=@newlink={0x50, 0x10, 0x721, 0x0, 0x0, {0x0, 0x0, 0xb}, [@IFLA_LINKINFO={0x28, 0x12, @veth={{0xc, 0x1, 'veth\x00'}, {0x18, 0x2, @VETH_INFO_PEER={0x14}}}}, @IFLA_NET_NS_FD={0x8}]}, 0x50}}, 0x0) 01:56:38 executing program 1: r0 = memfd_create(&(0x7f00000000c0)='\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00', 0x0) perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x3e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff7fffffffffff}, 0x0, 0x0, 0xffffffffffffffff, 0x0) write$binfmt_elf32(r0, &(0x7f0000000540)=ANY=[@ANYBLOB="77454c4600000000000000000000000003000300000000000000000000000000200001000000000000000000000003000000000000000000000000000000ff0f000000000000090000000000000000000000000000000000"], 0x58) setsockopt$inet6_dccp_int(r0, 0x21, 0x5, &(0x7f0000000040)=0x2, 0x4) execveat(r0, &(0x7f0000000000)='\x00', &(0x7f0000000280), &(0x7f0000000040), 0x1000) getsockopt$inet_sctp_SCTP_AUTH_ACTIVE_KEY(r0, 0x84, 0x18, &(0x7f0000000080)={0x0}, &(0x7f0000000100)=0x8) setsockopt$inet_sctp_SCTP_PR_SUPPORTED(r0, 0x84, 0x71, &(0x7f0000000140)={r1, 0x9}, 0x8) ioctl$SG_SCSI_RESET(r0, 0x2284, 0x0) 01:56:38 executing program 0: socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000001f80)={0xffffffffffffffff, 0xffffffffffffffff}) setsockopt$SO_ATTACH_FILTER(r2, 0x1, 0x1a, &(0x7f0000ab9ff0)={0x2, &(0x7f000039a000)=[{0x20, 0x0, 0x0, 0xfffffffffffff010}, {0x6}]}, 0x10) sendmmsg(r1, &(0x7f0000001e80)=[{{&(0x7f0000000700)=@l2={0x1f, 0x0, {}, 0x0, 0x0}, 0x80, &(0x7f0000001dc0)}}], 0x1, 0x0) 01:56:38 executing program 3: r0 = socket$inet(0x2, 0x3, 0x2) connect$inet(0xffffffffffffffff, &(0x7f0000000000)={0x2, 0x0, @local}, 0x10) setsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x23, &(0x7f0000000000)={{{@in=@multicast2, @in=@multicast1}}, {{@in6}, 0x0, @in6=@loopback}}, 0xe8) syz_emit_ethernet(0x2a, &(0x7f0000000640)={@random="b100485caa2a", @link_local, [], {@ipv4={0x800, {{0x5, 0x4, 0x2000000000000000, 0x0, 0x1c, 0x0, 0x0, 0x0, 0x2, 0x0, @rand_addr, @broadcast}, @igmp={0x11, 0xffffffffffffffff, 0x0, @multicast1}}}}}, &(0x7f0000000140)) 01:56:38 executing program 2: r0 = socket$inet(0x2, 0x3, 0x2) connect$inet(0xffffffffffffffff, &(0x7f0000000000)={0x2, 0x0, @local}, 0x10) setsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x23, &(0x7f0000000000)={{{@in=@multicast2, @in=@multicast1}}, {{@in6}, 0x0, @in6=@loopback}}, 0xe8) syz_emit_ethernet(0x2a, &(0x7f0000000640)={@random="b100485caa2a", @link_local, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x1c, 0x0, 0x0, 0x0, 0x2, 0x0, @rand_addr, @broadcast}, @igmp={0x11, 0x0, 0x0, @multicast1}}}}}, &(0x7f0000000140)={0x0, 0x0, [0x0, 0x0, 0x700]}) 01:56:38 executing program 7: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000180)='/dev/sequencer\x00', 0x10002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000080)="0a5cc80700315f85715070") r1 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000001c0)={0x2, 0x0, &(0x7f0000000140)=ANY=[@ANYBLOB='\fc'], 0x0, 0x0, &(0x7f0000000080)}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, &(0x7f00000001c0)}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000040)={0x8, 0x100000000000000, &(0x7f00000000c0)=[@release={0x400c630f}], 0x1, 0x0, &(0x7f0000000100)='V'}) fstat(r0, &(0x7f00000002c0)) 01:56:38 executing program 5: perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1f}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000340)={&(0x7f0000000000), 0xc, &(0x7f0000000300)={&(0x7f0000000240)=@newlink={0x50, 0x10, 0x721, 0x0, 0x0, {0x0, 0x0, 0x900000000000000}, [@IFLA_LINKINFO={0x28, 0x12, @veth={{0xc, 0x1, 'veth\x00'}, {0x18, 0x2, @VETH_INFO_PEER={0x14}}}}, @IFLA_NET_NS_FD={0x8}]}, 0x50}}, 0x0) 01:56:38 executing program 2: r0 = socket$inet(0x2, 0x3, 0x2) connect$inet(0xffffffffffffffff, &(0x7f0000000000)={0x2, 0x0, @local}, 0x10) setsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x23, &(0x7f0000000000)={{{@in=@multicast2, @in=@multicast1}}, {{@in6}, 0x0, @in6=@loopback}}, 0xe8) syz_emit_ethernet(0x2a, &(0x7f0000000640)={@random="b100485caa2a", @link_local, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x1c, 0x0, 0x0, 0x0, 0x2, 0x0, @rand_addr, @broadcast}, @igmp={0x11, 0x0, 0x0, @multicast1}}}}}, &(0x7f0000000140)={0x0, 0x0, [0x0, 0x0, 0x4000000]}) 01:56:38 executing program 4: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000140)='/dev/net/tun\x00', 0x48000, 0x0) ioctl$sock_SIOCETHTOOL(r0, 0x8946, &(0x7f0000000040)={'bon\x00', &(0x7f0000000240)=ANY=[@ANYRES16=r1]}) r2 = syz_open_dev$dspn(&(0x7f00000000c0)='/dev/dsp#\x00', 0xffffffff00000001, 0x101000) r3 = bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000100)={&(0x7f0000000000)='/dev/net/tun\x00', r2}, 0x10) ioctl$sock_SIOCGSKNS(r0, 0x894c, &(0x7f0000000080)=0x7) getsockopt$inet_opts(r3, 0x0, 0x4, &(0x7f0000000180)=""/108, &(0x7f0000000200)=0x6c) 01:56:38 executing program 1: epoll_create(0x4000000004000016) pselect6(0x40, &(0x7f0000000000)={0x6, 0x0, 0xfffffffffffffffd, 0x0, 0x76e}, &(0x7f0000000180)={0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x2}, &(0x7f0000000300)={0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x8}, &(0x7f0000000340), &(0x7f00000003c0)={&(0x7f0000000380)={0x100000000000}, 0x8}) r0 = openat$qat_adf_ctl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/qat_adf_ctl\x00', 0x82000, 0x0) getpeername$inet(r0, &(0x7f00000000c0)={0x2, 0x0, @multicast1}, &(0x7f0000000100)=0x10) socket$inet6_dccp(0xa, 0x6, 0x0) syz_open_dev$sndseq(&(0x7f0000000140)='/dev/snd/seq\x00', 0x0, 0x101000) ioctl$sock_kcm_SIOCKCMUNATTACH(r0, 0x89e1, &(0x7f0000000040)={r0}) [ 684.243262] binder: 14306:14308 Acquire 1 refcount change on invalid ref 0 ret -22 01:56:38 executing program 3: r0 = socket$inet(0x2, 0x3, 0x2) connect$inet(0xffffffffffffffff, &(0x7f0000000000)={0x2, 0x0, @local}, 0x10) setsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x23, &(0x7f0000000000)={{{@in=@multicast2, @in=@multicast1}}, {{@in6}, 0x0, @in6=@loopback}}, 0xe8) syz_emit_ethernet(0x2a, &(0x7f0000000640)={@random="b100485caa2a", @link_local, [], {@ipv4={0x800, {{0x5, 0x4, 0x1c00000000000000, 0x0, 0x1c, 0x0, 0x0, 0x0, 0x2, 0x0, @rand_addr, @broadcast}, @igmp={0x11, 0xffffffffffffffff, 0x0, @multicast1}}}}}, &(0x7f0000000140)) 01:56:38 executing program 5: perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1f}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000340)={&(0x7f0000000000), 0xc, &(0x7f0000000300)={&(0x7f0000000240)=@newlink={0x50, 0x10, 0x721, 0x0, 0x0, {0x0, 0x0, 0x6000000}, [@IFLA_LINKINFO={0x28, 0x12, @veth={{0xc, 0x1, 'veth\x00'}, {0x18, 0x2, @VETH_INFO_PEER={0x14}}}}, @IFLA_NET_NS_FD={0x8}]}, 0x50}}, 0x0) 01:56:38 executing program 0: socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000001f80)={0xffffffffffffffff, 0xffffffffffffffff}) setsockopt$SO_ATTACH_FILTER(r2, 0x1, 0x1a, &(0x7f0000ab9ff0)={0x2, &(0x7f000039a000)=[{0x20, 0x0, 0x0, 0xfffffffffffff010}, {0x6}]}, 0x10) sendmmsg(r1, &(0x7f0000001e80)=[{{&(0x7f0000000700)=@l2={0x1f, 0x0, {}, 0x0, 0x0}, 0x80, &(0x7f0000001dc0)}}], 0x1, 0x0) 01:56:38 executing program 2: r0 = socket$inet(0x2, 0x3, 0x2) connect$inet(0xffffffffffffffff, &(0x7f0000000000)={0x2, 0x0, @local}, 0x10) setsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x23, &(0x7f0000000000)={{{@in=@multicast2, @in=@multicast1}}, {{@in6}, 0x0, @in6=@loopback}}, 0xe8) syz_emit_ethernet(0x2a, &(0x7f0000000640)={@random="b100485caa2a", @link_local, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x1c, 0x0, 0x0, 0x0, 0x2, 0x0, @rand_addr, @broadcast}, @igmp={0x11, 0x0, 0x0, @multicast1}}}}}, &(0x7f0000000140)={0x0, 0x0, [0x0, 0x0, 0x300]}) [ 684.364808] QAT: Invalid ioctl [ 684.377743] QAT: Invalid ioctl [ 684.402540] binder: 14306:14308 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 684.525673] binder: 14306:14336 Acquire 1 refcount change on invalid ref 0 ret -22 [ 684.572162] binder: 14306:14336 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 684.587699] binder: 14308 RLIMIT_NICE not set 01:56:38 executing program 3: r0 = socket$inet(0x2, 0x3, 0x2) connect$inet(0xffffffffffffffff, &(0x7f0000000000)={0x2, 0x0, @local}, 0x10) setsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x23, &(0x7f0000000000)={{{@in=@multicast2, @in=@multicast1}}, {{@in6}, 0x0, @in6=@loopback}}, 0xe8) syz_emit_ethernet(0x2a, &(0x7f0000000640)={@random="b100485caa2a", @link_local, [], {@ipv4={0x800, {{0x5, 0x4, 0x6000000, 0x0, 0x1c, 0x0, 0x0, 0x0, 0x2, 0x0, @rand_addr, @broadcast}, @igmp={0x11, 0xffffffffffffffff, 0x0, @multicast1}}}}}, &(0x7f0000000140)) 01:56:38 executing program 4: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) ioctl$sock_SIOCETHTOOL(r0, 0x8946, &(0x7f0000000040)={'bond0\x00', &(0x7f0000000240)=ANY=[@ANYBLOB="4c010013100000be8f4d0462d7082b00"]}) 01:56:38 executing program 6: r0 = syz_open_dev$sndseq(&(0x7f0000000100)='/dev/snd/seq\x00', 0x0, 0x0) read(r0, &(0x7f0000fb6000)=""/28, 0x3f0) ioctl$SNDRV_SEQ_IOCTL_REMOVE_EVENTS(r0, 0x4040534e, &(0x7f00000001c0)={0xbf}) ioctl$SNDRV_SEQ_IOCTL_QUERY_SUBS(r0, 0xc058534f, &(0x7f00000002c0)={{}, 0x1, 0x0, 0x0, {}, 0x0, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xbf]}) r1 = gettid() timer_create(0x0, &(0x7f0000044000)={0x0, 0x12}, &(0x7f0000000040)) r2 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r2, 0x8912, &(0x7f00000001c0)="0a5cc80700315f85715070") timer_settime(0x0, 0x0, &(0x7f0000000080)={{0x0, 0x989680}, {0x0, 0x9}}, &(0x7f0000040000)) tkill(r1, 0x1000000000014) 01:56:38 executing program 2: r0 = socket$inet(0x2, 0x3, 0x2) connect$inet(0xffffffffffffffff, &(0x7f0000000000)={0x2, 0x0, @local}, 0x10) setsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x23, &(0x7f0000000000)={{{@in=@multicast2, @in=@multicast1}}, {{@in6}, 0x0, @in6=@loopback}}, 0xe8) syz_emit_ethernet(0x2a, &(0x7f0000000640)={@random="b100485caa2a", @link_local, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x1c, 0x0, 0x0, 0x0, 0x2, 0x0, @rand_addr, @broadcast}, @igmp={0x11, 0x0, 0x0, @multicast1}}}}}, &(0x7f0000000140)={0x0, 0x0, [0x0, 0x0, 0x7]}) 01:56:38 executing program 0: socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000001f80)={0xffffffffffffffff, 0xffffffffffffffff}) setsockopt$SO_ATTACH_FILTER(r2, 0x1, 0x1a, &(0x7f0000ab9ff0)={0x2, &(0x7f000039a000)=[{0x20, 0x0, 0x0, 0xfffffffffffff010}, {0x6}]}, 0x10) sendmmsg(r1, &(0x7f0000001e80)=[{{&(0x7f0000000700)=@l2={0x1f, 0x0, {}, 0x0, 0x0}, 0x80, &(0x7f0000001dc0)}}], 0x1, 0x0) 01:56:38 executing program 5: perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1f}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000340)={&(0x7f0000000000), 0xc, &(0x7f0000000300)={&(0x7f0000000240)=@newlink={0x50, 0x10, 0x721, 0x0, 0x0, {0x0, 0x0, 0x9000000}, [@IFLA_LINKINFO={0x28, 0x12, @veth={{0xc, 0x1, 'veth\x00'}, {0x18, 0x2, @VETH_INFO_PEER={0x14}}}}, @IFLA_NET_NS_FD={0x8}]}, 0x50}}, 0x0) 01:56:38 executing program 7: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000180)='/dev/sequencer\x00', 0x10002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000080)="0a5cc80700315f85715070") r1 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000001c0)={0x2, 0x0, &(0x7f0000000140)=ANY=[@ANYBLOB='\fc'], 0x0, 0x0, &(0x7f0000000080)}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, &(0x7f00000001c0)}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000040)={0x8, 0x6000000, &(0x7f00000000c0)=[@release={0x400c630f}], 0x1, 0x0, &(0x7f0000000100)='V'}) fstat(r0, &(0x7f00000002c0)) 01:56:38 executing program 1: r0 = socket$inet(0x2, 0x1, 0x0) r1 = open(&(0x7f0000000000)='./file0\x00', 0x0, 0x41) ioctl$PIO_CMAP(r1, 0x4b71, &(0x7f0000000040)={0xffff, 0x7fff, 0x5, 0x0, 0x0, 0x8}) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f0000000080)=@broute={'broute\x00', 0x20, 0x1, 0x240, [0x0, 0x0, 0x0, 0x0, 0x0, 0x20000280], 0x0, &(0x7f0000000240), &(0x7f0000000280)=[{0x0, '\x00', 0x0, 0xfffffffffffffffe}, {0x0, '\x00', 0x0, 0xffffffffffffffff}, {0x0, '\x00', 0x0, 0xfffffffffffffffe, 0x1, [{{{0x5, 0x0, 0x86dd, 'syzkaller0\x00', 'tunl0\x00', 'sit0\x00', 'ifb0\x00', @empty, [], @broadcast, [], 0x128, 0x160, 0x1b0, [@ip6={'ip6\x00', 0x50, {{@empty, @ipv4={[], [], @local}, [], [], 0x0, 0x0, 0x7fffffe}}}, @mark_m={'mark_m\x00', 0x18}]}, [@common=@dnat={'dnat\x00', 0x10, {{@broadcast}}}]}, @common=@LED={'LED\x00', 0x28, {{'syz0\x00'}}}}]}]}, 0x2b8) 01:56:39 executing program 3: r0 = socket$inet(0x2, 0x3, 0x2) connect$inet(0xffffffffffffffff, &(0x7f0000000000)={0x2, 0x0, @local}, 0x10) setsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x23, &(0x7f0000000000)={{{@in=@multicast2, @in=@multicast1}}, {{@in6}, 0x0, @in6=@loopback}}, 0xe8) syz_emit_ethernet(0x2a, &(0x7f0000000640)={@random="b100485caa2a", @link_local, [], {@ipv4={0x800, {{0x5, 0x4, 0x20000000, 0x0, 0x1c, 0x0, 0x0, 0x0, 0x2, 0x0, @rand_addr, @broadcast}, @igmp={0x11, 0xffffffffffffffff, 0x0, @multicast1}}}}}, &(0x7f0000000140)) 01:56:39 executing program 5: perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1f}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000340)={&(0x7f0000000000), 0xc, &(0x7f0000000300)={&(0x7f0000000240)=@newlink={0x50, 0x10, 0x721, 0x0, 0x0, {0x0, 0x0, 0x8100}, [@IFLA_LINKINFO={0x28, 0x12, @veth={{0xc, 0x1, 'veth\x00'}, {0x18, 0x2, @VETH_INFO_PEER={0x14}}}}, @IFLA_NET_NS_FD={0x8}]}, 0x50}}, 0x0) 01:56:39 executing program 1: syz_emit_ethernet(0x1, &(0x7f0000000080)=ANY=[@ANYBLOB="aaaaaaaaaaaaaaaaaaaaaa0086dd6050a0bc008000000000000000000000000000bbfe60ac0349"], &(0x7f0000000040)) r0 = socket(0xa, 0x2, 0x0) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000100)={'veth1_to_team\x00', &(0x7f00000000c0)=ANY=[@ANYBLOB="ffff00000000000000000000000000000000000002"]}) ioctl$BLKDISCARD(0xffffffffffffffff, 0x1277, &(0x7f0000000140)=0x9) setsockopt$inet_int(r0, 0x0, 0x40, &(0x7f0000000080), 0x4) 01:56:39 executing program 2: r0 = socket$inet(0x2, 0x3, 0x2) connect$inet(0xffffffffffffffff, &(0x7f0000000000)={0x2, 0x0, @local}, 0x10) setsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x23, &(0x7f0000000000)={{{@in=@multicast2, @in=@multicast1}}, {{@in6}, 0x0, @in6=@loopback}}, 0xe8) syz_emit_ethernet(0x2a, &(0x7f0000000640)={@random="b100485caa2a", @link_local, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x1c, 0x0, 0x0, 0x0, 0x2, 0x0, @rand_addr, @broadcast}, @igmp={0x11, 0x0, 0x0, @multicast1}}}}}, &(0x7f0000000140)={0x0, 0x0, [0x0, 0x0, 0xe0]}) 01:56:39 executing program 4: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) r1 = openat$full(0xffffffffffffff9c, &(0x7f0000000000)='/dev/full\x00', 0x8041, 0x0) getsockopt$inet6_IPV6_XFRM_POLICY(r1, 0x29, 0x23, &(0x7f0000000080)={{{@in6=@dev, @in6=@loopback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in=@local}, 0x0, @in=@remote}}, &(0x7f0000000180)=0xe8) ioctl$ifreq_SIOCGIFINDEX_vcan(r1, 0x8933, &(0x7f00000001c0)={'vcan0\x00', r2}) r3 = gettid() ioctl$TIOCGPGRP(r1, 0x540f, &(0x7f0000000200)=0x0) tgkill(r3, r4, 0x11) ioctl$sock_SIOCETHTOOL(r0, 0x8946, &(0x7f0000000040)={'bond0\x00', &(0x7f0000000240)=ANY=[@ANYBLOB="4c0037ff7f0000000000000000002300"]}) [ 685.087411] binder: 14369:14371 Acquire 1 refcount change on invalid ref 0 ret -22 01:56:39 executing program 3: r0 = socket$inet(0x2, 0x3, 0x2) connect$inet(0xffffffffffffffff, &(0x7f0000000000)={0x2, 0x0, @local}, 0x10) setsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x23, &(0x7f0000000000)={{{@in=@multicast2, @in=@multicast1}}, {{@in6}, 0x0, @in6=@loopback}}, 0xe8) syz_emit_ethernet(0x2a, &(0x7f0000000640)={@random="b100485caa2a", @link_local, [], {@ipv4={0x800, {{0x5, 0x4, 0x60000000, 0x0, 0x1c, 0x0, 0x0, 0x0, 0x2, 0x0, @rand_addr, @broadcast}, @igmp={0x11, 0xffffffffffffffff, 0x0, @multicast1}}}}}, &(0x7f0000000140)) 01:56:39 executing program 5: perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1f}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000340)={&(0x7f0000000000), 0xc, &(0x7f0000000300)={&(0x7f0000000240)=@newlink={0x50, 0x10, 0x721, 0x0, 0x0, {0x0, 0x0, 0x4}, [@IFLA_LINKINFO={0x28, 0x12, @veth={{0xc, 0x1, 'veth\x00'}, {0x18, 0x2, @VETH_INFO_PEER={0x14}}}}, @IFLA_NET_NS_FD={0x8}]}, 0x50}}, 0x0) 01:56:39 executing program 0: socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000001f80)={0xffffffffffffffff, 0xffffffffffffffff}) setsockopt$SO_ATTACH_FILTER(r2, 0x1, 0x1a, &(0x7f0000ab9ff0)={0x2, &(0x7f000039a000)=[{0x20, 0x0, 0x0, 0xfffffffffffff010}, {0x6}]}, 0x10) sendmmsg(r1, &(0x7f0000001e80)=[{{&(0x7f0000000700)=@l2={0x1f, 0x0, {}, 0x0, 0x0}, 0x80, &(0x7f0000001dc0)}}], 0x1, 0x0) 01:56:39 executing program 4: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) socketpair$inet_icmp_raw(0x2, 0x3, 0x1, &(0x7f0000000000)) ioctl$sock_SIOCETHTOOL(r0, 0x8946, &(0x7f0000000040)={'bond0\x00', &(0x7f0000000240)=ANY=[@ANYBLOB="4c000000000023000000000000000002"]}) 01:56:39 executing program 2: r0 = socket$inet(0x2, 0x3, 0x2) connect$inet(0xffffffffffffffff, &(0x7f0000000000)={0x2, 0x0, @local}, 0x10) setsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x23, &(0x7f0000000000)={{{@in=@multicast2, @in=@multicast1}}, {{@in6}, 0x0, @in6=@loopback}}, 0xe8) syz_emit_ethernet(0x2a, &(0x7f0000000640)={@random="b100485caa2a", @link_local, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x1c, 0x0, 0x0, 0x0, 0x2, 0x0, @rand_addr, @broadcast}, @igmp={0x11, 0x0, 0x0, @multicast1}}}}}, &(0x7f0000000140)={0x0, 0x0, [0x0, 0x0, 0x400300]}) [ 685.259074] binder: 14369:14371 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 685.383906] binder: 14371 RLIMIT_NICE not set [ 685.858868] binder: 14369:14425 Acquire 1 refcount change on invalid ref 0 ret -22 [ 685.866845] binder: 14369:14425 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 685.874224] binder: 14419 RLIMIT_NICE not set 01:56:39 executing program 6: r0 = syz_open_dev$sndseq(&(0x7f0000000100)='/dev/snd/seq\x00', 0x0, 0x0) read(r0, &(0x7f0000fb6000)=""/28, 0x3f0) ioctl$SNDRV_SEQ_IOCTL_REMOVE_EVENTS(r0, 0x4040534e, &(0x7f00000001c0)={0xbf}) ioctl$SNDRV_SEQ_IOCTL_QUERY_SUBS(r0, 0xc058534f, &(0x7f00000002c0)={{}, 0x1, 0x0, 0x0, {}, 0x0, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xe00000000000000]}) r1 = gettid() timer_create(0x0, &(0x7f0000044000)={0x0, 0x12}, &(0x7f0000000040)) r2 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r2, 0x8912, &(0x7f00000001c0)="0a5cc80700315f85715070") timer_settime(0x0, 0x0, &(0x7f0000000080)={{0x0, 0x989680}, {0x0, 0x9}}, &(0x7f0000040000)) tkill(r1, 0x1000000000014) 01:56:39 executing program 3: r0 = socket$inet(0x2, 0x3, 0x2) connect$inet(0xffffffffffffffff, &(0x7f0000000000)={0x2, 0x0, @local}, 0x10) setsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x23, &(0x7f0000000000)={{{@in=@multicast2, @in=@multicast1}}, {{@in6}, 0x0, @in6=@loopback}}, 0xe8) syz_emit_ethernet(0x2a, &(0x7f0000000640)={@random="b100485caa2a", @link_local, [], {@ipv4={0x800, {{0x5, 0x4, 0xf000, 0x0, 0x1c, 0x0, 0x0, 0x0, 0x2, 0x0, @rand_addr, @broadcast}, @igmp={0x11, 0xffffffffffffffff, 0x0, @multicast1}}}}}, &(0x7f0000000140)) 01:56:39 executing program 4: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) bpf$BPF_PROG_GET_NEXT_ID(0xb, &(0x7f0000000080)=0x100000000003, 0x139) ioctl$sock_SIOCETHTOOL(r0, 0x8946, &(0x7f0000000040)={'bond0\x00', &(0x7f0000000240)=ANY=[@ANYBLOB="4c000000000023000000000000000002"]}) 01:56:39 executing program 2: r0 = socket$inet(0x2, 0x3, 0x2) connect$inet(0xffffffffffffffff, &(0x7f0000000000)={0x2, 0x0, @local}, 0x10) setsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x23, &(0x7f0000000000)={{{@in=@multicast2, @in=@multicast1}}, {{@in6}, 0x0, @in6=@loopback}}, 0xe8) syz_emit_ethernet(0x2a, &(0x7f0000000640)={@random="b100485caa2a", @link_local, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x1c, 0x0, 0x0, 0x0, 0x2, 0x0, @rand_addr, @broadcast}, @igmp={0x11, 0x0, 0x0, @multicast1}}}}}, &(0x7f0000000140)={0x0, 0x0, [0x0, 0x0, 0x20000000]}) 01:56:39 executing program 5: perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1f}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000340)={&(0x7f0000000000), 0xc, &(0x7f0000000300)={&(0x7f0000000240)=@newlink={0x50, 0x10, 0x721, 0x0, 0x0, {0x0, 0x0, 0x100000000000000}, [@IFLA_LINKINFO={0x28, 0x12, @veth={{0xc, 0x1, 'veth\x00'}, {0x18, 0x2, @VETH_INFO_PEER={0x14}}}}, @IFLA_NET_NS_FD={0x8}]}, 0x50}}, 0x0) 01:56:39 executing program 0: socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000001f80)={0xffffffffffffffff, 0xffffffffffffffff}) setsockopt$SO_ATTACH_FILTER(r2, 0x1, 0x1a, &(0x7f0000ab9ff0)={0x2, &(0x7f000039a000)=[{0x20, 0x0, 0x0, 0xfffffffffffff010}, {0x6}]}, 0x10) sendmmsg(r1, &(0x7f0000001e80)=[{{&(0x7f0000000700)=@l2={0x1f, 0x0, {}, 0x0, 0x0}, 0x80, &(0x7f0000001dc0)}}], 0x1, 0x0) 01:56:39 executing program 1: r0 = openat$ipvs(0xffffffffffffff9c, &(0x7f0000000300)='/proc/sys/net/ipv4/vs/backup_only\x00', 0x2, 0x0) r1 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000180)='IPVS\x00') sendmsg$IPVS_CMD_SET_INFO(r0, &(0x7f0000000280)={&(0x7f0000000140)={0x10, 0x0, 0x0, 0x20}, 0xc, &(0x7f0000000240)={&(0x7f0000000400)=ANY=[@ANYBLOB="800000006ea7b45a88b1ef36aa57b8981bff56f7a1f6ceccf89e21e7259da2c089489c6ba5876997d93545d344e7dccd9adcf7be7634e612c2aeb4c602baa3141a7f75efd185f0069c8d5af1c7701e2a3fb97d7ab44a43a705c425739787ef35848a28fcb47a3160d51eae", @ANYRES16=r1, @ANYBLOB="020025bd7000fbdbdf250e00000008000500010000000c00020008000800070000001400030008000400ab000000080007004e2000003c000200080009008700000008000b000200000008000700000000000800060000000000080002004e240000080004000000000008000700900f000008000500ff0f0000"], 0x80}, 0x1, 0x0, 0x0, 0x4000}, 0x11) r2 = openat$ion(0xffffffffffffff9c, &(0x7f00000003c0)='/dev/ion\x00', 0x0, 0x0) pwrite64(r0, &(0x7f0000000340)="e23ae6e6702149b4556a1e2ebe7efd3384672d264e7aa7d7364779dbfdbf66c8b42dec656e10417c7b593174df84ccee87c2e274a195243be9886f32bf7c444313cfb99d4916", 0x46, 0x0) ioctl$ION_IOC_ALLOC(r2, 0xc0184900, &(0x7f0000000000)={0x5, 0x1, 0x0, 0xffffffffffffffff}) ioctl$DMA_BUF_IOCTL_SYNC(r3, 0x40086200, &(0x7f0000000040)=0x1) r4 = dup2(r2, r3) getsockopt$bt_rfcomm_RFCOMM_LM(r4, 0x12, 0x3, &(0x7f0000000080), &(0x7f00000000c0)=0x4) 01:56:39 executing program 7: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000180)='/dev/sequencer\x00', 0x10002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000080)="0a5cc80700315f85715070") r1 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000001c0)={0x2, 0x0, &(0x7f0000000140)=ANY=[@ANYBLOB='\fc'], 0x0, 0x0, &(0x7f0000000080)}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, &(0x7f00000001c0)}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000040)={0x8, 0xa00, &(0x7f00000000c0)=[@release={0x400c630f}], 0x1, 0x0, &(0x7f0000000100)='V'}) fstat(r0, &(0x7f00000002c0)) 01:56:39 executing program 4: perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1f}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_open_procfs(0x0, &(0x7f0000000140)='net/ip6_tables_matches\x00') readv(r0, &(0x7f0000000200)=[{&(0x7f00000002c0)=""/164, 0xa4}], 0x1) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) ioctl$sock_SIOCETHTOOL(r1, 0x8946, &(0x7f0000000040)={'bond0\x00', &(0x7f0000000240)=ANY=[@ANYBLOB="4c000000000023000000000000000002"]}) 01:56:39 executing program 1: r0 = socket$kcm(0x29, 0x1000000000000005, 0x0) io_submit(0x0, 0x1, &(0x7f0000001dc0)=[&(0x7f00000014c0)={0x0, 0x0, 0x0, 0x0, 0x0, r0, &(0x7f0000001440), 0x0, 0xfffffffffffffffd}]) r1 = socket$inet_tcp(0x2, 0x1, 0x0) io_setup(0x2, &(0x7f0000000080)=0x0) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(0xffffffffffffff9c, 0x84, 0x6f, &(0x7f00000000c0)={0x0, 0xbd, &(0x7f00000014c0)}, &(0x7f0000000100)=0x10) r3 = syz_open_dev$midi(&(0x7f0000000000)='/dev/midi#\x00', 0x0, 0x381080) write$cgroup_subtree(r3, &(0x7f0000000040)={[{0x2b, 'memory'}, {0x0, 'io'}]}, 0xc) write$UHID_INPUT(r3, &(0x7f0000000140)={0x8, "e13a85e8cb0c4d5884db62dc54fa68fcfd91c4172b60e0d88ccfe058e61807ccdafa484a1b077fa76897ca070b4d5dc9b6f2cbe06cb9c33a3e17261cfa66ec212aea2f65730b19e2ab11bcf2517e6fdcabef508a5f4c2d5b7fe1c33085824a86c991ecc8b286ce0222e2cbf80d520eb441d8f54f1bda2244c3daab9a968a276cb09d33e7631b9e05e7105bfe7d9ee7c91193b791fbd11c94e63edb899059b1403d50bd535f97af4cac039e2c2b24bb9872f81230c6c86cedd447e6fc2e305ffa7dbb08505eb6347edbae20fc97c9d00f14d4edbbe82826c96796270bb5a4fb1d35f78a1403260bc8ab1e4b4d7c39c75eac917cf73e67e1dcc8d36197929d87722651e9d07d83a3da8e4916edb8c648066bea24639998a087a27c3ed5298b91fd73f77732a059c49e0bd1f3c7a0371d94fab7456e7c48512f0a779db268b99add3a0a523f6fa30f33e38b93c1fdbeb44cea60f173f909991fe27018993934b956c21c11993eb4b64c893e60c16309ea77ac180b939fe8ce47dd20a132c0c280fa1aafe936cb973453b9a35e77881e4c0ae1513357224da30d38a68da042916da1675baaa0c14dd73102329a481c2c3dd468f9775d74351bb149c7d0d1ab99cb6ff2fbaa026770202585ef463df4d0262ec6755a2a378453d63e65f6bc673d503aa7ee09338f2d0f029602731fca2bd8e230f8a63edb05e0afdcc69dc03c4dbfb764491fd6e905d7ff07088cdf1147e7ca192c150e43140b930f12d43eea6c4179664009d21dd36e96b21408bd299591418de27e2b41ac99fcb0248dab2c4d93f95a819be98f42ed4eca76ab0f3599b6717f6996c33f4370cb6766a9c92a79ce96876f48bc7f46611efb454c6d94a230b7e887333dfa1f8d431b699646d96ad6c572f562279b1e9037dfa827ad801e8b36ece59055f08fd1726bdfc059de744076f511b6a7633c2f4f1ef499df1eb16d1991b7e509edefa85713c6621fcb66b3076554c22ae442373e9314bfdd24b94e0c48e84ac6dd89b5e3ff3189dcc71c3dd7ccf95dbd45d5893ae69964735a4f0662cd5e7f0504acc1f640718b03797b6c1632ed4b05d68b528cb27bf2c8e5f7e631b0777ae59e56f3ab46ed05bb0f70416585227c74c47892e7412f0f6b08bb7b564e54fbf2fb449cd62dda20bd6125b2c73918f682514d74441afb7109e5f3ab408bd679d951701eb6222b0d3eacbc0bdcc269391347e31eff157e546190727f3a81abd2e25520cd049a391a76f9259fa4ae5fbad396bebe98140f30377ef7ffd07db764de6fec4e9aaf7c5a8f671afbc6403f2400f9ffc3b5fdfea0be1793c12ad7e684afb0fd5c12bf378ed313d7073035a25023bea33b31957387c529b6de5f1f71e86112b28a155e3447809fa4b368bc321e165d11dd6e875ea912fb14261e28ff517f0be9e3c1e07339a605c8f06dbd78ff4152dbddc428dbbaa730b74fd410aa4bbf3bf23c9b53834c9d62b067d92d5a7ae156be7b789a8c2bf98b369f08dadf4cb4f9184ed04d38ec76a858f6234557878b1f0b4633d8a0faeae93a07e2bfdf57d18831fc500ab8bcad57a4aa1089aaad62df297026bfaf0a1f8694862508d8787d2853762d12e9bd3fced1ece57a8a7ef0b5c3b78019a2f7440b8a672d862c8bfc802fba6ebca2bb5d8411f0595119a1f3215d3b18115a8b90281d8c7b2fd70264436aca2a1ba7c7cb37e629489a20a303f6121b57570ca52375448eefb769e04a434be7579b2cba6030ff7c505581998380a3e969be85e2c89e2bdba04e4c870ea52f84484e48b787863b8b1b2fdfa6b4bc3b3802b67a52575772e18225a281ec30fb32f18a8afb860ee3beb529d2d42f027330cfb013607157b1bcb0c17820576a0ba27baa2469f216c80d6b02379d92898252346ab1ac46c6afbbc481c55d8b37e10187a564a3736655513ad00be52e5cdabeafcbfd81a1a53dd65b8703904bb9d2d4b713c46a1990c7f90c47844c3cf5ba3ab85d2155c5fa49283a3a767c7935529ae45a3960586abd52a1457dafdc49f474d56a2eaca05030527b30cbf3f36440135d431f99384d33f94fe469eb4a486269dfa86f09583db620abf46d02f823c316b69171829e4914e83c4f713d760801e3fb66cc6338582fd0f908b960096fce3d99e6191549e39af21cdf734c810d68e48247ef06cf1b48666202b38f56b2184df83a454d662f5fa2172575c640906c2dc8641250253cec43dd271234e7e18d898e04f89400160b1979e2df8e7e69477a2ad9533665073ce6356a53b7a97b6d4433a8a358b10fb71d783c8106af6715a52962600bd42ab62961e41bca212099761232189be3510d1703b502e4e60a344b6f443ebef54f2fd0d4ec93384555438b87f04998fd1ef16d6d92c1019c857b8673845423499371a012809c4f370e46447e8d26dc0344fb40db26dd2ed31cd566d20c4d3e1fccd45902275ce6139dbf8f7bc965aed7292a9b9a35725db7bcda432f5988b68e29b0416f69da6dbda6c36fa09d2129e84a49892212aaac8166aae64ff471a93d666f1622f3e2d890ebd893ff290fba3db545900083a5b78568cd70a404df68c2aabe4f5a8105c0098c77c3c8f51e738124b93d985fc095b48acbf74714e6c0332cf1ac68c569ee34aded90c97291dbbda192581615100873e5b470fbaefbfbb023f139421bbe6e36ab9a0730b45ee61ab8e86c5334b94acd9451692625938af2940ebdd87bd65a4ff2adaff694ae31d4be5d9ad20c8a25c2c8a878f5399c905eadd9b5ef32ef4d397d86032bd728c88a9ee4ac701d66caac11ccf6107b0ec881411a56c8dfb629e7a6f08c7a977767cee7c6e0a0877499dbced878ed9d1e2ba9215265d511b2ec920a56be9e68b9e1204b7b5187ed19b7b7b21a98dace4ac27a189cc4baed069d11c17a082a6e8daaf67160befa8bdf2d20f255b73c6f3367f8f4d5f0856d859ddb497f840116877eb2d793fb9fccbf7bc90a70732a955957cbb0f5b24652bfca0483c864dd60292fa3cd1e0d8bdb11ebfc9d926fd7b87960f60507f55acaa467ba8c32adaa41fb622b0fc6095fb8e2fffea3d8636b4204832307fbc6936568a02c5a1de06d1fb993a0feae879fb70a55c3966cd78949cb133911a5930425c334a1300ddb2198914d9f16ca52f170389fb44f23b0668be3fcf240c846918ce887eb4588df282917f21a8e581e0ccac49c341bf260d1b8556cb7feb79bcd33c0b9ef1f59606836351b499a8ebff797134f710e90c943f38c027492ec8ed2233c50c6fdf6982500aa4d06765878ea981bd9b9e6274d1477adad77caca62e65772f3cbe082d181a21e0a9123907026f8cb3d59b58daedd89cd15a762190364793a7d228d7a10114cbe41a1143a17c5f0ff4030af6918584f09679613e341016eb3a2d7d4309299e773b7153c96087800812acf88fcd7b18aaabe0ce95f218a6478eb8b7566a1588ab585a8dc45942554fb1c2bf85264f453dfecbf91aa174d09a63e03b026364a1a2589b4cc69bca8152e371955a008891d944171904f0c6db0de6f4a4f575364c472fdb4dbad1c7a4ad6b51b3caeaf05bcb30986294c309ae324138fe1cbe8f47fea2a2b149889a75759828297974e9905c794c922507ef2e7e44dcdf812bba16bbb17a1593f5cab38eee96293f3071434c92c8f20cc2157a1c1027faa73a1e48cdf7c943dab6aea5af14dc1a3586f6e9fcdc72ce3886581d8e45e47b0742c17966aee6123b4a0f07e31f12f3c2554df5b0e395a3dd9f504cb8e1002abb79487e6f900d9f6d1decde19bd4942c8c6c02cc4e6babea2c1c76fe9d5d744e0cfeee38085c95a0e4feed49e042f6fbe99136b2e180369d8f8be6e41e009ff45c2fc51e8383bade9f35f25ff4a2db9620feeec37b1b8ebcc2c4864d7ce9c34c034b4a857fbf51379aafc450afdc1223b2c29569479505b0a14181e2eb0210391c1ccebe4f540735b0ebe8a438e8aafcb95432c092243bd0a79caf6b8cfab38f73b8e72b5266aa937542ee2b86999df0a878478468ad57699fd0e893c0d92fea721c312b26e3bbe73fd9eb1c3df51e710b445a3af9967a4bd9789eaa14e16c1a04c0a6a4bb1762bba380fd9428566dd77ab71fa399df814db186c42dcef7ef26d54b558aa815afb3b5c48d20a547f72af8cc0b349370caa359b8363fd467b417fe0d0f20d7e08e3b5b5214413bf71201fdea87bb4eafbfaea3497827c602cf710cfadef5f4839571b4547be5254faf090cb57ece861a969e20a1a4a601cc760c28b9e5617a905825c43ac508784c71c023b4d5f4438ca8b05924133d3c3a5279c50b4d4aeef0714a44c6957dff17fa629e1170aeab0fe5b24cfdf48fe33c99d132036f574947f0a58c50b1dda2a5505498fdd57c6dc4f7fa9fe3f2cd9ad1e8f4430c3db9821d880585191bbf49dc15dd9977d8e535ad0c0718d9bc1030cdd7e959ffc4456424ab12d580d0f72d967804699dc66d398439b2399567e2e1f54e7f931b23daba3b38c0aa5dbfb216308ae32de97f1eb638367bd40d654e2224f26accdd58eab128ae760e4412288d950b0d866cacdce703c317a1dc2bf8a082a7872e1481f2aaafd3734f94c7a919f53ef4c5ec55ed2f4ec06e66b9200af528fa679d939c78cf5f11687ced82407a96f802792a8634cd257b84413a386365ec9b7ebe12edde50d92c8dae466ef47f32363c0bfcbd2fcb258d01d52aabb47d9f0b5792632ff43166ee85e73f5ce831bfd2b9d020c7ea73d803b26a139e2ec666f1539fe282543bbefc91aa6333a1aaacf49bb6d975854f87cd294607fc07c25a1532fa673628393de2bdf2017df5f8dbc9913e8cbf56699ff553af84ec5df2e025ecbc51c918d4e417aff428c0ed7b7ee5f6f8daa08c8712a4d79093f17f8c451afc005f15a501721f7555c02aa3444196fdaf261751812c7487efadee2609fab00fce2d1168f44abf67979e70534f0d59223f4db81ad12bfc85fa13c295a1081c14401b76fe02de017633f3dac651ec52f234a9c82fe899036a20b32d56a72fadf710884a5d145c61d6d7567c745a78ee986946ce3b8d1088d0d6266e35f74ea44336e9f2b1b261964256510fd1032ca8180d1132b60ec7040e268ce55eb5a7cbfb73b582427bcbfdc8ed2f1b167a3826150875d6c6e0e46e55b6bea06fdcfc26baa604236475c1d112f0dc85fb1ebdbdb4436a15e2381fef2fbbe790603291acfb95ade3099e594581a361628e024235bde992cd36ddccdfb792e6f55bbf64722902359422a910182af1ab523b5ba223b374d8444b520e79384e12d05a701c2af0fd736c7c762c3f4908c0a51bbd82fe1aad949a4bec2efcf9fdfe8052499d8ded3d632773550aeba6e2bac6d8c62bec49fdbf392d36385ad5849842fdeb44571ed08c947a57971011ae33dcbaecb23c3364bc653261d87302b2034f1cf602001cadea3878ea6183d7649dd0872b3643692f8bd721ff73d0fdfc765b04f9fe9446aca98901151f3081fba8cc60f4adaa4425f9e94f68f6503f022692810315b7e427f653279f0d711d9b24b220a2123831b66333ef8902c2a63c9c90029a2a154f17735e474826a4d76f18cfc21f044b7c1c5c9856e1a10caf95428f28f4f496d5a06ce709f4d95e891bc5889f08b4ff290278bae3a9773a5e32edb2159571d41e1baa017e8935cb6c3acb07c9363aad697cbdcad51c6b80eecef41d97fce36ebb6b76ad6e2f03ddf121bdecfcd12e9385c8ddefaf86fae17b39d439531ee028eca913643b9f56aeaf96ae3b", 0x1000}, 0x1006) io_submit(r2, 0x12f, &(0x7f00000000c0)=[&(0x7f0000000100)={0x0, 0x0, 0x0, 0x0, 0x0, r1, &(0x7f0000001000)}]) 01:56:39 executing program 3: r0 = socket$inet(0x2, 0x3, 0x2) connect$inet(0xffffffffffffffff, &(0x7f0000000000)={0x2, 0x0, @local}, 0x10) setsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x23, &(0x7f0000000000)={{{@in=@multicast2, @in=@multicast1}}, {{@in6}, 0x0, @in6=@loopback}}, 0xe8) syz_emit_ethernet(0x2a, &(0x7f0000000640)={@random="b100485caa2a", @link_local, [], {@ipv4={0x800, {{0x5, 0x4, 0x1c00, 0x0, 0x1c, 0x0, 0x0, 0x0, 0x2, 0x0, @rand_addr, @broadcast}, @igmp={0x11, 0xffffffffffffffff, 0x0, @multicast1}}}}}, &(0x7f0000000140)) 01:56:39 executing program 5: perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1f}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000340)={&(0x7f0000000000), 0xc, &(0x7f0000000300)={&(0x7f0000000240)=@newlink={0x50, 0x10, 0x721, 0x0, 0x0, {0x0, 0x0, 0x800000000000000}, [@IFLA_LINKINFO={0x28, 0x12, @veth={{0xc, 0x1, 'veth\x00'}, {0x18, 0x2, @VETH_INFO_PEER={0x14}}}}, @IFLA_NET_NS_FD={0x8}]}, 0x50}}, 0x0) 01:56:39 executing program 2: r0 = socket$inet(0x2, 0x3, 0x2) connect$inet(0xffffffffffffffff, &(0x7f0000000000)={0x2, 0x0, @local}, 0x10) setsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x23, &(0x7f0000000000)={{{@in=@multicast2, @in=@multicast1}}, {{@in6}, 0x0, @in6=@loopback}}, 0xe8) syz_emit_ethernet(0x2a, &(0x7f0000000640)={@random="b100485caa2a", @link_local, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x1c, 0x0, 0x0, 0x0, 0x2, 0x0, @rand_addr, @broadcast}, @igmp={0x11, 0x0, 0x0, @multicast1}}}}}, &(0x7f0000000140)={0x0, 0x0, [0x0, 0x0, 0xe0000000]}) [ 686.062315] binder: 14450:14451 Acquire 1 refcount change on invalid ref 0 ret -22 01:56:40 executing program 0: socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000001f80)={0xffffffffffffffff, 0xffffffffffffffff}) setsockopt$SO_ATTACH_FILTER(r2, 0x1, 0x1a, &(0x7f0000ab9ff0)={0x2, &(0x7f000039a000)=[{0x20, 0x0, 0x0, 0xfffffffffffff010}, {0x6}]}, 0x10) sendmmsg(r1, &(0x7f0000001e80)=[{{&(0x7f0000000700)=@l2={0x1f, 0x0, {}, 0x0, 0x0}, 0x80, &(0x7f0000001dc0)}}], 0x1, 0x0) 01:56:40 executing program 3: r0 = socket$inet(0x2, 0x3, 0x2) connect$inet(0xffffffffffffffff, &(0x7f0000000000)={0x2, 0x0, @local}, 0x10) setsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x23, &(0x7f0000000000)={{{@in=@multicast2, @in=@multicast1}}, {{@in6}, 0x0, @in6=@loopback}}, 0xe8) syz_emit_ethernet(0x2a, &(0x7f0000000640)={@random="b100485caa2a", @link_local, [], {@ipv4={0x800, {{0x5, 0x4, 0x8, 0x0, 0x1c, 0x0, 0x0, 0x0, 0x2, 0x0, @rand_addr, @broadcast}, @igmp={0x11, 0xffffffffffffffff, 0x0, @multicast1}}}}}, &(0x7f0000000140)) 01:56:40 executing program 1: r0 = openat$zero(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/zero\x00', 0x40000, 0x0) r1 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000140)='IPVS\x00') sendmsg$IPVS_CMD_DEL_SERVICE(r0, &(0x7f00000002c0)={&(0x7f0000000100), 0xc, &(0x7f0000000280)={&(0x7f0000000180)={0xe4, r1, 0x208, 0x70bd28, 0x25dfdbff, {}, [@IPVS_CMD_ATTR_DAEMON={0x74, 0x3, [@IPVS_DAEMON_ATTR_MCAST_IFN={0x14, 0x2, 'ipddp0\x00'}, @IPVS_DAEMON_ATTR_MCAST_PORT={0x8, 0x7, 0x4e24}, @IPVS_DAEMON_ATTR_MCAST_GROUP6={0x14}, @IPVS_DAEMON_ATTR_SYNC_MAXLEN={0x8, 0x4, 0xd2}, @IPVS_DAEMON_ATTR_MCAST_IFN={0x14, 0x2, 'team_slave_0\x00'}, @IPVS_DAEMON_ATTR_MCAST_IFN={0x14, 0x2, 'veth0_to_team\x00'}, @IPVS_DAEMON_ATTR_MCAST_TTL={0x8, 0x8, 0x4}, @IPVS_DAEMON_ATTR_MCAST_GROUP={0x8}]}, @IPVS_CMD_ATTR_TIMEOUT_TCP={0x8, 0x4, 0x8647426}, @IPVS_CMD_ATTR_SERVICE={0x20, 0x1, [@IPVS_SVC_ATTR_PE_NAME={0x8, 0xb, 'sip\x00'}, @IPVS_SVC_ATTR_FLAGS={0xc, 0x7, {0x1, 0x20}}, @IPVS_SVC_ATTR_AF={0x8, 0x1, 0xa}]}, @IPVS_CMD_ATTR_DAEMON={0x1c, 0x3, [@IPVS_DAEMON_ATTR_MCAST_GROUP={0x8}, @IPVS_DAEMON_ATTR_MCAST_GROUP={0x8, 0x5, @local}, @IPVS_DAEMON_ATTR_MCAST_PORT={0x8, 0x7, 0x4e24}]}, @IPVS_CMD_ATTR_TIMEOUT_TCP_FIN={0x8, 0x5, 0xffffffff}, @IPVS_CMD_ATTR_TIMEOUT_UDP={0x8, 0x6, 0xfffffffffffffffb}, @IPVS_CMD_ATTR_TIMEOUT_TCP={0x8, 0x4, 0x7}]}, 0xe4}, 0x1, 0x0, 0x0, 0x840}, 0x20000000) r2 = socket$inet_udp(0x2, 0x2, 0x0) open$dir(&(0x7f0000000000)='./file0\x00', 0x400383, 0x100) setsockopt$inet_int(r2, 0x0, 0x2, &(0x7f0000000080), 0x4) setsockopt$inet_MCAST_JOIN_GROUP(r0, 0x0, 0x2a, &(0x7f0000000300)={0x2, {{0x2, 0x4e20, @loopback}}}, 0x88) setsockopt$inet_int(r2, 0x0, 0x1f, &(0x7f0000000040)=0x4, 0x4) [ 686.182776] binder: 14450:14451 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 686.262777] binder: 14450:14481 Acquire 1 refcount change on invalid ref 0 ret -22 [ 686.312090] binder: 14475 RLIMIT_NICE not set [ 686.317600] binder: 14450:14481 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 01:56:40 executing program 2: r0 = socket$inet(0x2, 0x3, 0x2) connect$inet(0xffffffffffffffff, &(0x7f0000000000)={0x2, 0x0, @local}, 0x10) setsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x23, &(0x7f0000000000)={{{@in=@multicast2, @in=@multicast1}}, {{@in6}, 0x0, @in6=@loopback}}, 0xe8) syz_emit_ethernet(0x2a, &(0x7f0000000640)={@random="b100485caa2a", @link_local, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x1c, 0x0, 0x0, 0x0, 0x2, 0x0, @rand_addr, @broadcast}, @igmp={0x11, 0x0, 0x0, @multicast1}}}}}, &(0x7f0000000140)={0x0, 0x0, [0x0, 0x0, 0x1c00]}) 01:56:40 executing program 5: perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1f}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000340)={&(0x7f0000000000), 0xc, &(0x7f0000000300)={&(0x7f0000000240)=@newlink={0x50, 0x10, 0x721, 0x0, 0x0, {0x0, 0x0, 0xb000000}, [@IFLA_LINKINFO={0x28, 0x12, @veth={{0xc, 0x1, 'veth\x00'}, {0x18, 0x2, @VETH_INFO_PEER={0x14}}}}, @IFLA_NET_NS_FD={0x8}]}, 0x50}}, 0x0) 01:56:40 executing program 6: r0 = syz_open_dev$sndseq(&(0x7f0000000100)='/dev/snd/seq\x00', 0x0, 0x0) read(r0, &(0x7f0000fb6000)=""/28, 0x3f0) ioctl$SNDRV_SEQ_IOCTL_REMOVE_EVENTS(r0, 0x4040534e, &(0x7f00000001c0)={0xbf}) ioctl$SNDRV_SEQ_IOCTL_QUERY_SUBS(r0, 0xc058534f, &(0x7f00000002c0)={{}, 0x1, 0x0, 0x0, {}, 0x0, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xe]}) r1 = gettid() timer_create(0x0, &(0x7f0000044000)={0x0, 0x12}, &(0x7f0000000040)) r2 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r2, 0x8912, &(0x7f00000001c0)="0a5cc80700315f85715070") timer_settime(0x0, 0x0, &(0x7f0000000080)={{0x0, 0x989680}, {0x0, 0x9}}, &(0x7f0000040000)) tkill(r1, 0x1000000000014) 01:56:40 executing program 4: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) r1 = openat$zero(0xffffffffffffff9c, &(0x7f0000000000)='/dev/zero\x00', 0x80000, 0x0) getsockopt$inet_sctp6_SCTP_GET_ASSOC_STATS(0xffffffffffffffff, 0x84, 0x70, &(0x7f0000000080)={0x0, @in={{0x2, 0x4e20, @remote}}, [0x1, 0x7, 0x9, 0x1, 0xc50, 0x9, 0x80, 0x8, 0xffff, 0x2, 0x6, 0xae71, 0x79, 0xd586, 0x3]}, &(0x7f0000000180)=0x100) getsockopt$inet_sctp6_SCTP_PEER_ADDR_THLDS(r1, 0x84, 0x1f, &(0x7f0000000280)={r2, @in6={{0xa, 0x4e23, 0x7bff, @mcast1, 0x7}}, 0x2, 0x6}, &(0x7f00000001c0)=0x90) ioctl$sock_SIOCETHTOOL(r0, 0x8946, &(0x7f0000000040)={'bond0\x00', &(0x7f0000000240)=ANY=[@ANYBLOB="4c000000000023000000000000000002"]}) 01:56:40 executing program 3: r0 = socket$inet(0x2, 0x3, 0x2) connect$inet(0xffffffffffffffff, &(0x7f0000000000)={0x2, 0x0, @local}, 0x10) setsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x23, &(0x7f0000000000)={{{@in=@multicast2, @in=@multicast1}}, {{@in6}, 0x0, @in6=@loopback}}, 0xe8) syz_emit_ethernet(0x2a, &(0x7f0000000640)={@random="b100485caa2a", @link_local, [], {@ipv4={0x800, {{0x5, 0x4, 0xe0, 0x0, 0x1c, 0x0, 0x0, 0x0, 0x2, 0x0, @rand_addr, @broadcast}, @igmp={0x11, 0xffffffffffffffff, 0x0, @multicast1}}}}}, &(0x7f0000000140)) 01:56:40 executing program 1: r0 = socket$inet_tcp(0x2, 0x1, 0x0) r1 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000040)='/dev/vga_arbiter\x00', 0x101800, 0x0) setsockopt$inet_sctp_SCTP_INITMSG(r1, 0x84, 0x2, &(0x7f0000000100)={0x8, 0x5, 0xd1b, 0x7fffffff}, 0x8) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$sock_inet_SIOCDELRT(r0, 0x890b, &(0x7f0000000080)={0x0, {0x2, 0x0, @broadcast}, {0x2, 0x0, @multicast1}, {0x2, 0x0, @multicast2}, 0x1b4, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000000)='veth1\x00'}) 01:56:40 executing program 0: socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000001f80)={0xffffffffffffffff, 0xffffffffffffffff}) setsockopt$SO_ATTACH_FILTER(r2, 0x1, 0x1a, &(0x7f0000ab9ff0)={0x2, &(0x7f000039a000)=[{0x20, 0x0, 0x0, 0xfffffffffffff010}, {0x6}]}, 0x10) sendmmsg(r1, &(0x7f0000001e80)=[{{&(0x7f0000000700)=@l2={0x1f, 0x0, {}, 0x0, 0x0}, 0x80, &(0x7f0000001dc0)}}], 0x1, 0x0) 01:56:40 executing program 7: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000180)='/dev/sequencer\x00', 0x10002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000080)="0a5cc80700315f85715070") r1 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000001c0)={0x2, 0x0, &(0x7f0000000140)=ANY=[@ANYBLOB='\fc'], 0x0, 0x0, &(0x7f0000000080)}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, &(0x7f00000001c0)}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000040)={0x8, 0xffffff7f00000000, &(0x7f00000000c0)=[@release={0x400c630f}], 0x1, 0x0, &(0x7f0000000100)='V'}) fstat(r0, &(0x7f00000002c0)) 01:56:40 executing program 4: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) r1 = accept(r0, 0x0, &(0x7f0000000000)) getsockopt$inet_sctp_SCTP_STREAM_SCHEDULER(0xffffffffffffff9c, 0x84, 0x7b, &(0x7f0000000080)={0x0, 0x8d}, &(0x7f00000000c0)=0x8) getsockopt$inet_sctp6_SCTP_RESET_STREAMS(r1, 0x84, 0x77, &(0x7f0000000100)={r2, 0x3, 0x6, [0x2, 0x2, 0xf518, 0x100, 0x80000001, 0x200]}, &(0x7f0000000140)=0x14) ioctl$sock_SIOCETHTOOL(r0, 0x8946, &(0x7f0000000040)={'bond0\x00', &(0x7f0000000240)=ANY=[@ANYBLOB="4c000000000023000000000000000002"]}) 01:56:40 executing program 5: perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1f}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000340)={&(0x7f0000000000), 0xc, &(0x7f0000000300)={&(0x7f0000000240)=@newlink={0x50, 0x10, 0x721, 0x0, 0x0, {0x0, 0x0, 0x9}, [@IFLA_LINKINFO={0x28, 0x12, @veth={{0xc, 0x1, 'veth\x00'}, {0x18, 0x2, @VETH_INFO_PEER={0x14}}}}, @IFLA_NET_NS_FD={0x8}]}, 0x50}}, 0x0) 01:56:40 executing program 2: r0 = socket$inet(0x2, 0x3, 0x2) connect$inet(0xffffffffffffffff, &(0x7f0000000000)={0x2, 0x0, @local}, 0x10) setsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x23, &(0x7f0000000000)={{{@in=@multicast2, @in=@multicast1}}, {{@in6}, 0x0, @in6=@loopback}}, 0xe8) syz_emit_ethernet(0x2a, &(0x7f0000000640)={@random="b100485caa2a", @link_local, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x1c, 0x0, 0x0, 0x0, 0x2, 0x0, @rand_addr, @broadcast}, @igmp={0x11, 0x0, 0x0, @multicast1}}}}}, &(0x7f0000000140)={0x0, 0x0, [0x0, 0x0, 0x3]}) 01:56:40 executing program 1: r0 = socket$inet_sctp(0x2, 0x1, 0x84) setsockopt$inet_sctp_SCTP_EVENTS(r0, 0x84, 0xb, &(0x7f0000000040)={0x0, 0x0, 0x0, 0x9, 0x0, 0x0, 0xfffffffffffffffc}, 0xb) fsync(r0) sendto$inet(r0, &(0x7f0000000380)="f2", 0x1, 0x0, &(0x7f0000000100)={0x2, 0x4e23, @loopback}, 0xfffffdb4) accept4$inet(r0, &(0x7f0000000000)={0x2, 0x0, @loopback}, &(0x7f0000000080)=0x10, 0x800) recvfrom$inet(r0, &(0x7f0000000100), 0xffffffffffffff6b, 0xfffffffffffffffe, &(0x7f0000000180)={0x2, 0x0, @multicast2}, 0x704000) [ 686.948460] binder: 14516:14517 Acquire 1 refcount change on invalid ref 0 ret -22 [ 686.975251] binder: 14516:14517 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 686.984718] binder: 14517 RLIMIT_NICE not set 01:56:40 executing program 3: r0 = socket$inet(0x2, 0x3, 0x2) connect$inet(0xffffffffffffffff, &(0x7f0000000000)={0x2, 0x0, @local}, 0x10) setsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x23, &(0x7f0000000000)={{{@in=@multicast2, @in=@multicast1}}, {{@in6}, 0x0, @in6=@loopback}}, 0xe8) syz_emit_ethernet(0x2a, &(0x7f0000000640)={@random="b100485caa2a", @link_local, [], {@ipv4={0x800, {{0x5, 0x4, 0x4000000, 0x0, 0x1c, 0x0, 0x0, 0x0, 0x2, 0x0, @rand_addr, @broadcast}, @igmp={0x11, 0xffffffffffffffff, 0x0, @multicast1}}}}}, &(0x7f0000000140)) 01:56:40 executing program 0: socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000001f80)={0xffffffffffffffff, 0xffffffffffffffff}) setsockopt$SO_ATTACH_FILTER(r2, 0x1, 0x1a, &(0x7f0000ab9ff0)={0x2, &(0x7f000039a000)=[{0x20, 0x0, 0x0, 0xfffffffffffff010}, {0x6}]}, 0x10) sendmmsg(r1, &(0x7f0000001e80)=[{{&(0x7f0000000700)=@l2={0x1f, 0x0, {}, 0x0, 0x0}, 0x80, &(0x7f0000001dc0)}}], 0x1, 0x0) 01:56:40 executing program 4: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) r1 = open(&(0x7f0000000000)='./file0\x00', 0x440000, 0x7) getsockopt$IP6T_SO_GET_REVISION_MATCH(0xffffffffffffffff, 0x29, 0x44, &(0x7f0000000280)={'NETMAP\x00'}, &(0x7f00000002c0)=0x1e) getsockopt$inet_sctp_SCTP_ASSOCINFO(0xffffffffffffff9c, 0x84, 0x1, &(0x7f0000000080)={0x0, 0x7fffffff, 0x9, 0x2566, 0x7, 0x87f6}, &(0x7f00000000c0)=0x14) setsockopt$inet_sctp6_SCTP_PEER_ADDR_THLDS(r1, 0x84, 0x1f, &(0x7f0000000100)={r2, @in={{0x2, 0x4e20, @loopback}}, 0x7fffffff, 0x1}, 0x90) getsockopt$inet_sctp6_SCTP_ASSOCINFO(r1, 0x84, 0x1, &(0x7f00000001c0)={r2, 0x100000001, 0x6, 0x100000001, 0x465, 0x250}, &(0x7f0000000200)=0x14) ioctl$sock_SIOCETHTOOL(r0, 0x8946, &(0x7f0000000040)={'bond0\x00', &(0x7f0000000240)=ANY=[@ANYBLOB="4c000000000023000000000000000002"]}) 01:56:41 executing program 5: perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1f}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000340)={&(0x7f0000000000), 0xc, &(0x7f0000000300)={&(0x7f0000000240)=@newlink={0x50, 0x10, 0x721, 0x0, 0x0, {0x0, 0x0, 0x34000}, [@IFLA_LINKINFO={0x28, 0x12, @veth={{0xc, 0x1, 'veth\x00'}, {0x18, 0x2, @VETH_INFO_PEER={0x14}}}}, @IFLA_NET_NS_FD={0x8}]}, 0x50}}, 0x0) 01:56:41 executing program 1: r0 = perf_event_open(&(0x7f0000000080)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xa018, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000040)}, 0x0, 0x0, 0x9}, 0x0, 0x0, 0xffffffffffffffff, 0x0) fcntl$F_GET_FILE_RW_HINT(r0, 0x40d, &(0x7f0000000100)) r1 = syz_open_dev$dmmidi(&(0x7f0000000000)='/dev/dmmidi#\x00', 0xff, 0x4000000000800) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(0xffffffffffffff9c, 0x84, 0x6f, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)}, &(0x7f0000000180)=0x10) setsockopt$inet_sctp_SCTP_AUTH_DEACTIVATE_KEY(r1, 0x84, 0x23, &(0x7f00000001c0)={r2, 0x5c8}, 0x8) 01:56:41 executing program 2: r0 = socket$inet(0x2, 0x3, 0x2) connect$inet(0xffffffffffffffff, &(0x7f0000000000)={0x2, 0x0, @local}, 0x10) setsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x23, &(0x7f0000000000)={{{@in=@multicast2, @in=@multicast1}}, {{@in6}, 0x0, @in6=@loopback}}, 0xe8) syz_emit_ethernet(0x2a, &(0x7f0000000640)={@random="b100485caa2a", @link_local, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x1c, 0x0, 0x0, 0x0, 0x2, 0x0, @rand_addr, @broadcast}, @igmp={0x11, 0x0, 0x0, @multicast1}}}}}, &(0x7f0000000140)={0x0, 0x0, [0x0, 0x0, 0x800000000000000]}) [ 687.717550] binder: 14516:14571 Acquire 1 refcount change on invalid ref 0 ret -22 [ 687.725456] binder: 14516:14571 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 687.732986] binder: 14530 RLIMIT_NICE not set 01:56:41 executing program 6: r0 = syz_open_dev$sndseq(&(0x7f0000000100)='/dev/snd/seq\x00', 0x0, 0x0) read(r0, &(0x7f0000fb6000)=""/28, 0x3f0) ioctl$SNDRV_SEQ_IOCTL_REMOVE_EVENTS(r0, 0x4040534e, &(0x7f00000001c0)={0xbf}) ioctl$SNDRV_SEQ_IOCTL_QUERY_SUBS(r0, 0xc058534f, &(0x7f00000002c0)={{}, 0x1, 0x0, 0x0, {}, 0x0, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xbf]}) r1 = gettid() timer_create(0x0, &(0x7f0000044000)={0x0, 0x12}, &(0x7f0000000040)) r2 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r2, 0x8912, &(0x7f00000001c0)="0a5cc80700315f85715070") timer_settime(0x0, 0x0, &(0x7f0000000080)={{0x0, 0x989680}, {0x0, 0x9}}, &(0x7f0000040000)) tkill(r1, 0x1000000000014) 01:56:41 executing program 3: r0 = socket$inet(0x2, 0x3, 0x2) connect$inet(0xffffffffffffffff, &(0x7f0000000000)={0x2, 0x0, @local}, 0x10) setsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x23, &(0x7f0000000000)={{{@in=@multicast2, @in=@multicast1}}, {{@in6}, 0x0, @in6=@loopback}}, 0xe8) syz_emit_ethernet(0x2a, &(0x7f0000000640)={@random="b100485caa2a", @link_local, [], {@ipv4={0x800, {{0x5, 0x4, 0xf0ffff, 0x0, 0x1c, 0x0, 0x0, 0x0, 0x2, 0x0, @rand_addr, @broadcast}, @igmp={0x11, 0xffffffffffffffff, 0x0, @multicast1}}}}}, &(0x7f0000000140)) 01:56:41 executing program 4: r0 = syz_open_dev$dmmidi(&(0x7f0000000080)='/dev/dmmidi#\x00', 0x81, 0x1) getsockopt$inet_sctp6_SCTP_RESET_STREAMS(0xffffffffffffff9c, 0x84, 0x77, &(0x7f0000000140)={0x0, 0x1, 0x6, [0xcba, 0x459b764e, 0x1, 0x65, 0x100000000, 0x9]}, &(0x7f0000000180)=0x14) setsockopt$IP6T_SO_SET_REPLACE(r0, 0x29, 0x40, &(0x7f00000002c0)=@filter={'filter\x00', 0xe, 0x4, 0x4d8, 0x0, 0x1e0, 0x1e0, 0x1e0, 0x0, 0x408, 0x408, 0x408, 0x408, 0x408, 0x4, &(0x7f0000000280), {[{{@uncond, 0x0, 0xc8, 0xf0}, @common=@unspec=@CONNSECMARK={0x28, 'CONNSECMARK\x00', 0x0, {0x1}}}, {{@uncond, 0x0, 0xc8, 0xf0}, @REJECT={0x28, 'REJECT\x00', 0x0, {0x8}}}, {{@uncond, 0x0, 0x200, 0x228, 0x0, {}, [@common=@rt={0x138, 'rt\x00', 0x0, {0x9, 0x800, 0x8, 0x5, 0x6, 0x7, [@empty, @loopback, @mcast2, @loopback, @mcast2, @dev={0xfe, 0x80, [], 0x11}, @mcast2, @empty, @remote, @mcast1, @ipv4={[], [], @rand_addr=0x1}, @dev={0xfe, 0x80, [], 0x13}, @empty, @dev={0xfe, 0x80, [], 0x21}, @mcast1, @dev={0xfe, 0x80, [], 0x18}]}}]}, @REJECT={0x28, 'REJECT\x00', 0x0, {0xf}}}], {{[], 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x538) r2 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000900)='net/rfcomm\x00') getsockopt$inet_sctp6_SCTP_AUTOCLOSE(r2, 0x84, 0x4, &(0x7f00000000c0), &(0x7f0000000100)=0x1) ioctl$KVM_SMI(r0, 0xaeb7) dup3(r0, r0, 0x80000) mq_timedsend(r0, &(0x7f0000000840)="d9cf722a47ff3300a15d4d6bec2e4fb22a5abf6368ca098a3807c03aa9e3f209074ec443a3cae0b7884ca4fbd50c0d555e27ec5a64763ef246347c3dc391617eaa58e25c553131870238657c22d3d71bd9de78bb8b", 0x55, 0xf8c, 0x0) setsockopt$inet_sctp6_SCTP_SET_PEER_PRIMARY_ADDR(r0, 0x84, 0x5, &(0x7f00000001c0)={r1, @in6={{0xa, 0x4e23, 0x4, @mcast1, 0x400}}}, 0x84) openat$uinput(0xffffffffffffff9c, &(0x7f00000008c0)='/dev/uinput\x00', 0x802, 0x0) r3 = socket$nl_netfilter(0x10, 0x3, 0xc) ioctl$sock_SIOCETHTOOL(r3, 0x8946, &(0x7f0000000040)={'bond0\x00', &(0x7f0000000000)=ANY=[@ANYRESHEX=r3]}) setsockopt$inet_sctp6_SCTP_CONTEXT(r0, 0x84, 0x11, &(0x7f0000000800)={r1, 0x6}, 0x8) 01:56:41 executing program 2: r0 = socket$inet(0x2, 0x3, 0x2) connect$inet(0xffffffffffffffff, &(0x7f0000000000)={0x2, 0x0, @local}, 0x10) setsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x23, &(0x7f0000000000)={{{@in=@multicast2, @in=@multicast1}}, {{@in6}, 0x0, @in6=@loopback}}, 0xe8) syz_emit_ethernet(0x2a, &(0x7f0000000640)={@random="b100485caa2a", @link_local, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x1c, 0x0, 0x0, 0x0, 0x2, 0x0, @rand_addr, @broadcast}, @igmp={0x11, 0x0, 0x0, @multicast1}}}}}, &(0x7f0000000140)={0x0, 0x0, [0x0, 0x0, 0x400000000000000]}) 01:56:41 executing program 1: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/ptmx\x00', 0x0, 0x0) tee(r0, r0, 0x401, 0x4) ioctl$TCSETS(r0, 0x40045431, &(0x7f00003b9fdc)) r1 = syz_open_pts(r0, 0x800) dup3(r1, r0, 0x0) select(0x40, &(0x7f0000000140)={0x1f}, &(0x7f0000000180), &(0x7f00000001c0), &(0x7f0000000200)) 01:56:41 executing program 5: perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1f}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000340)={&(0x7f0000000000), 0xc, &(0x7f0000000300)={&(0x7f0000000240)=@newlink={0x50, 0x10, 0x721, 0x0, 0x0, {0x0, 0x0, 0xf00000000000000}, [@IFLA_LINKINFO={0x28, 0x12, @veth={{0xc, 0x1, 'veth\x00'}, {0x18, 0x2, @VETH_INFO_PEER={0x14}}}}, @IFLA_NET_NS_FD={0x8}]}, 0x50}}, 0x0) 01:56:41 executing program 0: socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000001f80)={0xffffffffffffffff, 0xffffffffffffffff}) setsockopt$SO_ATTACH_FILTER(r2, 0x1, 0x1a, &(0x7f0000ab9ff0)={0x2, &(0x7f000039a000)=[{0x20, 0x0, 0x0, 0xfffffffffffff010}, {0x6}]}, 0x10) sendmmsg(r1, &(0x7f0000001e80)=[{{&(0x7f0000000700)=@l2={0x1f, 0x0, {}, 0x0, 0x0}, 0x80, &(0x7f0000001dc0)}}], 0x1, 0x0) 01:56:41 executing program 7: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000180)='/dev/sequencer\x00', 0x10002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000080)="0a5cc80700315f85715070") r1 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000001c0)={0x2, 0x0, &(0x7f0000000140)=ANY=[@ANYBLOB='\fc'], 0x0, 0x0, &(0x7f0000000080)}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, &(0x7f00000001c0)}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000040)={0x8, 0x200000000000000, &(0x7f00000000c0)=[@release={0x400c630f}], 0x1, 0x0, &(0x7f0000000100)='V'}) fstat(r0, &(0x7f00000002c0)) 01:56:41 executing program 3: r0 = socket$inet(0x2, 0x3, 0x2) connect$inet(0xffffffffffffffff, &(0x7f0000000000)={0x2, 0x0, @local}, 0x10) setsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x23, &(0x7f0000000000)={{{@in=@multicast2, @in=@multicast1}}, {{@in6}, 0x0, @in6=@loopback}}, 0xe8) syz_emit_ethernet(0x2a, &(0x7f0000000640)={@random="b100485caa2a", @link_local, [], {@ipv4={0x800, {{0x5, 0x4, 0xf0, 0x0, 0x1c, 0x0, 0x0, 0x0, 0x2, 0x0, @rand_addr, @broadcast}, @igmp={0x11, 0xffffffffffffffff, 0x0, @multicast1}}}}}, &(0x7f0000000140)) 01:56:41 executing program 5: perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1f}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000340)={&(0x7f0000000000), 0xc, &(0x7f0000000300)={&(0x7f0000000240)=@newlink={0x50, 0x10, 0x721, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0xf0ffffff00000000}, [@IFLA_LINKINFO={0x28, 0x12, @veth={{0xc, 0x1, 'veth\x00'}, {0x18, 0x2, @VETH_INFO_PEER={0x14}}}}, @IFLA_NET_NS_FD={0x8}]}, 0x50}}, 0x0) 01:56:41 executing program 2: r0 = socket$inet(0x2, 0x3, 0x2) connect$inet(0xffffffffffffffff, &(0x7f0000000000)={0x2, 0x0, @local}, 0x10) setsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x23, &(0x7f0000000000)={{{@in=@multicast2, @in=@multicast1}}, {{@in6}, 0x0, @in6=@loopback}}, 0xe8) syz_emit_ethernet(0x2a, &(0x7f0000000640)={@random="b100485caa2a", @link_local, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x1c, 0x0, 0x0, 0x0, 0x2, 0x0, @rand_addr, @broadcast}, @igmp={0x11, 0x0, 0x0, @multicast1}}}}}, &(0x7f0000000140)={0x0, 0x0, [0x0, 0x0, 0x2000]}) 01:56:41 executing program 4: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) pipe2(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}, 0x800) bpf$BPF_GET_PROG_INFO(0xf, &(0x7f00000001c0)={r2, 0x50, &(0x7f0000000140)={0x0, 0x0}}, 0x10) bpf$BPF_PROG_GET_FD_BY_ID(0xd, &(0x7f0000000200)=r3, 0x4) ioctl$EVIOCGREP(r1, 0x80084503, &(0x7f0000000080)=""/157) ioctl$sock_SIOCETHTOOL(r0, 0x8946, &(0x7f0000000040)={'bond0\x00', &(0x7f0000000240)=ANY=[@ANYBLOB="4c000000000023000000000000000002"]}) 01:56:41 executing program 1: r0 = socket$inet6(0xa, 0x7fffc, 0x43) setsockopt$inet6_group_source_req(r0, 0x29, 0x400000002e, &(0x7f0000000000)={0x1ff, {{0xa, 0x0, 0x1, @mcast2}}, {{0xa, 0x0, 0x7fffffff, @empty, 0x4}}}, 0x108) setsockopt$inet_icmp_ICMP_FILTER(r0, 0x1, 0x1, &(0x7f0000000140)={0x5}, 0x4) syz_emit_ethernet(0x388, &(0x7f00000001c0)={@random="cd390b081bf2", @local={[], 0xffffffffffffffff}, [], {@mpls_uc={0x8847, {[{0x40, 0x7, 0xbcf, 0x7}], @ipv6={0x7, 0x6, '9+\'', 0x34e, 0xb7, 0x80000000, @loopback, @remote, {[@hopopts={0x0, 0x1, [], [@padn={0x1, 0x4, [0x0, 0x0, 0x0, 0x0]}, @enc_lim={0x4, 0x1, 0x3f}]}, @fragment={0x2c, 0x0, 0x9, 0x5, 0x0, 0x7fffffff, 0x64}, @routing={0x5c, 0x2, 0x0, 0x7ff, 0x0, [@mcast2]}, @dstopts={0x2c, 0x6, [], [@enc_lim={0x4, 0x1, 0x4}, @enc_lim={0x4, 0x1, 0xfffffffffffff000}, @pad1, @pad1, @jumbo={0xc2, 0x4, 0x10000}, @jumbo={0xc2, 0x4, 0xabf3}, @hao={0xc9, 0x10, @loopback}, @jumbo={0xc2, 0x4, 0x9}, @ra={0x5, 0x2, 0x7fff}]}, @srh={0x2b, 0x6, 0x4, 0x3, 0x6ea6a1a2, 0x8, 0x2, [@loopback, @loopback, @mcast2]}, @fragment={0x7f, 0x0, 0x3, 0x857f, 0x0, 0x100000000, 0x66}, @srh={0x0, 0x4, 0x4, 0x2, 0x10001, 0x10, 0x4, [@remote, @mcast2]}, @fragment={0x33, 0x0, 0x3, 0x3, 0x0, 0x6, 0x66}, @srh={0x29, 0x6, 0x4, 0x3, 0x8, 0x28, 0x9, [@local, @local, @local]}, @fragment={0xc, 0x0, 0x101, 0x8000, 0x0, 0xff, 0x67}], @gre={{0x0, 0x0, 0x1, 0xc2, 0x0, 0x81, 0x0, 0x1, 0x880b, 0x67, 0x2, [0x100], "631faede44cc4ba5e15461651b0ad39350a4ef56cbd490855ce7da6e413d26aff310fd9552d84c4661eb02c92ea85c9a696fd159a8624bb2243afc21404233816e3399066ab6f2f22f4d056d171046ecdcf4f49f333a3e98a609a3063403e1f881756ca3e93df9"}, {0x0, 0x0, 0x9, 0x3, 0x0, 0x0, 0x800, [], "59116d859505646bb14d0b6e0be88e48a050f66c474944ef36bc653ec49c30c37a022f4b2bad61f18eb725b76f49fcc077a95a90e5a389eee70898cf21ed6f599f2c5ace9800fd9f26dacb"}, {0x6, 0x0, 0x7f, 0x6bfd, 0x0, 0x0, 0x86dd, [0x83, 0x400, 0x1f], "e660a85e89e5af34047dc3385f4ae5acb5d1db6fa54c7538ca937b4cbb4cf656f520f589238bb3db65f830c77815a3e55acc0dc19269d80cbf776b702cc6883849317a7fba5f0b6b29c02f45fcd950cc61732062b3f5e7669ef02625e1cbf859674d50a518788099145e715bdff02a27e1620cef28ab2e553e94ecf2d038ccec793972685883d2e794016112880dd81e34e334b86b4939a9ac007bf69d059cf5eb02799991868746375a31b79e6ff686740a0c431f2a8a667bc2d09a4230934e44805ece2dec19f4ae87f7"}, {0x8, 0x88be, 0x4, {{0x100000000, 0x1, 0x101, 0x7, 0x3, 0x5, 0x5, 0x823}, 0x1, 0x4}}, {0x8, 0x22eb, 0x4, {{0x8, 0x2, 0x0, 0x3, 0x2, 0x100000001, 0x8, 0x1000000000000}, 0x2, 0x2, 0x1, 0x8, 0x52de, 0x4, 0x1ff, 0x2202, 0x6, 0x7}}, {0x8, 0x6558, 0x0, "aa955762e7847e09dbcfd6ba545f46163c8ec41b06a7bcc0db4c2bcf8124dfe3b9c23db6272b960b7b43c827fafc3f7efa2eeab7c660be29d354a7b4a67f32c6f89197b3ead554390a36ad6261c8e3a2197d592458e8b8c130e824badb"}}}}}}}}, 0x0) bind$inet6(r0, &(0x7f0000000180)={0xa, 0x4e21, 0x100000000, @remote, 0x800}, 0x1c) [ 687.922354] binder: 14595:14596 Acquire 1 refcount change on invalid ref 0 ret -22 01:56:41 executing program 0: socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000001f80)={0xffffffffffffffff, 0xffffffffffffffff}) setsockopt$SO_ATTACH_FILTER(r2, 0x1, 0x1a, &(0x7f0000ab9ff0)={0x2, &(0x7f000039a000)=[{0x20, 0x0, 0x0, 0xfffffffffffff010}, {0x6}]}, 0x10) sendmmsg(r1, &(0x7f0000001e80)=[{{&(0x7f0000000700)=@l2={0x1f, 0x0, {}, 0x0, 0x0}, 0x80, &(0x7f0000001dc0)}}], 0x1, 0x0) 01:56:41 executing program 3: r0 = socket$inet(0x2, 0x3, 0x2) connect$inet(0xffffffffffffffff, &(0x7f0000000000)={0x2, 0x0, @local}, 0x10) setsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x23, &(0x7f0000000000)={{{@in=@multicast2, @in=@multicast1}}, {{@in6}, 0x0, @in6=@loopback}}, 0xe8) syz_emit_ethernet(0x2a, &(0x7f0000000640)={@random="b100485caa2a", @link_local, [], {@ipv4={0x800, {{0x5, 0x4, 0x300, 0x0, 0x1c, 0x0, 0x0, 0x0, 0x2, 0x0, @rand_addr, @broadcast}, @igmp={0x11, 0xffffffffffffffff, 0x0, @multicast1}}}}}, &(0x7f0000000140)) 01:56:42 executing program 4: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) ioctl$sock_SIOCETHTOOL(r0, 0x8946, &(0x7f0000000040)={'bond0\x00', &(0x7f0000000240)=ANY=[@ANYBLOB="4c000000000023000000000000000002"]}) openat$rtc(0xffffffffffffff9c, &(0x7f0000000000)='/dev/rtc0\x00', 0x100, 0x0) [ 688.046171] binder: 14595:14596 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 688.120019] binder: 14595:14622 Acquire 1 refcount change on invalid ref 0 ret -22 [ 688.195215] binder: 14596 RLIMIT_NICE not set [ 688.219951] binder: 14595:14622 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 01:56:42 executing program 6: r0 = syz_open_dev$sndseq(&(0x7f0000000100)='/dev/snd/seq\x00', 0x0, 0x0) read(r0, &(0x7f0000fb6000)=""/28, 0x3f0) ioctl$SNDRV_SEQ_IOCTL_REMOVE_EVENTS(r0, 0x4040534e, &(0x7f00000001c0)={0xbf}) ioctl$SNDRV_SEQ_IOCTL_QUERY_SUBS(r0, 0xc058534f, &(0x7f00000002c0)={{}, 0x1, 0x0, 0x0, {}, 0x0, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xe00]}) r1 = gettid() timer_create(0x0, &(0x7f0000044000)={0x0, 0x12}, &(0x7f0000000040)) r2 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r2, 0x8912, &(0x7f00000001c0)="0a5cc80700315f85715070") timer_settime(0x0, 0x0, &(0x7f0000000080)={{0x0, 0x989680}, {0x0, 0x9}}, &(0x7f0000040000)) tkill(r1, 0x1000000000014) 01:56:42 executing program 5: perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1f}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000340)={&(0x7f0000000000), 0xc, &(0x7f0000000300)={&(0x7f0000000240)=@newlink={0x50, 0x10, 0x721, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0xb00000000000000}, [@IFLA_LINKINFO={0x28, 0x12, @veth={{0xc, 0x1, 'veth\x00'}, {0x18, 0x2, @VETH_INFO_PEER={0x14}}}}, @IFLA_NET_NS_FD={0x8}]}, 0x50}}, 0x0) 01:56:42 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_MAX_THREADS(r0, 0x40046205, 0x3) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) 01:56:42 executing program 2: r0 = socket$inet(0x2, 0x3, 0x2) connect$inet(0xffffffffffffffff, &(0x7f0000000000)={0x2, 0x0, @local}, 0x10) setsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x23, &(0x7f0000000000)={{{@in=@multicast2, @in=@multicast1}}, {{@in6}, 0x0, @in6=@loopback}}, 0xe8) syz_emit_ethernet(0x2a, &(0x7f0000000640)={@random="b100485caa2a", @link_local, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x1c, 0x0, 0x0, 0x0, 0x2, 0x0, @rand_addr, @broadcast}, @igmp={0x11, 0x0, 0x0, @multicast1}}}}}, &(0x7f0000000140)={0x0, 0x0, [0x0, 0x0, 0x600]}) 01:56:42 executing program 3: r0 = socket$inet(0x2, 0x3, 0x2) connect$inet(0xffffffffffffffff, &(0x7f0000000000)={0x2, 0x0, @local}, 0x10) setsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x23, &(0x7f0000000000)={{{@in=@multicast2, @in=@multicast1}}, {{@in6}, 0x0, @in6=@loopback}}, 0xe8) syz_emit_ethernet(0x2a, &(0x7f0000000640)={@random="b100485caa2a", @link_local, [], {@ipv4={0x800, {{0x5, 0x4, 0xfffffffffffff000, 0x0, 0x1c, 0x0, 0x0, 0x0, 0x2, 0x0, @rand_addr, @broadcast}, @igmp={0x11, 0xffffffffffffffff, 0x0, @multicast1}}}}}, &(0x7f0000000140)) 01:56:42 executing program 0: socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000001f80)={0xffffffffffffffff, 0xffffffffffffffff}) setsockopt$SO_ATTACH_FILTER(r2, 0x1, 0x1a, &(0x7f0000ab9ff0)={0x2, &(0x7f000039a000)=[{0x20, 0x0, 0x0, 0xfffffffffffff010}, {0x6}]}, 0x10) sendmmsg(r1, &(0x7f0000001e80)=[{{&(0x7f0000000700)=@l2={0x1f, 0x0, {}, 0x0, 0x0}, 0x80, &(0x7f0000001dc0)}}], 0x1, 0x0) 01:56:42 executing program 4: r0 = syz_open_dev$sndpcmp(&(0x7f0000000140)='/dev/snd/pcmC#D#p\x00', 0x601, 0xc85d27ef28cc933c) ioctl$RNDGETENTCNT(r0, 0x80045200, &(0x7f0000000080)) ioctl$IOC_PR_REGISTER(r0, 0x401870c8, &(0x7f0000000100)={0x6, 0x2}) r1 = syz_open_dev$sndpcmc(&(0x7f0000004fee)='/dev/snd/pcmC#D#c\x00', 0x0, 0x0) getgroups(0x2, &(0x7f00000002c0)=[0x0, 0xffffffffffffffff]) getgroups(0x2, &(0x7f0000000140)=[0x0, r2]) sendmmsg$unix(0xffffffffffffffff, &(0x7f000000a000)=[{&(0x7f000000a000)=@abs, 0x6e, &(0x7f000000d000), 0x0, &(0x7f0000001ef8)=[@cred={0x20}, @cred={0x20}, @cred={0x20}, @rights={0x20, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff]}, @cred={0x20, 0x1, 0x2, 0x0, 0x0, r3}], 0xa0}], 0x1, 0x0) ioctl$KVM_S390_INTERRUPT_CPU(0xffffffffffffffff, 0x4010ae94, &(0x7f0000002000)={0x0, 0x15}) ioctl(r1, 0xc1004110, &(0x7f0000001f64)) r4 = socket$nl_netfilter(0x10, 0x3, 0xc) ioctl$sock_SIOCETHTOOL(r4, 0x8946, &(0x7f0000000040)={'bond0\x00', &(0x7f0000000180)=ANY=[@ANYBLOB="75366facabb07814772fff284f0dc74c000000000023000000000100000002117b053b67781ea0b0a10982de614e1ed0f1ed77b69c7a1c57243c95f840e140760473db5a895f08e426de158ead807f8f2ae8e898aeda"]}) 01:56:42 executing program 7: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000180)='/dev/sequencer\x00', 0x10002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000080)="0a5cc80700315f85715070") r1 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000001c0)={0x2, 0x0, &(0x7f0000000140)=ANY=[@ANYBLOB='\fc'], 0x0, 0x0, &(0x7f0000000080)}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, &(0x7f00000001c0)}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000040)={0x8, 0xfdfdffff00000000, &(0x7f00000000c0)=[@release={0x400c630f}], 0x1, 0x0, &(0x7f0000000100)='V'}) fstat(r0, &(0x7f00000002c0)) 01:56:42 executing program 3: r0 = socket$inet(0x2, 0x3, 0x2) connect$inet(0xffffffffffffffff, &(0x7f0000000000)={0x2, 0x0, @local}, 0x10) setsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x23, &(0x7f0000000000)={{{@in=@multicast2, @in=@multicast1}}, {{@in6}, 0x0, @in6=@loopback}}, 0xe8) syz_emit_ethernet(0x2a, &(0x7f0000000640)={@random="b100485caa2a", @link_local, [], {@ipv4={0x800, {{0x5, 0x4, 0x600000000000000, 0x0, 0x1c, 0x0, 0x0, 0x0, 0x2, 0x0, @rand_addr, @broadcast}, @igmp={0x11, 0xffffffffffffffff, 0x0, @multicast1}}}}}, &(0x7f0000000140)) 01:56:42 executing program 2: r0 = socket$inet(0x2, 0x3, 0x2) connect$inet(0xffffffffffffffff, &(0x7f0000000000)={0x2, 0x0, @local}, 0x10) setsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x23, &(0x7f0000000000)={{{@in=@multicast2, @in=@multicast1}}, {{@in6}, 0x0, @in6=@loopback}}, 0xe8) syz_emit_ethernet(0x2a, &(0x7f0000000640)={@random="b100485caa2a", @link_local, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x1c, 0x0, 0x0, 0x0, 0x2, 0x0, @rand_addr, @broadcast}, @igmp={0x11, 0x0, 0x0, @multicast1}}}}}, &(0x7f0000000140)={0x0, 0x0, [0x0, 0x0, 0x40000000]}) 01:56:42 executing program 5: perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1f}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000340)={&(0x7f0000000000), 0xc, &(0x7f0000000300)={&(0x7f0000000240)=@newlink={0x50, 0x10, 0x721, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x9effffff}, [@IFLA_LINKINFO={0x28, 0x12, @veth={{0xc, 0x1, 'veth\x00'}, {0x18, 0x2, @VETH_INFO_PEER={0x14}}}}, @IFLA_NET_NS_FD={0x8}]}, 0x50}}, 0x0) [ 688.770545] binder: 14648:14660 ioctl 40046205 3 returned -22 [ 688.798667] binder: BINDER_SET_CONTEXT_MGR already set [ 688.798681] binder: 14648:14660 ioctl 40046205 3 returned -22 01:56:42 executing program 4: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) ioctl$sock_SIOCETHTOOL(r0, 0x8946, &(0x7f0000000000)={'bond0\x00', &(0x7f0000000080)=ANY=[@ANYBLOB="4c0000aaee297469164ff8236359cd00bae1d0d1436bc2170ff972176071123a53dcdf0cd79d183aaf8d5a184d0707b1cf4696fda6e9de4ea391e3f3b373b827916d3b215914ce555297ac0d87cbf6044ff9838e471781b6db92864b7bf41590bbba63b0952b94dcfed293"]}) [ 688.842109] binder: 14648:14665 ioctl 40046207 0 returned -16 [ 688.848755] binder: 14664 RLIMIT_NICE not set 01:56:42 executing program 1: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) llistxattr(&(0x7f0000000080)='./file0/file1/file0\x00', &(0x7f00000002c0)=""/250, 0xfa) mount(&(0x7f0000000280)='./file0\x00', &(0x7f0000026ff8)='./file0\x00', &(0x7f000000c000)='ramfs\x00', 0x0, &(0x7f000000a000)) mkdir(&(0x7f0000000200)='./file0/file1\x00', 0x0) r0 = socket(0x0, 0x80000, 0x1) setsockopt$inet_sctp6_SCTP_PARTIAL_DELIVERY_POINT(r0, 0x84, 0x13, &(0x7f00000000c0)=0x5, 0x4) ioctl$KVM_REGISTER_COALESCED_MMIO(0xffffffffffffffff, 0x4010ae67, &(0x7f0000000040)) mkdir(&(0x7f0000000180)='./file0/file1/file0\x00', 0x0) rmdir(&(0x7f0000000100)='./file0/file1\x00') 01:56:42 executing program 3: r0 = socket$inet(0x2, 0x3, 0x2) connect$inet(0xffffffffffffffff, &(0x7f0000000000)={0x2, 0x0, @local}, 0x10) setsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x23, &(0x7f0000000000)={{{@in=@multicast2, @in=@multicast1}}, {{@in6}, 0x0, @in6=@loopback}}, 0xe8) syz_emit_ethernet(0x2a, &(0x7f0000000640)={@random="b100485caa2a", @link_local, [], {@ipv4={0x800, {{0x5, 0x4, 0x8000000, 0x0, 0x1c, 0x0, 0x0, 0x0, 0x2, 0x0, @rand_addr, @broadcast}, @igmp={0x11, 0xffffffffffffffff, 0x0, @multicast1}}}}}, &(0x7f0000000140)) [ 688.945540] binder: 14658:14682 Acquire 1 refcount change on invalid ref 0 ret -22 01:56:42 executing program 4: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) ioctl$sock_SIOCETHTOOL(r0, 0x8946, &(0x7f0000000040)={'bond0\x00', &(0x7f0000000240)=ANY=[@ANYBLOB="4c003b00000023000000000000000002"]}) r1 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vcs\x00', 0x10100, 0x0) getsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x11, &(0x7f0000000080)={{{@in=@loopback, @in6=@ipv4={[], [], @remote}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in=@multicast2}}}, &(0x7f0000000180)=0xe8) setsockopt$inet_mreqn(r1, 0x0, 0x20, &(0x7f00000001c0)={@multicast1, @local, r2}, 0xc) 01:56:42 executing program 0: socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000001f80)={0xffffffffffffffff, 0xffffffffffffffff}) setsockopt$SO_ATTACH_FILTER(r2, 0x1, 0x1a, &(0x7f0000ab9ff0)={0x2, &(0x7f000039a000)=[{0x20, 0x0, 0x0, 0xfffffffffffff010}, {0x6}]}, 0x10) sendmmsg(r1, &(0x7f0000001e80)=[{{&(0x7f0000000700)=@l2={0x1f, 0x0, {}, 0x0, 0x0}, 0x80, &(0x7f0000001dc0)}}], 0x1, 0x0) [ 688.987123] binder: 14658:14682 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 689.051472] binder: 14664 RLIMIT_NICE not set 01:56:43 executing program 3: r0 = socket$inet(0x2, 0x3, 0x2) connect$inet(0xffffffffffffffff, &(0x7f0000000000)={0x2, 0x0, @local}, 0x10) setsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x23, &(0x7f0000000000)={{{@in=@multicast2, @in=@multicast1}}, {{@in6}, 0x0, @in6=@loopback}}, 0xe8) syz_emit_ethernet(0x2a, &(0x7f0000000640)={@random="b100485caa2a", @link_local, [], {@ipv4={0x800, {{0x5, 0x4, 0x40030000000000, 0x0, 0x1c, 0x0, 0x0, 0x0, 0x2, 0x0, @rand_addr, @broadcast}, @igmp={0x11, 0xffffffffffffffff, 0x0, @multicast1}}}}}, &(0x7f0000000140)) 01:56:43 executing program 2: r0 = socket$inet(0x2, 0x3, 0x2) connect$inet(0xffffffffffffffff, &(0x7f0000000000)={0x2, 0x0, @local}, 0x10) setsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x23, &(0x7f0000000000)={{{@in=@multicast2, @in=@multicast1}}, {{@in6}, 0x0, @in6=@loopback}}, 0xe8) syz_emit_ethernet(0x2a, &(0x7f0000000640)={@random="b100485caa2a", @link_local, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x1c, 0x0, 0x0, 0x0, 0x2, 0x0, @rand_addr, @broadcast}, @igmp={0x11, 0x0, 0x0, @multicast1}}}}}, &(0x7f0000000140)={0x0, 0x0, [0x0, 0x0, 0x7000000]}) 01:56:43 executing program 6: r0 = syz_open_dev$sndseq(&(0x7f0000000100)='/dev/snd/seq\x00', 0x0, 0x0) read(r0, &(0x7f0000fb6000)=""/28, 0x3f0) ioctl$SNDRV_SEQ_IOCTL_REMOVE_EVENTS(r0, 0x4040534e, &(0x7f00000001c0)={0xbf}) ioctl$SNDRV_SEQ_IOCTL_QUERY_SUBS(r0, 0xc058534f, &(0x7f00000002c0)={{}, 0x1, 0x0, 0x0, {}, 0x0, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xbf00]}) r1 = gettid() timer_create(0x0, &(0x7f0000044000)={0x0, 0x12}, &(0x7f0000000040)) r2 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r2, 0x8912, &(0x7f00000001c0)="0a5cc80700315f85715070") timer_settime(0x0, 0x0, &(0x7f0000000080)={{0x0, 0x989680}, {0x0, 0x9}}, &(0x7f0000040000)) tkill(r1, 0x1000000000014) 01:56:43 executing program 1: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="025c3f0a00145f8f764070") r1 = socket$inet6(0xa, 0x1000000000002, 0x0) perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1f}, 0x0, 0x0, 0xffffffffffffffff, 0x0) socket$inet6(0xa, 0x2, 0x80000000) add_key$keyring(&(0x7f0000000080)='keyring\x00', &(0x7f00000000c0), 0x0, 0x0, 0xffffffffffffffff) getsockopt$sock_cred(r1, 0x1, 0x11, &(0x7f00000002c0)={0x0, 0x0}, &(0x7f00000001c0)=0x87) keyctl$get_persistent(0x7, r2, 0x0) 01:56:43 executing program 5: perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1f}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000340)={&(0x7f0000000000), 0xc, &(0x7f0000000300)={&(0x7f0000000240)=@newlink={0x50, 0x10, 0x721, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0xa}, [@IFLA_LINKINFO={0x28, 0x12, @veth={{0xc, 0x1, 'veth\x00'}, {0x18, 0x2, @VETH_INFO_PEER={0x14}}}}, @IFLA_NET_NS_FD={0x8}]}, 0x50}}, 0x0) 01:56:43 executing program 4: socket$nl_netfilter(0x10, 0x3, 0xc) 01:56:43 executing program 0: socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000001f80)={0xffffffffffffffff, 0xffffffffffffffff}) setsockopt$SO_ATTACH_FILTER(r2, 0x1, 0x1a, &(0x7f0000ab9ff0)={0x2, &(0x7f000039a000)=[{0x20, 0x0, 0x0, 0xfffffffffffff010}, {0x6}]}, 0x10) sendmmsg(r1, &(0x7f0000001e80)=[{{&(0x7f0000000700)=@l2={0x1f, 0x0, {}, 0x0, 0x0}, 0x80, &(0x7f0000001dc0)}}], 0x1, 0x0) 01:56:43 executing program 7: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000180)='/dev/sequencer\x00', 0x10002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000080)="0a5cc80700315f85715070") r1 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000001c0)={0x2, 0x0, &(0x7f0000000140)=ANY=[@ANYBLOB='\fc'], 0x0, 0x0, &(0x7f0000000080)}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, &(0x7f00000001c0)}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000040)={0x8, 0x4000000, &(0x7f00000000c0)=[@release={0x400c630f}], 0x1, 0x0, &(0x7f0000000100)='V'}) fstat(r0, &(0x7f00000002c0)) 01:56:43 executing program 4: ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000040)={'bond0\x00', &(0x7f0000000240)=ANY=[@ANYBLOB="4c000000000023000000000000000002"]}) 01:56:43 executing program 3: r0 = socket$inet(0x2, 0x3, 0x2) connect$inet(0xffffffffffffffff, &(0x7f0000000000)={0x2, 0x0, @local}, 0x10) setsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x23, &(0x7f0000000000)={{{@in=@multicast2, @in=@multicast1}}, {{@in6}, 0x0, @in6=@loopback}}, 0xe8) syz_emit_ethernet(0x2a, &(0x7f0000000640)={@random="b100485caa2a", @link_local, [], {@ipv4={0x800, {{0x5, 0x4, 0x300000000000000, 0x0, 0x1c, 0x0, 0x0, 0x0, 0x2, 0x0, @rand_addr, @broadcast}, @igmp={0x11, 0xffffffffffffffff, 0x0, @multicast1}}}}}, &(0x7f0000000140)) 01:56:43 executing program 5: perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1f}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000340)={&(0x7f0000000000), 0xc, &(0x7f0000000300)={&(0x7f0000000240)=@newlink={0x50, 0x10, 0x721, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x81000000}, [@IFLA_LINKINFO={0x28, 0x12, @veth={{0xc, 0x1, 'veth\x00'}, {0x18, 0x2, @VETH_INFO_PEER={0x14}}}}, @IFLA_NET_NS_FD={0x8}]}, 0x50}}, 0x0) 01:56:43 executing program 2: r0 = socket$inet(0x2, 0x3, 0x2) connect$inet(0xffffffffffffffff, &(0x7f0000000000)={0x2, 0x0, @local}, 0x10) setsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x23, &(0x7f0000000000)={{{@in=@multicast2, @in=@multicast1}}, {{@in6}, 0x0, @in6=@loopback}}, 0xe8) syz_emit_ethernet(0x2a, &(0x7f0000000640)={@random="b100485caa2a", @link_local, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x1c, 0x0, 0x0, 0x0, 0x2, 0x0, @rand_addr, @broadcast}, @igmp={0x11, 0x0, 0x0, @multicast1}}}}}, &(0x7f0000000140)={0x0, 0x0, [0x0, 0x0, 0xe000]}) 01:56:43 executing program 1: r0 = creat(&(0x7f0000000080)='./file1\x00', 0x0) mount$fuseblk(&(0x7f0000000100)='/dev/loop0\x00', &(0x7f0000000140)='./file1\x00', &(0x7f0000000200)='fuseblk\x00', 0x5014, &(0x7f0000000580)=ANY=[]) ioctl$TUNGETFEATURES(r0, 0x800454cf, &(0x7f0000000040)) mount(&(0x7f00000002c0)='./file1\x00', &(0x7f0000000180)='./file1\x00', &(0x7f0000000300)='btrfs\x00', 0x0, 0x0) rmdir(&(0x7f00000000c0)='./file1\x00') [ 689.700344] binder: 14732:14733 Acquire 1 refcount change on invalid ref 0 ret -22 01:56:43 executing program 0: socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000001f80)={0xffffffffffffffff, 0xffffffffffffffff}) setsockopt$SO_ATTACH_FILTER(r2, 0x1, 0x1a, &(0x7f0000ab9ff0)={0x2, &(0x7f000039a000)=[{0x20, 0x0, 0x0, 0xfffffffffffff010}, {0x6}]}, 0x10) sendmmsg(r1, &(0x7f0000001e80)=[{{&(0x7f0000000700)=@l2={0x1f, 0x0, {}, 0x0, 0x0}, 0x80, &(0x7f0000001dc0)}}], 0x1, 0x0) 01:56:43 executing program 4: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) ioctl$sock_SIOCETHTOOL(r0, 0x8946, &(0x7f0000000040)={'bond0\x00', &(0x7f0000000240)=ANY=[@ANYBLOB="4c000000000023000000000000000002"]}) socketpair(0x13, 0x5, 0x6, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) setsockopt$inet6_tcp_TCP_ULP(r1, 0x6, 0x1f, &(0x7f0000000140)='tls\x00', 0x4) 01:56:43 executing program 3: r0 = socket$inet(0x2, 0x3, 0x2) connect$inet(0xffffffffffffffff, &(0x7f0000000000)={0x2, 0x0, @local}, 0x10) setsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x23, &(0x7f0000000000)={{{@in=@multicast2, @in=@multicast1}}, {{@in6}, 0x0, @in6=@loopback}}, 0xe8) syz_emit_ethernet(0x2a, &(0x7f0000000640)={@random="b100485caa2a", @link_local, [], {@ipv4={0x800, {{0x5, 0x4, 0xf0ffffffffffff, 0x0, 0x1c, 0x0, 0x0, 0x0, 0x2, 0x0, @rand_addr, @broadcast}, @igmp={0x11, 0xffffffffffffffff, 0x0, @multicast1}}}}}, &(0x7f0000000140)) 01:56:43 executing program 2: r0 = socket$inet(0x2, 0x3, 0x2) connect$inet(0xffffffffffffffff, &(0x7f0000000000)={0x2, 0x0, @local}, 0x10) setsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x23, &(0x7f0000000000)={{{@in=@multicast2, @in=@multicast1}}, {{@in6}, 0x0, @in6=@loopback}}, 0xe8) syz_emit_ethernet(0x2a, &(0x7f0000000640)={@random="b100485caa2a", @link_local, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x1c, 0x0, 0x0, 0x0, 0x2, 0x0, @rand_addr, @broadcast}, @igmp={0x11, 0x0, 0x0, @multicast1}}}}}, &(0x7f0000000140)={0x0, 0x0, [0x0, 0x0, 0x1c]}) [ 689.869023] binder: 14732:14733 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 01:56:43 executing program 5: perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1f}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000340)={&(0x7f0000000000), 0xc, &(0x7f0000000300)={&(0x7f0000000240)=@newlink={0x50, 0x10, 0x721, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0xf00000000000000}, [@IFLA_LINKINFO={0x28, 0x12, @veth={{0xc, 0x1, 'veth\x00'}, {0x18, 0x2, @VETH_INFO_PEER={0x14}}}}, @IFLA_NET_NS_FD={0x8}]}, 0x50}}, 0x0) [ 689.999108] binder: 14732:14773 Acquire 1 refcount change on invalid ref 0 ret -22 [ 690.077371] binder: 14732:14773 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 01:56:44 executing program 2: r0 = socket$inet(0x2, 0x3, 0x2) connect$inet(0xffffffffffffffff, &(0x7f0000000000)={0x2, 0x0, @local}, 0x10) setsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x23, &(0x7f0000000000)={{{@in=@multicast2, @in=@multicast1}}, {{@in6}, 0x0, @in6=@loopback}}, 0xe8) syz_emit_ethernet(0x2a, &(0x7f0000000640)={@random="b100485caa2a", @link_local, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x1c, 0x0, 0x0, 0x0, 0x2, 0x0, @rand_addr, @broadcast}, @igmp={0x11, 0x0, 0x0, @multicast1}}}}}, &(0x7f0000000140)={0x0, 0x0, [0x0, 0x0, 0xffffffffffffffff]}) 01:56:44 executing program 1: r0 = openat$mixer(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/mixer\x00', 0x0, 0x0) getsockopt$inet_sctp_SCTP_GET_PEER_ADDR_INFO(r0, 0x84, 0xf, &(0x7f0000001440)={0x0, @in6={{0xa, 0x4e24, 0x4, @dev={0xfe, 0x80, [], 0x12}, 0x400}}, 0x9, 0x480, 0x7, 0x19e4, 0xffffffff}, &(0x7f0000001500)=0x98) setsockopt$inet_sctp6_SCTP_RESET_ASSOC(r0, 0x84, 0x78, &(0x7f0000001540)=r1, 0x4) ioctl$VHOST_GET_FEATURES(r0, 0x80044df9, &(0x7f00000001c0)) r2 = syz_genetlink_get_family_id$fou(&(0x7f0000000040)='fou\x00') sendmsg$FOU_CMD_ADD(r0, &(0x7f0000000180)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x1080000}, 0xc, &(0x7f0000000080)={&(0x7f00000002c0)=ANY=[@ANYBLOB="ff008055661785cf95982b7835112c51095aec62cd53587a7561c8fbb102c72aaa2b0349bbd59a2a5574e539e4649d2e9988a0ac7084b1d990098fcf364368bb3e242c85c8c923dd0de341e67cc5b4e32ae0151458d45a4c04b3d2d43ecd5f2bf3e1d71a430f94f1de8abd180b5767c0ea621ec3735f6a11585aa8e2ac111d6c3a500e61124018df91a0546b22a434865008649e0f01b583e6ff29d2fbcb41961a7ff65f486cee0a347e1688429279dbed2bb0e09216038ae605d1ce81d4d4445c0170a4617e88863bc662c9b32197a9c922f51ecf92e581480fc945216b22b377c802b22b3d0a29ec83a590f0ab1da1f2cbf535f5b0aa6ef9f1275c7531b0eaebe97227f4", @ANYRES16=r2, @ANYBLOB="04002dbd7000fddbdf25010000000800040000000000080003003c000000080002000a000000080001004e2000000800040001000000080002000a000000"], 0x44}, 0x1, 0x0, 0x0, 0x1}, 0x4000000) setsockopt$packet_buf(r0, 0x107, 0x2, &(0x7f0000000200)="6158482e82933fa23af051421f0f808d3c325c5e1c54ea2c408c98b84388e069a1d082bb55fb4762323da16d4273ca50e016a5f6799ccb2cb3eeb1602cf300a012d7340d597c6e20f2346980f86e5b27c5de0f58fd203866b3fadc9c2ae85a3421245f075a511cc12800e89d3648ff127262745f2af78b49717fb937cb85ae0fc43e07b2669c7c5116e55f13a7c158225b332b20ad61a6ca", 0x98) recvfrom$unix(r0, &(0x7f0000000440)=""/4096, 0x1000, 0x100, &(0x7f0000000100)=@file={0x1, './file0\x00'}, 0x6e) 01:56:44 executing program 6: r0 = syz_open_dev$sndseq(&(0x7f0000000100)='/dev/snd/seq\x00', 0x0, 0x0) read(r0, &(0x7f0000fb6000)=""/28, 0x3f0) ioctl$SNDRV_SEQ_IOCTL_REMOVE_EVENTS(r0, 0x4040534e, &(0x7f00000001c0)={0xbf}) ioctl$SNDRV_SEQ_IOCTL_QUERY_SUBS(r0, 0xc058534f, &(0x7f00000002c0)={{}, 0x1, 0x0, 0x0, {}, 0x0, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xe00000000000000]}) r1 = gettid() timer_create(0x0, &(0x7f0000044000)={0x0, 0x12}, &(0x7f0000000040)) r2 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r2, 0x8912, &(0x7f00000001c0)="0a5cc80700315f85715070") timer_settime(0x0, 0x0, &(0x7f0000000080)={{0x0, 0x989680}, {0x0, 0x9}}, &(0x7f0000040000)) tkill(r1, 0x1000000000014) 01:56:44 executing program 4: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) ioctl$sock_SIOCETHTOOL(r0, 0x8946, &(0x7f0000000040)={'bond0\x00', &(0x7f0000000240)=ANY=[@ANYBLOB="4c000000000023000000000000000002"]}) r1 = geteuid() getresgid(&(0x7f0000000080)=0x0, &(0x7f00000000c0), &(0x7f0000000100)) lchown(&(0x7f0000000000)='./file0\x00', r1, r2) 01:56:44 executing program 0: socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000001f80)={0xffffffffffffffff, 0xffffffffffffffff}) setsockopt$SO_ATTACH_FILTER(r2, 0x1, 0x1a, &(0x7f0000ab9ff0)={0x2, &(0x7f000039a000)=[{0x20, 0x0, 0x0, 0xfffffffffffff010}, {0x6}]}, 0x10) sendmmsg(r1, &(0x7f0000001e80)=[{{&(0x7f0000000700)=@l2={0x1f, 0x0, {}, 0x0, 0x0}, 0x80, &(0x7f0000001dc0)}}], 0x1, 0x0) 01:56:44 executing program 7: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000180)='/dev/sequencer\x00', 0x10002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000080)="0a5cc80700315f85715070") r1 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000001c0)={0x2, 0x0, &(0x7f0000000140)=ANY=[@ANYBLOB='\fc'], 0x0, 0x0, &(0x7f0000000080)}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, &(0x7f00000001c0)}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000040)={0x8, 0x6c000000, &(0x7f00000000c0)=[@release={0x400c630f}], 0x1, 0x0, &(0x7f0000000100)='V'}) fstat(r0, &(0x7f00000002c0)) 01:56:44 executing program 5: perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1f}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000340)={&(0x7f0000000000), 0xc, &(0x7f0000000300)={&(0x7f0000000240)=@newlink={0x50, 0x10, 0x721, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0xf0ffffffffffff}, [@IFLA_LINKINFO={0x28, 0x12, @veth={{0xc, 0x1, 'veth\x00'}, {0x18, 0x2, @VETH_INFO_PEER={0x14}}}}, @IFLA_NET_NS_FD={0x8}]}, 0x50}}, 0x0) 01:56:44 executing program 3: r0 = socket$inet(0x2, 0x3, 0x2) connect$inet(0xffffffffffffffff, &(0x7f0000000000)={0x2, 0x0, @local}, 0x10) setsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x23, &(0x7f0000000000)={{{@in=@multicast2, @in=@multicast1}}, {{@in6}, 0x0, @in6=@loopback}}, 0xe8) syz_emit_ethernet(0x2a, &(0x7f0000000640)={@random="b100485caa2a", @link_local, [], {@ipv4={0x800, {{0x5, 0x4, 0xe000, 0x0, 0x1c, 0x0, 0x0, 0x0, 0x2, 0x0, @rand_addr, @broadcast}, @igmp={0x11, 0xffffffffffffffff, 0x0, @multicast1}}}}}, &(0x7f0000000140)) 01:56:44 executing program 3: r0 = socket$inet(0x2, 0x3, 0x2) connect$inet(0xffffffffffffffff, &(0x7f0000000000)={0x2, 0x0, @local}, 0x10) setsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x23, &(0x7f0000000000)={{{@in=@multicast2, @in=@multicast1}}, {{@in6}, 0x0, @in6=@loopback}}, 0xe8) syz_emit_ethernet(0x2a, &(0x7f0000000640)={@random="b100485caa2a", @link_local, [], {@ipv4={0x800, {{0x5, 0x4, 0x700, 0x0, 0x1c, 0x0, 0x0, 0x0, 0x2, 0x0, @rand_addr, @broadcast}, @igmp={0x11, 0xffffffffffffffff, 0x0, @multicast1}}}}}, &(0x7f0000000140)) 01:56:44 executing program 1: capset(&(0x7f00000fc000)={0x19980330}, &(0x7f0000244000)) r0 = openat$pfkey(0xffffffffffffff9c, &(0x7f0000000140)='/proc/self/net/pfkey\x00', 0x40, 0x0) ioctl$TUNSETSNDBUF(r0, 0x400454d4, &(0x7f0000000000)=0x6) 01:56:44 executing program 2: r0 = socket$inet(0x2, 0x3, 0x2) connect$inet(0xffffffffffffffff, &(0x7f0000000000)={0x2, 0x0, @local}, 0x10) setsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x23, &(0x7f0000000000)={{{@in=@multicast2, @in=@multicast1}}, {{@in6}, 0x0, @in6=@loopback}}, 0xe8) syz_emit_ethernet(0x2a, &(0x7f0000000640)={@random="b100485caa2a", @link_local, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x1c, 0x0, 0x0, 0x0, 0x2, 0x0, @rand_addr, @broadcast}, @igmp={0x11, 0x0, 0x0, @multicast1}}}}}, &(0x7f0000000140)={0x0, 0x0, [0x0, 0x0, 0x8]}) 01:56:44 executing program 4: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) ioctl$sock_SIOCETHTOOL(r0, 0x8946, &(0x7f0000000040)={'bond0\x00', &(0x7f0000000240)=ANY=[@ANYBLOB="4c000000000023000000000000000002"]}) r1 = creat(&(0x7f0000000000)='./file0\x00', 0x4) setsockopt$inet_sctp6_SCTP_EVENTS(r1, 0x84, 0xb, &(0x7f0000000080)={0x4, 0x8001, 0x0, 0x9, 0x1, 0x40, 0x2, 0xa5, 0x8, 0x7fff, 0x3f}, 0xb) 01:56:44 executing program 5: perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1f}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000340)={&(0x7f0000000000), 0xc, &(0x7f0000000300)={&(0x7f0000000240)=@newlink={0x50, 0x10, 0x721, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x1000000000000000}, [@IFLA_LINKINFO={0x28, 0x12, @veth={{0xc, 0x1, 'veth\x00'}, {0x18, 0x2, @VETH_INFO_PEER={0x14}}}}, @IFLA_NET_NS_FD={0x8}]}, 0x50}}, 0x0) [ 690.654127] binder: 14809:14810 Acquire 1 refcount change on invalid ref 0 ret -22 01:56:44 executing program 1: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000080)="0a5cc80700315f85715070") r1 = openat$sequencer(0xffffffffffffff9c, &(0x7f0000000040)='/dev/sequencer\x00', 0x100, 0x0) getsockopt$inet_sctp6_SCTP_SOCKOPT_PEELOFF(r0, 0x84, 0x66, &(0x7f00000000c0)={0x0, 0x9}, &(0x7f0000000100)=0x8) getsockopt$inet_sctp_SCTP_STREAM_SCHEDULER_VALUE(r1, 0x84, 0x7c, &(0x7f0000000140)={r2, 0x6a107ad7, 0x8001}, &(0x7f0000000180)=0x8) r3 = socket$vsock_stream(0x28, 0x1, 0x0) getsockopt$inet_IP_IPSEC_POLICY(r3, 0x28, 0x6, &(0x7f0000581000)={{{@in=@rand_addr, @in6=@mcast2}}, {{}, 0x0, @in=@rand_addr}}, &(0x7f0000000000)=0xe8) 01:56:44 executing program 5: perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1f}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000340)={&(0x7f0000000000), 0xc, &(0x7f0000000300)={&(0x7f0000000240)=@newlink={0x50, 0x10, 0x721, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x6000000}, [@IFLA_LINKINFO={0x28, 0x12, @veth={{0xc, 0x1, 'veth\x00'}, {0x18, 0x2, @VETH_INFO_PEER={0x14}}}}, @IFLA_NET_NS_FD={0x8}]}, 0x50}}, 0x0) 01:56:44 executing program 2: r0 = socket$inet(0x2, 0x3, 0x2) connect$inet(0xffffffffffffffff, &(0x7f0000000000)={0x2, 0x0, @local}, 0x10) setsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x23, &(0x7f0000000000)={{{@in=@multicast2, @in=@multicast1}}, {{@in6}, 0x0, @in6=@loopback}}, 0xe8) syz_emit_ethernet(0x2a, &(0x7f0000000640)={@random="b100485caa2a", @link_local, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x1c, 0x0, 0x0, 0x0, 0x2, 0x0, @rand_addr, @broadcast}, @igmp={0x11, 0x0, 0x0, @multicast1}}}}}, &(0x7f0000000140)={0x0, 0x0, [0x0, 0x0, 0x600000000000000]}) 01:56:44 executing program 3: r0 = socket$inet(0x2, 0x3, 0x2) connect$inet(0xffffffffffffffff, &(0x7f0000000000)={0x2, 0x0, @local}, 0x10) setsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x23, &(0x7f0000000000)={{{@in=@multicast2, @in=@multicast1}}, {{@in6}, 0x0, @in6=@loopback}}, 0xe8) syz_emit_ethernet(0x2a, &(0x7f0000000640)={@random="b100485caa2a", @link_local, [], {@ipv4={0x800, {{0x5, 0x4, 0x3, 0x0, 0x1c, 0x0, 0x0, 0x0, 0x2, 0x0, @rand_addr, @broadcast}, @igmp={0x11, 0xffffffffffffffff, 0x0, @multicast1}}}}}, &(0x7f0000000140)) 01:56:44 executing program 4: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) ioctl$sock_SIOCETHTOOL(r0, 0x8946, &(0x7f0000000040)={'bond0\x00', &(0x7f0000000240)=ANY=[@ANYBLOB="4c000000000023000000000000000002"]}) [ 690.806656] binder: 14809:14810 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 690.953999] binder: 14809:14836 Acquire 1 refcount change on invalid ref 0 ret -22 [ 691.007977] binder: 14809:14836 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 691.031744] binder: 14810 RLIMIT_NICE not set 01:56:45 executing program 6: r0 = syz_open_dev$sndseq(&(0x7f0000000100)='/dev/snd/seq\x00', 0x0, 0x0) read(r0, &(0x7f0000fb6000)=""/28, 0x3f0) ioctl$SNDRV_SEQ_IOCTL_REMOVE_EVENTS(r0, 0x4040534e, &(0x7f00000001c0)={0xbf}) ioctl$SNDRV_SEQ_IOCTL_QUERY_SUBS(r0, 0xc058534f, &(0x7f00000002c0)={{}, 0x1, 0x0, 0x0, {}, 0x0, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xbf00000000000000]}) r1 = gettid() timer_create(0x0, &(0x7f0000044000)={0x0, 0x12}, &(0x7f0000000040)) r2 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r2, 0x8912, &(0x7f00000001c0)="0a5cc80700315f85715070") timer_settime(0x0, 0x0, &(0x7f0000000080)={{0x0, 0x989680}, {0x0, 0x9}}, &(0x7f0000040000)) tkill(r1, 0x1000000000014) 01:56:45 executing program 0: socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000001f80)={0xffffffffffffffff, 0xffffffffffffffff}) setsockopt$SO_ATTACH_FILTER(r2, 0x1, 0x1a, &(0x7f0000ab9ff0)={0x2, &(0x7f000039a000)=[{0x20, 0x0, 0x0, 0xfffffffffffff010}, {0x6}]}, 0x10) sendmmsg(r1, &(0x7f0000001e80)=[{{&(0x7f0000000700)=@l2={0x1f, 0x0, {}, 0x0, 0x0}, 0x80, &(0x7f0000001dc0)}}], 0x1, 0x0) 01:56:45 executing program 3: r0 = socket$inet(0x2, 0x3, 0x2) connect$inet(0xffffffffffffffff, &(0x7f0000000000)={0x2, 0x0, @local}, 0x10) setsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x23, &(0x7f0000000000)={{{@in=@multicast2, @in=@multicast1}}, {{@in6}, 0x0, @in6=@loopback}}, 0xe8) syz_emit_ethernet(0x2a, &(0x7f0000000640)={@random="b100485caa2a", @link_local, [], {@ipv4={0x800, {{0x5, 0x4, 0x6000000000000000, 0x0, 0x1c, 0x0, 0x0, 0x0, 0x2, 0x0, @rand_addr, @broadcast}, @igmp={0x11, 0xffffffffffffffff, 0x0, @multicast1}}}}}, &(0x7f0000000140)) 01:56:45 executing program 5: perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1f}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000340)={&(0x7f0000000000), 0xc, &(0x7f0000000300)={&(0x7f0000000240)=@newlink={0x50, 0x10, 0x721, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x700}, [@IFLA_LINKINFO={0x28, 0x12, @veth={{0xc, 0x1, 'veth\x00'}, {0x18, 0x2, @VETH_INFO_PEER={0x14}}}}, @IFLA_NET_NS_FD={0x8}]}, 0x50}}, 0x0) 01:56:45 executing program 1: r0 = socket$inet6(0xa, 0x1000000000003, 0x7) setsockopt$inet6_opts(r0, 0x29, 0x36, &(0x7f0000000080), 0x245) vmsplice(r0, &(0x7f0000000280)=[{&(0x7f00000000c0)="02bb49083e6a66791082cb1d0d3a316ecf495fe90259bcfac1606cfc9f89500e024e0b4191c1aa2be55f39170c95c06eb0a88b77c1ac9572d559d314a4bc02533e143e3745ff13b1e3df8721eb3a515cba8ebac6f71260c2282b8c8715d2cc5c153f742a8e47806ede66d418a045b18209e22ab60933734f137998f5b70b22fa163ddd1fdf3343bb262535af903722c5848723496406d5aa0f973bf89462d10451c6c84e2d1c53c25e0db60e2788c208e12a31e0866d375f5fb49cf6250f58faaf5d1660a1a03f76a5cf1befe76eb9bc64aa5e3b0a88992c7ba9f9e9491a31126f10740c853529e5ab2de8e439f6a79da1bff20b025bfccef4d1bb46", 0xfc}, {&(0x7f0000000000)="19714297d6b6de96d2a09ee11695a77d197be9c359a9734fc3c122f32fdc3a7975817c315b9f01e2eb5c4e2d8311", 0x2e}, {&(0x7f0000000040)="da5972a15e0df615a7a955775a0458a3b03f640ff1f766cce014885d9cbe80075d655418d015", 0x26}, {&(0x7f00000001c0)="d5a52bbecdb2d2cbcd675f4574bf98c69334966d878ef7b9334ae59c", 0x1c}, {&(0x7f0000000200)="8d57fba1058730f60dbe1543678b2a3a7f4e55df72c7f061f86a375f043f2a60c47024eed9c81801a4c52cd370f2801571c17c065bfa82256abc57", 0x3b}, {&(0x7f0000000240)="73fabeb1dad2b9aed877b3c0961f42be38096dc88c0f313e1da0", 0x1a}], 0x6, 0x0) 01:56:45 executing program 4: r0 = openat$autofs(0xffffffffffffff9c, &(0x7f0000000000)='/dev/autofs\x00', 0x488d02, 0x0) setsockopt$sock_timeval(r0, 0x1, 0xef3aa150f733aa30, &(0x7f0000000080)={0x77359400}, 0x10) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) ioctl$sock_SIOCETHTOOL(r1, 0x8946, &(0x7f0000000040)={'bond0\x00', &(0x7f0000000240)=ANY=[@ANYBLOB="4c000000000023000000000000000002"]}) 01:56:45 executing program 2: r0 = socket$inet(0x2, 0x3, 0x2) connect$inet(0xffffffffffffffff, &(0x7f0000000000)={0x2, 0x0, @local}, 0x10) setsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x23, &(0x7f0000000000)={{{@in=@multicast2, @in=@multicast1}}, {{@in6}, 0x0, @in6=@loopback}}, 0xe8) syz_emit_ethernet(0x2a, &(0x7f0000000640)={@random="b100485caa2a", @link_local, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x1c, 0x0, 0x0, 0x0, 0x2, 0x0, @rand_addr, @broadcast}, @igmp={0x11, 0x0, 0x0, @multicast1}}}}}, &(0x7f0000000140)={0x0, 0x0, [0x0, 0x0, 0x6000000000000000]}) 01:56:45 executing program 7: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000180)='/dev/sequencer\x00', 0x10002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000080)="0a5cc80700315f85715070") r1 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000001c0)={0x2, 0x0, &(0x7f0000000140)=ANY=[@ANYBLOB='\fc'], 0x0, 0x0, &(0x7f0000000080)}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, &(0x7f00000001c0)}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000040)={0x8, 0x500, &(0x7f00000000c0)=[@release={0x400c630f}], 0x1, 0x0, &(0x7f0000000100)='V'}) fstat(r0, &(0x7f00000002c0)) [ 691.455653] binder: 14864:14865 Acquire 1 refcount change on invalid ref 0 ret -22 [ 691.463674] binder: 14864:14865 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 691.471759] binder: 14865 RLIMIT_NICE not set 01:56:45 executing program 2: r0 = socket$inet(0x2, 0x3, 0x2) connect$inet(0xffffffffffffffff, &(0x7f0000000000)={0x2, 0x0, @local}, 0x10) setsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x23, &(0x7f0000000000)={{{@in=@multicast2, @in=@multicast1}}, {{@in6}, 0x0, @in6=@loopback}}, 0xe8) syz_emit_ethernet(0x2a, &(0x7f0000000640)={@random="b100485caa2a", @link_local, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x1c, 0x0, 0x0, 0x0, 0x2, 0x0, @rand_addr, @broadcast}, @igmp={0x11, 0x0, 0x0, @multicast1}}}}}, &(0x7f0000000140)={0x0, 0x0, [0x0, 0x0, 0x0, 0x8000000]}) 01:56:45 executing program 5: perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1f}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000340)={&(0x7f0000000000), 0xc, &(0x7f0000000300)={&(0x7f0000000240)=@newlink={0x50, 0x10, 0x721, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0xf}, [@IFLA_LINKINFO={0x28, 0x12, @veth={{0xc, 0x1, 'veth\x00'}, {0x18, 0x2, @VETH_INFO_PEER={0x14}}}}, @IFLA_NET_NS_FD={0x8}]}, 0x50}}, 0x0) 01:56:45 executing program 1: r0 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000040)='/dev/vga_arbiter\x00', 0x1, 0x0) ioctl$UFFDIO_WAKE(r0, 0x8010aa02, &(0x7f0000000080)={&(0x7f0000f32000/0x2000)=nil, 0x2000}) mmap(&(0x7f0000ffb000/0x2000)=nil, 0x2000, 0xf515a7d2fc355af, 0x20010, 0xffffffffffffffff, 0x0) mmap(&(0x7f00006a5000/0x1000)=nil, 0x1000, 0x3, 0x32, r0, 0xffeffffffffffffd) openat$null(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/null\x00', 0x40000, 0x0) r1 = syz_open_dev$evdev(&(0x7f0000000000)='/dev/input/event#\x00', 0x2, 0x0) ioctl$EVIOCSKEYCODE(r1, 0x40084503, &(0x7f0000002ffc)) 01:56:45 executing program 4: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) r1 = dup(r0) setsockopt$inet6_buf(r1, 0x29, 0xff, &(0x7f0000000400)="7d685b88008e1d71ce9bd9461e1f683eee2b5104f7c5fe92cd71dbae977408f64489862403b70a0dc7fa14e717b34c89c6cd08664652c40629c820db3e7f21845f28c936646191514a9aa0c20f022e67045600f7b3040149274b014138c5559119d811dac4b3257a46d494ee10a48bd54f4044e8fbc3a02a5a2548e0386bf23ef1e89d45d9fcc2a89f0d6f614568e7d2c604b9699e67586f6d1e88b71bacf8434bb52d4f70576fdb6bec82c67d997cbaf6376c8743f0aabe69b1407398c84c1a08e346c3504705e666327a4e", 0xcc) ioctl$sock_SIOCETHTOOL(r0, 0x8946, &(0x7f0000000040)={"01046e641000", &(0x7f00000003c0)=ANY=[@ANYPTR=&(0x7f0000000200)=ANY=[@ANYPTR=&(0x7f0000000080)=ANY=[@ANYRESOCT=r0, @ANYRESOCT=r0, @ANYRESOCT=r0, @ANYRESHEX], @ANYRES64, @ANYBLOB="66e474fa8dd11b392b1d62fa6cf5c41c64a0e007a4a29efbe74673171fe38944bdb705fdea1b0c47860d8c726402d53db2591f023e5a779904b11a425d6b300fe26da6c1560cb2c88265c70f4ae5fd2caadf2897a5699979d8d43f235e6a0cdf6cb4e119591b7cfc1b462ed714f9cb3da0090d77a72220b3fd6ef20586d32bef797f8eb7ff57e69429f2a27dd7dbfe9a70dc1dad314b463ff8ae23edff11cd82b9f384504dd196492cac395491a472656574abe36f17f35b9ba72dc011f2302d58809baad5f819c545a8a557696f4f9370", @ANYPTR64=&(0x7f0000000100)=ANY=[@ANYPTR, @ANYBLOB="461e611316e2b4e4a6ebfa9cf3aa7d4730d36d30b270b92fde7eb1b2c930a113a8435bba692c76fc9986b69dce8f2d898757810942463e84dbbd92aca9a7b1ebf130cad3aaea53d21b2921ce58dc398171e30e5da631f3b7be24b296a040576e8dbe395f6a16030a76b8af2f188a70d84eaf099af041bb9974d3744dada7a9a2befda8a23b0acd3d8112780efd5c0442162f"], @ANYPTR, @ANYRES64=r0, @ANYPTR=&(0x7f00000001c0)=ANY=[@ANYRESDEC=r0, @ANYRESOCT=r0, @ANYRES16=r0, @ANYPTR, @ANYPTR64], @ANYRES16=r0], @ANYRES16=0x0, @ANYRESDEC=r0, @ANYRESOCT=r0, @ANYRES64=r0, @ANYRES16=r0]}) 01:56:45 executing program 3: r0 = socket$inet(0x2, 0x3, 0x2) connect$inet(0xffffffffffffffff, &(0x7f0000000000)={0x2, 0x0, @local}, 0x10) setsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x23, &(0x7f0000000000)={{{@in=@multicast2, @in=@multicast1}}, {{@in6}, 0x0, @in6=@loopback}}, 0xe8) syz_emit_ethernet(0x2a, &(0x7f0000000640)={@random="b100485caa2a", @link_local, [], {@ipv4={0x800, {{0x5, 0x4, 0x1000000, 0x0, 0x1c, 0x0, 0x0, 0x0, 0x2, 0x0, @rand_addr, @broadcast}, @igmp={0x11, 0xffffffffffffffff, 0x0, @multicast1}}}}}, &(0x7f0000000140)) 01:56:45 executing program 2: r0 = socket$inet(0x2, 0x3, 0x2) connect$inet(0xffffffffffffffff, &(0x7f0000000000)={0x2, 0x0, @local}, 0x10) setsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x23, &(0x7f0000000000)={{{@in=@multicast2, @in=@multicast1}}, {{@in6}, 0x0, @in6=@loopback}}, 0xe8) syz_emit_ethernet(0x2a, &(0x7f0000000640)={@random="b100485caa2a", @link_local, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x1c, 0x0, 0x0, 0x0, 0x2, 0x0, @rand_addr, @broadcast}, @igmp={0x11, 0x0, 0x0, @multicast1}}}}}, &(0x7f0000000140)={0x0, 0x0, [0x0, 0x0, 0x0, 0x7000000]}) 01:56:45 executing program 0: socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000001f80)={0xffffffffffffffff, 0xffffffffffffffff}) setsockopt$SO_ATTACH_FILTER(r2, 0x1, 0x1a, &(0x7f0000ab9ff0)={0x2, &(0x7f000039a000)=[{0x20, 0x0, 0x0, 0xfffffffffffff010}, {0x6}]}, 0x10) sendmmsg(r1, &(0x7f0000001e80)=[{{&(0x7f0000000700)=@l2, 0x20000780, &(0x7f0000001dc0)}}], 0x1, 0x0) 01:56:45 executing program 5: perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1f}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000340)={&(0x7f0000000000), 0xc, &(0x7f0000000300)={&(0x7f0000000240)=@newlink={0x50, 0x10, 0x721, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x800000000000000}, [@IFLA_LINKINFO={0x28, 0x12, @veth={{0xc, 0x1, 'veth\x00'}, {0x18, 0x2, @VETH_INFO_PEER={0x14}}}}, @IFLA_NET_NS_FD={0x8}]}, 0x50}}, 0x0) [ 692.253671] binder: 14864:14927 Acquire 1 refcount change on invalid ref 0 ret -22 [ 692.261477] binder: 14864:14927 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 692.268748] binder: 14883 RLIMIT_NICE not set 01:56:46 executing program 6: r0 = syz_open_dev$sndseq(&(0x7f0000000100)='/dev/snd/seq\x00', 0x0, 0x0) read(r0, &(0x7f0000fb6000)=""/28, 0x3f0) ioctl$SNDRV_SEQ_IOCTL_REMOVE_EVENTS(r0, 0x4040534e, &(0x7f00000001c0)={0xbf}) ioctl$SNDRV_SEQ_IOCTL_QUERY_SUBS(r0, 0xc058534f, &(0x7f00000002c0)={{}, 0x1, 0x0, 0x0, {}, 0x0, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffff00000000]}) r1 = gettid() timer_create(0x0, &(0x7f0000044000)={0x0, 0x12}, &(0x7f0000000040)) r2 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r2, 0x8912, &(0x7f00000001c0)="0a5cc80700315f85715070") timer_settime(0x0, 0x0, &(0x7f0000000080)={{0x0, 0x989680}, {0x0, 0x9}}, &(0x7f0000040000)) tkill(r1, 0x1000000000014) 01:56:46 executing program 4: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) ioctl$sock_SIOCETHTOOL(r0, 0x8946, &(0x7f0000000040)={'bond0\x00', &(0x7f0000000080)=ANY=[@ANYBLOB="d0d1fd14d999ae4c000000000085ea4963116fa7b5060f66d6180ec823000000000000000002f23c7e108053e58780783897a4fee454e209e5ef1d876f27ae7b93da30c1be1fe63263ff288d4eeb490b91645e60ed11185115c448b88552c1297f2ebd34a37ddd18c8761d708272de83fe0a0fe731f38d195977801c87c572f5d45745672d047f33a5b4f402b46b7eba192405c1ad23b8130e96b8e5ef13469e35e2439cc1ed45428c"]}) pipe2(&(0x7f0000000000)={0xffffffffffffffff}, 0x84000) ioctl$SNDRV_SEQ_IOCTL_CREATE_QUEUE(r1, 0xc08c5332, &(0x7f0000000140)={0xfffffffffffffff8, 0x8, 0xfff, 'queue0\x00', 0x2}) 01:56:46 executing program 1: r0 = openat$dsp(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dsp\x00', 0x0, 0x0) ioctl$PPPIOCGL2TPSTATS(r0, 0x80487436, &(0x7f0000000040)="e16ac8d7a481f048cadb511c94d8d7c60a4094d19296479bcc6a123c6a3df4e5df1f71c8cd1db84fa860f0cc99320e7553055f516a54df53b04c548b8be22c40ede056fc37f41812c46e99a6c1c6db27914cc2b7457db11ea8013b2c0fa1cc19eae6e8f75fb151e48d358c5346e5b44bc801df2d76e1132c8d455a50c4a9c3382cbe1d4c89366f30126e91ec237a47955e4387b7d958d316536285b6cf0c5f305904b1108118159b4df3a13ad7f8fed422a4e1d8585b") r1 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r1, &(0x7f0000002fdd)={&(0x7f0000015ff4), 0xc, &(0x7f0000015000)={&(0x7f000000bf20)=ANY=[@ANYBLOB="5c000000150001400000000000000000e0f75a09000000000000000000000000fffffbff00000001000000000000000000000000000000000000000000000000", @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00 \f\x00\b\x00\x00\x00\x00\x00\x00\x00\x00\x00'], 0x7f}}, 0x0) 01:56:46 executing program 3: r0 = socket$inet(0x2, 0x3, 0x2) connect$inet(0xffffffffffffffff, &(0x7f0000000000)={0x2, 0x0, @local}, 0x10) setsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x23, &(0x7f0000000000)={{{@in=@multicast2, @in=@multicast1}}, {{@in6}, 0x0, @in6=@loopback}}, 0xe8) syz_emit_ethernet(0x2a, &(0x7f0000000640)={@random="b100485caa2a", @link_local, [], {@ipv4={0x800, {{0x5, 0x4, 0x600, 0x0, 0x1c, 0x0, 0x0, 0x0, 0x2, 0x0, @rand_addr, @broadcast}, @igmp={0x11, 0xffffffffffffffff, 0x0, @multicast1}}}}}, &(0x7f0000000140)) 01:56:46 executing program 2: r0 = socket$inet(0x2, 0x3, 0x2) connect$inet(0xffffffffffffffff, &(0x7f0000000000)={0x2, 0x0, @local}, 0x10) setsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x23, &(0x7f0000000000)={{{@in=@multicast2, @in=@multicast1}}, {{@in6}, 0x0, @in6=@loopback}}, 0xe8) syz_emit_ethernet(0x2a, &(0x7f0000000640)={@random="b100485caa2a", @link_local, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x1c, 0x0, 0x0, 0x0, 0x2, 0x0, @rand_addr, @broadcast}, @igmp={0x11, 0x0, 0x0, @multicast1}}}}}, &(0x7f0000000140)={0x0, 0x0, [0x0, 0x0, 0x0, 0x60000000]}) 01:56:46 executing program 5: perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1f}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000340)={&(0x7f0000000000), 0xc, &(0x7f0000000300)={&(0x7f0000000240)=@newlink={0x50, 0x10, 0x721, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x8100000000000000}, [@IFLA_LINKINFO={0x28, 0x12, @veth={{0xc, 0x1, 'veth\x00'}, {0x18, 0x2, @VETH_INFO_PEER={0x14}}}}, @IFLA_NET_NS_FD={0x8}]}, 0x50}}, 0x0) 01:56:46 executing program 0: socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000001f80)={0xffffffffffffffff, 0xffffffffffffffff}) setsockopt$SO_ATTACH_FILTER(r2, 0x1, 0x1a, &(0x7f0000ab9ff0)={0x2, &(0x7f000039a000)=[{0x20, 0x0, 0x0, 0xfffffffffffff010}, {0x6}]}, 0x10) sendmmsg(r1, &(0x7f0000001e80)=[{{&(0x7f0000000700)=@l2, 0x80, &(0x7f0000001dc0)}}], 0x1, 0x0) 01:56:46 executing program 7: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000180)='/dev/sequencer\x00', 0x10002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000080)="0a5cc80700315f85715070") r1 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000001c0)={0x2, 0x0, &(0x7f0000000140)=ANY=[@ANYBLOB='\fc'], 0x0, 0x0, &(0x7f0000000080)}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, &(0x7f00000001c0)}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000040)={0x8, 0x700, &(0x7f00000000c0)=[@release={0x400c630f}], 0x1, 0x0, &(0x7f0000000100)='V'}) fstat(r0, &(0x7f00000002c0)) 01:56:46 executing program 3: r0 = socket$inet(0x2, 0x3, 0x2) connect$inet(0xffffffffffffffff, &(0x7f0000000000)={0x2, 0x0, @local}, 0x10) setsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x23, &(0x7f0000000000)={{{@in=@multicast2, @in=@multicast1}}, {{@in6}, 0x0, @in6=@loopback}}, 0xe8) syz_emit_ethernet(0x2a, &(0x7f0000000640)={@random="b100485caa2a", @link_local, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x8, 0x1c, 0x0, 0x0, 0x0, 0x2, 0x0, @rand_addr, @broadcast}, @igmp={0x11, 0xffffffffffffffff, 0x0, @multicast1}}}}}, &(0x7f0000000140)) 01:56:46 executing program 5: perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1f}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000340)={&(0x7f0000000000), 0xc, &(0x7f0000000300)={&(0x7f0000000240)=@newlink={0x50, 0x10, 0x721, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0xa000000}, [@IFLA_LINKINFO={0x28, 0x12, @veth={{0xc, 0x1, 'veth\x00'}, {0x18, 0x2, @VETH_INFO_PEER={0x14}}}}, @IFLA_NET_NS_FD={0x8}]}, 0x50}}, 0x0) 01:56:46 executing program 2: r0 = socket$inet(0x2, 0x3, 0x2) connect$inet(0xffffffffffffffff, &(0x7f0000000000)={0x2, 0x0, @local}, 0x10) setsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x23, &(0x7f0000000000)={{{@in=@multicast2, @in=@multicast1}}, {{@in6}, 0x0, @in6=@loopback}}, 0xe8) syz_emit_ethernet(0x2a, &(0x7f0000000640)={@random="b100485caa2a", @link_local, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x1c, 0x0, 0x0, 0x0, 0x2, 0x0, @rand_addr, @broadcast}, @igmp={0x11, 0x0, 0x0, @multicast1}}}}}, &(0x7f0000000140)={0x0, 0x0, [0x0, 0x0, 0x0, 0xe0]}) 01:56:46 executing program 1: r0 = socket(0xa, 0x1, 0x0) setsockopt$inet6_opts(r0, 0x29, 0x39, &(0x7f0000c84fb8)=ANY=[@ANYBLOB="0004040000ff0000fe7feb0000070000000000000000ffff0000517c5100000002000000000000ff"], 0x28) socket$inet6(0xa, 0x803, 0xffff) 01:56:46 executing program 4: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) r1 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vga_arbiter\x00', 0x84000, 0x0) setsockopt$RDS_GET_MR_FOR_DEST(r1, 0x114, 0x7, &(0x7f0000000280)={@vsock={0x28, 0x0, 0x0, @hyper}, {&(0x7f0000000080)=""/245, 0xf5}, &(0x7f0000000180), 0x46}, 0xa0) ioctl$sock_SIOCETHTOOL(r0, 0x8946, &(0x7f0000000040)={'bond0\x00', &(0x7f0000000240)=ANY=[@ANYBLOB="4c000000000023000000000000000002"]}) [ 692.449996] binder: 14949:14950 Acquire 1 refcount change on invalid ref 0 ret -22 [ 692.482577] binder: 14949:14950 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 01:56:46 executing program 4: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) r1 = openat$full(0xffffffffffffff9c, &(0x7f0000000000)='/dev/full\x00', 0x2000, 0x0) setsockopt$inet6_tcp_TCP_CONGESTION(r1, 0x6, 0xd, &(0x7f0000000080)='htcp\x00', 0x5) ioctl$sock_SIOCETHTOOL(r0, 0x8946, &(0x7f0000000040)={'bond0\x00', &(0x7f0000000240)=ANY=[@ANYBLOB="4c000000000023000000000000000002"]}) 01:56:46 executing program 3: r0 = socket$inet(0x2, 0x3, 0x2) connect$inet(0xffffffffffffffff, &(0x7f0000000000)={0x2, 0x0, @local}, 0x10) setsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x23, &(0x7f0000000000)={{{@in=@multicast2, @in=@multicast1}}, {{@in6}, 0x0, @in6=@loopback}}, 0xe8) syz_emit_ethernet(0x2a, &(0x7f0000000640)={@random="b100485caa2a", @link_local, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x60, 0x1c, 0x0, 0x0, 0x0, 0x2, 0x0, @rand_addr, @broadcast}, @igmp={0x11, 0xffffffffffffffff, 0x0, @multicast1}}}}}, &(0x7f0000000140)) 01:56:46 executing program 0: socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000001f80)={0xffffffffffffffff, 0xffffffffffffffff}) setsockopt$SO_ATTACH_FILTER(r2, 0x1, 0x1a, &(0x7f0000ab9ff0)={0x2, &(0x7f000039a000)=[{0x20, 0x0, 0x0, 0xfffffffffffff010}, {0x6}]}, 0x10) sendmmsg(r1, &(0x7f0000001e80)=[{{&(0x7f0000000700)=@l2, 0x80, &(0x7f0000001dc0)}}], 0x1, 0x0) [ 692.597198] binder: 14950 RLIMIT_NICE not set 01:56:47 executing program 5: perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1f}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000340)={&(0x7f0000000000), 0xc, &(0x7f0000000300)={&(0x7f0000000240)=@newlink={0x50, 0x10, 0x721, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0xf000}, [@IFLA_LINKINFO={0x28, 0x12, @veth={{0xc, 0x1, 'veth\x00'}, {0x18, 0x2, @VETH_INFO_PEER={0x14}}}}, @IFLA_NET_NS_FD={0x8}]}, 0x50}}, 0x0) 01:56:47 executing program 2: r0 = socket$inet(0x2, 0x3, 0x2) connect$inet(0xffffffffffffffff, &(0x7f0000000000)={0x2, 0x0, @local}, 0x10) setsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x23, &(0x7f0000000000)={{{@in=@multicast2, @in=@multicast1}}, {{@in6}, 0x0, @in6=@loopback}}, 0xe8) syz_emit_ethernet(0x2a, &(0x7f0000000640)={@random="b100485caa2a", @link_local, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x1c, 0x0, 0x0, 0x0, 0x2, 0x0, @rand_addr, @broadcast}, @igmp={0x11, 0x0, 0x0, @multicast1}}}}}, &(0x7f0000000140)={0x0, 0x0, [0x0, 0x0, 0x0, 0x400000000000000]}) 01:56:47 executing program 6: r0 = syz_open_dev$sndseq(&(0x7f0000000100)='/dev/snd/seq\x00', 0x0, 0x0) read(r0, &(0x7f0000fb6000)=""/28, 0x3f0) ioctl$SNDRV_SEQ_IOCTL_REMOVE_EVENTS(r0, 0x4040534e, &(0x7f00000001c0)={0xbf}) ioctl$SNDRV_SEQ_IOCTL_QUERY_SUBS(r0, 0xc058534f, &(0x7f00000002c0)={{}, 0x1, 0x0, 0x0, {}, 0x0, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xe000000]}) r1 = gettid() timer_create(0x0, &(0x7f0000044000)={0x0, 0x12}, &(0x7f0000000040)) r2 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r2, 0x8912, &(0x7f00000001c0)="0a5cc80700315f85715070") timer_settime(0x0, 0x0, &(0x7f0000000080)={{0x0, 0x989680}, {0x0, 0x9}}, &(0x7f0000040000)) tkill(r1, 0x1000000000014) 01:56:47 executing program 4: r0 = socket$inet6(0xa, 0x5, 0x0) ioctl(r0, 0x8912, &(0x7f0000000080)="0a5cc80700315f85715070") unshare(0x100000fd) fcntl$getown(r0, 0x9) rename(&(0x7f0000000200)='./file0/file0\x00', &(0x7f0000000180)='./file1\x00') 01:56:47 executing program 1: r0 = socket$can_bcm(0x1d, 0x2, 0x2) getsockopt$inet6_mreq(0xffffffffffffff9c, 0x29, 0x1c, &(0x7f0000000740)={@mcast2}, &(0x7f0000000780)=0x14) getsockname$packet(0xffffffffffffffff, &(0x7f0000000800)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @remote}, &(0x7f0000000840)=0x14) getsockopt$inet_pktinfo(0xffffffffffffff9c, 0x0, 0x8, &(0x7f00000008c0)={0x0, @multicast1, @rand_addr}, &(0x7f0000000900)=0xc) connect$can_bcm(r0, &(0x7f00000007c0)={0x1d, r1}, 0xffffffffffffff29) sendto(r0, &(0x7f0000000100)="d9c45e2a0052199d67f794d6940d5a4468a070301776e0c75c709b74d465ac7530a9d97341092d6f8d87be45c0badb5f0e123ea0df3bf606", 0x38, 0x0, &(0x7f0000000280)=@generic={0x1d, "22cd473a59f437d1e76cf3cf6223490a82bdb57830c889171a07f5f195f02f205b1db9984f4e822ba1ec187e1cc9f94d99c24d61c71c0837f20c917d43222f3c011c3f0c0e9f93514c05f72556b56ca5ffd3eadfccd4326258aff1454f235d35d20b0053907766bd697a21e7bcc0ecc27b82d9bc6230b51f381ec5756049"}, 0x80) r2 = syz_open_dev$usbmon(&(0x7f0000000080)='/dev/usbmon#\x00', 0xa9d6, 0x402) setsockopt$IP_VS_SO_SET_EDIT(r2, 0x0, 0x483, &(0x7f0000000040)={0x21, @loopback, 0x4e23, 0x0, 'lc\x00', 0x16, 0x4, 0x16}, 0x2c) 01:56:47 executing program 3: r0 = socket$inet(0x2, 0x3, 0x2) connect$inet(0xffffffffffffffff, &(0x7f0000000000)={0x2, 0x0, @local}, 0x10) setsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x23, &(0x7f0000000000)={{{@in=@multicast2, @in=@multicast1}}, {{@in6}, 0x0, @in6=@loopback}}, 0xe8) syz_emit_ethernet(0x2a, &(0x7f0000000640)={@random="b100485caa2a", @link_local, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x3000000, 0x1c, 0x0, 0x0, 0x0, 0x2, 0x0, @rand_addr, @broadcast}, @igmp={0x11, 0xffffffffffffffff, 0x0, @multicast1}}}}}, &(0x7f0000000140)) 01:56:47 executing program 0: socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000001f80)={0xffffffffffffffff, 0xffffffffffffffff}) setsockopt$SO_ATTACH_FILTER(r2, 0x1, 0x1a, &(0x7f0000ab9ff0)={0x2, &(0x7f000039a000)=[{0x20, 0x0, 0x0, 0xfffffffffffff010}, {0x6}]}, 0x10) sendmmsg(r1, &(0x7f0000001e80)=[{{&(0x7f0000000700)=@l2, 0x80, &(0x7f0000001dc0)}}], 0x1, 0x0) 01:56:47 executing program 7: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000180)='/dev/sequencer\x00', 0x10002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000080)="0a5cc80700315f85715070") r1 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000001c0)={0x2, 0x0, &(0x7f0000000140)=ANY=[@ANYBLOB='\fc'], 0x0, 0x0, &(0x7f0000000080)}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, &(0x7f00000001c0)}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000040)={0x8, 0x4, &(0x7f00000000c0)=[@release={0x400c630f}], 0x1, 0x0, &(0x7f0000000100)='V'}) fstat(r0, &(0x7f00000002c0)) [ 693.224977] binder: 14949:14995 Acquire 1 refcount change on invalid ref 0 ret -22 [ 693.232923] binder: 14949:14995 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 01:56:47 executing program 1: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="0a5cc80700315f85714070") r1 = openat$zero(0xffffffffffffff9c, &(0x7f0000000040)='/dev/zero\x00', 0x282000, 0x0) ioctl$KVM_DIRTY_TLB(r1, 0x4010aeaa, &(0x7f0000000080)={0x80000000, 0x4}) setrlimit(0x2, &(0x7f0000000000)) pkey_mprotect(&(0x7f0000ffb000/0x4000)=nil, 0x4000, 0x2, 0xffffffffffffffff) 01:56:47 executing program 5: perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1f}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000340)={&(0x7f0000000000), 0xc, &(0x7f0000000300)={&(0x7f0000000240)=@newlink={0x50, 0x10, 0x721, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x2}, [@IFLA_LINKINFO={0x28, 0x12, @veth={{0xc, 0x1, 'veth\x00'}, {0x18, 0x2, @VETH_INFO_PEER={0x14}}}}, @IFLA_NET_NS_FD={0x8}]}, 0x50}}, 0x0) 01:56:47 executing program 2: r0 = socket$inet(0x2, 0x3, 0x2) connect$inet(0xffffffffffffffff, &(0x7f0000000000)={0x2, 0x0, @local}, 0x10) setsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x23, &(0x7f0000000000)={{{@in=@multicast2, @in=@multicast1}}, {{@in6}, 0x0, @in6=@loopback}}, 0xe8) syz_emit_ethernet(0x2a, &(0x7f0000000640)={@random="b100485caa2a", @link_local, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x1c, 0x0, 0x0, 0x0, 0x2, 0x0, @rand_addr, @broadcast}, @igmp={0x11, 0x0, 0x0, @multicast1}}}}}, &(0x7f0000000140)={0x0, 0x0, [0x0, 0x0, 0x0, 0x1c00000000000000]}) 01:56:47 executing program 4: r0 = syz_open_dev$sndpcmp(&(0x7f0000000040)='/dev/snd/pcmC#D#p\x00', 0x200, 0xd4686ecba40cf669) ioctl$BLKIOOPT(r0, 0x1279, &(0x7f0000000080)) r1 = perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1f}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r2 = socket$xdp(0x2c, 0x3, 0x0) setsockopt$EBT_SO_SET_ENTRIES(0xffffffffffffffff, 0x0, 0x80, &(0x7f0000001340)=@broute={'broute\x00', 0x20, 0x3, 0x90, [0x0, 0x0, 0x0, 0x0, 0x0, 0x200004c0], 0x0, &(0x7f00000003c0), &(0x7f00000004c0)=[{}, {0x0, '\x00', 0x1}, {0x0, '\x00', 0x3}]}, 0x108) dup2(r1, r2) ioctl$BLKPG(0xffffffffffffffff, 0x1269, &(0x7f0000000240)={0x0, 0x0, 0x0, &(0x7f0000000200)}) 01:56:47 executing program 3: r0 = socket$inet(0x2, 0x3, 0x2) connect$inet(0xffffffffffffffff, &(0x7f0000000000)={0x2, 0x0, @local}, 0x10) setsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x23, &(0x7f0000000000)={{{@in=@multicast2, @in=@multicast1}}, {{@in6}, 0x0, @in6=@loopback}}, 0xe8) syz_emit_ethernet(0x2a, &(0x7f0000000640)={@random="b100485caa2a", @link_local, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0xf000, 0x1c, 0x0, 0x0, 0x0, 0x2, 0x0, @rand_addr, @broadcast}, @igmp={0x11, 0xffffffffffffffff, 0x0, @multicast1}}}}}, &(0x7f0000000140)) 01:56:47 executing program 0: socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000001f80)={0xffffffffffffffff, 0xffffffffffffffff}) setsockopt$SO_ATTACH_FILTER(r2, 0x1, 0x1a, &(0x7f0000ab9ff0)={0x2, &(0x7f000039a000)=[{0x20, 0x0, 0x0, 0xfffffffffffff010}, {0x6}]}, 0x10) sendmmsg(r1, &(0x7f0000001e80)=[{{&(0x7f0000000700)=@l2, 0x80, &(0x7f0000001dc0)}}], 0x1, 0x0) [ 693.414473] binder: 15020:15021 Acquire 1 refcount change on invalid ref 0 ret -22 [ 693.431563] mmap: syz-executor1 (15026): VmData 18382848 exceed data ulimit 0. Update limits or use boot option ignore_rlimit_data. 01:56:47 executing program 5: perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1f}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000340)={&(0x7f0000000000), 0xc, &(0x7f0000000300)={&(0x7f0000000240)=@newlink={0x50, 0x10, 0x721, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x7}, [@IFLA_LINKINFO={0x28, 0x12, @veth={{0xc, 0x1, 'veth\x00'}, {0x18, 0x2, @VETH_INFO_PEER={0x14}}}}, @IFLA_NET_NS_FD={0x8}]}, 0x50}}, 0x0) 01:56:47 executing program 4: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="0a5cc80700315f85715070") perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x15, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10000003, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) io_cancel(0x0, &(0x7f0000000100)={0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, 0xffffffffffffffff, &(0x7f0000000040)}, &(0x7f0000000140)) getsockopt$inet_sctp_SCTP_DELAYED_SACK(0xffffffffffffffff, 0x84, 0x10, &(0x7f0000000080)=@sack_info={0x0, 0x1, 0x2}, &(0x7f00000000c0)=0xc) getsockopt$inet_sctp6_SCTP_GET_LOCAL_ADDRS(r0, 0x84, 0x6d, &(0x7f00000001c0)={r1, 0x82, "62f3edff27afd80c288657cbc1de123ed98826481248f99743344f6dac9cfa04cb0b6d86f8e252162f6465e3bc1a66d04df7a38f7ece08197285e12320af1e39541f29c4ee829115d2e2768cd8781c6588ff52c708883e1a1c91fb2e7eb0bdf2933f2b8d9e6c8f91844fda7e0299da7e612a0d05fdc6dc773aa1adca9bec30e4c03d"}, &(0x7f00000002c0)=0x8a) 01:56:47 executing program 3: r0 = socket$inet(0x2, 0x3, 0x2) connect$inet(0xffffffffffffffff, &(0x7f0000000000)={0x2, 0x0, @local}, 0x10) setsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x23, &(0x7f0000000000)={{{@in=@multicast2, @in=@multicast1}}, {{@in6}, 0x0, @in6=@loopback}}, 0xe8) syz_emit_ethernet(0x2a, &(0x7f0000000640)={@random="b100485caa2a", @link_local, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x4000, 0x1c, 0x0, 0x0, 0x0, 0x2, 0x0, @rand_addr, @broadcast}, @igmp={0x11, 0xffffffffffffffff, 0x0, @multicast1}}}}}, &(0x7f0000000140)) 01:56:47 executing program 2: r0 = socket$inet(0x2, 0x3, 0x2) connect$inet(0xffffffffffffffff, &(0x7f0000000000)={0x2, 0x0, @local}, 0x10) setsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x23, &(0x7f0000000000)={{{@in=@multicast2, @in=@multicast1}}, {{@in6}, 0x0, @in6=@loopback}}, 0xe8) syz_emit_ethernet(0x2a, &(0x7f0000000640)={@random="b100485caa2a", @link_local, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x1c, 0x0, 0x0, 0x0, 0x2, 0x0, @rand_addr, @broadcast}, @igmp={0x11, 0x0, 0x0, @multicast1}}}}}, &(0x7f0000000140)={0x0, 0x0, [0x0, 0x0, 0x0, 0x1000000]}) [ 693.586878] binder: 15020:15021 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 693.665032] binder: 15020:15051 unknown command 0 [ 693.670542] binder: 15020:15051 ioctl c0306201 20000040 returned -22 [ 693.714661] binder: 15020:15051 Acquire 1 refcount change on invalid ref 0 ret -22 [ 693.783278] binder: 15020:15021 unknown command 0 [ 693.794034] binder: 15020:15021 ioctl c0306201 20000040 returned -22 [ 693.800885] binder: 15020:15051 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 01:56:48 executing program 6: r0 = syz_open_dev$sndseq(&(0x7f0000000100)='/dev/snd/seq\x00', 0x0, 0x0) read(r0, &(0x7f0000fb6000)=""/28, 0x3f0) ioctl$SNDRV_SEQ_IOCTL_REMOVE_EVENTS(r0, 0x4040534e, &(0x7f00000001c0)={0xbf}) ioctl$SNDRV_SEQ_IOCTL_QUERY_SUBS(r0, 0xc058534f, &(0x7f00000002c0)={{}, 0x1, 0x0, 0x0, {}, 0x0, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xbf000000]}) r1 = gettid() timer_create(0x0, &(0x7f0000044000)={0x0, 0x12}, &(0x7f0000000040)) r2 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r2, 0x8912, &(0x7f00000001c0)="0a5cc80700315f85715070") timer_settime(0x0, 0x0, &(0x7f0000000080)={{0x0, 0x989680}, {0x0, 0x9}}, &(0x7f0000040000)) tkill(r1, 0x1000000000014) 01:56:48 executing program 1: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000040)="0a5cc80700315f85715070") r1 = syz_open_dev$sndseq(&(0x7f0000000100)='/dev/snd/seq\x00', 0x0, 0x0) read(r1, &(0x7f0000000200)=""/28, 0x1c) getsockopt$inet_sctp6_SCTP_STATUS(r0, 0x84, 0xe, &(0x7f0000000140)={0x0, 0x7, 0x4, 0x8000, 0x5, 0x3fffffffc000000, 0x89, 0x4, {0x0, @in={{0x2, 0x4e20, @rand_addr=0x3}}, 0x0, 0x4, 0x9, 0x275b, 0x8}}, &(0x7f0000000240)=0xb0) setsockopt$inet_sctp6_SCTP_PR_SUPPORTED(r0, 0x84, 0x71, &(0x7f0000000280)={r2, 0x5}, 0x8) ioctl$SNDRV_SEQ_IOCTL_REMOVE_EVENTS(r1, 0x4040534e, &(0x7f0000000400)={0xbf}) ioctl$SNDRV_SEQ_IOCTL_GET_QUEUE_CLIENT(r1, 0xc0105303, &(0x7f00000002c0)) r3 = gettid() timer_create(0x0, &(0x7f0000000000)={0x0, 0x12, 0x0, @thr={&(0x7f0000000480), &(0x7f0000000580)}}, &(0x7f0000000040)) timer_settime(0x0, 0x0, &(0x7f0000000080)={{0x0, 0x989680}, {0x0, 0x9}}, &(0x7f0000040000)) tkill(r3, 0x1000000000013) ptrace$poke(0x5, r3, &(0x7f00000000c0), 0x6) 01:56:48 executing program 0: socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000001f80)={0xffffffffffffffff, 0xffffffffffffffff}) setsockopt$SO_ATTACH_FILTER(r2, 0x1, 0x1a, &(0x7f0000ab9ff0)={0x2, &(0x7f000039a000)=[{0x20, 0x0, 0x0, 0xfffffffffffff010}, {0x6}]}, 0x10) sendmmsg(r1, &(0x7f0000001e80)=[{{&(0x7f0000000700)=@l2, 0x80, &(0x7f0000001dc0)}}], 0x1, 0x0) 01:56:48 executing program 5: perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1f}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000340)={&(0x7f0000000000), 0xc, &(0x7f0000000300)={&(0x7f0000000240)=@newlink={0x50, 0x10, 0x721, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x2000000}, [@IFLA_LINKINFO={0x28, 0x12, @veth={{0xc, 0x1, 'veth\x00'}, {0x18, 0x2, @VETH_INFO_PEER={0x14}}}}, @IFLA_NET_NS_FD={0x8}]}, 0x50}}, 0x0) 01:56:48 executing program 2: r0 = socket$inet(0x2, 0x3, 0x2) connect$inet(0xffffffffffffffff, &(0x7f0000000000)={0x2, 0x0, @local}, 0x10) setsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x23, &(0x7f0000000000)={{{@in=@multicast2, @in=@multicast1}}, {{@in6}, 0x0, @in6=@loopback}}, 0xe8) syz_emit_ethernet(0x2a, &(0x7f0000000640)={@random="b100485caa2a", @link_local, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x1c, 0x0, 0x0, 0x0, 0x2, 0x0, @rand_addr, @broadcast}, @igmp={0x11, 0x0, 0x0, @multicast1}}}}}, &(0x7f0000000140)={0x0, 0x0, [0x0, 0x0, 0x0, 0x20000000]}) 01:56:48 executing program 4: r0 = perf_event_open(&(0x7f0000000a40)={0x2, 0x70, 0x3e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1f}, 0x0, 0x0, 0xffffffffffffffff, 0x0) fcntl$lock(r0, 0x7, &(0x7f0000000240)={0x2, 0x2, 0x0, 0x8}) ioctl$sock_kcm_SIOCKCMCLONE(0xffffffffffffff9c, 0x89e2, &(0x7f0000000040)={0xffffffffffffff9c}) accept$alg(r1, 0x0, 0x0) 01:56:48 executing program 3: r0 = socket$inet(0x2, 0x3, 0x2) connect$inet(0xffffffffffffffff, &(0x7f0000000000)={0x2, 0x0, @local}, 0x10) setsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x23, &(0x7f0000000000)={{{@in=@multicast2, @in=@multicast1}}, {{@in6}, 0x0, @in6=@loopback}}, 0xe8) syz_emit_ethernet(0x2a, &(0x7f0000000640)={@random="b100485caa2a", @link_local, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x20000000, 0x1c, 0x0, 0x0, 0x0, 0x2, 0x0, @rand_addr, @broadcast}, @igmp={0x11, 0xffffffffffffffff, 0x0, @multicast1}}}}}, &(0x7f0000000140)) 01:56:48 executing program 7: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000180)='/dev/sequencer\x00', 0x10002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000080)="0a5cc80700315f85715070") r1 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000001c0)={0x2, 0x0, &(0x7f0000000140)=ANY=[@ANYBLOB='\fc'], 0x0, 0x0, &(0x7f0000000080)}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, &(0x7f00000001c0)}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000040)={0x8, 0x4c00000000000000, &(0x7f00000000c0)=[@release={0x400c630f}], 0x1, 0x0, &(0x7f0000000100)='V'}) fstat(r0, &(0x7f00000002c0)) 01:56:48 executing program 4: r0 = syz_open_dev$midi(&(0x7f0000000080)='/dev/midi#\x00', 0xffffffffffffff9a, 0x200002) ioctl$SNDRV_CTL_IOCTL_ELEM_WRITE(r0, 0xc4c85513, &(0x7f0000000280)={{0x7, 0x3, 0x34, 0x7, '\x00', 0x1}, 0x0, [0x2c5, 0x5d, 0x200, 0x80000001, 0x7, 0x800, 0xd037, 0x7, 0x8, 0x9, 0x1, 0xfffffffffffffffc, 0xc66, 0x3, 0x80000001, 0x32, 0x2, 0x9, 0x5ca, 0x5, 0x643, 0xccf9, 0x5, 0xdb80, 0x5, 0x7, 0x7f, 0x8, 0x100, 0x101, 0xcdcc, 0x1000, 0x0, 0x6, 0xcb66, 0x2, 0x7, 0x5, 0x400, 0x4, 0xffffffffffffff2b, 0x0, 0x7, 0x4, 0x9, 0x81, 0x0, 0xad5f, 0x3, 0x6, 0x2, 0x81, 0x5a, 0x40, 0x126, 0x1, 0x80000001, 0x0, 0x1000, 0x24b, 0x6a, 0xfffffffffffffffa, 0x1, 0x0, 0x40, 0x6, 0x2, 0x100, 0xd, 0x8, 0xfffffffffffffe00, 0x5, 0x800, 0x1, 0x0, 0x1, 0x3, 0x8b5dcc5, 0x100000001, 0x193, 0x3a0, 0x9, 0x7fff, 0x9, 0x6fa, 0x100000000, 0x5, 0x1, 0x2, 0x5, 0x5, 0x2f1, 0x200, 0x2, 0x3, 0x8, 0x80000000, 0x6d, 0xfffffffffffffc01, 0x40, 0x9, 0x9, 0x1, 0x9, 0x81, 0xd21, 0x8, 0x4, 0xa1, 0xff, 0x1, 0xffffffffffffd378, 0xfff, 0x800, 0x100000001, 0x4, 0x0, 0x36b8, 0xfffffffffffffffe, 0x7f, 0x81, 0x2b1ca8d1, 0xc7, 0x9, 0x2, 0x3, 0x6a], {0x77359400}}) setsockopt$inet_sctp6_SCTP_SOCKOPT_BINDX_ADD(r0, 0x84, 0x64, &(0x7f00000000c0)=[@in6={0xa, 0x4e22, 0x7, @loopback, 0x1}, @in6={0xa, 0x4e22, 0x6, @empty, 0x3}, @in6={0xa, 0x4e22, 0x1, @ipv4={[], [], @loopback}, 0x3fa3}, @in6={0xa, 0x4e23, 0x800, @mcast1, 0x40}], 0x70) ioctl$sock_SIOCGSKNS(r0, 0x894c, &(0x7f0000000180)=0x6) r1 = epoll_create(0x9) socket$vsock_dgram(0x28, 0x2, 0x0) ioctl$SG_GET_NUM_WAITING(r0, 0x227d, &(0x7f0000000780)) ioctl$sock_kcm_SIOCKCMATTACH(r0, 0x89e0, &(0x7f00000007c0)={r0, r0}) ioctl$PIO_UNIMAPCLR(r0, 0x4b68, &(0x7f0000000240)={0x8, 0x80, 0x1}) epoll_pwait(r1, &(0x7f0000000000)=[{}], 0x1, 0x0, &(0x7f0000000040), 0x8) ioctl$sock_inet6_tcp_SIOCINQ(r0, 0x541b, &(0x7f0000000140)) fsync(r0) ioctl$SNDRV_SEQ_IOCTL_REMOVE_EVENTS(r0, 0x4040534e, &(0x7f00000001c0)={0x40, @time, 0x2, {0x9}, 0xf77, 0x0, 0x6d}) 01:56:48 executing program 3: r0 = socket$inet(0x2, 0x3, 0x2) connect$inet(0xffffffffffffffff, &(0x7f0000000000)={0x2, 0x0, @local}, 0x10) setsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x23, &(0x7f0000000000)={{{@in=@multicast2, @in=@multicast1}}, {{@in6}, 0x0, @in6=@loopback}}, 0xe8) syz_emit_ethernet(0x2a, &(0x7f0000000640)={@random="b100485caa2a", @link_local, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0xf0ffff, 0x1c, 0x0, 0x0, 0x0, 0x2, 0x0, @rand_addr, @broadcast}, @igmp={0x11, 0xffffffffffffffff, 0x0, @multicast1}}}}}, &(0x7f0000000140)) [ 694.283710] binder: 15078:15094 Acquire 1 refcount change on invalid ref 0 ret -22 01:56:48 executing program 2: r0 = socket$inet(0x2, 0x3, 0x2) connect$inet(0xffffffffffffffff, &(0x7f0000000000)={0x2, 0x0, @local}, 0x10) setsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x23, &(0x7f0000000000)={{{@in=@multicast2, @in=@multicast1}}, {{@in6}, 0x0, @in6=@loopback}}, 0xe8) syz_emit_ethernet(0x2a, &(0x7f0000000640)={@random="b100485caa2a", @link_local, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x1c, 0x0, 0x0, 0x0, 0x2, 0x0, @rand_addr, @broadcast}, @igmp={0x11, 0x0, 0x0, @multicast1}}}}}, &(0x7f0000000140)={0x0, 0x0, [0x0, 0x0, 0x0, 0x40000000]}) 01:56:48 executing program 5: perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1f}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000340)={&(0x7f0000000000), 0xc, &(0x7f0000000300)={&(0x7f0000000240)=@newlink={0x50, 0x10, 0x721, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0xf0ffffff}, [@IFLA_LINKINFO={0x28, 0x12, @veth={{0xc, 0x1, 'veth\x00'}, {0x18, 0x2, @VETH_INFO_PEER={0x14}}}}, @IFLA_NET_NS_FD={0x8}]}, 0x50}}, 0x0) [ 694.346466] binder: 15078:15094 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 01:56:48 executing program 4: perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff7ffffffffffb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = openat$pfkey(0xffffffffffffff9c, &(0x7f0000000140)='/proc/self/net/pfkey\x00', 0x0, 0x0) getsockopt$inet_sctp6_SCTP_ASSOCINFO(0xffffffffffffff9c, 0x84, 0x1, &(0x7f0000000300)={0x0, 0x2, 0x0, 0x8, 0x5, 0x6}, &(0x7f0000000340)=0x14) getsockopt$inet_sctp_SCTP_PR_ASSOC_STATUS(r0, 0x84, 0x73, &(0x7f0000000380)={r1, 0x0, 0x20, 0x80000000, 0x4}, &(0x7f00000003c0)=0x18) ioctl$SNDRV_SEQ_IOCTL_SUBSCRIBE_PORT(0xffffffffffffffff, 0x40505330, &(0x7f0000000080)={{0x0, 0x800}}) r2 = syz_open_dev$dspn(&(0x7f0000000040)='/dev/dsp#\x00', 0x7ff, 0x800) r3 = syz_genetlink_get_family_id$fou(&(0x7f00000002c0)='fou\x00') sendmsg$FOU_CMD_DEL(r2, &(0x7f0000000280)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x20000400}, 0xc, &(0x7f00000001c0)={&(0x7f0000000180)={0x2c, r3, 0x200, 0x70bd28, 0x25dfdbfc, {}, [@FOU_ATTR_TYPE={0x8, 0x4, 0x1}, @FOU_ATTR_TYPE={0x8, 0x4, 0x1}, @FOU_ATTR_TYPE={0x8, 0x4, 0x2}]}, 0x2c}, 0x1, 0x0, 0x0, 0x8080}, 0x811) setrlimit(0x400000000000007, &(0x7f0000000000)) socket$kcm(0x29, 0x5, 0x0) 01:56:48 executing program 0: socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000001f80)={0xffffffffffffffff, 0xffffffffffffffff}) setsockopt$SO_ATTACH_FILTER(r2, 0x1, 0x1a, &(0x7f0000ab9ff0)={0x2, &(0x7f000039a000)=[{0x20, 0x0, 0x0, 0xfffffffffffff010}, {0x6}]}, 0x10) sendmmsg(r1, &(0x7f0000001e80)=[{{&(0x7f0000000700)=@l2, 0x80, &(0x7f0000001dc0)}}], 0x1, 0x0) [ 694.448266] binder: 15078:15104 Acquire 1 refcount change on invalid ref 0 ret -22 [ 694.465610] binder: 15078:15104 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 01:56:48 executing program 3: r0 = socket$inet(0x2, 0x3, 0x2) connect$inet(0xffffffffffffffff, &(0x7f0000000000)={0x2, 0x0, @local}, 0x10) setsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x23, &(0x7f0000000000)={{{@in=@multicast2, @in=@multicast1}}, {{@in6}, 0x0, @in6=@loopback}}, 0xe8) syz_emit_ethernet(0x2a, &(0x7f0000000640)={@random="b100485caa2a", @link_local, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x6000000, 0x1c, 0x0, 0x0, 0x0, 0x2, 0x0, @rand_addr, @broadcast}, @igmp={0x11, 0xffffffffffffffff, 0x0, @multicast1}}}}}, &(0x7f0000000140)) [ 694.499937] binder: 15094 RLIMIT_NICE not set 01:56:48 executing program 4: r0 = socket$inet6_udp(0xa, 0x2, 0x0) getsockopt$inet6_buf(r0, 0x29, 0xb, &(0x7f0000000000)=""/40, &(0x7f0000001000)=0x28) r1 = accept4$inet6(r0, &(0x7f0000000040)={0xa, 0x0, 0x0, @ipv4={[], [], @remote}}, &(0x7f0000000080)=0x1c, 0x80800) getsockopt$inet_sctp6_SCTP_GET_PEER_ADDRS(0xffffffffffffffff, 0x84, 0x6c, &(0x7f00000000c0)={0x0, 0xaf, "45eb1c69e786127b5bec4165d9e6f346ce44ae7c2c3149d033ab5ddd6d9ab4aae54f879f08e78d3bb27af8ab477822ddecfaccddf1672944c2cc1bc0194958c6dce006d89ce7e8fce5b80a78c6af57e5a718d7bc1d335de18d3039910f895957844980ae4856f89830c3a6e0bcfe793430daffd16a7f5ecd8d6d41259fa451347ded67866b378cdd158214f769b38c59b084bd5aa4f7b5e80aa91d03dac1688e2f937309f57bb0a3913271328e6e43"}, &(0x7f0000000180)=0xb7) setsockopt$inet_sctp6_SCTP_AUTH_DELETE_KEY(r1, 0x84, 0x19, &(0x7f00000001c0)={r2, 0x9}, 0x8) 01:56:48 executing program 6: r0 = syz_open_dev$sndseq(&(0x7f0000000100)='/dev/snd/seq\x00', 0x0, 0x0) read(r0, &(0x7f0000fb6000)=""/28, 0x3f0) ioctl$SNDRV_SEQ_IOCTL_REMOVE_EVENTS(r0, 0x4040534e, &(0x7f00000001c0)={0xbf}) ioctl$SNDRV_SEQ_IOCTL_QUERY_SUBS(r0, 0xc058534f, &(0x7f00000002c0)={{}, 0x1, 0x0, 0x0, {}, 0x0, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xe]}) r1 = gettid() timer_create(0x0, &(0x7f0000044000)={0x0, 0x12}, &(0x7f0000000040)) r2 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r2, 0x8912, &(0x7f00000001c0)="0a5cc80700315f85715070") timer_settime(0x0, 0x0, &(0x7f0000000080)={{0x0, 0x989680}, {0x0, 0x9}}, &(0x7f0000040000)) tkill(r1, 0x1000000000014) 01:56:49 executing program 1: r0 = socket$inet(0x2, 0x80000, 0x0) r1 = creat(&(0x7f00000000c0)='./file0\x00', 0x1) setsockopt$inet_sctp6_SCTP_SOCKOPT_BINDX_ADD(r1, 0x84, 0x64, &(0x7f0000000100)=[@in6={0xa, 0x4e24, 0x6, @remote, 0x8}, @in={0x2, 0x4e21, @broadcast}, @in6={0xa, 0x4e23, 0x3ff, @ipv4={[], [], @local}, 0x7}], 0x48) setsockopt$IP_VS_SO_SET_STARTDAEMON(r0, 0x0, 0x10, &(0x7f00000005c0)={0x0, 'lo\x00'}, 0x18) getsockopt$sock_cred(r0, 0x1, 0x11, &(0x7f0000000000)={0x0}, &(0x7f0000000040)=0xc) rt_sigqueueinfo(r2, 0x10, &(0x7f0000000080)={0x15, 0x81, 0x1, 0x40}) 01:56:49 executing program 2: r0 = socket$inet(0x2, 0x3, 0x2) connect$inet(0xffffffffffffffff, &(0x7f0000000000)={0x2, 0x0, @local}, 0x10) setsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x23, &(0x7f0000000000)={{{@in=@multicast2, @in=@multicast1}}, {{@in6}, 0x0, @in6=@loopback}}, 0xe8) syz_emit_ethernet(0x2a, &(0x7f0000000640)={@random="b100485caa2a", @link_local, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x1c, 0x0, 0x0, 0x0, 0x2, 0x0, @rand_addr, @broadcast}, @igmp={0x11, 0x0, 0x0, @multicast1}}}}}, &(0x7f0000000140)={0x0, 0x0, [0x0, 0x0, 0x0, 0x6]}) 01:56:49 executing program 5: perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1f}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000340)={&(0x7f0000000000), 0xc, &(0x7f0000000300)={&(0x7f0000000240)=@newlink={0x50, 0x10, 0x721, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x600}, [@IFLA_LINKINFO={0x28, 0x12, @veth={{0xc, 0x1, 'veth\x00'}, {0x18, 0x2, @VETH_INFO_PEER={0x14}}}}, @IFLA_NET_NS_FD={0x8}]}, 0x50}}, 0x0) 01:56:49 executing program 7: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000180)='/dev/sequencer\x00', 0x10002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000080)="0a5cc80700315f85715070") r1 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000001c0)={0x2, 0x0, &(0x7f0000000140)=ANY=[@ANYBLOB='\fc'], 0x0, 0x0, &(0x7f0000000080)}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, &(0x7f00000001c0)}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000040)={0x8, 0x6000000000000000, &(0x7f00000000c0)=[@release={0x400c630f}], 0x1, 0x0, &(0x7f0000000100)='V'}) fstat(r0, &(0x7f00000002c0)) 01:56:49 executing program 3: r0 = socket$inet(0x2, 0x3, 0x2) connect$inet(0xffffffffffffffff, &(0x7f0000000000)={0x2, 0x0, @local}, 0x10) setsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x23, &(0x7f0000000000)={{{@in=@multicast2, @in=@multicast1}}, {{@in6}, 0x0, @in6=@loopback}}, 0xe8) syz_emit_ethernet(0x2a, &(0x7f0000000640)={@random="b100485caa2a", @link_local, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x3, 0x1c, 0x0, 0x0, 0x0, 0x2, 0x0, @rand_addr, @broadcast}, @igmp={0x11, 0xffffffffffffffff, 0x0, @multicast1}}}}}, &(0x7f0000000140)) 01:56:49 executing program 4: r0 = socket$inet_tcp(0x2, 0x1, 0x0) ioctl$sock_inet_SIOCSIFADDR(r0, 0x891c, &(0x7f00000000c0)={'tunl0\x00', {0x2, 0x0, @loopback}}) setsockopt$IP_VS_SO_SET_ZERO(r0, 0x0, 0x48f, &(0x7f0000000000)={0xff, @multicast1, 0x4e20, 0x2, 'lblcr\x00', 0x14, 0x8000, 0x19}, 0x2c) 01:56:49 executing program 0: socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000001f80)={0xffffffffffffffff, 0xffffffffffffffff}) setsockopt$SO_ATTACH_FILTER(r2, 0x1, 0x1a, &(0x7f0000ab9ff0)={0x2, &(0x7f000039a000)=[{0x20, 0x0, 0x0, 0xfffffffffffff010}, {0x6}]}, 0x10) sendmmsg(r1, &(0x7f0000001e80)=[{{&(0x7f0000000700)=@l2, 0x80, &(0x7f0000001dc0)}}], 0x1, 0x0) [ 695.131555] IPVS: set_ctl: invalid protocol: 255 224.0.0.1:20000 [ 695.153029] IPVS: set_ctl: invalid protocol: 255 224.0.0.1:20000 01:56:49 executing program 5: perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1f}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000340)={&(0x7f0000000000), 0xc, &(0x7f0000000300)={&(0x7f0000000240)=@newlink={0x50, 0x10, 0x721, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x8100}, [@IFLA_LINKINFO={0x28, 0x12, @veth={{0xc, 0x1, 'veth\x00'}, {0x18, 0x2, @VETH_INFO_PEER={0x14}}}}, @IFLA_NET_NS_FD={0x8}]}, 0x50}}, 0x0) 01:56:49 executing program 4: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000080)="0a5cc80700315f85715070") flock(r0, 0x2) r1 = openat$sequencer(0xffffffffffffff9c, &(0x7f0000000180)='/dev/sequencer\x00', 0x80000000000046, 0x0) r2 = getpgrp(0x0) write$FUSE_DIRENT(r1, &(0x7f00000001c0)={0xc8, 0x0, 0x7, [{0x3, 0x7, 0xf, 0x7, '/dev/sequencer\x00'}, {0x0, 0x59, 0xf, 0x80000001, '/dev/sequencer\x00'}, {0x4, 0x5, 0x9, 0x6, '//selinux'}, {0x1, 0x2, 0x5, 0xfc, 'maps\x00'}, {0x2, 0x8, 0x5, 0x4, 'maps\x00'}]}, 0xc8) r3 = syz_open_procfs(r2, &(0x7f00000000c0)='maps\x00') sendfile(r1, r3, &(0x7f0000000000), 0x2b420a4f) 01:56:49 executing program 2: r0 = socket$inet(0x2, 0x3, 0x2) connect$inet(0xffffffffffffffff, &(0x7f0000000000)={0x2, 0x0, @local}, 0x10) setsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x23, &(0x7f0000000000)={{{@in=@multicast2, @in=@multicast1}}, {{@in6}, 0x0, @in6=@loopback}}, 0xe8) syz_emit_ethernet(0x2a, &(0x7f0000000640)={@random="b100485caa2a", @link_local, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x1c, 0x0, 0x0, 0x0, 0x2, 0x0, @rand_addr, @broadcast}, @igmp={0x11, 0x0, 0x0, @multicast1}}}}}, &(0x7f0000000140)={0x0, 0x0, [0x0, 0x0, 0x0, 0x3e00000000000000]}) [ 695.183117] binder: 15149:15151 Acquire 1 refcount change on invalid ref 0 ret -22 [ 695.222050] binder: 15149:15151 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 01:56:49 executing program 3: r0 = socket$inet(0x2, 0x3, 0x2) connect$inet(0xffffffffffffffff, &(0x7f0000000000)={0x2, 0x0, @local}, 0x10) setsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x23, &(0x7f0000000000)={{{@in=@multicast2, @in=@multicast1}}, {{@in6}, 0x0, @in6=@loopback}}, 0xe8) syz_emit_ethernet(0x2a, &(0x7f0000000640)={@random="b100485caa2a", @link_local, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x1c, 0x1c, 0x0, 0x0, 0x0, 0x2, 0x0, @rand_addr, @broadcast}, @igmp={0x11, 0xffffffffffffffff, 0x0, @multicast1}}}}}, &(0x7f0000000140)) 01:56:49 executing program 1: r0 = socket$inet6(0xa, 0x3, 0x84) connect$inet6(r0, &(0x7f0000000180)={0xa, 0x0, 0x0, @remote, 0x9}, 0x1c) sendmsg(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000040)=[{&(0x7f0000000300)="ba02000001f4000000e99f7b01adc2f2", 0x10}], 0x1, &(0x7f0000000100)}, 0x0) modify_ldt$write2(0x11, &(0x7f0000000000)={0x2, 0x20001000, 0xffffffffffffffff, 0xffffffffffff0001, 0x40, 0x8, 0x2, 0x2, 0x2, 0x3}, 0x10) 01:56:49 executing program 0: socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000001f80)={0xffffffffffffffff, 0xffffffffffffffff}) setsockopt$SO_ATTACH_FILTER(r2, 0x1, 0x1a, &(0x7f0000ab9ff0)={0x2, &(0x7f000039a000)=[{0x20, 0x0, 0x0, 0xfffffffffffff010}, {0x6}]}, 0x10) sendmmsg(r1, &(0x7f0000001e80)=[{{&(0x7f0000000700)=@l2, 0x80, &(0x7f0000001dc0)}}], 0x1, 0x0) 01:56:49 executing program 2: r0 = socket$inet(0x2, 0x3, 0x2) connect$inet(0xffffffffffffffff, &(0x7f0000000000)={0x2, 0x0, @local}, 0x10) setsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x23, &(0x7f0000000000)={{{@in=@multicast2, @in=@multicast1}}, {{@in6}, 0x0, @in6=@loopback}}, 0xe8) syz_emit_ethernet(0x2a, &(0x7f0000000640)={@random="b100485caa2a", @link_local, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x1c, 0x0, 0x0, 0x0, 0x2, 0x0, @rand_addr, @broadcast}, @igmp={0x11, 0x0, 0x0, @multicast1}}}}}, &(0x7f0000000140)={0x0, 0x0, [0x0, 0x0, 0x0, 0x4000000000000000]}) 01:56:49 executing program 5: perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1f}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000340)={&(0x7f0000000000), 0xc, &(0x7f0000000300)={&(0x7f0000000240)=@newlink={0x50, 0x10, 0x721, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x300}, [@IFLA_LINKINFO={0x28, 0x12, @veth={{0xc, 0x1, 'veth\x00'}, {0x18, 0x2, @VETH_INFO_PEER={0x14}}}}, @IFLA_NET_NS_FD={0x8}]}, 0x50}}, 0x0) [ 695.370860] binder: 15149:15191 Acquire 1 refcount change on invalid ref 0 ret -22 [ 695.404122] binder: 15149:15191 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 695.519981] binder: 15151 RLIMIT_NICE not set 01:56:49 executing program 6: r0 = syz_open_dev$sndseq(&(0x7f0000000100)='/dev/snd/seq\x00', 0x0, 0x0) read(r0, &(0x7f0000fb6000)=""/28, 0x3f0) ioctl$SNDRV_SEQ_IOCTL_REMOVE_EVENTS(r0, 0x4040534e, &(0x7f00000001c0)={0xbf}) ioctl$SNDRV_SEQ_IOCTL_QUERY_SUBS(r0, 0xc058534f, &(0x7f00000002c0)={{}, 0x1, 0x0, 0x0, {}, 0x0, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xbf]}) r1 = gettid() timer_create(0x0, &(0x7f0000044000)={0x0, 0x12}, &(0x7f0000000040)) r2 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r2, 0x8912, &(0x7f00000001c0)="0a5cc80700315f85715070") timer_settime(0x0, 0x0, &(0x7f0000000080)={{0x0, 0x989680}, {0x0, 0x9}}, &(0x7f0000040000)) tkill(r1, 0x1000000000014) 01:56:49 executing program 4: r0 = syz_open_dev$sndctrl(&(0x7f000000a000)='/dev/snd/controlC#\x00', 0x0, 0x0) perf_event_open(&(0x7f0000001000)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8ce, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x0, 0x4}, 0x1000000000c}, 0x0, 0x0, 0xffffffffffffffff, 0x0) getsockopt$inet_sctp_SCTP_PR_ASSOC_STATUS(0xffffffffffffff9c, 0x84, 0x73, &(0x7f000000d000), &(0x7f0000001000)=0xfea6) r1 = syz_open_dev$sndctrl(&(0x7f0000000080)='/dev/snd/controlC#\x00', 0x0, 0x0) r2 = epoll_create(0x277) ioctl$SNDRV_CTL_IOCTL_SUBSCRIBE_EVENTS(r1, 0xc0045516, &(0x7f0000000000)=0xec35) fcntl$setlease(r2, 0x400, 0x2) epoll_ctl$EPOLL_CTL_ADD(r2, 0x1, r1, &(0x7f00000000c0)) ioctl$SNDRV_CTL_IOCTL_PVERSION(r0, 0xc1105517, &(0x7f0000001000)) 01:56:49 executing program 3: r0 = socket$inet(0x2, 0x3, 0x2) connect$inet(0xffffffffffffffff, &(0x7f0000000000)={0x2, 0x0, @local}, 0x10) setsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x23, &(0x7f0000000000)={{{@in=@multicast2, @in=@multicast1}}, {{@in6}, 0x0, @in6=@loopback}}, 0xe8) syz_emit_ethernet(0x2a, &(0x7f0000000640)={@random="b100485caa2a", @link_local, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0xfffffffffffff000, 0x1c, 0x0, 0x0, 0x0, 0x2, 0x0, @rand_addr, @broadcast}, @igmp={0x11, 0xffffffffffffffff, 0x0, @multicast1}}}}}, &(0x7f0000000140)) 01:56:49 executing program 1: r0 = syz_open_dev$dspn(&(0x7f00000001c0)='/dev/dsp#\x00', 0x1, 0x6) ioctl$int_in(r0, 0x800000c0045005, &(0x7f0000000000)=0x40000) close(r0) accept4(0xffffffffffffffff, 0x0, &(0x7f0000000040)=0xffffffffffffff54, 0x0) 01:56:49 executing program 2: r0 = socket$inet(0x2, 0x3, 0x2) connect$inet(0xffffffffffffffff, &(0x7f0000000000)={0x2, 0x0, @local}, 0x10) setsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x23, &(0x7f0000000000)={{{@in=@multicast2, @in=@multicast1}}, {{@in6}, 0x0, @in6=@loopback}}, 0xe8) syz_emit_ethernet(0x2a, &(0x7f0000000640)={@random="b100485caa2a", @link_local, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x1c, 0x0, 0x0, 0x0, 0x2, 0x0, @rand_addr, @broadcast}, @igmp={0x11, 0x0, 0x0, @multicast1}}}}}, &(0x7f0000000140)={0x0, 0x0, [0x0, 0x0, 0x0, 0x400300]}) 01:56:49 executing program 5: perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1f}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000340)={&(0x7f0000000000), 0xc, &(0x7f0000000300)={&(0x7f0000000240)=@newlink={0x50, 0x10, 0x721, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0xfffffff0}, [@IFLA_LINKINFO={0x28, 0x12, @veth={{0xc, 0x1, 'veth\x00'}, {0x18, 0x2, @VETH_INFO_PEER={0x14}}}}, @IFLA_NET_NS_FD={0x8}]}, 0x50}}, 0x0) 01:56:49 executing program 0: socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000001f80)={0xffffffffffffffff, 0xffffffffffffffff}) setsockopt$SO_ATTACH_FILTER(r2, 0x1, 0x1a, &(0x7f0000ab9ff0)={0x2, &(0x7f000039a000)=[{0x20, 0x0, 0x0, 0xfffffffffffff010}, {0x6}]}, 0x10) sendmmsg(r1, &(0x7f0000001e80)=[{{&(0x7f0000000700)=@l2, 0x80, &(0x7f0000001dc0)}}], 0x1, 0x0) 01:56:49 executing program 7: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000180)='/dev/sequencer\x00', 0x10002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000080)="0a5cc80700315f85715070") r1 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000001c0)={0x2, 0x0, &(0x7f0000000140)=ANY=[@ANYBLOB='\fc'], 0x0, 0x0, &(0x7f0000000080)}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, &(0x7f00000001c0)}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000040)={0x8, 0x2000000, &(0x7f00000000c0)=[@release={0x400c630f}], 0x1, 0x0, &(0x7f0000000100)='V'}) fstat(r0, &(0x7f00000002c0)) 01:56:49 executing program 2: r0 = socket$inet(0x2, 0x3, 0x2) connect$inet(0xffffffffffffffff, &(0x7f0000000000)={0x2, 0x0, @local}, 0x10) setsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x23, &(0x7f0000000000)={{{@in=@multicast2, @in=@multicast1}}, {{@in6}, 0x0, @in6=@loopback}}, 0xe8) syz_emit_ethernet(0x2a, &(0x7f0000000640)={@random="b100485caa2a", @link_local, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x1c, 0x0, 0x0, 0x0, 0x2, 0x0, @rand_addr, @broadcast}, @igmp={0x11, 0x0, 0x0, @multicast1}}}}}, &(0x7f0000000140)={0x0, 0x0, [0x0, 0x0, 0x0, 0x4000000]}) 01:56:49 executing program 5: perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1f}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000340)={&(0x7f0000000000), 0xc, &(0x7f0000000300)={&(0x7f0000000240)=@newlink={0x50, 0x10, 0x721, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x10000000}, [@IFLA_LINKINFO={0x28, 0x12, @veth={{0xc, 0x1, 'veth\x00'}, {0x18, 0x2, @VETH_INFO_PEER={0x14}}}}, @IFLA_NET_NS_FD={0x8}]}, 0x50}}, 0x0) 01:56:49 executing program 4: unshare(0x10100) r0 = getpgrp(0xffffffffffffffff) wait4(r0, &(0x7f0000000000), 0x2, &(0x7f0000000040)) r1 = fcntl$dupfd(0xffffffffffffff9c, 0x0, 0xffffffffffffffff) perf_event_open(&(0x7f000001d000)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0x0, r1, 0x4) 01:56:49 executing program 3: r0 = socket$inet(0x2, 0x3, 0x2) connect$inet(0xffffffffffffffff, &(0x7f0000000000)={0x2, 0x0, @local}, 0x10) setsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x23, &(0x7f0000000000)={{{@in=@multicast2, @in=@multicast1}}, {{@in6}, 0x0, @in6=@loopback}}, 0xe8) syz_emit_ethernet(0x2a, &(0x7f0000000640)={@random="b100485caa2a", @link_local, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x300000000000000, 0x1c, 0x0, 0x0, 0x0, 0x2, 0x0, @rand_addr, @broadcast}, @igmp={0x11, 0xffffffffffffffff, 0x0, @multicast1}}}}}, &(0x7f0000000140)) [ 696.020568] binder: 15230:15234 Acquire 1 refcount change on invalid ref 0 ret -22 01:56:50 executing program 0: socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000001f80)={0xffffffffffffffff, 0xffffffffffffffff}) setsockopt$SO_ATTACH_FILTER(r2, 0x1, 0x1a, &(0x7f0000ab9ff0)={0x2, &(0x7f000039a000)=[{0x20, 0x0, 0x0, 0xfffffffffffff010}, {0x6}]}, 0x10) sendmmsg(r1, &(0x7f0000001e80)=[{{&(0x7f0000000700)=@l2, 0x80, &(0x7f0000001dc0)}}], 0x1, 0x0) 01:56:50 executing program 5: perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1f}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000340)={&(0x7f0000000000), 0xc, &(0x7f0000000300)={&(0x7f0000000240)=@newlink={0x50, 0x10, 0x721, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x4}, [@IFLA_LINKINFO={0x28, 0x12, @veth={{0xc, 0x1, 'veth\x00'}, {0x18, 0x2, @VETH_INFO_PEER={0x14}}}}, @IFLA_NET_NS_FD={0x8}]}, 0x50}}, 0x0) 01:56:50 executing program 1: r0 = socket$inet6(0xa, 0x80001, 0x0) getsockopt$bt_hci(r0, 0x0, 0x20000000062, &(0x7f00000000c0)=""/30, &(0x7f0000000040)=0x1e) 01:56:50 executing program 2: r0 = socket$inet(0x2, 0x3, 0x2) connect$inet(0xffffffffffffffff, &(0x7f0000000000)={0x2, 0x0, @local}, 0x10) setsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x23, &(0x7f0000000000)={{{@in=@multicast2, @in=@multicast1}}, {{@in6}, 0x0, @in6=@loopback}}, 0xe8) syz_emit_ethernet(0x2a, &(0x7f0000000640)={@random="b100485caa2a", @link_local, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x1c, 0x0, 0x0, 0x0, 0x2, 0x0, @rand_addr, @broadcast}, @igmp={0x11, 0x0, 0x0, @multicast1}}}}}, &(0x7f0000000140)={0x0, 0x0, [0x0, 0x0, 0x0, 0x6000000]}) [ 696.149040] binder: 15230:15234 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 696.287701] binder: 15230:15272 Acquire 1 refcount change on invalid ref 0 ret -22 [ 696.368139] binder: 15230:15272 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 01:56:50 executing program 6: r0 = syz_open_dev$sndseq(&(0x7f0000000100)='/dev/snd/seq\x00', 0x0, 0x0) read(r0, &(0x7f0000fb6000)=""/28, 0x3f0) ioctl$SNDRV_SEQ_IOCTL_REMOVE_EVENTS(r0, 0x4040534e, &(0x7f00000001c0)={0xbf}) ioctl$SNDRV_SEQ_IOCTL_QUERY_SUBS(r0, 0xc058534f, &(0x7f00000002c0)={{}, 0x1, 0x0, 0x0, {}, 0x0, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xe000000]}) r1 = gettid() timer_create(0x0, &(0x7f0000044000)={0x0, 0x12}, &(0x7f0000000040)) r2 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r2, 0x8912, &(0x7f00000001c0)="0a5cc80700315f85715070") timer_settime(0x0, 0x0, &(0x7f0000000080)={{0x0, 0x989680}, {0x0, 0x9}}, &(0x7f0000040000)) tkill(r1, 0x1000000000014) 01:56:50 executing program 4: bpf$PROG_LOAD(0x5, &(0x7f0000000000)={0x0, 0x2, &(0x7f0000001000)=ANY=[@ANYBLOB="7b1af8f70089e71148c95c671a4ee900000069a27fff"], &(0x7f0000000100)='GPL\x00'}, 0x48) setsockopt$inet_sctp_SCTP_RTOINFO(0xffffffffffffffff, 0x84, 0x0, &(0x7f0000001000)={0x10000, 0x4, 0x100, 0x400}, 0x6) perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1f}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket(0x11, 0x80002, 0x0) setsockopt$packet_int(r0, 0x107, 0xa, &(0x7f0000788000)=0x6, 0x4) bind$packet(r0, &(0x7f0000000480)={0x11, 0x3, 0x0, 0x1, 0x0, 0x6, @local}, 0x14) setsockopt(r0, 0x107, 0x5, &(0x7f0000001000), 0xc5) syz_emit_ethernet(0x66, &(0x7f0000000140)={@empty=[0x2b], @random="1b207f5c5eeb", [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x58, 0x0, 0x0, 0x0, 0x0, 0x0, @local={0xac, 0x18}, @local}, @gre={{0x0, 0x0, 0x1, 0x0, 0x3, 0x0, 0x0, 0x1, 0x6558}}}}}}, &(0x7f0000000000)) 01:56:50 executing program 3: r0 = socket$inet(0x2, 0x3, 0x2) connect$inet(0xffffffffffffffff, &(0x7f0000000000)={0x2, 0x0, @local}, 0x10) setsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x23, &(0x7f0000000000)={{{@in=@multicast2, @in=@multicast1}}, {{@in6}, 0x0, @in6=@loopback}}, 0xe8) syz_emit_ethernet(0x2a, &(0x7f0000000640)={@random="b100485caa2a", @link_local, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x400000000000000, 0x1c, 0x0, 0x0, 0x0, 0x2, 0x0, @rand_addr, @broadcast}, @igmp={0x11, 0xffffffffffffffff, 0x0, @multicast1}}}}}, &(0x7f0000000140)) 01:56:50 executing program 5: perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1f}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000340)={&(0x7f0000000000), 0xc, &(0x7f0000000300)={&(0x7f0000000240)=@newlink={0x50, 0x10, 0x721, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x9effffff00000000}, [@IFLA_LINKINFO={0x28, 0x12, @veth={{0xc, 0x1, 'veth\x00'}, {0x18, 0x2, @VETH_INFO_PEER={0x14}}}}, @IFLA_NET_NS_FD={0x8}]}, 0x50}}, 0x0) 01:56:50 executing program 2: r0 = socket$inet(0x2, 0x3, 0x2) connect$inet(0xffffffffffffffff, &(0x7f0000000000)={0x2, 0x0, @local}, 0x10) setsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x23, &(0x7f0000000000)={{{@in=@multicast2, @in=@multicast1}}, {{@in6}, 0x0, @in6=@loopback}}, 0xe8) syz_emit_ethernet(0x2a, &(0x7f0000000640)={@random="b100485caa2a", @link_local, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x1c, 0x0, 0x0, 0x0, 0x2, 0x0, @rand_addr, @broadcast}, @igmp={0x11, 0x0, 0x0, @multicast1}}}}}, &(0x7f0000000140)={0x0, 0x0, [0x0, 0x0, 0x0, 0x4000]}) 01:56:50 executing program 1: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000200)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_SET_SIGNAL_MASK(0xffffffffffffffff, 0x4004ae8b, &(0x7f0000001000)=ANY=[@ANYBLOB="fb"]) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) syz_kvm_setup_cpu$x86(r1, r2, &(0x7f0000004000/0x18000)=nil, &(0x7f00000000c0)=[@text64={0x40, &(0x7f0000000040)="c441fc2f5e0cb9490300000f32673666430ff6843c05000000c74424000a010000c744240241000000ff1c24b9b50a0000b8f3ffffffbaffffffff0f3066430f3882420026f0801600c4810172e00d47f4b9800000c00f3235000800000f30", 0x5f}], 0x1, 0x8, &(0x7f0000000000)=[@cstype0={0x4, 0xb}, @vmwrite={0x8, 0x0, 0x8, 0x0, 0xffff, 0x0, 0x6, 0x0, 0x8}], 0x18b) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f00000002c0)={0x0, 0x0, 0x0, 0x2000, &(0x7f0000001000/0x2000)=nil}) ioctl$KVM_RUN(r2, 0xae80, 0x0) r3 = syz_open_dev$mice(&(0x7f00000001c0)='/dev/input/mice\x00', 0x0, 0x424101) write$P9_RREAD(r3, &(0x7f0000000300)=ANY=[@ANYBLOB="a80000007502009d000000dbc0fadb74381708996ff6f56636d9c1ccdfbb43b912dd87183e866080dd4fdb32e680e370d5265d38aa44f35d4fc6e6395985bf36ae0194a2e921d06c2551bb8a863ebaa082644e77266e9c4fb2296f7b87456b3f9a24e8b3678e28cf63ed45765689ff4e1706bebc32b9049fbcfe8e0a14ca4e2ed47f790a5c04f6a936eb84c10d53251c1c3b515f351c8e66bfa55b233037f45a18d6000000000000"], 0xa8) r4 = syz_open_dev$mouse(&(0x7f0000000100)='/dev/input/mouse#\x00', 0x6, 0x10000) ioctl$RTC_VL_READ(r4, 0x80047013, &(0x7f0000000180)) ioctl$RTC_PLL_GET(r4, 0x80207011, &(0x7f0000000140)) 01:56:50 executing program 0: socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000001f80)={0xffffffffffffffff, 0xffffffffffffffff}) setsockopt$SO_ATTACH_FILTER(r2, 0x1, 0x1a, &(0x7f0000ab9ff0)={0x2, &(0x7f000039a000)=[{0x20, 0x0, 0x0, 0xfffffffffffff010}, {0x6}]}, 0x10) sendmmsg(r1, &(0x7f0000001e80)=[{{&(0x7f0000000700)=@l2, 0x80, &(0x7f0000001dc0)}}], 0x1, 0x0) 01:56:50 executing program 7: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000180)='/dev/sequencer\x00', 0x10002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000080)="0a5cc80700315f85715070") r1 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000001c0)={0x2, 0x0, &(0x7f0000000140)=ANY=[@ANYBLOB='\fc'], 0x0, 0x0, &(0x7f0000000080)}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, &(0x7f00000001c0)}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000040)={0x8, 0x7a00, &(0x7f00000000c0)=[@release={0x400c630f}], 0x1, 0x0, &(0x7f0000000100)='V'}) fstat(r0, &(0x7f00000002c0)) 01:56:50 executing program 2: r0 = socket$inet(0x2, 0x3, 0x2) connect$inet(0xffffffffffffffff, &(0x7f0000000000)={0x2, 0x0, @local}, 0x10) setsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x23, &(0x7f0000000000)={{{@in=@multicast2, @in=@multicast1}}, {{@in6}, 0x0, @in6=@loopback}}, 0xe8) syz_emit_ethernet(0x2a, &(0x7f0000000640)={@random="b100485caa2a", @link_local, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x1c, 0x0, 0x0, 0x0, 0x2, 0x0, @rand_addr, @broadcast}, @igmp={0x11, 0x0, 0x0, @multicast1}}}}}, &(0x7f0000000140)={0x0, 0x0, [0x0, 0x0, 0x0, 0x34000]}) 01:56:50 executing program 4: r0 = syz_open_dev$sg(&(0x7f00000003c0)='/dev/sg#\x00', 0x7, 0x4000) fallocate(r0, 0x0, 0x8, 0x4) r1 = socket$inet(0x10, 0xffffffffffffffff, 0x7) setsockopt$IP_VS_SO_SET_ADD(r1, 0x0, 0x482, &(0x7f0000000000)={0x6c, @remote, 0x4e20, 0x2, 'dh\x00', 0x0, 0x7ffffffe, 0x27}, 0x2c) sendmsg(r1, &(0x7f0000011fc8)={0x0, 0x0, &(0x7f00000000c0)=[{&(0x7f0000001640)="24000000100007031dfffd946fa2830020200a0009000300001c85680c1ba3a20400ff7e28000000080affffba16a0aa1c0009b356da5a80d18bec4c8546c8243929db2406b20cd37ed01cc0", 0x4c}], 0x1}, 0x0) r2 = syz_open_dev$mouse(&(0x7f0000000180)='/dev/input/mouse#\x00', 0x3, 0x20002) write$RDMA_USER_CM_CMD_GET_EVENT(r2, &(0x7f00000001c0)={0xc, 0x8, 0xfa00, {&(0x7f0000000240)}}, 0x10) r3 = syz_open_procfs(0x0, &(0x7f0000000040)='net/raw6\x00') write$P9_RREADLINK(r3, &(0x7f0000000080)={0x10, 0x17, 0x1, {0x7, './file0'}}, 0x10) accept(r1, &(0x7f0000000100)=@can, &(0x7f0000000200)=0x80) 01:56:50 executing program 5: perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1f}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000340)={&(0x7f0000000000), 0xc, &(0x7f0000000300)={&(0x7f0000000240)=@newlink={0x50, 0x10, 0x721, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x900}, [@IFLA_LINKINFO={0x28, 0x12, @veth={{0xc, 0x1, 'veth\x00'}, {0x18, 0x2, @VETH_INFO_PEER={0x14}}}}, @IFLA_NET_NS_FD={0x8}]}, 0x50}}, 0x0) 01:56:50 executing program 3: r0 = socket$inet(0x2, 0x3, 0x2) connect$inet(0xffffffffffffffff, &(0x7f0000000000)={0x2, 0x0, @local}, 0x10) setsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x23, &(0x7f0000000000)={{{@in=@multicast2, @in=@multicast1}}, {{@in6}, 0x0, @in6=@loopback}}, 0xe8) syz_emit_ethernet(0x2a, &(0x7f0000000640)={@random="b100485caa2a", @link_local, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0xe000, 0x1c, 0x0, 0x0, 0x0, 0x2, 0x0, @rand_addr, @broadcast}, @igmp={0x11, 0xffffffffffffffff, 0x0, @multicast1}}}}}, &(0x7f0000000140)) [ 696.913633] binder: 15298:15299 Acquire 1 refcount change on invalid ref 0 ret -22 01:56:50 executing program 0: socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000001f80)={0xffffffffffffffff, 0xffffffffffffffff}) setsockopt$SO_ATTACH_FILTER(r2, 0x1, 0x1a, &(0x7f0000ab9ff0)={0x2, &(0x7f000039a000)=[{0x20, 0x0, 0x0, 0xfffffffffffff010}, {0x6}]}, 0x10) sendmmsg(r1, &(0x7f0000001e80)=[{{&(0x7f0000000700)=@l2, 0x80, &(0x7f0000001dc0)}}], 0x1, 0x0) 01:56:50 executing program 2: r0 = socket$inet(0x2, 0x3, 0x2) connect$inet(0xffffffffffffffff, &(0x7f0000000000)={0x2, 0x0, @local}, 0x10) setsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x23, &(0x7f0000000000)={{{@in=@multicast2, @in=@multicast1}}, {{@in6}, 0x0, @in6=@loopback}}, 0xe8) syz_emit_ethernet(0x2a, &(0x7f0000000640)={@random="b100485caa2a", @link_local, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x1c, 0x0, 0x0, 0x0, 0x2, 0x0, @rand_addr, @broadcast}, @igmp={0x11, 0x0, 0x0, @multicast1}}}}}, &(0x7f0000000140)={0x0, 0x0, [0x0, 0x0, 0x0, 0x60]}) 01:56:51 executing program 3: r0 = socket$inet(0x2, 0x3, 0x2) connect$inet(0xffffffffffffffff, &(0x7f0000000000)={0x2, 0x0, @local}, 0x10) setsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x23, &(0x7f0000000000)={{{@in=@multicast2, @in=@multicast1}}, {{@in6}, 0x0, @in6=@loopback}}, 0xe8) syz_emit_ethernet(0x2a, &(0x7f0000000640)={@random="b100485caa2a", @link_local, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x6000, 0x1c, 0x0, 0x0, 0x0, 0x2, 0x0, @rand_addr, @broadcast}, @igmp={0x11, 0xffffffffffffffff, 0x0, @multicast1}}}}}, &(0x7f0000000140)) [ 697.047555] binder: 15298:15299 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 01:56:51 executing program 1: symlink(&(0x7f0000000000)='.\x00', &(0x7f0000000540)='./file0\x00') mount(&(0x7f0000000bc0)='./file0\x00', &(0x7f0000000c00)='./file0/file0\x00', &(0x7f0000000c40)='tmpfs\x00', 0x0, 0x0) umount2(&(0x7f0000000080)='./file0/file0\x00', 0x0) r0 = syz_open_dev$mouse(&(0x7f0000000040)='/dev/input/mouse#\x00', 0x4, 0x200800) bind$unix(r0, &(0x7f00000000c0)=@file={0x0, './file0/file0\x00'}, 0x6e) [ 697.177308] binder: 15298:15323 Acquire 1 refcount change on invalid ref 0 ret -22 [ 697.199435] binder: 15298:15323 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 697.277719] binder: 15299 RLIMIT_NICE not set 01:56:51 executing program 6: r0 = syz_open_dev$sndseq(&(0x7f0000000100)='/dev/snd/seq\x00', 0x0, 0x0) read(r0, &(0x7f0000fb6000)=""/28, 0x3f0) ioctl$SNDRV_SEQ_IOCTL_REMOVE_EVENTS(r0, 0x4040534e, &(0x7f00000001c0)={0xbf}) ioctl$SNDRV_SEQ_IOCTL_QUERY_SUBS(r0, 0xc058534f, &(0x7f00000002c0)={{}, 0x1, 0x0, 0x0, {}, 0x0, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xbf00]}) r1 = gettid() timer_create(0x0, &(0x7f0000044000)={0x0, 0x12}, &(0x7f0000000040)) r2 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r2, 0x8912, &(0x7f00000001c0)="0a5cc80700315f85715070") timer_settime(0x0, 0x0, &(0x7f0000000080)={{0x0, 0x989680}, {0x0, 0x9}}, &(0x7f0000040000)) tkill(r1, 0x1000000000014) 01:56:51 executing program 4: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_SET_SIGNAL_MASK(0xffffffffffffffff, 0x4004ae8b, &(0x7f0000001000)=ANY=[@ANYBLOB="86"]) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r2, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000100)=[@text32={0x20, &(0x7f0000000140)="ff1fc4e18ded31c4e1fd5b598666baf80cb8f87fc28fef66bafc0cedb9e80a0000b8d4480000ba000000000f30660f01c8660f38819f00000000c7442400c4690000c74424029772f926c7442406000000000f011424660f383f150000000066b89c000f00d0", 0x66}], 0x1, 0x0, &(0x7f0000000000), 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f00000002c0)={0x0, 0x2, 0x0, 0x2000, &(0x7f0000001000/0x2000)=nil}) ioctl$KVM_RUN(r2, 0xae80, 0x0) socket$packet(0x11, 0x3, 0x300) 01:56:51 executing program 5: perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1f}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000340)={&(0x7f0000000000), 0xc, &(0x7f0000000300)={&(0x7f0000000240)=@newlink={0x50, 0x10, 0x721, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0xa00}, [@IFLA_LINKINFO={0x28, 0x12, @veth={{0xc, 0x1, 'veth\x00'}, {0x18, 0x2, @VETH_INFO_PEER={0x14}}}}, @IFLA_NET_NS_FD={0x8}]}, 0x50}}, 0x0) 01:56:51 executing program 1: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="0a5cc80700315f85714070") socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000180)={0xffffffffffffffff}) setsockopt$SO_ATTACH_FILTER(r1, 0x1, 0x1a, &(0x7f0000000040)={0x2, &(0x7f00000000c0)}, 0x1) 01:56:51 executing program 2: r0 = socket$inet(0x2, 0x3, 0x2) connect$inet(0xffffffffffffffff, &(0x7f0000000000)={0x2, 0x0, @local}, 0x10) setsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x23, &(0x7f0000000000)={{{@in=@multicast2, @in=@multicast1}}, {{@in6}, 0x0, @in6=@loopback}}, 0xe8) syz_emit_ethernet(0x2a, &(0x7f0000000640)={@random="b100485caa2a", @link_local, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x1c, 0x0, 0x0, 0x0, 0x2, 0x0, @rand_addr, @broadcast}, @igmp={0x11, 0x0, 0x0, @multicast1}}}}}, &(0x7f0000000140)={0x0, 0x0, [0x0, 0x0, 0x0, 0x40030000000000]}) 01:56:51 executing program 3: r0 = socket$inet(0x2, 0x3, 0x2) connect$inet(0xffffffffffffffff, &(0x7f0000000000)={0x2, 0x0, @local}, 0x10) setsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x23, &(0x7f0000000000)={{{@in=@multicast2, @in=@multicast1}}, {{@in6}, 0x0, @in6=@loopback}}, 0xe8) syz_emit_ethernet(0x2a, &(0x7f0000000640)={@random="b100485caa2a", @link_local, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x6, 0x1c, 0x0, 0x0, 0x0, 0x2, 0x0, @rand_addr, @broadcast}, @igmp={0x11, 0xffffffffffffffff, 0x0, @multicast1}}}}}, &(0x7f0000000140)) 01:56:51 executing program 0: socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000001f80)={0xffffffffffffffff, 0xffffffffffffffff}) setsockopt$SO_ATTACH_FILTER(r2, 0x1, 0x1a, &(0x7f0000ab9ff0)={0x2, &(0x7f000039a000)=[{0x20, 0x0, 0x0, 0xfffffffffffff010}, {0x6}]}, 0x10) sendmmsg(r1, &(0x7f0000001e80)=[{{&(0x7f0000000700)=@l2, 0x80, &(0x7f0000001dc0)}}], 0x1, 0x0) 01:56:51 executing program 7: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000180)='/dev/sequencer\x00', 0x10002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000080)="0a5cc80700315f85715070") r1 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000001c0)={0x2, 0x0, &(0x7f0000000140)=ANY=[@ANYBLOB='\fc'], 0x0, 0x0, &(0x7f0000000080)}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, &(0x7f00000001c0)}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000040)={0x8, 0x2000, &(0x7f00000000c0)=[@release={0x400c630f}], 0x1, 0x0, &(0x7f0000000100)='V'}) fstat(r0, &(0x7f00000002c0)) 01:56:51 executing program 2: r0 = socket$inet(0x2, 0x3, 0x2) connect$inet(0xffffffffffffffff, &(0x7f0000000000)={0x2, 0x0, @local}, 0x10) setsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x23, &(0x7f0000000000)={{{@in=@multicast2, @in=@multicast1}}, {{@in6}, 0x0, @in6=@loopback}}, 0xe8) syz_emit_ethernet(0x2a, &(0x7f0000000640)={@random="b100485caa2a", @link_local, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x1c, 0x0, 0x0, 0x0, 0x2, 0x0, @rand_addr, @broadcast}, @igmp={0x11, 0x0, 0x0, @multicast1}}}}}, &(0x7f0000000140)={0x0, 0x0, [0x0, 0x0, 0x0, 0x2000000000000000]}) 01:56:51 executing program 1: r0 = getpid() r1 = syz_open_procfs(r0, &(0x7f0000000080)="2f65786500000000000409004bddd9de91be10eebf000ee9a90f798058439ed554fa07424adee901d2da75af1f02acc7edbcd7a071fb35331ce39c5a") r2 = open(&(0x7f00000000c0)='./bus\x00', 0x141042, 0x0) mq_getsetattr(r1, &(0x7f0000000040)={0x3, 0x2, 0xa2a1, 0x8, 0x10001, 0x9, 0x7f, 0xfff}, &(0x7f0000000100)) ioctl$SG_SET_FORCE_PACK_ID(r1, 0x227b, &(0x7f0000000140)=0x1) mmap(&(0x7f0000001000/0xa000)=nil, 0xa000, 0x0, 0x11, r2, 0x0) fsetxattr(r1, &(0x7f0000000000)=@known='user.syz\x00', &(0x7f00000000c0)='\x00', 0xfe9, 0x0) 01:56:51 executing program 5: perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1f}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000340)={&(0x7f0000000000), 0xc, &(0x7f0000000300)={&(0x7f0000000240)=@newlink={0x50, 0x10, 0x721, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0xf00}, [@IFLA_LINKINFO={0x28, 0x12, @veth={{0xc, 0x1, 'veth\x00'}, {0x18, 0x2, @VETH_INFO_PEER={0x14}}}}, @IFLA_NET_NS_FD={0x8}]}, 0x50}}, 0x0) 01:56:51 executing program 3: r0 = socket$inet(0x2, 0x3, 0x2) connect$inet(0xffffffffffffffff, &(0x7f0000000000)={0x2, 0x0, @local}, 0x10) setsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x23, &(0x7f0000000000)={{{@in=@multicast2, @in=@multicast1}}, {{@in6}, 0x0, @in6=@loopback}}, 0xe8) syz_emit_ethernet(0x2a, &(0x7f0000000640)={@random="b100485caa2a", @link_local, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x7, 0x1c, 0x0, 0x0, 0x0, 0x2, 0x0, @rand_addr, @broadcast}, @igmp={0x11, 0xffffffffffffffff, 0x0, @multicast1}}}}}, &(0x7f0000000140)) [ 697.896271] binder: 15366:15367 Acquire 1 refcount change on invalid ref 0 ret -22 [ 697.919062] binder: 15366:15367 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 01:56:51 executing program 2: r0 = socket$inet(0x2, 0x3, 0x2) connect$inet(0xffffffffffffffff, &(0x7f0000000000)={0x2, 0x0, @local}, 0x10) setsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x23, &(0x7f0000000000)={{{@in=@multicast2, @in=@multicast1}}, {{@in6}, 0x0, @in6=@loopback}}, 0xe8) syz_emit_ethernet(0x2a, &(0x7f0000000640)={@random="b100485caa2a", @link_local, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x1c, 0x0, 0x0, 0x0, 0x2, 0x0, @rand_addr, @broadcast}, @igmp={0x11, 0x0, 0x0, @multicast1}}}}}, &(0x7f0000000140)={0x0, 0x0, [0x0, 0x0, 0x0, 0x700000000000000]}) 01:56:51 executing program 1: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000080)="0a5cc80700315f85715070") r1 = syz_open_dev$sndpcmc(&(0x7f0000000000)='/dev/snd/pcmC#D#c\x00', 0xffffffff, 0x40) ioctl$sock_inet_SIOCRTMSG(r1, 0x890d, &(0x7f00000000c0)={0x7, {0x2, 0x4e22, @multicast2}, {0x2, 0x4e22, @multicast1}, {0x2, 0x4e23, @multicast1}, 0x92, 0x0, 0x8, 0x1, 0x3, &(0x7f0000000040)='teql0\x00', 0x7fffffff, 0x33, 0xffffffffffff1255}) r2 = syz_open_dev$sndctrl(&(0x7f000000a000)='/dev/snd/controlC#\x00', 0x0, 0x0) getsockopt$inet_sctp_SCTP_PR_ASSOC_STATUS(0xffffffffffffff9c, 0x84, 0x73, &(0x7f000000d000), &(0x7f0000001000)=0xfea6) ioctl$SNDRV_CTL_IOCTL_PVERSION(r2, 0x5452, &(0x7f0000001000)) 01:56:51 executing program 0: socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000001f80)={0xffffffffffffffff, 0xffffffffffffffff}) setsockopt$SO_ATTACH_FILTER(r2, 0x1, 0x1a, &(0x7f0000ab9ff0)={0x2, &(0x7f000039a000)=[{0x20, 0x0, 0x0, 0xfffffffffffff010}, {0x6}]}, 0x10) sendmmsg(r1, &(0x7f0000001e80)=[{{&(0x7f0000000700)=@l2, 0x80, &(0x7f0000001dc0)}}], 0x1, 0x0) 01:56:51 executing program 5: perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1f}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000340)={&(0x7f0000000000), 0xc, &(0x7f0000000300)={&(0x7f0000000240)=@newlink={0x50, 0x10, 0x721, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x9}, [@IFLA_LINKINFO={0x28, 0x12, @veth={{0xc, 0x1, 'veth\x00'}, {0x18, 0x2, @VETH_INFO_PEER={0x14}}}}, @IFLA_NET_NS_FD={0x8}]}, 0x50}}, 0x0) [ 698.018190] binder: 15367 RLIMIT_NICE not set 01:56:52 executing program 6: r0 = syz_open_dev$sndseq(&(0x7f0000000100)='/dev/snd/seq\x00', 0x0, 0x0) read(r0, &(0x7f0000fb6000)=""/28, 0x3f0) ioctl$SNDRV_SEQ_IOCTL_REMOVE_EVENTS(r0, 0x4040534e, &(0x7f00000001c0)={0xbf}) ioctl$SNDRV_SEQ_IOCTL_QUERY_SUBS(r0, 0xc058534f, &(0x7f00000002c0)={{}, 0x1, 0x0, 0x0, {}, 0x0, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xe00000000000000]}) r1 = gettid() timer_create(0x0, &(0x7f0000044000)={0x0, 0x12}, &(0x7f0000000040)) r2 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r2, 0x8912, &(0x7f00000001c0)="0a5cc80700315f85715070") timer_settime(0x0, 0x0, &(0x7f0000000080)={{0x0, 0x989680}, {0x0, 0x9}}, &(0x7f0000040000)) tkill(r1, 0x1000000000014) 01:56:52 executing program 4: r0 = socket(0x10, 0x80002, 0x0) bind$netlink(r0, &(0x7f0000177ff4)={0x10, 0x0, 0x1}, 0xc) r1 = socket(0x10, 0x5, 0x0) bind$netlink(r1, &(0x7f0000177ff4)={0x10, 0x0, 0x1}, 0xc) getsockopt$inet_sctp6_SCTP_RECONFIG_SUPPORTED(r0, 0x84, 0x75, &(0x7f0000000000)={0x0, 0x8}, &(0x7f0000000040)=0xb2) getsockopt$sock_cred(r0, 0x1, 0x11, &(0x7f0000000100)={0x0}, &(0x7f0000000140)=0xc) r4 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080)='/dev/kvm\x00', 0x0, 0x0) r5 = ioctl$KVM_CREATE_VM(r4, 0xae01, 0x0) r6 = ioctl$KVM_CREATE_VCPU(r5, 0xae41, 0x0) syz_kvm_setup_cpu$x86(r5, r6, &(0x7f000001e000/0x18000)=nil, &(0x7f0000000100)=[@text64={0x40, &(0x7f00000002c0)="6465f637b93a0a00000f322e4e0fc72d0880000064f20f2d7104460f01ca66b893008ec8c74424000f000000c7442402e3d17300c7442406000000000f011c2466ba4000ec48b804000000000000000f23d80f21f835000000100f23f8660f38068600000100", 0x66}], 0x1, 0x0, &(0x7f0000000340)=[@cr4={0x1, 0x40002}, @cr4={0x1, 0x408}], 0x27e) r7 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r7, 0x8912, &(0x7f0000000280)="0a5cc80700315f85714070") ioctl$KVM_RUN(r6, 0xae80, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r6, &(0x7f0000020000/0x18000)=nil, &(0x7f00000000c0)=[@textreal={0x8, &(0x7f00000001c0)="0f323ef2f6ef0fae58b7baf80c66b83ed7318466efbafc0ced0f20d86635080000000f22d80f35a5e367baf80c66b8e098c78d66efbafc0c66ed3e3e660f380015", 0x41}], 0x1, 0x0, &(0x7f00000002c0), 0x0) ioctl$KVM_RUN(r6, 0xae80, 0x0) sched_rr_get_interval(r3, &(0x7f0000000180)) setsockopt$inet_sctp6_SCTP_FRAGMENT_INTERLEAVE(r0, 0x84, 0x12, &(0x7f00000001c0)=0xffffffffffffff7f, 0x4) getsockopt$inet_sctp6_SCTP_DEFAULT_PRINFO(r1, 0x84, 0x72, &(0x7f0000000080)={r2, 0xac14, 0x30}, &(0x7f00000000c0)=0xc) dup3(r0, r1, 0x0) 01:56:52 executing program 3: r0 = socket$inet(0x2, 0x3, 0x2) connect$inet(0xffffffffffffffff, &(0x7f0000000000)={0x2, 0x0, @local}, 0x10) setsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x23, &(0x7f0000000000)={{{@in=@multicast2, @in=@multicast1}}, {{@in6}, 0x0, @in6=@loopback}}, 0xe8) syz_emit_ethernet(0x2a, &(0x7f0000000640)={@random="b100485caa2a", @link_local, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x600000000000000, 0x1c, 0x0, 0x0, 0x0, 0x2, 0x0, @rand_addr, @broadcast}, @igmp={0x11, 0xffffffffffffffff, 0x0, @multicast1}}}}}, &(0x7f0000000140)) 01:56:52 executing program 2: r0 = socket$inet(0x2, 0x3, 0x2) connect$inet(0xffffffffffffffff, &(0x7f0000000000)={0x2, 0x0, @local}, 0x10) setsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x23, &(0x7f0000000000)={{{@in=@multicast2, @in=@multicast1}}, {{@in6}, 0x0, @in6=@loopback}}, 0xe8) syz_emit_ethernet(0x2a, &(0x7f0000000640)={@random="b100485caa2a", @link_local, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x1c, 0x0, 0x0, 0x0, 0x2, 0x0, @rand_addr, @broadcast}, @igmp={0x11, 0x0, 0x0, @multicast1}}}}}, &(0x7f0000000140)={0x0, 0x0, [0x0, 0x0, 0x0, 0x7]}) 01:56:52 executing program 5: perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1f}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000340)={&(0x7f0000000000), 0xc, &(0x7f0000000300)={&(0x7f0000000240)=@newlink={0x50, 0x10, 0x721, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x5}, [@IFLA_LINKINFO={0x28, 0x12, @veth={{0xc, 0x1, 'veth\x00'}, {0x18, 0x2, @VETH_INFO_PEER={0x14}}}}, @IFLA_NET_NS_FD={0x8}]}, 0x50}}, 0x0) 01:56:52 executing program 0: socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000001f80)={0xffffffffffffffff, 0xffffffffffffffff}) setsockopt$SO_ATTACH_FILTER(r2, 0x1, 0x1a, &(0x7f0000ab9ff0)={0x2, &(0x7f000039a000)=[{0x20, 0x0, 0x0, 0xfffffffffffff010}, {0x6}]}, 0x10) sendmmsg(r1, &(0x7f0000001e80)=[{{&(0x7f0000000700)=@l2, 0x80, &(0x7f0000001dc0)}}], 0x1, 0x0) 01:56:52 executing program 1: r0 = memfd_create(&(0x7f00000003c0)='4,[.security(@mime_typeppp1.mime_type\t-vboxnet1vmnet0\x00', 0x3) ioctl$LOOP_CHANGE_FD(r0, 0x4c06, 0xffffffffffffffff) r1 = socket(0x10, 0xd, 0x1000000000000000) r2 = openat$pfkey(0xffffffffffffff9c, &(0x7f0000000180)='/proc/self/net/pfkey\x00', 0x101000, 0x0) write(r1, &(0x7f0000000300)="000000000080e81f00c0e9ff094a51f10101c7033500b00000000000000000", 0x1f) setsockopt$sock_int(r1, 0x1, 0x27, &(0x7f00000001c0)=0x11, 0xfffffffffffffefc) r3 = dup2(r1, r1) ioctl$KDGETMODE(r2, 0x4b3b, &(0x7f0000000340)) mq_notify(r3, &(0x7f0000000040)={0x20000000, 0x1000000003, 0x4, @thr={&(0x7f00000000c0)="98d68935be494aede97ee27272bbff0cbbb60bfdce39e8f0ac9b2c20988d4b2c4ad94be57e89978db040d8858195ff2464d872b162a8443d8489a430351c8887e9352f75acca69215401f718794a081f4309b277acee42fc4230d9a0fdf35b003c42471dbfef548d5161cbcb4532ef89cc46afdb24ec1a2b6fe8bb0983396747d4eafd667096", &(0x7f0000000200)="85b3385cbfff0da025d958374de917232d2f7207374ca865398a2b2a9bef4c349f8a04b3fc5affe81c9f841dc4eb712c424dedbdbc51188ada858e0ceb39406f92843eb09c9a2864a95b99ece55adc223fb69952968df55f3592bca895c8510d93f47793081574138b19f6eec7fb6ffd27f118517790ba35439fe99dedb2cbe4d438ee399864484c93a10efe58ba5f0486e429c5a8d6649ecd6f6b05f0fa3b623e05813eb78a6c2d47264ab95c4fcaf6761db672d3bd49bb42d3f92365a0eaae7553dc6881b45e1f1a8e39e1cd05463c1b8656bc94e729ff306562b24894016f336d622f126871"}}) close(r1) r4 = memfd_create(&(0x7f0000000000)='system\x00', 0x2) ioctl$VHOST_SET_FEATURES(r2, 0x4008af00, &(0x7f0000000380)=0x1000000) ioctl$KDGETMODE(r4, 0x4b3b, &(0x7f0000000080)) 01:56:52 executing program 7: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000180)='/dev/sequencer\x00', 0x10002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000080)="0a5cc80700315f85715070") r1 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000001c0)={0x2, 0x0, &(0x7f0000000140)=ANY=[@ANYBLOB='\fc'], 0x0, 0x0, &(0x7f0000000080)}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, &(0x7f00000001c0)}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000040)={0x8, 0x2, &(0x7f00000000c0)=[@release={0x400c630f}], 0x1, 0x0, &(0x7f0000000100)='V'}) fstat(r0, &(0x7f00000002c0)) [ 698.597844] binder: 15366:15414 Acquire 1 refcount change on invalid ref 0 ret -22 [ 698.605845] binder: 15366:15414 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 698.613112] binder: 15404 RLIMIT_NICE not set 01:56:52 executing program 1: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000040)="0a5cc80700315f85715070") r1 = socket$can_bcm(0x1d, 0x2, 0x2) getsockopt$inet_sctp_SCTP_DEFAULT_PRINFO(0xffffffffffffff9c, 0x84, 0x72, &(0x7f0000000000)={0x0, 0x2000000000000, 0x10}, &(0x7f0000000080)=0xc) setsockopt$inet_sctp6_SCTP_ASSOCINFO(r0, 0x84, 0x1, &(0x7f0000000300)={r2, 0x0, 0x2, 0x6, 0xbe, 0x690}, 0x14) ioctl$FS_IOC_SETFSLABEL(r1, 0x41009432, &(0x7f0000000200)="9d1c17a28594412b0b3b9a4d3590788aa9c1395256c38485139a2f2dac2550be578d88c36956041e063bf6f5a4c4f72b18f32fbafef8c97893f4e4b63c6231ec3184ae0b608dfbbc5e94bc2edcc286486e523897b8fae4197ab3c9baee4b99293f41bd8230ddf7a553abd27821fe0de5381e9cd0b5e639a71c42fd99c65991b357f9f65167d1daa793c84aa6ae08ca70aecddea83c0d4607a5c97d34bcd39b464c5c0e10e95016c7ead070e6e6ea672d72a579d9b17883c5c080e1e56ce10be7591f6216ea31eae0af0755007b0f76681dcecf72bbe117439645ce9affef0ad65c11e70f193e051b1fece4cf7512e2fe7eb850303ccccaf32758c95a6788b74f") connect(r1, &(0x7f0000002000)=@ethernet, 0x10) sendmsg$can_bcm(r1, &(0x7f00000001c0)={&(0x7f00000000c0), 0x10, &(0x7f0000000180)={&(0x7f0000000100)={0x5, 0x600, 0x0, {0x77359400}, {0x0, 0x7530}, {0x0, 0x0, 0x5}, 0x1, @can={{}, 0x0, 0x0, 0x0, 0x0, "a95da9bfb6640453"}}, 0x48}}, 0x0) r3 = openat$pfkey(0xffffffffffffff9c, &(0x7f0000000780)='/proc/self/net/pfkey\x00', 0x80, 0x0) ioctl$sock_kcm_SIOCKCMUNATTACH(r3, 0x89e1, &(0x7f00000007c0)={r1}) pipe(&(0x7f0000000340)={0xffffffffffffffff}) socket$bt_bnep(0x1f, 0x3, 0x4) execveat(r4, &(0x7f0000000380)='./file0\x00', &(0x7f0000000480)=[&(0x7f00000003c0)='\x00', &(0x7f0000000400)='em0}vmnet0$eth1}!.,\x00', &(0x7f0000000440)='\x00'], &(0x7f0000000700)=[&(0x7f00000004c0)='\x00', &(0x7f0000000500)='\x00', &(0x7f0000000540)='@\x00', &(0x7f0000000580)='vboxnet1\x00', &(0x7f00000005c0)='\x00', &(0x7f0000000600)='/\x00', &(0x7f0000000640)='%[eth1self@\x00', &(0x7f0000000680)='/\\$ppp0systemmd5sum\x00', &(0x7f00000006c0)='mime_type\x00'], 0xc00) 01:56:52 executing program 5: perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1f}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000340)={&(0x7f0000000000), 0xc, &(0x7f0000000300)={&(0x7f0000000240)=@newlink={0x50, 0x10, 0x721, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0xa00000000000000}, [@IFLA_LINKINFO={0x28, 0x12, @veth={{0xc, 0x1, 'veth\x00'}, {0x18, 0x2, @VETH_INFO_PEER={0x14}}}}, @IFLA_NET_NS_FD={0x8}]}, 0x50}}, 0x0) 01:56:52 executing program 3: r0 = socket$inet(0x2, 0x3, 0x2) connect$inet(0xffffffffffffffff, &(0x7f0000000000)={0x2, 0x0, @local}, 0x10) setsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x23, &(0x7f0000000000)={{{@in=@multicast2, @in=@multicast1}}, {{@in6}, 0x0, @in6=@loopback}}, 0xe8) syz_emit_ethernet(0x2a, &(0x7f0000000640)={@random="b100485caa2a", @link_local, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x6000000000000000, 0x1c, 0x0, 0x0, 0x0, 0x2, 0x0, @rand_addr, @broadcast}, @igmp={0x11, 0xffffffffffffffff, 0x0, @multicast1}}}}}, &(0x7f0000000140)) [ 698.738051] binder: 15435:15438 Acquire 1 refcount change on invalid ref 0 ret -22 01:56:52 executing program 2: r0 = socket$inet(0x2, 0x3, 0x2) connect$inet(0xffffffffffffffff, &(0x7f0000000000)={0x2, 0x0, @local}, 0x10) setsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x23, &(0x7f0000000000)={{{@in=@multicast2, @in=@multicast1}}, {{@in6}, 0x0, @in6=@loopback}}, 0xe8) syz_emit_ethernet(0x2a, &(0x7f0000000640)={@random="b100485caa2a", @link_local, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x1c, 0x0, 0x0, 0x0, 0x2, 0x0, @rand_addr, @broadcast}, @igmp={0x11, 0x0, 0x0, @multicast1}}}}}, &(0x7f0000000140)={0x0, 0x0, [0x0, 0x0, 0x0, 0x1c]}) 01:56:52 executing program 0: socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000001f80)={0xffffffffffffffff, 0xffffffffffffffff}) setsockopt$SO_ATTACH_FILTER(r2, 0x1, 0x1a, &(0x7f0000ab9ff0)={0x2, &(0x7f000039a000)=[{0x20, 0x0, 0x0, 0xfffffffffffff010}, {0x6}]}, 0x10) sendmmsg(r1, &(0x7f0000001e80)=[{{&(0x7f0000000700)=@l2, 0x80, &(0x7f0000001dc0)}}], 0x1, 0x0) [ 698.837315] binder: 15435:15438 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 01:56:52 executing program 1: r0 = openat$vnet(0xffffffffffffff9c, &(0x7f0000001940)='/dev/vhost-net\x00', 0x2, 0x0) ioctl$VHOST_SET_FEATURES(r0, 0x4008af00, &(0x7f0000000080)=0x200000000) ioctl$int_in(r0, 0x40000000af01, &(0x7f0000000300)) ioctl$VHOST_SET_VRING_ADDR(r0, 0x4028af11, &(0x7f0000000240)={0xfffffffffffffffc, 0x0, &(0x7f0000001740)=""/163, &(0x7f0000000540)=""/246, &(0x7f0000000640)=""/4096}) r1 = openat$audio(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/audio\x00', 0x0, 0x0) close(r1) r2 = fcntl$getown(r1, 0x9) r3 = fcntl$getown(r1, 0x9) kcmp(r2, r3, 0x6, r0, r1) write$vnet(r0, &(0x7f0000000340)={0x1, {&(0x7f0000000000), 0xfffffec5, &(0x7f0000000140)=""/139, 0x0, 0x2}}, 0x68) socket$packet(0x11, 0x3, 0x300) ioctl$VHOST_SET_MEM_TABLE(r0, 0x4008af03, &(0x7f00000007c0)=ANY=[]) ioctl$VHOST_NET_SET_BACKEND(r0, 0x4008af30, &(0x7f0000f1dff8)={0x0, r1}) 01:56:52 executing program 4: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc80700145f8f764070") socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) io_setup(0x8, &(0x7f00000000c0)=0x0) io_getevents(r2, 0x0, 0x0, &(0x7f0000000000), &(0x7f00000001c0)) close(r1) r3 = syz_open_dev$mice(&(0x7f0000000000)='/dev/input/mice\x00', 0x0, 0x0) ioctl$BLKBSZGET(r3, 0x80081270, &(0x7f0000000040)) socket$inet6(0xa, 0x805, 0x2) io_submit(r2, 0x1400, &(0x7f0000000600)=[&(0x7f0000000180)={0x0, 0x0, 0x0, 0x0, 0x0, r1, &(0x7f0000000140), 0x700000000000}]) [ 698.928434] binder: 15435:15452 unknown command 16396 01:56:52 executing program 3: r0 = socket$inet(0x2, 0x3, 0x2) connect$inet(0xffffffffffffffff, &(0x7f0000000000)={0x2, 0x0, @local}, 0x10) setsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x23, &(0x7f0000000000)={{{@in=@multicast2, @in=@multicast1}}, {{@in6}, 0x0, @in6=@loopback}}, 0xe8) syz_emit_ethernet(0x2a, &(0x7f0000000640)={@random="b100485caa2a", @link_local, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x300, 0x1c, 0x0, 0x0, 0x0, 0x2, 0x0, @rand_addr, @broadcast}, @igmp={0x11, 0xffffffffffffffff, 0x0, @multicast1}}}}}, &(0x7f0000000140)) [ 699.003093] binder: 15435:15452 ioctl c0306201 20000040 returned -22 [ 699.079680] binder: 15435:15452 Acquire 1 refcount change on invalid ref 0 ret -22 [ 699.089783] binder: 15435:15452 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 699.097654] binder: 15435:15438 unknown command 16396 [ 699.119757] binder: 15435:15438 ioctl c0306201 20000040 returned -22 01:56:53 executing program 6: r0 = syz_open_dev$sndseq(&(0x7f0000000100)='/dev/snd/seq\x00', 0x0, 0x0) read(r0, &(0x7f0000fb6000)=""/28, 0x3f0) ioctl$SNDRV_SEQ_IOCTL_REMOVE_EVENTS(r0, 0x4040534e, &(0x7f00000001c0)={0xbf}) ioctl$SNDRV_SEQ_IOCTL_QUERY_SUBS(r0, 0xc058534f, &(0x7f00000002c0)={{}, 0x1, 0x0, 0x0, {}, 0x0, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xbf00000000000000]}) r1 = gettid() timer_create(0x0, &(0x7f0000044000)={0x0, 0x12}, &(0x7f0000000040)) r2 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r2, 0x8912, &(0x7f00000001c0)="0a5cc80700315f85715070") timer_settime(0x0, 0x0, &(0x7f0000000080)={{0x0, 0x989680}, {0x0, 0x9}}, &(0x7f0000040000)) tkill(r1, 0x1000000000014) 01:56:53 executing program 2: r0 = socket$inet(0x2, 0x3, 0x2) connect$inet(0xffffffffffffffff, &(0x7f0000000000)={0x2, 0x0, @local}, 0x10) setsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x23, &(0x7f0000000000)={{{@in=@multicast2, @in=@multicast1}}, {{@in6}, 0x0, @in6=@loopback}}, 0xe8) syz_emit_ethernet(0x2a, &(0x7f0000000640)={@random="b100485caa2a", @link_local, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x1c, 0x0, 0x0, 0x0, 0x2, 0x0, @rand_addr, @broadcast}, @igmp={0x11, 0x0, 0x0, @multicast1}}}}}, &(0x7f0000000140)={0x0, 0x0, [0x0, 0x0, 0x0, 0x600000000000000]}) 01:56:53 executing program 5: perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1f}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000340)={&(0x7f0000000000), 0xc, &(0x7f0000000300)={&(0x7f0000000240)=@newlink={0x50, 0x10, 0x721, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x100000000000000}, [@IFLA_LINKINFO={0x28, 0x12, @veth={{0xc, 0x1, 'veth\x00'}, {0x18, 0x2, @VETH_INFO_PEER={0x14}}}}, @IFLA_NET_NS_FD={0x8}]}, 0x50}}, 0x0) 01:56:53 executing program 1: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000200)="0a5cc80700315f85715070") r1 = syz_open_procfs(0x0, &(0x7f0000000380)) fcntl$notify(r1, 0x402, 0xfffffffffffffffd) exit(0x0) r2 = socket(0x10, 0x2, 0x0) r3 = syz_open_procfs(0x0, &(0x7f0000000380)='schedstat\x00') getsockopt$inet_sctp_SCTP_DEFAULT_SNDINFO(r2, 0x84, 0x22, &(0x7f0000000180)={0x1, 0x820e, 0x1, 0x3ff, 0x0}, &(0x7f00000001c0)=0x10) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r1, 0x84, 0x6f, &(0x7f0000000300)={r4, 0x84, &(0x7f0000000240)=[@in6={0xa, 0x4e21, 0x8, @local}, @in6={0xa, 0x4e24, 0x8, @remote, 0x90}, @in={0x2, 0x4e23, @rand_addr=0x2}, @in6={0xa, 0x4e23, 0x6, @mcast1, 0x75d}, @in={0x2, 0x4e20, @multicast2}, @in={0x2, 0x4e24, @multicast2}]}, &(0x7f0000000340)=0x10) ioctl$KVM_SET_NR_MMU_PAGES(r1, 0xae44, 0x2) getsockopt$inet_sctp6_SCTP_GET_PEER_ADDRS(r2, 0x84, 0x6c, &(0x7f00000003c0)=ANY=[@ANYRES32=0x0, @ANYBLOB="3f000000364848cec969c1c4d91173f120c8974bb72019d2b1e13c9263a2c304cf08c79d0515774abbfdc93ab1206764b665e7fa696a25a92de4075b2e391bf0e9a22d2263e4e473589bf84b5061e525696e87781e35ca651970817523c853e7f12a1b617bebd6075944295f63c456cd1db8b5936e0d415cb801806f12fdbc90c642d70af4f1"], &(0x7f0000000080)=0x47) getsockopt$inet_sctp6_SCTP_DEFAULT_SEND_PARAM(r0, 0x84, 0xa, &(0x7f0000000100)={0x0, 0x7, 0x0, 0x9, 0x200, 0xe8, 0x0, 0x3, r5}, &(0x7f0000000140)=0x20) sendfile(r2, r3, &(0x7f00000000c0), 0x80000002) 01:56:53 executing program 3: r0 = socket$inet(0x2, 0x3, 0x2) connect$inet(0xffffffffffffffff, &(0x7f0000000000)={0x2, 0x0, @local}, 0x10) setsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x23, &(0x7f0000000000)={{{@in=@multicast2, @in=@multicast1}}, {{@in6}, 0x0, @in6=@loopback}}, 0xe8) syz_emit_ethernet(0x2a, &(0x7f0000000640)={@random="b100485caa2a", @link_local, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x7000000, 0x1c, 0x0, 0x0, 0x0, 0x2, 0x0, @rand_addr, @broadcast}, @igmp={0x11, 0xffffffffffffffff, 0x0, @multicast1}}}}}, &(0x7f0000000140)) 01:56:53 executing program 0: socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000001f80)={0xffffffffffffffff, 0xffffffffffffffff}) setsockopt$SO_ATTACH_FILTER(r2, 0x1, 0x1a, &(0x7f0000ab9ff0)={0x2, &(0x7f000039a000)=[{0x20, 0x0, 0x0, 0xfffffffffffff010}, {0x6}]}, 0x10) sendmmsg(r1, &(0x7f0000001e80)=[{{&(0x7f0000000700)=@l2, 0x80, &(0x7f0000001dc0)}}], 0x1, 0x0) 01:56:53 executing program 7: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000180)='/dev/sequencer\x00', 0x10002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000080)="0a5cc80700315f85715070") r1 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000001c0)={0x2, 0x0, &(0x7f0000000140)=ANY=[@ANYBLOB='\fc'], 0x0, 0x0, &(0x7f0000000080)}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, &(0x7f00000001c0)}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000040)={0x8, 0x500000000000000, &(0x7f00000000c0)=[@release={0x400c630f}], 0x1, 0x0, &(0x7f0000000100)='V'}) fstat(r0, &(0x7f00000002c0)) 01:56:53 executing program 4: r0 = socket$inet6(0xa, 0x80c, 0x6) r1 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r1, &(0x7f0000000100)={&(0x7f0000f4dff4), 0x4d9, &(0x7f0000000040)={&(0x7f0000000080)=@migrate={0x15c, 0x21, 0x1, 0x0, 0x0, {{@in6=@ipv4={[], [], @multicast1}, @in6=@dev}}, [@migrate={0x10c}]}, 0x15c}}, 0x0) ioctl(r0, 0x8912, &(0x7f0000000040)="0a5cc80700315f85715070") r2 = socket$inet6(0xa, 0x8000000000000806, 0x0) connect$inet6(r2, &(0x7f0000000000)={0xa, 0x0, 0x0, @local, 0x5}, 0x1c) setsockopt$sock_linger(r2, 0x1, 0xd, &(0x7f0000000080), 0x8) close(r1) 01:56:53 executing program 2: r0 = socket$inet(0x2, 0x3, 0x2) connect$inet(0xffffffffffffffff, &(0x7f0000000000)={0x2, 0x0, @local}, 0x10) setsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x23, &(0x7f0000000000)={{{@in=@multicast2, @in=@multicast1}}, {{@in6}, 0x0, @in6=@loopback}}, 0xe8) syz_emit_ethernet(0x2a, &(0x7f0000000640)={@random="b100485caa2a", @link_local, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x1c, 0x0, 0x0, 0x0, 0x2, 0x0, @rand_addr, @broadcast}, @igmp={0x11, 0x0, 0x0, @multicast1}}}}}, &(0x7f0000000140)={0x0, 0x0, [0x0, 0x0, 0x0, 0x3e00]}) 01:56:53 executing program 3: r0 = socket$inet(0x2, 0x3, 0x2) connect$inet(0xffffffffffffffff, &(0x7f0000000000)={0x2, 0x0, @local}, 0x10) setsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x23, &(0x7f0000000000)={{{@in=@multicast2, @in=@multicast1}}, {{@in6}, 0x0, @in6=@loopback}}, 0xe8) syz_emit_ethernet(0x2a, &(0x7f0000000640)={@random="b100485caa2a", @link_local, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x34000, 0x1c, 0x0, 0x0, 0x0, 0x2, 0x0, @rand_addr, @broadcast}, @igmp={0x11, 0xffffffffffffffff, 0x0, @multicast1}}}}}, &(0x7f0000000140)) 01:56:53 executing program 5: perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1f}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000340)={&(0x7f0000000000), 0xc, &(0x7f0000000300)={&(0x7f0000000240)=@newlink={0x50, 0x10, 0x721, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x300000000000000}, [@IFLA_LINKINFO={0x28, 0x12, @veth={{0xc, 0x1, 'veth\x00'}, {0x18, 0x2, @VETH_INFO_PEER={0x14}}}}, @IFLA_NET_NS_FD={0x8}]}, 0x50}}, 0x0) 01:56:53 executing program 4: r0 = socket$inet6_sctp(0xa, 0x10000000005, 0x84) setsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX(r0, 0x84, 0x6e, &(0x7f0000961fe4)=[@in={0x2, 0x0, @dev}], 0x10) getsockopt$inet_sctp6_SCTP_GET_ASSOC_ID_LIST(r0, 0x84, 0x1d, &(0x7f0000000080)=ANY=[@ANYBLOB='\x00\x00\x00\b', @ANYRES32=0x0], &(0x7f000095dffc)=0x2) setsockopt$inet_sctp6_SCTP_MAX_BURST(r0, 0x84, 0x14, &(0x7f0000000000)=@int=0xfffffffffffffff7, 0x4) [ 699.621234] binder: 15511:15513 Acquire 1 refcount change on invalid ref 0 ret -22 01:56:53 executing program 0: socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000001f80)={0xffffffffffffffff, 0xffffffffffffffff}) setsockopt$SO_ATTACH_FILTER(r2, 0x1, 0x1a, &(0x7f0000ab9ff0)={0x2, &(0x7f000039a000)=[{0x20, 0x0, 0x0, 0xfffffffffffff010}, {0x6}]}, 0x10) sendmmsg(r1, &(0x7f0000001e80)=[{{&(0x7f0000000700)=@l2, 0x80, &(0x7f0000001dc0)}}], 0x1, 0x0) 01:56:53 executing program 5: perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1f}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000340)={&(0x7f0000000000), 0xc, &(0x7f0000000300)={&(0x7f0000000240)=@newlink={0x50, 0x10, 0x721, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x400000000000000}, [@IFLA_LINKINFO={0x28, 0x12, @veth={{0xc, 0x1, 'veth\x00'}, {0x18, 0x2, @VETH_INFO_PEER={0x14}}}}, @IFLA_NET_NS_FD={0x8}]}, 0x50}}, 0x0) 01:56:53 executing program 3: r0 = socket$inet(0x2, 0x3, 0x2) connect$inet(0xffffffffffffffff, &(0x7f0000000000)={0x2, 0x0, @local}, 0x10) setsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x23, &(0x7f0000000000)={{{@in=@multicast2, @in=@multicast1}}, {{@in6}, 0x0, @in6=@loopback}}, 0xe8) syz_emit_ethernet(0x2a, &(0x7f0000000640)={@random="b100485caa2a", @link_local, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x800000000000000, 0x1c, 0x0, 0x0, 0x0, 0x2, 0x0, @rand_addr, @broadcast}, @igmp={0x11, 0xffffffffffffffff, 0x0, @multicast1}}}}}, &(0x7f0000000140)) [ 699.753268] binder: 15511:15513 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 699.763000] sctp: [Deprecated]: syz-executor4 (pid 15540) Use of int in max_burst socket option deprecated. [ 699.763000] Use struct sctp_assoc_value instead 01:56:53 executing program 2: r0 = socket$inet(0x2, 0x3, 0x2) connect$inet(0xffffffffffffffff, &(0x7f0000000000)={0x2, 0x0, @local}, 0x10) setsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x23, &(0x7f0000000000)={{{@in=@multicast2, @in=@multicast1}}, {{@in6}, 0x0, @in6=@loopback}}, 0xe8) syz_emit_ethernet(0x2a, &(0x7f0000000640)={@random="b100485caa2a", @link_local, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x1c, 0x0, 0x0, 0x0, 0x2, 0x0, @rand_addr, @broadcast}, @igmp={0x11, 0x0, 0x0, @multicast1}}}}}, &(0x7f0000000140)={0x0, 0x0, [0x0, 0x0, 0x0, 0x700]}) [ 699.867141] binder: 15511:15539 Acquire 1 refcount change on invalid ref 0 ret -22 [ 699.914230] binder: 15511:15539 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 01:56:54 executing program 6: r0 = syz_open_dev$sndseq(&(0x7f0000000100)='/dev/snd/seq\x00', 0x0, 0x0) read(r0, &(0x7f0000fb6000)=""/28, 0x3f0) ioctl$SNDRV_SEQ_IOCTL_REMOVE_EVENTS(r0, 0x4040534e, &(0x7f00000001c0)={0xbf}) ioctl$SNDRV_SEQ_IOCTL_QUERY_SUBS(r0, 0xc058534f, &(0x7f00000002c0)={{}, 0x1, 0x0, 0x0, {}, 0x0, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffff00000000]}) r1 = gettid() timer_create(0x0, &(0x7f0000044000)={0x0, 0x12}, &(0x7f0000000040)) r2 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r2, 0x8912, &(0x7f00000001c0)="0a5cc80700315f85715070") timer_settime(0x0, 0x0, &(0x7f0000000080)={{0x0, 0x989680}, {0x0, 0x9}}, &(0x7f0000040000)) tkill(r1, 0x1000000000014) 01:56:54 executing program 0: socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000001f80)={0xffffffffffffffff, 0xffffffffffffffff}) setsockopt$SO_ATTACH_FILTER(r2, 0x1, 0x1a, &(0x7f0000ab9ff0)={0x2, &(0x7f000039a000)=[{0x20, 0x0, 0x0, 0xfffffffffffff010}, {0x6}]}, 0x10) sendmmsg(r1, &(0x7f0000001e80)=[{{&(0x7f0000000700)=@l2, 0x80, &(0x7f0000001dc0)}}], 0x1, 0x0) 01:56:54 executing program 5: perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1f}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000340)={&(0x7f0000000000), 0xc, &(0x7f0000000300)={&(0x7f0000000240)=@newlink={0x50, 0x10, 0x721, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0xffffff7f00000000}, [@IFLA_LINKINFO={0x28, 0x12, @veth={{0xc, 0x1, 'veth\x00'}, {0x18, 0x2, @VETH_INFO_PEER={0x14}}}}, @IFLA_NET_NS_FD={0x8}]}, 0x50}}, 0x0) 01:56:54 executing program 3: r0 = socket$inet(0x2, 0x3, 0x2) connect$inet(0xffffffffffffffff, &(0x7f0000000000)={0x2, 0x0, @local}, 0x10) setsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x23, &(0x7f0000000000)={{{@in=@multicast2, @in=@multicast1}}, {{@in6}, 0x0, @in6=@loopback}}, 0xe8) syz_emit_ethernet(0x2a, &(0x7f0000000640)={@random="b100485caa2a", @link_local, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x4000000, 0x1c, 0x0, 0x0, 0x0, 0x2, 0x0, @rand_addr, @broadcast}, @igmp={0x11, 0xffffffffffffffff, 0x0, @multicast1}}}}}, &(0x7f0000000140)) 01:56:54 executing program 2: r0 = socket$inet(0x2, 0x3, 0x2) connect$inet(0xffffffffffffffff, &(0x7f0000000000)={0x2, 0x0, @local}, 0x10) setsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x23, &(0x7f0000000000)={{{@in=@multicast2, @in=@multicast1}}, {{@in6}, 0x0, @in6=@loopback}}, 0xe8) syz_emit_ethernet(0x2a, &(0x7f0000000640)={@random="b100485caa2a", @link_local, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x1c, 0x0, 0x0, 0x0, 0x2, 0x0, @rand_addr, @broadcast}, @igmp={0x11, 0x0, 0x0, @multicast1}}}}}, &(0x7f0000000140)={0x0, 0x0, [0x0, 0x0, 0x0, 0x600]}) 01:56:54 executing program 7: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000180)='/dev/sequencer\x00', 0x10002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000080)="0a5cc80700315f85715070") r1 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000001c0)={0x2, 0x0, &(0x7f0000000140)=ANY=[@ANYBLOB='\fc'], 0x0, 0x0, &(0x7f0000000080)}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, &(0x7f00000001c0)}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000040)={0x8, 0x2000000000000000, &(0x7f00000000c0)=[@release={0x400c630f}], 0x1, 0x0, &(0x7f0000000100)='V'}) fstat(r0, &(0x7f00000002c0)) 01:56:54 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x3e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff7fffffffffff}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, &(0x7f00000001c0)}) r1 = openat$cuse(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/cuse\x00', 0xa03, 0x0) ioctl$TIOCGWINSZ(r1, 0x5413, &(0x7f0000000100)) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f0000000040)=[@release], 0x0, 0x0, &(0x7f0000000100)}) [ 700.501507] binder: BINDER_SET_CONTEXT_MGR already set 01:56:54 executing program 5: perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1f}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000340)={&(0x7f0000000000), 0xc, &(0x7f0000000300)={&(0x7f0000000240)=@newlink={0x50, 0x10, 0x721, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x8000000}, [@IFLA_LINKINFO={0x28, 0x12, @veth={{0xc, 0x1, 'veth\x00'}, {0x18, 0x2, @VETH_INFO_PEER={0x14}}}}, @IFLA_NET_NS_FD={0x8}]}, 0x50}}, 0x0) 01:56:54 executing program 2: r0 = socket$inet(0x2, 0x3, 0x2) connect$inet(0xffffffffffffffff, &(0x7f0000000000)={0x2, 0x0, @local}, 0x10) setsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x23, &(0x7f0000000000)={{{@in=@multicast2, @in=@multicast1}}, {{@in6}, 0x0, @in6=@loopback}}, 0xe8) syz_emit_ethernet(0x2a, &(0x7f0000000640)={@random="b100485caa2a", @link_local, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x1c, 0x0, 0x0, 0x0, 0x2, 0x0, @rand_addr, @broadcast}, @igmp={0x11, 0x0, 0x0, @multicast1}}}}}, &(0x7f0000000140)={0x0, 0x0, [0x0, 0x0, 0x0, 0x1c00]}) 01:56:54 executing program 3: r0 = socket$inet(0x2, 0x3, 0x2) connect$inet(0xffffffffffffffff, &(0x7f0000000000)={0x2, 0x0, @local}, 0x10) setsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x23, &(0x7f0000000000)={{{@in=@multicast2, @in=@multicast1}}, {{@in6}, 0x0, @in6=@loopback}}, 0xe8) syz_emit_ethernet(0x2a, &(0x7f0000000640)={@random="b100485caa2a", @link_local, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x60000000, 0x1c, 0x0, 0x0, 0x0, 0x2, 0x0, @rand_addr, @broadcast}, @igmp={0x11, 0xffffffffffffffff, 0x0, @multicast1}}}}}, &(0x7f0000000140)) 01:56:54 executing program 4: r0 = socket$netlink(0x10, 0x3, 0x15) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000040)={"7465616d300000000000e7ff0000ecff", 0x0}) r2 = dup2(r0, r0) getsockopt$inet_sctp_SCTP_STATUS(0xffffffffffffff9c, 0x84, 0xe, &(0x7f0000000080)={0x0, 0x1f0000, 0x6, 0x0, 0x7, 0x1, 0xf, 0xfffffffffffffff7, {0x0, @in6={{0xa, 0x4e23, 0xfffffffffffff5c9, @loopback, 0x2}}, 0x0, 0x5, 0x7fff, 0x3, 0x6}}, &(0x7f0000000000)=0xb0) getsockopt$inet_sctp_SCTP_PEER_ADDR_PARAMS(r2, 0x84, 0x9, &(0x7f0000000140)={r3, @in={{0x2, 0x4e23, @loopback}}, 0x10001, 0x80000000, 0x75, 0x7, 0x8}, &(0x7f0000000200)=0x98) getsockopt$inet_sctp_SCTP_PEER_ADDR_THLDS(r2, 0x84, 0x1f, &(0x7f0000000300)={r3, @in={{0x2, 0x4e22}}, 0x4, 0x2}, &(0x7f0000000240)=0x90) sendmsg$nl_route(r0, &(0x7f00000018c0)={&(0x7f00000002c0), 0xc, &(0x7f0000001880)={&(0x7f0000000500)=@newlink={0x2c, 0x10, 0x15, 0x0, 0x0, {0x0, 0x0, 0x0, r1}, [@IFLA_ADDRESS={0xc, 0x1, @broadcast}]}, 0x2c}}, 0x0) [ 700.539773] binder: 15568:15576 ioctl 40046207 0 returned -16 [ 700.569950] binder: 15577:15578 Acquire 1 refcount change on invalid ref 0 ret -22 01:56:54 executing program 1: r0 = socket(0x40000000015, 0x5, 0x0) r1 = socket$pptp(0x18, 0x1, 0x2) r2 = syz_open_dev$midi(&(0x7f0000000000)='/dev/midi#\x00', 0x7, 0x8cf2553544b01ca4) write$binfmt_aout(r2, &(0x7f0000000100)={{0x0, 0x9, 0x401, 0x23b, 0x78, 0xdbc, 0x21c, 0x8e1}, "9d02ad57973acd919d44f3a73e7bee8e2f6e946a0709e95e6c21b2c34acea9477b5b79c966acfca7c6d8efbcd4ccbe6d6982050cf4dd15f6af96ab1b912f74fdd6725311df2d02081f714d44077ed543ebe85976f0067c5aff27577332c78e7ea64f6e66395784da1ffc672e8f138b29157d08e82fdbfcaf57dcdb1608a1cc9fb55f2df485f841a8c42b81ebd2a31369cc9ebd43fdced09d2195f9141c0719acb8b68b685d5c174c18090213ab6f6c94f7502b73b9093c970da412", [[], [], [], [], [], [], [], []]}, 0x8db) ioctl$UFFDIO_ZEROPAGE(r2, 0xc020aa04, &(0x7f0000000040)={{&(0x7f0000ffd000/0x1000)=nil, 0x1000}, 0x1}) write$P9_RCREATE(r2, &(0x7f0000000b40)={0x18, 0x73, 0x1, {{0x4, 0x4, 0x2}, 0x8}}, 0x18) setsockopt(r1, 0x2, 0x800000a, &(0x7f0000002ffc)="043b20b4", 0xfffffffffffffe34) getsockopt$inet_IP_IPSEC_POLICY(r2, 0x0, 0x10, &(0x7f0000000a00)={{{@in6=@mcast2, @in6=@mcast1}}, {{@in6=@mcast2}, 0x0, @in=@multicast1}}, &(0x7f0000000b00)=0xe8) getsockopt$inet_mreqsrc(r0, 0x0, 0x25, &(0x7f0000000080)={@multicast2, @multicast2, @local}, &(0x7f00000000c0)=0xc) 01:56:54 executing program 5: perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1f}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000340)={&(0x7f0000000000), 0xc, &(0x7f0000000300)={&(0x7f0000000240)=@newlink={0x50, 0x10, 0x721, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x6}, [@IFLA_LINKINFO={0x28, 0x12, @veth={{0xc, 0x1, 'veth\x00'}, {0x18, 0x2, @VETH_INFO_PEER={0x14}}}}, @IFLA_NET_NS_FD={0x8}]}, 0x50}}, 0x0) 01:56:54 executing program 4: r0 = openat$ipvs(0xffffffffffffff9c, &(0x7f00000001c0)='/proc/sys/net/ipv4/vs/sync_persist_mode\x00', 0x2, 0x0) ioctl$SG_GET_REQUEST_TABLE(r0, 0x2286, &(0x7f0000000200)) r1 = socket(0x1e, 0x1, 0x0) r2 = perf_event_open(&(0x7f0000000140)={0x0, 0x70, 0x3e3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x6}, 0x0, 0x0, 0xffffffffffffffff, 0x0) setsockopt$inet_group_source_req(r1, 0x0, 0x2e, &(0x7f0000000000)={0xdb, {{0x2, 0x4e22, @multicast2}}, {{0x2, 0x4e21, @dev={0xac, 0x14, 0x14, 0xb}}}}, 0x108) sendmsg(r1, &(0x7f0000030000)={&(0x7f00004aeb5c)=@generic={0x10000000001e, "02ed01000000000000000001e527cc573c5bf86c483700c71e14dd6a739effea1b48006be61ffe0000e103000000f8000004003f010039d8f9b1ff010003000024e7af50dd0700000000000000e3ad316a19830000000000000006cb24281e2780e503000076c3979ac40023bd07020078a1dfd300881a8365b186827436"}, 0x51, &(0x7f0000000080), 0x358, &(0x7f00008b2000)}, 0x0) open_by_handle_at(r2, &(0x7f00000003c0)={0xdd, 0x5, "f0010ea55922e82d26b4db5fb583f42b672e118c837ad8aea412f947c96926b07e5956b13c1c56e18800705477adc46e8567b9d2c9c58377c700325b966d4b7f0cd24feb3365cd67367b88fcb11fe89b313148fcc569e847912fa01e51b63bd093f136e5df9ea136db357a2d471d8df4963bed4581b4899bed7ef3e74b86fbeff2d6ada4250e93b91b416f813ddab7895b5897ccf9046733478842e44c4e807309ac813bbe3cba8f011928fe84095f7e911fff1d2b8ab9ddc98284fa4c150cc0b9cdcd412fbe8901bdfc2c153aaf9c0f8b06ec4728"}, 0x200) ioctl$IOC_PR_PREEMPT_ABORT(r0, 0x401870cc, &(0x7f0000000380)={0x1, 0x10000, 0xfffffffffffffffb, 0x7}) close(r1) 01:56:54 executing program 3: r0 = socket$inet(0x2, 0x3, 0x2) connect$inet(0xffffffffffffffff, &(0x7f0000000000)={0x2, 0x0, @local}, 0x10) setsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x23, &(0x7f0000000000)={{{@in=@multicast2, @in=@multicast1}}, {{@in6}, 0x0, @in6=@loopback}}, 0xe8) syz_emit_ethernet(0x2a, &(0x7f0000000640)={@random="b100485caa2a", @link_local, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0xe0000000, 0x1c, 0x0, 0x0, 0x0, 0x2, 0x0, @rand_addr, @broadcast}, @igmp={0x11, 0xffffffffffffffff, 0x0, @multicast1}}}}}, &(0x7f0000000140)) [ 700.701144] binder: 15577:15578 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 01:56:54 executing program 2: r0 = socket$inet(0x2, 0x3, 0x2) connect$inet(0xffffffffffffffff, &(0x7f0000000000)={0x2, 0x0, @local}, 0x10) setsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x23, &(0x7f0000000000)={{{@in=@multicast2, @in=@multicast1}}, {{@in6}, 0x0, @in6=@loopback}}, 0xe8) syz_emit_ethernet(0x2a, &(0x7f0000000640)={@random="b100485caa2a", @link_local, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x1c, 0x0, 0x0, 0x0, 0x2, 0x0, @rand_addr, @broadcast}, @igmp={0x11, 0x0, 0x0, @multicast1}}}}}, &(0x7f0000000140)={0x0, 0x0, [0x0, 0x0, 0x0, 0x8]}) [ 700.823542] binder: 15577:15611 Acquire 1 refcount change on invalid ref 0 ret -22 [ 700.838190] binder: 15577:15611 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 700.887573] binder: 15578 RLIMIT_NICE not set 01:56:55 executing program 5: perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1f}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000340)={&(0x7f0000000000), 0xc, &(0x7f0000000300)={&(0x7f0000000240)=@newlink={0x50, 0x10, 0x721, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0xb40a}, [@IFLA_LINKINFO={0x28, 0x12, @veth={{0xc, 0x1, 'veth\x00'}, {0x18, 0x2, @VETH_INFO_PEER={0x14}}}}, @IFLA_NET_NS_FD={0x8}]}, 0x50}}, 0x0) 01:56:55 executing program 0: socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000001f80)={0xffffffffffffffff, 0xffffffffffffffff}) setsockopt$SO_ATTACH_FILTER(r2, 0x1, 0x1a, &(0x7f0000ab9ff0)={0x2, &(0x7f000039a000)=[{0x20, 0x0, 0x0, 0xfffffffffffff010}, {0x6}]}, 0x10) sendmmsg(r1, &(0x7f0000001e80)=[{{&(0x7f0000000700)=@l2, 0x80, &(0x7f0000001dc0)}}], 0x1, 0x0) 01:56:55 executing program 6: r0 = syz_open_dev$sndseq(&(0x7f0000000100)='/dev/snd/seq\x00', 0x0, 0x0) read(r0, &(0x7f0000fb6000)=""/28, 0x3f0) ioctl$SNDRV_SEQ_IOCTL_REMOVE_EVENTS(r0, 0x4040534e, &(0x7f00000001c0)={0xbf}) ioctl$SNDRV_SEQ_IOCTL_QUERY_SUBS(r0, 0xc058534f, &(0x7f00000002c0)={{}, 0x1, 0x0, 0x0, {}, 0x0, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xbf000000]}) r1 = gettid() timer_create(0x0, &(0x7f0000044000)={0x0, 0x12}, &(0x7f0000000040)) r2 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r2, 0x8912, &(0x7f00000001c0)="0a5cc80700315f85715070") timer_settime(0x0, 0x0, &(0x7f0000000080)={{0x0, 0x989680}, {0x0, 0x9}}, &(0x7f0000040000)) tkill(r1, 0x1000000000014) 01:56:55 executing program 1: r0 = perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff7ffffffffffb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) getsockopt$inet_sctp6_SCTP_GET_PEER_ADDR_INFO(r0, 0x84, 0xf, &(0x7f0000000000)={0x0, @in6={{0xa, 0x4e22, 0x3, @remote, 0x40}}, 0x2, 0x3, 0x100, 0x0, 0x4}, &(0x7f00000000c0)=0x98) ioctl$PIO_FONT(r0, 0x4b61, &(0x7f0000000340)="3427e931180d6b016d603078107c0c59861612aaba254b5eccacf0dca7f40dbc39fbe1478cffbc6bc5fc991248e51b697e5a9aed8ed5543d2eb371ee61d8699754e5960afade016a3172c3aca349cea6d3ed8a89d9eae206b565d6f7cf4b8ddd2fde65a05eed31c387b25a70ed422629faed9da23e0b8442f0260e00db75644c47571f35aceda13ab3c7553deb564a1d24f1875434d8cee39c833aef3c1ecff286995092") setsockopt$inet_sctp6_SCTP_RECONFIG_SUPPORTED(r0, 0x84, 0x75, &(0x7f0000000140)={r1, 0x2}, 0x8) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) close(r3) io_setup(0x8, &(0x7f0000000100)=0x0) r5 = msgget$private(0x0, 0x100) msgctl$IPC_RMID(r5, 0x0) setsockopt$inet_sctp_SCTP_PRIMARY_ADDR(r2, 0x84, 0x6, &(0x7f0000000400)={r1, @in={{0x2, 0xff3}}}, 0x84) ioctl$KVM_GET_REGS(r0, 0x8090ae81, &(0x7f0000000280)) socket$l2tp(0x18, 0x1, 0x1) io_submit(r4, 0x1400, &(0x7f0000000600)=[&(0x7f0000000180)={0x0, 0x0, 0x0, 0x0, 0x0, r3, &(0x7f0000000140), 0xfe}]) 01:56:55 executing program 2: r0 = socket$inet(0x2, 0x3, 0x2) connect$inet(0xffffffffffffffff, &(0x7f0000000000)={0x2, 0x0, @local}, 0x10) setsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x23, &(0x7f0000000000)={{{@in=@multicast2, @in=@multicast1}}, {{@in6}, 0x0, @in6=@loopback}}, 0xe8) syz_emit_ethernet(0x2a, &(0x7f0000000640)={@random="b100485caa2a", @link_local, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x1c, 0x0, 0x0, 0x0, 0x2, 0x0, @rand_addr, @broadcast}, @igmp={0x11, 0x0, 0x0, @multicast1}}}}}, &(0x7f0000000140)={0x0, 0x0, [0x0, 0x0, 0x0, 0x4]}) 01:56:55 executing program 3: r0 = socket$inet(0x2, 0x3, 0x2) connect$inet(0xffffffffffffffff, &(0x7f0000000000)={0x2, 0x0, @local}, 0x10) setsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x23, &(0x7f0000000000)={{{@in=@multicast2, @in=@multicast1}}, {{@in6}, 0x0, @in6=@loopback}}, 0xe8) syz_emit_ethernet(0x2a, &(0x7f0000000640)={@random="b100485caa2a", @link_local, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0xf0ffffffffffff, 0x1c, 0x0, 0x0, 0x0, 0x2, 0x0, @rand_addr, @broadcast}, @igmp={0x11, 0xffffffffffffffff, 0x0, @multicast1}}}}}, &(0x7f0000000140)) 01:56:55 executing program 7: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000180)='/dev/sequencer\x00', 0x10002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000080)="0a5cc80700315f85715070") r1 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000001c0)={0x2, 0x0, &(0x7f0000000140)=ANY=[@ANYBLOB='\fc'], 0x0, 0x0, &(0x7f0000000080)}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, &(0x7f00000001c0)}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000040)={0x8, 0x74000000, &(0x7f00000000c0)=[@release={0x400c630f}], 0x1, 0x0, &(0x7f0000000100)='V'}) fstat(r0, &(0x7f00000002c0)) 01:56:55 executing program 4: r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000180)={0x5, 0x3, 0x7, 0x3}, 0x2c) r1 = syz_open_dev$midi(&(0x7f0000000000)='/dev/midi#\x00', 0x0, 0x2) ioctl$sock_inet6_tcp_SIOCOUTQ(r1, 0x5411, &(0x7f0000000040)) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f00000002c0)={r0, &(0x7f0000000080), &(0x7f0000000100)}, 0x20) perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff7ffffffffffb, 0x0, 0x0, 0x8c7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$KDGKBLED(r1, 0x4b64, &(0x7f0000000080)) bpf$MAP_DELETE_ELEM(0x3, &(0x7f0000000140)={r0, &(0x7f0000000040)}, 0x10) 01:56:55 executing program 2: r0 = socket$inet(0x2, 0x3, 0x2) connect$inet(0xffffffffffffffff, &(0x7f0000000000)={0x2, 0x0, @local}, 0x10) setsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x23, &(0x7f0000000000)={{{@in=@multicast2, @in=@multicast1}}, {{@in6}, 0x0, @in6=@loopback}}, 0xe8) syz_emit_ethernet(0x2a, &(0x7f0000000640)={@random="b100485caa2a", @link_local, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x1c, 0x0, 0x0, 0x0, 0x2, 0x0, @rand_addr, @broadcast}, @igmp={0x11, 0x0, 0x0, @multicast1}}}}}, &(0x7f0000000140)={0x0, 0x0, [0x0, 0x0, 0x0, 0x3]}) 01:56:55 executing program 5: perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1f}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000340)={&(0x7f0000000000), 0xc, &(0x7f0000000300)={&(0x7f0000000240)=@newlink={0x50, 0x10, 0x721, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0xf0}, [@IFLA_LINKINFO={0x28, 0x12, @veth={{0xc, 0x1, 'veth\x00'}, {0x18, 0x2, @VETH_INFO_PEER={0x14}}}}, @IFLA_NET_NS_FD={0x8}]}, 0x50}}, 0x0) 01:56:55 executing program 4: r0 = socket$inet(0x2, 0xa, 0x311) r1 = dup3(r0, r0, 0x80000) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x1, 0x32, 0xffffffffffffffff, 0x0) getsockopt$inet_sctp6_SCTP_ENABLE_STREAM_RESET(r1, 0x84, 0x76, &(0x7f0000000180)={0x0, 0xffffffff}, &(0x7f00000001c0)=0x8) setsockopt$inet_sctp_SCTP_RTOINFO(r0, 0x84, 0x0, &(0x7f0000000200)={r2, 0x8001, 0x3, 0xa1e}, 0x10) r3 = socket$inet(0x2, 0x3, 0x2) setsockopt$inet_sctp6_SCTP_DISABLE_FRAGMENTS(r1, 0x84, 0x8, &(0x7f0000000380)=0x401, 0x4) r4 = dup2(r0, r1) ioctl$BLKZEROOUT(r4, 0x127f, &(0x7f0000000000)={0x9}) getsockopt$inet_mreqsrc(r3, 0x0, 0xd0, &(0x7f00000000c0)={@dev, @local, @broadcast}, &(0x7f0000000040)=0xc) ioctl$PPPIOCGFLAGS(r4, 0x8004745a, &(0x7f0000000080)) write$FUSE_INTERRUPT(r1, &(0x7f0000000240)={0x10, 0xfffffffffffffff5, 0x5}, 0x10) getsockopt$bt_BT_VOICE(r1, 0x112, 0xb, &(0x7f0000000100)=0x2, &(0x7f0000000140)=0x2) ioctl$EVIOCGABS2F(r4, 0x8018456f, &(0x7f0000000280)=""/240) getgid() 01:56:55 executing program 3: r0 = socket$inet(0x2, 0x3, 0x2) connect$inet(0xffffffffffffffff, &(0x7f0000000000)={0x2, 0x0, @local}, 0x10) setsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x23, &(0x7f0000000000)={{{@in=@multicast2, @in=@multicast1}}, {{@in6}, 0x0, @in6=@loopback}}, 0xe8) syz_emit_ethernet(0x2a, &(0x7f0000000640)={@random="b100485caa2a", @link_local, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x1c000000, 0x1c, 0x0, 0x0, 0x0, 0x2, 0x0, @rand_addr, @broadcast}, @igmp={0x11, 0xffffffffffffffff, 0x0, @multicast1}}}}}, &(0x7f0000000140)) 01:56:55 executing program 1: r0 = fcntl$dupfd(0xffffffffffffff9c, 0x0, 0xffffffffffffffff) openat$cgroup_type(r0, &(0x7f0000000540)='cgroup.type\x00', 0x2, 0x0) clone(0x1000002, &(0x7f0000000200), &(0x7f0000001800), &(0x7f0000000280), &(0x7f0000001700)="05280c220620c4e6bd8e6a24874054b4e5a1146999e20c8c4332af9c2130d3d6827f2b1ba8b4ebdd53a87f2d35ad98e3deb14aeb1a98917568a39acc8fd62dcc8ab6616b4f1561f2a927ff70aa541a0b70e51bdd283e7a0a2a86cd10868dea9434eb6fd2bff3f9e8d209bf439c3c5488796544605b01f5fa794fb3d7885ef23350786eb31ebe9873dee4003719b283c152a9a4cdccbe9892f07f5db48e0e1a1819bc314466afb1f097bc03db5f65cf948a6ed2d9972a6c2925cae831a5150deab78245ab764abb62e8e5b0") mknod(&(0x7f00000000c0)='./file0\x00', 0x1040, 0x0) clock_gettime(0x0, &(0x7f0000000340)={0x0, 0x0}) timer_settime(0x0, 0x0, &(0x7f0000000380)={{r1, r2+10000000}}, &(0x7f00000003c0)) r3 = perf_event_open(&(0x7f0000940000)={0x2, 0x70, 0xfffffffffffffffe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r4 = syz_open_dev$loop(&(0x7f0000000000)='/dev/loop#\x00', 0x10000000000, 0x0) r5 = perf_event_open(&(0x7f0000940000)={0x0, 0x70, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8000, 0x80000000000000, @perf_bp, 0x0, 0x0, 0x2}, 0x0, 0x0, 0xffffffffffffffff, 0x0) setsockopt$inet6_udp_int(r3, 0x11, 0xd, &(0x7f0000000100)=0xc, 0x4) perf_event_open(&(0x7f0000940000)={0x2, 0x78, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mkdir(&(0x7f0000027000)='./file0\x00', 0xfffffffffffffffd) mount(&(0x7f0000018000)='./file0\x00', &(0x7f00000005c0)='./file0\x00', &(0x7f0000000580)='ext3\x00', 0x0, &(0x7f0000000480)="e1fb76c3860f81bef9d4aeb257a3b11475c4c532976c5d67863a33c4d35ff3f7f7e0b114170f8b6e08002e5f08783b6eae45dddc37237ec6b534f42392dea4128ec010324f1dd744a33492cff40469735e786cc79807f7d6c63073a0573204f9cb2df8066cb2b72e7b0fa2141c29c6c88e83463243a5c090e7323822475a91345e3c34c019772375df194c357611efbda31af1487fe3c549fc163e0045a8f192d830268f4ae86ce0a8aba73458e93c19") r6 = open$dir(&(0x7f00000000c0)='./file0/bus\x00', 0x40, 0x0) ioctl$BLKTRACETEARDOWN(r0, 0x1276, 0x0) setsockopt$netlink_NETLINK_CAP_ACK(r0, 0x10e, 0xa, &(0x7f0000000140)=0x9, 0x4) open$dir(&(0x7f0000000600)='./file0/bus\x00', 0x40, 0x80) ioctl(r4, 0x9, &(0x7f0000000800)="2957e1311f16f47767107011a81617f45c61093586afc722babfd2a0a660c87f515cdb1827018d999a5834339d3a8179b8b9927a9b4db8317177af718e6cb42a6041c20e804d0888777c4e050f311bf539d53ec66408000000000000002eef9c1231a2d92b86d76d734491ae7f9fe8504e1a147ccda57209ce77af4df09d819d633dec2e9a01a4daa747f6af513d995c09ea2d4bc40800000000000049cd0301586c9358831a77bd109389188534a9bcb75532a0c8d26067434666b447d6b75499c34525afd52e37750dae67a1749cba05c0ef0c0e9762cc43a33a3c0d0e904d187daf2921fa3bac10479c0a8dfd215b6c442b1076cdd4a968e96bdad9dc4565361c6cd9985c75ca1e9ee869c06f157a59a3b83feb041463e3a297922de2748fee5a055c9ba2d71e9f80") r7 = socket(0x0, 0x0, 0x0) fcntl$getown(r5, 0x9) timer_create(0x6, &(0x7f0000000240)={0x0, 0x1d, 0x2, @thr={&(0x7f0000000200)="0aa21a865c", &(0x7f00000002c0)="507db1f329182e4faebb3f9d72113f879274ac21c7b49ee56b44ad6d0073aab6f7365505049ffe7c15580009a5ef715f9bec649ff3e10878cf49cd1ebd14a1d4c663a2da694d6da20cc2b7bd80d4a921d170c29ee5ae6193aecfde851adf6ddb4903d316"}}, &(0x7f0000000400)=0x0) timer_gettime(r8, &(0x7f0000000440)) getsockopt$sock_buf(r7, 0x1, 0xffffffffffffffff, &(0x7f0000000940)=""/192, &(0x7f0000000180)=0xc0) ioctl$BLKTRACESETUP(r4, 0xc0481273, &(0x7f0000000040)={[], 0x0, 0x9, 0xed34, 0x2000000, 0xff}) ioctl$BLKTRACESTART(r4, 0x1274, 0x0) ioctl$SNDRV_RAWMIDI_IOCTL_STATUS(r0, 0xc0385720, &(0x7f00000001c0)={0x1, {0x0, 0x1c9c380}, 0x4, 0x2}) r9 = dup(r6) ioctl$SIOCGIFHWADDR(r9, 0x8927, &(0x7f0000000680)) ioctl$BLKTRACESTOP(r4, 0x1275, 0x0) ioctl$BLKTRACETEARDOWN(r4, 0x1276, 0x0) [ 701.445454] binder: 15653:15654 Acquire 1 refcount change on invalid ref 0 ret -22 [ 701.457057] binder: 15653:15654 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 01:56:55 executing program 2: r0 = socket$inet(0x2, 0x3, 0x2) connect$inet(0xffffffffffffffff, &(0x7f0000000000)={0x2, 0x0, @local}, 0x10) setsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x23, &(0x7f0000000000)={{{@in=@multicast2, @in=@multicast1}}, {{@in6}, 0x0, @in6=@loopback}}, 0xe8) syz_emit_ethernet(0x2a, &(0x7f0000000640)={@random="b100485caa2a", @link_local, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x1c, 0x0, 0x0, 0x0, 0x2, 0x0, @rand_addr, @broadcast}, @igmp={0x11, 0x0, 0x0, @multicast1}}}}}, &(0x7f0000000140)={0x0, 0x0, [0x0, 0x0, 0x0, 0x300000000000000]}) 01:56:55 executing program 4: r0 = socket$inet6(0xa, 0x5, 0x0) ioctl(r0, 0x8912, &(0x7f0000000080)="0a5cc80700315f85715070") socket$inet6_tcp(0xa, 0x1, 0x0) r1 = socket$inet_udplite(0x2, 0x2, 0x88) setsockopt$IP_VS_SO_SET_ADD(r1, 0x0, 0x482, &(0x7f0000000140)={0x84, @empty, 0x0, 0x0, 'mh\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00 ', 0xfffffffffffffffe, 0x2}, 0x2c) 01:56:55 executing program 0: socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000001f80)={0xffffffffffffffff, 0xffffffffffffffff}) setsockopt$SO_ATTACH_FILTER(r2, 0x1, 0x1a, &(0x7f0000ab9ff0)={0x2, &(0x7f000039a000)=[{0x20, 0x0, 0x0, 0xfffffffffffff010}, {0x6}]}, 0x10) sendmmsg(r1, &(0x7f0000001e80)=[{{&(0x7f0000000700)=@l2, 0x80, &(0x7f0000001dc0)}}], 0x1, 0x0) 01:56:55 executing program 5: perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1f}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000340)={&(0x7f0000000000), 0xc, &(0x7f0000000300)={&(0x7f0000000240)=@newlink={0x50, 0x10, 0x721, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x900000000000000}, [@IFLA_LINKINFO={0x28, 0x12, @veth={{0xc, 0x1, 'veth\x00'}, {0x18, 0x2, @VETH_INFO_PEER={0x14}}}}, @IFLA_NET_NS_FD={0x8}]}, 0x50}}, 0x0) [ 701.600705] binder: 15653:15679 Acquire 1 refcount change on invalid ref 0 ret -22 01:56:55 executing program 3: r0 = socket$inet(0x2, 0x3, 0x2) connect$inet(0xffffffffffffffff, &(0x7f0000000000)={0x2, 0x0, @local}, 0x10) setsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x23, &(0x7f0000000000)={{{@in=@multicast2, @in=@multicast1}}, {{@in6}, 0x0, @in6=@loopback}}, 0xe8) syz_emit_ethernet(0x2a, &(0x7f0000000640)={@random="b100485caa2a", @link_local, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0xf0, 0x1c, 0x0, 0x0, 0x0, 0x2, 0x0, @rand_addr, @broadcast}, @igmp={0x11, 0xffffffffffffffff, 0x0, @multicast1}}}}}, &(0x7f0000000140)) [ 701.650147] binder: 15653:15679 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 701.720757] IPVS: ip_vs_svc_hash(): request for already hashed, called from do_ip_vs_set_ctl+0x1b3a/0x1d80 [ 701.785031] binder: 15654 RLIMIT_NICE not set [ 701.800516] IPVS: ip_vs_svc_hash(): request for already hashed, called from do_ip_vs_set_ctl+0x1b3a/0x1d80 01:56:56 executing program 6: r0 = syz_open_dev$sndseq(&(0x7f0000000100)='/dev/snd/seq\x00', 0x0, 0x0) read(r0, &(0x7f0000fb6000)=""/28, 0x3f0) ioctl$SNDRV_SEQ_IOCTL_REMOVE_EVENTS(r0, 0x4040534e, &(0x7f00000001c0)={0xbf}) ioctl$SNDRV_SEQ_IOCTL_QUERY_SUBS(r0, 0xc058534f, &(0x7f00000002c0)={{}, 0x1, 0x0, 0x0, {}, 0x0, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xe00]}) r1 = gettid() timer_create(0x0, &(0x7f0000044000)={0x0, 0x12}, &(0x7f0000000040)) r2 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r2, 0x8912, &(0x7f00000001c0)="0a5cc80700315f85715070") timer_settime(0x0, 0x0, &(0x7f0000000080)={{0x0, 0x989680}, {0x0, 0x9}}, &(0x7f0000040000)) tkill(r1, 0x1000000000014) 01:56:56 executing program 1: r0 = accept(0xffffffffffffff9c, &(0x7f0000000000)=@nfc_llcp, &(0x7f00000000c0)=0x80) rseq(&(0x7f0000001240)={0x0, 0x0, &(0x7f0000000080)={0x0, 0x2, 0x5, 0x5, 0x5}, 0x1}, 0x20, 0x0, 0x0) setsockopt$inet_int(r0, 0x0, 0x1f, &(0x7f0000001200)=0x9, 0x1c7) r1 = socket$inet6(0xa, 0x1000000000002, 0x0) r2 = openat$cuse(0xffffffffffffff9c, &(0x7f0000001180)='/dev/cuse\x00', 0x0, 0x0) ioctl(r1, 0x8912, &(0x7f0000001140)="0a5cc80700315f85715070") r3 = socket$inet6_sctp(0xa, 0x800, 0x84) ioctl$KDSIGACCEPT(r2, 0x4b4e, 0x100000020001d) connect$inet6(r1, &(0x7f00008c0000)={0xa, 0x4e23, 0x0, @loopback, 0x2}, 0x33a) mremap(&(0x7f0000ffd000/0x2000)=nil, 0x2000, 0x4000, 0x2, &(0x7f0000ffb000/0x4000)=nil) getsockopt$sock_buf(r3, 0x1, 0x1c, &(0x7f0000000100)=""/4096, &(0x7f0000001100)=0x1c) ioctl$int_out(r2, 0x2, &(0x7f00000011c0)) 01:56:56 executing program 3: r0 = socket$inet(0x2, 0x3, 0x2) connect$inet(0xffffffffffffffff, &(0x7f0000000000)={0x2, 0x0, @local}, 0x10) setsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x23, &(0x7f0000000000)={{{@in=@multicast2, @in=@multicast1}}, {{@in6}, 0x0, @in6=@loopback}}, 0xe8) syz_emit_ethernet(0x2a, &(0x7f0000000640)={@random="b100485caa2a", @link_local, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x600, 0x1c, 0x0, 0x0, 0x0, 0x2, 0x0, @rand_addr, @broadcast}, @igmp={0x11, 0xffffffffffffffff, 0x0, @multicast1}}}}}, &(0x7f0000000140)) 01:56:56 executing program 2: r0 = socket$inet(0x2, 0x3, 0x2) connect$inet(0xffffffffffffffff, &(0x7f0000000000)={0x2, 0x0, @local}, 0x10) setsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x23, &(0x7f0000000000)={{{@in=@multicast2, @in=@multicast1}}, {{@in6}, 0x0, @in6=@loopback}}, 0xe8) syz_emit_ethernet(0x2a, &(0x7f0000000640)={@random="b100485caa2a", @link_local, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x1c, 0x0, 0x0, 0x0, 0x2, 0x0, @rand_addr, @broadcast}, @igmp={0x11, 0x0, 0x0, @multicast1}}}}}, &(0x7f0000000140)={0x0, 0x0, [0x0, 0x0, 0x0, 0x6000000000000000]}) 01:56:56 executing program 5: perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1f}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000340)={&(0x7f0000000000), 0xc, &(0x7f0000000300)={&(0x7f0000000240)=@newlink={0x50, 0x10, 0x721, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0xfffff000}, [@IFLA_LINKINFO={0x28, 0x12, @veth={{0xc, 0x1, 'veth\x00'}, {0x18, 0x2, @VETH_INFO_PEER={0x14}}}}, @IFLA_NET_NS_FD={0x8}]}, 0x50}}, 0x0) 01:56:56 executing program 0: socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000001f80)={0xffffffffffffffff, 0xffffffffffffffff}) setsockopt$SO_ATTACH_FILTER(r2, 0x1, 0x1a, &(0x7f0000ab9ff0)={0x2, &(0x7f000039a000)=[{0x20, 0x0, 0x0, 0xfffffffffffff010}, {0x6}]}, 0x10) sendmmsg(r1, &(0x7f0000001e80)=[{{&(0x7f0000000700)=@l2, 0x80, &(0x7f0000001dc0)}}], 0x1, 0x0) 01:56:56 executing program 4: socketpair$inet6_dccp(0xa, 0x6, 0x0, &(0x7f0000000000)) r0 = socket$inet6(0xa, 0x2, 0x0) ioctl$sock_SIOCETHTOOL(r0, 0x8946, &(0x7f00000000c0)={'syz_tun\x00', &(0x7f0000000080)=@ethtool_sset_info}) 01:56:56 executing program 7: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000180)='/dev/sequencer\x00', 0x10002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000080)="0a5cc80700315f85715070") r1 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000001c0)={0x2, 0x0, &(0x7f0000000140)=ANY=[@ANYBLOB='\fc'], 0x0, 0x0, &(0x7f0000000080)}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, &(0x7f00000001c0)}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000040)={0x8, 0x6000, &(0x7f00000000c0)=[@release={0x400c630f}], 0x1, 0x0, &(0x7f0000000100)='V'}) fstat(r0, &(0x7f00000002c0)) 01:56:56 executing program 4: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r0, 0x6, 0x13, &(0x7f00000000c0)=0x100000001, 0x1d4) connect$inet6(r0, &(0x7f0000000080)={0xa, 0x0, 0x0, @dev={0xfe, 0x80, [], 0x21}}, 0x1c) r1 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r1, 0x8912, &(0x7f0000000000)="0a5cc80700315f85715070") setsockopt$inet6_tcp_TCP_ULP(r0, 0x6, 0x1f, &(0x7f0000006580)='tls\x00', 0x95d59845436eab44) setsockopt$inet6_tcp_TLS_TX(r0, 0x11a, 0x1, &(0x7f0000000100), 0x28) sendto(r0, &(0x7f0000000040)="f1", 0x1, 0x0, &(0x7f0000000380)=@rc, 0x80) 01:56:56 executing program 1: r0 = openat$autofs(0xffffffffffffff9c, &(0x7f0000000000)='/dev/autofs\x00', 0x2, 0x0) ioctl$KVM_HYPERV_EVENTFD(r0, 0x4018aebd, &(0x7f0000000040)={0x4, r0}) ftruncate(0xffffffffffffffff, 0xfffffffffffff05a) 01:56:56 executing program 0: socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000001f80)={0xffffffffffffffff, 0xffffffffffffffff}) setsockopt$SO_ATTACH_FILTER(r2, 0x1, 0x1a, &(0x7f0000ab9ff0)={0x2, &(0x7f000039a000)=[{0x20, 0x0, 0x0, 0xfffffffffffff010}, {0x6}]}, 0x10) sendmmsg(r1, &(0x7f0000001e80)=[{{&(0x7f0000000700)=@l2, 0x80, &(0x7f0000001dc0)}}], 0x1, 0x0) 01:56:56 executing program 3: r0 = socket$inet(0x2, 0x3, 0x2) connect$inet(0xffffffffffffffff, &(0x7f0000000000)={0x2, 0x0, @local}, 0x10) setsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x23, &(0x7f0000000000)={{{@in=@multicast2, @in=@multicast1}}, {{@in6}, 0x0, @in6=@loopback}}, 0xe8) syz_emit_ethernet(0x2a, &(0x7f0000000640)={@random="b100485caa2a", @link_local, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x40000000, 0x1c, 0x0, 0x0, 0x0, 0x2, 0x0, @rand_addr, @broadcast}, @igmp={0x11, 0xffffffffffffffff, 0x0, @multicast1}}}}}, &(0x7f0000000140)) 01:56:56 executing program 5: perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1f}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000340)={&(0x7f0000000000), 0xc, &(0x7f0000000300)={&(0x7f0000000240)=@newlink={0x50, 0x10, 0x721, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x3}, [@IFLA_LINKINFO={0x28, 0x12, @veth={{0xc, 0x1, 'veth\x00'}, {0x18, 0x2, @VETH_INFO_PEER={0x14}}}}, @IFLA_NET_NS_FD={0x8}]}, 0x50}}, 0x0) 01:56:56 executing program 2: r0 = socket$inet(0x2, 0x3, 0x2) connect$inet(0xffffffffffffffff, &(0x7f0000000000)={0x2, 0x0, @local}, 0x10) setsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x23, &(0x7f0000000000)={{{@in=@multicast2, @in=@multicast1}}, {{@in6}, 0x0, @in6=@loopback}}, 0xe8) syz_emit_ethernet(0x2a, &(0x7f0000000640)={@random="b100485caa2a", @link_local, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x1c, 0x0, 0x0, 0x0, 0x2, 0x0, @rand_addr, @broadcast}, @igmp={0x11, 0x0, 0x0, @multicast1}}}}}, &(0x7f0000000140)={0x0, 0x0, [0x0, 0x0, 0x0, 0x2000]}) [ 702.347335] binder: 15728:15730 Acquire 1 refcount change on invalid ref 0 ret -22 01:56:56 executing program 4: r0 = perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1f}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = socket$inet_udp(0x2, 0x2, 0x0) r2 = dup(r0) ioctl$GIO_UNIMAP(r2, 0x4b66, &(0x7f0000000740)={0x1, &(0x7f0000000700)=[{}]}) bind$inet(r1, &(0x7f00001edff0)={0x2, 0x4e20, @multicast1}, 0x10) setsockopt$inet_mreq(r1, 0x0, 0x20, &(0x7f0000000000)={@rand_addr, @local}, 0x8) ioctl$KVM_GET_SUPPORTED_CPUID(r2, 0xc008ae05, &(0x7f00000007c0)=""/71) r3 = syz_open_dev$vcsa(&(0x7f0000000040)='/dev/vcsa#\x00', 0x6, 0x1) setsockopt$RDS_GET_MR_FOR_DEST(r3, 0x114, 0x7, &(0x7f0000000200)={@nl=@kern={0x10, 0x0, 0x0, 0x1000000}, {&(0x7f0000000080)=""/74, 0xfffffffffffffd9b}, &(0x7f0000000140), 0x10}, 0xffffffb0) ioctl$sock_SIOCOUTQ(r3, 0x5411, &(0x7f0000000100)) sendto$inet(r1, &(0x7f0000e76000), 0x0, 0x0, &(0x7f0000bc8ff0)={0x2, 0x4e20, @multicast1}, 0x10) r4 = epoll_create1(0x0) socketpair(0x0, 0x6, 0x1, &(0x7f0000000340)={0xffffffffffffffff}) getsockopt$inet6_IPV6_XFRM_POLICY(r3, 0x29, 0x23, &(0x7f0000000400)={{{@in6, @in=@dev, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in=@multicast2}, 0x0, @in=@multicast2}}, &(0x7f0000000380)=0xe8) setsockopt$inet_pktinfo(r5, 0x0, 0x8, &(0x7f00000006c0)={r6, @multicast2, @multicast2}, 0xc) poll(&(0x7f0000000780)=[{r3, 0x8000}, {r2, 0x80}, {r2, 0x144}, {r4, 0x2}, {r2, 0x2}], 0x5, 0x76) epoll_ctl$EPOLL_CTL_ADD(r4, 0x1, r1, &(0x7f00000003c0)) recvmmsg(r3, &(0x7f0000002700)=[{{&(0x7f00000002c0)=@generic, 0x80, &(0x7f0000000840)=[{&(0x7f0000000500)=""/186, 0xba}, {&(0x7f00000005c0)=""/245, 0x12f}], 0x2, &(0x7f00000008c0)=""/129, 0x81}}], 0x1, 0x0, &(0x7f0000002880)={0x0, 0x989680}) 01:56:56 executing program 1: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) r1 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r1, 0x8912, &(0x7f0000000040)="0a4cc80700315f85715070") getsockopt$IP6T_SO_GET_REVISION_MATCH(r0, 0x29, 0x44, &(0x7f0000000000)={'ah\x00', 0x10}, &(0x7f0000000080)=0x1e) [ 702.482386] binder: 15728:15730 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 702.619103] binder: 15728:15757 Acquire 1 refcount change on invalid ref 0 ret -22 [ 702.634408] binder: 15728:15757 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 702.652097] binder: 15730 RLIMIT_NICE not set 01:56:57 executing program 0: socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000001f80)={0xffffffffffffffff, 0xffffffffffffffff}) setsockopt$SO_ATTACH_FILTER(r2, 0x1, 0x1a, &(0x7f0000ab9ff0)={0x2, &(0x7f000039a000)=[{0x20, 0x0, 0x0, 0xfffffffffffff010}, {0x6}]}, 0x10) sendmmsg(r1, &(0x7f0000001e80)=[{{&(0x7f0000000700)=@l2, 0x80, &(0x7f0000001dc0)}}], 0x1, 0x0) 01:56:57 executing program 5: perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1f}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000340)={&(0x7f0000000000), 0xc, &(0x7f0000000300)={&(0x7f0000000240)=@newlink={0x50, 0x10, 0x721, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x500000000000000}, [@IFLA_LINKINFO={0x28, 0x12, @veth={{0xc, 0x1, 'veth\x00'}, {0x18, 0x2, @VETH_INFO_PEER={0x14}}}}, @IFLA_NET_NS_FD={0x8}]}, 0x50}}, 0x0) 01:56:57 executing program 3: r0 = socket$inet(0x2, 0x3, 0x2) connect$inet(0xffffffffffffffff, &(0x7f0000000000)={0x2, 0x0, @local}, 0x10) setsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x23, &(0x7f0000000000)={{{@in=@multicast2, @in=@multicast1}}, {{@in6}, 0x0, @in6=@loopback}}, 0xe8) syz_emit_ethernet(0x2a, &(0x7f0000000640)={@random="b100485caa2a", @link_local, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x400300, 0x1c, 0x0, 0x0, 0x0, 0x2, 0x0, @rand_addr, @broadcast}, @igmp={0x11, 0xffffffffffffffff, 0x0, @multicast1}}}}}, &(0x7f0000000140)) 01:56:57 executing program 6: r0 = syz_open_dev$sndseq(&(0x7f0000000100)='/dev/snd/seq\x00', 0x0, 0x0) read(r0, &(0x7f0000fb6000)=""/28, 0x3f0) ioctl$SNDRV_SEQ_IOCTL_REMOVE_EVENTS(r0, 0x4040534e, &(0x7f00000001c0)={0xbf}) ioctl$SNDRV_SEQ_IOCTL_QUERY_SUBS(r0, 0xc058534f, &(0x7f00000002c0)={{}, 0x1, 0x0, 0x0, {}, 0x0, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xbf00]}) r1 = gettid() timer_create(0x0, &(0x7f0000044000)={0x0, 0x12}, &(0x7f0000000040)) r2 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r2, 0x8912, &(0x7f00000001c0)="0a5cc80700315f85715070") timer_settime(0x0, 0x0, &(0x7f0000000080)={{0x0, 0x989680}, {0x0, 0x9}}, &(0x7f0000040000)) tkill(r1, 0x1000000000014) 01:56:57 executing program 2: r0 = socket$inet(0x2, 0x3, 0x2) connect$inet(0xffffffffffffffff, &(0x7f0000000000)={0x2, 0x0, @local}, 0x10) setsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x23, &(0x7f0000000000)={{{@in=@multicast2, @in=@multicast1}}, {{@in6}, 0x0, @in6=@loopback}}, 0xe8) syz_emit_ethernet(0x2a, &(0x7f0000000640)={@random="b100485caa2a", @link_local, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x1c, 0x0, 0x0, 0x0, 0x2, 0x0, @rand_addr, @broadcast}, @igmp={0x11, 0x0, 0x0, @multicast1}}}}}, &(0x7f0000000140)={0x0, 0x0, [0x0, 0x0, 0x0, 0xe000]}) 01:56:57 executing program 7: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000180)='/dev/sequencer\x00', 0x10002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000080)="0a5cc80700315f85715070") r1 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000001c0)={0x2, 0x0, &(0x7f0000000140)=ANY=[@ANYBLOB='\fc'], 0x0, 0x0, &(0x7f0000000080)}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, &(0x7f00000001c0)}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000040)={0x8, 0x400000000000000, &(0x7f00000000c0)=[@release={0x400c630f}], 0x1, 0x0, &(0x7f0000000100)='V'}) fstat(r0, &(0x7f00000002c0)) 01:56:57 executing program 4: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000140)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_X86_SETUP_MCE(r2, 0x4008ae9c, &(0x7f0000000000)={0x19, 0x1}) openat$ipvs(0xffffffffffffff9c, &(0x7f0000000040)='/proc/sys/net/ipv4/vs/amemthresh\x00', 0x2, 0x0) ioctl$KVM_X86_SET_MCE(r2, 0x4040ae9e, &(0x7f00000000c0)={0xfffffffffffffffc}) 01:56:57 executing program 1: mmap(&(0x7f0000011000/0x4000)=nil, 0x4000, 0x1, 0x32, 0xffffffffffffffff, 0x0) r0 = userfaultfd(0x0) ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f00002c5fe8)) r1 = epoll_create1(0x0) ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000e4cfe0)={{&(0x7f0000012000/0x2000)=nil, 0x2000}, 0x1}) r2 = syz_open_dev$sndtimer(&(0x7f0000f85ff1)='/dev/snd/timer\x00', 0x0, 0x0) ioctl$SNDRV_TIMER_IOCTL_NEXT_DEVICE(r2, 0xc0145401, &(0x7f0000013000)) r3 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r3, 0x8912, &(0x7f0000000280)="0a5cc80700315f85714070") ioctl$SNDRV_TIMER_IOCTL_SELECT(r2, 0x40345410, &(0x7f0000000040)={{0x0, 0x1}}) dup2(r1, r2) dup3(r1, r0, 0x0) 01:56:57 executing program 5: perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1f}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000340)={&(0x7f0000000000), 0xc, &(0x7f0000000300)={&(0x7f0000000240)=@newlink={0x50, 0x10, 0x721, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x200000000000000}, [@IFLA_LINKINFO={0x28, 0x12, @veth={{0xc, 0x1, 'veth\x00'}, {0x18, 0x2, @VETH_INFO_PEER={0x14}}}}, @IFLA_NET_NS_FD={0x8}]}, 0x50}}, 0x0) 01:56:57 executing program 2: r0 = socket$inet(0x2, 0x3, 0x2) connect$inet(0xffffffffffffffff, &(0x7f0000000000)={0x2, 0x0, @local}, 0x10) setsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x23, &(0x7f0000000000)={{{@in=@multicast2, @in=@multicast1}}, {{@in6}, 0x0, @in6=@loopback}}, 0xe8) syz_emit_ethernet(0x2a, &(0x7f0000000640)={@random="b100485caa2a", @link_local, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x1c, 0x0, 0x0, 0x0, 0x2, 0x0, @rand_addr, @broadcast}, @igmp={0x11, 0x0, 0x0, @multicast1}}}}}, &(0x7f0000000140)={0x0, 0x0, [0x0, 0x0, 0x0, 0x3e]}) 01:56:57 executing program 3: r0 = socket$inet(0x2, 0x3, 0x2) connect$inet(0xffffffffffffffff, &(0x7f0000000000)={0x2, 0x0, @local}, 0x10) setsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x23, &(0x7f0000000000)={{{@in=@multicast2, @in=@multicast1}}, {{@in6}, 0x0, @in6=@loopback}}, 0xe8) syz_emit_ethernet(0x2a, &(0x7f0000000640)={@random="b100485caa2a", @link_local, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x700, 0x1c, 0x0, 0x0, 0x0, 0x2, 0x0, @rand_addr, @broadcast}, @igmp={0x11, 0xffffffffffffffff, 0x0, @multicast1}}}}}, &(0x7f0000000140)) 01:56:57 executing program 0: socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000001f80)={0xffffffffffffffff, 0xffffffffffffffff}) setsockopt$SO_ATTACH_FILTER(r2, 0x1, 0x1a, &(0x7f0000ab9ff0)={0x2, &(0x7f000039a000)=[{0x20, 0x0, 0x0, 0xfffffffffffff010}, {0x6}]}, 0x10) sendmmsg(r1, &(0x7f0000001e80)=[{{&(0x7f0000000700)=@l2, 0x80, &(0x7f0000001dc0)}}], 0x1, 0x0) [ 703.297184] binder: 15798:15802 Acquire 1 refcount change on invalid ref 0 ret -22 01:56:57 executing program 4: r0 = socket$inet(0x2, 0x2, 0x1) getsockopt$inet_sctp_SCTP_MAXSEG(0xffffffffffffff9c, 0x84, 0xd, &(0x7f0000000000)=@assoc_value={0x0, 0x5}, &(0x7f0000000040)=0x8) getsockopt$inet_sctp_SCTP_SOCKOPT_PEELOFF(r0, 0x84, 0x66, &(0x7f0000000080)={r1, 0x6}, &(0x7f00000000c0)=0x8) r2 = socket$rds(0x15, 0x5, 0x0) r3 = syz_open_dev$midi(&(0x7f0000000100)='/dev/midi#\x00', 0x2, 0x300) ioctl$SG_SCSI_RESET(r3, 0x2284, 0x0) bind(r2, &(0x7f00000001c0)=@rc, 0x10) 01:56:57 executing program 1: r0 = socket$alg(0x26, 0x5, 0x0) close(r0) r1 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000000)={0x26, 'skcipher\x00', 0x0, 0x0, 'cbc-camellia-asm\x00'}, 0x58) setsockopt$ALG_SET_KEY(r1, 0x117, 0x1, &(0x7f0000001f3a)="ad56b6c5820faeb995298992ea54c7beef9f5d56534c90c2", 0x18) r2 = accept$alg(r0, 0x0, 0x0) io_setup(0x1, &(0x7f0000e4b000)=0x0) sendmsg$alg(r2, &(0x7f00000013c0)={0x0, 0x0, &(0x7f0000001300), 0x0, &(0x7f00000004c0)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}, 0x0) io_submit(r3, 0x1, &(0x7f0000bd9fe0)=[&(0x7f0000617fc0)={0x0, 0x0, 0x0, 0x0, 0x0, r2, &(0x7f0000000500)='\x00', 0x1}]) r4 = syz_open_dev$sndtimer(&(0x7f0000000080)='/dev/snd/timer\x00', 0x0, 0x400) ioctl$SNDRV_TIMER_IOCTL_INFO(r4, 0x80e85411, &(0x7f00000000c0)=""/238) 01:56:57 executing program 2: r0 = socket$inet(0x2, 0x3, 0x2) connect$inet(0xffffffffffffffff, &(0x7f0000000000)={0x2, 0x0, @local}, 0x10) setsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x23, &(0x7f0000000000)={{{@in=@multicast2, @in=@multicast1}}, {{@in6}, 0x0, @in6=@loopback}}, 0xe8) syz_emit_ethernet(0x2a, &(0x7f0000000640)={@random="b100485caa2a", @link_local, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x1c, 0x0, 0x0, 0x0, 0x2, 0x0, @rand_addr, @broadcast}, @igmp={0x11, 0x0, 0x0, @multicast1}}}}}, &(0x7f0000000140)={0x0, 0x0, [0x0, 0x0, 0x0, 0xffffffffffffffff]}) 01:56:57 executing program 5: perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1f}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000340)={&(0x7f0000000000), 0xc, &(0x7f0000000300)={&(0x7f0000000240)=@newlink={0x50, 0x10, 0x721, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0xab4}, [@IFLA_LINKINFO={0x28, 0x12, @veth={{0xc, 0x1, 'veth\x00'}, {0x18, 0x2, @VETH_INFO_PEER={0x14}}}}, @IFLA_NET_NS_FD={0x8}]}, 0x50}}, 0x0) [ 703.460221] binder: 15798:15802 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 01:56:57 executing program 3: r0 = socket$inet(0x2, 0x3, 0x2) connect$inet(0xffffffffffffffff, &(0x7f0000000000)={0x2, 0x0, @local}, 0x10) setsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x23, &(0x7f0000000000)={{{@in=@multicast2, @in=@multicast1}}, {{@in6}, 0x0, @in6=@loopback}}, 0xe8) syz_emit_ethernet(0x2a, &(0x7f0000000640)={@random="b100485caa2a", @link_local, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0xe0, 0x1c, 0x0, 0x0, 0x0, 0x2, 0x0, @rand_addr, @broadcast}, @igmp={0x11, 0xffffffffffffffff, 0x0, @multicast1}}}}}, &(0x7f0000000140)) 01:56:57 executing program 4: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000)='/dev/kvm\x00', 0x0, 0x0) r1 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r1, 0x8912, &(0x7f0000000080)="0a5cc80700315f85715070") r2 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) openat$cgroup_ro(r0, &(0x7f0000000040)='cgroup.events\x00', 0x0, 0x0) r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) ioctl$KVM_ENABLE_CAP_CPU(r3, 0xc008ae88, &(0x7f00000004c0)={0x7b, 0x0, [0x40000106]}) 01:56:57 executing program 1: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000180)="0a5cc80700315f85715070") r1 = perf_event_open(&(0x7f0000000140)={0x1, 0x70, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff7fffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r2 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, r1, 0x0) ioctl$PERF_EVENT_IOC_DISABLE(r1, 0x2401, 0x7fff) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x2400, 0x1) r3 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ppp\x00', 0x101040, 0x0) ioctl$TUNSETNOCSUM(r3, 0x400454c8, 0x1) [ 703.601241] binder: 15798:15828 Acquire 1 refcount change on invalid ref 0 ret -22 [ 703.676264] binder: 15798:15828 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 703.724862] binder: 15802 RLIMIT_NICE not set 01:56:57 executing program 2: r0 = socket$inet(0x2, 0x3, 0x2) connect$inet(0xffffffffffffffff, &(0x7f0000000000)={0x2, 0x0, @local}, 0x10) setsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x23, &(0x7f0000000000)={{{@in=@multicast2, @in=@multicast1}}, {{@in6}, 0x0, @in6=@loopback}}, 0xe8) syz_emit_ethernet(0x2a, &(0x7f0000000640)={@random="b100485caa2a", @link_local, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x1c, 0x0, 0x0, 0x0, 0x2, 0x0, @rand_addr, @broadcast}, @igmp={0x11, 0x0, 0x0, @multicast1}}}}}, &(0x7f0000000140)={0x0, 0x0, [0x0, 0x0, 0x0, 0xe000000000000000]}) 01:56:57 executing program 0: socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000001f80)={0xffffffffffffffff, 0xffffffffffffffff}) setsockopt$SO_ATTACH_FILTER(r2, 0x1, 0x1a, &(0x7f0000ab9ff0)={0x2, &(0x7f000039a000)=[{0x20, 0x0, 0x0, 0xfffffffffffff010}, {0x6}]}, 0x10) sendmmsg(r1, &(0x7f0000001e80)=[{{&(0x7f0000000700)=@l2, 0x80, &(0x7f0000001dc0)}}], 0x1, 0x0) 01:56:57 executing program 6: r0 = syz_open_dev$sndseq(&(0x7f0000000100)='/dev/snd/seq\x00', 0x0, 0x0) read(r0, &(0x7f0000fb6000)=""/28, 0x3f0) ioctl$SNDRV_SEQ_IOCTL_REMOVE_EVENTS(r0, 0x4040534e, &(0x7f00000001c0)={0xbf}) ioctl$SNDRV_SEQ_IOCTL_QUERY_SUBS(r0, 0xc058534f, &(0x7f00000002c0)={{}, 0x1, 0x0, 0x0, {}, 0x0, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xbf]}) r1 = gettid() timer_create(0x0, &(0x7f0000044000)={0x0, 0x12}, &(0x7f0000000040)) r2 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r2, 0x8912, &(0x7f00000001c0)="0a5cc80700315f85715070") timer_settime(0x0, 0x0, &(0x7f0000000080)={{0x0, 0x989680}, {0x0, 0x9}}, &(0x7f0000040000)) tkill(r1, 0x1000000000014) 01:56:57 executing program 5: perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1f}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000340)={&(0x7f0000000000), 0xc, &(0x7f0000000300)={&(0x7f0000000240)=@newlink={0x50, 0x10, 0x721, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0xb000000}, [@IFLA_LINKINFO={0x28, 0x12, @veth={{0xc, 0x1, 'veth\x00'}, {0x18, 0x2, @VETH_INFO_PEER={0x14}}}}, @IFLA_NET_NS_FD={0x8}]}, 0x50}}, 0x0) 01:56:57 executing program 3: r0 = socket$inet(0x2, 0x3, 0x2) connect$inet(0xffffffffffffffff, &(0x7f0000000000)={0x2, 0x0, @local}, 0x10) setsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x23, &(0x7f0000000000)={{{@in=@multicast2, @in=@multicast1}}, {{@in6}, 0x0, @in6=@loopback}}, 0xe8) syz_emit_ethernet(0x2a, &(0x7f0000000640)={@random="b100485caa2a", @link_local, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0xffffffff00000000, 0x1c, 0x0, 0x0, 0x0, 0x2, 0x0, @rand_addr, @broadcast}, @igmp={0x11, 0xffffffffffffffff, 0x0, @multicast1}}}}}, &(0x7f0000000140)) 01:56:57 executing program 7: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000180)='/dev/sequencer\x00', 0x10002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000080)="0a5cc80700315f85715070") r1 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000001c0)={0x2, 0x0, &(0x7f0000000140)=ANY=[@ANYBLOB='\fc'], 0x0, 0x0, &(0x7f0000000080)}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, &(0x7f00000001c0)}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000040)={0x8, 0x20000000, &(0x7f00000000c0)=[@release={0x400c630f}], 0x1, 0x0, &(0x7f0000000100)='V'}) fstat(r0, &(0x7f00000002c0)) 01:56:57 executing program 4: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0xb843, &(0x7f0000000280)="0a5cc80700315f85714070") r1 = socket(0x10, 0x802, 0x0) ioctl$sock_inet_SIOCSARP(r1, 0x8955, &(0x7f0000000000)={{0x2, 0x4e21, @local}, {0x306, @remote}, 0x20, {0x2, 0x4e24, @multicast2}, 'bond0\x00'}) write(r1, &(0x7f0000001500)="240000001a0025f0006bb404feff141c020b5aff6e10b500001180cc0800100023020000", 0x24) socket(0x2, 0x0, 0x1ff) 01:56:57 executing program 1: r0 = syz_open_dev$sndctrl(&(0x7f000000a000)='/dev/snd/controlC#\x00', 0x0, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_READ(r0, 0xc4c85512, &(0x7f0000000080)={{0x2}, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7]}) r1 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000640)='/dev/vga_arbiter\x00', 0x240, 0x0) setsockopt$inet_sctp_SCTP_RECVNXTINFO(r0, 0x84, 0x21, &(0x7f0000000580)=0x3, 0xfffffffffffffe0e) setsockopt$inet6_tcp_int(r1, 0x6, 0xa, &(0x7f0000000040)=0x3, 0x4) 01:56:58 executing program 1: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000000)="0a5cc80700315f85715070") mmap(&(0x7f0000011000/0x3000)=nil, 0x3000, 0x4, 0x32, 0xffffffffffffffff, 0x0) r1 = userfaultfd(0x0) ioctl$UFFDIO_API(r1, 0xc018aa3f, &(0x7f0000003fe8)) ioctl$UFFDIO_REGISTER(r1, 0xc020aa00, &(0x7f0000001fe2)={{&(0x7f0000011000/0x3000)=nil, 0x3000}, 0x1}) r2 = socket$inet6_sctp(0xa, 0x1, 0x84) setsockopt$inet_sctp6_SCTP_DISABLE_FRAGMENTS(r2, 0x84, 0x8, &(0x7f0000013e95), 0x4) r3 = openat$sequencer(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/sequencer\x00', 0x200000, 0x0) ioctl$SNDRV_SEQ_IOCTL_GET_PORT_INFO(r3, 0xc0a85322, &(0x7f0000000140)) ioctl$UFFDIO_REGISTER(r1, 0xc020aa00, &(0x7f0000000080)={{&(0x7f0000ffb000/0x3000)=nil, 0x3000}, 0x2}) setsockopt$inet6_MRT6_ADD_MIF(r0, 0x29, 0xca, &(0x7f0000000200)={0x3f, 0x1, 0x400, 0x91, 0x7fffffff}, 0xc) ioctl$sock_SIOCETHTOOL(r2, 0x8946, &(0x7f0000000040)={'veth1_to_bond:\x00', &(0x7f0000000100)=@ethtool_sfeatures={0x26}}) close(r2) close(r1) 01:56:58 executing program 5: perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1f}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000340)={&(0x7f0000000000), 0xc, &(0x7f0000000300)={&(0x7f0000000240)=@newlink={0x50, 0x10, 0x721, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x5000000}, [@IFLA_LINKINFO={0x28, 0x12, @veth={{0xc, 0x1, 'veth\x00'}, {0x18, 0x2, @VETH_INFO_PEER={0x14}}}}, @IFLA_NET_NS_FD={0x8}]}, 0x50}}, 0x0) 01:56:58 executing program 4: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) r1 = syz_open_dev$vcsn(&(0x7f0000000100)='/dev/vcs#\x00', 0x8, 0x2800) ioctl$UI_ABS_SETUP(r1, 0x401c5504, &(0x7f0000000140)={0xfff, {0xea9, 0x9, 0x1, 0x5, 0x6d, 0x7}}) setsockopt$SO_TIMESTAMPING(r0, 0x1, 0x25, &(0x7f00000000c0)=0x4, 0x4) connect$inet6(r0, &(0x7f0000000080), 0x1c) ioctl(r0, 0x8912, &(0x7f0000000000)="0a5cc80700315f85715070") setsockopt$SO_TIMESTAMPING(r0, 0x1, 0x6, &(0x7f0000000040), 0x4) dup3(r0, r0, 0x80000) 01:56:58 executing program 2: r0 = socket$inet(0x2, 0x3, 0x2) connect$inet(0xffffffffffffffff, &(0x7f0000000000)={0x2, 0x0, @local}, 0x10) setsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x23, &(0x7f0000000000)={{{@in=@multicast2, @in=@multicast1}}, {{@in6}, 0x0, @in6=@loopback}}, 0xe8) syz_emit_ethernet(0x2a, &(0x7f0000000640)={@random="b100485caa2a", @link_local, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x1c, 0x0, 0x0, 0x0, 0x2, 0x0, @rand_addr, @broadcast}, @igmp={0x11, 0x0, 0x0, @multicast1}}}}}, &(0x7f0000000140)={0x0, 0x0, [0x0, 0x0, 0x0, 0xe0000000]}) 01:56:58 executing program 3: r0 = socket$inet(0x2, 0x3, 0x2) connect$inet(0xffffffffffffffff, &(0x7f0000000000)={0x2, 0x0, @local}, 0x10) setsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x23, &(0x7f0000000000)={{{@in=@multicast2, @in=@multicast1}}, {{@in6}, 0x0, @in6=@loopback}}, 0xe8) syz_emit_ethernet(0x2a, &(0x7f0000000640)={@random="b100485caa2a", @link_local, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x700000000000000, 0x1c, 0x0, 0x0, 0x0, 0x2, 0x0, @rand_addr, @broadcast}, @igmp={0x11, 0xffffffffffffffff, 0x0, @multicast1}}}}}, &(0x7f0000000140)) [ 704.145951] binder: 15880:15881 Acquire 1 refcount change on invalid ref 0 ret -22 [ 704.174958] binder: 15880:15881 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 01:56:58 executing program 0: socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000001f80)={0xffffffffffffffff, 0xffffffffffffffff}) setsockopt$SO_ATTACH_FILTER(r2, 0x1, 0x1a, &(0x7f0000ab9ff0)={0x2, &(0x7f000039a000)=[{0x20, 0x0, 0x0, 0xfffffffffffff010}, {0x6}]}, 0x10) sendmmsg(r1, &(0x7f0000001e80)=[{{&(0x7f0000000700)=@l2, 0x80, &(0x7f0000001dc0)}}], 0x1, 0x0) 01:56:58 executing program 5: perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1f}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000340)={&(0x7f0000000000), 0xc, &(0x7f0000000300)={&(0x7f0000000240)=@newlink={0x50, 0x10, 0x721, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0xf0ffff}, [@IFLA_LINKINFO={0x28, 0x12, @veth={{0xc, 0x1, 'veth\x00'}, {0x18, 0x2, @VETH_INFO_PEER={0x14}}}}, @IFLA_NET_NS_FD={0x8}]}, 0x50}}, 0x0) 01:56:58 executing program 4: r0 = socket(0x9, 0x80802, 0x9) r1 = dup(r0) perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10000003, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) write(r1, &(0x7f0000000000)="2400000058001f02ff07f4f9002304000a04f511080001000201009f0800028001000000", 0x24) 01:56:58 executing program 3: r0 = socket$inet(0x2, 0x3, 0x2) connect$inet(0xffffffffffffffff, &(0x7f0000000000)={0x2, 0x0, @local}, 0x10) setsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x23, &(0x7f0000000000)={{{@in=@multicast2, @in=@multicast1}}, {{@in6}, 0x0, @in6=@loopback}}, 0xe8) syz_emit_ethernet(0x2a, &(0x7f0000000640)={@random="b100485caa2a", @link_local, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x100000000000000, 0x1c, 0x0, 0x0, 0x0, 0x2, 0x0, @rand_addr, @broadcast}, @igmp={0x11, 0xffffffffffffffff, 0x0, @multicast1}}}}}, &(0x7f0000000140)) [ 704.306174] binder: 15881 RLIMIT_NICE not set 01:56:58 executing program 2: r0 = socket$inet(0x2, 0x3, 0x2) connect$inet(0xffffffffffffffff, &(0x7f0000000000)={0x2, 0x0, @local}, 0x10) setsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x23, &(0x7f0000000000)={{{@in=@multicast2, @in=@multicast1}}, {{@in6}, 0x0, @in6=@loopback}}, 0xe8) syz_emit_ethernet(0x2a, &(0x7f0000000640)={@random="b100485caa2a", @link_local, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x1c, 0x0, 0x0, 0x0, 0x2, 0x0, @rand_addr, @broadcast}, @igmp={0x11, 0x0, 0x0, @multicast1}}}}}, &(0x7f0000000140)={0x0, 0x0, [0x0, 0x0, 0x0, 0x1c000000]}) [ 704.907715] binder: 15880:15937 Acquire 1 refcount change on invalid ref 0 ret -22 [ 704.915573] binder: 15880:15937 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 704.923054] binder: 15923 RLIMIT_NICE not set 01:56:58 executing program 6: r0 = syz_open_dev$sndseq(&(0x7f0000000100)='/dev/snd/seq\x00', 0x0, 0x0) read(r0, &(0x7f0000fb6000)=""/28, 0x3f0) ioctl$SNDRV_SEQ_IOCTL_REMOVE_EVENTS(r0, 0x4040534e, &(0x7f00000001c0)={0xbf}) ioctl$SNDRV_SEQ_IOCTL_QUERY_SUBS(r0, 0xc058534f, &(0x7f00000002c0)={{}, 0x1, 0x0, 0x0, {}, 0x0, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xe00000000000000]}) r1 = gettid() timer_create(0x0, &(0x7f0000044000)={0x0, 0x12}, &(0x7f0000000040)) r2 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r2, 0x8912, &(0x7f00000001c0)="0a5cc80700315f85715070") timer_settime(0x0, 0x0, &(0x7f0000000080)={{0x0, 0x989680}, {0x0, 0x9}}, &(0x7f0000040000)) tkill(r1, 0x1000000000014) 01:56:58 executing program 1: mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x9) r0 = creat(&(0x7f0000000000)='./file0\x00', 0x120) getsockname$packet(r0, &(0x7f0000000040)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @random}, &(0x7f0000000080)=0x14) ioctl$UI_SET_MSCBIT(r0, 0x40045568, 0x35) futex(&(0x7f0000004000), 0x400000084, 0x0, &(0x7f0000000140)={0x0, 0x1c9c380}, &(0x7f0000004000)=0x2, 0x0) 01:56:58 executing program 5: perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1f}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000340)={&(0x7f0000000000), 0xc, &(0x7f0000000300)={&(0x7f0000000240)=@newlink={0x50, 0x10, 0x721, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0xfffffffffffff000}, [@IFLA_LINKINFO={0x28, 0x12, @veth={{0xc, 0x1, 'veth\x00'}, {0x18, 0x2, @VETH_INFO_PEER={0x14}}}}, @IFLA_NET_NS_FD={0x8}]}, 0x50}}, 0x0) 01:56:58 executing program 3: r0 = socket$inet(0x2, 0x3, 0x2) connect$inet(0xffffffffffffffff, &(0x7f0000000000)={0x2, 0x0, @local}, 0x10) setsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x23, &(0x7f0000000000)={{{@in=@multicast2, @in=@multicast1}}, {{@in6}, 0x0, @in6=@loopback}}, 0xe8) syz_emit_ethernet(0x2a, &(0x7f0000000640)={@random="b100485caa2a", @link_local, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x1000000, 0x1c, 0x0, 0x0, 0x0, 0x2, 0x0, @rand_addr, @broadcast}, @igmp={0x11, 0xffffffffffffffff, 0x0, @multicast1}}}}}, &(0x7f0000000140)) 01:56:58 executing program 4: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080)='/dev/kvm\x00', 0x2c0000, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff}) ioctl$sock_inet_SIOCGIFDSTADDR(r2, 0x8917, &(0x7f0000000040)={'bcsf0\x00', {0x2, 0x4e23, @loopback}}) ioctl$KVM_CREATE_IRQCHIP(r1, 0xae60) r3 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_ENABLE_CAP_CPU(r3, 0xc008ae88, &(0x7f00000001c0)={0x2, 0x0, [0x40000070]}) 01:56:58 executing program 0: socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000001f80)={0xffffffffffffffff, 0xffffffffffffffff}) setsockopt$SO_ATTACH_FILTER(r2, 0x1, 0x1a, &(0x7f0000ab9ff0)={0x2, &(0x7f000039a000)=[{0x20, 0x0, 0x0, 0xfffffffffffff010}, {0x6}]}, 0x10) sendmmsg(r1, &(0x7f0000001e80)=[{{&(0x7f0000000700)=@l2, 0x80, &(0x7f0000001dc0)}}], 0x1, 0x0) 01:56:58 executing program 2: r0 = socket$inet(0x2, 0x3, 0x2) connect$inet(0xffffffffffffffff, &(0x7f0000000000)={0x2, 0x0, @local}, 0x10) setsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x23, &(0x7f0000000000)={{{@in=@multicast2, @in=@multicast1}}, {{@in6}, 0x0, @in6=@loopback}}, 0xe8) syz_emit_ethernet(0x2a, &(0x7f0000000640)={@random="b100485caa2a", @link_local, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x1c, 0x0, 0x0, 0x0, 0x2, 0x0, @rand_addr, @broadcast}, @igmp={0x11, 0x0, 0x0, @multicast1}}}}}, &(0x7f0000000140)={0x0, 0x0, [0x0, 0x0, 0x0, 0x6000]}) 01:56:58 executing program 7: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000180)='/dev/sequencer\x00', 0x10002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000080)="0a5cc80700315f85715070") r1 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000001c0)={0x2, 0x0, &(0x7f0000000140)=ANY=[@ANYBLOB='\fc'], 0x0, 0x0, &(0x7f0000000080)}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, &(0x7f00000001c0)}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000040)={0x8, 0x7000000, &(0x7f00000000c0)=[@release={0x400c630f}], 0x1, 0x0, &(0x7f0000000100)='V'}) fstat(r0, &(0x7f00000002c0)) 01:56:58 executing program 3: r0 = socket$inet(0x2, 0x3, 0x2) connect$inet(0xffffffffffffffff, &(0x7f0000000000)={0x2, 0x0, @local}, 0x10) setsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x23, &(0x7f0000000000)={{{@in=@multicast2, @in=@multicast1}}, {{@in6}, 0x0, @in6=@loopback}}, 0xe8) syz_emit_ethernet(0x2a, &(0x7f0000000640)={@random="b100485caa2a", @link_local, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x8000000, 0x1c, 0x0, 0x0, 0x0, 0x2, 0x0, @rand_addr, @broadcast}, @igmp={0x11, 0xffffffffffffffff, 0x0, @multicast1}}}}}, &(0x7f0000000140)) 01:56:59 executing program 2: r0 = socket$inet(0x2, 0x3, 0x2) connect$inet(0xffffffffffffffff, &(0x7f0000000000)={0x2, 0x0, @local}, 0x10) setsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x23, &(0x7f0000000000)={{{@in=@multicast2, @in=@multicast1}}, {{@in6}, 0x0, @in6=@loopback}}, 0xe8) syz_emit_ethernet(0x2a, &(0x7f0000000640)={@random="b100485caa2a", @link_local, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x1c, 0x0, 0x0, 0x0, 0x2, 0x0, @rand_addr, @broadcast}, @igmp={0x11, 0x0, 0x0, @multicast1}}}}}, &(0x7f0000000140)={0x0, 0x0, [0x0, 0x0, 0x0, 0x300]}) 01:56:59 executing program 1: r0 = socket$inet(0x2, 0x1, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f0000000100)=@filter={'filter\x00', 0xe, 0x2, 0x318, [0x0, 0x20000e40, 0x20000f58, 0x20000f88], 0x0, &(0x7f00000000c0), &(0x7f0000000180)=ANY=[@ANYBLOB="00000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff010000000d0000001800000000006272696467655f736c6176655f30000069705f767469300000000000000000006272696467655f736c6176655f30000062637366300000000000000000000000ffffffffffff00ff00000000ffffffffffff0000ffd6ff0000007000000070000000e80000006e666c6f6700000000000000000000000000000000000000000000000000000050000000000000000800000000100800000000008bcfd7e72d44b67d318e2c77a1f72f56ad796187379ba9c9011e604765c56ae55f2c895c6876098041d36a2e55565efd9815f3b9df7bfb6ca2b50968740c23fc0000000000000000000000000000000000000000000000000000000000000000000000000000000001000000feffffff0000000000000000000000000000000000000000000000000000000000000000000000000000000001000000feffffff0100000003000000000000000000766c616e3000000000000000000000007465616d5f736c6176655f3100000000726f73653000000000000000000000006970365f767469300000000000000000aaaaaaaaaabb000000000000aaaaaaaaaabb00000000000000007000000070000000a00100005345434d41524b000000000000000000000000000000000000000000000000000801000000000000010000000000000073797374656d5f753a6f626a6563745f723a736861646f775f743a73300000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000a16c107e70bfec739cf892591b7d665d50ab9caf57025a5f3dea6903d827abb0927686335643047b5efadc07aad2f2c245bc072e982361c6d452efdc6434a765f14849597f6f588637bf517fe86b7692e6c00b4d763811f06b93946e4fc51f70ab0e1ed02e33c94547835f3f1ba6bb0c242ebe23899315d9ad3f925e4c30425f9aee6e9692868a02e91bc429d8de8bcd9f6da0f185aa77bc1f0b2e9027e83cbf240ba9ccfad862457f03d395aa038856e19bae2d5b14773540e9be55e1db9d8ea02151dc6072efc360401bb753cf61f49c00ebb4163e4230bd69be751936bbda8202f0605c6df63ceb0818ea9020e2816e5f8c73fc73b22033ab560205ebdf40d20ac75800fa7805f6ef3f2b5faf97326f68e01722709bae3f6bf57c980160b26ebc23f8b2b0f6d0d08d9e9d27bfe84fa7eab18080203b25bb14b6c59b1634c45c6ae6ed66f10f91d607ea0e2a7b27a69d41b9944cc6eeee12dbcaa608fa2b8923d5c8ad3d00e581bc033c4a14f55eb711f940685f98800d95d3a62260456cadf04e09c9ac1d4e5b09518e72c6a59d2c4362ff2c9bbb39846e206da8ce516840764b912545f2547337a85bb6c99a6ea33d4e9fb6f9"]}, 0x545) r1 = request_key(&(0x7f0000000000)='rxrpc_s\x00', &(0x7f0000000040)={0x73, 0x79, 0x7a, 0x3}, &(0x7f0000000080)='filter\x00', 0xfffffffffffffff9) r2 = add_key$keyring(&(0x7f00000007c0)='keyring\x00', &(0x7f0000000800)={0x73, 0x79, 0x7a, 0x0}, 0x0, 0x0, 0xfffffffffffffff9) keyctl$instantiate_iov(0x14, r1, &(0x7f0000000780)=[{&(0x7f0000000680)="43db6483239d890b7c0b632d23ac210187ec2fd9b6eea8c9f5a6e61b4d21908fed6c82ff6a92f734a67ae9718533a035afffe8fa2088d7fd3c27cfcbd8cb6deb14b1a9bdf9efeecde24acd33958e2432089afa6f4097c1951e5d1e0000d3efbe7cb7a0a6e7b6606090070b538d66469fb332bd8482c2e35f15", 0x79}, {&(0x7f0000000700)="958635dec49965eb403e1706343917a9e9b90697b0968ca6165d2e2d304559470a904227f7b497dbe1", 0x29}, {&(0x7f0000000740)="28ea2769e859e4aeecdd8b7b920d54fdbcc75a7588b868c668681c4c9a4514b0d09dff0d2bc03df9f4630eeef7acb3bb", 0x30}], 0x3, r2) 01:56:59 executing program 4: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = openat$cuse(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/cuse\x00', 0x10000, 0x0) setsockopt$inet_MCAST_LEAVE_GROUP(r1, 0x0, 0x2d, &(0x7f0000000200)={0x6, {{0x2, 0x4e24, @loopback}}}, 0x88) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r2 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r2, &(0x7f0000000080)={0x1000000efffffff, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=ANY=[@ANYBLOB="020d000000000300067c1d1f00000200006ae0000001000edf000100000008001200020002000000000000000000300000999b78d8d7c434c20f0000000002000000000000009cab000000000001020014bb0020000000000000000000000300050000000000020000f3df000021000000000200000013831a42226d00000000000000000000"], 0x80}}, 0x0) syz_open_dev$sndpcmp(&(0x7f0000000180)='/dev/snd/pcmC#D#p\x00', 0xb31, 0x80000) 01:56:59 executing program 5: perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1f}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000340)={&(0x7f0000000000), 0xc, &(0x7f0000000300)={&(0x7f0000000240)=@newlink={0x50, 0x10, 0x721, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x34000}, [@IFLA_LINKINFO={0x28, 0x12, @veth={{0xc, 0x1, 'veth\x00'}, {0x18, 0x2, @VETH_INFO_PEER={0x14}}}}, @IFLA_NET_NS_FD={0x8}]}, 0x50}}, 0x0) [ 705.087136] binder: 15958:15959 Acquire 1 refcount change on invalid ref 0 ret -22 01:56:59 executing program 0: socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000001f80)={0xffffffffffffffff, 0xffffffffffffffff}) setsockopt$SO_ATTACH_FILTER(r2, 0x1, 0x1a, &(0x7f0000ab9ff0)={0x2, &(0x7f000039a000)=[{0x20, 0x0, 0x0, 0xfffffffffffff010}, {0x6}]}, 0x10) sendmmsg(r1, &(0x7f0000001e80)=[{{&(0x7f0000000700)=@l2, 0x80, &(0x7f0000001dc0)}}], 0x1, 0x0) 01:56:59 executing program 3: r0 = socket$inet(0x2, 0x3, 0x2) connect$inet(0xffffffffffffffff, &(0x7f0000000000)={0x2, 0x0, @local}, 0x10) setsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x23, &(0x7f0000000000)={{{@in=@multicast2, @in=@multicast1}}, {{@in6}, 0x0, @in6=@loopback}}, 0xe8) syz_emit_ethernet(0x2a, &(0x7f0000000640)={@random="b100485caa2a", @link_local, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x1c00, 0x1c, 0x0, 0x0, 0x0, 0x2, 0x0, @rand_addr, @broadcast}, @igmp={0x11, 0xffffffffffffffff, 0x0, @multicast1}}}}}, &(0x7f0000000140)) [ 705.196634] kernel msg: ebtables bug: please report to author: Wrong len argument [ 705.236081] kernel msg: ebtables bug: please report to author: Wrong len argument 01:56:59 executing program 5: perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1f}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000340)={&(0x7f0000000000), 0xc, &(0x7f0000000300)={&(0x7f0000000240)=@newlink={0x50, 0x10, 0x721, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x7000000}, [@IFLA_LINKINFO={0x28, 0x12, @veth={{0xc, 0x1, 'veth\x00'}, {0x18, 0x2, @VETH_INFO_PEER={0x14}}}}, @IFLA_NET_NS_FD={0x8}]}, 0x50}}, 0x0) [ 705.252625] binder: 15958:15959 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 705.361859] binder: 15958:16001 Acquire 1 refcount change on invalid ref 0 ret -22 [ 705.389080] binder: 15958:16001 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 01:56:59 executing program 6: r0 = syz_open_dev$sndseq(&(0x7f0000000100)='/dev/snd/seq\x00', 0x0, 0x0) read(r0, &(0x7f0000fb6000)=""/28, 0x3f0) ioctl$SNDRV_SEQ_IOCTL_REMOVE_EVENTS(r0, 0x4040534e, &(0x7f00000001c0)={0xbf}) ioctl$SNDRV_SEQ_IOCTL_QUERY_SUBS(r0, 0xc058534f, &(0x7f00000002c0)={{}, 0x1, 0x0, 0x0, {}, 0x0, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xbf00000000000000]}) r1 = gettid() timer_create(0x0, &(0x7f0000044000)={0x0, 0x12}, &(0x7f0000000040)) r2 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r2, 0x8912, &(0x7f00000001c0)="0a5cc80700315f85715070") timer_settime(0x0, 0x0, &(0x7f0000000080)={{0x0, 0x989680}, {0x0, 0x9}}, &(0x7f0000040000)) tkill(r1, 0x1000000000014) 01:56:59 executing program 4: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000080)="0a5cc80700315f85715070") r1 = socket$inet6(0xa, 0x1, 0x0) socketpair$inet_udp(0x2, 0x2, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) sendto$inet6(0xffffffffffffffff, &(0x7f0000000040), 0x0, 0x0, &(0x7f0000f62fe4)={0xa, 0x0, 0x0, @loopback}, 0x1c) ioctl(0xffffffffffffffff, 0x0, &(0x7f0000000080)) r3 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000500)='/dev/nullb0\x00', 0x0, 0x0) ioctl$EVIOCGABS3F(0xffffffffffffffff, 0x8018457f, &(0x7f00000001c0)=""/50) r4 = dup2(r2, r1) ioctl$KDGKBSENT(r4, 0x4b48, &(0x7f0000000040)={0x7ff, 0x8, 0x1}) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f00000000c0)={'syzkaller0\x00', 0x0}) bind$xdp(r4, &(0x7f0000000100)={0x2c, 0x7, r5, 0x1c, r4}, 0x10) fadvise64(r3, 0x0, 0x0, 0x3) dup2(0xffffffffffffffff, 0xffffffffffffffff) ioprio_get$pid(0x1, 0x0) 01:56:59 executing program 2: r0 = socket$inet(0x2, 0x3, 0x2) connect$inet(0xffffffffffffffff, &(0x7f0000000000)={0x2, 0x0, @local}, 0x10) setsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x23, &(0x7f0000000000)={{{@in=@multicast2, @in=@multicast1}}, {{@in6}, 0x0, @in6=@loopback}}, 0xe8) syz_emit_ethernet(0x2a, &(0x7f0000000640)={@random="b100485caa2a", @link_local, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x1c, 0x0, 0x0, 0x0, 0x2, 0x0, @rand_addr, @broadcast}, @igmp={0x11, 0x0, 0x0, @multicast1}}}}}, &(0x7f0000000140)={0x0, 0x0, [0x0, 0x0, 0x0, 0xffffffff00000000]}) 01:56:59 executing program 1: r0 = socket$inet6(0xa, 0x0, 0x0) bind$inet6(r0, &(0x7f0000000000)={0xa, 0x20004e20}, 0x1c) r1 = socket$inet_dccp(0x2, 0x6, 0x0) listen(r0, 0x6) setsockopt(r1, 0x10d, 0x800000000d, &(0x7f00001c9fff)="03", 0x1) connect$inet(r1, &(0x7f0000e5c000)={0x2, 0x4e20, @dev={0xac, 0x14, 0x14, 0x20}}, 0x10) clock_gettime(0x0, &(0x7f0000000040)={0x0, 0x0}) clock_settime(0x0, &(0x7f00000000c0)={r2, r3+30000000}) r4 = socket$inet6(0xa, 0x6, 0x10001) ioctl(r4, 0x8912, &(0x7f0000000080)="0a5cc80700315f85715070") shutdown(r0, 0x0) 01:56:59 executing program 3: r0 = socket$inet(0x2, 0x3, 0x2) connect$inet(0xffffffffffffffff, &(0x7f0000000000)={0x2, 0x0, @local}, 0x10) setsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x23, &(0x7f0000000000)={{{@in=@multicast2, @in=@multicast1}}, {{@in6}, 0x0, @in6=@loopback}}, 0xe8) syz_emit_ethernet(0x2a, &(0x7f0000000640)={@random="b100485caa2a", @link_local, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x4, 0x1c, 0x0, 0x0, 0x0, 0x2, 0x0, @rand_addr, @broadcast}, @igmp={0x11, 0xffffffffffffffff, 0x0, @multicast1}}}}}, &(0x7f0000000140)) 01:56:59 executing program 5: perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1f}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000340)={&(0x7f0000000000), 0xc, &(0x7f0000000300)={&(0x7f0000000240)=@newlink={0x50, 0x10, 0x721, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x9000000}, [@IFLA_LINKINFO={0x28, 0x12, @veth={{0xc, 0x1, 'veth\x00'}, {0x18, 0x2, @VETH_INFO_PEER={0x14}}}}, @IFLA_NET_NS_FD={0x8}]}, 0x50}}, 0x0) 01:56:59 executing program 0: socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000001f80)={0xffffffffffffffff, 0xffffffffffffffff}) setsockopt$SO_ATTACH_FILTER(r2, 0x1, 0x1a, &(0x7f0000ab9ff0)={0x2, &(0x7f000039a000)=[{0x20, 0x0, 0x0, 0xfffffffffffff010}, {0x6}]}, 0x10) sendmmsg(r1, &(0x7f0000001e80)=[{{&(0x7f0000000700)=@l2, 0x80, &(0x7f0000001dc0)}}], 0x1, 0x0) 01:56:59 executing program 7: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000180)='/dev/sequencer\x00', 0x10002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000080)="0a5cc80700315f85715070") r1 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000001c0)={0x2, 0x0, &(0x7f0000000140)=ANY=[@ANYBLOB='\fc'], 0x0, 0x0, &(0x7f0000000080)}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, &(0x7f00000001c0)}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000040)={0x8, 0x4800, &(0x7f00000000c0)=[@release={0x400c630f}], 0x1, 0x0, &(0x7f0000000100)='V'}) fstat(r0, &(0x7f00000002c0)) 01:56:59 executing program 3: r0 = socket$inet(0x2, 0x3, 0x2) connect$inet(0xffffffffffffffff, &(0x7f0000000000)={0x2, 0x0, @local}, 0x10) setsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x23, &(0x7f0000000000)={{{@in=@multicast2, @in=@multicast1}}, {{@in6}, 0x0, @in6=@loopback}}, 0xe8) syz_emit_ethernet(0x2a, &(0x7f0000000640)={@random="b100485caa2a", @link_local, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x4000000000000000, 0x1c, 0x0, 0x0, 0x0, 0x2, 0x0, @rand_addr, @broadcast}, @igmp={0x11, 0xffffffffffffffff, 0x0, @multicast1}}}}}, &(0x7f0000000140)) 01:56:59 executing program 5: perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1f}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000340)={&(0x7f0000000000), 0xc, &(0x7f0000000300)={&(0x7f0000000240)=@newlink={0x50, 0x10, 0x721, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x400300}, [@IFLA_LINKINFO={0x28, 0x12, @veth={{0xc, 0x1, 'veth\x00'}, {0x18, 0x2, @VETH_INFO_PEER={0x14}}}}, @IFLA_NET_NS_FD={0x8}]}, 0x50}}, 0x0) 01:56:59 executing program 2: r0 = socket$inet(0x2, 0x3, 0x2) connect$inet(0xffffffffffffffff, &(0x7f0000000000)={0x2, 0x0, @local}, 0x10) setsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x23, &(0x7f0000000000)={{{@in=@multicast2, @in=@multicast1}}, {{@in6}, 0x0, @in6=@loopback}}, 0xe8) syz_emit_ethernet(0x2a, &(0x7f0000000640)={@random="b100485caa2a", @link_local, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x1c, 0x0, 0x0, 0x0, 0x2, 0x0, @rand_addr, @broadcast}, @igmp={0x11, 0x0, 0x0, @multicast1}}}}}, &(0x7f0000000140)={0x0, 0x0, [0x0, 0x0, 0x0, 0x100000000000000]}) [ 706.010544] binder: 16010:16026 Acquire 1 refcount change on invalid ref 0 ret -22 01:56:59 executing program 4: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000001100)="0a5cc80700315f85715070") r1 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_route(r1, &(0x7f00000001c0)={&(0x7f0000000000), 0xc, &(0x7f0000000140)={&(0x7f0000000080)=ANY=[@ANYBLOB="24000000180001c5000000000000000002000000000000010000000002000f00ac141400"], 0x24}}, 0x0) [ 706.077590] binder: 16010:16026 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 01:57:00 executing program 0: socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000001f80)={0xffffffffffffffff, 0xffffffffffffffff}) setsockopt$SO_ATTACH_FILTER(r2, 0x1, 0x1a, &(0x7f0000ab9ff0)={0x2, &(0x7f000039a000)=[{0x20, 0x0, 0x0, 0xfffffffffffff010}, {0x6}]}, 0x10) sendmmsg(r1, &(0x7f0000001e80)=[{{&(0x7f0000000700)=@l2, 0x80, &(0x7f0000001dc0)}}], 0x1, 0x0) 01:57:00 executing program 5: perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1f}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000340)={&(0x7f0000000000), 0xc, &(0x7f0000000300)={&(0x7f0000000240)=@newlink={0x50, 0x10, 0x721, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0xb00}, [@IFLA_LINKINFO={0x28, 0x12, @veth={{0xc, 0x1, 'veth\x00'}, {0x18, 0x2, @VETH_INFO_PEER={0x14}}}}, @IFLA_NET_NS_FD={0x8}]}, 0x50}}, 0x0) 01:57:00 executing program 3: r0 = socket$inet(0x2, 0x3, 0x2) connect$inet(0xffffffffffffffff, &(0x7f0000000000)={0x2, 0x0, @local}, 0x10) setsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x23, &(0x7f0000000000)={{{@in=@multicast2, @in=@multicast1}}, {{@in6}, 0x0, @in6=@loopback}}, 0xe8) syz_emit_ethernet(0x2a, &(0x7f0000000640)={@random="b100485caa2a", @link_local, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x40030000000000, 0x1c, 0x0, 0x0, 0x0, 0x2, 0x0, @rand_addr, @broadcast}, @igmp={0x11, 0xffffffffffffffff, 0x0, @multicast1}}}}}, &(0x7f0000000140)) 01:57:00 executing program 2: r0 = socket$inet(0x2, 0x3, 0x2) connect$inet(0xffffffffffffffff, &(0x7f0000000000)={0x2, 0x0, @local}, 0x10) setsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x23, &(0x7f0000000000)={{{@in=@multicast2, @in=@multicast1}}, {{@in6}, 0x0, @in6=@loopback}}, 0xe8) syz_emit_ethernet(0x2a, &(0x7f0000000640)={@random="b100485caa2a", @link_local, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x1c, 0x0, 0x0, 0x0, 0x2, 0x0, @rand_addr, @broadcast}, @igmp={0x11, 0x0, 0x0, @multicast1}}}}}, &(0x7f0000000140)={0x0, 0x0, [0x0, 0x0, 0x0, 0x800000000000000]}) [ 706.191431] binder: 16010:16054 Acquire 1 refcount change on invalid ref 0 ret -22 [ 706.302061] binder: 16010:16054 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 01:57:00 executing program 6: r0 = syz_open_dev$sndseq(&(0x7f0000000100)='/dev/snd/seq\x00', 0x0, 0x0) read(r0, &(0x7f0000fb6000)=""/28, 0x3f0) ioctl$SNDRV_SEQ_IOCTL_REMOVE_EVENTS(r0, 0x4040534e, &(0x7f00000001c0)={0xbf}) ioctl$SNDRV_SEQ_IOCTL_QUERY_SUBS(r0, 0xc058534f, &(0x7f00000002c0)={{}, 0x1, 0x0, 0x0, {}, 0x0, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffff00000000]}) r1 = gettid() timer_create(0x0, &(0x7f0000044000)={0x0, 0x12}, &(0x7f0000000040)) r2 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r2, 0x8912, &(0x7f00000001c0)="0a5cc80700315f85715070") timer_settime(0x0, 0x0, &(0x7f0000000080)={{0x0, 0x989680}, {0x0, 0x9}}, &(0x7f0000040000)) tkill(r1, 0x1000000000014) 01:57:00 executing program 4: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000000)="0a5cc80700315f85715070") syz_emit_ethernet(0x4a, &(0x7f0000000200)=ANY=[@ANYBLOB="0180c2000000484cc7d10baf86dd603ec77900140000fe80005d46000000000000000000000000000000000000000000ffffe000000200000000", @ANYRES32=0x41424344, @ANYRES32=0x41424344, @ANYBLOB="5000000090780100"], &(0x7f0000000100)) r1 = dup3(r0, r0, 0x80000) getsockopt$inet6_mreq(r0, 0x29, 0x1c, &(0x7f0000000040)={@local, 0x0}, &(0x7f0000000080)=0x14) sendmsg$xdp(r1, &(0x7f0000001740)={&(0x7f00000000c0)={0x2c, 0x4, r2, 0x30}, 0x10, &(0x7f0000001680)=[{&(0x7f0000000140)="b8902d681c2fc3d51012b5b3a4d7b46d6d6a23e28b2f779cc6", 0x19}, {&(0x7f0000000180)="3f8b726a3c32", 0x6}, {&(0x7f0000000280)="d0f1d346774dd52d75ed8763c4b79c31a6026b32bf5675a9c5b19e72afd160cbb79712f27b93fcc8871b06515b6da89dbc73c1db2666593ae9d0818cb5bef712e79252b1fa1c431417eee6c2224a89278e7941f5089c5d169b252d948eb884c3588d8a5f050b6ebbbc4acd4385ec4df1bf78d9df3f4b1d2421e70a0addc4c08621141ff84b8100408354981066d4a355a069eae3795b2377f0cde7cccce3f9cdd1fff1065243ee", 0xa7}, {&(0x7f00000001c0)="a18f9aa5f60d9b888b44f9", 0xb}, {&(0x7f0000000340)="630dd1ae4e26672a9adb84770cb75bbb2840bee50567e9daf5250cf9b06e5fe589c0f325da6512190a4d4409231a4ae0318b5ed827b8a120905c676223ee4665fb0c4f8d414481bc5e29dad93d72130adbadd95bd83ace1c5dcfac339e8b41ce20198e7f2ad3048a092c4e", 0x6b}, {&(0x7f00000003c0)="6c51b74daff5ec477ebbf46294307f69ea5fa348cc3b3664c204c3d400ac8aa6d51d7be86cbd0312a4fa7aefc0fba71a1d55100c9c9f127ccb01665a311cf291cc9f1161445b1a5fbbd2d39101adc17a70a1d33e44840731fb5fd325d404d1d8c0f35816d84fd3e96ed799252e64e953e18ee34eb83743b55f5065c8c33262568e0a2a3314d831ac5938d7d0afd4a801554abbdb4ddeff3f6c06dc9eb52eb2a010f9da81a1bd90c165663c425375c047fef0978d25729f5a33e2f429dbb6a22ac3d0f0530698c8dcc5d1b6b90bbc06439399bdd34e911428a1309ec0766fac4b15e27d40235cb23dd3cf52e42cfd18525c", 0xf1}, {&(0x7f00000004c0)="25819132c0d954a9ece6c4eba2b68e539df62b782ec713739422a3f3660a6c00a49535b52a60364b21cab160433efa7158fc7012ead2306ee6b68bdc02439b3d8128f8306e4fd6b921c0b1ceee916a2b3d818a277541829e9801348825502214ba26f5f98d0f8d329e4899c0b3f5039e9cc5608b598c690870e247c5adff274c92ffa8d1609f2dceac0dc0b79a4efed1f765a71d06d7a9da8d573d73585e2a6841ce3a06c63b12bd9a293c5e070761b9779798ac43c45853ce5e2d0891e05b17fea388c89a9f2a26c2646794b89380f1d710790bafc0078549ca44a185a41ef36743d38094a9a8ca848a0aad0d96d78759def021afce973d394801b3a5c881468b11d2aad9a4fe692d68a309d0ad184508e3669699a9b349cef9e07459029c1713911c06dd41e01dc0d82bc70eb1eb9e8b036e5d6ecc80c7a8882cd44e89a3f67ea88ab2576c8f8e98c18fc94e154d76ea5b83d16a3c6c3389cdf3505a2f608b44cc01b5fa7acb8bcae6e425f4770870c3b0133d784803efc7cfc802aa12994c6ad7fcc54e5d503e081d6ced9aca7a10b94f03bb755a191c8ea7b4dbd4f05e0a6e977823e8073e030ca949ce3ff7708bad9de99ac2980fa3bf47eab6cea9daa0fefc9fc9a8a2977d28d22f06c9853871ef4e77723671384f55274dba764677ceaa0f542e6a0026d0497c2c9b2f90cf5108407580d9cd80797a58320c035852b3d538de2f8db5aa35f368fba2c39fa302e748a193103fe040bca229eb08c144a56a7b82c0ca7b9ddc25849b0a372af2f01dac59f8cbaff799287cdf6f5ba86ebeec1d1896fe9e6a403d173478ea3007e319da5bc78526be73ba95dae2266add72f87c8d44aabfe5581a4db89607e882fe827045307c0eed60ae6eda4a306077ad05f9663d9daf9325ba792f0b41a584f149daeae6987ecc37f494fa6e313607fb38b180710a4b143add4076a26d3f1b9c8cf8beee646ba5d60540316f1f620c2ab2a39676a950cbadeb58089eacd24876655e87f95612ab08606f97dc05f0d1ca71971fd712633fe45c15dee80874186e34512c5b0613dab32786f085f95af8112042473bbbec8a1ba3b6b63a136511c94b6de421f3e509799320718d831eb6a1a570113c323a66a3a52437e17e88b31cb5e3863181d101e7a76a2621af561e5a33f12ceea274797b24332aec05322fc79ddc3ec76496dba4893fcada406b7792f5eb85346b8390ebdc5e9fab8f3eafe6555f1326ed5d09b451fac21298a4ff968f9e7622715d2bad38da35e9fb1bff02b07357d4091d763bade64d7e94e49b029ad38d4152270d65f8845d48847eadf257bc82ebae767f9d08d190d0d2cdcb5f698eadb96830f76fbde96626e627d3d0dbc5e00fbeac3f937db45bb2b1451eb24e6124d556a650b326cd5d32a77f008a1a755394322b80ce8c11f1b3d8677f8606ac7515624417e75d7155307d69e5a5ae09dc0ad3ca8f49638d6d85e4ed050fc5eb378cc48b63314cc3273a12bb90a6f01de347ae6b8abbcaf2dfad28f5575d2b0a12f132a7a24a64d40555b17ea8269aa97106bc22eef3d4573f2d4457e605ff7b0ccb7d0fcbce0d84e28d7ae36e5edb977f95744cc44d8e0549a76dd4e31a62d820dda28b3a2e39ed05fa3d8b941d42e99742d269f7542a1749909169daeb1fc80a5572745eb452e25f37ae9cc8b5ddf59a1368119bc8fad36784b362f0a66fe4002caa94cf99ebc16798b855cb4dd0aebe2ac85590a5de983396875dd4d8ca41037dbe51d1f90cadbf9c583637678d3848bc5423de4547203c8e69ae7b393c9be75de047665e0e03b45ef3f4040b7fc59ada80081a1c278fe1749389949848457f855a9f787ba26b2c1a572c646b6e4de48d9f6f94c3a1e39f2c2be486013d0ff4f5abee50e6d1a8dbe72141648bae586518040c5bc9d15459ffafaa8fc968e2e42df2463d91aa8b92539356213272e49dffb086885fef7f1165ac308513cfecd4b2d0dbf06a71c5e7c83020f099fee90aa1afa373e1995f0eb4515be5c80f6ed739b64be41b8855044fc3c13177c85d906eec4e18e7f41dbd9fa2262ebea163290696f8fc7726997ff6c263484605820bee8ab3482194aed4003cb8ec5beb46d13087f403c97f13812fb28660854c21160c9b358d7fe0592b5481f439d13b1a7a9be46188d7c9a568c00d17a1d2f5bf8695d45fe56f2f9ed3872cbe536d992d7f020a7778d8058db6c79c6659705d28543e319932f52ffe1ddd6076dfb2cd92233a34ef23ba90ff1647ac2c6fa17791a427202cbcddf8c25cb44fa0c76b37246dc85d1bf3b93b2685d66995503ed245ecb8f78190a11f181077419865e61daa71618b13b7d42317b923203cd67630b234821e5a97ba5d507210be877e1ca310da3c4951eed7b59fb5c033f9817f718074935ca53fb973c88249a7aac631f3d4290d7eb71d266bd6ab378310840a5621f89e525b468b7d7041eccba57dab1f2560ad79c5e2810e99a9118bd0d62e448389a3997f482de0c9a413988c72804d57778880f9eae0613f91daf04aa916c6d52de2ac7f2a82aa31291c23febd10b7f6eb302aa4f9d03097368cdcf70c231b585747579b1d567039243d25713f23b160a6138f03933ea3ee9a751498de6ceb164e775e12346bdacd8d80f52866ab3c5eee846e878acae0ac214fa854ac4630d2feedd078381b481c9b1860fd2d988352ca465770fd330c4b3367a4a504d333013710d11fd758b8c343e507a73e148525a7e0706e4168633838945122132c740929de49a41bbf2c0f9e656bc3c2ea6155ad66da9a36ea44051b159fc8dc391690d4d99406170da57c3b5768092454f72ad3c97a42c5b7506439710dbc3f7c9429c70f51eca77ce11d4dfa6c7098e59d1cbc3fef7e9bd182e51968d4ca033adedec563d799e0defd1fdf33001f084b79f0dbc4dba9f7501c2927ec806b44c293c2e476e473c58d7f05977344c953f86aed88df3b5b649c6af268d6c386f68c45c76d41481d827498ce431c694d69198765b133d9e6e9fe10438e9b9796fa5c6ac2f4c3e453f6b969b4344d0efcc24673afd4096548503ea9fee3377fb96d8bc1d790fce089662c32292994de8358d165573b6cfff4d96757cf0af0127648b5a5294dc80c2c4c392bbfec8834198d4b51e1d287fa3d5d56e6b2e607fabb01952f4e0da5e86b3b5503547d5cae04aff9e387f25fed4bdb3a245fa05c933f7f55062cacf12311fd2207c375f7f98bd8e38c6e6610613fc45d1b96de81f4eef00a6612b018e52e370e99052ec0139bfcf60f07eb431bf5bf4cb4a8566344852a5e6c728f2e20213474c15e16f392fe1663e8f3705e3bc6f5d327281623431bf8977bf390215e848845660f050162360644e3bc50ed3a32fde4b329a83366136330eeb5485eb30369942f3a5fb19954a7b25256f31e67de242751a04011451b20dd9ecbf62ca5839fc178cd3c09a9bedd1feb67eb200073c8091bcc9f3d2cbcf044e8b4ce9a7f345fb435e54fff187822851394aebc5097f72ce64c0f95dce15fbe1d4fcfa2ff3258a67281cb4605285484e8f9946516e59f47a136bc2102b3d8e3fa1b97c37fc4a494fd6844a803d254057bae0c1d606479615b3f57c61a0cb84decb64cafb47cfef16cb9fc4944b6d8525f14798bb31b197b14b51bcd89efd41286e4e17f4a330365c9f000bf6c69d921893f3b0971e5d885d9fbcf23afd17aaa8daf03c14be343d6f175238393dc0095b338337f9ff9550b2a7f78dacc6571e422a82028871b11fb03935da8536f5edd21ca792308aa5486be5726df1cdd173a7537ccd8912c6ba42de81385da98148acb27aa3287092009b3e0a4008f9f4b22e758a9343d82e760d75ee9098b96d577a999e7a880693270f7c380e79613d48c4708589210465160e01a991d919e27d36df25935eb507102a556b94a0073b3155c79f674ee7c12d171cbca9aa55a843e3a368797b8582cfc640858561e4c87fa2ec876194aac9da42148c78cdfa858092fbf3d47ec12d3e4a352c1f605454c07a06dba62f6ee711cd09111cad239e9b79a7944cecb266d27c4694c93feebbfe04e35315e1a6f08e0484ef2c9ae88b40719f3bf640010405e6dd0f6177184e666a8635118aed708ef11593f8b75c85c80ec0eec3b1e4767c5a35af6a22d7dcecb50b0f99a453c1f16e4d44ab9dd3341ff2ee595089f870093cd430b56a0d22f8f7e5b4909b6104f8618b9e2063696e32edf3846e4673b679b8a8092501ceec6c32df2f89aabe9fd62ab57741a3c3ec526e33b26bf70346ea200212bde38b17cc69f641ffeb98a11e9cfe1606209dd939f7d4799f6e8b7862e9e1009f657959f6cf309d006cb180c61e2b40770cf41d19b8fdd84c6b041d983f130dda46d3f667559fe613d7a45b845666e99c61f59c9340135d2d047963612528db3137dab1ce4d2313dc39270bb6b900911506653f13a8e5a5391c393d064209f150dd667d5a1bd65a374e1ff01ac18691a3ace49d6467a21ee0434c7531da42d27c97b4adbe264cd8e376e21ac31b6a319620b069e580b8bb96b801ec2f911b3f8fa8a58decfaf31a7e1ebe25df208f0c79f32a168e3c8b2dbe9030b1c7a059194ae6ca77a06d7ff60ceff78366b2fe728e5c07bcce88ea61500450070bbb9d23791f753783b5eb013b8ecdcd99c8b13a605774c3c47ee4a97a707d994c5c973e1ef0254007af8267bd779cf175e8c871a948d2c0d4806dab1516ffe890424639b9e83a3cd19a4e770940d01a2b99e8a4e6e429513d468b2344d8deb475d9c20b9993ad26f25adf7a9c14d5a67a7de1d28586e02e9571a5ac9f51cbf6c1f74e860309dee4d1f0305749d3e6138f1ace72cf4b52e700460fbad8f87b4e4a5ffd9601f7f1a5177b33483e5f3a5e424aeb6f7f9026402755ca89c595ddc48709a0237184ecbe7ec8d3cead4da88fe0a48047da7823f5ff7c26f96a8f12b40cac2fe0738231907104719cb8ac00bfa2ed3451c0a77c8286714c33b7e15673ed9c6258956638e471c9887405b3d65165490048b15c53953a720f3b8b23fec6fa6df976a47d7a6dcbba337534db8575fad7eac7a1785e682e0b23e0ae212e06ba2de1fd8378354f03a3aff755d3b6d60345b997dd7dc49cab154caa6e1c97ca4a3dac9698720bf5cb23987b0edd89ed4173efc82c277cd72ec6d47ed9178d38806b8e7147fed0d6fdc60eb61940d29204fd37c592f716e8adcfd88cc24df17e52921898c9a341ba4ca03c23927d540fa4a1398a07f78484e52ac8505cb7c29b836b262ca75a41f49d5a7996c2ec91948d97aac539e6b3f067547e1ceae68abec1eaa5d11530e57e11d5d65e478a7f2d85934dc38d682fa5f8231361eff5114299f5bfa0f975453ab8d34a2fba9a0c198f47ddf88955c01e652a852f3c079ff5e280888fe166da30803d9c8d4a4959ddf7797a7369de8408aa56d7e215759d4d1653e125ae6bf00ec5ae0130d0a5b484c9a89060598b34f3c7ee150ffbb5eab291906922a752b55842861688392bda3182fb781cfe1d45c064bfcd02fb8c76c639e8b20ec851778476a13e81e66619031158ed27ba1acfb5676b7123cd193962d45b26f1addd23f872ec36d1dda2682d183b470f8ce2f47ef0c7c3810c6121d9e976acd32db52e76efc4956465225e4d09654daba38788e76632f708e88ee3638bcc2daddf08cb85f097bbb7e0d0fa09c9906d652c6817f5b41190af56b2d8c97d83394fbb7f0d37212b7b51b11a53638d85553f411fc57c807", 0x1000}, {&(0x7f00000014c0)="fc5986e93233f6b5f8d76043ee748f9326cd49780aa72c852f8055cc9bcb727071c5d0d568a1769fe05ab6ef50d1be3908e1635402a5ab5b1dd2afe767011e1b922271992212c0135d6827fa6cd40621ac3c2074ffba1e92a7efae7efda51c1a1bc37f2d49f8c622c8a687b017a9824f1ee710271ae24a0637726b9a58faa91ecb3047cd3210346609fef59c3591752d70773ef3cb89de2f46f7279cf0dcf86a4ee757ca25ac4c1ef7188d8cf929942d26e865e635dd94ed8faaa8c4d4db4337e8bf25aeea887d685aa846e76ad74f90", 0xd0}, {&(0x7f00000015c0)="b20e850c381b0a4f5f16955d9248e05e24f4cabe22927086e226495f045231cbac28d6ab71d31374003f251f98bc80973a5e6cea3a1fc99930452c70a0a2ffc572cfc2ace04a53631767b936565d418e783697b5043ed83dd736e9f93056e819b8a92e9c7eae75625515728207dc395af68cf35ea0baf371255a749ca319c532e30a8d9ff248a9b96a0e4c1527f9e2253c7f9d07421ca81493b781d6", 0x9c}], 0x9, 0x0, 0x0, 0x804}, 0x40) 01:57:00 executing program 5: perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1f}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000340)={&(0x7f0000000000), 0xc, &(0x7f0000000300)={&(0x7f0000000240)=@newlink={0x50, 0x10, 0x721, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0xffffff9e}, [@IFLA_LINKINFO={0x28, 0x12, @veth={{0xc, 0x1, 'veth\x00'}, {0x18, 0x2, @VETH_INFO_PEER={0x14}}}}, @IFLA_NET_NS_FD={0x8}]}, 0x50}}, 0x0) 01:57:00 executing program 3: r0 = socket$inet(0x2, 0x3, 0x2) connect$inet(0xffffffffffffffff, &(0x7f0000000000)={0x2, 0x0, @local}, 0x10) setsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x23, &(0x7f0000000000)={{{@in=@multicast2, @in=@multicast1}}, {{@in6}, 0x0, @in6=@loopback}}, 0xe8) syz_emit_ethernet(0x2a, &(0x7f0000000640)={@random="b100485caa2a", @link_local, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x2000000000000000, 0x1c, 0x0, 0x0, 0x0, 0x2, 0x0, @rand_addr, @broadcast}, @igmp={0x11, 0xffffffffffffffff, 0x0, @multicast1}}}}}, &(0x7f0000000140)) 01:57:00 executing program 2: r0 = socket$inet(0x2, 0x3, 0x2) connect$inet(0xffffffffffffffff, &(0x7f0000000000)={0x2, 0x0, @local}, 0x10) setsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x23, &(0x7f0000000000)={{{@in=@multicast2, @in=@multicast1}}, {{@in6}, 0x0, @in6=@loopback}}, 0xe8) syz_emit_ethernet(0x2a, &(0x7f0000000640)={@random="b100485caa2a", @link_local, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x1c, 0x0, 0x0, 0x0, 0x2, 0x0, @rand_addr, @broadcast}, @igmp={0x11, 0x0, 0x0, @multicast1}}}}}, &(0x7f0000000140)={0x0, 0x0, [0x0, 0x0, 0x0, 0x3e000000]}) 01:57:00 executing program 0: socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000001f80)={0xffffffffffffffff, 0xffffffffffffffff}) setsockopt$SO_ATTACH_FILTER(r2, 0x1, 0x1a, &(0x7f0000ab9ff0)={0x2, &(0x7f000039a000)=[{0x20, 0x0, 0x0, 0xfffffffffffff010}, {0x6}]}, 0x10) sendmmsg(r1, &(0x7f0000001e80)=[{{&(0x7f0000000700)=@l2, 0x80, &(0x7f0000001dc0)}}], 0x1, 0x0) 01:57:00 executing program 7: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000180)='/dev/sequencer\x00', 0x10002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000080)="0a5cc80700315f85715070") r1 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000001c0)={0x2, 0x0, &(0x7f0000000140)=ANY=[@ANYBLOB='\fc'], 0x0, 0x0, &(0x7f0000000080)}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, &(0x7f00000001c0)}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000040)={0x8, 0x5, &(0x7f00000000c0)=[@release={0x400c630f}], 0x1, 0x0, &(0x7f0000000100)='V'}) fstat(r0, &(0x7f00000002c0)) 01:57:00 executing program 1: perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1f}, 0x0, 0x0, 0xffffffffffffffff, 0x0) getsockopt$EBT_SO_GET_INIT_ENTRIES(0xffffffffffffffff, 0x0, 0x83, &(0x7f0000000100)={'filter\x00', 0x0, 0x0, 0x84, [], 0x0, &(0x7f0000000000), &(0x7f0000000040)=""/132}, &(0x7f0000000180)=0x78) r0 = memfd_create(&(0x7f0000000380)='\'', 0x0) r1 = syz_open_dev$sndseq(&(0x7f00000001c0)='/dev/snd/seq\x00', 0x0, 0x82) r2 = dup2(r1, r1) ioctl$SNDRV_SEQ_IOCTL_CREATE_QUEUE(r2, 0xc08c5332, &(0x7f0000001000)={0x0, 0x0, 0x0, "9ec77a8c5ae95ec8672c93340f643a664f13eeab65c0322901dc6bd36cde2c51f01b7f0b014f9f91eeb7c37c7240f476c8d753d000aa8faf8fb574dbcfa6dc4d"}) ioctl$TIOCGSID(r0, 0x5429, &(0x7f00000002c0)=0x0) fcntl$lock(r1, 0x7, &(0x7f0000000300)={0x0, 0x0, 0x2, 0xcca5, r3}) r4 = memfd_create(&(0x7f000003e000)='\t', 0x0) ioctl$TCSETSF(r0, 0x5404, &(0x7f0000000280)={0x7, 0x7, 0xa5, 0xfffffffffffffffb, 0xffffffff80000000, 0x6, 0x0, 0xc2, 0x8, 0x8, 0x6, 0x6}) r5 = syz_open_dev$sndseq(&(0x7f000011c000)='/dev/snd/seq\x00', 0x0, 0x8000000000102) ioctl$SNDRV_SEQ_IOCTL_SET_QUEUE_TEMPO(r2, 0x402c5342, &(0x7f0000000200)={0x9, 0x0, 0x0, {0x0, 0x1c9c380}}) write$sndseq(r2, &(0x7f0000000000)=[{0x0, 0x0, 0x0, 0x0, @tick, {}, {}, @result}], 0x218) dup2(r5, r4) write$sndseq(r4, &(0x7f0000e6ffd0)=[{0x1e, 0x0, 0x0, 0x3fd, @time}], 0x30) 01:57:00 executing program 3: r0 = socket$inet(0x2, 0x3, 0x2) connect$inet(0xffffffffffffffff, &(0x7f0000000000)={0x2, 0x0, @local}, 0x10) setsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x23, &(0x7f0000000000)={{{@in=@multicast2, @in=@multicast1}}, {{@in6}, 0x0, @in6=@loopback}}, 0xe8) syz_emit_ethernet(0x2a, &(0x7f0000000640)={@random="b100485caa2a", @link_local, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0xfffff000, 0x1c, 0x0, 0x0, 0x0, 0x2, 0x0, @rand_addr, @broadcast}, @igmp={0x11, 0xffffffffffffffff, 0x0, @multicast1}}}}}, &(0x7f0000000140)) 01:57:00 executing program 2: r0 = socket$inet(0x2, 0x3, 0x2) connect$inet(0xffffffffffffffff, &(0x7f0000000000)={0x2, 0x0, @local}, 0x10) setsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x23, &(0x7f0000000000)={{{@in=@multicast2, @in=@multicast1}}, {{@in6}, 0x0, @in6=@loopback}}, 0xe8) syz_emit_ethernet(0x2a, &(0x7f0000000640)={@random="b100485caa2a", @link_local, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x1c, 0x0, 0x0, 0x0, 0x2, 0x0, @rand_addr, @broadcast}, @igmp={0x11, 0x0, 0x0, @multicast1}}}}}, &(0x7f0000000140)={0x0, 0x0, [0x0, 0x0, 0x0, 0x3000000]}) 01:57:00 executing program 4: r0 = socket$inet6(0xa, 0x1000000000005, 0x0) ioctl(r0, 0x8912, &(0x7f0000000080)="0a5cc80700315f85715070") r1 = socket$inet(0x2, 0x4000000000000001, 0x0) mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x6, 0x31, 0xffffffffffffffff, 0x0) ioctl$sock_inet_tcp_SIOCINQ(r1, 0x5411, &(0x7f00000000c0)) 01:57:00 executing program 5: perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1f}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000340)={&(0x7f0000000000), 0xc, &(0x7f0000000300)={&(0x7f0000000240)=@newlink={0x50, 0x10, 0x721, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0xb40a000000000000}, [@IFLA_LINKINFO={0x28, 0x12, @veth={{0xc, 0x1, 'veth\x00'}, {0x18, 0x2, @VETH_INFO_PEER={0x14}}}}, @IFLA_NET_NS_FD={0x8}]}, 0x50}}, 0x0) [ 706.955232] binder: 16097:16103 Acquire 1 refcount change on invalid ref 0 ret -22 01:57:00 executing program 1: r0 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vhost-net\x00', 0x2, 0x0) r1 = dup(r0) ioctl$VHOST_SET_OWNER(r0, 0xaf01, 0x0) ioctl$TCXONC(r1, 0x4004af07, 0x0) 01:57:00 executing program 3: r0 = socket$inet(0x2, 0x3, 0x2) connect$inet(0xffffffffffffffff, &(0x7f0000000000)={0x2, 0x0, @local}, 0x10) setsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x23, &(0x7f0000000000)={{{@in=@multicast2, @in=@multicast1}}, {{@in6}, 0x0, @in6=@loopback}}, 0xe8) syz_emit_ethernet(0x2a, &(0x7f0000000640)={@random="b100485caa2a", @link_local, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0xffffffffffffffff, 0x1c, 0x0, 0x0, 0x0, 0x2, 0x0, @rand_addr, @broadcast}, @igmp={0x11, 0xffffffffffffffff, 0x0, @multicast1}}}}}, &(0x7f0000000140)) 01:57:01 executing program 0: socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000001f80)={0xffffffffffffffff, 0xffffffffffffffff}) setsockopt$SO_ATTACH_FILTER(r2, 0x1, 0x1a, &(0x7f0000ab9ff0)={0x2, &(0x7f000039a000)=[{0x20, 0x0, 0x0, 0xfffffffffffff010}, {0x6}]}, 0x10) sendmmsg(r1, &(0x7f0000001e80)=[{{&(0x7f0000000700)=@l2, 0x80, &(0x7f0000001dc0)}}], 0x1, 0x0) 01:57:01 executing program 2: r0 = socket$inet(0x2, 0x3, 0x2) connect$inet(0xffffffffffffffff, &(0x7f0000000000)={0x2, 0x0, @local}, 0x10) setsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x23, &(0x7f0000000000)={{{@in=@multicast2, @in=@multicast1}}, {{@in6}, 0x0, @in6=@loopback}}, 0xe8) recvfrom(r0, &(0x7f0000000180)=""/159, 0x9f, 0x10000, &(0x7f0000000240)=@nfc_llcp={0x27, 0x0, 0x2, 0x7, 0x7, 0x0, "7f126e7a03a1736db882e0e5ef573f35f59a1ad374d86a78f6d381b464e212cdced76e072257480e59e8a54ec7b21109bec6a890a84343b01ea547a1932851", 0x12}, 0x80) syz_emit_ethernet(0x2a, &(0x7f00000002c0)=ANY=[@ANYBLOB="b1060000000000000000000290533509f2f9847800000000ffffffff11009078e00000013e7a0d735337826c9e5972f4fba754a1efea42757ad51052309a80d8df7be73da38c470e9e5b1b5842c92ea8b9bda5882e1a1707f0675b6a8d41defc37aeb56bd181d1a6823340591d254873139d298ebd60e112abfd0103317f43eaa5933ee9a9e121cee8453d3e1d9c6a166e6d313c2cf8cd1ffb91257b4385a8827a3c680905df73a319c20e00e197104f1e5a4b228166a60cf6ea23703d7a9c3ab6196467583656294cefc86eefa3add8ed045b9ba60a3864881c226f92580464898067a95fd1bbf37219bd2ab15df732a028d95710f8ac920f90f79a95a21bf543ae7804208c5492b129ff69e98d582490ccc72f10e7d09c944146fe01f0f811106bfc45c0ef56ac5ccb40eab37b583f6a5d22154318eb7c5dc7aff6256488233326a0a4f7cb5a37b3ce6e9ff4bfd079c85eb3cf1050ab9a64dbfb"], &(0x7f0000000140)) [ 707.100270] binder: 16097:16103 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 707.159340] binder: 16097:16131 unknown command 0 [ 707.225008] binder: 16097:16131 ioctl c0306201 20000040 returned -22 [ 707.241735] binder: 16097:16131 Acquire 1 refcount change on invalid ref 0 ret -22 [ 707.279155] binder: 16097:16131 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 707.287338] binder: 16097:16103 unknown command 0 [ 707.293993] binder: 16097:16103 ioctl c0306201 20000040 returned -22 01:57:01 executing program 6: r0 = syz_open_dev$sndseq(&(0x7f0000000100)='/dev/snd/seq\x00', 0x0, 0x0) read(r0, &(0x7f0000fb6000)=""/28, 0x3f0) ioctl$SNDRV_SEQ_IOCTL_REMOVE_EVENTS(r0, 0x4040534e, &(0x7f00000001c0)={0xbf}) ioctl$SNDRV_SEQ_IOCTL_QUERY_SUBS(r0, 0xc058534f, &(0x7f00000002c0)={{}, 0x1, 0x0, 0x0, {}, 0x0, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xe000000]}) r1 = gettid() timer_create(0x0, &(0x7f0000044000)={0x0, 0x12}, &(0x7f0000000040)) r2 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r2, 0x8912, &(0x7f00000001c0)="0a5cc80700315f85715070") timer_settime(0x0, 0x0, &(0x7f0000000080)={{0x0, 0x989680}, {0x0, 0x9}}, &(0x7f0000040000)) tkill(r1, 0x1000000000014) 01:57:01 executing program 1: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000200)="0a5cc80700315f85715070") unshare(0x400) socketpair(0x8000000000001e, 0x1, 0x0, &(0x7f0000a77ff8)={0xffffffffffffffff, 0xffffffffffffffff}) setsockopt$l2tp_PPPOL2TP_SO_SENDSEQ(r2, 0x10f, 0x85, 0x0, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r1, &(0x7f0000000040)={0x0, 0x18, 0xfa00, {0x4, &(0x7f0000000000)={0xffffffffffffffff}, 0x106, 0x4}}, 0x20) write$RDMA_USER_CM_CMD_LISTEN(r2, &(0x7f0000000080)={0x7, 0x8, 0xfa00, {r3, 0x8}}, 0x10) 01:57:01 executing program 4: r0 = syz_open_dev$dspn(&(0x7f0000000040)='/dev/dsp#\x00', 0x1d1e7207, 0x1) ioctl$sock_inet_SIOCGIFBRDADDR(r0, 0x8919, &(0x7f0000000100)={'eql\x00', {0x2, 0x4e23, @local}}) r1 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r1, 0x8912, &(0x7f0000000000)="0a5cc80700315f85715070") r2 = socket$alg(0x26, 0x5, 0x0) bind$alg(r2, &(0x7f0000000080)={0x26, 'aead\x00', 0x0, 0x0, 'rfc4543(rfc7539(ctr-camellia-aesni,md5-generic))\x00'}, 0x58) 01:57:01 executing program 5: perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1f}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000340)={&(0x7f0000000000), 0xc, &(0x7f0000000300)={&(0x7f0000000240)=@newlink={0x50, 0x10, 0x721, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0xffffff7f}, [@IFLA_LINKINFO={0x28, 0x12, @veth={{0xc, 0x1, 'veth\x00'}, {0x18, 0x2, @VETH_INFO_PEER={0x14}}}}, @IFLA_NET_NS_FD={0x8}]}, 0x50}}, 0x0) 01:57:01 executing program 2: r0 = socket$inet(0x2, 0x3, 0x2) connect$inet(0xffffffffffffffff, &(0x7f0000000000)={0x2, 0x0, @local}, 0x10) setsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x23, &(0x7f0000000000)={{{@in=@multicast2, @in=@multicast1}}, {{@in6}, 0x0, @in6=@loopback}}, 0xe8) syz_emit_ethernet(0x2a, &(0x7f0000000640)={@random="b100485caa2a", @link_local, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x1c, 0x0, 0x0, 0x0, 0x2, 0x0, @rand_addr, @broadcast}, @igmp={0x11, 0x0, 0x0, @multicast1}}}}}, &(0x7f0000000140)) r1 = dup3(r0, r0, 0x80000) ioctl$TIOCSTI(r1, 0x5412, 0x9) 01:57:01 executing program 0: socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000001f80)={0xffffffffffffffff, 0xffffffffffffffff}) setsockopt$SO_ATTACH_FILTER(r2, 0x1, 0x1a, &(0x7f0000ab9ff0)={0x2, &(0x7f000039a000)=[{0x20, 0x0, 0x0, 0xfffffffffffff010}, {0x6}]}, 0x10) sendmmsg(r1, &(0x7f0000001e80)=[{{&(0x7f0000000700)=@l2, 0x80, &(0x7f0000001dc0)}}], 0x1, 0x0) 01:57:01 executing program 3: r0 = socket$inet(0x2, 0x3, 0x2) connect$inet(0xffffffffffffffff, &(0x7f0000000000)={0x2, 0x0, @local}, 0x10) setsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x23, &(0x7f0000000000)={{{@in=@multicast2, @in=@multicast1}}, {{@in6}, 0x0, @in6=@loopback}}, 0xe8) syz_emit_ethernet(0x2a, &(0x7f0000000640)={@random="b100485caa2a", @link_local, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0xe000000000000000, 0x1c, 0x0, 0x0, 0x0, 0x2, 0x0, @rand_addr, @broadcast}, @igmp={0x11, 0xffffffffffffffff, 0x0, @multicast1}}}}}, &(0x7f0000000140)) 01:57:01 executing program 7: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000180)='/dev/sequencer\x00', 0x10002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000080)="0a5cc80700315f85715070") r1 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000001c0)={0x2, 0x0, &(0x7f0000000140)=ANY=[@ANYBLOB='\fc'], 0x0, 0x0, &(0x7f0000000080)}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, &(0x7f00000001c0)}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000040)={0x8, 0x60, &(0x7f00000000c0)=[@release={0x400c630f}], 0x1, 0x0, &(0x7f0000000100)='V'}) fstat(r0, &(0x7f00000002c0)) 01:57:01 executing program 3: r0 = socket$inet(0x2, 0x3, 0x2) connect$inet(0xffffffffffffffff, &(0x7f0000000000)={0x2, 0x0, @local}, 0x10) setsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x23, &(0x7f0000000000)={{{@in=@multicast2, @in=@multicast1}}, {{@in6}, 0x0, @in6=@loopback}}, 0xe8) syz_emit_ethernet(0x2a, &(0x7f0000000640)={@random="b100485caa2a", @link_local, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x1c00000000000000, 0x1c, 0x0, 0x0, 0x0, 0x2, 0x0, @rand_addr, @broadcast}, @igmp={0x11, 0xffffffffffffffff, 0x0, @multicast1}}}}}, &(0x7f0000000140)) 01:57:01 executing program 5: perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1f}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000340)={&(0x7f0000000000), 0xc, &(0x7f0000000300)={&(0x7f0000000240)=@newlink={0x50, 0x10, 0x721, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0xf000000}, [@IFLA_LINKINFO={0x28, 0x12, @veth={{0xc, 0x1, 'veth\x00'}, {0x18, 0x2, @VETH_INFO_PEER={0x14}}}}, @IFLA_NET_NS_FD={0x8}]}, 0x50}}, 0x0) 01:57:01 executing program 4: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000180)="0a5cc80700315f85715070") r1 = perf_event_open(&(0x7f000001d000)={0x2, 0x70, 0x0, 0x8001, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000001080)}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r2 = userfaultfd(0x0) ioctl$UFFDIO_API(r2, 0xc018aa3f, &(0x7f00000000c0)) ioctl$FIBMAP(r0, 0x1, &(0x7f0000000000)=0x8) ioctl$UFFDIO_REGISTER(r2, 0xc020aa00, &(0x7f000086c000)={{&(0x7f0000068000/0x800000)=nil, 0x800000}, 0x1}) read(r1, &(0x7f0000465f8e)=""/114, 0x47) ioctl$sock_kcm_SIOCKCMUNATTACH(r1, 0x40082406, &(0x7f0000000080)) close(r1) ioctl$UFFDIO_UNREGISTER(r2, 0x8010aa01, &(0x7f0000c22ff0)={&(0x7f000001d000/0xc00000)=nil, 0xc00000}) [ 707.797643] binder: 16154:16170 Acquire 1 refcount change on invalid ref 0 ret -22 01:57:01 executing program 2: r0 = socket$inet(0x2, 0x3, 0x2) connect$inet(0xffffffffffffffff, &(0x7f0000000000)={0x2, 0x0, @local}, 0x10) setsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x23, &(0x7f0000000000)={{{@in=@multicast2, @in=@multicast1}}, {{@in6}, 0x0, @in6=@loopback}}, 0xe8) syz_emit_ethernet(0x2a, &(0x7f0000000640)={@random="b100485caa2a", @link_local, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x1c, 0x0, 0x0, 0x0, 0x2, 0x0, @rand_addr, @broadcast}, @igmp={0x11, 0x0, 0x0, @multicast1}}}}}, &(0x7f0000000140)) socket$inet(0x2, 0x1, 0x2) 01:57:01 executing program 1: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = socket$inet6(0xa, 0x200000002, 0x0) connect$inet6(r1, &(0x7f00000000c0)={0xa, 0x0, 0x0, @local, 0x4}, 0x1c) r2 = syz_open_dev$sndpcmp(&(0x7f0000000040)='/dev/snd/pcmC#D#p\x00', 0x8001, 0x400000) setsockopt$inet_tcp_TCP_MD5SIG(r2, 0x6, 0xe, &(0x7f00000001c0)={@in={{0x2, 0x4e23, @loopback}}, 0x7, 0x1f, 0x7fff, "df69ba537b233ed4871d8ec62a51dc3cbb7a0a7443d36f1e914f2f569e162b174a1d30f09ee970e9b1a6b9f43059702b25cc23f809ad62cd0500564cbd25e4f82059c74c9ade436b838f0a129ac6521a"}, 0xd8) setsockopt$SO_ATTACH_FILTER(r1, 0x1, 0x22, &(0x7f0000000100)={0x1, &(0x7f0000000000)=[{}]}, 0x10) 01:57:01 executing program 3: r0 = socket$inet(0x2, 0x3, 0x2) connect$inet(0xffffffffffffffff, &(0x7f0000000000)={0x2, 0x0, @local}, 0x10) setsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x23, &(0x7f0000000000)={{{@in=@multicast2, @in=@multicast1}}, {{@in6}, 0x0, @in6=@loopback}}, 0xe8) syz_emit_ethernet(0x2a, &(0x7f0000000640)={@random="b100485caa2a", @link_local, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x2000, 0x1c, 0x0, 0x0, 0x0, 0x2, 0x0, @rand_addr, @broadcast}, @igmp={0x11, 0xffffffffffffffff, 0x0, @multicast1}}}}}, &(0x7f0000000140)) 01:57:01 executing program 0: socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000001f80)={0xffffffffffffffff, 0xffffffffffffffff}) setsockopt$SO_ATTACH_FILTER(r2, 0x1, 0x1a, &(0x7f0000ab9ff0)={0x2, &(0x7f000039a000)=[{0x20, 0x0, 0x0, 0xfffffffffffff010}, {0x6}]}, 0x10) sendmmsg(r1, &(0x7f0000001e80)=[{{&(0x7f0000000700)=@l2, 0x80, &(0x7f0000001dc0)}}], 0x1, 0x0) [ 707.902276] binder: 16154:16170 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 01:57:01 executing program 5: perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1f}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000340)={&(0x7f0000000000), 0xc, &(0x7f0000000300)={&(0x7f0000000240)=@newlink={0x50, 0x10, 0x721, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0xb}, [@IFLA_LINKINFO={0x28, 0x12, @veth={{0xc, 0x1, 'veth\x00'}, {0x18, 0x2, @VETH_INFO_PEER={0x14}}}}, @IFLA_NET_NS_FD={0x8}]}, 0x50}}, 0x0) [ 707.985250] binder: 16154:16198 Acquire 1 refcount change on invalid ref 0 ret -22 [ 708.083352] binder: 16154:16198 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 01:57:02 executing program 6: r0 = syz_open_dev$sndseq(&(0x7f0000000100)='/dev/snd/seq\x00', 0x0, 0x0) read(r0, &(0x7f0000fb6000)=""/28, 0x3f0) ioctl$SNDRV_SEQ_IOCTL_REMOVE_EVENTS(r0, 0x4040534e, &(0x7f00000001c0)={0xbf}) ioctl$SNDRV_SEQ_IOCTL_QUERY_SUBS(r0, 0xc058534f, &(0x7f00000002c0)={{}, 0x1, 0x0, 0x0, {}, 0x0, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xe00]}) r1 = gettid() timer_create(0x0, &(0x7f0000044000)={0x0, 0x12}, &(0x7f0000000040)) r2 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r2, 0x8912, &(0x7f00000001c0)="0a5cc80700315f85715070") timer_settime(0x0, 0x0, &(0x7f0000000080)={{0x0, 0x989680}, {0x0, 0x9}}, &(0x7f0000040000)) tkill(r1, 0x1000000000014) 01:57:02 executing program 1: unshare(0x8020000) r0 = syz_open_procfs$namespace(0x0, &(0x7f0000000140)='ns/mnt\x00') fchmod(r0, 0x2) setns(r0, 0x0) unshare(0x28000000) write(r0, &(0x7f0000000000)="fb7ee00038a05a744f7b4d9630e5f565f94b7972a2284d176ee142393ca6b8096efaeaf49986efca56e0f80dec4e657e73dfec4cc7dc3e2189df825fa63fa23393082b15b7d24df2fce48821e71c323650d957799c3842fcb9fc30cbe96793784da59a53b0d65d78549296f9a5bba847c2eb5fb32775eb24683e529c1e34cda1d2f30642b0b4cef4e283c1887c7201ba260f4717baa71421e661b941aa8f7a9aa569651789eca9440b27df674e88c73b4c24df0959a7361d2b336210459f028c43dc6b9ba5226bc40aba4797720b33fc521173bd625bea5458515a66f360462c1b718eac37d446e567318b165234ab1f20e25c", 0xf3) r1 = dup(r0) getsockopt$inet_sctp6_SCTP_PRIMARY_ADDR(0xffffffffffffff9c, 0x84, 0x6, &(0x7f0000000200)={0x0, @in6={{0xa, 0x4e23, 0xf8bd, @local, 0x2ec}}}, &(0x7f0000000100)=0x84) getsockopt$inet_sctp_SCTP_GET_PEER_ADDR_INFO(r1, 0x84, 0xf, &(0x7f00000002c0)={r2, @in6={{0xa, 0x4e22, 0xfffffffffffffffb, @mcast2}}, 0x100000000, 0x8, 0xd9, 0x5, 0x80000001}, &(0x7f0000000380)=0x98) clone(0x34004000, &(0x7f0000000040), &(0x7f0000000180), &(0x7f00000001c0), &(0x7f00000000c0)) 01:57:02 executing program 3: r0 = socket$inet(0x2, 0x3, 0x2) connect$inet(0xffffffffffffffff, &(0x7f0000000000)={0x2, 0x0, @local}, 0x10) setsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x23, &(0x7f0000000000)={{{@in=@multicast2, @in=@multicast1}}, {{@in6}, 0x0, @in6=@loopback}}, 0xe8) syz_emit_ethernet(0x2a, &(0x7f0000000640)={@random="b100485caa2a", @link_local, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x14, 0x0, 0x0, 0x0, 0x2, 0x0, @rand_addr, @broadcast}, @igmp={0x11, 0xffffffffffffffff, 0x0, @multicast1}}}}}, &(0x7f0000000140)) 01:57:02 executing program 2: r0 = socket$inet(0x2, 0x3, 0x2) connect$inet(0xffffffffffffffff, &(0x7f0000000000)={0x2, 0x0, @local}, 0x10) setsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x23, &(0x7f0000000000)={{{@in=@multicast2, @in=@multicast1}}, {{@in6}, 0x0, @in6=@loopback}}, 0xe8) setsockopt$inet_tcp_TLS_RX(r0, 0x6, 0x2, &(0x7f0000000100), 0x4) syz_emit_ethernet(0x2a, &(0x7f0000000640)=ANY=[@ANYBLOB="b100485caa2a0180c200000008004500001c000000ff0300007800000000ffffffff11009078e0000001"], &(0x7f0000000140)) 01:57:02 executing program 5: perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1f}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000340)={&(0x7f0000000000), 0xc, &(0x7f0000000300)={&(0x7f0000000240)=@newlink={0x50, 0x10, 0x721, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x4000000}, [@IFLA_LINKINFO={0x28, 0x12, @veth={{0xc, 0x1, 'veth\x00'}, {0x18, 0x2, @VETH_INFO_PEER={0x14}}}}, @IFLA_NET_NS_FD={0x8}]}, 0x50}}, 0x0) 01:57:02 executing program 4: r0 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup\x00', 0x200002, 0x0) r1 = openat$cgroup_int(r0, &(0x7f0000000280)="70629833df54377b08f9dd8e6964732e6d617800af2207e0f6777f2e1b61a00100000000000000e94ac0c178a3af665b6e3bf6bd8b6da67b0bf4c1c5f4584127a7a95be12f2bedfcab8b8487bd3bdf1c777035f2d56b512f15cf9e8b56045abd3378020326c216a550816462307a651b153e8455ea200afd5982dba94ec72c9e4626c98d729cfde12f82f446dfb6c90014be318609ccbf0000", 0x2, 0x0) write$cgroup_int(r1, &(0x7f0000000100)=0x100000000, 0x12) 01:57:02 executing program 0: socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000001f80)={0xffffffffffffffff, 0xffffffffffffffff}) setsockopt$SO_ATTACH_FILTER(r2, 0x1, 0x1a, &(0x7f0000ab9ff0)={0x2, &(0x7f000039a000)=[{0x20, 0x0, 0x0, 0xfffffffffffff010}, {0x6}]}, 0x10) sendmmsg(r1, &(0x7f0000001e80)=[{{&(0x7f0000000700)=@l2, 0x80, &(0x7f0000001dc0)}}], 0x1, 0x0) 01:57:02 executing program 7: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000180)='/dev/sequencer\x00', 0x10002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000080)="0a5cc80700315f85715070") r1 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000001c0)={0x2, 0x0, &(0x7f0000000140)=ANY=[@ANYBLOB='\fc'], 0x0, 0x0, &(0x7f0000000080)}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, &(0x7f00000001c0)}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000040)={0x8, 0xa00000000000000, &(0x7f00000000c0)=[@release={0x400c630f}], 0x1, 0x0, &(0x7f0000000100)='V'}) fstat(r0, &(0x7f00000002c0)) 01:57:02 executing program 4: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) fcntl$setsig(r0, 0xa, 0x2) ioctl(r0, 0x8912, &(0x7f0000000080)="0a5cc80700315f85715070") sendfile(r0, r0, &(0x7f0000000040), 0x7) r1 = socket$inet(0x10, 0x3, 0x0) ioctl$sock_inet_udp_SIOCOUTQ(r1, 0x5411, &(0x7f0000000000)) sendmsg(r1, &(0x7f0000000900)={0x0, 0x0, &(0x7f0000009ff0)=[{&(0x7f0000000880)="24000000460007031dfffd946f61830020200a00090003fcff1c85680c1ba3a20400ff7e280000001100ffffba16a0aa1c0009b3ebea8653b1cc7e63975c0ac47b6268e3966cf055d90f15a3", 0x4c}], 0x1}, 0x0) 01:57:02 executing program 3: r0 = socket$inet(0x2, 0x3, 0x2) connect$inet(0xffffffffffffffff, &(0x7f0000000000)={0x2, 0x0, @local}, 0x10) setsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x23, &(0x7f0000000000)={{{@in=@multicast2, @in=@multicast1}}, {{@in6}, 0x0, @in6=@loopback}}, 0xe8) syz_emit_ethernet(0x2a, &(0x7f0000000640)={@random="b100485caa2a", @link_local, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x13, 0x0, 0x0, 0x0, 0x2, 0x0, @rand_addr, @broadcast}, @igmp={0x11, 0xffffffffffffffff, 0x0, @multicast1}}}}}, &(0x7f0000000140)) 01:57:02 executing program 5: perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1f}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000340)={&(0x7f0000000000), 0xc, &(0x7f0000000300)={&(0x7f0000000240)=@newlink={0x50, 0x10, 0x721, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x1000000}, [@IFLA_LINKINFO={0x28, 0x12, @veth={{0xc, 0x1, 'veth\x00'}, {0x18, 0x2, @VETH_INFO_PEER={0x14}}}}, @IFLA_NET_NS_FD={0x8}]}, 0x50}}, 0x0) 01:57:02 executing program 2: r0 = socket$inet(0x2, 0x3, 0x2) connect$inet(0xffffffffffffffff, &(0x7f0000000000)={0x2, 0x0, @local}, 0x10) setsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x23, &(0x7f0000000000)={{{@in=@multicast2, @in=@multicast1}}, {{@in6}, 0x0, @in6=@loopback}}, 0xe8) syz_emit_ethernet(0x2a, &(0x7f0000000180)=ANY=[@ANYBLOB="b100485caa2a0180c200000008004501001c0000000370dcf52af53a236f40000002907800000000ffff302d3490a7e051a50000d91b784eae0575182db900453d3284919283098f76d9d899e0555455e3e80a2afec6972fe34b90af5b2b892dcb47617f8622b5fc848a6bba793e0b1bd6bd20773b99bae077f283fc5ae8593330c6468cced2f2518d9eafd6aeb0211f4f3439430cafa339dc3306f07d2d50916db0bc4cdf2f5b000000"], &(0x7f0000000140)) r1 = syz_open_dev$amidi(&(0x7f0000000280)='/dev/amidi#\x00', 0x4c3, 0x40003f) mkdirat$cgroup(r1, &(0x7f0000000240)='syz0\x00', 0x1ff) select(0x40, &(0x7f0000000100)={0xce8, 0x5, 0x6, 0x100000000000000, 0x5, 0x6, 0x8, 0x7}, &(0x7f00000002c0)={0x3ff, 0x7, 0x9, 0x7, 0x4, 0x0, 0xeda4, 0x8}, &(0x7f0000000300)={0x7f, 0x7ba, 0x100000000, 0x4, 0x4, 0x1, 0x0, 0x7}, &(0x7f0000000340)={0x0, 0x2710}) [ 708.766750] binder: 16239:16241 Acquire 1 refcount change on invalid ref 0 ret -22 [ 708.766757] netlink: 8 bytes leftover after parsing attributes in process `syz-executor4'. [ 708.786118] netlink: 8 bytes leftover after parsing attributes in process `syz-executor4'. 01:57:02 executing program 4: r0 = syz_open_dev$adsp(&(0x7f0000000080)='/dev/adsp#\x00', 0x42a, 0x10040) ioctl$KVM_ASSIGN_PCI_DEVICE(r0, 0x8040ae69, &(0x7f00000000c0)={0x7ff, 0x1, 0x8, 0x0, 0x7}) r1 = syz_open_procfs(0x0, &(0x7f0000000780)="2f65786500000000000409004bddd9de91be10eebf000ee9a90f798058439ed554fa07424adee901d2da75af1f0200f5ab26d7a071fb35331ce39c5a") ioctl$KVM_IOEVENTFD(r1, 0xc0c0583b, &(0x7f0000000040)) 01:57:02 executing program 5: perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1f}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000340)={&(0x7f0000000000), 0xc, &(0x7f0000000300)={&(0x7f0000000240)=@newlink={0x50, 0x10, 0x721, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x500}, [@IFLA_LINKINFO={0x28, 0x12, @veth={{0xc, 0x1, 'veth\x00'}, {0x18, 0x2, @VETH_INFO_PEER={0x14}}}}, @IFLA_NET_NS_FD={0x8}]}, 0x50}}, 0x0) 01:57:02 executing program 3: r0 = socket$inet(0x2, 0x3, 0x2) connect$inet(0xffffffffffffffff, &(0x7f0000000000)={0x2, 0x0, @local}, 0x10) setsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x23, &(0x7f0000000000)={{{@in=@multicast2, @in=@multicast1}}, {{@in6}, 0x0, @in6=@loopback}}, 0xe8) syz_emit_ethernet(0x2a, &(0x7f0000000640)={@random="b100485caa2a", @link_local, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x1c, 0x6, 0x0, 0x0, 0x2, 0x0, @rand_addr, @broadcast}, @igmp={0x11, 0xffffffffffffffff, 0x0, @multicast1}}}}}, &(0x7f0000000140)) 01:57:02 executing program 0: socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000001f80)={0xffffffffffffffff, 0xffffffffffffffff}) setsockopt$SO_ATTACH_FILTER(r2, 0x1, 0x1a, &(0x7f0000ab9ff0)={0x2, &(0x7f000039a000)=[{0x20, 0x0, 0x0, 0xfffffffffffff010}, {0x6}]}, 0x10) sendmmsg(r1, &(0x7f0000001e80)=[{{&(0x7f0000000700)=@l2, 0x80, &(0x7f0000001dc0), 0xffffff7f}}], 0x1, 0x0) [ 708.946704] binder: 16239:16241 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 709.022326] binder: 16239:16271 Acquire 1 refcount change on invalid ref 0 ret -22 [ 709.085736] binder: 16239:16271 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 01:57:03 executing program 6: r0 = syz_open_dev$sndseq(&(0x7f0000000100)='/dev/snd/seq\x00', 0x0, 0x0) read(r0, &(0x7f0000fb6000)=""/28, 0x3f0) ioctl$SNDRV_SEQ_IOCTL_REMOVE_EVENTS(r0, 0x4040534e, &(0x7f00000001c0)={0xbf}) ioctl$SNDRV_SEQ_IOCTL_QUERY_SUBS(r0, 0xc058534f, &(0x7f00000002c0)={{}, 0x1, 0x0, 0x0, {}, 0x0, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xe]}) r1 = gettid() timer_create(0x0, &(0x7f0000044000)={0x0, 0x12}, &(0x7f0000000040)) r2 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r2, 0x8912, &(0x7f00000001c0)="0a5cc80700315f85715070") timer_settime(0x0, 0x0, &(0x7f0000000080)={{0x0, 0x989680}, {0x0, 0x9}}, &(0x7f0000040000)) tkill(r1, 0x1000000000014) 01:57:03 executing program 2: r0 = socket$inet(0x2, 0x3, 0x2) connect$inet(0xffffffffffffffff, &(0x7f0000000000)={0x2, 0x0, @local}, 0x10) setsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x23, &(0x7f0000000000)={{{@in=@multicast2, @in=@multicast1}}, {{@in6}, 0x0, @in6=@loopback}}, 0xe8) syz_emit_ethernet(0x2a, &(0x7f0000000640)={@random="b100485caa2a", @link_local, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x1c, 0x0, 0x0, 0x0, 0x2, 0x0, @rand_addr, @broadcast}, @igmp={0x11, 0x0, 0x0, @multicast1}}}}}, &(0x7f0000000140)) r1 = dup3(r0, r0, 0x80000) write$RDMA_USER_CM_CMD_CREATE_ID(0xffffffffffffff9c, &(0x7f0000000200)={0x0, 0x18, 0xfa00, {0x2, &(0x7f00000001c0)={0xffffffffffffffff}, 0x13f, 0x4}}, 0x20) write$RDMA_USER_CM_CMD_JOIN_IP_MCAST(r1, &(0x7f0000000240)={0x10, 0x30, 0xfa00, {&(0x7f0000000180), 0x4, {0xa, 0x4e22, 0x7, @mcast2, 0x2}, r2}}, 0x38) socket$inet(0x2, 0x6, 0x6) setsockopt$inet_sctp_SCTP_SOCKOPT_BINDX_ADD(r0, 0x84, 0x64, &(0x7f0000000100)=[@in6={0xa, 0x4e22, 0x7fffffff, @local, 0x67}, @in6={0xa, 0x4e22, 0xb7c0, @loopback, 0x4}], 0x38) 01:57:03 executing program 4: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000000)="0a5cc80700315f85715070") memfd_create(&(0x7f000000e000)='\x00 ', 0x0) r1 = syz_open_dev$sndseq(&(0x7f0000000180)='/dev/snd/seq\x00', 0x0, 0x101801) r2 = syz_open_dev$vcsa(&(0x7f0000000100)='/dev/vcsa#\x00', 0x6, 0x121080) r3 = syz_open_dev$sndctrl(&(0x7f000000a000)='/dev/snd/controlC#\x00', 0x0, 0x0) clone(0x80008000, &(0x7f0000001080)="49889fa7886c830d17c0cbfc43be5efa3c57580442340959bd84945f4c9ea8c4eb12981af16ea489171b7437cf7b761f583b49477310d60d90454519da67341e6b9972b3ae08263e9a0fe11181ad41c6a8cc37dc87157bd98eca0a23b1a47848a54de0b7d4386fa278f2e931d99ed182f87e52a85a4440132625306278c71f2c27feac5e88cb8dadb289e8b9a614606a453d58b251d580b9fb93f55fdcb8016e4d0f923ccaed04c5f74188bb0bca3b5b030e358fa0a7657731d373b638dff7e766c5d577ee0583383e74ba9ff2c8e297324d59db8db95704da712514e98fd6c5a25f5506c81fbed2ebb94cba53ee331164aec062c6d4d6c52a6480e109f6f835e9e76899f2174e1079d3418f7ce8e2646577a36c254e8ba513871b037d14de5d2298b7f1c3008426034e89f74981adabb81860b8a92c97fd26623b15a6e74924497f3e5ec4ba10e9f5227ba4475523d4c91d3f1d29d7574580fd52dbd50c88e12d7da485e7ff4d7784a1ea947e30d12a623daf468aba28301ab92dc4cab3c7a9e43684db68253357ac8d06d9f4305e7567792751edd3e19ddcd14a1c734f2ac8490a3e46a8043755f1c56c70d19e1c1db6a28aa76db1d1d1cd3225eb4b3f13772354ff6a04a4fd7dbf797b3f8e257d809517fa5b92df5174f45bff92b6adb9e2cf640d5dfc8e293d1ae04610894b452c38c54b551e47e1c77a8c16f4eeb0332938346c523304c270524d78141956926c197a5f6ce0d766bc58a449f86cd6076d9c39b1d6c69faf81406b9cac6106e1290c3a889789703a01ea15737d9f678513d508106f9fe715529b26d8827149f4da354e09b9460b0e34236d721de665266d5c68c5c789ace56f064cfa969a3407c5388682e6baf1590bfc1901373326f4bc3cfb57a1b42e433f4c8ff0fd4041d21fe42d7df7ec3f32c39cf2a7e041294fc90eda2cd65913127cadbee2cbc9b515d39581e6c55c23dec520fbe91d154ae6c16a96595fe0dc544ac4b664fe891dc10cf576fd5aaf45b723a3f0dcf407ad51a57f41768326208c03fedd14a6a61617fe1f27175e327d4825d0103f22c88ab9933bca021542220cd809024822be2a0b36376ec40cfa997cf444c603b1f4113ef932eff24e726310a53013433bc14e6d3abbf5153e901da38af2657f863b37cc8389624050b6484225ba37d0c66cd279eac2956ad74375ac3fb71c07e178697fdec19ee7fbd1951b880864fdef06c8c98be5ffd4eb161452f8f7214f77aa7991295eef7745e73e175d5a86104ab8e1d1add49db301ce4c2c69a188a497e58a661c9f238c41b2fc2827e61796ef3565fd18e74df755adb1599379ff9ab7d7519643513907cec5a99b63670a90674ee67449ff1adce319080d6e03f17b2fb150c6a5427a52667fe29c64b1a9cad0256522b91ea693635608be69d448f988f5d1df61095e6dbf6369d339ea3d8011c1e5a86f35c6726fc714f4da0b2fee9461d2a22f8b37d8c8b1f7163c6ec00692d77292d3112d4a852dc3d805002fa5fae97a303c9fc85212cdb95abe6a397609d181630449d5b75f989710bcb2d12bbf769ffbb21e2ee89ddc05e5ff8c303021370ad69959200bc7d33752742c515d69c50e3665c596d69a8ac695926493ceb17e8ba39e63e68601b5223f0273cd03afb23df4a6b5e50c52e8e39fc88f790a15e0da649b6aa8ddd34dc0314c9558347d545cd35a81ad158002932060df739635ecdf17cfc9d320c1bf1eb5987c6842c38d43a2b04457bb91125d4759fdf4efbc708470abd3bf713ea5b1a6385659890cf9742f31934b7ded7769846b28b713c23d0ba474e3ef23cae2422ff335d35b965ba8a713058f26534c1c5eb891702e77b122de97a58891870d691bb92d4ab40d3f2817111587b071a5bac7d6e215d54c1001795064b627858f16df2bceaa5c3f948a159fcf4cebfa81a57019bffbf3eaea82d53320e23be23758f92ac590e12533760409884b6f7d2be3dc8287708d1eb73348f15adbd566b82e5088f8e31a0ae84b0f2d00a4373d49f848fa3943946f822c28b73c20bd4fc8952256e4975b837f60b8253a51a4ae68694839b092473a461de7b85a55982c95548c18812fea40ae7e0875be411808ffd77c0f1e8db3faa55ff0774ef85889de3ec7e9e2a28bd546d6a010cf6001243bced98c50ed48bf71f78d177e8ba12a9ed1fcfd6bc36feb14d44ff6aeeabee9737ea696fec63aa97cd0f1a62ee272405b5a8a62aa0d9fdfc878c82012f7ef106aa9cdcc63f71bda7262e236b8a8ea077963249c1edc9dcb1def6282aed1768bef6250c9684fbb1d253cf94a6642bcb20e767f7c49ad8f55bc8cb1606af9abecda4d9568eacb22b997c5491536d3d09c4103e9ddb22d6a7699e86fe8baadeda32012ecbac26eeceb8b4c4f5902b803cfd559b5facc65030a0f7dde47e524be9955ad95af8615b8938e55f91146451977e6badd758b0efc0d497c82ad4f30f023f22be7f0ac50e068cc511c6c5c4542ce2a3fdaefdc213c65389a06a65d5a4a416d7d075763ecb86cafaa720bb8ac334fe46d1a6fe5856a9c1b45510ec4940ba4bebf31dc7101f85bca2ca318c9cfab7e07281623ff4089c8ed1f8136fee974859da3b488569aca106439249be0833695c210e22425ec04144fa293758235956270fecf4d53329edbd7c2644672d29c59ce1e55859dc3e517c5cc50ffd98d9509ce6c2e11ed772541779a2357e9fb80b955f507c2b29ed962e2afd75e9ce645755708d9ccf288797b771238d39fe2327db9ff3dba641eae8175a1ec1fa6edb28574467374f6c04fed8ce4b1ff2a2007f5f14fd85a40683aec09925e825cb5c3445bc33d65e5192db440916edd892597a85142b4dfd4c65ac9b3dc7e1d1093838cc6723913327091be92605142c61aa912d68fd3ebeebe6f37cc68d0ac5d5c5b9cb82da7cb022dc0b0ba03fdab645dc0a1f84ad7b30b5b42a7d9d2a16259e2d7aa55833834b0b23a2f27dd97cf2e567352c3648d962ae26f10e60549f3fbe1a871639b9c32126eac750cdcba1200236034336dfc3a10c21db3b026b8123030bb10d774b5544bd76d61e7b7737ee24ccdf16359cfd81f8d57edba3fba354fd80cea6323c26ab9ce784cc5c4e58f0787eebfd97ba4f7a89053976ada94e7a5156d22df09c9a60a203cd3bd6feb526262a0c0fbf4c3bc2285150b793e451bf8d50ce24286b7c2266321d1b153a795552d52054744a0f0924f90c69cb079288a76c8b8bb3dfd764ec1b1e615033681d5146358e57c6d0679367ba03c71a7366784b3fec06b3f5a00a752fd8dc57917f276d4415796a232dafe3a092d3cb14ddc5480b3cce03a8303ecc40ff8f63ffea89cb002ea30731456ec1873c92d84f4297997e0d0cabbf082e24e1ebb581002a02e318cdf7e0a82b87c0ac8bb5eeb7fa70cc71ef4644a6d3c091de7df543e81e2dcafc339ee97b494d5a05b8168ed716856d16b9517e22672e99dbb26dedb9bb9856ecffb4547e757bde2c7ee593a68c59dea5fbda8c9f829476c2a59cf2007b9426e3b40358f666aef37029f0d6fc5e0f86b6f2d2906b03347c78da69c952e17798f62d74a486a6100c6038189b2447c9aa2a90d201193780bca07d8d484180bbdf381b8f9f86194fc4227870223dc6f8899d89f59f164c6c8230885ed70d1566e7aa54e99c67fc23b935b90ec48d6ccb6bb2f0594fc884c07b27b9a9b1a3a7273fdd1f580bf0e495eb578eb77134f912b2877752344a685e8abaad31a704a0ed38c6e70a4b6aaaff21a1a868c056e5ffbcbeaba86490caf782dc4ccb9094fdc68aec068cc1756c97eb0f7ba81b69864ba87044771234766cf04c83818371cc8dba995d023ad0c08e1fa84c16fd2d67d61f7d26b987859560333efa4a96c3b8b25d21dcdb9e2d9ba47fa1c5012e25137755246aff689da3ed8511fb9138c5211ade9cfc9fd02253d8a3481cd61d2e4072464f28599b40238da4c8bc76619b9cc6a597b25b218b924cba235e26dbb2a2e78dfd38a819f0282d0cfff977355853f104995cd621513e9dbd49c46cb0969a76350bc2c055bede2e40c45af37819d031fbb0374a6848ed7dccd4e2b14c4a4b13a2bb80ff2f60dcffb45ca7c22f9e964f5840ef3e32abddc0088e71b7b50d7cfc2d24cdaaffeb75102f0a7e000a3f8e4333d22805db9230bea815b017d06e6a45c1b7aa1a2501b428d8ea9edf97f5f3514bc7135ba8579347e42cef6bd0d61955fbc7a608c1430ef5700b6ddd1727205aeeed650761a30d660cbef4d8f2813485344c68217261fe2d82fda708f94c42de6398b3447aa1eb0df33d387a785f4a9e2187fe6ab23750fdb465b60a8fc8c6a76f35f38cd810bc01ba13be501cede57b6ca1724eeab420090f6fc040374756c9cb4200919e80af2b9d26f0d0638357daa7f76bed312495ab1697a39dcfa21e336c62807746fbceda9e78dce617cfe38a6c9c9248539fd9aa2e4a622af2dcf62a5bce4b208548b091122cccd9ffe6872fdce2467e447f085ff090ed58b4da746496720e6a12fc1f2e45d809428d770aea06242b77ce5052bbd651cf71bb87959a12e10fb60b19a7af70679200149118b5d8c329579600b61df2816e866071c3521ce2d1e1636c3220a718742e23fd16ed098a95d9a82caa9042597a857df047bf614ac929a6df09d92cfe95b2728f87eb4eb81fc578f10eeb5a76cebbfc34dcf5278e9a294b82c57095f07cb327f79ee62485ef7b127d70ff40a46e4513d5a0429d497d107c86589fbac470fe754aceabee2641693f427e244d98c8399584ae2677a4973c1f950d38f3236dc0cc1024547294cc2bc77a8963a34aff4e71b48689222ef7b3c3f5ec93dd7c614ded95b4842784765520bd65cd911b94022253d78bb939b867df831cc599b4fd9def5f40b97069326418f12a5fe2a0db816c6db8f69a3d7e83c0bbce1f90c9130bcc069b4855a3e03f26e8195bfc2829c1aeaad06106c8015bf363d0ceac74491393dd7de076ea8dc1ccd87c512b25287e6db2404abf3180616bd8eb42a602715af3d83619771b54fe2b6af7d2b3cbde3db865d0d3b26213b82d1c38f30839d29f82158ad8ccdd875b6c5a88358bf3cd83da58527dd3898d412e2fe38dbe358d60c6585ae49ef57aef726ab3eb8d51dd7a3ab8293244917abc1b1a50615176034088d022dfbe761f49737082c19eb92dfd8982b7839a7621943c838c3387519b1c3c672ff32a946de267e3feebf3adcca895346f7fc6381614e5cfd902f491fc07857a3e8f831516f99c653e235d4d42cd300d82bd1bf0d0896fd7cbb8c8cf86e3414fe815933c75d2239a55fc6a02e405d8c230e70690c46577d7893b88c8f229a825cabd534d3655dafbc3c15f99ccfdfe08420462854490cdebf6c2393467a5e5689c567eeaa95eb1be94b1a465743ce2897258fa76c16017c30a784a55cbe2dec12bb996dbb9a9c8d33a2b8476b043114567a7bb9ebefab7ae8b2f5df011f180f1356c087963257dc8b035e738bafb510e07bc3f682f11ce8c33e0ea23144ff9b29377fa5466f3ad19f5aad820220f7555d54a5e589f5acc38e118b21b7c55e52878dc0989f13411bd72cce7f596bee1ecb9bd3c97a4da68c083b9b0749c31e363e04da607a1455753e4169bbccb919c33a0a6241a51369ea99e3156cb0e1edd54520551d81ca803e94b7f03b81e0897d7c91a348ae049c8002e2378cb40d1ab9d46687b8cf5e512eda51a471ccb148d8fb173e71ba515d8e7c15d765d37bc5d3eb", &(0x7f0000000140), &(0x7f0000000200), &(0x7f0000000240)="da4e95d81e83be97314b5c4139e6f3683ed7e6a0a8fde258ab77130337dd1c80cdab5f848212ef") ioctl$int_out(r2, 0x5460, &(0x7f0000000640)) socketpair$inet6_udplite(0xa, 0x2, 0x88, &(0x7f0000000300)) perf_event_open(&(0x7f0000001000)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8ce, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) fcntl$getownex(r3, 0x10, &(0x7f00000002c0)) r4 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r4, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") bpf$MAP_CREATE(0x0, &(0x7f0000346fd4)={0x0, 0x0, 0x0, 0x894, 0x10}, 0x2c) bpf$PROG_LOAD(0x5, &(0x7f00000ba000)={0x1, 0x5, &(0x7f0000346fc8)=@framed={{}, [@alu={0x8000000201a7f19, 0x0, 0x201a7fa6, 0x48, 0x1}]}, &(0x7f00000006c0)='GPL\x00', 0x0, 0xfb, &(0x7f0000000cc0)=""/251, 0x0, 0x0, [], 0x0, 0x1}, 0x48) sendmsg$nl_netfilter(r2, &(0x7f0000000780)={&(0x7f0000000280)={0x10, 0x0, 0x0, 0x20000000}, 0xc, &(0x7f00000003c0)={&(0x7f00000004c0)=ANY=[@ANYBLOB="100400000103220429bd7000fddbdf250300000008002f0004000000157b801bc38a2d0b333b53ab75421ac1d5fb7946149ea83b8110088152ed3cac3fafed2e12fef726cc714e7fc0e35fe18f87dde119b60c6876f7a5367aabaa75643f95e07547e5c7095ba1081a867b6b8a058061fc41f2be55d99069dbf54e4a97872fb387107744a024644c39f1e34f0c0183004738c61881c0d3e4352bc692d1abfb0d9ce345bf5fc4bb40dcc9b52e6b97ff2de12ae3f02ef365a3baaff2edd75d81e7b6679238752967fc74e3fccafd2a28633333d48420574d0e498e916f7134195b529009d7cc7ea0498babf719ce72b420ecc55156201f6f0d038bb07938cb1d4f6b674e540cca6f4eb850cc0dc8af11af2272053a5a57ed82ceeb029e844f38d218132f07356677e79d4850415ae184f2d8852b157e74234d98f96367950d3980a8a7477fff6e503e0ce6d6ceb2dbe1454376562ee912d48c3c08008d00"], 0x15d}, 0x1, 0x0, 0x0, 0x20400095}, 0x40010) r5 = socket$nl_netfilter(0x10, 0x3, 0xc) perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0xf, 0x100, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1f}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendmsg$nl_netfilter(r5, &(0x7f0000d65000)={&(0x7f00000000c0), 0xc, &(0x7f0000000040)={&(0x7f0000000080)={0x14, 0xa, 0xa, 0xffffffffffffffff}, 0x14}}, 0x0) arch_prctl(0x1004, &(0x7f0000000700)="e45f5e9d151aebc80818259f5a4e20d009bf88f15d61eb13649980ab3b3536755cf3cf4bfb30d483b94ebbcb340b27bb3c2f49bf6b101e16c2389e8ef8b0a468217c0294e3604303f90967b16c93207a041638221ed37566096a06cf57e0fbf165e410775585b022172664d03066f231396854445ab8bd") ioctl$KVM_SET_MP_STATE(r2, 0x4004ae99, &(0x7f0000000680)=0x3) syz_open_dev$ndb(&(0x7f00000007c0)='/dev/nbd#\x00', 0x0, 0x80000) ioctl$EVIOCGEFFECTS(r2, 0x80044584, &(0x7f0000000800)=""/21) ioctl$KVM_SET_NR_MMU_PAGES(r2, 0xae44, 0x7) write$FUSE_NOTIFY_INVAL_INODE(r2, &(0x7f0000000380)={0x28, 0x2, 0x0, {0x2, 0xb1, 0x4}}, 0x28) ioctl$SNDRV_CTL_IOCTL_PVERSION(r3, 0xc0405519, &(0x7f0000001000)) r6 = dup2(r0, r1) ioctl$SNDRV_SEQ_IOCTL_CREATE_QUEUE(r6, 0xc08c5332, &(0x7f000002b000)={0x0, 0x0, 0x0, "9ede7a8c5ae95ec8672c93340f643a664f13eeab65c0322901dc6bd36cde2c51f01b7f0b014f9f91eeb7c37c7240f476c8d753d000aa8faf8fb574dbcfa6dc4d"}) clock_adjtime(0x7, &(0x7f0000000380)={0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5118, 0x1891, 0x0, 0x2, 0x0, 0x0, 0x10000, 0x0, 0x0, 0xffffffffffffff7f, 0x0, 0x0, 0x0, 0x0, 0x80000000000000}) 01:57:03 executing program 1: r0 = socket$inet6(0xa, 0x805, 0x8) r1 = syz_open_dev$usbmon(&(0x7f0000000080)='/dev/usbmon#\x00', 0x9, 0x2) r2 = syz_open_dev$adsp(&(0x7f00000000c0)='/dev/adsp#\x00', 0x401, 0x140) fanotify_mark(r1, 0x63, 0x8, r2, &(0x7f0000000100)='./file0\x00') fsetxattr(r0, &(0x7f0000000000)=@known='com.apple.system.Security\x00', &(0x7f0000000040)='ppp1\x00', 0x5, 0x0) ioctl$KDSETMODE(r2, 0x4b3a, 0x81) mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x1, 0x31, r0, 0x0) keyctl$dh_compute(0x17, &(0x7f0000000340), &(0x7f0000000480)=""/216, 0xd8, &(0x7f0000000600)={&(0x7f0000000580)={'tgr160-generic\x00'}, &(0x7f00000005c0)}) 01:57:03 executing program 5: perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1f}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000340)={&(0x7f0000000000), 0xc, &(0x7f0000000300)={&(0x7f0000000240)=@newlink={0x50, 0x10, 0x721, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x700000000000000}, [@IFLA_LINKINFO={0x28, 0x12, @veth={{0xc, 0x1, 'veth\x00'}, {0x18, 0x2, @VETH_INFO_PEER={0x14}}}}, @IFLA_NET_NS_FD={0x8}]}, 0x50}}, 0x0) 01:57:03 executing program 3: r0 = socket$inet(0x2, 0x3, 0x2) connect$inet(0xffffffffffffffff, &(0x7f0000000000)={0x2, 0x0, @local}, 0x10) setsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x23, &(0x7f0000000000)={{{@in=@multicast2, @in=@multicast1}}, {{@in6}, 0x0, @in6=@loopback}}, 0xe8) syz_emit_ethernet(0x2a, &(0x7f0000000640)={@random="b100485caa2a", @link_local, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x1c, 0x7, 0x0, 0x0, 0x2, 0x0, @rand_addr, @broadcast}, @igmp={0x11, 0xffffffffffffffff, 0x0, @multicast1}}}}}, &(0x7f0000000140)) 01:57:03 executing program 0: socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000001f80)={0xffffffffffffffff, 0xffffffffffffffff}) setsockopt$SO_ATTACH_FILTER(r2, 0x1, 0x1a, &(0x7f0000ab9ff0)={0x2, &(0x7f000039a000)=[{0x20, 0x0, 0x0, 0xfffffffffffff010}, {0x6}]}, 0x10) sendmmsg(r1, &(0x7f0000001e80)=[{{&(0x7f0000000700)=@l2, 0x80, &(0x7f0000001dc0), 0x3e80}}], 0x1, 0x0) 01:57:03 executing program 7: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000180)='/dev/sequencer\x00', 0x10002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000080)="0a5cc80700315f85715070") r1 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000001c0)={0x2, 0x0, &(0x7f0000000140)=ANY=[@ANYBLOB='\fc'], 0x0, 0x0, &(0x7f0000000080)}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, &(0x7f00000001c0)}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000040)={0x8, 0x1000000, &(0x7f00000000c0)=[@release={0x400c630f}], 0x1, 0x0, &(0x7f0000000100)='V'}) fstat(r0, &(0x7f00000002c0)) 01:57:03 executing program 3: r0 = socket$inet(0x2, 0x3, 0x2) connect$inet(0xffffffffffffffff, &(0x7f0000000000)={0x2, 0x0, @local}, 0x10) setsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x23, &(0x7f0000000000)={{{@in=@multicast2, @in=@multicast1}}, {{@in6}, 0x0, @in6=@loopback}}, 0xe8) syz_emit_ethernet(0x2a, &(0x7f0000000640)={@random="b100485caa2a", @link_local, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x1c, 0x3, 0x0, 0x0, 0x2, 0x0, @rand_addr, @broadcast}, @igmp={0x11, 0xffffffffffffffff, 0x0, @multicast1}}}}}, &(0x7f0000000140)) 01:57:03 executing program 5: perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1f}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000340)={&(0x7f0000000000), 0xc, &(0x7f0000000300)={&(0x7f0000000240)=@newlink={0x50, 0x10, 0x721, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x10}, [@IFLA_LINKINFO={0x28, 0x12, @veth={{0xc, 0x1, 'veth\x00'}, {0x18, 0x2, @VETH_INFO_PEER={0x14}}}}, @IFLA_NET_NS_FD={0x8}]}, 0x50}}, 0x0) 01:57:03 executing program 2: r0 = socket$inet(0x2, 0x1, 0x80010001) connect$inet(0xffffffffffffffff, &(0x7f0000000000)={0x2, 0x0, @local}, 0x10) setsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x23, &(0x7f0000000000)={{{@in=@multicast2, @in=@multicast1}}, {{@in6}, 0x0, @in6=@loopback}}, 0xe8) syz_emit_ethernet(0x2a, &(0x7f0000000640)={@random="b100485caa2a", @link_local, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x1c, 0x0, 0x0, 0x0, 0x2, 0x0, @rand_addr, @broadcast}, @igmp={0x11, 0x0, 0x0, @multicast1}}}}}, &(0x7f0000000140)) [ 709.646449] binder: 16310:16315 Acquire 1 refcount change on invalid ref 0 ret -22 01:57:03 executing program 1: perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10000003, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$midi(&(0x7f0000000040)='/dev/midi#\x00', 0x7, 0x8004) write$cgroup_type(r0, &(0x7f0000000080)='threaded\x00', 0x9) r1 = syz_open_dev$sndmidi(&(0x7f0000000380)='/dev/snd/midiC#D#\x00', 0xe440, 0x1) write$cgroup_type(r1, &(0x7f0000000000)='threaded\x00', 0xfeb6) [ 709.760684] binder: 16310:16315 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 01:57:03 executing program 3: r0 = socket$inet(0x2, 0x3, 0x2) connect$inet(0xffffffffffffffff, &(0x7f0000000000)={0x2, 0x0, @local}, 0x10) setsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x23, &(0x7f0000000000)={{{@in=@multicast2, @in=@multicast1}}, {{@in6}, 0x0, @in6=@loopback}}, 0xe8) syz_emit_ethernet(0x2a, &(0x7f0000000640)={@random="b100485caa2a", @link_local, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x1c, 0x60, 0x0, 0x0, 0x2, 0x0, @rand_addr, @broadcast}, @igmp={0x11, 0xffffffffffffffff, 0x0, @multicast1}}}}}, &(0x7f0000000140)) 01:57:03 executing program 5: perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1f}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000340)={&(0x7f0000000000), 0xc, &(0x7f0000000300)={&(0x7f0000000240)=@newlink={0x50, 0x10, 0x721, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x600000000000000}, [@IFLA_LINKINFO={0x28, 0x12, @veth={{0xc, 0x1, 'veth\x00'}, {0x18, 0x2, @VETH_INFO_PEER={0x14}}}}, @IFLA_NET_NS_FD={0x8}]}, 0x50}}, 0x0) 01:57:03 executing program 2: r0 = socket$inet(0x2, 0x3, 0x2) connect$inet(0xffffffffffffffff, &(0x7f0000000000)={0x2, 0x0, @local}, 0x10) setsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x23, &(0x7f0000000000)={{{@in=@multicast2, @in=@multicast1}}, {{@in6}, 0x0, @in6=@loopback}}, 0xe8) syz_emit_ethernet(0x1dd, &(0x7f0000000200)={@dev={[], 0x15}, @link_local, [], {@ipv4={0x800, {{0x38, 0x4, 0x81, 0xffffffffffff8950, 0x1cf, 0x64, 0x2, 0xffffffff, 0x7f, 0x0, @remote, @rand_addr=0x81, {[@ra={0x94, 0x6, 0x100000001}, @noop, @generic={0x89, 0x10, "0d7deb794161054b5dc348a0e6ed"}, @ra={0x94, 0x6, 0x5}, @timestamp={0x44, 0x28, 0x2, 0x0, 0x5, [{[], 0x7ff}, {[@rand_addr=0x1000], 0x4}, {[@multicast1], 0x2}, {[], 0x81}, {[], 0x4}, {[@multicast2], 0x5}]}, @noop, @cipso={0x86, 0x51, 0x9, [{0x5, 0x8, "ac64864b8c9b"}, {0x3, 0x3, "e9"}, {0x2, 0xc, "1ea40d469120bd26679d"}, {0x7, 0xe, "82e4ced48ad916d004d8829e"}, {0x5, 0xd, "e734ed0b261769e5cfe534"}, {0x5, 0x7, "2f02189ab6"}, {0x7, 0xc, "2ce7bce164c1640836fa"}, {0x0, 0x6, "dee8eff9"}]}, @timestamp={0x44, 0x20, 0x66, 0x3, 0x4, [{[], 0x9}, {[@rand_addr=0x1], 0x9}, {[@multicast1], 0x7a2}, {[], 0x3ec6}, {[], 0x8}]}, @ra={0x94, 0x6, 0xffffffffffffff85}, @rr={0x7, 0xf, 0x1ff, [@dev={0xac, 0x14, 0x14, 0x18}, @loopback, @dev={0xac, 0x14, 0x14, 0x16}]}]}}, @udp={0x4e23, 0x4e20, 0xef, 0x0, [@guehdr={0x1, 0x3, 0x9, 0x80000000, 0x100}, @guehdr={0x1, 0x9, 0x40, 0x4, 0x100}, @guehdr={0x1, 0x9, 0x8, 0x5, 0x100}], "5fdc5058f63af653f4c5b779d980e7f8f441239d2e452539ab15750645f7a744ced5ade112611d26439106b1d8fc5c881fcf2ab2b8fadbbc03b886d7fc1e6423f14af1ad78c0ae4122cc01831ec22ecec2ad459351c8b4efcacc487f54b03c9deda9c6ae95816a503aa6287ad1f7f0c713b3ca84e0f97461fa103b27468a6292eb039149195511928728962db7121696451a4588675568c8ab6eed5e0e7ddda73e67035c695bb7a5bbf68ea6c483fb249fdef49552a6a365bec082b2c569c22eeb0697f8a4c31eff773b5e9f504eea80cc73ecd35546e8541afd4a"}}}}}, &(0x7f0000000140)={0x1, 0xfffffffffffffffd, [0x0, 0x0, 0x84c, 0xfffffffffffffffe]}) 01:57:03 executing program 0: socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000001f80)={0xffffffffffffffff, 0xffffffffffffffff}) setsockopt$SO_ATTACH_FILTER(r2, 0x1, 0x1a, &(0x7f0000ab9ff0)={0x2, &(0x7f000039a000)=[{0x20, 0x0, 0x0, 0xfffffffffffff010}, {0x6}]}, 0x10) sendmmsg(r1, &(0x7f0000001e80)=[{{&(0x7f0000000700)=@l2, 0x80, &(0x7f0000001dc0), 0x1100000000000000}}], 0x1, 0x0) [ 709.904153] binder: 16310:16348 Acquire 1 refcount change on invalid ref 0 ret -22 [ 710.139664] binder: 16338 RLIMIT_NICE not set [ 710.194628] binder: 16310:16348 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 01:57:04 executing program 3: r0 = socket$inet(0x2, 0x3, 0x2) connect$inet(0xffffffffffffffff, &(0x7f0000000000)={0x2, 0x0, @local}, 0x10) setsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x23, &(0x7f0000000000)={{{@in=@multicast2, @in=@multicast1}}, {{@in6}, 0x0, @in6=@loopback}}, 0xe8) syz_emit_ethernet(0x2a, &(0x7f0000000640)={@random="b100485caa2a", @link_local, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x1c, 0x600000000000000, 0x0, 0x0, 0x2, 0x0, @rand_addr, @broadcast}, @igmp={0x11, 0xffffffffffffffff, 0x0, @multicast1}}}}}, &(0x7f0000000140)) 01:57:04 executing program 4: r0 = openat$qat_adf_ctl(0xffffffffffffff9c, &(0x7f0000000100)='/dev/qat_adf_ctl\x00', 0x4400, 0x0) setsockopt$inet6_int(r0, 0x29, 0xc9, &(0x7f0000000140), 0x4) mmap(&(0x7f0000001000/0x1000)=nil, 0x1000, 0xc, 0x32, 0xffffffffffffffff, 0x0) r1 = socket(0x2, 0x1, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f0000000000)=@broute={'broute\x00', 0x20, 0x2, 0xe78, [0x0, 0x0, 0x0, 0x0, 0x0, 0x200007c0], 0x0, &(0x7f0000000080), &(0x7f00000007c0)=[{0x0, '\x00', 0x0, 0x0, 0x1, [{{{0x11, 0x0, 0x0, 'veth0_to_team\x00', 'ipddp0\x00', 'bridge_slave_0\x00', "7465616d5f73ff5e76655f30004000", @local, [], @link_local, [], 0x938, 0xab0, 0xae0, [@among={'among\x00', 0x850, {{0x0, 0x0, 0x0, {[], 0x1, [{[], @dev}]}, {[], 0x3, [{[], @dev}, {[], @local}, {[], @broadcast}]}}}}, @helper={'helper\x00', 0x28, {{0x0, 'H.245\x00'}}}]}, [@common=@RATEEST={'RATEEST\x00', 0x20, {{'syz0\x00'}}}, @common=@SECMARK={'SECMARK\x00', 0x108, {{0x0, 0x0, 'system_u:object_r:usb_device_t:s0\x00'}}}]}, @common=@NFQUEUE0={'NFQUEUE\x00', 0x8}}]}, {0x0, '\x00', 0x1, 0x0, 0x1, [{{{0x0, 0x0, 0x0, 'bond_slave_0\x00', 'veth1_to_bridge\x00', 'syz_tun\x00', 'eql\x00', @broadcast, [], @broadcast, [], 0xa8, 0x1d8, 0x308, [@mac={'mac\x00', 0x10}]}, [@common=@SECMARK={'SECMARK\x00', 0x108, {{0x0, 0x0, 'system_u:object_r:var_spool_t:s0\x00'}}}]}, @common=@SECMARK={'SECMARK\x00', 0x108, {{0x0, 0x0, 'system_u:object_r:bsdpty_device_t:s0\x00'}}}}]}, {0x0, '\x00', 0x2}]}, 0xef0) r2 = socket$inet6(0xa, 0x1000000000002, 0x0) setsockopt$netlink_NETLINK_LISTEN_ALL_NSID(r1, 0x10e, 0x8, &(0x7f00000000c0)=0x9, 0x4) ioctl(r2, 0x8912, &(0x7f0000000280)="0a5cc80700315f85714070") sendto(0xffffffffffffffff, &(0x7f00000002c0), 0x0, 0x40000, 0x0, 0x0) 01:57:04 executing program 6: r0 = syz_open_dev$sndseq(&(0x7f0000000100)='/dev/snd/seq\x00', 0x0, 0x0) read(r0, &(0x7f0000fb6000)=""/28, 0x3f0) ioctl$SNDRV_SEQ_IOCTL_REMOVE_EVENTS(r0, 0x4040534e, &(0x7f00000001c0)={0xbf}) ioctl$SNDRV_SEQ_IOCTL_QUERY_SUBS(r0, 0xc058534f, &(0x7f00000002c0)={{}, 0x1, 0x0, 0x0, {}, 0x0, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xbf000000]}) r1 = gettid() timer_create(0x0, &(0x7f0000044000)={0x0, 0x12}, &(0x7f0000000040)) r2 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r2, 0x8912, &(0x7f00000001c0)="0a5cc80700315f85715070") timer_settime(0x0, 0x0, &(0x7f0000000080)={{0x0, 0x989680}, {0x0, 0x9}}, &(0x7f0000040000)) tkill(r1, 0x1000000000014) 01:57:04 executing program 2: r0 = socket$inet(0x2, 0x3, 0x2) connect$inet(0xffffffffffffffff, &(0x7f0000000000)={0x2, 0x0, @local}, 0x10) r1 = syz_open_dev$vcsn(&(0x7f0000000100)='/dev/vcs#\x00', 0x9, 0x440000) flock(r1, 0x4) setsockopt$inet_opts(r1, 0x0, 0x24c04c8d2a2894c1, &(0x7f0000000240)="0d2389ba87a3efd501dea42197ec1ba581c7cee1d2db083f6651783052", 0x1d) fcntl$getownex(r0, 0x10, &(0x7f0000000180)={0x0, 0x0}) flock(r0, 0x0) ioctl$BLKTRACESETUP(r1, 0xc0481273, &(0x7f00000001c0)={[], 0x1f, 0x370d, 0x2, 0x1ff, 0x10001, r2}) setsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x23, &(0x7f0000000000)={{{@in=@multicast2, @in=@multicast1}}, {{@in6}, 0x0, @in6=@loopback}}, 0xe8) syz_emit_ethernet(0x2a, &(0x7f0000000640)={@random="b100485caa2a", @link_local, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x1c, 0x0, 0x0, 0x0, 0x2, 0x0, @rand_addr, @broadcast}, @igmp={0x11, 0x0, 0x0, @multicast1}}}}}, &(0x7f0000000140)) 01:57:04 executing program 1: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000040)={'tunl0\x00', 0x0}) ioctl$sock_inet6_SIOCADDRT(r0, 0x890b, &(0x7f0000000080)={@local, @remote, @mcast1, 0xc3b4, 0x7, 0x0, 0x100, 0x45, 0x200, r1}) ioctl(r0, 0x8912, &(0x7f0000000000)="0a5cc80700315f85715070") r2 = bpf$MAP_CREATE(0x0, &(0x7f0000000180)={0x5, 0x9, 0x4000000000000800, 0x1}, 0x2c) r3 = syz_open_dev$dspn(&(0x7f0000000380)='/dev/dsp#\x00', 0x7, 0x0) ioctl$KDGKBTYPE(r3, 0x4b33, &(0x7f00000003c0)) mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x3, 0x31, 0xffffffffffffffff, 0x0) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000140)={r2, &(0x7f0000000040), &(0x7f00000000c0)}, 0x20) bpf$MAP_LOOKUP_ELEM(0x1, &(0x7f0000000100)={0xffffffffffffffff, &(0x7f0000000040), &(0x7f0000002180)=""/4096}, 0x18) getsockopt$inet_sctp_SCTP_GET_ASSOC_ID_LIST(0xffffffffffffff9c, 0x84, 0x1d, &(0x7f00000001c0)={0x3, [0x0, 0x0, 0x0]}, &(0x7f0000000200)=0x10) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r0, 0x84, 0x6f, &(0x7f0000000300)={r4, 0xb0, &(0x7f0000000240)=[@in={0x2, 0x4e20, @dev={0xac, 0x14, 0x14, 0x13}}, @in6={0xa, 0x4e22, 0x7e, @mcast1, 0x523}, @in6={0xa, 0x4e21, 0xf797, @remote, 0xb57b}, @in={0x2, 0x4e22, @rand_addr=0x7ff}, @in6={0xa, 0x4e20, 0x4, @ipv4={[], [], @dev={0xac, 0x14, 0x14, 0x11}}, 0x7}, @in={0x2, 0x4e23}, @in6={0xa, 0x4e22, 0xc5f3, @mcast1, 0x9}, @in={0x2, 0x4e22, @rand_addr=0x98a}]}, &(0x7f0000000340)=0x10) 01:57:04 executing program 5: perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1f}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000340)={&(0x7f0000000000), 0xc, &(0x7f0000000300)={&(0x7f0000000240)=@newlink={0x50, 0x10, 0x721, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x40030000000000}, [@IFLA_LINKINFO={0x28, 0x12, @veth={{0xc, 0x1, 'veth\x00'}, {0x18, 0x2, @VETH_INFO_PEER={0x14}}}}, @IFLA_NET_NS_FD={0x8}]}, 0x50}}, 0x0) 01:57:04 executing program 0: socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000001f80)={0xffffffffffffffff, 0xffffffffffffffff}) setsockopt$SO_ATTACH_FILTER(r2, 0x1, 0x1a, &(0x7f0000ab9ff0)={0x2, &(0x7f000039a000)=[{0x20, 0x0, 0x0, 0xfffffffffffff010}, {0x6}]}, 0x10) sendmmsg(r1, &(0x7f0000001e80)=[{{&(0x7f0000000700)=@l2, 0x80, &(0x7f0000001dc0), 0xc0000000}}], 0x1, 0x0) 01:57:04 executing program 7: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000180)='/dev/sequencer\x00', 0x10002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000080)="0a5cc80700315f85715070") r1 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000001c0)={0x2, 0x0, &(0x7f0000000140)=ANY=[@ANYBLOB='\fc'], 0x0, 0x0, &(0x7f0000000080)}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, &(0x7f00000001c0)}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000040)={0x8, 0x60000000, &(0x7f00000000c0)=[@release={0x400c630f}], 0x1, 0x0, &(0x7f0000000100)='V'}) fstat(r0, &(0x7f00000002c0)) 01:57:04 executing program 5: perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1f}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000340)={&(0x7f0000000000), 0xc, &(0x7f0000000300)={&(0x7f0000000240)=@newlink={0x50, 0x10, 0x721, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0xb40a0000}, [@IFLA_LINKINFO={0x28, 0x12, @veth={{0xc, 0x1, 'veth\x00'}, {0x18, 0x2, @VETH_INFO_PEER={0x14}}}}, @IFLA_NET_NS_FD={0x8}]}, 0x50}}, 0x0) 01:57:04 executing program 1: r0 = inotify_init1(0x0) fcntl$setown(r0, 0x8, 0xffffffffffffffff) r1 = socket$inet6_udp(0xa, 0x2, 0x0) ioctl$sock_proto_private(r1, 0x89ee, &(0x7f0000000540)="5173891c058fb21037d9844e9576efb4acc3d7e4559db23e94372db65ca53180e15965c9616eea9bd4c07938688bb2e5e79c576a555f67289497c4279d6f4935451d4f23636782aea1aca192d4f542e631dbb3bbc5e785f15c11e74797bf8d11b5fd2080134898954df63af7976d0faf07f66c42e37f804d40e282615980605aa1c6ba9c4daa717001b76648ee3515") fcntl$getownex(r0, 0x10, &(0x7f0000000240)={0x0, 0x0}) ptrace$setopts(0x4206, r2, 0x0, 0x0) r3 = socket$inet6(0xa, 0x803, 0x3) r4 = openat$autofs(0xffffffffffffff9c, &(0x7f0000000740)='/dev/autofs\x00', 0x519040, 0x0) ioctl$sock_bt_bnep_BNEPCONNDEL(r4, 0x400442c9, &(0x7f0000000780)={0xffff, @broadcast}) setsockopt$inet6_IPV6_FLOWLABEL_MGR(r3, 0x29, 0x20, &(0x7f0000000000)={@empty, 0x80000001, 0x1, 0x0, 0x2, 0x3, 0x100, 0x9}, 0x20) r5 = socket$inet(0x2, 0x4000000000000001, 0x0) setsockopt$inet_tcp_int(r5, 0x6, 0x80000000000002, &(0x7f0000000180)=0x78, 0x4) bind$inet(r5, &(0x7f0000deb000)={0x2, 0x4e23, @multicast1}, 0x10) socket$inet(0x2, 0x7, 0x6) r6 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r6, &(0x7f0000000140)={0xa, 0x4e24, 0x93f2, @local, 0x1}, 0x1c) r7 = openat$audio(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/audio\x00', 0x1, 0x0) symlinkat(&(0x7f0000000100)='./file0\x00', r7, &(0x7f0000000200)='./file0\x00') setsockopt$SO_ATTACH_FILTER(r6, 0x1, 0x1a, &(0x7f0000ad7000)={0x1, &(0x7f0000acbff8)=[{0x6, 0x0, 0x0, 0x6}]}, 0x10) bind$inet6(r6, &(0x7f0000000080)={0xa, 0x4e22}, 0x1c) setsockopt$IP_VS_SO_SET_EDITDEST(0xffffffffffffffff, 0x0, 0x489, &(0x7f0000000300)={{0x0, @empty, 0x0, 0x0, 'wrr\x00'}, {@rand_addr}}, 0x44) getsockopt$inet_sctp6_SCTP_DELAYED_SACK(r4, 0x84, 0x10, &(0x7f0000000600)=@assoc_value={0x0, 0x4}, &(0x7f0000000640)=0x8) setsockopt$inet_sctp_SCTP_PRIMARY_ADDR(r5, 0x84, 0x6, &(0x7f0000000680)={r8, @in={{0x2, 0x4e20, @multicast1}}}, 0x84) getsockopt$inet_IP_IPSEC_POLICY(r4, 0x0, 0x10, &(0x7f00000003c0)={{{@in6=@mcast1, @in6=@mcast2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@dev}, 0x0, @in6=@mcast1}}, &(0x7f00000004c0)=0xe8) sendto$packet(r7, &(0x7f0000000280)="69292e86906e94f70b14a50df66b0f1ad0681d8216", 0x15, 0x10, &(0x7f0000000500)={0x11, 0x7, r9, 0x1, 0x4, 0x6, @remote}, 0x14) sendto$inet6(r6, &(0x7f0000000100), 0x0, 0x200408d4, &(0x7f0000000380)={0xa, 0x4e22, 0x0, @loopback}, 0x1c) connect$inet6(0xffffffffffffffff, &(0x7f00000000c0)={0xa, 0x0, 0x0, @loopback}, 0x1c) vmsplice(0xffffffffffffffff, &(0x7f0000000240), 0x0, 0x0) setsockopt$inet6_buf(r6, 0x29, 0x3a, &(0x7f00000002c0)="4b39168e", 0x4) sendto$inet6(r6, &(0x7f0000000000)="cc", 0x1, 0x0, &(0x7f0000000040), 0x1c) close(r6) 01:57:04 executing program 3: r0 = socket$inet(0x2, 0x3, 0x2) connect$inet(0xffffffffffffffff, &(0x7f0000000000)={0x2, 0x0, @local}, 0x10) setsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x23, &(0x7f0000000000)={{{@in=@multicast2, @in=@multicast1}}, {{@in6}, 0x0, @in6=@loopback}}, 0xe8) syz_emit_ethernet(0x2a, &(0x7f0000000640)={@random="b100485caa2a", @link_local, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x1c, 0xf000, 0x0, 0x0, 0x2, 0x0, @rand_addr, @broadcast}, @igmp={0x11, 0xffffffffffffffff, 0x0, @multicast1}}}}}, &(0x7f0000000140)) 01:57:04 executing program 2: r0 = socket$inet(0x2, 0x3, 0x2) setsockopt$IP_VS_SO_SET_EDIT(r0, 0x0, 0x483, &(0x7f0000000100)={0x3a, @multicast1, 0x4e23, 0x0, 'nq\x00', 0x20, 0x9, 0x59}, 0x2c) connect$inet(0xffffffffffffffff, &(0x7f0000000000)={0x2, 0x0, @local}, 0x10) pipe2(&(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) ioctl$KVM_GET_ONE_REG(r1, 0x4010aeab, &(0x7f00000001c0)={0x1ff, 0x3}) setsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x23, &(0x7f0000000000)={{{@in=@multicast2, @in=@multicast1}}, {{@in6}, 0x0, @in6=@loopback}}, 0xe8) syz_emit_ethernet(0x2a, &(0x7f0000000640)={@random="b100485caa2a", @link_local, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x1c, 0x0, 0x0, 0x0, 0x2, 0x0, @rand_addr, @broadcast}, @igmp={0x11, 0x0, 0x0, @multicast1}}}}}, &(0x7f0000000140)) [ 710.492723] binder: 16391:16392 Acquire 1 refcount change on invalid ref 0 ret -22 [ 710.516772] ptrace attach of "/root/syz-executor1"[4368] was attempted by "/root/syz-executor1"[16402] 01:57:04 executing program 3: r0 = socket$inet(0x2, 0x3, 0x2) connect$inet(0xffffffffffffffff, &(0x7f0000000000)={0x2, 0x0, @local}, 0x10) setsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x23, &(0x7f0000000000)={{{@in=@multicast2, @in=@multicast1}}, {{@in6}, 0x0, @in6=@loopback}}, 0xe8) syz_emit_ethernet(0x2a, &(0x7f0000000640)={@random="b100485caa2a", @link_local, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x1c, 0x1c00000000000000, 0x0, 0x0, 0x2, 0x0, @rand_addr, @broadcast}, @igmp={0x11, 0xffffffffffffffff, 0x0, @multicast1}}}}}, &(0x7f0000000140)) 01:57:04 executing program 4: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8000000008912, &(0x7f0000000080)="0a5cc80700315f85715070") r1 = socket(0x1e, 0x4, 0x0) setsockopt$packet_tx_ring(r1, 0x10f, 0x87, &(0x7f0000000040)=@req={0x80, 0x0, 0x3, 0x73d}, 0x29b) write$binfmt_elf32(r1, &(0x7f0000001700)=ANY=[@ANYBLOB="7f"], 0x1) r2 = dup2(r0, r0) sendto$inet6(r1, &(0x7f0000000000), 0x101d0, 0x0, 0x0, 0x0) read$FUSE(r2, &(0x7f0000000700), 0x1000) ioctl(0xffffffffffffffff, 0x0, &(0x7f00000001c0)) fcntl$dupfd(0xffffffffffffffff, 0x0, 0xffffffffffffffff) recvmmsg(r1, &(0x7f0000006400)=[{{&(0x7f0000000080)=@un=@abs, 0x80, &(0x7f0000000000)=[{&(0x7f0000000100)=""/121, 0x79}], 0x1, &(0x7f0000000640)=""/190, 0xbe}}], 0x1, 0x0, &(0x7f0000006540)) setsockopt$inet_msfilter(0xffffffffffffffff, 0x0, 0x29, &(0x7f0000000040)={@multicast2, @loopback}, 0x10) 01:57:04 executing program 5: perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1f}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000340)={&(0x7f0000000000), 0xc, &(0x7f0000000300)={&(0x7f0000000240)=@newlink={0x50, 0x10, 0x721, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x3000000}, [@IFLA_LINKINFO={0x28, 0x12, @veth={{0xc, 0x1, 'veth\x00'}, {0x18, 0x2, @VETH_INFO_PEER={0x14}}}}, @IFLA_NET_NS_FD={0x8}]}, 0x50}}, 0x0) [ 710.601993] IPVS: set_ctl: invalid protocol: 58 224.0.0.1:20003 [ 710.612632] binder: 16391:16392 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 01:57:04 executing program 0: socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000001f80)={0xffffffffffffffff, 0xffffffffffffffff}) setsockopt$SO_ATTACH_FILTER(r2, 0x1, 0x1a, &(0x7f0000ab9ff0)={0x2, &(0x7f000039a000)=[{0x20, 0x0, 0x0, 0xfffffffffffff010}, {0x6}]}, 0x10) sendmmsg(r1, &(0x7f0000001e80)=[{{&(0x7f0000000700)=@l2, 0x80, &(0x7f0000001dc0), 0xc0}}], 0x1, 0x0) 01:57:04 executing program 1: r0 = socket$inet6(0xa, 0x1000000000002, 0x6) ioctl(r0, 0x8912, &(0x7f0000000080)="0a5cc80700315f85715070") mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x0) r1 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000080)='/dev/fuse\x00', 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000040)='./file0\x00', &(0x7f0000000300)='fuse\x00', 0x0, &(0x7f0000000180)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r1, @ANYBLOB=',rootmode=00000000000000000040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0, @ANYBLOB="2c0004a29d3898de5c81acdb7d879b1c6452407e51d7702ea74999ef023b021cd4a10fb035c74d33a27527c184394ed075655570d1e02c7141c78c"]) read$FUSE(r1, &(0x7f00000040c0), 0x1000) read$FUSE(r1, &(0x7f00000020c0), 0x1000) ioctl$sock_inet_SIOCGIFADDR(0xffffffffffffffff, 0x8915, &(0x7f00000000c0)={'team_slave_0\x00', {0x2, 0x0, @multicast2}}) write$FUSE_INIT(r1, &(0x7f0000000100)={0x50, 0x0, 0x1}, 0x50) llistxattr(&(0x7f0000000240)='./file0\x00', &(0x7f0000000480)=""/222, 0xde) read$FUSE(r1, &(0x7f00000030c0), 0x1000) clock_gettime(0x0, &(0x7f0000000280)={0x0, 0x0}) setsockopt$sock_timeval(r0, 0x1, 0x15, &(0x7f00000002c0)={r2, r3/1000+30000}, 0x10) r4 = gettid() timer_create(0x0, &(0x7f0000000440)={0x0, 0x12, 0x0, @thr={&(0x7f0000000240), &(0x7f0000000340)}}, &(0x7f0000044000)) timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x8}, {0x0, 0x9}}, &(0x7f0000040000)) tkill(r4, 0x15) [ 710.654007] IPVS: set_ctl: invalid protocol: 58 224.0.0.1:20003 01:57:04 executing program 3: r0 = socket$inet(0x2, 0x3, 0x2) connect$inet(0xffffffffffffffff, &(0x7f0000000000)={0x2, 0x0, @local}, 0x10) setsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x23, &(0x7f0000000000)={{{@in=@multicast2, @in=@multicast1}}, {{@in6}, 0x0, @in6=@loopback}}, 0xe8) syz_emit_ethernet(0x2a, &(0x7f0000000640)={@random="b100485caa2a", @link_local, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x1c, 0xfffff000, 0x0, 0x0, 0x2, 0x0, @rand_addr, @broadcast}, @igmp={0x11, 0xffffffffffffffff, 0x0, @multicast1}}}}}, &(0x7f0000000140)) [ 710.712884] binder: 16391:16429 Acquire 1 refcount change on invalid ref 0 ret -22 [ 710.743253] binder: 16391:16429 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 01:57:05 executing program 6: r0 = syz_open_dev$sndseq(&(0x7f0000000100)='/dev/snd/seq\x00', 0x0, 0x0) read(r0, &(0x7f0000fb6000)=""/28, 0x3f0) ioctl$SNDRV_SEQ_IOCTL_REMOVE_EVENTS(r0, 0x4040534e, &(0x7f00000001c0)={0xbf}) ioctl$SNDRV_SEQ_IOCTL_QUERY_SUBS(r0, 0xc058534f, &(0x7f00000002c0)={{}, 0x1, 0x0, 0x0, {}, 0x0, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xbf00000000000000]}) r1 = gettid() timer_create(0x0, &(0x7f0000044000)={0x0, 0x12}, &(0x7f0000000040)) r2 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r2, 0x8912, &(0x7f00000001c0)="0a5cc80700315f85715070") timer_settime(0x0, 0x0, &(0x7f0000000080)={{0x0, 0x989680}, {0x0, 0x9}}, &(0x7f0000040000)) tkill(r1, 0x1000000000014) 01:57:05 executing program 2: r0 = socket$inet(0x2, 0x2, 0xfff) connect$inet(0xffffffffffffffff, &(0x7f0000000000)={0x2, 0x0, @local}, 0x10) setsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x23, &(0x7f0000000000)={{{@in=@multicast2, @in=@multicast1}}, {{@in6}, 0x0, @in6=@loopback}}, 0xe8) syz_emit_ethernet(0x2a, &(0x7f0000000180)=ANY=[@ANYBLOB="b100485caa2a0180c200000008004500001700f5ff000002eec8cab8a238398effff11009078e000000108364b27889feaaa18698fb96e5ba0fc04aed46f557d8d54d58d096013c80b0000b9f1e2"], &(0x7f0000000140)) 01:57:05 executing program 5: perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1f}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000340)={&(0x7f0000000000), 0xc, &(0x7f0000000300)={&(0x7f0000000240)=@newlink={0x50, 0x10, 0x721, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x8}, [@IFLA_LINKINFO={0x28, 0x12, @veth={{0xc, 0x1, 'veth\x00'}, {0x18, 0x2, @VETH_INFO_PEER={0x14}}}}, @IFLA_NET_NS_FD={0x8}]}, 0x50}}, 0x0) 01:57:05 executing program 3: r0 = socket$inet(0x2, 0x3, 0x2) connect$inet(0xffffffffffffffff, &(0x7f0000000000)={0x2, 0x0, @local}, 0x10) setsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x23, &(0x7f0000000000)={{{@in=@multicast2, @in=@multicast1}}, {{@in6}, 0x0, @in6=@loopback}}, 0xe8) syz_emit_ethernet(0x2a, &(0x7f0000000640)={@random="b100485caa2a", @link_local, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x1c, 0x4000000, 0x0, 0x0, 0x2, 0x0, @rand_addr, @broadcast}, @igmp={0x11, 0xffffffffffffffff, 0x0, @multicast1}}}}}, &(0x7f0000000140)) 01:57:05 executing program 0: socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000001f80)={0xffffffffffffffff, 0xffffffffffffffff}) setsockopt$SO_ATTACH_FILTER(r2, 0x1, 0x1a, &(0x7f0000ab9ff0)={0x2, &(0x7f000039a000)=[{0x20, 0x0, 0x0, 0xfffffffffffff010}, {0x6}]}, 0x10) sendmmsg(r1, &(0x7f0000001e80)=[{{&(0x7f0000000700)=@l2, 0x80, &(0x7f0000001dc0), 0x100000000000000}}], 0x1, 0x0) 01:57:05 executing program 7: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000180)='/dev/sequencer\x00', 0x10002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000080)="0a5cc80700315f85715070") r1 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000001c0)={0x2, 0x0, &(0x7f0000000140)=ANY=[@ANYBLOB='\fc'], 0x0, 0x0, &(0x7f0000000080)}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, &(0x7f00000001c0)}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000040)={0x8, 0x4c00, &(0x7f00000000c0)=[@release={0x400c630f}], 0x1, 0x0, &(0x7f0000000100)='V'}) fstat(r0, &(0x7f00000002c0)) 01:57:05 executing program 3: r0 = socket$inet(0x2, 0x3, 0x2) connect$inet(0xffffffffffffffff, &(0x7f0000000000)={0x2, 0x0, @local}, 0x10) setsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x23, &(0x7f0000000000)={{{@in=@multicast2, @in=@multicast1}}, {{@in6}, 0x0, @in6=@loopback}}, 0xe8) syz_emit_ethernet(0x2a, &(0x7f0000000640)={@random="b100485caa2a", @link_local, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x1c, 0x60000000, 0x0, 0x0, 0x2, 0x0, @rand_addr, @broadcast}, @igmp={0x11, 0xffffffffffffffff, 0x0, @multicast1}}}}}, &(0x7f0000000140)) 01:57:05 executing program 5: perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1f}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000340)={&(0x7f0000000000), 0xc, &(0x7f0000000300)={&(0x7f0000000240)=@newlink={0x50, 0x10, 0x721, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x0, 0x3}, [@IFLA_LINKINFO={0x28, 0x12, @veth={{0xc, 0x1, 'veth\x00'}, {0x18, 0x2, @VETH_INFO_PEER={0x14}}}}, @IFLA_NET_NS_FD={0x8}]}, 0x50}}, 0x0) 01:57:05 executing program 2: connect$inet(0xffffffffffffffff, &(0x7f0000000000)={0x2, 0xffffffffffffffff, @local}, 0x10) r0 = socket$nl_xfrm(0x10, 0x3, 0x6) getpeername$netlink(r0, &(0x7f0000000100), &(0x7f0000000180)=0xc) setsockopt$inet_IP_XFRM_POLICY(0xffffffffffffffff, 0x0, 0x23, &(0x7f0000000000)={{{@in=@multicast2, @in=@multicast1}}, {{@in6}, 0x0, @in6=@loopback}}, 0xe8) syz_emit_ethernet(0x2a, &(0x7f0000000640)={@random="b100485caa2a", @link_local, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x1c, 0x0, 0x0, 0x0, 0x2, 0x0, @rand_addr, @broadcast}, @igmp={0x11, 0x0, 0x0, @multicast1}}}}}, &(0x7f0000000140)) [ 711.352492] binder: 16468:16469 Acquire 1 refcount change on invalid ref 0 ret -22 01:57:05 executing program 0: socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000001f80)={0xffffffffffffffff, 0xffffffffffffffff}) setsockopt$SO_ATTACH_FILTER(r2, 0x1, 0x1a, &(0x7f0000ab9ff0)={0x2, &(0x7f000039a000)=[{0x20, 0x0, 0x0, 0xfffffffffffff010}, {0x6}]}, 0x10) sendmmsg(r1, &(0x7f0000001e80)=[{{&(0x7f0000000700)=@l2, 0x80, &(0x7f0000001dc0), 0xe03f0300}}], 0x1, 0x0) [ 711.399312] binder: 16468:16469 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 01:57:05 executing program 3: r0 = socket$inet(0x2, 0x3, 0x2) connect$inet(0xffffffffffffffff, &(0x7f0000000000)={0x2, 0x0, @local}, 0x10) setsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x23, &(0x7f0000000000)={{{@in=@multicast2, @in=@multicast1}}, {{@in6}, 0x0, @in6=@loopback}}, 0xe8) syz_emit_ethernet(0x2a, &(0x7f0000000640)={@random="b100485caa2a", @link_local, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x1c, 0x100000000000000, 0x0, 0x0, 0x2, 0x0, @rand_addr, @broadcast}, @igmp={0x11, 0xffffffffffffffff, 0x0, @multicast1}}}}}, &(0x7f0000000140)) 01:57:05 executing program 4: socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000001f80)={0xffffffffffffffff, 0xffffffffffffffff}) setsockopt$SO_ATTACH_FILTER(r2, 0x1, 0x1a, &(0x7f0000ab9ff0)={0x2, &(0x7f000039a000)=[{0x20, 0x0, 0x0, 0xfffffffffffff010}, {0x6}]}, 0x10) sendmmsg(r1, &(0x7f0000001e80)=[{{&(0x7f0000000700)=@l2, 0x80, &(0x7f0000001dc0), 0xc0}}], 0x1, 0x0) 01:57:05 executing program 5: perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1f}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000340)={&(0x7f0000000000), 0xc, &(0x7f0000000300)={&(0x7f0000000240)=@newlink={0x50, 0x10, 0x721, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x0, 0x4}, [@IFLA_LINKINFO={0x28, 0x12, @veth={{0xc, 0x1, 'veth\x00'}, {0x18, 0x2, @VETH_INFO_PEER={0x14}}}}, @IFLA_NET_NS_FD={0x8}]}, 0x50}}, 0x0) 01:57:05 executing program 2: r0 = socket$inet(0x2, 0x3, 0x2) connect$inet(0xffffffffffffffff, &(0x7f0000000100)={0x2, 0x0, @local}, 0xfffffffffffffed9) timer_create(0x2, &(0x7f0000000300)={0x0, 0x3e, 0x1, @thr={&(0x7f0000000180)="0ecf485cc9cdb38afc5695dbcb5bc401c324dbf150cd4a54f94ca9234451b7db3fbf4eb3cb2724a281fa731295c47863f36c28412708c028efa118843e4725aa4ad652426b4cd5ec7e6e443b2fd2b9790514ac2995649121fd4692ce05b7b9fb130e7ca839b4d30bfef6d8e7d3b150bd92dad0bca2bb72c9b155992a87ee6f873a875b810abfa6a459d3c9e49e7c62129fb7ab4be72be17a2e435069d8eb417fd71ecee80b45cd14199c8dcb11eba9b062a8d3049ba5c538411542af4b07c83e5083b4dea5e98e532f8bddd1ea86a162bec96e0658db4aa9e01a4e", &(0x7f0000000280)="34302b6476650b08561fdc91e324355e846d3ec96710fc82fe479e8117e81a7ef4336ac57e676323919e1da83b49e5e989c3adee988a24e7941841eb3457552a2c44091f755cac620f21b474b3da36d3615fda64f947f1a3a1290247a2915f2d3a46"}}, &(0x7f0000000340)=0x0) timer_getoverrun(r1) setsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x23, &(0x7f0000000000)={{{@in=@multicast2, @in=@multicast1}}, {{@in6}, 0x0, @in6=@loopback}}, 0xe8) syz_emit_ethernet(0x2a, &(0x7f0000000640)={@random="b100485caa2a", @link_local, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x1c, 0x0, 0x0, 0x0, 0x2, 0x0, @rand_addr, @broadcast}, @igmp={0x11, 0x0, 0x0, @multicast1}}}}}, &(0x7f0000000140)) pipe2(&(0x7f0000000380)={0xffffffffffffffff, 0xffffffffffffffff}, 0x4000) r3 = getpgrp(0xffffffffffffffff) getsockopt$inet_sctp_SCTP_DEFAULT_PRINFO(r2, 0x84, 0x72, &(0x7f0000000400)={0x0, 0x6, 0x30}, &(0x7f0000000440)=0xc) getsockopt$inet_sctp_SCTP_MAXSEG(r2, 0x84, 0xd, &(0x7f0000000480)=@assoc_value={r4, 0x9}, &(0x7f00000004c0)=0x8) write$P9_RGETLOCK(r2, &(0x7f00000003c0)={0x1e, 0x37, 0x7, {0x3, 0x1, 0x1000, r3}}, 0x1e) [ 711.489389] binder: 16468:16486 Acquire 1 refcount change on invalid ref 0 ret -22 [ 711.520010] binder: 16468:16486 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 01:57:05 executing program 1: r0 = perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff7ffffffffffb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$TCXONC(0xffffffffffffffff, 0x5421, 0x0) r1 = dup(r0) syz_emit_ethernet(0x1, &(0x7f0000000500)=ANY=[@ANYBLOB="aaaaaaaaaaaaaaaaaaaaaa0086dd60dbd49503d4000000000000000000000000ffffac1414000000000000000000000000000000000000070000000000000401090001000728005320723793de8fbf0000800000000012c9ffffffffffff0000000000000000ff0f0000000000000100c204000000450502079b00000000290e02ff0000000000000000000000000000ffffac1414aa00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffff0000000100000019000000000000ffffe0000002ff0200000000000000000000000000017f08000200000000ff010000000000000000000000000001ff020000000000000000000000000001ff02000000000000000000000000000100000000000000000000ffff7f0000018800064866000000be1203080000000000000000000000ffac1414aa0000000000000000000000000000000100000000000000000000000000000001ff01000000000000000000000000000100000000000000000000000000008b0001ff02000000000000000000000000000100000000000000000000ffff00000009fe8000000000000000000000000000aa000000000000000000000000000000000c21880b00ae000280170e6091d97944e0999ef32b01fa3c76a5ce286a33ee7caa59016cf7ab952cac6e02c10c80a230c9b941000000460e2dcaa471f921099e9eee8a7e112a21c8737bf9d49fa1cdb21f8c12e4c26ab6a96ac1ec6a146e7f243aa35414195c53bec7a220e3efe36bf5ef1ad86914f27c80f9fb7019f43ca5ffd4c7f0d7c080e43236d8af6085cef6e20b086916272c45f97c9199c6c89cab7044c5f81e65b49de5be0b911912d3cd9b2286fd4a8961af77010008004baa555a05360c0086dd92754c7b588b420d9b82ef186233575a2694e7dcb9cb079f69dc35adf96885ebf0f201d18506b11477e4816bfd4b7222e1e5065eb709eab30d00f8e237a2fe09c278c80183c19a7f807e71ec164e9e0eab17d9d975051bf34dfcf7ca83aea7d3de7be643f925e83a1d22d8b63e3d19f154599774e54d3ce41cef696e496bbfb27500df982c5173b5e2f0649028158b2bdbe2b4ff429ee3eb906d2da862391d6a7d7f3283a06f000800008e07362b0a403f2ea5e18ea6b098cbbed568c9795be1f7080088be00000003183f03020100000000000002080022eb0000000423080309020000000000007f0080661a0800655800000004876a5f0c36422eac8fab756338e4be8a0ce92ccaaea4ab76e22af4a38bff617ffebc76a96a3f132dcafe659c50802a61c7486bdb401754df216ee15938d215e6aca971e9d48cd23909ac58713bbfed892f5cb72774643e33f1fa2c584010e0ec9c25a1ecf896c0e1aaef924ba31430bd0500000000"], &(0x7f0000000080)={0x0, 0x4}) ioctl$PIO_FONTRESET(r1, 0x4b6d, 0x0) 01:57:05 executing program 3: r0 = socket$inet(0x2, 0x3, 0x2) connect$inet(0xffffffffffffffff, &(0x7f0000000000)={0x2, 0x0, @local}, 0x10) setsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x23, &(0x7f0000000000)={{{@in=@multicast2, @in=@multicast1}}, {{@in6}, 0x0, @in6=@loopback}}, 0xe8) syz_emit_ethernet(0x2a, &(0x7f0000000640)={@random="b100485caa2a", @link_local, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x1c, 0x6000000000000000, 0x0, 0x0, 0x2, 0x0, @rand_addr, @broadcast}, @igmp={0x11, 0xffffffffffffffff, 0x0, @multicast1}}}}}, &(0x7f0000000140)) 01:57:06 executing program 0: socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000001f80)={0xffffffffffffffff, 0xffffffffffffffff}) setsockopt$SO_ATTACH_FILTER(r2, 0x1, 0x1a, &(0x7f0000ab9ff0)={0x2, &(0x7f000039a000)=[{0x20, 0x0, 0x0, 0xfffffffffffff010}, {0x6}]}, 0x10) sendmmsg(r1, &(0x7f0000001e80)=[{{&(0x7f0000000700)=@l2, 0x80, &(0x7f0000001dc0), 0x4000000000000}}], 0x1, 0x0) 01:57:06 executing program 5: perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1f}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000340)={&(0x7f0000000000), 0xc, &(0x7f0000000300)={&(0x7f0000000240)=@newlink={0x50, 0x10, 0x721, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x0, 0x100000000000000}, [@IFLA_LINKINFO={0x28, 0x12, @veth={{0xc, 0x1, 'veth\x00'}, {0x18, 0x2, @VETH_INFO_PEER={0x14}}}}, @IFLA_NET_NS_FD={0x8}]}, 0x50}}, 0x0) 01:57:06 executing program 2: r0 = socket$inet(0x2, 0x3, 0x2) connect$inet(0xffffffffffffffff, &(0x7f0000000000)={0x2, 0x0, @local}, 0x10) setsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x23, &(0x7f0000000000)={{{@in=@multicast2, @in=@multicast1}}, {{@in6}, 0x0, @in6=@loopback}}, 0xe8) ioctl$TUNSETVNETBE(r0, 0x400454de, &(0x7f0000000100)=0x1) syz_emit_ethernet(0x2a, &(0x7f0000000640)={@random="b100485caa2a", @link_local, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x1c, 0x0, 0x0, 0x0, 0x2, 0x0, @rand_addr, @broadcast}, @igmp={0x11, 0x0, 0x0, @multicast1}}}}}, &(0x7f0000000140)) 01:57:06 executing program 6: r0 = syz_open_dev$sndseq(&(0x7f0000000100)='/dev/snd/seq\x00', 0x0, 0x0) read(r0, &(0x7f0000fb6000)=""/28, 0x3f0) ioctl$SNDRV_SEQ_IOCTL_REMOVE_EVENTS(r0, 0x4040534e, &(0x7f00000001c0)={0xbf}) ioctl$SNDRV_SEQ_IOCTL_QUERY_SUBS(r0, 0xc058534f, &(0x7f00000002c0)={{}, 0x1, 0x0, 0x0, {}, 0x0, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xbf000000]}) r1 = gettid() timer_create(0x0, &(0x7f0000044000)={0x0, 0x12}, &(0x7f0000000040)) r2 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r2, 0x8912, &(0x7f00000001c0)="0a5cc80700315f85715070") timer_settime(0x0, 0x0, &(0x7f0000000080)={{0x0, 0x989680}, {0x0, 0x9}}, &(0x7f0000040000)) tkill(r1, 0x1000000000014) 01:57:06 executing program 4: sched_setaffinity(0x0, 0x8, &(0x7f0000d81ff8)=0x101) r0 = syz_open_dev$sndseq(&(0x7f0000000100)='/dev/snd/seq\x00', 0x0, 0x0) read(r0, &(0x7f0000000200)=""/28, 0x1c) ioctl$SNDRV_SEQ_IOCTL_REMOVE_EVENTS(r0, 0x4040534e, &(0x7f0000000400)={0xbf}) ioctl$SNDRV_SEQ_IOCTL_CREATE_QUEUE(r0, 0x40505330, &(0x7f0000000340)={0x0, 0x0, 0x0, "717565756531000000000000001f00"}) ioctl$SNDRV_SEQ_IOCTL_GET_QUEUE_CLIENT(r0, 0xc0105303, &(0x7f00000002c0)) r1 = gettid() timer_create(0x0, &(0x7f0000044000)={0x0, 0x12}, &(0x7f0000000040)) timer_settime(0x0, 0x0, &(0x7f0000000080)={{0x0, 0x989680}, {0x0, 0x9}}, &(0x7f0000040000)) tkill(r1, 0x1000000000013) 01:57:06 executing program 3: r0 = socket$inet(0x2, 0x3, 0x2) connect$inet(0xffffffffffffffff, &(0x7f0000000000)={0x2, 0x0, @local}, 0x10) setsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x23, &(0x7f0000000000)={{{@in=@multicast2, @in=@multicast1}}, {{@in6}, 0x0, @in6=@loopback}}, 0xe8) syz_emit_ethernet(0x2a, &(0x7f0000000640)={@random="b100485caa2a", @link_local, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x1c, 0x400300, 0x0, 0x0, 0x2, 0x0, @rand_addr, @broadcast}, @igmp={0x11, 0xffffffffffffffff, 0x0, @multicast1}}}}}, &(0x7f0000000140)) 01:57:06 executing program 1: r0 = syz_open_dev$sg(&(0x7f00000001c0)='/dev/sg#\x00', 0x0, 0x2) ioctl$SG_IO(0xffffffffffffffff, 0x2285, &(0x7f0000000380)={0x0, 0x0, 0x0, 0x0, @buffer={0x0, 0xe9, &(0x7f0000000080)=""/233}, &(0x7f0000000180), &(0x7f0000000240)=""/126, 0x0, 0x0, 0x0, &(0x7f00000002c0)}) perf_event_open(&(0x7f00000000c0)={0x2, 0x70, 0x3e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1f}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) write$binfmt_aout(r0, &(0x7f0000000580)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\a\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00'], 0x120) mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x0, 0x31, 0xffffffffffffffff, 0x0) ioctl$SG_GET_NUM_WAITING(r0, 0x227c, &(0x7f0000000180)) 01:57:06 executing program 7: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000180)='/dev/sequencer\x00', 0x10002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000080)="0a5cc80700315f85715070") r1 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000001c0)={0x2, 0x0, &(0x7f0000000140)=ANY=[@ANYBLOB='\fc'], 0x0, 0x0, &(0x7f0000000080)}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, &(0x7f00000001c0)}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000040)={0x8, 0x6, &(0x7f00000000c0)=[@release={0x400c630f}], 0x1, 0x0, &(0x7f0000000100)='V'}) fstat(r0, &(0x7f00000002c0)) 01:57:06 executing program 5: perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1f}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000340)={&(0x7f0000000000), 0xc, &(0x7f0000000300)={&(0x7f0000000240)=@newlink={0x50, 0x10, 0x721, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x0, 0x5000000}, [@IFLA_LINKINFO={0x28, 0x12, @veth={{0xc, 0x1, 'veth\x00'}, {0x18, 0x2, @VETH_INFO_PEER={0x14}}}}, @IFLA_NET_NS_FD={0x8}]}, 0x50}}, 0x0) 01:57:06 executing program 3: r0 = socket$inet(0x2, 0x3, 0x2) connect$inet(0xffffffffffffffff, &(0x7f0000000000)={0x2, 0x0, @local}, 0x10) setsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x23, &(0x7f0000000000)={{{@in=@multicast2, @in=@multicast1}}, {{@in6}, 0x0, @in6=@loopback}}, 0xe8) syz_emit_ethernet(0x2a, &(0x7f0000000640)={@random="b100485caa2a", @link_local, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x1c, 0x40000000, 0x0, 0x0, 0x2, 0x0, @rand_addr, @broadcast}, @igmp={0x11, 0xffffffffffffffff, 0x0, @multicast1}}}}}, &(0x7f0000000140)) 01:57:06 executing program 1: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00003e0000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r0, 0x40045431, &(0x7f00003b9fdc)) perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1f}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = syz_open_pts(r0, 0x0) r2 = openat$vsock(0xffffffffffffff9c, &(0x7f0000000040)='/dev/vsock\x00', 0x10000, 0x0) ioctl$SG_GET_NUM_WAITING(r2, 0x227d, &(0x7f00000000c0)) epoll_ctl$EPOLL_CTL_ADD(r2, 0x1, r1, &(0x7f0000000080)={0x10000000}) ioctl$TIOCSETD(r1, 0x5423, &(0x7f0000fd0ffc)=0xe) ioctl$TCFLSH(r1, 0x540b, 0x2) 01:57:06 executing program 2: r0 = socket$inet(0x2, 0x3, 0x2) fcntl$setpipe(r0, 0x407, 0xf417) connect$inet(0xffffffffffffffff, &(0x7f0000000000)={0x2, 0x0, @local}, 0x10) setsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x23, &(0x7f0000000000)={{{@in=@multicast2, @in=@multicast1}}, {{@in6}, 0x0, @in6=@loopback}}, 0xe8) syz_emit_ethernet(0x2a, &(0x7f0000000180)=ANY=[@ANYBLOB="b100485caa2a0180c200000008004500001c000000000002907800000000ffffffff11009078e00000017947a8ed176c6eebd93049eefe01b208c02d43c0c3c472f293267027eae8ab765834cb8d38a25de969d1a4528063ea948b33b7f91ca28ccc617a13df78ac9c69e6b8b1a5630ac3056aa5c2f7f961808416d31770af455c11fabf8316c1c2b948eff8ab5303f0d5"], &(0x7f0000000140)) [ 712.254597] binder: 16545:16547 Acquire 1 refcount change on invalid ref 0 ret -22 01:57:06 executing program 0: socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000001f80)={0xffffffffffffffff, 0xffffffffffffffff}) setsockopt$SO_ATTACH_FILTER(r2, 0x1, 0x1a, &(0x7f0000ab9ff0)={0x2, &(0x7f000039a000)=[{0x20, 0x0, 0x0, 0xfffffffffffff010}, {0x6}]}, 0x10) sendmmsg(r1, &(0x7f0000001e80)=[{{&(0x7f0000000700)=@l2, 0x80, &(0x7f0000001dc0), 0xc000}}], 0x1, 0x0) 01:57:06 executing program 3: r0 = socket$inet(0x2, 0x3, 0x2) connect$inet(0xffffffffffffffff, &(0x7f0000000000)={0x2, 0x0, @local}, 0x10) setsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x23, &(0x7f0000000000)={{{@in=@multicast2, @in=@multicast1}}, {{@in6}, 0x0, @in6=@loopback}}, 0xe8) syz_emit_ethernet(0x2a, &(0x7f0000000640)={@random="b100485caa2a", @link_local, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x1c, 0x1000000, 0x0, 0x0, 0x2, 0x0, @rand_addr, @broadcast}, @igmp={0x11, 0xffffffffffffffff, 0x0, @multicast1}}}}}, &(0x7f0000000140)) 01:57:06 executing program 5: perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1f}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000340)={&(0x7f0000000000), 0xc, &(0x7f0000000300)={&(0x7f0000000240)=@newlink={0x50, 0x10, 0x721, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x0, 0xb40a0000}, [@IFLA_LINKINFO={0x28, 0x12, @veth={{0xc, 0x1, 'veth\x00'}, {0x18, 0x2, @VETH_INFO_PEER={0x14}}}}, @IFLA_NET_NS_FD={0x8}]}, 0x50}}, 0x0) 01:57:06 executing program 2: r0 = socket$inet(0x2, 0x3, 0x2) connect$inet(r0, &(0x7f0000000000)={0x2, 0x0, @local}, 0xffffffffffffffcc) setsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x23, &(0x7f0000000000)={{{@in=@multicast2, @in=@multicast1}}, {{@in6}, 0x0, @in6=@loopback}}, 0xe8) r1 = syz_open_dev$vcsa(&(0x7f00000001c0)='/dev/vcsa#\x00', 0x7fffffff, 0x8101) ioctl$SG_SET_DEBUG(r1, 0x227e, &(0x7f0000000200)) syz_emit_ethernet(0x2a, &(0x7f0000000640)={@random="b100485caa2a", @link_local, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x1c, 0x0, 0x0, 0x0, 0x2, 0x0, @rand_addr, @broadcast}, @igmp={0x11, 0x0, 0x0, @multicast1}}}}}, &(0x7f0000000140)) setsockopt$inet_sctp6_SCTP_SOCKOPT_BINDX_ADD(r1, 0x84, 0x64, &(0x7f0000000240)=[@in={0x2, 0x4e24, @broadcast}, @in={0x2, 0x4e21}, @in={0x2, 0x4e21, @broadcast}], 0x30) r2 = openat$null(0xffffffffffffff9c, &(0x7f0000000100)='/dev/null\x00', 0x20000, 0x0) openat$null(0xffffffffffffff9c, &(0x7f0000000280)='/dev/null\x00', 0x0, 0x0) setsockopt$inet6_mtu(r2, 0x29, 0x17, &(0x7f0000000180)=0x2, 0x4) [ 712.408221] binder: 16545:16547 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 712.408250] binder: 16545:16573 unknown command 0 01:57:06 executing program 1: mknod(&(0x7f0000000ffa)='./bus\x00', 0x1000, 0x0) r0 = openat$audio(0xffffffffffffff9c, &(0x7f0000000180)='/dev/audio\x00', 0x800, 0x0) ioctl$BLKZEROOUT(r0, 0x127f, &(0x7f00000003c0)={0x8001, 0xb52a}) fgetxattr(r0, &(0x7f0000000280)=@known='system.posix_acl_access\x00', &(0x7f00000002c0)=""/214, 0xd6) r1 = open(&(0x7f00000001c0)='./bus\x00', 0x800, 0x0) ppoll(&(0x7f00000000c0)=[{r1}], 0x1, &(0x7f0000000100)={0x77359400}, &(0x7f0000000140), 0x8) restart_syscall() open(&(0x7f0000000600)='./bus\x00', 0x2, 0x0) sendto$unix(r1, &(0x7f0000000000)="5dff51253e303f2d91cb39f58186c359da3f6f6aaa2fc4508cdc842fa27255877f3e38b1d6f7c7a0fae0494b080e8708f145868801f690ce6963ede6328dc18ad094ab68a05a550daa9231bdafb5819052fdd94ea0ff937a078698d1771f8070cffa28e8471ca7a0d767040a92a9d7eb229c6883f86c8a694bb12215d7df16992270e943ba2f7efe61b21218c4860e8cd8ab8bb93e4505d5e700e3fa9b41f8ae875ae2ef11ede28e796c2afc1ccbb104", 0xb0, 0x80, &(0x7f0000000200)=@abs={0x1, 0x0, 0x4e21}, 0x6e) shmget$private(0x0, 0x2000, 0x2, &(0x7f0000ffd000/0x2000)=nil) 01:57:06 executing program 2: r0 = socket$inet(0x2, 0xa, 0xfdfffffffffffff8) connect$inet(0xffffffffffffffff, &(0x7f0000000000)={0x2, 0x0, @local}, 0x10) setsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x23, &(0x7f0000000000)={{{@in=@multicast2, @in=@multicast1}}, {{@in6}, 0x0, @in6=@loopback}}, 0xe8) syz_emit_ethernet(0x2a, &(0x7f0000000640)={@random="b100485caa2a", @link_local, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x1c, 0x0, 0x0, 0x0, 0x2, 0x0, @rand_addr, @broadcast}, @igmp={0x11, 0x0, 0x0, @multicast1}}}}}, &(0x7f0000000140)) 01:57:06 executing program 0: socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000001f80)={0xffffffffffffffff, 0xffffffffffffffff}) setsockopt$SO_ATTACH_FILTER(r2, 0x1, 0x1a, &(0x7f0000ab9ff0)={0x2, &(0x7f000039a000)=[{0x20, 0x0, 0x0, 0xfffffffffffff010}, {0x6}]}, 0x10) sendmmsg(r1, &(0x7f0000001e80)=[{{&(0x7f0000000700)=@l2, 0x80, &(0x7f0000001dc0), 0xe03f030000000000}}], 0x1, 0x0) [ 712.558229] binder: 16545:16573 ioctl c0306201 20000040 returned -22 [ 712.634082] binder: 16545:16573 Acquire 1 refcount change on invalid ref 0 ret -22 [ 712.644330] binder: 16545:16573 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 712.652515] binder: 16545:16547 unknown command 0 [ 712.658439] binder: 16545:16547 ioctl c0306201 20000040 returned -22 01:57:06 executing program 6: r0 = syz_open_dev$sndseq(&(0x7f0000000100)='/dev/snd/seq\x00', 0x0, 0x0) read(r0, &(0x7f0000fb6000)=""/28, 0x3f0) ioctl$SNDRV_SEQ_IOCTL_REMOVE_EVENTS(r0, 0x4040534e, &(0x7f00000001c0)={0xbf}) ioctl$SNDRV_SEQ_IOCTL_QUERY_SUBS(r0, 0xc058534f, &(0x7f00000002c0)={{}, 0x1, 0x0, 0x0, {}, 0x0, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xe]}) r1 = gettid() timer_create(0x0, &(0x7f0000044000)={0x0, 0x12}, &(0x7f0000000040)) r2 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r2, 0x8912, &(0x7f00000001c0)="0a5cc80700315f85715070") timer_settime(0x0, 0x0, &(0x7f0000000080)={{0x0, 0x989680}, {0x0, 0x9}}, &(0x7f0000040000)) tkill(r1, 0x1000000000014) 01:57:06 executing program 4: r0 = syz_open_dev$adsp(&(0x7f0000000000)='/dev/adsp#\x00', 0x2, 0x8000) r1 = socket$alg(0x26, 0x5, 0x0) bind$alg(r1, &(0x7f000065ffa8)={0x26, 'aead\x00', 0x0, 0x0, 'rfc7539esp(ctr-camellia-aesni,ghash)\x00'}, 0x58) r2 = accept$alg(r1, 0x0, 0x0) close(r1) close(r2) ioctl$TIOCGPTPEER(r0, 0x5441, 0xbca) r3 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r3, 0x8912, &(0x7f0000000100)="0a5cc80700315f85715070") r4 = socket$alg(0x26, 0x5, 0x0) bind$alg(r4, &(0x7f0000000200)={0x26, 'rng\x00', 0x0, 0x0, 'drbg_pr_hmac_sha384\x00'}, 0x58) setsockopt$ALG_SET_KEY(r4, 0x117, 0x1, &(0x7f00000001c0), 0x0) r5 = accept$alg(r4, 0x0, 0x0) recvmmsg(r5, &(0x7f0000003ec0)=[{{&(0x7f00000015c0)=@pppol2tpv3in6={0x18, 0x1, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, {0xa, 0x0, 0x0, @mcast1}}}, 0x80, &(0x7f0000001780)=[{&(0x7f0000001640)=""/79, 0x4f}], 0x1, &(0x7f0000001900)=""/4096, 0xfffffffffffffec5}}], 0x1, 0x0, 0x0) 01:57:06 executing program 5: perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1f}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000340)={&(0x7f0000000000), 0xc, &(0x7f0000000300)={&(0x7f0000000240)=@newlink={0x50, 0x10, 0x721, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x0, 0xf0ffffffffffff}, [@IFLA_LINKINFO={0x28, 0x12, @veth={{0xc, 0x1, 'veth\x00'}, {0x18, 0x2, @VETH_INFO_PEER={0x14}}}}, @IFLA_NET_NS_FD={0x8}]}, 0x50}}, 0x0) 01:57:06 executing program 3: r0 = socket$inet(0x2, 0x3, 0x2) connect$inet(0xffffffffffffffff, &(0x7f0000000000)={0x2, 0x0, @local}, 0x10) setsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x23, &(0x7f0000000000)={{{@in=@multicast2, @in=@multicast1}}, {{@in6}, 0x0, @in6=@loopback}}, 0xe8) syz_emit_ethernet(0x2a, &(0x7f0000000640)={@random="b100485caa2a", @link_local, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x1c, 0xf0ffff, 0x0, 0x0, 0x2, 0x0, @rand_addr, @broadcast}, @igmp={0x11, 0xffffffffffffffff, 0x0, @multicast1}}}}}, &(0x7f0000000140)) 01:57:06 executing program 0: socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000001f80)={0xffffffffffffffff, 0xffffffffffffffff}) setsockopt$SO_ATTACH_FILTER(r2, 0x1, 0x1a, &(0x7f0000ab9ff0)={0x2, &(0x7f000039a000)=[{0x20, 0x0, 0x0, 0xfffffffffffff010}, {0x6}]}, 0x10) sendmmsg(r1, &(0x7f0000001e80)=[{{&(0x7f0000000700)=@l2, 0x80, &(0x7f0000001dc0), 0x1000000}}], 0x1, 0x0) 01:57:06 executing program 2: r0 = socket$inet(0x2, 0x3, 0x2) connect$inet(r0, &(0x7f0000000180)={0x2, 0x4, @dev={0xac, 0x14, 0x14, 0xe}}, 0xffffffffffffff47) socket$inet(0x2, 0x6, 0x2) setsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x23, &(0x7f0000000000)={{{@in=@multicast2, @in=@multicast1}, {}, {}, 0x0, 0x0, 0x0, 0x1}, {{@in6}, 0x0, @in6=@loopback}}, 0xe8) 01:57:06 executing program 7: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000180)='/dev/sequencer\x00', 0x10002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000080)="0a5cc80700315f85715070") r1 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000001c0)={0x2, 0x0, &(0x7f0000000140)=ANY=[@ANYBLOB='\fc'], 0x0, 0x0, &(0x7f0000000080)}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, &(0x7f00000001c0)}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000040)={0x8, 0x48, &(0x7f00000000c0)=[@release={0x400c630f}], 0x1, 0x0, &(0x7f0000000100)='V'}) fstat(r0, &(0x7f00000002c0)) 01:57:07 executing program 5: perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1f}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000340)={&(0x7f0000000000), 0xc, &(0x7f0000000300)={&(0x7f0000000240)=@newlink={0x50, 0x10, 0x721, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x0, 0xb00000000000000}, [@IFLA_LINKINFO={0x28, 0x12, @veth={{0xc, 0x1, 'veth\x00'}, {0x18, 0x2, @VETH_INFO_PEER={0x14}}}}, @IFLA_NET_NS_FD={0x8}]}, 0x50}}, 0x0) 01:57:07 executing program 3: r0 = socket$inet(0x2, 0x3, 0x2) connect$inet(0xffffffffffffffff, &(0x7f0000000000)={0x2, 0x0, @local}, 0x10) setsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x23, &(0x7f0000000000)={{{@in=@multicast2, @in=@multicast1}}, {{@in6}, 0x0, @in6=@loopback}}, 0xe8) syz_emit_ethernet(0x2a, &(0x7f0000000640)={@random="b100485caa2a", @link_local, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x1c, 0x8, 0x0, 0x0, 0x2, 0x0, @rand_addr, @broadcast}, @igmp={0x11, 0xffffffffffffffff, 0x0, @multicast1}}}}}, &(0x7f0000000140)) 01:57:07 executing program 0: socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000001f80)={0xffffffffffffffff, 0xffffffffffffffff}) setsockopt$SO_ATTACH_FILTER(r2, 0x1, 0x1a, &(0x7f0000ab9ff0)={0x2, &(0x7f000039a000)=[{0x20, 0x0, 0x0, 0xfffffffffffff010}, {0x6}]}, 0x10) sendmmsg(r1, &(0x7f0000001e80)=[{{&(0x7f0000000700)=@l2, 0x80, &(0x7f0000001dc0), 0x1100}}], 0x1, 0x0) [ 713.194648] binder: 16622:16623 Acquire 1 refcount change on invalid ref 0 ret -22 01:57:07 executing program 5: perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1f}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000340)={&(0x7f0000000000), 0xc, &(0x7f0000000300)={&(0x7f0000000240)=@newlink={0x50, 0x10, 0x721, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x0, 0x1000000000000000}, [@IFLA_LINKINFO={0x28, 0x12, @veth={{0xc, 0x1, 'veth\x00'}, {0x18, 0x2, @VETH_INFO_PEER={0x14}}}}, @IFLA_NET_NS_FD={0x8}]}, 0x50}}, 0x0) 01:57:07 executing program 3: r0 = socket$inet(0x2, 0x3, 0x2) connect$inet(0xffffffffffffffff, &(0x7f0000000000)={0x2, 0x0, @local}, 0x10) setsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x23, &(0x7f0000000000)={{{@in=@multicast2, @in=@multicast1}}, {{@in6}, 0x0, @in6=@loopback}}, 0xe8) syz_emit_ethernet(0x2a, &(0x7f0000000640)={@random="b100485caa2a", @link_local, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x1c, 0x1c, 0x0, 0x0, 0x2, 0x0, @rand_addr, @broadcast}, @igmp={0x11, 0xffffffffffffffff, 0x0, @multicast1}}}}}, &(0x7f0000000140)) [ 713.235727] binder: 16622:16623 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 01:57:07 executing program 2: r0 = socket$inet(0x2, 0x3, 0x2) ioctl$sock_inet_tcp_SIOCOUTQ(r0, 0x5411, &(0x7f00000001c0)) connect$inet(0xffffffffffffffff, &(0x7f0000000000)={0x2, 0x0, @local}, 0x10) setsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x23, &(0x7f0000000000)={{{@in=@multicast2, @in=@multicast1}}, {{@in6}, 0x0, @in6=@loopback}}, 0xe8) r1 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000100)='/dev/hwrng\x00', 0x82002, 0x0) write$FUSE_NOTIFY_STORE(r1, &(0x7f0000000180)={0x29, 0x4, 0x0, {0x6, 0x4, 0x1, 0x0, [0x0]}}, 0x29) syz_emit_ethernet(0xfffffffffffffefa, &(0x7f0000000640)={@random="b100485caa2a", @link_local, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x1c, 0x0, 0x0, 0x0, 0x2, 0x0, @rand_addr, @broadcast}, @igmp={0x11, 0x0, 0x0, @multicast1}}}}}, &(0x7f0000000140)) [ 713.356337] binder: 16622:16648 Acquire 1 refcount change on invalid ref 0 ret -22 01:57:07 executing program 4: r0 = socket$inet6(0xa, 0x6, 0x0) r1 = syz_open_dev$sndpcmc(&(0x7f0000000040)='/dev/snd/pcmC#D#c\x00', 0x2, 0x8a000) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000080)={'veth0\x00', 0x0}) r3 = openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000100)='/dev/sequencer2\x00', 0x800, 0x0) sendto$inet(r3, &(0x7f0000000140)="d109bac12420eacde3d0e09df0a88304bcf48bdaab5246b0e024d5a2af704759170de144a9ee8b17dfef6b3327403c87b469854e80ffbd51b93317996f9b81", 0x3f, 0x1, 0x0, 0x0) ioctl$sock_inet6_SIOCSIFADDR(r0, 0x8916, &(0x7f00000000c0)={@mcast2, 0x4d, r2}) bind$inet6(r0, &(0x7f0000000000)={0xa, 0x20004e20}, 0x1c) r4 = socket$inet_dccp(0x2, 0x6, 0x0) listen(r0, 0x6) ioctl$KVM_XEN_HVM_CONFIG(r1, 0x4038ae7a, &(0x7f00000002c0)={0x8, 0xc0010379, &(0x7f0000000180)="97e5aa4ad4e0cb5c9ff45e373331bedf93c0bd55a4df513f31785b6290a66249db0a886bafe1ec81aea43c0c5532d387810cc16da8accd2cda0d459dbfbb1796f92f5a1975b43bf10edfd61dabfa09d0bdbd964d8b57fde59d9f65efd1e3d2908391822b66b6df797be2475234aeaab8d7e40ab9", &(0x7f0000000200)="66679f88bb986adbfa3589173447e17de6d09884f55c2660d87bb3ed500a419048089a66c977a720a80df2d404d90037e0279ff9406d4a2bc53548366024e31d203e6bfa3e5ef4528ee2c6a3246c35c15f010d37d1bfc1f280a759c881f0eb32311d9d742ac170f30fbe546233ca196b5a03c58aef0cff268421f662bae91b4578cfb74819ad1a288217284181ca", 0x74, 0x8e}) connect$inet(r4, &(0x7f0000e5c000)={0x2, 0x4e20, @dev={0xac, 0x14, 0x14, 0x20}}, 0x10) 01:57:07 executing program 5: perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1f}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000340)={&(0x7f0000000000), 0xc, &(0x7f0000000300)={&(0x7f0000000240)=@newlink={0x50, 0x10, 0x721, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffff000}, [@IFLA_LINKINFO={0x28, 0x12, @veth={{0xc, 0x1, 'veth\x00'}, {0x18, 0x2, @VETH_INFO_PEER={0x14}}}}, @IFLA_NET_NS_FD={0x8}]}, 0x50}}, 0x0) 01:57:07 executing program 1: r0 = socket(0x200000000000011, 0x3, 0x8) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f00000002c0)={'bridge0\x00', 0x0}) bind$packet(r0, &(0x7f0000000080)={0x11, 0x0, r1}, 0xd) sendmmsg$alg(r0, &(0x7f00000027c0)=[{0x0, 0x0, &(0x7f0000000640)=[{&(0x7f00000001c0)="65aa0ee2ba94f53781dc324bcd084cb3624fdbc491fd078f42e14223746d0958a7378736d83edee94054d11d97d273ed22df984d1b147c61b82dedb2a99f", 0x3e}], 0x1, 0x0, 0x19d, 0x4000000}], 0x1, 0x0) r2 = syz_open_dev$usbmon(&(0x7f0000000000)='/dev/usbmon#\x00', 0x1ff, 0x220002) fremovexattr(r2, &(0x7f0000000040)=ANY=[@ANYBLOB="6f73322e656d30637075ff01742c73656375720370707031402d2f2a00"]) sendmmsg(r0, &(0x7f0000005b00)=[{{0x0, 0x0, &(0x7f0000000140)=[{&(0x7f00000000c0)="d8c2dec174ec19f4d308e136dbac8eaf459dccbe0690fcf2b5e22004f24d24a23811fb97b094f6439c2ea29ebf3a75ba9208b1a04cf7e8057a187267dc4aa1dc66685f7a00117e8e68714bdb1c64ca9b1fde6eadf39393201dec523478567c241532b12176cd65898037783763b06fb0225fb9bfecd9803e0f", 0x79}, {&(0x7f0000000300)="1deee6586817dcbd34bef3420da9a83dfdcb37901d75038f4a7ce99e7cfbcb5bfcf1a046b52fc11ce151bea00400d56e4cbe05d07fd6910eab497e88250291bee4f3ff572a2f6dd55602d8f87b6a71120757eb58e558a098ed4eed1a981a60e3401a84e6c8807ea1edfd68aa9e54ff83cc2a4ac717ff6c704a1f6adb1baacae47436ba7d4e57a85f61219b640ec49952e738b65e5b2e8bc9c29b41b7db4ae5ed346a274bcc9e04ad025655503e9729c256fbde54766134456ef0b008dd625eace4113d9813b7c1d4542358879863796a97a50d8ace6e31a254fc87d4d869a8e0b5864c291b28fb", 0xe7}], 0x2, &(0x7f0000000400)=[{0x68, 0x11f, 0x4, "6d7ac6bd003859413d19864ca0f17a9b0a0ea31450bd483c6512aa0d7be37475d360a7828c9ecbca0a24fb9c60c29c690f4cf5f344430e47e78c97c52674fb958c279c3df1452b8f3aca87b4238228952248737b"}, {0x98, 0x101, 0x10001, "5315fccb469df02dcd598392898fe5c81f7542d35208677441eca89e09c819af973b6817cbc9f5e7e3e32865812b769fbf0aa0d17d26e1afa2dfa55e2060290e839d6f4884d66a02ffb8ff4adfde99358288942af0f4d45234225b82608b1459b680bbf3b05531de76c2dc1c741da7c0abb3fbdde14ba17ca31102873f3e24a45a7676db"}, {0x50, 0x6, 0x9, "157ba7e04adebc6214fb6eb9f4ba692e4b589ffdbf6018513012552d1a8d2d9020c8f19b1c647d3bae13d446ca269897d9801523810bf09a5f25a2cd71250e8c"}], 0x150}, 0x6}, {{0x0, 0x0, &(0x7f0000000580)=[{&(0x7f0000000200)="a890f456bd87fc9e2a6c9ac0325d1a3eb83cf4d98416c49fd4a1a2b4dbb2998347a0fc0266a58b309069e8f68b963349163ee15d96902d9113c803d6ba66315ca4007c270be0937b71347398be97365ecef95caacd19850688271c9c48cb79f28e71e40a5178307dee94d1d550101d7735a73618db948096a5c634dcbbc2a298a64d37f976b39565c8afafd7bc54d0d50f58ea", 0x93}, {&(0x7f0000000180)="6858394de63e776c304ae70cfc874f39518b902832975e99f92503732422a34de93dac5eaf929b53b5ed", 0x2a}], 0x2, &(0x7f00000005c0)=[{0x60, 0x113, 0x0, "e3ade1997267f710bf7f8aefc8c0165cf7a5a6738973887ddd99fe2b4f470076bad3c2cb961a1e4af11e72e48f8e18b1fd242d93d46fc52195613a6b85246208eb1a848fe64b31f8f5"}], 0x60, 0x20000000}, 0x40}, {{&(0x7f0000000680)=@in={0x2, 0x4e20, @loopback}, 0x80, &(0x7f0000001a40)=[{&(0x7f0000000700)="e3f2f438e523391b980d75489f804eb1255c9d4041c5f9b25630f737b01db194cee1df61cdbd669ce63757d687c0b542bb804a2efc8443f5f237f4b6c3f7cd52acd613532d15119a7a2c99ecab808cb7502cdcf39d6450301d9d2faa7c62ec632509881c262b2fdc1dc29628d8391bb8174cfe407873192104bac2a3c05118af335f5014724d8d27fdeef85b2b61a658780e3cd9ca6193844cb2d186adf5e286fc9e536eeca5ef6cf12d724e22f96f3db8ff15bbcde9589bd4d8407084b3c6b228831c356690fc9b855aa9df4b25e2c15c4f65dd98a25d8916c3cc5a066955a98387bfe0c786063711091bb664e0c41de6883d84a0b55f444e7d6f1c433af365ee0d0b6ce1c4cc02893ae21b42ffdbbb0eb838bf5f7ebb129cae31f6548f1aadd7c72a0f664f515bb53375a3ba500e1afbb8ca720a5db2bc596d33f600f35b7575199a89e738781c7908fb948b649a812d5e70979bce1214001fb8c97c14698342e75f2609db45aec7aecbc0bd4566c31e8b3ae5c026a757e8fe56129a0cacb376ae825c0f72cfc4ee1e40c82be76eb5f8ffd843a2e4319878761f7649c0337ca9892bb30f7298ab5fe032672c7429bf41bf41eb143adde9e3a5c3d817d1a946f90cd0ebcb26d463c63c317abd6af13e1e59ce044262174cd4d6e539077dbd415b56756850bcc501d6ff0079b8b6fcf1fd39751bf055defe27d796e935adc472ff80fba57cb074dfce3d462f32a031990c61977ef55ea26600b4892a1cb8b9ae7dda4e53deaa6fda85803dbf0f058c3fdb6a9b9ad587e5b29621b99905c33b289f8b9f16a30253902db650559936cf1353c76d31c4c9f9c16379e57d34985f7e73229656bbd4eaaa2176685749cac68edfe028a0eb038e9bdfbee67bdd6fd934a4fdec08a226c28d8e3fd5ded2504f6834c1dc7fe05267c2fbe3d503c0f93a1a8b0b520658b47eabc51162caf6d57784a8857cc81860a2b6488e8aafc918d84fc8cadb67164316fbab79cd9b12328ac092f84d485ee447d81e88e0f2cbd619249d6f6e4051d089153acc31119baed6354f972f3fcae44111b3a786ae6e9b3cf88f50a762c0dfc2cf2c9a26b8e3a4ea7c72143cc98ed44c48b80faecae3f8525a1d2897fd0ff1f927c0aa94d44ffe7916fee3b7e6f53b33869d51db442964ae10c69a4b6320dbbef6bbb1d71d7acae022b1dd103fcb0347a10d9dd2948f8c9bbe215e334ef690cb82fb4694287d10536d36ace1f5d476e78659536dbce664779d560aef8ef03d5f43cf5462a0ccec8ad5ed6f6ff66655e31cfac136d6d22dc6c582ce4ac3b7596fe1caf77760675a7a6778fca2edd56bc87fca7ddbdedf5f59ba6b07ab86a45e0e6a64134f48f42fdbf6da03b09b8dbe9afefa028b68a8bee6006e15545cba2ea836f75e510cda398b122376b310258268018b59437ad1cf2a7fbf7b4a3eb1638fa0f2e60fb222985a7eb7d13bbb9c9ec9a574ef733d8a8ceae48842ff07ef63371285e9896b34d53771b3eb2dda60273dcefda6e49b520c40d56c734c07a3ba3d0a859ecb93fa2556ac493bb53cb9fed9e6ce529a0cca3e3cdfa2ac828cf03fe216df53cc0534c026a71fb8dd28ad98f6cc378570b1e036bfd14784ffbfa044516c0696127cc173a45208f2a4c416d5f0f56489ee6863071429608c8513f9b9e511d34b16cf0ca241198def000f8cb11bd35ab075acf8c7d8ee8a0f525dc1bf16eaf632d425a9a6ee399a94a7978932faee284a8f2db7ce6480f4c60b53c1504b283ecfe05eb8f7271ac14b9435af22f0a419cc6211051453171e767d0bc4a32e2e13ee243a504954d2043c44639e5419d82f7c95d9cbfae72349923852feb29a741f428a8570144d7ddcd58b5eeb373c569a66dc54424ef9d4e1212c7eaaea3c789b2eb77f4a2842906c9bb316ece4ccf1b20b4d3a2f361ee6fcf09d761b7bce0681f40b7eb0b5bbaef4de7511613c889a258d1eb0fe861a44d0b7b6ec1aa7bfb776cb5ac0b05a4dbdb4fe6af4fbd3caefbee1da3be170836aed5355c4a0d4ccaca73ba668324429c60671cc5016415af2aea6dfa55ca8606277c03df69f58341719eed8f2bc4c340e9a6c0526d4a8456f3d64efbb8a214344438a2298d4e976c9428beb5b1941a351f064bd72a8a46d46ea74a5b38c7ebda9e90b0f4c8f1f03bb9b912cc96b807ccc13c06452778d23f9abefcd049aa903c0d9b0c2e8c1adbe7dec7ec58a09a7f1c227f92dc61099b19477aaab32445714bc923132458c946d33b4eb72b68dce611d4b9432510013ecc8d2dea9894f74a7020bb7da65797b85bed7c1be6fd28ab4d5b738ac3915e52143f5f532960a9b9a44f1f4e66474994e0e84aef9538535f7ce2ffd9217145875bc5d5a67accdf02fb93101060daf39dd4f8d8975d560381ccda6a28f0ec37abb9afe424871a76e23cc7288febc90f9573a467bab14668250801b55e9ea8e96246c9d8a9fb9287b1d7c929a2ca56b25154c064fe1b02e2e734c36e74f386dc4dfda5231f34f632e6a03de7577b72b8db540910043b255cd974a98ea1a9cfdabf25d6c103d2590446f07db661e26118e77192b801576aa88e39e5481484c1bbb9be7c87bac7c586d28e588334cef165bc2ef645809632a6c71d6072767e2677d39870016fd78cbe1e57f94c9a0f7f52e4100b6f719fad2a347ac3e4f1a78b99354b43b6d9b8a6abaaefd68ef8aabecaf5940867f7aa3aa5719771a7c52d29cb0efe97460033ca17f0ad8f05c7b3c0150d110eb14dab2d50f809c55e518f2f27b2a905bdac3a50b7e1e19be4419ab8a92803d8f09c0f926621d18abe7995ff818937cc7652ba99b80c62038d24204914e4d9b37f74a50137539d27afd8e28783515d32ee18bc221b29961a08bacef0d3a708616f99a25938df47175aac58ef8868064e671a69f5ab5300f0bd6e1baf531c20c4c4502fa71c5530a73e08df3cf57fdb47d1a3b9f97eecc2628771a1c359185de72b4d7c5befbbf184a46a5f49483a2ac630a0b95e2e7165be21773f6016a39d5182ce069f847adf93ff81b17851927edef83fbb3a4d563215c0038db257810403300f7a4325b7dd5f795b59a449d44d1eb31b2bffabf13aba84cc1df6609e4a4d5e717910a029c556c23ad7c4fed19a3ef959d29267c128c532f4a916e773901511a4a962fc054d5516a7d2e90abd67532c1a0ca95c1a60e0c914c0ef94626182bc1b8b0de924ff61ecae9565d070aaaf59fa41740432f6bd4810b3e615685a25ca4b6ecfa3e7f3f0430997069c9d56fc85f6a4194b75967f97366568750c0c7df91860c22aa354b65f4c07050199d6096ecfe2b758f41e6a49f85f819e4a304045ecb6ace0b3a030e77af88e1146bd80f66043af329ff9d8dc1fed08249c334ada7bc61627a31ae45fdb371a1f3c8a5e5565171ad684e895f5e1e2ca5fc33536e05faa53c8774b7a3a44d5397c160d9bcdf7d50115b4105094385ccf6078da829f495dd2b6c961bd2102e295da091e4bad25fe272f082301f0d1aa3ab91edd09a088f6fcc6e2850db6da70425c22b746feca5b551debebcc5db166adeeaec5cf5ad654a22ae38c08a5e64e8bee9309b792efd5a2fe86b3f529a06eba72f17f6bfcf527a27c1df8450ec74fdb98ce6e07d1f49c26a19573d831ddb2302e9066479885891a3b1cf054e93d25f6e1bcc882c0a3b218de9cb6d1ea7f952be9eb5d557e13c12a1af62bce333c8fe2d2eb7d2e58f21ec1c676cda8eba67bdc2529b82d1a98b97c7e89a75485350f75702ada9a654461616928a3c8526b7a9a2640014eae851c3370072c269ed51ed84a3b1b06eaaa5919409ad9c2fbdc182e41c9fd38e93a53b4cd1738b4cae37194f98b4f1b2358978c442c77833460730949675aa119b3b582a20e9c2293a249fbcd37fdd5496bc3345308f85511449cd7d36035f756691d710ceb3b5527b765b0822bcd78da86c5f0a365ae10d4c3ecbf2a38d058290bf075dcc3ed862001756d9c0d2078b5cf879f6394d32b39b7ee374f28d38fbc8b57983bfefa9a8014c6ccfd95f38261953ee524abfdc979ba1cca59534f84ae4ba19b4dce0ea3807fd5759c948aa75fcf87c55d11a363eef712955b2d114769c7b1c2b9ca6700a282ad08697c163e13ceb1f4f214f94e8aea9d84718ca8c3b2c6169c14cdeef31459608c240c49600e914c65278e71662efe56ad227a8b50f3a14739ccf0cbc14de45a29750f4af3992ce98654c6f014d4b7fba6213cc62986f96ecf2f6f00c75e7b7a8235c3c5a01630de9c079a949204867ca9cef27ede34e3bf9bbb9e8322a9e67e18fdd0fbf3ff2b7a33252d4bcf9d7486c6295cbe5cc238598cba0522df13c769b6b838748d7e17332f8dffd5de57da4c2e8c6906d101bccc5e71f8929a05b9fa3a5a067fc25a07d0657427cb485be6b2a57bb3554e58b64759c8b0b4a3bfb8460b5d630ad26473fea02201c32843ef3a48671bf087ac776203e34556a22b2ec2ab63c934e33c05ee63682da2a8de64c2dba8cfb3aeb3acd8fd11f279e28bb0e18f414a0f697764eee528cbafc962b9855a677161c773cfbb675b435ca492aee139889fa8d45312730da09a99a767b9c07f433d3c659c52a968100c1b7559e42d6bc10bd72b6df85ad7e7c3276332d905a0d24712643522644ea323b13367235eb6e4da0959788e0d002695617efeb214cfe2eb19e53e42e0474a6de206b31f0970417877d1b569b4adb92198573f86c0a31e02e98e4133a9e53e1a126980a1d609667a4e503cc4f12f576a5da3dea291cd9a900dc63b6788ed40bf8ce30fb19744c1493c3fd52ea6eacf66d189679c6760342dbb23de64f9cb641f97e339c95cc6559784b6572406d598b670905a095611d43748e17e939e2a5252c822bda531b0719c422533e2820d991fbbe39c987b3ae280cebdb519003cb3277f2049482f21eef228b1970b9518790eb73baba5443c66a9e702ac04e52cc8179b4c3a14c229fb696b40244e579b8d094a966ff7689ef869df89f184847fa5d6c64bcca35539ad2ba7110581879bcd1499d031cdd08131603b0d0abfb7c9f0e256bf5348eb99cf3deea30217d9350e3a82c6beaeb53aad1791fecb1428d40cb9f8e6c2ba190676d3b2ffbf1fcfb17fd2bc16effd5b950bd5487333fc60accdea8cf79a5cbb8fae9683fcf1b5aabe1a9c8f1a678677c0a18fa5fe682ebb60ffe235e540c1531fa8a8bb394b119477bb39fdffbd75e7d92f6c788673138288de3b50764a5443b0284409a2f94f0912422dab1419704abd73c6eaaadb8b4c4ace5db36babd293c8aded533321a3c9323e765fc31f7380963def79c539090f785ddfa0e26a6e50a8059b9d13088a784d5a6ab079b0fcf06ae9bf082efd0d3b698df6fbc6474176b9e907d356fee069bd4b5590390541fdccbb0ef32ad0b0e8e2df29b92c8f22f76920da449e2f7dcd68649a99be7913c83ec6fb937b05bb8fe93129afdcbaec1a864684430ff725fc00a7341d3bbfc85afb4d9947e812135e62e53106234a4eb4407f153eb101410c87422f598bb9af1c9e7ab87bc23fd1fce52bfc9332297106b93919615b582ccc64928849757c017461128236fc6cf4f6c291cda38e91938f4e537dbcb55b6442e9e33bef2f28ec11de40261a451a823c59c1cf10aac5b0c51bf6aff6bfd982660bb19fd71b080342d7f6591131982b7f2d51c669998c7c39d62db2a5c0f94feea83ede600afbb08024ef4e8d0ba6a6b4da90129d7e1ef2bd62073bd44c017f1ad47949ea8", 0x1000}, {&(0x7f0000001700)="28c693aa7b598700f1d2ce4ba75d9712463ecbed3c08a2675d961e1965554d1c36f5e0307ece093049a957fffd6c3d33b4db398224bc7c95d470cf28bc01fc4238b12e0260e34848b9591e77d7fe9df05020816e4aa5d79a9bf2b777f1147e11acff5a0ba223970b90afd7998debcd4a538ebdc695b8dda09170b2faec351e0eeabb3c0db182c7f7100c92e9b6f1c2f9507fb44c571f60c3ca676955de4938bfd289b239bf0f0b1bc1100c47033798be47bb064d4230c0ab54046e650e978314d81669b9cae6eee94f365fde78527ec5b22eb70a1825c532ca32a675fb6270f74556932a64918e48bc8ccd38", 0xec}, {&(0x7f0000001800)="a5f3f70a878f8f1865aafb8f6f83b36b6ee69a02128f1e6afc75dc9e9222cb5866b028b2a469ddad74c39314b93347d955cf1ca91dc38a8f99335ee27319278bfc3227b64f9901af57b0b5", 0x4b}, {&(0x7f0000001880)="0307997c0d3a62762a04138d504b6d503ee5217514add641ac37d0d14fe38e0e777a6752bdcd1bd071a1f8b0e528c8e4530ab906ae873e0dff54841b74e117f88035747d09ce3ffe76fe4513969f2583", 0x50}, {&(0x7f0000001900)="b7e3e0b64f23803db0f526b81a80d4bc72ee47a8055849cbd84196aaf8ba7ab712ed2303da7b0525cf231be4353201e0bfd189882e668e09652ee07aa6c43899302e937f6ba8ffcf7f68bbaf985fe376cf12950cc357db7adff4149ef44e81ade57ba9ec2a8e6ff5b948d3765bbf8b2be7d96710dc0de834e0c0887098ab608e5fc77a375a6c12fb1b0323d698b790947bd99adda817367df7302bb669311fcddfa0186d7f8547209924981de1d0591ad647053575ab3869bc19c2fe5f207adae988a7e35bd6336fc52b7efe9301eee76b0d9dda4081bc06bed0c321b1d9b6d5117a99fc98080d79445f0e7b47e249a957d53ca4676e8b", 0xf7}, {&(0x7f0000002800)="b5641d3917f6ed72a831e508c123337adbe8066e4e3f4ef4f91b91e551846485f8af7fd69258d25a633e672a74a3eea272dc88616fab8e36239a235de51d29bddbb4cabbcfc0ecad09241845f5fc46e706c0512ca0b06db83f194fbc795982967778c8428116d538c86315c010aefadba2bf7c08492ccae5a44d339e644d7e00d509e382a2c3c3c3a52123172a4f19f48b148ddefebaf712739f91a01436f8e904525a35762fe212408bc994b3305c4229fa5d5dde2c813ed7e56e01a9e9d8aee1e024ea19c5a4c0c93e0fbc043a50cf6715516de3d3e549cf23a9f6eaf49e6c3b081c91b6cd474e1b364f7faa5f6a7a8164d7dae521902ae19742195c929d1377bef0ee6109d5a68afcf3f401703b250f6b836d3c1e90697fe3945c32c636c0cb275657ad3361c308a6f2d291885436d4dc3d8e4e0cbf25183059389b159b9f889ba56cb5796595e5abd9305d3aa24431bdcbc33c04356ab7d86416bbf3425a7da5e5d47a98685198f568723db60a78bc309348163e88c38071686e0adb873b714cb73682003fb809a728aea48a1da21bb93f16848282944d2d4f89a533b548d405ba511697eb26a5f30b39a0e3b661a5b4eab919edfff5a84c4e20702d0f5157c8eeacde8b12fde7c310fd719ea32182573be47645ac7e27da1b1da5391a1058d7aefdcd7233acc3077e1609e510a19011a0d4214a4820e8f8de67b527569aa537cd08fab20130434e16c8607c2cc1ab949fc1487be01cabc0729e2c6a2d54e80dcba4e816081911633e6a8fa28c623ec9ba5846949e6e61e3e7738f974724f9f58e1744241d3abe14c961461559fbad04e387b65fd13bd2891348bc2b9858a94ef6e2b92977dd9b9ce02639ee6e1d4384143314c88c616d2adab9f6a23c03273c0725a0e999eb01e79bdc11f87efa17f9ae27e2113662532c050dcccd47f856e6740ed771308cb965724586ec1bbb0825325b02834f2a3ff4b0849322792dd96df66ccfee25c859be0d5fcf6a08b210d3d138d9a970b64b1a61744aef9e792a65dadea73908529f4af2456cbf2da625e5b5acb8c584a74c55a8924c02cf14f4ea471704035d88acb28d9198126980950395ab357cf0d816b250bfb2392b0ea2cf7fb986ed3ba95bbb7c77d87c39946a3a7aae78cd5fd73cba59285f2e0ec76a5b5a71258de2baa4b16292d2f912c889d1d07338d44effd2012e25f4e328d1b99ef344918b065b38c57e14b8f750a7c42dbc33014a93f7c12ff813ec70af394499dbc167758c94085ffd6c424bd811e065ca5532600eb21c5a2037f2ad970796bc6664a147a71c0e2c5d62476e1278b522a9b1120cdbe7641d7c2e38c8479961eefaacf36ad5e81fa867ed3a9e9a355e6db60dab58b1a539c22c173b56a57affc80953381862795d73c905fe6792ba32697c5f6129ce5580efd49779210802acdf37cc44a3eb299b578e4875026374c8dea4610404f906d5fad2fdbea763c04884af73364779d89b26afc15e555aad66ddb4f6fe336c628476d822b0f38d916c18384820ac7a23debad0630e6fd09ed80a307cbc6daecbb3821918b92893b70056daca253905914de8c98ea221a5d466595f3bbf71a7b11caa64aa7ee54c38b58fd2a54a0963a45aff9a88b579d2ee03fff1225605e4ee78f0d38c048970d2066e7c0f7a509bcdc6e5bc664c4ca8450b79431cc4728379a52174198de0c7bbc7ac0463da89ea76844543b51da6e68a1e75220e757fcc4312f9625e8f77a1c272659256f74443b38dd59f3d0fb950bd74aeefec656f7bb5a6638095d34560e8a0a77853d091b587bbf2345a8495dd1028de3b394f93cd2b1e4bdb226bee303de2bf4b735029cc52c4e35aa168c75a739419bc891da7fec4f3fd9bf9b1fccf851340bc5b3006850bad76bc45e2de99b27722c4f00ea454c678864d1d65dd83c4891f21358019f65a7e4014b12a23a828bb95010f4716111c439ea87bc8cd2f47a4e612e529fb1b036d98223c26b87ab6722f3d4a72aae1a05eb427fab6c4403d4a5e7016b039c0899fdb83a6851652f9a3d7e1b4e4c84f6dcef40bb14a751d62e3ffbdd4a7cacebb3f23352d11dd888be884df05ad6e81aba67d583026cce02a24fa3689840114d5a31066a4a9688882273cbbc4b705f6600dae0c91eba7c1e679da1290340c8b89e103c5c804e5be160a49588a5fab791aa437216c23cc2e3fff228b2ea4257becd3853916c006248eaa98ccf7cb02cf0614f0fa95f80e42593b9e6df5a27f215c37bc03996143b601ef8f9f1d84fe5c06fb810e3667eae04591aeee0893faceef1d07cfc220c8524ca32d8125397920cc55513ed3598de4f1ad6b093857c0eead43f35f06d1227b952558dc1019955e9f7a45bbd22fb44ae6ceaa785ef7edcdbf5a2f173669876318477ada2d835e04730cb9f43ccf19ce534f7da207edea5a9c569783add2ef4983bb423a7d454f7cea65a3ceb4125d163d1aba292a0e1012dbaa41050ea9f9bbe42a151c8d8f68f08dc6769c6a2e193b8ff0a34c351452d2bd45c91559dd94eccc60bdf6d703b78631ab561d52a9cba186c30fac33144a22fd5fe7ed3f1309574cb4213100ae71688ee635e4c98d62c896f43cefc33c0fb55cdcb42e0a4f49cbb6072b8ad3641d35c7bfb851d6dfc22c56a967e270ae3a8518f82fdc93cb44fb0923cce83e9c6025ec3bf92a3ab15005340beea1d14f06cce4afaff2a79bb301780b69f427df5685e1aadeec1003a0a78ed6e1b30d179fa10b15368a9db1c866c208939a86024bb44646a84c7c13ed4bec3869af5a467ab983b4206a1e60784189e9518de91eff069e3bfe124b7b0236ed6ace2864796152e98387e0f56d8d13896d58059cd4efb07190d23bbcd3e93605429b2bccc64ff28f68491c22808113de66d25830fe63c0a0b2517b5fcefbf6cfcc1d929ea1d172c655e0832e3031578a0aa2145aa195f6c87ab818140cf3347b46ebaab602c3470b9e4cda8d3115e4f0d3af01a7c93370c20ae9451ab1102f45911abcbee0f0a717cb848156bc9dd836a002f2421b27542a501a9cff5ff984fa2caffb8c63184df972740fea41d5dfb0cdd8e56cd31e0de1d5a945ebb5dd0c3d16785e96a700b2bd9ead774e54baa2961e76fe380b74a59c8d246cf188910ef770f69c2e80d13bd14e166a6c45663aee19b98fe9d466460fd4f3f3c3ac4469eff4f289e5aa0cac4a919a05e46ef7975c4547df41f9d700cc2f3f5a10a9b873e234e5b6fd89a1af0ba0a709a54336027e7f1dc8af2bcbc3fe495c86ec3b4ed4625c09d9461a5800163835fe4d4f187fb212069bd8ee1dbcd86a2395968c476f724434cc236bb471a10a7fc7c10dc7d75e906278391ff2500d823bb709a76ca4d4941fe416fa9cf0b68c204223ae9edd8f0288f1bf766621526de8d72b215d239b464d36078d3e25b4123e59b008b746381b5eafa9fecca6342f563e9d4d096cd3ecbd9c217c887be99504b4943481931468a04bc3b4dcc87276f083571180114cfe01e6ad72918d9ecc69b73836839b32c45934388fa6be77cb78511bbd4b9a46ddbb8adfefa04bf5bfc79a8e77aebc7558e819693b30ee56287eab088415866e3df954f7e09ae31603b9dc0bd90f7a7c75cf6cb9493de8f6b4ed241c938e233be82f770f29e44e781eb37be6647dd8bdb4e9f2f74521f73b154b817a508605e9803a6b153940073f604a190223a0d0dcca4ad1a1131c250174453c9aaa44cc1afabc2f3f891182b8569e5d388bba4b0ba6ec50e279ba3da307077f111fa56ea9ad94269391e82d7733f017075c78e72e3e5ba8d89d83069f6d2a5265a43c328d24c614b26d45d745810ae470b331fa4083ee646554ec4a86d3db1e65a564c6242e255f2bb35bf393f6f84640f4e9b7b14ef04302d5c7bcddb869681732ba7dc7e1c0e69850dc9f31ecdb6392f19dfb681ec2285dfdfc81219e04b2506b83ebd3edb77fc169eeed8c03a0cdffc226aca4e43b31606b8537703b6fab659de707eb7312fdec8a840f370c1e5a6982cd7d3df478184b766ff4226b1177282acd6cccb03dcf9d04f26b89d61a2fef71e7e24b30607c64ec390c367fbb5bc2bb978204c281475a43c328c6a97dea7fd1acc34b37c26b5a0a4c0fcb15dd8b98865f1da81480336a3b7ad075d90655cf2a9e5780b0496d14b14dc1979bc887a44fcbeb2c630b7f138c0e24101f34eb602c7c9bc3f09d0033a4bd52598138148bdd57068e5f68045e0145a2d7a616fecd0483f4c9ad20e4d592d5ae607cce23679d1885fdff85f8d040fa7ccf1b121970ce78f39926916ae464f710cf872a78b09c5e71e825bae4a4e679e616265299e6d1ff985474397a339d3260647c87f7de80d372aba5cbe9a4f2f92303daf2a7e2e83919cc44a74a8c9248fcdbaf5d3a17b51d135af87f5708ebc164b3e9069feed6e742c4b5caa60acdf34994088222b305f7561f4485575cffd0500ff05cc634d23513f8d42e3b90982bbadcb4cd9a7e0ef4e7ac7bafd2943f58c42d7f90c3ef155f1dd1920778798b33b6e6c15a80a5553088d8bb1b5ea655b88d21e2b4cbaa441fa7b67734ac922fb21098565bcf96a5f896957f1fdc89442775a9f8de709f452863ad7baf4a7e183fe8aadf26281e72722ca25ed3b376bec04ce15194d67fe08547c458a75d9554479ae9f96e77bead000618603a43d7293b3d91d96c9a2be1969ef4d68920399131ffb9f144b83f4a9824c779d3652e8f90c6575cc2c7ecc83785c19ce9cdbe6baed6dc6c420ada9d6601fa8c2b409b693279e8b612f02cb4b085311d20dd55056de303b89b570b72c2ba307c358b10f8bb804d34d581e5dab29c3a5b76e5c3e236418b7f9cc1641bd921870ad11ac615a863c7fa0e371d4b8c32dc2494fb4804337a303ef7b8eebd822bcd0e61a47d6bf7bc8c00f04af28d377bb93837804be061ef0ddc3d778642c7246a37bf8fef565778b91541dba0436844ce58ea7ae6d554f28b868377f7fe62d0782eaf1a86f8e9b5c2b035f552bdcaf3ddebcbe865c47f57e7aad839254bcbb2aad0d7baeaa47958b91ee5cfa43a48c3f6b6606ee8947c95becaedf77783e825fe5cdae7227e3408a5d0f011bdc23e62d1e75ea9f8033df042257f2a65044e34844694ba0db9e87df2ee86b3d8529000278bf70fa4937a0101132ec38c8a2699aaec02c5c3ceeb8309555282280b0a172e6af6692843591ffcd42cb402b94c5d4106441ad7bc053a1b7e277ea99d34a6662e555ead0e128312253525ec3a5fe62a5c7c9ce60a68e76336dee58fd60047e198b56b7270b58bc40e23a44feae457c03e9093801b3071df69a37249bc56c0f8987350281b10342c86afbfea952b15c07d2a7fb93e9a81721b4a728d561b34637fa628a6b9aecf761c31db4b8245a2aef94a713d1d52a13a9c76837e44f38129df7c6aea9cb411ae15ed7b749dd1de431692e9b20f0a268e9d3a8c3da0e795a1ada758006167dfe8ccf80e8430efe1c0a59bd568b84f1f42d7fbff0beb4c128d2ca4290e5553d17761664460d959a96061cfce39e0d10bda6ead5aa422281a6f340c3b57f4cea5754e0e91ccc130d19102d024f8b909b07cbf9c187c393f0ef92ad303858693e1a65e88011b109e2f32916ff1c7df88fa3a251561da9dc090044a3ad1a153ed6b9fff8dea58519130c31623c6642df002bf9a90097f02861fb236245376b65cbcf17b2a078d23ddddcbcab33966d17ed82f3bbecc0b77c7073954787283edb9cac069d439300f82e943", 0x1000}, {&(0x7f0000001a00)="24949d763bcf6767236983feffdbe67a95529f0c5f7e7813fcc645695db9e86e6cc14215", 0x24}], 0x7, &(0x7f0000003800)=[{0x90, 0x6, 0x401, "bf060295ad1214328ba0715fc450c82e51e916298f1dc24acc4e23cccc8c8e0099e81037ca1b10204ad79df6e365e68ece87ad0cef5d300a7fa99d4f5fc0cfb863b6768fd6c86525dd8d4826774a1b2eba8bfd7475655fcb530b2302b9f0acc92836a94cd6fbea021dca6ec4548ee4e1bc6d0486cf2d116054"}, {0x80, 0x1bf, 0x80, "7d060ffda08dd7f7c1f281b6f66369c09bba7f4c0abe4dedd7ec4e92c2cc60c725f750fc0f7bf0783a19fad4a5c2c9430c21286048785591fd6461ab076a5ef164b6f15f7decd41d019f4f630f30566381f830969449283b4af30cb70d4ddabe3e6b7afab18311ecc821ea"}, {0x88, 0x105, 0x633, "41f4d7b0dc23eaf2a21d60ad4ab85a8874b1f785a288a7d4d4de6b786ee800b98d46c0f90dcc12f1d2c617fdcb1eeb894bd3409e8e653d59c7d65fcfd12a82995b22ddd8a4a85187e065f2aa82c76edc042d1054a3c5c423e9d41ea31b90226ae5406d74e4fb42ece4a754c514817856ec23d1faf5ee"}, {0xc0, 0x1ff, 0x8, "5670278bf8daf4564dbcf8bbc38dc4141ba69f8a4266f26f324c45cf834d782634fac26cdf7805136ec9ad7405cbcc02da5af2f9fbd683a35d97d6c21a15e444f1fcd57b12f040d0728fb712c53c49c8fb623c9e8792b36b57741c8f89a7b5a060197aa5bf95c3854be8d6dafc8bb9936c8df562bff0b00e3f0367f229788095f9d12ca8659f6806aaa57db3a4bb53ebf22cf796d33137712448de8530b5b10a901798028f0c0b5f3b89f4aee3"}, {0x60, 0x88, 0x1, "6b2b4a07c4e73c65d4cf9b12b044cc90133ff0c04c136b97828af1bd0ef66b6a89ca0489164142e0443723e7399c4df505a64cfa0302b741321f0fb97035555efc92af200733f245cc8b60c060d78786"}, {0x1010, 0x3a, 0xf8a, "31f6435b916ae523845ee1a11a0c3a92f1bbb8fcf2f0e3a7b2a59bd6599b28eeea6f3507aeaf5f44c4977622953ac62fe8d7dab74487292dc4e8236fc2f409ad26768e9732225b80f89fb3b13d803378694c9c28208b6219669d467f0a1e60fcd4faf1ca53107323d4246dbf57195b9185455fce6ba1867a1c61c7ce3a4ad906f25509ad17bd98a70ade5eac25b1dd56e2e8f6511d0c8e26e72de940e5086e1210c8982456339a867c0165f1af6b894f39323a5ed37c171328ae44f581da31903fe9db54638a81e497fcef8f82752d0f1ebc4024c4113fb5819be4cb87180b0252b10a35f5bf3493bafc10845323f1d5d06e01744a86de8361a6c258832553362030a8b20814403e0cb2bde943a3b762a7dc790bca6d6e1234d902a6653df50fb194d7481f5dd6241527899719467fcf43b084b77f059b8316bf8d658c7336b728a0ca11c783031063375a5d1d186530381e5182ed7fde543cbc2d78c55826d302abb38f9752d8a7e8eaebbea63f192368b372f6ddc2d92097d9f039c132734d8a801ce271c9385c3d3777ab122c46ae8105454a7e8a4c4fb9cf1aa774201419f56a7baabc7581abb671d49ee04622e9b7d05d5ca9a21c7161798d1e841cf87eb2f822eb6c127f7f065227c58b7bac5d39a588435b0d30fe973cb7437a74a124a6f2ed7796e85a1d3bb25096d61830a305e1be1694314829419e5fa14f64f0aa157dbe6c9f958da26b9e0b96271e38037bedc1bcf1f8d48c52774a3f743460c658134602d5cef7855477b946dd89252fabfe89ddef6b57da27cd68bbb629fff005980e80492f26a3b7090459f1ec34978eb02645f5e4b3dc29a42976341acd97277b7ae2edd3a363b21d5d488400eb188fbba8a67f7bfa8a4c84c1445ace2d04929dba21a53d069eb80efc867488615c24653860699bf6fd4460a6399f1cd96c25109d776cda0b45ef6d815727a8997d6691939b351e8ee848fcf1dfbd4142f6e3a89ab16d1cc5f196ce38e538dfad7dc411c78e8cf28d9ce1cd21620f64819fb24352a000f3b43addf6e8ddf457ca840c9c430b83250f414a24f3369e452a416c9e0514492fb7c52aa68f0e0cd8b329dc4fdc91e9b6a8b651b0938d7158af77ed5742244773dd6c884206ccb4a1447f8298370a13148479213942405fe98c77e0b6347f9c24fe12d63751bbdfa8fed05e060d590728b387497961887f442354c737622f593523bf8ee68e6c19ec7d7573a08644505be6d73cb4c4c2857a0f9dac6604c703569f0fb2d61bda8bda9e70b416543a2640c01d5d457388f9ab3f8afdef7700e46dac59349fbec452054d128a76938af74b2e47011ce547b04e7c9c2919212aed0dc677d233bb981ed664aba9559f7873463d5ccb8608f917ac2d38fde0f33957c54fcad35879338e561303a5f88dd12a4d436e09f89d5dfd0971bfee8746008105d0c5b31fc2d37cc12ee211cafbafb766a0183eb8c5142a04576522ff3b48a46936af0978751e081eb5e81c759b9d31777275a94085804056c5ea727010cdf36d31c02c72cf19588f8d91589fccc9b0e44d40b136d8a01fd052144e1c73acee95ca1e25541088a6b7489f4289f454282ec27537d82502a17ab2d588b9a25c1348e13a4ff5fba24caba9bb9b3643f4335b30c6dc1a91d2038acaa409c3979e694de37727629f64752d42ce3a23346ce4974ad5fe5e15f3de209c758d0559805e9baee1655e646a479b660b57d1c0a1a6e89812fb937815664cdbf748647744b57ae5f66bc70c7d817908529e36415dd44dc3942b7a92185068c238134270faab359232db8b4fc5059786d75181227c1e0fed18c2a5ff8014beb7118bac7b68cc7c5736e7769dfdf4d8821b77e98dc73b3105177d2adb85838abd682c6f169c91e6b14f6b911d7ad80adad287b67b94f202af7ce41fa86d5e83d1fa305eb416f868aa78e64044e479d3fa2f642aad5d63974c1ccfb9e282e1552f35f784ae3bc7059a4bb83da4daa3e5fa346ec0c4b67098c2027392365a8bd8228a72d0b6df18326e07fe2ed6717a025b28aa161c9ec61dd42df188ea1fa899820a059d538da20757d8bb8cca2fdf5b950f151449a9dc4473ea952921eae5573813725c99c4f745f74ae8176e03ef05bd8f0d9d9e9e847697433bde500628c1030541153626ca80a7f833e93ee51e9d7b4dafa6cd6845da7d934fc1d200148133b0f172ac1089e487bf4c7d3d1e57796a61672a24eeaf09d922bcf070b5a9211080fc6a22e58d8bfbd970f65d6adb978d6261b94140ead554bb4709ee1b8349cac95acdb6fd99c2c8639ca7f3242f8c65e2c42b0d6b7c9981e830ab556fe9d0391c2e9f7352c69947559544d8eaa0973e4cab9322e0b33a7a438b3dbee53069cf6ca57f8eb724a258ef7443ab8fea196a7b2a3e9967c465721f3dd7cff642cc16a9441ec30b34913bfa82021191d7f039c593faf17bbb647d8eb1e18e6baa92311ec9b8705df2bd7fc2e091cb6d958f13d44ab550cd1f280cd4647ae9718ebaa9c753a53c08eb68eebea5db43c6346a8f3e2976821abe1456a65649dc1d05ba12085208272b03f3bbe2f1b42c1a9b7b8d8b81b11352f821f78353c493a46a3270b3c5df6eda6894ff44eac96ef22eb174aeb63ec7f733501f2653030faed39ed0a0a5d1b4ec767c07304697cef4b30a201c4b7d4ad50d87db8b099b2708e3e69ef08f4093d9e7d4d0695fcda849476becb006bc66af83ccb1c47f70ca5c745eff6abbc12fb4c66489e6d5a9b796ef0b3c5622211381bad41f3c0e1db10912bb139ad9de5592cf6fdd586082bc48ca3dfb7ad4f27b26a380ad0ab46484f2e6062630494236b98156af35cc56bc3250a4c6a0df8e6fe0f5b4c0f35416eb5746b81a85a5009568ff8e2f0a033bec6374e9e254dd70440325bf95df4790fbec60b67594db7c03242215ed11322079bc789bca281c9cb2037076de510c139e1271d48effe71b750b98f06be09ac1c783a928c27e50647df35000d73b233bcf96b332b7b5c4ec649277db48520f91e82d4c4eec7f47723af9c6f31057f21897e276e6ba118ef88dd3ba9447270846b97e814d48051ab42e42e3c1f78d59cf82526b58ece81b29a1f33a7ea522badddaa6f302c16124fc0119891b1fd1efc3c53be0bad59624d91ead448337bbe30241e096779ed7c5e74ad12c51570e04b5f1a518035a2a19474442c0ead5424f8c4e258a2552d1c46b22e9f3fc9a3b738a3bed9c20116c1f6d4593834da3353600a6d570b03344c43f685ace72ae6de1d2312e308a932772a17b789461ba17e15821d2dc997c098fcdf8bf89a0a39ef3c18c234eaab994e08cf9a4c1ef39bee2d78034a185a9d9b537e89533a4c5d05a8333563d53ef15238c6c685b3fbf7d17660203014270e02b460723a6cd819e9cecaeede75f563e876e9d3ded82d5020b1e33335d03713cc2a24b86f5b2179aec9ceb24b0f2000de4898e97d7e306e156c7c1b103df07a227e220d54459a5f825c98bad44c3a26633d8e97796914b6669bdb8784500d620146eae2b341f0e40570b0a24c634682d1759c132a6fcbab6dcadff391105b460e780f6c70e72ae54b31ae9c3838a8f0e92f320e84d7de26fe42a212bf8d877348d33ef0067a28ab252e709b890834b0d2319d237c9accb0eef9d1afb6b2c046719eec71ff8426c6e7c664b08d903cac54bc5867a1638d570f4aff3ddc8154b99224f6def5982e38ed5cd2fc7ecbc0a4eda4aa0e82363afc80b47e7a73f1fa7cd85678f9128f11e060d125262ba76d74c5d2f6a2a3893dfb4bf15a92788b28773db39720db4cbd3e115a931a408ec02585738aee3776092b25cb41f944d73705172627cdf98ae1e2a1d255e75e3ba95cb8f8c7498b08cacb48a0df6d7fb3043ead86dd2b06ba6e83d7f01a02e5eff126518a24269bf7b47178711898c720e3a82e2469ca4f39d8914865eff6a91fdedcf8988733046b49469328dc0ddc545ebb30b940da9036d4fd133aa6501e5cd6f9b0dabe133849f5e6eb594c7a0302e5b11f56debfe8921bacfc4e14333ffc6561eae5e30880ace84bbfbca8bd52e2bd48f316dae7a76b07448fa309c90fdd9816b0768e3f13cfdb8198e7ba3a0772000ce8e42a56e5ad1d1919a3d761732d2471a6e01e024f2e209005f2fe42ffc367f661956eff3cadc32d3754c38f7d242466800d4de33fded8ab5b995ded22ab2c5b79040cde1883c31ed358f0a5ce83c8894dedecad81e572c36911f295fb7549bc11196af1b66312b49a139fbde36526fca5876aac03241a8f35cb234fe31d03bd5076328371bd71633b372363a7f721c1f0b70de7387fa7fe0dc4810034a99a015b2a95eb88aebacb932bd3a05a068ab1e8cf50ca43a4fd4b88feb22aa02bcee840abcd6165392e0b579bfb98ed4985c736ab6a091fa43d8967cc41a5538b3263d9ea4263ffab92338d6e48e0f5fbd3a67825155fcf8592059731c5b9569750d0e9ef6684b93c7b00a0198343324c32e24e7607a6e1b26e0c02fb538e244373960083621d9665e518566ab38bd33c7fccb2ba0d0062ca04c27826929010d1ddc69b86ec438b6e07b6083e95ccb8f3400a0023029f04538043d341d37497c8f090efb6e70f2c93d5d3a49e382e4d68ea0f8f17bc0e8af45e5eb5e4a618490bec54a04cb845f8c0622be9d8e573deb3428930db547a098ae8972e7d30783aeefc48e8188507622a6249c063abdf4bde0642fa127420e4437a037c729953635e352848b5fa5774a228d53b9301981aa152107264c2596919aaa68c6034c2b9d0f1b3eba065b932e84575ef57c2fac522683b0c612d56cf38e2255c596c154544b7145fc90fb596a482b5403d91e4163d9111bb98029edeaf235659fc83864627fd42392d25e0390d5f5a5a273e838a89b55e8bf39be2ba7eb1a4c50f28166e907562d38da1b47b6a0e947571ff927da8e88e3d19b5f00356efa09db2689d4ec8f038ee2a79f84c216c99e7aaa35691cc3aa7810db9263d5d33dbd6a2e137f1a56f5b94ee16f8bc5e1185b37974233c7d727c61fe3ff824c16bcdc537b6181efb1ebb8d4da97d0dcc99bbf01f22fefbf3683a26d4c606fce4eddb5bc2f9a754858a175c65042a84070804271c207cc88a5aeabfb361fd8b8f316ea06ee2e4b51e6ea296b4f84416ea7ce5edafd3ecc9eb92e27af987ae28dae6533a7067f7a45f33b355925ca6057a0475413009b62bc0069fd3b083535a83e00ba3f268421fd525d1bd790967c80cba8ae2558570dfdbef23fda32645946686c7269bcc821ebced9f48de578b8e4cb23f131de01e124246fd97f8ed713a1d7f95c64b2b5629ce89d27d93ae7f3c7e579fba1105aad981ab4ebee5c16baaaa2d7f954b38c79a05524b3ae31b4f9c22658a468a2ec4746162121591fe79c2b12089bc460984f50a340df34e31bb563c7763fc6b047f0b6f051eee9fdcbdd08e007cfdc393bac7fc9457f10de3e2aac2b8826993e137104e85193f18739f2ed265bdf8cd247988a4eefb3768095abdfdbb1b3785d2c197f7a79f8dfb2ef1ceff81ab631e280ecbb6248b0afff0f9c89b24b6b6e65fa3c5aaa22dd5d9b330f98f8d70f7ea836d1460f84f55ce1807f583692baea59a72e361f598468fd2727172a336fb27183f41c18fdad4635c693de9ec762ee99691b486e7ea00762516c470620e987f332552c956a6b6a7ae7415bcc2bfd3583f3193cad0357a70227d1e5fd4a18c3da74bd2d6c3e46be4d60a690a0487a6c3ceb3514f63de3"}], 0x12c8, 0x8000}, 0x4}, {{&(0x7f0000001ac0)=@pptp={0x18, 0x2, {0x2, @remote}}, 0x80, &(0x7f0000001bc0)=[{&(0x7f0000001b40)="60bbbe8873ded886117b93e451245dd152664f853380ba7f339688818df4d27f817a12a257702a41555ba34114feeae9f254adbd2ec7f9a19f746112fed406819377ce050e6fb1140f967502e2c29bb8052fd9df1bcb6b334dd2", 0x5a}], 0x1, &(0x7f0000001c00)=[{0x50, 0x10b, 0x6, "233f05b6fc106fddeb6667079b09da4295fc20e92d9f447480193a48d28575bf77f5ba802c7cba39736e2098a919a5f9142048c4d3ec3f95cfe5880e6cf03d21"}], 0x50, 0x10}, 0x9}, {{&(0x7f0000001c80)=@alg={0x26, 'hash\x00', 0x0, 0x0, 'sha256-ssse3\x00'}, 0x80, &(0x7f0000002140)=[{&(0x7f0000004b00)="af0e83a4d8c5d2c3a90c8f5b33e92355ef559693a5749fb0907f5c866b23b9a4f16b99c8dbe83d7fa79c8dac70701be7727c20ab187822a6a70ffd12b236345ed703eeeacac96525412708cea48897cb2efabe77c4e8d28807753671be137121245c7b005f4b6287ac379d587362c0fd1d4d34a56e90ac432b30cbcbd335078b43ad95ddef86109d033a568f529540f40445e91afbbe5bfd3e10dca246f4101e56b1af9148f3b12b65aa38da7eb676c9960c1c591c4a9e548baded5a9455e40d520968bf16943b3b1b09748c0046ae7ade2be78f12706792329adcf8c61b191eff0d67a83100c2279915252198f6d53324738e192776c3092e8de99cbaf0ecddf984f6fbf0ac555da1068cae41d362aa6d5931600174f9e15ba2e39ed9dc20f59cfeda8cf086f41f08c6111771c4cbe8da10c41d31d80f6596d2cffc5ee2f30f038b79cdf14d3fb58545d65f014ba050a646828ef22d1ad16c4748f15597baedf7c4642ae13ecf14e4d4a033a641068a5dd15fd2a76273346ca982b51c4dd77e2b8a8b7a64bbf053d3cb79453810213ca039eb79ca5be36c82e1ad00253c9f1643a28a43167025f93a526a3d5e047c83fc2f38c10ddcd7034fc37b8b41ce3ca949508b50efa4cc2c485e2d6fd5a6f73b7d7c4bbe1ab9d54f3906f267e1ae04dd42d7cd860373826566381c6f6f9521278db122763ea703a4e934cd2b5072d6f1fe90a7dbeb9ff98fefb94505441bc32c013989acf7011b3248086d94494aada54069791a8ea1b86d6174dc2c705f51df6c91b95ab86c402e9376e6aac08a69c4fcfb5988f11e17a5357c5ade684f1f15bd4ecb2513b26593f7c81845c76e5e4f5e2aea5b53c4f1c4defba37bdb79edaa428d580a9e80ef6093405a0b5660e5f8f5f79a3bbae4e11ad1fa55f22637354afa4b35a4f387629762d0de2b7c6d6ff8408e24b642308024948aaf5288bd07ce1101194e2be9f82d6e70c32950cf25a0df772f980d6f63833aec1beeee02cc59f77df6f9e09ce8f85c142a01a5dd323be912593a452a56d989909545fc21a209222cf2c8455e71c17643db62647fb377d93d436a69f0d3694e220f4ce1c63b6cfd1aeac3268af3853cdd14da5a2828153669f89f41323c373bbd956edaf8c58cd027f98b8af633ea083d6da348897d51edd339ea5b7a94da43b8987fa195be8e388a1481ffb42746331f1814ce552d199ab349bcd268100799837659182a19cca88f8beccf4da64c66c2997d58fb6e89a81c19489193a0f726a557ccd02248c009ba15cc13ca4a77eca1f7b4d41a4638d5731927f1323de7dd392fdf761dbd163ec21d16e35d02ed6cdc7c05ea43aaff92752bfa8dfbfddd010ea46a6a575a82723f4ad6fa81a3d02dbca2383cc680f7e482f85bb5d1f0bbc4d65a6211c61ad274d48b24962997d8ba3790bb819c38e5abac7009396b58ab13e1803a67e003afa712ff504641f3222dcaae511a1e7085bd896bd968f3b63ce4694de9805264a692812813591681753e2e24761cdfd508649daefcff0d5c9a2325addd3969b10b030f4978925f1f7d0e11e3e9f17787bc1fdf660020f94417ff78255d3092822e53236041bded9a580f0718c0a4c6cf593622aa1a8d88ba07c142ef0adda9dbda1b6277d2b5d1c1336e0d5018573ae645bc624206ea2b6f7ff3477f6003f42f0387a1992cda57c534aff57ef74ed56c1b40291e71dad421e0e81058587ed8eded8dea80ca7b7c5b911d5c1afbcb504f50790d7a04bbdb9c75cb82aec86f71107a431a27ece21869528ca301d7cf81be5a61998ace54174d2c636a8a1879896a49e7c4fb9bf23198c61cd70ad0098c81e327d6aa0dc0aac42e0f48b89c53e7776703b4824c7650eb13500e6af2c7b28d4eb9ecbb6d3eb0f00b05d4732098bfe8f7345766f45b71ced2ddff87115dece18b49467ab36865c96ea01e5dc5b02de384d709a28d8a137e80f41452808658a8b8984cc3a174f925d616a476f3b869529f812fae3410c173c3452ee637945bfbc9ae544dd34d49ac05ec078cf1ae15c91ed0d0e341bb1172a29f0c5c4eb6300dc9b7d15d6b94ea5f5fb8264f962168a215abcc15edbe802188a2828db054ed62950aa732115e1c7482377528eb1d1311580a8ed98ecf06538816c33782e2b6aae5ed5c42181f1fff478cbc8278f48d97fd1d7fb06e2b5604ba09e06f755b2488fdbf12bf8897f00f99d5c1417527630ff42271ada58e647af2eab280f562d3de5ceafc0f381e660cb0e9ab717cb8e185022345105296d689ab439690f5bdd0a493a4a4609f5fb41de2b45d39eef2609c899e4896c1f45c88f6384e6f78e320b2a10d43e30b80405063ea42fed3d2eaff3b39c05f1cb8f66f63043a1a92d28d72b73d2f2cad426d5b96e8f30b1fa14666fed8f8cddf326cc7bb16d0f07e6835d2e8fe37d1043bff29721bc4698ce0385f61ed18131b592f436e66d0e6f35df1c1d93856e6a3767988e3cb918c6a5a2fc87df88179e8e21f4fe28f888e80250459cdbb4c95c3ba3e8547d095233a7612ba328687891c70e553af3c0ab3d14e61a9d7263bf08a434c36edca6138ee4d491216e73fdd3a05f3822df6f0bc0dc677b388019d7669802ad94675987af066724e227611e9f15087b99853ea8241fd773ce69bae136569e402ec15ceae097f281a8b579f4053d1f77a39b9bf2e437b7344c3604856566bb98a973ff1eac25f5b87b555908f595b6b53a0715434c5856039b927f52e9ecda9027538785bb351bb85a70ea324881e114038967004690c83d1b04452ab3645fcdb67d97396a0ab4cb9a9f1a1c45b18b9801e866d44efe589f0f7adb1ba87157f055913dcc39f5db0914309e68bf764e93cce11b1c820c555f876d24554c7318f253ce91c793c95ef222a9d9e8e50d52ce124532de3d96b84dc7104e4f21d07cf440cd68ca1d539f17754a43b29af0b65d5d96f57128ddbafdf1cbd1a503b567975b9a21edbda20d7d0be17da2c456fd4b3ef09ac1b5da611573b7fb82a081050ce4554d56377ce95755a654b1c3fbb6e9e0bcd84430a2e0825d99e1628d744e09150fbfb3556a78a6767350dede4bae6ab754ac0e64d963eb772b264c8adbf671b3d4be3d1eda60b625cfe3847c4745654450bc86e1884f64e2a4c6f42833d3cf3f496cf5ef6c9a90c70f9db13a092cdf213b649eb79c05deec7ecd4ac449c681d6a60844017dae5c429b70dcd727d84e30a932e6f962dd067ce733694cd64c08024c21dd16a672c54d16e9f248734f84a3b0cda9ae27167d721616ea2c950ff9efce9bcbac412cae5ca8a17ff4c4c4a3eabdcbd80fec7fbcaafab8ade9f289448a06afcc26dbca32cd79d3702335ba65c0541319e01de7aa48b0bad9ee684f51c83842de791706043dec308d49bee64000b4f08a7b1d8776d9b9556d6608cf25b696d06729053401e0c197b512dcbc60d8840b808fcce5a136904ab776e0e942c200dc5b04dbfe4602e839b56193579006e27ce24cf65e3f1fe0a129db1a977426914bad2ed409e81a6ca8cc2137bb775adb4c512da6a0e6d6cb84f327f591d653104a10c4ad5481343577c2d08b0f0088fbf9449c677139eeb1fe5ab9b1b7ff91b83efe1c151b377767297bfb3dea4f91694c786dded39dd98241ad569830f6023aea27a452f2b11c8c225caba83d01d256a2dac9f4d02c1937b449e14cb52a45187a05cddae583ed3953682438965635a51331d88c3b51afe1cf2fe33c280e24621bb6d34f001a4422999fe7413651a6fb1680752164dd247c3b626dc6b3370d798f0dee0a250cc11d7bf05e2c561cbcac180934e3f325cdc266ab7a8a74080b0a61c9229d39e192a4330f1e743c18336cc2823575e1720e0e6aea4666a04be54448a45f364da3d574a27515920478210ee57c401f6657820bdf26406f40d0871a9e91cb964d275a27aa633ed660492aff2eaeea3888dbac6a82029ed6fcb2d54729082f0d1da6f9d2467aa20f170c504e3f10765b7a0ddc3e5b51afcefd29990e6f3bd5086f9a9d67437ba68377622176d9a1c3ba31df2fe9d6e696723a03a7da9ab458685112c79a049b61b99ae5c3880f7378aae1627b1092a03e6030a8a2577229d84b51786899e4079322c0cbbef20bc9ede9cc82206b1cc634e74b261032c6b2c191dfc175d5ec2027327a9de4d9418efa6dc6cff779cb65f2e770e0136c683ed50f26c09fa13299d124f0345c1e1451e71a4782924d8e21775dc5f450863b4ba93b8a2f6e3e9bb4992cb6b100e5deb3c1e6ad176d3ae2187dd4c7bb0f01661e818411472929b0f202fcd01954829b1e5ea14773b7a4df11541819225a075a238ae87e9bb3e61fe3a5f666f3a5522975fe7d3c3d97aafc118539734d9d9beb5df48043947a750a8c896b4657f4d55f9ce285ef3656225a7b713869da827b879e5f283b7614a7acb7619582b30f912f371bd9923fd4b5f4ce4d29b92c9df2761b8893d258d9a48c8dde28bfc201fecfe008bbd92b0aba374aafd418d306a919b02cd09ad91e42b7c87e71e91d7cc31d80b791bdf9093a1fdd7cec6cbfb66edf1f69eff1a4095ae1ef9e893db68536ae40cb0060c6a25ed115d6092314a677d4e7a0e7249ba53bed6572adaf7cff6706a07d1e18be9b9991097b4c63b42a8fe3cccde6e37e24d92b3034d3e18467170aaaf284a9ef099fc52b7c7704db13c65bcdbb9882ea27fab3fd8580305c9f2c998f996c5a8caa2ec0565a56325c47fdf678ac3c2111b24a1011b389b1a44c73183b6d5ae7d59049ab5afbca4bcd6293771b332fad496df0959951d18184d9a11a71d6d7f3e7d096aa4b8e6e5857fa28a94e4439809c021b2096cd5426097add12fc770291be9724f63c5ccb5248c0712aa4f8784666824e25edce27364a49d04aed6a5ebfcac2e5395e3aa88590f8177775f908b475930dc5819717c22047b5e257ca4b426cc49bfb105fdf21d00e0760868c1c78d9609666643896c4e206a231b2d16d7954f6c202124ccdc3cfafb629d8324cdf9e8487c9c83be5da489d7c0ede2a84b6daf7e04f1e27b5b404e0df55efaa194549904c29a6506cbb60f9282832d8031b2527b62c2b4b5b8480d2ca6842cb238bc8bb35d359830107333226b1b85f59538e4c94529de67b44b0a5b28199bf8ea200ff514bbe57cbe390500db1c5cc8aa354ee4d11e9b17b03db9c23c4a55a4573b7cdf07a5031f5620dba239ea7cb80771836fe2cb5c03091c3a5663b178cca970c3391a18fa79323572e201e1d3ae7beac88ecc9a72637f1b8b5c17e9a05a5d4c4627f9caaf3bd6b8532175e934f8b38893b87dc02ab40346022cdd16aeb9c942c115129d9490fa133ceddf769325537838397d116385169db8b20525e937c4687a7be8a709435db4092cd46d179f045d8c8945536a4a8a590b77c9b78ce1c38b035d9dfdda7556c493b8f1010e00aeff7986151ffaf738151d8ce1fc92a0c9ec051051b9ed8fac873f7e96ad550d3d227525c3f4ea5e6c521b325e38faf32d7786767d49771d7ffbbd7b05d841e697dbba0c48cb8255c96f756abcb6d6e4f64db4f923a9779e1c792f825a36e01b4c21dd69e46d4a66451ba0ba09c4ad3ec922962570fe04f71d4ee46bda1a87264903755eeecad49e35085ea954b413cd8211cad1e761b78a7bccb59d0434572098db55b1ccb2b094c1565bddb5592ccc0274a945c1e9966d149bf3d45ba587d7d5b2b41079d76a49b5871b4f982efe188bbb9d1b985af3d7e9ba3bbc60dccbd4337196cd", 0x1000}, {&(0x7f0000001d00)="52929c6c3580a333fda2e75d8e68e15ec4e66c8ed5699c455b41088fd5c30fa2fbcd9357a509c159c2d68d4408e0ed59a96745598041a80f136935195925327685c9cca683a11b1ad12306256bf1c147b24803f52adc2040e14561dcf68a685fc4d35dce08b3d9ff7ad63a30e07ca6add24e0cd802f8eee936079648c816bbd75e30e72aa5d60686e819d7d8d53a9f7d9d5ada783d0bd68fb94376adebdb4e4f65b94328a90c857512724759f88919d44693d73a0939c6b07cbe03d0f59bf0837968c8358ff1e759d9af5c15", 0xcc}, {&(0x7f0000001e00)="56cfd207b59cf894c73112333e86e38c111eeda0894ff25685d472314898eccf2873519c7e27691c306bdc7902544969b50abd73f2741753a6003629207a989098bf08284aef8dab69d82cb12a7a160c290c13c82d6fbbb3804aff2583", 0x5d}, {&(0x7f0000001e80)="e761a433f5e1d0448480547f164ec57e85f151dfbf04fe0c86679146d7d1b09441cd3cb9e37ed5d3580e32b9d68193aeb1452c913ca10e6cf393ac21a4d06539948843d41b97f187f9b4e70029d5b3b7f59ca0a50b642965e4f4808a00f49c591ad0a8670ab726a83c835c93253c4dfe982f89db09adf5aa9b44d183e6bbfc246824c56de5b401a3afe5c75baa4d016541559c290f034da5c5ef9c95720cb8c918456721", 0xa4}, {&(0x7f0000001f40)="f8b7e928c87426d0397e9fcaa136172255570258756fdb56d4ab548a15160bef6dbacc710cfabb34bdf7db99fd1186a5ddd0bed044395e8acc2631cb6d953940a7121b88fd21ce04762c64424854c97fa5cd430496a52e25d3c0d7f6c0792864204317590722d4d837d91dbfcbeee87dfc20ddb37e6c0ad1ece016e0e428c97a3fbb6c6233657a49687ea40e1fce5650b455778b0cd5a03410fb90100a12fecb77780839efed2a33a6284936831068723cfa485377be8e6ddd93a44f4507eb65e56b0df307eac0194dc18b90567234b13bc7c456557f9a4aa73ec0e0e1d1deffd7", 0xe1}, {&(0x7f0000002040)="dc2516e4c2b1868cc7e998cab3bcb47caf5f9d95da2d7e0cee28ea35e8054693af26a42bbbd4ce85f0a49808c086cebe7010e14cffa6741e1c68fc108f5f612e9112b8e68941b0faa4efce5a34987a4042847e41152d4710afdf90e9c1ae16966e4d033c2f7f6716b444d55d6ecf99f97561ad7de4bed4833415500a66773a947517cae3b5095fd1f6e36002775777c9ebcb396b6dc407019110686d10e71950488ff76f5f1b5596219d571b3d9293616d985c86f5e1f9166416481846de5fbf4fb8beff1a4a1c259c23", 0xca}], 0x6}, 0xb6d}, {{&(0x7f00000021c0)=@llc={0x1a, 0x322, 0x100, 0x5, 0x1f, 0x7, @broadcast}, 0x80, &(0x7f0000002540)=[{&(0x7f0000005c80)="bb70ad8f8fc74a3af1098593d6f70f2b012df95884ec711e72ed6bcb6576fec9e74afc450fcf9c0430bb3ab66964af88724991231aac93334f5f4dea3a14392798c714ee9f2e58ae4f2f69c3511a03361d99fd3ea3a7f772a90639fba5ff14f873e3adaad4c011d5835bd7485f089e2ecc437b6e9cacd9ef93376774053203c00ff4f898ad7ed6dab65626b8c2c1ea887db7635d9e246b2c725fbd7a930ae4f220b8605eeae70cef4f703224e8d6e5866d2865a0a1fea3970e4ae0a5ea9581ee823b854d2003b6d797c34fae1b5f8e6760fc21463c5fb9e0c8be13216456f44fe7e000eb87188ffab31a66a7b331ce18bd5268278065ddca0e78221dbefd339fa9d89bbcd97a791dc8c2", 0x10a}, {&(0x7f0000002340)="d3db2112e5154b3860b29d8300750deca8ccf64d55db52f6ef599474fa09dd5ff9350343691df87f4ca4dece0605b42824ee529daf95a08aa55ffc1fe2ccb05f112989698ffe70eaea657404546328fd8d72457c92e005776db6820ae1233ef650dd36735fb47e9934cb5bdd42fefa40e6899f7ff6a18c608bf62d19a79a9e81c5d8bd1f8578d67181d804d7ca16f9bb25693a72bd59dc883f1054f7bfa53309fac1875dc4970fd7997dfb232cd62f7be3c37e885116df9a3d24e428d2a23687232b817a07207bbbd2c1ec0ba5c2cb7c62685b03dab66624e8ea72666c54279c9b7075", 0xe3}, {&(0x7f0000002440)="8f8d59bd6077133898bd1d02a39b0265d81345665c49237c0c0b4b1fd1a47b51afc34640f9a8967b20d89ced32ac18f64618c290d87b884e39e17bb1afce875ebe4862dd08a9dd04f2793c7b4fcb24e1c1383512df054b67628ba90a1d05b7b4f8aee668041f4bd7a0cbcaa92e4f258c633ede71155ec73d68d41bd51bfc32e60c", 0x81}, {&(0x7f0000002500)="2e2f321fdc6f3192e3b3622ba264c0680aa09efa1722ba6aee751867c9309296e51ecc2529d29bcb7a1e5da990a4ebc3dc4d3d7bd693fe43b86b790a0ec2", 0x3e}], 0x4, &(0x7f0000002580)=[{0xb0, 0x0, 0x8, "1ddb34f1f8e66f2583b80f5d536ff78fd262ace100660e030076fe2c09c0d08562cf287279ca81f5cd66eb209e36ae2a0c3d1c14af39c2fb304a7a049b216a180a0c22297022c4c03166a917f8a7b2169a5019d83f8e6a6b1f1f0a0e058ac2af7d6fc8e67d212304ba8cb27b6d4191fd4c1d9425e69688f5b4c0516ed5a709e05250cc2af6cc924383f23f5ef374b4c2c870cedab858fb85c0fa65"}, {0xd0, 0x119, 0x80000000, "6dfa89687540be849fa6cb40353ad89b9f900e995f3d4b557ce8cc69520e3903c197c3a42c29bace2ac7e6f7cc499ae40c0ce86fa4ffcc4bdf594013c7fd6abb37f5e23eaff2d932acf50387eca8018ed529505291defe918bb6fee80beb1439f74e45005bdde53f695bd1913be870911b3a8061fb0e579455812f52594d6d60f104311a1d98cb8a86a8428155a148ea4b5afaa531021a595b18647efb76f13779d250280a2038a41b2c9f67d1b93948bc42bb55928046738b759423a230b7d9"}, {0x40, 0x0, 0x10001, "f777e96139f4e4f0c6317546eaa3fa584ff74b8c0a7f73671b2da69672437955a2d15cb74f89f2ba972ad71c1176585d"}], 0x1c0, 0x4000800}, 0x7f}], 0x6, 0x40004) ioctl$TIOCSLCKTRMIOS(r2, 0x5457, &(0x7f0000002740)) [ 713.470873] binder: 16623 RLIMIT_NICE not set [ 713.555129] binder: 16622:16648 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 01:57:07 executing program 0: socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000001f80)={0xffffffffffffffff, 0xffffffffffffffff}) setsockopt$SO_ATTACH_FILTER(r2, 0x1, 0x1a, &(0x7f0000ab9ff0)={0x2, &(0x7f000039a000)=[{0x20, 0x0, 0x0, 0xfffffffffffff010}, {0x6}]}, 0x10) sendmmsg(r1, &(0x7f0000001e80)=[{{&(0x7f0000000700)=@l2, 0x80, &(0x7f0000001dc0), 0x4}}], 0x1, 0x0) 01:57:07 executing program 3: r0 = socket$inet(0x2, 0x3, 0x2) connect$inet(0xffffffffffffffff, &(0x7f0000000000)={0x2, 0x0, @local}, 0x10) setsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x23, &(0x7f0000000000)={{{@in=@multicast2, @in=@multicast1}}, {{@in6}, 0x0, @in6=@loopback}}, 0xe8) syz_emit_ethernet(0x2a, &(0x7f0000000640)={@random="b100485caa2a", @link_local, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x1c, 0xffffffff00000000, 0x0, 0x0, 0x2, 0x0, @rand_addr, @broadcast}, @igmp={0x11, 0xffffffffffffffff, 0x0, @multicast1}}}}}, &(0x7f0000000140)) 01:57:07 executing program 6: r0 = syz_open_dev$sndseq(&(0x7f0000000100)='/dev/snd/seq\x00', 0x0, 0x0) read(r0, &(0x7f0000fb6000)=""/28, 0x3f0) ioctl$SNDRV_SEQ_IOCTL_REMOVE_EVENTS(r0, 0x4040534e, &(0x7f00000001c0)={0xbf}) ioctl$SNDRV_SEQ_IOCTL_QUERY_SUBS(r0, 0xc058534f, &(0x7f00000002c0)={{}, 0x1, 0x0, 0x0, {}, 0x0, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xbf]}) r1 = gettid() timer_create(0x0, &(0x7f0000044000)={0x0, 0x12}, &(0x7f0000000040)) r2 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r2, 0x8912, &(0x7f00000001c0)="0a5cc80700315f85715070") timer_settime(0x0, 0x0, &(0x7f0000000080)={{0x0, 0x989680}, {0x0, 0x9}}, &(0x7f0000040000)) tkill(r1, 0x1000000000014) 01:57:07 executing program 2: r0 = socket$inet(0x2, 0x3, 0x2000002) connect$inet(0xffffffffffffffff, &(0x7f0000000000)={0x2, 0x0, @local}, 0x10) setsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x23, &(0x7f0000000000)={{{@in=@multicast2, @in=@multicast1}}, {{@in6}, 0x0, @in6=@loopback}}, 0xe8) syz_emit_ethernet(0x2a, &(0x7f0000000640)={@random="b100485caa2a", @link_local, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x1c, 0x0, 0x0, 0x0, 0x2, 0x0, @rand_addr, @broadcast}, @igmp={0x11, 0x0, 0x0, @multicast1}}}}}, &(0x7f0000000140)) 01:57:07 executing program 5: perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1f}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000340)={&(0x7f0000000000), 0xc, &(0x7f0000000300)={&(0x7f0000000240)=@newlink={0x50, 0x10, 0x721, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x0, 0x34000}, [@IFLA_LINKINFO={0x28, 0x12, @veth={{0xc, 0x1, 'veth\x00'}, {0x18, 0x2, @VETH_INFO_PEER={0x14}}}}, @IFLA_NET_NS_FD={0x8}]}, 0x50}}, 0x0) 01:57:07 executing program 1: perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10000003, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) socket$inet6_icmp_raw(0xa, 0x3, 0x3a) r0 = socket$inet_udplite(0x2, 0x2, 0x88) inotify_init() rt_sigprocmask(0x0, &(0x7f0000000400)={0x2}, &(0x7f0000000480), 0x8) sendto$inet(r0, &(0x7f0000000000)="ed5e683e4aff75573525928ec56ee3b5b639cb05d129112eac4216ea3ef2c86e003b8f1048ad68d3b3c6cc15ebb90ded100f2f4adfcd18bb2826e6ecbeb68e7ca2222e58ec1707640af76bdd6870c93188b083e037fe99a1117fcd49f1c0938f56defffac1a42583eabfae96cc32ef4da7c4b95283d08efd30952a16537473cef491214a45062c0cf58c0d42cd99c2145f9430460555acb21bedfdd668db21b8f6b4d26464912f2922099b2598b317982023a36925c3199dc493c66c6fa19f24871dabee920a44e90cf3260fd75b1ae066d230a4c5211017862a226f739d52af01e76fc5d807a13381d7ec2169dfcb5f", 0xf0, 0x1, &(0x7f0000000100)={0x2, 0x4e21, @rand_addr=0x5322}, 0x10) r1 = socket$xdp(0x2c, 0x3, 0x0) setsockopt$XDP_UMEM_REG(r1, 0x11b, 0x4, &(0x7f0000000040)={&(0x7f0000000000)=""/2, 0x2000, 0x800}, 0x18) setsockopt$XDP_UMEM_REG(r1, 0x11b, 0x4, &(0x7f00000002c0)={&(0x7f0000000280)=""/64, 0x1000000, 0x1000, 0x800}, 0x18) 01:57:07 executing program 7: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000180)='/dev/sequencer\x00', 0x10002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000080)="0a5cc80700315f85715070") r1 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000001c0)={0x2, 0x0, &(0x7f0000000140)=ANY=[@ANYBLOB='\fc'], 0x0, 0x0, &(0x7f0000000080)}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, &(0x7f00000001c0)}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000040)={0x8, 0xa000000, &(0x7f00000000c0)=[@release={0x400c630f}], 0x1, 0x0, &(0x7f0000000100)='V'}) fstat(r0, &(0x7f00000002c0)) 01:57:07 executing program 5: perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1f}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000340)={&(0x7f0000000000), 0xc, &(0x7f0000000300)={&(0x7f0000000240)=@newlink={0x50, 0x10, 0x721, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x0, 0x500000000000000}, [@IFLA_LINKINFO={0x28, 0x12, @veth={{0xc, 0x1, 'veth\x00'}, {0x18, 0x2, @VETH_INFO_PEER={0x14}}}}, @IFLA_NET_NS_FD={0x8}]}, 0x50}}, 0x0) 01:57:07 executing program 2: r0 = socket$inet(0x2, 0x3, 0x2) connect$inet(0xffffffffffffffff, &(0x7f0000000000)={0x2, 0x0, @local}, 0x10) setsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x23, &(0x7f0000000000)={{{@in=@multicast2, @in=@multicast1}}, {{@in6}, 0x0, @in6=@loopback}}, 0xe8) syz_emit_ethernet(0x2a, &(0x7f0000000640)={@random="b100485caa2a", @link_local, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x1c, 0x0, 0x0, 0x0, 0x2, 0x0, @rand_addr, @broadcast}, @igmp={0x11, 0x0, 0x0, @multicast1}}}}}, &(0x7f0000000140)) r1 = openat$audio(0xffffffffffffff9c, &(0x7f0000000100)='/dev/audio\x00', 0xc840, 0x0) setsockopt$netlink_NETLINK_NO_ENOBUFS(r1, 0x10e, 0x5, &(0x7f0000000180)=0x7fffffff, 0x4) 01:57:07 executing program 1: unshare(0x0) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000200)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_CREATE_DEVICE(r1, 0xc00caee0, &(0x7f0000000040)={0x4, 0xffffffffffffffff}) openat$kvm(0xffffffffffffff9c, &(0x7f0000000140)='/dev/kvm\x00', 0x200000, 0x0) r3 = dup3(r1, r0, 0x80000) setsockopt$inet6_MRT6_DEL_MFC(r3, 0x29, 0xcd, &(0x7f00000000c0)={{0xa, 0x4e22, 0x2, @remote, 0x6}, {0xa, 0x4e22, 0xd9, @local, 0x2a}, 0x4, [0x3, 0x8b11, 0x7, 0xe7, 0x8, 0x5f57, 0x7fff, 0x1]}, 0x5c) perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1c, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffc}, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$KVM_SET_DEVICE_ATTR(r2, 0x4018aee1, &(0x7f0000000240)={0x0, 0x2000000001, 0x2, &(0x7f0000000080)}) 01:57:07 executing program 3: r0 = socket$inet(0x2, 0x3, 0x2) connect$inet(0xffffffffffffffff, &(0x7f0000000000)={0x2, 0x0, @local}, 0x10) setsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x23, &(0x7f0000000000)={{{@in=@multicast2, @in=@multicast1}}, {{@in6}, 0x0, @in6=@loopback}}, 0xe8) syz_emit_ethernet(0x2a, &(0x7f0000000640)={@random="b100485caa2a", @link_local, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x1c, 0x4000000000000000, 0x0, 0x0, 0x2, 0x0, @rand_addr, @broadcast}, @igmp={0x11, 0xffffffffffffffff, 0x0, @multicast1}}}}}, &(0x7f0000000140)) [ 714.043407] binder: 16707:16708 Acquire 1 refcount change on invalid ref 0 ret -22 01:57:08 executing program 0: socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000001f80)={0xffffffffffffffff, 0xffffffffffffffff}) setsockopt$SO_ATTACH_FILTER(r2, 0x1, 0x1a, &(0x7f0000ab9ff0)={0x2, &(0x7f000039a000)=[{0x20, 0x0, 0x0, 0xfffffffffffff010}, {0x6}]}, 0x10) sendmmsg(r1, &(0x7f0000001e80)=[{{&(0x7f0000000700)=@l2, 0x80, &(0x7f0000001dc0), 0xffffff7f00000000}}], 0x1, 0x0) 01:57:08 executing program 5: perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1f}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000340)={&(0x7f0000000000), 0xc, &(0x7f0000000300)={&(0x7f0000000240)=@newlink={0x50, 0x10, 0x721, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x0, 0x800000000000000}, [@IFLA_LINKINFO={0x28, 0x12, @veth={{0xc, 0x1, 'veth\x00'}, {0x18, 0x2, @VETH_INFO_PEER={0x14}}}}, @IFLA_NET_NS_FD={0x8}]}, 0x50}}, 0x0) [ 714.172635] binder: 16707:16708 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 714.204911] binder: 16707:16733 Acquire 1 refcount change on invalid ref 0 ret -22 [ 714.287746] binder: 16708 RLIMIT_NICE not set [ 714.297405] binder: 16707:16733 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 01:57:08 executing program 4: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000)='/dev/kvm\x00', 0x400105bfc, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r2, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000280)=[@text64={0x40, &(0x7f0000000500)="0f0866b8ed008ec066ba4000b000eed2a807000000410f01cab98e0b0000b862000000ba000000000f30b90b0800000f320fc72a8f2a60128f00000000003000000fc7aa00100000", 0x48}], 0x1, 0x5d, &(0x7f0000000580), 0x0) syz_kvm_setup_cpu$x86(r1, 0xffffffffffffffff, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000140)=[@text32={0x20, &(0x7f0000000100)="0f0103f26d67f2f7320fc79b000000000f01cbc4c23dab8b0a000000f2a3381dd45266baf80cb8bcbd3f80ef66bafc0cb803000000ef0f239df20f5a5b00", 0x3e}], 0xaaaacd8, 0x0, &(0x7f0000000140), 0x0) openat$cuse(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/cuse\x00', 0x0, 0x0) ioctl$KVM_RUN(r2, 0xae80, 0x0) 01:57:08 executing program 2: r0 = socket$inet(0x2, 0x3, 0x2) connect$inet(0xffffffffffffffff, &(0x7f0000000000)={0x2, 0x0, @local}, 0x10) setsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x23, &(0x7f0000000000)={{{@in=@multicast2, @in=@multicast1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd}, {}, {0x2}, 0xff2}, {{@in6}, 0x0, @in, 0x800000000000000, 0x0, 0x0, 0x400000000000000, 0xa5b8, 0x5}}, 0xe8) syz_emit_ethernet(0x2a, &(0x7f0000000640)={@random="b100485caa2a", @link_local, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x1c, 0x0, 0x0, 0x0, 0x2, 0x0, @rand_addr, @broadcast}, @igmp={0x11, 0x0, 0x0, @multicast1}}}}}, &(0x7f0000000140)) r1 = syz_open_dev$midi(&(0x7f0000000100)='/dev/midi#\x00', 0x6, 0x101000) setsockopt$inet6_udp_encap(r1, 0x11, 0x64, &(0x7f0000000180)=0x3, 0x4) connect(r0, &(0x7f00000001c0)=@generic={0x3, "83ad0d185c54f683b567b30fd1e7e710626f0719981807254de5c3b30eb7f7da39e297b3faa4a11605e265be40a63c9724894d5530652623515742e62b42ffa65d89bcdb616f71b7046acc6f353cb7aba7eb189f0acb87ae3801c44d1de5f9feef24c84b1768681e8d519813f048ef85a5578e498cb8234295ed501dad88"}, 0x80) 01:57:08 executing program 3: r0 = socket$inet(0x2, 0x3, 0x2) connect$inet(0xffffffffffffffff, &(0x7f0000000000)={0x2, 0x0, @local}, 0x10) setsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x23, &(0x7f0000000000)={{{@in=@multicast2, @in=@multicast1}}, {{@in6}, 0x0, @in6=@loopback}}, 0xe8) syz_emit_ethernet(0x2a, &(0x7f0000000640)={@random="b100485caa2a", @link_local, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x1c, 0xf0ffffffffffff, 0x0, 0x0, 0x2, 0x0, @rand_addr, @broadcast}, @igmp={0x11, 0xffffffffffffffff, 0x0, @multicast1}}}}}, &(0x7f0000000140)) 01:57:08 executing program 1: perf_event_open(&(0x7f0000000080)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff7ffffffffffb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$inet6(0xa, 0x3, 0x200000088) bind$inet6(r0, &(0x7f0000000040), 0x18) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000000400)={0x0}, &(0x7f0000000440)=0xc) sched_setaffinity(r1, 0x8, &(0x7f0000000480)=0x5) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f0000000000)={[], 0x0, 0x9, 0x8001}) perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x3e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff7fffffffffff}, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$BLKTRACETEARDOWN(0xffffffffffffffff, 0x1276, 0x0) msgget$private(0x0, 0x0) inotify_init1(0x80000) stat(&(0x7f0000000240)='./file0\x00', &(0x7f0000000300)) getuid() getgid() ioctl$TIOCGSID(0xffffffffffffffff, 0x5429, &(0x7f0000000280)) r2 = accept4$inet(0xffffffffffffffff, 0x0, &(0x7f0000000100), 0x80800) getsockopt$inet_sctp6_SCTP_AUTH_ACTIVE_KEY(r0, 0x84, 0x18, &(0x7f0000000140)={0x0, 0x2}, &(0x7f0000000180)=0x8) setsockopt$inet_sctp_SCTP_RECONFIG_SUPPORTED(r2, 0x84, 0x75, &(0x7f00000001c0)={r3, 0xe247}, 0x8) r4 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) r5 = bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000001400)={&(0x7f00000002c0)='\x00'}, 0x10) ioctl$sock_bt_hidp_HIDPGETCONNINFO(r5, 0x800448d3, &(0x7f0000001440)={{0x3, 0x8000, 0x1, 0x5, 0x1, 0x4}, 0x8, 0x1, 0x81, 0x3, 0x20, "ae0ab017dcbf09d58fa5d7259b5ce8f4c1ae6eaf7202d79c378080edcd8920872f472f9d8c53f5b78817fe7da66c7f74a1585bb886d91695a5fc492bcd74cc318fe2b3d314ee17c89e7aa1f7b8028606bbbda479bba62141d768540e5663d107c2ffbbd13141427df4894dbd307a240794bd34c8417eb518f4601f59a44d72f5"}) write(r0, &(0x7f0000001500)="ccfd1259caccbb6f7549979c652b131ad78999c340a50e87bea398d59ee242de603ccf9de8bcf1ecdfd86d6e61a71a3c0fac1c34fe0d21d1adf77bba96c4d1d6339a691dfe38ee3e20cccfec079c64f64d1aba5654c231d3f890ec88ac68f476d6502adc25728db7e42f400cda1b2dcc9dbbd22874c7905eb31d2233ffaa0bd7ead61b598e7fd53f2ef9844fff8ed9e49c8b0f38e7242b0df4173b734269dbf731", 0xa1) r6 = socket$inet6(0xa, 0x1000000000002, 0x0) pipe2(&(0x7f0000000200)={0xffffffffffffffff}, 0x800) ioctl$SNDRV_RAWMIDI_IOCTL_PARAMS(r7, 0xc0305710, &(0x7f00000013c0)={0x1, 0x0, 0x1ff, 0x5}) ioctl(r6, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f760070") socket$bt_bnep(0x1f, 0x3, 0x4) open_by_handle_at(r4, &(0x7f0000000380)={0x1008, 0x200, "37e4451339d07852ab8958b3da6fdedd333a74e565036a258843979cb566bc377a79ef35f95c386758ff5ff78fa264601c4bfd635de5205c89e135d948dace32923d6bf3ad848e540c8ffacf321f8859d71a53bf3549d9cf2235a83efff51ca215c72babd6733fe4e26b7ee43ea7e84d484122f9b3df576a59bda2c08d2e4d2546d6fbab287326c0c0b115f44297f677da3e4fec3c4c3e3676c33187ac0e681bbb891e0a30d9c298d610b51af6e2eb6fa6b692e42a328d3f9e8490cc8cd6aef24796c06052ad5e1fedeece2d423f87611639923e05a7608639f21373741beed59706806396962b962c301f6b6be6a7fdfe08d3dc47756e35cbed84631525239a3bcbac624013b8a8c2e3a74974a3686d09f1682e2d46d0ea7b93ddcb5c680d8ed3f923fd9ed588022fd5197aa444ca27b4816399fb1cbc2f5de6f363b0114cbd22ce6118726dac6355bd89c84937325b34ab3747e65779b365d0b7b3320937a806bcbfc8f0f709a79dc5ae2cea7eb7b612df9c27019235341b84329aa830dbf1200b2013d38ce4bce755ddf7e4972a1a8f5de6d48a7ae6876003f7381f9930dfbdc85412fbf7af38a912738f9d0dda6c2e2623ecaf29862b9f9d0d5e3b01bb318880c5a66fa7bbf5d8b6a58cc52539490665974ceea65c2805dd7f226a7feeee49f22fcc6ba7fba07e803302323e9f9877dd7adb6319715e8e570e2364a47fa81cb1f30f383ef63f9f75087451dd53e9483854fc64191ba0665638f4aeee23d30c7050d47f89598299f461096f8f74481163e764af31192832520e3804c83701f83e9185b78e706b96ba0228676790602c2395ce36d6d9e04f03c44e0633646a407abe71185faa253cbd83912310e66be37ba225cc5b1d91eb35616392a7b532300115968439fa8d337a7cc23c0d91f83d1d6f7df9f3e96e9d1c2f26d1b3c9bc58fb50935818cef2175ad22958a7f208fa11878a5cd4c6d16d51507385baaff0345ad1fa60ee0e68961d814b06244f0373ab797885c61114b37b7733bb124b80200111bfc014661cda1ad1c2ba61f7c82c98df6b18a9dd7164af07e0119a5a5a2295e7aab426b1486f447205064f14265faf951d42c57e94c42f41954affcf9a7f0899a6a9c238088e34847b3335503a0d9faf567cdf109275ad67d6245d650b4f91c67dfadbc7465952bd7a1facc5350acb1ad9fb26c43c581b1d184d8a01cb2bd886d6e2ef7e9bc3f64c39f26ea16d5ba8a8ebb7e84925b81a88dffa309fb965067941fa545d4c6604b006a85dcf6ab4939b11b24069577426de2dd389cab4c79e35e2eaa5573f2b26e4785d030ffe678f4237ebd1cb34c3ce0d0432904ff9c5bad97781657c64961c7e3bf13d71c1cfd081d38d952329edc9b72a7ce2166f0f94be4d056a82f86a91725ccae52ddbdd06d69c39a69cc620d153f05beb40b49081abda63c7e18684d83fa5eeeb068980468297d43b5150e57ca3ae06c1819ca7245505c4febb564b69bc07bb8448d6001654874c05eb3ee60e57effa2123992d3d6c1bfd78808e12a9af9a14c3f6dce8c96c29976b39569d6776211e9f54e2e6fddb5318f16564b1618f6ff5a1744a0480d4eaeffd8fe5f2fcebfb281642aedeac7d2875116ae31a1a23f76f6e79b11c4c6a2972147d8f9e753db5cee05ec7a8451852a023abff12774f459464e9f6d75c6d6cb8c485a642f075ebacc26e4f7826015a9695f608f24660301518fc327468dfa5d29ef76799f88011e2a66fa1c3e566060c872357a4698bf4370eda538d7e11b741eed81f1499b7441094a285d62d9a2eb40899b320f2faab984ef43bc5170b07ae2a994fd8d54bc45f9ddb3ae35240e286e3a3e86e67c8a9d255c5f547219ddacbd6126ed2c39d7719070569d812d6149cb321c658b7d01250f1ea50310ca985c5dbe9e43e1a8ac0346f1e1971d074215048b4a89b0f6c7c7133c5b3917c1b1e1896862a93f2f6da6ec53cf4539d267dad28061e1976771e307850504e8e02f90785a3e09081f04855d47ac842e3ca64043a5ad6e25bf05c6194156993c21f1479645f041a308f9dd0963015cf5d324f5b3660499d8e2a67594d2fc9f82011b942dfbaaf227b265b60b5d26139eea9dafa2fea5e6c4afe286eb11023345ef6194775de977d82975f7d01c2a1f2c360fc5d982d0446f91215481f920915196485ff803c5c822ef72d3be847b9f59f8f8d6d2b8e306b56103d01d05fab0a6525cd78a90c91b12591458ce8c5d489066ea3444ece7dff451f675d47e2e270aeae10bb387a4197aca82cfd91a67bd1dde60c4da6626ebc7dbf78ac3bf89e5ff467485ca1989a253ebd733ef3d06cd8e781e01cd4edd19450f9b15fb79c3d0ba72473839966ec2c7165724054117d8dbba900728714b689401c050c4cb16291af0d61d03d91f83e587c0ffbb577fc666f163705dec81165aa9f853e45e03495a348214dea1b5346888a527d9cfc0e75754987caadc3d5c9467396cad966efaea4171bee78bf89d3a9ffcd09cd79b9694db1963cf375f00ecdc82bc366f89afe5f2f18c1e33f6ff4bbe4bed7b66f0b301674fa1af6882fa3e25e0d46371bbc21d545622c64922828ec67f3e470722390716c32549b00b0fb3c1ac953663b52529bbeb0921d6ee316b7892ffcffccb90f0adc631854ec9b349257407af2cc6c93dde59536e6f63b4308411f158876dbf1a0d6ee2c00890601ede790c803e8188d76c14db62f42bf9431c813b96420744fe1bcc026a45fbfa4fc84b6642ba5438936406edc5c6c52d0130150742a66233305d15daa85e62c07abd4ed42c1690879818d2ecd8b095c035b850d4a7a3933d1bb21f64a530835cabda7bacaceec4a9c786f500c6d8d5457b98ec96a44a2a9d379091b56494fa1e4c30660621e360d7c88612afb9cf78f219e6b98c2f47cc7f830ae8b4f212ddcfe1e233e0c077f672c41cfb7dad5a5abaac93dbfc2189954aacaaf409117c2ff722715d5a5f593a782878ab3a833337e33929b97cb15082e15b3971c48c021b4dd29ccd14f8f09e2d3748fdce355b06ec92cc09328c1abc10c226a52c0c4166291544543f075348141166d4f9738913a2c933273788dd7711efc19069c85ac4204b499265b9c469022fdf177f9a0e6f76b4c2982470ba6772070438d153fca29d0908bae8c6cc9c5179b4e2dff421f0b6ac51e13e0122d42effb62a903bb5d9dadfd0de4c5e6b744dbf62ea490b04035a72f30e80fdc4c7a054678e1d82024179473be9a161ca73358e0dbd959e7418dfa60d20216d91b9d7c92c06709c4ad5c3ac023a9dda328116b4152fc756b7473658971a1db0915f5dc75c999649eaa6ef11d5f0799290847f9c1e69db851a096a971f51ea31faefcf5331ec6a61d24424cfbbd5ffec3b0068d45cc580088301670c2e8a387be9a3af8476faad26c845350273906ca437dcd96518497b653ed3f4ef84829b36298c4f2ad49c2eb98e98c77465c86dab4e02a0cddacac230a69c3f98ee495262855569bff600acbe63b1b8ac38da37414783a54060579740c7a0e3112b0a1360248ba66ed897b2e884921f95255e716c92abbb9b14818d8457af1ce7511c649e55b072698b65549ef6fe4322be69413b41fd6b046b5543d4473f52a96c333c57c3fda39293e855f3f134939cf4e15c37fe1941f09c18ef21220b1b8bfce6e2417d6facd8d379d4f7ea13e300d443b70c854b26d4cc5d607f2f2012880e6ca4b3bd2dbc102dd3de607f3845aafd2573dd92c2a85575e19639dad45e0b79480537a8ba8373cd01c7a2d642f359400f4ab0725c67bc8fe4a7f78172f1d8ee7fc1f63982898469116ae79525f6763ceee1e470a1a4c7c60f1f61e171c1e13de279be2e2f6dea4f9f56c45bf46ecc55f33242f0a29cb2adb445f7c5405484a56b6651fd6845dbf58c63e8b6e0b627755a0176a8389d0d43d21b3c0c376b42bc6ce74ee3a49b7d2b8e49e84877fa6679b6c6290767e051810b0f630e7db315bad2e9fba2b4046f4d4ca93076e4386b644509f8e42567588573dc87e4a7d0e57e22f28f1c2d19081b2c4494fafcdaec6a49355dc5cb2f0fc32c74d90b3496e61f65317bc425af8e62d9ef72b098774e71bfce6f26f2abc9cdc36242895ede52db2e8305877a8bc45be67dd10fae806036172237c8bf7e989384688efa0cab8a636dcfec1fd023b456163e829e7094c7c96802527ab91e97fe44a684e0ffbd15c81720dcd44ff4e6a43070f1a606318dc73dceb4ce8703baafcfa7d9c5b2f09d469e7f1bf6902703ad4aeb0e4cfa52d825120f9e3ec6dd6e2560f192bcabd04aba10903af2f76371a9628b99d4d3abd11b1a08355184726647fdbef0748810e8afdc194b8e7117d6622dc96324c729ebefe214217f580464c6d48d70d16a05536587b52e748a844ff0385c5129f44d0643ef8f852ac7b83d89a8b09c4417e43c08dee78b0e3824ba7517bb7bd74e67555f509083792f3a0ae3a6be36a21341e381ae07926cda954fa223b753871cebd3442756812ed96b27dd3b17afec1b3a7d4728589fa765984212688c52a2dd1d8fce2a6a452736a4e011b6956da2b108a3347e1bcf8036d93c7bccb515bd369aba3b3bf4b39f7c956ad83a7a5bd60401aac5cc65776f41fad0cc77727e2cb90c40ac914ef1685e5cb6f855427c713ed33147e7084920b85b368f905896c8b3120d399c0500dca7cf3980b8d46d1b96b4d9b394d83664bf6eb205aeb20ae4e34466ebd21f19ee1b23c59aa8258ea3794bcf4746341189c523f9f12acd345197817aad66fe6d671197c8120b745888854709633b3e7339c634e3bbd38109144e8e5de2cf07eef2ee89a5b5747ac9f98a641228395c43377d9e77479ce7351ada7eb6288ba6fbb7c4332ab37eab9c0b680269f636a662ae47d1865421d002acc70794c67c762e5ac6755b6e9741879739c32ce4ffa63e6ac6c507b9f12955f62a0f8a5302ed42b22bf096ffde1f3e749b9975d8be417c3e2b40f151561b79fa566447b1e8043e36ddea9e6534f66c8ad8337fae6c7d6ec18c12b2dd36d7e0ed1606ac995a4973023f50497b2615498675c8ea245a68d940c19e6379f1aa8a734d148c078249a6cd687a1e81ad7887cde5709b055afe05ba152ed11085a67289064160e156e462e86723496af2cd79e021e23b8b3d91f164ca93313a9da5492c346652137b609ff7ac3c8cd17ad3f58135272e2a0c0a86601ac4fbd37ee7af81137643f44c6adb9b4be2555bc50dc89f102dd43dedba2b863c0423631fdfd580486e565985cbd12a56756b2f04ce142a80f30063be0774568f80ea732a1318d5fe8f128d85831f5d94c1b8be6827cb69480d81286a954a2d577b92caa721964b606edd9d3f3f605599432e2c68f5f79524d3ab601a77aba3cf200d06e18799499858019a18a1a4a5767c246962948a91f5b93b1ab519c9b9db7bcc06204bc27021300426191e0855d63c66ade44d708e74f7ea587cf9b8f8c8494685f42ba540da262d2c445c566416cc173652f227b15c478957e990052b339da2d9b389863d023f1bc7903e6e9923f413fa0f0ab0efe11e19e6fba1c54f665e422b9385b8e8c59c03004915f8a193e05f94090d9b18cce2bd9a386de490bf35e37019096f50109adb3b3c4b114d1df4262ed778686ac741c18197f8f5976f3a314ea00dd262a8eee5df6b9d0a62e035365efdf41ca33a00b75bd9c8ba9cec1c1945959d32a5d7fe361cdf564d1e50723f1176433cfe4dca55143391ddb8371"}, 0x10000) socket(0x10, 0x2, 0x0) getsockopt$inet_sctp6_SCTP_GET_LOCAL_ADDRS(r7, 0x84, 0x6d, &(0x7f00000015c0)={r3, 0x9d, "35fa7ffd47f431866ec6a7511bfc64fc3c2403a25b2215fa98c538a7640da7d64b962e2d046598d2a38655753696f045ce8086d197de8deb0633e40a2e6cbdd55a54cc661b857ba33be35f7b49e8c0f1ba5f5300876e72e61eae4936fa6492c6b5d6b997eaf4bb83fef25d986b754c7e3a425ee9e5b718dd16495baddf20bde777bad67d8d91e51cb06fce4c1cf2cd1a4e8daaf1c6ebdbb70feeddeaeb"}, &(0x7f0000001680)=0xa5) syz_open_procfs(0x0, &(0x7f0000000080)='net/raw6\x00') 01:57:08 executing program 0: socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000001f80)={0xffffffffffffffff, 0xffffffffffffffff}) setsockopt$SO_ATTACH_FILTER(r2, 0x1, 0x1a, &(0x7f0000ab9ff0)={0x2, &(0x7f000039a000)=[{0x20, 0x0, 0x0, 0xfffffffffffff010}, {0x6}]}, 0x10) sendmmsg(r1, &(0x7f0000001e80)=[{{&(0x7f0000000700)=@l2, 0x80, &(0x7f0000001dc0), 0xc03e000000000000}}], 0x1, 0x0) 01:57:08 executing program 7: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000180)='/dev/sequencer\x00', 0x10002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000080)="0a5cc80700315f85715070") r1 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000001c0)={0x2, 0x0, &(0x7f0000000140)=ANY=[@ANYBLOB='\fc'], 0x0, 0x0, &(0x7f0000000080)}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, &(0x7f00000001c0)}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000040)={0x8, 0x0, &(0x7f00000000c0)=[@release={0x40106309}], 0x1, 0x0, &(0x7f0000000100)='V'}) fstat(r0, &(0x7f00000002c0)) 01:57:08 executing program 5: perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1f}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000340)={&(0x7f0000000000), 0xc, &(0x7f0000000300)={&(0x7f0000000240)=@newlink={0x50, 0x10, 0x721, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x0, 0x9000000}, [@IFLA_LINKINFO={0x28, 0x12, @veth={{0xc, 0x1, 'veth\x00'}, {0x18, 0x2, @VETH_INFO_PEER={0x14}}}}, @IFLA_NET_NS_FD={0x8}]}, 0x50}}, 0x0) 01:57:08 executing program 3: r0 = socket$inet(0x2, 0x3, 0x2) connect$inet(0xffffffffffffffff, &(0x7f0000000000)={0x2, 0x0, @local}, 0x10) setsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x23, &(0x7f0000000000)={{{@in=@multicast2, @in=@multicast1}}, {{@in6}, 0x0, @in6=@loopback}}, 0xe8) syz_emit_ethernet(0x2a, &(0x7f0000000640)={@random="b100485caa2a", @link_local, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x1c, 0x3000000, 0x0, 0x0, 0x2, 0x0, @rand_addr, @broadcast}, @igmp={0x11, 0xffffffffffffffff, 0x0, @multicast1}}}}}, &(0x7f0000000140)) 01:57:08 executing program 6: r0 = syz_open_dev$sndseq(&(0x7f0000000100)='/dev/snd/seq\x00', 0x0, 0x0) read(r0, &(0x7f0000fb6000)=""/28, 0x3f0) ioctl$SNDRV_SEQ_IOCTL_REMOVE_EVENTS(r0, 0x4040534e, &(0x7f00000001c0)={0xbf}) ioctl$SNDRV_SEQ_IOCTL_QUERY_SUBS(r0, 0xc058534f, &(0x7f00000002c0)={{}, 0x1, 0x0, 0x0, {}, 0x0, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xe00000000000000]}) r1 = gettid() timer_create(0x0, &(0x7f0000044000)={0x0, 0x12}, &(0x7f0000000040)) r2 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r2, 0x8912, &(0x7f00000001c0)="0a5cc80700315f85715070") timer_settime(0x0, 0x0, &(0x7f0000000080)={{0x0, 0x989680}, {0x0, 0x9}}, &(0x7f0000040000)) tkill(r1, 0x1000000000014) 01:57:08 executing program 2: r0 = socket$inet(0x2, 0x3, 0x2) connect$inet(0xffffffffffffffff, &(0x7f0000000000)={0x2, 0x0, @local}, 0x10) setsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x23, &(0x7f0000000000)={{{@in=@multicast2, @in=@multicast1}}, {{@in6}, 0x0, @in6=@loopback}}, 0xe8) syz_emit_ethernet(0x2a, &(0x7f0000000100)=ANY=[@ANYBLOB="b100485c000008f6db60543914fffd00ffffffff11009078e03f05003431170face66b3d108a0000000000000000000000"], &(0x7f0000000140)) 01:57:08 executing program 0: socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000001f80)={0xffffffffffffffff, 0xffffffffffffffff}) setsockopt$SO_ATTACH_FILTER(r2, 0x1, 0x1a, &(0x7f0000ab9ff0)={0x2, &(0x7f000039a000)=[{0x20, 0x0, 0x0, 0xfffffffffffff010}, {0x6}]}, 0x10) sendmmsg(r1, &(0x7f0000001e80)=[{{&(0x7f0000000700)=@l2, 0x80, &(0x7f0000001dc0), 0xc000000000000000}}], 0x1, 0x0) 01:57:08 executing program 4: mkdir(&(0x7f0000fd5ff8)='./file0\x00', 0x0) mount(&(0x7f0000000080)='./file0\x00', &(0x7f0000000880)='./file0\x00', &(0x7f0000000140)='fusectl\x00', 0x0, &(0x7f0000000000)) 01:57:08 executing program 1: perf_event_open(&(0x7f0000000140)={0x2, 0xb1, 0x3e3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10000003, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = accept$inet(0xffffffffffffffff, &(0x7f0000000000)={0x2, 0x0, @multicast2}, &(0x7f00000001c0)=0x10) getsockopt$inet_sctp_SCTP_AUTOCLOSE(r0, 0x84, 0x4, &(0x7f0000000200), &(0x7f0000000240)=0x4) r1 = socket(0x20000000000000a, 0x2, 0x0) r2 = syz_open_dev$usbmon(&(0x7f0000000380)='/dev/usbmon#\x00', 0x7ff, 0x0) ioctl$SCSI_IOCTL_SYNC(r2, 0x4) setsockopt$SO_ATTACH_FILTER(r1, 0x1, 0x1a, &(0x7f00000000c0)={0x2, &(0x7f0000000080)=[{}, {0x6}]}, 0x10) getsockopt$sock_buf(r1, 0x1, 0x1a, &(0x7f0000000040)=""/1, &(0x7f0000000100)=0x1) getsockopt$inet_sctp6_SCTP_PR_SUPPORTED(r1, 0x84, 0x71, &(0x7f0000000280)={0x0, 0x7}, &(0x7f00000002c0)=0x8) getsockopt$inet_sctp6_SCTP_PR_SUPPORTED(r1, 0x84, 0x71, &(0x7f0000000300)={r3, 0xe3}, &(0x7f0000000340)=0x8) 01:57:08 executing program 4: r0 = syz_open_procfs(0x0, &(0x7f0000000280)="66642f343735006bc81a30f48a62d8694a59365f5ab67305d1fe80ed3c6153655e67e6fd4905f2e88242936ec146692c8584194c14de24e890deb876533c037ae9c8b4148a922f318f8ea48bbd0f94f3f22da9be7634ad05d5831dcc39666983d4b304d212fe28482bbee9e2610dd53e16d6c200d56c813f9f4a3391d8d5702575f43d30b6609cc3e2065200c40c97009e5876b8258b45ee5db7") ioctl$FS_IOC_RESVSP(r0, 0x40305828, &(0x7f0000000000)={0x0, 0x0, 0x6, 0x60d}) 01:57:08 executing program 3: r0 = socket$inet(0x2, 0x3, 0x2) connect$inet(0xffffffffffffffff, &(0x7f0000000000)={0x2, 0x0, @local}, 0x10) setsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x23, &(0x7f0000000000)={{{@in=@multicast2, @in=@multicast1}}, {{@in6}, 0x0, @in6=@loopback}}, 0xe8) syz_emit_ethernet(0x2a, &(0x7f0000000640)={@random="b100485caa2a", @link_local, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x1c, 0x6000000, 0x0, 0x0, 0x2, 0x0, @rand_addr, @broadcast}, @igmp={0x11, 0xffffffffffffffff, 0x0, @multicast1}}}}}, &(0x7f0000000140)) 01:57:08 executing program 2: r0 = socket$inet(0x2, 0x3, 0x2) r1 = open(&(0x7f0000000100)='./file0\x00', 0x101880, 0x100) ioctl$KVM_SIGNAL_MSI(r1, 0x4020aea5, &(0x7f0000000180)={0x5000, 0xd000, 0x0, 0x10000}) connect$inet(0xffffffffffffffff, &(0x7f0000000000)={0x2, 0x0, @local}, 0x10) setsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x23, &(0x7f0000000000)={{{@in=@multicast2, @in=@multicast1}}, {{@in6}, 0x0, @in6=@loopback}}, 0xe8) syz_emit_ethernet(0x2a, &(0x7f0000000640)={@random="b100485caa2a", @link_local, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x1c, 0x0, 0x0, 0x0, 0x2, 0x0, @rand_addr, @broadcast}, @igmp={0x11, 0x0, 0x0, @multicast1}}}}}, &(0x7f0000000140)) 01:57:08 executing program 5: perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1f}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000340)={&(0x7f0000000000), 0xc, &(0x7f0000000300)={&(0x7f0000000240)=@newlink={0x50, 0x10, 0x721, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x0, 0x8000000}, [@IFLA_LINKINFO={0x28, 0x12, @veth={{0xc, 0x1, 'veth\x00'}, {0x18, 0x2, @VETH_INFO_PEER={0x14}}}}, @IFLA_NET_NS_FD={0x8}]}, 0x50}}, 0x0) 01:57:08 executing program 0: socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000001f80)={0xffffffffffffffff, 0xffffffffffffffff}) setsockopt$SO_ATTACH_FILTER(r2, 0x1, 0x1a, &(0x7f0000ab9ff0)={0x2, &(0x7f000039a000)=[{0x20, 0x0, 0x0, 0xfffffffffffff010}, {0x6}]}, 0x10) sendmmsg(r1, &(0x7f0000001e80)=[{{&(0x7f0000000700)=@l2, 0x80, &(0x7f0000001dc0), 0xeffdffff}}], 0x1, 0x0) 01:57:08 executing program 1: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000280)='/dev/nullb0\x00', 0x4002, 0x0) mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x200000e, 0x10, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000410000/0x2000)=nil, 0x2000, 0x2, 0x40032, r0, 0x0) sendfile(r0, r0, &(0x7f0000000040)=0x3c002800, 0xc10000) [ 714.916109] binder: 16788:16790 Acquire 1 refcount change on invalid ref 0 ret -22 [ 714.945059] binder: 16788:16790 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 01:57:08 executing program 3: r0 = socket$inet(0x2, 0x3, 0x2) connect$inet(0xffffffffffffffff, &(0x7f0000000000)={0x2, 0x0, @local}, 0x10) setsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x23, &(0x7f0000000000)={{{@in=@multicast2, @in=@multicast1}}, {{@in6}, 0x0, @in6=@loopback}}, 0xe8) syz_emit_ethernet(0x2a, &(0x7f0000000640)={@random="b100485caa2a", @link_local, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x1c, 0x600, 0x0, 0x0, 0x2, 0x0, @rand_addr, @broadcast}, @igmp={0x11, 0xffffffffffffffff, 0x0, @multicast1}}}}}, &(0x7f0000000140)) 01:57:09 executing program 4: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = syz_open_procfs(0x0, &(0x7f00000001c0)='oom_score_adj\x00') writev(r1, &(0x7f0000000100)=[{&(0x7f00000000c0)="2b3497f8f44ecf5ac42a6cc5c0594d74910d4221c36c9a68d8c724008b1d4488ca22378a465db88d75226e236fc5e2b91a8620e137ddd065fb", 0x1}], 0x1) [ 715.064121] binder: 16788:16815 BC_ACQUIRE_DONE u0000000000000000 no match [ 715.153775] binder: 16788:16815 Acquire 1 refcount change on invalid ref 0 ret -22 [ 715.211775] binder: 16788:16815 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 715.233126] binder: 16788:16790 BC_ACQUIRE_DONE u0000000000000000 no match [ 715.240354] binder: 16790 RLIMIT_NICE not set 01:57:09 executing program 7: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000180)='/dev/sequencer\x00', 0x10002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000080)="0a5cc80700315f85715070") r1 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000001c0)={0x2, 0x0, &(0x7f0000000140)=ANY=[@ANYBLOB='\fc'], 0x0, 0x0, &(0x7f0000000080)}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, &(0x7f00000001c0)}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000040)={0x8, 0x0, &(0x7f00000000c0)=[@release={0x40046302}], 0x1, 0x0, &(0x7f0000000100)='V'}) fstat(r0, &(0x7f00000002c0)) 01:57:09 executing program 2: r0 = socket$inet(0x2, 0x3, 0x2) connect$inet(0xffffffffffffffff, &(0x7f0000000000)={0x2, 0x0, @local}, 0x10) setsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x23, &(0x7f0000000000)={{{@in=@multicast2, @in=@multicast1}}, {{@in6}, 0x0, @in6=@loopback}}, 0xe8) syz_emit_ethernet(0x2a, &(0x7f0000000640)=ANY=[@ANYBLOB="b100485caa2acc0180c200000008004500001c0000000000b2957800000000ffffffff11009078e00000"], &(0x7f0000000140)) 01:57:09 executing program 5: perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1f}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000340)={&(0x7f0000000000), 0xc, &(0x7f0000000300)={&(0x7f0000000240)=@newlink={0x50, 0x10, 0x721, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x0, 0xf00}, [@IFLA_LINKINFO={0x28, 0x12, @veth={{0xc, 0x1, 'veth\x00'}, {0x18, 0x2, @VETH_INFO_PEER={0x14}}}}, @IFLA_NET_NS_FD={0x8}]}, 0x50}}, 0x0) [ 715.377977] binder: 16840:16841 Acquire 1 refcount change on invalid ref 0 ret -22 [ 715.409483] binder: 16840:16841 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 715.417260] binder: BC_ACQUIRE_RESULT not supported [ 715.423244] binder: 16840:16841 ioctl c0306201 20000040 returned -22 [ 715.432459] binder: 16840:16845 Acquire 1 refcount change on invalid ref 0 ret -22 [ 715.448132] binder: 16840:16845 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 715.455574] binder: BC_ACQUIRE_RESULT not supported [ 715.468087] binder: 16840:16841 ioctl c0306201 20000040 returned -22 01:57:09 executing program 0: socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000001f80)={0xffffffffffffffff, 0xffffffffffffffff}) setsockopt$SO_ATTACH_FILTER(r2, 0x1, 0x1a, &(0x7f0000ab9ff0)={0x2, &(0x7f000039a000)=[{0x20, 0x0, 0x0, 0xfffffffffffff010}, {0x6}]}, 0x10) sendmmsg(r1, &(0x7f0000001e80)=[{{&(0x7f0000000700)=@l2, 0x80, &(0x7f0000001dc0), 0x3}}], 0x1, 0x0) 01:57:09 executing program 3: r0 = socket$inet(0x2, 0x3, 0x2) connect$inet(0xffffffffffffffff, &(0x7f0000000000)={0x2, 0x0, @local}, 0x10) setsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x23, &(0x7f0000000000)={{{@in=@multicast2, @in=@multicast1}}, {{@in6}, 0x0, @in6=@loopback}}, 0xe8) syz_emit_ethernet(0x2a, &(0x7f0000000640)={@random="b100485caa2a", @link_local, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x1c, 0x300, 0x0, 0x0, 0x2, 0x0, @rand_addr, @broadcast}, @igmp={0x11, 0xffffffffffffffff, 0x0, @multicast1}}}}}, &(0x7f0000000140)) 01:57:09 executing program 6: r0 = syz_open_dev$sndseq(&(0x7f0000000100)='/dev/snd/seq\x00', 0x0, 0x0) read(r0, &(0x7f0000fb6000)=""/28, 0x3f0) ioctl$SNDRV_SEQ_IOCTL_REMOVE_EVENTS(r0, 0x4040534e, &(0x7f00000001c0)={0xbf}) ioctl$SNDRV_SEQ_IOCTL_QUERY_SUBS(r0, 0xc058534f, &(0x7f00000002c0)={{}, 0x1, 0x0, 0x0, {}, 0x0, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffff00000000]}) r1 = gettid() timer_create(0x0, &(0x7f0000044000)={0x0, 0x12}, &(0x7f0000000040)) r2 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r2, 0x8912, &(0x7f00000001c0)="0a5cc80700315f85715070") timer_settime(0x0, 0x0, &(0x7f0000000080)={{0x0, 0x989680}, {0x0, 0x9}}, &(0x7f0000040000)) tkill(r1, 0x1000000000014) 01:57:09 executing program 4: r0 = openat$snapshot(0xffffffffffffff9c, &(0x7f0000000000)='/dev/snapshot\x00', 0x440000, 0x0) accept4$inet6(r0, &(0x7f0000000080)={0xa, 0x0, 0x0, @remote}, &(0x7f00000000c0)=0x1c, 0x80000) r1 = socket$inet6(0xa, 0x802, 0xf19d) getsockopt$IP_VS_SO_GET_DAEMON(r1, 0x0, 0x31, &(0x7f0000000100), &(0x7f0000000040)=0x4b) setsockopt$inet6_buf(r1, 0x29, 0xed, &(0x7f0000000140)="62b519e904cf2da8079b93e13255da0528902b55842e912b42b7642cb4ca7db70e1b26719c6d9b8d5e8da6fd13a99e7b829c4a8326b92821960930f6ba40802c32962109abf54067bb8fdca73582d72f4532863169e040b9141607003c44d9a32b3308405fac93298bc3ad6515262fddddabc23d78d5cf773dbea16577dd5ab75abedff502eb52101cbfdc35b7b0666653f384853a74958c77b89d41ab8627144688b984159e5b9e2b14885df45297733dac084c48eebc49e1dd8aa51b76f72c68f24cda7ffafd6b7c7b241605f538dee564d6b42e3c2517c0e2e2fac50a390545e2ac906f496fa9c62616cc27c5e9bc6416a050a89c6930", 0xf8) 01:57:09 executing program 5: perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1f}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000340)={&(0x7f0000000000), 0xc, &(0x7f0000000300)={&(0x7f0000000240)=@newlink={0x50, 0x10, 0x721, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x0, 0x900000000000000}, [@IFLA_LINKINFO={0x28, 0x12, @veth={{0xc, 0x1, 'veth\x00'}, {0x18, 0x2, @VETH_INFO_PEER={0x14}}}}, @IFLA_NET_NS_FD={0x8}]}, 0x50}}, 0x0) 01:57:09 executing program 1: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="0a5cc80700315f85714070") pipe(&(0x7f0000000780)={0xffffffffffffffff, 0xffffffffffffffff}) r3 = getpgid(0x0) write$P9_RGETLOCK(r1, &(0x7f0000000040)={0x1e, 0x37, 0x1, {0x0, 0x8, 0x5, r3}}, 0x1e) r4 = gettid() vmsplice(r1, &(0x7f00000014c0)=[{&(0x7f00000004c0)='0', 0x1}], 0x1, 0x0) timer_create(0x0, &(0x7f0000044000)={0x0, 0x12}, &(0x7f0000044000)) fcntl$F_SET_RW_HINT(r0, 0x40c, &(0x7f0000000180)) getsockopt$XDP_STATISTICS(r1, 0x11b, 0x7, &(0x7f0000000080), &(0x7f0000000140)=0x18) timer_settime(0x0, 0x0, &(0x7f00000000c0)={{0x0, 0x8}, {0x0, 0x9}}, &(0x7f0000040000)) tkill(r4, 0x1000000000016) write(r2, &(0x7f0000000100)="03", 0x1) getsockopt$inet6_IPV6_XFRM_POLICY(r2, 0x29, 0x23, &(0x7f0000000840)={{{@in6=@remote, @in=@local}}, {{@in=@dev}, 0x0, @in6=@mcast1}}, &(0x7f0000000940)=0xe8) ioctl$RTC_WKALM_RD(r1, 0x80287010, &(0x7f0000000740)) ioctl$ION_IOC_HEAP_QUERY(r2, 0xc0184908, &(0x7f0000000800)={0x34, 0x0, &(0x7f00000007c0)}) recvmmsg(r1, &(0x7f0000000700)=[{{&(0x7f00000001c0)=@ll={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @remote}, 0x80, &(0x7f0000000600)=[{&(0x7f00000002c0)=""/113, 0x71}, {&(0x7f0000000340)=""/106, 0x6a}, {&(0x7f00000003c0)=""/188, 0xbc}, {&(0x7f0000000240)=""/52, 0x34}, {&(0x7f0000000500)=""/193, 0xc1}, {&(0x7f0000000480)=""/27, 0x1b}], 0x6, &(0x7f0000000680)=""/98, 0x62, 0xffe}, 0x5}], 0x1, 0x100, 0x0) getsockopt$IP_VS_SO_GET_TIMEOUT(r2, 0x0, 0x486, &(0x7f0000000000), &(0x7f0000000980)=0xfffffffffffffe9b) 01:57:09 executing program 2: r0 = socket$inet(0x2, 0x3, 0x2) connect$inet(0xffffffffffffffff, &(0x7f0000000000)={0x2, 0x0, @local}, 0x10) setsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x23, &(0x7f0000000000)={{{@in=@multicast2, @in=@multicast1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5e}, {0x1000000000}}, {{@in6}, 0x0, @in6=@loopback}}, 0xe8) syz_emit_ethernet(0x2a, &(0x7f0000000640)=ANY=[@ANYBLOB="b100485caa2a0180c2800000080045b2cb403f0d076698e02be6cb916affffff00008000029078000000"], &(0x7f0000000140)) 01:57:09 executing program 7: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000180)='/dev/sequencer\x00', 0x10002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000080)="0a5cc80700315f85715070") r1 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000001c0)={0x2, 0x0, &(0x7f0000000140)=ANY=[@ANYBLOB='\fc'], 0x0, 0x0, &(0x7f0000000080)}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, &(0x7f00000001c0)}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000040)={0x8, 0x0, &(0x7f00000000c0)=[@release={0x40486312}], 0x1, 0x0, &(0x7f0000000100)='V'}) fstat(r0, &(0x7f00000002c0)) 01:57:09 executing program 4: r0 = syz_open_dev$dmmidi(&(0x7f0000000480)='/dev/dmmidi#\x00', 0x7, 0xa440) setsockopt$IP_VS_SO_SET_DEL(r0, 0x0, 0x484, &(0x7f0000000500)={0x89, @local, 0x4e24, 0x0, 'rr\x00', 0x21, 0xff, 0x2}, 0x2c) r1 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r1, 0x8912, &(0x7f0000000280)="025cc80700145f8f764070") r2 = socket$alg(0x26, 0x5, 0x0) bind$alg(r2, &(0x7f0000000080)={0x26, 'skcipher\x00', 0x0, 0x0, 'ecb(twofish)\x00'}, 0x58) recvmmsg(0xffffffffffffffff, &(0x7f00000077c0)=[{{&(0x7f00000005c0)=@in6={0xa, 0x0, 0x0, @remote}, 0x80, &(0x7f0000000cc0)=[{&(0x7f0000000640)=""/96, 0x60}, {&(0x7f00000007c0)=""/210, 0xd2}, {&(0x7f00000008c0)=""/167, 0xa7}, {&(0x7f0000000b40)=""/100, 0x64}], 0x4, &(0x7f0000000d80)=""/4096, 0x1000}}], 0x1, 0x0, &(0x7f00000078c0)) r3 = syz_open_dev$dmmidi(&(0x7f0000000000)='/dev/dmmidi#\x00', 0x80, 0x200040) sendmsg$alg(r3, &(0x7f0000000440)={0x0, 0x0, &(0x7f00000003c0)=[{&(0x7f0000000100)="339e6c31f7d9df22dd10e3c297547418ec7b5f71014f4a7b81a115d6c5ab2b6f5bac8741b274523fba9e03e7c1a25c93ee288384d250891905495d9132b9c550415bfcb939cc1ff2236ba1025e3bb9b121693e157472", 0x56}, {&(0x7f0000000040)="604f735eb4413b8984fa97e9b73540c1b05c701e9960314385c7fff8a6f02e99082b895438ac1076fc2f3e7ed5ae3a00352d4b50a94bf04b8b5f64", 0x3b}, {&(0x7f0000001d80)="0214741964d54ffc095129970dc9a5fedfe4e26e17099304277d6df3ed28d7e4cb344985910a7f044285f8d82d78016473718443a970b6784815bcfae6e3823c9437c7e77808b256822b5398c566ee8c1b52dd16b42cb7cbdee51eca43e1e21ffb1e3687664c1a1bd88219b37a94866bd9419a7659cde5f0ed9ce0dc5c8bbb6388b54926580edb254c6d5e1dbba807789ce32cadd67b1bfe55d780f38a3db3836ad87ff4841bbbf6ddc9ce305cc311e35ff7872caee8d914ce034877fa831e5042fd15ad63eccd35f55dc35c17aaa5d1044e8f70e327a2a4e7c76df3653b50fdcd3c41fdf535144acc6872a3315b29846a9d93ae2f5b6731e46f4deed1ffb5bc934f9f78138703ab672be54e77b174596dde492cc9cb3ba3f08ed6640ba2551cb77c268ef53e1ed98ce001839248c602f854923ed8297dbdb04bd140c7eac2e342fd179fbaa19d1e6b94f03cf5e44efeb8b94dcdddb0e797ba58df81d4eb7dae6efe4ca321ed31fcae8b758e13b28aa84611ea5e4d50087e3279d3c14fe3c4a308549e959bc4d3d9e87cecbf81a6b7769056f0a77c61ef9a2b26f47de3ead7bdb70937cfd1acfd7aee66f4c2aaeaec7d3a4cfd1d9c5f57c6672cba5938256264ccdcaa8466dca74bfa2437e7e32c7bf73065da2691258421aa0d4a3fbc88abf51c7fd03186b9ec4ecf5622197ba7eec5500cf7e001dcf7b7a75f579a26b62d790e83a3dd0cc18d20f634b0a8eb8b3882db86720b1916e63f64184d4f8d8c26e741a93e989f287f7cde7a12d0fbf5598a5d782d82ff13d87e0bd066c9828befb630925dbdc72c622ace2647007f45bf701d423344eb0a4ae90fb7204fa0329351122cd3b2a22cadf0e9e4efed4b79e95c93516d64adb4f159791b7e62b7eb9656dc8f977c68cd544a032a52013a514737148c984806513d1beea577d3a203e24bad573e68af2fb871c57ebfb9e3d276f30f941febfb8877dc5f0d3137a38c0ae89b71d36469b67a2f4980e034edbf913ba6665204524ccd95e8da0194729f9003ad798b33356c4bd08f082b06e8c30148d9482ca7ada2b74125504aad572e2a589dd0017cfbbcd3d580758fb45e379a8c7196b051c5e5d55c243facab2c09dc7b7ff134d6f7e64bdc9d287564f9325e2a36d11a21bf41cd66434b6d780b4cf327c79e7623b8135ea4e77d739824ab105954c4408c182e5e47991b151900340253c0bdba46ccefb5b214f5059701148b01305c589c7eddd09e7ebf48fb90a096a1d9b9df62a3cb8e7e3a7b9e11ab7ded8fab6ece6fa6e68a0595d46b19ebfc348a352b2c53e9a370a8b0dee16cb7f1019a05fb241b1996c772caa50094a46181e4f25c3741d92d852567d49c44e92e3550fa86cf20b47134ada91d422f18b162999044fceec92526b512d49a823a2a15205a9d200895240776f783850ef0bf81b8511017fe53aa1ca6a81a12f49744ac64a49bed9ddb52833a023bcec8d9c09b66691b1b172e6d31cf815c268fd8a8000ce05a18c5fc7b08f6eae76732eda4287aa90603a0dbac8f9dbd6664e81ff9114334be7e78ffafca05043e18994f52251eddf7a24c4ea64f547b4ac400a438b7deda32c8d45cb32e1acb6144922427fbcdaa6ef5f7c5fd59ae18919043f0e92bf319073cdf767b49994ea145219c9a341e22082c969c0810582cddd5ea5fab6d52cc6970185e348c7f5fd12e819f4a4314c6d8aec648c787b057b9934b0e8ebd143560c1e4f6ca86ff41e637532f808411e0910238ed09bc38d8fb1e7c815fe97726288c023f0641155a89a83d851d75c3789806d0374d96cdf4b73c69e067b3914d71fc1387cb867cb4d951b680a12c47d5770056545682cdbbe26fbc876bfc41cdbb206d64fb0319aa83f0992e68acad856b8e4d32474c98fe15ed50f5eeed02c3d6adb04292edb5ed0713bb174a51af14353b7a34d3854b7b94f377d1e9df96b58e4967322403749428f5f10a81b437cf0e09bfbaa88fcb4341c63ec58351329ec490b53992649cfa85099c8fe311f292902af4f2d5203017c2396accacf389e2629444c4fa4faa7442f6d51f61ff2d0f87af3c0714e7a17565682f952a4c73711f752ca3186505709fb423eca42f97ce15c364b08449c17bdff7e2d11d103080ae01a81f780e520d43150a78b6e91fa3537c75a6b0aff1f33bf6602e87b77bbf9cb31f66fec06072f44be1cb624ba6ed85b2d5400cf1ee51501d3be4b5f226cda597b4c889032beafd12876dea058c86c9aae9928ab115ee45052bc34489064ba673237239bd441b8423de1076a63e13dbd4015a5f3995cf00fcaaffc3aff64a01d216ccb80e87864a5dcd376c5048b2d0a578d563f484d0bab7ce9a0a8d9492e8d4053ac39e79b3ab73b3e3eefdfb38a1656c61c92f22025f6e2996a12745b111082aa3bddb256f305c88bcf2cbd08184afe3eb144fcbf439439b0ed73fd960d85b0bef352fb202b9f78d5791f7f6e266173a2afdc77d9600e2a50d1797499e0af539e0f91e9862c001947c063b3238ad449db12fd13b2fe32e74b6e508b688136cdaaa332f0fc222bd95ab729c7e536e63fbe6eeae171a0540596f89778106af6aa8a0c70b32d488a44dbb69c7d2b8d0de85be84c1db27097a93e757612bb512cce9f0d39f0c9e96828b483907019e5176ab710806b2fb58ee0445c307f3af0fee5bcce1dbed6e21b67c4c2c0b856d4b58266c4f85ca69f506e53833ae1d04d23d0a74d87c9f07c153e63646b813002035064c875b9d8ea1fb69a1d0f0c1d1e652a8ff4e7e1d29161b8573e8503b7aec8b3dfd290856ba63a72d729c88805fcbece107ee88e3f3ea2b4d1cc30f0fe7699716b47e0172f4c8f7bd10a9c396bb731b50cc8f9ac102a09c72891e0a2ad9c9fee80e002a365a9c2bce40708f1e95cdf2099701da457d26b94ed6b512183e374f73ee91d4a5752b5252c0f7e50d9ec89a07144bf31eb6cf282cfe9f204597c9131a2de9898712cb6a756bcc994881b979fdfdcdd6ce1f3c14f249d176047f31887399a0c5934895f6b11300b4c79d5270dda9316879a7473ab9679169f57962e52f68bdcf2d3e8c5c9b323e53d82a05ff20af6f7a70c87b7d74cf3dc034e7aebbcf9426ee6be40dec172bbf4c03b97444a73f0acb7721b27f0be0480e039ca6e8ac0838e44e1e25c01b4823de9b3d4d0358f50bb08ea01730df9ac2e53a500544c244fb73589dabb8c558aa57a1f8bb6fd2da52f8b41e677cdaab0ea4fc3821df7d19fcb19c2071ca3314b163bb3be2f3a2a5e9259a67b724e8c00c4111a344b0dd1de7cdcf7fc0c1c826168e73f09a433ea91d44d75e6cb9a9e4b7eec774b502c504dbc98a1f9974354395e8bf508c02f4144c81eb48135fe77ca6ffd1f6c5562b2dce0806b14db0cad85288ff18eb0b32a7c9af87b5052aa123b07f0835014e57cb5849827fe7a0a942de136fa5e30a85f774f0a3b5e3da1804fa110ba9098abda5714ba17a420f65cb31697546b498aba333328c016799355032c0eb552f1fb5b046bcc6d010b7c5cfe83cbd128a02b58ee4265370d4a20d4753a84ce696746fa77bd61a84a7fd681349e0ea0c8e0fb89bc19a7a19f192ef0b10bd58c22dc2bc5935f0875519d11daa9bcf76e38acadecc9819dbb23cf63e1b64ecdea8c61ff1cbae40dffd0fe49684488da0dc9026b7cca6cac1b9aa0dde8b352675dc88b0f7bdaa9038a0562ac952a84daa3b9005cf559e9dcc2abc0cfe544dbfc2884e7411f43f82dc8773e1a0580cc5949ee8cfee2c0714852c6b9c877feb6bc636675ffac47c6f24b30858ea9909be1dd0d00962a3be770051a7139f496223aa39b9fd386e80fb026f205945e59d4392c42206888a7b406ade8e3558374236e8a6cf28324b68c77b22f819ad3504fa5e3ec50cc9e619bf630d0ac91e5638deb51ff7ba6a735e1165e0cc6fd54b9a2cd251e6b624df22eb9e96021bcda5d37dc899c85ea3de892c7f880608bdaf581476cd06d502c625ad1239d525b166b99f6c1ccb37d217b0e7370173573f61f9ff2a2cab1f15fd7c3ce0f72dee7f596a83dea521526bb33ffe686d726f6588e3d61e314b5a8b4ab55faea01c31d5d8f7a485cb1a0d1ecb073bbe3df4ef20afb809fba47bf11afb1ad9e993ac5ba2ad991d68d94fc6edd5fad69345ed33c29d0d5e5b607aa608180953cd916cb13da287d132d2d3960d3e6c48969ac6dd5734312273373cad1184f06b4316ce08d5ece46f39581b4e33569382f2b78e580dabbf414ed4b202cffcfbf07c814d9a3d5db40d2f608d1dd821309c3e4baeb40cfc69a883982a7db1de6302c748bbe574d05da6d5dbdca45c962ac466e0a568e6fe0f48c47d327301d711162ee6223b58f06f4469a6ecbb854883ec7d22f19af49aa277b1f61e80c5b73d04570ca4809e930945e6c0a11bc790d396c188f49602c83a548f6cb4d9ed2c4dba185aff617b76463b994bf308b4c03a3db5c8723adc71a76d880f96f9d9b7e5e3eefa33330a859c97b2c2c46cbdc83bf9d7f87843e0ea3a39faf9ff069293a0bc903d52ccbef7c3833be4117263b3a842f424bc3604e5f0310cc3d8a3ebacdb387353a6c432a4f4f4aac2ab4da15006cdf3b6f76f60e1b2790e2227097b3b6a18ae5d5415d7f9168677b634adc64b6b20a485d93734461bd2deff69efc0969930eee65e4dfd6f2014e23c9563ec31d96571e7a100ca1214ef6bf8e2652fd8d694a2f415fe9f2835f8ef93a564bf6a9e8d3827ffcf715deace832fb3b6a29f08e7fa87eb10f12d785797a9b188f324c8a2e4247c7acc39bfdc97cc77c6faea7c712cc4a3c13cd54602ed57ca58b87759cd421f62bc11d38bbd089f21f5ceda6d4c778aee24a09510138a534768108a9e1de4625173940485c6c45de1d96939051cf104e7f79c4a6d18df1b4b6bbad192082903adb855a1cee1b4873f9cbc191356e31156910efc8a76fd27d1f76ef2e89a756842c773eaaef09926b4c549bb2af0609f129a1cf9ff1a525de814df7512fe5d9c9016b3e55772e6f25c3dc5d09f39b2103716dabb174ea5b195772e2cdf30cab4c4b5822f91944b1ee9a7e7dd9c1c7c40ef76edaf824e48874616bbc25ac94c314d23a95e6a83cca2967461bb5b1b0e85c23c2d266a192f104c8bd7d23b4632a83bf80d5ad6fbf0c127626757268fea9f09f14b2ae095b87471d45c24aee251d22c89c04b1e0a7f1fcbcb2fca8d88b3655bbbac8118f564f55aa73e52c6eb6f6824e2be420cc20aa9d40c1f4d8ef52989e3f0069d496b876579a8693cd0c7a4e69ae9c0d79efd8493f53998088cab632865282f9bdd672da78ff35df756c81f554b3203b66a12869320abae54d6d694a99b4d4c0f8260b25d93718e84b501e9d9e2f2845633fa1452647aa87f31a33cb0684e0e76689356f864c0f16d12945e6e473bfbcaed24127d5581230a6552837179f65a77233c57f76c8bf7eeaa8fd374b050589f2890706f91c15126da0826a047251cc0e4e23a014f5dc0cddbffa0e7bdf68348f9491998ff0d227103292d91f638672d6fb8388625139340bd98778ba0d4035f194c8e9ad9a0ac33b951d767d0cbb2f5430e9e25848b36ce57c5b0b334cc19964f9b2517abfc464639c0725a791510369aa46cbb32c831e8f07319a603af2ac67ae138ff2b7393e6aefd8b47a7d7bf06d98c554febadb0f1d5cecac6e476fcba59e6064e9d5ececb44cd520d79ebc813caf466cdfc30354c71ba38e61c2f51d1d646be9336fdab93a1a605d0d07f3cf26f1216", 0x1000}, {&(0x7f0000000180)="1e4c3a885aa6ea69bdf0dc571c1a959521da04c4f5a5b40055388640ea4ce374c3740ba4dabbc638ede10967bc620bbdb54722df0a2fe50ecc4957ba7bee58847037632538a4b6b7fa0a7432cbd4963e152d60068e10d7fe97b19b979efaaf0f2e3902a1cddef2467968f8c2bad6212d0df0305d39d967028e8385ad61d3d5b0956206fc0583248a7a2a1d7910b03499e64691e9654b72f061f384b07eab71a383cf818d6c69ad528670e7318a66931e99205777da1323974eda0b5b3255", 0xbe}, {&(0x7f00000002c0)="889841c9ffcfb7d16822dd1059ac201b1b783e7a8934268190f714afbddc61f5dbb094b6b33677f0372ed5d6d59e3bd91c7ec4429b441bd722cd9b3d5dab383ca03a7b5a458da0b99056dbf0f4a60b995626d8e5eb820b129859cd4484c4a989f21830cde34af1e7040ba298c67e6c8e23174ae23884561385fd6369191af57c4b3afc23c8e311d793237d52cece52d32df0680661e90d05c570720788c338572f823ff464fc5713fa629fbfa91b4f3033389f55243f57e8a1f08b3419b143ad25fb9ac030ad89b75a2dab161ed1649702bc3d", 0xd3}, {&(0x7f0000000240)="a6ca49a63b0fffb31100915ab32291894c096873aaeccdc917ab7fc6f4d2aabafd5f", 0x22}], 0x6}, 0x10) r4 = accept$alg(r2, 0x0, 0x0) sendmmsg$alg(r4, &(0x7f00000004c0)=[{0x0, 0x0, &(0x7f0000000100), 0x0, &(0x7f0000000140)}], 0x1500, 0x0) 01:57:09 executing program 3: r0 = socket$inet(0x2, 0x3, 0x2) connect$inet(0xffffffffffffffff, &(0x7f0000000000)={0x2, 0x0, @local}, 0x10) setsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x23, &(0x7f0000000000)={{{@in=@multicast2, @in=@multicast1}}, {{@in6}, 0x0, @in6=@loopback}}, 0xe8) syz_emit_ethernet(0x2a, &(0x7f0000000640)={@random="b100485caa2a", @link_local, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x1c, 0xf0, 0x0, 0x0, 0x2, 0x0, @rand_addr, @broadcast}, @igmp={0x11, 0xffffffffffffffff, 0x0, @multicast1}}}}}, &(0x7f0000000140)) 01:57:09 executing program 5: perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1f}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000340)={&(0x7f0000000000), 0xc, &(0x7f0000000300)={&(0x7f0000000240)=@newlink={0x50, 0x10, 0x721, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x0, 0x6000000}, [@IFLA_LINKINFO={0x28, 0x12, @veth={{0xc, 0x1, 'veth\x00'}, {0x18, 0x2, @VETH_INFO_PEER={0x14}}}}, @IFLA_NET_NS_FD={0x8}]}, 0x50}}, 0x0) 01:57:09 executing program 2: r0 = socket$inet(0x2, 0x3, 0x2) connect$inet(r0, &(0x7f0000000000)={0x2, 0x0, @local}, 0x10) setsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x23, &(0x7f0000000000)={{{@in=@multicast2, @in=@multicast1}}, {{@in6}, 0x0, @in6=@loopback}}, 0xe8) syz_emit_ethernet(0x2a, &(0x7f0000000640)=ANY=[@ANYBLOB="b100485caa2a0180c23ec50008004500001c000000000002b3c0ac51e41a66907800000000ffffffff11"], &(0x7f0000000140)) [ 715.842257] binder: 16867:16868 Acquire 1 refcount change on invalid ref 0 ret -22 01:57:09 executing program 1: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r0, &(0x7f00001fefe4)={0xa, 0x4e22, 0x0, @ipv4={[], [], @loopback}}, 0x1c) r1 = creat(&(0x7f0000000000)='./file0\x00', 0x48) ioctl$RTC_ALM_SET(r1, 0x40247007, &(0x7f0000000040)={0x13, 0x1b, 0x12, 0x8, 0x4, 0x400, 0x3, 0x28, 0xffffffffffffffff}) listen(r0, 0x0) r2 = socket$netlink(0x10, 0x3, 0x8000000004) getpeername$netlink(r1, &(0x7f0000000080), &(0x7f00000000c0)=0xc) ioctl$LOOP_GET_STATUS64(r1, 0x4c05, &(0x7f00000001c0)) writev(r2, &(0x7f0000e11ff0)=[{&(0x7f0000000140)="580000001400add427323b470c458c560a067fffffff81004e220000000058000b4824ca945f64009400050028925aa80000000000000080000efffeffe809000000fff5dd00000010000100090a1000410400000000fcff", 0x58}], 0x1) 01:57:09 executing program 0: socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000001f80)={0xffffffffffffffff, 0xffffffffffffffff}) setsockopt$SO_ATTACH_FILTER(r2, 0x1, 0x1a, &(0x7f0000ab9ff0)={0x2, &(0x7f000039a000)=[{0x20, 0x0, 0x0, 0xfffffffffffff010}, {0x6}]}, 0x10) sendmmsg(r1, &(0x7f0000001e80)=[{{&(0x7f0000000700)=@l2, 0x80, &(0x7f0000001dc0), 0xfffffdef}}], 0x1, 0x0) [ 715.927536] binder: 16867:16868 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 01:57:09 executing program 5: perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1f}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000340)={&(0x7f0000000000), 0xc, &(0x7f0000000300)={&(0x7f0000000240)=@newlink={0x50, 0x10, 0x721, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x0, 0xb40a000000000000}, [@IFLA_LINKINFO={0x28, 0x12, @veth={{0xc, 0x1, 'veth\x00'}, {0x18, 0x2, @VETH_INFO_PEER={0x14}}}}, @IFLA_NET_NS_FD={0x8}]}, 0x50}}, 0x0) 01:57:09 executing program 2: socketpair$inet6_icmp_raw(0xa, 0x3, 0x3a, &(0x7f0000000100)={0xffffffffffffffff}) setsockopt$inet6_int(r0, 0x29, 0x53, &(0x7f0000000180)=0x1ff, 0x4) connect$inet(0xffffffffffffffff, &(0x7f0000000000)={0x2, 0x0, @local}, 0x10) setsockopt$inet_IP_XFRM_POLICY(0xffffffffffffffff, 0x0, 0x23, &(0x7f0000000000)={{{@in=@multicast2, @in=@multicast1}}, {{@in6}, 0x0, @in6=@loopback}}, 0xe8) syz_emit_ethernet(0x2a, &(0x7f0000000640)=ANY=[@ANYBLOB="b100485caa2a8bf170f8000008004500001c000000000002907800000000ffffffff11009078e0000001"], &(0x7f0000000140)) socket$inet(0x2, 0x807, 0x5a6c) 01:57:09 executing program 3: r0 = socket$inet(0x2, 0x3, 0x2) connect$inet(0xffffffffffffffff, &(0x7f0000000000)={0x2, 0x0, @local}, 0x10) setsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x23, &(0x7f0000000000)={{{@in=@multicast2, @in=@multicast1}}, {{@in6}, 0x0, @in6=@loopback}}, 0xe8) syz_emit_ethernet(0x2a, &(0x7f0000000640)={@random="b100485caa2a", @link_local, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x1c, 0x6000, 0x0, 0x0, 0x2, 0x0, @rand_addr, @broadcast}, @igmp={0x11, 0xffffffffffffffff, 0x0, @multicast1}}}}}, &(0x7f0000000140)) 01:57:09 executing program 1: r0 = socket$inet6(0xa, 0x2, 0x0) r1 = socket$inet6(0xa, 0xffffffffffff, 0x17d) getsockopt$inet6_IPV6_FLOWLABEL_MGR(r0, 0x29, 0x20, &(0x7f0000000140)={@dev={0xfe, 0x80, [], 0x1a}, 0x2, 0x3, 0x0, 0xa, 0x1, 0x2, 0x100000001}, &(0x7f0000000180)=0x20) bpf$PROG_LOAD(0x5, &(0x7f0000000000)={0x1, 0xe, &(0x7f0000001000)=ANY=[@ANYBLOB="b700000001ed0000bfa30000000000000703000028feffff7a0af0fff8ffffff71a4f0ff00000000b7060000000000012d400500000000005504000001ed00001d040000000000006f460000000000006b0a00fe000000008500000007000000b7000000000000009500000000000000"], &(0x7f0000000100)='EPL\x00'}, 0x48) ioctl(r1, 0x8912, &(0x7f0000000280)="0a5cc80700315f85714070") accept(r0, &(0x7f00000000c0)=@pppol2tpv3in6={0x18, 0x1, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, {0xa, 0x0, 0x0, @ipv4={[], [], @multicast1}}}}, &(0x7f0000000000)=0x80) connect$inet6(r0, &(0x7f0000000040)={0xa, 0x0, 0x0, @loopback}, 0x1c) setsockopt$SO_TIMESTAMPING(r0, 0x1, 0x22, &(0x7f0000000080), 0x4) [ 716.048612] binder: 16867:16884 got reply transaction with no transaction stack [ 716.056282] binder: 16867:16884 transaction failed 29201/-71, size 0-0 line 2759 [ 716.108036] binder: 16867:16884 Acquire 1 refcount change on invalid ref 0 ret -22 [ 716.127885] binder: 16867:16884 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 716.241146] binder: 16867:16868 got reply transaction with no transaction stack [ 716.248874] binder: 16867:16868 transaction failed 29201/-71, size 0-0 line 2759 01:57:10 executing program 6: r0 = syz_open_dev$sndseq(&(0x7f0000000100)='/dev/snd/seq\x00', 0x0, 0x0) read(r0, &(0x7f0000fb6000)=""/28, 0x3f0) ioctl$SNDRV_SEQ_IOCTL_REMOVE_EVENTS(r0, 0x4040534e, &(0x7f00000001c0)={0xbf}) ioctl$SNDRV_SEQ_IOCTL_QUERY_SUBS(r0, 0xc058534f, &(0x7f00000002c0)={{}, 0x1, 0x0, 0x0, {}, 0x0, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xe000000]}) r1 = gettid() timer_create(0x0, &(0x7f0000044000)={0x0, 0x12}, &(0x7f0000000040)) r2 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r2, 0x8912, &(0x7f00000001c0)="0a5cc80700315f85715070") timer_settime(0x0, 0x0, &(0x7f0000000080)={{0x0, 0x989680}, {0x0, 0x9}}, &(0x7f0000040000)) tkill(r1, 0x1000000000014) 01:57:10 executing program 4: r0 = socket$key(0xf, 0x3, 0x2) perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffc, 0x0, 0x0, 0x0, 0x0, 0x8000, 0x0, 0x0, 0x0, @perf_bp, 0x0, 0x0, 0x0, 0x7}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendmsg$key(r0, &(0x7f0000cd0000)={0x0, 0x0, &(0x7f00008feff0)={&(0x7f0000f85000)={0x2, 0x1, 0x0, 0x3, 0xc, 0x0, 0x0, 0x0, [@sadb_address={0x5, 0x6, 0x0, 0x0, 0x0, @in6={0xa, 0x0, 0x0, @ipv4={[], [], @multicast2}}}, @sadb_address={0x5, 0x5, 0x0, 0x0, 0x0, @in6={0xa, 0x0, 0x0, @ipv4={[], [], @broadcast}}}]}, 0x60}}, 0x0) r1 = socket(0x2, 0x80000, 0x1) getsockopt$inet_sctp_SCTP_ENABLE_STREAM_RESET(0xffffffffffffffff, 0x84, 0x76, &(0x7f0000000100)={0x0, 0x9}, &(0x7f0000000140)=0x8) getsockopt$inet_sctp6_SCTP_PEER_ADDR_PARAMS(r1, 0x84, 0x9, &(0x7f0000000200)={r2, @in={{0x2, 0x4e23, @local}}, 0xc, 0x20401, 0x0, 0x5, 0x10}, &(0x7f00000002c0)=0x98) getsockopt$inet_sctp_SCTP_GET_LOCAL_ADDRS(r1, 0x84, 0x6d, &(0x7f0000000300)={r3, 0xdc, "b017d697fe937a9dc47089051b1ea0856557d3a928ad50f327dfdba32998b49114859390682e8c71206779c3ad4b53cbf5a1c88f221d5959313347359919fdad4b80a3890b8c9013a43fdc7a10eb7844caaa584897246ef8f447daa5ef16bb5601b2e827047756d4ce66e176b3d95dc4541b6ddad34a4f15bfbab9b0a1614ba01a0e428ac87827d9b9c995a088ac44d84fb2769a768b3e9897e13717c95668427a205c552abf7dc4ac85b75716c5f01baea1d7759ce41817f2e3d3344f9c2dcae620d8c55a46780b2dbcaf57bdd76136fee89f53dfd5af6a24627c49"}, &(0x7f0000000040)=0xe4) 01:57:10 executing program 5: perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1f}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000340)={&(0x7f0000000000), 0xc, &(0x7f0000000300)={&(0x7f0000000240)=@newlink={0x50, 0x10, 0x721, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x0, 0x600}, [@IFLA_LINKINFO={0x28, 0x12, @veth={{0xc, 0x1, 'veth\x00'}, {0x18, 0x2, @VETH_INFO_PEER={0x14}}}}, @IFLA_NET_NS_FD={0x8}]}, 0x50}}, 0x0) 01:57:10 executing program 3: r0 = socket$inet(0x2, 0x3, 0x2) connect$inet(0xffffffffffffffff, &(0x7f0000000000)={0x2, 0x0, @local}, 0x10) setsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x23, &(0x7f0000000000)={{{@in=@multicast2, @in=@multicast1}}, {{@in6}, 0x0, @in6=@loopback}}, 0xe8) syz_emit_ethernet(0x2a, &(0x7f0000000640)={@random="b100485caa2a", @link_local, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x1c, 0xe0, 0x0, 0x0, 0x2, 0x0, @rand_addr, @broadcast}, @igmp={0x11, 0xffffffffffffffff, 0x0, @multicast1}}}}}, &(0x7f0000000140)) 01:57:10 executing program 2: r0 = socket$inet(0x2, 0x3, 0x2) r1 = open(&(0x7f0000000100)='./file0\x00', 0x20000, 0x41) setsockopt$packet_tx_ring(r1, 0x107, 0xd, &(0x7f0000000180)=@req3={0x8765, 0x3, 0x6, 0x2, 0x9, 0x6, 0x6}, 0x1c) connect$inet(0xffffffffffffffff, &(0x7f0000000000)={0x2, 0x0, @local}, 0x10) setsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x23, &(0x7f0000000000)={{{@in=@multicast2, @in=@multicast1}}, {{@in6}, 0x0, @in6=@loopback}}, 0xe8) syz_emit_ethernet(0x2a, &(0x7f0000000640)={@random="b100485caa2a", @link_local, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x1c, 0x0, 0x0, 0x0, 0x2, 0x0, @rand_addr, @broadcast}, @igmp={0x11, 0x0, 0x0, @multicast1}}}}}, &(0x7f0000000140)) write$FUSE_NOTIFY_STORE(r1, &(0x7f00000001c0)={0x2c, 0x4, 0x0, {0x4, 0xd2, 0x4, 0x0, [0x0, 0x0, 0x0, 0x0]}}, 0x2c) 01:57:10 executing program 0: socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000001f80)={0xffffffffffffffff, 0xffffffffffffffff}) setsockopt$SO_ATTACH_FILTER(r2, 0x1, 0x1a, &(0x7f0000ab9ff0)={0x2, &(0x7f000039a000)=[{0x20, 0x0, 0x0, 0xfffffffffffff010}, {0x6}]}, 0x10) sendmmsg(r1, &(0x7f0000001e80)=[{{&(0x7f0000000700)=@l2, 0x80, &(0x7f0000001dc0), 0xeffdffff00000000}}], 0x1, 0x0) 01:57:10 executing program 1: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240)='/dev/net/tun\x00', 0x0, 0x0) fcntl$F_SET_FILE_RW_HINT(r0, 0x40e, &(0x7f0000000000)=0x1) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={"00ac720000000000ec973f820f7c4000", 0x102}) ioctl$TUNSETLINK(r0, 0x400454cd, 0x324) close(r0) 01:57:10 executing program 7: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000180)='/dev/sequencer\x00', 0x10002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000080)="0a5cc80700315f85715070") r1 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000001c0)={0x2, 0x0, &(0x7f0000000140)=ANY=[@ANYBLOB='\fc'], 0x0, 0x0, &(0x7f0000000080)}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, &(0x7f00000001c0)}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000040)={0x8, 0x0, &(0x7f00000000c0)=[@release={0x40046307}], 0x1, 0x0, &(0x7f0000000100)='V'}) fstat(r0, &(0x7f00000002c0)) 01:57:10 executing program 5: perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1f}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000340)={&(0x7f0000000000), 0xc, &(0x7f0000000300)={&(0x7f0000000240)=@newlink={0x50, 0x10, 0x721, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x0, 0x6}, [@IFLA_LINKINFO={0x28, 0x12, @veth={{0xc, 0x1, 'veth\x00'}, {0x18, 0x2, @VETH_INFO_PEER={0x14}}}}, @IFLA_NET_NS_FD={0x8}]}, 0x50}}, 0x0) 01:57:10 executing program 3: r0 = socket$inet(0x2, 0x3, 0x2) connect$inet(0xffffffffffffffff, &(0x7f0000000000)={0x2, 0x0, @local}, 0x10) setsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x23, &(0x7f0000000000)={{{@in=@multicast2, @in=@multicast1}}, {{@in6}, 0x0, @in6=@loopback}}, 0xe8) syz_emit_ethernet(0x2a, &(0x7f0000000640)={@random="b100485caa2a", @link_local, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x1c, 0x20000000, 0x0, 0x0, 0x2, 0x0, @rand_addr, @broadcast}, @igmp={0x11, 0xffffffffffffffff, 0x0, @multicast1}}}}}, &(0x7f0000000140)) 01:57:10 executing program 2: r0 = socket$inet(0x2, 0x3, 0x2) connect$inet(0xffffffffffffffff, &(0x7f0000000000)={0x2, 0x0, @local}, 0x10) setsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x23, &(0x7f0000000000)={{{@in=@multicast2, @in=@multicast1}}, {{@in6}, 0x0, @in6=@loopback}}, 0xe8) syz_emit_ethernet(0x2a, &(0x7f0000000640)={@random="b100485caa2a", @link_local, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x1c, 0x0, 0x0, 0x0, 0x2, 0x0, @rand_addr, @broadcast}, @igmp={0x11, 0x0, 0x0, @multicast1}}}}}, &(0x7f0000000140)) pipe(&(0x7f0000000100)={0xffffffffffffffff}) ioctl$SNDRV_CTL_IOCTL_PCM_INFO(r1, 0xc1205531, &(0x7f0000000180)={0x5e, 0x1, 0x0, 0x6, [], [], [], 0x401, 0x9, 0x1, 0x1, "d887cfef353778cb3edce1f951058489"}) [ 716.754218] binder: 16951:16953 Acquire 1 refcount change on invalid ref 0 ret -22 01:57:10 executing program 1: membarrier(0x2, 0x0) r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000080)="0a5cc80700315f85715070") r1 = openat$cuse(0xffffffffffffff9c, &(0x7f0000000000)='/dev/cuse\x00', 0x200, 0x0) ioctl$TIOCLINUX4(r1, 0x541c, &(0x7f0000000040)) r2 = memfd_create(&(0x7f0000000140)='\x00', 0x0) r3 = syz_open_dev$sndseq(&(0x7f0000027ff3)='/dev/snd/seq\x00', 0x0, 0x20005) ioctl$KVM_IRQ_LINE(r1, 0x4008ae61, &(0x7f00000000c0)={0x6}) ioctl$TIOCLINUX5(r1, 0x541c, &(0x7f0000000100)={0x5, 0x100000001, 0x7, 0x1ff, 0x7f}) r4 = dup2(r3, r2) ioctl$SNDRV_SEQ_IOCTL_CREATE_QUEUE(r3, 0xc08c5332, &(0x7f0000037000)={0x0, 0x0, 0x0, "9ede7a8c5ae95e48000000000000007f4f13eeab65c0322901dc6bd36cde2c51f01b7f0b014f9f91eeb7c37c7240f476c8d753d000aa0500000074dbcfa6dc4d"}) write$sndseq(r2, &(0x7f00000001c0)=[{0x22, 0xfffffffe, 0x0, 0x0, @tick, {}, {0x0, 0xfdffffff}, @ext={0x0, &(0x7f0000038ffe)}}], 0xfffffdc5) ioctl$KVM_CHECK_EXTENSION(r4, 0xae03, 0x1000) 01:57:10 executing program 0: socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000001f80)={0xffffffffffffffff, 0xffffffffffffffff}) setsockopt$SO_ATTACH_FILTER(r2, 0x1, 0x1a, &(0x7f0000ab9ff0)={0x2, &(0x7f000039a000)=[{0x20, 0x0, 0x0, 0xfffffffffffff010}, {0x6}]}, 0x10) sendmmsg(r1, &(0x7f0000001e80)=[{{&(0x7f0000000700)=@l2, 0x80, &(0x7f0000001dc0), 0x40000}}], 0x1, 0x0) 01:57:10 executing program 4: r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x40, 0x20) ioctl$ifreq_SIOCGIFINDEX_vcan(0xffffffffffffffff, 0x8933, &(0x7f0000000040)={'vcan0\x00', 0x0}) ioctl$TUNSETIFINDEX(r0, 0x400454da, &(0x7f0000000080)=r1) renameat2(r0, &(0x7f00000000c0)='./file0\x00', r0, &(0x7f0000000100)='./file0\x00', 0x2) r2 = eventfd(0xffffffffffffffff) ioctl$KDDELIO(r0, 0x4b35, 0x2) ioctl$ASHMEM_SET_PROT_MASK(r0, 0x40087705, &(0x7f0000000140)={0x2, 0x4}) read(r2, &(0x7f0000000180)=""/48, 0x30) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f00000001c0)={'ipddp0\x00'}) r3 = mmap$binder(&(0x7f0000ffb000/0x2000)=nil, 0x2000, 0x0, 0x80010, r0, 0x0) r4 = mmap$binder(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x8, 0x44011, r0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000004c0)={0xb0, 0x0, &(0x7f00000003c0)=[@acquire={0x40046305, 0x1}, @transaction={0x40406300, {0x2, 0x0, 0x2, 0x0, 0x11, 0x0, 0x0, 0x48, 0x20, &(0x7f0000000240)=[@ptr={0x70742a85, 0x0, &(0x7f0000000200), 0x1, 0x2, 0x33}, @fda={0x66646185, 0x5, 0x3, 0x30}], &(0x7f00000002c0)=[0x40, 0x18, 0x28, 0x28]}}, @increfs={0x40046304, 0x3}, @register_looper, @reply={0x40406301, {0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x40, 0x38, &(0x7f0000000340)=[@ptr={0x70742a85, 0x1, &(0x7f0000000300), 0x1, 0x1, 0xd}, @flat={0x776a2a85, 0x101, r3}], &(0x7f0000000380)=[0x18, 0x48, 0x18, 0x48, 0x0, 0x78, 0x48]}}, @acquire_done={0x40106309, r4, 0x3}], 0x2c, 0x0, &(0x7f0000000480)="122a94a1fe17ad3a6d3ed7773020b6d4fd0ad060201c4467b1198f8517fd8215df24b4f43c339fec645415d7"}) ioctl$BINDER_THREAD_EXIT(r0, 0x40046208, 0x0) sendmsg$nl_route_sched(r0, &(0x7f00000005c0)={&(0x7f0000000500)={0x10, 0x0, 0x0, 0x10}, 0xc, &(0x7f0000000580)={&(0x7f0000000540)=@gettclass={0x24, 0x2a, 0x600, 0x70bd27, 0x25dfdbfe, {0x0, r1, {0xfff7, 0xf}, {0x4, 0x6}, {0x0, 0x3}}, ["", "", ""]}, 0x24}, 0x1, 0x0, 0x0, 0x4000004}, 0x4000000) ioctl$TIOCGLCKTRMIOS(r0, 0x5456, &(0x7f0000000600)={0x3, 0xb0b8, 0xadd, 0x2, 0x7499, 0x100000000, 0x80000001, 0x6, 0xcc, 0x5, 0xa1, 0x5}) getsockopt$inet_sctp_SCTP_MAXSEG(r0, 0x84, 0xd, &(0x7f0000000640)=@assoc_id=0x0, &(0x7f0000000680)=0x4) getsockopt$inet_sctp6_SCTP_GET_PEER_ADDR_INFO(r0, 0x84, 0xf, &(0x7f00000006c0)={r5, @in6={{0xa, 0x4e21, 0x286, @local, 0x1f}}, 0x7fff, 0x5, 0x5, 0x7, 0x3f}, &(0x7f0000000780)=0x98) ioctl$SNDRV_CTL_IOCTL_ELEM_LOCK(r0, 0x40405514, &(0x7f00000007c0)={0x8, 0x2, 0x10001, 0x3, 'syz1\x00', 0x8}) fcntl$F_SET_FILE_RW_HINT(r0, 0x40e, &(0x7f0000000800)=0x3) ioctl$PIO_SCRNMAP(r0, 0x4b41, &(0x7f0000000840)="ad65606538a341d2ed9eb098aa4aab11ba44d834b30ab3d339ac5faedd104b5293eb573cbb02d095a555668ea594850b5774e51f161162926dcf248c790f43923d01285c53a4bf09937edb2bd5b9368077564b33dca3710f3312fdda7ea204cfc45ef0d7265080d0ac7fc0e7b5f2c4b7ce069747e4e4dd71cfdbb319cb1c171c454445fecaaeea9dc4d7598d265ffc7bb195281807c7b7368d918483de9a6333e4fd233828784f1c339d050052138c4a834cb5642f85820d08b36d4368205b50926fa9e66fb94b4bdff3ffdc63dbadb533da0e5f28d8ddc19e1ac57264198c") ioctl$sock_inet_tcp_SIOCINQ(r0, 0x541b, &(0x7f0000000940)) setsockopt$inet_sctp6_SCTP_RESET_ASSOC(r0, 0x84, 0x78, &(0x7f0000000980)=r5, 0x4) write$UHID_INPUT2(r0, &(0x7f00000009c0)={0xc, 0xd5, "5aaac11dc288f3e02ca15860944c05600d0cbf8ff40637baee0d5add8810db6b61e5b74ea994d427f73bebc5ee34f50dce68730f0c30f73670810aaa7c66e2b3398b210df3b4ab4da02571a3329be5f5c55aa8ed66576d3372956842d9811bcd2ee649092a6724db1cb5f4d7a31d591a3bfb11f8dea955f6d8f50c10e20b33a77e69fcb2062075635d1bde500b67070e957f6a2aa65e12624543288a1d259b35d32ee6c2addd1d868430ad413be095b567136305b9d9188ee812406c667850a82e4e988e327d4c479b50fa480f32f70f1f15a7a57d"}, 0xdb) getsockopt$IP_VS_SO_GET_DAEMON(r0, 0x0, 0x487, &(0x7f0000000ac0), &(0x7f0000000b00)=0x30) r7 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000b80)='IPVS\x00') sendmsg$IPVS_CMD_DEL_DEST(r0, &(0x7f0000000c40)={&(0x7f0000000b40)={0x10, 0x0, 0x0, 0x8000000}, 0xc, &(0x7f0000000c00)={&(0x7f0000000bc0)={0x1c, r7, 0x10, 0x70bd2a, 0x25dfdbfc, {}, [@IPVS_CMD_ATTR_TIMEOUT_TCP_FIN={0x8, 0x5, 0x100}]}, 0x1c}, 0x1, 0x0, 0x0, 0x20000001}, 0x0) setsockopt$inet_sctp_SCTP_STREAM_SCHEDULER(r0, 0x84, 0x7b, &(0x7f0000000c80)={r6, 0x401}, 0x8) r8 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000cc0)='/dev/vga_arbiter\x00', 0x200000, 0x0) setsockopt$SO_VM_SOCKETS_BUFFER_MAX_SIZE(r0, 0x28, 0x2, &(0x7f0000000d00)=0x6, 0x8) ioctl$EVIOCGABS0(r8, 0x80184540, &(0x7f0000000d40)=""/108) 01:57:10 executing program 5: perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1f}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000340)={&(0x7f0000000000), 0xc, &(0x7f0000000300)={&(0x7f0000000240)=@newlink={0x50, 0x10, 0x721, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x0, 0x7}, [@IFLA_LINKINFO={0x28, 0x12, @veth={{0xc, 0x1, 'veth\x00'}, {0x18, 0x2, @VETH_INFO_PEER={0x14}}}}, @IFLA_NET_NS_FD={0x8}]}, 0x50}}, 0x0) [ 716.892346] binder: 16951:16953 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 01:57:10 executing program 3: r0 = socket$inet(0x2, 0x3, 0x2) connect$inet(0xffffffffffffffff, &(0x7f0000000000)={0x2, 0x0, @local}, 0x10) setsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x23, &(0x7f0000000000)={{{@in=@multicast2, @in=@multicast1}}, {{@in6}, 0x0, @in6=@loopback}}, 0xe8) syz_emit_ethernet(0x2a, &(0x7f0000000640)={@random="b100485caa2a", @link_local, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x1c, 0x7000000, 0x0, 0x0, 0x2, 0x0, @rand_addr, @broadcast}, @igmp={0x11, 0xffffffffffffffff, 0x0, @multicast1}}}}}, &(0x7f0000000140)) [ 716.994476] binder: 16951:16978 DecRefs 0 refcount change on invalid ref 0 ret -22 [ 717.128204] binder: 16951:16978 Acquire 1 refcount change on invalid ref 0 ret -22 [ 717.158659] binder: 16951:16978 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 717.185461] binder: 16951:16953 DecRefs 0 refcount change on invalid ref 0 ret -22 [ 717.193416] binder: 16953 RLIMIT_NICE not set 01:57:11 executing program 6: r0 = syz_open_dev$sndseq(&(0x7f0000000100)='/dev/snd/seq\x00', 0x0, 0x0) read(r0, &(0x7f0000fb6000)=""/28, 0x3f0) ioctl$SNDRV_SEQ_IOCTL_REMOVE_EVENTS(r0, 0x4040534e, &(0x7f00000001c0)={0xbf}) ioctl$SNDRV_SEQ_IOCTL_QUERY_SUBS(r0, 0xc058534f, &(0x7f00000002c0)={{}, 0x1, 0x0, 0x0, {}, 0x0, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xbf00]}) r1 = gettid() timer_create(0x0, &(0x7f0000044000)={0x0, 0x12}, &(0x7f0000000040)) r2 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r2, 0x8912, &(0x7f00000001c0)="0a5cc80700315f85715070") timer_settime(0x0, 0x0, &(0x7f0000000080)={{0x0, 0x989680}, {0x0, 0x9}}, &(0x7f0000040000)) tkill(r1, 0x1000000000014) 01:57:11 executing program 4: r0 = socket$inet6(0xa, 0x40000000000002, 0x0) r1 = dup3(r0, r0, 0x80000) ioctl$SG_GET_KEEP_ORPHAN(r1, 0x2288, &(0x7f0000000000)) setsockopt$inet6_opts(r0, 0x29, 0x3b, &(0x7f0000000180)=@routing={0x0, 0xc, 0x0, 0x0, 0x0, [@empty, @empty, @mcast1, @empty, @loopback, @mcast2]}, 0x68) setsockopt$inet6_udp_int(r0, 0x11, 0x67, &(0x7f00000000c0)=0x7, 0x4) sendto$inet6(r0, &(0x7f0000000080), 0x0, 0x0, &(0x7f0000000140)={0xa, 0x4e21, 0x0, @mcast1}, 0x1c) 01:57:11 executing program 2: r0 = socket$inet(0x2, 0x3, 0x2) r1 = openat$pfkey(0xffffffffffffff9c, &(0x7f0000000200)='/proc/self/net/pfkey\x00', 0x30000, 0x0) getsockopt$inet_sctp6_SCTP_I_WANT_MAPPED_V4_ADDR(r1, 0x84, 0xc, &(0x7f0000000240), &(0x7f0000000280)=0x4) connect$inet(0xffffffffffffffff, &(0x7f0000000000)={0x2, 0x0, @local}, 0x10) setsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x23, &(0x7f0000000000)={{{@in=@multicast2, @in=@multicast1}}, {{@in6}, 0x0, @in6=@loopback}}, 0xe8) syz_emit_ethernet(0x2a, &(0x7f0000000640)=ANY=[@ANYBLOB="b106005caa2a0180c20000009078000000000000000000000005e000000100000000000e000000000000"], &(0x7f0000000140)) 01:57:11 executing program 5: perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1f}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000340)={&(0x7f0000000000), 0xc, &(0x7f0000000300)={&(0x7f0000000240)=@newlink={0x50, 0x10, 0x721, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x0, 0x300000000000000}, [@IFLA_LINKINFO={0x28, 0x12, @veth={{0xc, 0x1, 'veth\x00'}, {0x18, 0x2, @VETH_INFO_PEER={0x14}}}}, @IFLA_NET_NS_FD={0x8}]}, 0x50}}, 0x0) 01:57:11 executing program 0: socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000001f80)={0xffffffffffffffff, 0xffffffffffffffff}) setsockopt$SO_ATTACH_FILTER(r2, 0x1, 0x1a, &(0x7f0000ab9ff0)={0x2, &(0x7f000039a000)=[{0x20, 0x0, 0x0, 0xfffffffffffff010}, {0x6}]}, 0x10) sendmmsg(r1, &(0x7f0000001e80)=[{{&(0x7f0000000700)=@l2, 0x80, &(0x7f0000001dc0), 0x33fe0}}], 0x1, 0x0) 01:57:11 executing program 3: r0 = socket$inet(0x2, 0x3, 0x2) connect$inet(0xffffffffffffffff, &(0x7f0000000000)={0x2, 0x0, @local}, 0x10) setsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x23, &(0x7f0000000000)={{{@in=@multicast2, @in=@multicast1}}, {{@in6}, 0x0, @in6=@loopback}}, 0xe8) syz_emit_ethernet(0x2a, &(0x7f0000000640)={@random="b100485caa2a", @link_local, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x1c, 0x700, 0x0, 0x0, 0x2, 0x0, @rand_addr, @broadcast}, @igmp={0x11, 0xffffffffffffffff, 0x0, @multicast1}}}}}, &(0x7f0000000140)) 01:57:11 executing program 7: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000180)='/dev/sequencer\x00', 0x10002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000080)="0a5cc80700315f85715070") r1 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000001c0)={0x2, 0x0, &(0x7f0000000140)=ANY=[@ANYBLOB='\fc'], 0x0, 0x0, &(0x7f0000000080)}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, &(0x7f00000001c0)}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000040)={0x8, 0x0, &(0x7f00000000c0)=[@release={0x40086303}], 0x1, 0x0, &(0x7f0000000100)='V'}) fstat(r0, &(0x7f00000002c0)) 01:57:11 executing program 1: socketpair(0x1, 0xe, 0x10001, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_SET_FILTER(r0, 0x40082406, &(0x7f0000000040)='@\x00') setsockopt$inet_sctp6_SCTP_AUTO_ASCONF(r0, 0x84, 0x1e, &(0x7f0000000080)=0x2, 0x4) ioctl$sock_SIOCBRDELBR(r0, 0x89a1, &(0x7f00000000c0)='veth0_to_team\x00') getsockopt$inet_sctp_SCTP_SOCKOPT_CONNECTX3(r0, 0x84, 0x6f, &(0x7f00000001c0)={0x0, 0xac, &(0x7f0000000100)=[@in6={0xa, 0x4e24, 0x40, @empty, 0x4}, @in={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0x13}}, @in6={0xa, 0x4e22, 0x6, @empty, 0x1}, @in6={0xa, 0x4e21, 0x683c, @dev={0xfe, 0x80, [], 0x17}, 0x6}, @in={0x2, 0x4e24, @broadcast}, @in6={0xa, 0x4e21, 0xcaa3, @dev={0xfe, 0x80, [], 0xe}, 0x5}, @in6={0xa, 0x4e21, 0x40, @loopback, 0x80}]}, &(0x7f0000000200)=0x10) getsockopt$inet_sctp_SCTP_MAXSEG(r1, 0x84, 0xd, &(0x7f0000000240)=@assoc_id=r2, &(0x7f0000000280)=0x4) ioctl$SNDRV_CTL_IOCTL_RAWMIDI_PREFER_SUBDEVICE(r0, 0x40045542, &(0x7f00000002c0)=0x9) ioctl$PERF_EVENT_IOC_QUERY_BPF(r0, 0xc008240a, &(0x7f0000000300)={0x5, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0]}) r4 = semget(0x1, 0x2, 0x10) semctl$SEM_STAT(r4, 0x4, 0x12, &(0x7f0000000340)=""/191) semctl$IPC_RMID(r4, 0x0, 0x0) r5 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000440)='IPVS\x00') sendmsg$IPVS_CMD_GET_SERVICE(r0, &(0x7f0000000580)={&(0x7f0000000400)={0x10, 0x0, 0x0, 0x40000000}, 0xc, &(0x7f0000000540)={&(0x7f0000000480)={0x94, r5, 0x100, 0x70bd28, 0x25dfdbfc, {}, [@IPVS_CMD_ATTR_DEST={0x24, 0x2, [@IPVS_DEST_ATTR_INACT_CONNS={0x8, 0x8, 0x3f}, @IPVS_DEST_ATTR_INACT_CONNS={0x8, 0x8, 0x7}, @IPVS_DEST_ATTR_ADDR_FAMILY={0x8, 0xb, 0x2}, @IPVS_DEST_ATTR_U_THRESH={0x8, 0x5, 0x1f}]}, @IPVS_CMD_ATTR_TIMEOUT_TCP={0x8, 0x4, 0x800}, @IPVS_CMD_ATTR_SERVICE={0x54, 0x1, [@IPVS_SVC_ATTR_FWMARK={0x8, 0x5, 0x3}, @IPVS_SVC_ATTR_ADDR={0x14, 0x3, @ipv4=@remote}, @IPVS_SVC_ATTR_NETMASK={0x8, 0x9, 0x78}, @IPVS_SVC_ATTR_ADDR={0x14, 0x3, @ipv4=@loopback}, @IPVS_SVC_ATTR_TIMEOUT={0x8, 0x8, 0x8}, @IPVS_SVC_ATTR_PE_NAME={0x8, 0xb, 'sip\x00'}, @IPVS_SVC_ATTR_TIMEOUT={0x8, 0x8, 0x1}]}]}, 0x94}, 0x1, 0x0, 0x0, 0x40000}, 0x20040050) setsockopt$IP_VS_SO_SET_STARTDAEMON(r0, 0x0, 0x48b, &(0x7f00000005c0)={0x0, 'veth1_to_bridge\x00', 0x1}, 0x18) getsockopt$inet_buf(r0, 0x0, 0x2b, &(0x7f0000000600)=""/16, &(0x7f0000000640)=0x10) setns(r1, 0x0) ioctl$UI_SET_FFBIT(r1, 0x4004556b, 0x25) setns(r0, 0x20020000) ioctl$PERF_EVENT_IOC_DISABLE(r1, 0x2401, 0x2) setsockopt$inet6_tcp_int(r1, 0x6, 0x17, &(0x7f0000000680)=0x81, 0x4) getsockopt$inet_sctp_SCTP_MAXSEG(r0, 0x84, 0xd, &(0x7f00000006c0)=@assoc_value={r3, 0x3}, &(0x7f0000000700)=0x8) getsockopt$inet_sctp6_SCTP_ADAPTATION_LAYER(r1, 0x84, 0x7, &(0x7f0000000740), &(0x7f0000000780)=0x4) ioctl$KVM_TPR_ACCESS_REPORTING(r1, 0xc028ae92, &(0x7f00000007c0)={0x0, 0x6}) ioctl$UI_DEV_SETUP(r1, 0x405c5503, &(0x7f0000000800)={{0x93, 0xfff, 0x1, 0x7}, 'syz0\x00', 0x3a}) splice(r0, &(0x7f0000000880), r1, &(0x7f00000008c0), 0x80000001, 0x6) fcntl$getownex(r0, 0x10, &(0x7f0000000900)={0x0, 0x0}) setpriority(0x0, r6, 0x8) r7 = openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000940)='/dev/sequencer2\x00', 0xa0202, 0x0) setsockopt$IP_VS_SO_SET_STOPDAEMON(r7, 0x0, 0x48c, &(0x7f0000000980)={0x3, 'yam0\x00'}, 0x18) fadvise64(r7, 0x0, 0x6, 0x5) 01:57:11 executing program 5: perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1f}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000340)={&(0x7f0000000000), 0xc, &(0x7f0000000300)={&(0x7f0000000240)=@newlink={0x50, 0x10, 0x721, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x0, 0xf000000}, [@IFLA_LINKINFO={0x28, 0x12, @veth={{0xc, 0x1, 'veth\x00'}, {0x18, 0x2, @VETH_INFO_PEER={0x14}}}}, @IFLA_NET_NS_FD={0x8}]}, 0x50}}, 0x0) 01:57:11 executing program 4: prctl$getreaper(0x29, &(0x7f0000000000)) r0 = socket$xdp(0x2c, 0x3, 0x0) socketpair$inet_smc(0x2b, 0x1, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) dup2(r0, r1) mmap(&(0x7f0000000000/0xfbe000)=nil, 0xfbe000, 0xa, 0x31, 0xffffffffffffffff, 0x0) r2 = socket$inet6(0xa, 0x7, 0x1) ioctl(r2, 0x8000000008912, &(0x7f0000000080)="0a5cc80700315f85715070") remap_file_pages(&(0x7f0000849000/0x400000)=nil, 0x400000, 0x0, 0x0, 0x0) 01:57:11 executing program 1: openat$qat_adf_ctl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/qat_adf_ctl\x00', 0x80000, 0x0) r0 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000000)='/dev/rtc0\x00', 0x100, 0x0) ioctl$INOTIFY_IOC_SETNEXTWD(r0, 0x40044900, 0x6) accept$inet(r0, &(0x7f00000000c0)={0x2, 0x0, @remote}, &(0x7f0000000100)=0x10) r1 = socket$inet(0x2, 0xf, 0x10000009) setsockopt$inet_IP_XFRM_POLICY(r1, 0x0, 0x11, &(0x7f0000000140)={{{@in6=@local, @in, 0x0, 0x0, 0x0, 0x0, 0x2}, {0x401}, {}, 0x0, 0x6e6bbd, 0x1}, {{@in=@rand_addr, 0x4d6}, 0xf52e9819881e6aba, @in=@local, 0x0, 0x3, 0x0, 0x0, 0x5eaa}}, 0xe8) ioctl$TUNGETSNDBUF(r0, 0x800454d3, &(0x7f0000000040)) socket$inet(0x2, 0xca2db3f4c51ba251, 0xfffffffffffff000) [ 717.599972] binder: 17022:17023 Acquire 1 refcount change on invalid ref 0 ret -22 01:57:11 executing program 2: r0 = socket$inet(0x2, 0x3, 0x2) connect$inet(0xffffffffffffffff, &(0x7f0000000000)={0x2, 0x0, @local}, 0x10) setsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x23, &(0x7f0000000000)={{{@in=@multicast2, @in=@multicast1, 0x0, 0x0, 0x0, 0x0, 0x100000000, 0x0, 0x2}, {0x0, 0x0, 0x6}, {0x0, 0xffffffffffffffff}, 0x101}, {{@in6}, 0x0, @in6=@loopback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x200}}, 0x20) ioctl$sock_SIOCGIFCONF(r0, 0x8910, &(0x7f0000000180)=@req={0x28, &(0x7f0000000100)={'ip6_vti0\x00', @ifru_ivalue}}) syz_emit_ethernet(0x2a, &(0x7f0000000640)=ANY=[@ANYBLOB="b100485caa2a0180c200000008004500001ce3ffffff0002907800000000ffffffff11009078e0000001"], &(0x7f0000000140)) 01:57:11 executing program 3: r0 = socket$inet(0x2, 0x3, 0x2) connect$inet(0xffffffffffffffff, &(0x7f0000000000)={0x2, 0x0, @local}, 0x10) setsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x23, &(0x7f0000000000)={{{@in=@multicast2, @in=@multicast1}}, {{@in6}, 0x0, @in6=@loopback}}, 0xe8) syz_emit_ethernet(0x2a, &(0x7f0000000640)={@random="b100485caa2a", @link_local, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x1c, 0x2000, 0x0, 0x0, 0x2, 0x0, @rand_addr, @broadcast}, @igmp={0x11, 0xffffffffffffffff, 0x0, @multicast1}}}}}, &(0x7f0000000140)) [ 717.649125] binder: 17022:17023 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 01:57:11 executing program 0: socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000001f80)={0xffffffffffffffff, 0xffffffffffffffff}) setsockopt$SO_ATTACH_FILTER(r2, 0x1, 0x1a, &(0x7f0000ab9ff0)={0x2, &(0x7f000039a000)=[{0x20, 0x0, 0x0, 0xfffffffffffff010}, {0x6}]}, 0x10) sendmmsg(r1, &(0x7f0000001e80)=[{{&(0x7f0000000700)=@l2, 0x80, &(0x7f0000001dc0), 0x11}}], 0x1, 0x0) 01:57:11 executing program 1: socketpair$inet_sctp(0x2, 0x3, 0x84, &(0x7f0000000300)={0xffffffffffffffff}) getsockopt$inet_sctp_SCTP_DEFAULT_PRINFO(0xffffffffffffffff, 0x84, 0x72, &(0x7f0000000040)={0x0, 0xffffffffffffffff}, &(0x7f0000000080)=0xc) getsockopt$inet_sctp_SCTP_RECONFIG_SUPPORTED(r0, 0x84, 0x75, &(0x7f00000000c0)={r1, 0x8}, &(0x7f0000000200)=0x8) r2 = socket$alg(0x26, 0x5, 0x0) bind$alg(r2, &(0x7f0000000340)={0x26, 'aead\x00', 0x0, 0x0, 'aegis256-generic\x00'}, 0x58) setsockopt$ALG_SET_KEY(r2, 0x117, 0x1, &(0x7f0000000100)="71e67a111fde54fe46b904832c8fff73d41196c3cdf8311cfc093a52a7d10000", 0x20) setsockopt$inet_sctp_SCTP_SOCKOPT_BINDX_ADD(r0, 0x84, 0x64, &(0x7f0000000280)=[@in={0x2, 0x4e24}, @in={0x2, 0x4e22}], 0x20) recvmsg$kcm(0xffffffffffffffff, &(0x7f0000003780)={&(0x7f0000003180)=@pppol2tp={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @multicast1}}}, 0x80, &(0x7f00000036c0)=[{&(0x7f0000003200)=""/249, 0xf9}, {&(0x7f0000003300)=""/95, 0x5f}], 0x2, &(0x7f0000003740)=""/31, 0x1f}, 0x0) r3 = accept4$alg(r2, 0x0, 0x0, 0x0) perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10000003, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) sendmsg$alg(r3, &(0x7f0000003b80)={0x0, 0x0, &(0x7f0000000240)=[{&(0x7f00000003c0)="e054c4ad1f4f0249c5229a656302a0bcd343edc79a91c7fbf60ff87bdff39efc1515628e108ca8a51572ee9309e811a3d3553f8579a1d294efd49416c5cf607b809813375377395de149050ae1ce1b8aec5459e391a5872e8294a735130f042aa967b6866012532c3f3eecae0e2cfda430434da4fa7d8ea98b7602f66503fb6fc33ab5e36f3f13b6f7a0f353fe3e898ba66cd0fa2cab3a60842251586b1ec5e5fb6d135b5bf92c00596e381ce3418bddfa89d8762f655a223e82d810f33bfc4603e230428492512c473b72848b52ae14974bad0f77b36f0186d696f3094b3b4617462d61292a67d681e2d160c470d29d9724deffb4acc6c1b85bfcdf360c2d02c330758a211a4149bfd7d1060404c09b1b22bd6d6ac29ae02a2c6794467eb7437e778f5b46fbe66beb84988c992ed27fd6996f2281ccc57e7fa8d405ac42aa38a2bbf002eff61564a99818968c5096a6151bab05a752d914c976ffa75cce4b26993fd39d70aee2368632086ab78a35362f04efe244b9e73e3c354c88d08245cae2cf5666f365240d8d12490c42f870bdb35f4a90bc89baba14ee311639c4ca7542a12d5acfce749f499f06425e54a4083bf0c1fd11e5857b62646c05aa7c396cdebae9948e7c5275cd1ac51f0642e4779220a90eb3b1d23a88ee867bbaac4d318a563d44d440c3223e1fc1", 0x1eb}], 0x1, &(0x7f00000000c0)}, 0x0) recvmmsg(r3, &(0x7f0000002480), 0x871, 0x0, &(0x7f00000001c0)={0x77359400}) 01:57:11 executing program 5: perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1f}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000340)={&(0x7f0000000000), 0xc, &(0x7f0000000300)={&(0x7f0000000240)=@newlink={0x50, 0x10, 0x721, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x0, 0xa00}, [@IFLA_LINKINFO={0x28, 0x12, @veth={{0xc, 0x1, 'veth\x00'}, {0x18, 0x2, @VETH_INFO_PEER={0x14}}}}, @IFLA_NET_NS_FD={0x8}]}, 0x50}}, 0x0) [ 717.761703] binder: 17022:17023 BC_FREE_BUFFER u0000000000000000 no match [ 717.768821] binder: 17023 RLIMIT_NICE not set 01:57:12 executing program 6: r0 = syz_open_dev$sndseq(&(0x7f0000000100)='/dev/snd/seq\x00', 0x0, 0x0) read(r0, &(0x7f0000fb6000)=""/28, 0x3f0) ioctl$SNDRV_SEQ_IOCTL_REMOVE_EVENTS(r0, 0x4040534e, &(0x7f00000001c0)={0xbf}) ioctl$SNDRV_SEQ_IOCTL_QUERY_SUBS(r0, 0xc058534f, &(0x7f00000002c0)={{}, 0x1, 0x0, 0x0, {}, 0x0, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xe00]}) r1 = gettid() timer_create(0x0, &(0x7f0000044000)={0x0, 0x12}, &(0x7f0000000040)) r2 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r2, 0x8912, &(0x7f00000001c0)="0a5cc80700315f85715070") timer_settime(0x0, 0x0, &(0x7f0000000080)={{0x0, 0x989680}, {0x0, 0x9}}, &(0x7f0000040000)) tkill(r1, 0x1000000000014) 01:57:12 executing program 3: r0 = socket$inet(0x2, 0x3, 0x2) connect$inet(0xffffffffffffffff, &(0x7f0000000000)={0x2, 0x0, @local}, 0x10) setsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x23, &(0x7f0000000000)={{{@in=@multicast2, @in=@multicast1}}, {{@in6}, 0x0, @in6=@loopback}}, 0xe8) syz_emit_ethernet(0x2a, &(0x7f0000000640)={@random="b100485caa2a", @link_local, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x1c, 0x1c00, 0x0, 0x0, 0x2, 0x0, @rand_addr, @broadcast}, @igmp={0x11, 0xffffffffffffffff, 0x0, @multicast1}}}}}, &(0x7f0000000140)) 01:57:12 executing program 2: r0 = socket$inet(0x2, 0x3, 0x2) connect$inet(0xffffffffffffffff, &(0x7f0000000000)={0x2, 0x0, @local}, 0x10) setsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x23, &(0x7f0000000000)={{{@in=@multicast2, @in=@multicast1}}, {{@in6}, 0x0, @in6=@loopback}}, 0xe8) openat$hwrng(0xffffffffffffff9c, &(0x7f0000000100)='/dev/hwrng\x00', 0x0, 0x0) syz_emit_ethernet(0x2a, &(0x7f0000000640)={@random="b100485caa2a", @link_local, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x1c, 0x0, 0x0, 0x0, 0x2, 0x0, @rand_addr, @broadcast}, @igmp={0x11, 0x0, 0x0, @multicast1}}}}}, &(0x7f0000000140)) 01:57:12 executing program 5: perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1f}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000340)={&(0x7f0000000000), 0xc, &(0x7f0000000300)={&(0x7f0000000240)=@newlink={0x50, 0x10, 0x721, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x0, 0x9}, [@IFLA_LINKINFO={0x28, 0x12, @veth={{0xc, 0x1, 'veth\x00'}, {0x18, 0x2, @VETH_INFO_PEER={0x14}}}}, @IFLA_NET_NS_FD={0x8}]}, 0x50}}, 0x0) 01:57:12 executing program 0: socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000001f80)={0xffffffffffffffff, 0xffffffffffffffff}) setsockopt$SO_ATTACH_FILTER(r2, 0x1, 0x1a, &(0x7f0000ab9ff0)={0x2, &(0x7f000039a000)=[{0x20, 0x0, 0x0, 0xfffffffffffff010}, {0x6}]}, 0x10) sendmmsg(r1, &(0x7f0000001e80)=[{{&(0x7f0000000700)=@l2, 0x80, &(0x7f0000001dc0), 0x3ec0}}], 0x1, 0x0) 01:57:12 executing program 4: ioctl$sock_bt_bnep_BNEPGETCONNINFO(0xffffffffffffffff, 0x800442d3, &(0x7f0000000100)={0x0, 0x0, 0x0, @link_local, 'eql\x00'}) r0 = socket$inet_udp(0x2, 0x2, 0x0) getsockopt$IP_VS_SO_GET_SERVICE(r0, 0x0, 0x483, &(0x7f0000000100), &(0x7f0000000080)=0x68) setsockopt$sock_int(r0, 0x1, 0x2e, &(0x7f0000000000)=0x2, 0x4) 01:57:12 executing program 1: r0 = syz_open_dev$sndpcmc(&(0x7f0000001fee)='/dev/snd/pcmC#D#c\x00', 0x0, 0x0) ioctl$KDSETKEYCODE(r0, 0x4b4d, &(0x7f0000000080)={0x800, 0x11}) preadv(0xffffffffffffffff, &(0x7f0000000000)=[{&(0x7f0000009f7c)=""/132, 0x84}, {&(0x7f0000012000)=""/252, 0xfc}, {&(0x7f0000012000)=""/155, 0x400000}, {&(0x7f0000009000)=""/11, 0xb}, {&(0x7f0000000000)=""/102, 0x66}], 0x5, 0x0) ioctl(r0, 0xc2604110, &(0x7f0000000000)) ioctl$sock_inet_SIOCGARP(r0, 0x8954, &(0x7f0000000100)={{0x2, 0x4e21, @multicast1}, {0x6, @random="c5c9d4e5e82a"}, 0x8, {0x2, 0x4e21, @multicast1}, 'rose0\x00'}) ioctl$VT_SETMODE(r0, 0x5602, &(0x7f00000000c0)={0x7, 0x6, 0x3, 0x3}) 01:57:12 executing program 7: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000180)='/dev/sequencer\x00', 0x10002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000080)="0a5cc80700315f85715070") r1 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000001c0)={0x2, 0x0, &(0x7f0000000140)=ANY=[@ANYBLOB='\fc'], 0x0, 0x0, &(0x7f0000000080)}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, &(0x7f00000001c0)}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000040)={0x8, 0x0, &(0x7f00000000c0)=[@release={0x400c6312}], 0x1, 0x0, &(0x7f0000000100)='V'}) fstat(r0, &(0x7f00000002c0)) [ 718.375337] binder: 17022:17067 Acquire 1 refcount change on invalid ref 0 ret -22 [ 718.383265] binder: 17022:17067 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 718.390634] binder: 17022:17067 BC_FREE_BUFFER u0000000000000000 no match [ 718.397659] binder: 17067 RLIMIT_NICE not set 01:57:12 executing program 4: r0 = socket$inet6(0xa, 0x3, 0x4000000004) ioctl(r0, 0x8912, &(0x7f0000000000)="025cc83d6d345f8f762070") r1 = memfd_create(&(0x7f0000000080)='&mime_type\x00', 0x1) setsockopt$RDS_GET_MR_FOR_DEST(r1, 0x114, 0x7, &(0x7f0000000300)={@nl=@proc={0x10, 0x0, 0x25dfdbff, 0x20000}, {&(0x7f00000000c0)=""/222, 0xde}, &(0x7f00000001c0), 0x14}, 0xa0) r2 = socket$packet(0x11, 0x3, 0x300) ioctl$KDSETMODE(r1, 0x4b3a, 0x1) setsockopt$packet_int(r2, 0x107, 0xf, &(0x7f0000000040)=0x100, 0xff1f) sendto$inet6(r2, &(0x7f0000000280)="020300000700000000000000fff55b4202938207d9fb3780398d5375000000007929301ee616d5c01843e06590080053c0e385472da7222a2bb42f2dbd94c3b50035110f118d0000f55dc62600009b000000faffffff00000000aeb46245004bae1356642490a7b5fc88046a", 0x6c, 0x0, &(0x7f0000000000)={0xa, 0x200800800, 0x20000000005, @mcast2}, 0x1c) 01:57:12 executing program 3: r0 = socket$inet(0x2, 0x3, 0x2) connect$inet(0xffffffffffffffff, &(0x7f0000000000)={0x2, 0x0, @local}, 0x10) setsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x23, &(0x7f0000000000)={{{@in=@multicast2, @in=@multicast1}}, {{@in6}, 0x0, @in6=@loopback}}, 0xe8) syz_emit_ethernet(0x2a, &(0x7f0000000640)={@random="b100485caa2a", @link_local, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x1c, 0x700000000000000, 0x0, 0x0, 0x2, 0x0, @rand_addr, @broadcast}, @igmp={0x11, 0xffffffffffffffff, 0x0, @multicast1}}}}}, &(0x7f0000000140)) 01:57:12 executing program 5: perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1f}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000340)={&(0x7f0000000000), 0xc, &(0x7f0000000300)={&(0x7f0000000240)=@newlink={0x50, 0x10, 0x721, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x0, 0xf0ffff}, [@IFLA_LINKINFO={0x28, 0x12, @veth={{0xc, 0x1, 'veth\x00'}, {0x18, 0x2, @VETH_INFO_PEER={0x14}}}}, @IFLA_NET_NS_FD={0x8}]}, 0x50}}, 0x0) 01:57:12 executing program 1: perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1f}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = memfd_create(&(0x7f0000000000)='ppp1&\x00', 0x6) fallocate(r0, 0x3, 0x0, 0x1000000000) 01:57:12 executing program 2: r0 = socket$inet(0x2, 0x3, 0x2) r1 = syz_open_dev$adsp(&(0x7f0000000100)='/dev/adsp#\x00', 0xf57, 0x300) setsockopt$SO_VM_SOCKETS_CONNECT_TIMEOUT(r1, 0x28, 0x6, &(0x7f0000000180), 0x10) connect$inet(0xffffffffffffffff, &(0x7f0000000000)={0x2, 0x0, @local}, 0x10) setsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x23, &(0x7f0000000000)={{{@in=@multicast2, @in=@multicast1}}, {{@in6}, 0x0, @in6=@loopback}}, 0xe8) syz_emit_ethernet(0x2a, &(0x7f0000000640)={@random="b100485caa2a", @link_local, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x1c, 0x0, 0x0, 0x0, 0x2, 0x0, @rand_addr, @broadcast}, @igmp={0x11, 0x0, 0x0, @multicast1}}}}}, &(0x7f0000000140)) [ 718.533739] binder: 17097:17099 Acquire 1 refcount change on invalid ref 0 ret -22 [ 718.659330] binder: 17097:17099 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 718.677617] ------------[ cut here ]------------ [ 718.682815] refcount_t: increment on 0; use-after-free. [ 718.688506] WARNING: CPU: 0 PID: 17119 at lib/refcount.c:153 refcount_inc_checked+0x5d/0x70 [ 718.697023] Kernel panic - not syncing: panic_on_warn set ... [ 718.697023] [ 718.704413] CPU: 0 PID: 17119 Comm: syz-executor2 Not tainted 4.18.0+ #194 [ 718.711437] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 718.720806] Call Trace: [ 718.723423] dump_stack+0x1c9/0x2b4 [ 718.726613] binder: 17097:17122 unknown command 1074553618 [ 718.727106] ? dump_stack_print_info.cold.2+0x52/0x52 [ 718.738000] panic+0x238/0x4e7 [ 718.741224] ? add_taint.cold.5+0x16/0x16 [ 718.745470] ? __warn.cold.8+0x148/0x1ba [ 718.749558] ? refcount_inc_checked+0x5d/0x70 [ 718.754082] __warn.cold.8+0x163/0x1ba [ 718.757992] ? refcount_inc_checked+0x5d/0x70 [ 718.762517] report_bug+0x252/0x2d0 [ 718.766173] do_error_trap+0x1fc/0x4d0 [ 718.770081] ? math_error+0x3e0/0x3e0 [ 718.773898] ? vprintk_default+0x28/0x30 [ 718.777998] ? vprintk_func+0x81/0x117 [ 718.781901] ? printk+0xa7/0xcf [ 718.785226] ? trace_hardirqs_off_thunk+0x1a/0x1c [ 718.790118] do_invalid_op+0x1b/0x20 [ 718.793851] invalid_op+0x14/0x20 [ 718.797318] RIP: 0010:refcount_inc_checked+0x5d/0x70 [ 718.802430] Code: 1d 7d f5 24 05 31 ff 89 de e8 7f be 1b fe 84 db 75 df e8 a6 bd 1b fe 48 c7 c7 00 72 3a 87 c6 05 5d f5 24 05 01 e8 43 4e e6 fd <0f> 0b eb c3 0f 1f 44 00 00 66 2e 0f 1f 84 00 00 00 00 00 55 48 89 [ 718.807451] binder: 17097:17122 ioctl c0306201 20000040 returned -22 [ 718.821350] RSP: 0018:ffff88019521ebd8 EFLAGS: 00010286 [ 718.821365] RAX: 0000000000000000 RBX: 0000000000000000 RCX: ffffc9000200d000 [ 718.821373] RDX: 0000000000003667 RSI: ffffffff8163ac21 RDI: ffff88019521e8c8 [ 718.821380] RBP: ffff88019521ebe0 R08: ffff880199d10080 R09: 0000000000000002 01:57:12 executing program 0: socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000001f80)={0xffffffffffffffff, 0xffffffffffffffff}) setsockopt$SO_ATTACH_FILTER(r2, 0x1, 0x1a, &(0x7f0000ab9ff0)={0x2, &(0x7f000039a000)=[{0x20, 0x0, 0x0, 0xfffffffffffff010}, {0x6}]}, 0x10) sendmmsg(r1, &(0x7f0000001e80)=[{{&(0x7f0000000700)=@l2, 0x80, &(0x7f0000001dc0), 0x11000000}}], 0x1, 0x0) 01:57:12 executing program 4: r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000001000)={0x0, 0x0, &(0x7f0000182000)={&(0x7f0000000200)={0x2, 0x4000000000000d, 0x0, 0x0, 0x14, 0x0, 0x0, 0x0, [@sadb_x_policy={0x8, 0x12, 0x0, 0x3, 0x0, 0x0, 0x0, {0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @in=@multicast1}}, @sadb_address={0x3, 0x6, 0x0, 0x0, 0x0, @in={0x2, 0x0, @remote={0xac, 0x14, 0xffffffffffffffff}}}, @sadb_address={0x3, 0x5, 0x0, 0x0, 0x0, @in={0x2, 0x0, @remote={0xac, 0x14, 0xffffffffffffffff}}}, @sadb_lifetime={0x4, 0x3, 0x9}]}, 0xa0}}, 0x0) ftruncate(r0, 0x400) 01:57:12 executing program 3: r0 = socket$inet(0x2, 0x3, 0x2) connect$inet(0xffffffffffffffff, &(0x7f0000000000)={0x2, 0x0, @local}, 0x10) setsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x23, &(0x7f0000000000)={{{@in=@multicast2, @in=@multicast1}}, {{@in6}, 0x0, @in6=@loopback}}, 0xe8) syz_emit_ethernet(0x2a, &(0x7f0000000640)={@random="b100485caa2a", @link_local, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x1c, 0x300000000000000, 0x0, 0x0, 0x2, 0x0, @rand_addr, @broadcast}, @igmp={0x11, 0xffffffffffffffff, 0x0, @multicast1}}}}}, &(0x7f0000000140)) [ 718.821388] R10: ffff880199d10080 R11: 0000000000000000 R12: 0000000000000000 [ 718.821395] R13: 0000000000000008 R14: ffff8801d7aaa2c0 R15: dffffc0000000000 [ 718.821425] ? vprintk_func+0x81/0x117 [ 718.821445] ? refcount_inc_checked+0x5d/0x70 [ 718.821459] igmp_start_timer+0xaf/0xe0 [ 718.821474] igmp_rcv+0x1920/0x3060 [ 718.821501] ? ip_mc_leave_group+0x4b0/0x4b0 [ 718.821515] ? raw_rcv_skb+0x43/0x70 [ 718.821532] ? kasan_check_write+0x14/0x20 [ 718.821546] ? do_raw_read_unlock+0x3f/0x60 [ 718.821559] ? _raw_read_unlock+0x22/0x30 [ 718.821573] ? raw_local_deliver+0x2ca/0xc3a [ 718.821589] ? graph_lock+0x170/0x170 [ 718.821604] ? raw_rcv+0x550/0x550 [ 718.821623] ? __lock_is_held+0xb5/0x140 [ 718.821647] ip_local_deliver_finish+0x2eb/0xda0 [ 718.927675] ? ip_sublist_rcv_finish+0x3e0/0x3e0 [ 718.932467] ? __sanitizer_cov_trace_cmp4+0x16/0x20 [ 718.937506] ? nf_hook_slow+0x11e/0x1c0 [ 718.941509] ip_local_deliver+0x1e9/0x750 [ 718.945680] ? ip_call_ra_chain+0x730/0x730 [ 718.950028] ? ip_sublist_rcv_finish+0x3e0/0x3e0 [ 718.954804] ? rcu_is_watching+0x8c/0x150 [ 718.958981] ? rcu_cleanup_dead_rnp+0x200/0x200 [ 718.963671] ip_rcv_finish+0x1f9/0x300 [ 718.967605] ip_rcv+0xed/0x610 [ 718.971530] ? ip_local_deliver+0x750/0x750 [ 718.975873] ? ip_rcv_finish_core.isra.16+0x1f10/0x1f10 [ 718.981278] ? ktime_get_with_offset+0x3a9/0x4b0 [ 718.986057] ? lock_acquire+0x1e4/0x540 [ 718.990048] ? netif_receive_skb_internal+0xaa/0x680 [ 718.995174] __netif_receive_skb_one_core+0x14d/0x200 [ 719.000388] ? __netif_receive_skb_core+0x3af0/0x3af0 [ 719.005597] ? rcu_cleanup_dead_rnp+0x200/0x200 [ 719.010274] __netif_receive_skb+0x2c/0x1e0 [ 719.014607] netif_receive_skb_internal+0x12e/0x680 [ 719.019664] ? dev_cpu_dead+0xaa0/0xaa0 [ 719.023651] ? kasan_check_read+0x11/0x20 [ 719.027810] ? rcu_is_watching+0x8c/0x150 [ 719.031975] ? rcu_pm_notify+0xc0/0xc0 [ 719.035883] netif_receive_skb+0xbf/0x420 [ 719.040046] ? netif_receive_skb_internal+0x680/0x680 [ 719.045254] ? find_held_lock+0x36/0x1c0 [ 719.049342] ? tun_rx_batched.isra.56+0x494/0x8c0 [ 719.054209] tun_rx_batched.isra.56+0x4ba/0x8c0 [ 719.058899] ? tun_sock_write_space+0x3a0/0x3a0 [ 719.063604] ? __local_bh_enable_ip+0x161/0x230 [ 719.068311] ? trace_hardirqs_on_caller+0x421/0x5c0 [ 719.073347] ? tun_get_user+0x2fce/0x42c0 [ 719.077514] tun_get_user+0x2ac9/0x42c0 [ 719.081509] ? perf_trace_lock+0xde/0x920 [ 719.085678] ? tun_build_skb.isra.55+0x2280/0x2280 [ 719.090621] ? perf_trace_lock+0xde/0x920 [ 719.094780] ? futex_wait_setup+0x410/0x410 [ 719.099123] ? graph_lock+0x170/0x170 [ 719.102964] ? zap_class+0x740/0x740 [ 719.106716] ? find_held_lock+0x36/0x1c0 [ 719.110804] ? lock_downgrade+0x8f0/0x8f0 [ 719.114998] ? rcu_cleanup_dead_rnp+0x200/0x200 [ 719.119696] ? tun_get+0x231/0x370 [ 719.123250] ? tun_chr_close+0x180/0x180 [ 719.127354] tun_chr_write_iter+0xb9/0x154 [ 719.131608] do_iter_readv_writev+0x8b0/0xa80 [ 719.136129] ? vfs_dedupe_file_range+0xa00/0xa00 [ 719.140908] ? rw_verify_area+0x118/0x360 [ 719.145092] do_iter_write+0x185/0x5f0 [ 719.148992] ? dup_iter+0x270/0x270 [ 719.152638] vfs_writev+0x1f1/0x360 [ 719.156268] ? __fget_light+0x2f7/0x440 [ 719.160250] ? vfs_iter_write+0xb0/0xb0 [ 719.164232] ? trace_hardirqs_off+0xd/0x10 [ 719.168473] ? _raw_spin_unlock_irqrestore+0x63/0xc0 [ 719.173593] ? sockfd_lookup_light+0xc5/0x160 [ 719.178108] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 719.183651] ? __fdget_pos+0xde/0x200 [ 719.187462] ? __fdget_raw+0x20/0x20 [ 719.191183] ? kmem_cache_free+0x25c/0x2d0 [ 719.195427] do_writev+0x11a/0x310 [ 719.198981] ? vfs_writev+0x360/0x360 [ 719.202785] ? __sanitizer_cov_trace_const_cmp1+0x1a/0x20 [ 719.208344] __x64_sys_writev+0x75/0xb0 [ 719.212330] do_syscall_64+0x1b9/0x820 [ 719.216223] ? finish_task_switch+0x1d3/0x870 [ 719.220723] ? syscall_return_slowpath+0x5e0/0x5e0 [ 719.225663] ? syscall_return_slowpath+0x31d/0x5e0 [ 719.230598] ? __switch_to_asm+0x34/0x70 [ 719.234663] ? entry_SYSCALL_64_after_hwframe+0x59/0xbe [ 719.240052] ? trace_hardirqs_off_thunk+0x1a/0x1c [ 719.244906] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 719.250115] RIP: 0033:0x456f41 [ 719.253313] Code: 75 14 b8 14 00 00 00 0f 05 48 3d 01 f0 ff ff 0f 83 34 b6 fb ff c3 48 83 ec 08 e8 da 2c 00 00 48 89 04 24 b8 14 00 00 00 0f 05 <48> 8b 3c 24 48 89 c2 e8 23 2d 00 00 48 89 d0 48 83 c4 08 48 3d 01 [ 719.272245] RSP: 002b:00007f1641b03ba0 EFLAGS: 00000293 ORIG_RAX: 0000000000000014 [ 719.279974] RAX: ffffffffffffffda RBX: 000000000000002a RCX: 0000000000456f41 [ 719.287251] RDX: 0000000000000001 RSI: 00007f1641b03bf0 RDI: 00000000000000f0 [ 719.294523] RBP: 0000000020000640 R08: 00000000000000f0 R09: 0000000000000000 [ 719.301794] R10: 0000000000000000 R11: 0000000000000293 R12: 00000000ffffffff [ 719.309105] R13: 00000000004d6410 R14: 00000000004c9a96 R15: 0000000000000000 [ 719.317040] Dumping ftrace buffer: [ 719.320846] (ftrace buffer empty) [ 719.324545] Kernel Offset: disabled [ 719.328181] Rebooting in 86400 seconds..